Built in steps.
Recorded along the way.

Still and video documents now support editable Position, Opacity, Transform and Style keyframes. Expand a layer in the Timeline, enable a property with its stopwatch, move the playhead and edit the property normally. Enabled tracks capture the change automatically. Key controls provide previous/next navigation, add/delete, editable times and Linear or Hold interpolation. Position and Transform are alternative geometry tracks. Native53 saves the keys; Undo and the optional API use the same commands. Geometry animation retains source raster/video pixels instead of repeatedly resizing them. Image-sequence export renders the evaluated animation.

The first focused run exposed two integration issues. Our test incorrectly assumed playback would leave the API revision unchanged; view-state revisions deliberately change even though playback adds no history. An existing sequence-export test also exposed a revoked transfer continuing to render until cancellation surfaced late. The API now owns and cancels its export worker when permission or sharing is revoked, while desktop exports remain independent. Both failures and the passing repair are preserved. Timeline duration now survives rate/loop edits, and unsupported adjustment-layer tracks stay disabled.

All 65 focused tests and 2,450 full optimized tests pass. Five independently decoded PNG frames match 1,920 analytic RGBA8 channel values exactly. These are owned animation fixtures, not a Photoshop byte-equivalence claim. Advanced keyframe contexts, full visual Timeline interactions, clip groups/splitting, transitions, audio, Render Video, editable PSD/Actions and universal/live qualification remain open. The installed221 app and private universal232 package are unchanged. Detailed record, keyframe evidence.

File > Open now reads supported MOV/MP4 movies through AVFoundation, and Layer > Video Layers > New Video Layer from File adds an editable clip to an existing document. The importer retains exact rational presentation times, including variable frame durations, and keeps the original container and audio bytes. Native archive52 saves those sources alongside edited frame pixels. Placement converts all frames to the target profile/depth, starts at its playhead and supports Undo. The optional API shares movie upload, placement and cancellation; the Timeline explicitly indicates retained audio whose playback is not yet implemented.

Independent fixtures caught real problems. The first legacy QuickTime Animation fixture could not be decoded by this host; preserved probes established working uncompressed ARGB and ProRes decoding. A corrected rotation fixture then exposed opposite coordinate conventions in AVFoundation and Core Image. We fixed the transform instead of relaxing the pixel check. We also repaired a missed archive52 header guard and updated the unknown-version test. A normal128×96 H.264/AAC fixture now verifies movie decoding and presentation order; a tiny H.264 host rejection is preserved separately.

All 62 focused tests and 2,435 full optimized tests pass. Independent FFmpeg/Pillow comparison matches all 6,144 RGBA8 channel values across eight normal and rotated lossless frames. This establishes those owned fixture results, not Photoshop byte equality. The implementation still has explicit source/frame/memory limits and SDR conversion. Long disk-backed footage, HDR, audio playback/editing, keyframes, transitions, Render Video, editable PSD/Actions and full platform/live qualification remain required. The installed221 app and privately uploaded universal232 package are unchanged. Detailed record, movie evidence.

Both Timeline modes can now export numbered PNG frames with a chosen range, prefix, starting number and padding. A companion manifest retains source frame numbers, timing, dimensions, color conversion and loop information. The native interface creates a new folder only after every file succeeds. Existing folders stay unchanged, and cancellation removes staging. The optional API runs the same renderer and returns a bounded ZIP with matching cancellation and permission/revision checks. Export preserves the editable source and its history.

The first54-test run had one assertion failure: Foundation decoded the JSON decimal0.07 with a tiny floating-point difference. Independent inspection confirmed the serialized timing was correct. We repaired the numerical assertion while retaining exact image/archive checks, and added permission revocation during export. All55 focused tests and2,428 full optimized tests now pass. Python's independent ZIP reader and Pillow verify both archives, all seven PNG frames/336 pixel-channel samples, checksums, filenames, order and timing. The failed attempt remains in the record.

The universal Apple Silicon/Intel macOS14+ development package is verified and uploaded to the private GitHub repository. Build metadata and source hashes accompany it; source was not pushed and the installed221 app was not replaced. PNG retains the current integer-profile pipeline, while32-bit HDR exports explicitly convert to SDR sRGB16. Native movie codecs, audio/keyframes, further export controls, full Render Video and Photoshop/live/platform parity remain open. Detailed record, export evidence, private build.

PNG sequences now import into one editable video layer. Reviewing Adobe's public workflow changed the implementation plan: separate still layers would not provide the video behavior we need. The native Timeline now offers seeking, playback, clip start and trim, independent source and Timeline frame rates, and painting on the current source frame. Undo restores edits, Rasterize Layer creates a still from the selected frame, and native archive51 preserves every source frame and its timing. The optional API provides the same construction, timing, view and cancellation paths while retaining the original source documents.

The first two builds found Swift range-type and actor-isolation errors. The first runtime run passed62 of63 checks; its remaining assertion compared two different internal raster representations rather than their pixels. We changed that assertion to compare every visible pixel and dimensions, while keeping exact Undo restoration of the original document. All63 focused tests and2420 full optimized tests now pass. Three independently encoded PNG fixtures and Pillow inspection verify144 output samples, including numeric file order, non-square coordinates and partial transparency. Every failed attempt remains in the record.

This is the video foundation, with bounded PNG sequences in memory. Sequence export, movie-file decoding, audio, keyframes, transitions, full Render Video, editable PSD/Actions and exact Photoshop behavior remain required. No new live comparison or universal package is claimed. The installed221 app and private uploaded224 package remain unchanged. Detailed record, video evidence.

Opening an animated GIF now preserves its complete sequence as editable Timeline frames. Partial frame rectangles, transparent pixels, restore-previous/restore-background disposal, delays and loop settings survive import. The Timeline can export a rendered animated GIF, with the same implementation available through the optional API. Export preserves the editable document and history, supports cancellation and commits a file only after successful encoding.

An original four-frame fixture exposed a real platform edge case: ImageIO silently dropped the maximum finite loop count when writing. The first48-test run had one failure. We repaired the public loop metadata while keeping Apple's native pixel encoder. All48 focused tests and2410 full optimized tests now pass. An independent Pillow decoder checks the owned input and four exports against960 expected RGBA samples, timing and loop counts. The fixture generator and both failed and passing results are retained.

GIF's palette, binary transparency and centisecond timing impose visible output constraints; Photoshop's full Save for Web controls and exact output remain open. Image-sequence interchange comes next, followed by video, keyframes and audio. No live Photoshop comparison or new universal package is claimed. Installed221 and private uploaded224 remain unchanged. Detailed record, animation evidence.

Photato now has a native Timeline strip below the canvas. Create an animation, duplicate or reorder frames, change their delays and looping, and preview playback. Each frame stores layer visibility, position, opacity and style while sharing the editable pixels and text. Changes through the normal layer controls update the selected frame. Position/opacity tweening can insert intermediate frames between two compositions.

Frame edits use the existing Undo path. Selection and playback do not create content history entries, and playback leaves the committed document untouched. Native50 files and scratch history preserve every frame. Two new optional API commands share these operations and expose Timeline state. Preview ticks leave the API revision stable so clients can stop playback reliably; edits during playback ask the client to stop it first. Unsupported saves report the animation that would be lost.

All47 focused integration checks pass. The record retains a compiler insertion mistake, an incorrect test expectation about the view restored by Redo, and a legacy test that rejected newly supported archive50. Repairs keep their failed attempts alongside passing evidence. The first full run exposed three more legacy archive-version assertions. A separate regression then caught a real visibility-draft preview failure: temporary layer properties were being validated against the saved frame cache. Rendering a temporary still composition fixes it without changing saved frames; another guard prevents prepared replacements from silently dropping animation. All2,402 full optimized tests now pass on2,262 unchanged inputs, including15 new animation tests. Native menu/layout checks pass; no new live Photoshop or visual acceptance is claimed.

This is the first stage of Timeline support. Animated GIF/image-sequence interchange comes next, followed by video layers, timing, audio and keyframes. Multi-frame controls, effect tween, onion skins, all-frame geometry, semantic Actions, editable Photoshop animation files and exact/live/platform parity remain open. Installed221 and private uploaded224 are unchanged. Detailed record, animation evidence.

The developer diary now bundles its HTML, CSS, JavaScript, logos, source provenance and downloadable narrative and license notice into one file. Copy nusite/diary.html anywhere and open it directly in a browser. Its entries, search, sorting and internal navigation need no server. The existing Forensic Intelligence design is retained, and the product page includes a download link for the standalone file.

The first dependency check caught a footer link that still depended on the product page. That link now returns to the diary overview, and validation passes. All 25 offline Chromium checks pass, including search, sorting, deep links, exact downloads, mobile navigation and widths from 320 to 1,440 pixels. All 228 entries are readable without JavaScript. Desktop and mobile screenshots retain the existing site appearance. External company and GitHub links still lead to their websites; the repository remains private until release. Each saved file is a dated snapshot, refreshed by the existing diary generator after source records change. The separate live dashboard is unchanged. This website update adds no native editing features or API operations; Timeline remains the next major application workflow. Detailed record.

Photato now follows separate RGB, CMYK and Gray policies when opening external documents and pasting between profiles. Optional missing-profile and mismatch review lets the user preserve a profile, convert colors, discard a tag or assign an interpretation before an image opens. Paste can preserve appearance or compatible component numbers. Cancel leaves the artwork untouched, and a changed clipboard or document prevents a stale decision from committing. Native and API paths share the same preparation and history transaction.

The API returns review choices without opening a desktop dialog. Older five-field Color Settings clients retain the newly added policy fields; version 2 persistence reads earlier settings with defaults. Working CMYK proofing now captures the selected working profile instead of always resolving to Generic CMYK. Stored proof presets keep that captured profile.

All 76 focused checks pass. A stronger test then caught a real presentation defect: the Color Settings window was 430 points high while its controls needed 641. Sizing the real window to its content fixes it, and 13 policy checks pass after the repair. Both failure and repair remain recorded. The offscreen captures omit native controls, so they do not establish visual acceptance. The first full run found one older PSB test comparing raw decoding with policy-aware opening. Native and API opens now produce identical bytes with no added profile tag. The first replacement assertion wrongly assumed all fixture layers were raster; it now compares all layer content, including groups, and checks that the source file remains untouched. All 2,387 full optimized tests also pass on 2,257 unchanged source inputs.

Custom ICC assignment during binary API import still requires a separate profile command or configured working profile. Drag/drop, additional rich/mode contexts, presets and exact/live/platform color qualification remain open. Installed build221 and private uploaded build224 are unchanged. The next major workflow is Timeline and animation, including editable frames, playback, export and video capabilities; smaller color fidelity refinements remain tracked. Detailed record, policy evidence.

Color Settings now stores working RGB, CMYK and Gray profiles between launches. The native dialog uses the Photoshop menu position and Shift-Command-K shortcut, with installed-profile choices, ICC file loading, conversion intent and black point compensation. Cancel leaves settings unchanged; stale dialogs and API requests cannot overwrite newer settings. Files use bounded atomic writes, preserving prior bytes on a failed save.

New Document, color-mode changes and profile operations capture those settings when they begin. Changing only precision retains the document’s own profile. Native and shared-document API operations use the same defaults, with explicit overrides. Stateless Adobe and Photato resource jobs retain their own contract defaults. All28 initial focused and2,374 full optimized tests pass, including10 new settings tests and the mode/depth-picker regression. Source03 retains2,253 unchanged inputs; full workflow and live/platform qualification remain open.

Missing/mismatched-profile import and paste policies, working proof integration, Spot settings, CSF presets and advanced conversion options remain open. No claim is made of Adobe ACE output equivalence or live acceptance. Installed221 and uploaded224 remain unchanged. Detailed record, settings evidence.

Assign Profile now changes color interpretation without changing numerical samples. Convert to Profile transforms colors through Apple ColorSync, with rendering intent, black point compensation, optional flattening and a live draft preview. Both operations share Undo and the optional API. Supported RGB text, solid fill and shape layers remain editable; complex conversions ask for explicit flattening. Negative and HDR float colors, alpha and transparent pixel colors are tested.

Untagged documents retain their interpretation internally and omit profile tags when exported. Native49 preserves that choice; independent readers verify PSD, TIFF, PNG and JPEG outputs. Adobe-compatible output settings now accept the published iccProfile field, using the same native engine and isolated per-output resources. All60 integration tests,33 repair-focused optimized tests and2,364 full optimized tests pass. The record retains a test-representation mistake, a compiler repair and an independent inspector byte-order mistake alongside the passing results.

Color Settings, mismatch policies, full rich-layer handling, semantic Actions, exact Photoshop output and live/platform qualification remain open. The installed221 app and qualified/uploaded224 package are unchanged. Detailed record, profile evidence.

Photato now has native Print and Print One Copy commands with physical page layout, printer settings, profile-managed output, hard proofs and individual ink plates. The PDF route and printer use the same native renderer; the API adds five commands and a separate opt-in for physical printing. Output settings stay outside image pixels and undo history.

Tests caught an AppKit dirty-state effect from assigning NSDocument.printInfo, an invalid test controller startup order and a printerless-preview regression; each failed attempt and repair is retained. All 65 focused tests now pass. The real AppKit print path also wrote four distinct separation pages to an owned PDF without contacting a printer. An independent PDF reader confirms16-bit CMYK/gray image data and embedded profiles. All2,351 full optimized tests also pass on the same unchanged source. Universal macOS14+ build224 is verified and uploaded as a private draft; all four downloaded assets match their SHA256 hashes.

The830×640 offscreen layout check passes, but the captured controls are incomplete; it is not a live UI pass. Physical printers, exact Photoshop color/marks, print Actions, some driver controls and the broader HDR/color workflow remain open. Installed221 is unchanged. Private development build224. Detailed record, printing evidence.

1. Resume the next major workflow: Prior turn made concrete progress: Multichannel PSD/PSB,52 focused/2316 optimized tests, independent files and diary/audit updates. Verify all2,229 source30 inputs unchanged and no live native worker. Follow the maintainer’s major-feature breadth priority into COL03, retaining unclosed COL02 gaps. Preserve source/tests/records under before01. Audit the existing renderer, preview routes, profile conversion, factory menus and public Adobe proofing instructions/Apple ColorSync SDK headers. Proof menus currently have no working bindings. Start native profile-based soft proofs, gamut indication, preview-only settings, menu/shortcut/UI and API integration; printing and HDR/EDR remain part of the same open major workflow. Existing manual desktop-unlock request remains pending; do not repeat GUI polling. Some guessed helper paths were absent; use actual file inventory/symbols for subsequent reads.

2. ColorSync research and resumed work: The intervening percentage question was answered from current ledgers without product changes (no implementation progress); resume the available COL03 work after confirming no compiler/test worker. Preserve failed Swift probes01/02 (unmanaged CF constants/creation results), successful03 and staged conversion04. Use public ColorSync headers and the licensed Rust cms proof/gamut algorithms; Adobe documents profile, preserve-numbers, rendering-intent and paper/black controls. The first Adobe page open returned404 despite its search index, and Apple Markdown fetch was unsupported; local public SDK headers supply API details. No proprietary executable is inspected. Proofing must not alter stored samples, Undo or file output, and no Adobe-only display endpoint will be invented.

3. Native proof implementation and first build: Add Imaging/SoftProof.swift, app ProofWorkspace.swift and AutomationProof.swift; integrate preview capture, factory CmdY/ShiftCmdY and working plate/sRGB/monitor presets, native Custom sheet/ICC picker/JSON presets, per-document view settings, strict API configuration/read/state and a separate proof-preview.png route. Regular exports and preview.png remain pixel-document paths. Add seven independent/behavioral imaging tests, including CGColor comparisons and native CMYK/Lab/Gray retention. Probe04 proves ColorSync Lab uses a/256+0.5 (document uses(a+128)/255); fix the boundary explicitly. core05 compile fails on imported ColorSync C constant globals under Swift6 concurrency checking. Preserve before06 and apply @preconcurrency only to the C SDK import; each transform remains locally owned. Full working-space preferences, PSF/color-blind presets, print and exact Adobe results remain open.

4. First integration build repair: core06 passes the C SDK compilation, then stops on a missing try in the new test fixture constructor. Preserve before07 and correct the test. The accessible Adobe proofing page clarifies that Internet/Monitor presets simulate unmanaged RGB numbers and are unavailable in CMYK/Lab; align those menu presets accordingly. Add end-to-end desktop/API proof isolation, stale/busy/invalid settings and factory shortcut tests before the next run.

5. API test compile correction: integration07 compiles production modules but fails in the new test on a guessed unshare method. Replace it with the actual revoke(shareID), and verify the formerly valid share route becomes404. Remove an unused test wrapper. Preserve the failed attempt/test before08; no production behavior changes for this repair.

6. First executed results: integration08 runs11 tests. All four app/API tests pass, as do six imaging tests. The native CMYK/Lab/Gray comparison reports eight component differences; retain the failure and add mode/sample diagnostics before changing either calculation or acceptance. Existing preserved-number plate assertions already pass. No tolerance is relaxed. Exact Photoshop output remains unclaimed.

7. Independent Lab diagnosis and production repair: native09 localizes all eight differences to Lab; CMYK/gray pass. Owned standalone lab-probe10 compares built-in Generic Lab with a CGColorSpace loaded from its identical ICC bytes. Physical neutral a=b=0 becomes reported ICC a=b=-0.5: the ICC API range maps255 units onto ColorSync's256-unit chroma scale. The existing NativeModeRaster conversions had normalized that reported range directly, producing wrong physical Lab planes while a same-path round trip concealed the error. Correct the four ICC input/output boundaries to retain the documented (a+128)/255 document encoding. Change the existing core oracle to built-in physical Generic Lab for the default Lab profile; retain independent CMYK/RGB/gray references. Add a literal128/255 neutral test; do not relax tolerances or modify stored file samples. Earlier native Lab documents retain their numeric values; their former display interpretation is corrected, with exact Photoshop validation still open. Preserve all changed inputs under before11. Also handle proof-only render errors without freezing the underlying canvas, expose the diagnostic in API/status/sheet, and add preset sandbox scopes.

8. Color repair passes: integration11 completes38 focused tests, zero failures, including native components, PSD/TIFF, proofing and HTTP workflows. Add two acceptance regressions before final qualification: a later opacity edit makes Preserve Numbers invalid without leaving stale canvas pixels, and an offscreen native proof sheet must fit470×550. This capture is not live UI/Photoshop acceptance. Preserve root fixed-name artifacts before menu/full runs, freeze source12, and run the broader focused integration set followed by optimized qualification only after it passes.

9. Focused integration result and capture limitation: integration12 passes75 tests with zero failures, including file modes, desktop/API, factory menu/shortcut and edit-invalidated proof fallback. Inspect the offscreen proof-controls PNG: the frame fits, but control contents are not fully rendered in that capture. Retain it as incomplete visual evidence, never a live/visual acceptance pass; manual-unlock handoff remains pending. Correct proof status naming to derive built-in device names from the actual selected device even if an API client leaves profileName unchanged. Freeze source13 and start the full optimized suite after preserving the focused menu report.

10. Documentation and breadth reconciliation: Add PROOFING_REFERENCES and WORKING_CHECKPOINT_223 with explicit running/full-test and visual limitations; update API guide, status, diary/plan, component/menu references and COL03 scheduling. Mark eleven proof commands partial, giving366 partial/279 pending out of645. Regenerate the stale MENU_PARITY.csv from the tested native inventory:802 entries,363 bound/362 unavailable leaf actions,102 primary/eight alternate shortcuts. This is binding breadth, not Photoshop-complete coverage. Preserve previous documents under before-record14. Keep older menu/reference counts attached to their historical checkpoints; correct the diary's old209 handoff label to historical (current installed package remains221). No parity package closes. New source delta: five files added, eleven modified, none removed; full source13 remains frozen while release13 compiles/runs.

11. Full optimized result and remaining oracle repairs: release13 finishes2,330 tests with four assertion failures in two older methods: DocumentModeTests direct CMYK→Lab and ModeActionProgramTests profiled encoded-Float32→Lab. Both old expected values used ICC-reported chroma as physical Lab, the same independently disproven assumption. Preserve failures and before15; change their default Lab reference to built-in Generic Lab, leaving numeric tolerances/production code unchanged. Extend the existing Display P3 test to check both chroma planes as well as lightness. Freeze source15 and qualify these corrected core oracles before rerunning the full optimized suite.

12. Corrected optimized core qualification: core15 passes41 tests, zero failures, including direct CMYK/P3/encoded-Float32 Lab references, native samples, proof controls and HTTP workflows. All2,234 source15 inputs remain unchanged. Preserve fixed-name outputs under before-full16 and run the complete optimized suite using the just-built source15 binary (--skip-build), with a separate release16 log.

13. Full optimized success and source checkpoint: release16 finishes2,330 tests with zero failures in164.404 seconds; terminal28459 exits0. Verify all2,234 source15 input hashes unchanged. Save the result/log hash and final menu report; add ACTIVE_CHECKPOINT_223 and finish the working checkpoint/reference/status/phase/plan/diary. This qualifies the current source, not a universal223 package or live UI acceptance. Installed/qualified221 and private uploaded220 remain unchanged. Final source delta is five additions/thirteen modifications/no removals, including the two older corrected Lab oracles. Native printing/page setup and print/PDF API are the next major work; COL03 and every full-parity gate remain open.

14. Diary, dashboard and evidence audit: Regenerate the223-entry public diary using the existing website generator. Verification18 confirms served HTML matches the generated file, the dashboard shows checkpoint223/2,330 passing optimized tests, all2,234 source inputs are unchanged, both site stylesheet hashes are unchanged, the retired brand remains absent from current source/tests/docs/site, and installed221 retains its exact executable hash. The tracker has105 broad packages,16 active and zero fully closed;366 commands are partial and279 pending. The first refresh/check17 audit passes with48,568 evidence files/25,334 logs and zero missing explicit references. Record the final audit paths in both checkpoints, refresh the diary for this final note, then refresh/check the evidence index again. No package is uploaded or existing user app/document closed.

The next major workflow is editable ink separations. Work starts with authoritative grayscale samples, ordered ink curves and independent ink plates, followed by native controls, history, files and shared APIs. Build221 remains the qualified development preview. No Duotone/Multichannel feature or Photoshop equivalence is claimed at this initial stage.

Eight focused core tests now pass, including exact sample comparisons with the licensed Rust ink implementation. These are internal foundations; document, controls, persistence and API integration remain unfinished.

A repeated window-overlap report revealed that the obsolete test app is still running. The current canvas fix passes34 focused window/viewport checks. The qualified221 application is now installed at the usual Photato location, with its executable unchanged and signature verified. Existing running apps and saved artwork were preserved. The Mac is locked, so switching the user's document into the corrected app and checking live zoom, scrolling and resizing still await unlock. This delivery check does not claim a new rendering fix or completed live acceptance.

The ink data now lives in real documents. Duotone retains its gray source and ink curves; Multichannel retains separate8/16-bit plates without an artificial RGB layer. Native48 files and scratch-backed Undo retain exact samples. Conversion reads an opaque CMYK layer directly, preserving its black plate, and geometry transforms every plate along with saved masks and selections.

All40 focused integration tests pass, including file/API save, import, geometry and Undo. One test needed an async assertion repair; another still expected the newly supported archive48 to be rejected and now checks49. Both failed attempts remain recorded. The full optimized run now passes all2,284 tests, with the tested source unchanged. The next work is the actual ink-control workspace and complete channel/API editing, then print and file interchange. This is an internal implementation checkpoint, not a completed Photoshop ink workflow or a newly packaged release.

The public PSD specification leaves the Duotone color-mode block undocumented, and the licensed Rust importer retains that block while showing grayscale. That fallback does not meet the goal of editable ink interchange. It remains an explicit open item; documented Multichannel storage and usable ink controls/API work can proceed independently.

Native ink controls and automation: Duotone now has a native preview dialog for ink count, names, colors, density curves and overprint colors, with settings files and local Undo. Multichannel conversion asks before flattening layered artwork. Both commands appear in their existing Photoshop menu positions. Three matching Photato API operations read and change the same settings through the shared transaction engine; Actions20 records the conversion without baking in an image snapshot.

All 88 focused tests pass, including preview/Cancel, saved settings, native reopening, history, stale requests and API revocation. Review also caught source-specific channel identities in recorded Multichannel playback; playback now adapts them to the destination's channels, and tests cover Grayscale, CMYK16 and Duotone input. Hosted snapshots show the preview and layout, but native controls are incomplete in cached rendering, so live visual acceptance remains open. The full optimized run now passes all 2,293 tests, with all tested source inputs unchanged. Complete Channels editing and ink file/print interchange are next; this is not a completed Photoshop ink workflow.

Real ink Channels: The panel now shows Duotone's gray source or the actual Multichannel plates. Select and view individual inks, paint or erase, fill, invert, filter with a preview, load a selection, and create/reorder/duplicate/delete or change spot options. Other plates keep their original samples. Six matching API operations expose the same edits, raw sample pages and view state, with Undo and native reopening.

The integrated tests caught two real adapter mismatches: desktop brush seeds exceeded the API's exact numeric range, and channel selection loading used the wrong default name. Both are repaired. A later failure came from a test mask at the wrong bit depth; document validation stayed intact. All93 focused tests and all 2,307 optimized tests now pass. Hosted panel images are offscreen evidence, not live acceptance. The full ink workflow still needs interchange/printing, more tool and clipboard contexts, semantic channel Actions and Adobe compatibility. The obsolete-window handoff remains pending unlock; current apps and user artwork remain preserved.

The completion question is recorded separately from regression results. Qualified build221 connects350 of725 menu actions (48.3%); the current ledger marks355 of645 tracked commands partially implemented (55.0%) and290 pending. These measure implementation breadth, not fully qualified Photoshop functionality. Every broad parity package still has open acceptance requirements; a single overall completion percentage would require a weighted workflow audit.

Multichannel Photoshop files: Native Save/Open and the two API interfaces now preserve8/16-bit ink and alpha samples in PSD and PSB. Channel names, spot colors and solidity travel with the planes. The parser accepts modern and legacy display records and retains unchanged imported RGB, HSB, CMYK, Lab and gray color records. Changed display colors use the file format's16-bit precision and solidity uses whole percentages. Printing and the complete color-book workflow remain open.

Independent fixtures exposed a five-channel limit in the shared compression code; API tests exposed an older color-mode admission rule. Both now admit supported Multichannel files while retaining memory and transfer limits. Test-only mistakes—a helper name and comparisons of sparse storage layouts instead of image samples—are recorded separately. All52 focused tests and all2,316 full optimized tests pass. An independent PSD reader verifies16 exported files and768 sample values exactly. This is file-format evidence, not a live Photoshop acceptance test or proof of full rendering equality. No new packaged build is claimed; qualified221 and uploaded220 remain separate.

To follow the requested major-feature priority, the next major workflow is native proofing and printing. The source currently has its factory menu entries without a matching proof/print implementation. Remaining ink presets, tools and format gaps stay on the backlog; this scheduling move does not mark color-mode parity complete.

Tested development build: The integrated Indexed Color and Bitmap workflows now pass all2,259 optimized tests and package as a universal macOS14+ app. A painting regression exposed previews whose stored color samples were stale. The shared preparation step now reconciles those samples before preview or commit, preserving untouched colors and duplicate palette indices. Six new workflow tests cover12 mode/depth contexts and84 tool/context combinations, native cancellation/history, automatic layers/masks, HTTP painting and reopening; all39 final focused checks pass. The failed reproduction and one API test-fixture correction remain documented. API capabilities and the diary reflect the fix. Build221 is saved locally;220 remains the uploaded private build. Same-artwork window acceptance still needs an unlocked desktop. Exact Photoshop output, full tool contexts and other parity gaps remain open; Duotone/Multichannel are the next major workflow.

Window follow-up: The reported overlap still comes from the older test app. The corrected app is installed and its signature verifies, but switching the artwork into it is unfinished: the desktop is locked. The document remains preserved; same-document zoom, scroll and resize acceptance stays open pending manual unlock. No new window code or live success is claimed. Separately, the painting regression reproduced stale stored samples in prepared previews across six modes; the repair and final qualification are recorded above.

Latest Actions checkpoint: Recorded conversions now keep their settings and apply them to each playback image. Copy, Copy Merged, Cut and Paste share a private playback clipboard, with native publication only after success. The same engine runs native Actions, API playback and Batch. Master palettes use immutable source snapshots; Previous and Color Table retain palette data without embedding source images. Actions19 reads older libraries and rejects falsely downgraded files. All523 combined regressions pass;34 final checks verify the exposed API response schema. Twelve new workflow tests cover native controls, portable replay, HTTP recording/output, Batch file changes, palette retention, history, cancellation, failed clipboard writes and stale sources. Earlier compile and assertion failures remain documented. This is still a development checkpoint; complete tools, Adobe descriptors, exact Photoshop output and live/platform/release qualification remain open.

The window-overlap follow-up confirms that the older test app remains open alongside the installed corrected app. The current317-test result includes canvas containment and document-window checks, and the app/artwork hashes remain unchanged. The live handoff is still pending the requested manual unlock; the bug stays open until that same artwork passes zoom, pan, scrolling and resizing in the corrected app.

Build220 is qualified and available privately. The next major workflow adds genuine palette-index and monochrome-bit storage, conversion settings, Color Table editing, native history/files and corresponding APIs. Work begins with licensed quantization algorithms and independent Rust fixtures. No new restricted mode is exposed or qualified yet; full Photoshop parity remains open.

Window follow-up: the reported screenshot is from the obsolete159 test app, which is still running. The corrected installed build and saved artwork verify unchanged, and the current tested source retains viewport clipping. A fresh UI attempt reports the Mac locked, so the same-document handoff remains pending; no new live pass is claimed. That window investigation changed no product or API code. Evidence.

The core now retains actual palette indices and packed one-bit pixels, including duplicate palette identity, transparency, profiles and canonical row padding. Conversion, Color Table changes and ordinary painting preserve Undo/Redo, and native47 files restore their display caches from the retained samples. Shared adapters require explicit flattening consent and handle grayscale prerequisites, master palette profiles and Bitmap output resolution.

All94 focused integration tests pass, including18 new restricted-mode tests. The unchanged licensed Rust algorithms independently supply124 indexed and21 bitmap reference cases; all match byte-for-byte. One compile failure and one real regression in Adobe creation validation were preserved and repaired. Adding the model enum had accidentally made an unfinished mode parse successfully; the component-only menus, schemas and parsers are now explicit. These results do not establish Photoshop numerical equality.

This increment remains unfinished: native controls, Color Table UX, real PSD/PNG/TIFF storage, full tool/geometry context, both API integrations and broad/live qualification remain. The existing118 commands remain, with accurate restricted mode/depth state when such a native document is present; no new restricted conversion command is advertised. Build220 remains the latest qualified downloadable package. Working checkpoint.

The next format stage has draft PSD/PSB and PNG codecs and dedicated fixtures. It is not compiled or tested yet; the94 passing tests above apply to the preceding core checkpoint. The renewed overlap report was checked first: the corrected app and retained artwork verify unchanged, but the locked desktop prevents the live handoff. No window code changed in this follow-up.

The file-interchange stage is now tested: PSD/PSB retain actual index or one-bit planes; PNG retains palettes and bit polarity through interlace/filter decoding; TIFF retains packed samples, palette identity, transparency, profiles and resolution through lossless compression and both byte orders. Native Save/Save As uses flat TIFF for these modes, and JPEG ordinary Save is excluded because it cannot retain the mode. HTTP downloads explicitly negotiate native47, and both existing action-job routes share the same codec path.

All166 combined focused tests pass, including33 restricted-mode tests and a separate Lab-profile stability regression. The independent incoming corpus contains37 files from Pillow/tifffile/imagecodecs; independent readers verify42 final exports and11,934 stored samples. Failures exposed a Swift slice typo, an overly strict PackBits row boundary, an outdated job header guard and a system Lab-profile timestamp change; each failure and repair is preserved. The Lab fix retains one default profile per process without altering imported profiles.

These are focused Debug and independent format checks, not full Photoshop equivalence or a new qualified release. Conversion/Color Table UI and typed APIs, complete mode-aware tools/Actions, unsupported file variants and live/platform qualification remain. The earlier unqualified codec draft is superseded by this tested checkpoint. The window handoff still awaits the existing manual unlock request; no additional desktop poll occurred.

The workflow now reaches the native interface. Image → Mode opens Indexed Color and Bitmap conversion previews; Color Table edits individual entries without changing pixel indices. Palette/dither/transparency/halftone/resolution controls, custom ACT tables and threshold tiles feed the same native preparation used by six new automation commands. Local Undo/Redo and Cancel leave the original untouched until OK; accepted edits have one document Undo. Index/Bitmap channel rows and API state report the stored mode rather than the RGB display cache. Remembered save defaults adapt after conversion, while explicit API output options retain validation.

Tests found and repaired an ACT base64 length guard, an omitted ellipsis in the Indexed Color menu binding, and a master-palette source race. The last repair checks captured document contents as well as revision tokens before accepting a result. Nine new workflow tests exercise these failures, stale/busy requests, native/API equivalence, palette identity through real files, history, closing and saved options. All215 combined focused tests pass. Three native-window-hosted offscreen captures show readable controls and contained previews; they do not qualify live input or Photoshop appearance.

This is a working development checkpoint, not a new release or full Indexed/Bitmap parity claim. Adobe restricted conversion descriptors, semantic Actions, full tool/clipboard/geometry behavior, exact Photoshop outputs and live/platform checks remain. Build220 stays the last qualified package; the existing window handoff still needs an unlocked Mac.

The next editing stage now transforms the stored palette indices and bitmap bits directly. Crop, Image Size, Canvas Size and canvas turns preserve duplicate palette entries for exact grid/nearest operations. Extension fills stay within the flat document and map to its existing colors. Four additional API commands use the desktop transaction path, bringing the total to128. Native archive, PSD/PSB, PNG and TIFF checks retain the changed samples.

A focused test caught crop fill attempting to install the compositor’s floating-point surface in an8-bit indexed document; the repair fills the original8-bit expansion. All68 geometry-focused tests and260 combined focused tests now pass, including nine new geometry tests and the existing window containment regressions. These are development checks, not a new release, a live overlap acceptance or proof of Photoshop pixel equality. Clipboard/tool contexts, semantic Actions, Adobe geometry descriptors and broad qualification remain open. The old test window is still open; the locked desktop prevents safely finishing the handoff to the installed corrected app.

Clipboard work now preserves the data that Indexed Color and Bitmap actually store. Native copies retain palette indices or packed bits alongside selection transparency. Paste changes the existing flat image, and a matching opaque copy retains duplicate palette identities. Cut preserves the flat layer and uses transparency where available, or the chosen background color. New from Clipboard keeps the original mode when its coverage fits that mode; fractional transparency remains RGB.

Four explicit clipboard API commands share these operations without reading or writing the Mac system clipboard. Transfers check encoded and decoded size, current revisions, sharing and document lifecycle. Oversized or revoked operations leave documents unchanged. No-op desktop edits now leave the modified flag alone.

The earlier clipboard checkpoint passed317 combined focused tests, including16 new clipboard regressions. Failed compile attempts, a test-document cleanup leak and its correction remain in the technical log. The API has132 typed commands. The Actions work described above follows that checkpoint; complete tool contexts, Adobe clipboard descriptors, large API transfers and exact/live/platform behavior still need work. Build220 remains the latest qualified package. The existing live window handoff still awaits manual unlock; this stage made no new desktop access attempt.

Photato now retains actual RGB, Grayscale, CMYK and Lab component planes, including independent black ink, ICC profiles and floating-point HDR. Native format46 and history preserve these samples; existing RGB tools use a derived display/editing cache. Conversion has a native preview dialog, profile/depth/intent controls, local Undo, Cancel and one document Undo. Seven Image > Mode entries follow the existing Photoshop menu inventory. Merging rich layers and clipping HDR values are explicit choices. Three Photato API operations expose conversion and bounded numerical component reads/writes through the same engine.

All91 focused Debug tests pass, including28 new mode tests, HTTP native-file reopen, menu/window regressions, API equivalence and stale/busy/protected errors. Two new-test compile mistakes were repaired and their logs retained. An earlier373-test run failed in the existing Layers rename lifecycle test. The same focus issue reproduces in freshly built219 Debug while its optimized binary passes; additional zero-size assertions remain unqualified. An attempted focus repair was ineffective and withdrawn byte-for-byte. No live desktop check or new universal package is claimed.

The next implementation stage adds real mode-aware PSD/PSB raster/group/mask interchange. All182 selected mode/PSD/TIFF checks pass. Seven files also pass independent decoding: psd-tools recovers24 layer planes byte-for-byte, and Apple ImageIO reads each merged cache. A new mask test initially compared internal Surface layout; its16-bit fixture and bounded sample assertions were corrected, with both failed and passing runs retained. Existing RGB Photoshop reference tests still pass. Merged CMYK/Lab previews currently use the RGB compositor and are not proof of native ink/blend equivalence.

The TIFF stage now retains Gray/CMYK/Lab channels, profiles, alpha and orientation, with both byte orders, pixel/channel layouts, lossless compression and Float32 prediction. Native Save, Photato transfers and both asynchronous job interfaces use the same serializer. All192 focused tests pass, including ten new TIFF tests. Independent readers check14 files:48 composite planes follow the documented TIFF encoding, and24 embedded layer planes preserve the original bytes. Apple ImageIO reads all14 at the expected mode and depth. Flattened Lab16 chroma is rounded to the format’s signed1/256 scale; layered components remain exact. An initial external verifier used the wrong temporary wrapper for8-bit layer records; its repair and failed log are preserved. These checks do not prove Photoshop color or blend parity.

The Channels stage now shows the real components of RGB, Grayscale, CMYK and Lab documents. Visibility and editing targets are separate; numerical fill, brush/erase, Invert and eight filters preserve untouched channels and transparency through preview/Cancel and one Undo. High-depth RGB is included; the older qualified RGB8 path remains. Three new Photato APIs bring the catalogue to118 commands, with matching state and preview images.305 broader tests and126 final focused tests pass, including13 new component tests. Two schema-helper compile failures were repaired and retained. Hosted captures show the mode rows and footer within the panel; these are offscreen checks, not live Photoshop comparisons. Rich-effect previews still separate the RGB composite, so ink-space blend fidelity remains open.

File New and API jobs now share native blank-document creation in RGB, Grayscale, CMYK and Lab. Mode, supported bit depth, resolution, background and ICC profiles reach the same engine. Adobe create-composite accepts its published image-parameter subset; the Photato action-job API adds the same option while Adobe execute-actions keeps URL input. Custom profiles are checked before use, blank jobs fetch no image, and revocation prevents late publication. All124 focused tests pass, including nine new creation/HTTP/profile/layout/target cases. Earlier attempts exposed mistaken RGB PSD test expectations, a correctly enforced job quota and a2point label overflow; each failure and repair is preserved. Offscreen bounds pass, but native button interiors are not captured, so no live visual approval is implied.

Fourteen examples validate against the pinned image and selected PSD-output schemas and our local discoverable schema. Full strict request validation exposed an ambiguity in Adobe's published output union: its branches do not constrain mediaType. The original schema remains unchanged and this limitation is recorded. Other named profiles, nonpixel units/scales, guide-only solidColor fills and exact working-profile/color behavior remain open.

The next integration connects both job APIs to native channel editing and mode conversion. Gray, CMYK, Lab and higher-depth RGB targets support neutral Fill, Invert and eight filters; target state survives multiple action resources, while untouched planes and transparency stay intact. Conversion preserves layer selection and working-profile primaries, with explicit merging for rich content and no implicit HDR reduction. The legacy RGB8 byte-exact Fill path remains.158 focused tests pass, including11 new tests and actual desktop/API output equality. Independent readers recheck14 current TIFFs with48 composite and24 layer planes.

A failing merge test exposed an encoded Float32 compositor buffer being treated as linear solely because its storage was floating point. The shared conversion now respects its actual color encoding; direct ColorSync component checks cover the repair. New channel names use a plugin author's public observation on Adobe's developer forum, while conversion identifiers come from installed public scripting interfaces and official documentation. These are disclosed references, not proof of current Photoshop2026 numerical or descriptor equivalence. The integrated source has now completed full optimized and universal-package qualification; the next major work is Indexed Color and Bitmap, followed by the remaining ink modes.

The repeated window-overlap report was traced to the older test app still running beside the corrected installed build. All 34 current canvas, viewport and document-window regressions pass. The installed app and retained artwork verify unchanged. The Mac is locked, so reopening the artwork, checking zoom/pan/scroll/resize and safely closing the old window still require manual unlock; no new live acceptance is claimed.

Full qualification exposed one outdated test that still expected RGB32 component Fill to fail. It now checks actual channel values, untouched green/blue/alpha bytes, Undo/Redo and equality across the desktop and both HTTP interfaces. All46 focused regressions and all2,173 optimized tests pass. The failed attempt remains preserved. Independent readers verify seven current PSD files and fourteen TIFFs; the universal package passes fresh-extraction, signature, resources, architecture, minimum-OS and optional-AI weak-link checks.

The private development build220 contains the verified ZIP, checksums and source-input provenance; all uploaded assets match their downloaded copies. It is built from the local frozen source, which is newer than remote main. No source changes were pushed and repository visibility remains private. The existing Debug-only Layers focus issue, physical platform checks and the locked-desktop window handoff remain open.

This increment is unfinished. Full native component tool/menu/shortcut coverage, complete Adobe component descriptor variants, TIFF storage variants, editable non-RGB rich PSD/TIFF content and restricted color modes still need implementation. Mode-native blend/filter fidelity, semantic Actions and independent Photoshop color comparisons remain open. The corrected209 app and retained artwork are preserved; the old159 overlapping window still awaits the previously requested manual-unlock handoff. The latest qualified local package and private GitHub draft are220. The already-installed corrected window build remains209 until a safe live handoff. Working checkpoint, development record.

Window follow-up on October28 confirmed the corrected installed executable and preserved artwork are unchanged. The Mac still reports locked, so the old test window has been left intact and the same-document handoff remains pending. No additional clipping change or live acceptance is claimed.

Five previously unavailable Image > Adjustments workflows now run in native Swift. Shadows/Highlights includes tonal widths, radii, clipping and color/midtone controls, and can remain editable on Smart Objects. HDR Toning offers four methods, a curve and a flattened result with one Undo restoring the source layers. Match Color can read an open source document or layer with selection-weighted Lab statistics. Replace Color supports additive/subtractive samples, localized clusters and selection-mask preview. Equalize supports selected-area mapping or whole-target mapping based on the selected sample. Native previews, local history, cancellation and document Undo share the same engine with two new API commands.

The implementation translates the licensed PhotoCraft tone, Gaussian, Lab, HSL and Equalize behavior. Twelve independently generated original-Rust RGB8 references match byte-for-byte. They are not Photoshop output. The first compile found a missing API-schema bracket; the next regression found outdated generic command/version/interchange expectations. Both failures and repairs remain in the evidence record. A final API review corrected the statistics depth schema to match its actual string payload. All161 focused tests and2,094 full optimized tests pass, followed by fresh-extraction universal package verification. Four hosted dialog renders were inspected for contained previews and readable controls, with longer HDR controls in a scrollable panel. These are offscreen checks, not live interaction acceptance.

There are112 typed Photato commands. Statistics are read only through a shared source document route and are portable values for a separate target request. Editable Shadows/Highlights uses native45; ordinary tone Actions use18. Semantic HDR Actions, Adobe STA/presets/ActionJSON/ATN and editable PSD descriptors remain unsupported. Exact Photoshop output/defaults/depth behavior and ICC-specific processing remain unqualified, as do physical Intel/macOS14/macOS26 and live workflows. Full A03 is still open. The next major breadth work is native document color modes and separations.

The old159 test window from the overlap report remains running. The installed corrected209 app and retained artwork are preserved. Current native UI access returned no window; no new live handoff or safe closure of the old app is claimed. Canvas containment and document-window regressions pass in the full suite. The pending handoff is to open the retained artwork in Photato Verified, check title/zoom/pan/scroll/resize and review unsaved state before closing the obsolete window. The private downloadable build remains209; this219 package stays local. Development record.

Twelve more factory menu operations now work in native Swift: Blur, Blur More, Radial Blur, Shape Blur, Smart Blur, Surface Blur, Despeckle, Dust & Scratches, Median, Sharpen, Sharpen Edges and Sharpen More. Six apply immediately; the other six open settings and previews with Cancel and local Undo. Radial Blur has Spin/Zoom, quality and a draggable center. Shape Blur offers nine built-in kernels. Smart Blur has quality and three output modes. The family shares document Undo, selection/transparency handling, cropped pixel and mask placement, editable Smart Filters, native44/Actions17 saving and the Photato API. Known Adobe bit-depth restrictions are enforced in desktop and API execution.

The Rust reference harness initially failed because unused large-Gaussian helpers referenced Rayon. A sequential iterator adapter repaired the harness while preserving the selected original algorithm bodies. All 44 resulting RGB8 test images match byte-for-byte. The first native focused run passed all 149 tests; the only later production change clarified the aggregate API description of unsupported editable PSD interchange. The complete optimized suite then passed all 2,082 tests. Fresh extraction verifies the universal macOS14+ package. Hosted settings-dialog images were inspected for control placement; these are offscreen checks, not live user interactions.

This is F01 functional breadth; the initial working note classified it as F02, which is corrected in the current ledger. Both packages remain open. Exact Photoshop output/defaults, imported or custom Shape presets beyond the nine source kernels, Adobe ActionJSON/ATN/editable PSD descriptors, large-document processing budgets and live/platform qualification remain outstanding. Radial Draft/Good use native sample budgets derived from the source Best path; no Adobe quality-kernel equivalence is claimed. Next major breadth work is the remaining classic adjustment family.

The overlap screenshot still corresponds to the old159 app. The corrected209 app and retained document keep their verified hashes and signature. A new native app selection returned no window, and the follow-up inventory explicitly reported the Mac locked. No input was sent and no same-document live handoff is claimed. Canvas pixel-containment and document-window regressions pass in the full suite; opening the saved artwork, zooming, scrolling, resizing and safely closing the old window remain pending manual unlock. The private downloadable build remains209; this218 package stays local. Development record.

Seven more Photoshop menu operations now have working native Swift implementations: Custom, HSB/HSL, Maximum, Minimum, Offset, De-Interlace and NTSC Colors. Custom offers a 5×5 matrix with scale and offset plus portable JSON presets. Maximum and Minimum support square and round neighborhoods. Offset handles wrapping, repeated edges and transparency in the selected region or canvas. De-Interlace offers field order and duplication/interpolation choices. Settings, previews, Cancel and local/document Undo share the same transactions as the Photato API. Editable Smart Filters retain their sources through native43 and Actions16 saving; ordinary raster results also survive PSD saving.

The reference generator initially needed a Copy annotation on its Rust adapter and a fresh output directory. Three early Swift builds caught spacing, missing error propagation and a test fixture using a read-only store property. The next run exposed eight old generic interchange expectations that incorrectly included filters whose Adobe descriptors are explicitly unsupported, plus a busy-request test that had not selected its newly created layer. Those tests now distinguish qualified operations and check that a preview really opened. The full suite then caught two older archive expectations: discovery still ended at42 and the invalid-version list contained the now-supported43. Those now use readable1–43 and unsupported44. Every failed attempt remains preserved. No expected reference pixels were changed.

All 124 focused tests and 2,068 full optimized tests pass. All 44 synthetic original-Rust RGB8 outputs match byte-for-byte. Fresh extraction verifies the universal macOS14+ package. Hosted dialog images were inspected for layout; these are offscreen checks. Photoshop output/defaults, Adobe ACF presets, ActionJSON/ATN and editable PSD descriptors, fractional Roundness behavior and live/platform qualification remain open. Full F02 is still in progress. The next major breadth work is the remaining Blur, Noise and Sharpen operations.

The older window from the overlap screenshot is still running. Selecting the corrected installed app again reports the Mac locked, so the same-document zoom, scrolling, resizing and safe closure of the old window remain pending. The private downloadable build remains209; this217 package is local. The stale Actions import-help version hint noted in216 is now corrected to1–16, matching the actual decoder and discovery state. The diary overview was also brought forward from its stale211 summary to this verified checkpoint. Development record.

Three more Render workflows now run in Swift. Flame follows a chosen document path and exposes the six source modes, shape, style and flame controls. Tree offers34 source designs, leaf/branch/light controls and a draggable base. Picture Frame offers16 source designs, line/spacing/color and fade settings. Each has a native preview, local Undo, Cancel, one document Undo on commit and optional new-layer output. Selection, transparency locks, cropped storage and mask placement are retained. The three Photato API commands use those same transactions. Actions15 records settings, portable target layers and actual Flame paths; generated raster pixels use existing native and PSD persistence.

The first core run stopped at incorrect persistence helper names in a new test. After that repair,70 original-Rust reference comparisons exposed89 channel samples differing by one eight-bit level across36 cases. Diagnostic paint-buffer comparisons traced this to the floating-point PI constant: Swift's Float.pi rounds down, whereas the source Rust constant rounds to nearest. Using the explicit source bit pattern fixes every reference without changing expected images or weakening assertions. The first app-integration compile then caught grouped declarations unsupported by Swift Observation and an error-variable shadowing mistake; those were repaired. Failed attempts remain available in the development record.

All109 focused tests and2,055 full optimized tests pass. The universal macOS14+ package verifies after fresh extraction. All70 original-Rust RGB8 cases match byte-for-byte in both focused and optimized tests. The three hosted dialog images were inspected for containment and layout; that is offscreen evidence. These results do not prove Photoshop pixel equivalence. Exact Photoshop settings, output/depth contexts, Adobe raster ActionJSON/ATN compatibility, live interaction and physical platform qualification remain open. The original-source fallback arc is not substituted when Flame lacks a real path. F02 stays open; remaining Other/Video workflows are next, with Lighting Effects' current availability still requiring a separate audit.

The workspace-overlap handoff remains unfinished. The old test app is still running alongside the corrected installed209 app. All23 dedicated window/containment checks pass, as do the window cases in the full suite. The installed executable and saved document match their verified copies, but native app access reports the Mac locked. Same-document zoom, scrolling, resizing and safe closure of the obsolete window remain pending. The private downloadable build remains209; this216 package is local. The inherited Actions import-description version hint also remains a small metadata follow-up, while the actual decoder/discovery state correctly supports Actions15. Development record.

Clouds, Difference Clouds, Fibers and Lens Flare now run in native Swift. Clouds and Difference Clouds use immediate menu commands; Fibers and Lens Flare offer native previews and local Undo. Lens Flare can be positioned directly in the preview. Generated textures fill the selected canvas region even on empty or cropped pixel layers while retaining transforms, masks and transparency locks. Editable Smart Filters preserve the source and captured settings through native42 and Actions14 saving. The Photato API uses the same commands, history and validation.

Twelve synthetic images produced using the licensed original Rust functions match byte-for-byte. The first attempt stopped at a test typing error. The second exposed a real Lens Flare porting mistake: the original helper handles reversed smoothstep edges with a hard step, while the initial translation used a smooth ramp. The implementation was corrected without changing the expected reference images. Two further assertions differed only because separately created Smart Filters received different identifiers; those comparisons now normalize that identifier while checking the complete document. Both failed attempts and their repairs remain preserved.

All 94 final focused checks and 2,041 full optimized tests pass. The universal macOS14+ package verifies after fresh extraction. Fibers and Lens Flare workspace images were inspected for layout; they are offscreen evidence. Adobe actionJSON and editable PSD mappings, exact Photoshop output/defaults/depth contexts, live interaction and physical platform qualification remain open. F02 remains in progress. Flame, Tree and Picture Frame are the next major Render workflows. Lighting Effects exists in the licensed source but is absent from the captured current Photoshop menu; its reference context needs separate review.

The recurring window-overlap report still requires a live handoff. The older test app remains running; the corrected installed app and saved document retain their verified hashes. Current canvas-containment tests pass. The Mac remains locked, so the same-document zoom, scroll and resize check and safe closure of the old window remain pending. The private GitHub development build remains209; this215 package is local. Development record.

Diffuse, Emboss, Extrude, Find Edges, Oil Paint, Solarize, Tiles, Trace Contour and Wind now run in native Swift. Find Edges and Solarize apply immediately; the other seven offer native settings, preview and local Undo. The same commands power the desktop and Photato API. Editable Smart Filters retain the original pixels, parameters and masks through native41 and Actions13 saving. Emboss also has PSD descriptor round-trip coverage using the licensed PhotoCraft mapping.

Twenty-seven synthetic reference images generated with the original Rust source match byte-for-byte. The first run exposed three test setup issues: tiny Tiles settings legitimately produced no change, an HDR fixture used encoded instead of linear storage, and a wide Oil Paint reference used whole-image processing instead of the original application's default256-pixel tiles. A separate original-Rust experiment reproduced the tile-dependent difference. The corrected fixtures retain exact assertions and preserve the failed evidence; no editing algorithm was changed to make these tests pass.

All 80 final focused checks and 2,027 full optimized tests pass. The universal macOS14+ package verifies after fresh extraction. Oil Paint, Extrude and Tiles workspace renderings were inspected for layout; they are offscreen evidence. Adobe actionJSON support, wider editable PSD interoperability, exact Photoshop output/defaults/depth behavior, live interaction and physical platform qualification remain open. F02 is still in progress; Render workflows are next.

For the recurring window-overlap report, the corrected installed app and saved document still match their verified checksums. The older test app remains running. Current canvas-containment tests pass, but the locked Mac prevents the same-document zoom, scroll and resize handoff. The obsolete window will remain open until that handoff can safely finish. Development record.

Color Halftone, Crystallize, Facet, Fragment, Mezzotint and Pointillize now run in native Swift. Facet and Fragment apply immediately; the other four have settings, previews and local Undo. Smart Filters keep their source and editable parameters. Native40 and Actions12 save those settings, and the Photato API uses the same commands as the desktop. Pointillize captures the current background color; seeded patterns make repeatable renders possible.

Eighteen synthetic reference images produced by the original, unmodified Rust filter source match byte-for-byte. The first focused run exposed unnecessary sparse-tile allocation on an unchanged white image; that was repaired without changing expected pixel output. All68 final focused checks and2,015 full optimized tests pass. The universal macOS14+ package verifies after fresh extraction. Hosted workspace images were inspected; they are not live interaction evidence.

Adobe's published API lists these filter families but requires recorded action descriptors. Those mappings and editable PSD interchange remain incomplete. Exact Photoshop pixels/defaults/depth availability, live interactions and the physical platform matrix also remain open. Other major F02 workflows are still outstanding; the next family is Stylize.

The recurring workspace-overlap report remains a delivery handoff in progress. The older test app is still running; the corrected installed build and saved copy of its document retain their verified hashes. Automated canvas-containment checks pass. The Mac remains locked, so reopening that document, checking zoom/scroll/resize and safely closing the obsolete test window still await unlock. No new live pass is claimed. Development record.

Displace, Shear, Wave, Pinch, Spherize, Twirl, Ripple, Polar Coordinates and ZigZag now have native Swift settings, previews, Cancel/Undo and editable Smart Filters. Displacement maps stay embedded with the document; Shear curves can be edited directly. The Photato API shares the same operations. Native39 and Actions11 preserve the new settings. The first integration attempts exposed a Swift getter, a test comparison and missing archive negotiation paths; each failed attempt was preserved and repaired. The full run also found two outdated version expectations, corrected before the final run.

All45 focused checks and2,003 final full optimized tests pass. The universal macOS14+ package verifies after fresh extraction. Adobe's observed dialogs informed controls and parameter ranges; exact Photoshop pixels, action descriptors, editable PSD interchange, live native filters and the physical platform matrix remain unqualified. Other major F02 filter families remain open.

The maintainer's recurring workspace-overlap screenshot was traced to an older test app still running before the clipping fix. Its document was saved separately, and the verified corrected build was installed alongside it. The title appears correctly, but the Mac locked before the same-document zoom/scroll check and handoff could finish. That live check remains pending; automated containment checks pass.

The diary overview was checked at desktop and phone widths, with five readable numbered steps and no horizontal page overflow. At the maintainer’s request, it explains the actual engineering process, licensed PhotoCraft provenance, public specifications, black-box comparisons and saved-file analysis. It explicitly excludes decompiling/disassembling Photoshop or copying proprietary Adobe implementation code. It does not assert a formal clean-room separation or the unsupported broader statement that no reverse engineering of any kind occurred. Development record.

At the maintainer's request, the verified universal macOS 14+ development build is now attached to a private GitHub draft release. It includes Lens Blur, the document window title and canvas containment fixes, and the current branding cleanup. The repository remains private until software release day.

A fresh extraction verifies the signature, executable hash and both architectures. All four uploaded assets were downloaded again and their hashes match. The package is ad-hoc signed, not notarized or App Store signed. The 50 focused tests apply to this snapshot; the preceding 1,991-test full run is historical. Full Photoshop parity and the physical platform matrix remain open. The release notes explicitly state that local build sources are newer than GitHub main; this build-only upload does not push source changes. Private draft release. Development record.

The maintainer requested an elegant way to read the developer diary from the Photato website. The website now presents210 dated, expandable entries with local search, chronological sorting, keyboard access, stable per-entry links and a downloadable narrative diary. The existing Forensic Intelligence visual style is retained. Desktop and320/390px mobile views were inspected; search, empty state, sorting, permalinks and mobile navigation pass with no browser warnings/errors. The GitHub repository already exists; it remains private during development and will become public on the same day the software is released. The website is saved locally for the maintainer to publish.

At the maintainer’s request, removed the retired family identity from About, demo names, project documentation, the diary and archived text copies. Photato retains its own name, supplied icon and original PhotoCraft attribution. Renamed owned TIFF fixture group metadata without changing image samples. All50 focused checks pass, including TIFF decoding/pixels, gradient presets, support links and window/viewport regressions. The refreshed universal macOS14+ app verifies after extraction; its contents have no retired branding. Earlier208 full1991-test results remain historical. Archived signed binaries and screenshots are retained as historical evidence. The repository stays private until the software’s release day, when it will become public.

The user requested Photato - <current doc name> and supplied a screenshot of canvas content covering window controls. Read-only live inspection and a failing pixel-boundary regression confirmed the overflow. Added view/layer clipping and a saved CGContext clip around the full draw pass. Window titles now update with active tabs and document names; native API state exposes the same title. The first resized fixture misinterpreted bitmap Y coordinates; its repaired rerun proves no pixels escape the viewport. Failure evidence is preserved.

All 59 focused Debug and 1,991 full optimized tests pass. The universal macOS 14+ package verifies after fresh extraction, including both architectures, signature, icon/licenses and optional model provenance. All1,601 frozen inputs match workspace/isolation; one test file added, six files modified, none removed. Four protected files and754 original Rust hashes remain unchanged. Separate current Debug live checks cover title,200% zoom, horizontal/vertical scrolling and actual native window resizing. No user document input/edit/save; validation app exited. Application0.2.0build2 and Xcode project unchanged. The current Lens Blur work is included in this package. Evidence, checkpoint208.

Implemented iris/depth/highlight/noise controls with native preview, focus picking, local history, one commit and API support. Live mask/channel references remain editable; invalid sources or source deletion reject. Native38 and Actions10 preserve settings. Adobe excludes Lens Blur from Smart Filters, so Photato's editable version is explicitly a native extension.

All53 focused and1990 full optimized tests pass. Early failures, including a real background stack overflow in nested Smart Filter mask dispatch, were preserved and repaired. Offscreen layout was inspected. Production packaging was batched with the user's208 title/overflow fixes; the combined208 universal package now verifies. Full Photoshop parity remains open. Evidence.

The maintainer explicitly resumed development. Smart Sharpen and Reduce Noise now have native controls, preview at Fit/100%, Cancel/local Undo, one document commit and editable Smart Filters. Gaussian sharpening and guided denoising follow the original Rust approach; Lens/Motion use actual native disk/line deconvolution. Tonal fades, JPEG-grid softening and additional RGB channel denoising are available. Native37/Actions9 and the shared Photato API retain the new settings. Exact Adobe descriptors and editable PSD remain unqualified and reject explicitly.

The first compile exposed grouped Observation properties; splitting them repaired it. Integration tests initially referenced two wrong API names; these were corrected with failures retained. All45 focused checks pass, including noise/edge behavior, blur direction, depth/alpha, desktop/API equivalence, history, persistence, cancellation and rejection guards. Both offscreen panels were inspected. An API review also caught unnecessary internal fields in the preview-state payload. The first full build was stopped and retained, then the payload and a public round-trip check were repaired before restarting. All45 final focused Debug and1980 full optimized tests pass. The universal macOS14+ package verifies after fresh extraction, including both architectures, signature, icon/licenses and optional model provenance. All1595 frozen inputs match the tested source;6 additions/19 modifications/0 removals are listed in changes02.json. Four protected files and754 original Rust hashes remain unchanged. Application0.2.0build2 and Xcode project unchanged. The next major workflow plan covers Lens Blur depth maps and iris controls.

Development record, scope and evidence.

Verified checkpoint206.

A brief resumed Smart Sharpen/Reduce Noise source investigation produced no application changes or new builds. The maintainer requested pause again; the goal is paused and checkpoint203 remains the last verified implementation. Saved the exact next-major work and opened the existing live dashboard against the current project. Its105 open broad packages include implemented capabilities still awaiting strict parity qualification. Source and package hashes remain unchanged.

Pause checkpoint, development record.

The maintainer paused development after the verified Filter Gallery checkpoint and asked to see remaining work. The master goal is paused. Preserved exact package/source identity and the next Smart Sharpen/Reduce Noise plan. A current expandable dashboard distinguishes81 major,21 minor and3 final broad packages from285 partial/360 pending command statuses and282 wired/443 unavailable menu commands. Existing functions still need qualification inside those broad packages, so these are not percentage-complete estimates. The October9 snapshot remains unchanged. No application source or package changed.

Pause checkpoint, development record.

The47 original artistic effects are now Swift kernels with a native gallery workspace: category thumbnails rendered from the actual layer, parameter and color controls, effect ordering/visibility, before-after preview/zoom, local Undo and one document commit. Smart Objects retain source pixels and editable effects. Existing native filter APIs and Actions/Batch share the same command; native36 and Actions8 prevent older formats from silently discarding Gallery metadata. Exact Adobe ActionJSON and editable PSD mappings remain explicitly unsupported.

The first compile found a duplicate decoder variable. New engine/workspace/API tests then passed; broader regression checks found older assumptions that every filter used native15 or supported Adobe/PSD descriptors. Those qualification lists were corrected. An independent adapter executed the original unmodified Rust kernels and helper bodies, producing47 synthetic default fixtures: the Swift results match every RGBA8 byte. This is source-port evidence, not Photoshop equality. A hidden-window image verifies readable controls and layout; it is not a live desktop check.

All42 focused Debug and1973 full optimized tests pass. The universal macOS14+ package verifies after fresh extraction, including both architectures, signature, icon/licenses and optional model provenance. All1589 frozen inputs match workspace/isolation;59 additions/20 modifications/0 removals are listed in changes01.json. Four protected files and754 original Rust hashes remain unchanged. Application0.2.0build2 and Xcode project unchanged; no installation, publication or commit. The next major family is Smart Sharpen/Reduce Noise; minor variants and exact numerical/cosmetic polishing stay deferred.

Development details, checkpoint, references.

Text can follow a saved path, fit inside a closed shape, use fifteen preset warps, or dynamically fit Block, Circle, Arch and Bow layouts. A native workspace retains rich text beside the curved preview, layout controls, local Undo, canvas preview and one document transaction. Logical-origin compensation prevents normalized glyph bounds from moving the text anchor or its mask. The native API exposes the same layout engine through text.layout and complete text descriptions. Native35 and Actions7 retain geometry; unsupported editable PSD output fails explicitly.

The first five compile attempts caught Core Foundation casting, a test initializer, Observation declarations/initialization, a mutable detached-task capture and API helper mismatches. Runtime checks then found two inconsistent HTTP input error codes and an older test still rejecting newly supported archive35. Each attempt and repair is retained. Offscreen diagnostics show all seven layouts; the hidden-window native sheet is synthetic evidence, not a live desktop check.

All 89 focused Debug and 1966 full optimized tests pass. The universal macOS14+ package verifies after fresh extraction, including both architectures, signature, icon/licenses and optional model provenance. All1530 frozen inputs match workspace/isolation;6 additions/27 modifications/0 removals are enumerated in changes01.json. Four protected files and754 original Rust hashes remain unchanged. Application0.2.0build2 and the Xcode project remain unchanged; no installation, publication or commit. Full T04/Photoshop equality remains open. Filter Gallery is the next major family; minor typography utilities and numerical/cosmetic refinements remain deferred.

Development details, checkpoint, references.

Vertical Type joins the T tool group with native editable point/paragraph text. Properties exposes OpenType features, variable axes and a language tag; the Glyphs panel pages installed fonts and inserts retained glyph identities at the text cursor. Font discovery and glyph insertion have typed APIs, while text creation/editing exposes the same options. The published Adobe text adapter accepts vertical orientation and small capitals through existing contract fields. Native34 and Actions6 retain advanced metadata; the bounded PSD subset retains orientation and represented flags and rejects metadata it cannot preserve.

The first two compile attempts caught CoreText option-set syntax and API range-type conversions. Focused runtime tests caught missing version34 reader allowlists. An initial ligature expectation used a font that did not provide that substitution on this host; an independent six-font probe established HelveticaNeue as the valid regression font. A new downgrade test needed property-list parsing. Final review repaired paragraph formatting loss on glyph insertion through shared desktop/API construction. Failed attempts and repairs remain individually saved.

All 70 focused Debug and 1959 full optimized tests pass. The universal macOS 14+ package verifies after fresh extraction, including both architectures, signature, icon/licenses and optional model provenance. All1524 source inputs match workspace/isolation;6 additions/23 modifications/0 removals are enumerated in changes01.json. Four protected files and754 original Rust hashes remain unchanged. Tests prove host native rendering, metadata/Undo/API behavior and source-derived codec round trips; no live desktop, independent Photoshop output or physical platform certification is claimed. Application0.2.0build2 and the Xcode project remain unchanged; no installation, publication or commit. T04 path/warp text is next; minor utilities and exact/cosmetic refinements remain deferred.

Development details, checkpoint, references.

Freeform and Curvature Pen now join the P tool group. Freeform previews sampled geometry, fits editable cubic handles on release, extends endpoints and cancels without history. Curvature clicks interpolate smooth anchors, double-click toggles corners, clicking the first point closes a contour and anchors remain draggable. The Paths panel exposes selection tracing with tolerance, foreground fill and current-brush stroke with optional pressure simulation. All share existing saved/work paths, vector masks, native persistence and Undo. Five typed API commands expose the same engines, geometry, settings and state. Rust marching squares/fitting provenance is recorded.

Two compile attempts caught a shadowed error assignment and a test whitespace error. The first runtime suite exposed a shared API guard that rejected selected paths; a narrowly scoped path-context option repaired that without removing channel/mask/busy/revocation protection. Preserved failed attempts remain under the200 run directory.

All100 focused Debug and1951 full optimized tests pass. The universal macOS14+ package verifies after fresh extraction, including both architectures, signature, icon/licenses and optional model provenance. All1518 frozen inputs match workspace/isolation;7 additions,12 modifications and0 removals are enumerated in changes01.json. Protected root app/ZIP, Xcode project, workspace preferences and754 original Rust hashes remain unchanged. Synthetic native events are functional evidence; the locked desktop was not re-probed. Full G04, exact Photoshop curve/pressure kernels, magnetic pen, multiple-anchor editing, advanced Fill/Stroke options, clipping exports and semantic Actions remain open. Next major breadth is multilingual/OpenType typography. No installation/publication/commit or version bump occurred.

Development details, checkpoint, references.

The legacy rectangle/ellipse fill-only mouse-up path now uses native live geometry shared by seven tools: rectangle, ellipse, triangle, polygon, star, line/arrows and custom shapes. Retained components support boolean drawing, individual corners and parameter editing; fills and strokes support none, solid, gradient and embedded pattern paints, with alignment/dash/cap/join controls. Native properties preview and cancellation, shape/path/pixel output, custom preset definition/import/export, U-group integration, native33 saving and Actions5 shape recording accompany three API commands. Rasterize Shape uses the existing native raster/API engine. Rust geometry provenance remains explicit; no Adobe artwork/presets are redistributed.

Initial compiler/fixture failures were preserved and repaired. A background stack overflow revealed that nested Frame commands allocated the large primitive command dispatcher twice; indirect shape enum storage helped but did not resolve it. Separating modular dispatch from the primitive switch fixed the underlying nesting problem without dropping protection validation. A reused dictionary-only API decoder also raised an Objective-C exception for mode strings; the shape decoder now explicitly supports typed JSON fragments. All failed runs and diagnostic stacks remain in the199 evidence directory.

All80 focused Debug and1944 full optimized tests pass. The universal macOS14+ package verifies after fresh extraction, including both architectures, signature, icon/licenses and optional model provenance. All1511 frozen inputs match the workspace and isolation;9 files added,26 changed and0 removed. Root app/ZIP, Xcode project, workspace preferences and754 original Rust source hashes remain unchanged. Native events and offscreen snapshots demonstrate functional integration; locked-session native chrome/text does not fully render in those snapshots, so no live visual qualification is claimed. Full editable PSD/.csh/gradient cross-profile transfers and precise Adobe output/default parity remain open. No version bump, installation, publication or commit occurred.

Next is the missing major Pen/Paths workflow. Fine shape rasterization/default/cosmetic refinements remain deferred under the maintainer's major-first instruction.

Development details, checkpoint, references.

The native person picker now selects hair, face skin, body skin, clothes and accessories, independently or together, for selected people. Feature probability maps intersect Vision person instances; the existing selection modes, Hard Edge, refinement, Undo/Redo, Actions4 and native32 archive paths remain shared with the API. Missing or failing optional model resources leave whole-person selection available and disclose feature availability/errors. Fine facial labels remain unavailable.

Google's official Apache2.0 MediaPipe multiclass256 model was pinned by source SHA, with embedded class, normalization and SOFTMAX metadata verified. An independent bounded graph converter produces a macOS14 Core ML MLProgram; the deployed app uses only Swift and Apple frameworks. Offline Python/TensorFlow tools regenerate the ignored resource and record provenance. Twelve comparisons, including photographs on CPU/all compute, match original-runtime classifications within declared numerical tolerances. The first converter failed on a scalar reduction axis; the first Swift build failed actor isolation. Both failures and passing repairs are preserved. Actual Swift inference matches original photo probabilities within0.000006974, and one/two-person selection/save/Undo checks pass. Native overlays were inspected; no pixel-perfect Adobe or live-desktop claim is made.

All61 focused Debug and1933 full optimized tests pass. The universal macOS14+ package includes197 Select People and the native feature model; fresh extraction verifies both architectures, signature and model provenance. Xcode Debug build also passes. All1502 frozen inputs match the workspace/isolation. Seventeen newly covered inputs include existing NOTICE/.gitignore, generated native resources and new tooling; ten previously covered inputs changed and none were removed. NOTICE/.gitignore were modified, not newly created. The Xcode project deliberately gains a verified optional model resource phase; original bytes are retained. Root app/ZIP, user settings and754 original Rust hashes remain unchanged. No version change, publication or installation occurred. Independent platform, exact/model/default/persistence and live UI qualification remain open.

Next is G03 live shape drawing/editing, with native UI, history, persistence and API as one workflow. Existing rectangle/ellipse/path foundations and original Rust live-shape code can be reused; proprietary shape-library assets will not be copied. Fine semantic-mask and numerical/cosmetic refinement remains deferred under the major-first scheduling instruction.

Development details, checkpoint, references.

The native Object Selection options now open a person picker backed by Apple's macOS14 person-instance request. It detects people separately from ordinary foreground objects, creates bounded thumbnails and previews actual masks on the canvas. Choose one or several people, apply New/Add/Subtract/Intersect with optional Hard Edge, or hand the resulting selection to Select and Mask for manual refinement. Hover, detection and picker state do not dirty the document; applying the union uses one Undo and Actions4 explicit coverage. Native32 remains unchanged.

Three matching APIs expose detection, hover and selection, with optional full-canvas UInt8 mask export and96px PNG thumbnails. Strict cache IDs, source/sample/layer/tool invalidation and cancellation/read/close/revocation guards keep results tied to the current image. Empty detections return an empty ready list; model failures remain visible. Hair/skin/facial features are explicitly unavailable because the Apple request does not provide those semantic labels. No new Adobe route or model equality is claimed.

The first compile found a SwiftUI binding through an immutable workspace reference. A mistakenly gated repair command did not apply before the second attempt; both failed logs remain. Explicit get/set binding repaired it. Seven new imaging/workflow tests plus shared selection/API regression coverage pass. Offscreen overlays are readable, but some unshown native controls remain blank, so full live/control rendering is not qualified. The desktop remains locked and was not re-probed.

All46 focused Debug and46 optimized tests pass;9 optimized menu checks also pass. Real local Vision finds1 person in a portrait and2 in an overlapping two-person photo; selection, source retention, native save and Undo/Redo succeed. Latest full1920-test/universal baseline196 excludes197. Timings in the model report include selection/archive/overlay work, not just inference. NASA images stay in local evidence with attribution/use provenance; they are not bundled or published. All1485 frozen inputs,754 original Rust hashes and four protected files verify. Five files added, nine modified inputs, none removed. Xcode project/version/root and installed apps/settings remain unchanged. Broad/full/universal qualification stays batched. Next: evaluate and verify a suitably licensed semantic model through native Core ML before exposing hair/skin/clothes classes; fine cosmetic/numerical details stay deferred.

Development details, checkpoint, references.

Object Finder now runs one local Vision instance analysis and reuses its masks while the pointer moves. The canvas shows the actual hovered mask; clicking selects it with New/Add/Subtract/Intersect modes and optional Hard Edge. A click during inference waits for the matching source. Selection-only changes reuse detection, while source edits, layer/tool switches, sample mode, refresh and document replacement invalidate it. The native options add Finder, Hard Edge, refresh, highlight color and cancellation; Escape also cancels detection. Manual rectangle/lasso and the earlier direct point detector remain available.

Three APIs expose detection, temporary hover and cached selection, including optional bounded raw masks for clients that draw their own overlay. Configuration and result/state schemas are discoverable. Cache identity prevents stale selection; native and HTTP paths share selection/history/Actions. Detection and hover never dirty the document. Native32 remains unchanged and recorded Actions4 stores resulting coverage, not an unverified adaptive detector. No new Adobe endpoint or semantic-model equivalence is claimed.

Three imaging tests and seven workflow tests cover hit testing, source/cache keys, hard edges/modes, repeated hover without repeated inference, native click/Undo/Redo/Actions, pending clicks, source/sample/tool/lifecycle invalidation, model failure, actual HTTP schemas/mask export/configuration/hover/select and invalid/stale/busy/refreshed/cancelled/revoked requests. The first build caught two test-helper access mistakes, preserved and repaired.70 focused tests pass. Escape received a dedicated synthetic event check. The offscreen canvas visibly shows the expected enlarged blue mask; several unshown native option controls still have blank interiors in snapshots, so complete control/live rendering remains unqualified and cosmetic work is deferred.

All70 final focused Debug and1920 full optimized tests pass. The universal macOS14+ package verifies and includes195 Mask All Objects. Real local Vision detect/hit/select/save/Undo succeeds. All1480 frozen inputs,754 Rust source hashes and four protected files verify. Five code/test files were added,13 inputs modified and none removed. Universal extraction verifies arm64/x86_64, macOS14 minimum, signature, version, licenses and icon. The Xcode project, root/installed app, user settings and version remain unchanged. Source and package identities are recorded in checkpoint196;195 evidence is annotated with this subsequent full qualification while its original checkpoint stays immutable.

The next major workflow is Select People. Adobe’s February23 workflow describes a thumbnail picker and whole-person/feature selection; the public Apple SDK supports person-instance masks on macOS14. It does not itself provide semantic hair/beard/skin parts. The saved plan requires capability/model verification and honest unavailable parts rather than generic shapes presented as precise selection. No live desktop re-probe occurred while the desktop remains locked.

Development details, checkpoint, references.

Mask All Objects now creates one editable masked group per locally detected foreground instance. This advances beyond the source Rust implementation, which explicitly combines all objects into a single mask. The native Vision adapter performs one inference and requests each actual instance independently. Groups are empty Pass Through folders above the original clipping family, ready for a targeted adjustment; original pixels, masks, hierarchy and document selection remain intact. Source layers may remain locked, but locked parents reject insertion.

The captured Layer menu and layer context menu now invoke the shared native command. The new layer.maskAllObjects API brings the catalogue to90 and exposes schemas, availability, limits and created group IDs. Both paths use prepared history transactions and preserve atomic failure on cancellation, revocation, invalid masks and resource limits. Native32 archives retain editable groups. Recorded Actions reports explicit unsupported status; no Adobe route or actionJSON conformance is invented.

Seven new workflow tests exercise multiple injected instances, all three native depths, source retention, targeted adjustments, archive/Undo/Redo, nested clipping placement, transformed inputs/locks, menus/context, native cancellation/reload and actual HTTP equivalence/schema/error/lifecycle/resource cases. The first test build failed on throwing/actor test syntax and was repaired. The second run had one partial-schema-helper assertion failure; the result envelope was correct, and its declared extension fields now validate independently. Both failed attempts remain preserved. A code review added a conservative padded-tile memory budget for thin canvases.

All82 focused Debug and82 optimized tests pass. Real Apple Vision inference succeeds on the1024×1024 icon with source retention and Undo/Redo. Latest full/universal baseline194 has1903 passing tests and excludes195. The real-model mask was inspected as the expected Photato icon silhouette; it is neither a real-photo multi-object accuracy study nor live Photoshop evidence. All1475 frozen inputs,754 original Rust files and four protected hashes verify. Five source/test files were added,12 inputs modified, none removed; exact lists are in changes01. No installed/root app replacement, publication, commit or settings mutation occurred. The Xcode project and version remain unchanged. Full qualification will be batched after the next major selection workflow.

Next is Object Finder with cached hover highlighting/click selection, refresh/cancellation, source invalidation, controls and API. People/body-part workflows and exact parity remain open. Details, checkpoint, references.

Focus Area now selects sharp regions using a native Swift translation of PhotoCraft's local Laplacian-energy detector, normalization, guided cleanup and upsampling. The source's range direction contradicted Adobe's documented interface, so the native controls deliberately increase strictness as range rises; manual zero selects the entire image. Auto range/noise estimates are transparent native heuristics, with exact Adobe algorithms/defaults still unqualified. Attribution preserves the original MIT/Apache provenance.

The existing refinement workspace supplies the preview, Add/Subtract brushes, view modes, local history and six selection/mask/layer/document outputs. Focus controls add Auto/manual range/noise and Soften Edge. Turning Auto off preserves the displayed estimate. Preview can show the unmodified image. Select and Mask handoff keeps corrected coverage in the draft without changing the source until OK. Native document reload/close cancels pending analysis and cannot commit late results.

Select > Focus Area is bound in the captured menu position. The new selection.focus API uses strict settings/stroke schemas, requested/effective workspace state, shared native preparation/history and existing new-document permission/revision/lifecycle guards. Selection output records coverage in Actions4; nonselection output remains explicitly unsupported for recording. Native archive32 and the Xcode project are unchanged. No dedicated Adobe endpoint or focus actionJSON conformance is claimed.

The first core and integration runs passed. Expanded controls exposed a Swift exclusivity compile error; the failed attempt is preserved and the settings copy repaired. Code review also found hard-mask output could resurrect discarded tiny components at the soft-field threshold; hard output now uses cleaned binary labels, with a focused regression. Six core and seven new workflow tests cover sharp/blur/noise/flat/depth/cancellation, six native/API outputs, source and archive preservation, transforms/locks, sampling independent of prior selection, controls/brush/handoff, new-document/read/close lifecycle and invalid/stale/busy/revoked requests. The offscreen synthetic preview is readable; it is not live desktop evidence.

All83 final focused Debug and1903 full optimized tests pass. The universal macOS14+ package verifies and includes193 Sky workflows. All1470 frozen inputs, four protected files and754 original Rust hashes verify. Fresh extraction checks both architectures, macOS14 minimum, signature, version, licenses and icon. No installed/root app replacement, publication, commit or user settings change occurred. The original full Photoshop objective remains active. Next: Mask All Objects with separate editable per-object mask groups, followed by broader object-selection workflows; numerical/cosmetic refinements remain deferred.

Development details, checkpoint194, Focus Area references.

Select > Sky now runs the source-derived detector in Swift. Edit > Sky Replacement opens a native preview with imported skies or a raster layer source, sky placement, manual Add/Subtract mask brushing, edge refinement, sky brightness/temperature and foreground color/light controls. Output preserves the original layers and either adds editable masks/transforms/adjustments or a merged duplicate. The user sky library persists atomically and reports invalid files instead of overwriting them. The classical detector is not represented as Adobe AI, and no proprietary sky assets were copied.

Three Photato commands expose selection, replacement and sky-library management with strict discovery schemas, observable state, document/library revisions and the same prepared history path as the desktop. Select Sky records explicit coverage in Actions4; replacement recording remains visibly unsupported. The Adobe contract has no dedicated sky route. Native archive32 and the Xcode project remain unchanged.

The development record preserves failed compilation, test assumptions and a metadata-validation defect that blocked output. The attempted arbitrary sourceTags metadata was removed; existing native layers retain editability. Follow-up tests verify no-sky/manual fallback, all depths, canvas gestures, preview/local/document Undo, read/close cancellation, native/API equality, valid source-layer strokes, selection combinations, library corruption and stale/busy/revoked requests. The only retained numerical discrepancy is Float32 duplicate recomposition at up to2.98e-8 in the synthetic fixture; integer-depth samples match. The functional tolerance is1e-7, with exact bytes explicitly deferred under the maintainer's major-first priority. The renderer was not changed to chase that detail.

A documentation helper used the wrong CSV column and partially wrote the command matrix. The partial file was preserved; reconstruction from earlier backups/update blocks exactly matched final192's recorded hash before applying the one intended change atomically. All645 prior rows remain. The first recovery attempt stopped before writing because an obsolete626-row assertion failed; both helpers remain evidence.

All113 focused Debug and113 optimized tests pass. The universal macOS14+ package verifies. Last full regression is1876 passing tests at192; the next major batch will broaden again. All1464 frozen inputs, four protected files and754 original Rust hashes verify. Fresh package extraction confirms both architectures, macOS14 minimum, ad-hoc signature, licenses and icon. The offscreen synthetic preview is readable; no live desktop test was performed because the latest authoritative desktop state remains locked. Exact/model/preset/Actions/full-context/platform requirements remain open. Next is Focus Area, followed by Mask All Objects; numerical and cosmetic work stays deferred.

Development details, checkpoint193, sky references.

Object Selection now supports rectangle/lasso initialization through native graph cut and clicked-object targeting through Apple's local Vision adapter. Quick Selection follows image boundaries from painted seeds. Selection Brush paints editable soft coverage with a colored overlay. The graph, mixture model, geodesic costs and boundary refinement were translated from the preserved MIT/Apache PhotoCraft sources into Swift, with attribution and native cancellation/work limits. Source images remain unchanged; existing masks, history and Select and Mask workflows consume the result.

Four typed API commands expose configuration and all three tools through the same native transaction, with discoverable state/result schemas and request lifecycle guards. Actions version4 retains explicit coverage on its original canvas; replay does not silently redetect objects. Native archives remain32. Tests include independent exhaustive small-graph cuts, textured segmentation fixtures, reduced-resolution recut, offscreen/synthetic interaction, soft coverage at8/16/32-bit, current/composite sampling, cancellation and native/HTTP equality. No test attempt failed; one stale-context patch made no changes and was reapplied correctly. Validation also corrected stale overlays on tool changes and the API's omitted Object Selection mode fallback.

All155 broad focused Debug checks,7 final dedicated workflow checks and1876 full optimized tests pass. The universal macOS14+ package verifies and includes191 Adjustment Brush. All1455 frozen inputs, four protected files and754 original Rust hashes verify. The Xcode project remains present and unchanged. Source deltas, build/signature evidence and prior attempts are retained. No live desktop qualification was possible because the last authoritative desktop state remains locked. Photoshop byte/model equivalence, broader finder/People workflows and platform qualification remain open. Continue major workflow breadth with Sky Selection and Sky Replacement.

Development details, checkpoint192, selection references.

Adjustment Brush creates a masked adjustment on its first stroke and paints further coverage onto that editable mask. Fifteen native adjustment types reuse the existing engines and Properties editors. Add/Subtract, object clicks, overlays, inversion, replacement, New Adjustment, density/feather and brush controls form one native workflow. Original pixels remain unchanged. The on-device Vision integration selects the foreground instance at the clicked point; synthetic detector/label-buffer tests validate the new path without claiming live inference qualification.

Four Photato commands share the native engine, strict schemas, session state and transaction/history behavior. Native/API mask refinements are equivalent. Recorded Actions version3 preserves brush requests, semantic layer references, explicit object coverage and replacement operations; older action files remain readable. The captured factory Frame/K binding is retained despite conflicting newer Adobe prose; Adjustment Brush has no invented shortcut. No dedicated Adobe masked-paint endpoint is claimed.

Validation found and fixed a missing shared const-schema rule, outdated command-count assertions and an out-of-canvas test fixture. Final API review corrected an assumed mask endpoint by adding density/feather operations and updated action-library version descriptions. Failed attempts remain saved. All156 focused Debug and156 focused optimized checks pass. Full regression and universal packaging are batched with the next major selection increment; the last verified package190 does not contain191. All1444 frozen inputs,754 original Rust files and four protected files verify. Photato.xcodeproj remains present/unchanged. The desktop remains locked; no live UI comparison or physical platform qualification is claimed. Full presets, newer adjustment types, exact pixels/models and richer Adobe compatibility remain open. Major feature work continues with Object Selection, Quick Selection and Selection Brush; fine numeric/cosmetic work waits.

Development details, checkpoint191, Adjustment Brush evidence.

Pencil/Auto Erase, Color Replacement, Mixer Brush, Pattern Stamp, Background Eraser and Magic Eraser now use the shared native brush, selection, layer protection and history infrastructure. Factory B/S/E toolbar groups expose their controls. Mixer paint wells update only after successful commit; sampling, load/clean and automatic choices share native/API behavior. Aligned Pattern Stamp retains its phase. Brush/Pencil create an ordinary transparent layer when painting above nonraster content. Masks and grayscale channels work where applicable, including transformed Smart Filter mask coordinates.

Three typed API commands expose configuration, painting and Mixer state. Tests cover visible previews, Cancel, Undo, source preservation, archives, settings, protected/transformed targets, native/API equivalence and invalid/busy/stale/revoked requests. Validation repaired a real no-op tile allocation, an existing sampler visibility boundary and two erroneous test helper/target assumptions; failed logs are retained. All 184 focused Debug and 1851 full optimized tests pass. The universal macOS 14+ package verifies. The original Rust, root/installed app and user settings remain unchanged. The desktop remains locked, so offscreen and synthetic-event tests are not live UI qualification. Full Adobe brush-resource jobs, new-tool Actions/Batch recording, physical wet-media behavior and exact Photoshop output remain open. Major feature breadth continues with Adjustment Brush; secondary controls and numerical/cosmetic refinements wait.

Development details, checkpoint190, paint-tool references.

The circular painter now has an optional native dynamics engine, with seeded spacing, custom tips, shape/scatter/color/transfer/texture/dual behavior, flow, smoothing, pose, symmetry and timed airbrush strokes. Modeless Brush Settings and Brushes windows, factory menus/F5 and the options bar make the configuration usable while painting. Canvas previews render the same frozen stroke as the final undoable edit, preserving selections, placement and supported mask/channel targets. Presets save atomically in the native format or the supported ABR subset; twelve generated presets contain no Adobe-owned assets. New typed APIs expose configuration, preset management and painting; advanced Actions use version 2 to prevent old readers from silently dropping settings.

Validation found and repaired analytic test expectations, an API schema concurrency error, invalid Smart Object/mask fixtures, a preview scheduling race and a genuine nested-command stack overflow caused by large inline brush settings. Immutable indirect settings preserve value semantics and the wire format while keeping command values small. Every failed attempt and the crash report remain saved. All 103 focused Debug and 1834 full optimized tests pass. The universal macOS 14+ package verifies. Offscreen layout and synthetic AppKit events are separate from live desktop/tablet evidence; the desktop remains locked. The current Adobe brush-resource job path, physical bristle simulation and exact Photoshop output remain open. Next major batch: Pencil, Mixer Brush, Color Replacement, Pattern Stamp and the two missing erasers. No source publication, installed/root app replacement or user-settings change occurred.

Development details, checkpoint189, brush references.

Perspective planes, related-plane edits, perspective paste/clone/brush, local preview/history, native32 and a typed API now share a Swift prepared edit. Seven new source/test files and18 changed files are enumerated in the run manifest; none removed. The core derives from the original Rust plane and paste/clone geometry with native brush support. Failed attempts exposed a conversion-signature error, an Observation declaration restriction, a cross-test-target helper reference and a Float32 renderer/document-depth mismatch; all repairs and failure logs are preserved. The final117 focused Debug checks pass, including native/API agreement and cancellation. The full1816-test optimized suite and universal package subsequently pass for steps186–188. A documentation helper used the wrong CSV field name; its partial output was retained, the complete matrix restored and the edit reapplied without touching frozen build inputs. Secondary tool/Actions/PSD and exact/live/platform gaps stay open. The offscreen view is layout evidence only. Full record.

Straightening now works through a native constraint workspace with lines, polygons, individual edge orientations and five projection choices. The Swift solver ports the source camera/mesh approach, with an explicit cylindrical panorama and bounded geometry cache. A shared input helper keeps Lens and Wide Angle coordinates aligned with placed Smart Objects and preceding filters. Native controls, history, native31 persistence, direct API and recorded Actions/Batch share the same correction engine. The first integrated17 tests and final107 focused regression tests all pass; catalogue archive/identity/unsupported-PSD expectations were updated before broad regression. No failed test attempts occurred. The offscreen image verifies preview/overlay/layout only. Exact/live/profile/PSD and performance qualification remain open, with optimized/universal work batched after Vanishing Point. Full record.

Lens Correction now shares its typed Swift geometry and settings across native controls, Smart Filters, direct API edits and recorded Actions/Batch. The workspace includes correction/profile controls, straighten/distortion gestures, grid/navigation, preview/Cancel and local/document history. The original Rust calibration estimates are labelled as generic; no manufacturer database is claimed. The vignette midpoint follows the documented Adobe direction. Integration repaired a throwing loop, value-access conflict, a test-only Equatable assumption and legacy tests that wrongly expected identity defaults to change pixels. Smart Object geometry now resolves the actual placed/prior-filter input. All97 final focused Debug tests pass. Broader packaging is batched with Adaptive Wide Angle and Vanishing Point; the current universal candidate remains step185. Exact/live/platform/profile/PSD gaps remain open. Full record.

All five Blur Gallery tools now share editable source-relative geometry, a native preview workspace, local/document history and Smart Filter persistence with the API. Spatial blur follows the original Rust Gaussian-level approach; path/spin use premultiplied sampling. Bokeh/noise and bounded spin strobes extend the core workflow. Compiler integration failures, stale archive/PSD tests and an action descriptor that incorrectly accepted defaults were repaired and preserved. A single-flash invariant exposed a sampling edge case and drove a functional repair. Offscreen layout was inspected but does not prove live behavior. Exact Photoshop output and richer subfunctions remain open while work proceeds to major lens/perspective workspaces. Full record.

Frames now retain an editable boundary separately from image contents. Native K tool drawing, type/shape conversion, fitting, replacement and independent transformations share one-step history and API commands. Closed text contours preserve counters, empty frames show placeholders and optional strokes, and source bytes survive transforms. Native28 preserves metadata; PSD writes reject instead of dropping it. Three compilation attempts exposed accessor/visibility/glyph/concurrency issues and their preserved repairs preceded passing module and140 integration checks. No live desktop pass is claimed. Minor refinements are deferred while major workflows remain missing; Blur Gallery is next. Full record.

Artboards now form a complete basic multi-layout workflow: create, convert layers/groups, move/resize/duplicate, edit backgrounds/guides, save native27, and export separate files or a multipage PDF. Native controls, Photato commands and published Adobe jobs share the core metadata/clipping engine. Negative coordinates rebase physical pixels without resampling; extraction retains source layers and gradients. Compilation repairs and an outdated archive-version test expectation are preserved in the detailed record. Exact Photoshop output, richer contexts, PSD interchange and Frames remain open. No live interaction is claimed while the desktop is locked. Full development record.

• Previous turn classified as progress: Perspective Warp,92 Debug/92 optimized checks, universal package and development audit verified. Rechecked all1364 source01 inputs, final ZIP and four protected-state hashes. Prior workers terminal. Begin AUT01 native action recording/replay and batch processing, sharing native transactions and both API contracts where defined. Full Photoshop parity remains open. Evidence: [local evidence archive]. Original Rust, root/installed build and user settings remain protected.

• Implementation182a: Added core RecordedActions (portable active/named layer targets, bounded action/step format, common edit operations, explicit unsupported entries and atomic playback), history-linked recording at EditorSession/PreparedEdit commits, and Codable conformances for recorded value types. Undo/Redo moves recorded transaction groups with the same history identity; coalesced strokes retain their ordered commands. Added native persistent ActionLibrary, floating Window > Actions panel, recording/playback/step controls/import/export, injected test libraries and two Photato commands (actions.manage, actions.play) with state, schemas and revision guards. Both desktop and API use Command.action and the shared prepared transaction. Adobe execute-actions remains its separately documented descriptor subset; this native file format does not claim .atn compatibility. Batch remains the next part of AUT01.
• Investigation: inspected original Rust actions journal and batch implementation plus native history, prepared edits, menu and API paths. A few exploratory reads used non-existent guessed filenames; subsequent rg searches located the actual files. No worker was active during changes. Official Actions/Batch references are retained in step181 next-major-plan01. Current UI evidence remains offscreen-only because the last live desktop evidence was locked; no unlock re-probe.

• Integration01 failed during test compilation: the core-only test incorrectly referenced Imaging.Renderer and an unavailable invert filter kind. Repaired the fixture to compare core layer contents and use High Pass. Application changes remain unqualified until the rerun. Failure preserved in integration01.log/json.

• Integration02 compiled the application, then failed on optional chaining in the new history test; repaired to await the nonoptional task. Review also tightened recording of added content: layers with placement/extra metadata become explicit unsupported entries instead of losing those attributes. API import retains the existing 64 KiB request ceiling (60,000 base64 characters); native files remain bounded at16 MiB.

• Integration03 passes all59 focused Actions/core/history/API/menu/Adobe regression tests. Added Batch to complete the primary workflow: independent file/folder/open-document snapshots, native action picker, output format/JPEG quality/suffix, progress/cancel/stop-on-error and per-file results. Shared ActionBatch uses existing decoding/encoding and atomic staged writes, publishes new files with exclusive hard-link creation, preserves existing outputs/originals and removes staging files. The API adds actions.batch/actions.batch.cancel for shared snapshots in the separately approved local-save folder, with source revision/sharing/save-permission guards immediately before each publication. Existing Adobe execute-actions resource jobs remain separate. Added per-step action resource validation for API and batch playback, then focused Batch tests. No worker was live during these edits.

• Integration04 failed compilation because the newly added per-step validation closure shadowed the action format validator. Qualified the format call as self.validate(); preserved the failed log before rerunning.

• Integration05 failed on a missing PhotoCraftImaging import for the shared-source schema in AutomationBatch; added the import. Extended the recording-limit guard to layer-selection-only sequences so reaching the limit always leaves a blocking diagnostic rather than silently dropping a target change.

• Integration06 passes all64 focused tests. Visually inspected the generated Batch PNG: layout bounds are present, but offscreen AppKit controls are incompletely rendered; this is not a live visual pass. Added Actions/Batch reference manifest, API guide/schema notes, diary/status/plan summaries and partial command matrix entries. Four new Photato commands bring the catalogue to66; menus retain802 entries with237 bound/488 unavailable and102 primary/8 alternate shortcuts. Begin frozen full optimized regression and universal packaging. No source/test changes will occur while the worker is live.

• Documentation01 failed while writing the command matrix because its columns are swift_status/evidence, not status/notes. Preserved the partial output, restored the complete step178 snapshot and replayed the exact documented179/180/181 row updates before applying the two182 entries. All645 command rows are retained; reconstruction and hashes are in documentation-repair01.json. Completed the API guide and current phase plan. The optimized/package worker remained frozen on1374 application/test inputs; no build input was edited.

• Matrix recovery qualification: the reconstructed645-row matrix differs from the previous inventory hash; exact prior bytes are not claimed recovered. The preserved snapshot and179–181 update scripts recover the complete row structure and documented feature changes; any unpreserved wording difference remains unknown. Current feature rows are requalified with their actual evidence. The partial write, reconstruction and original recorded hash are preserved.

182 final qualification: All64 focused Debug and1759 full optimized tests pass. The universal macOS14+ package verifies. Zero failures. All1374 frozen inputs match in the workspace and isolated build; four protected hashes and754 Rust source hashes are unchanged. ZIP extraction verifies arm64/x86_64, macOS14 minimum, version0.2.0build2, signature/licenses/icon. 10 new inputs and15 modified, none removed; changes01.json enumerates them. No commits, publication, root/installed build replacement or user settings changes. Photato.xcodeproj remains present and unchanged. Verification: [local evidence archive]; checkpoint: docs/ACTIVE_CHECKPOINT_182.json. Live/physical-platform/exact parity and complete AUT01 remain open. Next major workflow: Artboards and Frames. Development evidence audit follows.

• Final development audit01 passed: 182 milestones, 36910 evidence files, 19312 logs and0 missing explicit references. Refresh/check02 repins this metadata. The inventory validates records, not Photoshop equivalence. All application/test/build workers are terminal. Major-workflow continuation: Artboards and Frames.

• Previous turn classified as progress: Puppet Warp,84 focused/1736 optimized tests and universal package verified. Rechecked all1357 source02 inputs, final ZIP and four protected-state hashes; prior workers terminal. Begin Perspective Warp: linked Layout/Warp planes, shared-edge homographies, straightening, native preview/history, retained Smart Filter/native26 and API. Exact/full Photoshop parity remains open. Evidence: [local evidence archive]. Original Rust remains read-only. No root/installed build replacement or user settings changes.

181 implementation01: Added Perspective settings/planes/locks, linked-corner and shared-edge homography geometry, single-plane inverse sampling and bounded multi-plane tessellation using the existing WarpRaster sampler. Added native Layout/Warp plane drawing/dragging/snapping, straightening/edge locks, preview/cancel/local history and re-edit input display. Integrated retained Smart Filters, ordinary raster masks/history, native26, Photato schemas/state and explicit channel/Adobe/PSD guards. Updated all-kind fixtures before compilation. The edit script stopped at a mismatched AutomationFilters schema pattern; preserved its record and completed remaining integrations after inspection. No application tests/builds yet; every new path remains unverified.

181 oracle/tests: Original Rust oracle01 generated independent adjacent-plane/shared-edge/interior/exterior mappings and all three straightening outputs from unchanged geometry arithmetic (standalone serde derives omitted). Added eight workflow tests for oracle/continuity, linked dragging/locks, strict geometry/horizon rejection, HDR/masks/identity/history, native26/source retention/rasterization, filter composition, native Layout/Warp/Undo/cancel/re-edit/offscreen layout and real HTTP errors/equivalence/persistence. Compile/integration follows.

181 integration01: Core and geometry compile; native re-edit layout preview failed Swift exclusivity because it simultaneously read and replaced input.layers filters. Worker95674 exited1 before repair. Copy the preceding filter list into a local value before assignment. Put the native controls inside a scroll view to keep every action reachable at the fixed sheet size. Preserve failed diagnostics; runtime tests have not yet run.

181 integration02: All92 focused checks pass, including original Rust oracle/continuity/straightening, linked/locked handles, HDR/masks/native26/Smart Filter/history and actual HTTP stale/busy/invalid/channel rejection. Inspected [local evidence archive]: two planes, shared corners, locked edge, preview and controls render coherently. This is offscreen evidence only; last actual desktop remains locked. Worker81243 terminal0. A read-only transform review found raw saved lock settings should be canonicalized before a non-axis transform releases their axis lock. Preserve that effective geometry and add a regression assertion, then freeze final inputs. No physical-platform/live/Adobe-pixel claim.

181 integration03: All92 final Debug focused tests pass after the locked-plane transform preservation repair. Worker71233 terminal0 before freezing. Run the same92 optimized checks and universal packaging in isolation. The immediately previous step180 full suite passed1736 tests; broader full/platform qualification remains batched rather than repeating it for this major-workflow increment. Original Rust and protected root/project/user-state inputs remain unchanged.

181 final qualification: All92 focused Debug and92 optimized focused tests pass. The universal macOS14+ package verifies. Zero failures. Clean ZIP extraction verifies arm64/x86_64, macOS14 minimum, version0.2.0build2, ad-hoc signature and packaged Info.plist/licenses/icon. All1364 frozen inputs, four protected-state hashes and754 original Rust hashes match. Seven new inputs and24 modified, none removed; [local evidence archive] identifies every source/test/asset change. No commits, publication, root/installed build replacement or user settings changes. Photato.xcodeproj remains present and unchanged. Verification: [local evidence archive]; checkpoint: docs/ACTIVE_CHECKPOINT_181.json. The previous step1801736-test full suite remains historical evidence; this increment runs92 Debug/92 optimized focused tests.

• Menu report:802 entries,235 bound/490 unavailable,102 primary/8 alternate shortcuts. Read-only next-work planning identifies native Actions and Batch as missing major workflows; original Rust journal/UI/batch sources and current Adobe guidance recorded in next-major-plan01. No Actions application source changed during the frozen build. Development audit follows under [local evidence archive]. Full G02, exact Photoshop output, richer contexts/interchange and live/platform qualification remain open.

• Final development audit01 passed: 181 milestones, 36865 evidence files, 19304 logs and0 missing explicit references. Refresh/check02 repins this metadata. The inventory validates records, not Photoshop equivalence. All application/test/build workers are terminal. Major-workflow continuation: Actions and Batch processing.

• Previous turn classified as progress: native Warp,55 focused/1727 full optimized tests, universal package and final evidence audit verified. Rechecked all1349 source02 inputs, the ZIP and four protected-state hashes. All previous workers terminal. Begin the next major workflow: coverage mesh, pin-driven deformation, native preview/cancel/history, retained Smart Filter editing and API coverage. Exact/full Photoshop parity stays open. Evidence: [local evidence archive]. Original Rust remains read-only; no user settings/installed or root build changes.

180 implementation01: Added Puppet pin/settings/coverage mesh, cotangent ARAP/ASAP solver with banded Cholesky/CG fallback, and bounded source/HDR rendering. Factored WarpRaster’s existing triangle mapping/sampling for reuse without changing regular Warp semantics. Added native Puppet workspace with pin placement/drag/removal, rotation/depth, mesh/mode/density/expansion, local history and preview/cancel; integrated the factory Edit command and editable Smart Filter rows. Extended filter.apply/smartFilter.set schema/state, native25, source-preserving filter extents and pin transforms, and explicit Adobe/PSD unsupported guards. Ordinary linked mask settings are preserved through the shared Warp path. No tests/builds yet; source/model/renderer, pipeline and UI/API changes remain unverified. Original Rust unchanged.

180 integration01: Application/core compiled on the first attempt and45 existing focused cases ran. Two assertions in the all-filter history fixture assumed a default Puppet program changes pixels; empty pins correctly produce no change. Update that fixture to use two real pins, preserving the failed log. Worker65226 terminal before edits. Add independent Rust solver fixtures and new workflow tests next. Reflections now negate retained fixed-pin rotation while transforming pin positions.

180 fixtures/tests: Original Rust solver oracle01 succeeds using unmodified Csr/BandChol/PuppetSolver arithmetic and synthetic5×4 mesh/three pins, fixed rotation, all three modes and depth order. Added eight workflow tests for oracle/constraints, disconnected components, identity, coverage/density/expansion, malformed programs, all-depth HDR/masks/history, editable/native25/replace/rasterize/transform/order/mask/opacity, native workspace and actual HTTP guards/persistence/equivalence. Added pin translation to layer alignment/distribution and attribution. No live Photoshop/app UI checks attempted; last desktop evidence remains locked.

180 integration02: All53 focused tests executed; three assertions failed only because separately appended Smart Filters receive different UUIDs. Compare documents after normalizing that one generated identity, preserving pixels/settings/source/history checks. The independent Rust solver, HDR/masks, native25 and other geometry checks pass. Worker terminal1 and no Swift processes remained before repair. Added actual HTTP retained-filter re-edit/Undo and offscreen workspace layout capture; gated duplicate preparation on an existing preview. Fixed initial rotation seeding for outside-mesh pins to use the bound mesh point, as upstream does. No new live UI evidence.

180 integration03: All53 focused checks pass. Inspected [local evidence archive]: preview, deformed mesh, pins and controls render coherently; this is offscreen, not live UI. A workflow review found that placing another pin after deforming must map its visible position back through the mesh. Added inverse barycentric placement using topmost triangle depth order and a regression assertion. All source/test edits followed worker57449 terminal0.

180 integration04: All53 focused tests pass, including inverse pin placement after deformation. Worker52141 terminal0 before the final API capability-text correction (explicit Puppet PSD limitation). Updated status/README/plan, diary index, API guide, three capability/reference manifests, command matrix and G02 record. No removals. Freeze inputs and run full optimized regression plus a universal package in isolation; root build and user state remain protected.

180 frozen review: While full optimized source01 tests run, read-only review found two legacy all-filter fixtures also need explicit Puppet programs and exclusion from the unimplemented Adobe-descriptor loop. A separate API correctness issue needs repair: generic channel filtering can accept Puppet through a grayscale proxy, whose output drops the changed layer origin. Reject that unsupported target at the shared channel command boundary, matching the desktop availability guard, and test atomic failure. No application/test inputs changed while worker80504 remains live; finish and preserve the attempt before repair.

180 full01/repair02: All1735 optimized tests executed with11 failures (2 unexpected). Four are in the two predicted legacy fixtures (default empty program is a no-op; Adobe Puppet descriptor is unsupported); inspect and repair the remaining failures before claiming final qualification. Full01 exited1, worker80504 terminal before repairs; no package was produced for source01. Corrected those fixtures, added shared-core rejection of channel-only Puppet filtering, and added atomic core/actual HTTP422 regression coverage plus explicit unverified-descriptor rejection. Final focused scope now also includes core filter/channel and document-transfer tests. Preserve failed source01 and logs; freeze source02 after focused validation.

180 integration05: Expanded focused tests pass, including actual channel.edit HTTP422 with unchanged document. Worker47430 terminal0. The remaining7 full01 failures are the analogous Smart Filter all-kind/native-version/PSD fixtures, not additional engine failures. Add nonempty Puppet pins/native25 expectations there and exclude explicitly unsupported editable Puppet PSD from the supported-descriptor loop (dedicated rejection remains tested). Extend focused coverage to SmartFilterTests and publish the channel-filter restriction in capabilities. No unsupported operation is reclassified as supported.

180 integration06: All84 expanded Debug tests pass, including core filters/channels, imaging Smart Filters/PSD, native25 downloads and the new Puppet workflows. Worker57852 terminal0. Freeze source02 (five changed inputs from source01) and rerun the full optimized suite/universal packaging in the same isolated checkout. Earlier failures and source01 remain intact.

180 final qualification: All84 focused Debug and1736 full optimized tests pass. The universal macOS14+ package verifies. Zero failures. Clean ZIP extraction verifies arm64/x86_64, macOS14 minimum, version0.2.0build2, ad-hoc signature and packaged Info.plist/licenses/icon. All1357 frozen inputs, four protected-state hashes and754 original Rust hashes match. Eight new inputs and26 modified, none removed; [local evidence archive] and [local evidence archive] name every source/test/asset change. No commits, publication, root/installed build replacement or user settings changes. Photato.xcodeproj remains present and unchanged. Verification: [local evidence archive]; checkpoint: docs/ACTIVE_CHECKPOINT_180.json.

• Menu report:802 entries,234 bound/491 unavailable,102 primary/8 alternate shortcuts. Read-only next-work planning covers linked Perspective planes/homographies/straightening and existing native primitives; no Perspective code was changed during the frozen build. Documentation audit follows under [local evidence archive]. Exact Photoshop output, live/platform evidence and the broader G02 gate remain open.

• Final development audit01 passed: 180 milestones, 36840 evidence files, 19298 logs and0 missing explicit references. Refresh/check02 repins this metadata. The inventory validates records, not Photoshop equivalence. All application/test/build workers are terminal. Major-workflow continuation: Perspective Warp.

• Verified all1342 source inputs and the final178 ZIP. Previous turn made concrete progress:79 Debug focused and1720 full optimized tests passed, universal package/evidence audit verified. Prior workers terminal0. Next major breadth: G02 Warp presets/Bezier controls, native preview/cancel/history, editable Smart Object placement and APIs. Original Rust, root/installed build, Xcode project and user settings remain protected. Evidence: [local evidence archive].

179 implementation01: Added Warp.swift preset/Bézier model and exact de Casteljau splits; WarpRaster.swift bounded triangle/UV renderer, HDR-aware premultiplied sampling and prepared history. Added Layer.warp, source-preserving Smart Object/filter rendering, native24 negotiation, explicit PSD export rejection, WarpWorkspace.swift native preview/draggable grid/local Undo and factory menu bindings, and AutomationWarp.swift typed settings/state/capabilities with the shared transaction path. Source: original Rust geom/warp.rs and algo/warp.rs; no upstream edits. This breadth pass explicitly rejects selections/vector masks/direct groups/type/shapes; conversion to Smart Object is available. PSD transport, anchor-conversion/split menu contexts, live UI and exact results remain open. No tests/builds yet. Preliminary reads included several guessed filenames that did not exist; repository searches located their actual modules.

179 integration01: Initial compile failed because Warp target validation referenced a nonexistent document.colorMode; CraftDocument currently represents RGB only. Worker98879 terminated before removing that redundant guard. Preserved the failed log/input manifest. Added custom-mesh scaling on Smart Object source-size replacement and updated existing API/archive expectation counts before focused tests. Original Rust explicitly calls the preset formulas approximations; record this rather than imply Adobe formula equivalence.

179 integration02: Compile exposed Swift exclusive-access overlap while remapping an unlinked mask. Worker23029 terminated; use a local MaskProperties value before assignment. Corrected the new test to use the actual SmartFilterEngine append API/mosaic filter. Added analytical translation/HDR, exact split/removal, Rust preset, source/native24/history/rasterization and native/API tests. Oracle01 succeeds for all fifteen presets in both orientations. Added tiny rounding tolerance at integer output bounds to avoid allocating an extra pixel from Bézier floating-point noise.

179 integration03: Core/imaging compiled; Swift Observation rejected multiple stored variables in single declarations in the new workspace. Worker6234 terminated before splitting the tracked declarations. Preserved the compile diagnostics; no runtime assertions ran.

179 integration04:54 focused tests ran; all core Warp/Rust/native24/mask/filter/history assertions pass. One UI test exposed duplicate initial preview refresh when its NSHostingView appeared after preparing the model, temporarily clearing the ready edit. Gate the view’s initial task on absence of an edit/in-progress render, await preparation in the offscreen check, and preserve a screenshot. Linked mask output now retains its original storage depth. Worker82116 terminal before edits.

179 integration05:54 tests ran; the new workflow’s native preview/commit/Undo and API edit/stale/busy checks pass. Three assertions in native-download checks failed because the test omitted the existing opt-in document-transfer permission (HTTP403); enable that permission in the fixture. Worker24052 terminal before repair. Added Warp clearing to the existing Reset Smart Object Transform command and regression coverage. Inspected [local evidence archive]: preview/grid and layout visible; offscreen system control text/background rendering is incomplete and is not live UI evidence. Last actual desktop evidence remains locked; no new live inspection attempted.

179 integration06: All54 focused tests pass, including six new workflow tests. Native preview/Cancel/commit/local and document Undo, actual HTTP equivalence/stale/busy/invalid errors, native24 negotiation/round trips, presets against unchanged Rust arithmetic, exact mesh split/removal and all-depth source/cache/rasterization checks pass. Updated development diary, README/status/plan, API/menu/Adobe manifests and G02 phase record; no feature-family closure claimed. Freeze final inputs and run the full optimized suite/universal build in a separate temporary checkout; root build117 remains untouched.

• Factory menu report confirms802 entries,233 bound/492 unavailable,102 primary/8 alternate shortcuts. Only Edit > Transform > Warp is a visible new factory command; the Rust Layer > Smart Objects > Warp alias is absent from the captured Photoshop menu and must not be counted as a second binding. Corrected reference metadata. Read-only next-work preparation maps the upstream coverage mesh/ARAP pin solver and Smart Filter integration; saved next-major-plan01, with no Puppet application code started during the frozen build.

179 frozen review: Found a data-preservation issue in ordinary raster Warp: sampling the effective linked mask and resetting its properties would bake density/inversion/feather and turn a disabled mask into white pixels. Smart Object source masks remain retained, but destructive raster Warp must also preserve editable mask state. Plan: warp neutral raw mask samples, retain the original properties and remap only its transform; add disabled/inverted/density/feather coverage. No application/test inputs changed while worker78698 is live. Finish the frozen candidate before the repair and keep its evidence separate.

179 mask repair02: After worker78698 terminated, preserved source01/full regression/universal candidate and repaired linked raster-mask storage: sample raw coverage with neutral controls, retain original enabled/inverted/density/feather/outside values, and reset only the derived coordinate transform. Added a three-depth disabled-mask round-trip/re-enable test. This prevents destructive mask loss; numerical feather matching remains deferred. Final Debug/optimized regression and packaging follow under new log names.

179 integration07: All55 Debug focused tests pass, including the new mask-state preservation test at8/16/32 bits. Source02 changes only WarpRaster.swift and WarpWorkflowTests.swift from the already-passing1726-test source01; old universal candidate retained as Photato179-candidate01.zip. Run full optimized regression and universal packaging again for the changed source, without claiming the earlier binary verifies the repair.

• Documentation validation parsed all updated JSON and preserved all command-matrix IDs/columns. The first diagnostic mistakenly expected647 CSV rows; actual baseline and current both contain646 including the header. Corrected the diagnostic by comparing baseline IDs; no rows lost. documentation-validation01.json records this failed assumption and passing check. Finalizer Python syntax validated.

• Final55 focused Debug and1727 full optimized tests pass,0 failures. Clean universal ZIP extraction verifies arm64/x86_64, macOS14 minimum, version0.2.0build2, ad-hoc signature, Info.plist/licenses/icon. All1349 frozen inputs, four protected-state hashes and754 original Rust hashes match. Seven source/test/fixture inputs added,20 modified,none removed; [local evidence archive] and [local evidence archive] name all changes across both freezes. No commits, publication, installed/root build replacement or user settings changes. Photato.xcodeproj remains present and unchanged. Final verification: [local evidence archive]; checkpoint: docs/ACTIVE_CHECKPOINT_179.json.

• Documentation/evidence audit follows under [local evidence archive]; record integrity does not establish Photoshop equivalence. All Swift/test/build workers terminal before final checkpoint. Next: Puppet Warp and Perspective Warp, maintaining major-feature breadth priority.

• Evidence-audit refresh01 stopped at its section-format assertion: the initial179 anchor lacked the required blank line before its heading. All179 anchors/headings existed. Added that blank line, preserving the failed audit log; rerun with unique refresh02/check02 outputs. No application/test/package inputs changed.

• Evidence refresh02/check02 pass:179 milestones,36,791 evidence files,19,288 logs and zero missing explicit references. All1349 final source02 inputs still match. Record this result in the checkpoint/reference manifest, then refresh03/check03 to capture the final documentation state. No source/test/package mutations or new functional work after verification.

178 release-full02: All1720 optimized tests pass,0 failures on frozen source02, including both Adobe job routes and thirteen new stack cases. Universal build continues in the same isolation; source/test/package inputs remain frozen until worker9394 terminates.

178 release-full01: The full optimized suite ran1720 tests; two assertions in DocumentIOWorkflowTests expected the old native22 boundary (23 rejected, advertised versions1…22). All other tests, including thirteen stack workflows, pass. Saved release-full01 unchanged; after worker30195 terminated, updated only those two legacy expectations to24 rejected/1…23 advertised. Frozen source02 differs from source01 only in that test file; production source and initial79 Debug evidence unchanged. Rerun full optimized suite before universal packaging.

178 integration04: All79 focused tests pass,0 failures, including13 new stack cases, both actual Adobe job interfaces, explicit created-share API updates, native23/all-depth persistence, source retention/child-save/Undo, mode replacement, file loading/cancel and revocation. Menu report802/232bound/493unavailable/102primary/8alternate. Worker28250 terminal. Freeze source01 and run the full optimized suite at this photo-workflow milestone, then build/verify a universal candidate in a new temporary isolation; preserve the root build.

178 integration03: Test compilation required an explicit MainActor annotation on the new local HTTP helper; preserved compiler diagnostics and annotated that helper after worker55521 terminated. Production implementation unchanged.

178 integration02:75 focused tests ran,23 assertions failed in two new tests. Original-Rust eleven-mode oracle, native23/all-depth round trips, per-instance replacement and remaining regressions passed. The alignment assertion incorrectly expected retained affine metadata although PhotoAlign bakes warps; replaced with independent overlap-pixel error/count checks. The API test reused AutomationTests.edit, which always targets the first share, while giving the newly created share’s revision. Added an explicit created-share request path instead of weakening stale guards. Added both real async Adobe routes, folder error/cancel, stacked child-save/Undo and API cancellation/revocation/busy/invalid tests. Worker81726 terminal before repair; saved failed log unchanged.

178 first validation/repair: oracle01.log preserves the Rust include! adapter failure (inner module documentation comments); regenerated distinct oracle02 adapter with comments normalized, leaving original arithmetic unchanged. integration01.log preserves the Swift compile failure: isolated rendering assigned get-only isClipped; corrected to stored optional clipped. No tests ran in that first attempt; waited for terminal worker66600 before all repairs.

178 implementation attempt01: Added ImageStackMode and ImageStack with eleven PhotoCraft-derived operators, retained editable photo sources, optional shared alignment and per-instance mode caches. Extended SmartObject/Engine/native archives to23, source replacement and shared-source validation; None restores compositing, RAW stack sources reject, PSD stack export rejects explicitly. Added native loading/Statistics workspace, fourteen factory menu bindings, creation/cancel/mode Photato commands and state/schema/native23 downloads. Added Adobe installed Statistics.jsx-derived applyImageStackPluginRenderer class descriptor subset through an injected native imaging renderer; captured source hash/protocol only. No proprietary code redistributed. New app/API tests and numeric fixtures follow before build.

Investigation notes: Adobe public image-stack help and installed scripts confirm11 operators, optional alignment, native Smart Object retention and32-bit support. Native baseline follows Rust population variance/normalized entropy/skewness/kurtosis;32-bit sum now preserves HDR range. These conventions and PSD input stack metadata remain unqualified against Photoshop. Guessed upstream model path and nonexistent AdobeActions.swift were corrected using file searches; no source deletion/rollback. Last live session remains locked; offscreen native tests will not be represented as live qualification.

• Previous turn made verified progress: HDR checkpoint177 passed67 Debug and67 final optimized focused tests, universal package and evidence audit. Verified1334 source hashes and final ZIP before continuing. Prior build/audit workers are terminal. Continue major-function breadth with persisted editable statistical stacks, native source loading, menus/history and APIs. Preserve full parity requirements and original Rust/root build/user state. Evidence: [local evidence archive].

• Initial source01 passes79 focused Debug and final source02 passes1720 full optimized tests,0 failures. The universal package and clean ZIP extraction verify arm64/x86_64, macOS14 minimum, version0.2.0build2, ad-hoc signature, matching Info.plist, licenses/attribution and icon. All1342 root/isolation inputs, four protected-state hashes and754 original Rust hashes match. Evidence: [local evidence archive] and docs/ACTIVE_CHECKPOINT_178.json. Eight inputs added,21 modified across two freezes,none removed; [local evidence archive] and [local evidence archive] name every source/test/package-input change. No commits, publication, installed/root build replacement or user settings changes. Photato.xcodeproj remains present and unchanged; synchronized groups discover the new Swift sources.

• Updated README/status/plan, API guide, command matrix, menu/Adobe/stack manifests, function phase record and chronological diary; previous checkpoints and failures retained. Read-only next-work preparation identifies source-space preset/Bezier Warp, then pin-based Puppet and connected-plane Perspective workflows. No179 implementation started. Full parity, PSD statistical interchange, native/live/physical-platform and exact numerical/UI gates remain open.

• Final evidence inventory refresh/check is recorded under [local evidence archive]; this checks record integrity, not Photoshop equivalence. All Swift/test/build workers terminal before final record.

• Previous turn made verified progress: Photomerge checkpoint176 passed1697 full optimized tests and universal packaging. Verified1322 source inputs and package identity before beginning HDR. Prior build/audit workers are terminal. Continue major-function breadth; original Rust/root build/user state remain preserved. Evidence: [local evidence archive]. Read original hdr.rs/tone.rs/photo_util.rs and official Adobe HDR workflow already saved in176 next-major notes. Implement actual bracket merge, alignment, radiance, deghosting and tone mapping with native UI/API/lifecycle; defer fine proprietary defaults and exact pixels while retaining the full goal.

• Added native HDR settings, exposure estimation, median-threshold alignment, weighted camera-response/radiance reconstruction, ghost removal and four tone operators; image pipeline uses explicit sRGB conversion, EXIF/manual/estimated exposures, opaque equal-sized inputs,32-bit radiance or16/8-bit output, and display-only preview exposure. Added independent HDR source/preview/window lifecycle with manual EV and native menu; Photato creation/cancel commands share the engine. The API edit generator initially stopped after creating AutomationHDRMerge.swift because it assumed creation preceded cancellation in the catalogue; corrected its matcher to the observed order and completed integration. No tests run yet. Original Rust unchanged.

• Added eight engine/native/API tests covering original-Rust radiance/response, estimated/manual/EXIF exposures, known translation, flat alignment, moving-object removal, four tone operators, all output depths/native/PSD persistence, source history, preview-only exposure, stale/cancel/revocation and workspace exclusion. Original-Rust oracle01 failed because the unused HdrToning shim retained serde derive macros; oracle02 removes those unused serialization derives, retains unchanged hdr.rs and original dense solver, and produces attributed synthetic fixtures. No ghost/tone stub is executed. Core response solver uses Apple Accelerate from Swift to avoid large dense unoptimized loops. Initial focused integration run follows.

• integration01 passes the full selected engine/native/API/menu regressions, including all8 new HDR cases. Added two workflow-level checks for actual shifted-bracket pipeline/border handling and folder import/preview/Cancel before freezing. Hardened dynamic-range reporting to divide luminance as Double, avoiding an unnecessary intermediate Float overflow. No output algorithm/fixture expectations were relaxed. Final focused rerun follows.

• integration02 ran58 cases with2 assertions failing in the new shifted-bracket pipeline test: MTB selected(−4,2) instead of known(−5,3), with3.76% scene difference. Its exclusion band gives adjacent candidates equal scores; added normalized intensity correlation to break equal-score plateaus, retaining displacement as final tie-break. Saved pre-repair math. Also corrected API numeric-bound storage from Float to Double so exact documented minima such as0.1 are accepted. Audit of the test filter found the name MenuParityTests did not match PhotoshopMenuTests: integration01 actually passed56 engine/native/API/path cases, not menu checks. Corrected the final filter; no menu qualification is inferred from those earlier runs. No test expectations relaxed.

• integration03 passes67 cases, including ten HDR workflow tests and all nine actual Photoshop menu tests. Known pipeline translation now recovers exactly and scene comparison passes. Final API review adds observable native preview exposure/source count/readiness to capabilities (presentation state, no image/sample changes), with a real HTTP assertion; also tests every documented numeric parameter boundary. Freeze after final focused pass, then optimized focused/universal packaging. Broader full regression remains batched after step176’s1697-test pass.

• integration04 passes66 of67 cases; the new capabilities assertion expected ready=true while the SwiftUI preview-exposure observer could start another asynchronous display render during HTTP. Production state is allowed to be busy. Preserve the failed test copy; assert coherent ready/rendering flags in the response, then await the current preview task and require ready=true with the same output document. This distinguishes legitimate in-flight presentation work from an invalidated/failed result. Rerun without production source changes.

• integration05 passes67 final focused tests,0 failures. Diagnostic HTTP state was rendering=true/ready=false and settled to ready=true afterward, confirming a presentation-timing assumption rather than lost output. Preserved final test/API generator scripts and a labeled reconstruction of the initial failed catalogue matcher. Frozen optimized focused tests and isolated universal packaging now follow; no source/test edits during workers.

• Frozen release-focused01 runs67 tests with2 assertions failing in the cancellation test: optimized3k-pixel merge can finish before the first5ms observation, leaving no live operation to cancel. All other cases pass. Preserved original frozen inputs/log and pre-repair test. Test-only repair enlarges the actual bracket images to512×512 for cancellation/revocation and observes every1ms; no fake worker or weakened cancellation assertion. No production source changes. Final source02 changes only this test; optimized focused rerun and package follow.

• release-focused02 passes67 optimized cases,0 failures, including actual larger-bracket cancellation/revocation. Only test input/timing changed from source01; all production inputs are identical. Universal package02 is running on frozen source02. The new API presentation fields are tested independently of whether preview work is currently in flight.

• Debug source01 and final source02 optimized focused runs each pass67 cases,0 failures. Only the cancellation test fixture/timing changed between snapshots; production source is identical. Universal package and clean ZIP extraction verify arm64/x86_64, macOS14 minimum, version0.2.0build2, ad-hoc signature, matching Info.plist, attribution/licenses and icon. All1334 root/isolation inputs, four protected-state hashes and754 original Rust hashes match. Evidence: [local evidence archive] and docs/ACTIVE_CHECKPOINT_177.json. No source deletions, commits, publication or user settings changes. Existing deployment project remains present and unchanged; synchronized source groups include the added Swift modules.

• Updated current README/status/plan, command matrix, API/menu/Adobe manifests, diary and classification; prior checkpoints retained. Read original stack.rs and source/loading/Smart Object stack-mode paths during frozen verification and saved the next-major plan. Full-suite regression is batched after176’s1697-case pass; exact Photoshop, difficult/production-size inputs and physical/live gates remain open.

• Final evidence inventory refresh/check is recorded under [local evidence archive]; this validates evidence paths/hashes, not Photoshop equality. No Swift/test/build worker remains.

• Previous turn is verified progress: Auto-Align source/package checkpoint175 passes all1,317 source hashes and ZIP identity. No prior build/test workers remain. Continue major-function breadth with native multi-file Photomerge creation, shared engine and APIs. Preserve original Rust/root build117/user state; exact/live/platform gates remain open. Evidence: [local evidence archive].

• Implemented native Photomerge pipeline in Imaging: flattened source snapshots, ColorSync conversion, shared alignment, expanded union canvas, optional shared blending/fill and independent hole-fill overlay when blending is disabled. Added file/folder/open-document workspace, cancellable preview, source-change validation and new unsaved document commit; factory Photomerge menu. Added document.photomerge and cancellation command, shared-source revisions, native transfer grant, source/lifecycle/revocation guards and observable operation state. Tests cover geometry/depth/profile/persistence/history, file batches, native preview/commit and API creation/cancel. No tests have run yet.

• Reviewed original photo_cmds.rs and current native lifecycle/transfer modules. Official Photomerge help found at repair-retouch/clean-restore-images/create-panoramic-images-with-photomerge.html after an outdated URL failed. The published API reference exposes its spec URL; web fetch of the spec failed, so retained pinned contract routes remain the authoritative local schema. It has no dedicated Photomerge route; no Adobe endpoint invented. Existing alignment/blend action tests will run as regression coverage. Several guessed local filenames were absent and were corrected by source searches; no source was removed.

• integration01 stopped at compile: a missing closing List brace nested subsequent declarations, and the window helper shadowed NSWindowController.owner with a narrower type. Fixed the brace and renamed the reference to documentController. Also bound preview readiness to the settings/name actually rendered, preventing stale commits before SwiftUI change callbacks run. No runtime tests ran in this attempt. Original diagnostics preserved.

• integration02 compiles the app but the new tests used an inaccessible document setter and a nonexistent EditorSession.canUndo convenience property. Corrected fixtures to perform a real rename transaction/increment the store revision, and inspect undoStack.isEmpty. Production implementation unchanged. Failed diagnostics preserved.

• integration03 ran65 cases with5 assertions failing in2 new tests. Four failures exposed sub-nanopixel solver noise producing extra pixel rows/columns for mathematically integral placements. Applied the existing affine-bounds1e-9 edge tolerance to shared PhotoPlacement bounds; this avoids unintended panorama borders without rounding meaningful subpixel positions. The cancellation test reused stale API revisions after a cancellation/render cycle; refreshed all source revisions before its second operation so revocation is tested during actual work. Seven other new tests and all56 prior regressions pass. Failed output retained; no broad parity claim.

• integration04 passes cancellation/revocation and all other checks, but4 integral-geometry assertions still fail. This disproves the initial sub-nanopixel diagnosis for these fixtures. Preserved the prior test and added a temporary matrix/RMS diagnostic to distinguish real fractional registration from wrong bounding geometry before changing implementation or expectations. The1e-9 bound tolerance remains consistent with existing affine math but did not fix this case.

• diagnostic05 initially used direct gray values and produced exact translations, so diagnostic06 repeated with the actual weighted-luminance/HDR preparation. It measured(75.98305,16.01695) at8-bit and(76.01493,15.98507) at32-bit, with0.183/0.171px matching residuals. Their extra bounding pixels are correct coverage of genuine fractional fits, not floating-point floor noise. Reverted the speculative PhotoRegistration tolerance change byte-for-byte to175 (hash verified); preserved that withdrawn attempt and both diagnostics. Replaced invalid exact-integer expectations with independently known crop extent/raster-sample comparisons: enclosing bounds within one pixel, matching RMS<0.25px and scene-sample mean error<0.02. This qualifies bounded synthetic workflow accuracy, not exact Photoshop output. Removed temporary diagnostics from the running test; saved copies remain in the run evidence. Added176 attribution and current Auto-Blend API guidance.

• integration07 passes65 focused cases,0 failures, including all9 new Photomerge tests and56 alignment/blend/menu/API regressions. Source data and user state are unchanged. Freeze the passing source and run the full optimized suite at this photo-workflow milestone, then the isolated universal package. No source/test edits while workers run.

• Full optimized release-full01 finished1697 tests with1 failure, in PathWorkflowTests document-type registration. Initial suspicion was an outdated test, but source inspection found the actual defect: step173 inserted RAW UTIs inside TIFF’s writable Editor registration. Preserved the failing full log and old plist; moved RAW into its own Camera RAW Viewer/import declaration, retaining TIFF’s correct writable declaration and the existing test unchanged. This does not alter native RAW editing or source preservation. No Xcode setting changed. Frozen source02 differs only by Info.plist; rerun the full optimized suite and universal package on that snapshot.

• Read the current official Adobe HDR workflow (updated2026-10-06) through web search: [local evidence archive] preserves the URL, concise workflow facts and implementation decisions. This is documentation evidence, not live Photoshop qualification.

• Final source02 passes all1,697 full optimized tests,0 failures. Earlier focused Debug passes65 on source01; only RAW import plist registration changed afterward. Universal package02 and clean ZIP extraction verify arm64/x86_64, macOS14 minimum, version0.2.0build2, ad-hoc signature, matching Info.plist, attribution/licenses and icon. All1,322 root/isolation inputs, four protected-state hashes and754 original Rust hashes match. Evidence: [local evidence archive] and docs/ACTIVE_CHECKPOINT_176.json. No application/test source deleted; the speculative bounds edit was explicitly rolled back and its copy retained. No commits, publication or user settings changes.

• Current README/status/plan, command matrix, API/menu/Adobe manifests, diary and classification are updated; prior checkpoints retained. Next-major HDR plan is saved. Read original hdr.rs, tone.rs HdrToning and engine photo_cmds.rs Merge to HDR source while the frozen build ran; no HDR source has been implemented yet. Full parity, production-size, physical/live and exact Adobe gates remain open.

• Final evidence inventory refresh/check is recorded under [local evidence archive]. These validate documented paths/hashes, not live UI or Photoshop equality. No Swift/test/build worker remains.

Implementation175a: Added native Harris/steered-BRIEF matching, normalized robust motion fits, six projections, connected graph placement and bounded joint refinement. Added full-resolution layer/mask warp, fixed locked planar reference, transactional history, native preview/Cancel/OK, factory menu, typed photo.autoAlign schema/state and authenticated installed $Algn descriptor in both action-job interfaces. Input/output budgets and unsupported contexts fail explicitly; disconnected matches apply nothing. Lens distortion/vignette and exact matching remain deferred. Added original synthetic texture and 289-corner independent Rust oracle (unmodified features.rs, original Homography and serial par_map adapter), plus eight focused engine/UI/API tests. Original Rust untouched. No build/test run yet. PhotoRegistrationMath.swift verified after context continuation. Local source reads had two missing optional filenames; corrected by searching actual modules.

• Verified all1,307 current source02 inputs and the final174 ZIP. Previous turn is progress; no previous worker remains. Begin the RAW02 registration/projection workflow using the preserved174 source/fixture/API plan. Evidence: [local evidence archive]. Original Rust remains read-only. Keep major feature breadth ahead of fine blend/RAW refinement and retain exact/live/platform gates.

• integration01 stopped at compile: the action enum reader returns an optional string. Added explicit unwrapping before the projection lookup; no runtime tests ran in this attempt. The failed log is preserved.

• integration02 passes54 focused cases, including all8 new alignment tests, native offscreen preview/history, all depths/persistence, both asynchronous API outputs, invalid/busy/stale guards and menu regressions. Added two meaningful coverage extensions before freezing: actual image matching under nonidentity rotation/scale/perspective, automatic cylindrical fallback and indirect three-photo overlap. No source/runtime defect was exposed by the first completed run.

• integration03 passes56 cases (10 new alignment cases). Actual warped-image registration recovers the analytic transform within1.5px at tested points; this is a synthetic functional threshold, not exact Photoshop equivalence. Auto selects Cylindrical for the narrow-focal fixture; the three-photo connected graph chains correctly. Added final attribution and corrected Auto-Blend capability guidance to point to the now-available photo.autoAlign. Freeze, final Debug/optimized focused tests and isolated universal packaging follow; root build117 remains untouched.

• Documentation updater01 stopped after three current summaries because the diary table orders date before step. Saved the failed script and partial outputs, restored those three files from this attempt’s own preserved copies, and corrected the table matcher in updater02. No application/source input changed; optimized/build worker continues on frozen inputs.

• The frozen changes01.json records10 new and13 changed source/resource inputs,0 removed. Final Debug and optimized focused runs each pass56 cases. Universal architecture builds are still running. The Xcode project remains present and byte-identical; its synchronized source groups discover the new Swift modules. Existing compiler warnings in RasterDecodeBudget and unused MainActor results remain outside this increment.

• Final frozen Debug and optimized focused runs each pass56 cases, with0 failures. Universal package01 and clean ZIP extraction verify arm64/x86_64, macOS14 minimum, version0.2.0build2, ad-hoc signature, attribution/licenses and icon. All1,317 root/isolation inputs, four protected-state hashes and754 original Rust hashes match. Evidence: [local evidence archive] and docs/ACTIVE_CHECKPOINT_175.json. No source deletions, commits, publication or user settings changes.

• Updated current README/status/plan, command matrix, API guide, menu/Adobe manifests, diary and classification while preserving earlier checkpoints. Next-major plan covers Photomerge sources/new-document/expanded bounds/API lifecycle, then HDR. Original photo_cmds.rs source loading and registration were reviewed read-only during builds. Large production/physical/live and exact Adobe gates remain open; broader regression stays batched.

• Final evidence inventory refresh/check is recorded under [local evidence archive]. These validate documented paths/hashes, not live UI or Photoshop equality. docs/ACTIVE_CHECKPOINT_175.json is the resume point; no Swift/test/build worker remains.

Auto-Blend Layers (step174): Panorama seams and focus stacking now have native preview/Cancel/OK, editable masks, multiband blending, transparent-area fill, Undo/Redo and both API paths. All 69 focused/regression and 69 optimized focused tests pass. The universal macOS 14+ package verifies. All 15 follow-up catalogue checks pass after test-only expectation updates. Auto-Align, Photomerge, HDR and exact/live/platform qualification remain open. Next: native Auto-Align Layers. See blend evidence. The Swift pyramid translation matches an independently compiled original-Rust fixture. Installed Photoshop source establishes the bounded panorama action descriptor vocabulary; no Adobe code was executed or copied. Compilation and two fixture failures were repaired with previous attempts retained. Source pixels remain unchanged; masks are editable and a merged output hides the originals to preserve alpha. Masks-only output retains layer selection. This does not establish Adobe algorithm, visual or factory-dialog equivalence. See the complete record.

26 October: editable statistical stacks

The major-feature pass added file/folder/open-document loading and statistical Smart Objects. All eleven PhotoCraft operators preserve original photo layers; changing or removing a mode is undoable, and editing the source refreshes each shared instance with its own mode. The native Statistics/Load Layers dialogs include optional shared alignment and preview/cancel. Native23 retains mode metadata, and unsupported editable PSD export fails explicitly. Three Photato commands and the installed Adobe renderer descriptor use the same engine. Original-Rust and analytical checks distinguish source-port correctness from unqualified Photoshop equality. The failed adapter/compiler/test assumptions and passing repairs are retained in step178.

Sensor RAW development (step173): Supported camera RAW/DNG files now retain their original source in editable Smart Objects, with native sensor controls, preview, history, native22 saving and both API paths. All 96 final focused and 96 optimized focused tests pass. The universal macOS 14+ package verifies. Camera-specific qualification, local RAW masks/XMP, editable PSD RAW interchange and exact Photoshop output remain open. Next major family: photo alignment and merging. See RAW evidence. The generated Bayer DNG has no embedded preview. Independent Core Image comparisons exposed a strip row-order error; it was repaired before the final 96-case pass. Empty small-fixture decoder probes, compilation failures and failing assertions remain recorded. Offscreen native workspace tests cover preview and local/document history; they are not live UI qualification. See the complete record.

Camera Raw Filter (step172): Light, color, curves, mixer/grading, detail and effects now have a native workspace with preview, settings files, local/document history, editable Smart Filters and both API paths. All 67 final focused/regression and 1,659 full optimized tests pass. The universal macOS 14+ package verifies. Sensor RAW/DNG import, lens corrections, local masks, XMP, exact Adobe output and live/platform qualification remain open. Next: actual sensor RAW development. See Camera Raw evidence. The first build caught multi-variable observation declarations; the next test run caught obsolete all-filter assumptions and a test ID changed by Smart Object conversion. All failed attempts and repairs are retained. This increment implements RGB development; sensor decoding is a separate next step, not a completed RAW01 claim. Complete development record.

Patch, Content-Aware Move/Extend and Red Eye now share native prepared edits with toolbar controls, history and three API operations. The implementation reuses the source-port healing/fill foundations. Tests exposed nested-array inference, a mutable concurrency capture, integer-depth/linear-buffer confusion and a full-coverage Float32 rounding defect; each failure and repair is retained. All 123 focused/regression tests pass. All 39 optimized focused checks also pass, and the universal macOS 14+ package verifies. Independent Photoshop algorithms and live/platform parity remain unqualified. The next major family is Camera Raw. Complete development record.

The Crop tool now has an expandable boundary, rotation/straighten line, common aspect ratios, retained/deleted raster pixels and transparent/background/content-aware extension. Preview, cancellation, one-step undo and API use the same native implementation. Generated edge pixels remain on an editable layer; interior transparency is retained. A redundant mask-coordinate calculation and a synthetic event-coordinate test were repaired; all 47 focused tests pass. The first full run exposed two outdated API counts; these and the shared Image > Crop integration are covered by the final 1,637 passing Release tests. The universal macOS 14+ package verifies. Exact Photoshop rendering, advanced presets/settings and live/platform checks remain open. Patch, Content-Aware Move and Red Eye are next. Complete development record.

Native seam carving now shrinks or enlarges a raster layer or selected pixels while retaining protected content. The existing canvas transform controls add reference-point, Amount, saved alpha-channel and skin-tone options; preview, cancellation and one-step undo share the engine with the API. The factory shortcut is connected. A compile-time error-property assignment was repaired, and all 25 focused engine, desktop/API, menu and transform tests pass. A procedural output comparison was inspected. The universal macOS14+ package verifies. Photoshop numerical equality, nonlinear mask deformation and live/platform qualification remain open. Content-aware crop fill is next. Complete development record.

The next major workflow now has native sampling and selection brushes, a preview, color/rotation/scale/mirror adaptation, current/new/duplicate-layer outputs, cancellation and undo. The desktop and contentAware.fill API share the Swift implementation derived from the licensed Rust source. A compile error and an AppKit test-controller initialization crash were repaired; all 30 final focused tests pass. A procedural before/after image was inspected. The universal macOS14+ package verifies. Exact Photoshop output, live interaction, cross-document sampling and finer workspace controls remain open. Content-Aware Scale and crop fill are next. Complete development record.

The maintainer reinforced breadth over fine fidelity. Persistent grayscale channels, saved selections, painting/filtering, Quick Mask, native20 saving and history now work through the native UI and two typed API operations. Three Select commands and Q are connected. Three compile failures and repairs are retained;47 initial and73 final focused tests pass. The final universal macOS14+ package and28 refresh-repair tests pass. PSD/spot channels, cross-document operations and independent/live fidelity remain open. Full-suite and platform qualification are batched. Content-Aware Fill is next. Complete development record.

A major selection workflow now has a native Swift matting engine and workspace: guided edge detection, global refinements, decontamination, brushes/lasso, subject selection, local history and six output choices. The factory menu/shortcut and existing selection/mask controls open it. The Photato API shares the engine and prepared document history; new-document outputs require transfer permission and leave the source untouched. Compilation repairs, the missing decontamination-preview correction and their passing focused tests are preserved. Offscreen captures have unreliable native-control compositing and are not accepted visual qualification; live work awaits unlock. All47 initial/12 repaired focused checks and1597 final full Release tests and54 checks per architecture pass; the universal macOS14+ package verifies. Adobe proprietary hair/Object Aware algorithms, action descriptors, exact output and broader contexts remain open. Next major workflow: channels, saved selections and Quick Mask. Complete development record.

The major-feature queue moves to Liquify. PhotoCraft’s inverse displacement grid now has native Swift brushes, freeze masks, reconstruction and mesh-program persistence, alongside a dedicated macOS workspace. Local Vision landmarks feed independent face controls. Pixel-layer editing and editable Smart Filters use shared history, native19 saving and the typed API; face detection is a read-only API command. Compilation/test fixture failures and their repairs are preserved in DEVLOG. All53 Debug focused,1,583 full Release tests before identity repair,71 final Release checks and29 public checks per architecture pass; the universal macOS14+ package verifies. Real local Vision requests on a nonface image complete on both architectures; portrait quality remains unqualified. Photoshop mesh files/PSD descriptors, Adobe Liquify actions, exact numerical behavior and live checks stay open. Liquify development record

Color Lookup now has a usable native grading workflow: import Cube/3DL/LOOK, choose generated Photato looks, preview or create editable layers, and retain masks/settings/history in native18. Source-domain and nonuniform shaper information survive import and save. Photato APIs upload bounded LUTs, create/set/apply adjustments and download original LUT files; Adobe execute-actions uses the shared native engine for a bounded inline descriptor subset. PSD/PSB supports loaded Trilinear LUTs. No Adobe preset files are redistributed. Two compile failures and an incorrect Adobe test-request envelope were repaired with their logs retained. All34 focused tests pass; 1,569 full Release tests passed, followed by a PSD name/format metadata correction,35 final focused Release checks and27 cases per architecture. The final universal macOS14+ package verifies. Both source snapshots and packages are retained. Live UI, exact Photoshop grading, ICC/CSP and richer interchange remain open. Complete record.

Five missing classic adjustments now share native Properties/dialog controls, selection masks, history, native17 saving and three typed Photato commands. The source approximations were translated from Rust with explicit validation. Nine factory menu commands are newly bound; the newer Color and vibrance layer remains open because its white-balance controls are additional functionality. PSD/PSB carries editable supported records; Adobe action jobs and the published /v2/edit color subset use the same Swift engine. Test failures exposed an omitted archive-header version discriminator and stale catalogue/fixture expectations; each attempt is retained. All46 integration tests pass. All1,559 final Release tests and90 checks per architecture pass; universal macOS14+ packaging verifies. The first full run found11 stale catalogue/version expectations. Those were corrected, and a review also added a missing prepared API creation-limit check with an atomicity test;36 final focused checks pass. Exact Photoshop output, richer Photo Filter transport and live UI remain open. Complete record.

The basic text stamp is now a native point/paragraph editor with caret selection, mixed character formatting, paragraph controls, local typing Undo and a single committed document edit. Native16, two Photato commands and a published Adobe create-composite subset preserve editable content. A bounded Swift port of upstream TySh/EngineData supports native-generated PSD/PSB round trips. Compilation and runtime failures are preserved, including a missing NSTextView text system initially mistaken for a Redo failure; an explicitly owned TextKit stack repaired it. All54 integration tests pass. All1,548 final Release tests and48 checks per architecture pass, and the universal macOS14+ package verifies. The first full Release run exposed one obsolete PSD type-rejection test, corrected before the passing rerun. Independent Photoshop/live UI and advanced typography remain open; major-feature breadth continues with classic adjustments. Complete record.

Eight native filters now remain editable over original Smart Object sources. Layers expose filter settings, per-filter blending/visibility/order and a shared paintable mask; ordinary layers retain baked filters. Native15, history, Photato automation and published Adobe execute-actions share the same engine. Seven filter types have bounded PSD/PSB descriptor/cache mappings; unsupported exports fail explicitly.67 integration checks pass. All1,536 final Release tests,87 checks per architecture and the universal macOS14+ package verify. The first Release run exposed one outdated archive-version test; its two expectations were corrected before the passing full rerun. All failed compile attempts remain recorded; no independent Photoshop or live UI claim while the Mac is locked. The next major workflow is native text editing; numerical refinements remain deferred. Complete record.

The next major workflow preserves the original source behind a rendered layer. Resize/rotate retains source samples; ordinary copies share content, while New Smart Object via Copy stays independent. Native Edit Contents opens a child document and Save updates its parent through Undo. Placement, replacement, source export, native14 persistence and an affine PSD/PSB subset share the Photato/Adobe API engine.57 integration tests and14 final focused tests pass. All1,524 full Release tests,36 checks per architecture and the universal macOS14+ package verify. The Mac remains locked for live checks; no independent Photoshop Smart Object fidelity claim is made. Linked sources, warp, richer source formats and Smart Filters remain open. Complete record.

The next broad workflow uses Apple's local Vision model to select foreground subjects or create an editable layer mask. Original pixels stay editable; native history and both API interfaces use the same engine.56 focused checks pass, including cancellation and revoked sharing. The real model removes the icon background and native Select Subject/Undo works. A mask-focus callback guard found by testing was repaired. The Mac locked before the remaining live mask check; all1,510 full Release tests and the universal macOS14+ package verify. Final parser/default repair passes26 focused tests, with platform model results preserved separately. Intricate edges and the rest of object/sky/people selection remain open. See the development record.

Major-feature breadth continues with ten native effect kinds, a style editor, copy/paste/clear, native persistence and both APIs. Six effect kinds have bounded PSD interchange. Live numeric editing exposed an exclusivity crash that model-only tests missed; the setter was repaired and a regression added. A command-matrix writing error was recovered from preserved evidence; eight filter evidence sentences are explicitly reconstructed. All55 focused Debug and1,498 full Release tests pass, plus30 cases each on arm64/Rosetta and universal package verification. The repaired native workflow passes. Fine contour matching, advanced variants and full Photoshop parity remain open. See the complete record.

Scope and priority change. Implement broad usable filter functionality before further feather/pixel refinement. Native Swift Gaussian/Box/Motion Blur, Unsharp Mask, High Pass, Add Noise, Mosaic and Average share a transactional engine, selection/transparency protection, preview/Cancel/OK, existing factory menu locations and both APIs through supported actionJSON. Focused functional checks precede one meaningful full checkpoint; Photoshop numerical parity remains explicitly open. Existing Gaussian modal/Core Image path is replaced with the shared filter workflow. Reference: Adobe official UXP Layer API, event-code catalogue and filter-effects reference (retrieved2026-10-26). Run: [local evidence archive] No release installed.

Implementation and focused01. Added RasterFilter/Engine, FilterControls and AutomationFilters; extended native Command/protection, render drafts, menu binding, prepared API execution and PhotoshopActionProgram. Eight filters share Swift arithmetic, selected coverage, RGB8/16/32 samples and one history transaction; persistence uses existing baked pixels. Gaussian replaces the old Core Image-only modal path; Smart Filters and Photoshop numerical parity are deferred. Added core/workflow/both-job tests and updated command-count/menu expectations. Frozen source01 compiles and executes59 tests; four assertions fail: an extreme black/white sharpening fixture is already clipped (correct no-op), and the old Gaussian test assumes synchronous Core Image execution. Change the fixture to middle tones and await/compare the new native asynchronous filter path. Preserve focused01/source01; no passing repair claimed yet.

Focused02 and native UI. All59 focused tests pass on source02, including every filter/depth/history/native archive, independent box-impulse arithmetic, PSD reopen, invalid/locked/selection contexts, HTTP stale/busy rejection and both actual resource-job routes. The live Debug-object harness opens all eight native sheets; Gaussian radius editing/Preview/Escape and Mosaic32 Apply/factory Undo/Redo are observed, with screenshots/AX evidence. Discard the owned document; the first empty-window AX query times out, then the process is explicitly quit and CUA inventory confirms it exited. Original Photoshop document and installed117 remain untouched. Begin one isolated full Release test/universal package run; full Debug repetition is deferred because this checkpoint already has focused Debug coverage and the full optimized suite.

API event identifier correction. The official Adobe event-code table names Average $Avrg, not the typed Photato kind average. Stop the owned full-release validation tree before edits (preserved incomplete release-tests01/validation01-cancelled; no completed suite claimed). Accept the canonical $Avrg event plus lowercase boxblur; keep typed local aliases. Switch core and both actual HTTP job tests to these identifiers. Kernel/UI code is unchanged from the live-tested source02. No workers remain before source03 edits.

Full Release02 inventory failures. Source03 runs all1,483 tests with eight failures, each a legacy API catalogue-count assertion expecting21 instead of22. No filter/editor behavior failures occur. Preserve release-tests02. Update only those eight test expectations in AutomationClosing/Opening/RecentDocuments/RecoveryAdmission/RecoveryBackups/RecoverySalvage and RecoveryIndex/RecoveryPreferences tests, retaining previous contents in prior-tests03. Freeze source04; production code remains identical to source03. Reuse the isolated checkout for this test-only change, then rerun the full Release suite before Intel build/packaging.

Full Release03 passes. All1,483 optimized tests pass with zero failures on source04. The production source equals source03; eight catalogue assertions were the only test repair. Continue the isolated x86_64 Release build and universal packaging, then a bounded24-case-per-architecture filter/history/archive probe. No additional pixel-fidelity refinements, legacy export-matrix repetition or full Debug repetition is added to this feature batch.

Completed functional checkpoint157. All59 focused Debug and1,483 full Release tests pass. Universal arm64/x86_64 macOS14 deployment/signature/package checks pass;24 deterministic filter/depth/history/archive cases execute on each architecture (Intel through Rosetta). Exact per-case differences are recorded in platform01.json; no physical Intel/macOS14 or full Photoshop numerical claim. The root build117, original workspace and Xcode project hashes remain unchanged. Source04/test repairs and all failed/cancelled attempts are preserved. Add FILTER_REFERENCES/ACTIVE_CHECKPOINT_157 and update eight command rows, APIs, phase plan, priority instructions, status and diary. No public publication or release installation. Next major batch: layer styles and effects, before returning to deferred feather/filter precision.

Baseline and next hypothesis. Reverify checkpoint155/final audit, all1,156 frozen inputs/550 Swift files and durable candidate. Previous turn is progress: qualified the visibility save repair and independent feather references. Goal remains active; continue major D01/I03 rendering work. Read current mask implementation and surviving155 measurements. Existing point-sampled Gaussian weights and the1e-6 output cutoff cannot establish Photoshop fidelity. Generate new transparent-background impulse controls to isolate merged alpha from opaque RGB subtraction rounding; broaden fractional radii and then8/16-bit cases. Preserve metadata/parameter checks and every rejected fit; do not hard-code three previously matching radii. No production/test edit yet. Evidence: [local evidence archive]

General numerical hypothesis and transparent controls. general-fit01.py uses a triangular variance budget floor(1.5*r²), three near-radius boxes and a greedy remainder decomposition. Across the prior larger integer radii3–100 it reproduces all samples at4/5/10/50 under one quantization model; radius8 also matches with reciprocal multiplication, while3/20/100 retain a few one-step Float32 discrepancies. Every prior kernel is symmetric. This remains an unimplemented hypothesis. Generate48 owned transparent RGB32 impulse rows using the verified155 Release engine with cheap0.001 placeholder feathers, then independently patch only each mask's feather Double to the requested0–100 values. Preserve placeholder/input/provenance; the deliberately stale merged preview is not an oracle and must be recomputed by Photoshop Save As. This avoids spending minutes evaluating the known-wrong native kernel solely to construct reference inputs. No product/test changes.

Deferred at maintainer request. Photoshop saved the 48-radius transparent atlas (alpha-photoshop01.psd); measure-alpha01.py independently extracted all alpha kernels into alpha-kernels01.json. Fractional radii disprove the simple integer variance-budget hypothesis. No production or test code changed. The Open panel also disabled a known-good155 PSD; Finder Open With opened the owned input successfully. Restore All Readable Documents and close only owned Photoshop/Finder windows; leave the original documents unchanged. Saved output parameter metadata still needs verification. The maintainer explicitly prioritizes major functionality over this numerical research: preserve these experiments and defer further feather/pixel matching. Product checkpoint155 remains the last fully qualified package.

This increment began on20October and completed its file-visibility qualification on26October; the original dated pause and evidence are retained.

Baseline and experiment. Previous goal turn made verified progress: checkpoint154/final audit and all1,154 frozen inputs/candidate hash reverified. Continue D01/I03 major rendering work. Generate the planned1024×16 linear RGB32 impulse atlas with16 separate white rows/radii0–100 over black, vertical unit-impulse masks and native154 codec. Independent Photoshop Save As and merged-plane decoding will measure actual kernel values before any native algorithm change. Source/Test files remain unchanged. Evidence: [local evidence archive] Initial guessed PSD file/mask helper names were absent; rg locates PSDMask/PSDOutput and existing PSDCodec composition path. No API behavior or parity claim changes yet.

Input harness repair. compile-kernel-input01 rejects two Surface initializer labels in the wrong order. Preserve failed source/log; kernel-input02 reorders fill before colorEncoding. No application source changed.

Explicit user pause. Input02 generates the16-radius atlas successfully. Photoshop Open/Go To required one state-change refresh; after selecting impulse-input.psd, Photoshop reports “Could not update smart object files because Photoshop does not recognize this type of file.” No reference Save As completed and no inference about kernel behavior is made. The user requests pause while this alert is visible; leave the UI untouched, record PAUSE_CHECKPOINT_155.json and stop. All1,154 product inputs still equal verified154; no application source/test changes or live worker remain. Step155 remains an unfinished reference experiment; history refresh/check is deferred until resumption.

2026-10-26 resume and import reproduction. User resumes the active goal. Reverify1,154 inputs, candidate154, installed117 and saved workspace with no changes; Photoshop remains27.2.0. Prior turn is progress (fixture generation and preserved failure), not a blocker. New evidence: [local evidence archive] The former alert has been dismissed externally; original Untitled-1 is visible. Explicit File→Open on the preserved impulse PSD reproduces rejection, this time “Could not import the clipboard because Photoshop does not recognize this type of file.” The alert disappears before our dismissal (state-change guard); re-observe original document and leave it untouched. Inspect native PSD framing and generate a single-radius variant to isolate the defect; no reference output or kernel conclusion yet.

Resumed build and independent controls. single-input01 compilation fails because old temporary PhotoCraftCore modules are absent. Preserve the failure; a fresh unique reference scratch build of PhotoCraftImaging succeeds in43.60s with build-manifest caching disabled. Independent PSD framing and zlib/prediction decoding validates all17 layers and expected0/1 samples in the rejected atlas, with the same HDR/profile payloads as the accepted RGB32 source control. Photoshop opens that prior control successfully through File→Open; close it without saving. Proceed with single-input02 linked to the fresh unchanged154 engine.

Import isolation corrects the hypothesis. Single radius1 and0 native PSDs open; larger/native multi-radius files fail. Changing only the radius1 parameter to100, or swapping only the merged section, produces accepted copies. Crucially, a byte-identical Python-written copy of the rejected large-input.psd also opens: the observed failure is not proof of a malformed PSD or invalid feather parameter. Preserve byte identities and filesystem attribute hashes; investigate publication/metadata separately without modifying the encoder. Capture single-photoshop.psd independently: radius1 weights are [1,9,30,48,30,9,1]/128, differing from the native Gaussian. A quick decoder first incorrectly assumed four saved channels and fails; corrected header-based decoding handles Photoshop’s three opaque channels in single-kernel01.json. Python os.listxattr is unavailable on this host; the metadata reader uses native xattr CLI and records only hashes/sizes.

Causal visibility reproduction / native regression. Add UF_HIDDEN to an owned exact copy: Photoshop rejects it. Remove only that flag on the same file: Photoshop opens it. All bytes remain identical; flag0x8000 is confirmed by the installed SDK stat.h. AtomicFileWriter uses a dot-prefixed staging name and publishes without normalizing visibility. Capture the full16-radius atlas from a byte-identical visible copy, Save As impulse-photoshop.psd and close only owned documents. Add two Core regressions that simulate hidden staging and preserve intentional destination visibility through symlinks, including unrelated UF_NODUMP. Freeze01 before the product repair to reproduce failures. The feather algorithm remains unchanged; repairing this major persistence dependency takes priority.

2026-10-26 explicit user pause after baseline reproduction. Session48169 is terminal: focused01 exits1, with two tests and three expected assertions reproducing inherited staging visibility and loss of intentional destination visibility. No product repair has begun. Preserve the failing log/result and all1,155 frozen inputs (549 Sources/Tests Swift files); pause-time hash verification finds 0 mismatches. Add docs/PAUSE_CHECKPOINT_155_20261026.json with the precise repair/test/API plan and unfinished full-atlas analysis. Add a current pause notice to STATUS; retain the Oct20 pause record and all experiment evidence. No new UI action, source edit, build, release installation or feature claim follows the pause request. No owned worker remains running. Step155 and its history refresh/check remain unfinished until resumption.

2026-10-26 second resume. Goal service now reports active with a later update than the explicit pause. Reverify all1,155 frozen inputs with zero mismatches; the previous turn completed baseline evidence and the pause record, so it is progress rather than a blocker. Resume the pre-publication visibility repair from the two failing regressions; both historical pause checkpoints remain immutable.

Pre-publication repair and regression expansion (unqualified). Extend AtomicFileWriter identity with flags and add per-transaction fchflags injection. Normalize only UF_HIDDEN on the retained staging descriptor before fsync/full-sync, preserve existing destination visibility and unrelated stage flags, retry EINTR, skip unnecessary calls, and reject observed visibility changes before rename. No post-publication failure is introduced. Expand AtomicFileVisibilityTests to seven tests covering real flags, symlinks, dot names, syscall ordering/errors and concurrent destination/stage changes. Add AtomicVisibilityWorkflowTests for all six formats through prepared output, native AppKit Save As and authenticated local HTTP saves with byte/model/history checks. Expose the policy in AtomicPersistenceCapabilities and document it in AUTOMATION_API; no command/menu/shortcut or Adobe wire contract changes. Re-run existing both-route output tests. A guessed shell glob for Automation save filenames failed without mutation; rg located the actual files. No tests are claimed passing yet.

Focused02 / AppKit staging defect and fixture correction. Freeze02 (1,156 inputs/550 Swift files) compiles; all seven Core visibility tests pass, but the32-test selection reports18 assertions (four unexpected errors). Prepared-output visibility passes; native/HTTP Save As loses intentionally hidden destination flags because AppKit supplies a new intermediate URL. Extend AtomicFileWriter/PreparedDocumentOutput with an optional outer-destination visibility value and carry the final destination flag with preparedSaveOutput in DocumentSaving/NativeDocument before AppKit writes. Preserve AppKit coordination. Correct the HTTP test's transparent blank fixture to an opaque fill so JPEG Save is representable; its422 errors were expected product validation, not encoder defects. Expand native checks to Save back with edit/Undo/Redo and Save a Copy ownership across all formats. Preserve focused02 and freeze02; no passing repair claimed until rerun.

Independent atlas measurements saved. measure-atlas01.py independently decodes merged RGB32 planes in both native154 and Photoshop27.2.0 files, validates dimensions, finite values, matching RGB and native alpha1, and stores all16 radii in atlas-kernel01.json. Zero feather matches; every nonzero radius differs. Radius1 is the previously measured [1,9,30,48,30,9,1]/128. This evidence supports subsequent feather work but is limited to this owned unit impulse/canvas/row layout; it does not establish a general replacement algorithm or other-depth parity. No Photoshop implementation or user image content is copied.

Freeze03 harness failure. An overly broad suffix replacement accidentally changed the20261020 baseline directory text to20361030. The freeze manifest was saved, but isolation packaging failed and focused03 could not start without isolation03.txt. Preserve both scripts, freeze03 and freeze03-result.json; construct freeze04 with exact filename replacements. No source/test change or product test occurred in this failed harness attempt.

Focused04 compilation repair. Swift resolves Darwin.stat as the struct rather than the POSIX function in DocumentSaving. Preserve the failed compile and change the visibility read to fstatat(AT_FDCWD, path, ..., 0), which follows ordinary symlinks and reports lookup errors. Freeze05 before retry. An inspection of a guessed compile-single-input02.py path also failed; existing experiment evidence remains intact.

Focused05 passes / full qualification started. All33 selected tests pass on freeze05 (1,156 inputs/550 Swift files), including seven Core visibility regressions, four new native/HTTP workflow tests, existing persistence faults/recovery and both actual job routes. Save As, edited Save with Undo/Redo and Copy preserve visibility, exact bytes and appropriate ownership across all six formats. Launch full Debug/Release, then a fresh-manifest Intel package build and universal packaging from the same isolated frozen inputs. Product sources/tests remain fixed during qualification.

Bounded feather hypothesis while full tests run. fit-atlas-boxes01.py compares independently convolved integer box kernels with saved Photoshop samples. Candidate widths [3,3,7,7,9] at radius4 and [3,3,9,9,11] at radius5 exactly match all1,024 row samples after an explicit Float32 subtraction-quantization hypothesis. Radius3 and8 candidates retain four/two differing samples by one Float32 step. Preserve atlas-box-fit01.json as exploratory evidence only; parameter selection, precision, other radii/depths and edges are unresolved. No renderer changes. Compile an owned Debug native UI probe from freeze05 objects with in-memory workspace/preferences/recovery; leave it unlaunched while AppKit tests run.

Reference integrity and third bounded fit. inspect-atlas-reference01.py independently decodes all17 saved layers and verifies the16 feather parameters exactly. atlas-box-fit02.json adds a six-box radius10 candidate [3,3,5,19,19,21] matching all1,024 saved row samples under the same quantization hypothesis. General rule/precision remains unverified. Start the unique Intel test-bundle build in parallel with Debug execution; Intel tests themselves will run only after the existing AppKit suites finish.

Full suites and Intel execution pass. All1,471 Debug and1,471 Release tests pass on freeze05. The clean x86_64 Release bundle passes22 focused Core/persistence/native/API tests under Rosetta; this is not physical Intel/macOS14 qualification. All692 retained outputs equal154 with zero missing/changed files. Package construction remains running. Compile live-probe02 using the already-owned single-radius fixture for a bounded Save As interaction; preserve unlaunched full-atlas probe01. The full-atlas Debug writer process is still CPU-active and is retained until terminal rather than restarted.

Owned live save and Photoshop import pass. The isolated native Debug probe uses Command-Shift-S, selects Photoshop format and saves native-visible-save.psd directly in the Desktop evidence folder. Its bytes equal the prior single-input file and UF_HIDDEN remains clear; the probe quits cleanly. The full-atlas native writer completes with bytes identical to the originally rejected atlas, flags64 instead of32832. Photoshop27.2.0 opens both new outputs directly without copying/unhiding or other post-save metadata changes. Capture and visually inspect native/Photoshop screenshots and full AX evidence, close only owned documents, and leave original Untitled-1 untouched. live-verification01.json records the bounded result; this proves the observed import repair, not feather/rendering parity.

Completed step155 qualification. The five production files and two added test files are enumerated in [local evidence archive]; nothing is removed. Freeze05 verifies1,156 inputs/550 Swift files. All33 focused,1,471 Debug,1,471 Release and22 clean-build Rosetta tests pass, with no skips. Both current-source Release manifests, universal macOS14 minimum, strict signature, icon/notices/project and unchanged menu inventory verify. Preserve [local evidence archive] without installing it. All754 original Rust inputs, installed117, workspace and absent recovery settings/directory remain unchanged. Update STATUS, PORTING_PLAN, FUNCTION_PHASES, COMMAND_PARITY, both API records, diary, FILE_VISIBILITY_REFERENCES and ACTIVE_CHECKPOINT_155; historical checkpoints stay immutable. Record bounded live Debug/native/Photoshop checks, unchanged692 outputs, remaining feather differences and next-major plan. All major gates remain open; no broad byte-parity or packaged Release UI claim. Final history refresh/check follows under [local evidence archive]

Baseline and investigation. Previous turn is verified progress: checkpoint153 closes the supported import subset with full Debug/Release, Rosetta, native UI and universal-package evidence. Verify all 1,144 frozen inputs, checkpoint/final audit and candidate153/installed117 hashes before continuing. Follow the major-first plan under the current project location. Compare original photocraft-compose::flatten against native Renderer.composite for the six source-generated projects; preserve exact Float32 values and emitted sample bytes separately. Source sample preservation is already tested, but complete composite equivalence is not established. No new product/API claims or source edits yet. Evidence: [local evidence archive] Initial plan output was truncated; no state changed by that read.

Independent rendering and live references. Original Rust render01 and native Debug render01 succeed for all six source fixtures. Every composite differs: source pixel-mask fixtures reach 0.031903 maximum Float error / nine clamped8-bit codes; the vector fixtures differ by at most one clamped code. Generate native layered PSD inputs for the three pixel-mask depths, open each in Photoshop2026 and Save As separate reference files; close only owned documents, preserving Untitled-1. Independent raw-planar decoding finds additional native/Photoshop edge differences up to0.179519, not merely source/import parameter precision. Read both native/Photoshop PSDs and compose natively; Photoshop’s16-bit save expands the mask to layer bounds and reduces the discrepancy, while8/32 crop it. No renderer changes yet.

Reference harness failures and controlled diagnosis. The first PSD generator successfully writes all three pixel-mask inputs, then throws the explicit unsupported fractional outside-mask error on the richer vector fixture. The command-line harness’s uncaught error exits via signal5; the product API correctly throws before committing that file. Preserve this failure; no app crash was exercised. A controlled-input harness reused its executable path as an output directory and similarly failed; input02 fixes the destination and generates cropped/canvas/stripe controls. A naive raw inspection printed RLE bytes, then boundary-decode01 independently decodes PackBits correctly. Photoshop preserves the cropped-mask canvas-edge behavior, disproving the broad early hypothesis that all cropped edges should stop clamping. Test off-canvas layer bounds and white outside-mask coverage independently with input03 before changing code. First multi-select attempts did not select additional files; proceed with observed single-file Open/Save As. Several guessed source/reference paths were absent; subsequent reads used rg-discovered files.

Controlled Photoshop result / regression freeze01. The six tiny controls distinguish cropping, full-canvas, stripe, white outside, gray constant and off-canvas content. Cropped/full-canvas/white-outside behavior retains canvas-edge extension. Only the raster extending beyond the canvas changes the corner from255 to Photoshop120; native153 incorrectly remains255. Add six owned Photoshop PSD fixtures with provenance, a Core regression for both opposing corners at8/16/32, Imaging reference/persistence/Apply tests and native/HTTP/both-action-interface tests. Freeze01 has1,154 inputs/548 Swift files; production remains unchanged while focused01 compiles/runs. The broader Gaussian kernel still differs by several sample codes and vector edges by one; do not call this byte parity. The first batched Open/Go To guard correctly stopped on a missing control; retry after observing the actual Open dialog.

Reproduction and repair. focused01 runs12 tests: six exact-coverage assertions and the independent Photoshop corner assertion fail as expected; one additional fixture-conversion error rejects the8-bit working profile after switching to32-bit. Preserve all eight failures. With the runner terminal, change only MaskSampler boundary eligibility: for unscaled raster content continuing beyond an edge, remove that edge from the canvas clamp set. Other content/affine cases retain existing behavior pending qualification. Adjust the constant-control test so its physical raster actually matches the canvas (opposing layer/affine translations), while the new off-canvas test retains coverage of mask-to-layer translation. Correct the test’s32-bit working-profile conversion using the existing shared importer. No product profile logic or blur kernel changed. Freeze02 for expanded native/API/renderer checks.

Focused repair passes / complete qualification running. focused02 passes 24 tests with zero failures in 69.084 seconds, including existing RGB32 exact-composite regressions, source native/API workflows, independent mask boundary/Apply/persistence and both action-interface output equality. Start full Debug, full Release and universal packaging sequentially against freeze02; preserve all1,154 inputs/548 Swift files during validation. Prepare package/Intel/codec compatibility, post-fix quantitative comparison and an owned native UI probe, without launching UI during automated native tests. API documentation records the shared renderer impact and unchanged routes/schema.

Fixture attribution before packaging. Preserve the previous ATTRIBUTION text and append the six original Photoshop mask-boundary fixture provenance/license terms. Copy this documentation-only change into the validation isolation before build01; packaging-documents03 records the sole documentation delta from02. Frozen Sources/Tests remain unchanged, and the package verifier will check03. No test result is rerun or reattributed for this notice-only update. All754 original Rust inputs remain unchanged (source-provenance01).

Validation follow-through. Full Debug passes 1,460 tests in full01; Release/package qualification continues sequentially. Intel compilation succeeds separately; execute its UI tests only after the native suites finish. Review of the proposed live-save checker finds fresh UUID creation on each PSD import. Preserve unexecuted checker01 and prepare checker02, aligning only document/layer UUIDs before exact whole-model comparison. This is evidence-harness work, not a change to frozen Sources/Tests. A guessed Layer.swift path was absent; Document.swift establishes the identity behavior.

Release pixel measurements. Once final Release Core/Imaging objects are built, native-postfix-render01 and measure-postfix01 succeed while the independent native test runner continues. Original-source input maximum errors against Photoshop decrease from0.17668–0.17903 to0.00948–0.00982. The six controls retain zero quantized differences for constant white/gray; other feathered controls still differ by up to0.04292, explicitly not byte parity. Preserve raw before/after samples and postfix-comparison01. Record installed117/workspace/Xcode/fixture identity and absent recovery files before the later owned UI probe. No UI probe has launched yet.

Intel evidence guard catches a stale build. Full Release passes1,460 tests and all692 previous export outputs remain byte-identical. Intel-tests01 exits0 but executes only nine old LayerMask tests, omitting the new regression suites; it is invalid qualification, not a fourteen-test pass. The shared Intel release.yaml still names isolation153 despite running build-tests01 from154. Preserve manifest/log/binary identity and prepare build02 in a new scratch directory with build-manifest caching disabled. Keep native live UI separate from any Intel execution. Verify package compilation manifests belong to154 as an additional guard; do not accept a mixed-source package.

Owned native workflow completed. Debug probe154 launches only after both native suites and the invalid Intel01 run end. Magnify owned12×12 fixture to1200%; Properties Apply Mask removes the mask. First Command-Z remains in zoom text editing and does not navigate history; preserve failed assertion/AX. Leaving text editing then Command-Z restores it; Command-Shift-Z reapplies. Menu Escape did not dismiss through this automation; exposed Cancel does. Native Command-S saves live-mask.photato, clean tab state; raising the window repairs a transient unavailable screenshot. Quit probe and verify process absence. Release checker02 passes exact model/sample equality after aligning only fresh PSD document/layer UUIDs. All installed117/workspace/Xcode/fixture hashes and absent recovery state are preserved. live-verification01 records Debug UI versus Release model-check scope. Prepare package verifier02 to reject stale-source build manifests for either architecture.

Clean architecture and package qualification. Clean Intel build-tests02 completes in148.12s; tests02 executes all14 current regressions with zero failures. Universal build01 succeeds; package verifier02 passes strict extracted-ZIP signature, macOS14 targets, both architectures, notices/icon, unchanged menu inventory and no external Rust/Zstd/BLAKE3 runtime. Both saved package manifests name only isolation154, excluding the stale153 build caught in Intel01. Prepared finalizer02 supersedes unexecuted finalizer154.py to cite the valid Intel02/package02 evidence and preserve the failed cache/focus attempts. No product source/test changes occurred during qualification.

Completed qualification and boundary. Freeze02 contains 1,154 inputs/548 Swift files, with ten added fixture/test files and two changed existing files. All 24 focused, 1,460 Debug, 1,460 Release and 14 x86_64 Release tests pass. Package verification confirms universal macOS14+, strict signature and notices, unchanged menu inventory and no Rust runtime dependency. Owned native UI verifies Apply Mask, Undo/Redo and exact native-save model equality after aligning only fresh import UUIDs. Independent before/after pixel measurements remain in postfix-comparison01, including unresolved Gaussian kernel error. All 692 prior codec outputs remain identical. Preserve failed hypotheses, harness/test failures, all original Rust sources and installed117/user state. Write checkpoint154/current reference/API/command/phase/status/plan/diary; all major gates stay open. Final history refresh/check and identity verification follow under [local evidence archive]

Baseline and scope. Classify checkpoint152 as progress. Verify its checkpoint/audit hash, all1,133 inputs/540 Swift files, candidate ZIP and preserved installed117. Prior validation handles are terminal. Continue major D01/I03 under the current “-” directory, without Git mutations or subagents. Read the original Rust format manifest, native document model/opening boundary and intermediate project reader. Map sparse defaults, depth/profile interpretation, identities, hierarchy, locks, masks and supported content to actual editable native data. Keep unsupported features explicit and source files unchanged; previews are not an editing substitute. Desktop and Photato import/input jobs must share native semantics and errors; Adobe input remains limited to its published formats. Initial combined reads exceeded the output budget; repeat only the missing excerpts. Evidence: [local evidence archive] All major gates remain open.

Adapter implementation (unvalidated). Add PcraftImport/PcraftSamples/PcraftLayerMapper/PcraftPaths and wire DocumentIO, DocumentOpenFormat, PreparedLocalDocument, Photato upload and isolated action jobs. Convert RGB8/16/32 raster tiles, nested groups, independent masks/partial locks, paths and selection without cached flattening. Original source Transfer::for_document explicitly treats F32 as linear; preserve Float32 bits and linearize only the working-profile description. Keep raster geometry across the full allocated tile extent, including hidden RGB/off-canvas values; unbounded nonzero raster defaults reject. Bound aggregate native expansion before allocation. Exact UInt64 source identities produce deterministic namespaced UUIDs; retain raw manifest as immutable provenance. Reject unrepresented content, non-default metadata/features and unknown fields atomically. Imported sources have no writable association; directory reads use the established no-follow/stability checks. Register the imported project UTI and expose Photato capability/errors, keeping Adobe inputs unchanged. Sources/Tests are not yet frozen or tested. Several oversized inspection reads were truncated and guessed filenames/globs failed; no files were changed by those failures. No replacement/deletion of existing source, fixtures or prior evidence.

First frozen validation and independent fixtures. Freeze01 contains1,139 inputs/546 Swift files. focused01 compiled and ran69 tests:68 pass,1 Open-panel filter assertion fails; exact sample preservation at8/16/32, native/API editing/download/save/reopen, isolated Photato jobs and Adobe input rejection pass. Preserve the failing log/result and stack sample01 (CPU work was source BLAKE3 verification, not a hang). Original Rust caller01 independently saved/reloaded three additional tiny projects with same-depth fractional-default masks, nested groups, full locks, Violet labels, vector/saved/work paths, GRAY8 selection and signed-zero/HDR/hidden-RGB values. All754 original Rust inputs remain unchanged. Add PcraftEditable fixtures/provenance and regression tests for those properties. Review found that explicit all-zero selection must reject rather than become unrestricted nil selection; add a regression before repair. Broader source content and all major gates stay open.

Reproduced failures and repairs (unvalidated). focused02 preserves two failing regression tests: an explicit empty selection was accepted, and the new original-source fixture's Violet label was rejected. Repair selection admission with an explicit unsupported error (native nil means unrestricted editing); map supported source color labels through existing editable layer labels, with no invented PSD record. Tighten editable-reader limits to512 layers/1,025 surfaces/4MiB blobs and caller raster budget plus bounded manifest/profile overhead. Preserve all previous reader-only limits for the lossless intermediate module. Add non-finite/alpha/default/extreme-coordinate/off-canvas-selection guards. Open-panel diagnosis01 shows an undeclared imported UTI has no filename tag in a SwiftPM test host; AppKit discards that filter. Use the extension-tagged fallback in native Open and All Readable filters, while retaining the packaged UTI declaration. Update the regression to verify the actual pcraft filename filter. XcodeGen2.45.2 regeneration passed. No source/test edits occurred during either frozen validation run.

Repaired focused qualification. Freeze03 retains1,144 inputs/546 Swift files (11added,10changed,0deleted versus152). focused03 passes26 tests with zero failures in198.109s. This includes all new original-source fixtures and both regression repairs, exact original tile samples at three depths, native Open/edit/undo/Save As/reopen/source preservation, HTTP upload/edit/native12download, isolated Photato job output equality, Adobe rejection, and existing Open cancellation/stale/publication guards. Start full01, release01 and build01 sequentially on this same frozen source; keep Sources/Tests unchanged while validation runs.

Full-suite registration failure and repair. full01 exposes two regressions: NativeFileExtensionTests and PathWorkflowTests require Photato's native format to remain the first bundle document type. The new import declaration had been prepended. Preserve both assertion failures and full01-interruption01; terminate only the identified owned XCTest process, wait for validate01 to exit1, then append the new document/type declarations after the existing registrations. This retains native preferred-format order and existing imported PSB ordering. XcodeGen02 succeeds; no Swift Sources/Tests changed after freeze03. Re-freeze04 for registration-focused checks followed by full02/Release/universal qualification. Earlier successful per-module results are not promoted to a passing full suite.

Full Debug repair passes. full02 completes1,455 tests with zero failures. Freeze04 differs from03 only in Info.plist declaration order; registration-focused04 passed10 tests. Xcode project/scheme discovery01 succeeds (discovery only, not an Xcode build). Proceed with Release/universal qualification already queued. Source-property/sample preservation is distinct from complete original-Rust/Photoshop composite equivalence; retain that major rendering requirement in the next plan.

Release/package and live workflow. release01 passes all 1,455 tests; build01 exits 0. Package verification confirms universal arm64/x86_64, minimum macOS 14, strict signature, resources and unchanged menu inventory. Native owned Debug probe opens the original source ZIP, edits its layer name, verifies Undo/Redo, saves a native document and opens the equivalent source directory through the explicit PhotoCraft format. The separate native reader verifies the complete saved model with only the intended name/selection changes. Quit/cleanup, source ZIP/directory hashes and installed117/workspace/recovery preservation pass. Preserve live AX/screenshots and live-verification01. The first Go To paste timed out; observed unchanged field, then native SetValue succeeded. Initial AX and combined source/document reads exceeded output budgets; subsequent bounded reads recovered needed context without edits.

Xcode reference reconciliation. XcodeGen01 added navigator references for three already-existing fixture scripts; XcodeGen02 preserved that result. The project was unchanged between these regenerations, not unchanged from152. Preserve xcode-project-delta01.diff; build settings are unchanged. Record the actual current project hash in checkpoint153 instead of inheriting152’s stale hash. Preserve unexecuted finalize153-planned01.py before correcting that field and next-plan references. No Sources/Tests changes after freeze04. x86_64 Release qualification is running under Rosetta, separate from physical Intel/macOS14 qualification.

Completed qualification and current boundary. Freeze 04 retains 1,144 inputs/546 Swift files; only Info.plist differs from the 26-test passing freeze03. Registration-focused04 passes10 tests. full02 and release01 each pass 1,455 tests; build01 produces a verified arm64/x86_64 macOS14+ package, and 13 x86_64 Release tests pass under Rosetta. Live owned Debug UI evidence verifies native Open,editable layer naming and native Save As; the saved model and cleanup are checked separately. All692 prior generated codec/reference outputs match152. Preserve every failed run/diagnosis,all 754 original Rust inputs,installed117,user workspace/recovery state and historical evidence. Update STATUS,PORTING_PLAN,diary,command/API/Adobe/phase/reference documents and checkpoint153. New candidate is saved separately; no major gate closes. Next follow next-major-plan02 for represented content migration and missing major native workflows. Final history inventory refresh/check and final input verification are recorded under [local evidence archive]

Final checkpoint audit preparation. intel-build-tests01 and intel-tests01 both exit 0; all 13 selected x86_64 Release cases pass under Rosetta. Finalize153 verifies frozen inputs, candidate package, source provenance, export compatibility and user-state preservation before writing the checkpoint and current documents. Prepare final-audit01 for history refresh/check and final source/package identity. Preliminary next-work reading identifies original photocraft-compose::flatten/render and native Renderer.composite as independent comparison boundaries; no rendering implementation changes yet. A wrong-directory lookup and two guessed native filenames returned no match; subsequent reads used discovered Renderer.swift/GroupRenderer.swift. This inspection does not qualify composite equivalence.

Baseline / scope. Classify151 as verified progress. Revalidate all1,126 inputs/533 Swift files, package texts,candidate151,installed117,Xcode and final history audit; prior validation handles are terminal (Intel01 failed,02 passed). Continue major D01/I03 with actual native model/commands/painting/desktop/protection API activation, using the saved six-part plan and independent Photoshop records. Preserve original Rust, installed117,user documents/settings; no Git mutations or subagents. Runtime integration must retain old archive Bool semantics, avoid stale sourceTags reinterpretation, and follow the current pinned Adobe create-composite contract. No major closure is inferred from module tests. Evidence: [local evidence archive].

Runtime integration in progress (unvalidated). Add LayerProtectionCommands/ProtectedPixels and LayerProtectionControls, AdobeProtectionEdit and update Document/Engine/Paint, all clone/heal/focus/bucket/gradient painters, PSDCodec and desktop availability/panels/menu/shortcut wiring. Partial flags now stay separate from legacy full locks; ancestor protection applies by operation, protected painting preserves alpha, explicit Clear/Cut remain distinct. Rename remains available on full locks. Add optional create-composite protection edits using existing resource/job transport; no service credentials or proprietary algorithms. These changes are not yet compiled or qualified. New native partial-flag documents require version12 (both legacy plist and chunked formats) so old readers reject rather than silently unlock; ordinary legacy outputs remain version10/11. Add Photato typed protection command/state/schema, native sheet cancellation/stale checks, and correct mixed-state checkbox toggling. No sourceTags reinterpretation.

Additional reference / investigation. In an owned Photoshop transparency-locked64×64 reference, Select All enables Clear/Cut; Clear erases selected pixels. Save As photoshop/transparency-clear-selection.psd then Undo restores the disposable active reference; original user Untitled-1 remains untouched. Pixel decoding is pending. Broad source/document reads were truncated; narrowed subsequent inspection. Guessed Persistence.swift read failed (NativeArchive actually lives in Document.swift); no file changed by that failed read. Record this as reference discovery, not a parity claim.

Focused01 failure / repair. Freeze01 contains1,133 inputs/540 Swift files. The first compile fails in the new runtime test because mixed numeric literals infer an Any array. Explicitly type the alpha fixture as [Float]; retain focused01/freeze01, then freeze02 before retrying. No production repair was needed for this first compiler failure. The additional guessed EngineTests.swift read failed without mutation.

Focused02 failure / repair and reference cleanup. App compilation catches a sheet-draft initializer closure capturing self before values is initialized. Read the store’s document/selection directly during initialization; freeze03 follows. The independent PSD parser confirms Photoshop Clear saved empty channel planes with protection1 retained. Close only the owned reference and discard its undone working state; the original modified Untitled-1 remains open and untouched. Add lock-button selected state and allow grouping fully locked roots under an unlocked parent, matching151 observed metadata operations. A guessed ToningBrush.swift search failed without mutation; subsequent path discovery is required.

Focused03 passes / expanded runtime verification. All15 selected tests pass on freeze03, including32 flag combinations through both native archives, operation-specific/inherited guards, protected fill/brush/eraser and Clear, HTTP/desktop equivalence and busy rejection, actual PSDCodec decoding of all nine independent Photoshop fixtures. Add alpha/bounds/hidden-RGB checks for13 retouch operations across8/16/32-bit, a real loopback create-composite asynchronous job/status/download test and stale Photato revision rejection; freeze04 before running those and the broader suites. Native old-reader rejection is enforced by format version12; whole-Photoshop output parity remains unclaimed.

Focused04 passes / API version negotiation review. All17 focused tests pass, including13 retouch operations atthree depths and the actual Adobe-compatible resource-job route. Before full regression, fix explicit native download negotiation: preserve version10 default/11 requests, reject partial protection with422 unless12 is requested, and force chunked12 when explicitly requested. Advertise12/read support and test rejection/download/exact model equality. Update executable command-count assertions20→21 and native read-version expectation. A broad search accidentally included enormous JSON fixtures and truncated output; subsequent searches use Swift-only globs. Guessed app-path reads failed without mutation.

Final preflight refinements. Disable Properties geometry fields for inherited position locks; show implied transparency protection correctly in the sheet. Add direct native protected-Fill pixel comparison against Photoshop’s independent black-Fill reference (exact visible RGBA and all alpha, excluding canonicalized hidden RGB). Freeze05 for focused/full/release/universal qualification. All major gates remain open; auto-nest flags are preserved, but artboard auto-nesting itself remains unsupported.

Focused05 passes / full qualification. All18 focused tests pass on1,133 frozen inputs/540 Swift files, including protected Fill against independent Photoshop pixels and explicit native12 download negotiation. Start sequential full Debug, full Release and universal packaging with before-stage root/isolation hash checks. No source/test edits while this validation runs. Prepare package/Intel qualification scripts and update both API guides/compatibility metadata as in-progress; no completed checkpoint claim yet.

Full01 findings / final repairs. The complete frozen Debug run reports two obsolete assertions: version12 must now be accepted, and full-lock Rename must now remain available. Preserve full01, then change only those expectations to invalid13 / Rename allowed. Align Layer Via Cut menu validation with the image-lock engine guard. Extend independent fixture PSD/PSB/both-endian layered-TIFF roundtrips, group/native/Adobe descendant propagation, mask editing under image locks and grouping locked root layers. Preserve clear-reference01 and add02 recording Photoshop’s exact0×0 cleared layer/four empty channels. Freeze06 before rerunning focused and complete qualification.

Full01 complete / correction to preliminary failure count. The final run executed1,440 tests with94 failed assertions (one unexpected), not merely the two early failures. Ninety repetitions come from TIFFLayerTests.check asserting full lock for every independent TIFF transparency-only fixture. A direct endian-aware binary inventory confirms lspf=1 in all30 immutable TIFF fixtures; replace that lossy expectation with exact transparency protection and locked=false. The remaining TIFF HTTP failures are the new native12 negotiation, so request12 explicitly. Focused06 separately runs19 tests with one error: opaque Photoshop shmd is unsupported in little-endian TIFF. Keep that existing explicit rejection; the protection-only little-endian test uses an explicitly metadata-free owned copy while big-endian tests retain original metadata. No production metadata stripping is introduced. Preserve06 failure and defer the scheduled full02 runner (validate02-planned.py retained; no second full run started). Freeze07 and run expanded focus before complete validation. Earlier failed guessed TIFF fixture/run paths changed nothing.

Expanded focus and preliminary byte audit. All58 focused07 tests pass after the full01/focused06 repairs. Start full02/Release02/build02 sequentially on freeze07. An independent preliminary comparison of346 retained output files finds60 changed PSD/TIFF exports; each differs exclusively inside identified four-byte lspf payloads (collapsed7→correct1). All other file bytes match151. Final qualification will cover both Debug and Release output families (692 files total). Compile an owned Debug UI harness from the frozen production objects with in-memory workspace/preferences/recovery; no live interaction has occurred yet. Preserve all previous inspection/compile evidence.

Final control accessibility review. After completing the freeze07 validation chain, correct two WorkspaceView/WorkspaceLayers presentation details: only actual toggle buttons expose On/Off, and the full-lock button exposes its actual selected state. Ordinary action icons previously inherited a misleading Off value from the new helper. No editing/API/format algorithm changes. Preserve freeze07 results and compile-live-probe01; freeze08, rerun the58 focused checks and full Debug/Release/package chain, then compile a second owned UI probe from final Debug objects.

API/native dialog edge case / intentional full03 interruption. Focused08 passes58 tests. Review finds that valid API raw Image-only2 and All-only0x80000000 flags display implied checked boxes, but clearing Image/All must preserve those checked subordinate settings, as Photoshop does. Stop only the owned full03 XCTest child after265.5seconds; verify the validator and child are terminal before editing. Preserve interruption record, partial log and exit1; this is deliberate cancellation, not a newly observed test failure. Normalize UI setting transitions only: Image-off retains Transparency; All-off retains allfour partial settings. Raw archive/API replacement bits remain unchanged until a user toggles a dialog control. Align transparency toggle direction with effective checked state and add core/native-draft regressions. Freeze09 and rerun focused/full/Release/package qualification.

Protected Fill storage invariant / full04 interruption. Focused09 passes58. A targeted code review finds that mapStoredPixels deliberately bypasses integer requantization, so using it directly for protected Fill can store fractional RGB values outside8/16-bit sample grids. Stop only the owned full04 XCTest child after232.45seconds; retain interruption/log/exit1 and verify terminal status before edits. Add sparse-default,partial-alpha,non-endpoint-colour,outside-selection and undo assertions to the existing runtime test. Freeze10 runs this regression against the unfixed implementation first; no production change yet. A guessed Pixel.swift read failed (Pixel is defined elsewhere); no file changed by that lookup.

Focused10 reproduces Fill defect / repair. Allfour runtime tests execute; two assertions fail exactly at the8-/16-bit integer-grid invariant for fractional0.3/0.5/0.7 RGB. Preserve freeze10 and the failing log. In Engine.fill, quantize only edited RGB to the actual target surface depth, restore the exact original alpha, and return original pixels unchanged outside coverage or at zero alpha. This retains sparse/default and Float32 storage behavior. Freeze11 for the expanded58 tests followed by full05/Release05/build05; no further source edits are planned.

Freeze11 Debug passes / final qualification continues. Expanded focused11 passes58 tests and full05 passes1,441 without failures/skips in414.0seconds command wall time. Release05/build05 remain sequentially active under session71950; source/test inputs remain frozen. Compile-live-probe04 succeeds using final Debug objects and the explicitly activated owned document; prior three probe builds were never launched. Prepare a read-only native-save verifier for exact65,536 procedural pixels, layer name, raw protection3 and native12 framing. Repeated overly broad documentation/script output reads were truncated; they made no file changes. Subsequent inspection uses selected metadata and bounded excerpts.

Release05 passes / export changes qualified. All1,441 Release tests pass on freeze11; universal build05 now runs. Final comparison covers692 Debug/Release output files across eight families:572 are byte-identical to151,120 layered PSD/TIFF outputs differ only in independently located four-byte lspf fields, replacing the previous collapsed7 with transparency1. Every other byte matches. Finalizer review preserves all older unresolved workflow limitations and updates the existing next_increment field rather than leaving a stale151 activation instruction; retain finalize152-planned01.py as the unexecuted earlier draft. No application/test changes.

Universal package verifies / Intel qualification running. Validation session71950 finishes successfully: full05,release05,build05 all exit0. Package01 extracts a fresh ZIP, checks strict signature, arm64/x86_64 minmac14, notices/icon/links, Xcode and expected158 bound/567 unavailable menu leaves. Candidate binary SHA599e19e6d96fe186e343372f84f0460d0d31f20b4dd458f853f77e8e6a9888f4; ZIP05cc5489d3c7a8319ade403b736370e1f2a3d2367b265b8f11c7d0a8933f7234. Intel build/test session81830 runs next with explicit x86_64 XCTest; live UI waits until native automated activity finishes. Preserve nine current documentation files in docs-before-checkpoint01 before finalization (ongoing152 state, not an invented historical baseline).

Live native check finds initial checkbox enablement defect. All19 Rosetta tests pass and session81830 is terminal. Launch compile04 owned Debug probe through CUA. Image click correctly implies/locks Transparency, applies one history action, disables Fill and permits geometry. Command-/ sets full protection and disables geometry; reopening Lock Layers shows allfive checked, but the four subordinate checkboxes incorrectly remain enabled on first presentation (AX and screenshot live-dialog-full01.png/live-dialog-full02.txt). Preserve all evidence and the passing freeze11 package; do not claim final UI success. Cancel, quit/discard only the owned document; CUA read-after-quit relaunched a fresh clean probe, which is quit again without another activating observation. pgrep verifies no probe remains. Add an actual NSHostingView/NSButton initial-enablement regression for full,image and no protection, before fixing production. Existing API/model semantics are unaffected; enabled presentation needs to honor the SwiftUI environment. Freeze12 reproducer next.

Hosted-control regression reproduces / repair. Focused12 runs one actual NSHostingView/NSButton test and fails five assertions: four full-lock subordinate boxes and image-lock Transparency are enabled at initial presentation. Session62178 is terminal before edits. Apply the same enabled condition through SwiftUI .disabled as well as NSButton.isEnabled so initial view installation cannot override the intended state. This is a native UI availability fix; command/API results stay unchanged. Freeze13; run expanded59 tests, full1,442 Debug/Release and universal build, then20 Intel-focused tests and repeat the owned live workflow. Preserve freeze11 passing binaries and all earlier outputs without overwriting them.

Focused13 passes / final chain restarts. All59 focused tests pass including the actual initial native checkbox regression. Full06/Release06/build06 run sequentially under session17071 on freeze13 (1,133 inputs/540 Swift files). Compile05 succeeds against these final Debug objects, but the replacement UI probe is not yet launched. Prepare fresh package02,Intel02,export02 scripts; preserve previously executed01 results. Planned finalizer/audit now point to freeze13 and expected1,442 full/20 Intel counts. Seven files added/57 prior inputs changed, zero removed, unchanged from the previous delta totals. No source/test edits while validation runs.

Final live workflow passes / package02 verifies. Full06 and Release06 each pass1,442 tests; universal build06 exits0 and session17071 is terminal. During package compilation, with both full AppKit suites already terminal, launch the exact compile05 binary (PID2077/path/hash recorded) and perform live CUA checks. The final native dialog now disables four subordinate controls immediately under full lock and Transparency immediately under image lock. Image apply disables Fill but leaves Free Transform; Command-/ sets/clears full protection, All-off retains subordinate choices, Cancel preserves full lock, and Rename succeeds while fully locked. The layer-panel Image button produces raw3. Native Save As writes live-owned.photato; a separate Core decoder verifies version12, renamed editable layer, raw3 and every65,536 procedural sample/exact Surface unchanged. Screenshots/AX/process/source/object hashes are retained in live-verification01. Command-W closes the document but its following CUA observation times out with no window; Command-Q succeeds and process absence is verified without relaunch. Real workspace/recovery state stays unchanged. Intel02 starts only after this owned UI probe exits, avoiding AppKit overlap. Package02 verifies final binary71a13d300a233e66f3a9d65717a5753180e7c08f1947308e094cc09f4e9653e2 and ZIP00e91b50c0ae6fb906176887275f8ac958d65d092884f36c975a0ec4009e0563. All692 outputs equal freeze11 exactly; against151, only120 files have corrected lspf metadata. Master goal remains active; no major gate closed.

Final qualification / checkpoint152. Freeze13 adds7 files and changes57 retained inputs; no files deleted. All59 focused,1,442 Debug,1,442 Release and20 Intel-emulated Release tests pass; universal arm64/x86_64 macOS14+ package/signature/licenses/icon/Xcode checks verify. See source-delta13 for all affected paths and final-export-compatibility02/export-differences02 for exact retained export changes. The owned native UI probe uses the frozen Debug objects with in-memory preferences; live results are separate from Release binary qualification. Original Rust754 files, installed117 and real workspace/recovery state remain unchanged. Preserve all failed attempts and record the final source/candidate hashes in ACTIVE_CHECKPOINT_152. Update both API guides, reference manifest, status, plan, command matrix, phase record and diary. Every major gate remains open; next is editable original PhotoCraft import under the saved plan. Refresh/check development history only after these records are complete.

Baseline / scope. Classify150 as verified progress. Revalidate all1,109 frozen inputs/527 Swift files, package notices,candidate150,installed117,Xcode and final history audit; all prior owned validation handles are terminal. Continue major D01/I03 with separate layer protection settings, the native edit guards/UI, format persistence and shared Photato API. Keep the full Photoshop goal and every major gate open. Read AGENTS,development-record rules,status and checkpoint150; preserve original Rust/user files. No Git changes or subagents. Evidence: [local evidence archive].

Primary/live reference investigation. Restore CUA documentation and connect to Photoshop2026. The original modified Untitled-1 is still open at921×921 and remains untouched. Consult Adobe's current layer-lock help, PSD specification and Firefly advanced-layer migration guide. The migration guide is under a beta path; verify the current published GA contract before implementing Adobe compatibility. Inspect actual Photoshop lock controls/behavior on owned fixtures rather than infer all operation semantics from help text. Current native code collapses PSD lspf bits and all command guards into one locked Bool; partial locks need end-to-end treatment. All previous .pcraft adapter and source-model gaps remain explicit.

Independent live evidence / implementation boundary. On the owned 64×64 RGBA fixture, save separate Transparency, Image, Position, Prevent auto-nest, All, unlocked, locked-renamed and protected-black-fill PSDs. Independent Python PSD/PackBits decoding verifies exact protection words 1,3,4,8,0x8000000f,0; all alpha planes match, lock/rename retain every visible color sample, and protected black Fill retains alpha. Photoshop can rename an All-locked layer; Command-/ clears all flags, whereas clearing All in the dialog retains four checked flags. Image forces Transparency checked/disabled. Image-locked Adjustments are disabled; Position disables geometry fields while opacity/blending stay enabled. Save references and close only the owned document; original modified921×921 Untitled-1 remains untouched. Preserve initial parser offset failure and corrected inventory03, plus custom-dialog AX/Escape failures. No live Photato workflow is claimed.

Native prerequisite implementation. Add PhotoCraftCore/LayerProtection.swift, PhotoCraftImaging/PSDLayerProtection.swift, PhotoCraft/AdobeLayerProtection.swift and three corresponding test modules plus11 fixture/provenance files. The value model preserves independent flags and observed dialog/shortcut distinctions; codec validates exact4-byte records, legacy transparency and unknown bits; contract parser distinguishes omitted/null/empty edit from explicit none/all. Re-fetch official AdobeDocs current contract: byte-identical pinned217,311-byte schema (SHA2569916044d…). It explicitly defines protection on EditLayer; no need to infer GA support from the beta-path guide. Duplicate partial flags are idempotent because the published schema lacks uniqueItems. All/none must stand alone.

These modules are intentionally isolated until the existing Layer model, all pixel/geometry/mask/group guards, UI, Photato operations and Adobe create-composite job adapter can switch together. Activating only the PSD interpretation would make previously fully blocked imported content editable before protection enforcement is ready. Existing PSDCodec still collapses flags and writes7 for locked; no correction to runtime behavior is claimed. No existing production module/API/menu is changed, removed or replaced. All user-facing lock functionality, rename correction, alpha-protected painting and editable .pcraft migration remain open; the next integration increment must include both APIs and desktop/history/persistence tests. This is an internal dependency of major D01/I03, not a completed major or minor feature.

Validation preparation. Preserve all previous frozen inputs; freeze01 includes the new modules,tests and independent fixtures. Run10 focused tests before the full Debug/Release/universal checks. No source/test edits while validation runs. Original Rust, installed117, user state and Xcode configuration remain preserved.

Focused01 passes / broader validation. All10 new tests pass without failures/skips on freeze01 (1,126 inputs/533 Swift files). All1,109 prior inputs remain byte-identical;17 files are added (three source modules,three test modules,nine PSDs,manifest,README). Start sequential full Debug,Release and universal build verification with immutable logs and all eight existing export families. Internal Adobe parser changes no exposed route/capability. Save a concrete six-part activation plan covering archive/model,permissions,painting,UI,both APIs and final migration qualification. Keep all major requirements open.

Contract detail / Debug qualification. All1,432 Debug tests pass; Release/build validation continues. Independent inspection confirms the same six enum values in all13 current protection properties. Their descriptions explicitly allow null to leave an edit unchanged, while the JSON schema declares array without nullable. Record this discrepancy in adobe-protection-contract-analysis01.json; the isolated parser follows the documented semantics, without claiming full endpoint/schema-validator conformance.

Migration review while packaging. Preserve plan01 and add plan02: legacy sourceTags lspf may be stale after native lock/unlock edits, so do not reinterpret old native locked Bool from provenance tags. Introduce explicit authoritative protection state with backward-read and mutation tests. No source/test changes during validation.

Intel harness failure and repair. Full Debug and Release each pass1,432 tests; universal packaging and692 unchanged output comparisons pass. Intel build-tests01 exits1 before any test runs: PhotoCraftAI is not compiled for @testable import. swift build --build-tests differs from swift test in Release. Preserve the complete compiler log/result; retry02 adds -Xswiftc -enable-testing and still invokes explicit x86_64 xctest. Sources/Tests and freeze01 remain unchanged.

Final frozen qualification / checkpoint151. All10 focused,1,432 Debug,1,432 Release and10 x86_64 Release focused tests pass without failures/skips. Intel harness attempt01 fails before tests because Release swift build --build-tests omits testable imports. Preserved retry02 adds -Xswiftc -enable-testing, then explicit x86_64 xctest; this avoids the previous arm64 discovery mismatch without changing frozen source. Universal macOS14+ package signature/resources/menus/Xcode verify;692 retained output/reference files equal150 byte for byte. All1,109 prior inputs remain unchanged;17 files are added, none removed/replaced. Original Rust hashes,installed117,user workspace and absent recovery state remain preserved.

Save checkpoint151,LAYER_PROTECTION_REFERENCES,candidate151,source/export evidence and the six-part activation plan. Update STATUS,PORTING_PLAN,COMMAND_PARITY,FUNCTION_PHASES,AUTOMATION_API,ADOBE_API_COMPATIBILITY and readable DEVELOPMENT_DIARY, preserving prior document copies. Relabel this milestone/index as references and model to distinguish isolated qualification from unfinished runtime behavior. Refresh/check development-history evidence and bind final audit to source/package/checkpoint. Master goal stays active; all major gates stay open and minor/detail work waits.

Baseline / scope. Classify149 as progress. Revalidate all1,100 frozen inputs/523 Swift files, packaging notices, checkpoint/audit and candidate149; installed117 is preserved. Previous validation handles are terminal. Continue major D01/I03 in the current externally named “-” directory without Git operations or subagents. Inspect the full source manifest and native models before mapping; document represented fields and semantic differences. Source .pcraft must migrate editable data rather than substitute previews. The user-facing increment must connect desktop and Photato API import,schemas,capabilities,errors,source-preserving persistence and tests together; no invented Adobe .pcraft contract. Keep every other major requirement open. Read current AGENTS/CONTRIBUTING and the149 development record. A glob including nonexistent CraftDocument*.swift fails under zsh; use actual paths from rg. Evidence: [local evidence archive].

Source/native mapping decision. Read the complete version1 schema, payload conversion/loading and color storage definitions. Native Bool locks, finite raster defaults, linear RGB32 profiles and missing Smart Object/artboard/auxiliary channel/rich-type/effect models prevent faithful direct mapping today. Narrow this increment to the lossless internal project reader and payload integrity; keep editable UI/API migration and I03 open. Preserve exact raw JSON/numeric tokens, all source layer kinds and metadata, every known surface/blob reference, signed tile coordinates/defaults and original sample bytes. Do not silently unlock layers or replace editable content with previews. Correct the initial research note: text_styles.psd_raw is inline JSON bytes, not a content-store hash; comp appearance effects do reference blobs. Add bounded JSON parsing and guarded directory-bundle reads; retain existing ZIP decoder. Record hashes and scope in source-native-map01.json. No public API capability is added at this stage. Earlier broad reads were clipped and guessed paths failed without changing files; narrow reads resolve the actual schema.

Implementation / independent fixtures. Add PcraftJSON.swift, PcraftDirectory.swift and PcraftProject.swift under PhotoCraftImaging, plus PcraftProjectTests.swift and Fixtures/PcraftProjects. JSON keeps exact numeric tokens, rejects duplicate keys, bounds depth/nodes; project graph validates identity/kinds/referenced surfaces and hashes, preserves original bytes/defaults and counts logical tile uses. Directory reads retain root identity, use no-follow relative opens/64KiB reads, reject special files and revalidate every consumed entry. Linked Smart Object paths are never opened. This is structural/payload integrity, not full feature-schema or rendering validation; previews are not imported. Existing reader rejects .pcraft publicly until an editable adapter is ready.

Use unmodified original tests/common/mod.rs rich_doc through owned Rust caller01/02 to generate RGB8/16/32 text, shape, smart, mask, channel, pattern, metadata and source-format fixtures; add comp appearance payloads, video defaults, inline styles and IDs above2^53. Caller01 wrongly asserted document equality and panicked (full diagnostic retained). Caller02 saves both manifests and reports differences: only document/layer IDs and comp links change. Source store.rs explicitly remaps extreme IDs when reserve_ids_through fails; this is expected original-loader policy, not lost pixel data. Keep original serialized IDs in the intermediate graph; adapter will map identities explicitly. Independent Python ZIP/JSON plus zstd CLI inventories every stored editing payload and surface. Synthetic profile/opaque blobs are arbitrary bytes, not valid ICC rendering fixtures. No upstream source changes. Add tests for exact payloads/metadata/48 pixel-format combinations, negative coordinates, unknown metadata, corrupt payloads, JSON/depth/budgets, directory/link/replacement safety and cancellation. Review catches and fixes strict hexadecimal defaults and escaping read closure before compilation. text_styles.psd_raw is arbitrary inline JSON (not restricted to bytes); preserve it exactly. Freeze inputs before focused testing.

Validation preparation / scope review. Freeze01 records1,109 inputs/527 Swift files (nine additions, all1,100 previous inputs retained). Focused01 compiles successfully and runs the container plus project suites. Source review identifies one boundary to check before final freeze: the original loader permits an empty child array beneath a group at maximum depth100; the graph reader currently checks depth before emptiness. Add a boundary regression and correct this after focused01 is terminal, never during frozen validation. The Rust01 panic emitted a large synthetic document dump; preserve its log but inspect only bounded diagnostics subsequently. Rust02 exits0 and the manifest diff proves ID/remapped comp-link changes only. Independent fixture generation exits0 with16 surfaces/74 payloads per depth (48 surfaces/222 stored payloads total). Inline text-style psd_raw is arbitrary JSON; prior wording “bytes” describes a test value, not the source type.

Focused01 passes / boundary refinement. All23 selected container/project tests pass (terminal session96556). A read-only process snapshot finds the XCTest process already finished; no sampling or interruption occurs. On terminal validation, change PcraftProject.layers to allow empty children at depth101 while still rejecting any layer deeper than100, matching original convert.rs/store.rs behavior. Add a101-group acceptance/102-group rejection test. This is a reviewed source-boundary correction, not a failed test repair. Retain freeze01 and its successful log, create freeze02 and rerun focused coverage before full/release/universal validation. No Sources/Tests mutation while tests are running.

Focused02 passes / full qualification starts. All24 focused tests pass on freeze02 (terminal session74175). Start validate01.py, sequential Debug suite, Release suite and universal build, each verifying root/isolated inputs before execution and preserving distinct outputs. No Sources/Tests changes until terminal. Record source-delta02.json: nine new files, zero changed/deleted prior inputs. Save source-native-map02.json to clarify arbitrary inline text-style JSON rather than restricted byte arrays, retaining map01. Prepare package verification, x86_64 Release focused qualification, finalization and final-audit scripts; these are evidence tooling, not application edits.

Next-major read-only dependency review. While freeze02 validates, inspect Layer.locked, Engine.index/editable and lock/move/pixel paths, ancestor locking, layer organization/geometry helpers, native panel controls and PSDCodec lspf/flags. Separate lock semantics affect commands, availability, format persistence and API state, not merely one stored property. Save the reviewed call-site plan as next-major-plan02.json, preserving plan01. Native API currently has no typed lock command in AutomationCommands; its next increment needs shared state/command/schema/error/history coverage plus Adobe mapping only where defined. Capture independent Photoshop lock behavior before parity claims. Initial guessed NativeArchive/Edit paths fail without changes; rg file discovery supplies actual Core/Engine/format paths. No application or test edits occur during validation.

Debug suite passes / Release continues. Full01 exits0 with1,422 passing tests, zero failures/skips,411.329s command wall time on unchanged freeze02. Existing diagnostic output still reports known Photoshop RGB32/vector differences; a passing suite is not a byte-parity claim. Release build/tests continue sequentially. Independently verify all754 protected original Rust/lock inputs unchanged (upstream-verification01.json). Save a reproducible fresh-destination fixture inventory script after the initial inline generator; no generated/test inputs are overwritten. Final phase records will replace the stale “manifest/content-store/directory still missing” item with the actual adapter/model/API gaps, preserving other outstanding export/platform requirements and historical149 evidence.

Release/build/export qualification. Release01 exits0 with1,422 tests and no failures/skips; build01 exits0 with arm64/x86_64 macOS14+ packaging. The owned validate01 session96650 is terminal; no Sources/Tests changed during the sequence. compare-exports01.py verifies identical file sets and all692 prior/current full/release output/reference files across eight export families. Save final-export-compatibility01.json and use it in finalization without rerunning the same comparison. Start package signature/resource/source verification and x86_64 Release focused XCTest qualification sequentially. Existing unrelated compiler warnings remain recorded; no cleanup/polish changes are folded into this major prerequisite.

Intel harness failure / explicit architecture retry. Package verification passes for arm64/x86_64,minmac14,signature/notices/icon/links and source hashes. Intel-tests01 builds the Release XCTest bundle successfully but exits1 during SwiftPM discovery: the host-arm64 swiftpm-xctest-helper cannot load its x86_64 bundle (NSCocoaError3585). This is not a passing run and no test-case failure is inferred. Preserve log/result and terminal session20790. Add intel-tests02.py: verify actual bundle architecture with lipo, then run that same built bundle using arch -x86_64 and Xcode xctest with the two explicit reader/container suites. No source/test edits or rebuild for this harness repair; fresh output files preserve attempt01. A preliminary read of a nonexistent Adobe reference filename also fails without changes; further lock-contract research remains for the next increment.

Final frozen qualification / checkpoint150. All24 focused,1,422 Debug and1,422 Release tests pass without failures/skips, plus24 x86_64 Release focused tests under Rosetta. Universal macOS14+ packaging verifies signature,resources,licenses,icon and unchanged menus/Xcode;692 prior full/release output/reference files equal149 byte for byte. Freeze02 has1,109 inputs/527 Swift files: nine additions and all1,100 prior inputs unchanged, no removals/replacements. Source original hashes remain checked; candidate150 is preserved separately from installed117 and real workspace/recovery state. This is intermediate source structure/payload qualification, not native editability, feature-schema validation, live UI or Photoshop parity.

Save ACTIVE_CHECKPOINT_150,PCRAFT_PROJECT_REFERENCES,source/export evidence and next-major plan. Update STATUS,PORTING_PLAN,COMMAND_PARITY,FUNCTION_PHASES,AUTOMATION_API and DEVELOPMENT_DIARY narrative/index, retaining prior document copies. Relabel this milestone/index to project graph and payload reader while preserving the initial editable-import intent and dependency decision. Next is native partial-lock semantics and adapter integration; no public capability or Adobe route is invented. Master goal remains active, all major gates open, optional minor/detail work deferred. Refresh/check the development evidence index and bind final audit to source/package/checkpoint hashes.

Baseline / source audit. Classify148 as progress. Verify checkpoint148,991 frozen inputs/515 Swift files,candidate148,installed117 and passing final audit. Previous native validation processes are terminal. Read current AGENTS/CONTRIBUTING: a concurrent documentation task added a human-readable diary and explicit addition/modification/removal rules; preserve those edits and bring its historical148 snapshot forward to the verified checkpoint. Continue major I04 original .pcraft migration. Source version1 uses ZIP STORE or directory bundles with Zstd/BLAKE3 content-addressed tiles/blobs; native import must preserve editable content rather than flatten a thumbnail. Inspect source ZIP/manifest/store/convert and primary format/hash specifications, establish independent source-produced fixtures, then implement native shared decoding and API coverage. Keep all major gates open. Initial reads used the wrong cwd for the prior review; guessed user Cargo paths and b3sum are absent, while Homebrew cargo/zstd exist. Tool discovery is unavailable, so use the exposed native web tool for primary references. Evidence: [local evidence archive].

1. Independent decoder references and source-fixture attempt. Pin the official BLAKE3 reference/vectors at f55849f89cd85083c1c9daa2c5de20766f309c00, Zstandard format at 49cf51799ea051457f57243527aa2058f999f005, and RFC8878; save URLs, bytes, licenses and hashes under references01. Inspect Apple compression headers: no public Zstd constant is available for the macOS14 target, so implement the needed decoder in Swift rather than add a Rust/C runtime. Source .pcraft uses 256px little-endian tiles, BLAKE3 hashes and Zstd frames. Create an independent Rust caller against untouched upstream crates. Installed Rust1.94 compiles the original crates with metadata-only --ignore-rust-version (workspace declares1.95), but caller01 fails because &Vec<u8> is not Read. Preserve its code/log/result and create caller02 using bytes.as_slice(); the original sources remain unchanged. Generated documents are owned procedural fixtures. Record the diary's verified148 update while preserving its earlier retrospective reconstruction. A read of nonexistent ACTIVE_CHECKPOINT_107.json is corrected to the recorded PAUSE_CHECKPOINT_107.json; no application source is changed by this investigation.

2. Native container prerequisites. Caller02 succeeds against unchanged upstream (three editable RGB8/16/32 projects with negative-coordinate tile pixels and density/feather masks,42 blob vectors). Add original Swift PcraftBLAKE3, PcraftZstdBits/FSE/Huffman, PcraftXXHash64, PcraftZstd and PcraftZIP under Imaging. Bound allocation/window/output, check checksums/content lengths, permit ZIP STORE/raw DEFLATE and data descriptors, reject unsupported dictionaries/concatenated frames/ZIP64/encryption and unsafe or overlapping archive paths. No extraction to disk. Full FSE compressed tables and Huffman literals are implemented; this is not a raw-block-only shortcut. The initial draft's ambiguous FSE-weight termination is corrected after inspecting upstream ruzstd0.9.1; no decoder code is linked or copied into the app. BLAKE3 follows the official CC0 reference; retain its license and provenance.

3. Independent fixtures and module tests. Add Tests/PhotoCraftImagingTests/Fixtures/Pcraft (101 files,~3.45MB) using generator01, with three source projects,42 source blobs,48 independent Zstd1.5.7 streams (four compression levels,known/unknown lengths,six patterns),four Python ZIP variants,official BLAKE3 vectors and attribution. Add10 PcraftContainerTests for exact decompressed bytes/hashes,source tile addresses,deflate/descriptors,hand-framed Huffman reuse/raw/RLE,checksums,truncation,invalid paths/limits,mutation safety and cancellation. App/source edits are now frozen before validation; no previously running validation was active. API review: these internal decoder modules do not yet expose project import or change executable capabilities. Preserve I04 as open; mapping,document transactions,desktop/API entry points and their equivalence tests are the next required migration increment. No existing production module was replaced or removed.

4. Focused01 compile failure retained. The frozen1100-input/523-Swift attempt01 fails compilation because nine ZIP header read expressions need explicit try across comma-separated conditions. No tests run. Preserve source isolation, hash manifest and compiler log; add the missing error propagation in PcraftZIP only, then freeze02 and rerun the10 module tests.

5. Focused02 and independent fixture repair. All independent source/CLI/BLAKE3/ZIP checks pass, but the10-test run has one failure: the hand-built two-block Huffman frame declares a4-byte window while its compressed block occupies7 bytes. Zstd1.5.7 independently rejects that same fixture (handframe-oracle01.json) and accepts the repaired1024-byte-window variant with exact output00010100. Preserve both artifacts and freeze02. Correct only the test framing, retain the original as an explicit rejection, and target the missing-Huffman-table mutation at the actual literal header. Add sliced-Data ZIP input coverage. No production decoder changes are needed. Reconcile the phase catalogue: original .pcraft migration is I03, not I04 as previously abbreviated; D01 depends on both I03 migration and I04 export/interchange. Keep all gates open.

6. Focused03 passes; source dependency pin verified. All10 decoder tests pass with zero failures/skips in24.821 seconds. The original workspace lock pins ruzstd0.9.0, while caller02 resolved0.9.1. Preserve caller02 and independently build caller03 with the untouched upstream Cargo.lock as seed and an explicit0.9.0 pin. All88 emitted files (three projects,42 compressed/raw pairs,provenance) match caller02 byte for byte. Original upstream sources/lock are preserved; no test fixture or production change is required. Advance frozen03 to full Debug/Release and universal packaging. Foundation capabilities remain internal; I03 import and every major gate stay open.

7. Final frozen qualification and records. All10 focused,1,408 Debug and1,408 Release tests pass with no failures/skips; universal arm64/x86_64 macOS14+ packaging verifies signature,notices,icon,links and the unchanged Xcode project. Optimized probes compile the exact seven frozen decoder sources with production Core objects and verify42 tile addresses,42 source blobs,48 CLI streams,35 official hash vectors and four ZIP variants on both architectures; all result bytes match (Rosetta is not physical Intel/macOS14 proof). Every retained export in16 prior/current configuration folders remains byte-identical148. Installed117,real Workspaces.json and absent recovery settings/data remain unchanged. Source delta adds109 inputs (seven modules,one test module,101 fixture files),retains every991 prior input,and deletes/replaces none. NOTICE/ATTRIBUTION add BLAKE3/format provenance; no build configuration,API implementation or menu binding changes.

8. Checkpoint scope and next work. Save checkpoint149,PCRAFT_CONTAINER_REFERENCES,source/export manifests and the candidate ZIP. Update STATUS,PORTING_PLAN,COMMAND_PARITY,FUNCTION_PHASES,AUTOMATION_API and the readable DEVELOPMENT_DIARY narrative/index. The milestone/index label now says container foundation to distinguish tested dependency completion from unfinished editable migration; preserve the original investigation account and explicit I03/I04 correction. Preserve prior documentation copies,all source/fixture/compiler attempts and every failure. Internal prerequisite work does not advertise a new API; native/API import,mapping,source-preserving persistence and broader source features are next. All major gates and the master goal remain active; minor functions/details wait. Refresh/check the evidence inventory and bind the final audit to this source/package/checkpoint.

Baseline / investigation. Classify147 as progress. Revalidate checkpoint147,986 frozen inputs/510 Swift files,candidate147,installed117 and final history audit. Previous validation sessions are terminal. Read current repository/development rules and continue major D01/I04 with JPEG output controls. The existing shared ImageIO path hardcodes quality0.95 and white matte; the native accessory has no JPEG controls. Reconcile desktop numeric quality/format/scans/matte with the pinned Adobe job schema before adding shared native/API behavior. Preserve existing output defaults unless a verified Photoshop contract requires a documented correction. Inspect native codec capabilities and independently verify actual encoded structures rather than treating accepted ImageIO property names as proof. All major gates remain open. Evidence: [local evidence archive].

Contract / encoder investigation. The current Adobe-owned OpenAPI file is byte-identical to the pinned contract (references01/provenance.json). Execute-actions uses JpegOutput with seven named quality values, without scan; JpegOutputWithScan belongs to other endpoints. The current migration guide explicitly excludes scan from execute-actions. UXP documents quality0…12, standard/optimized/progressive, matte and profile options; SDK defaults are not evidence of the factory native dialog. Native probe01 compiles/runs successfully and produces39 files:13 qualities × default/baseline/progressive. Independent marker inspection verifies baseline SOF0/one SOS and progressive SOF2/ten SOS, so the public ImageIO flag does not establish Photoshop3–5 scan control. Baseline has standard Huffman tables. Implement original bounded Swift entropy recoding for Baseline Optimized, keeping quantized coefficients and metadata unchanged; use installed libjpeg-turbo3.1.3 jpegtran/djpeg only as independent test oracles, never app runtime dependencies. Preserve omitted95%/white/profile defaults. Add quality, format, custom sRGB matte and profile controls to the native accessory and Photato schema; Adobe action outputs receive only the published quality field. The local numeric/named quality mapping is not proof of Adobe quantization or byte parity; progressive scan-count control remains open. No application inputs have changed or tests started at this point.

Implementation / first freeze. Add JPEGContainer marker/ICC handling and JPEGEntropyOptimizer with bounded single-baseline two-pass symbol analysis/re-encoding, cancellation, malformed-input guards and16-bit canonical Huffman limits. Add JPEG encoding options and native Save/Copy controls, forwarding options through DocumentIO. Strict Photato parameters/state/schema and JPEG action outputs share the same native engine; the Adobe interface accepts seven published quality values and rejects scan with400 and Photato extensions with422. The documented local quality map is0/2/4/6/8/10/12. Add five imaging and three native/HTTP/contract tests covering all13 qualities/three formats, tiny/odd dimensions, three depths, matte/ICC, cancellation/malformed input, save/copy/state/invalid/busy behavior and actual job routes. Update the old unsupported-JPEG test to unsupportedWebP. Preserve omitted encoder defaults. Freeze01 before compilation; independent external coefficient/sample validation follows. Live UI and all major parity gates remain open.

Focused01 compile repair. Freeze01 contains991 inputs/515 Swift files. Compilation fails before tests: Swift cannot resolve the overloaded CGFloat.init mapping plus the array literal in the custom matte expression. Preserve the complete failed log/source; after session5319 terminates, use an explicitly typed closure/literal. No behavior or assertions weakened. Freeze02 and rerun focused validation.

Focused02 / actual ImageIO behavior. All47 focused tests execute with6 failures (5 unexpected). The production AddImageAndMetadata path emits a nonzero DRI/restart interval, unlike the smaller AddImage probe; rejecting restarts makes optimization fail. It also represents default sRGB via EXIF without an ICC APP2 block, invalidating the initial profile-presence assumption. Preserve logs and freeze02. After session84759 terminates, implement entropy padding/restart sequence handling at MCU boundaries in both passes, preserving coefficient deltas and DRI. Explicit jpegEmbedProfile=true now inserts the actual working ICC before SOF with bounded APP2 splitting; nil retains existing platform signaling and false removes only ICC APP2. Correct the explicit-profile positive test and capability/default labels. Native sheet error occurred alongside failed encoding and will be independently reevaluated. Freeze03; no parity claim made.

Focused03 / fixture correction. The five imaging tests and native Save/Copy controls pass, including all quality/format combinations and restart handling. Across47 tests, the HTTP test reports3 assertions (1 unexpected) because its shared helper starts with transparency and ordinary JPEG Save correctly rejects it422. Preserve that explicit rejection, then fill the owned test document opaquely before asserting successful ordinary Save. Do not weaken the production representability guard. Preserve frozen03/log; session80974 is terminal before editing. Freeze04 and rerun.

Focused04 passes / full validation. All47 focused tests pass, zero failures/skips, on991 frozen inputs/515 Swift files. The earlier native sheet error does not recur after the codec repair; no unrelated document lifecycle code was changed. Independently compile/run a helper against hash-verified147 production Release Core/Imaging objects to preserve three prior JPEG default outputs at8/16/32-bit before the new build replaces scratch objects. Begin full Debug, Release and universal build sequentially on freeze04. No Sources/Tests edits during validation. Prepare independent libjpeg-turbo coefficient canonicalization/integer-IDCT comparison and public Release Save accessory/callback probes for both architectures; all major gates remain open.

Diary reconstruction on 20 October 2026

The maintainer renewed the requirement to record every addition, modification and deletion and requested a human-readable account reconstructed from project history. This side-conversation change is documentation only. Add docs/DEVELOPMENT_DIARY.md: a chronological account of the original brief, changed requirements, implementation, removals, failures and open work, with all148 existing milestone links. Use the inherited explicit requirements, surviving DEVLOG/checkpoints and a read-only retrieval of recent history from “Port Photoshop Clone to Swift”; do not claim an exhaustive replay of all chat/tool history. Label the reconstruction date and original evidence gaps. Keep147 as the latest verified checkpoint and148 as work in progress, including the observed focused02 result of47 tests/six failures; no JPEG repair or success is claimed by this documentation task.

Strengthen AGENTS.md and CONTRIBUTING.md to name additions, modifications, deletions, renames, rollbacks and replacements across code/tests/assets/configuration/docs/APIs, with affected paths, reasons, behavior, validation and removal/replacement details. Require readable-diary updates at completed checkpoints while detailed notes continue during work. Add the DEVLOG navigation link. Preserve the three previous documents, the diary's source snapshot/hash and application/test/package baseline in [local evidence archive]. No application implementation, tests, builds, Git operations, goal changes or messages to other chats are performed. The initial tool-discovery request was unavailable; the existing read-only thread tool provided history. Large preliminary excerpts were clipped, so narrower source reads were used before drafting. Validate new links/index and documentation evidence below; retain any concurrent-history limitation rather than inventing a clean audit.

Diary documentation checks. All274 local links/anchors resolve, all148 numbered milestones appear once in chronological order, and all909 recorded application/test/package/project inputs are unchanged with no source/test additions or deletions. The diary has4,351 words. Results: [local evidence archive]. The full evidence refresh indexes148 milestones,34,524 evidence files and18,820 logs with zero missing explicit references. The subsequent check does not pass: concurrent parent work adds jpeg-debug-marker-diagnostic01.json and changes full01.log in the active148 run. Preserve refresh01/check01, audit-commands01.json and concurrent-inventory-diagnostic01.json in [local evidence archive]. This is a moving-inventory failure, not a missing diary link or a passing full-history audit. Leave the main build running; its checkpoint audit must refresh/check the final evidence. No native tests are rerun for this documentation-only change.

Next-major investigation while frozen. Read the original PhotoCraft format book, manifest/migration/store sources and Cargo metadata without editing upstream. Version1 .pcraft is ZIP STORE or directory, with Zstd-compressed BLAKE3-addressed little-endian tiles/blobs. Source schema includes many editable document fields, so thumbnail flattening cannot count as migration parity. Record hashes and native decoder/container/budget/independent-fixture prerequisites in next-pcraft-review01.json. Initial assumed src and FileHandling glob lookups fail; rg discovery locates the actual crate/native paths. Prioritize this major original-source migration workflow next while preserving Maximize Compatibility and all remaining D01/I04 requirements. No application/test inputs changed during validation.

Debug pass / next-major platform check. All1,398 Debug tests pass in295.559s, zero failures/skips. The independent marker diagnostic sees58 generated JPEGs with expected ICC presence for explicit embedding and absence for stripped/default sRGB output. Release validation continues on unchanged freeze04. The installed SDK public compression.h has no ZSTD declaration (rg no-match exit1); record its hash and avoid assuming an Apple macOS14 Zstd API for the upcoming .pcraft decoder.

Live Photoshop available / independent references. CUA now opens Photoshop2026 successfully, superseding the earlier locked-Mac observation. Open only the owned q8-baseline.jpg129×73 output; preserve the existing modified Untitled-1. Use native File→Save a Copy to create five new embedded-sRGB quality8 JPEG references: standard baseline, optimized, Progressive3/4/5. Capture actual JPEG Options screenshots in the conversation; AX confirms numeric8/High, disabled matte None for this opaque source, three format choices, scan3/4/5 and Preview. These are observed document/session choices, not factory-default proof. One clipboard paste times out; the actual native path field succeeds. One helper stops while Save is temporarily unavailable; a fresh state supplies the enabled Save button. All five outputs are parsed and hashed in photoshop-jpeg-reference01.json. Photoshop progressive3/4/5 emits7/10/14 SOS segments; quality8 DQT differs from current ImageIO mapping, and Photoshop uses4:4:4 here. Close only the owned image; CUA returns to the original modified Untitled-1 with its921×921 dimensions. Source artifact is checked against the independent export hash. No frozen application/test input changes. Photoshop quantization/scan/UI parity stays open, now with concrete independent references.

Final qualification / checkpoint148. All1,398 Debug tests pass in295.559s and1,398 Release tests in84.187s, zero failures/skips, on991 inputs/515 Swift files. Independent libjpeg-turbo verifies116 JPEG outputs,26 canonical coefficient/metadata pairs and26 exact integer-IDCT pairs,36 explicit red-matte outputs and58 matching Debug/Release JPEGs. Prior TIFF/PSD independent suites reverify;161 retained unrelated outputs and three default JPEG depth exports equal147. Public production Release JPEG controls/save/reopen pass for three formats on arm64/Rosetta, with previous opening/TIFF/PSD checks. Universal package/signature/resources verify; installed117, real workspace/recovery, Core/AI and Xcode stay preserved. Failed attempts01–03 remain retained. Five live Photoshop quality8 references establish7/10/14 progressive SOS counts and different DQT/sampling; original Untitled-1 is restored. Photoshop quantization,3–5 scan choice, defaults/dialog/live/platform and all major gates remain open. Next: major original .pcraft migration, preserving Maximize Compatibility and all remaining format dependencies. Updated API/phase/command/status/reference records; finalize evidence audit.

Baseline / investigation. Classify146 as progress. Verify corrected checkpoint146,953 frozen inputs/507 Swift files,candidate146,installed117 and final history audit02. No validation process remains active. Continue major D01/I04 by preserving global user-mask display metadata and broadening little-endian rich layer transport through shared PSD semantics. Read current AGENTS/development records and primary Adobe TIFF/PSD specifications; inspect pinned psdtags and ExifTool's author implementation for structural byte order. ExifTool recognizes reversed descriptor type identifiers in little-endian layer metadata while string IDs stay textual; opaque payloads must still be treated according to their own structures. Establish independent fixtures and bounds before qualifying additional records. Keep the full Photoshop/native/API/platform objective and all major gates open. Evidence: [local evidence archive].

Structural implementation / reference qualification. Add bounded numeric transport for Levels, Curves, Hue/Saturation, Color Balance, Threshold, Posterize, Gradient Map and vector-mask records; shared PSD readers retain semantic validation. Preserve retained global LMsk metadata in PSD/PSB/TIFF serialization. A draft generic descriptor converter is preserved under rejected-descriptor-draft01 and removed from production before testing: pinned Krita reader/writer disagree about identifier byte order and the reader omits its order template in descriptor names/classes. Do not certify a guessed fill/path descriptor representation from that code. Pinned primary references01/02/03 include hashes and three initial404s corrected using the repository tree. No GPL implementation is copied. The author's TIFF article supplies general structural endian context, not detailed2026 descriptor proof. CUA inventory succeeds, but Photoshop access explicitly reports the Mac locked; prior unlock request stays pending. Several guessed source paths/globs failed and were corrected with repository discovery. Independent synthetic numeric/vector/global-mask fixtures and native/API tests follow; all major gates remain open.

Independent fixtures / workflow coverage. Generator attempt01 succeeds: six8/16/32-bit TIFF containers across both byte orders and22 literal record payloads are constructed without importing Photato. Pinned psdtags independently decodes the containers, all cached layer sample arrays and nondefault LMsk; it treats rich blocks as opaque, so payload construction is labeled separately from independent semantic decoding. Add imaging checks for exact canonical record bytes/typed numeric values/Unicode/vector geometry, native/PSD/PSB/TIFF preservation, truncation/limits/unknowns and cancellation. Add native Open/history/Save/Copy and actual HTTP upload/download/save plus both job-interface regressions. Update capability and Save explanations; existing contracts/options remain sufficient and Adobe rejects Photato-only options. Update the prior LE Levels guard expectation to successful preservation. Freeze before compiling; no tests run yet.

Focused01 / fixture correction. Freeze01 has986 inputs/510 Swift files. Focused01 runs96 tests in24.886s with5 failures (4 unexpected). The new synthetic32-bit fixture incorrectly includes a Gradient Map, which the existing Photoshop-compatible serializer intentionally forbids at32-bit; this causes imaging/API export failures and cascading reported cleanup/native errors. Preserve the failure/freeze and remove that record only from32-bit positive fixtures, retaining full8/16-bit Gradient Map assertions and adding explicit rejection for32-bit Gradient Map export. No production restriction is weakened. Investigate any remaining native error independently on focused02; do not claim it resolved yet.

Focused02 passes / full qualification starts. All96 focused tests pass in25.289s, zero failures/skips, on unchanged986-input/510-Swift freeze02. Native errors from the failed run do not recur after correcting the invalid32-bit Gradient Map fixture; no format-detection or lifecycle production changes were needed. All8/16-bit Gradient Map checks and the explicit32-bit export rejection remain. Begin full Debug, optimized Release and universal package validation sequentially on the same frozen sources. Prepare independent numeric/payload/global-mask output inspection and public Release native callback/save checks for both architectures; no Sources/Tests edits while validation runs.

Next-major reference preparation during frozen validation. Read current Adobe desktop JPEG guidance, UXP JPEGSaveOptions and Firefly v2 output migration guidance. Record next-jpeg-reference01: desktop numeric quality/matte/baseline/progressive controls differ from the published API quality enums and operation-specific defaults. Current native Save policy uses fixed95% quality. Next inspect shared encoder and already implemented job fields; do not invent Adobe options or assume JPEG encoder equivalence. A guessed accessory filename failed, with repository discovery deferred to the next implementation. No application inputs changed.

Reference pin during validation. Preserve ExifTool author source at commit2200871d9cef988051d2a99d67df3bda6cbb30a8 with SHA in references04/provenance.json. Its layerTime matcher recognizes both doub/buod alongside literal layerTime; that does not settle short descriptor-ID representation. No third-party runtime code is introduced, and guarded descriptor scope is unchanged.

Full Debug / independent-oracle repair. All1,390 Debug tests pass in298.123s with zero failures/skips. Independent rich output attempt01 fails its first-layer name assertion. Diagnostic01 and pinned psdtags source show two oracle limitations: PsdLayerMask.read tests bit3 (0b1000), while its enum/documented applied-parameters bit is bit4; PSB tagged-record iteration requires8B64 although valid8BIM tags are accepted by the format. Preserve failed script/log and diagnostic. Add a separate bounded raw-record framing/name/Unicode/parameter parser, retaining the unmodified pinned psdtags channel and global-mask decoders. Inspector02 passes all24 Debug rich outputs, including exact literal rich bytes, vector parameter density/feather, base sample bits and nondefault LMsk. No application source or assertions are relaxed. Release validation remains on freeze02.

Release / independent qualification passes. All1,390 optimized tests pass in78.684s, zero failures/skips. qualify-oracles01 runs six independent inspections successfully:48 rich outputs,72 prior layered TIFFs,48 layered PSDs,88 storage TIFFs,18 Float32 TIFFs,22 LZW boundary streams and96 PSD/PSB compression outputs. All161 unrelated outputs equal146 and their current Debug counterparts byte-for-byte. The synthetic fixture generator reproduces all29 payload/container/provenance files exactly. Extended-mask/PSB oracle limitations remain explicitly recorded; they do not become Photoshop parity claims. Universal package build remains active on the same freeze02; public Release callbacks and final audit follow.

Final qualification / checkpoint147. All1,390 Debug tests pass in298.123s and1,390 Release tests in78.684s with zero failures/skips on986 inputs/510 Swift files. Independent output checks cover48 rich TIFF/PSD/PSB files with exact base samples/global-mask values and independently constructed literal rich payloads; this is not independent rendering or Adobe-produced fixture proof. The previous72 layered TIFF/48 layered PSD/88 storage TIFF/18 Float32 TIFF/22 LZW streams/96 PSD compression outputs reverify;161 unrelated whole outputs equal146 in Debug and Release. Public production Release six rich TIFF callbacks/saves and PSB data checks pass on arm64/Rosetta, alongside previous checks. Universal package/signature/resources verify; installed117, actual workspace/recovery, Core/AI and Xcode remain unchanged. Preserve failed focused01, corrected fixtures, and rejected descriptor draft/reference inconsistencies. Live Photoshop remains unavailable while the Mac is locked; all major gates stay open. Update phase/API/command/status/reference records and finalize the evidence audit.

Baseline / design. Goal remains active under major → minor → details ordering. Classify145 as progress; baseline01 verifies its checkpoint,952 frozen inputs/506 Swift files,candidate145 and installed117. Previous validation processes are terminal. Continue D01/I04 with layered TIFF output using the shared PSD serializer without a redundant merged PSD cache. Preserve existing flattened export defaults; ordinary Save defaults to preserving editable layers and rejects explicit flattening of layered documents. Expose preservation and RLE/ZIP layer compression in native Save/Copy and Photato options/state/capabilities; the pinned Adobe TiffOutput has no equivalent preservation option, so keep its published contract/defaults and explicit extension rejection. Both endian orders use structural conversion with unchanged channel samples; rich little-endian payloads remain guarded until qualified. Bound reader global-block count as a related parser dependency. Preserve installed117, user state and all open major gates. Evidence: [local evidence archive]. Initial read incorrectly prefixed Sources with PhotoCraftSwift; rg located the root-level sources. No content was inferred from the failed read.

Implementation / focused01. Shared PSD serialization now optionally omits its merged cache for TIFF embedding; public PSD/PSB defaults are unchanged. TIFF writes depth-specific layer blocks/resources and the distinct first MTrn marker, preserving structural endian order while channel samples remain big endian. Native Save defaults to layer preservation; Copy/download/job defaults stay flat with explicit preservation controls. Strict options/state/capabilities expose RLE/ZIP independently of composite compression, without extending Adobe fields. Reader global blocks are bounded to4096; endian conversion handles extended mask parameters and zero-width row tables. Four imaging and three native/HTTP/job tests cover36 output combinations, exact independent input samples, big-endian rich records, explicit little-endian guards, cancellation, original-file protection and actual API contracts. Frozen01 contains953 inputs/507 Swift files. Focused01 executes89 tests in24.683s with one old assertion failure: the layered Save As format list did not expect newly eligible TIFF. All new tests pass. After session29309 terminates, update that expectation only; retain the failed source/log and freeze02 for rerun. Current Adobe TIFF guide confirms RLE/ZIP layer choices and copy-only discard behavior; Ask Before Saving Layered TIFF Files, exact options dialog/defaults, Save Transparency/pyramids and full Photoshop parity remain open. A guessed test-module path failed during inspection; rg located PhotoCraftAppTests.

Focused02 / full qualification. All89 focused tests pass on frozen02, zero failures/skips. Begin sequential full Debug, full Release and universal build01 using the same953 inputs/507 Swift files, with no Sources/Tests edits while active. Export36 layered TIFF variants per configuration for pinned independent psdtags decoding alongside the prior PSD/storage/float outputs. Prepare production-object public native save/control probes for arm64 and Rosetta. CUA Photoshop lookup returns cgWindowNotFound; listApps explicitly confirms the Mac remains locked. Preserve the prior unlock request and user state; live Photoshop validation remains pending rather than inferred from automated tests.

Independent Debug output / metadata boundary. Pinned psdtags decodes all36 Debug layered TIFF outputs with every independently supplied layer/mask sample bit exact; tifffile decodes each composite, byte order and compression choice. Its warnings report missing global usermask display metadata (LMsk), not missing per-layer masks. Review confirms the shared PSD writer currently omits that retained source overlay block; record explicit follow-up for broader global/display metadata preservation before full TIFF parity. No Sources/Tests change during the running full/release/build pipeline. Full Debug exits0; optimized compilation continues.

Final qualification / checkpoint146. All1,383 Debug tests pass in297.131s and all1,383 Release tests in77.739s, zero failures/skips, on953 inputs/507 Swift files. Independent psdtags verifies72 layered TIFF outputs and48 PSD reexports with exact layer/mask bits. Prior88 storage TIFF,18 Float32 TIFF,22 LZW boundary streams and96 PSD/PSB compression outputs independently reverify; all161 retained whole output files equal145. Public production Release24 layered Open callbacks/six PSD saves/six layered TIFF saves pass on arm64/Rosetta alongside six earlier Open callbacks/four-format saves/three default and12 storage TIFF saves. Universal macOS14+ packaging/signature/resources verify; installed117, actual workspace/recovery, Core/AI and Xcode remain unchanged. Preserve focused01 stale expectation and repair. CUA confirms the Mac remains locked; live Photoshop comparisons remain pending. Update API/phase/command/status/reference records; all major gates remain open. Final history audit binds source/package/checkpoint identities.

Final documentation correction. The first final history audit passes. Subsequent command-name verification finds that generated API evidence incorrectly listed document.saveCopy, which is not a registered typed command. Preserve the complete draft documents and first audit under this run; remove that invented name from current checkpoint/reference metadata and clarify that native Copy is reflected through API downloads. Registered document.save/document.saveAs and download/job tests already cover the new options. Source, tests and candidate bytes are unchanged. Rerun only the documentation audit as refresh02/check02 and bind the corrected checkpoint hash; no unrelated test rerun.

Baseline / investigation. Classify144 as progress and verify its checkpoint hash,907 frozen inputs/502 Swift files, candidate144, installed117 and completed history audit. All previous validation handles are terminal. Continue major D01/I04 with layered TIFF: inspect Adobe’s primary TIFF/file-format specifications and pin the psdtags author’s independent implementation/license/example for reference and qualification. Existing PSD/PSB layer/resource machinery is the candidate shared engine; do not create a separate editing model. Current TIFF imports silently take the composite and ordinary Save is single-raster-only; examine framing, endian behavior, independent fixtures and native/API representation policy before changes. Keep all major gates open and preserve installed117/user state. Evidence: [local evidence archive].

Transport investigation / scope decision. Pinned psdtags 3b72663b375b60dbadaedfa6eefe5bb4c5cd9e7a and installed NumPy2.4.1/tifffile2026.1.28/imagecodecs2026.1.14 in an isolated temporary oracle environment; installation exits0. Primary implementation confirms TIFF-order structural integers/FourCC/Unicode and always-big-endian channel samples, including compressed payloads. Krita's pinned TIFF test directory contains ordinary/multipage raster files, with no identified Photoshop-layer fixture; no third-party images were copied into tests. Implement this increment as editable layered TIFF import, followed by native layered output in the next dependency: use the existing PSD layer engine with the independently decoded TIFF composite, bounded tag37724 framing, matching profiles and explicit unsupported-record errors. Both byte orders admit raster/group/mask metadata; little-endian rich adjustment/fill/vector/opaque blocks remain explicit gaps until their structures are independently qualified. Big-endian rich blocks use existing PSD validation. No on-disk PSD serialization defaults change. Save a Copy remains flattened, and ordinary layered TIFF Save remains guarded until the writer is complete. This is a major-workflow dependency, not a closed parity gate. The initial guessed PSDMaskRecord.swift inspection path failed; rg located PSDMask.swift. Oracle probe01 succeeds and records the pinned library enum names.

Implementation / independent fixtures. Add TIFFLayers and TIFFLayerEndian, bounded selective container-field retention and an internal externally decoded composite handoff to PSDCodec. Endian conversion covers structural fields, channel/RLE headers, basic mask parameters, groups and common tags; compressed sample payloads remain untouched. Native/API Open uses this shared path; ordinary layered TIFF Save stays guarded while native/PSD Save As retains edits. Both isolated action-job interfaces now accept TIFF through the shared native decoder without new Adobe fields. Expose exact supported/unsupported scope in transfer/job capabilities. Add six imaging and three native/HTTP/job tests. Pinned psdtags fixture attempt01 fails in its own reader because its Unicode writer counts code points rather than UTF16 units for a surrogate pair; preserve script/output/traceback and use BMP Unicode in independent attempt02. All24 RGB8/16/32 × both orders × four layer-compression fixtures then generate and independently decode successfully. A separate native PSD-to-TIFF transport test covers surrogate-pair names and rich big-endian Levels/mask parameters. Adobe's current reference page loads, but its embedded schema URL is inaccessible in web and HTTP404 in Python; retain the already pinned official contract at docs/contracts/adobe-photoshop-v2.json (Image resource shape permits these inputs; no request schema changes). Guessed PSDGroupTests.swift inspection path fails; no evidence is inferred from it. Freeze01 next; no application tests have run on these changes yet.

Focused01 compile failure / repair. Freeze01 records946 inputs/506 Swift files. Focused01 exits1 before tests: four throwing TIFF admission expressions lacked individual try markers, and Swift warns that grouped switch patterns only apply where to their last pattern. Add explicit try markers and per-pattern guards; make both expected-file reads explicit in the matrix assertion. Preserve frozen01/log/result; no source edits while validation was active. Freeze02 next.

Focused02 passes / full qualification begins. Freeze02 keeps946 inputs/506 Swift files. All54 selected tests pass with zero failures/skips in16.364s, including24 independent layer matrices, rich big-endian records, malformed/profile/mask/cancel guards, native Open/edit/Undo/editable persistence/original-source protection, actual HTTP upload and both job interfaces at8/16/32-bit. Independent fixture regeneration reproduces all34 TIFF/raw/provenance files exactly. Start sequential full Debug, full Release and universal build on frozen02; no Sources/Tests edits while validation is live.

Post-suite reference finding / preservation repair. Frozen02 passes all1,375 Debug tests in295.767s, all1,375 Release tests in77.110s and universal build01; all validation handles are terminal before source changes. Independent decoding verifies48 layer PSD outputs,88 storage TIFFs,18 Float32 TIFFs,22 LZW boundary streams and96 PSD combinations. Final primary reference review of psdtags issue17 identifies Photoshop's distinct, undocumented MTrn marker before layer blocks; it must not be renamed to PSD Mtrn. Add strict empty/first marker admission and separate retained tiffGlobal_MTrn metadata, while explicitly rejecting saved alpha/spot or unsupported ExtraSamples layouts. Preserve fixture-attempt02; extend the independent generator with six marker files and add one targeted test. Native/HTTP/both-job fixtures now exercise marker inputs; public Release probe will exercise them in its six PSD-save cases. Preserve full01/release01/build01 as pre-marker qualification and freeze03 for final requalification.

Focused03 passes / final requalification. Freeze03 records952 inputs/506 Swift files. All55 focused tests pass in16.336s, zero failures/skips. All30 independent fixtures generate/read successfully, including six distinct MTrn cases. The new marker survives separately from PSD metadata; saved-alpha/spot channel layouts reject and marker inputs pass native and both API workflows. Start full02/release02/build02 on this frozen state; no Sources/Tests edits while validation is live.

Final qualification / checkpoint145. All1,376 Debug tests pass in296.372s and all1,376 Release tests in77.005s, zero failures/skips, on952 inputs/506 Swift files. Independent psdtags verifies48 PSD exports with exact layer/mask bits;40 fixture/expected/provenance files regenerate exactly. Prior88 storage TIFF,18 Float32 TIFF,22 LZW boundary streams and96 PSD/PSB compression outputs independently reverify; all161 retained whole output files equal144. Public production Release24 layered TIFF Open callbacks/six PSD Save As cases pass on arm64/Rosetta alongside six earlier Open callbacks/four-format saves/three default and12 storage TIFF saves. Universal macOS14+ packaging/signature/resources verify; installed117, actual workspace/recovery, Core/AI and Xcode remain unchanged. Preserve focused01 compile failure and independent generator01 defect/repair. CUA confirms the Mac remains locked; prior unlock request stays pending. Update API/phase/command/status/reference records with import-only scope and layered writer next; all major gates remain open. Final history audit binds source/package/checkpoint identities. A few read-only guessed controller/Layer/LOCAL_API paths returned missing-file errors; subsequent rg located NativeDocument.swift/AUTOMATION_API.md, with no inferred contents or code changes from the failed reads.

Baseline / reference investigation. Classify143 as verified progress; revalidate890 inputs/497 Swift files, candidate143, checkpoint/audit and installed117. All prior validation handles are terminal. Continue major D01/I04 with native/API TIFF byte order, channel layout and float predictor; layered TIFF, broad metadata/profile and whole-file parity remain open. Read Adobe’s current TIFF guide, TIFF6 specification from ITU and pinned LibTIFF predictor source as primary technical references. Author-hosted AdobeTechnicalNote3 remains unavailable. Apple public headers expose no predictor/planar/byte-order controls; investigate a bounded Swift serializer over ImageIO’s uncompressed pixels/metadata, preserving all existing no-new-options outputs. First independently construct storage variants and verify system decode before changing application inputs. Evidence: [local evidence archive].

Independent decode finding / native integration. Python storage probe01 generates both endians × interleaved/per-channel × ZIP prediction off/on. ImageIO retains all interleaved samples, but its planar Float32 path replaces alpha with NaN in all four variants. Probe02’s diagnostic JSON serialization aborts on that NaN; preserve it as a failed diagnostic, then probe03 records UInt32 sample bits and isolates the alpha defect. Implement bounded classic TIFF directories, Swift TIFF LZW and native strip decode/layout/prediction; preserve opaque ICC/XMP and endian-convert typed metadata/child directories. Use direct import only when the embedded/working RGB profile bytes match, leaving conversion to ColorSync otherwise. Add native Save/Copy controls and strict Photato option/schema/state/capability coverage; keep the published Adobe output contract unchanged. Independent synthetic fixtures and generator/provenance join the imaging tests, alongside a44-case depth/order/layout/compression/prediction matrix, LZW width/reset boundaries, malformed/cancelled inputs, native save/copy/failure state and actual HTTP/job contracts. Original ImageIO outputs remain the default when no storage option is requested. No source tests have run yet; freeze next. A few guessed file paths failed during inspection and were corrected using repository search. Full layered/pyramid/JPEG-TIFF/color/large-file/live/Photoshop parity remain open.

Focused01 failure and repair. Freeze01 contains907 inputs/502 Swift files. python3 .../focus.py 01 exits1 after290 tests/2 unexpected failures in168.987s: the new writer rejects the8/16-bit ImageIO intermediate because its alpha is associated (ExtraSamples1); Float32 uses unassociated alpha (2). Standalone production-object diagnostic compile/run succeeds; its first Python metadata-inspection command has a globals-scope NameError and a corrected result02 records the tags. Allow associated alpha for byte-preserving storage rewrites while retaining ImageIO’s established associated-alpha import/conversion behavior. The native straight-sample import still requires unassociated alpha. Review also identifies tiled TIFFs needing explicit deferral to ImageIO, so retain tile tags for admission and add a regression assertion. Preserve frozen01 and all failures; no source edits occurred while its validation was live. Freeze02 next; revalidate unchanged sample/API assertions.

Focused02 planar integer failure and repair. Freeze02 keeps907 inputs/502 Swift files. python3 .../focus-storage.py 02 runs42 targeted tests and exits1 with12 assertion failures in13.747s: every planar8/16-bit variant differs from its interleaved baseline, while Float32 and native/API cases pass. Production-object diagnostic diagnose-planar02 confirms ImageIO replaces integer planar alpha with full opacity, parallel to the Float32 NaN finding; raw RGB stays premultiplied. Extend native planar associated-alpha assembly and recreate its interleaved CGImage before the existing CoreGraphics conversion. Keep interleaved associated-alpha imports unchanged, preserve native unassociated sample handling and identical-profile guard, and rerun the unchanged exact-pixel assertions. All failed attempts remain preserved.

Focused03 passes / full qualification begins. Freeze03 retains907 inputs/502 Swift files; all42 focused tests pass in14.620s with zero failures/skips, including unchanged44-case pixel assertions, independent planar Float32 fixtures, LZW boundary interoperability, metadata, native controls/save/copy/failure state and actual HTTP/jobs. Start sequential full Debug, full Release and universal package validation on this frozen state; no Sources/Tests edits while live. CUA Photoshop lookup returns cgWindowNotFound and app inventory confirms the Mac remains locked; the prior unlock request remains pending. Preserve installed117 and user state; live Photoshop/UI qualification stays open.

Next-major reference preparation while frozen validation runs. Read Adobe’s2019 file-format specification and locate the Adobe-authored2002 TIFF Technical Notes through the AlternaTIFF mirror; the original partners.adobe.com URL returns an internal error. Record tag37724 framing and its PSD payload relationship in next-layered-tiff-reference01.json. This supports the next layered-TIFF investigation only; no source changes or unsupported2026 claims. Independent high-depth/endian/layered fixtures and live qualification remain required.

Debug and independent output checks pass. Full Debug completes1,366 tests/0 failures/0 skips in294.464s. inspect-storage01.py debug independently verifies44 storage TIFFs and11 LZW boundary streams, including12-bit codes and dictionary resets; every encoded sample, ICC, custom XMP and Exif value matches the baseline. Integer comparison preserves the baseline associated-alpha bytes; native tests separately verify reconstructed editable pixels. inspect-tiff01.py debug verifies nine existing Float32 TIFF outputs. Fixture generator reproduces all eight synthetic TIFF files byte-for-byte. Release compilation/qualification is running on the same freeze03.

Release and independent checks pass. All1,366 optimized tests pass in75.840s with zero failures/skips. inspect-storage01.py, inspect-tiff01.py and inspect-psd01.py each exit0:88 storage TIFF outputs,18 prior Float32 cases,22 LZW boundary streams and96 PSD compression cases independently decode correctly. Preflight comparison finds all105 PSD/PSB and nine default TIFF outputs byte-identical to143. Universal packaging is still running; public Release callbacks and final signature/source/documentation audit follow. Existing compiler warnings remain recorded in full logs.

Final qualification / checkpoint144. All1,366 Debug tests pass in294.464 seconds and all1,366 Release tests in75.84 seconds, zero failures/skips. Freeze03 has907 inputs/502 Swift files; Core/AI and Xcode remain unchanged. Independent Python decoding verifies88 new TIFF outputs,18 existing Float32 outputs and22 LZW boundary streams, including12-bit/reset cases and exact encoded samples/ICC/XMP/Exif. Eight independent fixtures regenerate exactly. All105 PSD/PSB and nine default TIFF outputs equal143. Public Release six Open callbacks/four-format controls/three default TIFF cases plus12 TIFF storage Save/reopen cases pass on arm64/Rosetta. Universal package/signature/resources verify. Failed focused01/02, all diagnostics and immutable source freezes remain preserved. API/docs/phase/command manifests updated; all major gates remain open. Installed117 and actual workspace/preferences/recovery are preserved. Live UI awaits unlocked Mac. Final history audit binds records and frozen source/package identities.

Baseline / investigation. Classify142 as progress and revalidate887 inputs/494 Swift files, checkpoint/candidate142 and installed117. No validation sessions remain live. Photoshop selection again reports cgWindowNotFound; inventory then confirms locked Mac and prior unlock request remains pending. Continue major D01/I04 through TIFF while current Maximize Compatibility references remain unavailable. Adobe October4 guidance documents32-bit TIFF and lossless compression/options/layers. Current native pipeline converts TIFF output to16-bit SDR, rejects32-bit ordinary Save and resource jobs. First probe ImageIO Float32 encoding/decoding independently to choose a precision-preserving implementation. Retain full TIFF layer/predictor/order/size scope as open; no scope narrowing or whole-file parity claim. One guessed source wildcard failed, corrected by file discovery. Evidence: [local evidence archive].

Float probes / implementation. Standalone Apple ImageIO probes retain every Float32 sample through None/LZW/ZIP; the first probe changes ICC rendering-intent byte67 from0 to1 because the CGImage uses relative colorimetric intent. Default intent preserves the original Apple linear-sRGB and retained Adobe linear profile exactly in probes02/03. Reject an unnecessary TIFF profile rewriter in favor of this measured setting. Add direct same-space straight Float32 provider import with endian/stride/finite/cancellation checks, retaining generic ColorSync conversion for other layouts. Float TIFF exports bypass the SDR integer context; native Save/Copy and both applicable job interfaces share it. Update native format descriptions and API limitations. Nine tests cover lossless/profile/metadata cases, independently constructed both-endian TIFFs/all orientations, padded RGB/RGBA providers, invalid samples, cancellation, native persistence/history and actual HTTP/document/job behavior. PNG32 conversion/rejection and layered TIFF restrictions remain. Several source-path guesses failed and were corrected by rg. Freeze before validation; no Sources/Tests edits while any validation runs.

Focused01 failure / repair. The first frozen run compiled and ran 280 tests, reporting 35 assertion failures in new TIFF sample-retention cases; direct-provider/layout tests pass. A separate linked diagnostic proves ImageIO's extended-range CGColorSpace is not CFEqual to the reconstructed space despite identical ICC bytes. The guard therefore fell through to CGContext, clipping HDR and losing hidden RGB. After the run terminated, change matching to accept exact nonnil RGB ICC bytes as well as CFEqual; distinct profiles still use ColorSync. Preserve focused01/freeze01 and diagnostic artifacts. Freeze02 and rerun the full focused selection without weakening sample assertions.

Focused02 passes. All280 selected tests pass in168.150 seconds with zero failures/skips on freeze02 (890 inputs/497 Swift). The original35 sample assertions now pass without changing expected bytes. Allnine new tests pass, including independent endian/orientation and native/actual HTTP workflows. Begin full Debug/Release/universal validation from the same isolated inputs; no Sources/Tests edits.

Next TIFF reference review. During frozen full validation, review current Adobe TIFF guidance and the older TIFF table in Adobe’s2019 specification. Preserve predictor/planar/byte-order/pyramid/transparency/layers and legacy16/24-bit float output qualification as outstanding. The old table omits newer32-bit/predictor/planar behavior; do not infer2026 restrictions from it. Official LibTIFF references point to AdobeTechnicalNote3, but guessed note path, author PDF and TIFF6PDF retrievals fail/timeout. Record URLs/results without treating fetched failures as evidence. No application inputs change. See [local evidence archive].

Live availability recheck. Refresh CUA documentation, list apps and select Photoshop. Inventory returns apps, but selection explicitly reports the Mac remains locked and cannot auto-unlock. Preserve this result and the existing pending manual-unlock request; no new live UI qualification. Public ImageIO headers expose compression/metadata keys but no predictor/planar/byte-order/layer options, informing the next native TIFF work. Evidence: [local evidence archive] and [local evidence archive].

Full Debug passes. All1,356 tests pass in282.634 seconds, zero failures/skips. Nine Float32 TIFF outputs with expected samples/profile sidecars are retained for independent parsing. Release validation follows on the same freeze02; no input changes.

Independent Debug TIFF inspection. A separate Python classic-TIFF IFD/None/LZW/ZIP decoder verifies allnine Debug files against expected raw little-endian samples and exact ICC bytes, including retained custom XMP. No ImageIO or Photato decoder is used by this inspection. Release and final package work continue from freeze02. Evidence: [local evidence archive].

Release / independent outputs pass. All1,356 Release tests pass in74.265 seconds with zero failures/skips. Independent Python parsing verifies all18 Debug/Release TIFF outputs: exact HDR/hidden RGB/alpha samples, original ICC bytes and custom XMP. The96 PSD/PSB compression combinations also retain exact decoded samples/metadata. Universal packaging is running from freeze02; release callback/control probes follow after its objects stop changing.

Final qualification / checkpoint143. All1,356 Debug tests pass in282.634 seconds and all1,356 Release tests in74.265 seconds, zero failures/skips. Freeze02 has890 inputs/497 Swift files; Core/AI and Xcode remain unchanged. Independent Python decoding verifies18 TIFF outputs' exact samples/profile/XMP and96 PSD compression cases. All105 PSD/PSB outputs equal142. Public Release six Open callbacks/four-format controls plus three Float32 TIFF compression Save/reopen cases pass on arm64/Rosetta. Universal package/signature/resources verify. Preserve failed focused01, profile-intent probe and extended-range equality diagnosis. API/docs/phase/command manifests updated; all major gates remain open. Installed117 and actual workspace/preferences/recovery are preserved. Live UI awaits unlocked Mac. Final audit binds documentation and exact frozen source/package identities.

Baseline / investigation. Classify141 as progress and verify884 frozen inputs/491 Swift files, checkpoint/candidate141, installed117 and final audit02. Continue major D01/I04. Current Adobe October6 performance guidance confirms File Handling disable-compression for16/32-bit PSD/PSB. Implement persistent native preference, migration, separate default-off API permission, shared native/API document output defaults and explicit override semantics. Keep stateless jobs deterministic, recovery content independent, native choice memory unresolved, and compatibility omission/default/dialog claims open. CUA selection reports cgWindowNotFound and subsequent inventory confirms locked Mac; prior unlock request remains pending. Several guessed source filenames were absent; locate actual files with rg. Older regional Adobe URL returned404; use current primary page. Evidence: [local evidence archive].

Implementation / freeze01. Add version3 File Handling storage with legacy1/2 reads and retained recovery/recent state; native toggle and separate session-only API write permission, strict schemas/status/errors. Save/Copy/download defaults resolve the16/32-bit preference once before encoding; explicit choices win, remembered values remain unresolved, jobs retain contract-specific defaults. Expose effective save choices and correct default accessory labels. Nine new tests cover migration/reload, three-depth native saves, subsequent Save, Copy/partial overrides, stale/busy/failure guards, HTTP permissions/schema/preferences isolation, downloads/Save and both job contracts. Corrected guessed BitDepth/bitDepth symbols to actual PixelDepth/depth and supplied options to encodeForPersistence before validation. No algorithm/Core/AI changes. Freeze inputs and begin isolated focused01; no Sources/Tests edits while validation is live.

Focused01 passes. All266 selected tests pass in168.219 seconds, zero failures/skips, on887 inputs/494 Swift files. Allnine preference tests pass, covering native output/depth/default memory, migration, permission/error handling and both job interfaces. Start an owned production-delegate probe with real AppKit callbacks/external HTTP and a second fresh process; prepare independent output inspection. Application inputs remain frozen.

Owned process / next-reference investigation. Production AppDelegate/native Save/Copy/cancel/stale and external HTTP pass with isolated settings/workspace/recovery. A second fresh app process reloads the preference and saves allsix depth/container variants correctly; independent Python decoding verifies actual compression codes and every layer/mask/merged sample plus retained metadata against the first process. Full Debug/Release/universal validation starts with unchanged freeze01. Read-only scan of209 existing PSD/PSB test fixtures finds two PhotoshopCC2019 RGB8 files with resource1057 hasRealMergedData=false but full-size RLE merged payloads. Decode and preserve these findings for the next compatibility work; they disprove simply truncating merged data, but do not prove Photoshop2026 behavior across depths/formats. Evidence: [local evidence archive] and [local evidence archive].

Full suites / independent regression. Debug passes1,347 tests in282.774 seconds; Release passes1347 in76.084 seconds, zero failures/skips. The independent parser again verifies all96 layer/mask/merged compression/depth/container outputs with exact samples and retained metadata. Universal packaging continues from the same frozen inputs; no Source/Tests repairs or reruns were needed.

Next major JPEG reference. While universal packaging runs, review Adobe’s October10 JPEG guidance: quality0–12, baseline/optimized/progressive, transparency matte and automatic16-to8-bit save conversion. Current native encoding and representability policy need further work; do not equate an arbitrary linear ImageIO-quality mapping with Photoshop bytes. Record reference and required independent codec/scan/depth checks in [local evidence archive]. No JPEG application code changed in142.

Final qualification / checkpoint142. All1,347 Debug tests pass in282.774 seconds and all1,347 Release tests in76.084 seconds, zero failures/skips. Freeze01 has887 inputs/494 Swift files; Core/AI/imaging codecs and Xcode remain unchanged. Owned native preference/save/cancel/stale/external HTTP and second-process reload checks pass. Independent decoding verifies six default-preference outputs and96 compression combinations; all105 ordinary codec outputs equal141 byte for byte. Universal package and public Release Open/PNG/TIFF/PSD/PSB Save controls pass on arm64/Rosetta; no new preference-specific IntelUI or physicalmacOS14 claim. API docs/reference manifests and phase/command plan updated, with all major gates open. Current Adobe guidance and two old false-merged fixtures inform next compatibility work; JPEG/TIFF major work remains available while Mac is locked. Installed117 and actual workspace/preferences/recovery are preserved. Final audit binds the documentation and frozen source/package identities.

Baseline / investigation. Classify140 as progress and revalidate880 inputs/488 Swift files, checkpoint140/candidate, installed117, Xcode and final audit. All validation sessions terminal. Continue major D01/I04 save/export. Adobe file specification confirms four channel/composite compression methods and PSD/PSB row-table widths; Swift decoder already supports them, but writer omits RLE and always emits the merged cache raw. Read the original Rust PackBits writer and current Adobe PsdOutput schema. The published Adobe output object has no compression field; keep Photato-specific choices separate. Adobe performance guidance documents disable-compression for16/32-bit and compatibility choices, but does not prove current file/default/dialog byte equivalence. Do not invent omitted-composite serialization or claim preferences are complete. Native/UI/API defaults and the full major gates stay open. Run evidence: [local evidence archive].

Implementation / focused01. Translate original Rust PackBits packet decisions to Swift; add streamed RLE with format-specific row-length patching, four-plane compression and independent layer/merged choices. Keep existing no-options ZIP-predicted layers/raw merged bytes. Enforce PSD65535-byte RLE row boundary with explicit PSB/other-method alternative; preserve file transaction/cancellation cleanup. Add native PSD/PSB compression accessory rows with independent per-format drafts and successful-save memory, staged/Data path propagation, strict optional Photato fields and job cache integration. The Adobe route keeps its published schema/default output; native-only fields stay rejected. Native controls are initial Photato save choices, not verified Photoshop preference/dialog parity. Generate44 independent packet oracle cases from the unchanged original Rust function, with source/license hashes. Addnine tests covering all96 combinations of depth/container/layer/composite methods, file/Data equality, decoded layer/mask/merged bytes/profile/metadata, row overflow/cancellation, native Save/Copy/drafts, HTTP/options/jobs/errors. Extend the earlier row encoder comparison to PSB for newly supported RLE rows that exceed the PSD row limit. Freeze and run focused01 in an isolated copy; no Sources/Tests edits during validation.

Focused01 passes. All230 selected tests pass in161.415 seconds, zero failures/skips, on884 frozen inputs/491 Swift files. Allnine new tests pass, including the96 output combinations and original Rust44-case oracle. No product repair is needed. Prepare an independent Python PSD/PSB parser with PackBits/zlib/prediction decoding for the emitted matrix and an owned AppKit/HTTP probe for actual high-depth saving/copying/cancellation/stale settings. Start full Debug/Release/universal qualification from freeze01; keep application inputs frozen.

Owned process01 passes. Six actual native PSD/PSB Save As callbacks at8/16/32-bit match selected native encodings; ordinary Save reuses successful settings, Copy preserves ownership/history, and held cancelled/stale saves preserve original bytes/settings. External HTTP downloads match all four methods for each container and PSD ZIP Save As remembers choices; four invalid headers reject400. Record isolated workspace/recovery preferences, exact production-object hashes and no live-UI claim. Full validation remains live. Prepare Release public opening and PNG/TIFF/PSD/PSB save-control probes and document exact fields/defaults/budgets/Adobe boundary.

Live availability check. CUA app inventory lists Photoshop by bundle ID, but selecting that app for its actual UI still reports the Mac locked. Inventory availability alone is not an unlocked/live document observation. Preserve existing user documents, UI118 and installed117; the prior unlock request remains pending. No live interaction or Photoshop output equivalence is claimed. Existing packaged notices already retain the original PhotoCraft licenses and compression-module attribution; the new Swift source/oracle explicitly identifies PackBits translation and the reference manifest records exact source hashes.

Full suites / independent decoding. Debug passes1,338 tests in279.958 seconds and Release passes1,338 in69.471 seconds, zero failures/skips. The independent Python parser consumes the96 Release PSD/PSB files, checks actual channel/merged compression tags and row tables, inflates ZIP/checksums, decodes PackBits and reverses8/16/32-bit prediction. All layer/mask/merged sample bytes, layer records, profiles and retained metadata equal the default-encoding baseline. No product decoder is used by this check and no Photoshop-rendering claim follows. Universal packaging continues with the same frozen inputs.

Final qualification / checkpoint141. All1,338 Debug tests pass in279.958 seconds and all1,338 Release tests in69.471 seconds, zero failures/skips, on884 inputs/491 Swift files. All96 layer/mask/merged compression/depth/container variants decode through an independent Python parser with exact samples and retained metadata;44 packet cases match original Rust output. Owned process verifies six high-depth native Save As callbacks, remembered ordinary Save, independent Copy, cancel/stale preservation, eight HTTP method/container downloads and PSD Save As. Public Release opening and PNG/TIFF/PSD/PSB save controls pass on arm64/Rosetta. Universal macOS14+ signature/resources and unchanged Xcode verify; nine ordinary PSB outputs equal140. Core/AI, installed117 and actual user workspace/preferences/recovery remain unchanged. API docs/references record exact fields and Adobe rejection boundary. CUA inventory exists but app selection confirms locked Mac; no live parity claim. All major gates remain open. Next complete documented File Handling compression preference with API coverage, while acquiring exact compatibility/default references. Final checkpoint and evidence audit bind source/package/test identities.

Documentation audit repair02. Final refresh01 rejected the chronological index because step141 used a third-level heading while the evidence parser requires second-level milestone headings. The index row and anchor were already present; correct the heading and retain the failed log and prior records. Update checkpoint/reference hashes and run refresh02/check02 plus the final frozen-input/package verification. This changes documentation only; no application tests or package builds are repeated. An initial checkpoint lookup used the nonexistent ACTIVE_CHECKPOINT_107 filename; read the actual PAUSE_CHECKPOINT_107 instead. Neither diagnostic changed application state. Evidence: [local evidence archive] and [local evidence archive].

Baseline / investigation. Previous139 is progress: bounded indexed recovery admission and the AppKit startup-accounting repair have passing focused/full Debug/Release/process/universal/audit evidence. Revalidate874 inputs/482 Swift files, candidate139, installed117, Xcode and checkpoint/audit identities. All prior validation sessions are terminal. Continue major D01/I04 format-specific native saving/export. Current JPEG is fixed95%/white matte; PSD uses ZIP prediction; native/API/job serializers lack a common explicit options model. Inspect real encoder output and the pinned Adobe contract before adding controls. The original .pcraft, complete format/color/model fidelity and all major gates remain open. No production-source changes yet.

Contract review. Pinned Adobe JpegOutputWithScan exposes quality/scan fields but JpegScanOptions says scan is supported only on create-composite/create-artboard/generate-manifest; do not infer execute-actions conformance from a property name. PNG compression uses ten named values; TIFF output does not define a compression field. Investigate Apple ImageIO progressive/PNG interlace/TIFF tag behavior and a shared lossless PNG compression path; unknown or unsupported choices must fail explicitly. New options must flow through native persistence/copy and both supported job interfaces, with cache keys including options and exact schemas. Retain existing no-options client behavior.

Encoder evidence / implementation and focused01. Original procedural ImageIO probes verify PNG Adam7 and TIFF compression tags1/5/8 (also PackBits capability observed, not exposed). Independent JPEG marker parsing confirms baseline SOF0/one scan and progressive SOF2/ten scans; this is not Photoshop’s3–5 scan control. Do not invent a Photoshop0..12 quality mapping. Current official Adobe contract fetch is byte-identical to the pinned217311-byte blob8db3553512c6a0ff0532c8a009cbb2c8210c8f41. Implement the shared native save-options pipeline first for lossless PNG/TIFF; full JPEG/PSD/other options remain in the major D01/I04 scope, not closed or moved to minor work.

Add a validated Sendable options model, streaming PNG IDAT recompression with checksums/geometry limits and unchanged ancillary chunks, and ImageIO PNG interlace/TIFF compression properties. Native Save As/Copy accessories expose supported controls; successful Save/Save As remembers options per open-document format; failures/cancel/copy/download do not adopt them. Defaults remain unchanged for old clients. Photato Save/Save As accepts optional options, downloads accept a bounded JSON header, and state/capabilities expose exact schemas. Both action-job routes gain named PNG compression and TIFF output; only Photato jobs accept the native encodingOptions extension. Cache keys include options. RGB32 action PNG/TIFF remains rejected rather than silently reducing depth. Add13 engine/native/API tests, including all PNG levels/Adam7/depths, TIFF tags/samples, fragmented streams/metadata/cancellation, AppKit save callbacks, failed-save preservation, actual HTTP/job outputs and pinned schemas. Freeze01 has880 inputs/488 Swift files; focused01 runs in isolated [local workspace]. No source edits while validation is running.

Focused01 repair. The first isolated build fails before executing tests because the new fixture assigned the read-only pixelsPerInch accessor. Set the document's stored resolution instead. Preserve focused01.log and focused01-result.json; the process is terminal before editing. Three attempted diagnostic reads used nonexistent guessed filenames (focused01.json, PhotoCraftTests/DocumentEncodingOptionsTests.swift, PhotoCraftImagingTests/RasterMetadataTests.swift); use discovered paths thereafter. Freeze02 and rerun the same focused group.

Focused02 passes. All140 selected tests pass in23.852 seconds, zero failures/skips, on freeze02 (880 inputs/488 Swift files). This includes13 new compression/options tests and existing native/API save, transfer, job, closing and metadata regression coverage. Start full Debug, full Release and universal packaging sequentially from the frozen isolated copy; no Sources/Tests edits during validation. Add independent stream inspection and owned production-process lifecycle probes before final qualification.

Independent/process qualification preparation. Add an owned production-object AppKit/HTTP process harness with private workspace/recovery settings, real Save As/Save callbacks, independent Copy, cancelled/stale save encoding, all ten PNG download levels and TIFF Save As. Add an independent Python PNG chunk/CRC/zlib inspection for40 encoded variants at8/16-bit and both interlace modes. Harness scripts are outside Sources/Tests; full validation remains live and application inputs stay frozen. CUA documentation restored; Photoshop name selection returned cgWindowNotFound, then app inventory confirmed the Mac is locked. The prior manual-unlock request remains pending; live UI is not claimed.

Full Debug / process01. Full Debug passes1,329 tests in265.365 seconds, zero failures/skips. Release validation is continuing. The separately linked owned process compiles but fails to reach its HTTP-ready checkpoint within35 seconds; its case directory remains empty. Preserve the failed attempt and terminate only that owned process. Add startup instrumentation and an owned-process stack sample on timeout in process02; no application/source changes or successful process claim.

Process02 diagnosis / process03. Startup instrumentation reaches the task, then the captured stack shows NSDocumentController presenting a batched file-open error in a modal alert. The harness passed its case directory as a positional app argument, so AppKit treated it as a document to open. Preserve the stack/logs and change only the harness invocation to the existing probes’ --probe-folder convention. Run process03; application Sources/Tests remain unchanged.

Process03 passes. Actual native Save As and subsequent Save use the selected remembered PNG settings; Copy preserves ownership/history/settings; cancellation and stale model mutation leave original bytes/settings untouched. External HTTP validates all ten PNG compression levels byte-for-byte against the native encoder, TIFF ZIP Save As and four invalid requests. Independently parse CRCs and inflate40 PNG variants (both8/16-bit and both interlace modes) with Python zlib: filtered sample bytes and every non-IDAT chunk match the corresponding default-compression baseline. The process also emits44 PNGs including baselines and six TIFFs. Add public Release Save As/control checks for PNG/TIFF to the existing arm64/Rosetta opening probe; no source mutation.

Final qualification / checkpoint140. All1,329 Debug tests pass in265.365 seconds and all1,329 Release tests in68.635 seconds, zero failures/skips, on880 inputs/488 Swift files in freeze02. Native/HTTP process03 passes Save As/subsequent Save, independent Copy, cancelled/stale settings preservation, ten PNG download levels and TIFF ZIP saving;40 independent Python zlib/CRC inspections preserve filtered bytes/non-IDAT chunks. Public Release callbacks and PNG/TIFF save-control encodings pass on arm64/Rosetta. Universal macOS14+ packaging, clean signature/resources and unchanged Xcode verify. Nine whole PSB outputs equal139; Core/AI unchanged. Installed117 and real workspace/preferences/recovery remain untouched. Menus802/102primary/8alternate/157bound/568unavailable;20 commands and Adobe2partial/6unimplemented unchanged. API guide includes exact options/defaults/header/schema/remembered-state/interface limitations. CUA confirms locked Mac. PSD/JPEG/TIFF/full dialogs/preferences and all major gates stay open; next continue major D01/I04 per next-major-plan01. Preserve all failed and passing attempts and complete final evidence refresh/check.

Baseline / investigation. Previous138 is concrete progress. Revalidated869 frozen inputs/477 Swift files, candidate138 ZIP, installed117, Xcode project and passing138 checkpoint/audit. Prior validation processes are terminal. Continue major D02/I02: serial recovery decoding still retains unbounded aggregate restored payload across up to512 index records. Investigate preallocation decode budgeting, current-document/history accounting and render/metadata overhead before choosing admission policy. Preserve every backup and make deferral observable through native UI and the shared API; permit retry after documents close. No new source edits or tests claimed yet.

Admission design. Native raster budgeting already reserves tile payload before expansion but reports its limit as a generic invalid-file error; metadata reads currently allocate the whole checked manifest up to the512MiB file cap. Add typed limit classification, a manifest read cap and lightweight checked recovery metadata so capacity deferral is distinguished from damage. Plan off-main workspace/session accounting with signature rechecks, conservative automatic budget/allowances, pre-decode limits and post-decode admission, native deferred summary and API schemas. Preserve groups/backups without falling back to an older snapshot merely because the latest is too large. design01.json records exact initial policy, acceptance and exclusions. This is not a whole-process memory or Photoshop-default preference claim.

Implementation / focused qualification start. Added typed native metadata/raster capacity errors, manifest read caps before Data allocation and checked context/dimensions/manifest-size inspection. Added off-main workspace/session/history accounting with identity rechecks, quarter-RAM automatic admission (256MiB..4GiB), conservative render/metadata allowances, explicit decoder budgets and a second admission check before publication. Deferred groups retain all registrations/bytes and do not fall back to older snapshots. Native progress retains a deferred-results notice; File Handling reports deferred counts; shared API adds lastDeferred, estimated memory and reason counts with exact schemas. Permission revocation during accounting takes precedence over worker cancellation. Fifteen new core/native/API tests cover read-before-allocation bounds, typed errors, batch deferral/close/retry, oversized metadata/raster/canvas, workspace changes/history, privacy/schemas/revocation and existing outputs. Existing recovery reader tests now forward explicit allowances. Freeze01/focused01 will run before further source edits; all attempts remain isolated and retained.

Focused01 compile failure / test isolation repair. Production modules compile on freeze01. The new repeated-workspace-change test captures non-Sendable CraftNSDocument directly in its Sendable worker closure, which Swift rejects before tests execute. Move that mutation into an explicitly MainActor/Sendable closure constructed on MainActor; the worker only schedules that closure. Preserve focused01 and freeze02/focused02 after the process is terminal. No production source changed for this test repair.

Focused02 passes / owned-process qualification start. All220 focused tests pass in22.321seconds, zero failures/skips, on874 frozen inputs/482 Swift files. This includes all15 new tests and affected recovery/source/maintenance/open/close/save/menu/core archive coverage. The actor-isolated test mutation compiles and repeated workspace changes return409 without publication. Prepare owned production Debug processes to restore five registered snapshots under a two-document allowance, verify native/API deferral and exact models, close/retry in batches, and interrupt after partial recovery before a fresh-process continuation. No process/live/full-suite result is claimed yet.

Process01 failure / diagnostic02. Owned native and HTTP batch recovery each pass2/2/1 plus clean relaunch. Interruption after the first2 recovered/3 deferred preserves all backups and registrations, but fresh exercise fails the deferred-count assertion before readiness. Preserve the failed harness, logs and private fixture; add per-batch phase/count diagnostics in separate process02 without relaxing expectations or changing production source. All attempt01 processes are terminal.

Process02 diagnosis / startup repair. Fresh relaunch records two AppKit-restored documents, zero scanned entries and a workspace-changed accounting conflict. Two immediate snapshot attempts are insufficient during finite startup restoration. Bound accounting to eight attempts with cancellable20ms yields after changes, still requiring an unchanged signature and returning conflict for continuous mutation. Add a deterministic three-document startup-arrival regression. Process03 will distinguish already-open AppKit restorations from indexed discoveries while requiring exactly2/2/1 documents,3/1/0 deferrals, exact contents and preserved backups. This also exposes the existing limitation that AppKit-owned restoration is outside indexed admission. Freeze03/focused03 follow after both failed process attempts are terminal.

Focused03 pass / process03 harness correction. All221 focused tests pass including finite startup arrivals and continuous-mutation rejection. Process03 native batches/clean relaunch pass, but its API driver mistakenly expects203 after a broad filename replacement altered202. The product returns correct202; preserve this harness failure and repair in separate process04. Production sources remain freeze03. CUA confirms the Mac is still locked; existing unlock question remains pending, so live UI qualification stays open.

Owned-process qualification passes. Admission process04 passes seven outcomes: native and HTTP batches2/2/1 plus clean relaunch, controlled SIGKILL after2 recovered/3 deferred, exact fresh recovery and clean relaunch. Fresh AppKit restoration is counted separately from indexed discovery; total documents and deferred counts remain strict. All original and deferred backup/index bytes are preserved until explicit discard. The prior background process suite rerun against freeze03 passes all nine outcomes: startup cancellation/queued opening, before/after-decode interruption, exact recovery/save/discard and clean relaunch. Retained results-window geometry fits programmatically; no live UI claim. Begin full Debug/Release suites and universal packaging in the isolated freeze03 workspace with separate01 logs.

Next-major investigation while validation runs. Current Adobe opening docs distinguish macOS File Open/Format from Windows Open As; Swift already has explicit DocumentOpenFormat validation. Source review confirms JPEG Save/Copy is fixed at95% and fixed white matte; select shared format-specific save/export choices as the next D01/I04 dependency, including native panels, prepared output and both APIs wherever defined. next-major-plan01 pins source hashes and official URLs. Read-only original .pcraft investigation finds ZIP/directory manifests with BLAKE3/Zstd payloads and a broad document schema; I03 stays separately open. Initial guessed pc-* glob and DocumentOpenActions.swift read failed; actual paths were discovered before drawing conclusions. No source/test changes during full validation.

Full Debug/Release pass / final verification preparation. Both full suites pass1,316 tests, zero failures/skips; universal build is running. Preserve failed process fixtures01/02/03 durably in the run directory without ephemeral API credentials. Review finds the unexecuted package-verifier draft inherited incorrect801/101 expectations through filename replacement; preserve that draft and restore the unchanged measured802 menu entries/102 primary shortcuts before running it. No product-source change or failed package-verification claim. next-major-plan02 adds authoritative JPEG controls, UXP ranges, Firefly output-schema migration and Apple ImageIO references for the next major save/export increment.

Final qualification / checkpoint139. All1,316 Debug tests pass in263.674 seconds and all1,316 Release tests in68.247 seconds, zero failures/skips, on874 inputs/482 Swift files in freeze03. Seven owned admission outcomes pass native/API2/2/1 recovery with3/1/0 deferrals, exact dirty/autosave/source state, controlled interruption, fresh recovery and clean relaunch; nine repeated background outcomes preserve cancellation/queued callbacks, before/after-decode interruptions and subsequent Save As/autosave/Discard. Startup accounting repair tolerates finite AppKit restoration while continuous mutation still returns conflict. Native results geometry fits programmatically; live UI remains unqualified. Universal macOS14+ packaging, clean signature/resources, unchanged Xcode and six public callbacks per Release architecture verify. Nine whole PSB outputs equal138; Core changes are typed bounds/metadata inspection and Imaging/AI remain unchanged. Installed117 and real workspace/preferences/recovery are preserved. Menus802/102primary/8alternate/157bound/568unavailable;20 typed commands and Adobe2partial/6unimplemented unchanged. API documentation covers exact memory/deferral schemas and policy limitations. CUA confirms locked Mac; existing unlock question pending. Major gates remain open. Next-major-plan01 reviews Adobe opening/saving docs and local save/format/Rust archive sources, selecting D01/I04 format-specific native save/export settings next. The original .pcraft migration remains separately open. Refresh stale phase summary to139 without promoting any gate. Final checkpoint and evidence audit preserve all failed and passing attempts.

Baseline / investigation. Previous137 is concrete progress. Revalidated864 inputs/472 Swift files, installed117, Xcode and passing137 checkpoint/audit. All prior validation handles are terminal. Continue major D02/I02: indexed metadata screening is asynchronous but full AppKit makeDocument recovery decoding blocks MainActor. Preserve AppKit recovery registration/dirty state and source verification while preparing full immutable archive contents off the main thread. Add native/API progress and cancellation without changing existing retry response semantics. Reproduce native factory state before selecting the adoption path. No source edits or passing new tests claimed yet.

Implementation / validation start. Captured the old production AppKit factory baseline for unsaved/native/PSD sources: edited=true, hasUnautosavedChanges=false, exact model/backup/group/source, empty history and expected source verification. Added background full decode, color/context/fingerprint/source-format validation and a scoped single-use prepared-read handoff through the real AppKit recovery factory. Added native progress/cancel, API operation state and POST /v1/recovery/cancel, permission-owned cancellation, partial-success preservation, external index/archive rechecks and queued SDK-open waiting. Upload publication now rejects a changed recovery generation. Ten new tests cover these concurrency, bookkeeping, lifecycle and HTTP boundaries. Freeze01 and focused01 run before any further edits; no source/test edits while validation is live. AppKit construction/index metadata remain on MainActor; aggregate recovery memory and platform parity remain open.

Focused01 compile failure / repair. The new defaulted started callback changed Swift trailing-closure matching for an existing validation call. Focused01 terminated before tests. Restore the old overload and add a required-started overload for API ownership; existing callers retain their validation semantics. Preserve the failed isolated build and freeze02 before focused02.

Focused02 runtime defect / repair. Compilation succeeds. Cancellation/progress HTTP test passes, but API revocation triggers Swift exclusivity failure: assigning state.phase reads state.cancellationRequested while the optional state is under modification. The test process terminates with signal6; preserve its stack trace. Compute the cancellation boolean before assigning phase, avoiding overlapping read/write access. Freeze03/focused03 follows only after the failed process is terminal.

Focused03 test-fixture corrections. All183 focused tests execute, with4 assertions failing across2 new tests; the runtime crash is repaired and all3 new HTTP tests pass. The manual-retry fixture had not marked initial startup finished, so the SDK queue legitimately initiated startup after the manual cancellation. Set its launch-complete state to exercise the intended manual-retry scenario; production startup cancellation is checked separately in owned processes. Source association comparisons also used raw /var and /private/var aliases; compare canonical source identity, retaining the exact model/format/dirty/autosave assertions. No production source changes for these corrections. Preserve failed run, freeze04/focused04.

Focused04 passes / process validation. All183 focused tests pass with zero failures/skips on869 frozen inputs/477 Swift files. New background/native/API concurrency tests and existing recovery/source/open/close/save/menu coverage pass. Prepare production Debug process harness for startup cancellation, main-run-loop heartbeat and HTTP responsiveness while decoding is held, queued SDK callback delivery, controlled interruption before/after full preparation, fresh restoration and later autosave/Save As/Discard/clean relaunch. No process or live UI result claimed before completion.

Owned-process validation passes / full qualification start. process-background01.py compiles against production Debug objects with hashes retained. Nine outcomes pass: external HTTP status responds and MainActor heartbeat advances while decoding is held; external cancellation retains3 backups/index bytes and resumes the queued SDK callback exactly once without an extra blank; owned SIGKILL before/after full preparation preserves registration/archive bytes. Each fresh process restores exact unsaved/native/PSD models and AppKit dirty/autosaved/source/history state, then performs edit→autosave→Save As or Discard. Further clean relaunch restores no retired documents and reads the saved edits. Original files remain byte-identical. Begin full Debug, Release and universal build on the unchanged freeze04; no live UI/physical Intel parity inferred from process checks.

Final-review race reproduced while freeze04 validation continues. The isolated retry-race01 production-object probe chains two recovery runs without yielding between them and queues SDK Open behind the first. It reports one premature failed callback during the second run: waitUntilIdle resumed after the first completion without rechecking whether a new recovery had started. Preserve this failure. Let the ongoing frozen Debug/Release/build attempt reach terminal state before editing source/tests; then make the waiter loop until truly idle and add a chained-retry regression. Freeze04 qualification alone will not close this defect.

Chained-retry repair / freeze05. Freeze04 full Debug and Release suites each passed1,299 tests, but retry-race01 independently demonstrated the missed queue race. Verified the obsolete build process PID/cwd/command and interrupted only that candidate build with SIGINT (exit130); validation parent and compiler children are terminal before editing. Change recovery waitUntilIdle from a single wait to a loop, so resumed callers wait again if another retry is active. Add a regression that immediately chains two retries and requires no callback until the second completes, then one successful callback. Freeze05/focused05 precedes repeat full/process/universal qualification.

Freeze05 focused/process qualification passes. All184 focused tests pass with zero failures/skips. Independent retry-race02 now reports zero callbacks during the second recovery and exactly one successful callback after it finishes. All nine process-background02 outcomes pass again on the repaired production Debug objects: responsiveness/cancel/queued opening, before/after-decode interruption, exact fresh restoration/autosave/save/discard and clean relaunch. Begin full02/release02/build02 on869 inputs/477 Swift files, preserving all previous attempts.

Final qualification / checkpoint138. All 1,300 Debug tests pass in 261.88 seconds and all1,300 Release tests in66.804 seconds, zero failures/skips, on 869 inputs / 477 Swift files in freeze05. Universal macOS14+ signatures/resources/architectures and unchanged Xcode project verify. Six public AppKit callbacks against each final Release architecture return exactly once with model/source preservation (native10/native11/PSD/PNG, dirty repeat and missing-file error). Nine owned Debug process outcomes check background HTTP/heartbeat responsiveness, native startup cancellation releasing queued opening, SIGKILL before/after full preparation, exact recovered AppKit contents/state, later autosave/Save As/Discard and clean relaunch. The independent chained-retry probe changed from one premature failed callback to no early callbacks and one successful callback after recovery is idle. Original files and pre-restoration backup/index bytes are preserved. Core/Imaging/AI are unchanged; nine whole PSB outputs equal137. Menus remain802/102primary/8alternate/157bound/568unavailable; API adds one application cancel route and progress state while retaining20 typed commands and Adobe2partial/6unimplemented. Installed117 and actual workspace/preferences/recovery remain unchanged. CUA Photoshop lookup returns cgWindowNotFound; app inventory confirms the Mac is locked and automatic unlock failed. Existing manual-unlock request remains pending; no live UI claim. All major gates stay open. Next D02/I02 is aggregate recovery admission/accounting with deferred state and safe retry; next-major-plan02 records source evidence/acceptance. Checkpoint138 and final history audit preserve the resume point.

Baseline and design. Previous136 is concrete progress. Revalidated859 inputs/467 Swift files, installed117, Xcode and the final136 audit/checkpoint; prior validation handles are terminal. Major D02 continues. Source inspection confirms unreadable registration blocks maintenance and new recovery, while deliberately forgotten backups remain on disk. Add an explicit bounded private-archive salvage scan and independent copy/export, never automatic orphan adoption. Provide a confirmed index reset only with no open documents; preserve original unreadable index bytes before committing a fresh empty registration. Keep archive/source bytes untouched and expose the same operations through the separately permissioned native API. No Photoshop factory menu or Adobe route invented. Live UI/platform/legacy-location discovery and complete parity remain open.

Implementation / focused validation start. Added bounded nonrecursive private Archives scanning independent of valid index decoding; metadata classification supports current, legacy, absent and unverified contexts. Full background document decode validates data before independent fresh-ID Open Copy or ordinary native11 Save Copy/download, with filesystem/revision/session checks. No provenance or automatic sharing is adopted. Explicit reset requires no open documents, a fresh scan and unreadable regular index up to2MiB, preserves exact old bytes through the atomic writer, then writes an empty index without changing archives. Failed resets preserve the old index and may retain an additional preservation copy. Existing maintenance generation/busy guards also cover salvage. Added a native Find Recovery Copies window under File Handling and five separately permissioned application HTTP routes with complete schemas/errors. The original backup permission description now includes scans and confirmed reset. No factory shortcut/menu path or Adobe endpoint added. Added12 focused workflow/API tests; source/test freeze01 will precede compilation, and no source edits occur during validation.

Focused01 compile failure / repair. Freeze01 has864 inputs/472 Swift files. Swift Observation attempts to turn the lazy salvage coordinator into a computed property, which cannot be lazy. Focused01 terminates with compile error before tests. Mark that lazily retained coordinator ObservationIgnored; its own observable state remains tracked by the native view. Preserve failed logs and isolate freeze02 before focused02. No edits occurred during the running validation process.

Focused02 defect / canonical-path repair. Compilation passes. The focused suite runs158 tests with1 failure: a retired registered archive appears unregistered because index paths were canonicalized while directory enumeration retained a macOS path alias. Native/API copy, exact export, reset preservation/failure and permission guards pass. Canonicalize candidate and registration URLs before matching, grouping registrations once to avoid a repeated full-index scan. Focused02 is terminal before editing; retain its evidence and run freeze03/focused03.

Focused03 passes / owned-process qualification. All158 focused tests pass, zero failures/skips, with the canonical-path correction on freeze03. Prepare a production-delegate Debug harness with private directories and bundle identity. It checks startup refusal to automatically adopt orphans, native window geometry/copy/export, external HTTP downloads/reset, exact old-index/archive/original preservation, and owned-process SIGKILL immediately before/after the atomic empty-index commit. Fresh-process verification and a further relaunch must retain manual salvage without reopening old backups. No live UI or process result claimed before completion.

Owned process qualification passes / full validation. All nine scenario/mode outcomes match expectations: exercise/native window geometry/independent copy/Save Copy/external API three exact downloads and index reset, two fresh exercise relaunches, and before/after atomic-index-commit SIGKILL with verification and another clean launch. Original sources and all three archive variants remain byte-identical. Exact old-index copies persist before replacement, a precommit kill leaves the damaged original, and a postcommit kill leaves an empty index. No orphan is automatically restored. Only owned child PIDs are interrupted; no actual user state touched. The unchanged freeze03 now runs full Debug/Release and universal builds sequentially. A fresh CUA Photoshop request returns cgWindowNotFound; live UI remains unverified, and this error alone is not evidence of current lock state.

Full Debug pass / next major investigation. All1,289 Debug tests pass in261.872seconds, zero failures/skips. Release tests and universal build remain in the same isolated validation driver. Source review records that normal File Open prepares an immutable model in the background, but indexed recovery still invokes AppKit full decode synchronously on MainActor. Next major D02/I02 work must preserve group/token, dirty/autosaved state, source verification/collision behavior, SDK queue completion and later Save/Discard/relaunch semantics while making the main run loop and native/API progress responsive. The retained investigation is static analysis only; no background-startup change is implemented in137.

Live availability retry. Retried CUA using the observed Photoshop application name after the bundle-ID cgWindowNotFound result. This attempt explicitly reports that the Mac is locked and automatic unlock failed. Preserve both observations; the second establishes current lock state. Earlier manual-unlock request remains pending and is not repeated. Native/Photoshop live comparison stays unqualified.

Release regression / export comparison. All1,289 Release tests pass in65.071seconds, zero failures/skips. Nine complete PSB exports are byte-identical to136; source-delta01 records unchanged Core/Imaging/AI modules. Universal arm64/x86_64 packaging is running. Final package and public Release opening evidence will be recorded only after verification.

Final qualification / checkpoint137. All1,289 Debug tests pass in261.872seconds and all1,289 Release tests in65.071seconds, zero failures/skips, on864 inputs/472 Swift files in freeze03. Universal macOS14+ signatures/resources/architectures and unchanged Xcode project verify. Six public AppKit callbacks against each final Release architecture return exactly once with model/source preservation (native10/native11/PSD/PNG, dirty repeat and missing-file error). New salvage is tested in full suites and owned Debug production-delegate processes: nine outcomes include actual native copy/export/API reset, exact preserved damaged-index bytes, before/after atomic-index-commit SIGKILL and fresh relaunches with no automatic orphan restoration. Process native fitting size1093x430 is recorded, not a live layout/accessibility parity claim. Core/Imaging/AI are unchanged; nine full PSB outputs equal136. Static menus remain802/102primary/8alternate/157bound/568unavailable; five application routes leave20 typed commands and Adobe2partial/6unimplemented unchanged. Installed117 and actual workspace/preferences/recovery remain unchanged. The bundle-ID CUA call returned cgWindowNotFound; a name-based retry confirms the Mac is locked and automatic unlock failed. No major gate closed. Next D02/I02 work is background full startup recovery preparation with exact lifecycle state and native/API progress/cancellation; static investigation and acceptance plan retained. Final checkpoint and history audit preserve the resume point.

Baseline / investigation. Previous135 is concrete progress. Revalidated854 frozen inputs/462 Swift files, installed117, Xcode project and the passing135 audit/checkpoint. All prior validation handles are terminal. Continue major D02. The512-entry recovery index retains retired/invalid groups; File Handling/API expose aggregate retry but no per-backup review, export or cleanup. Interrupted intents may coexist with the older committed snapshot. Adobe's Oct6,2026 file-loss guide confirms recovery interval default10minutes (5minutes is its recommendation); it does not establish a Photoshop backup-manager UI. This increment's manager is a clearly named Photato recovery affordance under existing File Handling, with no invented factory command. Apple FileManager supplies recoverable Trash. No third-party code copied.

Design. Inspect grouped registrations, recover an independent unsaved copy, export ordinary native11 without private source/recovery context, move only verified inactive owned archives to Trash with retire-before-move journal ordering, or explicitly forget a registration while preserving bytes. Missing-record removal reclaims capacity without image deletion. Keep the existing counts/retry API permission unchanged; a separate session-off backup-access permission discloses names/content/maintenance. Shared native/API operations require revision/lifecycle/session/ownership checks and tests. Preserve actual user backups and installed117. Legacy orphan migration, startup decoding latency, full Photoshop/platform/live/power-loss parity remain open. Detailed plan and primary references are in136 run records. No implementation or passing tests claimed at this point.

Implementation / validation start. Added grouped metadata inspection, full background copy/download decoding, ordinary native11 Save Copy, ownership-checked coordinated Trash with retire-before-move/final-remove ordering, explicit record-only removal and missing-record reclamation. Native File Handling opens the Photato Recovery Backups window; complete list/state/request schemas and six POST operations accompany the new separate session-off backup API permission. All record cleanup excludes groups used by open documents. Maintenance blocks competing opening/closing/recovery/autosave/file commands; ordinary API import publication also checks maintenance generation. Permission revocation before read publication rejects; an already-started Trash move completes journal cleanup, then refuses to disclose state if access ended. Reset the controller's manager during reconfiguration to avoid retained singleton state/test hooks. Also corrected the shared opening cancellation capability to explicitly name the recent-session ownership exception implemented in135.

Added16 tests covering grouped interrupted intents, exact copies/ordinary exports, corrupted data, full512-entry reclamation, invalid/symlink preservation, active-document protection, both Trash interruption boundaries, atomic/external-index errors, lifecycle guards, exact HTTP schemas/privacy/confirmation/stale/busy/revocation behavior and no automatic shares. Unit Trash tests use an owned move destination; actual native Trash and process interruption remain to qualify. Freeze/isolate inputs before focused01; no source/test edits while validation runs.

Focused01 fixture failure / repair. Freeze01 has859 inputs/467 Swift files. Compilation succeeds; 146 focused tests run with7 failures, all before the new copy/API operations because fixture setup requested a RecoverySourceReader fingerprint before creating its source file. The remaining maintenance and existing regression tests pass. Preserve the failed run; create the owned source archive before recording its recovery context in both new test helpers. Application source is unchanged. Focused01 is terminal before edits. Freeze02 and focused02 retain the repair separately.

Focused02 passes / process qualification. All146 focused tests pass in17.737seconds, zero failures/skips, on unchanged application code and repaired fixture freeze02. The new16 tests cover native storage/lifecycle and HTTP operations; previous opening/closing/recovery/menu/save regressions also pass. Prepare an owned production-delegate Debug process probe for exact recovered copies/ordinary export, native manager layout, external authenticated download/Trash, actual FileManager Trash and SIGKILL immediately before/after moving a retired backup. Use separate private directories/bundle, restore only the probe-owned Trash items to retained evidence, and preserve actual user files/settings. No process result claimed until terminal verification.

Process01 checkpoint timeout. Harness compilation succeeds, but the owned exercise process does not reach API-ready within30seconds and emits no error report. The driver terminates only its owned child in finally; all handles are terminal. Preserve the fixture/logs and failure record. No process pass is claimed. Add progress markers and a pre-cleanup stack sample in separate harness02 to locate the stalled native step before deciding whether application code needs repair. Application/test freeze02 remains unchanged.

Process02 diagnosis / harness03 repair. Progress stops at task-start. The retained stack sample locates AppKit NSDocumentController batch-error presentation in NSAlert.runModal: positional probe arguments were treated as document inputs. The owned child is terminated and the failed case retained. Harness03 uses named --probe-folder/--probe-mode/--probe-scenario flags, matching the working135 convention. This is a harness launch-argument repair; no application/test source changed, and no recovery operation result from01/02 is claimed.

Process03 partial pass / post-move expectation repair. Named arguments resolve the harness modal block. Native manager layout, exact unsaved recovered copy, ordinary Save Copy, external HTTP download and real FileManager Trash pass; no automatic shares. SIGKILL before moving leaves a retired, readable archive; a fresh process opens its exact content, forgets only its record, and another launch confirms cleanup. After-move SIGKILL reaches its boundary, but the next process fails the harness expectation of a retained record: existing startup discovery has correctly pruned the missing retired record already. Preserve this failure and restore only the probe-owned Trash receipt item to the retained case with matching bytes. No app/test changes. Run only the changed after-move scenario in04, capturing the on-disk retired index immediately after SIGKILL and before relaunch, then verifying automatic pruning and a further clean launch. Passing exercise/before03 cases are not repeated.

Owned process qualification passes. Exercise03 verifies the actual native backup-manager window and layout, exact independent unsaved copy, ordinary native Save Copy and external HTTP native11 download, zero automatic shares, and real FileManager Trash with exact retained bytes. Before-move03 SIGKILL retains a readable retired snapshot across restart; copying its content and forgetting only registration pass, followed by a clean second launch. After-move04 captures the retired journal on disk after SIGKILL, before relaunch; startup prunes the missing record and a second launch remains clean. All seven scenario/mode outcomes match expectations. Only probe-owned Trash items are moved back into retained evidence; originals remain byte-identical. Debug production objects match across03/04. Freeze02 remains unchanged. Full Debug/Release and universal qualification now run sequentially in the isolated checkout.

Debug regression / live availability. All1,277 Debug tests pass. Release regression and universal build continue in the isolated checkout; no Sources/Tests changes during validation. CUA inventory finds Photoshop running, but getApp reports the Mac is locked and automatic unlock failed. Existing manual-unlock request remains pending. Live UI/Photoshop claims remain unqualified. Prepare the previously qualified public-opening probe against the new Release objects; its scope covers callback/model/source preservation, not a full recovery-manager runtime test on Intel.

Release regression / output and salvage review. All1,277 Release tests pass in64.046seconds (Debug260.557seconds), zero failures/skips. Nine complete PSB exports equal135 byte for byte; source-delta01 records unchanged Core/Imaging/AI. Universal packaging continues; no package result claimed yet. Static source analysis confirms that index reload/maintenance deliberately refuse an unreadable index, startup discovers only indexed entries, and Forget Record preserves archive bytes without registration. Reconstructing from every archive would therefore risk reviving deliberate cleanup. Recorded bounded explicit orphan/legacy salvage as the next major D02 investigation, with no automatic adoption or source reassociation. This is a plan/source analysis, not a migration implementation or new experiment.

Final qualification / checkpoint136. All1,277 Debug tests pass in260.557seconds and all1,277 Release tests in64.046seconds, zero failures/skips. Final freeze02 has859 inputs/467 Swift files. Universal macOS14+ packaging, both architectures, signatures/resources and unchanged Xcode project verify. Six public AppKit calls against each final Release architecture return exactly once: native10/native11/PSD/PNG, a same dirty-document repeat and a missing-file error. Main-thread callbacks, model contents and source bytes match expectations; imported IDs/ImageIO dictionaries use the documented semantic comparison. New maintenance process qualification uses Debug production delegates on Apple silicon, including actual native Trash, external HTTP download and before/after-move SIGKILL/relaunch checks. This does not establish maintenance UI parity on Intel. Core/Imaging/AI are unchanged; nine complete PSB outputs equal135. Static menus remain802/102primary/8alternate/157bound/568unavailable. Seven HTTP routes do not increase20 typed command count; Adobe remains2partial/6unimplemented. Installed117 and actual workspace/preferences/recovery remain unchanged. Mac locked; live Photoshop/UI, full platform and byte-equivalence gates remain open. Recorded static analysis of missing/unreadable index and orphan/legacy salvage; no repair or automatic orphan adoption implemented. Next plan preserves deliberate forgotten/retired intent. No major gate closed. Checkpoint136 and final history audit preserve this resume point.

Baseline / investigation. Previous134 is progress: verified849 frozen inputs/457 Swift files, installed117, Xcode identity and134-milestone audit with zero missing references. All prior validation processes are terminal. Continue major D01, preserving originals and installed117. Open Recent is an empty factory submenu. File Handling currently persists recovery preferences only. Adobe documents recent limit0–100; its staff documents Clear Recent File List. Default20 remains provisional until current Photoshop preference verification; Photoshop Elements evidence is not substituted. The Apple SDK clarifies that document-class-associated Finder events go through NSDocumentController, so merely adding an AppDelegate openFiles method would not fix those requests.

Design. Extend the existing atomic settings archive with backward-readable optional recent entries and count, with distinct settings/list revisions. One commit changes the limit and trims records;0 clears/stops history. Record successful Open/Save/Save As, canonical deduplication and bookmarks; preserve prior bytes/state on failures. Native Open Recent and separately permissioned API reopen known IDs through the same background reader, with callback/cancellation/session/lifecycle checks. Clear removes references only. Queue SDK calls across active reads and startup recovery; preserve exact callbacks and avoid an extra launch blank. Existing20 typed commands and Adobe contracts remain distinct. See135 run design/reference records. No implementation or tests claimed yet.

Implementation / format decision before135 attempt01. Added bounded recent records/bookmarks, atomic limit/history commits and separate settings/list revisions; native Open/Save/Save As record successful sources. Existing Open Recent is populated dynamically with stable record IDs and Clear Recent File List. File Handling gains validated count text with OK/Cancel; old recovery API requests preserve that count. Added separate session-off recent API permission and list/limit/clear/open schemas, known-ID reopening, no implicit shares, exact revision and revoke/cancel checks. SDK Open requests queue behind startup recovery/active reads, coalesce into serial batches, complete every callback (including unstarted cancelled requests), and expose queued count/sanitized failure state. Close/Quit/import reject competing queued opens. Added16 regressions across store/native/menu/queue/HTTP behavior and adjusted prior SDK waits.

The initial version1-compatible write design was rejected before validation: old readers impose a4096-byte ceiling and could discard unknown recent fields on writing. New writes use explicit version2 with an8MiB bound; version1 reads retain existing recovery values and default recent limit20. Old readers must reject version2, not silently erase history. No older-reader forward compatibility is claimed. Native/API history persistence errors preserve successful image operations and prior settings/list. Full live/default/sandbox/platform parity remains open. Freeze/isolate all inputs before focused validation; no source/test edits while it runs.

Focused01 compile failure / repair. Freeze01 retains854 inputs/462 Swift files. The observable File Handling draft read its own accessor before all stored properties were initialized. Initialize the recent-limit text from the controller argument instead. No tests ran; the driver is terminal before this edit. Add explicit owned-folder cleanup to the startup-queue test helper. Freeze02 and a separate focused log retain the repair.

Focused02 pass / process harness01 repair. All135 focused tests pass, zero failures/skips, on final freeze02 (854 inputs/462 Swift files). These include16 new store/menu/native/queue/HTTP tests and existing opening/closing/recovery/save/workspace/menu suites. The first owned process harness fails compilation because its seeded recovery context omits the required optional source argument. Application/test source is unchanged; retain the failed harness/log and add source:nil in a distinct harness02. Actual LaunchServices delivery and fresh-process persistence follow before full validation.

Process harness02 compile repair. The seeded backupURL lookup is throwing and needs try; preserve02 compiler output and add the missing try in harness03. No application/test source changes or process-result claims.

Process03 passes. The owned production-delegate app receives three actual LaunchServices document URLs while a private recovery backup is pending. All three open after recovery, with four total documents and no extra blank; recovery-only files stay out of recent history. Native Save As becomes most recent and limit2 persists atomically. A fresh process retains IDs/order/limit, reopens the exact saved model and preserves dirty identity on repeat. An external authenticated API client clears the list; a third launch loads zero records and the retained limit2. All three initial image hashes remain unchanged; the saved native file after Clear is byte-identical to its retained expected output. Credentials are removed before archiving. These are owned-process/LaunchServices checks, not live Finder/Photoshop UI. Begin full Debug/Release/universal validation on unchanged freeze02.

Documentation / live availability. Added the recent-list routes, permission, exact schemas, asynchronous status/cancellation, version2 migration and queue behavior to the API guide. The recent capability explicitly documents its owned-operation cancellation exception; the shared opening capability retains its general transfer-permission description. Core/Imaging/AI hashes remain identical to134. A fresh CUA Photoshop lookup returns cgWindowNotFound; desktop inventory reports the Mac locked and automatic unlock failed. Existing unlock request remains pending; no repeated prompt or live UI claim. Full Debug has exited0; Release compilation/testing and universal build remain in progress.

Final qualification / checkpoint135. All 1,261 Debug tests pass in 258.453seconds and all 1,261 Release tests in 62.053seconds, zero failures/skips. Final freeze02 has854 inputs/462 Swift files. Universal macOS14+ packaging, both architectures, signatures/resources and unchanged Xcode project verify. Six public AppKit calls queued before run-loop dispatch return exactly once against each final Release architecture: four new native10/native11/PSD/PNG documents, one same dirty-document repeat and one missing-file error. Model contents and source bytes match retained expectations; imported IDs and ImageIO dictionaries use the documented semantic comparison. Separate Debug production-delegate checks qualify actual LaunchServices delivery after indexed recovery, Save As, three fresh process states and external API Clear. Core/Imaging/AI are unchanged; nine complete PSB outputs equal134. Static menu inventory remains802/102primary/8alternate/157bound/568unavailable; dynamic recent items populate the existing submenu. Four application API routes do not increase the20 typed command count; Adobe remains2partial/6unimplemented. Installed117, real workspace/preferences/recovery and user documents remain unchanged. The Mac is locked; default20, live menu/Finder/accessibility and full platform/Photoshop parity remain unqualified. No major gate closed. Recorded D02 maintenance/capacity investigation and next plan; no cleanup or new recovery behavior is implemented in135. Checkpoint135 and final history audit retain this resume point.

Audit01 failure / repair. Both full test runs, universal packaging and arm64/Rosetta public queue probes pass. The final history refresh succeeds with135 milestones and zero missing references, but check01 reports a stale inventory. The diagnostic identifies exactly one changed indexed file: the audit orchestration log itself, written between refresh and check; its final result file was also added after the check. No milestone or application input changed. Preserve audit01 and its diagnostic. Run audit02 with progress sent directly to the tool and logs/results under the excluded development-history-audit directory; use distinct refresh02/check02/final-inputs02 paths. Source/package assertions and the fresh inventory check must pass before handoff.

Baseline / investigation. Previous133 turn made concrete progress. Verified its844 frozen inputs, installed117, Xcode project and133-milestone audit (zero missing references); no prior test/build/probe process remains live. Continue major D01. Existing Open uses an automatic synchronous decoder, native-container routing depends on extension, and the captured File Open Recent submenu is empty. Adobe’s current primary documentation clarifies that macOS format selection is inside File Open; separate Open As is Windows-specific. The prior next-candidate note calling it an unbound macOS catalog command was inaccurate; the existing factory catalog is correct and stays unchanged.

Design / sequence. Implement supported-container selection and All Documents in File Open, background model/fingerprint preparation with cancel and safe publication, stable already-open identity and batch partial progress. Share detection/format validation with optional API uploads, and expose native-opening state/cancellation without local-path disclosure. Keep legacy API imports compatible when the new header is absent; no Adobe route is invented. Recent-file storage/bookmarks/count preference remains the next D01 dependency; it needs a separate persisted lifecycle and qualification. Primary sources/design are retained in the134 run. Preserve installed117, original documents, user workspace/preferences/recovery and old disposable118. No source tests claimed yet.

Implementation before attempt01 (unvalidated). Added DocumentOpenFormat detection/selection and native Open accessory; extensionless/renamed native containers and mislabeled image extensions now route by content. Added PreparedLocalDocument and serial observable DocumentOpening, off-actor reader/fingerprint preparation, cancellation/partial progress and a native progress window. SDK callbacks remain on main actor; existing synchronous recovery factories share preparation. Close/Quit/recovery and uploads guard competing open operations. Added API optional format header, octet-stream with explicit selection, native-opening state/cancel schemas and permission text. Added12 focused tests for container validation, actual panel controls, worker/cancel/batch/identity/source-date behavior, HTTP equivalence/errors/privacy/revocation; existing SDK callback test now awaits asynchronous completion. Freeze/isolate inputs before testing; no application source edits during validation.

Focused01 compile failure and repair. Frozen849 inputs/457 Swift files. allowedContentTypes is nonoptional; Apple’s retained SDK header specifies an empty array for All Documents. Replaced nil with[] and repaired the corresponding test. No tests ran. Also defer work until the Open panel callback has returned, and guard uploaded-document publication against intervening completed open/close operations by operation identity (not just current busy flags). Added a gated HTTP regression for Close All finishing while an upload is decoding. Attempt02 freezes these changes separately; prior output remains intact.

Focused02 and repairs. All233 selected tests execute;3 assertions fail in one new HTTP equivalence test because independently decoded PSD/PSB/PNG models allocate different UUIDs. The other232 tests pass. Normalize only document/layer/active identities for that one-layer fixture and compare the complete model with a bounded failure message; native identities remain exact. Give the Open accessory its fitting frame and verify both popup heights plus host size programmatically. This is native geometry evidence, not live UI validation. Focus02 is terminal before these source/test changes; attempt03 preserves a new frozen tree and log.

Focused03 / metadata diagnosis.233 tests run with one remaining PNG equivalence failure; all other cases pass, including popup geometry. A separately linked Debug diagnostic proves equal layers, source/working ICC, XMP and decoded ImageIO property dictionaries; only binary-plist dictionary ordering differs (626bytes each). Compare those property dictionaries semantically before normalizing their representation for the complete-model check. Do not claim canonical binary metadata or byte-identical imports. Correct the busy-upload message to mention opening as well as closing. Focus03 and the diagnostic are terminal before this repair. Attempt04 targets the24 opening/API/IO tests; full regression follows.

Focused04 / process01 pass; full qualification running. All24 opening/API/IO tests pass on final849 frozen inputs/457 Swift files. The owned production-delegate Debug process opens four differently named native10/native11/PSD/PNG files around one missing sibling, receives five main-thread callbacks and preserves all source bytes. An external authenticated client observes and cancels a gated background read; exactly one cancellation callback occurs, no cancelled document is published, and the prior four remain open. The actual Open accessory reports289×56points with nonzero popup heights. Credentials are removed before archiving evidence. This is programmatic native behavior, not live UI. CUA getApp again reports a locked Mac/failed automatic unlock; the existing unlock request remains pending. Core/Imaging/AI hashes match133. Full Debug/Release/universal build runs on immutable freeze04.

Full01 Debug passes. All1,245 tests pass with zero failures/skips on final freeze04. The native opening, closing, recovery, history, raster/PSD, API and factory-menu suites all remain included. Release compilation/tests and universal packaging are still running; no source/test changes are made.

Final qualification / checkpoint134. All1,245 Debug tests pass in257.428seconds and all1,245 Release tests in61.872seconds, zero failures/skips. Final freeze04 has849 inputs/457 Swift files. Universal macOS14+ packaging, both architectures, signatures/resources and unchanged Xcode project verify. Public Open/repeated-dirty/invalid callbacks against exact final arm64 and x86_64 Release objects preserve four native10/native11/PSD/PNG model contents and source bytes; imported IDs and ImageIO property dictionaries use the documented semantic comparison. Debug production-delegate evidence separately covers five batch callbacks, one missing file, external HTTP cancellation and289×56 accessory geometry. Core/Imaging/AI remain unchanged; nine complete PSB outputs equal133. No new menu command is invented;802 paths/102 primary/8 alternate shortcuts/157 bound/568 unavailable remain. Photato adds two application routes and optional import format selection;20 typed commands and Adobe2partial/6unimplemented remain. Installed117, real workspace/preferences/recovery and user documents remain unchanged. Live Mac is locked; no current Photoshop/UI equivalence claimed. Persistent recents, Finder event queueing and remaining full lifecycle/platform/format/memory work remain open. Saved checkpoint134 and next major plan; all major gates stay open. Final history audit follows.

Baseline / investigation (in progress).Classify132 as concrete progress. Revalidated checkpoint132,839 frozen inputs, installed117 and the132-milestone audit with zero missing references. No earlier validation process is live. Continue major D01: Close All/Close Others exist in the verified Photoshop factory catalog but are unbound. Current tab/frame Close serializes NSDocument.canClose calls without application-wide coordination, complete busy/revocation handling or an API. Preserve originals, installed117, preferences/workspace/recovery and old disposable118.

Public lifecycle / design.Apple primary documentation and retained SDK headers establish that NSApplication reviews unsaved documents through NSDocumentController before asking the application delegate to terminate. Plan one native serial coordinator shared by single/group/batch close, controller Quit callbacks and API. Keep stable target/retained-document identity, Save/Don’t Save/Cancel, optional apply-to-all, partial progress and cancellation; use public Save/Save As APIs and existing persistence guards. The optional API needs separately enabled application-close permission and asynchronous202/status/cancel because native review can exceed the existing15-second HTTP deadline. Queue destructive/quit work until response transmission completes; reject stale/busy/revoked requests. No Adobe desktop-close endpoint is invented. Installed locale-file string search found no plaintext matches; it is not UI evidence. Exact live Photoshop prompt/apply-to-all behavior remains unverified while the Mac is locked. References and detailed design are retained in the133 run; source implementation/testing follows.

Implementation before attempt01 (not yet validated). Added the shared native close coordinator, controller delegate callbacks, Close All/Close Others menu bindings, Save/Discard/Cancel and apply-to-all review, and close ownership/recovery guards. Added separately enabled application-level API state/start/cancel routes, response-delivery gating for destructive work/Quit, opaque revision and permission-generation checks, and native API controls. Added21 close/API regression cases covering stable object identity, partial progress, real Save delegate/Save As cancellation, dirty/history preservation, recovery cleanup, public callback context, invalid/busy/stale/revoked requests, response failure and accepted Quit. Typed editing commands remain20; Adobe has no corresponding desktop close route. Test/build inputs are frozen into a distinct isolated directory before validation; installed117 remains unchanged.

Attempt01 compile failure and repair. Frozen844 inputs/452 Swift files. Swift bound an unlabeled trailing callback to the earlier defaulted validation closure; explicit completion: fixes the type mismatch in DocumentCloseActions. The build ended before tests. Retained focused01.log/result and source freeze; attempt02 is a new isolated copy. Existing RasterDecodeBudget Sendable warnings are unchanged.

Focused02 passed:205 tests, zero failures/skips,17.733s. Includes21 new native/API tests, actual NSDocument Save delegates/Save As cancellation and existing workspace/recovery/persistence regressions. Follow-up review adds a termination guard for any dirty document arriving after review and suppresses API Save/Save As/Revert availability while a close owns the target. Four further regressions cover cancellation during saving, native/API new-document arrival, and HTTP cancellation of an actual native sheet. These changes require a new freeze/attempt03; no source changes occurred while focused02 was running.

Focused03 passed:209 tests, zero failures/skips,19.189s. Final candidate freeze03 contains844 inputs/452 Swift files. The first external process harness failed compilation because it used a nonexistent service.port property; production exposes endpoint. Preserve process-close-compile01.log/object hashes and correct the harness only in attempt02. Application sources/tests remain unchanged. Actual process Quit, full suites and universal packaging are still pending.

Process attempts02–03 exposed unresolved Quit. Attempt02 exclusive log creation refused a reused compile filename before invoking the compiler; the earlier failure remained intact. Corrected attempt03 compiles against frozen03 objects. Its first real NSApplication.terminate cancellation case hangs after writing the owned fixture/backup and before cancellation/termination markers; driver kills/reaps it at25s. Preserve owned data and failure record; diagnostic attempt04 will sample the blocked process. No success or live UI claim; full qualification waits for this path.

Quit diagnostic04 and process05. The sample shows NSApplication’s nested termination loop called synchronously from a Swift Task, preventing the coordinator Task from advancing. The event-loop entry in probe05 cancels correctly, preserves the exact dirty model, retries and exits0. Its remaining assertion incorrectly expected retired index tombstones to be immediately removed: close correctly removes the backup and retires the entry. Attempt06 asserts no active entries, adds fresh-process same-identity relaunch to check pruning/no restoration, and tests save/discard/clean/busy/API modes. Application freeze03 is unchanged.

Actual Quit process06 passed. Six owned production-delegate processes cover native cancel/retry, busy rejection/retry, discard, Save, clean Quit and external HTTP Quit. Each exits0; cancelled/busy attempts preserve exact dirty models before retry. Save produces exact expected ordinary archive bytes; other modes preserve source bytes. API client receives202 queued before actual termination. Every same-identity fresh relaunch reports zero recovered documents and zero index entries. Deliberate closes remove backup files; retired tombstones are pruned on fresh discovery. This is automated process evidence, not live Photoshop UX comparison. Final freeze03 now proceeds through full Debug, full Release and universal build.

Live UI recheck and release plan. CUA Photoshop lookup returned cgWindowNotFound; native-app inventory then explicitly reported the Mac locked and automatic unlock failed. No live check is claimed and the prior unlock request is not repeated. Full tests run from freeze03. Final Release-object process probes will compile a separate harness using the compiler’s documented -disable-access-control test flag to access internal declarations without changing production objects; both architectures will exercise actual public controller/termination/save behavior. The app remains100% Swift/native; Core/Imaging/AI sources are byte-identical to132.

Full Debug01 passed. All1,232 tests, zero failures/skips,255.353s (256.806s command wall time), on unchanged freeze03. Release01 and universal build01 continue sequentially from the same isolation; Source/Test edits remain frozen. New controls are inside the existing scrolling API window; no screenshot/live layout claim is made.

Release and architecture qualification. All1,232 Release tests pass, zero failures/skips,59.738s; universal build01 succeeds. Clean extracted package verifies arm64/x86_64, minimum macOS14, signatures, resources and factory menu counts157/568. The private-hook Release harness links unsuccessfully because whole-module optimization removes internal symbols; retain its compile log/object hashes. Replacement public-close01 uses only AppKit public methods and links to the exact production Release objects, with no access-control override or production edit. On both arm64 and Rosetta x86_64, clean close, native sheet Cancel/Discard/Save, delegate BOOL/context and unchanged persisted model checks pass. Six actual Quit/external-HTTP/fresh-relaunch cases are separately qualified by the Debug production-delegate probe; do not mislabel them as shipping-binary live checks.

Final qualification / checkpoint133. All1,232 Debug tests pass in255.353seconds and all1,232 Release tests in59.738seconds, zero failures/skips. Universal macOS14+ packaging, signatures, icon/licenses/links and unchanged Xcode project verify. Factory802 menu paths/102 primary/8 alternate shortcuts stay unchanged; two new bindings give157 bound/568 unavailable leaves. Twenty typed Photato commands and two-partial/six-unimplemented Adobe coverage stay unchanged; three application HTTP methods and closeOperationID state cover the new lifecycle. Actual Debug processes cover cancel, busy rejection, discard, Save, clean Quit and external HTTP Quit, followed by six clean relaunches. A first Release harness cannot link optimized-away internal hooks; its failure is retained. Replacement probes use only public AppKit methods against exact final arm64/x86_64 Release objects and pass clean close, Cancel, Discard and Save, preserving models and exact delegate context/BOOL callbacks. Rosetta exercises the Objective-C callback ABI and actual native sheets/saves; physical Intel/macOS14/live UI remain unqualified. Core/Imaging/AI source hashes are unchanged; nine complete PSB outputs equal132. Installed117, real workspace/preferences/recovery and user documents remain untouched. Live CUA again reports locked Mac; no current Photoshop interaction/pixel parity claim. Saved checkpoint133, reference/API/menu/command/phase records and next major plan. All major gates remain open; next D01 Open As/recent files and D02 maintenance, before minor functions/details. Final history audit follows.

Baseline / investigation (in progress).Classify131 as concrete progress: checkpoint131, all834 frozen inputs, installed117 and the131-milestone zero-missing-reference audit revalidate. No prior validation session remains. Continue major D02:131's actual crash probe proves AppKit skips a backup whose original was deleted, although explicit recovery preserves its exact pixels. Plan an app-owned bounded index with archive-token binding, write-ahead intent, startup reconciliation and honest failure/cleanup state; source/UI/API work remains in the major phase. Keep all user files, installed117 and original preferences/workspace unchanged. Examine public AppKit save/autosave/reopen semantics through local SDK headers and official references; no private preference parsing or borrowed implementation. Full D01/D02/I02 and Photoshop parity remain open.

Design under evaluation.The index must not merely list filenames: each archive should carry a random snapshot token, recovery-group ID and document ID. Preserve the last committed entry while writing a new intent so a crash before/after publication can choose a valid backup. Prefer private app-owned storage independent of the original folder, subject to an early isolated AppKit autosave probe. Keep128's synchronous super.save entry and background image writer. Startup reconciles already-restored documents, opens missing-original entries without replacing originals, and avoids duplicate/blank documents. Index failures must preserve backup bytes, expose retry/status via native UI and Photato API, and never delete unrelated paths. Existing131 context/legacy archives remain readable; exact ordinary save/download bytes must remain unchanged. The design and qualification cases are retained in the132 run; no source edits yet.

Private-location probe01 passes.Using unchanged131 Debug objects, six owned cases compare setting the public autosavedContentsFileURL before normal autosave against direct autosaveElsewhere saving, for unsaved/native/PSB documents. Both keep the requested private folder through first/repeated snapshots, retain exact models, original associations/types/dirty state, leave original bytes untouched and remove backups on close. This supports choosing the public autosaved-location property while retaining AppKit's autosave machinery. The probe uses a unique identity and exits normally; it is not timer/crash qualification. New records will bind private archives to intent tokens before publication, with old/new token reconciliation on startup.

Implementation in progress, untested.Added version2 recovery context with group/snapshot/document tokens, bounded atomic index records, private autosave locations, intent-before-archive registration and startup discovery. Added source/token checks, duplicate/source-collision handling, stale-index and permission-generation guards, a File Handling retry control and separate optional API recovery-management permission/state/retry routes. Ordinary saves continue omitting recovery metadata; legacy source context remains decodable. Tests will exercise interruption windows, storage failures, missing originals/folders, deduplication, retirement and API/native equivalence before any validation claim. No user recovery store has been used.

Focused attempt01, failed before test execution.Frozen839 inputs/447 Swift files compile the application; the new fixture helper omitted try on source fingerprint capture. Retained compiler log and freeze; added the missing try after the build terminated. No runtime claim. Attempt02 uses a fresh isolated freeze.

Focused attempt02, 157/158 passed.Application compilation succeeds. Nine new index/API tests pass; the simulated deleted-folder fixture finds no restored document after invoking normal AppKit close. That fixture was incorrectly relying on normal close to preserve an abandoned backup. Preserve and restore only its owned backup bytes after fixture teardown; real SIGKILL qualification will not reconstruct files. Added actual HTTP/native restore equivalence, unshared recovery and unreadable-index tests. All pre-existing selected tests passed. Logs and frozen attempt02 retained; attempt03 is separate.

Focused attempt03, 159/160 passed; deleted-parent defect found.The repaired fixture now restores the exact document, exposing a real source-classification defect: canonicalization resolved only an immediate parent, so deleting that folder could turn equivalent /var and /private/var paths into an unverified association. Resolve the nearest existing ancestor and append missing components. Added an external-index-change HTTP regression and a revision check after reload, preventing stale retries from silently acting on newer external state. Attempt04 freezes these repairs separately; no source/test edits occurred during a live validation process.

Focused04 and process01 pass.All161 focused tests pass on839 frozen inputs/447 Swift files. The owned production-delegate writer creates seven private backups, is killed with SIGKILL, and a fresh process automatically restores all seven exact models without an explicit recovery call: unchanged, moved, changed-PSB, deleted, replaced, unsaved and deleted-parent originals. Format/dirty/review states match expectations; original bytes remain unchanged. Normal close removes all snapshots; clean relaunch has zero recovered documents and zero index entries. Retain process bundle/object hashes, source, logs and case files. A separate new-bundle-identity reader will isolate index discovery from AppKit registration; full Debug/Release/universal checks are running with source/tests frozen.

Independent process02 exposes startup ordering.A fresh bundle identity with no AppKit registration automatically restores all seven exact models through the index (indexDiscovered=7), but also opens an extra blank before applicationDidFinishLaunching. Its foreign-identity security bookmark does not locate the moved file; the original is safely treated as missing/review-required. The reader closes all eight documents normally; its files/logs are retained. Terminated the active full01 XCTest process at this known source defect; driver recorded failure and stopped before Release/build. Only after all processes terminated, defer early Untitled requests while an unfinished initial index contains active entries; add a regression covering that exact delegate ordering. Focus05 and process03 will validate the repair. Foreign-identity bookmark relocation is not claimed.

Focused05 and independent process03 pass.All162 focused tests pass. A fresh bundle identity restores all seven exact models through the index with zero already-open entries and no extra blank. Foreign-identity bookmark relocation remains unverified and review-required; same-identity process01 separately passed the moved-source case. Close and clean relaunch leave no indexed backups. Full02 is running on final freeze05. Interruption harness01 failed to compile because its local pause helper lost main-actor isolation; this affects only the disposable probe, not application Sources/Tests. Preserve failure and annotate that helper in new harness02.

Interruption02 passes; live UI unavailable.Two actual SIGKILL boundaries recover the expected full model through a fresh app identity: after the second intent is persisted but before archive writing, the prior snapshot survives; after the new archive is published but before index finalization, the new snapshot survives. Both finish registration, retain dirty state and clean up on close. These are process-interruption checks, not physical power-loss qualification. CUA reports the Mac is locked and automatic unlock failed; no new live UI or screenshot claim. Installed117 remains untouched. Full02 continues on frozen source.

Final-source process04 and native geometry probe pass.The final freeze05 same-identity process again automatically recovers all seven exact models, including a verified moved original, and removes backups/entries on close and clean relaunch. The retained unchanged130 reader accepts all seven version2-context archives with full model equality. A native File Handling window geometry probe reports600×309 content and matching600×309 fitting size/minimum height, confirming the added recovery controls expand the host instead of being clipped by its old initial230-point size. This is programmatic geometry evidence only, not live interaction or screenshot verification. Full02 Debug passed; Release/universal qualification continues.

Full02 Debug and Release01 pass.Both complete suites execute1,207 tests with zero failures/skips on final freeze05; canonical839 input hashes still match. The universal build is finishing before package/Intel/output verification. Existing RasterDecodeBudget Sendable diagnostics and the test runner’s deprecated native-build-system warning remain; no warning-free claim.

Final qualification / checkpoint132.All1,207 Debug tests pass in247.921seconds and all1,207 Release tests in52.938seconds, zero failures/skips. Universal macOS14+ packaging/signatures/resources and unchanged802 menu paths/155 bound/570 unavailable commands verify. Arm64/Rosetta preserve three retained129 native archives byte-identically; current Intel verifies63PSB cases and ten independent groups/655360 merged bytes. Independent Python checks1092 original sample bytes; nine whole PSB outputs equal130. The unchanged130 reader accepts all seven new132 recovery archives with exact models. Only checked recovery-context reading changes in Core/Imaging; pixel algorithms and ordinary archive writing are unchanged. Both final same-identity and independent-index seven-document crash probes, two journal interruption boundaries and close/clean relaunch pass. Keep startup synchronous full decode, recovery maintenance/legacy migration, sandbox/network/power-loss/live/physical-Intel/macOS14 and full major-parity gaps open. Saved132 checkpoint, API/schema/reference/command/phase records and next major close-workflow plan. Installed117, project, real workspace/preferences/recovery and user documents remain unchanged. Final history audit follows.

Scope and investigation (in progress). Continue major D02/D01 recovery workflows in the maintainer's major → minor → details order. Step130 is complete and retained; installed117, version0.2.0/build2 and user files/preferences stay untouched. Source audit found that native recovery retains pixels but not the last-known original file identity; every associated recovery currently forces Save As and guesses its format from the current source. Plan: atomically embed bounded optional provenance in recovery archives only, retain the original format and fingerprint/bookmark, verify sources before allowing ordinary Save, and expose matching status/capabilities through the Photato API. Invalid or absent provenance must preserve recovered pixels and require review. Ordinary document Open/uploads must never bind embedded recovery metadata. Adobe's pinned v2 contract has no desktop recovery endpoint. Full D01/D02/I02 remain open.

Design constraints. Keep the existing native serializer byte-identical when context is absent; decode context and pixels through one stable file read. Cache source records before recovery entry to preserve AppKit's required synchronous autosave call and background serialization. Distinguish persistent volume/inode/birth identity from content hash; never infer identity solely from a filename or mtime. Use Apple's documented bookmark resolution without UI/mounting and balance access. Recovered originals must be rechecked at Save, with AppKit coordination and explicit remaining external-race limits. Keep all failed attempts and freeze source before validation.

Implementation / freeze01. Added a bounded optional recovery manifest field with one stable read for pixels/context, source fingerprints (volume/inode/birth/size/mtime/SHA-256), optional Foundation bookmarks, background restoration verification, source-format preservation, Save revalidation, Save/Save As/Revert record refresh, and close cancellation. API adds recoverySource state/schema/capabilities and409 conflicts without new routes; ordinary exports remain context-free. Added3 archive and10 lifecycle/HTTP regressions. Source capture uses a64KiB hash buffer; synchronous existing Open incurs an additional sequential read, with large-document latency still unqualified. Freeze01 isolates all validation inputs; no Source/Test edits while tests run.

Focused01 failure and repairs.146 tests execute with5 assertions failing in2 new cases; all prior selected suites pass. Foundation bookmarks on this host prefer an occupied original path, so the source fingerprint correctly rejects a replacement rather than locating the moved inode. Independent bookmark probes01–03 compare plain/minimal/alias/security-scoped options and preserve this finding; normal unoccupied renames resolve on canonical paths. Probe02's uncaught diagnostic read terminates the interpreter; its exact owned leftover directory is inspected/removed and recorded. Use canonical URLs for bookmark creation and a full ordinary bookmark fallback. Separate unoccupied-move success from occupied-path protection in tests; automatic rediscovery under an occupied path remains an explicit limitation. Revert's existing PreparedEdit intentionally keeps the editing document ID; correct that test to compare restored layers and retained identity. Add the checking-state409 API guard and regression. No storage protection is relaxed.

Focused02 / capture repair.147 tests execute with2 assertions failing in the HTTP source-state case. Save correctly rejects, but the record was absent after a post-save metadata timestamp change; a test had allowed nil==nil. Add a nonnil assertion and a bounded full-read retry for metadata-only ctime changes, matching step128's archive policy. Open/Revert repeat the entire decode+fingerprint capture on that specific conflict; size/mtime/inode/birth changes still reject. A missing record now publishes unverified/review before rejecting Save. Canonical bookmark creation fixes the unoccupied rename case; replacement protection and all other selected tests pass. Discovery also corrects a guessed WorkspaceLibrary filename to SavedWorkspaces.swift.

Focused03 pass / process qualification.Freeze03 retains834 inputs/442 Swift files. All147 focused tests pass, zero failures/skips, including canonical unoccupied rename, occupied-path replacement protection, all six formats, post-encode source changes, record refresh, invalid/legacy context, API409 and cancellation. Begin a five-document owned production-delegate probe: create real AppKit snapshots with embedded provenance, SIGKILL, alter only disposable originals (unchanged/moved/changed/missing/replaced), then recover in a fresh process and verify exact models, source state/type and close cleanup. Full Debug/Release and universal build follow only if that succeeds; all inputs stay frozen.

Process01 discovers an automatic-recovery gap.The writer creates five exact snapshots with records and is SIGKILLed; fresh AppKit launch automatically restores4 (unchanged/moved/changed/replaced), each with exact content, proper type/review and no source modifications. The deleted-original case is not enumerated by AppKit; its exact backup remains beside the former original. The five-automatic assertion correctly fails. This is an unresolved D02 discovery/registration dependency, not lost archive data or a source-verification pass. Expose that limit in API capabilities. Process02 repeats independently and separately labels4 automatic recoveries plus explicit recovery of the retained missing-original backup, followed by cleanup. Do not claim five automatic recoveries. Freeze04 changes only the capability limitation text from successful freeze03. Live CUA getApp reports cgWindowNotFound; inventory explicitly reports locked Mac/failed automatic unlock. No live pass or candidate installation.

Process02 source-path repair.The separately labelled explicit missing-file recovery restores exact pixels, but reports unverified rather than missing. Its record is present; Foundation canonicalization shortened an existing/private/tmp path to/tmp, then kept/private/tmp after deletion, so text comparison treated the registered source as unrelated. Replace existence-dependent URL normalization with POSIX realpath of the file or its existing parent, and compare both registered/record URLs through that routine. Add a regression for/private/tmp versus/tmp after deletion. Process02's original four automatic cases pass; no original is overwritten. Freeze05 and focused05 precede a fresh process03; prior probes remain immutable.

Focused05 and process03 pass.All148 focused tests pass on freeze05 (834 inputs/442 Swift files). Fresh production-delegate process03 restores4 documents automatically and the retained deleted-original backup explicitly: all5 exact models, original formats, expected unchanged/moved/changed/missing/replaced states and review flags match. Source files remain byte-identical to their deliberately changed pre-relaunch versions, and closing removes all5 snapshots. Automatic deleted-original discovery remains open, separately from the corrected explicit factory. Full Debug/Release and universal build now run on the same freeze. Process01's retained orphan backup is preserved for later registration cleanup; none of the original user documents are touched.

Debug / backward compatibility and cleanup.All1,193 Debug tests pass (249.072seconds, zero failures/skips). The preserved step130 process executable, whose hash matches130's manifest, reads all five131 recovery archives and compares complete models equal to plain expectations; optional context is backward-compatible and ignored by130. Two dedicated cleanup helpers for process01's orphan time out at20seconds (one bare controller, one production delegate); Python kills/waits both. No AppKit cleanup success is claimed for that older disposable identity. The orphan's bytes exactly match the retained immutable case01 copy, so remove only that known temporary file and record its hash. Any stale recovery reference for the ephemeral old probe identity is left untouched. Process03's five normal close removals remain independently verified. Release/build qualification continues.

Final qualification / checkpoint131.All1,193 Debug tests pass in249.072seconds and all1,193 Release tests in52.097seconds, zero failures/skips. Universal macOS14+ package/signatures/resources and unchanged802/155/570 menu counts verify. Current arm64/Rosetta engines read/write three retained129 native archives byte-identically and preserve/strip recovery context appropriately; current Intel checks63PSB comparisons and ten independent group fixtures/655360 merged bytes. Independent Python verifies1092 original sample bytes; nine whole PSB outputs equal130. Only NativeChunkedArchive changes among107 Core/Imaging files; no pixel algorithm changes. Installed117, Xcode project, real workspace/preferences and original user documents remain unchanged. Saved checkpoint131, source/API/command/status/phase records and next major discovery plan. Explicitly retain deleted-original automatic discovery, occupied-path rediscovery, old disposable cleanup-registration uncertainty, source-capture latency, live/physical-Intel/macOS14 and full major-parity gaps. Final history audit follows.

1. Baseline and investigation (20261020T061326Z UTC). Previous goal turn is concrete progress: checkpoint129, all827 frozen inputs, installed117 binary/ZIP and the final zero-missing-reference audit revalidate. Continue major D02/D01 durability. AtomicFileWriter currently opens a sibling by path, uses fsync, then resolves paths again for identity/rename/cleanup; a moved/replaced parent can redirect those operations. Prepared raster Data uses a separate Foundation atomic-write path. Plan retained directory descriptors and relative operations, parent/destination identity guards, stronger pre-publication flushing with explicit unsupported-filesystem fallback, shared raster persistence, deterministic syscall faults and owned process termination at publication boundaries. Preserve exact serialized bytes and both API contracts; expose the changed storage policy in capabilities/documentation. Parent-directory/power-loss guarantees, original-source bookmarks and full recovery parity remain open. Initial search includes one nonexistent guessed filename (DocumentSaveWorkflow.swift); subsequent rg file discovery corrects it. Tool discovery is unavailable, so primary-reference lookup uses the available web tool. Apple manuals/guidance are recorded in 20261020T061326Z-130-atomic-persistence/external-references01.json; no third-party implementation is copied. No130 source change yet.

2. Implementation and first freeze. AtomicFileWriter now retains the parent descriptor, creates/inspects/renames/unlinks relative to it, verifies the parent and staged inode before publication, and preserves a replacement file at a reused private name during cleanup. It retries interrupted fsync/full-sync calls and partial writes, requests F_FULLFSYNC before publication, and falls back only for EINVAL/ENOTSUP/ENOSYS after successful fsync; real I/O/space failures reject. Per-instance internal syscall injection supports deterministic faults without global test hooks. NativeArchive retains the exact version11 serializer through an internal writer-factory overload. Prepared raster Data now shares the writer/permission/symlink behavior. Native/API capabilities expose the policy and limits; routes/state schemas,20 typed commands and Adobe2-partial/6-missing coverage stay unchanged. Added10 Core fault/ownership tests and4 native/HTTP/raster/preferences workflow tests, including real shared writer failures and retry. Initial review caught and fixed cleanup deleting a replacement temporary name before testing. Freeze01 has830 inputs/438 Swift files. No power-loss, parent-entry durability or completed D02 claim.

3. Focused pass and permission repair. Focused01 passes132 tests, zero failures/skips,8.235seconds. Review then identifies a directory-access regression: O_RDONLY requires listing permission even though persistence only needs traversal/write access. An owned0300 directory probe records EACCES for O_RDONLY and successful relative create/unlink using O_SEARCH. The local SDK and Apple’s published xnu-10002.1.13 header both define O_SEARCH; no implementation code is copied. Changed the retained parent descriptor to search-only and added a real0300-directory regression. Clarified the API cleanup description to say ownership is checked, with the existing explicit no-compare-and-swap limitation. Freeze02 retains830 inputs/438 Swift files;15 new tests total. Full supported-platform/sandbox qualification remains open.

4. Interruption probe and kernel-limit harness correction. Focused02 passes133 tests, zero failures/skips. Process01 compiles and independently verifies the four SIGKILL boundaries: during a partial write, after real full-sync, before rename and after rename; complete prior/new archives remain exact and fresh readers decode them. Its file-size-limit case exits normally with a caught Cocoa4866 serialization error, violating the harness’s expected direct POSIX EFBIG result. The global process limit was applied before PropertyList serialization, so this did not isolate the file writer. Preserve all cases and the failing assertion. Process02 prepares the exact archive before imposing RLIMIT_FSIZE, then writes it through the same AtomicFileWriter; other interruption paths continue to use streamed NativeArchive.write. Product freeze02 stays unchanged. A separate bounded32MiB HFS+ disk-image probe will test real ENOSPC and retry, guarded against filling the host filesystem.

5. Process interruption pass and disk-image command correction. Process02 verifies all five cases: four owned SIGKILL boundaries plus actual POSIX EFBIG from the size-limited writer. Previous archives survive failures before publication; the complete new archive survives termination after rename; fresh readers verify exact models, and owned interrupted staging is retained as evidence then removed. Disk-image01 fails before creating/mounting a volume because this host’s hdiutil only accepts -format with a source image/folder. Preserve its command/error/cleanup report; the host filesystem was never filled. Disk-image02 uses the documented blank-image default instead. No product source changes or skipped validation.

6. Fill the remaining allocation fragments. Disk-image02 safely mounts only its owned32MiB HFS+ image and reaches ENOSPC with1MiB filler writes, but statvfs still reports212,992 available bytes. The small archive correctly saves successfully, so the expected-failure assertion fails. This is a harness exhaustion error, not a failed preservation guarantee. The volume detaches and its temporary image is removed. Disk-image03 progressively fills1MiB/64KiB/4KiB/512-byte/1-byte requests and requires zero available bytes before resuming the paused transaction. Preserve both attempts; broader tests remain gated.

7. Actual ENOSPC passes; broader validation and output checks. Disk-image03 reaches zero available bytes after32,718,848 filler bytes. The already-created native transaction then fails with actual NSPOSIXErrorDomain/ENOSPC28, retains the exact previous decodable archive, and removes its owned staging. Freeing the filler permits an exact new archive on retry. The owned volume detaches and the temporary image is removed; both earlier image attempts are also cleaned up. Full Debug validation passes1,178 tests; Release/universal checks continue. Added a post-build arm64/Rosetta storage probe for three retained129 archive files and search-only-directory writes, because the existing Intel PSD checks do not directly cover the changed writer. API documentation records the additive capability policy and unchanged wire contracts. No physical power-loss, complete AppKit registration or live Photoshop claim.

A further review checks filesystem attributes before accepting the raster-path change. The first probe uses an unavailable Python os.setxattr function and stops before executing Swift; its owned directory is recorded and removed. A second owned fixture uses the system xattr CLI and confirms the former Foundation Data.atomic path retained0640 mode but dropped the probe attribute. No new attribute-preservation regression is established; full filesystem tags/ACL preservation remains a D01 gap. Both probes and cleanup are retained, and production sources remain frozen.

8. Final automated qualification and checkpoint. All1,178 Debug tests pass in245.777seconds and all1,178 Release tests pass in51.377seconds, zero failures/skips. Universal macOS14+ ZIP signatures/resources and unchanged menu inventory pass. Current Intel engine checks63PSB comparisons and ten independent group references/655360 merged bytes; independent Python checks1092 original sample bytes. All nine PSB exports equal129. Release arm64 and Rosetta each re-save three retained129 native archives byte-identically and exercise search-only-directory persistence. Only AtomicFileWriter and its NativeArchive entry point change among107 Core/Imaging files. Every owned disk image detaches/removes, interrupted staging is retained as evidence then removed, and installed117/Xcode/user workspace/preferences remain unchanged. Saved checkpoint130, references, API/command/status/phase records and failures. Full D02/D01/I02, physical Intel/macOS14, live UI and Photoshop parity remain open. Final history audit follows.

1. Baseline and scope. Previous turn is concrete progress: checkpoint128 and823 source inputs, installed117 app/ZIP and final128 audit revalidated. Continue major D02 recovery with persistent enablement/interval preferences, native File Handling entry and shared application-scope API. Adobe’s current official recovery guide verifies enabled recovery, ten-minute default and a five-minute option. Exact2026 dropdown, dialog layout and preference transition behavior remain unqualified: Photoshop window lookup fails, and inventory confirms the Mac is locked. Existing factory menu catalogue has Settings > File Handling with no shortcut; General/Command-K must not be bound to a different operation. Keep all other unimplemented settings disabled. Plan atomic small-file persistence, cancel/stale/write-failure handling, timer updates, a separate default-off API preference-write permission, schemas/state/errors and tests. Preserve user documents, workspace and installed117. No129 source change yet.

2. Implementation and first freeze. Added an observable recovery-preferences store with validated5/10/15/30/60-minute choices, enabled/ten-minute defaults, versioned bounded JSON, atomic writes, external-change detection and preservation on load/write failure. Only production launch uses the persistent store; probes/tests/snapshots use injected stores. File Handling opens a native draft window with OK/Cancel; it does not repurpose General/Command-K. Settings change the controller timer after persistence, reject during file work, leave image/history and existing backups alone, and retain explicit backup support while automatic scheduling is disabled. Added authenticated GET/POST /v1/preferences/recovery with a separate default-off write permission, revision, strict fields/types, schemas, errors and capabilities; no Adobe settings route is invented. Twelve new tests cover persistence/reload, failures, stale/cancel, menu binding, document effects and HTTP behavior. Freeze01 contains827 inputs/435 Swift files. Exact currentPhotoshop dropdown/layout/transitions remain pending live verification; official primary guide directly establishes5/10-minute behavior.

3. Focused pass and persistent-process qualification. Focused01 passes105 tests, zero failures/skips,6.852seconds. All12 new preferences regressions pass, including explicit backup while automatic scheduling is disabled and unchanged prior backup/history. The process harness now uses the production delegate with an owned persistent preferences file: cancel a one-second test timer, observe no backup for three seconds, enable the saved five-minute setting, verify300seconds before a bounded one-second override, then edit during automatic backups and crash/relaunch. Fresh reader/clean processes must load300seconds from disk. Full Debug/Release/universal/output validation follows only after this passes; sources remain frozen.

4. Process failure exposes queued autosave behavior. Process01 compiles but its writer exits2: after setting the interval to0, an already scheduled AppKit backup still writes during the three-second disabled observation. The parent reports no ready state and exits4; no full suite or package build runs. Added an enablement check at the native recovery-save entry, while allowing the explicit document.autosave path. Intentional cancellation remains quiet and does not set write-failed state. A new regression calls a queued save after disabling, proves no output/dirty-state loss, then proves an explicit backup still succeeds. Freeze02 follows. Separately, offscreen snapshot01 exits signal11 after its first PNG; the raw harness NSWindow lacked the production window’s isReleasedWhenClosed=false guard, and the image is visibly incomplete. Preserve both failures; no live/visual pass is claimed. Failed process01 recovery artifacts will be preserved and closed through its own disposable app identity.

5. Tighten the timing interpretation. Further harness review identifies an ambiguity in process01: its one-second timer was enabled before constructing three windows, so an existing backup may have been created before disabling. Its failure does not by itself prove a queued write happened afterward. Preserve that limitation alongside the earlier interpretation. Process02 now starts with automatic recovery disabled, finishes construction/rendering, requires no existing snapshots, then enables the one-second test timer and immediately disables it. Record the before-disable snapshot/busy counts and require no new backup during the next three seconds. The added native guard is still required for any queued/direct recovery-save entry after disable, independently exercised by the focused regression.

6. Disable passes; enable exposes missing rescheduling. Focused02 passes106 tests. Process02 confirms zero snapshots/busy writes before disable and zero new backups during three seconds disabled. Re-enabling sets300seconds but none of the three already-dirty documents backs up during the accelerated observation, so the ready check fails. The public NSDocument.scheduleAutosaving contract in the local SDK provides the correct rescheduling entry; changing the controller property alone does not notify existing documents. Added a call for each document after preferences/timer commit, without changing content or change counts, plus a regression proving re-enable preserves document/history/revision. The process also invokes that same public method after its test-only one-second timer override. First patch attempt matched a pre-format test line and applied nothing; corrected anchors, then freeze03. Snapshot02 removes the harness close crash but both PNGs remain incomplete (native child controls are not rendered); no visual acceptance is claimed. Full live UI remains blocked by the locked Mac.

7. Replace ambiguous accelerated timing with the configured interval. Process03 exits4 with all three backups absent during its20-second observation, despite the public rescheduling call. This does not establish a production scheduling failure: changing the delay after arming a300-second timer may leave that deadline intact. Preserve and narrow substep6’s interpretation accordingly. Process04 constructs clean documents while disabled, enables recovery, sets a one-second probe delay before the first edits, immediately disables it, and requires zero backups after three seconds. It then re-enables the saved five-minute setting and leaves the first deadlines unaccelerated for up to450seconds. Only follow-up edits during a confirmed background write use a one-second delay. Record observed first-write times, exact content and fresh-process preference reload. Freeze03 remains unchanged; process03 is terminal and broader validation has not run.

8. Qualification wrapper correction. Driver04 exits1 before compilation because its copied command still selects process-recovery03.py; exclusive log creation correctly prevents overwriting attempt03. No app executes and no product source changes. Preserve the wrapper failure and use driver05 to select the new process04 harness.

9. Real interval and recovery pass; clean startup assertion fails. Process04 records first writes at300.334/300.338/300.340seconds after re-enable. All three documents accept edits during background writing, receive exact follow-up backups and recover those exact latest models after SIGKILL. Fresh reader loads300seconds; original source hashes and source-format/review checks pass; close removes every owned autosave. The final fresh clean process loads300seconds but reports no documents after five seconds, so driver05 exits1 on its expected-one-blank assertion and blocks full validation. This direct executable launch did not crash or resurrect stale content. Investigate launch callback behavior separately without rerunning the verified five-minute/crash sequence or forcing a blank over recovery. Product sources remain freeze03.

10. Startup callback diagnosis and bounded qualification. A second clean direct launch again exits0 with zero documents. Two12-second observer harnesses forward to production AppDelegate: fresh identity06 receives willFinish/shouldOpenUntitled/openUntitled/didFinish and already has one blank; reused process04 identity07 receives only willFinish/didFinish and has zero documents. Explicit production open-untitled callback creates exactly one clean Untitled-1 in either case, then close leaves zero. Thus the earlier unconditional-one-blank assertion assumed an AppKit request that was not delivered for the closed-window identity. No product source repair is justified by this observation. Preserve original process04 executable before instrumenting its owned bundle. Qualifier06 independently checks real300-second first writes, disabled state, latest-model crash recovery, associations, removed autosaves, fresh-process persisted preferences and both callback observations. It explicitly excludes unconditional blank startup/live Finder behavior. Full Debug/Release/build/postflight proceed against unchanged freeze03. During the wait, read AtomicFileWriter and native recovery source association: parent-directory durability and original-source identity/bookmarks remain concrete next D02 dependencies.

11. Full suites pass; package qualification follows. Debug and Release each complete1,163 tests with zero failures/skips on freeze03. The pre-existing RasterDecodeBudget/Sendable compiler warnings recur in unchanged Core files; matching warnings are present in128 Release logs, so no warning-free build is claimed. Existing nonzero Photoshop vector-render differences remain recorded rather than promoted to byte equality. Universal build, Intel engine checks, retained output comparison and owned-process01 cleanup follow before checkpoint finalization.

12. Final automated qualification and cleanup. All 1,163 Debug tests pass (244.867seconds) and all 1,163 Release tests pass (50.269seconds), zero failures/skips. Universal arm64/x86_64 macOS14+ packaging verifies clean ZIP signature, notices/icon and802 menu entries with155 bound/570 unavailable leaf commands. Intel engine underRosetta passes63 PSB comparisons and ten independent group references/655,360 merged bytes; independent Python checks1,092 original sample bytes in nine PSB outputs. All complete exports equal128 and all107 Core/Imaging sources remain identical. Failed process01 backups are preserved and removed through its own app identity; originals remain unchanged and no owned probe process remains. Candidate129 is preserved separately; installed117, Xcode project and real workspace/preferences match.

13. Checkpoint and next major work. Saved checkpoint129, preferences references, both API notes, menu/command evidence and every failed attempt. Full D02, exact preference UX/options/platform timing, source identity/durability and storage remain open. Incomplete offscreen PNGs are explicitly excluded from visual acceptance; the locked Mac still blocks live input. Continue major workflows before optional minor functions or details. Final evidence refresh/check follows.

1. Baseline and design (20261020T044823Z UTC). Previous turn is concrete progress: step127 repairs actual recovery and passes1,136 Debug/Release tests, universal/output checks and the final audit. Revalidated820 source inputs and installed117 ZIP. Continue D02/I02: recovery serialization still blocks the main thread. Apple’s public asynchronous NSDocument contract and local SDK require a thread-safe immutable snapshot and unblockUserInteraction before expensive writing; DispatchQueue.main.sync from a writer while AppKit is blocking that same thread would deadlock. Plan to capture the COW model before calling synchronous super.save, pass it through a locked immutable write context, unblock from the native writer and retain AppKit’s file coordination/change tokens. Guard replacement/close and overlapping manual file work; test editing during a held backup, failure/retry, API responsiveness and actual crash/relaunch. No Sources changed yet. Reference provenance: 20261020T044823Z-128-background-recovery/external-references01.json. Preserve original user documents and installed117; all major gates remain open.

2. Implementation and measured baseline. Captured a deterministic four-layer1024×768 RGB32 document using the exact127 Debug objects, preserving object/compiler/binary hashes. Three actual backups each retain the exact model and37,855,700 archive bytes; main-actor heartbeat gaps are2.090–2.132seconds, essentially the entire write duration. This establishes the synchronous problem on a bounded48MiB raw-pixel fixture, not a full large-document benchmark. Added a lock-protected immutable recovery context, AppKit asynchronous recovery writes with explicit unblock, in-flight replacement rejection, deferred close cleanup and deferral during other file operations. Native and HTTP use the same path; capabilities explain background writing and newer unsaved edits. Eight new deterministic tests cover COW pixels, Undo/change tokens, replacement, close, overlapping file work, HTTP response availability/revocation and injected out-of-space failure. Source freeze01/focused validation follows; no128 success claim yet.

3. Focused failure exposes legacy AppKit accounting. Focused01 compiles and runs83 tests; three assertions fail in the two concurrent-edit/Undo cases. The main actor is responsive and snapshots retain their captured pixels, but hasUnautosavedChanges becomes false and a follow-up backup no-ops. A separate minimal NSDocument probe confirms this platform’s autosavesElsewhere path calls changeAutosaved and never its change-token methods. The trace01 compile attempt also finds NSDocument.print shadowing Swift.print; trace02 qualifies the call and runs successfully. Preserved all logs and a bounded failure summary. Added explicit content/captured generations alongside AppKit bookkeeping so later edits and Undo remain eligible for recovery; no dirty-history state is fabricated. Read replacement invalidates that generation. Strengthened Undo to request a follow-up snapshot too. New attempt02 freezes the repair; no weakened assertion or claimed success from the failed run.

4. Generation repair and clean-Undo edge. Focused02 runs83 tests with one remaining assertion: edits and follow-up pixels now work, but after Undo returns a document to clean, AppKit removes the obsolete autosave instead of writing another. The generation marker incorrectly kept hasUnautosavedChanges true even without a registered backup. Restrict the extra stale-generation condition to an existing autosavedContentsFileURL; retain all assertions including clean/dirty state. Process qualification is strengthened to edit each owned document during an automatic background write, wait for a second automatic backup and then crash/relaunch, rather than only testing idle snapshots. Attempt03 freezes this final guard before validation.

5. Background and crash checks pass; final source review. Focused03 passes83 tests with zero failures/skips. The production-delegate subprocess captures three documents automatically, edits each during its first backup, waits for a second automatic backup, then verifies exact models after SIGKILL/relaunch, source associations, close cleanup and one clean fresh-launch blank. Three warm Debug backups of the same48MiB raw-pixel fixture have main-actor gaps3.1–6.0ms versus2.09–2.13seconds in127; all three entire archives remain byte-identical. These are bounded process/timing results, not live UI, Release, physical Intel, multi-GB or peak-RSS qualification. Corrected the source-review warning to explain Save As for recovered documents as well as imported-profile restrictions, and added a regression proving ordinary Save preserves the original while reviewed Save As succeeds. The final comment describes the observed generation repair rather than unobserved AppKit change tokens. Freeze04 will bind these last edits to fresh focused/process/timing/full validation; failed attempts remain intact.

6. Final focused pass; repeat timing detects a file change. Focused04 passes84 tests, zero failures/skips,6.382seconds. Runtime02 links the final Debug objects but exits signal5 after iteration0: NativeArchiveFileSource rejects a change during a later recovery-file read. This is preserved as a failed validation, not suppressed or counted as a pass; process02 did not run. Source inspection shows the guard includes inode/size/mtime/ctime. Add stage and before/after file metadata/hash capture to a separate timing03 harness to distinguish content replacement from metadata churn before changing product policy. The read-only native inventory returns apps, but selecting Photoshop still reports the Mac locked/autounlock failed; no live-input qualification or candidate install occurred.

7. Diagnostic compile repair. Timing03 does not run: Darwin.stat resolves to its Swift struct initializer instead of the C function. The separate04 diagnostic uses the same fstatat API as the production reader. No product source changed; failed03 compile remains preserved.

8. Final process and instrumented timing pass. Runtime04 on freeze04 passes three exact archive comparisons against127, with main-actor gaps3.1–6.7ms. Recorded file identities are stable during every successful read. The final production-delegate process02 independently verifies three edits during automatic backups, second automatic snapshots, SIGKILL/relaunch, exact content, source protection and cleanup. This does not explain the earlier transient read-guard failure; no guard is removed and no metadata-only cause is claimed. One further timing05 attempt omits the extra pre-read SHA read so instrumentation cannot merely mask that condition; full Debug/Release/build checks follow only if it passes.

9. Reproduced metadata conflict and bounded repair. Timing05 fails at iteration1 without the extra hash pre-read. Saved stat values have identical device/inode/size/mtime, but ctime changes by about0.55seconds. The complete after-read SHA matches the independent127 expected archive. This establishes metadata identity churn for this attempt; its originating service is not identified. Added a typed internal metadata conflict and exactly one complete-read retry with a fresh descriptor. Every attempt retains all identity, physical-read bounds and archive-integrity checks. Inode/size/mtime changes, integrity errors and cancellation do not qualify for retry; repeated metadata churn still returns the user-facing error. Four regressions exercise real chmod changes, bounded retries, replacement/content rejection and integrity rejection. This D01/D02 read-lifecycle dependency is shared by desktop and API imports/recovery, with no new API route/schema. An initial preparation command used a nonexistent NativeArchive.swift path and stopped before creating freeze05; no test ran or evidence was overwritten. Corrected preparation searches the actual source tree.

10. Final frozen runtime repair verified. Focused05 passes96 tests with zero failures/skips in6.926seconds on823 inputs/431 Swift source/test files. Timing06 uses the final read-retry implementation with no extra pre-read hash, passes three full archives byte-identically against127, and records main-actor gaps3.40–5.78ms. Process03 passes actual automatic follow-up backups after concurrent edits, exact three-document crash recovery, source-format/review checks, original-file preservation and close/fresh-launch cleanup. Full Debug/Release and universal/package/independent-output checks now run serially against this same freeze05.

11. Validation succeeds; finalization reference repaired. Both1,149-test suites, universal packaging, Intel probes and independent PSB checks pass. The first finalization script mistakenly sought127 freeze05 instead of historical freeze04 after a broad preparation substitution; it stopped before writing checkpoint128. Its export-comparison01 output is preserved. The audit refresh/check then passed its inventory rules, but its wrapper correctly failed on the absent checkpoint. Saved finalization01-failure.json and both scripts. A distinct finalize12802 fixes the historical reference, preserves prior output and targets a new final02 audit directory. No application source or tested package changed; no application tests are repeated for this bookkeeping repair.

12. Final validation. Timing06, with no extra pre-read SHA operation, passes all three exact archives against127; observed main-actor gaps3.39–5.78ms. This qualifies the bounded fixture after the metadata-conflict repair; earlier failed attempts remain preserved. All1,149 Debug tests pass (246.222seconds) and all1,149 Release tests pass (50.376seconds), zero failures/skips. Universal arm64/x86_64 macOS14+ packaging verifies clean ZIP signature, notices/icon and unchanged802-entry menu inventory. Intel engine underRosetta passes63 PSB comparisons and ten independent group references/655,360 merged bytes. Independent Python verifies1,092 original sample bytes in nine PSB outputs, and all complete outputs equal127. The archive reader and its entry point are the only two changed Core/Imaging files;105 remain unchanged. Pixel algorithms and serialized output stay identical. Candidate128 remains separate; installed117 and real workspace hashes match.

13. Checkpoint and remaining major work. Saved checkpoint128, background-recovery references, both API coverage notes, status/plan/command evidence and all failures. D02/D01/I02 remain open. No recovery preferences, full fault/power-loss durability, recovered Undo history, large-document memory qualification or full parity claim. The locked Mac prevents combined live native/Photoshop input checks. Next work continues recovery preferences/durability/source identity and storage dependencies. All validation processes are terminal. Final evidence refresh/check follows.

1. Baseline and investigation (20261020T041711Z UTC). Previous goal turn was concrete progress: checkpoint126 passed1,128 Debug/Release tests, universal/Intel/output checks and the final evidence audit. Revalidated all818 frozen126 inputs and the installed117 ZIP before new work. Continue D02 as a major dependency of document lifecycle, with I02 limits still open. Source inspection shows native autosave write/read leaves but no configured autosavingDelay and no custom recovery-reopen factory; the app's tabbed windows are not registered as individual NSDocument window controllers. Investigating AppKit recovery before deciding whether it can provide the required durable lifecycle. No127 product/source changes or tests yet. Primary references: Adobe recovery, local SDK declarations and fetched Apple documentation, with provenance at 20261020T041711Z-127-recovery-investigation/external-references01.json. Preserve original user documents, installed117, all126 evidence and the active full-parity goal.

2. Baseline process evidence and native integration. Linked a disposable Swift probe against the exact126 Debug objects (object hashes/commands preserved) and invoked the native recovery factory. baseline-runtime01.json reports autosavingDelay0; the process exited signal5 with an unimplemented CraftNSDocument.init() fatal error, saved in baseline-run01.log. Added the bounded default initializer required by AppKit’s factories, ten-minute scheduling on configured controllers, and recovery-window routing to the shared native workspace. Automatic native snapshot writes now capture committed content without finishing numeric/name drafts. Added document.autosave plus recovery state/schema/capabilities (20 typed commands), using the same native autosave registration and private storage. D02 is not closed: real subprocess relaunch, corruption/interruption, metadata and responsiveness qualification follow. AppKit’s public SDK documents that setting autosavedContentsFileURL registers crash reopening, so no duplicate journal is introduced before validating that mechanism. Added six lifecycle/API/draft tests; first source/test freeze and focused validation follows. Evidence root: 20261020T041711Z-127-recovery-investigation.

3. Focused compile failure and repair. The preserved focused01 attempt exits1 before tests: NSDocument’s Swift override is restoreWindow(withIdentifier:state:completionHandler:), not the Objective-C-derived restoreDocumentWindow spelling. Corrected the override and its Sendable completion, changed the window regression to use its async form, and opted the application delegate into secure restorable state. Apple declaration: https://developer.apple.com/documentation/appkit/nsdocument/restorewindow%28withidentifier%3Astate%3Acompletionhandler%3A%29 . No test or recovery success is claimed from this failed compile. Freeze a fresh attempt02 before rerunning; attempt01 is retained.

4. Focused repair validation. Focused02 passes on820 frozen inputs (428 Swift source/test files), including all six recovery regressions. AppKit factory recovery preserves native content, modified state and source association in the explicitly typed cases; numeric drafts stay uncommitted, and HTTP/native snapshots share validation and history effects. A separate linked process probe now uses the production delegate/controller in a disposable app identity and in-memory workspace library to test automatic timer writes followed by abnormal termination and relaunch. It creates only owned fixtures; this is process integration evidence, not live user-input or Photoshop qualification. Primary Apple restoration documentation is retained with hashes in external-references02.json.

5. Disposable harness startup failure. process02 compiles, but times out before fixture creation. Sampling its owned PID shows AppKit trying to open the probe’s positional arguments as documents and waiting in an error alert. This is a harness invocation defect, not proof of a recovery/runtime deadlock. The owned process was killed by the bounded parent; its bundle, logs and sample remain. Attempt03 moves probe configuration to task-specific environment variables and passes no positional document arguments; product sources are unchanged. Focused02 total is73 tests, zero failures/skips,6.229 seconds.

6. Actual automatic recovery exposes two product defects. Attempt03 uses the production delegate, automatic one-second test timer (production600), three owned unsaved/native/PSB documents and SIGKILL followed by a fresh process. All three snapshots and reopened models compare exactly. The reopened PSB incorrectly adopts native persistenceFormat and loses its review guard; startup also creates an extra blank. AppKit supplies the snapshot type to its recovery factory. Added a recovery-factory override that restores the source container/extension association and requires explicit Save As review, because the snapshot does not retain the original pre-crash file identity. Missing originals remain recoverable. AppKit now decides initial untitled creation through its normal delegate callback, rather than an eager did-finish-launching blank. The process also establishes that AppKit may place recovery files beside the original; corrected the API storage description (these are not universally private-directory files). Added a missing-source regression and strengthened all six format cases to pass the actual native recovery type. No claim of window/tab layout, edit history or full power-loss recovery parity.

7. Relaunch repair verified. Focused03 passes74 tests with no failures/skips. Process04 confirms three automatic snapshots, exact committed models after SIGKILL/relaunch, preserved native/PSB associations and modified state, required Save As review, no extra blank, removal of all three autosaves on close and one clean blank on the next fresh launch. Original source hashes are unchanged. Preserved copied snapshots and process-verification04.json. The attempt03 isolation preparation initially failed when docs already existed; merged that directory, verified all hashes and retained isolation03-preparation-failure.json; no tests ran against a partial checkout. Added one final recovery write-failure/retry regression to verify an unwritable destination preserves the last snapshot, document/history/revision and truthful failure state. Freeze04 follows.

8. Final focused validation and regression freeze. Focused04 passes75 tests/6.395seconds, zero failures/skips, including eight new recovery regressions. The write-failure test confirms last-good snapshot preservation, unchanged content/history/revision, accurate failure/busy state and successful retry. Freeze04 binds820 inputs/428 Swift files. Product Sources are identical to successful process04; only its final regression was added afterward. Core/Imaging107 files remain identical to126. Full Debug, full Release and universal packaging now run serially in the isolated checkout; installed117 is preserved.

8b. Live access and probe cleanup. CUA’s Photoshop request returns cgWindowNotFound; refreshed native inventory reports the Mac is locked and automatic unlock failed. No interactive qualification or candidate installation is claimed. Earlier process03’s owned backups were recovered under its exact disposable bundle identity with the corrected process04 executable, copied into evidence, then closed normally; cleanup confirms zero remaining documents and removal of the registered backups. Neither original user application/document was operated on. See live-ui02.json and process-cleanup03-result.json.

9. Final automated qualification. All1,136 Debug tests pass (246.138seconds) and all1,136 Release tests pass (49.905seconds), zero failures/skips. Universal arm64/x86_64 macOS14+ package signatures, icon/notices and802-entry menu inventory pass. Current Intel engine underRosetta completes63 PSB comparisons and ten independent Photoshop group references/655,360 merged bytes. Independent Python verifies1,092 original sample bytes in nine PSB outputs; complete exports equal126. No engine algorithm changed. Candidate127 is retained separately and installed117/workspace hashes match. Failed process03’s owned backups are preserved, reopened through the corrected native factory and closed; no probe process remains.

10. Checkpoint and next major work. Save checkpoint127, recovery reference, both API coverage notes, status/plan/command evidence. D02/D01/I02 remain open. Core recovery works for the tested fixtures, but preferences, full fault/durability/source-identity coverage, large-document latency and live Photoshop workflows remain unfinished. Native autosave is still synchronous; no lower-RSS, full power-loss, recovered Undo history or complete parity claim. Final evidence refresh/check follows.

1. Scope and baseline (20261020T035545Z, UTC). Continued the active major-function phase after checkpoint125. Revalidated all 816 frozen 125 inputs before work. Inspected EditorStore, native history menus/panel, geometry cancellation, document lifecycle, shared HTTP history and core EditorSession. Scratch restoration and spill currently run synchronously on the main actor. Plan: prepare a value-copy session in a detached cancellable task, publish only against the unchanged session/lifecycle/revision, and expose cancellation/state through the Photato API. Keep the core synchronous engine for non-UI callers and preserve Adobe routes. Resident navigation also uses the worker because restoring it may spill another snapshot. No new Photoshop equivalence, total-memory or live qualification claim. Initial record: 20261020T035545Z-126-async-history/scope01.json.

2. Implementation before validation. Added shared detached history preparation, session-mutation/lifecycle/render-revision publication guards, native progress cancellation and close/read invalidation. Photato exposes operation state/schema plus typed history.cancel (19 commands); HTTP Undo/Redo awaits publication and sharing revocation cancels API-owned workers. Existing history/pixel/dirty-state tests now await actual completion; native text UndoManager and core EditorSession remain synchronous. Added deterministic worker gates for native/API responsiveness, cancellation, ABA, replacement, validation, revocation and unchanged failed revisions. History-panel multi-step selection completes individual atomic transitions and stops on failure/cancellation. Xcode synchronized source groups include the new files automatically. Sources/Tests are frozen before the first focused compilation; no results claimed yet.

3. Preserved first compile failure and repair. 20261020T035545Z-126-async-history/focused01.log ended with exit 1 before tests. Four migrated numeric-field waits used RunLoop.run from async code; replaced them with suspending waits. The migration script also incorrectly marked unrelated PanelValidationProbe.refresh async because its method scan included later private functions; restored that method exactly. The three panel diagnostics came from that accidental signature change, not from a migrated helper caller. Application source unchanged for this repair. New frozen attempt: 20261020T040123Z-126-async-history-repair.

4. Preserved runtime failure; lifecycle review. Attempt 20261020T040123Z-126-async-history-repair compiled, passed the first new cancellation test, then terminated signal 11 during the next test’s dirty-state notification. Saved the diagnostic frames in crash-summary01.json. The standalone test had closed NSDocument before creating the custom document-controller singleton; the next test then received AppKit’s base singleton. Added explicit application/controller setup; rerun will determine whether this explains the failure. Separately found and fixed queued native actions starting after close/replacement, retired native status writes, and busy API accounting waiting on the shared scratch writer lock. Added queued-action regression coverage. Attempt 20261020T040338Z-126-history-lifecycle freezes these changes before validation.

5. Focused validation passes. 20261020T040338Z-126-history-lifecycle/focused01.log:104 tests,0 failures,0 skips,9.016 seconds. All 8 new async-history regressions pass, including the previously crashing HTTP test after explicit controller initialization. Preserved both earlier attempts. Started serial full Debug, Release and universal packaging from 818 frozen inputs/426 Swift files using 20261020T040338Z-126-history-lifecycle/validate01.py. No Sources/Tests edits while those checks run. Read-only CUA inventory reported Photoshop/original PhotoCraft/disposable118 running; Photoshop access explicitly failed because the Mac remains locked. Saved live-ui01.json; no candidate launched or installed. Updated API usage documentation. No new memory-performance claim; the core numerical/storage source is unchanged from125.

6. Final automated qualification. All 1,128 Debug tests pass (246.569 seconds), and all 1,128 Release tests pass (49.834 seconds), with 0 failures/0 skips on 818 frozen inputs/426 Swift files. Universal arm64/x86_64 macOS14+ packaging, clean-ZIP signature, icon/notices and unchanged factory menu inventory pass. Current x86_64 engine under Rosetta completes 63 PSB comparisons and ten independent Photoshop group references/655,360 merged bytes; no physical Intel claim. Independent Python checks preserve 1,092 original sample bytes across 9 PSB outputs; every complete file equals125. Core/Imaging 107 source files are unchanged. Candidate126 ZIP is preserved separately, installed117 and original workspace hashes match. Record: 20261020T040338Z-126-history-lifecycle/package-verification01.json.

7. Checkpoint and next work. Saved checkpoint126, async-history reference, API/Adobe coverage notes, command evidence, status and phase plan. No major gate is closed. Live combined118–126 tests await Mac unlock; no current candidate launched/installed. Continue major active-document/renderer memory and D02 recovery work, including start-time accounting/final cleanup latency. Optional minor/history extras remain queued. All validation drivers are terminal; final development-history refresh/check follows.

8. Final evidence audit. Commands: python3 scripts/audit-development-history.py then python3 scripts/audit-development-history.py --check. The refresh log, check result and final input/package binding record the terminal outcomes. These preserve the failed attempts as well as the final passing tests. No source/test edits after the final freeze. Existing Intel RasterDecodeBudget Sendable warnings also occur in125; this increment makes no warning-free build claim.

1. Revalidate all816 step124 frozen inputs, terminal audit, and current arm64/x86_64 Release object hashes. Classify124 as substantive progress. Continue major D01/I02 memory work with installed117 and user documents preserved; no pending product validation is restarted. Evidence run: [local evidence archive].

2. Inspect HistorySnapshot.restore, HistoryTileDecoder, Surface COW arrays and EditorSession navigation. Each restoration creates a fresh tile decoder and loses cross-state sharing, even for identical unchanged tiles. Plan one immutable reuse index attached to the current restored document: seed the next decoder from those live arrays, retain only referenced output arrays, and clear the index on document edits. Reused blobs must still pass current disk length/hash validation. No strong global cache, unbounded history cache, new public limits, or suppression of failures. Verify COW/branch isolation, cache lifetime, corruption after caching, cancellation/validation rollback, desktop/API state and exact prior sample/output hashes; measure final current-object RSS and latency against124 before claiming improvement.

3. Implement an immutable current-document tile index, reuse verified arrays across adjacent scratch restores and explicitly clear decoder-owned arrays on success/error. EditorSession publishes the new index only with a successful history transaction and clears it on changed edits; no-op edits preserve it. Photato state/schema adds reusableCurrentRasterBytes and capabilities describe reuse/integrity/lifetime; both job adapters keep the same session engine without new Adobe routes. Add four core tests for physical buffer sharing, release of unused tiles, corruption/missing-file checks after caching, rollback and concurrent value-branch COW isolation, plus one desktop/HTTP state/edit test. Prepare the first frozen isolated qualification.

4. Focused01 passes80 tests with zero failures/skips in16.217 seconds on816 frozen inputs/424 Swift source-test files. All five new core/HTTP tests pass, including exact physical buffer sharing and preserved corruption detection after reuse. CUA Photoshop binding explicitly reports the Mac locked; preserve installed117 and keep combined118–125 live qualification pending. Begin serial full Debug/Release/universal validation from freeze01 with no product source/test edits; prepare identical124/current memory and output comparisons.

5. Full Debug01 passes1,120 tests with zero failures/skips in244.703 seconds on freeze01. The unchanged-source serial driver continues Release and universal packaging. Prepare current-object prior/current history checks on both the original repeated-row fixture and step124 original Python less-compressible fixture, with every state sample hash and complete final PSB comparison; do not infer performance from correctness alone.

6. Full Release01 passes1,120 tests with zero failures/skips in48.870 seconds on freeze01. The serial driver continues universal packaging. Existing RasterDecodeBudget Foundation userInfo Sendable warnings remain; do not represent compilation as warning-free. No source/test changes occur during validation. The prepared postflight compares exact current/prior history and PSB outputs and both architectures, preserving all commands and process-memory observations.

7. Initial postflight reveals mixed memory results despite exact hashes: repeated-row Rosetta scratch RSS falls402,984,960→358,858,752 but remains above332,255,232 resident-only. The less-compressible arm64 probe rises283,574,272→320,176,128 while navigation falls30.217→25.437 seconds. Keep these first-attempt artifacts intact and do not claim a universal memory improvement. Complete the live probe before any source edits, then isolate Foundation temporary lifetimes with a transaction-only autoreleasepool diagnostic using the same final objects and input; pooling sample hashing is deliberately excluded.

8. Initial postflight and transaction-only pool diagnostic both terminate0; all state/output hashes match. Pooling only edit/Undo/Redo calls (not sample hashing/export) reduces the less-compressible arm64 peak from320,176,128 to281886720 bytes. Preserve every initial candidate/log/result. Integrate explicit Foundation autorelease boundaries in the shared engine transaction entry points, then perform fresh focused/full/Release/universal and current-object comparisons under a separate final attempt: [local evidence archive]. This bounds temporary-object lifetime without changing history ownership, sample values, limits or command/API semantics.

9. Add explicit autoreleasepool boundaries around shared executePrepared and Undo/Redo commits. History state, validation, cancellation and rollback paths remain inside the same synchronous transaction; returned document/index buffers retain native value ownership. API/desktop/job consumers all use these entry points. Freeze816 inputs/424 Swift files in the separate final125 run, copy a fresh isolated checkout and start focused qualification. Original sharing-only source/binary/test/memory evidence stays intact; no product source/test edits while validation is active.

10. Final-attempt focused01 passes80 tests with zero failures/skips in16.348 seconds on the repaired816-input freeze. Preserve the earlier80-test run separately. Begin fresh serial full Debug/Release/universal validation for the product transaction-boundary change, followed by final current-object memory/byte qualification. No product source/test edits during the run.

11. Repaired final-attempt full Debug01 passes1,120 tests with zero failures/skips in245.746 seconds on the final freeze. Release/universal validation continues serially. A new read-only CUA reference check first reports cgWindowNotFound; inventory then explicitly reports Mac locked/autounlock unsuccessful. Preserve both UI attempts and keep combined live qualification pending rather than interpreting a missing window as process termination.

12. Repaired final-attempt Release01 passes1,120 tests with zero failures/skips in48.536 seconds. The serial driver continues universal builds on the same frozen sources; existing SDK/SwiftPM warnings remain recorded. Final postflight will reuse the preserved124 less-compressible baseline results and run fresh125 processes, avoiding redundant baseline work while preserving exact hashes and baseline provenance.

13. Final postflight drivers terminate0. Current x86_64 objects pass63 PSB file/Data comparisons and ten independent Photoshop RGB32 group references (655,360 merged bytes). Independent Python verifies1,092 procedural channel/mask bytes across nine Release exports, and all nine complete files equal124. All13 history-state sample hash lists and final PSB outputs agree between124/125 and both architectures in the repeated-row probe; the less-compressible four-process comparison also matches every state and original independent Python layer hash.

14. Preserve exact memory/timing observations: [{"architecture":"arm64","budget":1073741824,"prior_peakRSSBytes":392986624,"current_peakRSSBytes":393019392,"prior_navigationSeconds":0.9683510065078735,"current_navigationSeconds":0.9985049962997437},{"architecture":"arm64","budget":33554432,"prior_peakRSSBytes":304529408,"current_peakRSSBytes":284229632,"prior_navigationSeconds":6.082531094551086,"current_navigationSeconds":5.795629024505615},{"architecture":"x86_64","budget":1073741824,"prior_peakRSSBytes":333299712,"current_peakRSSBytes":333344768,"prior_navigationSeconds":5.384113073348999,"current_navigationSeconds":5.356944918632507},{"architecture":"x86_64","budget":33554432,"prior_peakRSSBytes":402984960,"current_peakRSSBytes":303468544,"prior_navigationSeconds":13.975826025009155,"current_navigationSeconds":13.30599594116211}]. Less-compressible cases: [{"version":"124","architecture":"arm64","peakRSSBytes":283574272,"peakFootprintBytes":260686688,"forwardSeconds":11.302394986152649,"navigationSeconds":30.21732795238495,"scratchBytes":169569899},{"version":"125","architecture":"arm64","peakRSSBytes":295731200,"peakFootprintBytes":279544648,"forwardSeconds":11.357289910316467,"navigationSeconds":25.7034809589386,"scratchBytes":169569899},{"version":"124","architecture":"x86_64","peakRSSBytes":459034624,"peakFootprintBytes":458448640,"forwardSeconds":17.044811010360718,"navigationSeconds":47.88511896133423,"scratchBytes":169569899},{"version":"125","architecture":"x86_64","peakRSSBytes":413188096,"peakFootprintBytes":412688248,"forwardSeconds":17.25932502746582,"navigationSeconds":42.32229804992676,"scratchBytes":169569899}]. These separate processes include hashing and final output. They do not establish a total-RAM cap, physical Intel performance, default-budget multi-GB behavior or complete Photoshop performance parity.

15. Preserve Photato125-candidate.zip separately and verify all816 frozen inputs/424 Swift files, installed117 binary/ZIP, unchanged Xcode project and real workspace. Update API/provenance/status/phase/command records and checkpoint125. Full recovery, asynchronous history, bounded rendering/active storage, platform and combined118–125 live checks remain open. All product tests/build/postflight processes are terminal0. Finish development-history refresh/check and final hash audit; the master goal remains active and optional minor/detail work remains queued.

16. First final history refresh/check passes125 milestones/31,105 evidence files/18,163 logs/zero missing references, and all source/package assertions pass. Review finds a copied audit-summary key named candidate124_zip_verified even though the actual assertion verifies the125 candidate file/hash. Preserve the original summary and checkpoint, correct the label in a new audit02 driver, point the checkpoint at refresh02/check02/final-inputs02 and rerun documentation/hash audit. Product sources, tests, binaries and measured results are unchanged; no unrelated native retest is needed.

1. Classify123 as substantive progress:812 current frozen inputs and the terminal123 audit revalidate without mismatch. Preserve its candidate and installed117. Continue major D01/I02; first locate the Rosetta total-memory peak without changing product sources, then implement bounded portable native archive storage. The history payload accounting limit is not a process memory cap. Evidence run: [local evidence archive].

2. The separate123-object Rosetta phase probe retains exact state/output comparisons and locates growth during restore: low-budget peak rises from243,646,464 after forward edits to325,013,504 after Undo and365,084,672 after Redo; export reaches365,563,904. Resident-only peaks331,431,936 overall. This narrows the next investigation, not the cause. Reuse one inflation workspace per blob decoder and avoid an extra raw-tile copy; retain independent returned arrays, cancellation and exact finite-sample checks. Measure the final implementation against the preserved123 baseline rather than assuming the workspace change fixes RSS.

3. Implement portable native archive version11 with a fixed header, indexed content-addressed tile/selection blobs, binary-plist metadata and an integrity-checked footer. Data and atomic file outputs share one serializer. Native Open uses retained regular-file descriptors and64KiB reads; old binary-plist archives keep their mapped compatibility path. Core legacy encode remains version10; desktop/API output adopts11 and both versions decode. Add staged native Save/Copy and file-backed autosave leaf writing within AppKit coordination; this is not crash-relaunch qualification. Expose nativeArchives capabilities, version/schema metadata and header-only upload dimensions; retain all public file/canvas/API budgets. No user-document conversion or installed-app replacement occurs.

4. Add eight core regressions for exact sample/file/Data/legacy compatibility, integrity/offset/ownership corruption, bounded reads, atomic output failure, cancellation and reusable decoder isolation; add direct native autosave and real HTTP version11 import/download/copy/corruption checks. Expand prepared-file tests to native output and update the expected advertised version11. Freeze816 inputs/424 Swift source-test files and isolate before focused qualification. Native v1–10 fixtures and legacy encoder stay intact.

5. Focused01 runs75 tests with one failure: a failed native archive write leaves its private sibling file until the encoder releases the retained sink. The original destination remains unchanged. Preserve the failed log and pre-repair sources; add explicit AtomicFileWriter.discard and defer it in native file writing, then exercise cleanup while retaining the writer. Review the published Photato preview contract: keep both native download aliases version10 by default and add explicit X-Photato-Archive-Version:11 negotiation for new storage, preserving older clients. Native Save uses11; both versions upload/read. Add default/alias/opt-in/invalid-header HTTP assertions and retain legacy float32 capability metadata. Freeze02 and rerun.

6. Focused02 runs75 tests with two failures, both older native download byte comparisons still using the now-preserved version10 default against new desktop version11 files. All new integrity, cleanup and default-version protection checks pass. Preserve failed logs/tests; make the two equivalence tests explicitly request11, retaining independent default10 assertions. Review also routes NSDocument URL reads (including extensionless recovery files) through the bounded native reader and common model publication; add successful/failed leaf-read checks. Full AppKit recovery after process termination remains unqualified. Freeze03 and rerun.

7. Focused03 passes75 tests with zero failures/skips (14.851 seconds) on816 frozen inputs/424 Swift source-test files. This covers both archive versions, negotiated/default API bytes, direct file-backed autosave/read, corruption/cleanup and shared history/job regressions. Start serial full Debug/Release/universal builds using freeze03; no source/test edits while validation runs. Prepare independent Python container/sample inspection and current Intel/native-memory probes.

8. Full Debug01 passes1,115 tests with zero failures/skips in246.021 seconds on freeze03. Release/universal validation continues serially. Prepare current arm64/x86_64 native archive corpus/read/write probes, independent Python version11 framing/hash/tile/sample validation, and identical-history123/current memory comparisons. The cross-process native archive byte benchmark normalizes only generated document/layer UUIDs; input samples and other metadata remain unchanged, and legacy/new serialized formats are explicitly distinct.

9. Full Release01 passes1,115 tests with zero failures/skips in48.820 seconds; universal build and clean-ZIP qualification pass on freeze03. Current arm64/Rosetta native corpus/file/Data/legacy-model checks pass, and independent Python parsing verifies728 original procedural sample bytes across both architectures. The first four-layer memory input has repeated rows and compresses to177,919 native11 bytes, so add a deterministic low-compressibility input before assessing streaming memory benefit. No product sources change; the current-object history and PSD/group checks continue.

10. All postflight01 drivers terminate0. Current Rosetta objects pass63 PSB file/Data comparisons and ten independent Photoshop RGB32 group references (655,360 merged bytes). Independent Python validates1,092 original procedural PSB channel/mask bytes across nine Release exports, and all nine complete files equal123. Native version11 Data/file bytes match for the deterministic benchmark on arm64 and Rosetta; three-depth fixture checks retain the old native model and PSD outputs. The independent native parser validates728 procedural source bytes across the two architectures; original Photoshop RGB32 preservation is a separate Swift check, not a new live Photoshop observation.

11. Add native-entropy01.py: original deterministic Python PSB with four1024x1024 RGB32 layers, random finite RGB mantissas and opaque alpha; publish independent little-endian RGBA source hashes. Ten separate-process old10/new11-Data/new11-file/read comparisons all preserve every source layer. The48,319,327-byte new archives match completely across Data/file and arm64/Rosetta. Save peak RSS old10→new11-file is253,083,648→120,864,768 bytes on arm64 and231,075,840→106,106,880 under Rosetta. Reads are slower on this fixture (0.135→0.195s arm64,0.203→0.402s Rosetta), with approximately equal footprint versus mapped legacy reads. Keep these bounded single-run results separate from multi-GB or Photoshop performance claims.

12. Re-run the exact123 twelve-edit history benchmark with final124 objects: every13-state hash list, Undo/Redo result and final PSB hash remains equal. Arm64 scratch peakRSS304,529,408 versus392,986,624 resident-only; Rosetta scratch402,984,960 versus333,299,712. The latter is lower than prior123 scratch422,535,168, but remains worse than resident-only and does not close total-memory performance. Synchronous navigation remains slower with disk snapshots (6.083 vs0.968s arm64,13.976 vs5.384s Rosetta). No speculative source change or expanded public limits are introduced.

13. Preserve Photato124-candidate.zip and clean extracted universal app separately. Verify all816 frozen inputs/424 Swift files, installed117 binary/ZIP, unchanged Xcode project and real workspace hash. Update native format/API/provenance/status/phase/command records and checkpoint124; D01/I02/D02 and relevant D03 dependencies remain open. The Mac remains unavailable for the recorded live attempt; combined118–124 qualification and old118 disposable cleanup stay pending. All product tests/build/postflight/entropy processes are terminal0. Proceed with development-history refresh/check and final complete source/package audit; the master goal stays active and optional minor/detail work stays queued.

1. Revalidate all809 frozen122 inputs, complete source/test inventory and durable candidate; its final history audit passed and no validation process remains live. Classify122 as substantive major-workflow progress. Inspect Surface's native Array COW tiles, EditorSession history trimming, NativeArchive binary PropertyList serialization and desktop/API Undo/Redo. Existing history sums each snapshot's estimatedBytes, over-counting shared pixels and silently dropping even metadata-only states. Preserve installed117 and the original user documents; continue D01/I02 major dependencies.

2. Plan shared tile allocation accounting plus private scratch-backed history snapshots. Spill old snapshots instead of accepting an edit with its undo state silently discarded for memory pressure. Encode tiles separately with exact sample storage, content deduplication and per-blob integrity checks; retain value-copy snapshot ownership and cleanup. Restore through explicit throwing history transitions before mutating documents/stacks; keep desktop errors distinct from API failures and preserve factory Undo/Redo/menu behavior. Expose actual history storage state/capabilities in the Photato API; both job interfaces keep the same native session engine without new Adobe routes. Full active-document paging, streaming native archives, recovery, preference/Photoshop/platform qualification and larger public limits remain open. Evidence run: [local evidence archive].

3. Implement owned immutable scratch blobs with 64KiB physical I/O, SHA256 verification, content deduplication, bounded disk use and last-owner cleanup; use private metadata/tile coding contexts without changing portable native archives. Count shared COW raster buffers once beyond the active document, spill oldest snapshots, and make edit/Undo/Redo publication transactional. Desktop reports restore errors; API returns failures without native alerts and adds historyStorage state/capability/schema. Update callers for throwing engine history, preserve the metadata-history regression instead of expecting silent trimming, and add failure, sample-bit, ownership/concurrency, coalescing and desktop/HTTP/job-engine coverage. Reference Adobe's current scratch-disk and Performance preferences pages; actual preference parity, active-document paging, asynchronous history and complete D03/I02 remain open. Prepare the first frozen isolated test attempt; no product test result claimed yet.

4. Focused01 stops at compilation: the cancellation regression Task is inferred throwing by XCTest assertions, so awaiting its value requires try. Preserve failed log and pre-repair test; add try, freeze02 and rerun. No tests were claimed passed from this attempt. The primary Adobe scratch page loads; the separate performance-preferences URL returns an internal error and is not treated as a fully read source.

5. Focused02 passes86 tests with zero failures/skips in8.956 seconds on812 frozen inputs/420 Swift source-test files. This includes ten new core scratch regressions, two real HTTP/native history workflows and independent Photoshop RGB32 storage preservation. All failed scratch operations keep document/history/revision and dirty state unchanged in the covered cases. CUA reports the Mac locked; live combined118–123 qualification remains pending and installed117 is retained. Begin serial full Debug/Release/universal validation from freeze02 with no source/test edits during the run.

6. Full Debug01 passes1,105 tests with zero failures/skips (239.118 seconds); the unchanged-source driver continues Release and universal builds. Prepare separate current-engine1GiB/32MiB resident-budget processes with identical twelve edits, every Undo/Redo sample hash and complete output bytes. Read the current Adobe Performance page (updated2026-10-04): it documents50 default/1,000 maximum history states; Photato remains40/default and200 internal maximum, an explicit remaining preference delta. No limit change is smuggled into the frozen build.

7. Final full Debug01 passes1,105 tests (239.118 seconds) and full Release01 passes1,105 (48.56 seconds), zero failures/skips on freeze02. Universal packaging passes strict clean-ZIP signature, arm64/x86_64 macOS14 deployment, icon/notices/links/document types and fixture exclusion. Current Rosetta objects verify63 PSB file/Data outputs and ten independent RGB32 group composites (655,360 merged bytes). Independent Python parsing verifies1,092 original layer/mask bytes in nine Release exports; all nine complete files match122. Existing RasterDecodeBudget Foundation userInfo Sendable warnings remain, including the same synchronously confined budget in the new history decoder; warnings are retained, not reported as errors or silently suppressed.

8. Compare current1GiB resident and32MiB spilling configurations on the same four-layer1024×1024 RGB32 input with twelve pixel edits: all13 state sample-hash lists, every Undo/Redo restoration and complete final PSB hashes agree on arm64 and x86_64/Rosetta. Arm64 peak RSS is393,003,008 versus304,824,320 bytes; reported footprint384,779,128 versus296,043,432. The spilling process reports11 disk snapshots and16,778,240 resident history payload bytes after forward edits. These single-process observations include hashing and final export; they do not qualify Photoshop performance, multi-GB files, physical Intel or a total RSS cap. Preserve exact timing/memory/storage evidence and the tradeoff of synchronous disk work.

9. Preserve Photato123-candidate.zip separately and retain installed117, original user workspace and unchanged Xcode project. Update history/API/state-schema/provenance, Undo/Redo evidence, phase plan and checkpoint123. D01/I02 and D03 remain open; scratch history is a phase1 large-document prerequisite, not permission to start optional phase2 history features. Next: native archive streaming/recovery and active-document paging/error propagation, plus combined live118–123 checks after unlock. All test/build/postflight commands are terminal; finish the development-history refresh/check and final complete source/package/hash audit. No Git mutation, rename, new Adobe route or StoreKit/AI change.

10. Review all memory results before the final audit: x86_64/Rosetta peak RSS rises from333,697,024 to422,535,168 bytes under32MiB spilling, while arm64 falls from393,003,008 to304,824,320. History payload is bounded and all bytes agree, but total process memory is not universally improved and synchronous navigation is slower. Preserve these results and run a separate diagnostic with an autoreleasepool around each action to distinguish temporary Foundation lifetime accumulation from persistent history ownership; product sources and candidate remain unchanged.

11. The separate per-action autoreleasepool diagnostic passes all sample/output comparisons on unchanged objects. Rosetta scratch RSS falls to388,108,288, but still exceeds its pooled resident-only332,337,152; this does not explain or resolve the complete peak-RSS regression. No speculative product lifetime change is made. Record both probes, the higher Rosetta peak and synchronous latency in status/reference/checkpoint, and leave total-memory optimization/qualification open under major I02. The initial functional history defect is repaired; no full performance/Photoshop/major-gate closure is claimed. All validation and diagnostic processes are now terminal0; proceed to final source/package/evidence audit.

1. Revalidate all802 frozen121 inputs and recover its terminal final history check. Prior turn completes that audit boundary; no product validation is pending. Continue major D01/I02 with bounded output while retaining installed117 and all earlier isolated candidates. Current writer retains every compressed layer, layer section and final output Data. Plan a shared memory/file sink, checked backpatched lengths, incremental ZIP/prediction rows, atomic file replacement and prepared-file handoff through AppKit's existing coordinated safe-save machinery. API downloads/jobs retain bounded Data responses but use the same serializer. No file/canvas/API limits or major-gate closures are implied.

2. Read the official zlib manual (https://zlib.net/manual.html), Apple's write(to:ofType:) documentation and local NSDocument.h: preserve Z_NO_FLUSH row streaming through Z_STREAM_END; retain super.save and writeSafely behavior, overriding only the leaf writer for prepared files. Keep metadata/renderer/tile memory and complete external-file coordination as separate remaining work. Add corpus/sample and file/Data byte comparisons, compression compatibility, cancellation/output failure tests, desktop Save/Copy/ownership/dirty-state and both API regressions. Evidence run: [local evidence archive].

3. Implement AtomicFileWriter with64KiB positioned writes, checked patches, cancellation, destination-change checks and same-directory atomic replacement. Add shared PSDOutput and row-wise raw/ZIP/prediction output, write layer records before channel bodies, backpatch PSD/PSB lengths, and stream merged rows. Stage PSD/PSB Save/Copy off the main actor and hand the immutable private file to AppKit's leaf writer; keep native recovery and existing Data encoder injection. API local saves retain128MiB checks; downloads/jobs share the serializer and additive fileOutput capabilities describe limits. Add eight core/imaging/app tests plus HTTP download/desktop-copy equality. Freeze inputs and isolate before focused qualification. No claim of full crash durability, filesystem compare-and-swap, scratch-backed tiles or multi-GB support.

4. Focused01 stops at compilation because the new length-boundary test called nonexistent PSDReader.n instead of its existing length reader. Preserve the failed log/test, correct the test call to length(8), freeze02 and rerun. No product tests passed in that attempt. CUA inventory lists the reference/test apps running, but binding Photoshop explicitly reports the Mac locked; combined live workflow remains pending. Complete the isolated packaging-text copy before packaging; no product source edits while validation is live.

5. Focused02 runs79 tests with10 assertion failures in one new corpus test: fixtures without an embedded workingICC receive the existing encoder's default working profile, so comparing the output profile to nil was incorrect. All file/Data byte comparisons, layer/mask samples, compression boundaries and native/API save checks pass. Correct the assertion to the established default-profile policy, preserving explicit embedded-profile equality. Review also hardens AtomicFileWriter: cleanup requires successful ownership of the temporary file, and a failed/budget-exceeded physical output cannot later commit a partial file. Preserve pre-repair sources, add the failed-commit regression, freeze03 and rerun. The separate121 Release-object export baseline is terminal and preserved before Release caches change.

6. Focused03 stops at compilation: Swift requires try around the throwing nil-coalescing expression in the corrected profile assertion. Preserve this third failed attempt and pre-repair test, move try to cover the complete expression, freeze04 and rerun. The source lifecycle hardening remains unchanged. No tests are skipped or failures erased.

7. Focused04 passes79 tests with zero failures/skips (77.648 seconds) on809 frozen inputs/417 Swift source-test files. It includes24 independent-corpus file/Data output comparisons, all3 compression methods across3 sample depths and row/chunk boundaries, file transaction failure/cancellation/ownership, staged-file cleanup and existing desktop/API/job workflows. Review confirms no menu, AI, IAP or file/canvas/API limit changes. Start serial full Debug, full Release and universal packaging with freeze04; preserve distinct export directories and verify canonical/isolated hashes before each phase. No source/test changes while validation runs.

8. Full Debug01 passes1,092 tests with zero failures/skips (237.790 seconds). The unchanged-source driver continues optimized Release qualification and universal packaging. Prepare current Intel file/Data output checks and independent current Release exports plus three-way121 Data/122 Data/122 file memory/output comparisons. Retain the SDK and zlib reference provenance, explicit cache/tile/archive limits and unchanged installed117 package; live UI remains unavailable.

9. Final full Debug passes1,092 tests (237.79 seconds), final Release passes1,092 (48.09 seconds), zero failures/skips; build01 and package postflight pass on unchanged freeze04. Clean ZIP has arm64/x86_64 macOS14 deployment, strict signature, correct icon/licenses/links/types and no test fixtures. Current x86_64 engine objects under Rosetta perform63 PSB and10 group file/Data output comparisons; all655,360 group merged reference bytes remain exact. This does not qualify physical Intel/macOS14 full-app behavior.

10. Independently parse nine current Release PSB exports: all1,092 original layer/mask bytes and saved-path wide framing pass, and all nine complete outputs match121 hashes. Separate arm64 old121 Data/new122 Data/new122 file processes also produce identical complete raw and ZIP-prediction output hashes for the four-layer1024×1024 RGB32 probe. Raw peak RSS changes from423,329,792 to116,768,768 bytes; reported footprint from416,859,000 to110,150,256. ZIP-prediction peak RSS changes from145,014,784 to116,932,608; footprint from138,347,168 to110,297,712. Preserve all three modes and exact observations; these are bounded procedural cases, not multi-GB or general memory/latency guarantees. File output includes fsync/atomic replacement, so timings are not an identical I/O-policy comparison.

11. Preserve Photato122-candidate.zip separately; no122 launch/install or user-document/workspace change. Update output/API/reference records, Save command evidence, phase plan and checkpoint122. Reverify809 inputs/417 Swift files, packaging texts, unchanged Xcode, installed117 and workspace hashes. D01/I02, full external-file coordination/crash durability and the master goal remain open. Inspect Surface's in-memory COW tiles, EditorSession snapshot trimming and NativeArchive's binary PropertyList buffer for the next scratch/tile/history/archive increment; retain source hashes and acceptance plan. Finish history refresh/check using the checkpoint's audit paths, then write final verification in the excluded audit directory. No Git mutation, directory rename, unrelated StoreKit rerun or new API route.

1. Classify120 as substantive verified progress and revalidate all800 frozen inputs plus its durable universal candidate. No validation process remains live from120. Continue the authorized major D01/I02 phase; preserve the120/119/118 isolated candidates and installed117 package. The prior Mac lock does not block safe file-engine implementation. New evidence run: [local evidence archive].

2. Inspect PSDReader/row readers, RasterIO URL/Data entry points, DocumentIO, native controller and persistence readers. URL imports still load the complete input Data before bounded row decoding. Plan a single owned regular-file descriptor, checked64bit offsets, bounded64KiB read windows/eight-page cache, partial-read/cancellation handling and identity/size/mtime/ctime validation. Memory-backed API resources and file-backed native opens will use the same parser. Retained metadata and editable tiles retain existing budgets; do not advertise full multi-GB editing or raise512MiB/32768dimension/36MP limits before output/scratch/archive support is ready. Add exact file/Data corpus comparisons, sparse64bit-offset and invalid/mutated-file tests, API capability/desktop equivalence and a memory comparison.

3. Add PSDFileSource/PSDByteStorage and checked file-backed reader views. File input owns a regular descriptor opened nonblocking (rejecting pipes/devices), reads at most64KiB per system call, keeps at most eight cached pages, and validates descriptor/path identity plus size/timestamps before publishing. Share the existing parser/row decoder with Data inputs; retain metadata intentionally, check cancellation and preserve source format sniffing. Wire RasterIO URL/native DocumentIO Open/Revert and additive API capabilities. Add seven file/corpus/mutation/cancellation/cache/64bit-offset tests; expand actual desktop/Photato/both-job equality checks and keep the sn2P unsupported guard. The sparse4GiB test exercises only internal offsets and still requires the public512MiB import rejection. Freeze410 Swift files/802 inputs and isolate before focused tests; no edits while validation runs.

4. Focused01 stops during compilation: the SDK's qualified Darwin.stat resolves to the C struct rather than the pathname function. Preserve the log/source and use fstatat(AT_FDCWD, path, ..., 0), which follows the original path's target and is declared available since macOS10.10 in the installed Apple SDK. Verify pread/fstatat declarations in unistd.h/sys/stat.h; attempted Open Group reference fetches return403 and are not treated as read documentation. Keep descriptor fstat checks and all file identity/size/timestamp assertions intact. Re-freeze and rerun focused validation.

5. Focused02 compiles the imaging changes but stops in the app capability file because the newly centralized PSDCodec constants require an explicit PhotoCraftImaging import. Preserve that second compile attempt and the pre-repair file; add the missing module import, re-freeze, and rerun. No product test has been claimed passed from either compilation failure.

6. Focused03 passes72 tests with zero failures/skips (56.584 seconds), including30 original/external file-versus-Data PSD/PSB cases, sparse64bit addressing with unchanged public limits, cached-content mutation/replacement rejection, truncation/nonregular rejection, bounded interleaved pages, cancellation and shared API/job outputs. Before the final freeze, move the file consistency check after document validation to narrow the acceptance race and add normal symlink-path coverage. These last changes will be covered by the full suites; focused03 belongs to freeze03. Freeze04 is the final candidate input for serial full Debug/Release/universal qualification.

7. Full Debug01 passes1084 tests with zero failures/skips (202.986 seconds) on the final802-input/410-Swift-file freeze04, including the added symlink assertion and final consistency-check ordering. The serial driver proceeds to full Release and universal packaging with no source edits. Prepare actual x86_64 Release-object harnesses that read all21 supported PSBs from file (also comparing Data input) and open all ten independent RGB32 group references from file before checking their merged bytes. Prepare same-current-engine Data/file memory measurements against unchanged original120 procedural probes; no general performance claim is assumed in advance.

8. The first full Release also passes1,084 tests (47.056 seconds), and build01 succeeds. Review nevertheless identifies an avoidable memory regression outside PSD/PSB: the new RasterIO fallback materialized the complete PNG/TIFF/etc. input through source.bytes, replacing the prior mapped-Data path. This conclusion comes from allocation behavior in the code, not a claimed measured PNG benchmark. Wait for driver78179 to finish, preserve the freeze04 package/source, then restore mapped-Data ImageIO fallback while retaining bounded PSD/PSB reads and final file consistency checks. No source was edited during that validation process. Freeze05 and rerun full Debug/Release/build as distinct02 attempts; first-pass green tests do not validate the final changed source.

9. Final full02 passes1,084 Debug tests (203.243 seconds); final Release02 passes1,084 tests (46.808 seconds), both zero failures/skips on freeze05. Build02 proceeds serially without source edits. The final UI check first returns cgWindowNotFound from Photoshop, then app inventory explicitly reports the Mac locked; neither observation establishes process termination. Keep combined live qualification pending and preserve the installed117 app.

10. Final build02 and package postflight pass: arm64/x86_64 macOS14 deployment, strict clean-ZIP signature, icon/licenses/notices/links, PSB registration, fixture exclusion and unchanged Xcode/menu inventory verify. Actual current x86_64 Release objects under Rosetta read21 PSBs from files, compare Data-input samples and complete63 compression roundtrips; ten file-opened Photoshop RGB32 group references retain all655,360 merged bytes exactly. This is not physical Intel/macOS14 full-app qualification. Export nine PSBs from the final already-built Release test executable in a distinct one-test run, then independently parse them in Python; all1,092 original layer/mask bytes and saved-path framing match. This avoids attributing the earlier focused03 export artifacts to the later final05 source.

11. Current121 Data/file memory probes preserve every decoded RGBA Float32 hash, also matching120. For the raw four-layer1024×1024 RGB32 probe, peak RSS is160,284,672 bytes with mapped Data versus97,239,040 with file reads. Reported peak memory footprint rises slightly (87,966,344 to89,277,112 bytes); the file path also retains cache/read buffers. ZIP peak RSS is96,141,312 versus96,550,912 and footprint88,162,928 versus88,588,960. Report these distinct metrics and single-process scope honestly; do not describe this as a universal reduction in memory footprint, a latency guarantee or multi-GB qualification. Preserve original input hashes, current object hashes and all four process observations.

12. Preserve the final Photato121-candidate.zip separately; installed117 remains unchanged and121 has not launched. Update checkpoint121, current status/plan, File Open evidence, both API records, PSB/row/file manifests and next-major plan. Reverify802 inputs/410 Swift files, package text, Xcode, installed117 and workspace hashes. The old118 disposable process59596 remains alive at the latest process observation; its window and cleanup still await unlocked UI. Full02, Release02, build02, both Intel harnesses, memory and final export/parser processes are terminal0. D01/I02, complete external-file coordination, streamed output/scratch/archive storage and the full master goal remain open. Finish the development-history audit.

13. History refresh/check passes with121 milestones,30,470 evidence files,18,008 logs and zero missing explicit references. Add final audit paths to checkpoint121 and refresh/check after this final record update. Verify source/package inputs once more under the audit-excluded output directory. No goal closure, live-pass claim, package installation, directory rename, Git mutation or new external API route is implied by this increment.

1. Revalidate the active119 checkpoint and inspect the major D01/I02 memory dependency. PSDReader currently copies nested layer sections; PSDChannelCodec allocates complete compressed/decompressed channels, and PSDCodec retains all layer planes plus the complete unused merged preview. Surface already has conservative512MiB decoded budgets,32768 dimension/36MP limits; raising these numbers without a scratch/streaming architecture is rejected. Continue the authorized major phase, preserving119's isolated candidate and installed117 package. Live UI remains pending Mac unlock; no source or package claim depends on unavailable interaction.

2. Plan bounded shared-data reader views, incremental macOS zlib decoding and row-based layer/mask/merged loading through the same native engine used by desktop and both APIs. Retain exact size/checksum/trailing-data rejection and existing input/output/tile limits. Add independent compression-vector and corrupted/truncated-stream regressions, API capability metadata and a before/after memory experiment. Full multi-gigabyte input/output, disk-backed tiles and the I02 major gate remain open. Evidence run: [local evidence archive].

3. Implement shared-data PSDReader views with checked relative bounds,64KiB incremental ZIP input and row-wise raw/RLE/prediction decoding. Nested Lr16/Lr32, channels and RLE tables no longer materialize entire section copies. Layer RGB/alpha and masks consume rows; flattened planar inputs write into their final tiles; unused rich-layer/merged caches still fully validate. Add five independent-vector/boundary/corruption tests plus API capability and failed-import state checks. Six new Python vectors cross64KiB compressed boundaries, including80KiB float rows. Freeze and isolate source before focused validation; capture a119-object memory baseline before shared build caches change. App inventory now responds (UI access may have returned); defer current-candidate interaction until validation passes.

4. Focused01 stops during test compilation: existing independent golden parsers use PSDReader(data:offset:), which the new explicit initializer unintentionally removed. Preserve failed log/source, restore that internal convenience initializer and safely reject invalid offsets without overflow; add negative/extreme-offset checks. No tests were skipped to work around the failure. The refreshed app inventory was insufficient evidence of unlocked UI: binding the prior disposable app again reports the Mac locked. Live qualification stays pending.

5. Focused02 compiles and runs61 tests:60 pass, one fails because the experiment driver did not create the optional PSB export directory. All five new reader tests, shared API bad-cache rejection and both job interfaces pass. Preserve the harness failure; create the export directory in the next driver. Code review also finds that permitted long PackBits/no-op and section padding could still be copied wholesale; replace those tail checks with bounded in-place scanning and add a200,000-byte padding regression. Read the official zlib manual (https://zlib.net/manual.html): continue until Z_STREAM_END, preserve unconsumed input, and verify final checksums; the implementation's progress/end/size guards follow this contract. Six original Python vectors remain conformance references, not live Photoshop parity.

6. Focused03 passes65 tests with zero failures/skips on800 frozen inputs/408 Swift source-test files, including all six new streaming tests, independent PSD/PSB samples, RGB32 hierarchy references and desktop/HTTP transfers/jobs. Preserve the earlier compilation and output-directory failures separately. Start serial full Debug, full Release and universal packaging using freeze03; verify both canonical and isolated input hashes before each phase. Packaging text is frozen separately. No source/test edits during qualification.

7. Full Debug01 passes1077 tests with zero failures/skips (185.991 seconds); the unchanged-source serial driver begins optimized Release qualification. The independent Python PSB parser verifies12 input fixtures and nine current Swift exports, preserving all1,092 original layer/mask bytes and saved-path framing. Source review records exactly six changed/new Swift files and17 changed validation inputs; file/canvas/API limits and Photoshop menus/shortcuts remain unchanged. No source edits while tests/builds run.

8. Full optimized Release01 passes1077 tests with zero failures/skips (46.410 seconds); universal packaging follows from the unchanged800 inputs. Existing native-build-system/RasterDecodeBudget Sendable warnings remain in the logs. The planned postflight verifies clean ZIP/signature, both macOS14 architectures, current Intel PSB/group conformance and one-process memory comparisons against preserved119 engine objects. Live UI remains unavailable; project/build retains117 and no current release installation is claimed.

9. Universal build01 and postflight pass: both arm64/x86_64 declare macOS14; clean-ZIP strict signing, icon/notices/licenses/links, PSB registration, fixture exclusion and unchanged Xcode/menu inventories verify. Current x86_64 Release engine objects under Rosetta pass21 PSB inputs/63 compression roundtrips and all ten RGB32 hierarchy references. These are engine checks, not physical Intel/macOS14 full-app qualification. Preserve Photato120-candidate.zip in this run; installed117 app/ZIP remain unchanged.

10. The separate119/120 Release-object memory processes produce identical per-layer SHA256 hashes for all decoded RGBA Float32 bytes in both four-layer1024×1024 probes (64MiB of editable tiles each). Peak memory footprint falls from264,454,960 to87,917,192 bytes for raw layers (66.76%) and122,438,328 to88,162,952 bytes for ZIP layers (27.99%). These are single-process procedural cases, not a general benchmark or multi-gigabyte qualification. Preserve both raw observations, input/source/object hashes and the comparison report. Decoder times are recorded but no latency guarantee is inferred.

11. Final UI recheck returns cgWindowNotFound for the old118 binding, then the Photoshop binding explicitly reports the Mac locked. PID59596 still runs the old disposable118 app; do not claim it exited or alter user documents/workspace. The120 app has not been launched. Record the combined118/119/120 live plan and remaining I02 file-backed input, streamed output, scratch/tile/history/archive dependencies. Update checkpoint120, status/plan, File Open evidence, both API records and PSB/row-decoder manifests; leave major D01/I02 and the full goal open. All tests/builds/postflight processes are terminal0,800 inputs/408 Swift files reverify, installed117/Xcode/workspace hashes are unchanged. Finish history refresh/check.

12. The first history refresh stops because the new120 anchor had not yet been added to the oldest-first navigation table. Preserve refresh01.log, add the missing table entry and rerun the audit without changing application/test sources. This is a documentation-index failure, not a failed product test. The exact failed and repaired attempts remain separate.

13. Repaired history refresh/check passes with120 milestones,30,303 evidence files,17,982 logs and zero missing explicit references. Record the final audit paths in checkpoint120, then refresh/check once more after this documentation update. Final source/package verification is written under the audit-excluded directory to avoid changing the indexed evidence afterward. The increment is verified automated progress; live interaction and the full master goal remain open.

1. Classify the preceding turn as verified progress:118 source/package/Rosetta qualification, controlled clipping probes and history audit are preserved, but native live checks remain pending. Revalidate all749 frozen118 inputs. The existing UI binding again reports a locked Mac; do not bypass or treat unavailable UI as passed. Continue independent major D01 work on I02 PSB import/save/API instead of blocking the entire goal. Preserve the exact118 isolated candidate and installed117 app; later source changes belong to119 and cannot be claimed tested by118. Evidence run: [local evidence archive].

2. Inspect PSDCodec/PSDChannelCodec, DocumentIO, native save policy/controller, API transfers/job adapter and installed Photoshop type declarations. PSB currently rejects at the version header and RasterIO extension. Read Adobe's public PSD/PSB specification: version2 widens section/channel lengths and RLE row tables, while only enumerated tagged blocks use64bit lengths. The installed Photoshop app declares com.adobe.photoshop-large-image and application/x-photoshop. Plan shared native codec support, correct content-based source identity, Open/Save/Copy and API format discovery/operations; retain Adobe's published output MIME contract rather than invent a PSB output option. Add independent Python-authored binary fixtures, malformed-length tests, all-depth/compression roundtrips and native/API lifecycle coverage. Current dimension/memory budgets and missing large-file streaming remain explicit I02 acceptance gaps; this increment must not close I02 or D01 merely by reading small PSBs.

3. Add PSDFileFormat and checked unsigned length conversion; thread version-specific section/channel/RLE/tag widths through the shared reader/writer, accepting both documented tag signatures. Include the eight additional wide keys recorded in the original Rust parser (notably pths/cinf); keep unsupported rich-content guards and memory budgets. Add PSB native format/type registration, content-sniffed save-back (including misleading extensions), save/copy policy and source-review behavior. Existing API format enums automatically include psb; add explicit container/limit capabilities and test PSB input through both actual job routes while preserving Adobe's PSD output contract. No new command or endpoint is invented.

4. Generate12 original Python-authored PSB fixtures covering RGB8/16/32 and raw/RLE/ZIP/prediction, nested group records, a mask, Unicode names,8B64 signatures and wide cinf blocks. These are independent binary-conformance inputs, not Photoshop rendering or live-save evidence. Add exact sample/mask checks, saved-path/archive roundtrips, beyond-PSD dimensions, malformed/truncated64bit lengths and RLE rows exceeding65535 bytes. Extend native source-identity/save tests and HTTP import/download/save/both-job coverage. A drafted test used non-existent geometry type names; inspection corrects them to PathKnot/PathPoint before compilation. Format edited Swift files and validate Info.plist. Freeze406 Swift source/test files /765 validation inputs and create an identical isolated workspace before focused tests. The118 candidate remains intact; no edits while validation runs.

5. Focused01 compiles and runs73 tests with6 assertions failing (18.399 seconds). All five new imaging tests pass, as do native PSB upload/download and Save As/Save. The two job failures expose a separate version1-only header guard in AdobeActionAssets, before shared decoding; accept versions1/2 while preserving depth/colour/resource guards. Four copy-accessory assertions still encode the old five-format menu/index; update the expected Large Document Format entry and select JPEG by its title. Preserve failed logs/freeze and the three pre-repair files. Independently parse all12 procedural inputs and nine Swift-exported PSBs in Python: all1,092 original layer/mask bytes are exact and64bit saved-path tags parse correctly. This is container/sample conformance, not live Photoshop parity. Re-freeze and rerun focused validation after the repair.

6. Focused02 passes73 tests with zero failures/skips (18.108 seconds), including both actual HTTP job routes with original PSB inputs and native/API persistence. The public GitHub page fetch fails, so use the repository's HTTPS API/raw source to pin psd-tools commit b1b454baa5fdc4d72e26b9b4bd29b2e8ad1fb93b. Download ten unmodified PSD/PSB pairs with MIT license and per-file hashes (1,558,656 bytes including license); do not assert an unknown Photoshop capture version/date. External-corpus01 exposes test assumptions that group/hidden fixtures only contain rasters (they also contain supported fills), and an existing unsupported sn2P rich-content guard. Preserve the failed test/log. Correct the content comparison and add per-case failure context so all ten cases are inspected before deciding what remains unsupported. No unsupported metadata is silently discarded to force a passing test.

7. External-corpus02 identifies nine accepted PSD/PSB pairs with matching decoded samples, profile, hierarchy and native roundtrip composite. The remaining semi-transparent-layers pair contains sn2P data that the existing PSD reader already rejects. Preserve both original files and both failed corpus attempts; add a distinct regression requiring explicit unsupported-content rejection in both containers. Do not count that pair as supported or remove its original-content guard. Re-freeze787 inputs /406 Swift source-test files and run the final focused suite with nine external positive pairs and the explicit negative pair alongside all prior native/API/imaging checks. Large-file streaming and full rich-content support remain open.

8. Focused03 passes75 tests with zero failures/skips (36.343 seconds). The separate Python parser also passes against the final nine focused PSB exports, preserving all1,092 original layer/mask bytes. Run serial full Debug, full Release and universal packaging against freeze04 (787 inputs/406 Swift files); the driver rechecks canonical and isolated copies before each phase. Add explicit distribution attribution for PSB framing and pinned MIT test fixtures; these packaging-only text inputs are separately hashed before build and never masquerade as source-test coverage. No source/test edits during validation. PSB full native/Photoshop live checks and pending118 hierarchy UI remain awaiting the unlocked Mac.

9. Full01 passes1,071 Debug tests with zero failures/skips (180.782 seconds) on the787 frozen inputs; optimized qualification continues in the same serial driver. The updated README distinguishes implemented bounded PSB framing from unfinished streaming/large-file workflows; freeze those packaging text files separately as packaging-documents02.json before build. Rechecking the old118 UI binding first returns cgWindowNotFound; app-inventory refresh again reports the Mac locked. That does not prove the app exited, and no relaunch/cleanup/live-pass claim is made. Continue automated qualification without changing source/tests.

10. Full optimized Release01 also passes1,071 tests with zero failures/skips (45.653 seconds; Debug180.782 seconds). The serial driver starts universal arm64/x86_64 packaging from the unchanged787 validation inputs. Existing measured vector/pattern/other Photoshop differences remain reported by their tests and are not converted into parity claims by a green regression suite. No StoreKit production changes or purchases occurred. Prepare a post-build x86_64 conformance harness against the actual Release engine objects; it will inspect12 procedural and9 accepted external PSBs under Rosetta and separately require the sn2P case to reject. Do not execute it against stale pre-build objects.

11. Universal build01 and final package verification pass. Both architectures declare macOS14; strict clean-ZIP signing, actual PSB document-type registration, bundled attribution/licenses/icon/links, absence of PSD/PSB test fixtures and unchanged Xcode/menu inventory verify. Binary fdeb29b3221c0959af88c2499f991df8572400643ec0d0a6daeaecafa90359d2 and ZIP4c043f6c7deb0f9baa67f0a5b1e8a50633573daa12da23945d6d9eb9df1e46f0 identify the0.2.0/build2 candidate. Preserve a durable candidate ZIP inside this run; project/build remains the previously live-qualified117 package until combined native qualification. No Sources/Tests changes occurred during or after final tests/build.

12. Compile/run the PSB conformance harness against the actual x86_64 Release Core/Imaging objects: both exit0. Under Rosetta,12 procedural and9 external PSBs complete63 compression roundtrips with31,765,088 decoded source-plane bytes compared per pass; the sn2P case explicitly rejects. A separate current-object harness also matches all655,360 merged RGBA bytes across the ten118 Photoshop group references. This verifies the latest compiled codec/engine on x86_64 under Rosetta, not physical Intel/macOS14 app behavior. Both processes are terminal. Recheck all787 validation inputs/406 Swift files, original118 probe/workspace and installed117 hashes unchanged. The old118 disposable app process59596 still exists; locked UI prevents window/cleanup verification. Do not claim it exited or label any119 native live workflow passed.

13. Update current status/plan, four partial File rows, API documentation/compatibility, PSB provenance/limits and docs/ACTIVE_CHECKPOINT_119.json. Keep D01/I02 and the full master goal open. The latest combined native check should use the119 candidate for grouped PSD and PSB/native saves; preserve118 evidence without retroactively claiming its UI sequence passed. Pending UI does not prevent safe independent major implementation. Preserve all failed focused/corpus attempts and explicit unsupported cases. Finish history refresh/check after recording this state.

14. History refresh/check passes with119 milestones,30,195 evidence files,17,960 logs and zero missing explicit references. Bind the adapted Rust tagged-length rules to their source hash and preserve the exact public-corpus/type-declaration provenance. Record audit results and the final verification paths in checkpoint119, then refresh/check after this last record update. Both full test suites, universal build and Intel harnesses are terminal; only native/Photoshop interaction remains unavailable while locked. This turn is concrete implementation and verified progress, not an impasse or a goal-completion claim.

1. Classify117 as verified progress and revalidate all723 frozen inputs/402 Swift source-test files, installed universal binary/ZIP and Xcode project against checkpoint117. Continue major D01. Read the general GroupRenderer: isolated/group/clipping paths still differ from the measured root Normal path, including encoded temporary samples. Build independent procedural group/clipping PSDs, using retained original sample planes, before changing algorithms. Preserve native source and previous release until evidence identifies the next correction. New evidence run: [local evidence archive].

2. Create eight independent64×64 PSD32 inputs from retained procedural sample planes: full/partial Pass Through, full/partial masked isolated groups, clipping with Blend Clipped Layers as Group on/off, nested Pass Through and opaque-backdrop partial Pass Through. Python writes Adobe-documented Lr32/group-divider/clipping records; no Swift output is used as an oracle. Photoshop opens the expected editable hierarchy. Recalculation uses Hide/Show then Save. Early capture guards stop on asynchronous open and Saving states; observe completion before continuing, without restarting work. Independent preservation initially flags a raw group blend-key change: Photoshop places Pass Through in the section-divider override and normalizes the ordinary record to Normal. Preserve that failure, inspect the correct effective field, and verify all original planes/masks/opacity/visibility/clipping/group structure. The first five unchanged117 engine exports differ from Photoshop in9707/9103/9727/5825/9229 merged bytes; these are baseline failures, not successful parity.

3. All eight Photoshop references now preserve original layer/mask samples and effective hierarchy/opacity/visibility/clipping exactly. Full Pass Through and nested Pass Through match the prior flat-stack golden. Candidate arithmetic matches full isolated groups, default raster clipping, alpha-bearing Pass Through opacity, opaque-backdrop Pass Through opacity and masked isolated opacity. Group opacity/masks mix the fully rendered before/after state; alpha uses a different fused operation from ordinary layer-over. The opaque RGB path uses weighted interpolation rather than delta interpolation. Preserve all rejected candidates. Independent clipping blending remains different (including1863 alpha samples, max1.79e-7); keep its fixture and general path open. Implement a native linear hierarchy evaluator and shared Normal blend kernel, retaining the existing group memory budget and excluding unqualified operations. Add independent PSD/straight-layer/regional/empty-hidden-group regressions and desktop/download/both-job golden coverage; expose normalHierarchyComposition capability. Begin focused validation; no Sources/Tests changes while it runs.

4. Focused01 passes48 tests with zero failures/skips (15.312 seconds): seven group/clipping Photoshop goldens, all three PSD compression choices, original layer/mask/hierarchy preservation, regional equivalence, hidden/empty groups and five desktop/download/both-job cases. Add three discriminating probes before full qualification:213/255 group opacity, nested isolated/Pass Through groups with outer mask, and an isolated first group with fully transparent samples. The generator initially pads global Lr32 to two bytes rather than four; varied name lengths expose the container error. Preserve failed input/script, fix only global-block alignment and independently verify the new inputs. A closed Finder binding rejects a later action; rebind before reopening the disposable capture window.

5. Additional reference capture/preservation succeeds, but Focused02 runs13 tests with9 assertions failing:213-opacity, nested masked and isolated-first-group golden outputs each fail under all three PSD compression modes. The213 probe distinguishes canonical division from reciprocal multiplication for alpha-bearing group opacity: the latter matches all16,384 samples exactly in the independent candidate. Preserve the failed source and logs, then expand group opacity by the same opaque/alpha-bearing rule as ordinary layers. Add all three new probes to the desktop/download/both-job equivalence test. A small analysis-helper slicing error fails before evaluation; its corrected delimiter and successful arithmetic comparison are preserved. A guarded text edit also stops before mutation when formatting differs; inspect the fresh source and apply the intended edit. No tolerance or reference bytes are relaxed.

6. Focused03 passes13 tests with zero failures/skips (11.942 seconds), including all ten supported group references /40,960 pixels /655,360 normalized merged RGBA bytes and expanded desktop/download/both-job cases. Every original plane/mask/effective group/clipping property remains exact. Freeze404 Swift source/test files and749 validation inputs, including the pinned Adobe contract used by tests. Copy an identical temporary validation workspace and start serial full Debug, full optimized Release and universal packaging. Sources/Tests remain untouched throughout. The installed step117 package is retained until final qualification.

7. Full01 executes1,062 tests with one assertion failure (163.149 seconds), so Release/build phases do not start. All independent group references and APIs pass. The older PSDLinearStorage test equates an opaque duplicate clipping composite with raw source bits. A standalone harness linked against the actual Debug engine isolates exactly one pixel: three negative-zero RGB values become positive zero during fused blending; every numeric value is unchanged. Preserve the full failed source/test snapshot, diagnostic and log. Correct the test contract: require unchanged numeric composed values and exact original signed-zero bits in both saved straight layers, retaining exact group/regional checks and independent Photoshop merged-byte tests. No renderer tolerance or output oracle is changed. Re-run affected tests before a new full frozen qualification.

8. Focused04 passes25 tests with zero failures/skips (15.613 seconds), retaining all independent group/flat references and both APIs. Re-freeze749 validation inputs /404 Swift source-test files as tested-source-hashes02.json and repeat full Debug, Release and universal build serially in the identical workspace. The failed full01 snapshot/log remain immutable. Review the future live-output verifier before execution and correct a mechanical filename/layer-name variable collision; its syntax check passes. No source/test changes during the new validation.

9. While the frozen full02 suite runs, retain additional independent-clipping alpha candidates: direct/factored opacity, complementary weights, three-term generic blending and post-opacity mixes still leave nonzero differences. These are read-only experiments against fixture06, not renderer changes or qualification. Next distinguish the generic clipping path with controlled no-clip/full-opacity/alpha-grid references before changing it. Full02 remains the only current validation process; no duplicate/restarted test run.

10. Full02 passes1,062 Debug tests with zero failures/skips in163.182 seconds on the749 frozen inputs. Full optimized qualification is running against the same snapshot; source/tests remain unchanged. The test contract correction is supported by the preserved signed-zero diagnostic and exact saved-layer/Photoshop merged-byte evidence, not a relaxed output tolerance.

11. Release02 also passes1,062 tests with zero failures/skips (45.014 seconds); Debug163.182 seconds. Universal arm64/x86_64 packaging is building from the same749 frozen inputs. Existing RasterDecodeBudget Sendable/native-build-system warnings remain visible in the immutable logs. No production StoreKit, menu/shortcut mapping or endpoint/command count changes in this increment.

12. Universal build02 completes successfully. verify-package01.py verifies the clean ZIP, strict ad-hoc signature, both arm64/x86_64 macOS14 deployment targets, bundled attribution/icons/links, no test fixtures, and unchanged Xcode/menu inventory. Binary SHA256 dacdfbeedd049a6c25cfa761649033f26cd81afb61be0556c77063534b4bfe6c; ZIP2668ab065de61286d3065b79c543f86d73ecdd455012b2b2eb68baae7c27e999. verify-intel01.py compiles against the actual x86_64 Release engine objects and runs under Rosetta: all ten group references /655,360 merged RGBA bytes match exactly and original straight layers/masks remain unchanged. This does not establish physical Intel or macOS14 full-application runtime parity. Both validation sessions have exited0; no source/test edits followed the freeze.

13. Prepare a separate live Release identity local.photocraft.swift.ui118 and the original nested masked RGB32 reference. Preserve production/pre-resign and test/post-resign binary hashes, probe and workspace hashes in ui-release.json. The app launches with an Untitled-1 window, but the subsequent native Open action is rejected because the Mac is locked and automatic unlock failed. Ask the user to unlock; do not bypass the lock or claim this live sequence passed. Save/reopen, Photoshop output-open and UI cleanup remain pending. Keep the verified step117 project app/ZIP installed while completing independent records and the next controlled reference plan. Sources/tests remain frozen.

14. While native UI is unavailable, prepare ten original controlled clipping inputs: no clipped layer with the flag on/off, full-opacity base on/off, and Cartesian backdrop/base alpha with clipped alpha0/0.5/1 on/off. prepare-clipping-controls01.py writes them outside Sources/Tests; independent container parsing verifies every source plane and property. These are pending inputs, not Photoshop reference results. Preserve their hashes and capture copies in pending-clipping-controls01.json for the next D01 investigation. Revalidate all749 frozen inputs /404 Swift files, installed117 binary/ZIP, Xcode project, original118 probe and workspace bytes. Record the explicit pending live sequence and current package distinction in docs/ACTIVE_CHECKPOINT_118.json; latest fully live-qualified increment remains117. No major gate closes, no minor phase starts, and the master goal is not paused.

15. Pending-UI history refresh/check passes:118 milestones,30,100 evidence files,17,944 logs and zero missing explicit references. Save these results in checkpoint118 and refresh/check again after this final record update. No native118 live workflow or installation success is claimed; the Mac unlock request remains pending. All completed test/build/Intel processes are terminal, original probe/workspace bytes and the installed117 package remain verified unchanged. Continue from the exact pending sequence without restarting successful validation.

1. Classify step116 as verified progress. Revalidate all400 Swift source/test hashes, universal ZIP/binary and Xcode project against checkpoint116. AGENTS/CONTRIBUTING match the prior inspected snapshot. Preserve the baseline and all prior reference arithmetic experiments in a new immutable117 run. Continue D01: distinguish straight layer samples, canvas rendering and PSD merged white-matte output. The116 live output retains exact28672 layer bytes/ICC but has1495 merged-cache byte differences; the independent masked96×64 candidate matches18432 RGB samples. Expand original Photoshop reference coverage before editing kernels. The project remains in its externally renamed “-” directory; no rename, Git action, or source edit while validation is running.

2. Read Adobe's published PSD container specification for Lr32, channel/mask records and merged transparency. Build five independent16×16 procedural PSD inputs in Python: opaque samples, single-layer varying alpha, opaque base, translucent base, and offset mask with171/255 layer opacity. Include finite negative/subnormal/above-one HDR values and signed zero. Reuse the already identified linear-sRGB ICC and HDR-toning header, without a Swift exporter or colour conversion. Independently reparse every input layer sample. Photoshop opens01 successfully; Hide Layers/Show Layers forces recalculation, then Save produces a clean reference. Initial analysis assumes four merged planes and fails; Photoshop saves three for this opaque image. Correct the analyzer to read actual plane count. All layer samples remain identical, while432/768 merged RGB samples change; the white-distance candidate matches all768 exactly, including the HDR/signed-zero cases. Preserve failures, scripts, hashes and UI observations; no application code changed yet.
3. Complete Photoshop Hide/Show/Save captures for all five procedural fixtures. Independently verify every raw layer/mask plane, bounds and opacity unchanged. Single-layer opaque and varying-alpha merged references match the separate Float32 white-distance operations exactly; fusing the matte multiplication/subtraction differs on36 samples. Preserve the initial three-plane analysis failure. The03 saved AX snapshot shows an intermediate “Saving0%”; subsequent completed PSD parsing/hashing, rather than that snapshot alone, establishes a complete reference. All disposable documents are closed; original dirty Untitled-1 remains. Two screenshot previews were visually inspected. Photoshop's current Finder context is Downloads after cleanup.

4. Compare90 arithmetic candidates per two-layer reference. Fused delta interpolation with mask-before-opacity matches the masked fixture's768 RGB/256 alpha samples exactly, but a source-alpha-one shortcut leaves7 RGB differences in each unmasked fixture. Expand evidence before adopting a renderer kernel: test removal of that shortcut and generate independent Cartesian/random alpha and multilayer probes to distinguish alpha accumulation order. Both current and rejected candidates remain preserved in the117 run. Application sources/tests remain unchanged.

5. Broaden independent Photoshop captures to64×64 Cartesian alpha pairs, seeded random masks and three-layer HDR stacks. All disposable references are saved and closed. Photoshop crops case06's all-transparent first source column; coordinate-aware verification proves every retained layer sample unchanged. Other broad probes retain every layer/mask plane and opacity byte. Candidate06 matches every merged RGB/alpha sample with true Float32 FMA, separate matte rounding, clamped interpolation ratio, initial hidden base RGB, and reciprocal-multiplied PSD opacity. Earlier double-based FMA simulation missed a tie; direct fmaf resolves it. The three-layer fixture distinguishes reciprocal opacity multiplication and fused alpha accumulation. Preserve all rejected arithmetic candidates. Add eight original Photoshop PSDs and independently extracted normalized RGBA golden planes with provenance to imaging tests; a three-plane opaque source gets an explicitly implied alpha-one plane. Add regression tests before implementation. No new API route is proposed: this renderer repair must also qualify existing desktop, download and both action-job outputs.

6. Baseline-focused01 fails before tests: the externally renamed project retains a Clang module cache compiled at its former path. Preserve the compiler log and create a fresh identical temporary validation workspace instead of deleting prior evidence or moving the user's project. Continue with baseline-focused02 there.

7. Baseline-focused02 executes3 tests with25 expected assertions failing (0 unexpected): all eight merged references plus reciprocal opacity expose the prior behavior; regional recomposition already passes. Implement a bounded root/untransformed/Normal raster-stack path with fused interpolation/alpha, initial straight hidden RGB, ratio clamping and mask-before-opacity. Preserve the general renderer for complex stacks. RGB32 PSD opacity now uses the measured reciprocal expansion; PSD merged matting separately rounds distance from white even when opaque. Remove the old implementation-derived “opaque merged equals layer bits” expectation; independent Photoshop goldens now govern merged output while original straight-layer preservation stays tested. Add explicit finite-overflow rejection and desktop/download/both-job golden output coverage. Update exposed precision capabilities without adding routes or changing request/result schemas.

8. Focused03 runs21 tests with14 assertions failing. Unmasked references and reciprocal opacity pass; masked cases expose a second defect: the shared MaskSampler applies 1-(1-v) even at100% density, changing Float32 mask bits. Make full density an exact identity; other density behavior remains unchanged. The overflow test also incorrectly supplied a linear extreme through Surface's encoded fill initializer, which normalized it before rendering; correct the test to set literal linear samples. Preserve both failure evidence and the repair; no kernel tolerance or golden-output changes.

9. Focused04 passes156 tests with zero failures/skips, including all eight independent RGB32 goldens, both HTTP job outputs, document download, straight-layer preservation, overflow, regional/incremental composition and wider mask regressions. Add the unchanged prior96×64 offset-layer/mask Photoshop reference as a ninth fixture to qualify the original defect as well. Ignore invisible root leaf layers when choosing the Normal raster path; a hidden fill must not switch algorithms or change visible pixels. Extend the existing regional regression to cover this. Freeze the final candidate before full Debug/Release validation and universal packaging.

10. Freeze402 Swift source/test files and721 total validation inputs (fixtures, build configuration, assets and scripts included) in tested-source-hashes01.json. Run the full Debug suite, full optimized suite and universal build serially in the identical temporary workspace; the validation driver rechecks both source trees before every phase and preserves generated evidence separately. Application Sources/Tests remain untouched throughout. Review API documentation: correct two stale working-profile/archive statements and include the already-exposed profile-limit fields in the capability schema. No new credential, network exposure, command count or Adobe endpoint is introduced.

11. Full01 runs1058 tests and fails7 assertions: case09 golden extraction omitted its implied alpha plane, and the hidden-layer test changed document topology before expecting a regional update. Correct those test setup defects while preserving the failed source/fixture snapshot. Its438 remaining merged RGB byte differences also expose a genuine opaque-base arithmetic path: Photoshop omits alpha accumulation/division for a fully opaque canvas base. Generate/capture a tenth64×64 random-mask/213-opacity Photoshop reference; it distinguishes opaque opacity division from alpha-bearing reciprocal multiplication. Candidate07 (reciprocal) fails2094 RGB samples there; candidate08 (division) matches all12288, and both match the old18432-sample reference. Keep model/PSD-read opacity canonical and specialize only renderer evaluation. Determine opaque-base status over the entire canvas for consistent regional updates. All original layer/mask samples remain unchanged in the new reference.

12. The Photoshop Open chooser leaves the known fixture's Open button disabled, even with All Documents selected. Restore its original All Readable Documents filter, cancel and use Finder's exposed Open Finder item action successfully. A refreshed UI binding invalidates the older capture helper's guard; perform the guarded Hide/Show/Save steps directly. Preserve observations. Close the disposable PSD and capture window; Photoshop returns to the untouched dirty Untitled-1 and Finder to the existing Documents window.

13. Focused05 passes156 tests with zero failures/skips, now including10 independent Photoshop reference images /23808 pixels /380928 normalized merged RGBA bytes under all three layer-compression settings. Straight layer/mask/opacity preservation, native archive immutability, both job interfaces/download and regional/incremental behavior pass. Freeze the corrected candidate as tested-source-hashes02.json and repeat full Debug/Release/universal qualification. PSD model opacity uses canonical byte division; the differing expansion is contained in rendering. Do not infer full-file or complex-layer equivalence.

14. Full02 passes1058 Debug tests with zero failures/skips on the final frozen inputs. The normal-stack goldens include both opaque and alpha-bearing paths, original offset-mask defect, all layer compression options, unchanged straight layers and API/document state. Existing grouped/vector tolerance-based checks retain their historical measured differences and do not become exact-parity claims. Full optimized qualification and universal packaging continue without source/test edits.

15. Repair the canonical root's stale pre-rename compiler cache reversibly: move only .build/module-cache to .build/module-cache-before-root-rename-20261019-step117 and create a fresh cache. swift package --disable-sandbox --cache-path <root>/.build/pm-cache dump-package exits0; preserve stdout/stderr and the cache-move manifest. No project folder, source, user file or Git state is renamed. The full qualification continues independently in the isolated workspace.

16. Full optimized Release02 also passes 1,058 tests with zero failures/skips (43.613 seconds; Debug156.154 seconds). python3 [local evidence archive] runs ./scripts/test.sh, ./scripts/test.sh -c release and ./scripts/build-app.sh serially in the identical isolated workspace, checking the723 frozen inputs before each phase. Universal arm64/x86_64 macOS14 packaging succeeds. Existing RasterDecodeBudget Sendable and native-build-system deprecation warnings are retained; no new error. verify-package01.py verifies clean ZIP signature, both deployment targets, icons/licenses/notices/links, absence of test fixtures, unchanged Xcode project and menu inventory. Version0.2.0/build2 remains; binary d0212ea04375d43d86ec97daf7afa8bf88f8273bd5c06a52df21085e0b5ee631 and ZIP f094c64619722fda44d35dcd97c0fd3316fcb276eedc7e84ab8fb67db426f612 bind this increment. StoreKit production code is unchanged; step116 local StoreKit results remain historical, not rerun here.

17. python3 [local evidence archive] compiles an optimized harness against the actual x86_64 Release Core/Imaging objects, then executes via /usr/bin/arch -x86_64. Compile/run exit0; all ten Photoshop references /380,928 normalized merged bytes and straight layer/mask preservation pass. Preserve exact compiler/run arguments and both logs. This is Rosetta numerical qualification on the present host, not a physical Intel or macOS14 full-application check.

18. Launch a copy of the final universal Release under disposable identity local.photocraft.swift.ui117. Record identical pre-resign production binary and separately hashed re-signed test binary. Native Open attempts expose disabled Open, confusing GoTo key routing, a paste timeout and one stale offscreen AX index; the exposed Open Finder item action succeeds. An initial Save As click/Command-A/typing sequence dismisses the sheet and sends input to the disposable canvas. Preserve the intermediate/failure snapshots, discard only this test document's edits, reopen the untouched original and restore Move. Direct setValue of the freshly observed filename control succeeds. No speculative source fix or full keyboard/dialog parity claim follows from these ambiguous automation observations.

19. On the reopened original three-layer RGB32 probe, verify Hide/Undo/Redo/Undo, PSD Save As, native .photato Save As, close/reopen, then PSD Save a Copy without changing the clean native association. verify-live01.py independently parses both PSD outputs: each preserves all209,136 original layer/mask bytes, all65,536 original merged RGBA bytes and the actual working ICC exactly; native archive v10 retains its profile. Inspect the native screenshot. Photoshop opens rgb32-from-native.psd as editable RGB/32 with all three layers and source mask; capture fit-to-window, then close without saving. Original dirty Untitled-1 remains untouched, disposable Finder window closes back to the existing Documents window, and the test Photato app exits without an AX read relaunching it. Final hashes prove source probe, outputs and workspace bytes unchanged. Preserve [local evidence archive] and [local evidence archive].

20. Install the verified clean extracted step117 app and ZIP into the actual project build directory. Retain the prior app/ZIP in the117 run; ditto --noextattr --norsrc yields a strict-signature pass on the first attempt. All723 frozen inputs still match; no Sources/Tests edits occurred during or after final qualification. Record [local evidence archive]. Update current status, plan, four partial File command rows, dual API capability/compatibility evidence and docs/ACTIVE_CHECKPOINT_117.json. Keep18 Photato commands, two partial/six unimplemented Adobe endpoints and all major-function gates unchanged. The next major D01 work covers complex structure/composite fidelity, complete document format/profile/Save options and external-file/recovery workflows. Full PSD file equality and complete Photoshop parity are not claimed.

21. Refresh/check the development-history inventory with python3 scripts/audit-development-history.py and python3 scripts/audit-development-history.py --check: first pass reports117 milestones,29,885 evidence files,17,926 logs and zero missing explicit references. Logs and final source/package verification are kept under the excluded [local evidence archive] directory. Revalidate all723 frozen inputs,402 Swift source/test files, installed universal binary/ZIP and the .xcodeproj hash unchanged; then refresh/check again after this final record update. There is no pending native validation session, test app or API listener from this increment. Goal remains active; D01 remains open.

1. Classify step115 as verified progress. Revalidate all 395 source/test hashes, final universal ZIP and Xcode project against checkpoint115; preserve the baseline in this increment's immutable run directory. Prior validation sessions are terminal. Continue major D01 original working-profile preservation. Trace PSDCodec's Adobe-to-Apple conversion, document/archive sourceICC metadata, display/raster export, colour entry, clipboard and cross-document boundaries. Existing sourceICC records provenance; older archives already contain converted pixels and must not be re-tagged with their source profile. Inspect Apple's SDK CGColorSpace linearization APIs and Adobe's current preserve-embedded-profile policy. A guessed LayerDuplication.swift path is absent; locate actual routes with rg. No major workflow is closed.

2. Add a distinct validated workingICC field and native archive version10; versions1–9 retain historical sRGB interpretation. Preserve raw PSD coordinates and actual RGB profiles, linearizing matrix profiles for RGB32 where required. Add profile-aware display, raster export metadata, colour entry, text rendering, Place/AI-image insertion and native clipboard conversions. Keep mask/alpha coordinates uncoloured; cross-profile adjustment/fill conversions without a qualified policy reject explicitly. Both API routes share the codecs and gain observable working-profile state/schema. focused01 stops at compile errors: a throwing short-circuit expression needs try on the operator, and CGColorSpace has no localizedName property. Preserve the log, correct the expression and use native NSColorSpace profile descriptions. Guessed LinearStorageTests.swift and core RGBChannelView paths were absent; rg resolves PSDLinearStorageTests and the imaging view module.

3. focused02 stops at missing required depth arguments in the new test's rgbaData calls; preserve and correct them. focused03 executes39 tests: the original Adobe-profile merge matches all28,672 independently extracted raw RGBA bytes through merge/archive/PSD, and archive migration/display/clipboard checks pass. Two new PSD assertions fail because Surface equality includes different sparse tile/default representations; compare exact serialized sample bytes instead. Preserve all logs and the independently extracted procedural reference with source/output hashes in raw-reference-extraction.json. Extend real HTTP desktop/job merge comparisons with working-profile identity and the independent raw oracle, add compact profile hash/name/encoding state instead of sending large ICC payloads in every state response, and cover colour conversion on cross-document clone sampling. Full HDR kernels, conversion policy/preferences and original-profile raster decoding exactness remain unqualified.

4. focused04 executes90 tests and reports30 assertions from new profile expectations: RGB8/16 procedural fixtures are untagged, so native state correctly reports implicit sRGB while PSD export explicitly embeds sRGB. Compare effective colour spaces for untagged references and retain exact ICC-byte assertions for embedded profiles; reflect the actual nil/hash state. Do not change the raw RGB32 oracle or pixel requirements. Add native colour-well and cross-document clone/mask regressions. After formatting34 changed Swift files, focused05 passes92 tests with zero failures in6.934 seconds. Freeze400 source/test files as tested-source-hashes01.json. Start full Debug and full optimized tests, then universal packaging sequentially; no code edits during qualification.

5. Full01 completes 1052 tests with 1 failure and zero skips in 152.526 seconds: an existing Save-notice assertion expects the old “32-bit precision” wording. The revised notice correctly states retained working profiles while warning that full 32-bit output equivalence remains in development. Update that wording assertion; preserve full01 and freeze01. Correct the initial temporary summary parser to recognize singular “failure”; it had selected a15-test passing sub-suite instead of the failed full summary. full01-summary.json records the correction. Application sources are unchanged. Freeze400 files as tested-source-hashes02.json and rerun full Debug/Release/build under distinct02 names. During validation, inspect Photoshop's actual Color Settings: North America General Purpose2, preserve embedded RGB/CMYK/Gray, ACE/relative colorimetric, BPC and8-bit dither enabled, text gamma1.45. Capture AX/screenshot and Cancel without changing settings. The observation does not establish ColorSync/ACE conversion equivalence.

6. Full02 passes all1052 tests with zero failures/skips in153.444 seconds. Full optimized qualification and universal packaging continue sequentially on freeze02. Update profile/API/reference records with the actual observed Photoshop settings, the independent raw extraction and remaining ACE/conversion/HDR limitations. Prepare final-package UI and independent PSD/native-profile verification scripts without running them against an unqualified build. Earlier step115 checkpoint remains unchanged.

7. Full optimized release02 executes1052 tests and fails two existing ProjectLinks tests: valid App Store tip product IDs are rejected by the optimized module's nested CharacterSet predicate. All profile tests pass. focused06 reproduces both failures in isolation. A standalone diagnostic passes with both -Onone and -O, so do not assert a proven compiler or Foundation root cause; preserve both logs and source. Replace the predicate with direct ASCII byte validation using the same allowed characters, size, uniqueness and count limits. This repairs release metadata/IAP configuration validation without changing the purchase flow, products, URLs or API commands. Retain previous passing Debug and failed Release evidence before focused and full requalification. Also record the procedural raw-fixture attribution and authoritative ICC curve-format references.

8. focused07 passes20 optimized tests, including the three ProjectLinks regressions and profile/desktop/dual-job API checks, with zero failures in1.090 seconds. Freeze400 files as tested-source-hashes03.json after the isolated Release configuration repair. Start full Debug, full optimized and universal build03 sequentially. Preserve previous source freezes, diagnostics and failure logs; update pending verifier/UI/checkpoint scripts to bind this actual final source. No editing algorithm changed after freeze02.

9. Full03 and release03 both pass1052 tests; universal build03 succeeds in152.156 seconds. Clean-ZIP/package verification passes and binds freeze03; preserve that package/report separately before further changes. Code review finds ICC tag validation eagerly copies every tag payload, allowing shared ranges to amplify allocations. Replace payload copies with bounded ranges and a4096-tag descriptor cap; linear-curve inspection reads only fixed header bytes. Add a descriptor-budget regression. Local StoreKit simulation01 and unchanged rerun02 each execute3 tests with one failure: after two verified/finished same-product purchases, allTransactions reports1 rather than2. Pending/retry/recovery checks otherwise pass. Preserve both logs/results; add transaction-ID diagnostics while retaining the failing count assertion to distinguish simulator retention from a purchase failure. No real App Store account or payment is used.

10. focused08 passes15 tests after bounded ICC parsing. StoreKit diagnostic03 passes all3 tests and observes distinct transaction IDs36 and37 with the expected ledger entries; additional ledger reads changed timing. Treat simulator synchronization as an inference, not a proven StoreKit defect. Replace diagnostic prints with bounded waits for each verified transaction to be finished and visible in the local ledger, assert distinct IDs and keep the original count assertion. Add native-file ingress validation through ColorSync after structural ICC checks, plus rejection of a bounded but unusable profile; expose the4MiB/4096-tag limits in API capabilities. These complete the new profile boundary's validation; no source edits occur while a test/build session is active.

11. focused09 passes20 tests, including native ingress rejection, profiles and ProjectLinks. StoreKit04's explicit post-finish wait fails: the same consumable ID is returned twice, so the previous timing hypothesis is insufficient. Preserve all five assertions and xcresult, then inspect raw StoreKit unfinished transactions after the wrapped finish call. A guessed xcresult timestamp copy and two guessed storekit03.log reads fail; resolve the actual paths from logs/file inventory (storekit03-diagnostic.log). Apple finish/ledger documentation pages load, but their linked Markdown fetches are rejected by the web reader; these failures provide no API-behavior evidence. No production purchase change yet.

12. StoreKit diagnostic05 reproduces the first finish remaining unfinished; finishing the raw transaction obtained from Transaction.unfinished then permits a second distinct purchase. The run retains one failure and passes retry/pending recovery. Compare with diagnostic03's successful pre-finish ledger read: candidate test synchronization now establishes that SKTestSession has registered the purchased ID before calling the unchanged client finish, then verifies no unfinished delivery, two distinct purchases and two ledger entries. This is a local test-service barrier, not evidence of a proven OS cause or a production workaround. Preserve all attempts and retain App Store/sandbox qualification as open.

13. StoreKit06 now returns two distinct purchases and two ledger entries, but one added unfinished-delivery check exceeds its two-second polling bound. Pending-approval propagation consistently takes about15 seconds in the same local service. Extend only the test's post-finish bound to20 seconds and include the transaction/purchase index on failure; keep all functional assertions and production behavior unchanged. The local service timing remains under investigation, not a confirmed implementation defect.

14. StoreKit07 passes all3 local tests in30.201 seconds; repeat-purchase/finish propagation takes15.117 seconds and pending approval about15 seconds. Production purchase code is unchanged. Format the strengthened test and freeze400 Swift files as tested-source-hashes04.json. Run a fresh local StoreKit confirmation08, full Debug/Release and universal build04 sequentially; stop on any failure. No source edits during final qualification. Preserve the earlier pre-bounds package and all failed tests.

15. Fresh StoreKit08 passes all3 tests, zero failures,30.207 seconds, on freeze04. Preserve both passing xcresults alongside six diagnostic/failing attempts. Full Debug04 is running; full Release04 and universal build04 follow only if it passes. Record that local StoreKit qualification does not establish App Store/sandbox distribution behavior. Preserve a fresh read-only Photoshop baseline before the final disposable-document workflow.

16. During full04, the native project directory unexpectedly moves from PhotoCraftSwift to a sibling named “-”; test outputs recreate a partial PhotoCraftSwift/artifacts directory. This agent did not rename the project. Preserve the run and interrupt this agent's Python/zsh/SwiftPM/xctest processes; do not qualify the interrupted full run or continue dependent builds. All400 source/test hashes in the moved directory still equal freeze04. Request the intended location before reversing another actor's filesystem change. Two independent read attempts fail because their original paths vanished. The new notphotoshop Git administration record also shows that a separate owner-authorized task created a private repository; this supersedes the earlier enclosing-repository assumption for future work but does not alter prior evidence. No Git mutation performed here.

17. Confirm all four owned validation processes have exited; the explicit child interrupt finds xctest already gone. While the required directory-location clarification is pending, independently re-examine the preserved step114 raw PSDs without changing source: the white-distance candidate still leaves70/18,432 RGB samples different. A naive straight-layer composite experiment leaves4548 samples different and is rejected as incomplete because it does not model all PSD layer/mask properties. Preserve both investigation reports; neither is an implementation or qualification. StoreKit07/08 and focused native tests remain valid in their recorded scope; full04 is interrupted and final release/UI qualification remains pending.

18. Interruption-record audit refresh finds116 milestones and zero missing explicit references. Its first check correctly rejects a stale inventory because the audit logs/results were created inside the indexed run directory. Preserve that failed attempt and rerun refresh/check with logs in the auditor's excluded development-history-audit directory. Application source and packaged binaries remain unchanged; no final step116 checkpoint or release claim is written while location clarification and final qualification are outstanding.

19. The next goal continuation revalidates the same400-file freeze and unchanged directory situation. Classify the preceding turn as progress: stronger StoreKit checks, independent diagnostics and preserved interrupted validation. The folder choice remains unanswered, but it does not prevent testing an isolated snapshot. Copy all source/tests/fixtures/corpus/assets/docs/licenses/project/scripts into a unique private temporary directory, excluding old [local evidence archive] caches, and verify every frozen Swift hash. Start full Debug05, Release05 and universal build05 there; preserve independent output snapshots after each suite. This makes safe progress without reversing another actor's move. Canonical package placement and final project-path documentation still depend on resolving the location.

20. While isolated validation runs, extend the independent RGB32 PSD inspector to include the actual mask channel and its20×25 geometry. This explains why the previous naive composite experiment was invalid. A candidate with Float32(alpha×mask), rounded Float32(source−destination), a fused-style destination+alpha×delta, and Float32(1−Float32(1−composite)) matches all18,432 merged RGB samples of the preserved96×64 Photoshop-recalculated reference. Other tested arithmetic orders leave7–4548 mismatches. Preserve the parser, candidate script and all results in the isolated evidence directory. This is a useful next-step experiment only: no editing/export kernel has changed, and other profiles, HDR ranges, opacity, blend modes and architectures remain unqualified.

21. Inspect the actual native arithmetic paths: NormalLayerComposite already uses fused arithmetic for Photoshop merge probes, while Renderer.compositeLinearPixel falls back to the generic weighted blend for partial-alpha Normal layers. Independently modeling the existing merge helper's output-alpha/ratio ordering leaves26 merged-reference mismatches, so blindly sharing it would not close this renderer case. Preserve candidate03 and plan a separately qualified renderer/matte repair with broader independent fixtures. A guessed Blend* glob has no matches; rg locates Color.swift and NormalLayerComposite.swift. No frozen application source is edited.

22. Isolated full05 completes1053 tests with0 failures, zero skips, in209.059 seconds of tests (231.143 seconds including recompilation after the path change). Preserve all generated test artifacts separately before optimized validation. Release05 is running against the same400-file freeze; universal build05 follows only on success. Existing nonzero vector-rendering deltas printed by historical bounded tests remain explicit gaps, not evidence of exact Photoshop parity.

23. Isolated release05 passes all1053 optimized tests, zero failures/skips, in42.312 seconds of tests (145.006 seconds including compilation). Preserve optimized generated outputs independently of Debug outputs. Universal build05 is running on the same source. Existing RasterDecodeBudget Sendable warnings remain visible; this increment does not claim they are repaired. Keep the source frozen through final package/native/Photoshop validation.

24. Isolated universal build05 succeeds in151.890 seconds. Package verifier confirms arm64+x86_64, macOS14 minimum, clean-ZIP signature, icons/notices/links, unchanged Xcode project and menu inventory, and exact400-file source freeze. Final live app opens the original Adobe-profile RGB32 probe, merges, undoes/redoes, saves native archive10, closes/reopens it and saves PSD. Photoshop opens the output as one256×7 Source layer at(0,1); capture and inspect both screenshots. Independent parser confirms all28,672 layer RGBA bytes and original ICC bytes identical; native archive workingICC also matches. Merged-cache output still differs1495 bytes and remains open. Original probe/workspace bytes are unchanged, disposable app exits, disposable Photoshop/Finder windows close, and the user's original Photoshop/Finder windows remain. Initial Go To typing drops a character; correct the field before opening. No user document or setting is modified.

25. The folder relocation choice remains unanswered, but no move is needed to preserve a verified build. Revalidate the current project's400 Swift hashes plus every source/test/fixture/script/resource/project input against the isolated snapshot. Copy immutable isolated evidence into this increment's isolated05 subdirectory, preserve the previous ZIP, and install the verified app/ZIP in the project's existing build directory. Keep the project under its observed “-” name; no filesystem rename or Git mutation. Record package paths and actual Desktop signature result separately from the clean extracted ZIP. Finalize step116's bounded profile evidence/checkpoint, keep D01/full Photoshop parity open, then refresh/check development history.

26. Final step116 records retain1053 Debug and1053 optimized tests plus3 local StoreKit tests, exact original-profile layer bytes and the1495-byte merged-cache limitation. Recheck source freeze, prior checkpoint115 and all critical inputs before final audit. Initial Desktop copied app fails strict signature because of added metadata; clear extended metadata once and recheck successfully, preserving both observations. The clean ZIP remains independently verified throughout. Checkpoint116 stays active with D01 open, records the current “-” project path and points to the independent next-renderer plan. The unresolved directory naming preference does not block development in the verified current directory; no rename is inferred or performed.

27. Final profile-increment history refresh/check passes:116 milestones,29,550 indexed evidence files,17,914 logs, zero missing explicit references. Record those audit files in checkpoint116 and rerun the audit after this final documentation update. Preserve the full master objective and major-first ordering. All owned validation sessions are terminal and disposable UI state is cleaned up. Next: qualify and implement the independent RGB32 Normal-render/matte candidate; the measured1495-byte merged preview difference and broader D01/profile/API/platform requirements remain open.

1. Classify step114 as verified progress. Revalidate all 393 Swift source/test hashes, universal ZIP and Xcode project against checkpoint114. Preserve the complete baseline under [local evidence archive]; prior validation and isolated UI processes are terminal. Continue major D01 by independently analyzing the measured RGB32 merged delta and migrating the affected linear editing paths. Preserve full Photoshop/API/platform requirements; no major function is closed by this starting audit.

2. Inspect existing LayerMerge, its independent Photoshop fixtures, desktop routing and both API adapters. The layer merge transaction still round-trips RGB32 through transfer functions; its workflow tests currently allow RGB error. Replace that tolerance with exact linear RGBA byte comparison before changing the engine, to capture the deficiency. Existing API has 17 commands and no merge operation; actionJSON supports only component select/fill.

3. Preserve baseline01 compile failure (missing try on rgbaData), repair test syntax, then baseline02 reproduces six RGB32 merge/export exact-byte failures. Independent ICC/resource inspection finds all three 572-byte profiles identical (SHA256 42d1e258eddfda5492ad878a0077e1365c9662cfe90789c9663333f24bf3c3ff); a differing embedded profile does not explain the existing merged delta. Retain per-channel opaque-base sample comparisons in icc-and-base-delta01.json. Migrate LayerMerge to direct linear input/intermediate/output and remove final transfer; keep integer arithmetic unchanged.

4. focused01 passes12 tests including exact RGB32 workflow/export comparisons. Add typed layer.merge (down/selected/visible), machine schemas, selection/availability state, allocation cap and cancellable prepared native transaction with revision/share/token guards. Adobe actionJSON gains $Mrg2, $MrgV and the installed Adobe selectAllLayers descriptor shape; selection persists across action resources. Pin names/behavior from the installed Adobe ContactSheetII.jsx and Flatten All Layer Effects.jsx public scripting examples (read only; no implementation copied). Official batchPlay and v2 actions-migration documentation confirms the adapter mechanism; the legacy JavaScript PDF fetch is blocked by robots. Existing partial endpoint scope remains explicit.
5. focused02 compiles and exposes an outdated command-count expectation (18 vs17). focused03 exercises all-depth desktop/HTTP merges and both job interfaces, exposing a second old count, the test exceeding the real retained-job cap, and an oversized test hitting core bounds before the intended API cap. Preserve all failures. Repair test setup/counts, revoke completed test jobs between operation pairs, and use a union inside core bounds but above the API allocation cap. Native protection limits are unchanged.

6. focused04 passes48 tests with zero failures. Freeze395 Swift source/test files at tested-source-hashes01.json; begin the full suite, optimized affected suite (including desktop merge routing), then universal package build. Preserve rolling artifacts before the pipeline. No source edits during qualification.

7. While frozen validation runs, analyze the existing RGB32 merged delta independently. Float32(1 - Float32(1 - value)) reproduces all5472 base-only RGB samples (2889 previously differing), and reduces whole-image mismatches from12986 to70 of18432 samples. Preserve both experiment reports. This supports investigating Photoshop's white-matte output ordering, not profile mismatch; it is not yet an exporter repair or general Photoshop equivalence claim. Keep the qualified merge increment isolated and record matte/compositor qualification as the next major D01 dependency. Update API schemas/usage and explicit scope documentation.

8. Full suite passes1044 tests, zero failures/skips,153.338 seconds of tests. Optimized qualification and universal build continue on the same395-file freeze. The independent matte experiments do not modify source or replace current Photoshop byte requirements.

9. Optimized suite passes634 tests/16.713 seconds, universal build succeeds/150.118 seconds. Verify clean ZIP signatures, both macOS14 architectures, icon/licenses, unchanged Xcode project and factory menus. Live isolated Release app opens the original RGB32 merge fixture; Command-E, Undo, Redo and Save As PSD work. Photoshop's Open chooser stays disabled despite selection/filter/keyboard retries (preserved observations); restore All Readable Documents, cancel, then use a disposable Finder window's Photoshop association to open the output successfully. Inspect Source layer256x7 at0,1 and close the probe/window. Original Photoshop document remains untouched; Photato exits; workspace bytes remain exactly unchanged.
10. Independent parsing catches a qualification gap: output alpha7168 bytes is exact, but RGB differs in8736 bytes from the original Photoshop merge reference. The fixture embeds Adobe's linear sRGB ICC (SHA256 f50ef60e269f9011cec05505c991566e7e41569674b1ecf756deb973acbdad9d); the decoder converts it to Apple's linear sRGB, changing RGB values. Both sides of the automated PSD comparison used that decoder, masking this source-profile delta. Preserve independent-live01.json and merge-profile-review01.json. Do not claim original-profile raw parity. Add a complete65,536-pixel merge/archive/history regression directly against the existing independently extracted raw Photoshop oracle (no PSD/profile decoder), and explicitly label the PSD tests as working-space comparisons. Original source-profile retention is now the first remaining D01 dependency alongside the measured matte/compositor difference. The full goal and major function remain open.

11. focused05 passes10 tests, including the65536-pixel raw merge/archive/history regression without a profile decoder. Freeze395 files as tested-source-hashes02.json; only two test files differ from freeze01, application source is unchanged. Preserve the first package/report before rerunning full/optimized qualification and package verification. Existing live evidence remains applicable only if the final application binary hash is unchanged; original-profile fidelity remains explicitly unqualified.

12. Final full02 passes1045 tests/153.262 seconds, zero failures/skips. Retain the two source/test-edit scripts, all prior failure/pass logs, first package, profile mismatch evidence, live captures and before/after workspace bytes. Final optimized/build verification is still pending at this substep; no original-profile parity claim is made.

13. Final release02 passes 635 optimized tests with zero failures/skips in 16.888 seconds; universal build02 succeeds in 79.2969 seconds. Clean ZIP verification binds final production binary SHA256 1e4fc8a07274840639c261aa3ab358df44870a295415ef3eb95223da4c06293f, both architectures, macOS 14 deployment metadata and the unchanged Xcode project. The rebuilt binary differs from the first live-test binary despite unchanged application sources. The final-record identity assertion correctly refuses to reuse that live qualification; preserve finalize-records01.py and final-record-guard01.json. Prepare a fresh isolated copy from the final verified package and repeat native Open, Fit, Merge Down, Undo, Redo and separate PSD Save As. Capture final-open/merged/undo/redo/saved AX records and inspect final-merge.png. No source edits follow freeze02.

14. Independently parse the final live output: alpha remains exact and the original-profile RGB gap remains 8,736 differing bytes. The complete final PSD is byte-identical to the earlier output already opened in Photoshop (SHA256 80e037ce6e657b70c47cd7715a5cfec9e905c30167f637f2c30cd5e0b511ceb2); this connects Photoshop interoperability to the final saved file without claiming the earlier Photato process used the final binary. Preserve independent-final-live01.json and final-live-cleanup01.json. Confirm the final isolated app exited, the original probe is unchanged, and workspace bytes are unchanged. Revise the record generator as finalize-records02.py; finalize the live/release evidence, reference manifests, status, plan and checkpoint115. Full goal and major D01 stay active/open. Original working-profile retention is the next major dependency; both API interfaces remain subject to their documented coverage limits. History inventory refresh/check follows.

15. Development-history refresh/check01 passes: 115 milestones, 27,599 evidence files, 16,653 logs, zero missing explicit references. Record the result and final audit paths in checkpoint115, then run refresh/check02 after this final note. All 395 source/test hashes remain frozen; final package and project identity remain verified. No native validation session is pending. Continue the active major phase from original working-profile preservation; do not infer Photoshop parity or D01 closure from this bounded merge/API increment.

1. Classify step113 as progress: source-format Save/Save As, optional API saving and content-aware file association are implemented and qualified. Verify all 391 Swift hashes, ZIP and Xcode project against checkpoint113; preserve the baseline under [local evidence archive]. Prior validation sessions are terminal. Inspect Surface, native tile/archive serialization, PSD channel/profile import/export and full/group rendering. Guessed Pixel.swift, NativeArchive.swift, RegionalRenderer.swift and PSD_DEPTH_REFERENCES.json paths are absent; rg locates Color.swift, Document.swift and GroupRenderer.swift. No pending process is restarted.

2. Recheck Adobe's PSD format specification and current HDR support documentation. Trace the recorded 96-byte RGB32 round-trip difference to the linear→encoded Float32→linear conversion at PSD boundaries. A more accurate transfer function alone cannot retain all source float bits after a many-to-one rounded conversion. Plan explicit linear RGB storage in Surface, preserving the existing encoded pixel-view API while adding exact linear access. Native archives must declare/version that representation, crop/expansion/history must preserve it, and shared PSD/API paths must use it. This is a storage foundation for complete linear editing, not a cache of original file bytes. Existing wide-gamut/profile, unsupported HDR operations and full Photoshop rendering requirements remain open.

3. baseline01 reproduces the RGB32 failure: one test, one assertion, 96 differing working-composite bytes; the RGB16/masked references remain exact. Implement explicit linearRGB Surface storage, encoded-view and exact linear access, unchanged-component retention, storage-aware crop/expansion/serialization, raster packing version2 and native archive version9 with old versions still readable. PSD RGB32 imports retain linear samples; export reads those exact samples. ImageIO profile conversion accepts the declared storage representation. focused01-storage passes29 tests in1.550 seconds, including zero differing bytes for all three metadata fixtures and legacy tile/native migration coverage. This removes the measured import/export drift, but exact merged output and editing paths still need independent qualification.

4. focused02 fails compiling a new history test because EditorSession is a value type declared with let. Preserve its log and use var. focused03 executes five tests: core storage/history/archive tests and three-cycle original-Photoshop layer preservation pass, but three compression variants fail the independent literal merged-plane assertion. The old compositor loses signed zero and ordinary low bits and converts the largest finite HDR sample to black through an overflowing transfer round trip. Preserve failed03 source hashes and repair direct linear composition plus merged output; no whole-feature closure is claimed.

5. Direct linear raster composition, ordinary group/clipping composition and merged PSD encoding now avoid an encoded intermediate. Opaque Normal identity preserves exact sample bits including negative zero and the largest finite HDR sample. focused04-linear-render passes118 selected tests in10.146 seconds, including literal planes across all three layer compression modes and existing group references. Add grouped/regional and real HTTP RGB32 upload/rename/history/download plus both action-job interfaces. Publish the storage representation, version and explicit precision limits in optional API capabilities. Normal source-save review stays in place while profile, transformed/adjusted/fractional HDR parity remains open.

6. focused05 stops at a test compile error: Layer.isClipped is read-only; the stored flag is clipped. Repair the test fixture and refresh the metadata test comment. Run swift-format on changed source/tests, save the393-file freeze, then rerun the new storage/API suite. The old verify-app-package.py is pinned to step058 counts and is unsuitable for current package qualification; use a new run-specific verifier.

7. focused06 executes22 tests; the new job test fails because the existing resource decoder rejects every non-RGB8 input before action dispatch. Native upload/rename/download and all linear tests pass. Extend both shared job interfaces to RGB16/32 PSD composite-RGB selection/preservation, keep component selection/writes restricted toRGB8 in the common interpreter, retain RGB8 PNG input, and reject RGB32 PNG output explicitly. This is a narrow preservation path, not general HDR action support. Add matching capability/docs and high-depth action rejection tests; preserve all failed logs.

8. focused07 passes36 storage/imaging/HTTP/action tests with zero failures in4.914 seconds. Both job APIs now match desktop PSD bytes; original Photoshop RGB32 layer samples survive all tested routes. Add explicit RGB32 PNG-output and component-Fill rejection assertions before full/optimized/universal qualification. Freeze393 Swift source/test files as tested-source-hashes03.json. Preserve rolling artifacts before qualification.

9. The full01 run exposes full-versus-incremental render mismatches in ColorRegionRenderTests and FocusRenderTests. Trace these to RenderSnapshot copying a linear patch through pixel()/setPixel(), which rounds changed linear samples. Let the running suite finish to capture all failures before editing. The earlier nonexistent BlendMode.swift/Blend.swift and AdobeActionPipeline.swift guesses are resolved by rg to Color.swift and AdobeActionAssets.swift; no tool failure is treated as source evidence.

10. full01 terminates normally with1040 tests and three assertions failing in the two incremental-render tests; no tests skipped. Repair RenderSnapshot patch copying to use linearPixel/setLinearPixel with row cancellation checks for linear surfaces. Extend the literal storage regression to compare exact full and incremental raw-linear bytes including extreme/signed-zero samples. Preserve freeze03 and full01, create freeze04 and rerun full/optimized/build validation under new names.

11. full02 passes1040 tests with zero failures/skips after the incremental copy repair. Optimized qualification and universal build run sequentially on the same frozen sources. Add a bounded independent Python PSD32 plane inspector for the two-layer original reference: it reads raw/RLE/ZIP/predicted payloads without Swift or image color conversion, identifying122880 RGBA layer bytes and73728 original merged RGB bytes. Self-inspection is only parser setup; exact output preservation still requires comparing the packaged app’s actual saved file.

12. Optimized release02 passes628 tests with zero failures/skips in16.502 seconds. Universal packaging runs next. Existing RasterDecodeBudget Sendable warnings also appear in the accepted step113 optimized log; no new warning suppression is added. During independent Photoshop reference setup, refresh CUA after an inactive binding, recover a clipboard timeout with the visible path field, then observe a selected disposable RGB32 source with Open disabled. Re-selection, explicit Photoshop filter and bounded coordinate attempts do not open it. Preserve AX/screenshot, restore All Readable Documents and cancel; original Untitled-1 remains untouched. This is a chooser observation, not proof that Photoshop rejected PSD content.

13. Universal build02 succeeds; run-specific verification binds393 source/test files,1040 full/628 optimized tests,arm64+x86_64 and macOS14 metadata, unchanged Xcode project/menu inventory/licenses/icon, and a clean strict-signed ZIP. As before, the synced Desktop copy later acquires Finder/resource-fork metadata and fails strict verification; do not advertise that copy as signature-clean. Launch an isolated identity from the verified Release ZIP. A Go-to-folder highlight again leaves Open disabled until focusing the file list and typing the filename’s first letter commits selection. Open RGB32, rename Precision to HDR preserved, Undo/Redo, save native version9, close/reopen it, then Save As PSD. Capture AX and actual screenshot. Photoshop opens that saved RGB32 PSD with observed layer dimensions48×32 and offset13,9; close the disposable output without saving, retaining the user’s original Untitled-1.

14. Independent Python inspection of the actual live saved PSD confirms all122880 original layer RGBA bytes unchanged, including the renamed layer. The original73728-byte merged RGB reference still differs in13569 bytes /12986 Float32 samples, maximum absolute sample error4.470348358154297e-08; exported alpha is fully opaque. This is a measured remaining compositor gap, not full Photoshop equivalence. Preserve the native/PSD files and both comparison reports. Quit the isolated app; capture its automatic workspace panelDock migration, verify only that migration differs, and restore the exact original workspace bytes after confirming the app exited. Source probe and original Photoshop document remain unchanged.

15. Review the original merged cache outside the upper layer before attributing its differences to arithmetic. Create a separate copy of the live PSD, open it in Photoshop, change top-layer opacity from 100% to 99% and back to 100%, then Save and verify saving completes. Independent parsing of that freshly recalculated output confirms all layer bytes remain exact and reproduces the same 13,569-byte / 12,986-sample merged RGB difference, maximum 4.470348358154297e-08. Preserve both the initial cache review and recalculated evidence; close the disposable document. The remaining discrepancy needs color-management/compositor diagnosis, and is not waived by small visual error.

16. Finalize storage/API/reference manifests, command coverage, status/plan and active checkpoint114. All 393 Swift source/test hashes remain at freeze04; the universal package, Xcode project and earlier checkpoint113 remain bound and unchanged after qualification. The first development-history refresh/check passes: 114 milestones, 26,564 evidence files, 16,026 logs, zero missing references. Record that result in the active checkpoint and run the final refresh/check after this note. The goal remains active, major D01 remains open, and optional minor/detail work has not started.

1. Classify the preceding goal turn as progress: metadata preservation, TIFF encoding repair, native-extension integration and verified release/checkpoint112 changed authoritative state. Verify all387 source/test hashes, current ZIP and Xcode project against checkpoint112, then preserve the baseline under [local evidence archive]. Previous validation sessions are terminal, so no process is restarted. Read current instructions/checkpoint, document controller, shared codecs, persistence tests, optional API state/permissions and AppKit NSDocument saving headers. A guessed Raster.swift path is absent; rg --files locates Surface.swift. No source changes yet.

2. Adobe’s current Save guide distinguishes saving the current format/association from Save a Copy, and exposes format-dependent layers/profile options. Plan format-aware Save/Save As through NSDocument’s coordinated writing and change tracking, shared background encoders and a separate default-off API local-write permission. Save formats must preserve supported editable structure; flattened-only cases remain Save a Copy. Native recovery continues as a separate .photato archive. Existing source-profile conversion and RGB32 exact-byte gaps remain explicit major requirements rather than being represented as resolved by ownership/format controls. Do not add arbitrary filesystem paths to remote requests; API Save As needs an explicitly chosen local destination boundary.

3. Implement DocumentSavePolicy/DocumentSaving, format-aware NSDocument open/read/write/ownership, native Save As format controls and explicit conversion limits, and native recovery type. Add document.save/document.saveAs through the shared save operation, separate session-local save permission, native-selected Save As folder, filename/overwrite/symlink/external-change guards and capability/state schemas. Keep both Adobe resource routes unchanged over shared encoders. Split document type registration into editable supported formats and import-only types. The guessed AutomationGuard.swift file is absent; guards live in AutomationService.swift.

4. focused01 compiles but exposes four identity assertions: the old import-only PNG expectation must change, and canonical alias lookup no longer matches the newly associated source URL. It then deadlocks: sample83021 shows the new asynchronous save override waiting on AppKit’s document-file serialization semaphore during an autosave callback. Preserve source/log/sample, deliberately terminate only that confirmed test process, and retain terminal exit1 without claiming a completed test run. Keep recovery callbacks synchronous in AppKit’s original activity context; regular explicit saves continue to pre-encode. Extend canonical identity lookup to associated and import-only URLs, update the PNG lifecycle test to use real Save As, and update the independent API registry expectation from15 to17. Add scrolling to the expanded native API window so its new permission controls remain reachable.

5. focused02 passes23 existing lifecycle tests in3.026 seconds with zero failures/skips, confirming the autosave/alias repair. Add eight source-save/API regressions covering every writable format, actual NSDocument ownership/dirty/history, representation rejection, PSD recovery archive, stale/cancelled/failed encodes, duplicate destination ownership, HTTP permissions/equivalence and filename/replace/symlink/external-change/revocation. focused03 fails compiling the new tests because the existing edit helper returns an HTTP status Int, not a response tuple. Preserve the test candidate/log; use the actual helper return and a separate HTTP GET for returned document state. No tests execute in focused03.

6. focused04 passes45 tests in3.857 seconds, zero failures/skips. Review the already-known color/float fidelity gap before permitting source-file replacement: imported non-sRGB profiles and RGB32 PSDs need explicit Save As format review; ordinary Save must not silently replace those originals while exact preservation remains unresolved. Add a sourceSaveNeedsReview state/guard and regression preserving the original bytes; explicit Save As retains its visible conversion notice and resets this initial source review state. This guard is temporary incomplete fidelity coverage, not a substitute for implementing profile/float preservation or closing D01.

7. focused05 passes46 tests in4.090 seconds, zero failures/skips. Freeze391 files and prepare an isolated Debug app with updated type registration. Live Open initially shows a highlighted path with disabled Open; keyboard Home/Down selects the file and enables it. Open the disposable original Photoshop RGB8 masked fixture, change top-layer opacity60→75 and Command-S: it writes back to PSD, retains the association and clears the dirty tab. Shift-Command-S exposes a real missing-format-control defect: only the explanatory accessory is visible. Preserve AX/screenshot/source, cancel, close the saved probe and quit the isolated app. Add an explicit native format popup using the shared copy accessory with Save-specific notices/eligible types, and expose its selected type through NSDocument’s fileTypeFromLastRunSavePanel. Add a regression for actual accessory, extension/content type and selected type; live end-to-end confirmation remains required.

8. focused06 passes47 tests in4.059 seconds, zero failures/skips, and the391-file freeze02 records the format-control repair. The isolated Debug2 app opens the disposable Photoshop mask fixture; native Command-S saves opacity75 to its PSD and clears the dirty tab. Save As now offers Photato/Photoshop for this layered model, changes the extension and notice when Photato is selected, writes a binary native archive and adopts its URL. Close/reopen retains two layers, opacity75, density50.2 and feather1.5. The API window exposes17 commands and separate default-off local-save permission/folder selection with scrolling. Preserve AX/screenshots and output hashes. Quit the validation app; inventory confirms no ui113 app running and workspace bytes match the prelaunch copy. Some CUA keystrokes were refused after focus changed; refreshing the actual state and retrying completed the intended operation without altering other documents.

9. Open only the disposable Photato-saved PSD in Photoshop2026. It accepts the file, displays both original layer names, Multiply, opacity75%, mask density50% and feather1.5px. Capture AX/screenshots, close the probe without saving, and verify the original user Untitled-1 remains. This qualifies the observed file/structure properties; it is not an independent byte-equality comparison. Start unique full01, release-focused01 and build01 validation sequentially on the frozen sources; full validation/package qualification remain pending at this note.

10. full01 completes1031 tests with three failed assertions in two older tests: PathWorkflowTests still expects only the native writable type, and WorkflowTests still expects PNG to lack a file association. The remaining1029 tests pass. Preserve the run and both original tests. Update the bundle/type check to compare all Editor registrations while still asserting the canonical native type, and replace the old PNG assumption with actual source association plus a failed save-back after adding an editable layer, verifying original bytes and dirty state. Application source is unchanged from the live Debug2 check. Freeze03 differs only in these two test files. A preparation assertion incorrectly depended on filesystem enumeration order and stopped before running tests; compare the changed-path set, then run full02, expanded optimized tests and build02 sequentially.

11. full02 passes1031 tests; release-focused02 passes532 tests with zero failures/skips. While build02 runs, final source review identifies a missed save-back case: Format(fileExtension:) recognizes jpeg/tiff but not common jpg/tif aliases, and associated format is inferred from the filename rather than decoded content. A mislabeled opaque PNG could consequently be saved as lossy JPEG without an explicit format choice. Preserve the pre-repair source and let the existing build finish before changing compiled files. Add common alias/content-identification regression coverage and use native ImageIO type identification for source association; full qualification must be repeated for that repair. Earlier successful tests remain evidence only for freeze03.

12. build02 finishes successfully on freeze03 and its ZIP is preserved before repair. focused07 reproduces the alias/content bug in one test with27 failed assertions (five unexpected missing-file reads after AppKit renamed the wrong native-format saves). Repair source association using CGImageSourceGetType, accept jpg/jpe/tif aliases case-insensitively, preserve the associated filename extension for ordinary Save, and default Save a Copy to the actual associated format. focused08 passes34 selected document/file tests in3.607 seconds with zero failures/skips, including mislabeled PNG content kept as PNG and common JPEG/TIFF aliases kept at their original paths. Extend that same regression to legacy .pcswift/.PCSWIFT save-back, freeze04 and repeat full/optimized/build qualification.

13. full03 passes1032 tests and release-focused03 passes533, zero failures/skips. The optimized filter intentionally covers the broader workflow classes as well as codecs, APIs and menus after the old assumptions were repaired. build03 produces universal arm64/x86_64 macOS14+ binaries. Verify the clean ZIP signature, native/editor type registration, licenses/icon/links and unchanged Xcode project/previous checkpoint. Source freeze04 matches all391 files. Live universal Release validation under a unique identity repeats PSD Save, native Save As format/association and reopen, with API off and workspace bytes unchanged; the isolated app quits. Preserve exact package and UI hashes, failed attempts and Photoshop read evidence. Update current status, plan, command/API docs and checkpoint113. No full D01 or Photoshop parity closure is claimed; continue major profile/float/format/lifecycle dependencies.

14. The final Release PNG-with-.jpeg-name probe defaults to PNG in Save As, writes/adopts .png and leaves its original bytes unchanged. Final Release PSD bytes match exactly the earlier file inspected in Photoshop, so the recorded layer/opacity/mask reading applies to those same final output bytes. Cleanup inventory confirms the isolated app quit; workspace preferences are byte-identical. The clean ZIP signature verifies, but the Desktop app copy later fails strict verification because Finder/File Provider metadata adds a resource fork or similar extended attributes; this recurring local-copy issue is retained in release evidence and is not represented as a clean Desktop-copy signature. Use the verified ZIP/clean extraction for release validation. First history refresh/check passes113 milestones,25119 evidence files,15094 logs and zero missing explicit references. Record those results and run final refresh02/check02 after documentation completion. All application tests/build sessions are terminal; goal remains active with D01 open.

1. Continue the active major-first goal after verified step110 progress. Initial comparison against step110 fails: nine source/test paths changed and one test file was added by the separately documented step111 native-extension request. Inspect that manifest/log and verify all384 files match its tested snapshot; preserve the .photato changes and legacy aliases. The packaged ZIP remains step110. No pending test/build process is found. Preserve the combined baseline under [local evidence archive]. The aborted baseline script made no edits or run directory. Read instructions, current checkpoint, native save/type/metadata paths and Adobe’s official saving guide/PSD format specification. PSD currently retains resource bytes in native archives but drops most on export; RasterIO drops imported EXIF/IPTC metadata. Address preservation as a required dependency of D01 source-format Save/Save As; keep full lifecycle and profile fidelity open until independently qualified.

2. Add shared RasterMetadata capture/export through native ImageIO, retaining camera/descriptive/IPTC/XMP properties in the native archive; normalize exported orientation/dimensions/resolution/sRGB tags and retain custom XMP namespaces. Add bounded PSD resource parsing and exact opaque block retention while regenerating profile/resolution/paths and omitting known stale thumbnail/layer-selection/recovery records. PSD input XMP is available to raster export; imported raster XMP is emitted in PSD. Keep current sRGB working/profile behavior explicit. Five new imaging tests cover metadata/archive/format transfers, independent Photoshop fixtures, malformed metadata and profile consistency. A guessed PSDPatterns.swift path and Action* glob are absent; locate actual source by symbol before further reads.

3. focused01 compiles and executes five tests: four pass; exact original-versus-reencoded RGB32 composite bytes fail for an existing Photoshop fixture. Preserve the failed assertion. This test overstates the metadata increment’s pixel scope: the pre-existing float transfer/decode/encode path is not bit-exact. Add an exact comparison with the same encoder while imported resource retention is disabled, and print original round-trip mismatch counts; keep the full RGB32 equivalence requirement open rather than replacing it with a tolerance claim. Add a desktop/Photato download/both resource-job HTTP regression and capability metadata describing retention, regeneration and color limits. No new Adobe route is invented.

4. focused02 passes35 tests in4.633 seconds, zero failures/skips. Exact metadata-only output comparisons pass; the original RGB32 round trip differs in96 bytes while RGB16/mask fixtures differ in zero, retaining the unresolved float-fidelity requirement. Add normalization for stale XMP width/height/profile tags and PNG density, regenerate PSD XMP using the shared metadata path, and test bounds/truncated resource lengths. focused03 fails compilation because a scripted signature edit did not match swift-format’s one-line declaration; the new linear-profile parameter was referenced but not declared. Preserve that file/log and add the missing parameter explicitly; no tests ran in focused03.

5. focused04 passes36 tests in4.786 seconds, zero failures/skips, after the signature repair. Generate an original metadata TIFF-to-PSD probe in this run and copy it to a disposable temporary folder. Photoshop2026 opens it as RGB32/2×3 pixels; File Info visibly shows Photato test author, original/test keywords and Original test metadata copyright notice. The Camera Data coordinate action reports AXError.notImplemented and leaves the dialog unchanged; no unsupported field inspection is claimed. Escape cancels File Info, Command-W closes only the probe, and the original Untitled-1 returns unchanged. Probe bytes remain identical. Freeze387 source/test files, preserve the prior package and rolling artifacts, and begin full/optimized/universal validation including the step111 extension change.

6. full01 passes1020 tests in149.309 seconds, zero failures/skips, on the first387-file freeze; optimized compilation remains live. A separate Swift diagnostic linked against the already-built Debug core/imaging objects identifies a real metadata boundary defect: copying TIFF Compression=7 requests JPEG-in-TIFF and changes1445 raster bytes; default/none/LZW/Deflate outputs show no pixel changes. Preserve its source/build/result logs. Prepare a repair that removes imported TIFF compression as an encoder setting while retaining descriptive TIFF fields, with a regression asserting output compression/pixels/author. Do not change the source under the live first validation pipeline; apply the prepared fix after that pipeline reaches a terminal state, then freeze and repeat affected/full/package qualification. The first green full suite does not qualify this newly discovered defect.

7. The first pipeline reaches terminal success:1020 full tests,321 optimized tests and the universal build pass. Its package is preserved as before-compression-repair-Photato.zip and is not accepted for the newly discovered TIFF defect. Apply the two prepared files only after their originals match the captured candidates; imported TIFF compression no longer controls the export encoder, while author metadata remains. Add a three-compression pixel-exact regression, then format and rerun focused validation against the repaired source. The interrupted process observation after context restoration returns Unknown process id; the pipeline JSON and terminal build log independently confirm completion.

8. focused05 passes37 tests with zero failures/skips, including the imported TIFF compression regression. Its PSD metadata probe is byte-identical to the first probe inspected in Photoshop. Freeze387 files as tested-source-hashes02.json and start unique full02, release-focused02 and build02 logs; preserve first-pipeline artifacts and the pre-repair package. Native .photato remains its independent archive format per DOCUMENT_FORMAT_POLICY.json, with full PSD support tracked separately.

9. While the final pipeline runs, prepare isolated Release UI qualification without changing frozen source. Read the native archive implementation in Document.swift after a guessed NativeArchive.swift path is absent; an early pipeline-results02 lookup is absent because its first phase has not finished. Inspect RGB32 conversion: PSDCodec.convertProfile uses SRGBTransfer.encoded on imported linear floats, while export applies SRGBTransfer.linear. This Float transfer pair remains a working-representation issue for the next major dependency, not a metadata repair. Guessed PSDPixels.swift/Pixel.swift paths are absent; symbol search locates Color.swift. No additional fidelity claim or source edit is made.

10. full02 passes1021 tests in148.232 seconds with zero failures/skips on the repaired387-file freeze. Optimized compilation and packaging continue sequentially, with the source kept unchanged. Prepare the live check to open the original metadata PSD, save a canonical .photato native archive, export a PNG copy, reopen the native file and verify on-disk metadata and unchanged workspace/probe bytes. The earlier independent Photoshop File Info evidence remains applicable because metadata-probe02 is byte-identical.

11. release-focused02 passes322 tests in13.756 seconds and build02 completes successfully. Final package verification matches387 frozen files, both architectures/macOS14 minimum, .photato/.pcswift registration, bundled attribution/icon and unchanged Xcode project. Clean ZIP signature passes; the Desktop app copy retains the known Finder/FileProvider extended-metadata strict-signature failure, so use a clean extracted copy under a separate re-signed identity for live validation.

12. Live Release checks open the2×3 RGB32 metadata PSD, confirm Command-S suggests metadata-probe.photato, save the independent native archive, use Option-Command-S to save a PNG copy with the32-to16-bit disclosure, and close/reopen the native archive with its layer/dimensions intact. A batched Go To navigation initially leaves only / in the field; setting its freshly observed text-field value selects the correct disposable file. Explicit Quit succeeds; the immediate inventory still shows termination in progress, while the second inventory confirms absence. Original applications, source PSD and workspace bytes remain unchanged. Parse the saved native resources and PNG XMP to verify author/copyright/custom namespace values. Tighten the run-local native-depth assertion to the actual serialized value32 bit; this is verification-script cleanup, not an app change. Preserve AX states/screenshots and original verifier results.

13. Final native-file and package verifiers pass, including the corrected serialized32-bit depth assertion, metadata values, unchanged387-file freeze, clean ZIP signing, menu inventory and isolated-app cleanup. Update README/status/plan/API/command and extension-integration evidence plus ACTIVE_CHECKPOINT_112.json; historical checkpoint110 remains byte-identical. Record1021 full/322 optimized/37 focused passes and the still-open96-byte RGB32 mismatch. Current D01 source-format Save/Save As/profile/interoperability requirements and the full105-package major/minor/details plan remain open. Refresh/check the history inventory after final consistency checks.

14. First history refresh/check passes with112 milestones,24,904 evidence files,15,071 logs and zero missing explicit references. Final consistency confirms387 source/test hashes, five parseable API JSON examples,105 work packages/645 command mappings, active goal/open D01 and unchanged historical checkpoint110. Save these observed counts in checkpoint112 and run final refresh/check after this note. All Swift tests, builds and live validation processes have reached terminal results; only the bounded final documentation audit remains. No source/package changes occur after qualification.

1. The user explicitly requests the native extension change in a side conversation. Limit work to that change; do not continue or finalize the parent thread’s step110 work. Inspect file decoding, native document ownership/Save callbacks, Copy, API transfer/Revert/state, the shared bundle plist and current user documentation. Preserve candidates under [local evidence archive]. Use an isolated temporary source/build directory so the parent’s running universal build and caches are not changed. Its build process has ended before applying source changes.

2. Make .photato the native format’s default extension and explicit NSDocument Save filename extension; list photato first and pcswift second in macOS document/type registration. Retain the type identifier and archive encoding. Centralize native-extension recognition for open/file ownership/Revert; accept existing .pcswift files, including case variations. Save a Copy suggests .photato. API downloads advertise file.photato and retain file.pcswift as a byte-identical alias; update persistenceFormat/state schema and capability alias metadata. Adobe routes/models are unchanged. Update native help/errors, current README/API text and the product webpage’s document extension without changing its style. No existing user file is renamed or converted.

3. Add three regressions for preferred Save/Copy filenames and plist registration; actual native/legacy open, AppKit Save As and Revert; native/legacy loopback downloads, state/capabilities and API Revert. Existing imported-source workflow now saves .photato while other legacy tests remain. focused01 fails compilation because the new nonisolated AppKit override accesses an actor-isolated constant; preserve it and mark the immutable String constant nonisolated. focused02 executes242 tests with one failure caused by the isolated checkout’s missing artifacts output directory; all three extension regressions pass. Create that local output directory and rerun unchanged source. focused03 passes242 tests in13.521 seconds, zero failures/skips. Tests compile the app in the separate temporary workspace; no production GUI, package or live Photoshop interaction is claimed.

4. Apply only the tested changed files after verifying the working files still match the captured baseline; verify all384 source/test hashes match the tested isolated snapshot. Record unchanged Xcode project and existing package hashes, test commands/outcomes and API compatibility in docs/NATIVE_FILE_EXTENSION_REFERENCES.json and the run’s verification.json. Update current status/plan and affected command notes. The parent’s step110 package remains unchanged and predates .photato; its next freeze/build must include this change before claiming a current release. Do not rewrite the historical step110 source freeze or finish its pending Release UI work here. Refresh/check the development-history inventory for this side request.

5. Step111 history refresh/check passes with111 milestones,21,340 evidence files,12,606 logs and zero missing explicit references. Final read-only checks confirm the384-file source matches the isolated tested snapshot; the existing app/ZIP/Xcode project hashes are unchanged; all four API JSON examples parse. Preserve this observed first audit outcome and run a final refresh/check after this documentation note. All side-request test/audit sessions have reached terminal results; the parent’s unfinished packaging/UI qualification is not resumed.

6. Subsequent side-conversation clarification on2026-10-19: the user first requested .photato/.psd binary compatibility, then explicitly withdrew it: .photato is its own format; .psd must still receive100% support as a separate format. Source inspection and Adobe’s published PSD specification informed a temporary documentation proposal; no serializer changes or conversion occurred. The documentation script stopped at its milestone-ID collision assertion because the main thread had independently started step112 Source-format preservation. Preserve that main-thread entry unchanged and record this correction here. Remove only the temporary PSD-backed-native requirements from current status/plan/API/backlog/command notes, retain the withdrawn proposal in [local evidence archive], and establish docs/DOCUMENT_FORMAT_POLICY.json as the current decision. Native .photato/.pcswift archive behavior and separate PSD codec remain intact; full PSD interoperability is still incomplete. No application test rerun is needed for this documentation-only correction; refresh/check the evidence inventory without continuing the main thread’s work.

1. Continue the active major-first goal. The previous turn made verified progress and has no running validation process to restart. Re-read current instructions/status/priority/checkpoint, verify381 source/test files and package against step109, and preserve the baseline under [local evidence archive]. Inspect native document lifecycle, transfer APIs and imaging codecs; native Save As only offers .pcswift and read/revert only decodes native archives. Begin independent Photoshop Save/Save As/Save a Copy/Revert investigation. A guessed PSD.swift lookup fails; locate the actual codec filename before continuing. No source changes or new parity claims yet.

2. Inspect Photoshop 2026 File/Save As/Save a Copy using CUA and read Adobe’s current save-work guide plus AppKit NSDocument headers. The reference Open chooser kept the disposable PNG’s Open button disabled despite selection attempts; cancel without editing the user’s original Untitled-1. A lingering menu state required its exposed Cancel action. Save a Copy opens with Option-Command-S; Save As offers a document-dependent format list and a Save a Copy link. Save both dialog states and the format list, cancel all dialogs, and verify the original title is unchanged. No independent Revert result or new pixel parity is claimed. Additional guessed Layer.swift/History.swift/EditorCommands.swift/PreparedEdit.swift filenames were absent; actual model/session/prepared edit definitions are in Document.swift/Engine.swift.

3. Implement a native Save a Copy sheet with format selection, explicit current conversion limits, shared DocumentIO codecs, background encoding and atomic output. Preserve the open file association, dirty flag and edit history; reject source-file aliases and stale/cancelled encodes. Add an undoable saved-file Revert transaction retaining the open document identity, guarded background decoding and unchanged state on failures. Bind existing factory Save a Copy/Revert entries. Add document.revert to the Photato typed API, reuse its native method with permission/revision/share/session/size checks, and expose copy/revert capability/state metadata. Downloads remain the API copy operation; no invented Adobe route or additional Adobe support claim. Add nine tests for copies, aliases, errors/cancellation/staleness, imported/native Revert/Undo/Redo, loopback API and revocation, factory shortcuts and conversion disclosure. Full source-format Save/Save As and codec representability remain open.

4. focused01 stops during compilation because the new persistence file omitted its PhotoCraftImaging import for RGBChannelView. Preserve the failed source/log, add the explicit module import and rerun the same focused scope; no tests ran in the failed attempt.

5. focused02 compiles the app but fails compiling the new test: NSSavePanel.allowedContentTypes is nonoptional in the current SDK. Preserve that test/log and remove the incorrect optional chaining. No test-execution claim is made for this attempt.

6. focused03 reports Swift concurrency errors for the asynchronous test wait helper: sending XCTest self from main-actor tests to its concurrent method risks a race. Preserve the failed candidate/log and annotate that polling helper @MainActor; no unchecked actor annotation is added. A guessed WorkspaceLibrary.swift path is absent; use a symbol search for the preference location.

7. focused04 passes62 tests in6.061 seconds, zero failures/skips. Audit AppKit autosave semantics: autosavesInPlace would replace the explicit saved version used by Revert. Disable in-place autosaving while retaining AppKit’s separate recovery-autosave path and add a real autosave callback test proving the source remains unchanged. Adobe’s current saving guide permits original-file replacement after a warning, so the native Save panel’s confirmed replacement now explicitly authorizes that copy target; direct unconfirmed programmatic copies still reject original aliases. Add qualification for confirmed replacement without clearing dirty/history. This is an additional behavior correction, so freeze/test only after it passes.

8. focused05 passes63 tests in6.908 seconds with zero failures/skips, including real AppKit recovery autosave, confirmed replacement and ten new persistence tests. Freeze383 source/test files and prepare a separately identified Debug app for live checks; snapshot shared workspace preferences and copy the original procedural native probe. Source-format persistence/format controls remain open, along with exact live Photoshop Revert behavior.

9. The isolated Debug app passes live saved-native Open, opacity edit, Option-Command-S Save a Copy/PNG selection and save, F12 Revert Cancel/confirm, Command-Z Undo/Shift-Command-Z Redo and clean Close. The procedural source and shared workspace stay byte-identical; the PNG copy exists at96×64. Preserve AX states/screenshots and request validation-app Quit; verify its termination separately. The original Photoshop and PhotoCraft applications are preserved. Begin full and optimized regression checks on the frozen383 files; package after tests pass.

10. Review finds a stale hardcoded fourteen-command count in the API window footer. Preserve the pre-change file and replace only that literal with the typed registry’s count, preventing future drift. The full01 test binary and live app were already compiled from the first383-file freeze; freeze02 differs in this one display string only. Optimized tests and packaging will compile freeze02. Retain that exact distinction in release evidence; do not claim the two binaries are identical. CUA inventory now confirms the validation app has quit; original Photoshop/PhotoCraft remain running.

11. During final review, tighten the remaining concurrent lifecycle case: Save/Save As now share file-operation availability guards, copy encoding also checks that file association stayed unchanged, and a desktop edit during API Revert returns409 rather than the generic422 while retaining edits. Add a deterministic loopback busy/concurrent-edit test. Preserve the earlier candidate; full01 still runs its already-compiled first-freeze binary. The subsequent optimized/package stage must match a new freeze, and a final full02 run is required for these behavior changes.

12. full01 passes1008 tests in147.710 seconds, zero failures/skips, on its original compiled freeze. Preserve its rolling outputs while optimized tests are still compiling. Prepare a run-local final verifier requiring final383-file freeze03, full02/optimized results, updated154-bound/571-unavailable menu inventory, original source/checkpoint identity and clean universal packaging. Record the earlier live source and later guard/count changes explicitly.

13. Optimized tests on freeze03 pass310 cases in13.969 seconds, zero failures/skips; the universal build is running. Inspect the next D01 format dependency while it compiles: RasterIO always composites exports into sRGB and converts float PNG/TIFF to16-bit; PSDCodec preserves supported layer tags but rebuilds image resources/profile/global data instead of retaining every original resource. The codec correctly writes a profile matching its converted samples, but full profile/metadata-preserving Save As/save-back is not established. Keep source-format saving open and require representability/resource preservation before extending ownership. A guessed Validation.swift lookup is absent; validation is in Document.swift.

14. The original full/optimized/build pipeline reaches terminal success. Both architectures compile and build01 packages the final source. Preserve optimized rolling artifacts before running final full02 with ./scripts/test.sh on the unchanged383-file freeze03. The exact optimized filter includes DocumentPersistenceTests, DocumentIOWorkflowTests, DocumentWorkspaceTests, AutomationTests, AutomationActionJobsTests, TileArchiveTests, AdobeActionJobsTests, AdobeResourceTransferTests, PSDTests, PSDDepthTests, ImagingTests, OrientationTests, ComponentEditingWorkflowTests and PhotoshopMenuTests; those groups total310. Compiler warnings about RasterDecodeBudget Sendable and the legacy SwiftPM build-system option remain recorded.

15. full02 passes1009 tests in147.432 seconds with zero failures/skips on freeze03. package01 verifies both architectures/macOS14/clean ZIP signing and the383-file source. A separately identified copy of that universal Release binary exposes a remaining live Save defect: Command-S and File > Save write the correct0.75 opacity to disk, but the tab’s unsaved marker remains visible. Inspect AppKit’s updateChangeCountWithToken completion path and the custom shared-window presentation. Preserve the package and candidate before repair, add a real AppKit Save completion/workspace regression, and retain the failed live evidence. A guessed PhotoCraftTests path is absent; the test target is PhotoCraftAppTests. This finding prevents final acceptance of freeze03’s live Save presentation.

16. The first Save regression passes for disk data, NSDocument’s dirty flag and NSWindow presentation; it does not reproduce the stale tab. Extend it to inspect the real hosted DocumentTabButton after Save: before02 fails exactly that assertion. Root cause is observation placement: the parent tab strip reads workspace.revision, but stable ForEach child content does not observe the save-only change. Add the revision dependency to each documentTab child; no NSDocument completion override is necessary. The superseded Release validation app closes the saved probe without a save prompt, further confirming a presentation-only defect. Command-Q leaves it running in this check; explicit Photato > Quit terminates it, verified in app-cleanup02-final.json. Preserve both test attempts and the failed UI evidence.

17. focused06 passes65 tests with zero failures/skips after the tab observation repair, including the formerly failing real Save/button-title check. Freeze the383 source/test files as freeze04 and preserve rolling evidence before final full03, optimized release-focused02 and universal build02. The previous1009/310/package01 results remain valid historical evidence for freeze03 but no longer qualify the current source. Full D01 and global Photoshop parity remain open.

18. Final full03 passes1010 tests in146.367 seconds, zero failures/skips, on freeze04. Preserve rolling full-run artifacts while the optimized binary compiles. Documentation consistency confirms105 work packages,645 command mappings, four valid API JSON examples,383 unchanged source/test hashes and the unchanged Xcode project. The full goal remains active and D01 stays open. The new regression adds one test; no major workflow is marked closed by these passes.

19. release-focused02 passes311 optimized tests in13.921 seconds with zero failures/skips on freeze04. Preserve its rolling artifacts before build02 finishes; both API interfaces are included in the affected regression scope. Universal packaging is still running. The next source review confirms native-only Save/Save As cannot simply enable every imported format: document ownership must follow explicit representability and profile/resource preservation rules. Keep those requirements in the D01 queue rather than calling Copy support full persistence parity.

20. build02 reaches terminal success and package02 verifies freeze04, universal arm64/x86_64 macOS14 targets, clean ZIP signature, licenses/icon/links and Xcode project. The Desktop copy again fails strict signature after Finder/File Provider metadata appears; the clean ZIP/extracted app passes. A separately identified, re-signed copy of the final universal Release binary passes live Open/Command-S75%-opacity save with cleared tab marker;25%-edit/PNG Save a Copy without clearing dirty or overwriting the75% source; F12 Revert Cancel/confirm; Command-Z/Shift-Command-Z; and clean Close. Read the complete API window: transfer/Revert permission and dynamic15-command count fit, service stays off. Explicit application-menu Quit terminates the validation copy, verified by CUA inventory; original PhotoCraft/Photoshop and shared workspace preferences remain unchanged. Save final AX/screenshots/file hashes and live-ui-final-verification.json. Keep all earlier failed/superseded live/test/package evidence; no production-identity/Intel/macOS14 runtime or new Photoshop pixel equivalence claim.

21. package03 re-verifies the same final source/package and includes the final Release live evidence. Save ACTIVE_CHECKPOINT_110.json with the active goal, D01 open, final test/package/source hashes, cleanup, known limits and source-format saving as next work. Update README/current status/plan/command matrix/persistence and dual-API references; preserve checkpoint109 unchanged. Source consistency and all105 packages/645 mappings/four API JSON examples pass. All validation sessions are terminal. Refresh/check the development-history inventory after these records; this documentation audit does not rerun native tests or close the broader goal.

22. The first step110 history refresh/check passes:110 milestones,21,335 evidence files,12,605 logs and zero missing explicit references. Record the observed counts in the active checkpoint, confirm final source/package/Xcode/checkpoint109 identities and the finalized live cleanup, then run a second refresh/check after all documentation edits. No additional application changes or redundant native tests are introduced by the audit. Continue major D01 from the saved checkpoint; source-format Save/Save As and profile/metadata/representability gates remain next.

1. Receive the active goal continuation after step108’s priority change. Query the authoritative goal; it is active. Classify the previous implementation/checkpoint turn as verified progress, with no pending process to restart. Re-read repository instructions, current status, development log and priority/checkpoint records. Verify all378 source/test paths/hashes and the binary/ZIP against step107; preserve source/tests/configuration/current documents under [local evidence archive]. Keep the full Photoshop/native/universal/AI/API objective and new major→minor→details gates intact.

2. Inspect the105-package comprehensive backlog, current command matrix and native document/controller/import/API paths. The controller already decodes raster/PSD resources, but imported documents lose their origin and inherited Open panel behavior rejected a PNG in step106. Native persistence is currently .pcswift-only; full source-format Save/Save As/Revert and format interoperability remain broader major-workflow gaps. Reconcile the whole known backlog before choosing the next major increment; document-opening changes will not count as closure of the full document lifecycle.

3. Classify all105 original packages into major/minor/final scheduling, retain all645 current command mappings,62 tools and40 professional scenarios, and mark cross-cutting output/platform/scope requirements as applicable throughout. Save docs/FUNCTION_PHASES_109.json; no package-wide completion is inferred. Select D01 document lifecycle and format/API dependencies. Fresh reads of Adobe’s feature catalogue/open-import guide and Apple’s Open-panel API confirm relevant reference locations. Local AppKit headers specify readableTypes drives Open-panel filtering. Two guessed archive filenames and a guessed NativeMenuTests file are absent; locate NativeArchive in Document.swift before further inspection.

4. Implement shared DocumentIO decoding/encoding, explicit readable/Open-panel types, canonical imported-source deduplication and clearing that origin after native Save As association. Add optional authenticated API upload/download with native enablement, bounded request/pixel/raster budgets, shared codecs/history, stale/revoked/busy checks and capability schemas. Public archive decoding now permits a caller-supplied bounded raster budget. Downloads copy snapshots and never clear dirty/history state or accept local paths. No new Adobe desktop-open route is invented; the existing action-resource adapters retain their separately qualified subset. Add end-to-end native open/edit/save/reopen and real loopback transfer tests. Format the eight affected Swift files and start focused01; package/live claims await validation. Classify Timeline/video as a major workflow; cross-cutting gates and dependencies remain explicit.

5. focused01 fails during compilation before tests: NSDocument.fileURL’s setter is nonisolated, so direct mutation of main-actor imported-origin storage is rejected. Preserve the candidate and failed log. Repair with an actor-owned stored origin, a current-fileURL-aware getter for immediate identity checks and asynchronous cleanup in the existing main-actor presentation task. Also reject noncanonical duplicate-slash transfer routes. No passing-test claim is made for focused01.

6. focused02 passes54 tests in5.417 seconds after the actor-isolation repair. Add actual8/16/32-bit original Photoshop PSD and native archive transfers, capability discovery and deterministic disable/re-enable-during-decode rejection; recheck modal state after decoding. focused03 passes56 tests in6.715 seconds with zero failures/skips. Freeze381 source/test files. Create a separately identified, ad-hoc-signed Debug app from that binary for live validation, preserving the original running PhotoCraft process and a snapshot of shared workspace preferences. Generate an original96×64 RGBA PNG probe; no user image is used.

7. Live Debug testing opens the original PNG, edits opacity to50%, uses Command-S to save a new .pcswift file, closes it with Command-W and reopens it with the edit retained. Inspect the complete new API window; service remains off. Save screenshots and verify the native archive96×64/one-layer/0.5 opacity, unchanged original PNG and byte-identical shared workspace preferences. Quit the validation copy through its menu; CUA inventory confirms original PhotoCraft remains open. Correct the earlier Open diagnosis: Go-to-folder highlight left Open disabled, but keyboard Down selection enabled it; AX text clicking/double-click did not select. A stale AX index after a full-tree refresh was rejected without side effects. The disabled state alone is not evidence of a decoder/type bug. Preserve this correction in live-ui-verification.json rather than claiming a proved baseline repair.

8. Before final validation, name the optional transfer revision header X-Photato-Revision instead of borrowing If-Match with nonstandard bare-token semantics; preserve the earlier source. Native UI behavior is unchanged, while API tests and capabilities now use the explicit Photato header. Freeze the final source separately, preserve rolling artifacts and the step106 ZIP, then run full/optimized/package checks sequentially. The complete document lifecycle remains open; no phase transition or goal completion is claimed.

9. full01 passes998 tests with zero failures/skips in146.995 seconds on the frozen381-file source. Optimized compilation is live in the original sequential pipeline; preserve full-run rolling outputs before its tests start. The focused command is ./scripts/test.sh --filter DocumentIOWorkflowTests|DocumentWorkspaceTests|AutomationTests|AutomationActionJobsTests|TileArchiveTests, and the optimized command is ./scripts/test.sh -c release --filter DocumentIOWorkflowTests|DocumentWorkspaceTests|AutomationTests|AutomationActionJobsTests|TileArchiveTests|AdobeActionJobsTests|AdobeResourceTransferTests|PSDTests|PSDDepthTests|ImagingTests|OrientationTests|ComponentEditingWorkflowTests (shell arguments are passed as a single filter expression). The full command is ./scripts/test.sh and package build is ./scripts/build-app.sh. Prepare a run-local verifier; the older general package script is pinned to historical step058 counts and is not suitable for current release claims.

10. release-focused01 passes290 optimized tests in12.537 seconds with zero failures/skips. Source hashes remain frozen, and build01 is now running in the same sequential session. Documentation validation preserves all105 packages,645 current command mappings and the phase gates; both API JSON examples parse. The new original-PSD workflow checks qualify consistency with the shared native decoder and native archive retention, not new independent rendered-pixel equivalence. Keep current Adobe compatibility and historical component evidence distinct from the new Photato transfer routes.

11. build01 and package01 complete successfully on the same381-file final freeze. The run-local verifier checks998 full/290 optimized tests, both universal architectures and macOS14 deployment records, clean ZIP signature, icon/licenses/links, unchanged Xcode project and802-menu inventory. It verifies the only post-live changes are the explicit API revision-header names. The Desktop copy still has the known Finder/File Provider signature issue; the clean extracted app is verified and recorded. Save final evidence and docs/ACTIVE_CHECKPOINT_109.json, update current status/plan/README/API/command references, and keep D01 in progress with source-format Save As/Save a Copy/Revert and format/profile/durability requirements outstanding. All validation sessions are terminal; the full goal stays active.

12. The first step109 development-history refresh/check passes:109 milestones,17,746 evidence files,10,130 logs and zero missing explicit references. The earlier process-result observation was truncated; inspect both saved logs, then confirm its session handle has closed rather than restarting the completed audit. Update the active checkpoint with those observed results, verify the final source/package/project and preserved step107 checkpoint identities, and save final-consistency.json. Run a second refresh/check after these documentation-only updates, retaining separate refresh02/check02 logs. The first consistency diagnostic used an assumed executable name (PhotoCraft) and stopped with FileNotFoundError after source/ZIP checks; preserve final-consistency01-failure.json, read CFBundleExecutable from the actual app plist and repeat only the read-only identity checks. No application code changes or redundant application test runs are introduced; D01 and the full goal remain active.

1. The maintainer plans to unpause the master goal and requests a new completion order: all major functions, then all minor functions, then final small details. Treat this as a scheduling change for resumption, not an instruction to restart implementation during this planning turn. Query the existing goal; it remains paused. Preserve the affected instructions and documents under [local evidence archive]. No source or UI actions occur.

2. Save docs/WORK_PRIORITIES_108.json with phase definitions, completion gates, dependency handling and the first resume action. Necessary UI, menus/shortcuts, shared Photato/Adobe API coverage and relevant independent Photoshop validation are part of completing a function. Smaller prerequisites may be implemented with a major function; optional polish waits. Unresolved requirements remain open, and passing native tests alone does not prove Photoshop parity. The new order supersedes UI-first scheduling without reducing the full native/macOS/Photoshop goal.

3. Update AGENTS, README, current status and porting plan to make the new order discoverable. Keep docs/PAUSE_CHECKPOINT_107.json immutable as the exact verified implementation checkpoint; the new priority record supersedes its old next-work ordering. First resume work is to reconcile the existing backlog into the three phases with acceptance criteria, then select a major workflow. The observed File > Open restriction remains a candidate within major document/file workflows, not an automatic UI-first detour.

4. Verify all378 source/test hashes and the binary/ZIP/Xcode-project hashes still match step107, and preserve checkpoint107’s hash in [local evidence archive]. No implementation, APIs, command completion status, tests or package changes occur; do not rerun unrelated application tests. Refresh/check the development history, record the outcome and recheck the completed planning record. Leave the existing goal paused until the user unpauses it or explicitly requests resumption.

5. The initial history refresh/check passes108 milestones,15913 evidence files and8896 logs with zero missing explicit references. Record this outcome, then run final refresh02/check02 under [local evidence archive]. Checkpoint107 remains unchanged; implementation remains paused and no new test/build process was started.

1. The latest user message explicitly asks to pause after debugging the current additions/changes. Finish the already-running step106 final regression/optimized/build/package pipeline; do not start another feature. The original session returns terminal success. Preserve the current documentation and exact request under [local evidence archive] before finalizing the record.

2. Verify all378 current Swift source/test paths and hashes against the repaired step106 freeze, both terminal test-log hashes and990/279 passing counts, the packaged binary/ZIP and unchanged Xcode project. Save [local evidence archive]. No source, test, build setting, menu inventory or application package changes occur in step107, so no unrelated tests are rerun. The current increment retains version0.2.0/build2; no new version increment is implied.

3. Finalize README, current status/plan, API usage/compatibility, the three affected command-matrix rows, component integration references and rolling release evidence. Correct stale statements that targeting was still internal or that the registry contained12 commands; current coverage is14 document commands and a partial two-endpoint Adobe action/status subset. Six Adobe endpoints and full Photoshop parity remain open. Preserve prior failed/passing candidates and keep bounded Debug live evidence separate from universal package verification.

4. Save docs/PAUSE_CHECKPOINT_107.json with exact source/package/test evidence, repaired failures, runtime cleanup, limits and first resume actions. Both validation apps were quit after undoing the disposable edit; the original PhotoCraft process was retained. Shared Layers selection was restored through the UI, with all other fields equal to the saved pre-second-probe workspace; separate bundle identity does not isolate hardcoded workspace/preset paths. The next UI investigation is the observed File > Open PNG restriction, followed by broader component/API and Photoshop backlog work. No feature work or test/build session remains pending. Refresh/check the history inventory, record the outcome, refresh/check the completed record, then mark the existing goal paused and stop.

5. A final read-only strict signature check confirms the pre-existing Desktop/File Provider packaging limitation still applies: the Desktop build copy reports resource-fork/Finder metadata, while the clean ZIP extraction passes. Preserve both outputs in [local evidence archive] and set the checkpoint app_path to the verified extracted app. Do not label the Desktop copy signature as passing. This changes no source, binary or ZIP bytes.

6. The first history refresh/check passes107 milestones,15910 evidence files and8896 logs with zero missing explicit references. Record that observed outcome and the exact pause boundary, then reverify the frozen source/package/project identity and refresh/check the final record into unique refresh02/check02 logs under [local evidence archive]. Once those terminal checks pass, set the existing goal paused as explicitly requested and stop. The overall Photoshop-equivalence objective remains unachieved.

1. Receive the new goal continuation after the requested step105 pause. Query the authoritative goal state before editing; it is active again. The previous turn is verified checkpoint progress, not a pending build. Re-read repository rules and current status/log; verify all374 Swift source/test hashes against the tested step103 freeze. Preserve source/tests/documents under [local evidence archive]. Resume the saved component target/Fill/dual-API integration. No source work is pending from step105. A guessed ComponentFill.swift read fails; discover the actual filename before reading. Keep original Photoshop user documents untouched.

2. Implement document-local component editing targets independently of RGBChannelView, native Channels selection, factory Command2–5 routing, Normal component Fill opacity and reset/mask lifecycle. Add shared transaction guards for unported component writers and direct prepared edits, plus canvas/filter/clipboard entry guards. The qualified RGB8 kernel is reused; unsupported component operations remain explicit gaps. Add Photato channel.target/channel.fill, state/schema updates and preserve view-only commands. Wire both Photato isolated action-job routes and the Adobe execute-actions/status subset over the existing job/asset engine, authenticated hosted delivery, optional native enablement, revocation and route-specific4MiB request bodies. Existing document commands retain64KiB. No external service/upload or live native UI is exercised yet.

3. Add desktop/HTTP history, busy/stale/invalid/unsupported-writer, shortcut/mask/reload tests and two-interface job tests using original Photoshop fixture bytes. Preserve candidate01 before formatting changed files. Code inspection catches an overly broad text replacement introducing store references into static capability schemas; repair before compilation. Guessed ToneEditing.swift and AdobeActionAssetsTests.swift reads fail; actual files are discovered, and the resource-pipeline tests reside in AdobeActionJobsTests. Read pinned Adobe route/response schemas directly; conformance remains limited to the implemented action subset and requires validation. Run focused01 via ./scripts/test.sh --filter 'ComponentEditingWorkflowTests|AutomationActionJobsTests|AutomationTests|ChannelViewWorkflowTests|AdobeActionsRequestTests|AdobeActionJobsTests|RGBComponentFillTests'.

4. focused01 compiles and executes47 tests:46 pass and one existing machine-schema assertion fails because it still expects12 rather than14 commands. All seven new component/job tests pass, including122880 independent Photoshop output bytes through the desktop and each public job interface, history/context guards and authenticated job lifecycle. Repair the remaining catalogue count; add a full native loopback input-transfer/job/status/output test and preserve Adobe error envelopes for pre-handler framing/host/origin failures. Disable new-layer/mask creation entry points in unsupported component context. Additional guessed LayerMaskInteraction.swift read fails; actual assignments are found with rg before relying on behavior.

5. Re-open Adobe’s live GA guide and its consolidated migration reference. The guessed trailing-slash action/status guide URLs return404; keep the working consolidated reference and pinned OpenAPI as evidence, not a fabricated fetch success. Current references retain execute-actions, status, inline ActionJSON and asynchronous acceptance. Preserve the distinction between local bearer credentials/hosted outputs and Adobe identity/storage services. Run focused02 after format02; no live Adobe job or external upload is performed.

6. focused02 passes all48 tests with zero failures/skips in2.089 seconds, including the actual URLSession loopback resource/job pipeline and original Photoshop fixtures through both APIs. Freeze all378 Swift source/test hashes and preserve current rolling [local evidence archive] package before full01. Full suite command is ./scripts/test.sh; later results must match this source freeze. Native live UI and universal packaging for this source remain unqualified until their separate checks finish.

7. full01 passes all988 tests with zero failures/skips in145.931 seconds. All378 frozen Swift source/test hashes remain identical. Preserve current full-run rolling artifacts before optimized checks. Start release-focused01 with component/dual-API, resource transport, action interpreter, codec/depth/orientation and channel-view regression coverage; then build01 and package01 sequentially only after successful preceding validation. Prepare a current-scope package verifier with unchanged menu inventory, current14-command/partial-two-endpoint API facts and no unperformed live UI claim. CUA inventory shows the pre-existing PhotoCraft process remains running; preserve it and use an isolated validation copy for any new native UI checks.

8. release-focused01 passes277 optimized tests with zero failures/skips in8.381 seconds; the regex includes the imaging test module broadly. build01/package01 pass universal arm64/x86_64, both macOS14 deployment records, signatures, original icon/notices/links, unchanged Xcode project and frozen378-file identity. Preserve those results as pre-live qualification; they do not close UI validation. Create an ARM64 optimized validation app with a separate bundle identifier/ad-hoc signature, retaining the existing PhotoCraft app and its preferences/documents. Native Channels row targeting and Command4/5/2 transitions work. Canceling Fill preserves the untouched new document.

9. Live inspection exposes a real Fill layout defect: the zero-frame NSStackView accessory overlaps alert text. Preserve fill-dialog-before.png and .txt. Transform/flip controls remain enabled despite component writer guards. Native Open disables the original PNG probe (separate imported-image path vs native-document Open); record that broader Photoshop File>Open workflow gap for subsequent work. Go-to-folder typing/paste/Return produced confusing intermediate states and a clipboard timeout; Escape revealed the selected probe. Cancel the Open panel and use only the isolated default blank document. Cancel Fill, restore RGB and invoke Quit through the app menu; the post-Quit AX request reports procNotFound. Confirm shutdown separately before replacing the test copy. No user document was opened or edited.

10. Preserve the whole candidate source/tests, source freeze, package and package report under before-ui-repair. Give Fill an explicit native accessory frame, share a component-aware transform availability predicate with menu/Properties controls, and disable component-incompatible Quick Actions. Code review also finds that error-envelope detection decodes body bytes along with the request line; change it to inspect only the bounded first line so invalid or split UTF8 bodies cannot switch Adobe errors to Photato shape. Add regression coverage for that error and high-depth target rejection. Revalidate the repaired source before any final release claim.

11. focused03 passes39 component/API/menu tests with zero failures/skips in1.801 seconds after the repair. Live Debug copy UI02 shows clean separated Fill controls, disables component-incompatible transform/flip/position/Quick Actions, applies50% Black to Red, displays the expected cyan composite, removes the dirty marker on Undo and restores it on Redo. Undo again, restore RGB and the initially observed Layers panel, and quit via the app menu. CUA inventory confirms both validation copies stopped while the original PhotoCraft remains running. Last-tab close clicking alone did not establish closure; do not infer success from that action. Live evidence is in live-ui-verification02.json and the before/after dialog/result/undo captures.

12. Correct the UI-isolation account: separate bundle identity isolates native defaults but not the hardcoded Photato/Workspaces.json or preset libraries. No presets were edited. The only observed workspace change was Layers-to-Channels; restore Layers through the UI and verify every other JSON field equals workspace-before-ui02.json. Preserve workspace-after-ui02.json. No unsupported byte-identical-before-first-probe claim is made. WorkspaceLibrary is actually in SavedWorkspaces.swift; a guessed separate file read and an unmatched Properties glob failed before file discovery. Freeze378 repaired source/test hashes in tested-source-hashes02.json, preserve rolling outputs again and run full02, release-focused02, build02 and package02 sequentially with unique evidence. Keep the complete Photoshop/native/byte-exact/platform goal active.

13. The latest explicit user message requests a pause after debugging the current additions/changes. Honor this request after the already-running final validation; do not begin another feature. full02 has completed990 tests with zero failures/skips in145.803 seconds. Optimized tests, universal build and package verification remain sequentially in progress in the original session. Update the stale README step092 pause notice and the API paragraph still describing the step102 module as unexposed. These documentation corrections do not change the frozen source. Save a new complete pause checkpoint after terminal validation.

14. Final repaired-source validation completes: full02 passes990 tests in145.803 seconds and release-focused02 passes279 optimized tests in8.292 seconds, zero failures/skips. build02/package02 verify universal arm64/x86_64, macOS14 deployment records, clean ZIP signature, supplied icon/notices/links, unchanged Xcode project/menu inventory and378 frozen source/test hashes. Preserve final results in release-verification02.json. Existing compiler diagnostics remain in logs; no global Photoshop byte equality or Intel/macOS14 runtime claim is made. Native live evidence belongs to the repaired Debug copy, not a production-identity launch of the universal package. Complete the current increment and move directly to the user-requested step107 pause record.

1. The active user goal resumes after the explicit step104 pause. The preceding goal turn made checkpoint/evidence progress and ended with no pending test/build session. Re-read repository instructions, status/plan and the saved pause checkpoint. Verify all374 Swift source/test hashes and packaged app/ZIP hashes still match the tested baseline. Preserve source/tests/documentation before edits under [local evidence archive]. Continue actual native component targeting and Fill UI, both public API paths and integration tests; keep full Photoshop/native/exact-output/platform requirements unchanged. The current preview-only API operations must retain their meaning.

2. Investigate native component targeting and public integration without editing application source. Inspect EditorStore command/history and view state; ChannelsPanel/ChannelPanelOptions preview controls; Fill menu/validation; document/floating-window/Canvas keyboard routing; direct prepared commits in transform, clipboard and duplication; and existing automation request/state/job boundaries. Guessed WorkspaceShortcuts.swift and WorkspaceKeyboard.swift reads fail; file discovery identifies DocumentWorkspace.swift, FloatingPanelWindows.swift and CanvasView.swift instead. The candidate design separates editing target from preview, guards every pixel-writing route, preserves existing view-only API meaning and uses the qualified RGB8 neutral Fill kernel. These are findings and proposed work, not shipped capabilities. Save details in docs/PAUSE_CHECKPOINT_105.json.

3. The latest user message requests another pause once debugging is complete. No new code has been added since the repaired and tested step103 baseline, so do not begin the proposed feature expansion. Re-read repository requirements and previous qualification. The initial broad file discovery includes archived copies and truncates; restrict subsequent reads to current files. At 2026-10-19T17:46:26.520319+00:00, a Python hashlib/path-set verification confirms all374 Swift files match both the step103 test freeze and step105 starting snapshot; every source/test file also matches the preserved step105 tree. Full980/optimized80/focused33 log hashes and terminal summaries match their successful historical results. App binary, ZIP and Xcode project match their recorded hashes; version remains0.2.0/build2. Preserve the result in [local evidence archive]. This is current hash verification of prior tests, not a new test run. No source, test, build configuration, menu, API, package or live application interaction changes occur.

4. Preserve current documents before the pause update under [local evidence archive]. Save docs/PAUSE_CHECKPOINT_105.json with the exact source/package/test evidence, repaired defects, component/transaction/keyboard/API investigation, pending integration and first resume action. Update STATUS, PORTING_PLAN and AUTOMATION_API to paused. Command parity is unchanged. No test/build process was launched during step105 and no earlier validation session remains pending. Run the required development-history refresh/check, record its outcome, refresh/check the completed record, then mark the existing goal paused and stop. The full Photoshop-equivalence objective remains unachieved.

5. History refresh01/check01 passes with105 milestones,14464 evidence files,7964 logs and zero missing explicit references. Record this observed outcome, then run the final refresh02/check02 into [local evidence archive]. Verify the source/package identity once more before the pause tool. This closes the documentation checkpoint without starting any feature implementation or rerunning unrelated tests.

1. The user explicitly requests a pause after debugging the latest additions/changes. Step103 has already repaired its two observed failures, passed980 full/80 optimized/33 final focused tests with zero failures/skips, and verified the universal package. Re-read the development requirements and current records. Preserve current documentation and verify the existing evidence rather than running unrelated tests again.

2. At 2026-10-13T18:33:05.487415+00:00, all374 current Swift source/test paths and hashes exactly match the tested source freeze. Test-log hashes/counts and app/ZIP/Xcode-project hashes also match the qualified checkpoint. Record this read-only check in [local evidence archive] and save docs/PAUSE_CHECKPOINT_104.json with exact source/package evidence, repaired defects, scope limits, outstanding integration and the first resume action. No application source, package, menu, setting, capability or API contract changes in this pause step; no new tests/builds are needed. All previously launched validation sessions returned terminal success; no work remains running from them.

3. Update the current status/plan/API documentation to reflect the user-requested pause. Keep the full Photoshop-equivalence objective intact and unachieved. Next work remains actual component targeting/Fill/tool routing and both public API integrations over the qualified native modules. Refresh/check the development-history inventory, then set the existing goal to paused and stop feature work.

4. Pause-checkpoint history refresh01/check01 passes:104 milestones,14353 evidence files,7964 logs and zero missing explicit references. Record the repaired latest failures explicitly in the resume checkpoint, then refresh/check again into unique refresh02/check02 logs. Source, tests and packaged outputs remain unchanged. The pause tool is the final action after this documentation audit.

1. The prior goal turn is progress: independent expanded Photoshop references changed RGB8 opacity arithmetic, the new core transaction passed953 full/34 optimized tests, and its universal package verified. Re-read repository instructions/current queue and verify all365 tested Swift hashes before work. Preserve baseline records under [local evidence archive]. Continue the unfinished real component editing feature with Photoshop action descriptors and a shared native Adobe adapter/jobs/resources foundation, preserving the Photato interface and treating UI/dual-API coverage as feature completion requirements. No validation process is pending.

2. The current CUA surface does not reveal usable Actions controls after Window > Actions, clicking its collapsed icon or factory Option-F9; screenshots keep showing the collapsed main-workspace layout. No new action or document edit is recorded. Read Adobe's official ActionJSON and BatchPlay guides; direct Development recording needs a settings change/restart and the current menu lacks it. Do not disturb the modified user document for that route. Inspect installed factory .atn files instead with a standalone bounded Python descriptor reader. Eight files parse to their exact end; Frames and Default Actions fail and are excluded. Preserve both errors. Fully decoded Textures/Text Effects supply actual Select RGB and Fill white/black/gray/opacity/Preserve Transparency descriptors. The installed Terminology.jsx provides factual Red/Green/Blue/channel identifiers; record its hash and selected mappings without executing or redistributing the vendor script. A CR-delimited vendor script causes an overlong rg result; later extraction reads just selected facts. Initial provenance assembly fails with KeyError(name); correct to the parser's action key before producing action-descriptor-provenance.json. Source preservation had already completed; do not repeat or overwrite it.

3. The authoritative Adobe v2 contract permits typed resource and output variants and defines asynchronous job envelopes. Current official guides conflict on embedded image output (some examples use it, while restrictions limit embedding to text). Preserve that uncertainty; do not claim a guessed result envelope as conformance. Implement the native actionJSON interpreter first over Command.fillComponents, with strict validation and atomic isolated-document execution. It is the shared algorithm adapter needed by the eventual jobs/resource transport, not a new advertised endpoint. Preserve all source/tests before edits. Existing desktop and12-command Photato API remain intact until real target/UI and both applicable API paths are integrated.

4. Retrospective implementation/test record after the webpage-location interruption: add PhotoshopActionProgram.swift with bounded native actionJSON parsing, independently evidenced select/fill identifiers, strict unsupported-option errors and atomic value-copy execution through the shared component command. Seven core tests include all122880 Photoshop reference bytes, raw identifier aliases, malformed/oversized/deep input, cancellation and no partial return on failure. focused01.log records13 tests, zero failures/skips. Add AdobeActionsRequest.swift and seven app tests for the pinned request limits, ordered multiple resources sharing target/history, resource/output variants and the separate Adobe error envelope. Add a seeded EditorSession overload so subsequent resources retain history and target. focused02.log now authoritatively confirms20 tests passed, zero failures/skips in0.125 seconds (suite wall0.128). Neither adapter is exposed as an HTTP endpoint yet. Selected schema assertions do not prove service conformance.

5. The preceding webpage-location reply made no native-goal progress. Re-read the repository instructions and current queue, and inspect the existing focused02 terminal log rather than restarting it. The suite finished successfully; a restricted process-list check was unavailable, but no retry is needed. Continue the image resource/job foundation needed to finish this same component/UI/dual-API increment. Correct the guessed CraftNSDocument.swift read through source discovery; do not infer behavior from a missing filename.

6. Extend the shared native RasterIO import/export with in-memory Data entry points; file exports delegate to the same encoder. Add AdobeActionAssets for bounded PSD/PNG decode, shared action execution and complete output encoding before publication. Add AdobeActionJobs for ordered asynchronous isolated-document jobs, bounded queue/storage, hosted expiry, cancellation/generation revocation, status/error envelopes and external-output failure handling. Add NativeAdobeResourceTransport/AdobeResourceTransfer with per-transfer ephemeral URLSession, byte ceilings during download, conditional PUTs and explicit redirect/Dropbox limitations. Read Adobe’s current migration reference plus Microsoft Put Blob and AWS conditional-write primary documentation. No external upload was performed, and these internal modules remain unadvertised pending service/UI integration. New regression cases cover native output equivalence, lifecycle/expiry, revoke-and-restart, failure isolation and sensitive URL redaction. focused03.log preserves a compile failure because document.resolution is optional; repair export to use the desktop/default72 fallback. No tests executed in that failed attempt.

7. focused04.log executes25 tests and preserves one failure: the PNG test expected RGB8, but passing the renderer’s f32 working surface to the old surface encoder produced16-bit output. Add document-level RasterIO encode/write overloads that choose the document depth and pixelsPerInch; route desktop Export Flattened Image and the API asset encoder through that shared path. Retain the surface overload’s existing semantics. Add native transfer tests for streaming byte ceilings with/without Content-Length, unsuccessful/partial statuses, redirects, cancellation before/during transfer, signed PUT headers and real loopback HTTP. focused05.log passes31 tests with zero failures/skips in0.267 seconds. No external storage service was contacted.

8. Extend validation through the full native PSD input/action/output pipeline: reconstruct original input planes from the existing independently decoded fixtures, encode input, run the request adapter, decode the output and compare all122880 expected Photoshop plane bytes across five cases. Add RGB8/RGB16 document export depth and300-dpi checks. focused06.log passes33 tests, zero failures/skips in0.609 seconds. This qualifies bounded PSD layer samples, not whole-file equality, PNG Photoshop exactness, live HTTP endpoints or all Adobe actions. Freeze the current Swift source/test hashes, preserve rolling artifacts and the previous packaged ZIP, then run full regression and optimized affected suites before packaging. The current UI target/Photato command/Adobe service integration remains unfinished; no new capability is advertised.

9. full01.log completes all980 package tests with zero failures/skips in144.372 seconds; the source freeze still matches all374 Swift files. Launch the optimized affected suite covering action/request/job/transfer modules, image/PSD/depth/orientation codecs, component Fill and existing automation/channel workflows. Preserve all compile warnings and diagnostic output. Update command notes, component/API manifests and AUTOMATION_API.md to distinguish internal foundation from the still-unimplemented eight Adobe HTTP endpoints and unchanged twelve Photato commands. Read the CUA control documentation for possible native export qualification; no app launch or UI action has been performed in this validation phase.

10. release-focused01.log completes80 optimized affected tests with zero failures/skips in0.995 seconds. Build the universal app with the native access required by iconutil, using build01.log; do not repeat the already demonstrated sandbox-only icon failure. The prior ZIP and packaging hashes are preserved. Reuse the step102 packaging verifier with explicit374-file/980-full/80-optimized/current-feature scope, retaining clean ZIP signing, architectures, macOS14 metadata, notices/icon and unchanged Xcode-project checks. Capture actual host metadata. Keep the existing menu/API inventory unchanged; desktop export depth is the only new public behavior in this foundation checkpoint and is tested through the same encoder as the internal API resource path.

11. build01.log succeeds for arm64 and x86_64. Desktop File Provider adds disallowed Finder metadata on the initial local-copy signature check; the existing bounded cleanup/retry succeeds, so no rebuild or icon edit is required. package01.log verifies the clean extracted ZIP signature, both macOS14 deployment records, both architectures, original icon/notices/links, unchanged Xcode project and all374 frozen Swift hashes. The packaged binary and ZIP hashes are bound in release-verification.json. Update the rolling release summary only after preserving its prior version. No new native UI workflow is qualified by packaging; the last live channel checks still belong to step101. Photoshop and the pre-existing native application were not manipulated during this validation phase. Finalize STATUS, PORTING_PLAN, COMMAND_PARITY and ACTION_JOB_REFERENCES with980 full/80 optimized/33 final focused results. Run the development-history refresh/check before ending this goal turn. Next continue real component edit targets, Fill dialog/tool routing and both public API interfaces with full client/authentication/asset delivery tests; keep the full Photoshop/native/exact-output/platform objective active.

12. Development-history refresh01/check01 passes:103 milestones,14351 evidence files,7964 logs and zero missing explicit references. Add this observed outcome and refresh/check again into distinct refresh02/check02 logs so the final inventory includes the completed record. There is no live test/build job to wait on and no blocking condition. The full user goal remains active and unachieved; source/action/job progress does not close the UI, public dual-API, byte-parity or platform backlog.

1. Continue the full active user goal after step101. The previous turn is progress: independent RGB visibility, typed API, pointer-conflict repair,947 full/117 optimized tests and live universal qualification are complete; no process remains pending. Re-read repository instructions/current queue and verify all363 tested Swift hashes before work. Preserve documents/source hashes under [local evidence archive] Component editing must be implemented as real transactions, not conflated with the view-only commands. Inspect original Rust channel routing and acquire independent Photoshop fill/transparency/undo outputs on disposable original fixtures before committing to the native target model. API review must include both Photato operations and Adobe execute-actions job semantics where the published contract applies.

2. Retrospective completion of the reference record on 2026-10-13 after the webpage-location interruption: create an original64×64 PNG with RGB32/96/192 and four alpha stripes255/192/128/0; use Photoshop27.2 to save baseline, Red White100%, Undo Fill and Red White50% PSDs. Preserve dialog/result/undo/cleanup trees and screenshots in the step102 run. Independently decode raw layer planes with inspect-component-reference.py (portable second version; retain the initial version). Both analysis01/02 pass:100% produces Red255;50% produces Red144 at every stored pixel independent of alpha; Green/Blue/alpha remain byte-identical; Undo restores all12288 stored channel bytes. Layer bounds remain48×64, excluding the fully transparent trailing stripe. Restore Foreground Color/Normal100% Fill choices and RGB view, close the disposable document, and leave the original modified Untitled-1 untouched. These are RGB8 layer-plane comparisons, not full PSD-file or global output equivalence.

3. Inspect original Rust channel_cmds.rs, fill_cmds.rs, fill_key_cmds.rs and commands.rs. Compile and execute the original Normal composite math, stripping only serde annotations as in the existing oracle generator. The50% candidate yields Red144/159/180 for alpha255/192/128, unlike Photoshop's constant144; preserve rust-component-candidate.rs, rust-candidate01.log and rust-candidate-comparison.json. Reject alpha-weighted RGBA composition followed by channel restoration for component Fill. This executes the original composite function, not the full Rust application pipeline. Correct failed guessed paths edit_fill_cmds.rs, Pixel.swift and NativeMenu* using file discovery; no source changes occurred during those failures.

4. Inspect the pinned Adobe v2 ActionsRequest, ActionsOptions, image/resource/output and job schemas and the official execute-actions migration reference. Inline actionJSON is a stringified array in options.actions[].source.content; the guide requires contentType application/json, while the pinned schema describes that field less strictly. The shared native component operation will need Photato command/state/schema coverage plus Adobe actions/jobs/assets integration; no invented Adobe component route or premature conformance claim. Exact action descriptors still require independent reference. No Adobe service job, credential or proprietary model was used.

5. Resume after the user-facing webpage-location reply. That reply is no native-goal progress; revalidate the actual step102 files and repository requirements before proceeding. Existing native Fill is a five-content NSAlert for Normal100%, routed to Command.fill; it has no component target. Failed guessed reads SelectionControls.swift and Raster.swift are corrected through file discovery. Expand the independent RGB8 reference to all256 input levels and alpha holes before implementing the internal transaction foundation. Keep desktop/API capability advertising unchanged until the complete feature, both applicable interfaces and their validation are integrated.

6. Generate the original256×32 RGB ramp with alpha255/192/128/0 bands and an opaque final column retaining full bounds. Photoshop saves ramp-baseline.psd, Red White50/33 and Black50 PSDs, undoing each preceding edit before the next case. Restore original Fill settings through a disposable edit/undo, verify Foreground Color/Normal100%, cancel, return to RGB and close without a save prompt. The original modified user document remains untouched. Independent ramp-analysis01 finds full-plane identity for Green/Blue/alpha; hidden Red samples at alpha0 change. Floating interpolation fails768 byte positions for White33 and4096 for Black50; byte-quantized opacity matches every sample in all three ramps. This changes the required kernel from a naive scalar float blend to RGB8 integer weighting. Keep the tested scope explicit.

7. Verify363 baseline hashes and preserve all source/tests/package and rolling artifacts before implementation. Add RGBComponents, validated RGBComponentFill and Command.fillComponents using alpha-independent byte opacity/value arithmetic. A checked internal Surface.mapStoredPixels retains untargeted sample bits, skips unchanged writes, validates output and commits only after cancellation checks. Transactions preserve layer bounds/masks/metadata and existing history/stale safeguards. RGB16/32 reject explicitly until their separate arithmetic is established; no desktop/API capability is advertised yet. The current step102 implementation increment remains incomplete until real edit-target UI, Photato API and applicable Adobe coverage are integrated. Generate five independent expected RGBA cases directly from Photoshop PSD planes (245760 fixture bytes,122880 output bytes), with provenance and reproducible extraction script. Correct the failed Transform.swift read by discovering Geometry.swift.

8. Format only the four changed Swift files with xcrun swift-format. focused01 runs ./scripts/test.sh --filter RGBComponentFillTests: all6 tests pass, zero failures/skips,0.050s. They cover122880 exact Photoshop reference bytes/undo/redo, all7 native component combinations and preserved noncanonical sample bits, transformed document-space/fractional selections,14 rejection variants, no-op allocation/history, cancellation/staleness and atomic invalid output. Fractional selection and multi-component behavior are native invariants, not independently qualified Photoshop outputs. Existing SwiftPM cache/deprecation and unrelated concurrency/unused-variable warnings remain visible. Freeze365 Swift hashes and start full01 with AppKit/loopback access; outcomes follow.

9. full01 completes all953 tests with zero failures/skips in144.504s; all365 frozen Swift hashes still match. Preserve rolling artifacts and the prior qualified ZIP/package identity, then start optimized RGBComponentFill/SurfaceRegion/LayerVia/ChannelViewWorkflow/Automation coverage (release-focused01). No application behavior or API advertisement is changed during validation. Inspect official Adobe BatchPlay documentation: descriptor capture is available via Plugins Development recording or modifier-assisted Actions export. Current Photoshop Plugins menu exposes no Development submenu; preserve photoshop-plugins-menu.txt. Escape reports no AX change and a subsequent screenshot request is unavailable; do not infer a successful recording or modify Photoshop preferences. No probe is open and no user-document edit occurred in this read-only menu inspection.

10. release-focused01 passes all34 optimized affected tests with zero failures/skips in0.599s, including the independent PSD bytes and existing HTTP API regressions. Preserve rolling artifacts again and start build01 for both architectures and the standard universal macOS14 package. Adapt the step101 verifier to365 frozen Swift hashes,953/34 test counts, five-case component fixture hash, unchanged Xcode project and unchanged desktop/API surface; do not reuse its previous feature or live-UI claims. Packaging outcomes follow.

11. Recheck the Photoshop menu after the unavailable screenshot. Fresh full AX confirms Plugins is still open; invoke its explicitly exposed Cancel accessibility action. The returned document tree verifies dismissal and the original Untitled-1 title/geometry remain unchanged; save plugins-menu-cleanup.txt. App inventory confirms Photoshop and pre-existing PhotoCraft still run, while Photato is not running. This resolves the menu-cleanup uncertainty without changing preferences or inferring a system lock.

12. build01 compiles both architectures but exits1 at iconutil with Invalid Iconset before packaging. Preserve the log. Recreate all ten icon renditions in [local workspace] and record each successful sips output/hash in icon-diagnostic01.json; restricted iconutil fails again. The same directory converts successfully under approved native system access (icon-diagnostic02.log), identifying an execution-environment difference rather than an icon-source defect. Keep the original artwork/build script unchanged. Start build02 with native system access, unique log and unchanged tested sources.

13. build02 succeeds. package01 verifies the clean extracted ZIP signature, arm64/x86_64, both macOS14 minimum targets, bundled original icon/licenses/links, no fixture/test leakage, all365 tested Swift hashes and unchanged Photato.xcodeproj. Binary SHA256 is9cae0b3ce4aa6d96d083e601e37d0feb4bc05ee8745c11348618e6f41843ab16; ZIP SHA256 is4fe6ad411c6f021ff4ae2090db8adcf261254705cde68143a984e034dfea441b. The build02 local-copy signature also passes. No native app is launched for this core-only increment; no new live UI, Intel/macOS14 runtime or complete feature claim is made. Preserve the prior rolling release report and replace it with the current source-bound report.

14. Update STATUS, PORTING_PLAN, COMMAND_PARITY, existing channel references and both API records with the measured foundation and the explicitly incomplete UI/dual-API integration. Save docs/COMPONENT_FILL_REFERENCES.json, [local evidence archive] and [local evidence archive]. Next record actual select/fill actionJSON via Actions export, implement Adobe assets/jobs/status/contract adapters alongside typed Photato edit-target/Fill commands, and connect real Channels targets with factory shortcuts and target-aware tool availability. Maintain exact/native-only/platform/preferences requirements; RGB16/32 and other functions remain open. Refresh and check the evidence inventory; outcomes follow.

15. The first final audit refresh/check passes: 102 milestones, 13,459 evidence files, 7,341 logs and zero missing explicit references. A final hash check confirms all 365 tested Swift files remain unchanged and exactly four Swift paths differ from the step101 baseline: Engine.swift, Surface.swift, the new RGBComponentFill.swift and its new test file. Save post-validation-source-check.json. The core milestone has 953 full / 34 optimized passing tests and a verified universal package, while the complete component editing feature and the full Photoshop goal remain unfinished and active. Refresh/check again after this outcome note and final source-check record, under unique refresh02/check02 logs.

1. Revalidate repository instructions, status/plan, step100 channel evidence and all360 final tested Swift hashes. The preceding goal turn is progress: final package checks and independent Photoshop transition evidence changed the next implementation design; no validation process remains pending. Preserve source/tests, current documents, prior ZIP and workspace preferences under [local evidence archive]. Inspect EditorStore rendering/transactions, ChannelsPanel and both API requirements. A guessed Commands.swift path fails (actual implementation is Engine.swift); a Brush* glob has no matches. Discover the correct sources and continue. No production edits occur during those failed reads.

2. Plan the required visible-component state separately from the currently selected preview, preserving custom visibility combinations and unchanged document pixels/history. This is an incremental UI/rendering capability toward real channel editing; do not claim component edit-target support while pixel-writing tools still target RGB. Include matching typed Photato view operations/state/schema/preview and error/regression coverage. Search Adobe's official public sources for the missing contract before deciding corresponding Adobe coverage: the documentation hub says product contracts live in spoke repositories, while the legacy cis-photoshop-api-docs static directory contains swagger.json but no v2 file. The hub config page returns a web cache miss. Keep those failures distinct from a conformance conclusion.

3. Recover Adobe's authoritative contract through the live page's githubblobpath metadata, identifying AdobeDocs/ffs-photoshop-API. Sandbox DNS fails on the first hub fetch; preserve contract-fetch01.log and approved retries02–05. Retrieve the immutable Git blob 8db3553512c6a0ff0532c8a009cbb2c8210c8f41, verify its Git object hash, and preserve the217311-byte OpenAPI3.0.1 document (SHA2569916044d9a51ec1e3f622da8c4bd3d239ceef191077b4cb911d3d5ca5c046482). The documentation repository license is Apache2.0; the service schema separately references Adobe Creative API terms. No credentials or Adobe processing jobs are used. Eight paths are present; endpoint/schema inventory and local adapter qualification remain distinct tasks.

4. Additional Photoshop27.2 probes on the original step100 image show hidden Blue selection isolates Blue; the composite eye enables all components without changing the selected edit target; selecting already-visible Green retains all components; hiding the composite or last visible component leaves visibility unchanged. Preserve the ps-* screenshots/trees, restore Layers, close only the probe and leave the pre-existing modified document untouched. These observations qualify transitions, not pixel-byte equivalence.

5. Add RGBChannelView, independent Channels eye controls, shared native rendering, typed view.channelPreview/view.channelVisibility, observable channelView metadata and channel-preview.png while preserving preview.png's committed-composite contract. Keep explicit componentEditing=false and the preview-only UI notice: actual component editing and its factory shortcuts remain pending. Add imaging/native/real-HTTP regressions for all seven visibility combinations and RGB8/16/32, archive/history preservation, validation/auth/revocation/staleness and mask-view behavior. On resumption after the webpage-location response (no native goal progress), confirm edits exist, add row-level render cancellation, format the changed Swift files and preserve rolling artifacts before focused compilation. Test results follow.

6. Focused attempt01 stops at compilation: the new mask workflow test assigns the private EditorSession.document setter. Preserve its source and log; repair the fixture by constructing an EditorSession with the intended document, without changing production access control or assertions. Retry the same focused selection as focused02.

7. Focused02 passes46 tests with zero failures. Add capability result schema and HTTP assertions for its discovery and last-eye no-op revision stability. One patch misses a formatter-changed context and applies nothing; retry against the actual source successfully. Freeze all363 Swift source/test hashes, preserve pre-full rolling artifacts, and start full01 with separate captures. Pin the exact Adobe specification plus repository license/provenance; resolve394 internal references across162 schemas and inventory all8 endpoints as unimplemented/unqualified. The contract has no dedicated desktop channel-view-state endpoint; general ActionsOptions actionJSON/ATN/UXP execution remains an explicit gap. Update API usage, state schema and extension limits without inventing Adobe routes.

8. Full01 completes946 tests with16 failed assertions in the new HTTP workflow cases: commands receive409 before parameter/mask validation or execution. Preserve the complete log/captures, full01 source manifest and rolling outputs. These follow the earlier focused pass; do not infer a channel algorithm failure or relax production busy guards. Add test-only Boolean guard diagnostics (no document content, headers or tokens) to identify the conflict on reproduction. Repeat the affected ordering before deciding a repair. A read-only workspace-path search returns no matches; no file changes result.

9. Focused03 passes34 tests. Full02 completes946 tests with53 failed assertions; diagnostics consistently identify the system-wide pointer flag on unexpected409 responses, including pre-existing API commands. The ambient hardware button check incorrectly blocks a windowless shared document or a click in another app. Scope pointer conflicts to the active application's key document window, retaining every document gesture/draft/sheet guard. Inject only the hardware button reader for a deterministic real-HTTP regression: simulated unrelated pressed button permits preview, while geometryBusy still rejects mutation. Preserve full02 source hashes/log/captures/rolling outputs. The earlier step098 conflict remains historically unproven; this reproduction identifies the current failure, not retroactively its exact cause. Inspect original Rust channel routing for the next editing milestone; alpha display and multi-target semantics still require independent Photoshop qualification.

10. The pointer-scope repair passes24 focused tests (focused04). Freeze all363 source/test hashes and run full03, followed only on success by the optimized affected selection, universal build and adapted clean-package verifier. Full03 has947 tests expected because the deterministic unrelated-pointer HTTP regression is new. Inspect the small Channels hosted capture: eyes and independent previews are visible, rows remain aligned and the component-editing limitation stays readable. No Photoshop pixel equality is inferred. The pinned contract repository path is confirmed as static/photoshopv2-api.json from its API tree metadata (correcting the initially inferred src/pages/static prefix). Update the current command rows and porting queue; final package/live outcomes follow.

11. Full03 passes all947 tests with zero failures/skips in144.244 seconds on the frozen363-file Swift source/test state. The earlier full failures remain preserved and explained by current pointer diagnostics; no assertions were removed. Optimized affected tests are building next, followed by universal packaging and clean extraction verification. Confirm Photato.xcodeproj remains present with synchronized source groups. A guessed live-clean-package.txt reference from the older milestone does not exist; use actual manifests rather than infer evidence.

12. All117 optimized affected tests pass in12.307 seconds. Universal arm64/x86_64 Release compilation succeeds, but all3 strict checks of the Desktop app copy fail because Finder metadata is reattached. Preserve build01.log; do not claim that pipeline passed or recompile unchanged code. The separately staged clean ZIP verifies through package01: both architectures target macOS14.0, licenses/icon/resources/menu inventory and all363 tested Swift hashes match. Record generated app attributes, clear only that copy's extended attributes, and strict signature retry01 passes. The executable is c7d1fbb5af626f34636f6a904d1ee03447f81e0ce2c73a788fc97f5e7d398553; ZIP is3ca5d3a43c9eb1281fa4e5098d0857d3219b47a445c15f61729d2228bed7833f. Build targets do not certify macOS14/Intel runtime.

13. Launch the exact clean extracted package through CUA and open only the original64×64 channel probe. Paste initially reports a timeout; fresh Go To accessibility state proves the correct path is already entered, then Return/Open succeeds. Live checks qualify independent eyes, Red/Green preservation on selecting visible Green, hidden Blue isolation, last-visible no-op, composite-eye restoration without changing Blue preview, separate view state in Untitled-1, RGB reset and readable preview-only notice. Restore Layers, close the probe with no save prompt and quit the owned app. Immediate app inventory still shows Photato; an approved read-only process check confirms it has exited and only pre-existing PhotoCraft51407/Photoshop97810 remain. Original workspace preferences are byte-restored; all363 source/test hashes still match. Preserve live screenshots/trees and live-qualification.json; no Photoshop pixel-byte equivalence or component-writing claim is made.

14. Save CHANNEL_VIEW_REFERENCES.json, final record/release/live/Photoshop provenance and current API/plan/command notes. The authoritative Adobe schema has8 unimplemented endpoints; general actionJSON/ATN/UXP coverage remains open. Next work is genuine component edit targeting and temporary mask integration, with Adobe job/asset/action infrastructure for corresponding editing operations and independent output/shortcut/preferences qualification. All broader user requirements remain intact and incomplete. Refresh and check the complete development evidence index; results follow.

15. The development audit passes101 milestones,11705 evidence files and6105 logs with zero missing explicit references (refresh01/check01 under [local evidence archive]). The original probe SHA256 still matches its step100 fixture manifest exactly. Record this outcome, then refresh/check again into distinct refresh02/check02 logs. Goal remains active: the947-test result and bounded channel-view verification do not satisfy full Photoshop function/byte/shortcut/preferences/platform/API equivalence. No validation process or disposable native app remains running.

1. Inspect current ChannelsPanel, ChannelPanelOptions, EditorStore displayChannel and API preview/capability architecture. The current eye icons are decorative; a whole-row button selects a single grayscale preview, conflating selected and visible channels. Adobe's official channel-basics guide distinguishes eye visibility, selected edit targets and colored multi-channel views. Re-read its official page and the Photoshop v2 reference/GA guide; the reference still points to its separately embedded JSON contract. Before designing the native/API state transitions, acquire actual Photoshop2026 evidence on an original 64×64 RGBA probe. Generate deterministic pixels using Python standard-library PNG encoding and record provenance/hash under [local evidence archive]. The existing modified Untitled-1 remains untouched; only a separately opened disposable probe may be interacted with. No component edit, API conformance or byte-equivalence claim is made at this research stage.

2. Through CUA open only channel-probe.png in Photoshop, select its Channels panel, and capture twelve sequential RGB/component/eye/shortcut transitions. The saved screenshots show visibility independent of highlighted edit targets, grayscale for one visible component, colored R/G display, preservation of custom R/G visibility on Red reselection and Green selection, and isolation when selecting Blue from RGB. Command-4 selects Green; Command-2 restores RGB. The attempted last-eye-off state does not establish all-hidden behavior; preserve that uncertainty and the uncaptured intermediate composite-eye action. Restore Layers and close the probe without a save prompt. The original Untitled-1 title/modified marker is unchanged and no edit/save/undo targets it. Probe input bytes remain unchanged. Exact actions, version, artifact hashes and limitations are in record.json.

3. Recheck Adobe's reference and its explicitly linked JSON endpoint with the web tool; the endpoint remains inaccessible. A focused exact-filename search yields only the same embedded reference, not a verified replacement. Preserve this failure and do not infer that Adobe lacks a channel operation. Record the next native/state/transaction/API implementation sequence in next-implementation.json. Update current channel evidence, status/plan and the compatibility document's stale paused status. This research changes the next implementation design: a simple channel-selection-equals-visibility model would contradict the observed custom-visibility transitions. It does not implement component editing or qualify image-byte equality. No native source/test/package changes after step098 require another application build.

4. Final consistency confirms all360 source/test hashes, the universal app executable and ZIP match the tested step098 package; Photato.xcodeproj remains present and Photato workspace preferences are byte-restored. Preserve final-consistency.json. The evidence inventory refresh and check both pass with100 milestones,8682 evidence files,3946 logs and zero missing explicit references. Preserve refresh01.log/check01.log under [local evidence archive]; after recording these outcomes, rerun refresh/check into distinct refresh02.log/check02.log to bind the final narrative. Audit outputs are outside the indexed evidence tree. Full Photoshop equivalence is still contradicted by the tracked unsupported commands, component-editing/API gaps and unqualified platform/output requirements; leave the user goal active.

1. Continue the active UI-first parity goal after the panel accessibility repair. Inspect FloatingPanelWindows, dock header/menu routing, existing floating-host tests and the step092 qualification record. Preserve the current workspace and source hashes under [local evidence archive] before reversible live panel organization. A source lookup for DocumentWindows.swift fails because the implementation is named differently; discover its actual file before continuing. The initial scope is actual floating utility-window menus, focus and dock return, then pointer behavior where observable. Use only a disposable current Photato package and leave pre-existing PhotoCraft/Photoshop documents untouched. API review: qualification/repair of existing presentation input does not add editing capabilities; any resulting exposed-state change must be reviewed before completion.

2. Live Float Panel Group removes Layers/Channels/Paths from the main dock. CUA lists the running app but exposes no selectable utility-window surface; Raise produces the same main-window tree/screenshot. Preserve live-float-main.txt. This is a qualification limit, not evidence of a product failure; do not alter AppKit focus behavior merely to accommodate the tool. Reset Essentials restores the group/selection, preferences compare byte-for-byte, and quit the disposable app. Source/test hashes remain unchanged. Preserve record.json and live-reset.txt. Continue the next independent Channels work rather than repeating this known observation limit. No application regression rerun applies to this investigation-only milestone.

1. The active user goal resumes native parity work after the earlier pause and separately completed product webpage. Revalidate the saved checkpoint, source state, current process inventory and repository instructions. The last response only restated the webpage path and made no native goal progress; there is no live test/build handle to wait on. Both pre-existing PhotoCraft and Photoshop processes remain untouched. All360 Swift source/test hashes still match step092. Preserve baseline documentation, dock-header source and workspace preferences under [local evidence archive].

2. Follow the UI/menu/UX priority and step092's next recorded defect: panel flyout names can appear as generic Drag, despite the outer SwiftUI accessibilityLabel, particularly after sheet dismissal. Inspect dock header composition, native panel tab controls, observed sheet validation and existing regression coverage. Reproduce the actual accessible control before choosing a repair. API review: this is presentation/accessibility metadata, with no new editing capability; verify whether any exposed state/schema needs a corresponding change. Adobe-compatible coverage remains separately incomplete.

3. Auto-review initially rejects selecting the native app because the required post-compaction CUA documentation refresh was missing. Perform that refresh and retry successfully through the same supported tool. Live baseline inspection shows correct outer menu titles but Description: drag; cancelling Channels Panel Options changes all three flyouts to generic Drag. Preserve initial and post-dismissal accessibility trees. Restore the initially selected Layers tab and quit only the disposable clean Photato instance.

4. A proposed hosted accessibility regression cannot observe SwiftUI's generated menu elements: the protocol walker returns no menus and both tests fail on missing controls, not on the target defect. A second in-process native hierarchy trace reports AXUnknown for ordinary controls and likewise cannot qualify external assistive-technology behavior. Preserve both probes and failure logs in the run; remove the invalid harness from the shipped test suite rather than weakening its assertions or counting it as a reproduction. Apple's web accessibilityLabel page requires JavaScript and its linked Markdown fails with unsupported content-type; inspect the installed public AppKit accessibility protocol declarations as the local API reference. Existing hosted/native tests and live external accessibility verification will establish this presentation-only repair.

5. The first repair puts accessibilityLabel on the SwiftUI Image as well as the Menu. Thirty selected existing panel/sheet/channel tests pass, but live inspection still reports Description: drag; preserve candidate01.swift and live-candidate01.txt. Replace that candidate with an NSImage system symbol carrying the selected panel's native accessibilityDescription. Three sheet regressions pass. The second live candidate removes the erroneous drag description, follows Layers→Channels selection, and retains Color/Properties/Channels menu names after native Channels Options Escape. Restore Layers and quit the disposable candidate; the initial workspace preference bytes are restored exactly after baseline checks.

6. The implementation changes one native presentation source, WorkspaceDockView.swift. No image-processing algorithm, editing transaction, menu catalog/shortcut, model schema or automation capability changes. Existing API state does not expose assistive-control names, so no new endpoint or Adobe route applies; broad dual-interface coverage remains outstanding. Preserve rolling artifact files and the previous universal ZIP before full validation/package regeneration. Start the full native suite with unique logs/captures; qualification results follow.

7. Offscreen before/after native workspace captures match all1380×900 RGBA pixels exactly (zero changed pixels). The first comparison attempt cannot import PIL in system Python; use the bundled workspace Python/Pillow without installing anything, and preserve the failure note and successful visual-comparison.json. This equality qualifies the captured workspace only; it is not Photoshop output parity. Freeze all360 current source/test hashes for final verification.

8. The first full run executes937 tests with one failure: AutomationTests.testHistoryCannotRestoreDocumentsAboveAPILimits receives409 instead of413 for Undo. The API implementation is unchanged. Preserve full01 and its captures. Inspection shows409 can mean stale revision or an active desktop interaction (including process-wide pointer state); the original helper discarded the error body, so the exact cause is not established. All14 unchanged API tests then pass in isolation. Add test-only error-response logging (no token/header logging and no changed assertions), preserve its prior source, refreeze hashes, and repeat the full suite without simultaneous diagnostics/UI actions. Do not weaken production busy guards or infer that the isolated pass explains the original failure.

9. The diagnostic-enhanced full rerun passes all937 tests with zero failures/skips. Preserve before-release rolling outputs, then run the136-test optimized affected panel/menu/API selection, universal build and clean-ZIP verifier sequentially. The initial API conflict remains an unexplained intermittent observation; no acceptance criterion is relaxed. Preservation qualification: unique full01 logs/captures and pre-turn rolling artifacts survive, but intermediate rolling outputs were not separately copied between full01 and full02. Do not claim their full01 contents are reconstructed from the later files.

10. The following continuation revalidates the pending process instead of restarting it: session59281 exits0, all136 optimized tests pass, the universal build succeeds and the clean extracted ZIP signature/resources/arm64+x86_64 minimum14.0 package verify. The immediately preceding webpage-location response itself made no native goal progress; the completed pending validation supplies new evidence here. Launch the exact verified package through CUA. Channels Options Escape and Layers Options Cancel retain all three descriptive menu names; post-sheet Move/Float commands remain enabled. Save external accessibility trees and final-cleanup.json; all360 final source/test hashes match, workspace preferences are byte-restored, and the disposable app is closed. A focus-change interruption requires one fresh CUA observation before dismissing the menu and quitting; no document edits occur. The sandbox denies a read-only ps check; its approved elevated retry confirms only pre-existing PhotoCraft/Photoshop remain. Update current status, plan, command notes and PANEL_MENU_ACCESSIBILITY_REFERENCES.json. No broad Photoshop parity or macOS14 runtime claim follows from deployment-target/build qualification.

1. The maintainer requests a product webpage at the open project root nusite/index.html, then explicitly requires the existing forensicintelligence.ca style. This separately authorized presentation task does not resume native feature development. Read the Sites local-only workflow, design and preview references, native attribution/notices and current status. Inspect the live home and Structa product pages through the in-app browser: system typography, white/slate palette, blue pill actions, global navigation, sticky product subnavigation and spacious centered hero. Do not substitute an unrelated product theme.

2. The bare-domain web tool fetch fails; the browser successfully redirects to www.forensicintelligence.ca. A sandboxed curl request cannot resolve the www host. Read the successful live page's stylesheet and logo URLs; retrieve only the relevant public design references. A first status lookup used STATUS.md rather than docs/STATUS.md, and an AppMain.swift lookup did not exist; corrected by reading docs/STATUS.md and discovering source paths. No source or app changes result. Evidence and prior records are preserved in [local evidence archive].

3. Plan a self-contained static product page with genuine native app captures of original demo artwork, prominent PhotoCraft/ArtCraft credit, retained license texts, and explicit development/AI/API limitations. Do not publish local evidence, user documents, credentials or fictional download links. API impact: website presentation only, no change to executable capabilities, schemas or desktop state. Validation outcomes follow below.

4. Create the buildless site at the open workspace root nusite/index.html, with the existing shared CSS copied unchanged and Photato additions isolated in assets/photato.css. Preserve the company logo and maintainer icon; add responsive global/product navigation, actual app-view enlargement, native FAQ disclosures, feature/development distinctions, detailed PhotoCraft/ArtCraft attribution, license texts, original notice and asset provenance. The only contact actions are existing company mailto links. Public repository/download/store links are omitted because none is configured. The page contains no analytics, signup backend, live API connection or donation checkout; optional future tips remain IAP-only. English-only scope is explicit, rather than offering nonexistent translations.

5. Run the existing clean Photato 0.2.0 build2 executable with --snapshot and --snapshot-gradient-fill into this run's unique PNG/log paths. Both exit successfully. Inspect the native workspace/Gradient Fill views and use them unchanged as public assets; original Field Notes procedural artwork has retained MIT OR Apache-2.0 provenance. These are actual offscreen native captures, not live interaction tests. No Photoshop or user document is opened. The capture executable SHA-256 matches the qualified step092 binary; all360 source/test hashes match. No unrelated native tests/builds are rerun.

6. Validate HTML local resources/anchors, unique IDs, one H1, image alt attributes and absence of local-user paths in public files; all pass (static-check01.json). node --check nusite/assets/photato.js passes. The first sandboxed static server bind fails with PermissionError; record the failure and start an approved loopback-only server. HEAD/GET return HTTP200. Show the page in Codex; inspect desktop, 768px tablet, 390px and 320px phone layouts, with no main-content horizontal overflow or broken images. Test both image dialogs, Escape/Close and focus restoration, mobile menu/Escape, FAQ expand/collapse and the provenance anchor below sticky navigation. No browser console errors/warnings are observed. Save the settled desktop/full-page/mobile/provenance captures and browser-checks.json. An initial provenance capture caught the smooth-scroll transition; retain it separately. Direct file-URL navigation is blocked by the browser URL policy; do not bypass it. The supported HTTP preview is fully usable.

7. Preserve the complete website file hashes, public asset provenance and local reference/validation manifest (docs/PRODUCT_WEBPAGE_REFERENCES.json). README.txt explains static hosting, English scope, provenance, source/store-link prerequisites and capture qualifications. Update STATUS/PORTING_PLAN without changing the API command matrix or historical pause checkpoint: no native capabilities changed. Stop the owned temporary preview server after checks; leave the saved HTML and screenshots as the deliverable. The live website remains unchanged. Refresh/check the development evidence index; outcome is recorded below.

8. The first evidence refresh indexes97 milestones,7785 evidence files and3321 logs with zero missing references, but the immediate check reports a stale inventory after stopping the preview server flushes its buffered shutdown log. Preserve that failed check, then refresh and check again after server termination. The owned server exits cleanly on Ctrl-C; no listener is intentionally left running. Open the saved HTML in the Codex file panel. The second evidence check passes97 milestones,7785 evidence files and3321 logs with zero missing explicit references ([local evidence archive]).

1. The maintainer confirms support for both following the Photato-versus-Adobe compatibility discussion. Record both as maintained interfaces over one native Swift engine, rather than replacing the existing Photato API. Confirm the goal remains paused; this clarifies the saved architecture and completion criteria without resuming implementation. Preserve prior documentation under [local evidence archive].

2. Update AGENTS, CONTRIBUTING, API guide, compatibility plan, STATUS, PORTING_PLAN and the partial API command row. Every new capability requires Photato API coverage; where Adobe publishes the corresponding operation, its compatible interface and conformance tests belong in the same increment. Preserve existing clients and distinct versioned contracts, test shared underlying behavior, and retain each interface's document/job lifecycle. Photato-only capabilities stay explicit. The current ten-command preview still works; the Adobe-compatible interface remains unimplemented with the previously recorded schema-reference gaps.

3. Verify all360 tested Swift source/test hashes and app/ZIP hashes against step092: unchanged. Preserve the step093 pause checkpoint and existing test qualifications. No native implementation, server activation, UI interaction, external service call or resume occurs. Run the documentation evidence refresh/check with unique logs rather than rerunning unrelated native tests.

4. Evidence audit passes96 milestones with zero missing explicit references ([local evidence archive]). Refresh/check after recording this outcome. Both-interface support is a saved requirement; development remains paused.

1. The maintainer supplies Adobe's Photoshop API v2 GA page and requires API compatibility. Inspect that official page, its reference link, the v2 behavior catalog, status migration guide and font workflow; distinguish the Photoshop API in Firefly Services from separate Firefly image APIs. Confirm the goal remains paused. This is requirements/contract investigation and documentation, not resumed implementation.

2. The reference page exposes the JSON schema URL, but direct web access cannot retrieve it. A sandboxed Python request fails DNS; the approved host-network retry reaches Adobe and returns HTTP404. Preserve both failure records and the fetch script under [local evidence archive]. Detailed guides establish job-oriented v2 workflows, while the current native API executes proprietary synchronous document commands. Some published status/result/error examples conflict; do not invent a definitive schema or claim the complete OpenAPI was audited.

3. Preserve prior documentation before updates. Record the published v2 compatibility target in AGENTS, CONTRIBUTING, API guide/reference manifest, STATUS, PORTING_PLAN and the existing partial API command row. docs/ADOBE_API_COMPATIBILITY.json records sources, unresolved schema provenance, native adapters, jobs/assets, local client configuration, advanced workflow gaps and conformance gates. New functionality must ship its compatible API surface/tests in the same increment; keep Photato extensions distinct. Current ten-command /v1 remains proprietary and not Adobe-compatible.

4. Verify all360 Swift source/test hashes and app/ZIP hashes against step092: unchanged. Preserve the step093 pause checkpoint. No app/server/Photoshop actions, credentials, Adobe processing jobs or native implementation changes occur. Do not rerun unrelated native tests for this documentation-only update. Refresh/check the development evidence inventory with unique outputs; broader development remains paused until the user resumes.

5. Evidence audit passes95 milestones and zero missing explicit references ([local evidence archive]). Refresh/check once more after recording this outcome. The compatibility requirement is saved; implementation and conformance testing remain pending at the preserved pause.

1. The maintainer requires new functionality to be reflected in the API. Record this as a standing completion requirement while retaining the explicit step093 pause; the goal tool still reports paused. Preserve the existing guidance and documentation under [local evidence archive] before editing. No native feature implementation, UI interaction, server activation or automatic resume occurs.

2. Update AGENTS, CONTRIBUTING, the API guide, STATUS and PORTING_PLAN: every new or expanded capability must ship with the corresponding API operations/state, schemas, capability discovery, validation/error behavior, documentation and relevant tests in the same increment. Require one native Swift implementation with equivalent desktop/API results and history effects; explicitly review presentation-only API impact. Keep menu inventory separate from executable commands. Existing missing API coverage remains an honest backlog, and the current v1 still has ten commands.

3. Verify all360 tested Swift source/test hashes and app binary/ZIP hashes against the step092 qualification; all match. Preserve the step093 pause checkpoint. This documentation-only requirement change does not justify rerunning native tests or alter prior functional status. Run python3 scripts/audit-development-history.py and python3 scripts/audit-development-history.py --check, saving unique audit outputs.

4. Evidence audit passes94 milestones, with zero missing explicit references ([local evidence archive]). Refresh/check once more after recording the result. Development remains paused.

1. The maintainer requests a pause once current work is finished and working, with a return shortly. Step092 is already completed:937 full tests and136 optimized affected tests pass, Xcode Debug and universal package verification succeed, and bounded live Channels/Layers Cancel/OK checks pass. Do not start the queued accessibility or channel work. Preserve current documentation under [local evidence archive] before recording the pause.

2. Verify all360 current Swift source/test hashes and the current app binary/ZIP hashes against the completed step092 manifests. They match; no native source, test, application package or Photoshop document changes are made. Save docs/PAUSE_CHECKPOINT_093.json and the run checkpoint with completed functionality, test/package evidence, last verified cleanup, exact next tasks and constraints. Preserve the immutable step059 checkpoint. The broader Photoshop/API/web backlog remains incomplete.

3. Update README, STATUS and PORTING_PLAN to show the requested pause. This is documentation/control-state work, so preserve the existing test qualifications instead of rerunning unrelated native tests. Refresh and check the development evidence index, then mark the active goal paused and stop. No automatic resume is scheduled; wait for the user’s return.

4. Pause-record evidence audit passes93 milestones,7769 evidence files and3317 logs, with zero missing explicit references ([local evidence archive]). Refresh/check after recording this result; all implementation/package qualifications remain the unchanged step092 evidence.

1. The active-goal continuation resumes full Photoshop parity after the separately authorized API work. Classify091 as progress: native API implementation, tests, live browser/native editing and final accessibility repair are qualified. Read current source/status/plan/reference records and revalidate all359 step091 Swift hashes. Preserve baseline sources, tests, documentation and ZIP under [local evidence archive]. The overall goal remains incomplete and active; this turn continues the recorded UI/menu/UX priority, beginning with the post-sheet Panel Layout enablement observation. Preserve the pending Photoshop pre-existing-document restoration decision; do not edit that document.

2. Inspect WorkspaceDockView.canOrganizePanels, DocumentWindows.canChangeDocument, Channels/Layer Panel Options sheets and native window callbacks. The document predicate reads NSWindow.attachedSheet, an AppKit property outside Swift Observation, before reading the observable draft. A possible stale observation boundary exists while SwiftUI clears a draft before AppKit finishes dismissing its sheet. Reproduce through actual UI and a native-sheet observation regression before changing code. Installed NSWindow.h exposes windowWillBeginSheet/windowDidEndSheet delegate hooks; use native lifecycle evidence instead of timer-based polling or weakening modal guards.

3. Reproduce live in the clean step091 package at [local workspace]: in a disposable clean document, Channels → Panel Options → Escape leaves all Panel Layout Move/Float actions disabled although no sheet remains. Before opening the sheet, those actions are enabled. A CUA external-state interruption prevents the first menu-dismiss action; reobserve, restore Layers and quit this instance. Process metadata confirms its exit; the older PhotoCraft instance remains untouched. No Photoshop action or document edit is performed.

4. Add three native AppKit/Observation regressions covering begin/end invalidation, repeated Channels/Layers draft cancellation during native dismissal, and multiple-window/retained-draft guards. The first compilation (focused-before01.log) selects AppKit's async beginSheet overload in async tests. Preserve that test source and explicitly pass completionHandler: nil to select the callback overload. This is test harness repair; production source is unchanged. Run the corrected baseline before implementing the lifecycle bridge.

5. The corrected sandboxed attempt (focused-before02.log) cannot attach native sheets and reports13 assertions. Run the same regression with host AppKit access plus two existing sheet guard tests (focused-before03-host.log): both existing tests pass; the three new tests fail six observation assertions while the actual attached-sheet and cancellation checks succeed. This isolates the missing Observation notification from the sandbox artifact. Preserve test-reproduced.swift before the production repair.

6. Bridge DocumentWorkspaceController's windowWillBeginSheet/windowDidEndSheet callbacks to an observed DocumentWindows sheet revision, read before the attached-sheet guard. Keep the existing sheet/draft checks and reject callbacks from detached controllers. No polling or pixel algorithm changes. All25 focused native window/observation tests pass, zero failures/skips,8.550s (focused-after01.log). Freeze360 Swift source/test hashes (194source/166test) and source.diff, preserve rolling artifacts, then run the complete regression and optimized workspace/panel/menu/API suites before universal packaging and clean ZIP verification. Xcode Debug validation uses the unchanged checked-in project.

7. Full regression passes all937 tests with zero failures/skips (full01.log); existing Photoshop vector comparison diagnostics retain their nonzero measured residuals and are not reclassified as exact. Xcode Debug succeeds (xcode-debug01.log) with the checked-in project/spec unchanged. Add host AppKit access guidance to CONTRIBUTING; its pre-edit copy is reconstructed by removing only that new sentence, rather than falsely claiming an earlier snapshot. Preserve current workspace preference bytes before the final live test. Optimized affected suites, universal package and live dismissal checks remain in progress.

8. Final full regression is937 tests in145.641s; optimized affected panel/workspace/menu/API qualification passes136 tests in16.444s, zero failures/skips. Arm64/Intel packaging succeeds; Desktop FinderInfo causes two bounded signature retries before success, and the independently extracted ZIP signature verifies cleanly. Version0.2.0/build2, macOS14 metadata, supplied icon/notices and unchanged802-entry/102-primary/eight-alternate menu inventory verify. Binary SHA256 e02630693e43a0dc578668e990a161ad3c14014b5e8a5b5aaf1b7e9d8fe389fb; ZIP SHA256 4265d3cfec4a6150c8c030f961517099635710d00be69768c661361c031db49a. [local evidence archive] binds all360 frozen source/test hashes, tests and package. source-isolation.json confirms358 pre-existing Swift files unchanged, including all API/pixel-processing source, with only DocumentWorkspace changed and one regression file added.

9. Launch the verified clean ZIP at [local workspace]. Live in a disposable clean1200×800 RGB8 document: Channels Panel Options → Escape → reopen flyout recovers Move/New Group/Float actions; Return with unchanged Small options also recovers them. Float Panel Group executes and removes the group from the dock. The current CUA app-window surface exposes only the main document, not the separate utility window, so direct float visibility/input/docking is not certified. Restore the original default layout using Window → Workspace → Reset Essentials. Layers Panel Options → Cancel button → reopen flyout also recovers Move/Float. The document stays clean; Quit exits without a save prompt. Process metadata identifies only the older PhotoCraft instance afterward, and persisted workspace preference bytes exactly match the pre-test snapshot. The API is never started and Photoshop receives no actions. [local evidence archive] preserves the bounded results and limitations.

10. Record a distinct pre-existing accessibility defect: named panel menu controls become generic Drag after sheet dismissal. Prioritize that UI repair and the remaining floating-window input qualification before channel edit targeting. Update status, plan, relevant partial command rows and Channels/sheet manifests; preserve the immutable step090 backlog and step059 checkpoint. Keep the broad parity goal active and incomplete. All development attempts, including sandbox failures and test-harness repair, remain preserved. Refresh/check the development evidence inventory after finalizing these records.

11. The final evidence audit passes92 milestones,7765 evidence files and3317 logs with zero missing explicit references ([local evidence archive]). All360 frozen source/test hashes remain unchanged after live verification. Record this outcome, then refresh/check once more to include the final audit pointer and narrative. No additional native feature work or broader equivalence claim is included in this checkpoint.

1. The maintainer explicitly requests an optional application API and suggests a web client. Treat this as authorization for the bounded API work while the broader parity programme remains paused. Preserve sources/tests/docs and the verified step089 ZIP under [local evidence archive]. Inspect native AppDelegate selectors, EditorStore transactions/history/drafts, NSDocument ownership and menu/catalog evidence. Use the native command engine rather than triggering UI selectors or reproducing algorithms in a browser. Plan an opt-in loopback HTTP server, per-session authentication, explicit document sharing, revision-checked typed commands and a same-origin demonstration client. LAN/internet hosting, arbitrary file access and unimplemented commands are outside this first increment.

2. Consult Apple NWListener/requiredLocalEndpoint documentation; the website returns JavaScript shells and Markdown endpoints fail content-type handling in the browsing tool. Read the installed Network.framework Swift interface for the actual listener/local endpoint declarations. Use Apple's native Network framework with bounded requests/connections and lifecycle cleanup. Keep tokens out of URLs/logs and keep the server off on every launch. Tests will cover framing/auth/origin/host rejection, real loopback requests, command/history parity, stale revisions and sharing/cancellation boundaries. Expose the full reference menu catalogue separately from the small executable API command set; menu presence must not imply API implementation.

3. Add a bounded Swift Network.framework HTTP server, typed/versioned command catalogue, session authentication, explicit weak document shares, generation/revision checks, PNG snapshots and a native API control window. Refactor EditorStore’s committed transaction into a throwing helper shared by UI and API without changing native UI guards. Add ten commands and a same-origin browser demonstration; reject edits while desktop drafts, modal sheets, numeric fields, gestures or held mouse buttons are active. Append a clearly named Photato Help item and extend only that product addition in the existing menu fixture; the Photoshop shortcut baseline is unchanged. The optional browser frontend is an explicit new client, while all document operations and the desktop application remain Swift. Implementation validation follows; no success claim yet.

4. The production implementation compiles on the first attempt (compile-attempt01.log), which intentionally ran no tests before their addition. Add ten focused tests covering real HTTP, native transaction equivalence, all ten commands, history/dirty state, authentication/origin/host rejection, framing, stale revisions, invalid/locked/busy commands, no-ops, sharing lifecycle, token rotation, PNG previews and menu/size limits. Initial test compilation exposes a Swift6 actor-isolation issue in the test callback; preserve the source and focused-attempt01.log, annotate the callback MainActor and rerun separately. No production bypass or isolation weakening is introduced.

5. The sandboxed run (focused-attempt02.log) compiles but cannot bind a loopback listener: four protocol/unit tests pass and six network tests fail at startup. Run the same command with approved sandbox escalation for local networking; all ten tests pass with zero failures in0.344s (focused-attempt03-network.log). This establishes actual HTTP authentication, Host/Origin rejection and native editing, not a mocked network. Extend the suite with competing-client revision conflicts, additional desktop modal states/media-type rejection, parameter validation and machine-readable JSON Schemas. Format changed Swift files and capture the tested source hashes before complete regression/package checks.

6. Full regression (full-attempt01.log) passes all933 tests with zero failures/skips in137.258s (137.348s suite wall time). Start the optimized API/menu/document/editing suite and Xcode Debug verification against synchronized source groups. The sandboxed Xcode attempt fails because bundled Swift macro plugin processes return malformed responses, affecting existing Observable/SwiftUI code; preserve xcode-debug01.log and retry the same project/build with approved escalation in xcode-debug02.log. Process-path inspection finds a separate old build/PhotoCraft.app instance; leave it untouched and use a clean verified Photato package for live checks. Add API usage/limits documentation, update the native-vs-browser architecture wording, append one Photato-specific command-matrix row and record the802-menu/152-bound product adaptation without changing factory shortcuts.

7. Optimized validation passes377 tests, zero failures/skips, in10.467s; the escalated Xcode Debug build succeeds and discovers the new files without changing .xcodeproj. The first universal CLI package compiles both architectures but its sandboxed iconutil invocation fails with Invalid Iconset; preserve build-app01.log and repeat packaging with normal host services after the following source repair. Review finds that Undo/Redo can restore an oversized history entry despite the current-document limit. A deterministic65-layer fixture reproduces both violations (history-limit-before.log, one test/four failed assertions). Preserve the initial passing-source manifest and sources, then check the candidate history document before calling native Undo/Redo. Also initialize NSApplication explicitly in the standalone menu/limit test. Rerun the expanded14-test API suite, complete suite and optimized affected suites against final hashes. This extra validation is required by the demonstrated resource-limit defect.

8. Final history-guard code passes934 full tests (138.443s) and378 optimized tests (7.958s), with zero failures/skips. The host-service packaging retry succeeds; a transient Desktop FinderInfo signature failure clears through the script’s bounded retry. Independently extract the ZIP and verify signature, both architectures, macOS14 metadata, icon/notices, menu counts and all359 source/test hashes. before-accessibility-release-verification.json preserves this package’s binary hash143a304e… and ZIP hash1218e346…. Xcode discovers all194 source files with the original project/spec hashes unchanged (xcode-source-membership.json).

9. Launch the verified clean ZIP at [local workspace], leaving the older PhotoCraft process and Photoshop untouched. In its new disposable1200×800 white document, inspect Help → Photato Automation API, verify Off/no shares, start, explicitly share, copy the temporary token and open the served client in Firefox. Paste/connect without printing or saving the token. Browser Rename and Fill produce the matching native layer name, orange pixels and dirty mark. Native Command-Z restores white; the stale browser Fill is rejected; Refresh then browser Undo restores Background and clean state. Closing/reopening the control window preserves the server. Revoke rejects browser Redo and Refresh removes the shared document. Stop revokes the session; disconnect/close the browser tab and quit this Photato instance. live-listener.log/live-process.json independently identify PID24436 and the exclusive127.0.0.1:56931 listener. One CUA pipe interruption occurs after closing the control window; a fresh observation confirms the action completed. Screenshots/AX evidence were inspected inline in this conversation; no private Photoshop document was touched.

10. The live check finds an accessibility-only stale endpoint label: rendered text shows the address, but the grouped AX text retains Off. Preserve the prior view/source/package manifests, assign an explicit endpoint accessibility label/value and refresh that Text identity when state changes. This repair does not change HTTP, commands or document logic. Rebuild and repeat the endpoint lifecycle live check against the repaired package, keeping the initial functional qualification bound to its original hash. The Firefox password manager offers a save icon despite autocomplete=off; no save action is taken. Tokens are session-only in client code and are invalidated at Stop; browser-managed credential saving is outside that code’s control.

11. The isolated endpoint repair passes all934 full tests again (full-final03.log,137.243s), all23 optimized API/menu tests (release-focused03.log,0.609s), Xcode Debug (xcode-accessibility04.log) and universal packaging (build-app03.log). The same bounded FinderInfo retry succeeds; clean ZIP extraction verifies independently. Final binary SHA256e888f6dcf0dd89d0e35f571126aeef155b160604b3cf8211afc8645ae54ba778; ZIP SHA25607a3b730545db3dfac89dfa28a4dc42ad439ecd275e92d624e925923b453723e. [local evidence archive] binds934/23 passing tests,194 source/165 test files and the current package. The378 broader optimized tests remain qualified before the isolated view-only change; accessibility-isolation.json proves HTTP, command, editor, browser and test source hashes are unchanged from the successful live functional check.

12. Launch the final clean package at [local workspace]. Verify fresh API Off/no shares, Start updates both rendered and accessible endpoint to127.0.0.1:56952, and Stop restores Off while disabling token/client/share controls. Quit without modifying the new blank document. Process/port metadata confirm final app exit and no listener. [local evidence archive] records the repaired lifecycle; [local evidence archive] preserves the earlier browser/native qualification and its original binary hash. Do not generalize these bounded live checks to every interaction or a complete web workspace.

13. Finalize docs/AUTOMATION_API.md, docs/AUTOMATION_API_REFERENCES.json, README, contributing guidance, status, plan and the one-row command-matrix product addition. Preserve the step090 backlog and step059 pause checkpoint. Publish the current release evidence pointer, validate all359 source/test hashes, project/checkpoint immutability,645 current command rows and802 menu entries, then refresh/check the development evidence inventory. No Rust sources, Photoshop documents, external service configuration, Git history or unrelated Desktop projects are changed. The broader parity goal remains paused; API registry expansion, streaming/full web UX, remote identity/TLS/permissions, App Store server entitlement/sandbox tests and broader accessibility/concurrency qualification remain open. The service is left off and its ephemeral test tokens revoked. The initial final evidence audit passes91 milestones,7681 evidence files and3303 logs with zero missing explicit references ([local evidence archive]). The API guide open request is queued by the app; no rendered-editor inspection is claimed. Refresh/check once more after recording these outcomes.

1. The maintainer asks to pause and receive every outstanding Photoshop-parity item with an ETA. Set the implementation goal to paused and stop feature work. Preserve source/test/package/project/checkpoint hashes and the current planning/status/evidence documents under [local evidence archive]. This is a read-only implementation audit and documentation task; no native source, application binary, model, account or Photoshop document is changed. Retain the separate pending approval to restore the pre-existing Photoshop document.

2. Audit the644-row command checklist (491 pending/153 partial),801-entry native menu snapshot (151 bound/573 unavailable leaf commands,102 primary/eight alternate shortcuts),62 toolbar entries (29 native handlers),40 planned professional acceptance scenarios, source model/tool definitions, current status/qualification limits and App Store/open-source release plan. These counts have different denominators and are not a percentage of Photoshop parity. The command checklist contains stale states: Quit is implemented and exit-verified despite its pending label. Preserve original entries in the audit and annotate that discrepancy rather than rewriting historical evidence wholesale. Review measured Hue/Saturation, vector-alpha, gradient and RGB32 fill residuals; working commands are not automatically exact.

3. Read the installed Photoshop Info.plist without launching or operating the app: version27.2.0. Revisit the maintainer's Adobe feature catalogue and current desktop What's New, plus primary Light, Enhance Edge and Dynamic Text documentation. Adobe's current desktop page describes27.11 and is updated2026-10-05. Include documented2026 additions as separate unqualified gaps; do not pretend they were all exercised in the installed27.2 app. Include beta/retired/platform/service disposition, AI model quality and proprietary integration constraints rather than silently excluding them.

4. Produce105 work packages in the user's UI/menu/UX priority order, with missing/partial/verification/research states, dependencies and incremental engineering-effort ranges after task start. Map every historical command row to shared package estimates and retain all801 native menu rows,62 tools and40 workflow scenarios in appendices. Estimates assume one experienced native/macOS engineer assisted by AI; they are judgments, not measured agent wall-clock forecasts or dates. Research allowances do not promise success. Universal byte-identical results, proprietary services/plugins and unresolved decisions have no defensible completion ETA. The finite subtotal excludes these unknown completions and does not establish a final delivery date. Expand the initial103-package draft with explicit Sky Replacement and Adjustment Brush work before finalization.

5. Save the searchable report in docs/PARITY_BACKLOG_2026-10-09.html and complete structured inventory in docs/PARITY_BACKLOG_2026-10-09.json; retain generators and source snapshots in the step090 run. Update current status/plan to reflect the pause, preserving earlier historical statements. Validate report/JSON consistency, command coverage, links, all frozen353 Swift file hashes, package/project/checkpoint hashes, then refresh/check development-history inventory. No application tests are rerun for this documentation-only task. Resume checkpoint remains post-sheet Panel Layout validation, then independent channel visibility/edit targets, only after the maintainer resumes implementation.

6. Audit validation passes:105 unique work packages, all644 command rows mapped,801 menu entries/62 tools/40 scenarios retained,1,005 report links checked and all357 baseline hashes unchanged (353 Swift files plus package/project/Package.swift/checkpoint). Finite estimates total417.2–849.6 engineering-weeks, including12–28 weeks of research allowances; five packages have unknown completion estimates. These are not a promised calendar schedule or a bound on full parity. Correct report spacing and retain both passing verification logs. The report-open request returns queued, so no live rendered-preview inspection is claimed. Confirm goal control remains paused; run final development-history refresh/check. No code, tests or app package are changed.

1. Classify088 as progress: the user-requested native Xcode project now builds and starts Debug/universal Release; icon/resources/signature and exact workspace comparison pass. Revalidate all348 unchanged Swift source/test hashes. Preserve current source/tests/docs/build metadata under [local evidence archive] at2026-10-09T17:45:56.963571+00:00. Resume UI→menus→UX priorities with Channels. Native inspection finds four preview-only buttons, every eye always drawn and every thumbnail copied from the filtered canvas image. Only one optional component is represented; channel visibility and editing targets have no independent model. Reopen the user-supplied Adobe feature catalogue and current/legacy official Channels documentation. Preserve the pending Photoshop document-restoration authorization; independent native work can continue. Inspect Rust Channels behavior and existing layer-panel preferences/rendering before implementation; qualify actual previews/options/state without claiming unsupported per-channel editing.

2. Inspect Photoshop via native accessibility: Window→Channels, read the RGB/Red/Green/Blue row layout and Command2–5 labels, open its flyout and Panel Options, cancel without applying, then restore Layers. Preserve observed menu order, current-profile small selection, approximately37-point small rows/32-point thumbnails and limits in [local evidence archive]. No channel selection, eye action, document edit, save or Undo occurs. The pending pre-existing-document restoration remains unauthorized. Rust's channels_panel.rs/channel_view.rs distinguish composite, color, alpha/spot and temporary masks; native implementation still lacks those complete targeting/visibility transactions. Do not bind their editing shortcuts to preview-only behavior.

3. Add a single-pass premultiplied thumbnail reduction from the unfiltered composite, followed by independent RGB/grayscale component outputs. Keep results outside document pixels/history and compute only while the Channels view is mounted; None skips rendering. Add an asynchronous native thumbnail cache keyed by owner, document generation, accepted composite version and backing-pixel size, rejecting cancelled/stale work. Replace repeated filtered-image thumbnails with native rows; expose the observed flyout with unsupported actions disabled. Add separate global Channels thumbnail preferences and a native cancel/commit draft with persistent atomic writes, stale-library/concurrent-write/read/close guards and shared modal exclusion. Keep preview-only semantics explicit until actual channel edit targeting is implemented. Initial focused tests cover component values at all depths, area/alpha reduction, composite masks/visibility, cancellation/bounds, preference migration/persistence/failure, stale draft/cache rejection and unchanged saved document/history. Preserve focused-01.log before any repair.

4. Focused01 compiles and all8 app tests pass, but a composite fixture retains an active-layer ID after replacing its layers; correct that invalid fixture metadata. The process then crashes at DocumentWorkspace startup; focused02 reproduces the crash after all14 Channels methods pass. Preserve the crash report and first fixture versions. Diagnosis: the new independent-preview test creates NSDocument before registering the custom controller, allowing AppKit's base singleton to be initialized. Register NSApplication/CraftDocumentController first, matching product startup and existing fixtures. Focused03 passes96 tests in9.547 seconds. Add hosted panel/options captures plus packaged Channels snapshot flags. Focused04 reports four assertions because it compares a wrapping footer's unconstrained ideal width375 with its actual host width275; captured content wraps correctly. Retain the failed assertions/captures, replace that invalid ideal-size assertion with the actual host-bound observation and use an original multicolor fixture to expose independent thumbnails. Focused05 passes97 tests in10.067 seconds, zero failures/skips; visually review the captured native panel and options. Freeze353 Swift files (189 Sources/164 Tests) and start full920-test, optimized regression and universal package/signature gates. Logs/commands are retained under [local evidence archive]; preserve rolling artifacts before each phase.

5. Full920 tests pass146.019 seconds; optimized513 tests pass28.908 seconds, zero failures/skips. Universal arm64/x86_64 macOS14 packaging passes. The Desktop signature initially encounters FinderInfo and the existing bounded retry recovers; verify the extracted ZIP independently. Binary SHA256 6b5b36f890bb7d9e1afab3e590c8968321eb8825db841e44b20865b08fea5324; ZIP SHA256 75d538ab95b639f32abf66ea15184da30e868682e5cf64696796a7afceb05153. Version0.2.0/build2, archive8, supplied icon and licenses remain unchanged. The native Xcode Debug build automatically discovers all189 application Swift sources without regenerating the project. Keep all previous failed attempts, commands and frozen353 source/test hashes in [local evidence archive].

6. Nine fresh packaged offscreen diagnostics finish successfully. Review all five Channels variants: None removes thumbnails, Small shows all rows, Medium/Large use the compact panel's scroller, and Red changes only the canvas presentation/selection while keeping independent thumbnails. Three unaffected views exactly match step087 decoded RGBA: workspace-small, mask-gray and floating-panel (the latter corresponds to the old floating-gradients filename). The 1700×1174 workspace-reference is visually reviewed but has no qualified identical step087 counterpart; do not report four exact matches. Hosted Panel Options cacheDisplay images omit native compositing and are appearance-inconclusive. Actual sheet appearance is qualified separately below. Preserve original render reports and the explicit baseline mapping in [local evidence archive].

7. After all native test/build/render processes finish, launch the clean extracted binary and open an original256×192 RGB patch fixture. Live CUA verifies independent thumbnails, Red grayscale preview, RGB restoration and clean document state. The observed flyout order is retained with editing operations disabled. Actual Panel Options has dark gray background and grayscale examples; selecting Large then Escape and reopening retains Small. Cancel and restore Layers. Panel Layout move/float actions appear disabled on reopening after cancellation, despite being enabled beforehand; record this unresolved validation observation and reproduce it before further channel expansion. No live preference commit or exact Photoshop byte comparison is claimed. Save actions/limits in [local evidence archive].

8. Initial Quit followed by CUA inspection shows a clean window, and a second menu-Quit/inspection similarly shows Untitled-1. Read-only process inspection establishes that the original PID94299 was replaced by PID96216: UI lookup can reopen Photato, so this does not establish a Quit defect. Finally issue Command-Q without another UI lookup and confirm no matching process remains. Restricted ps initially reports operation not permitted; approved read-only process inspection succeeds. No documents are saved or dirty-discard prompts accepted. Photoshop's pre-existing restoration approval remains pending; no restoration action occurs. Finalize Channels references, status, plan and rolling release evidence. Revalidate source/package/reference consistency and refresh/check development-history inventory. Full Photoshop parity remains incomplete and active; next investigate post-sheet panel validation, then independent visibility/edit targets and mask rows.

9. Final consistency verifies all353 frozen Swift files,54 hashed references,801 menu entries,644 command-checklist rows (only Channels evidence changed), unchanged Xcode project and pause checkpoint, and current package/icon/signature hashes. Preserve the check script/log and44 original hosted captures in [local evidence archive]. Refresh and check the development-history inventory after this documentation update, storing its output outside the indexed evidence tree under the development-history-audit directory. No source or package changes follow the passing test/build gates.

1. The maintainer asks for an .xcodeproj in the project directory. Inspect the existing SwiftPM package and build metadata: only the separate StoreKit test host has an Xcode project. Preserve the baseline documentation/build configuration and all 348 source/test hashes under [local evidence archive]. Add a native Photato.xcodeproj beside Package.swift, with the existing app and three Swift modules, shared Run/Archive scheme, macOS 14 deployment, universal Release output, existing document types, icon, notices and links. Keep SwiftPM regression and StoreKit test workflows available. The installed XcodeGen 2.45.2 can generate a checked-in project; use synchronized source groups so new Swift files appear automatically. Validate Xcode project parsing, Debug build and universal Release archive, then smoke-test the resulting bundle. This build-system request takes priority over the queued Channels UI work; overall parity remains incomplete.

2. Add project.yml, the generated project/shared scheme/workspace and scripts/build-xcode-icon.sh; ignore Derived Data, archives and per-user Xcode state. Consult XcodeGen's official ProjectSpec documentation for synchronized-folder support. Keep PhotoCraft as the application module so the existing PhotoCraft.CraftNSDocument registration remains valid. Generate the supplied icon at the same ten sizes as the CLI package. The project uses no network packages or external runtime; XcodeGen is only a maintenance tool, not a build prerequisite. README and CONTRIBUTING explain Command-R, Archive, regeneration and the separate SwiftPM/StoreKit test workflows. The main app scheme deliberately has no XCTest targets.

3. Initial native dynamic-framework configuration parses (xcodebuild -list -json), builds Debug and archives universal Release successfully with Xcode27.0/build27A266a. Regeneration is byte-identical across three project files. Preserve generate-01/02, project-list-01, debug-build-01 and release-archive-01 logs in the step088 run. However, launching that archive's --snapshot-small diagnostic exits134: dyld rejects the ad-hoc internal framework under library validation. Build success alone was insufficient. Preserve the full loader diagnostic in release-smoke-01.log and the rejected project/specification in [local evidence archive]; retain the original archive under [local workspace] Replace the three framework targets with static Swift libraries and remove embedding, matching the existing package's linking arrangement while retaining hardened-runtime configuration. Regenerate separately (generate-03), rebuild in a fresh [local workspace] directory, and repeat Debug/Release/runtime verification. No editing source or Package.swift changes are required.

4. Corrected Debug build and universal Release archive pass (debug-build-02/release-archive-02), and both apps exit0 after rendering --snapshot-small diagnostics (debug-smoke-02/release-smoke-02). Both 1000×650 RGBA images exactly equal the step087 CLI package's final workspace-small reference; this is offscreen render qualification, not live Xcode interaction. Final generation04 is byte-identical to the compiled project. The bounded verifier's first attempt fails because it treats synchronized-folder paths as project-root-relative instead of relative to the Sources parent group; preserve that verifier and verification-01.log, resolve the parent correctly, then verification-02 passes. No app/project repair is required for this diagnostic assumption. All186 application Swift files appear in the archive's compiler file lists. All348 source/test hashes, Package.swift and the existing step087 CLI app/ZIP hashes remain unchanged; the905/498 passing SwiftPM test results remain the step087 evidence, not newly executed suites.

5. Final archive binary SHA256 is7f656ae5a08b1c91346df14cd135aa1a16e076f0fa848a8d17e230ab2d8e4fd4. Both architectures declare macOS14.0; deep/strict signature verification, all existing Info.plist fields/document classes and seven bundled icon/notice/link resources pass. No internal dynamic frameworks or XCTest bundles are embedded. Version0.2.0/build2 remains unchanged. Save exact commands, source/project/resource hashes, failed/passing logs and qualification limits in docs/XCODE_PROJECT_REFERENCES.json and [local evidence archive]. Existing RasterDecodeBudget Sendable warnings remain; AppIntents extraction is skipped and Xcode warns about the unset App Category. Local ad-hoc signing is qualified, not App Store distribution. Intel/macOS14 execution and actual Xcode Run-button interaction were not performed. README/CONTRIBUTING now describe the project and separate test workflows; STATUS/plan record the bounded completion. No menu or editing functionality changed, so COMMAND_PARITY stays unchanged. Refresh/check the development-history inventory after final documentation. Resume Layers/Channels work next; Photoshop restoration approval remains separately pending and no Photoshop action occurred in088.

1. Classify086 as progress: compact layout and live-discovered absolute X/Y typing repaired;886 full/479 optimized tests pass with a verified universal package. Revalidate346 source/test hashes,74 references,801 menu rows and current/preserved ZIP/pause hashes. Preserve baseline sources/tests/docs/package under [local evidence archive] at2026-10-09T16:43:42.204039+00:00. Investigate reverse field traversal, per-keystroke history, commit/cancel and keyboard Undo before Channels UI expansion. The086 coordinate input errors mean a Shift-Tab mismatch alone does not establish an application defect. Compare actual Photoshop numeric commit/history behavior on an original disposable fixture and reproduce native responder behavior deterministically before repair.

2. Generate original64×48 transparent PNG with24×16 opaque rectangle at5,4 and preserve its provenance/hash. Open through Photoshop's native Open dialog. Direct field input establishes deferred commit: typedX17 leaves canvas/title unchanged; Return moves content, marks dirty and exits field; one Command-Z restoresX5/clean. Y-12/Escape cancels; X23/Tab commits and selectsY; Shift-Tab selectsX. The subsequent coordinate outside-click probe is not reliable: after Escape/Undo restores and closes the clean fixture, the pre-existing Untitled-1 unexpectedly shows an unsaved dark fill and Edit reportsUndo Paint Bucket. Automatic review rejects attempted Undo on that pre-existing document. Inspect only, ask the user via async question for permission to undo that specific action, cancel the Edit menu and leave it untouched pending approval. Record this incident explicitly in photoshop-numeric-reference.json; no successful restoration or outside-click parity is claimed. Continue unaffected native implementation/testing.

3. Add a hosted Properties-field test through the real numberField factory: insert1 then7, require unchanged document/history until Return, then one move/Undo/Redo and released text focus. Run ./scripts/test.sh --filter NumericFieldEditingTests to reproduce current behavior in reproduction-01.log. Plan a native NSTextField draft with commit on Return/end editing/Tab, Escape cancellation and stable key-view traversal, retaining the existing absolute-position binding and compact line boxes. Keep context/generation/value guards so delayed edits cannot target another document/layer or overwrite concurrent changes.

4. Reproduction01 fails five assertions: typing changes the document immediately, adds two history states, retains field focus after Return and one Undo only removes the final digit. Implement NativeNumericField for number/percentage controls: keep uncommitted native text, parse complete finite localized input, clamp at commit, preserve fixed line boxes, honor disabled state, and guard owner/generation/layer/tool plus baseline value. Register the active editor weakly on EditorStore; commit before ordinary commands/selection/Undo/Redo/save/document switch/close review, cancel before read/final close and view retirement. Initial one-test repair passes. Expanded76-test run has one Tab-target failure. Diagnostic recalculation shows valid native next/previous links but custom selectNextKeyView routing still fails. Return false after draft commit for Tab/backtab so NSTextField performs its own field-editor movement. Key-loop02 passes, then all12 editor tests pass without the temporary recalculation/tracing. Preserve each failed approach/source separately. Add percentage/disabled and selection-boundary tests: final154 focused tests pass19.808 seconds, including14 new editor methods. Freeze348 Swift files (186 Sources/162 Tests); prepare900 full/493 optimized tests, universal packaging and46 render diagnostics. Photoshop restoration approval remains pending; no further action on its pre-existing document is authorized.

5. During full validation, review identifies a new boundary risk: document activation/close validates eligibility before committing numeric text, but a rejected commit can raise an error after that initial check. Hold optimized/package stages with an explicit marker, preserving the original348-file freeze/source tree and allowing the initial900-test suite to finish. Add real-document regressions requiring failed locked-position commits to keep the original document active/open. No Photoshop action is taken while its restoration approval remains pending.

6. Initial900-test full suite passes139.635 seconds; the intentional gate stops optimized/package execution, and its passing log/captures are preserved before further changes. Two added boundary tests fail four assertions: rejected locked-position input still allows document switching and closes a clean document. Add post-commit eligibility checks in DocumentWindows.activate/requestClose so commit errors keep the current document active/open. Run the expanded affected group again in focused-02.log. This is a reproduced lifecycle defect, not an inferred test-only edge case.

7. Focused02 passes156 tests/17.974 seconds after the post-commit guards. A final untouched-field regression fails two focus assertions: Return/Escape does not exit unless typing has created a draft. Add guarded editor resignation even without a draft, checking currentEditor ownership so retiring another field cannot steal focus. Preserve the failed reproduction and prior implementation. Focused03 passes157 tests/18.868 seconds with17 new methods. Freeze final348 source/test hashes; resolve the hold marker and run903 full/496 optimized tests, universal package verification and46 diagnostics. No source edits are planned during these final gates. The Photoshop approval request remains pending and independent of native validation.

8a. Final903 full tests pass149.432 seconds and496 optimized tests pass27.639 seconds. Universal build and clean ZIP signature pass. The first package diagnostic (mask-gray) times out after30 seconds with an empty diagnostic log; preserve the complete orchestration failure and render-attempt-01. No source change or passing test claim is invalidated, but visual qualification is incomplete. Retry the isolated diagnostic with a separate output/log and inspect the process if it stalls. Desktop app copy again acquires FinderInfo; clean extracted ZIP remains signature-valid.

8b. Isolated render02 also waits. Read-only sample ofPID61188 establishes a native NSPersistentUIRestorer crash-history alert before applicationDidFinishLaunching, not an editor/render deadlock. CUA confirms the reopen-windows alert. ChooseDon’t Reopen for the disposable diagnostic; the process then writes mask-gray.png and exits successfully. Preserve the stack sample, screenshot/AX observation and successful isolated capture. Resume all46 diagnostics with the unchanged verified binary and fresh final-renders paths; do not rerun passed tests/build.

8c. All46 fresh package renders match086 decoded RGBA exactly and are visually reviewed; four existing NSAlert offscreen appearance captures remain inconclusive. Live verifiedPID62039/binaryf694f3… passes draft/Return, whole-edit Command-Z/Shift-Command-Z, forwardTab and Escape. ReverseShift-Tab still remains inY, confirmed by screenshot and a subsequent uncommittedY173 draft even after directly focusingY. Isolated two-field selector tests did not cover the real workspace keyboard path. Cancel drafts/undo toX0/Y0 clean, quit and confirm process exit. Preserve the complete903-test source/package baseline and initial-live-qualification.json; hold finalization and add full-workspace regressions before further repair. Photoshop restoration approval remains pending; no action on that document.

8d. Full-workspace selector reproduction fails becauseY.previousValidKeyView is nil. Explicit diagnostic recalculateKeyViewLoop restores the link and makes the test pass. Enable autorecalculatesKeyViewLoop on DocumentWorkspaceWindow and FloatingPanelWindow construction, as described by Apple NSWindow documentation; the test passes without diagnostic recalculation. Expand to native key events in both host types. Initial synthetic Backtab uses inconsistent charactersIgnoringModifiers and is interpreted as insertTab; preserve the failed96-test run and selector traces. Correct both event character fields toNSBackTabCharacter (U+0019); both document/floating workflows now pass. Remove temporary prints, retain two new regressions and run the expanded affected suites. This distinguishes the reproduced product key-loop defect from the separate synthetic-event construction error.

8e. Final affected199 tests pass21.791 seconds with tracing/recalculation removed from tests. The new19 numeric-editor methods include real workspace selector routing and native forward/backtab events in document/floating windows. Preserve initial903/496 gates, package,46 renders and live failure under before-live-backtab. Freeze348 final source/test hashes and implementation.diff; update gates to905 full/498 optimized tests, universal packaging and46 diagnostics. No source edits during these gates unless a further defect requires repair.

8f. The final 905 full tests and 498 optimized tests pass in 140.955 and 30.748 seconds. Universal packaging and the clean ZIP signature verify. All 46 final captures match both step086 and the 46 initial step087 images already reviewed. Live testing uses binary 2b949ca4cfe9e8067fc3ba8067330cfee2b00771341e4091ea6e25ec5acba012, PID 71342. Shift-Tab now returns from Y to the selected X value of 23; typing 173 edits X. Draft/Return behavior, whole-edit Undo/Redo, and coordinate/opacity Escape checks pass. Committing opacity 62 and undoing once restores 100 and clears the dirty state. Restore the fresh test document to X0/Y0 and opacity 100, verify its white canvas and clean tab, quit through the native app menu, and confirm process exit. The exact scope is recorded in live-qualification.json. Floating-panel traversal is covered by native event regressions; the four NSAlert offscreen captures retain their appearance limitation. The separate Photoshop restoration approval remains pending.

9. Final905 full/498 optimized/199 focused test gates pass in140.955/30.748/21.791 seconds, zero failures/skips. Verify348 frozen Swift files, universal arm64/x86_64 macOS14+ packaging, clean ZIP signature, version0.2.0/build2, icon/licenses and801 unchanged factory-menu entries (102 primary/eight alternate shortcuts;151 bound/573 unavailable). Binary SHA256 2b949ca4cfe9e8067fc3ba8067330cfee2b00771341e4091ea6e25ec5acba012; ZIP SHA256 6d9165c9fb4e676260270113137411aaeaa079ea32a2773e149c0089d5d39917. Preserve all failures, initial900-test gate, final46 reviewed diagnostics and live findings under [local evidence archive]. Update status, plan, README, command checklist and numeric-editor reference manifest. No image-rendering algorithm or factory-menu binding changed. Overall goal remains active/incomplete; Photoshop restoration approval remains separately pending.

10. Final consistency verification checks all 348 frozen Swift files, 83 explicit hashed references, 801 menu rows, current/preserved package hashes and the unchanged historical pause checkpoint. Refresh and check the development-history inventory: 87 milestones, 7,444 evidence files, 3,231 logs, zero missing explicit references. Logs are under [local evidence archive]. Re-run the inventory after this closing documentation note. The next UI work is the Channels panel: independent thumbnails and options, then separate visibility/edit targets with correctly routed editing commands. The overall goal remains active and incomplete.

1. Classify085 as progress: native layer reveal lifecycle changed and passed878 full/471 optimized tests with a verified universal package. Revalidate344 source/test hashes,75 references,801 menu rows and current/preserved package/pause hashes. Preserve baseline sources/tests/docs/ZIP and rolling artifacts under [local evidence archive] at 2026-10-09T15:52:26.746393+00:00. Follow UI priority by diagnosing the intermittent Properties numeric-field height variation before Channels work. The retained084 failure changes only a51-pixel-wide numeric field; a14-pixel interior crop matches after one-pixel vertical translation, while the background top changes and its bottom stays fixed. Intrinsic-height variation is an inference to test, not an established cause. Plan opt-in geometry tracing and repeated unmodified whole-workspace comparisons before a narrow layout repair. Keep physical-input/Photoshop qualification pending; no new unlock request.

2. Add opt-in SwiftUI GeometryReader probes before/after numeric padding, tagged by store identity, plus fixture/capture markers in the existing exact workspace test. Initial geometry01 passes. Run24 independent skip-build test processes with immutable captures/logs. Twenty-three pass; one fails with11,643 changed RGBA bytes at(678,471)–(1000,595), confined to the Layers controls/row rather than the Properties fields. All logged X/Y content frames are45×13 and padded frames51×19, with no parse errors. This experiment does not reproduce the earlier Properties height variation; it reveals a related broader layout instability. Preserve the failure and add probes for percent/search fields plus a delayed same-host capture to distinguish persistent layout from capture timing. No product repair is claimed yet.

3. All-field geometry02 passes. Run32 fresh processes with immediate and400ms-later captures. Two fail persistently:07 has11,643 changed bytes in Layers, with search height12 versus13 and subsequent controls displaced one point;24 reproduces the327-byte Properties defect in Y, with content height12 at y359.5 versus13 at y359 and outer height18 versus19. Each failed host's first/late image is identical, ruling out mere screenshot delay in these cases. Preserve JSON geometry/captures; source rectangles now establish preferred-height variation rather than only inferring it from pixels. Plan explicit top-aligned13-point number/percentage fields and12-point search fields, matching the normal measured geometry. Keep bindings, validation, font, keyboard semantics and whole-workspace assertions unchanged. No claim about SwiftUI internals beyond the measured behavior.

4. Apply explicit heights with top alignment to numeric/percentage/search controls; retain the normal fonts, widths, padding and all binding/validation behavior. A first patch missed the formatter-adjusted search context and changed no files; refresh its anchor and apply successfully. Initial fixed-height01 passes the existing exact comparison. Run64 independent processes:32 with geometry/late-capture diagnostics,32 in the ordinary nontracing path. This tests the observed variability under both instrumentation states; no assertion tolerance or screenshot delay is changed in normal regression runs.

5. Repaired64-process series passes all64 exact whole-workspace assertions:32 traced and32 ordinary. All128 initial RGBA images share one hash; all64 delayed images from traced hosts match their first capture. This establishes bounded repeatability for the reproduced defects, not universal platform/Photoshop equivalence. Add a source comment explaining the fixed line boxes; no functional change after that series. Focused01 passes176 workspace/panel/viewport/text/selection/transform tests in17.039 seconds. A read-only Git status accidentally displayed unrelated enclosing-repository entries; no Git mutation or action outside the native subtree was taken, and private filenames are excluded from this record. Freeze344 source/test hashes and the implementation diff. Run878 full tests,471 optimized affected tests, universal macOS14+ package verification and46 offscreen package diagnostics sequentially.

6. CUA revalidation now permits live Photoshop input. Inspect the existing document without issuing document edits: Channels shows RGB/Red/Green/Blue with Command2/3/4/5 legends. Read the Channels flyout and Panel Options; the current profile selects the first illustrated thumbnail size, which is not by itself proof of factory defaults. Cancel the options and restore Layers. The first Cancel attempt is declined for stale UI state; refresh AX and retry successfully. Record current menu enabled/order evidence and screenshot provenance in live-qualification.json. Do not keep calling the Mac locked; prior lock-era qualifications remain outstanding. Full878-test regression passes130.642 seconds; optimized/package gates continue. After packaging, use the returned live access for native input checks and accumulated UI parity gaps.

6a. Initial full878/optimized471 package gates pass130.642/24.767 seconds; package9f2232… is retained as pre-position-repair evidence. Live launch uses the verified extracted package; read-only process metadata confirms PID38262 and its exact executable path. Its fresh unmodified Untitled-1 has X0/Y0. Click X, Command-A, type17 and Return: AX reports16 and dirty state. Inspect the setter: it captures an old layer position while reading newly changed active bounds, so rapid updates may accumulate a wrong delta. This is a real input defect, not a screenshot artifact. Preserve all tested source/package/logs/captures before repair; reproduce the retained binding with sequential values and fix current-state coordinate application before finalization. Do not label the initial package ready based only on green automated gates.

6b. Reproduce the old retained X/Y setter in two tests: four assertions fail, including1→17 becoming20 for a layer initially at4 and a Y edit resetting externally updated X. Replace captured coordinates with same-generation/current-active-layer lookup for both origin and translation; preserve the live orthogonal coordinate and reject nonfinite/stale/no-op input. Eight new tests cover rapid values, negatives, affine/group bounds, Undo/Redo, lock/read/close guards and range handling. First repair run has15 tests with one failed range expectation: the existing engine accepts a1,000,000 origin but bounds reject the shape edge beyond that coordinate. Verify stored position, the explicit bounds error and recovery to17 instead of claiming unsupported bounds work. ./scripts/test.sh --filter 'LayerPositionEditing|TransformWorkflow' in position-repair02.log passes15 tests/0.097 seconds. The origin-versus-extents limit remains a separately recorded engine gap.

6c. Clean up the initial live fixture through Undo: cancel its close/save prompt, focus canvas and undo twice (16→1→0), verify the dirty marker clears, then close/quit. No Delete button or saved-file removal was used. Preserve the initial package/gates before a new346-file source freeze. Run final886 full tests,479 optimized affected tests, universal package verification and46 package renders sequentially; repaired-package physical-input qualification remains required.

6d. While final native tests run, reopen the user's Adobe feature catalogue and current/legacy official Channels documentation. Record the distinction between visibility, edit selection and thumbnail preferences in channels-followup-research.json. Inspect native channelsPanel/displayChannel: four single-component preview buttons reuse the filtered canvas image as every thumbnail, with no independent visibility/edit-target model. Plan independent thumbnails/state and qualified command routing after current field validation; do not equate preview buttons with channel editing parity. Two contemporaneous Photoshop Layers-menu clicks had no visible effect; defer further live UI work until test windows finish rather than infer a new lock or menu behavior.

6e. After tests finish, native Photoshop menu input responds. Capture the Layers flyout order for the existing single selected pixel layer, then inspect Layers Panel Options (359×554 screenshot): first illustrated thumbnail size and Entire Document selected; default fill masks, expanded effects, copied-name suffix and reorder preview checked; mask badges unchecked. First Cancel is stale-state rejected, refreshed Cancel succeeds and returns to the original Layers workspace. These are current-profile observations, not verified factory settings. Record the detailed order/actions in live-qualification.json; no document-edit or preference-commit action is issued. Update Properties/Channels command-checklist notes with the bounded repair and explicit remaining gaps.

7. Final full886/optimized479 suites pass132.809/24.729 seconds; final46 offscreen RGBA images all match inspected085 captures. Review the contact sheet; inherited four black/white NSAlert captures remain inconclusive for real appearance. Clean extracted ZIP signature passes; the separate Desktop app copy again has FinderInfo and fails its signature check. Live launch uses binary15d6be… from the verified extracted bundle, PID43748 confirmed by read-only process metadata. X17 now stays17; Tab and negativeY-12 preserveX17; direct three-digitX173 entry is correct. Shift-Tab followed by173 instead changesY, so reverse traversal remains unresolved. Coordinate clicks return noWindowsAvailable; name lookup times out and bundle lookup is ambiguous; canonical/tmp path does not fix coordinate input. AX field/History controls work. History shows10 Move states; Undo/Redo X173→17→173 works; earliest state restoresX0/Y0 and clears dirty. Collapse History, request tab close (UI replaces with clean Untitled-1; exact last-close behavior remains open), then Quit by native menu and confirm no remaining process. No saved-file/irreversible delete action occurs. Record all tool failures and bounded qualification in live-qualification.json; queue deterministic focus/history investigation before Channels integration. Do not call this full UI or Photoshop equivalence.

8. Full886/optimized479/position-focused15 test gates pass in132.809/24.729/0.097 seconds, zero failures/skips. Verify346 frozen source/test hashes, universal arm64/x86_64 macOS14+ package, clean ZIP signature, version0.2.0/build2, icon/licenses and unchanged801 factory-menu entries (102 primary/eight alternate shortcuts;151 bound/573 unavailable). Binary SHA256 15d6be7e1ba4fab389ab5b276dcf79337e8b16e09173c52decc223376c235a34; ZIP SHA256 2de4200c571f3faf2814dd366e29138d88848245f3851a1884bd4c403950f947. Preserve46 inspected package captures, exact before/after geometry repetitions and all failed attempts in [local evidence archive]. Update status, plan, README and field-layout reference manifest. No document imaging algorithm or factory menu binding changed; Properties X/Y value binding semantics are repaired. Overall Photoshop parity remains incomplete; direct live UI qualification resumes with access now available.

9. Final consistency check verifies346 frozen Swift files,74 hashed references,801 menu rows, current package hashes, preserved085 ZIP and immutable pause checkpoint. Development-history refresh/check passes with86 milestones,7,148 evidence files,3,085 logs and zero missing explicit references. Record these checks and rerun the inventory after this final documentation note. Overall goal remains active and incomplete; no pause, completion claim, version increment or publication occurs.

1. Classify084 as progress: native mask interactions and lifecycle repairs changed the app, with872 full/465 optimized tests and a universal package. Revalidate current341 source/test hashes,75 referenced hashes,801 menu rows and package/pause hashes. Preserve source/tests/docs/ZIP at [local evidence archive] (2026-10-09T15:08:58.480921+00:00). Follow UI priority by investigating084's intermittent initial rename reveal and Properties numeric-text capture difference before Channels work. Inspect LayerRevealTracker's one-shot consume/ScrollViewProxy scheduling, native layer-name focus, Properties number fields and the existing two-host container comparison. Do not weaken assertions or dismiss a failure merely because reruns pass. Plan successive same-host captures and native geometry/state tracing to distinguish actual target/focus lifecycle failure from a fixed-delay snapshot.

2. Add opt-in layout tracing and a second same-host snapshot1.4 seconds after the ordinary0.6-second capture. Log native field/scroll geometry, rename focus and reveal preparation/consumption; ordinary runs do not trace or add timers. Instrumentation compiles; the existing selected suite runs16 tests with one whole-workspace pixel comparison failure. Preserve its log (capture directory was not supplied for this attempt). Run18 original sample captures across rename/plain/wrapped workspaces with first/late PNGs and JSON events. Rename03 confirms a valid request consumed and ScrollViewProxy called, but the clip remains at0 and no NameField exists in either capture, while the draft stays alive. This is a persistent lost reveal, not merely a slow screenshot or ended edit. Preserve instrumented sources/hashes before repair. Use native list geometry and NSClipView scrolling after attachment/layout, consuming only after position is verified; keep manual scrolling and stale/modal/document guards intact.

3. Initial18-run tracing finds two of six rename requests permanently unrevealed; every first/late image pair is byte-identical. All18 sample numeric-region hashes happen to match, so that sample series does not explain the separate blank-document numeric failure. Implement a passive native list background, observable pending requests, fixed-row geometry and minimal NSClipView scrolling; defer completion until target visibility is verified. First native reveal run compiles and runs56 tests, with four hosted large-thumbnail visibility/size assertions failing. Preserve evidence and inspect delayed lazy-list/document frame readiness; add frame/bounds notifications and targeted native lifecycle coverage rather than restoring a timed retry.

4. Add native clip/document frame and bounds notifications so a pending request can resume when lazy layout catches up. Traced hosted-size run02 aborts with SIGABRT6 (Swift concurrency task deallocation in XCTest); preserve the diagnostic crash frames. A tracing-disabled run03 exits normally but fails to find a NameField. Remove the newly inserted full-tree snapshot call from the async test, guard diagnostic JSON validity/nonfinite rectangles, and use smaller reveal-readiness logs to isolate the remaining layout defect. No source behavior or test assertion is declared passing yet.

5. Readiness trace04 proves the Large lazy-stack background is336 points while uniform current rows require360. The strict whole-list height condition deadlocks. Replace it with estimated approach scrolling followed by actual native eye-control geometry verification; only the target at the current row size may acknowledge the request. Observe native row attachment/frame updates, retain weak panel-local references, and retire observers after consumption. Existing18 reveal/options tests pass in6.520 seconds (attempt05). Add four lifecycle regressions including a155-row hosted stack, stale generation/cancel, delayed attachment/row realization, actual position and manual-scroll preservation. Attempt06 runs44 tests with one new large-list failure (missing target eye); preserve it and trace that case before further repair. One source search tried a nonexistent WorkspaceProperties.swift; rg identifies WorkspacePanels.swift and WorkspaceTools.swift.

6. Attempts07–08 reproduce distant-target misses in the155-row fixture: fixed current-height offsets and scaled estimated document-height offsets both miss lazy rows. Preserve both implementations. Attempt09 uses ScrollViewProxy identity navigation after native attachment, then native nearest-edge correction, but fails three visibility assertions because cached row controls retain obsolete ancestor positions. Add the actual native visibleRect/hidden-ancestor guard; clipped cached controls request identity navigation and cannot consume the request. Attempt10 passes22 tests in8.246 seconds. Two apply_patch context mismatches made no source changes; refreshed exact anchors and applied the repairs. Add clipped-ancestor and concurrent rename/selection cancellation tests; retain rename draft identity when its selection observation follows name-draft observation. Attempt11 runs77 tests with four assertions failing in the new clipping fixture: ordinary NSView does not clip by default on this runtime. Explicitly set clipsToBounds and preserve the failed fixture/log. Dismantling the native bridge now clears the callback/request as well as observers. Attempt12 is the repaired broader UI run. No timed retry or eager full-list realization is introduced.

7. Repaired focused12 passes77 tests/10.642 seconds, zero failures/skips. Thirty-six fresh debug-process diagnostics all exit0; all12 rename runs contain one native NameField with NSTextView focus in both the0.6-second and later capture. All36 first/late RGBA images are identical; sampled numeric-region hashes are also identical in this sample. This is bounded repeatability evidence, not a guarantee for all workloads or physical input. Reinspect the retained084 numeric failure: a14-pixel interior field crop matches exactly after a one-pixel vertical shift; the flat background begins one row earlier in one capture while its bottom is unchanged. The inferred intrinsic-height variation remains unresolved; do not weaken the full-workspace equality assertion. A guessed PanelTearOffContainer.swift path was absent; rg found PanelTearOff.swift. Freeze344 Swift files (184 source/160 test) and preserve the diff, all failed attempts and pre-repair versions. Run878 full tests,471 optimized affected tests, universal package verification and46 offscreen package captures sequentially.

8. Full suite passes878 tests/129.678 seconds and optimized affected suite471/22.091 seconds, zero failures/skips. Universal arm64/x86_64 macOS14+ packaging, clean ZIP signature, version0.2.0/build2, icon/licenses and801 factory-menu entries verify. Binary SHA256 953ce283dae942fda995c28261c642ddd8ea66f37ea7e4f0cc7538f2e406330d; ZIP SHA256 cdf3e6c9c5dd01b3964e0e46232cadf6e04911f1230f1d915269058bfd871922. Preserve344 frozen source/test hashes,46 package captures, all failed experiments and repairs in [local evidence archive]. Update status, plan, README and the layout-lifecycle reference manifest. No document imaging algorithm or main-menu mapping changed. Full Photoshop parity and physical input remain unqualified; next address the separately measured numeric-field height variation before Channels work.

9. Inspect46 packaged offscreen captures:45 match084 initial RGBA bytes exactly; only the previously failed rename frame changes, and it matches the successful084 layer-name-recheck-2.png bytes exactly. The inherited four NSAlert captures remain appearance-inconclusive. Clean ZIP signature passes again; the separate Desktop app copy again acquires FinderInfo and fails its strict signature check, so the verified ZIP is the deliverable. Keep exact full-workspace assertions, numeric-height limitation and earlier failed attempts in the record. Update Rename command evidence without changing the801-row main-menu inventory. All native test/build/render processes have completed. Run source/reference/package consistency and development-history refresh/check; the overall goal remains active and incomplete.

10. Initial consistency verifies344 source/test hashes,72 referenced hashes,801 menu rows and current/preserved ZIP plus the immutable pause checkpoint. Initial history refresh/check passes85 milestones,6533 evidence files and2775 logs with zero missing explicit references. Preserve these checks, attach their references to the record, and run final consistency/history checks under unique log names after this note. No application changes followed the source freeze. Continue with the numeric-field height diagnosis, then Channels and mask shortcuts in the user's priority order; no pause or completion is declared.

1. Continue the active goal in UI/menu/UX priority order. Revalidate083 baseline before changes; preserve sources/tests/docs and ZIP under [local evidence archive] at 2026-10-09T14:36:58.372948+00:00. Inspect Rust mask_thumbs_ui.rs, mask_view_cmds.rs and channel_view.rs and native EditorStore, WorkspaceLayers, CanvasView, MaskSampler and selection commands. Adobe's desktop selection-loading guide confirms Command/Shift/Option combination precedence; editing-mask guide confirms Option view and content-thumbnail exit. Rust supplies grayscale/rubylith toggling, ephemeral state and active-layer invalidation. Implement separate canvas-only presentation, mask selection loading and toggles with undo/dirty/stale-work tests. Exact Photoshop mask sampling, live input and defaults remain unqualified while manual unlock is pending. Initial investigation included missing guessed GeometryEditing.swift/select_cmds.rs paths; discover actual definitions before implementation.

2. Implement native mask-channel extraction and canvas-only grayscale/red-overlay images, raw coverage independent of density/feather/enablement, and transformed pixel-mask sampling. Add explicit native thumbnail mouse tracking with captured modifiers, movement cancellation, store/generation/layer checks and accessibility activation. Command takes precedence; plain clicks retain editing targets; Shift toggles are ordinary undoable commands. Preserve composite image/surface and archive data. Clear views on content/path/read/close or lost masks; add generation checks to asynchronous prepared edits so an identical document reload cannot accept obsolete selection work. Add analytical rendering and app-workflow tests plus grayscale/overlay diagnostic flags. Begin focused compilation in [local workspace]; no Rust oracle or live Photoshop equivalence claimed.

3. Focused01 compiles application/imaging changes but test compilation rejects two attempted mutations of EditorSession.document because its setter is private. Preserve the test source and failed log; repair fixture setup by replacing the session with a constructed model. CUA reports the Mac still locked; existing manual-unlock request remains pending. Add native mouse-down modifier, drag/stale/accessibility tests and read/close cancellation coverage before focused02. No app test result is claimed for the failed compile.

4. Focused02 passes27 mask tests in0.158 seconds. Extend with vector-click/selection tests, composite display-byte invariants and hosted native hit targets at all four sizes. Keep vector-thumbnail editing in Layers rather than switching to Paths; retain existing Paths-panel navigation elsewhere. Focused03 runs268 tests and fails eight AX-role assertions: SwiftUI's hidden preview ancestor also exposes the native overlay as AXUnknown. Preserve pre-repair sources and failure log; remove inherited accessibility hiding and explicitly expose native buttons/labels. Correct the new snapshot-mode parser to the existing CommandLine argument convention before running diagnostics. Geometry reload guards also suppress obsolete error/status updates. No live interaction qualification is inferred from these hosted tests.

5. Focused04 passes268 tests/16.980 seconds, including native mask targets at None/Small/Medium/Large sizes. Freeze341 Swift files and preserve current rolling artifacts. Start full validation, but review identifies that selectPath's revision-only update can invalidate an in-flight render without clearing its busy flag. Gate the subsequent optimized/package stage until a deterministic transition test and repair run; let the first full suite finish and retain its result separately. A read-only process listing was sandbox-denied; no escalation or process termination was needed. This planned gate is not a package failure.

6. First full suite passes871 tests/126.248 seconds; preserve its log, captures and source freeze as before-path-exit evidence. Packaging stops at the deliberate gate. A new pending-mask-to-vector regression fails two assertions (rendering remains true and no image arrives), proving the revision invalidation defect. Repair selectPath by restarting a pending render after the target changes; retain a revision-only redraw when idle. Preserve the one-test failed reproduction and pre-repair source, then rerun the affected workflow group. This is a native lifecycle repair, not Photoshop pixel qualification.

7. Focused05 passes276 tests/16.899 seconds, including the repaired pending-render reproduction and added transform workflows. Freeze the final341 Swift source/test hashes again and preserve the earlier freeze separately. Prepare final872-test full validation, optimized affected regressions, universal package/signature checks and46 diagnostics, including grayscale/overlay mask canvases. Preserve rolling artifacts before rerunning the final gates; no application source edits are planned during validation.

8. Final full attempt runs872 tests and reports one existing PanelTearOffTests.testNativeContainerDoesNotChangeHostedWorkspacePixels failure. Preserve the full log/captures separately. Image analysis finds327 changed RGB bytes confined to Properties numeric text at(702,356)–(753,372), with identical alpha; the fixture contains no masks. Focused05 and the earlier full run passed that test. A small crop-shift check does not establish exact equivalence of the whole field region, so do not dismiss or weaken the assertion. Retain the visual/byte evidence and rerun the isolated test on unchanged frozen sources before one full recheck; broad offscreen text stability remains a qualification limit.

8a. The isolated unchanged-source workspace recheck passes1 test/1.276 seconds, with exact pixel equality. Keep the failed full-run capture evidence; do not alter the assertion or application code. Run one full recheck, followed by optimized/package gates only if it passes. Add the text-stability limitation to the reference manifest rather than claiming the earlier failure never occurred.

8b. The single unchanged-source full recheck passes872 tests/127.215 seconds, including the exact workspace comparison. Continue to optimized regression and universal packaging. The prior one-failure run and its327-byte text-region difference remain in the immutable evidence and limitations; no assertion was removed or loosened. Hosted large-thumbnail capture shows content, pixel mask, vector mask and inline name within the narrow Layers dock; this remains an offscreen check.

8c. Universal build and clean ZIP verification pass; inspect46 package captures. Forty-two of44 retained frames are RGBA-identical to083. The two new mask views show the expected transformed grayscale triangle and red overlay. The remaining differences are432 bytes of Properties numeric text and a rename capture that did not reveal its editor. Preserve initial captures. First rerun under default sandbox aborts with SIGABRT6 and no output; the attempted image read consequently fails. Cause is not established. Two subsequent native-permission reruns succeed and match the083 rename image exactly. Record intermittent reveal/capture timing and numeric rasterization as unresolved; prioritize that investigation before additional UI expansion. The four inherited NSAlert captures remain appearance-inconclusive. Clean ZIP signature passes again; Desktop FinderInfo again invalidates only the separate Desktop app copy. No source/test edits followed the final freeze.

9. Final full suite passes872 tests/127.215 seconds; optimized affected suite passes465/20.114 seconds; final focused suite passes276/16.899 seconds, zero failures/skips. Verify341 frozen Swift files and universal arm64/x86_64 macOS14+ package, clean ZIP signature, version0.2.0/build2, icon/licenses and unchanged801-entry factory menu inventory (102 primary/eight alternate shortcuts;151 bound/573 unavailable leaves). Binary SHA256 e3330a1b43bb9a33062361dfd994e71039d980c9bc0999a3218c711f14185e49; ZIP SHA256 24e43c07e64b3288103334df9635f915ab72d1b774478d193986ce641c4658a2. Preserve46 package diagnostics, hosted button checks, all failures/repairs and source/package binding in [local evidence archive]. Update status, plan, README, command mapping and mask reference manifest. Native regression success is not Photoshop byte/physical-input qualification; preserve raw-channel/density/feather, high-depth selection, broad performance and pending channel/keyboard/clipboard/drag limitations. Overall goal remains active and incomplete.

10. Consistency verifies341 frozen source/test files,71 referenced hashes,801 menu rows, current/preserved ZIP and the unchanged pause checkpoint. Initial development-history refresh/check passes84 milestones,6253 evidence files and2642 logs with zero missing explicit references. Preserve audit logs in [local evidence archive]; append diagnostic recheck references to the record and run final consistency/inventory checks after this note. All native test/build/render processes are terminal. Goal remains active: next investigate intermittent rename reveal/numeric capture stability, then Channels integration and verified mask shortcuts in UI/menu/UX priority order.

1. Classify082 as progress and revalidate333 source/test hashes,67 referenced hashes,801 menu rows and current/preserved package hashes. Preserve Sources/Tests/docs/ZIP and rolling evidence under [local evidence archive]. Follow the user’s UI priority: reproduce the visible missing-fine-content defect, then improve thumbnail area coverage and mask preview geometry without editing document pixels. Inspect native LayerThumbnailRenderer/MaskThumbnail/PathThumbnail, MaskProperties/MaskSampler and upstream mask_thumbs_ui.rs. Fixed supersampling can still miss fine details; avoid full transformed-canvas allocation solely for previews. Plan bounded premultiplied area integration with deterministic analytical tests, cancellation and explicit Photoshop-fidelity limits.

2. Add three analytical reproductions for a one-pixel line between sample centers at8/16/32-bit depth, a semitransparent isolated blue pixel with hidden red RGB, and a rotated unit-area pixel split across preview cells. Reproduction01 fails all three tests with15 assertions, confirming point-sampling loss. Implement native premultiplied area integration (fast axis-aligned rectangles and clipped affine footprints), constant-surface fast paths, per-row cancellation and a128-million-sample ceiling; preserve bilinear enlargement. Focused02 passes10 thumbnail tests in0.003 seconds, including all reproductions. No document renderer/resampling algorithm changes.

3. Inspect upstream pixel/vector mask previews: pixel masks show editable grayscale, vector masks show white revealed/gray excluded regions and remain visible when disabled. Adobe’s vector-mask guide confirms disabled red-X behavior but does not establish exact thumbnail sampling/defaults. Historical CS6 and community results are not treated as current factory evidence. Plan document-coordinate pixel-mask sampling with outside coverage/inversion and bounded vector-coverage rasterization. Native raw editing previews will keep density/feather separate, explicitly unqualified against Photoshop (and not complete Rust vector-properties parity); the shared layer-content frame keeps mask/content geometry aligned. Retain the existing Paths-panel outline thumbnail separately.

4. Extend coverage tests to nonconstant affine footprints/reflection, alpha-weighted colors, fractional clipping, mixed-axis scaling, constant-surface/budget behavior, bilinear enlargement and a1060×470 sparse preview. Add eight mask-preview regressions for coordinate transforms, raw grayscale independent of alpha, outside/inversion, all-depth thin features, shared framing, disabled vectors, empty/inverted group masks and invalid inputs. Focused03 passes31 tests in1.813 seconds; debug sparse preview takes0.126 seconds. The small timing is diagnostic, not a broad interactive-performance qualification.

5. Wire content/pixel/vector components through the same cancellation-aware view and include component identity in its task key. Replace the10×10 pixel-mask grid and Layers vector outline with bounded coverage previews; keep PathThumbnail for the separate Paths panel. Preserve exact existing content/canvas-fill framing during refactoring. Add original patterned dual-mask diagnostic fixtures and disabled-mask captures; strengthen the hosted narrow-row fixture with actual shapes instead of solid white masks. Focused04 covers the broader layer/menu/workspace regressions. CUA again reports the Mac locked; previous unlock request remains pending and no physical-input claim is made.

6. Focused04 passes251 tests in16.854 seconds. First debug diagnostics reveal the new mask fixture was inserted below visible top rows (the panel deliberately does not auto-scroll on initial appearance); preserve captures and reorder only the disposable fixture to the top. Inspect upstream mask_thumbs_ui.rs red-X drawing and replace the small fixed SF Symbol with a full-thumbnail1.5-point native cross, preserving hit targets. Focused05 passes251 tests in16.832 seconds. Repaired debug captures show aligned blue content/black-white pixel mask/white-gray vector mask and full-size disabled crosses at the narrow dock width. Entire Document fine text remains tiny but now contributes coverage; comparison with082 changes54 RGB bytes in the expected fine-content region, and analytical tests establish its sampling rather than promising readability below pixel resolution.

7. Freeze337 Swift source/test hashes (180 application,157 tests), implementation diff and diagnostic commands. Preserve rolling artifacts before the full run. Prepare sequential856-test full suite,431 optimized affected tests, universal macOS14+ package/signature verification and44 package diagnostics using explicit YES switch values. Physical input, exact Photoshop sampling/defaults, native mask density/feather preview convention and broad runtime/performance coverage remain unqualified.

8. Final full regression passes856 tests/126.154 seconds, optimized qualification431/19.876 seconds and focused251/16.832 seconds, zero failures/skips. Verify337 frozen Swift files, universal arm64/x86_64 macOS14+ package signature, version0.2.0/build2, supplied icon and licenses. Binary SHA256 f238baad97b5f2673f8c81beff133cf60309a1f53bbf9adbb918b79dff003796; ZIP SHA256 5f6136104185db6da7ba335bcf0ae85fd4f0a72f53c6820c64d6cd4d9a497eaf. Factory inventory remains801 entries/102 primary/eight alternate shortcuts,151 bound/573 unavailable leaves. Document rendering algorithms are unchanged; native pixel-area thumbnail tests do not prove Photoshop resampling parity.

9. Inspect44 packaged diagnostics and hosted patterned-mask/name controls; retain four inherited NSAlert appearance limitations. Update status, plan, README, command mapping and docs/THUMBNAIL_COVERAGE_REFERENCES.json. Preserve failures, repairs, debug fixtures, source hashes/diff, package/signature evidence and next mask-interaction work in [local evidence archive]. Keep density/feather preview treatment, exact mask framing/defaults, physical input, full accessibility/platform coverage and broad performance explicitly unqualified. Goal remains active and incomplete.

10. Final layout comparison finds18 of41 retained frames RGBA-identical to082;23 differ in expected thumbnail regions and two one-pixel numeric-field alignments. Both field crops match exactly after shifting, and all alpha planes are unchanged. Inspect the three new patterned-mask captures and hosted narrow dual-mask/name capture; no layout regression is identified within this offscreen scope. Arm64/Intel builds take63.79/48.69 seconds; the clean ZIP signature passes twice, while Desktop FinderInfo again invalidates the separate local app copy. Optimized sparse-preview timing is0.00503 seconds for the single1060×470 case, not broad latency certification.

11. Consistency passes337 frozen source/test hashes,71 referenced hashes and801 menu rows, with current/preserved ZIP and immutable pause checkpoint intact. python3 scripts/audit-development-history.py and python3 scripts/audit-development-history.py --check pass:83 milestones,6028 evidence files,2564 logs, zero missing explicit references. Preserve logs under [local evidence archive] and refresh/check again after this note with unique final log names. All test/build/render processes are terminal; the goal stays active. Next use mask_thumbs_ui.rs modifier precedence and existing native selection/mask transactions to implement missing mask-thumbnail gestures.

1. Classify081 as progress; revalidate329 source/test hashes,68 references,801 menu rows and package/pause hashes. Preserve baseline source/tests/docs/ZIP under [local evidence archive]. Continue the user’s UI → menus → UX priority. Inspect upstream fixed-size thumbnails and native Layers row, rendering and workspace persistence code; no functional upstream Layers Panel Options dialog is found.

2. Read the installed Photoshop2026 layersPaletteOptions-2772.exv resource. It establishes the title, radio/checkbox order,33/58/83-point preview illustrations and a conditional reorder-preview control; it does not establish live appearance, actual row size or factory values. Record its path/hash and factual control inventory without copying Adobe UI implementation or image assets into the native product. Current Adobe docs confirm sizing; historical CS6 docs describe framing; community/Elements/web results are excluded from current default claims. Several initially guessed Swift filenames/globs were absent; rg locates WorkspaceLayers, CurvesControls, DocumentWorkspace and the actual geometry module.

3. Plan native persisted thumbnail size/framing controls and deterministic transformed-content previews, with compact native mask targets when previews are hidden. Keep settings shared at application scope outside document/history and preserve old workspace files. Retain other dialog control positions as disabled pending complete underlying workflows; no no-op setting is enabled. Medium native row geometry and Entire Document framing are provisional defaults, explicitly not qualified Photoshop factory settings while the Mac is locked. Test cancellation, failure atomicity, persistence, row hit targets, all-depth pixels, clipping/transforms and no document edits.

4. Add native LayerPanelOptions draft/sheet, shared optional workspace preferences, guarded save/cancel, modal/read/close lifecycle and variable-height eye/disclosure controls. Replace raw unpositioned layer previews with bounded transformed content/canvas sampling and cancellation-aware asynchronous image work scoped to store/read identity. None retains compact content/mask edit targets; mask/path previews retain their existing sampling implementation. No document editing algorithm changes. Existing reveal/disclosure/visibility/workspace smoke01 passes48 tests in6.318 seconds.

5. Add14 focused thumbnail/preferences regressions covering geometry/depth/empty/hidden content, cancellation, invalid inputs, legacy persistence, failed/cancelled/stale writes, unchanged archive/history/pixels and hosted narrow dual-mask rows at all sizes. Focused02 fails compilation because the test referred to canChangeDocument on EditorStore rather than DocumentWindows; preserve the test and failed log, assert the store modal guard used by DocumentWindows instead. Remove an unused metrics property. Add dedicated offscreen dialog and thumbnail-size/framing diagnostic flags; these render our content and do not establish live Photoshop equivalence. Focused03 is the repaired attempt.

6. Focused03 executes14 tests with three failed structural Surface comparisons: identical decoded samples can use different sparse tile/default-pixel representations. Preserve the tests/log; compare dimensions, depth and each decoded pixel instead (a first patch mismatched formatted context and made no change). Focused04 passes234 affected workflow tests in16.589 seconds, zero failures/skips. Hosted large/narrow dual-mask row capture is inspected: native eye, both masks and inline name remain usable; fixture cancels initial canvas rendering and is not a live product capture. CUA at approximately06:48 PDT again reports a locked Mac; keep prior unlock request pending, do not bypass, and retain live qualification as incomplete.

7. First debug-dialog command accidentally targets the obsolete cached PhotoCraft executable (last modified Oct7); it produces no image and is stopped with SIGINT after inspection. The current build log links Photato. Re-run the current debug/Photato binary under a unique diagnostic path; its500×548 native dialog renders successfully and is visually inspected (radio choices, original examples, ordered disabled checkboxes, OK/Cancel and spacing). Preserve both logs; no live comparison is claimed. Freeze333 Swift source/test hashes (178 application,155 test files) and prepare sequential full/optimized/universal-package validation plus41 packaged offscreen captures.

8. Full839 and optimized414 tests pass; arm64 and Intel package builds complete in63.48 and48.31 seconds. Clean ZIP signature, architectures/minimum deployment, supplied icon and licenses verify. The Desktop app copy again acquires FinderInfo and fails its separate strict-signature check; the clean extracted ZIP passes the recheck. The first packaged dialog capture times out at30 seconds with no image/output. This attempt had omitted the historical explicit YES values for boolean diagnostic switches. Preserve final-validation/complete-validation logs and final-renders; retry only captures with the established switch format into final-renders-02, without rebuilding/retesting unchanged sources. The timeout cause is not yet established; an argument difference alone is not proof.

9. Packaged capture retry with explicit YES switch values completes41 diagnostics without source/package changes. Cause of the first no-output timeout remains unproven. Fifteen of35 retained layouts are RGBA-identical to081; twenty have changed thumbnail regions, plus one numeric field whose displayed70 value is unchanged (alignment evidence retained). All alpha planes remain unchanged. Inspect the complete contact sheet, new dialog, Large/Layer Bounds captures and four hosted size/name/dual-mask layouts; keep four inherited NSAlert appearance captures inconclusive. Entire Document point-based downsampling can omit subpixel text; record that discovered limitation and prioritize antialiasing with mask framing next. This increment establishes preferences and coordinate framing, not Photoshop thumbnail-byte fidelity.

10. Final full regression passes839 tests/126.427 seconds, optimized qualification414/19.792 seconds and focused234/16.589 seconds, zero failures/skips. Verify333 frozen Swift files, universal arm64/x86_64 macOS14+ package signature, version0.2.0/build2, supplied icon and licenses. Binary SHA256 beb6a39336cdd993870ddfa51aab1aaa77f5161a1c85f9bc7195a31c24dd4ffa; ZIP SHA256 2e846c7de7157a6268dcedbcadc13d5f72175f5ca3b3c2dc5058868e1fc81c35. Factory menu inventory remains801 entries/102 primary/eight alternate shortcuts,151 bound/573 unavailable leaves. Panel Options is a flyout action and does not change those main-menu counts.

11. Inspect41 package diagnostics and four hosted size/name/mask captures; retain four NSAlert appearance limitations. Update README, status, plan, command mapping and docs/LAYER_PANEL_OPTIONS_REFERENCES.json. Keep exact defaults, row geometry, thumbnail byte equivalence, physical input, all-depth mask sampling and remaining preference behavior unqualified. Record test failures/repairs, source diff, separate clean-ZIP/Desktop signatures and next work in [local evidence archive]. Continue mask/row preview UX and remaining panel preferences in the user’s priority order; overall Photoshop parity is incomplete.

12. Initial consistency-helper check fails because adapting the old helper globally replaced329 inside its unrelated hexadecimal baseline ZIP literal, preventing the later intended hash substitution. Preserve the pre-repair helper and failure metadata; replace that literal with the independently verified081 ZIP hash. No application source, tests or package changes. The numeric field crop is byte-identical after a one-pixel vertical shift, confirming alignment variation rather than missing/changed content. Refresh and check the development-history inventory and all current references after this documentation/helper repair.

13. Repaired consistency check passes333 source/test hashes,67 referenced hashes and801 menu rows; current package/preserved081 ZIP/immutable pause checkpoint match. python3 scripts/audit-development-history.py and python3 scripts/audit-development-history.py --check pass with82 milestones,5821 evidence files,2497 logs and zero missing explicit references. Logs are retained under [local evidence archive]. Refresh/check once more after this final record note using unique final log names. No SwiftPM/build/render process remains running; source/package unchanged. Goal stays active; this milestone is progress, with thumbnail antialiasing and mask-preview framing next.

1. Continue the user’s UI → menus → UX priority after verified step080. Preserve source/tests/docs/ZIP and revalidate327 frozen files,69 references and801 menu rows. Inspect Rust layer_reveal.rs and its tests: only actual active-layer changes open closed ancestors and scroll minimally; first-document appearance, manual collapse and manual scrolling stay unchanged. Existing Swift forces centered scrolling on initial appearance and every selection while leaving closed ancestors hidden. CUA again reports the Mac locked; existing unlock request stays pending.

2. Plan a panel-owned observation/request tracker with runtime store and read-generation identity, guarded deferred minimal ScrollViewProxy scrolling and non-editing ancestor metadata updates. Explicit inline-name navigation also requests minimal scrolling. Keep all existing rendering/history/dirty behavior and factory menus unchanged. Apple scrollTo documentation returns a JavaScript shell and its Markdown endpoint is unsupported by web retrieval; qualify behavior through hosted native tests rather than guessing its timing. Source Rust tests remain inspected rather than executed (previous offline serde_json dependency limitation).

3. Implement panel observation scoped by store/document/read generation, one-shot guarded requests, non-editing ancestor expansion and deferred unanchored scrolling. Add eight regressions covering metadata/history/pixels, stale scopes, read/close, filters/modals, rename and hosted long-list navigation. Focused01 executes24 tests with seven assertions failing: the new tracker passed an empty ancestor set to the existing mutator, whose contract rejects empty requests and sets an error that blocks subsequent reveals. Preserve the failed log and pre-repair source; skip mutation when no ancestor needs opening. Also bind explicit rename requests to the pending draft ID so cancellation cannot trigger a late scroll. No editing-engine contract change is needed.

4. Focused02 passes the repaired ancestor logic but exposes two test-fixture assumptions (24 tests/two failures). Existing history redo restores the selection present at Undo, so it correctly changes back to Base and requires a reveal; update the assertion accordingly. The default compact panel displayed only part of the second row, so a15-point minimal scroll was correct, not unwanted centering. Give the hosted fixture a larger Layers area using the existing160-point Properties setting and assert that the target is fully visible before asserting an unchanged offset. Preserve the original tests and failed log; no production scrolling change is inferred from these failures.

5. Focused03 passes24 tests/2.926 seconds with zero failures/skips, including all eight new reveal regressions. Add a ninth hosted regression for a partially clipped row: select it and require exactly the nearest-edge offset, not centering. Enable optional before/after captures through the existing test capture environment variable. Expand qualification to the affected document/panel/menu/workspace workflows before freezing source hashes.

6. Expanded focused04 executes193 tests/two assertions fail. The partially clipped-row test undercounted the thumbnail-driven row height; measure the full row from adjacent eye positions and the known stack gap instead of assuming two points above the eye. The pre-existing eye hit-test fixture expected three lazy rows to exist in a viewport that now correctly starts at the top; enlarge its Layers area explicitly so it still verifies all three native targets without relying on the removed initial centering. Preserve the failed evidence and pre-repair tests. These fixture corrections keep the original native target assertions and do not alter scrolling code.

7. Final focused05 passes193 tests/11.995 seconds, zero failures/skips, including nine new reveal regressions and the existing eye controls/panel/menu/window workflows. Hosted tests demonstrate exact unchanged offsets for fully visible rows and nearest-edge placement for partially clipped rows, deep ancestor opening, initial/manual state preservation, read/close/copy scope guards and pending-name cancellation. Freeze329 Swift files (176 application/153 tests) and implementation diff. Preserve rolling evidence before full/optimized tests, universal package verification and35 retained package renders. The platform and live-Photoshop qualification limits remain explicit.

8. Pre-review candidate passes823 full tests/123.173 seconds,398 optimized/16.631 seconds and universal packaging (arm64 build62.74s, Intel39.32s);35 package renders complete. Final source review finds that resetting tracking on every panel appearance loses selection changes made while hidden and may leave an explicit Rename target offscreen when the command reopens Layers. Preserve the complete candidate source/tests/hashes, logs, ZIP and renders under [local evidence archive], with a relocation map for original log references. Add hosted reproductions for panel reopening and Rename before repairing; the pre-review tests do not qualify the final repaired source.

9. Two hosted reproductions fail with three assertions in reopen-reproduction06: selecting a deep layer while Channels is shown does not open its parents on returning to Layers, and Rename while hidden leaves its editor’s row unmaterialized. Retain the last observed selection across disappearance while cancelling pending requests and rejecting callbacks while invisible. On appearance, process a real same-document selection change and give any explicit rename draft its own reveal request, including first appearance. Keep first-document, unchanged/manual-collapse, read/close and copied-document guards. Requalify all final source after this repair.

10. Repaired-source focused07 passes195 tests/14.036 seconds, zero failures/skips, including11 new regressions and both formerly failing panel-reopen cases. Refreeze329 Swift hashes and complete implementation diff; all preliminary source/package evidence remains under before-panel-reopen. Preserve rolling artifacts again and rerun full/optimized/package/render qualification sequentially. The next UI task returns to Panel Options/thumbnail preferences; no live Photoshop equivalence is inferred.

11. Final full regression passes825 tests/124.71 seconds, optimized qualification400/18.656 seconds and focused195/14.036 seconds, zero failures/skips. Verify329 frozen Swift files, universal arm64/x86_64 macOS14+ package signature, version0.2.0/build2, supplied icon and licenses. Binary SHA256 1ce69fc7ad3fd318736351fab2237e978c9964791475c1531b9612f8fc0522c6; ZIP SHA256 068dcd35f09d6809dedbc782394250ffa3ce1d0e35133ecfb6828e7adeb24553. Factory inventory remains801 entries/102 primary/eight alternate shortcuts,151 bound/573 unavailable leaves.

12. Inspect35 package diagnostics and before/after hosted reveal captures; retain four NSAlert appearance limitations. Update current status, plan, README, command mapping and docs/LAYER_REVEAL_REFERENCES.json. The hosted reveal fixture intentionally uses an8×6 document and cancelled initial rendering; its tiny canvas and spinner are fixture artifacts, not evidence of application rendering regression. Separately check the Desktop app and clean ZIP signatures; record all outcomes in [local evidence archive]. Next inspect native Layers Panel Options/thumbnail preferences; source research finds fixed theme-dependent thumbnail sizes, not a functional upstream options dialog. No physical input or Photoshop-wide pixel parity is claimed.

13. Final package review finds19 of35 retained scenes RGBA-identical to080. Sixteen differ solely in Layers rows after initial top-of-list preservation and minimal rename scrolling; all alpha channels match. Inspect workspace, floating stack and pending-name scenes at full resolution and both final-source hosted reveal images. The Desktop app again fails its separate signature check because file-provider FinderInfo is attached; the clean extracted ZIP passes a second check. Preserve original failures, the preliminary candidate and the repaired-source results separately. While validation ran, retrieve current Adobe desktop thumbnail-size guidance and historical CS6 bounds choices for the next step in [local evidence archive]; do not treat historical defaults or web/Elements results as desktop2026 evidence. Refresh/check the evidence inventory and source/package/menu consistency before ending this increment.

14. Final consistency verifies329 source/test hashes,68 hashed references,801 menu rows, both package hashes, preserved080 ZIP and immutable pause checkpoint. Evidence audit passes81 milestones/5624 indexed files/2436 logs with zero missing explicit references; refresh/check again after this note. Final optimized compilation took80.54 seconds; universal arm64/Intel build phases took63.24/38.84 seconds. All child validation processes are complete. Step081 is progress, not goal completion or a pause; continue082 Layers Panel Options with the saved source/Adobe research and pending live qualification.

1. Classify step079 as progress and revalidate its323 source/test hashes,61 references,801 menu rows, current/preserved ZIP and immutable pause checkpoint. Continue UI → menus → UX. Inspect Rust group_view_cmds.rs, layer_tree_ui.rs/tests and Layers panel commands: expanded state is saved document metadata but does not create history or dirty changes; ordinary triangle toggles one group, Option-click applies the clicked state to every group, and Collapse All Groups is a panel command. Existing Swift uses groupProperties/perform, which incorrectly creates an undo entry for disclosure. Preserve source/tests/docs/ZIP and research in [local evidence archive]

2. Adobe visibility-guide find/open calls are unavailable this turn; a targeted search returns unrelated Adobe products and is excluded. Retain prior guide provenance without claiming a new Photoshop observation. Correct initially guessed source paths using rg. Rust offline test execution remains unqualified after the previously recorded missing dependency. Discover a separate active-layer reveal/minimal-scrolling gap in source layer_reveal.rs; preserve it as the next UI step after disclosure and before Panel Options. The existing Mac unlock request remains pending.

3. Add validated EditorSession.setGroupExpansion outside edit history/coalescing and native store disclosure/collapse-all actions. Locked content remains protected while its panel rows can expand/collapse. Native AppKit triangles retain modifier/cancellation/stale-state guards and sit outside row selection/reordering; Layers menu adds Collapse All Groups with truthful enablement. Extract the existing row filter into a testable store helper without changing its behavior. Smoke01 passes43 existing tests/1.464 seconds.

4. Add15 regressions across Core, Imaging and App: unchanged snapshots/redo/coalescing, selected group flags, invalid batch atomicity, native/PSD mixed-state persistence and exact native render invariance at all depths, clean/dirty state, selected IDs, native pointer callbacks, filters and hosted hit targets. Focused02 compiles and all15 new tests pass, then the later existing LayerPanelWorkflowTests.testPendingNameSurvivesSaveAndDocumentSwitch crashes with SIGSEGV. Preserve its log and crash report ([local evidence archive]). The fault stack is ObservationRegistrar → DocumentWindows.groups → document presentation, not the disclosure mutator. Product startup registers its custom NSDocumentController before creating documents; the new standalone-document fixture did not. Preserve the fixture and explicitly mirror product startup before constructing NSDocuments, then rerun the same sequence. This is a test-bootstrap correction hypothesis until the rerun passes; do not label the crashed run passing.

5. With fixture startup corrected, the same focused03 sequence passes58 tests/1.762 seconds, zero failures/skips, including the previously crashing document-window test. Production startup already uses the required order; no document-controller implementation is changed. Refine native disclosure to the source’s filled down/right triangle geometry instead of an SF chevron, add expanded/collapsed nested-group package diagnostics, and add a regression proving disclosure preserves Option-eye restoration. The exact Photoshop panel-menu placement and physical modifier behavior remain pending live qualification.

6. Focused04 passes249 tests/11.200 seconds, zero failures/skips, including16 new regressions. CUA again confirms Photoshop is inaccessible while the Mac is locked; no duplicate unlock request or bypass. Freeze327 Swift files (175 application/152 test files), preserve rolling artifacts and run full/optimized tests, universal macOS14+ packaging, signature verification and35 package renders sequentially. Keep source-derived disclosure semantics distinct from independent Photoshop verification.

7. The documentation audit’s previous parser could classify an interrupted run from its last passing suite summary. Preserve the old audit script and teach it to detect XCTest process signal termination before considering aggregate-looking counts. Retain those preceding counts only as last_reported_summary, with outcome=crashed. Run five deterministic classification cases plus the actual focused02 log; this records the crash honestly without changing frozen application sources or claiming the partial run passed.

8. Pre-review full tests pass814/121.698 seconds and optimized tests389/14.094 seconds. During read-only final review, identify a missing native control ownership check: separate open copies can retain the same persisted document and layer UUIDs, so matching only those IDs cannot reject a mouse-up after the control is rebound to a different EditorStore. Preserve the complete pre-repair source/tests/hashes and allow its already-running validation to terminate before changing application sources. Strengthen the existing stale-input regression using an actual second document constructed from the same model, reproduce the defect, then bind the press to the store’s distinct runtime identity. These initial passing tests do not qualify the repaired final source.

9. The pre-review validation completes; preserve its full/optimized/build/verification logs,35 captures, source/test hashes and ZIP under [local evidence archive]. The strengthened one-test reproduction fails exactly the copied-document expanded-state assertion in owner-reproduction05, confirming the old click reaches the wrong store. Capture the originating store.identity at mouse-down and require it at mouse-up. The first new diagnostic also reveals that the fixture grouped only the last two text layers, leaving Scene as a sibling; correct its group selection to all artwork above the background so the promised nested-group captures are actually nested. No production grouping algorithm changes are needed. Rerun focused and complete qualification against the final source.

10. Final focused06 passes249 tests with zero failures/skips after the copied-document ownership repair. Refreeze327 source/test hashes and implementation diff. Preserve rolling outputs again, use a distinct final package-preservation directory and rerun full/optimized/package/render validation sequentially; all pre-review evidence remains immutable under before-owner-guard. No claim of exact Photoshop physical interaction is added.

11. The repaired-source full suite passes814/122.077 seconds. The optimized suite executes389 tests but fails the existing PanelTearOffTests.testNativeContainerDoesNotChangeHostedWorkspacePixels exact comparison; all new disclosure tests pass. Preserve release-failed07 and both driver failure logs. No images were captured by that optimized invocation because its runner did not set the existing capture environment variable. Enable a distinct release-pixel-captures directory and rerun the same optimized suite before packaging. Keep this failure distinct from the earlier test-bootstrap crash and do not infer its pixel cause from previous milestones.

12. Final full regression passes 814 tests in 122.077 seconds and optimized qualification 389 tests in 13.917 seconds, zero failures/skips. Verify327 frozen source/test hashes, universal arm64/x86_64 macOS14+ clean ZIP signature, version0.2.0/build2 and supplied icon/licenses/links. Binary SHA256 842113ccff42b58140b5db2b14bb699ada8d195ca77522b3b9ab091c0ffddf90; ZIP SHA256 aa55781a190432914be94760f0422daac93f151dfa9e0f19c6ff550d840b21fd. Static menus retain801 entries/102 primary/eight alternate shortcuts,151 bound/573 unavailable leaves. The new Collapse All Groups command belongs to the Layers flyout; it does not alter the factory menu bar.

13. Review35 package diagnostics, including new expanded/collapsed nested-group scenes; retain four native alert appearance limitations. Update status, plan, README, command mapping and docs/GROUP_DISCLOSURE_REFERENCES.json. Preserve the source-derived next plan for active-layer reveal/minimal scrolling in [local evidence archive]. Record the crash, corrected test bootstrap and audit classification repair separately. Refresh/check evidence inventory and source/package/reference consistency; the immutable pause checkpoint remains unchanged and full Photoshop parity is still incomplete.

14. Final optimized rerun passes389/13.917 seconds and its two captured workspace images are RGBA-identical; the initial failed optimized comparison still has no captured images and its cause remains unknown. All33 retained package scenes match079 exactly; inspect both new nested-group captures at full resolution. Universal build times are63.45 seconds arm64 and38.86 seconds Intel. The separate Desktop app signature check fails again because sync-attached FinderInfo is present; the clean extracted ZIP passes a second signature check. Preserve the exact checks in [local evidence archive]. Do not conflate package integrity, offscreen appearance and live interaction.

15. Evidence audit passes80 milestones/5361 indexed files/2335 logs with zero missing references; consistency verifies327 Swift files,69 hashed references,801 menu rows and current/prior ZIP plus immutable pause hashes. Refresh/check again after this final note. Step080 is progress, not full parity or a pause.

1. Continue the requested UI → menus → UX order. Recheck the step078 baseline and inspect WorkspaceLayers.swift, EditorStore.swift, preview rendering, modal guards, document lifecycle and native controls. Adobe’s layer visibility guide describes dragging through the eye column; original Rust ui-egui/src/panels.rs:1618 and layer_row_ui/tests.rs:185 specify assigning the first eye’s toggled visibility to every crossed row without reordering. Preserve source provenance and investigation read failures in [local evidence archive] No new Rust test execution is claimed.

2. Preserve the complete pre-change source/tests/docs and previous ZIP in [local evidence archive] Implement a document-owned temporary visibility preview, native pointer routing scoped to one panel/window/document, atomic history commit and cancellation/stale guards. Native callbacks/offscreen captures are not live physical-input or Photoshop equivalence evidence. The Mac unlock request remains pending; independent work continues.

3. Add document-scoped visibility drafts to preview rendering and modal guards, retaining committed-only autosave and cancelling drafts on read/close. Native AppKit eye buttons share a panel-owned tracker, covering skipped rows, click/Option/accessibility routing, scroll-edge repetition, Escape, window closure/deactivation and stale document rejection. Add eleven regressions including hosted native hit targets and NSScrollView ancestry. smoke-01.log stopped at Swift 6 concurrency compilation: returning non-Sendable NSEvent through MainActor.assumeIsolated was invalid; return a Boolean decision and return the event outside the isolation closure. focused-02.log stopped at a test typo (rename instead of renameLayer); preserve and correct it. Neither failed compilation executed tests.

4. CUA recheck of Adobe Photoshop 2026 still reports the Mac locked; do not attempt to bypass the lock or infer live qualification. The existing unlock request is pending. Continue independent regression/package work.

5. Focused03 executes30 tests with four assertions failing in the new hosted layout test: AppKit alignment insets make all three native eyes40 points high, and one row’s full-bounds center lies outside the clipped viewport. All behavior tests pass. Preserve both implementation/test files before repair. Set native eye alignment insets to zero to retain the existing22×36 geometry; hit-test the visible clipped portion rather than an offscreen row center. Keep the failed log and rerun separately.

6. Focused04 executes231 tests with two hosted-hit assertions failing; the22×36 sizing repair passes. A separate one-test diagnostic (hit-diagnostic-05.log) reveals that SwiftUI-hosted NSView.visibleRect can extend beyond the eye button’s bounds (305-point width), so selecting that rectangle’s center targets the scroll container. This also exposes a real sweep bug: unchecked visibleRect would treat rows as covering the entire viewport. Intersect visibleRect with button.bounds in both the production sweep and hit test. Preserve the pre-repair control and both failed logs; verify the exact native hit target again. The earlier assumption that visibleRect already meant the clipped button rectangle was wrong.

7. Focused06 passes all11 new tests/0.805 seconds. Add a hosted short-drag regression that checks only the actual eye row changes, plus window-close/foreign-window-release and external-edit cancellation tests. Move the row’s SwiftUI selection/reorder gesture area beside the eye control so eye dragging cannot start a reorder. Add a deterministic visibility-preview diagnostic and composite the preview document in snapshots. This diagnostic remains separate from physical pointer qualification.

8. Final focused07 passes233 tests in11.114 seconds, zero failures/skips, including all13 new regressions and the real hosted short-drag/hit-target checks. Freeze323 Swift source/test files (174 application/149 test files), preserve rolling evidence again, then run full, optimized, universal-package and33 offscreen diagnostic checks sequentially. Do not label the locked-Mac native callback tests as physical input or claim Photoshop undo-history equivalence.

9. Final full regression passes 798 tests in 121.559 seconds and optimized qualification 373 tests in 13.859 seconds, zero failures/skips. Verify323 frozen source/test hashes, universal arm64/x86_64 macOS14+ clean ZIP signature, version0.2.0/build2 and supplied icon/licenses/links. Binary SHA256 af60fb15e4328ae086781d3fe68282f22e5bfdb6061f177667bdad2e43c959f8; ZIP SHA256 5501b71e6df555bfb0e0c74c878f97ff52bd0b867d922a28d32629060910c61f. Menus retain801 static entries/102 primary/eight alternate shortcuts,151 bound/573 unavailable leaves. These counts are not full feature parity.

10. Review33 packaged offscreen diagnostics, preserving native alert appearance limitations and all raw captures. Update status, plan, README, command/reference matrices and docs/LAYER_VISIBILITY_DRAG_REFERENCES.json. Read-only next-step investigation finds the current disclosure incorrectly uses a document history command, while Rust group_view_cmds.rs applies clean, unjournaled view metadata; Option-click affects all groups. Preserve this plan in [local evidence archive]. One Swift source lookup ran from the Rust cwd and was corrected before reading. Refresh/check development history and source/package/reference consistency before continuing. Immutable step059 pause checkpoint remains unchanged; overall goal stays active.

11. Package review compares32 retained scenes and one new visibility-preview scene. Fifteen retained captures are RGBA-identical; remaining eye-icon changes are confined to14-pixel-wide columns, with maximum channel difference2/255. The organization capture also repeats the known one-pixel Y-field placement variation; its normalized glyph RGBA pixels match exactly. Keep four NSAlert captures appearance-inconclusive. render-difference-qualification.log and offscreen-layout.json record measurements. Desktop bundle verification again fails with resource/Finder metadata, and xattr confirms com.apple.FinderInfo; the clean extracted ZIP passes a second strict signature check. Do not repeat metadata removal or disable sync. Qualified delivery remains build/Photato.zip.

12. Final consistency verifies323 source/test hashes,61 hashed references,801 menu rows, current and preserved ZIP hashes and the immutable pause checkpoint. Initial history audit passes79 milestones/5106 evidence files/2235 logs/zero missing explicit references. Optimized compilation takes81.58 seconds; arm64/Intel builds64.42/40.02 seconds. All validation processes are terminal. Step079 is a tested native increment, while full Photoshop functionality/byte equivalence remains incomplete and the goal active. Refresh/check the inventory after this outcome note; continue with the preserved group-disclosure plan.

1. The previous goal turn is progress: step077 completes native text/menu history and delete confirmation with766 full/341 optimized tests. Revalidate317 source hashes,57 reference hashes,801 menu rows, current/preserved ZIP and immutable pause checkpoint. Preserve sources/tests/docs/ZIP. Read the record requirements, current Layers UI/Core command/history paths and Adobe organization/visibility guides (updated September28/October6,2026). One initial Adobe open returns an internal error; targeted retry succeeds. Existing lclr metadata persists initial labels, but existing-layer context changes, selected visibility commands and Option-eye isolation are missing. Keep the full Photoshop objective and UI-first priority unchanged.

2. Implement atomic selected color-label changes and visibility maps, native row/context controls and factory Hide/Show Layers routing. Isolation keeps a bounded original visibility snapshot, supports restoration and invalidates after manual visibility/topology changes or history navigation. Preserve text/modal/transform guards, active selection, document pixels, native/PSD metadata and one-step undo. Group/clipping/default/menu-order equivalence still needs independent live reference. Eye-column dragging, recursive disclosure and Panel Options remain subsequent UI work rather than being counted as implemented.

3. Add Core LayerOrganization commands for atomic selected labels and visibility maps, preserving reserved lclr bytes and no-op encoding. Keep group children’s individual visibility, ancestor paths and required clipping bases during isolation; retain a document-local restoration fingerprint and invalidate on visibility/topology/history/read/close changes. Add native context colors, blank hidden-eye affordance, Option-click row handling and factory Command-comma Hide/Show routing without altering menu inventory/shortcuts. Smoke01 passes42 tests/1.497 seconds. Fourteen new Core/app regressions then pass with56 focused tests/1.482 seconds, including unchanged rendered surfaces at every depth and native/PSD label round trips. Add stale external visibility and document-isolation ownership cases, exercise native menu key-equivalent dispatch and add two organization/isolation diagnostic scenes before broader validation. Round trips and synthesized AppKit callbacks are not live Photoshop evidence.

4. Expanded focused03 passes161 tests/9.116 seconds, zero failures/skips, including native Command-comma dispatch and two added stale/document ownership cases (16 new tests total). Inspect organization and isolation debug scenes. The first has a render spinner and the second an omitted Y-field string, consistent with the prior offscreen uncertainty. Source inspection finds snapshot() freezes its render before History/organization setup, which subsequently restarts asynchronous renders. Preserve the source/captures and move the diagnostic freeze after all setup; this makes captures use the complete final model and removes that render race, without claiming it explains every earlier native-text variation. CUA still reports Mac locked; no live inputs or repeated unlock request.

5. Focused04 passes161 tests/9.055 seconds, zero failures/skips. Repaired debug captures show no render spinner and retain Y=250 in organization/isolation/History scenes; inspect all three at full resolution. This resolves the observed diagnostic race while earlier uncaptured pixel differences remain unproven. Freeze321 Swift files (173 application /148 test files), save the implementation diff and start sequential full tests, optimized tests, universal packaging and32 offscreen diagnostics. Preserve rolling evidence before package changes; no other SwiftPM process is live.

6. Independent Rust review finds its explicit show_only handler: an already-solo layout with no saved snapshot reveals all rows; changing solo targets retains the original snapshot. Its visibility map does not force a clipped layer’s base visible. The initial Swift implementation omitted the no-snapshot fallback and invented clipping-base visibility. Hold optimized/package work at a deliberate gate while the frozen full suite finishes, preserve its source/results, and correct these semantics rather than treating a tested approximation as source parity. Full pre-repair tests pass782 cases; the driver then stops at the deliberate gate. Add fallback and ancestor-alias restoration regressions, and retain all pre-repair files/logs. An exact-text patch initially fails after swift-format changes wrapping; inspect the actual block and apply it correctly before testing. Rust select.isolateLayers is a separate row-filter feature and remains unavailable; do not bind it to Option-eye solo.

7. Corrected focused05 passes163 tests/9.141 seconds, including source fallback and ancestor-alias restoration. Further source review shows unrelated undo does not clear the source solo snapshot; remove unconditional undo/redo clearing and retain the existing visibility/topology fingerprint check after actual history changes. Add a regression proving Undo of a label edit preserves the original mixed visibility restoration. Read/close still explicitly retire document-local snapshots. Preserve conservative topology invalidation and exact Photoshop history behavior as unqualified rather than claiming full source/Photoshop equivalence.

8. Final focused06 passes164 tests/9.098 seconds, zero failures/skips (19 new regressions across this increment). Refreeze321 Swift files, update helper expectations to785 full/360 optimized tests, preserve rolling outputs again and run final validation sequentially. An optional offline execution of the original Rust solo test stops at dependency resolution: serde_json is not cached (exit101), so no Rust test is claimed to pass. Preserve its log; the Rust comparison remains inspected-source/test evidence. The new Swift module and menu workflows are independently exercised by the current focused suite.

9. Final full regression passes 785 tests in 122.084 seconds and optimized qualification 360 tests in 13.478 seconds, zero failures/skips. Verify321 source/test hashes, universal arm64/x86_64 macOS14+ ZIP signature, version0.2.0/build2, supplied icon/licenses/links. Binary SHA256 a32f7abcd626ee11bfc930ad75762b550c6ac68c94ba07d5b9a63698e4c669b1; ZIP SHA256 a25a1f60b8b1a563d77b2ae917a6ce2e7c4aa80e0c02a6c52d72992191624e84. Inspect32 package diagnostics, retaining four native alert captures as appearance-inconclusive. Menus retain801 static entries/102 primary/eight alternate shortcuts; Hide/Show adds one native leaf for151 bound/573 unavailable. These counts do not prove feature parity.

10. Update status, plan, README, command/menu matrices and docs/LAYER_ORGANIZATION_REFERENCES.json; retain original evidence scopes and the immutable pause checkpoint. Next implement eye-column dragging, recursive disclosure and Panel Options, and qualify outstanding live inputs after unlock. Preserve source-review corrections, initial debug captures, held pre-repair full run and failed offline Rust dependency resolution under [local evidence archive]. Refresh/check the development-history and source/package/reference audit before continuing.

11. Final visual comparison preserves all30 prior scenes plus two new label/isolation scenes. Twenty-five ordinary retained layouts are pixel-identical; four raw NSAlert captures remain appearance-inconclusive. History and one new organization capture differ by a one-pixel Y-field position, with identical glyph pixels after translation and matching debug/package rechecks. Correct the previous missing-text interpretation retrospectively and retain both images. Desktop signature again fails with observed FinderInfo; the independently extracted ZIP verifies and its binary hash matches. Do not repeat the ineffective metadata removal or change sync settings. Record the actual package as the qualified artifact, then audit source/package/menu/reference consistency and the full development index.

12. Initial final audit passes78 milestones/4921 evidence files/2179 logs/zero missing explicit references. Consistency verifies321 source/test hashes,60 hashed references and801 menu rows, the current package, preserved step077 ZIP and immutable pause checkpoint. Arm64/Intel builds finish in64.92/63.61 seconds; optimized compilation takes81.75 seconds. Record the final consistency and refresh/check the inventory after this outcome note. Step078 is complete as a bounded native increment; the overall feature/byte equivalence goal remains active. Next implement native eye-column dragging and continue recursive disclosure/Panel Options, with live Photoshop qualification still pending.

1. Classify the previous goal turn as progress: step076 completed native Layers menus/inline names and atomic selected deletion, with 756 full/331 optimized tests and universal packaging. Revalidate 313 source hashes, 54 evidence references, 801 menu rows, current/previous packages and the immutable pause checkpoint. Preserve sources/tests/docs and the current ZIP. Inspect native menu targets, rename field editor, document lifecycle and deletion helpers. A guessed DocumentKeyboard.swift read fails; locate actual responder logic with rg in DocumentWorkspace, CanvasView and FloatingPanelWindows. AppDelegate Undo/Redo currently always routes to document history, whereas Cut/Copy/Paste use the responder chain. Read Apple NSTextViewDelegate undo-manager documentation and the previous Adobe organization/visibility references. Keep the overall feature/byte equivalence goal intact.

2. Reproduce native inline-text undo behavior and provide text/document-aware menu validation and execution without changing factory shortcuts. Add native deletion confirmation for menu/footer/context with Option-click bypass, cancellation/stale-target guards and one atomic edit. Qualify dynamic Rename Group naming. Continue color-label/visibility/panel preference work after these higher-priority menu/UX defects. Live comparison remains pending if the Mac is still locked; native callbacks and offscreen diagnostics are not live input.

3. Native field probe01 confirms AppKit already enables typing undo and supplies an undo manager. Direct UndoManager.undo restores editor text but does not immediately synchronize the layer-name draft (one failed assertion). Preserve probe source/log and repeat through the standard native undo:/redo: responder actions before choosing the menu route; do not replace AppKit’s native text undo with a custom text model based on this incomplete probe.

4. Probe02 reproduces stale draft text through native undo:/redo: actions as well. Keep AppKit’s existing undo manager; observe its completed undo/redo notifications for the owning field and synchronize only the matching draft. Add explicit-window history-menu validation/execution so editable native text gets native undo while non-text responders retain document history, including modal/busy guards. No factory title/key inventory is changed; dynamic Undo/Redo titles follow their actual target. Add native-window tests before deletion UX work.

5. Repair03 passes 12 native field/Layer panel tests with zero failures. Add contextual native delete alerts and an immutable request snapshot, optional footer bypass, cancellation and stale document/selection rejection. While confirmation is open, the shared modal guard rejects competing edits. A single group can retain its editable children through the existing atomic Ungroup operation; the dialog disables content deletion when it would remove the last layer or locked contents. Group-specific alert geometry/wording remains a proposed native workflow pending Photoshop capture. Update the prior immediate-delete context regression to explicitly accept the new prompt, and add tests for native history routing, no fall-through from empty text history, stale editor notifications, confirmation cancellation, footer modifiers, stale requests, group-only undo and native button states.

6. Focused04 passes 28 tests/0.488 seconds; expanded focused05 passes 144 tests/8.728 seconds with zero failures/skips. Verify the intended Rename Group patch actually applied: a whitespace-dependent replacement had matched no source, so correct the existing one-line condition explicitly and add an exercised menu regression. Give Group Only the Return key when full-content deletion is unavailable. Add four native alert-content diagnostics (single, multiple, group, only remaining group) alongside workspace/inline-name renders. The multiple fixture retains an unselected background so its ordinary confirmation action is enabled. Native dialog text/button geometry remains unqualified against live Photoshop.

7. Focused06 passes 144 tests/8.762 seconds with zero failures/skips. All seven offscreen diagnostics complete, but the four NSAlert captures omit native background/label rendering (white button shapes and transparent areas); they are inconclusive for appearance and must not be recorded as visual passes. Preserve those images and add native alert layout/bounds assertions. Keep AppKit’s actual confirmation UI rather than changing the product to match a faulty offscreen capture. The existing workspace/inline-name diagnostics remain available for visual inspection; actual alert appearance, keyboard, menu-click focus and dismissal require the unlocked Mac.

8. Final focused07 passes 144 tests in 8.812 seconds, zero failures/skips; freeze 317 Swift source/test files (171 application /146 test files). Inspect normal/compact/inline-name debug renders; retain four incomplete native alert captures separately as inconclusive appearance evidence. Start sequential full tests, optimized tests, universal packaging/signature verification and 30 diagnostic renders. CUA checks Photoshop again and reports Mac locked; the prior unlock request remains pending and no live input is performed.

9. While the frozen full suite is running, review finds that the inline-name local mouse monitor treats every event from another/no window as outside input. Menu-bar and popup-window events must preserve text focus so native Edit Undo can target the field. Set a deliberate gate at the not-yet-started optimized/package script; let the already-running full test finish and preserve its source hashes/log before repairing event classification. This newly identified UX issue justifies rerunning verification; no old result will qualify the repaired source.

10. The first full suite independently fails one pre-existing pixel equality assertion in PanelTearOffTests (765 tests, one failure,119.248 seconds); the optimized/package gate is therefore never reached. Preserve the full driver/log and frozen source. The menu-event repair and new regression pass145 focused tests in8.791 seconds. Add opt-in PNG capture evidence to the unchanged pixel assertion, then rerun the full suite with an isolated capture directory to investigate the mismatch; do not weaken its exact comparison or claim the first full run passed.

10a. The captured rerun passes all766 tests in118.420 seconds. Both1000×650 native workspace images are decoded-RGBA-identical (zero changed bytes); inspect the captured workspace. The original pixel mismatch has no preserved image and remains unexplained; the comparison assertion is unchanged. Record this limitation in research and the pixel investigation manifest instead of asserting a root-cause repair. Restore CUA documentation and recheck Photoshop; the Mac is still locked. Inspect existing label metadata and native row code for the next plan. Failed guessed Rust/Core paths are resolved with rg; no upstream source is modified. Optimized qualification passes341 tests; packaging continues sequentially.

10b. Universal arm64/Intel builds finish in62.58/38.90 seconds; optimized tests pass341/13.272 seconds. Clean ZIP signature/icon/licenses/minimum14/version checks pass. A separate Desktop copy signature fails after FinderInfo is attached. Remove only that observed root attribute, retaining fileprovider/provenance. Immediate signature passes, but FinderInfo reappears and a later check fails again. Preserve both checks and repair metadata; the clean ZIP and extracted candidate remain verified and their binary/archive hashes are unchanged. Do not claim durable Desktop signature validity or disable sync.

10c. Inspect the30-image package sheet and full-size inline-name/group-alert captures. Twenty-five retained layouts are RGBA-identical to step076. The History capture omits its Y=250 field (630 changed RGBA bytes); inspect both versions and rerender the same packaged binary once into a unique path. That recheck is pixel-identical to step076. Preserve initial/recheck images and classify this as unexplained offscreen variation requiring live qualification, not a source repair. Four NSAlert captures still omit native backgrounds/button labels and remain appearance-inconclusive. Native field/property source is unchanged in this increment; no live outcome is inferred. Record these limits before finalizing documentation.

11. Final full regression passes 766 tests in 118.42 seconds and optimized qualification 341 tests in 13.272 seconds, zero failures/skips. Verify317 source/test hashes, universal arm64/x86_64 macOS14+ ZIP signature, version0.2.0/build2, supplied icon/licenses/links. Binary SHA256 26c91218f6ebd0fd072ab1494611b342e432244fe34e2b2888305908e5830b81; ZIP SHA256 611296238ecc37b65db020d0ce4b5975ae8fbf1d01e148a73e2cb49d73ae6fb4. Inspect30 packaged diagnostics, retaining four native NSAlert captures as appearance-inconclusive. Menus retain801 static entries,102 primary/eight alternate shortcuts and150 bound/574 unavailable leaves. These are bounded tests and packaging evidence, not Photoshop feature completion.

12. Update status, plan, README, command matrix and docs/LAYER_EDITING_UX_REFERENCES.json, retaining historical reference scopes and the immutable pause checkpoint. Next implement color labels, visibility controls and Panel Options. The prior pixel assertion failure and native undo probes remain preserved in [local evidence archive]. Refresh/check development-history and source/package/reference consistency before continuing.

13. Initial final inventory audit passes with 77 milestones, 4706 evidence files, 2113 logs and zero missing explicit references. Source/package consistency verifies317 Swift files,56 hashed references and801 menu rows, preserved step076 ZIP and unchanged pause checkpoint. Step077 is a completed bounded native increment; full Photoshop feature/byte equivalence remains incomplete. Keep the Desktop signature instability, captured pixel/text variation and locked live qualification explicit. Continue color-label and visibility UI work next. Refresh/check the inventory and final consistency after this outcome note; all native validation processes are terminal.

14. Retrospective correction recorded during step078 on2026-10-09: direct pixel inspection shows that both step077 History captures contain the Y=250 glyphs. Their RGBA glyph pixels are identical after a one-pixel vertical translation; the earlier “omitted Y” interpretation in steps10c and the preserved offscreen notes was mistaken. Preserve the original records and point to [local evidence archive] for the measured correction. The separate first full-suite pixel failure has no preserved image, so its cause remains unproven. No live UI behavior is inferred.

1. Classify the previous goal turn as progress: step075 completes Duplicate Layer/Group with740 full/315 optimized tests and universal packaging. Revalidate308 source hashes,48 references,801 menu rows and current/previous package hashes before preserving sources/tests/docs/ZIP. Read native Layers/dock/menu/rename/mask/merge implementations, current status/record requirements, original Rust row/context-menu/multi-delete/inline-rename logic and Adobe Layers panel guide (2026-02-23). Correct guessed helper filenames using rg; these failed reads do not modify source. CUA still reports Mac locked; prior unlock request remains pending and live reference capture is unqualified. Rust context-menu ordering is a behavioral port source, not independent proof of Photoshop2026 layout.

2. Replace the Layers hamburger's generic organization content with editing commands; retain organization separately. Share command identity/validation across row and panel contexts, preserve selected rows, and do not route multi-selection to active-layer-only edits. Add native inline naming with Return/Tab/focus-loss commit, Escape cancellation, stale-target/empty/no-change guards and one undo step. Qualify minimum-layer/lock behavior for atomic selected deletion before exposing it. Keep unsupported effects, Smart Objects, export and panel preferences visibly unavailable. Capture and verify native menus/field behavior and layout before freezing sources and starting full/release/package checks.

3. Adobe Learn’s 2026-01-12 “Give your layers meaningful names” tutorial explicitly advances downward with Tab. Implement that over visible panel rows; Shift-Tab reverses, with no wrap. The Rust inline editor only commits Tab. Exact Photoshop filtered/collapsed/boundary behavior remains unqualified. Add shared native layer-name draft and NSTextField ownership/callback guards, outside-click commit, name-only double click and main-menu Rename binding. Remove the incorrect raster-thumbnail rename action. Stage multi-selected subtree deletion with final-layer/inherited-lock guards and one history entry; retain legacy single-delete for existing empty-document core callers. Replace the Layers flyout and row actions with shared contextual validation and keep custom row utilities separately. Full flyout ordering remains a proposed layout pending Photoshop capture, not a claimed reference match.

4. Compile/smoke attempt passes25 tests. Focused attempt02 compiles55 tests with two assertions failing in the newly added main-menu test: its NSDocument had no native window and therefore was not active in the shared controller. Preserve the failed test source/log, attach its window controller and activate it as existing document-menu tests do. Existing engine/inline-edit/selection tests passed. Add explicit native field focus/outside-click coverage and an inline-name offscreen diagnostic. Keep the edited row visible temporarily if a panel filter would otherwise hide it; exact filtered Photoshop navigation remains unqualified.

5. Broader focused attempt03 crashes in SwiftUI while an existing empty-floating-host test pumps the run loop; no application assertion reports. Isolated attempt04 reproduces signal11 in that same test before the new field tests execute. Preserve the diagnostic report (Swift reference-count/SwiftUI ForEach layout frames) and pre-repair source. Isolate the large shared menu into its own View component to reduce enclosing WorkspaceView captures/type complexity, then rerun the reproducer before proceeding. This is an investigated application regression, not a passing test or a live-input result.

6. Component isolation resolves the crashing empty-floating-host reproducer in attempt05. The new hosted field test then exposes four failures: the initial focus path calls both makeFirstResponder and selectText, allowing a redundant end-edit callback to retire the draft. Preserve source, request focus only through selectText, read the active field editor’s text before focus loss, and compare native event window numbers for outside-click detection. The test now edits the actual field editor rather than changing only the control’s backing string. Rerun the isolated native workflow before broad verification.

7. Isolated attempt06 passes11 tests, including hosted full-name selection, Return/Tab/Escape delegation and outside-click commit without duplicate undo. Add save/switch/close/read draft lifecycle handling and a persistence regression. Focused attempt07 passes173 tests in10.222 seconds with zero failures/skips. Freeze313 Swift source/test files. Offscreen render attempt01 times out because the sandbox cannot connect to AppKit services (its log is preserved); repeat under approved window-service access in debug-renders-02. Native diagnostics are offscreen evidence, not live input.

8. Full regression completes756 tests/118.436 seconds with zero failures/skips; optimized compilation/testing and packaging proceed sequentially. During independent follow-up research, Adobe’s 2026-09-28 organization guide confirms additional delete-confirmation/Option-click and color-label gaps; the 2026-10-06 visibility guide confirms solo/restore invalidation, eye-column dragging, recursive disclosure and selected Show/Hide commands. Capture these references in research/next-ui-plan. Code inspection also identifies native text-field Undo/Redo dispatch for the next UX pass; no physical key qualification is inferred from the callback tests.

9. Inspect the normal, compact and inline-name debug layouts before final validation. Full regression passes 756 tests in 118.436 seconds, optimized qualification 331 tests in 12.973 seconds, zero failures/skips. Verify universal arm64/x86_64 macOS14+ packaging, clean ZIP signature, version0.2.0/build2, icon/licenses/links and313 source hashes. Binary SHA256 3c16caee567f255e72d5cac12255aa13229dd225399a7609acf3ffc4ee6712c1; ZIP SHA256 60c93180b8d7c20953350b969a8a874b5dda70f8e19a2e02d9c0d116bc7b9343. Inspect26 packaged layouts; preserve all render comparisons separately. Menus retain801 static entries/102 primary/eight alternate bindings; Rename adds one native leaf for150 bound/574 unavailable. These counts do not prove feature parity.

10. Update status, plan, README, command/menu matrices and docs/LAYER_PANEL_REFERENCES.json; cross-link prior menu/Duplicate evidence without changing its original scope. Preserve the historical pause checkpoint. Next address delete confirmation/Option-click, dynamic group naming, color labels, visibility and Panel Options. Physical input, actual flyout order, Photoshop filtered/locked/Background/deletion semantics and broad output equivalence remain open. Refresh/check the development-history and source/package/reference inventory before further code changes.

11. Final arm64/Intel builds finish in62.30/61.19 seconds. The clean ZIP signature passes; the Desktop app later acquires com.apple.FinderInfo at its bundle root and fails a separate signature check. Inspect attributes, remove only that observed root attribute and retain fileprovider/provenance metadata; the immediate deep/strict signature recheck passes without source/binary/ZIP changes. All25 retained package layouts exactly match step075 RGBA pixels, and all three frozen-debug/package comparisons match; inspect the26-image sheet and full-size inline field. CUA still reports Mac locked; no live candidate or Photoshop input is performed. The newly discovered delete-confirmation, dynamic group-name/color-label, visibility and text-Undo gaps remain explicitly scheduled.

12. First history check passes76 milestones/4491 evidence files/2049 logs, with no missing explicit references. Source/package consistency checks313 Swift files,53 hashed references and801 menu rows, including the previous ZIP and immutable pause checkpoint. A final metadata review finds stale149/575 counts in the menu reference manifest despite its new follow-up; preserve that manifest, correct current counts to150/574 and add a consistency assertion. Attach the initial consistency result to the run record, then refresh/check the final inventory again. No application source or package is changed by this documentation repair.

13. Final consistency passes 313 source/test files, 54 hashed references and 801 menu rows; package hashes, preserved previous ZIP and pause checkpoint match. Final history audit passes 76 milestones, 4492 evidence files and 2049 logs with no missing references. Step076 is complete as a bounded native increment; the overall goal remains active and incomplete. The next increment begins with inline text Edit-menu/Undo routing and delete-confirmation UX, followed by color labels, visibility controls and Panel Options.

1. Previous goal turn is progress: step074 completed New Group,723 full/298 optimized tests and universal packaging. Revalidate304 source hashes,40 references,801 menu rows and packages before preserving sources/tests/docs/ZIP for step075. The overall Photoshop goal remains incomplete. Reopen Adobe Duplicate layers and Create document from layer/group guides (both2026-02-23), inspect the Rust multi-selected duplicate command, native engine/clipboard/document-controller and draft/menu infrastructure. Native duplication currently copies only the active subtree immediately. Clipboard centering, selection clearing and document bounds are inappropriate to reuse without explicit duplicate semantics. An initial search included nonexistent ToneControls.swift; resolve the guard definition with rg. CUA still reports Mac locked, so live dialog geometry/defaults remain pending and the existing unlock request is not repeated.

2. Implement the documented name/destination dialog and preserve editable subtree content. Support same-document multi-root copies in one undo step, copies into another open document and a new document retaining source canvas/depth/resolution. Remap layer/pattern IDs, preserve mask/path data and reject unsupported profile/precision contexts explicitly until color conversion is qualified. Keep source documents unchanged for transfers; validate stale/closed/busy destination and cancellation. Add focused engine/workflow/menu/native-layout tests before full regression and package checks.

3. Add a shared Core duplication module with normalized root selection, complete ID/parent remapping, per-original same-document placement, named single copies, pattern-conflict remapping, all-depth raster/mask conversion, source-canvas new documents and staged validation before publishing. Current-document copies retain locks and clipping; transfers detach only an external clipping base. Different ICC profiles and Gradient Map into RGB32 fail explicitly. Add observable native drafts, name/destination/New controls, dynamic Layer/Group/plural titles, shared modal guards and cancellable background preparation with stale/closed destination checks. Menu/context actions open the dialog; the existing whole-layer immediate helper remains available to its prior caller. Native controller ownership enables destinations and marks newly created documents unsaved. These are implemented semantics pending independent Photoshop qualification, particularly differing canvas sizes, profiles, Background, clipping and new-document metadata.

4. Initial focused run compiles and executes 53 tests in2.523 seconds, with one failure in a new test: it assumed a copied locked group would be the last layer even when its original was below other layers. The implementation correctly inserts directly above the original. Preserve failing output and test source; inspect the active copied group for its retained lock instead. All eight app workflow tests passed, including cancellation, destinations, menu controls and sample preservation. Add four offscreen dialog diagnostics (single, group, multiple and New destination), format touched Swift files and rerun focused coverage. Existing Sendable/unused-local/SwiftPM warnings remain unrelated.

5. Corrected focused coverage passes178 tests in10.219 seconds. Add two substantive regressions for a concurrent destination update after preparation starts and atomic rejection at the32-level group limit/locked destination. Final focused coverage passes 180 tests in10.112 seconds, zero failures/skips, including 17 new tests (eight Core/nine app). Freeze 166 application /142 test Swift files (308 total) and preserve the implementation diff. Prepare release verification scripts with full-suite prerequisites before running the full suite, optimized tests, universal build and25 diagnostic renders. Full parity/live input remains unproven.

6. Review four debug dialog renders. The multi-selection variant centers its intrinsic-width controls, and current-document Destination shrinks compared with New. This visual inconsistency warrants a layout repair: expand the dialog content and destination picker/group to the available width so labels/buttons keep consistent positions. First full suite completes740 tests with zero failures before any source edit. Preserve that log, source freeze/diff and pre-repair UI source; the new run will qualify the layout-adjusted source. No editing-engine change is made. Preserve initial renders and use a separate directory for repaired layouts.

7. The expanded layout passes180 focused tests and a second740-test full run (117.544 seconds), but inspection still finds the popup centered inside its frame. Preserve that full/source evidence before the final leading-alignment repair. An exact-string patch first fails because formatting wrapped the accessibility identifier; source remains unchanged and an inadvertently started focused05 run simply revalidates it. Preserve that failed patch account, apply a smaller verified replacement and rerun focused06: 180 tests pass in 10.171 seconds, zero failures/skips. Inspect final debug renders03: title, content, buttons and Document/Name fields now align consistently with no overflow. Re-freeze308 sources and diff; start final full → optimized → universal-package validation only after visual review. Initial renders, both superseded full passes, all focused attempts and pre-repair sources remain preserved.

8. Final full regression passes 740 tests in 118.096 seconds, optimized qualification 315 tests in 12.91 seconds, zero failures/skips. Verify universal arm64/x86_64 macOS14+ packaging, clean ZIP signature, version 0.2.0/build2, supplied icon/licenses/links and 308 source hashes. Binary SHA256 a5aae70db33bfd14f664503bf071363ac1e4cea4d3253b9a647987acde132d02; ZIP SHA256 43264a9ed620d4c85a10cd22d3d66aee60181bf6d11066a057852b8ec5d343dc. Inspect 25 packaged layouts including all four Duplicate dialog states. Static menu inventory remains 801 entries/102 primary/eight alternate,149 bound leaves/575 unavailable; the existing Duplicate selector now opens the dialog with context-sensitive titles and no new shortcut.

9. Update status, plan, README, duplicate command evidence and docs/DUPLICATE_LAYER_REFERENCES.json; cross-link menu/New Group follow-ups. Preserve earlier qualification scopes and the immutable pause checkpoint. The next UI/menu increment is the Layers panel command menu, currently exposing only generic panel organization actions. Exact panel order, duplication placement/defaults and physical input await unlock; independent native development remains available. Refresh/check history and source/package consistency before further source changes.

10. All four packaged Duplicate dialogs are byte-identical to final debug renders03. Twenty previous layouts remain pixel-identical to074; Gradient workspace differs at327 RGB component bytes within the previously varying X-position field and matches073 exactly. Inspect enlarged RGB detail and retain the unestablished cause instead of claiming universal visual equality. Local Desktop and clean ZIP signatures pass without repair; arm64/Intel build phases take61.36/60.01 seconds, optimized compilation76.94 seconds. CUA again reports Mac locked after packaging; no packaged candidate is launched for live interaction. During validation, inspect the actual Rust layer context menu and inline-rename tests after correcting a guessed source path. Record Layers panel command routing and inline naming as the next UI/menu/UX gaps; no next source edits begin before this checkpoint audit.

11. Final development-history check passes with 75 milestones /4316 evidence files /2000 logs /zero missing explicit references. Consistency verifies 308 source hashes /48 hashed references /801 menu rows, current app/ZIP, preserved step074 ZIP and the immutable pause checkpoint. Refresh/check again after this outcome note. Version remains0.2.0/build2; no source changed after final qualification. The Photoshop-equivalence goal remains active and incomplete; proceed next with Layers panel commands and inline renaming.

1. Classify the previous goal turn as progress: step073 added and qualified New Layer, with709 full/273 optimized tests and universal packaging. Revalidate its300 source hashes,38 hashed references,801 menus, packages and immutable pause checkpoint. Preserve sources/tests/docs/current ZIP before step074. The goal remains incomplete and active; live-only Mac lock does not prevent independent implementation. Read step073 next-UI proposal, Core grouping/hierarchy/PSD logic, New Layer draft infrastructure, menu routing and original Rust group/naming commands. Reopen official Adobe create-layers-groups (2023-05-24) and opacity/blending (2026-09-28) guides. They establish option fields, footer modifiers and default Pass Through, not current live geometry or pixel equivalence.

2. Correct the Group… and Group from Layers… dialog workflows while preserving immediate CmdG Group Layers. Group options must apply name/color/mode/opacity in one undo transaction, keep parent/subtree/clipping invariants and cancel without edits. Footer plain/Option/Shift/Command behavior must be explicit and tested; unsupported compound semantics remain unqualified. Use the existing native label metadata and archive version. Qualify module state, menu distinction, native control bounds and current image preservation before package/evidence checks.

3. Add group options and a transactional hierarchy builder shared by old/new commands. Construct a candidate hierarchy before publishing, including the depth-limit check. Preserve selected root/subtree order and inherited locks/clipping checks. New Group and Group from Layers now have distinct selectors/drafts; CmdG stays immediate. Add native name/color/Pass Through-or-mode/opacity fields, focus and Return/Escape bindings, stale document/selection validation and group footer routing. Share creation-modal guards with New Layer and close the feature-map/alert overlap gap. Shift requests selected grouping and takes precedence over Command in compound footer combinations; exact Photoshop compound-modifier behavior remains unqualified. The Rust source confirms first-unused Group N naming and grouping at the top selected root; its broader cross-parent behavior is not yet ported.

4. First focused attempt fails to compile because the Pass Through picker tag used BlendMode?.none, which Swift parses as optional chaining on a metatype. Preserve the failing log and pre-repair source; replace the tag with explicit Optional<BlendMode>.none. No tests ran and no package was replaced. Add a noncontiguous selected-roots regression after reviewing the source grouping order, then rerun the complete focused scope.

5. Second focused attempt exposes an import collision: both SwiftUI and PhotoCraftCore define BlendMode, so the explicit optional tag must use PhotoCraftCore.BlendMode. Preserve the second failed build and pre-qualification source; qualify the picker tag and the matching test type annotation. No tests ran or package changed. Retry under a third unique log.

6. Third focused attempt passes 163 tests in 9.925 seconds, zero failures/skips. Fourteen new tests qualify group options, nesting limits with raw-command atomicity, noncontiguous/root-subtree ordering, clipping/locks/caps, all eight native footer routes, invalid/stale/cancel behavior, modal/alert guards, menu distinction and active-document ownership, field bounds, bounded Pass Through sample preservation and native/PSD group settings at RGB8/16/32. Inspect both offscreen debug dialogs: default Pass Through and configured Group from Layers fields fit. Freeze 164 application /140 test Swift files (304 total) and implementation diff; start full regression before optimized checks and universal packaging. CUA still reports the Mac locked; no live dialog interaction is claimed and the prior request is not repeated. Scripts parse successfully before package execution.

7. Full regression passes 723 tests in 120.482 seconds and optimized qualification passes 298 tests in 12.375 seconds, zero failures/skips. Verify universal arm64/x86_64 macOS14+ packaging, clean ZIP signature, version0.2.0/build2, supplied icon/licenses/links and the 304-file source freeze. Binary SHA256 74c31416a4e5e22f30544796d2aa99185f0c4061c9c745af8c87019bfb99c30e; ZIP SHA256 d08383fb8cab3cb1237ee5a7e2459cc8fff4345a41be4788927a3969efe738bd. Inspect twenty-one packaged offscreen renders, including default and configured Group from Layers content. Menu inventory remains 801 entries /102 primary /eight alternate;149 bound leaves /575 unavailable; Group from Layers now has a distinct selector, without a new menu entry or shortcut.

8. Update status, plan, README, the three group command rows and docs/NEW_GROUP_REFERENCES.json; cross-link menu/New Layer follow-ups. Keep previous qualification scopes and the immutable pause checkpoint. Refresh/check the development-history inventory and source/package/menu consistency before further implementation. Next implement Duplicate Layer/Group name/destination workflows and multi-selection semantics, then the Layers panel menu. The goal remains active and incomplete; physical input and Photoshop exactness still await unlock/reference work.

9. Inspect all21 packaged images and both new dialogs at full resolution. Eighteen prior layouts remain pixel-identical; Gradient workspace differs at327 RGB component bytes within the X-position field, with the same zero value and a small rasterization/vertical-placement difference. Its cause remains unestablished; preserve enlarged RGB comparison, and do not claim all layouts are identical. An initial crop was mistakenly described as the disabled Free Transform label; the exact RGB crop corrects that attribution to the field below. Both new dialogs are byte-identical to debug outputs. First consistency check catches the stale Group from Layers selector in docs/MENU_PARITY.csv; preserve the failure and update only that action to groupFromLayers, matching the tested menu report. No source/package repair or unrelated retest is required. During packaging, inspect Duplicate Layer primary guides and Rust multi-selection semantics; save the next-step research without changing the frozen application sources.

10. Final inventory audit passes with 74 milestones /4134 evidence files /1945 logs /zero missing explicit references. Consistency verifies 304 source hashes /40 hashed references /801 menu rows, current app/ZIP, preserved step073 ZIP and the immutable pause checkpoint. Save and hash the consistency and next-UI proposal in the milestone record, then refresh/check again after this outcome note. No application source changed after the tested freeze; version remains0.2.0/build2. The goal remains active, with Duplicate Layer/Group next in the UI/menu/UX sequence.

1. Continue UI → menus → UX priority from qualified step072. Revalidate its consistency (296 source hashes, 36 references, 801 menu entries, packages and immutable pause checkpoint). CUA still reports the Mac locked; the prior unlock request remains pending. Review generic dock menus, Gradient/Pattern panel actions, History and official Adobe panel guides. The Layers menu review exposes a prerequisite: Cmd–Shift–N currently creates immediately instead of presenting New Layer options. Prioritize that native dialog before broader panel menus. Adobe’s “Create layers and groups” guide (updated 2023-05-24, accessed 2026-10-09) specifies Name, clipping, Color, Mode, Opacity and mode-neutral fill; Option-click footer opens options, Command-click inserts below. This is behavioral documentation, not current Photoshop visual qualification. Other read-only references: 2026-10-04 Patterns panel guide and History state guide. A few guessed filenames did not exist; actual implementations were located with rg. No edits resulted from those failed reads.

2. Preserve all application/test sources, docs and current universal ZIP before edits. Inspect command insertion, native sheet ownership/draft guards, PSD label metadata and blend modes. Implement transactional creation, cancellation and stale-draft protection; test module semantics and native controls before full suite and packaging. Exact Photoshop name/default/mode-neutral quantization and live Return/Escape/modifier interactions remain independent qualification gates.

3. Implement LayerCreation with a single undoable command, above/inside/below-group placement, clipping/parent-lock/cap validation, transparent or mode-neutral sparse raster fill at all depths, deterministic unused layer names and PSD lclr label access. Reuse existing source metadata/native archive version8 and preserve unrelated/reserved bytes. Read Adobe’s layer-opacity guide (2026-09-28) for the seven modes without neutral fill, Adobe PSD specification for the eight-byte label record and primary psd-tools enum documentation for color codes0–11. UI swatch shades and exact Photoshop defaults/rounding remain unqualified. Add native New Layer sheet with validated opacity/name, clipping eligibility, Return/Escape bindings, color/mode pickers and inline failure; store draft guards block editing/history/document switches. Menu Cmd–Shift–N opens options; plain/Option/Command/combined footer routes immediate/dialog/above/below. Expose labels in the visibility column. The footer remains enabled when only below-group insertion is legal, and commit rechecks concurrent editing state.

4. First focused attempt compiles and executes40 tests in2.012 seconds (2.016 reported wall), with one failure: the UI test assumed a SwiftUI Button had a concrete NSButton descendant. The native text-field bounds and all engine/workflow/PSD/menu tests passed. Preserve the failed log and pre-repair test. Replace that unsupported implementation-class assumption with a native field/value/bounds assertion; cancellation remains independently exercised by the store workflow test. This does not establish physical Return/Escape or button interaction. Existing RasterDecodeBudget Sendable, unused Healing test local and SwiftPM native-build deprecation warnings remain.

5. Corrected/broader focused run passes 145 tests in8.964 seconds (8.977 reported wall), zero failures/skips. Fourteen new tests cover native/Core creation, option validation, group placement, clipping/locks/caps, all-depth neutral sample storage, labels and PSD/native preservation, cancellation/stale drafts, modifier routing, menu context, document-switch guards and native field bounds. Add two deterministic offscreen dialog diagnostics. The first diagnostic command accidentally used the obsolete PhotoCraft scratch executable from October7; no image was produced and its own subprocess was terminated at30 seconds. Preserve the failed attempt and correct only the product name to Photato; the separate retry renders default and Soft Light dialogs successfully. Inspect both images: text, controls, disabled neutral fill and selected name fit. This is content rendering, not live sheet or physical input verification. Freeze 162 application /138 test Swift files (300total) and source diff; start full regression before optimized coverage and universal package qualification.

6. The release driver was invoked before the full-suite process had completed; its prerequisite assertion correctly stopped it before any second SwiftPM process or package mutation. Preserve [local evidence archive]; retry only after confirmed completion. Final full regression passes 709 tests in 121.317 seconds and optimized qualification passes 273 tests in 12.647 seconds, zero failures/skips. Verify universal arm64/x86_64 macOS14+ packaging, clean ZIP signature, version0.2.0/build2, supplied icon/licenses/links and the300-file source freeze. Binary SHA256 98290d067cac614fbef0b5f03cf0de79a78d53c63a1b7b9e4654db563995ca7b; ZIP SHA256 81492e486887c66d58c22b7803052a4121e972552f16decfa00cf58c4e502067. Inspect nineteen packaged offscreen renders, including both New Layer dialog states. Menu inventory remains 801 entries /102 primary /eight alternate;149 bound leaves /575 unavailable. No new binding is counted because the selector already existed.

7. Update status, plan, README, New Layer command evidence and docs/NEW_LAYER_REFERENCES.json. Preserve original qualification scopes and immutable pause checkpoint. Refresh/check development-history inventory and source/package/menu consistency. The overall goal remains active and incomplete; next correct New Group/Duplicate dialog workflows before the Layers panel menu and continue the UI-first sequence. Physical input/Photoshop exactness remain pending after unlock.

8. All17 existing packaged layouts are pixel-identical to step072; both new packaged dialog images are byte-identical to their debug counterparts. Nineteen images were reviewed as a contact sheet and the two dialogs at full resolution. The arm64/Intel builds and local Desktop/clean ZIP signatures pass without metadata repair. Optimized compilation took79.90 seconds. CUA reports the Mac still locked during packaging; no candidate is launched for live interaction and the prior request is not repeated. Read the Rust naming helper after implementation and confirm it also selects the first unused Layer N. Preserve the next New Group/Group from Layers/duplicate workflow proposal in the step073 run, without starting another source edit before this audit completes.

9. Final inventory audit passes with 73 milestones /3980 evidence files /1908 logs /zero missing explicit references. Consistency verifies 300 source hashes /38 hashed references /801 menu rows, current package hashes, preserved step072 ZIP and the unchanged pause checkpoint. Save the release, live-limit, offscreen, source, consistency and next-UI manifests in [local evidence archive]. Refresh/check once more after this outcome note; no implementation work or goal-wide blocked audit is pending for this checkpoint. The Photoshop-parity goal remains active.

1. Continue the user’s UI-first sequence after the verified step071 dock columns. Preserve sources/tests/docs and the universal ZIP; step071 final audit and consistency passed. The Mac remains locked and the existing unlock request is pending, so no live input is claimed. Read existing popover routing, panel topology/visibility, CloneSources, undo/redo sessions and the official Adobe guides retained in the previous next-panel proposal.

2. Integrate History and Clone Source into retained docking and native floating hosts. Replace the special History rail popover with a native utility icon dock, retain Clone Source hidden until requested, and preserve active-document behavior. Add versioned panel-catalog migration: validate old ten-panel topology before adding either new panel, keep existing groups/columns/hidden/floating states, and reject malformed/unknown data. Preserve Window menu titles/shortcuts and current clone editing semantics. Add forward History state navigation with draft guards; snapshots/nonlinear history/preferences remain separate future work. Qualify minimum-size panel content, isolation, migration and menu routing before full/package checks.

3. Add the versioned catalog decoder and utility icon dock, integrate both panels with native dock/floating content, remove their separate popover state and retain menu selectors. Clone Source gains flexible embedded width and scrollable content. History shows past/current/future states and guarded backward/forward navigation; existing undo/redo transactions and memory trimming remain authoritative. Correct the collapse-arrow direction for left docks. Update earlier fixtures to account for the two added catalog entries and hidden Clone Source without weakening their movement, sizing or isolation assertions. Existing 120 focused tests pass in8.212 seconds; nine new tests then pass with 129 focused tests in8.640 seconds, zero failures/skips. Add an identifier-collision migration test and History/Clone Source diagnostic layouts before final qualification.

4. Ten new regressions pass with 130 focused tests in8.730 seconds, zero failures/skips. Inspect compact History, Clone Source and minimum275-point Clone Source debug renders; future history rows are dimmed and the embedded controls fit horizontally. Detail crops confirm the tool rail remains present. Review tightens legacy validation to its original ten-panel column-count limit rather than the new twelve-panel limit; add an excessive-old-column rejection case to the migration regression. Record that the utility dock changes factory canvas width by five points versus the former special rail; exact Photoshop geometry remains unqualified pending live comparison.

5. Final focused attempt04 passes 130 tests in8.682 seconds, zero failures/skips. Freeze 160 application /136 test Swift files (296total) and the implementation diff; run full regression, then optimized Clone/History/workspace/image coverage and universal packaging. The existing diagnostic hooks are extended for History, Clone Source and minimum-width Clone Source. No user files or Photoshop preferences change. Native windows remain test-owned and offscreen; actual interaction is unqualified.

6. Full regression passes 695 tests in 120.138 seconds; optimized qualification passes 259 tests in 11.421 seconds, zero failures/skips. Verify universal arm64/x86_64 macOS14+ packaging, clean ZIP signature, version0.2.0/build2, supplied icon/licenses/links and the296-file source freeze. Binary SHA256 87cd61832a2007b1395f25b1ca7cc90470486c35b75c98b9e4f506f1e34b9cb8; ZIP SHA256 98dd82d123d9f5607eeb0a469cf5e8d070ec21dc1179130b21299b05559c48c2. Inspect seventeen packaged offscreen renders, including retained History and normal/minimum-width Clone Source. Menu inventory remains 801 entries /102 primary /eight alternate;149 bound leaves /575 unavailable. No new menu command is counted because these selectors were already bound.

7. Update status, plan, README, the History/Clone Source command evidence and utility-panel reference manifest. Keep earlier qualification scopes explicit and the historical pause checkpoint unchanged. Refresh/check the evidence inventory and source/package/menu consistency before further implementation. The overall goal remains active and incomplete; next UI work covers full panel menus, keyboard/accessibility, factory workspaces and preferences, with actual interaction comparison after unlock.

8. Optimized compilation completes in75.67s; arm64 release build in61.61s and Intel in39.20s. Clean ZIP and local Desktop signatures pass without metadata repair. Existing RasterDecodeBudget Sendable and SwiftPM deprecation warnings remain. Three prior floating-panel/stack renders have zero changed RGBA bytes; the eleven prior workspace renders change within dock/canvas bounds as expected from the utility dock and left collapse-arrow correction. All seventeen current layouts are inspected, including full-resolution History/minimum-width Clone Source. CUA still reports the Mac locked; retain the pending request without repeating it. Preserve the next panel-menu/keyboard/preferences investigation plan separately. A guessed DocumentWindows.swift read was absent; current native window routing remains in the already compiled document-window modules; no changes result from that failed read.

9. Evidence refresh/check passes 72 milestones /3,828 evidence files /1,870 logs /zero missing explicit references. Consistency verifies all 296 tested source hashes,35 linked records and801 menu rows, current universal package hashes, preserved step071 ZIP and the immutable pause checkpoint. Refresh/check again after this documentation-only outcome. Overall goal remains active; no pause, completion or goal-wide block is claimed. Resume from the saved next UI plan and current tested package; no unrecorded implementation is in progress.

1. Classify step070 as verified progress and revalidate its 290 source/test hashes, 33 linked records, 801 menu rows, current package hashes, preserved previous ZIP and immutable pause checkpoint. Read the development requirements, current UI plan, saved layout/topology/sizing and native drag/drop controls. Preserve sources/tests/docs and the step070 universal ZIP before changes. CUA still reports the Mac locked; the earlier unlock request stays pending. Two guessed Adobe docking/collapse URLs are inaccessible; resolve the actual links from the previously read stacking guide instead. Do not claim the failed pages were read.

2. Plan retained ordered dock columns, explicit column/new-column destinations, native vertical insertion and horizontal resize controls, per-column sizing/collapse/reveal and saved layout migration. Keep floating stacks separate from remembered dock placement and preserve each panel's single location and document undo isolation. Support sides around the canvas and preserve the existing default workspace; qualify compact sizes instead of silently overwriting saved widths. Continue exact Photoshop comparison and remaining History/Clone Source integration after this column stage.

3. Read Adobe's actual collapse/expand icon guide (updated February23,2026): individual icon expansion, double-arrow collapse, width-dependent labels and drag/reposition behavior. The actual dock/undock URL still times out and is not treated as read. Add optional column descriptors and remembered per-group destinations, explicit existing/new-column moves, side/order/width/collapse operations, per-column row sizing and validation. Preserve legacy primary width/collapse fields. Plan temporary icon presentation when a custom layout exceeds available space without rewriting saved preferences; mark exact Photoshop compact behavior unqualified. Start existing regression coverage before wiring native controls and icon presentation.

4. Existing focused coverage passes 101 tests in 7.048 seconds, zero failures/skips, on the column topology. Add native vertical insertion targets and horizontal divider callbacks, ordered left/right columns, icon/label controls with panel flyouts, per-column collapse and keyboard-accessible dock actions. Native tear-off activity becomes observable so new canvas-edge targets exist only during panel dragging and cannot intercept ordinary painting. Keep hidden/floating destinations, preserve default single-column dimensions, and record compact icon presentation as provisional pending Photoshop comparison.

5. Focused UI attempt02 runs 101 tests with one failure (7.492 seconds): the existing hosted row-splitter test chooses the first resizable view, which is now the new horizontal column divider, then sends vertical input. Preserve that fixture/log; select the vertical splitter explicitly, retaining the size/undo assertions and adding separate native horizontal input coverage. Review also preserves icon-flyout selection when legacy layouts first materialize and uses the actual source column's expanded width for floating/tear-off. Add independent column migration, transfer, sizing, lock/reveal and native-control regressions before final qualification.

6. All 112 focused tests pass in 7.857 seconds, including 11 new column regressions and the explicitly selected vertical splitter. Review identifies a compact-layout interaction gap: explicitly expanding a column could immediately auto-collapse it again. Track the most recently expanded/revealed/moved dock as transient presentation priority and allocate it available space while retaining saved dimensions; add a twelfth regression requiring a compact expansion/reveal to stay visible. Add diagnostics for wide/compact columns, collapsed icons and labels before final source freeze.

7. Focused attempt04 passes 113 tests in 7.832 seconds, zero failures/skips. Inspect five debug offscreen variants and top-left detail crops: the apparent top overlap is absent, but the label-width variant visibly loses the tool strip. Preserve source/tests and add a full-workspace native bounds/hit-test regression before repairing the layout. Two source reads used nonexistent WorkspacePropertiesView.swift/WorkspaceToolbarView.swift names; locate the actual files in WorkspacePanels.swift/WorkspaceTools.swift. These diagnostics remain pre-release and do not qualify live input.

8. Preserve three one-test failures from the tool-visibility investigation (1.854s/0.900s/0.901s). The native hit-test probe used host-local rather than superview coordinates; correct that conversion, retain the bounds assertions and remove diagnostic prints. The explicit workspace-frame experiment did not fix the invalid probe and is reverted. Three isolated label renders show the complete tool rail without a production layout change; preserve the earlier anomalous image and do not claim its cause established. All 114 focused tests pass with thirteen new column regressions. Freeze 158 application /135 test Swift files (293 total) and the source diff, then run full/optimized/package qualification. Live rendering and input remain pending.

9. Byte/pixel comparison clarifies the visual investigation: the original label PNG and all three rechecks have the same SHA256 and zero changed pixels. The earlier inline impression of a missing strip was not supported by the saved image evidence; no application rendering defect is established. Preserve this correction, all images and comparison.json. The corrected full-workspace regression passes in the 114-test focused run (8.014 seconds); the new test verifies actual native bounds and hit coordinates without changing production layout.

10. Full regression passes 685 tests in 117.514 seconds; optimized qualification passes 243 tests in 10.929 seconds, zero failures/skips. Verify universal arm64/x86_64 macOS14+ packaging, clean ZIP signature, version0.2.0/build2, supplied icon/licenses/links and the 293-file source freeze. Binary SHA256 bbb7589e6fb830f15096dddecc9b50ff57a0f4120d6a0e8cc94038f0b952a3f8; ZIP SHA256 7e01c4c5804ba5ebc4db5691651d3e4350ed1eb26197187fddc8823826af60af. Inspect fourteen package offscreen renders, including expanded/compact docks and icons/labels. Menu inventory remains 801 entries /102 primary /eight alternate;149 bound leaves /575 unavailable. Offscreen/test callbacks do not qualify live Photoshop interaction.

11. Update status, plan, README, command matrix and dock-column references; preserve all attempts and the corrected visual-investigation account. Live qualification remains separately recorded; previous pause checkpoint is unchanged. Refresh/check the evidence inventory and source/package/menu consistency before the next implementation increment. During next-panel source review, two assumed filenames were absent; locate menu routing in PhotoshopMenus.swift and Clone Source in CloneControls.swift. Next required UI work is History/Clone Source integration and complete panel menus. Overall goal remains active and incomplete.

12. Both architecture builds pass (59.90s arm64 /36.25s Intel); clean ZIP and local Desktop signatures verify without a metadata repair. Existing RasterDecodeBudget Sendable and SwiftPM deprecation warnings remain. All ten pre-existing packaged render variants have zero changed RGBA bytes; four new dock variants are inspected in the fourteen-image contact sheet, with full-resolution expanded/label review. The native menu inventory is unchanged. CUA still reports Mac locked; retain the pending unlock request. Save the next-panel migration proposal and three current official Adobe guide references in next-panel-design.json; the unlocalized Clone Source URL failed, its actual linked Canada URL succeeds. A guessed History.swift source path is absent; history lives in PhotoCraftCore/Engine.swift.

13. Evidence refresh/check passes 71 milestones /3,679 evidence files /1,832 logs /zero missing explicit references. Consistency verifies all 293 tested source hashes,37 linked records and801 menu rows, current package hashes, preserved step070 ZIP and the immutable pause checkpoint. Refresh/check once more after this documentation-only entry. No goal completion/pause/block is claimed; the next UI integration can proceed independently of the live-only lock.

1. Revalidate step069: 288 source/test hashes, 34 linked records, 801 menu rows, package hashes and immutable pause checkpoint agree; final evidence audit passes 69 milestones /3,393 files /1,764 logs /zero missing references. Preserve sources/tests/docs and previous universal ZIP before changes. Read the native panel topology, sizing, drop controls, floating hosts and tests, plus Adobe's current stacking guide. A lookup used the nonexistent WorkspaceLayout.swift filename; locate that model in SavedWorkspaces.swift. Live input remains unavailable while locked; no duplicate unlock request or bypass.

2. Scope this increment to floating stacks with independent stable host identities, one native panel per stack, native edge drop/reordering and shared movement/resize/close. Preserve individual group collapse/selection and hidden locations; retain optional-field migration for existing layouts. Separate expanded frame storage from visible collapsed/hidden rows; keep top edges stable and docking/tear-off free of duplicate groups. Window-menu reveal should leave an unrelated collapsed dock unchanged. Test ownership, persistence and native callbacks without presenting test windows; then full/optimized/package/render checks. Additional dock columns and full Photoshop panel/menu fidelity remain future work.

3. Add optional stack membership with independent host IDs and shared validated geometry; implement stack insertion/reorder, departure-size recovery, visible/expanded row sizing, native shared-window ownership and edge/splitter controls. Reuse the existing private drag payload and Command tear-off path. Initial focused compilation fails because a closure captures a partially initialized sizing value; preserve the failed source/log and use a local expanded-size dictionary before assigning stored properties. No tests ran in attempt01, so no test-produced rolling artifacts were overwritten; preserve the root artifacts before the repaired run. Native tear-off now uses the displayed floating row's expanded height rather than the entire stack height.

4. Repaired existing suite passes 92 tests in 6.781 seconds. Eight added regressions pass with 100 focused tests in 6.972 seconds, zero failures/skips. Review then identifies that resizing a visible row while another is collapsed must retain the collapsed row's expanded size; update native frame recording to reallocate only visible expanded rows, and add a ninth regression. Add separate offscreen stack/partially collapsed stack diagnostics and remove the unused prior diagnostic capture. Preserve the standalone-panel API's shared-frame invariant if called for a stack member. Real pointer/Command/Escape and Photoshop comparison remain pending.

5. Focused attempt04 executes 101 tests with one failure (7.224 seconds). The new resize test's expanded row sizes pass, but the native top edge moves by 34 points. Preserve the affected source and run a reduced diagnostic: one test/one failure (0.495 seconds). It shows the desired visible frame fits while its hidden expanded portion extends below the screen; fitting the expanded frame first incorrectly shifts the visible window. Fit the visible collapsed/hidden rectangle instead, retaining expanded row sizes separately and using actual visible row sizes after screen recovery. Also remove a newly exposed actor-isolation warning: measure AppKit titlebar metrics on the main actor and pass them into pure topology operations. No assertion is weakened; remove only diagnostic prints after preserving them.

6. Focused attempt05 passes 101 tests in 6.845 seconds, zero failures/skips, including the unchanged top-edge assertion and all nine new stack regressions. Freeze 156 application /134 test Swift files (290 total) and the implementation diff. The AppKit actor warning and unused capture warning are absent from this build. Full regression then passes 672 tests in 116.718 seconds, zero failures/skips. Start optimized universal packaging and ten offscreen renders, including expanded and partly collapsed stacks. Tests use isolated native windows without presenting them; live input remains unqualified. During independent next-column design review, an assumed WorkspaceSizing.swift path is absent; sizing remains in PanelDockSizing.swift and layout state in SavedWorkspaces.swift. Preserve the unimplemented column proposal separately.

7. Full regression passes 672 tests in 116.718 seconds and optimized qualification passes 230 tests in 10.027 seconds, zero failures/skips. Verify the universal arm64/x86_64 macOS14+ package, clean ZIP signature, version0.2.0/build2, supplied icon, licenses, links and the 290-file source freeze. Binary SHA256 a9e3e7893957b0cf71368f2a092d8e68d7a38c55b3ff26bc1b66ef50f734e0f6; ZIP SHA256 c85f98eb6df09afc49aac591d938f6a6a7425d2786d89961b909c55137444c56. Inspect ten offscreen package renders, including expanded and partly collapsed stack content. Static menus remain 801 entries /102 primary /eight alternate shortcuts;149 bound leaves /575 unavailable. No Photoshop function is promoted to complete by these layout tests.

8. Update status/plan/README/command matrix and floating-stack references; preserve earlier panel/tear-off/menu claims with explicit follow-up links. Keep the compile failure, resize failure, reduced diagnostic, passing repairs and implementation diff in [local evidence archive]. Record post-package live availability separately, then refresh/check the development evidence inventory and source/package/menu consistency. The goal remains active and incomplete. Next required UI work is additional dock columns and remaining panel integration, with real window/input and Photoshop visual qualification after unlock. The historical pause checkpoint remains unchanged.

9. Both architecture builds pass (56.37s arm64 release /32.57s Intel); the first local Desktop signature attempt reports Finder metadata, then the build script's bounded retry verifies the local app. Clean ZIP signature verification passes independently. Existing RasterDecodeBudget Sendable and SwiftPM deprecation warnings remain; no new stack actor warning remains. CUA still reports the Mac locked after packaging; retain the pending unlock request without repeating it. Compare eight existing render variants with step069: seven have zero changed RGBA bytes; Gradient has 109 changed RGB pixels /327 color-channel bytes confined to the Properties X position field, both visibly showing 0. The complete current Gradient PNG is byte-identical to step068. Preserve detail crops and avoid claiming pixel identity for that comparison. The first comparator used RGBA getbbox, whose zero alpha difference hid RGB bounds; preserve attempt01 and correct the bounds through RGB. These diagnostics do not qualify Photoshop appearance or live behavior.

10. Development evidence refresh/check passes 70 milestones /3,527 evidence files /1,790 logs /zero missing explicit references. Final consistency checks all 290 tested source hashes, linked records, 801 menu rows, current universal app/ZIP, preserved step069 ZIP and immutable pause checkpoint. Run the inventory refresh/check again after this documentation-only outcome entry; unchanged application code does not require another test run. No goal completion, pause or blocked status is claimed: additional dock columns and remaining UI/menu/functionality work can progress independently of the live-only lock.

1. Classify step068 as progress and revalidate its 286 source/test hashes, 28 linked records, 801 menu entries, current app/ZIP, preserved previous ZIP and immutable pause checkpoint. Read current requirements/status/plan and panel controls/coordinator/model. CUA still reports the Mac locked; the earlier unlock request remains pending. Revisit Adobe’s official Move Panels guide: Command prevents docking and Escape cancels. Inspect AppKit’s native drag source API and the current implementation; a failed/cancelled drag must not be guessed to mean a float operation. A source search used an unmatched NativeTab* glob and was corrected to directory-based rg. No user document/settings or unrelated repository changes were made.

2. Plan explicit native tear-off receivers for workspace/floating-panel content and temporary desktop drop surfaces during a native panel drag. Commit only through a successful drop callback; the session-ended callback performs cleanup only. Preserve drag anchor/size, revalidate library/document/layout identity, and route Command drops to floating while retaining normal blue dock insertion feedback. Desktop surfaces must not become key/main windows, must sit beneath editor windows and must close after success, cancellation or application deactivation. Tests will exercise test-owned native controls/payloads and geometry; real Escape/pointer/window-order behavior still requires live qualification. Floating stacks and extra columns remain subsequent required stages, not fulfilled by this tear-off foundation.

3. Add a document-window-owned tear-off coordinator, native ancestor drop containers and temporary transparent desktop targets, and route Command drops from existing tab/boundary destinations to the float transaction. The source’s session-ended method only closes temporary targets. Initial formatting/compilation fails because an overbroad text replacement inserted a guard into the boundary highlight expression; preserve the failed source/log and repair that expression. No tests executed in attempt01.

4. Existing focused attempt02 passes 83 tests in 5.042 seconds, zero failures/skips. Add seven native drag regressions using a test-owned NSDraggingInfo/pasteboard, with no OS event synthesis. The first new-test compile fails because the deprecated promised-files protocol method also exists on NSObject and needs override; preserve the failed fixture/log and add the required keyword. Review strengthens all live destination guards against a changed active document/workspace/layout and ensures a rejected source cannot start a drag. Schedule token-checked cleanup after both float and dock commits so removal of the source view cannot strand desktop targets or cancel a newer session.

5. Focused attempt04 passes 90 tests in 5.635 seconds, zero failures/skips. Inspect the local AppKit SDK’s NSDraggingInfo/source/destination and NSWindow registration declarations. Add explicit NSWindow destination conformance for main/document/floating-panel titlebar and chrome regions outside the content ancestor, plus an eighth regression exercising frame and panel window callbacks. Attempt05 passes 91 tests in 5.815 seconds, zero failures/skips. Final review also cancels and removes temporary targets immediately when the active document changes or closes; extend the stale-document regression accordingly before freezing the source.

6. Focused attempt06 passes 91 tests in 5.746 seconds, zero failures/skips, including immediate cleanup on document change. Add a package-only native-container snapshot mode to render the new ancestor wrapper around the compact workspace for visual regression inspection. Existing panel/window geometry and source drag behavior are otherwise frozen. Qualify this final source with focused/full/optimized runs and universal package checks; live drag ordering, Escape, Command input and cross-display movement remain pending.

7. Final focused attempt07 passes 91 tests in 5.771 seconds, zero failures/skips. Freeze 155 application /133 test Swift files (288 total) and the implementation diff. The eight new regressions cover committed/cancelled semantics, native content/window callback routing, Command versus ordinary dock placement, drag geometry, rejected payload/state changes and reliable temporary-window cleanup. No actual OS drag was synthesized, and the default tear-off size/title offset still requires Photoshop visual qualification. Start the full regression suite before optimized/package/render verification.

8. Full suite passes 662 tests in 114.491 seconds and optimized suite passes 220 tests in 8.710 seconds, zero failures/skips. Both architecture builds and clean staging/signing succeed, but all three bounded local-Desktop signature checks fail after Finder metadata is added to the copied app. Preserve the failed build and driver logs; do not rerun tests or overwrite them. Run a separate targeted removal of FinderInfo/ResourceFork from generated app paths only, with the bundle root last, and independently verify the already-created ZIP. Continue rendering from the extracted verified package; record recovery outcome explicitly.

9. Initial targeted metadata recovery cannot run because this Homebrew Python lacks os.listxattr; no attributes change. A second attempt uses macOS xattr, removes only the observed bundle-root FinderInfo and verifies the local app signature. Clean ZIP verification independently passes. Offscreen inspection detects a bounded wrapper-versus-direct-host shadow difference: 26,942 pixels in bounds (43,142)–(624,552), maximum six RGB levels, with matching canvas/control geometry. System Python lacks Pillow; use the provided bundled image runtime for the read-only comparison. Preserve the source/package/test evidence before investigating native layer-backed versus unbacked container rendering through a test-owned diagnostic. Do not silently accept pixel identity or apply an untested style workaround.

10. Diagnostic01 executes one test (3.557 seconds): both backed and unbacked ancestor captures differ from the direct host by 49,740 stored channel bytes, maximum six levels in its small canvas fixture. Diagnostic02 fails during export (one unexpected failure, 0.744 seconds); the specified evidence directory did not exist. Create a fresh directory and preserve that failed attempt. Diagnostic03 passes (one test, 4.906 seconds) and isolates the cause: capturing the *same NSHostingView* inside the wrapper changes zero bytes, while ancestor captures retain the difference. Do not alter product layer backing or styling. Make package diagnostics capture the same NSHostingView boundary and convert the experiment into an exact wrapped-versus-unwrapped hosted-pixel regression. Preserve the original source/package/tests and rewired historical verification under before-render-review before refreshing final evidence.

11. Final focused attempt08 passes 92 tests in 6.515 seconds, zero failures/skips, including the exact wrapped-versus-direct hosted-pixel assertion. Refresh the 288-file source freeze and implementation diff after preserving the previous freeze. Reconstruct the previous Application snapshot source by reversing the capture-only change and verify it against its preserved SHA256; this is recovery of recorded bytes, not an invented historical edit time. Run full/optimized/build qualification again under attempt02 names because the diagnostic code and test suite changed. The final test count is expected to be 663; that count remains unclaimed until the run completes.

12. Full regression passes 663 tests in 115.945 seconds; optimized qualification passes 221 tests in 9.437 seconds, zero failures/skips. Verify arm64/x86_64 universal macOS14+ app/ZIP, source binding, version0.2.0/build2, supplied icon, licenses and links. Inspect eight fresh package renders, including the new native-container compact layout and shared floating Gradient content. Final compact direct-host and wrapped-host renders have zero changed RGBA bytes at the same capture boundary; the permanent fixture also verifies exact hosted pixels. This does not establish native pointer routing, desktop ordering or OS Escape behavior. Both architecture builds and local/clean-ZIP signatures pass without another metadata recovery. The build retains one harmless unused diagnostic closure-capture warning and the existing SwiftPM build-system deprecation warning. Package hashes: binary ec4901b3f377d50eca1390115c6ddc958906cb99f9cd9b4b9ca4a4a30002b5c3; ZIP cf8567500300c44092b506e989079693763ed992348d5d5ab2de9f8abf5129ba. Static menus remain 801 entries /102 primary /eight alternate shortcuts;149 bound leaves /575 unavailable. No new Photoshop command was promoted to complete.

13. Update README/status/plan/command matrix and the tear-off reference manifest; attach follow-up links to prior panel/workspace/menu evidence without changing historical test claims. Preserve failures, repairs, source hashes, unique logs and implementation diff in [local evidence archive]. Record post-package live availability, then refresh/check the development evidence index and final source/package/menu consistency. The goal remains active and incomplete. Next required UI work is floating stacks, additional columns and remaining panel integration, with real drag/input/window qualification after unlock.

14. Final evidence refresh/check passes: 69 milestones /3,392 evidence files /1,764 logs /zero missing explicit references. Consistency verifies all 288 source/test hashes, linked records, 801 menu rows, current app/ZIP, preserved step068 ZIP and immutable pause checkpoint. Post-package CUA still reports the Mac locked; the earlier unlock request is not repeated. The final eight renders are inspected and their hashes retained. Record the separate pixel comparison (zero changed RGBA bytes), retained compile/build/diagnostic failures and next floating-stack design. A post-compaction audit-file read used a nonexistent scripts/development-history* glob; use the actual audit-development-history.py path. Final documentation-only changes receive another inventory refresh/check without rerunning unchanged application tests.

1. Revalidate step067: all 283 tested source hashes, 21 reference links, 801 menu rows, app/ZIP hashes and immutable pause checkpoint agree. Read development requirements/current status/plan and dock/document ownership code. CUA again reports the Mac locked; no bypass or duplicate unlock request. Adobe’s current stacking guide (updated February 23, 2026) confirms floating groups, docking back, edge resize and double-click collapse. Direct dock/undock guide fetch times out again. Scope this increment to native NSPanel hosts, active-document targeting, persisted geometry, closed-panel retention and docking return through native drop zones and group actions. Outside-dock tear-off and floating stacks remain separate unfinished interactions; cancelled native drags must not accidentally create panels.

2. Preserve all application/test sources, documentation and previous universal ZIP before editing. Plan optional per-group floating geometry for legacy migration, finite bounded coordinates and screen recovery, a single document-window-owned panel coordinator, shared panel content without duplicate document dialogs, and test-owned AppKit lifecycle/input checks. Explicit Float/Dock group actions are temporary Photato affordances, not claimed observed Photoshop menu entries. No image algorithm or archive format change is intended. Initial investigation also used a nonexistent CraftDocumentController.swift path; the class is located through source search instead.

3. Implement optional floating-frame geometry, pure validation/screen fitting and float/dock transitions, native NSPanel ownership and shared panel-only SwiftUI roots. Panel windows track the globally active document, keep text input local, forward canvas navigation, hide when inactive, preserve geometry on collapse/close/reveal, and follow shared workspace visibility. Native window movement obeys Lock Workspace while resize remains available. Initial existing regression run passes 49 tests in 3.850 seconds, then eight new tests pass with the expanded focused suite: 72 tests in 4.537 seconds, zero failures/skips. The AppKit test harness warns about inserting a test text view directly into NSHostingView; change this fixture to a common NSView container before final qualification. Code review also finds that floating every group removes all dock insertion surfaces; add a narrow native return target when the dock is empty. Add explicit observation/reconciliation and resize tests; no live drag assertion is inferred from hosted callback tests.

4. Focused attempt03 executes 82 tests with one failure (5.251 seconds): the existing Services-menu ownership assertion fails after the new asynchronous panel test lets AppKit initialize its service provider. Preserve source and diagnostics. A reduced diagnostic reproduces 18 tests/one failure (1.680 seconds); actual and expected Services objects differ while the main menu matches. Clearing the previous Services registration before assigning the rebuilt menu fixes the reduced run: nine tests, zero failures (0.856 seconds). Retain the existing identity assertion and add a dedicated repeated-build/run-loop regression. Apple’s Services property page exposes a Markdown link but that tool fetch is unsupported; the fix is justified by executed native evidence, not unreturned documentation. Add collapsed-window height bounds, floating-panel exclusion from document menus, an action to split a panel from an already-floating group, and fixture cleanup of screen/presentation overrides. The original asynchronous test-owned control checks remain bounded to AppKit; OS-level dragging still awaits unlock.

5. The stronger repeated-build Services regression disproves the provisional clear-and-reassign repair: focused attempt04 reports 83 tests/seven assertion failures (5.256 seconds). Preserve that source and failure. AppKit retains its initialized Services menu even after clearing the property in this context; reparent the registered native menu into the rebuilt application menu instead of replacing its identity. The regression now explicitly requires retained identity and correct visible parent; its fixture restores the original parent when restoring the prior application menu. This supersedes the provisional repair in substep4 rather than hiding the failed experiment.

6. Final focused attempt05 passes 83 tests in 5.266 seconds, zero failures/skips. Freeze hashes of 154 application /132 test Swift files (286 total) and preserve the implementation diff. The 11 added regressions comprise ten floating-panel tests and the stronger Services test. Screen recovery retains original saved geometry until an actual move/resize; automatic observation is tested without manually calling refresh. Test-owned native control hits, text responder behavior, document cycle guards, close/reveal and window resize callbacks are exercised. Existing DocumentWorkspaceTests retains its older direct-host-subview warning; the new fixture no longer emits it. A broad Git status read returned unrelated enclosing Desktop changes; none were touched. Full regression, optimized checks, universal packaging and offscreen package renders follow.

7. Full regression passes 654 tests in 114.544 seconds and optimized qualification passes 212 tests in 8.356 seconds, zero failures/skips. Build and verify arm64/x86_64 universal macOS14+ app/ZIP, source hashes, version0.2.0/build2, supplied icon, licenses and links. Inspect seven fresh offscreen renders from the extracted verified binary: normal/compact/two-column/gradient/reorganized dock layouts plus the shared floating Gradient panel content. These are bounded renders, not live window/input proof. Build details and signature cleanup attempts remain in the unique build log. Record current package hashes: binary 3df5775d2cfe0496e50c238fbb87c6ea342a6be47c1465af4027d2e997e35dcf; ZIP f842553352e74eb5cc557358a26ad41f02cf7ef4a94d4fe23126ab98bfc6f950. Static menus remain 801 entries /102 primary /eight alternate shortcuts;149 bound leaves /575 unavailable. No static Photoshop command was newly claimed functional.

8. Update status, plan, README, command matrix and floating-panel reference manifest; add follow-up links to historical dock/workspace/menu evidence without rewriting their original qualification. Preserve the complete failure/repair sequence and frozen source hashes in [local evidence archive]. Recheck live availability separately, then refresh/check development evidence and final package/document consistency. The goal remains active and substantially incomplete. Next work follows UI/menu/UX priorities: actual tear-off/cancellation, floating stacks, extra docks and integration of remaining panels. The immutable step059 pause checkpoint remains unchanged.

9. Post-package CUA remains locked; candidate was not launched live and the existing unlock request remains pending. Final consistency verifies 286 source/test hashes, 27 linked evidence records, 801 menu rows, current app/ZIP and preserved prior ZIP, with the immutable pause checkpoint unchanged. Universal packaging had no failure or metadata retry in this run. Run the required development-history refresh/check with audit logs outside the indexed evidence set, then record its outcome. No additional app/test edits followed the source freeze.

10. Development-history audit passes: 68 milestones, 3,207 evidence files, 1,694 logs, zero missing explicit references. Refresh/check again after adding this outcome, then verify source/package/menu consistency once more. This checkpoint preserves the exact continuation position: native floating hosts and menu Services ownership are implemented; actual tear-off/cancellation, stacks/columns and pending live checks remain next. No full-parity or byte-identical Photoshop-wide claim is made.

1. Classify step066 as progress and revalidate all 278 source hashes, current package/menu references and the immutable pause checkpoint. Read current requirements, status, plan and workspace sources. CUA access still reports the Mac locked; retain the earlier unlock request. Inspect the fixed three-group native inspector, original Rust dock model/drag/resize logic and current Adobe panel movement/docking guides. Adobe confirms tab-driven placement, docking indicators, cancellation and Lock Workspace; unlike the source’s fixed groups, Photoshop permits individual tab regrouping. Plan an editable native tab-group model and actual dock interactions, with persistence/migration, sizing and document-state regression gates. Floating panels and extra dock columns remain the subsequent required work; do not claim full docking parity from the initial editable right-hand dock.

2. Add an editable dock topology with stable group IDs, one retained location per supported panel, closed-panel restoration, tab/group moves and model validation. Preserve step066 layouts using optional new fields; workspace locking is a separate persistent setting. Refactor the existing panel bodies so tabs can be hosted in different groups, retain native AppKit click/drag/drop and splitter controls, add accessible group menu actions and blue placement feedback, and connect Lock Workspace. Default topology uses the existing verified sizing; custom groups use bounded allocation and adjacent splitter resizing. Floating windows, additional dock columns and complete panel-specific menus remain explicit requirements.

3. Initial compile and existing focused regression pass: 64 tests, zero failures/skips, 3.863 seconds. Add eight dock-specific regressions covering exact move/split/merge examples, all panel transfers, malformed topology, literal legacy workspace migration, saved/reset/lock persistence, unchanged native document state, bounded group sizing, native payload/click handling and an offscreen hosted tab/drop path. Tests call only test-owned AppKit controls; real drag, Escape/Command modifiers and Photoshop layout remain unqualified while locked.

4. The expanded focused attempt02 passes 72 tests, zero failures/skips, 4.181 seconds. Code review identifies a closed-active-tab group move retaining the now-hidden selection. Preserve sources, add an explicit regression and observe its expected failure (one test, one assertion failure, 0.251 seconds). Normalize the moving group to its visible selected tab before transfer; repaired focused attempt03 passes 72 tests, zero failures/skips, 4.287 seconds. A patch-context mismatch changed no files and was reapplied against the formatted source. Add a custom-dock offscreen diagnostic and inspect normal/reorganized debug renders: Layers can appear above a collapsed Color group, while Gradients sits in the Properties group. Then strengthen the hosted control test with actual hit testing and native splitter down/drag/up callbacks before the final source freeze. These remain test-owned/offscreen actions, not live pointer qualification.

5. Focused attempt04 reports 72 tests with one failed assertion, 4.356 seconds: the added hosted hit test passes the flipped hosting-view coordinates to NSView.hitTest, which expects its superview’s coordinates. A preserved hierarchy diagnostic reproduces the failure (one test, one assertion failure) and confirms that every ancestor reaches the native button with correctly converted parent coordinates. This is a test-harness defect, not a demonstrated product-input defect; correct the coordinate conversion and remove diagnostic printing. Native splitter down/drag/up already passes. Preserve both failed logs and diagnostic sources.

6. Corrected focused attempt05 passes 72 tests, zero failures/skips, 4.297 seconds. The hosted native tab receives pointer hits in the correct coordinate space, direct native splitter events publish its size, and the private payload routes the tab into another group. Freeze 283 Swift source/test hashes (152 application, 131 test files) and the implementation patch. Preserve rolling evidence before full/optimized tests and the universal package. Current menu inventory should gain only Lock Workspace; factory layout/order/shortcut catalog stays unchanged.

7. Full regression passes 643 tests, zero failures/skips, 113.420 seconds. All 283 tested source hashes remain unchanged. The current menu report confirms 149 bound leaves / 575 unavailable, with 801 entries, 102 primary and eight alternate shortcuts unchanged. Preserve rolling evidence and run optimized tests, both architecture builds, clean ZIP verification and six bounded package snapshots sequentially. Version0.2.0/build2 remains unchanged; no new imaging exactness is claimed.

8. Optimized regression passes 201 tests, zero failures/skips, 7.333 seconds. Both native architectures build. The clean extracted ZIP verifies signatures, macOS14 targets, supplied icon, licenses, project links and all 283 source hashes. The local app’s first signature check finds Desktop-added metadata; the existing bounded cleanup/retry succeeds. Binary SHA256 2b76fc3a2dbc62c0419848a4b9400a88e46e3926d55bb3a75ce165a0a805ca46; ZIP SHA256 c7d905da7fde5582f78e3e7dd489bb06e16ff405180e20f6c66a082639518699. Inspect six final package renders: normal, compact, two-column, Gradients and normal/compact regrouped docks. Tab groups, collapse and relocated content render in their requested positions. Post-package CUA access remains locked, so actual pointer/drop/modifier behavior and exact Photoshop geometry remain pending.

9. Update current status, plan, README, command/menu matrices, UI audit and panel-dock/saved-workspace/menu reference manifests. Preserve the immutable menu inventory with the release and all failed/regression diagnostics. Explicitly retain native floating panels, extra dock columns/stacks, History/Clone Source integration, unavailable Libraries content, panel-specific menus, exact defaults/preferences and complete accessibility as required follow-ups. Final source/package/reference consistency and the history audit follow; no full-parity, pause or blocked status is claimed.

10. Final consistency passes: all 283 source hashes, 21 linked hash references, 801 menu rows, current app/ZIP, preserved previous ZIP and immutable pause checkpoint match. The development-history audit passes with 67 milestones, 3,084 evidence files, 1,671 logs and zero missing explicit references. Staged candidate: [local workspace]. Record the completed checkpoint and next work precisely; the current date rolls to 2026-10-09 during final documentation, while this milestone retains its 2026-10-08 start date. The full goal remains active and incomplete. Refresh/check again after this record update.

Evidence: [local evidence archive].

1. Classify step065 as progress, confirm all 275 tested source hashes, read current status/requirements and preserve source, records and the previous package before editing. CUA Photoshop access remains locked; retain the pending unlock question. Inspect current per-view geometry, per-document presentation fields, native document/menu ownership, original Rust workspace implementation and Adobe’s current save/restore/delete workspace guides. Distinguish last-used layouts from the saved reset target. Plan shared native presentation state and atomic bounded persistence, plus Essentials/custom switching, Reset, New/Delete Workspace and Lock. Keep unimplemented built-in arrangements, optional shortcut/menu/toolbar capture and complete panel docking explicitly open. Adobe’s guide permits preset deletion with warning whereas the Rust code protects built-ins and current custom layouts; exact installed behavior needs live qualification.

2. Implement a shared layout value, separate saved/last-used arrangements, validated names and bounded atomic JSON persistence with a debounced layout save. Attach one library to all documents in a controller; independent test stores/controllers retain isolated in-memory libraries. Read the Rust dock implementation more deeply: Lock Workspace gates group movement while splitters remain usable. Reject the initial uncompiled interpretation that froze resizing; preserve that source attempt and remove it. Keep Lock unavailable until real panel rearrangement exists. This milestone therefore connects Essentials, Reset, New/Delete and custom selection while panel reordering/docking and Lock remain explicit next requirements.

3. Add native workspace menu binding, dynamic custom names/checkmarks/reset title, New/Replace/Delete dialogs and explicit unavailable capture choices. Add eight persistence/ownership/menu/dialog regressions, including unchanged native document bytes/undo/viewport and coalesced autosave. First focused attempt stops at compilation: the newly injected NSDocumentController initializer also requires init(coder:). Preserve the failed source/log and implement that required AppKit initializer. Review error reporting when no document window exists and route those errors through AppKit instead of leaving an invisible view-only error. Tests and offscreen diagnostics use isolated in-memory or temporary-file libraries; production launches alone load the shared application-support library.

4. Focused attempt02 reaches 64 tests but fails nine assertions (including one thrown error). The standalone AppKit probe confirms both subclass initializer calls return the same NSDocumentController instance; storage assigned before super.init() is discarded on later calls. Its first script attempt fails under the interpreter’s default actor isolation, and Swift6 rerun confirms identity reuse. Preserve both logs and failed sources. Move explicit workspace injection to a convenience initializer after self.init(), rebinding any existing documents, and keep ordinary controller lookup from resetting state. Document-controller fixtures now explicitly install an isolated in-memory workspace. Correct the previous per-document visibility expectation to shared presentation while retaining active-document and native-text responder checks. Also repair the common workspace-command error path to use the no-document AppKit error presenter.

5. Focused attempt03 passes 53 workspace/menu tests, zero failures/skips, 3.716 seconds. This filter omits Viewport and is not the prior 64-test filter. Inspect the native-alert offscreen images: text/accessory geometry is present but button/popup rendering is incomplete under the XCTest host; do not count these as visual acceptance. The actual native button titles, disabled capture options, accessibility labels and picker choices pass structural assertions. Strengthen the frame-input regression with Space key-down/up state on the separate floating canvas so shared Tab visibility cannot hide a forwarding defect. Direct CUA access still reports the Mac locked; retain the earlier unlock request and continue independent regression/package work.

6. The complete focused attempt04 passes 64 tests, zero failures/skips, 3.830 seconds. Space down/up proves floating-canvas forwarding independently of global Tab visibility. Freeze all 278 Swift source/test hashes (148 application, 130 test files) and preserve rolling artifacts before full, optimized and universal package validation. Version0.2.0/build2 and the historical pause checkpoint remain unchanged.

7. Full regression passes 635 tests, zero failures/skips, 111.826 seconds. All 278 source hashes still match. Preserve rolling evidence and start the sequential optimized-test/universal-build/clean-ZIP/snapshot helper. Four new static menu bindings bring the current inventory to 148 bound leaves / 576 unavailable, retaining 801 entries, 102 primary and eight alternate shortcuts. Existing exactness limitations in imaging remain unchanged; these passing tests do not establish full Photoshop equivalence.

8. Optimized regression passes 193 tests, zero failures/skips, 6.867 seconds. Both architectures build and the clean extracted ZIP verifies: macOS14 minimum targets, signatures, supplied icon, licenses, project links and all 278 source hashes. Binary SHA256 1895d0b7a19c6015f92bc6f4a96325968246d110d697157dbab8134103c2c6a7; ZIP SHA256 91dcb56818d2ae294a200fb14482368172bb3818bbb27b5b5a36bc6d81f0e802. Inspect four bounded offscreen package renders; normal/compact/two-column/Gradients layouts retain reachable footer controls, bounded inspector content and fixed right-side options controls. Native-alert visual qualification remains explicitly pending; XCTest structural assertions and incomplete captures are preserved separately.

9. Update current status, README, plan, command and menu matrices, UI audit and saved-workspace/menu reference manifests. Preserve an immutable current menu report alongside the release. Keep the source-protected deletion behavior and Photoshop discrepancy explicit, plus disabled built-in presets/capture settings, panel docking/order and Lock. Record exact surviving commands and explicitly mark the original attempt01/02 shell invocations as not retained. The goal remains active and incomplete; no pause or blocked status is requested. Finish source/package/reference consistency and refresh/check the history inventory.

10. Final consistency passes: all 278 source hashes, 19 linked hash references, all 801 menu rows, current app/ZIP, preserved previous ZIP and immutable pause checkpoint match. The history audit passes with 66 milestones, 3,024 evidence files, 1,648 logs and zero missing explicit references. Staged candidate: [local workspace]. Preserve next steps in the record: live saved-workspace plus steps062–065 qualification after unlock, then panel organization/docking/Lock, factory layouts and accessibility. Full Photoshop parity is still incomplete and the goal stays active. Refresh and check once more after recording this checkpoint.

Evidence: [local evidence archive].

1. Continue the user’s UI → menus → UX priority and confirm all 274 step064 Swift source/test hashes. Read the recorded requirements, current status, plan, UI audit and workspace sources. Direct CUA access reports the Mac remains locked; retain the existing unlock request and pending frame/tab/zoom checks. Inspect the step064 1000×650 offscreen render: the single-column tool rail puts foreground/background and final controls below the visible viewport. The inspector already scrolls its content, but splitter limits use hard-coded offsets that do not account for hidden panel groups. Plan to keep the color/control footer visible, scroll the tools independently and allocate inspector height from the visible groups. This is a native usability repair, not proof of exact Photoshop compact-layout behavior.

2. Implement the fixed tool-rail footer, automatic reveal of the selected tool group and accessible column-state label. Allocate Color/Properties/Layers from actual visible groups, reserve 220 points for Layers and start splitter drags from the displayed divider height rather than an old requested height. Add three regressions covering 192 sizing combinations, resize/hidden-group bounds and an offscreen native scroll host whose color well remains outside the scroll view. The first focused run executes 56 tests with three assertions failing, 3.388 seconds: NSView.visibleRect can exceed its own bounds in this SwiftUI host, so equality is not a valid visibility assertion. Bounds containment and fixed position already pass. Preserve failed output/source; assert full bounds containment instead. Center the rail’s content explicitly and add a two-column option to the existing offscreen snapshot diagnostic. No OS input was synthesized or posted.

3. Repaired focused run passes 56 tests, zero failures/skips, 3.269 seconds. Inspect three own offscreen debug renders: 1000×650 one-column, 1000×650 two-column and 1380×900. The color/footer controls are visible in all three; the compact two-column layout fits every tool group. The compact one-column tool list scrolls, and Properties/Layer content retains its existing scroll regions. These snapshots are layout evidence only; actual input and exact Photoshop sizing remain pending. Freeze 275 Swift source/test hashes (146 application, 129 test files), preserve rolling artifacts, then run the full and optimized regression suites and universal package build.

4. Full regression passes 627 tests, zero failures/skips, 106.470 seconds. No editing engine or document format changed. Preserve generated rolling evidence before the optimized run. Read the existing factory Workspace submenu while preparing the next UI/menu work: Essentials/reset, saved workspaces and lock remain unavailable; do not map them to a different action or count their menu presence as completion. Current changes do not alter any menu inventory or shortcut.

5. Optimized regression passes 185 tests, zero failures/skips, 6.521 seconds. Build the universal macOS14+ app. Preserve and verify the previous step064 ZIP against its immutable release hash before the package phase replaces it; the archive also retains the previous app. Production source remains the 275-file tested snapshot. Version0.2.0/build2 and the historical step059 pause checkpoint remain unchanged.

6. Initial universal build and clean ZIP verification pass. The package snapshot sequence produces normal/compact images, then stalls in the two-column diagnostic. A task-owned process sample shows NSDocumentController presenting a batched-open error in a modal alert, not a rendering loop. Preserve the sample, empty output and invocation; terminate only that diagnostic process. Repeating the two multi-flag commands with paired YES values and an explicit --snapshot-output pair succeeds within a 30-second timeout. No production source changes are needed for that harness correction. Initial sandboxed process inspection was denied; approved read-only inspection and sampling succeeded. Both CUA access attempts remain locked.

7. Inspect all four packaged renders. The Gradients variant exposes another compact UI defect: the long options row extends past the right edge and displaces Export/AI/feature-map buttons. Preserve the first tested source snapshot, universal ZIP, tests, logs and renders before repair. Give the horizontal options scroll view a zero minimum width and lower layout priority, and remove its redundant trailing Spacer so fixed right-side controls retain space. Recheck the focused suite and compact Gradients rendering before fresh full/optimized/build verification.

8. Focused attempt03 passes 56 tests, zero failures/skips, 3.300 seconds. The repaired compact Gradients offscreen render now retains the right-side controls and clips the long options row within its horizontal scroll region. Preserve its debug binary hash and exact paired-options command. Refresh the 275-file tested source snapshot and implementation patch, then repeat full/optimized/package checks because the options-bar source changed after the first package.

9. Final full regression passes 627 tests, zero failures/skips, 106.596 seconds. All 275 tested source hashes still match. Run the recorded final-validation helper sequentially for optimized tests, both architectures, clean package verification and four snapshots using paired argument values and bounded render timeouts. Earlier successful pre-options-repair evidence remains in its separate preserved directory.

10. Final optimized regression passes 185 tests, zero failures/skips, 6.782 seconds. Both architectures build; clean extracted ZIP signature, macOS14 targets, supplied icon/licenses/links and all 275 source hashes verify. Desktop reinjects metadata into the local app during two signature attempts; the existing bounded cleanup/retry succeeds before build completion. The final package binary SHA256 is fe549a531a02b4edebbe8aeb15f6fae9095933e8b701e2e09375f26e8166313c and ZIP SHA256 is a41214706f1aa91ffb70dcd1c41397a7fcf6c3fe45253bb4c65a0c5338b91e5c. Staged candidate: [local workspace]. Inspect all four final offscreen renders: footer controls and fixed right-side options-bar buttons remain visible, compact two-column tools fit, and panel content remains scrollable. These are not live interaction checks.

11. Update current status, README, plan, command matrix, UI audit and compact/viewport manifests; retain live input as pending and the step061 last bounded live baseline. Preserve the failed visibleRect assertions, original render stall/process sample, repaired command invocations, pre-options-repair package/test evidence and all final hashes. The goal remains active and incomplete. Refresh and check the development-history inventory.

12. Final consistency checks match all source, package, linked evidence and immutable pause-checkpoint hashes. The history audit passes with 65 milestones, 2,971 evidence files, 1,630 logs and zero missing explicit references. Preserve this completed checkpoint and next steps; full Photoshop parity remains incomplete, and no pause, blocked or completion status is requested or claimed.

Evidence: [local evidence archive].

1. Classify the previous turn as progress and verify all 271 step063 source hashes. The Mac remains locked on direct CUA access, so preserve the pending live checks and continue independent UI/UX work. Inspect the native canvas, status controls, document coordinator and original Rust canvas/zoom modules. Identify the hard-coded 50% starting value in menu zoom, inconsistent 800% limits, missing percentage entry, omitted backing-pixel conversion and inactive-document scroll focus. Retrieve Adobe’s current zoom guide; retain its URL/date and bounded paraphrase, not a claim of live Photoshop parity. The Rust menu ladder reaches 3200%, while its separate scrubby tool reaches 6400%; the current Adobe guide reports 3200%. Exact installed-version limits and presets remain unqualified. Evidence: [local evidence archive].

2. Add CanvasViewport geometry and source-derived Float zoom steps; unify menu/click/wheel/pinch and editable native percentage controls. Initial fit is resolved once (at most 100%); explicit Fit uses current bounds, and 100% preserves the viewed center. Account for backing pixels separately from AppKit points, use nearest sampling at 100% and above, and activate the owning document for scroller/gesture/percentage input. Execute the extracted Rust zoom function to produce 220 independent Float-bit reference cases; preserve the source, harness, compile log and fixture. Exact Photoshop ladder, fit margin, preferences and min/max limits remain pending.

3. First focused attempt stops during compilation: two optional CGFloat-to-Double conversions for NSWindow.backingScaleFactor need explicit casts; no tests execute. Preserve failed output and source hashes before repair. Add the casts. Review the display transition and preserve the document center when backing scale changes by adjusting pan in points; add its regression. Percentage input tests cover invalid values, Escape and a document switch during editing, alongside history/focus and original Rust step checks.

4. Focused attempt02 executes 52 tests with one failure, 2.939 seconds. All geometry/focus tests and all 220 executed Rust Float-bit cases pass; the failed assertion compares decimal percentage division to a separately rounded Double literal (0.6667000000000001 versus 0.6667). Preserve the failed test source and log; use a 1e-12 numeric tolerance for this UI parsing assertion. No production arithmetic or pixel exactness check is weakened.

5. Repaired focused run passes 52 tests, zero failures/skips, 2.937 seconds. Ten new viewport tests cover menu zoom direction from initial fit, one-time initial fitting, explicit fit, pointer/center anchoring, backing-pixel mapping and display transitions, percentage validation/commit/cancel/document replacement, scroller activation and direct canvas event routing. All 220 original Rust zoom-step results still match exact Float bits. Record 274 Swift source/test hashes and preserve artifacts before the full regression. The shipped source range is presently 1–3200%; Photoshop’s precise minimum, actual presets and preference-dependent behavior remain open.

6. Initial full run executes 623 tests with three failed assertions in one ColorRegionWorkflowTests case, 105.448 seconds. The fixed canvas click (90,100) assumed the former automatic 10× fit of a 20×12 fixture; at the new 100% initial view it correctly falls outside the image. Preserve the full log, source snapshot and old fixture. Make the interaction test’s magnification explicitly 10× and assert its event resolves to document coordinate (4,4), retaining the original Wand/cancel/history checks. No production painting behavior changes. Include this workflow in focused and optimized follow-up runs.

7. Focused attempt04 runs 56 tests with one failed coordinate precondition, 2.937 seconds; the original Wand/cancel/history assertions now pass. AppKit converts the window event into the flipped canvas, so the fixed click is (4,8), not the newly assumed (4,4). Correct only that fixture assertion and retain its failing attempt. Review queued viewport updates: a detached old canvas could overwrite the document’s new window/backing geometry during a host transition. Guard queued updates on window attachment and add a regression proving a detached view cannot replace the current viewport.

8. Final focused regression passes 57 tests, zero failures/skips, 2.879 seconds, including the corrected Wand interaction fixture and the detached-host guard. Eleven new viewport tests now supplement the existing workspace/menu/color-region suites. Refresh the 274-file source snapshot and rerun complete qualification. Keep the failed 623-test snapshot separate from the new expected 624-test suite.

9. Final full regression passes 624 tests, zero failures/skips, 105.695 seconds. The previously failing Wand interaction again verifies atomic selection/cancel/history at its explicit 10× input scale. Run optimized checks including both viewport and ColorRegionWorkflowTests, then package and inspect separate offscreen layouts. Historical imaging tolerances and incomplete Photoshop exactness remain explicitly unchanged.

10. Optimized critical regression passes 182 tests, zero failures/skips, 5.825 seconds, including the 11 viewport and four color-region workflows. Build both Mac architectures using the unchanged macOS14+ packaging script. Plan offscreen 1380×900 and 1000×650 native workspace renders from the exact extracted package; those images verify layout only, not physical input or Photoshop equivalence.

11. Universal package verification succeeds for arm64/x86_64, macOS14+, version0.2.0/build2, original icon/licenses/links and all 274 tested Swift hashes. Render the exact extracted package offscreen at 1380×900 and 1000×650; both PNGs are inspected and show readable percentage fields (77.25% / 45.58%) without status-bar overlap. The small layout leaves some toolbar/color controls and panel content below the visible region; record this separate UI gap without treating the two renders as full workspace qualification. A second direct Photoshop CUA check still reports the Mac locked. Candidate: [local workspace]; binary 2ac546dab24a25fb9073efc0f4fd5980db168be7786b383ea87c1d9a33d6f63f, ZIP 2bacd3a0ae1766d4c9fe4baf9b26a14ad2a1b6c43bc4b36690e7c86cfa5b301b. Live input/monitor/frame/tab checks remain pending.

12. Finalize the viewport reference manifest, STATUS, PORTING_PLAN, README, command evidence, UI audit and rolling release summaries. Record exact Rust/test/build/offscreen commands, bind the 220-case fixture and inspected images to the final package, preserve final artifacts and refresh/check development history. The goal stays active and incomplete; live viewport/frame/tab behavior, exact view defaults and compact-layout refinements are the next UI priorities.

1. Continue the maintainer’s UI-first priority. Revalidate all 270 step062 source hashes and preserve source, tests and documentation. The previous native tab drag candidate remains pending live input qualification. The Mac remains locked during the direct Photoshop access attempt at the start of this continuation; do not bypass it. Step061’s saved Photoshop floating-window observation shows a compact canvas window and a retained common application frame. Plan separate local canvas and global editing targets, one dialog presentation owner, cross-window tool settings, single-document floating, and safe consolidation/close review. No pixel algorithm change or live-equivalence claim is intended. Evidence: [local evidence archive].

2. Split DocumentSurfaceView from shared workspace chrome; add global active-document tracking and retain the application frame while all documents float. Floating hosts contain only canvas/scrollbars/contextual document controls. New documents dock in the frame, consolidation returns to that original frame, and close review retains NSDocument ownership. Cross-window preferences follow the active document; modal drafts and attached sheets prevent target changes. The first focused run passes 39 tests, zero failures/skips, 4.269 seconds. These are automated AppKit tests, not live UI certification.

3. Code review found two follow-ups: preserve the latest shared tool settings when the active document closes, and route keyboard canvas actions from the frame to the active floating document while retaining text-field responders. Add explicit regressions for both and hide inactive-canvas contextual actions. Fix the tab accessibility label’s optional-name interpolation warning. Preserve the first passing implementation and test source before this refinement.

4. Focused attempt02 runs 41 tests with one failure (5.055 seconds) in the existing Services-menu identity assertion. Preserve sources and add diagnostic output; the 29-test diagnostic repeats the same single failure (4.904 seconds), showing the application role points to an earlier Services submenu. Default NSTextView key handling changes the process-wide Services-role behavior in this test sequence; the diagnostic does not trace AppKit internals. Replace default text handling with an NSTextView subclass that records received key codes; assert the field receives Tab and the canvas state remains unchanged. Restore the menu test unchanged. Focused attempt03 passes 41 tests, zero failures/skips, 4.452 seconds. This proves dispatch to a text responder, not the OS text-service lifecycle. No production menu change is made from this test-only side effect.

5. Add native child-window ownership so floating canvases remain above their application frame when shared controls receive focus, and remove that relationship on consolidation/close. Extend the single-document float test with parent-window assertions. A further direct Photoshop CUA access attempt still reports the Mac locked; no live input or capture occurs. Preserve the exact blocker and retain live qualification as pending.

6. Final focused regression passes 41 tests, zero failures/skips, 4.538 seconds. Seven additional document-workspace tests now cover retained-frame single-document floating/consolidation, global focus and newly opened documents, pending dialogs/sheets, hosted canvas ownership, cross-window cycling and frame-close review, native keyboard/text-responder dispatch, and tool settings after closing the active float. Record all 271 current source/test hashes and preserve rolling artifacts before the complete regression.

7. Complete regression passes 612 tests, zero failures/skips, 108.645 seconds. All 271 source/test hashes remain unchanged. Preserve the root ZIP from step062 before replacing it; its SHA256 still matches 18536f19073ec447774fe0e3afa10925670da18a291d2a46fbcd5ed8471133a3. Run the optimized critical suite before building the two architectures. Existing image tests retain their declared exactness/tolerance bounds; a passing package suite is not full Photoshop pixel parity.

8. Optimized critical regression passes 166 tests, zero failures/skips, 7.539 seconds. Build the unchanged arm64/x86_64 macOS14+ packaging pipeline; no new release version or full-parity claim. Stage the exact extracted ZIP for later live qualification rather than treating the previous running app as evidence for this candidate.

9. The first universal package verifies successfully against the 612/166-test source snapshot; preserve its ZIP, extracted path, logs, hashes and manifest under before-host-refinement before further edits. Final view review finds that a newly created floating host with no assigned document briefly takes the shared-frame branch of the SwiftUI root. Make floating-versus-frame ownership unconditional, rendering neutral empty content during that transition, so a float cannot mount duplicate shared controls/dialog owners. Add an empty-host native-control regression and repeat qualification; the first package remains historical evidence only.

10. The refined floating-root implementation passes 42 focused tests, zero failures/skips, 2.930 seconds. Its empty-host test confirms that an unassigned float creates no native shared controls. Refresh all 271 source/test hashes and repeat the full, optimized and package checks sequentially. The prior 612/166-test package and evidence remain under before-host-refinement; they do not qualify this final change.

11. Final complete regression passes 613 tests, zero failures/skips, 107.511 seconds after the transient-host fix. No additional source changes are made. Repeat optimized validation and rebuild the universal package against this 271-file source snapshot.

12. Final optimized regression passes 167 tests, zero failures/skips, 5.757 seconds. The final universal package is being rebuilt; preserve the intermediate evidence separately and bind the current release only to the final 613/167/42-test source snapshot. Record provisional floating geometry, initial zoom and status/scroller activation as explicit follow-up checks alongside live pointer, dialog and close-review qualification.

13. Final universal macOS14+ package verification passes for arm64/x86_64, version0.2.0/build2, all 271 source hashes, original icon/licenses/project links and the clean ZIP signature. Binary SHA256 362db8d4fc098130ed5356a4f13ff0c658553f77625f99a0c551e917a5522795; ZIP 231fa751ec06937a1d1e3c78f188954b658a0820cfd3fd24f7d7b662f5884509. Candidate staged at [local workspace]; it is not live-qualified. Update STATUS, PORTING_PLAN, README, command evidence, UI audit and the application-frame/workspace/tab reference manifests; rolling summaries explicitly retain pending live status. Preserve the final artifacts and refresh/check development history. The full Photoshop goal remains active and incomplete.

1. Revalidate step061 source and read the current record/status/plan. The preceding turn was progress, with a genuine remaining live drag qualification gap. All 269 baseline source hashes match. Preserve affected sources, documentation and the package before changes. SwiftUI parent draggable/dropDestination wraps child Buttons; a previous Text experiment did not qualify input and was reverted. Implement explicit native AppKit drag-source/destination behavior with private document-tab payloads and before/after insertion semantics, retaining separate accessible close and selection controls. Verify with real pointer interaction and document-state tests; full Photoshop functionality remains incomplete.

2. Added DocumentTabControl/DocumentTabButton using public NSDraggingSource/NSDraggingDestination APIs, native click tracking, private pasteboard type and insertion indicators. Remove the implicit SwiftUI drag/drop wrapper; extend the coordinator with before/after insertion and non-mutating acceptance validation. The original 30 focused tests pass (1.572 seconds). Add three behavioral tests for after-insertion/cross-window cleanup and unchanged document history, private payload rejection, and native click/release/accessibility-action routing. Live pointer qualification follows; no success claim yet.

3. Expanded focused regression passes 33 tests, zero failures, 1.393 seconds. A fresh Photoshop CUA selection reports the Mac locked and unable to unlock automatically. Ask the maintainer to unlock through the asynchronous input tool; continue tests/package work without attempting an unlock bypass. Live pointer behavior remains pending. Record all 270 source/test hashes and preserve rolling artifacts before the full regression.

4. Full regression passes 604 tests, zero failures/skips, 110.717 seconds. Inspect public AppKit dragging headers and the preserved Photoshop floating screenshot (32×24 canvas in a compact 102×108 window). Plan a retained common application frame, global active-document routing and canvas-only floating hosts; document sheets must have one presentation owner to avoid duplicate dialogs. Add a targeted hosted-view hit-test regression to establish that pointer locations in each tab reach the native control rather than the canvas. Preserve the completed full run and test snapshot before this additional qualification.

5. The added hosted hit-test fails two assertions in the 34-test focused run (1.802 seconds); both tab-center probes resolve away from their native button. Preserve the failed test source and output. Trace public view frames, coordinate conversion and hit targets to determine whether this is a real routing issue or the test’s coordinate precondition before changing production code.

6. Diagnostic proves a test-coordinate mistake: the hosting root is flipped, its parent frame is not, and NSView.hitTest expects coordinates in that parent. Passing the tab’s root-local y=50 instead selects the canvas near the opposite edge. Correct the test to convert the tab center into root.superview coordinates; preserve the failing diagnostic and source. This does not establish the cause of the earlier live drag failure. No production routing change is justified by this test failure.

7. Corrected focused tests pass 34 tests, zero failures, 1.637 seconds. Both hosted tab centers reach their actual native buttons. Refresh the 270-file source snapshot and run the final full and optimized regression sequentially. The new suite has four additional document-interaction tests; earlier 604-test evidence remains preserved separately.

8. Final full regression passes 605 tests, zero failures/skips, 107.358 seconds. The Mac remains locked on a second direct CUA check; a preceding assignment failed because the initial thrown getApp call never established its binding, and performed no UI action. Record both observations. Run optimized checks and universal packaging with live qualification explicitly pending, retaining step061 as the last bounded live-qualified baseline.

9. Optimized critical suite passes 159 tests, zero failures/skips, 4.628 seconds. Build both architectures with the unchanged macOS14 packaging script. No pixel/editing algorithm changed; existing image regressions retain their declared limits. Current source has 142 application and 128 test Swift files. Native hit testing is automated AppKit evidence, not a live mouse-drag pass.

10. Universal macOS14+ package verification passes for arm64/x86_64, version0.2.0/build2, original icon/licenses/project links, clean ZIP signature and all 270 source hashes. Candidate ZIP SHA256 18536f19073ec447774fe0e3afa10925670da18a291d2a46fbcd5ed8471133a3, binary e519acadb64a34e577722e8c831da6ff3de135aa1f2a5a23bab00e52bd01048f. Staged candidate: [local workspace]; it has not been launched for live qualification. Update the status, plan, README, command matrix, UI audit and native-tab/workspace reference manifests; rolling package summaries explicitly mark live qualification pending. Step061 remains the last bounded live-qualified build. The goal remains active and incomplete. Preserve current rolling artifacts and refresh/check the history inventory.

11. Final consistency checks match all source/test/package/evidence hashes and retain live status as pending. History audit passes with 62 milestones, 2,700 evidence files, 1,573 logs and zero missing explicit references. No goal completion, pause or blocked status is claimed: this turn made implementation/test progress while live UI access was unavailable.

Evidence: [local evidence archive].

Scope: continue the user's UI → menus → UX priority with actual document grouping and removal of extra AppKit Window-menu items, retaining save/close/current-document behavior. Full Photoshop equivalence remains incomplete.

1. Re-read native recording requirements and source/current status. The prior turn was progress: step060 implemented and qualified workspace visibility. All 266 tested Swift hashes still match. Goal control now reports active; the prior continuation limitation is resolved. Preserve affected files, prior package and rolling evidence before experiments.
2. Read public AppKit NSWindow/NSWindowTabGroup headers and Apple documentation; compare Adobe's current document-window guide and inspect the installed app. Existing document strip enumerates every document and merely brings its separate window forward. NSApp.windowsMenu is assigned the curated menu, causing extra system entries. Evaluate public native tab-group APIs and their bar visibility before choosing a layout; retain document save/close semantics and explicitly record limitations. Adobe guide fetch timed out after its search result was retrieved; no fabricated page content is used.

3. A disposable native test confirms the public NSWindowTabGroup API keeps its tab bar visible with two windows even after toggleTabBar. Saved the probe source/output, then removed it from the shipping test target. Choose one native workspace window with a SwiftUI tab strip in the observed Photoshop position; retain distinct NSDocument objects for save, autosave, close review and independent editing state. No private AppKit APIs or view-hierarchy manipulation is used.
4. Captured Photoshop two/three-tab states using temporary 32×24 transparent documents Photato Tabs A/B. Control-Tab from the last tab wraps to the first; Control-Shift-Tab returns to the last. Float in Window detaches B to a separate compact canvas window. Closed B, explicitly selected A, closed A, and verified original Untitled-1 remains. No original pixels were edited. Floating palettes/application-frame sizing remain a separate visual qualification requirement.
5. Implemented the native workspace/window coordinator, independent document routing, close-review delegates, horizontal accessible tab buttons, tab reordering and grouped/floating/consolidation actions. Replace AppKit's managed Window-menu designation with a custom native document list so no system window-management hierarchy is injected. Initial compilation failed on an incorrect NSDocument sheet-property spelling and fileURL's nonisolated setter; preserve the failed attempt and sources. Use the actual windowForSheet property and dispatch file-URL presentation updates to MainActor. Tests of document lifecycle and interaction are next; no release is claimed yet.

6. The corrected code passes the original 20 workspace/menu tests. Seven initial document integration tests pass with them (27 total, zero failures, 1.633 seconds), covering one physical window, independent undo/native save data, current-document/sheet routing, reorder/cycle, moving between windows/consolidation, clean close review, sheet blocking and dynamic menu validation. Added workspace/tool setting retention with independent zoom/pan (28 focused tests pass, 1.401 seconds), and direct Control-Tab native event routing (nine document tests pass). Saved every attempt separately.
7. Inspecting the reused canvas found a possible gesture carryover between documents. Give the CanvasHost a document identity and focus its newly attached native view; cancel uncommitted source gestures when selecting another tab. Tool/panel settings carry across tabs while document pixels, selections, undo and viewport remain independent. Keep the auxiliary-window Close command directed to that window instead of closing a document behind it; add a regression assertion. Record all 269 Swift source/test hashes, then run the full suite. Floating windows are functional separate native workspaces; their duplicated chrome still differs from Photoshop's canvas-only floating document within one application frame and remains explicitly unqualified.

8. First full run completed 600 tests with three failures in 111.845 seconds. Two auxiliary-close assertions had not established a key-window precondition: focused diagnostics confirm the non-activated XCTest application has NSApp.keyWindow=nil despite makeKeyAndOrderFront. Factor close dispatch by explicit NSWindow for the test; the actual menu action still supplies NSApp.keyWindow and will be checked live. A separate failure showed Services no longer associated with its curated submenu after AppKit's main-menu replacement. Assign Services and Help roles after setting mainMenu. Preserve failed full output/sources/hashes, then verify 29 focused tests, zero failures, 1.427 seconds. Refresh the tested-source snapshot and rerun the full suite; previous failure evidence is retained as full-tests-failed-01.log.

9. Corrected full regression passes 600 tests, zero failures/skips, 112.274 seconds. Optimized critical imaging/menu/workspace regression passes 154 tests, zero failures/skips, 4.617 seconds. Preserve both logs and current source hashes; build the universal app for fresh live lifecycle checks. The menu report retains 801 static entries, 102 primary and eight alternate shortcuts; five newly bound arrangement actions increase bound leaves to 144 and reduce unavailable leaves to 580. These remain partial command implementations, not a complete Photoshop capability count.

10. First packaged launch exposed a real layout defect missed by the initial unit checks: the workspace window shrank to 428×166 while its initially empty hosting view attached document content. Two blank tabs also appeared during launch/reopen. Preserve this package, source, logs and screenshot before repair. Disable automatic NSHostingView sizing for the explicitly sized workspace; reuse existing documents during application untitled/reopen callbacks. Add layout and reopen regression assertions. The repaired focused run passes 30 tests, zero failures, 1.754 seconds (focused-tests-07.log). Full/package/live checks must be repeated for this changed source.

11. The post-layout-repair full run passes 601 tests, zero failures/skips, 113.291 seconds. Compile a separate read-only Swift NativeArchive checker for the disposable documents that will be saved through the live UI. Run optimized critical tests next; do not reuse the first package’s qualification for changed code.

12. Post-layout-repair optimized regression passes 155 tests, zero failures/skips, 4.829 seconds. Preserve rolling outputs before the second universal build; save an implementation patch against the preserved pre-step sources. Final live qualification remains pending.

13. Live second package opens full size with one tab. Two-document switching, independent native saves, unsaved close Cancel, clean tab closure/reopen, Float/Float All, Window document selection and consolidation pass. Save-close uses the existing native autosave sheet wording, which differs from Photoshop. Initial keyboard observations after floating were affected by activation; direct title-bar activation restores field input, Control-Tab and panel hiding. About Command-W closes after native transition; retain immediate and settled observations separately. Three drag attempts still fail to reorder. Preserve this package/source/test evidence before replacing the tab-title Button (which owns pointer tracking) with a draggable-compatible Text tap surface plus explicit button accessibility action. This is a candidate repair; live retest is required.

14. The Text/tap-surface experiment passes 30 focused tests (1.694 seconds) and builds, but does not qualify pointer drag. A redeclared CUA app variable left capture/action helper closures attached to the previous app while direct calls targeted the candidate; preserve those mixed observations as invalid candidate evidence. Rebind helpers through one explicit app object. Two coordinate probes moved a disposable layer and were undone; physical tab clicks work, but verified-source drag still does not reorder. The candidate does not establish a repair, so preserve it under drag-surface-experiment and restore the prior accessible Button implementation, all 269 previously tested source hashes, and the exact pre-experiment universal package. No unrelated regression rerun is needed for restored identical source. Reordering is coordinator-tested only; pointer drag remains unqualified.

15. Final qualified package is the restored 601 full / 155 optimized / 30 focused tested source, with 141 application and 128 test Swift files. Twelve bounded live checks pass; pointer drag and complete Minimize/Bring All contexts remain unqualified. Independent decoding verifies all 960,000 white pixels in TabA and 768 transparent layer samples in TabB; a post-interaction decode is identical. The final clean app remains open at [local workspace] (PID28150); the experiment is closed. Universal ZIP SHA256 b50955825e4c3da59362c1ac82147856a5a2d6b71b2706f952363fda40e7bb0c, binary 9a794e78c82e2d18d94a862b8a43b28deb84c55f5782a8c0fc1c67f6496269d5. Update current status, plan, README, UI audit, command matrix, menu/workspace reference manifests and rolling package summaries. The step059 pause checkpoint remains byte-identical. Refresh/check the evidence inventory next. Goal remains active and incomplete; next diagnose pointer drag, then implement the common application frame/canvas-only floating documents and panel/workspace organization.

16. The first history check failed because its freshly redirected output logs changed the inventory being checked (not missing evidence). Preserve that failed attempt and write final audit outputs under the script’s excluded development-history-audit directory. Update the five bound arrangement rows in MENU_PARITY.csv, which had still described the old unavailable actions; current static inventory remains 801 entries / 102 primary / eight alternate shortcuts, 144 bound and 580 unavailable leaves.

17. Evidence inventory refresh and check pass: 61 milestones, 2,656 evidence files, 1,561 logs, zero missing explicit references. Final consistency check confirms all 269 source hashes, release/evidence references, app/ZIP hashes and the immutable pause checkpoint. No full parity claim or goal pause/completion is made.

Evidence: [local evidence archive].

Scope: the user explicitly resumed development after the 0.2.0 pause and set priority to UI → menus → UX → major functions → subfunctions → minor functions → everything else. The full native Photoshop goal remains incomplete. The historical step059 checkpoint is retained unchanged.

1. Read the checkpoint, current status, contributor rules and workspace/menu/keyboard source. All 265 baseline Swift hashes match step058. No tests have been rerun at this point. Inspection found view-local dock collapse state inaccessible to Window menu actions, and no canvas Tab/Shift-Tab workspace hiding. Investigate the installed Photoshop reference before defining transitions. An initial root AGENTS.md lookup and guessed WorkspaceState.swift path were absent; the actual native AGENTS.md and workspace files were found and read.
2. Preserve affected source, documents and rolling evidence before editing. Record fresh UI observations and native tests under [local evidence archive]. User resumption supersedes the pause; the goal tool still reports paused and offers no active/resume setter, so do not recreate the existing goal or falsely mark it complete.

3. Captured eight live Photoshop 2026 workspace states using native UI automation: all visible; Tab-hidden; Tab then Shift-Tab (panels return, tools/options remain hidden); Tab from that mixed state (all return); Shift-Tab from visible (tools/options retained); Tab from panel-only hiding (all return); Window → Layers from all-hidden (only Layers/Channels/Paths group returns); restored original workspace. The original Untitled-1 pixels were not edited. Adobe’s panel documentation independently describes the two shortcuts: https://helpx.adobe.com/photoshop/desktop/get-started/learn-the-basics/hide-show-panels.html . Selection of a group while hidden must not force unrelated groups/tools visible.
4. Added native WorkspaceVisibility presentation state, canvas-only Tab/Shift-Tab dispatch, per-group reveal from existing Window commands, history-rail reveal, and conditional workspace layout. Preserve dock collapse and selected tabs across temporary hiding; do not add these transitions to document undo/save. Modified shortcuts remain available to AppKit; held-key repeats do not oscillate panels. Text fields retain their ordinary responder-chain Tab navigation. Five new regression tests cover mixed transitions, targeted group reveal, preservation, modifiers/repeats, and transient panel dismissal/document isolation. This step does not yet implement per-tab closing, detachable/rearrangeable groups, global workspace persistence, edge-hover reveal or shared document tabs.
5. Focused WorkspaceTests + PhotoshopMenuTests: 20 tests, zero failures/skips, 0.299 seconds (focused-tests-01.log). Existing 801 menu entries / 102 primary and 8 alternate shortcuts are unchanged. Preserve all rolling artifact outputs before the full regression run. Recorded 266 application/test source hashes before qualification.

6. Full regression: 591 tests, zero failures/skips, 110.854 seconds. The optimized invocation was queued before the full process exited; SwiftPM correctly serialized it on the shared scratch-path lock (message retained in release-tests.log). No simultaneous compilation occurred. Read-only process inspection first hit the filesystem sandbox; the authorized elevated check identified the baseline UI process as PID90184 at the clean step059 extracted path. Captured its workspace and quit that baseline app; older historical Photato processes were left untouched.
7. Goal-control check still reports paused despite the user’s explicit resumption. The exposed update tool has no resume/active action. An attempt to inspect the Codex Resume control through CUA was refused because computer use cannot control com.openai.codex. Respect that boundary; do not bypass it, recreate the goal, or imply the full objective is complete. Continue the authorized implementation in this turn and disclose the continuation-control limitation.

8. Optimized critical imaging/menu/workspace suite: 145 tests, zero failures/skips, 3.424 seconds. Preserved the previous 0.2.0 ZIP and all rolling test artifacts before rebuilding. Build uses the existing arm64/x86_64 macOS14 script; unchanged compiler warnings remain visible in its log. A focused release verifier checks source hashes, test log results, version, architectures/deployment targets, clean ZIP signature, licenses, original icon, project links and menu inventory. Historical image-workspace snapshots/performance/StoreKit integration are explicitly not fresh evidence for this UI change.

9. Clean universal ZIP verification passes with arm64/x86_64, macOS14 minimum, version0.2.0/build2, ad-hoc signature, original icon/licenses/project links and unchanged factory menu inventory. App sources are now 139, test sources 127; all 266 tested hashes remain identical after tests/build/live checks. Binary SHA256 0a4287b8b4892a7596e23ae2f248b76916aa9a3e47c5aa41461be88fb4941cfc; ZIP SHA256 55738c02af8b9c89fb160141151fb8c84e6087947356cdb1d5121d2711488fa3.
10. Launched the clean extracted app at [local workspace] (PID91708 verified from process path). Ten bounded live checks pass: both hide shortcuts; mixed-state restoration; Window Layers revealing only that group; Window Channels expanding a collapsed dock; Tab and Shift-Tab moving between X/Y text fields without hiding the workspace; restored Layers/default fit with unchanged 1200×800 Background. Initial field-focus assertions incorrectly required an AX focused-element annotation that the snapshot omitted. Preserved those false diagnostic results in live-observations-01.json; screenshots show Y then X selected, qualifying the corrected visual observations. No source repair was needed. Kept the new clean app open for review and left older historical processes alone.
11. Captured a further live menu deficiency: AppKit inserts window-management entries before the curated Window hierarchy, unlike the Photoshop reference. The static 801-entry inventory never proved dynamic menu equivalence. Queue this and native shared document tabs next under the user's UI/menu priority. Update current status, plan, command matrix, UI audit, new WORKSPACE_VISIBILITY_REFERENCES.json and rolling release evidence. Preserve the step059 pause checkpoint unchanged. Full Photoshop parity remains false. Refresh/check the development evidence inventory next.

12. Evidence refresh/check passes: 60 milestones, 2,524 evidence files, 1,533 logs, zero missing explicit references at the first final audit. Append the new dynamic Window-menu limitation to MENU_PARITY_REFERENCES.json without changing its historical release claims, preserve its prior form, and refresh/check once more after this final note. Current work is a qualified UI milestone, not full-goal completion. The next work and continuation-control limitation are recorded in STATUS; the previous requested pause has been revoked by the user, and no new pause is requested or set.

Evidence: [local evidence archive].

Scope: the user requested a pause after the next minor version increment and a precise durable memory of the work. The completed raster merge milestone is the release boundary; begin no new feature before pausing.

1. Read current version/recording requirements. The bundle still declares 0.1.0 (build 1); increment scripts/Info.plist to 0.2.0 (build 2). Preserve the previous ZIP, Info.plist, rolling verification files and affected documents under [local evidence archive]. All 265 Swift source/test hashes match the tested step058 baseline. This changes release metadata only, not the native archive format (v8) or editing code. Retain the previous 586 full / 133 optimized test results as inherited evidence; do not claim a fresh test run for metadata-only work.
2. Rebuild the universal macOS14+ app and independently check its version, minimum OS, both architectures, clean extracted signature and bundled resources. Record results before fulfilling the requested goal pause. Prepare docs/PAUSE_CHECKPOINT.md with exact files, evidence, arithmetic findings, caveats, runtime state and next work.

3. plutil validates the changed plist. Both cached architecture builds and the package script complete successfully. An independent clean ZIP check verifies 0.2.0/build2, only the two intended bundle metadata keys changed, arm64/x86_64, both macOS14 deployment targets, code signature and original licenses/icon/project links. All 265 tested Swift hashes remain identical to step058. No unrelated editing tests or live UI interactions were repeated. The previous running feature app is still an older-version step058 instance and is explicitly identified in the checkpoint; the new package is ready in build/.
4. Saved a detailed docs/PAUSE_CHECKPOINT.md with the completed feature boundary, source/test files, 34 independent references, exact composite arithmetic and traps, inherited 586/133 test results, native autosave caveat, build/runtime state, persistent product requirements, and the pending general-renderer/Background/Flatten/richer-merge work. Updated README, STATUS, the porting plan and rolling package evidence to point to this boundary. Preserve the user’s full Photoshop goal as unfinished; mark it paused only after the evidence audit completes.

5. Development-history refresh/check passes: 59 milestones, 2,471 evidence files, 1,527 logs, zero missing explicit references. Logs are preserved in [local evidence archive]. Refresh/check again after this final note, then fulfill the explicitly authorized goal pause. No further implementation is pending within this version increment; the broader Photoshop objective remains incomplete.

Evidence: [local evidence archive].

Scope: the previous goal turn made verified progress by implementing native selected-raster Layer Via Copy/Cut. Continue toward complete Photoshop functionality with Merge Layers/Down, Merge Visible and Flatten Image. Inspect transparency, hidden layers, bounds, retained metadata, selection and background behavior before implementation.

1. Re-read contributor requirements/current status, verified all 259 prior tested Swift hashes and preserved affected sources/docs/scripts. The native menu catalogue has these three commands but no actions. Rust implementations compose selected/visible layers and flatten onto white; those routines are intermediate source behavior, not Photoshop qualification. Native layers currently represent a single whole-layer lock and lack Photoshop’s distinct Background semantics; inspect the actual flattened PSD before choosing the model changes. No new production code or test pass is claimed yet.

2. Read Adobe’s current merge/stamp, layer-management and flattening documentation. Reused original procedural two-layer RGB8/16/32 probes with the saved selection channel already removed in step057. Captured 15 Photoshop saves (source, Merge Down, selected Merge Layers, Merge Visible, Flatten) and restored/closed each disposable document. Photoshop changes the single-selection menu title to Merge Down. Down retains the lower name Source; selected and visible merging with the top active retain Layer 1. All merged stored bounds are [0,1,256,7]; flattened images have no editable layer records and cover the opaque canvas. Extended the independent inspector to accept legitimate layerless flattened PSDs, preserving its prior version.
3. Prepared independent 65,536-pixel two-layer color/alpha matrices at all three depths, an RGB8 60% opacity variant, and an off-canvas three-layer/hidden-middle geometry probe. These test different source colors; the first reused Layer Via pair had equal RGB colors and could not qualify color mixing. Their neutral temporary merged caches are intentionally not reference expectations; Photoshop-saved operations will supply those. An optional historical-path shell glob failed before a search; the inspection command still ran and its output was retained. No production code has changed.

4. Acquired the independent RGB8/16 color/alpha matrices and RGB8 top-opacity 60% variant. Plain floating-point source-over differs in thousands of color samples. An integer rule quantizes output alpha, then source/output coverage, then interpolated colors. It matches every tested RGB8 sample, including opacity. For RGB16, ten exact half-product alpha ties distinguish a+b−round(a×b) from a+round(b×(1−a)); correcting that algebra produces exact RGBA across the independent 65,536-pixel matrix. These are independent Python observations; no native merge kernel is claimed yet.
5. Photoshop rejects the first new RGB32 matrix despite accepting the earlier smaller probe. Inspection isolates a global Lr32 payload length aligned to two bytes instead of four. Preserved the input/generator/failure observation, generated inputs-03 with four-byte padding, and Photoshop then opened/saved the RGB32 source/merge/flatten set. An attempted alert dismissal found the dialog already gone; a fresh state confirmed the original document, and no blind action followed. The float candidates are not yet exact; preserve all residual measurements and test fused arithmetic separately.
6. Hidden/off-canvas references establish that selected Merge Layers discards selected hidden layers and preserves off-canvas bounds [−4,3,38,18], whereas Merge Visible retains the hidden middle layer and clips merged content to [0,3,32,18]. The result uses the active visible layer’s name/stack position, qualified with both top and bottom active. Merge Down is disabled when the immediate lower layer is hidden; the menu title then reads Merge Layers. Flatten prompts “Discard hidden layers?”; the confirmation state changed before the queued click, so re-read and verified the completed flattened result rather than replaying it. Saved a Background plus new-empty-layer probe: Background has three RGB channels, protected-transparency flag and canvas bounds; the empty regular layer has a transparency channel. Undid temporary edits and closed all probes, retaining original Untitled-1. New Layer’s custom dialog had no accessible fields; its screenshot exposed the default Layer 1 and OK, and Return accepted that displayed default.

7. Float research now matches all 65,536 RGBA pixels using an FMA alpha calculation, a rounded source/output ratio and fused color interpolation, with a source-color fast path at full source alpha. Added the independent native NormalLayerComposite kernel and raster LayerMerge transactions, plus Cmd-E/Shift-Cmd-E routing, dynamic Merge Down title, cancellation/stale protection and single-step undo. Merge Visible clips to the canvas and retains hidden layers at their original stack positions; selected/down merging retains off-canvas pixels. Selected merging discards selected hidden layers. Pixel selection stays intact. Rich layers, masks, groups, clipping, transforms, locked layers and entirely empty results remain explicitly unsupported. Flatten remains disabled pending actual Background semantics. The existing general renderer is unchanged; the new kernel is used by merging only. RGB32 native sRGB transfer exactness remains an acknowledged boundary.
8. Extracted four original 65,536-pixel independent sample matrices (262,144 pixels total) and copied small original PSD workflow fixtures. Added nine core/imaging/app tests. First focused run: 17 tests, three assertions failed. All workflow/reference geometry tests pass; two failures are obsolete assertions that Merge Visible has no action. The third is one RGB32 alpha sample: the opaque-color fast path incorrectly returned constant alpha one, whereas the measured FMA alpha must still run. Preserve this failed implementation/log and repair the general opaque path; do not alter the independent expected samples. Several guessed test/helper filenames were absent during inspection; located the actual files with rg; no files were modified by those failed reads.

9. Repaired focused run passes all 17 tests with zero failures/skips in 1.654 seconds. All 262,144 independent kernel RGBA pixels match exactly. Nine small all-depth operation references qualify native/PSD geometry and metadata, with exact RGB8/16 stored pixels and RGB32 alpha; RGB32 colors retain the declared 0.00001 encoded bound. Three off-canvas/hidden-layer workflows also match exact stored RGBA and placement. Captured all 265 Swift source/test hashes before full regression.

10. Full regression passes 586 tests, zero failures/skips, in 108.783 seconds. All 265 tested Swift hashes remain unchanged. Updated command/menu matrices to 139 bound leaf operations and 585 unavailable entries while retaining 801 static entries, 102 primary/eight alternate factory bindings. Added original-fixture attribution and the merge reference manifest. The previous clean Layer Via test build quit via Command-Q; CUA reported the expected app-quit result. A sandboxed process-list check was denied and made no changes; packaged live process verification will use an authorized read. Optimized/package/live verification follows.

11. Optimized regression passes 133 tests, zero failures/skips, in 3.453 seconds. Universal arm64/x86_64 macOS14+ packaging succeeds. Desktop Finder metadata causes the first local signature check to fail; the existing bounded retry succeeds, and the independently extracted ZIP signature, architecture, deployment target, icon and bundled license integrity verify. Ten fresh packaged diagnostic layouts complete. Existing RasterDecodeBudget Sendable/build-system deprecation warnings remain; no new source changes followed the passing tests.
12. Live packaged Command-E merges the 256×256 RGB8 matrix into Bottom and undo restores both layers. The second procedural native archive initially fails to open. Preserved the truncated Go To path, clipboard timeout/format alert and obsolete menu capture; a tiny diagnostic linked against the tested Core objects isolates the actual archive failure: Python serialized 0.6 as Double, which the Swift property-list Float decoder rejects as nonrepresentable. A separately named -02 archive stores the exact Float32 value and decodes successfully. The failed original and manifest remain. An alert dismissal initially used a changed index and was rejected as offscreen; fresh AX state supplied the current OK button. No production code was changed for these fixture/UI repairs.
13. Live repaired hidden-layer case confirms the disabled Merge Layers title when the immediate lower layer is hidden, enabled Merge Visible, and disabled Flatten. Shift-Command-E preserves Hidden and yields canvas-clipped Top [0,3,32,18]; undo restores all three layers. Option-Command-A then Command-E yields off-canvas Top [−4,3,38,18], discards selected Hidden, and undo restores all three. Three exported PSDs match all stored RGBA layer samples and all 67,072 merged canvas pixels against independent Photoshop saves. Closed both disposable documents after undo without a manual Save or prompt; current Photato is clean Untitled-1. Automatic native archive rewriting was detected and separately checked in substep15 below. The original Photoshop document remains untouched. Captured the actual running packaged binary path; historical other builds were left alone. The live observation array retains intermediate failed-open attempts as well as the final passing states.

14. Final evidence binds all 265 tested Swift files and the universal binary/ZIP hashes to the 586 full / 133 optimized passing tests and three exact live exports. Development-history audit passes for 58 milestones, 2,450 evidence files and 1,522 logs, with zero missing explicit references; audit output is preserved under [local evidence archive]. Refresh/check again after recording this final note. This is progress on raster merging, not completion of the active Photoshop-parity goal. Next work remains general-renderer fidelity, richer merge contexts, explicit Background/locks and Flatten Image, together with the wider feature/preferences backlog.

15. A final optional raw-input hash assertion fails: the two successfully opened disposable native archives were automatically rewritten by NSDocument, while the rejected original and all 265 tested Swift hashes are unchanged. Preserve post-live copies and the original historical creation hashes; do not label native-file byte equality as passed. An independent Python decode confirms every restored raster sample, layer bound/name/visibility/opacity matches the original Photoshop source inputs. Record this successful semantic check in post-live-input-verification.json and the release/reference chain. The automatic saving behavior is not a merge-pixel failure; original Photoshop reference hashes still match. The second history audit passes with zero missing references; refresh/check once more after recording this distinction.

Evidence: [local evidence archive].

Scope: preceding goal turn made verified progress on factory menu/shortcut defaults. Continue the full Photoshop goal with selected-pixel Layer Via Copy and Layer Via Cut, currently disabled despite their factory Cmd-J / Shift-Cmd-J bindings. Inspect Photoshop behavior, including selection precision, retained layer properties, masks, positions, locks and undo; use PhotoCraft only as an intermediate reference.

1. Re-read recording requirements/current status and verified all 254 baseline source hashes before preserving files. Inspected the native clipboard/duplicate/selection pipeline, PhotoCraft crates/engine/src/edit_cmds.rs and Adobe’s feature catalogue/layer documentation. An initial guessed Rust src directory did not exist; located the crates tree with rg. Source behavior is not Photoshop qualification. No new implementation or passing tests are claimed yet.

2. Generated nine original procedural raster/selection probes (RGB/8, RGB/16 and RGB/32; opaque, varying alpha, and opacity plus pixel mask) and acquired 27 separate Photoshop copy/cut/source PSDs through the native UI. Source references were saved after undoing each operation; the original user document and preferences were retained. Load Selection exposes the saved channel as Alpha 1; a masked layer initially offers Source Mask instead of Source Transparency, so the acquisition explicitly selects Alpha 1. The extracted layer is named Layer 1, retains 60% opacity in the property probes, and omits the source pixel mask. These are bounded observations, not general property qualification.
3. Preserved acquisition failures and repairs: the first generator failed after one output because of a relative-path assertion; corrected the output root. Two Save As transitions required a fresh accessibility tree before clicking the already-pending Save button. Reassigning a helper did not update an earlier REPL closure, so the acquisition function was redeclared. One app-change interruption was inspected before retrying Open. Photoshop rejected the first RGB/32 inputs; inputs-04 adds HDR metadata and an Lr32 global layer block, after which all three float probes opened and saved. Inputs-03 accidentally repeats the prior format after an exploratory array-index failure; it is not a qualified reference input. All attempts remain in the run directory. A guessed PSDWriter.swift path was absent; the writer is in PSDCodec.swift.
4. An independent Python PSD decoder reads all 27 saved references, including trimmed source bounds, layer planes, masks and stored merged selection channels. The eight-bit copy alpha differs from ordinary source-alpha multiplication: the tested rows match a two-stage integer rounding rule involving the smaller/larger source and selection coverages. Directly scaling that equation to 16-bit working values does not match. RGB/16 and RGB/32 samples suggest an eight-bit coverage intermediate; further full-matrix and high-precision holdouts are required before implementing or claiming exactness. No application source, tests or package changed during these experiments.

5. Captured three independent 256×256 holdouts (all byte-alpha/selection pairs, non-byte-grid RGB/16 alpha, and float alpha with extended RGB). The same measured copy rule matches every alpha sample; Cut first converts the copied/source alpha ratio to a byte coverage, then applies depth-specific removal. RGB/16 uses 0…32768 intermediate multiplication, and RGB/32 uses explicit Float32 reciprocal/multiply/subtract ordering. All 196,608 holdout copy alpha and remaining-source alpha values match exactly; nontransparent RGB samples remain unchanged. Initial direct subtraction, normalized-double removal and direct 16-bit division candidates failed and remain preserved in alpha-arithmetic-02 through -04; -05 records the passing independent Python comparison. This is arithmetic research, not yet native Swift parity.
6. Captured Multiply and hidden-layer copy/cut probes. Inspect stored flags/properties before deciding native behavior. A Select menu remained in the accessibility state after Escape while Save As opened; preserved the failure, invoked its observed Cancel accessibility action, canceled the untouched Save panel, and resumed a separate named save. The locked probe opens with its mask targeted; its initial Cmd-J therefore duplicates the whole layer, so that observation cannot qualify selected content. A guessed core Layer.swift path was absent; located Layer in Document.swift with rg. Original user document remains untouched.

7. Added native LayerVia core arithmetic/transaction, selected-pixel menu routing and nine regression tests. The operation preserves RGB, opacity/blend and parent membership, creates a visible unlocked layer without source masks/tags, clears the selection, and leaves the clipboard untouched. Cut trims remaining nonempty raster bounds while retaining mask coordinates and sets newly transparent hidden RGB to white, as the saved references show. Affine/clipped/vector-mask/multilayer selected contexts remain unavailable. Existing whole-layer Copy behavior is retained separately. Locked-content probes explicitly reject both operations in Photoshop; mask-target duplication is separately recorded and not treated as selected-content parity. Two app-state interruptions were re-inspected before resuming; the probe was saved separately and closed.
8. First focused run: 17 tests, one unexpected failure. All 196,608 native alpha pairs and core/app/menu tests pass; imaging fixture import rejects a saved alpha channel. Investigation finds the fixture extractor assumed every composite retained transparency: Photoshop omits it for opaque composites, leaving three RGB channels plus the saved selection. Preserved the failed extractor, all derived fixtures and manifest; repair removes the actual last selection channel and retains three or four merged channels accordingly. No production pixel arithmetic changed for this repair. Original Photoshop references remain unchanged.

9. Repaired focused run passes all 17 tests with zero failures/skips in 1.984 seconds. The nine new tests qualify 196,608 independent alpha pairs, all stored native RGBA pixels in 18 small copy/cut outputs, native persistence, RGB8/16 PSD reopening, float PSD alpha, offsets/mask frames, locked/unsupported/empty/layer-limit rejection, stale/cancelled atomicity, history, clipboard isolation and both factory shortcuts. RGB32 sRGB/linear export conversion remains an existing non-bit-reversible boundary and is explicitly excluded from whole-RGBA PSD export identity. Added fixture attribution and captured all 259 Swift hashes before full regression.

10. Full regression passes 577 tests, zero failures/skips, in 106.235 seconds. All 259 captured Swift hashes still match. Updated command/menu matrices (137 bound leaf operations; 587 unavailable), original-fixture attribution and the reference manifest; factory menu order and all 102 primary/eight alternate bindings stay intact. The previous step056 clean blank test app quit through Command-Q; CUA reported the expected app-quit error. Historical other builds were not touched. Optimized regression and universal package/live verification follow. Corrected an inherited package-manifest log path from nonexistent full-tests-03.log to the current full-tests.log.

11. Optimized regression passes 124 tests, zero failures/skips, in 3.177 seconds. Both architecture compilations succeed. The first package script exits 1 because Desktop’s file provider adds FinderInfo to the copied app after each of three broad xattr-clearing retries; preserved the failed log and ZIP. The clean staged ZIP independently extracts with a valid signature, and all ten packaged diagnostic outputs pass. A separate broad-clear retry fails again; inspecting xattrs isolates FinderInfo on the app root. Removing only that attribute succeeds, and the local app signature verifies without modifying binary bytes. The package verifier passes against the clean ZIP. No build failure is relabeled as an initial pass.
12. Generated a disposable native v8 archive from independently inspected original source pixels and the ramp selection, preserving its generator/hash. Launched the clean extracted universal binary, opened that document, pressed Command-J, exported PSD, undid, pressed Shift-Command-J, exported PSD, and undid again. The two live exports match Photoshop in every stored layer RGBA sample and all 4,096 merged canvas pixels, including source/copy bounds. Menus enable both operations with a selection and disable Cut after Deselect; undoing Deselect and closing the probe returns to the clean blank document without a save prompt. An accessibility menu remained active after Escape; its observed Cancel action cleared that state. No clipboard write or original Photoshop document change occurred. Process evidence retains only Photato entries and binds the checked build to its actual path.
13. Final documentation and manifests bind all 259 Swift source/test files (135 application, 124 test) to the full/optimized results, reference fixture hashes, live observations and package. Binary SHA-256: ea080ff2db258f85e12f8c79107d4f5875774dbb145fff1cad2fea0fe3bd727a; ZIP: 4b5fdfc59b44bbeee01e57271c58df9d6d7d53c3f170d80161fa1c8b5f30abe0. The run contains 42 independently saved Photoshop documents. Additional guessed Mask.swift/Archive.swift paths did not exist; rg located LayerMask.swift and NativeArchive in Document.swift. Native selected affine/clipped/vector-mask/multilayer/rich-layer contexts, comprehensive whole-layer duplication semantics, empty/off-canvas cases, RGB32 PSD color-transfer exactness and cross-platform runtime qualification remain open. This is measurable feature progress, not full Photoshop equivalence.

Commands and final evidence: [local evidence archive], [local evidence archive], [local evidence archive], docs/LAYER_VIA_REFERENCES.json.

History refresh/check: [local evidence archive] and [local evidence archive]. Audit logs exist before refresh and remain outside the indexed evidence tree.

Evidence: [local evidence archive].

Request: default to Photoshop menus and shortcuts. The preceding menu capture used an already-modified Photoshop shortcut set; qualify the factory configuration independently and make that the built-in native baseline.

1. Re-read the development rules, status and preceding menu evidence, verified all 254 baseline Swift hashes, and preserved affected files before editing. Read the installed Photoshop 2026 factory shortcut data without altering Photoshop preferences. Its XML declares modified=0 and multi-undo=1. Official Adobe documentation independently confirms Command-H for Extras. A shell search with an unmatched optional filename glob failed harmlessly; subsequent searches use explicit directories. Initial log setup also failed on an incorrect index-cell assumption after preserving files; repaired the index lookup without recreating the run. Implementation and verification are in progress.

2. Parsed the installed unmodified factory shortcut file, preserving its hash and only normalized command/key facts. All 102 mapped primary shortcuts have an unambiguous current menu path. Three primary bindings differ from step055: Extras becomes Command-H, Hide Photato becomes Control-Command-H, and Help gains Shift-Command-/. Eight alternate keys use hidden native NSMenuItems with the same action/target/validation; visible menu structure remains unchanged. Four factory records have no captured current menu counterpart and are explicitly excluded, not mapped by ambiguous title alone. No Adobe implementation or raw preset is bundled.
3. The first focused run executes eight tests with 956 assertion failures: AppKit automatically assigns selector identifiers when aliases use nil, causing the visible inventory comparison to cascade; the live-window text-copy test also fails to receive its asynchronous action, and opening that test window changes AppKit service-menu state. Preserved the failed log and sources. Assigned a dedicated alias identifier namespace, filtered hidden aliases from the visible inventory, and replaced the window-dependent harness with native menu dispatch plus validation and a run-loop drain. Independent factory checks still assert identical clipboard targets/selectors. Live clipboard routing remains to be checked in the packaged app. Repaired focused run passes all eight tests with zero failures/skips in 0.248 seconds. Full regression follows.

4. Read-only live inspection of Photoshop’s Menus tab confirms the active menu preset is already “Photoshop Defaults,” independently qualifying the preceding menu hierarchy as the default preset. Saved its AX tree and screenshot, canceled without changing settings, and retained the original Untitled-1. Updated persistent contributor instructions, README, plan and command matrix to make Photoshop factory defaults the startup requirement.

5. Full regression passes 568 tests in 106.433 seconds; optimized regression passes 115 tests in 2.980 seconds, zero failures/skips. Revalidated all 254 Swift hashes. The previous menu-check app quits cleanly with its unchanged blank document; a process-path check is required because other historical test builds share its bundle identifier. The sandbox denied the initial read-only ps call; the approved retry identifies only two older historical builds, which are left alone. Universal rebuild is in progress.

6. Universal arm64/x86_64 packaging, clean ZIP signature, ten packaged diagnostics and the global package verifier pass. No signature retry was needed in this build. Recorded the running process path to distinguish the new clean extraction from historical test apps. Live launch requires no opt-in; Option-Command-0 yields 100%, Command-= yields 125%, and Command-0 restores fit. Command-H leaves the app visible while Extras remains disabled. F3 copy, F4 paste and F2 cut operate on disposable layer-filter text rather than document pixels; restored and cleared that filter. The clipboard contains only the nonsensitive test string afterward. Document pixels/history were not changed.
7. Captured all twelve final native menus: all 789 descendants retain expected order, and hidden shortcut aliases do not appear as duplicate visible commands. Shift-Command-/ selects the native Help menu rather than directly invoking the Help item; read-only comparison confirms the same macOS behavior in Photoshop. Canceled both menu states and retained original Photoshop Untitled-1. Saved ten observations and hash-bound live verification. Full context/tool/dialog coverage, visual geometry, customizable preferences and unavailable operations remain open.
8. Updated status, plan, menu matrix and reference/release manifests. A final metadata review found inherited step055/source/shortcut-set fields despite the new factory qualification; preserved both prior manifests and the helper, corrected those fields to step056/factory defaults, and refreshed the release manifest’s reference hash. Final binary SHA-256: dd7723bd50707df48c28cdc9a71d891dbcce8947edd55afccaa396be11bfd6a9; ZIP: 8f72be0509f12bca36f548f298e99d220d80e4076e5e1e6726cbd3a1d43eafe7. All 254 tested Swift files match. Intel/macOS14/macOS26 runtime qualification remains open; this host is macOS27.0.1 Apple Silicon. No IAP transaction, publication or Photoshop preference modification occurred. Full Photoshop parity remains incomplete.

Commands, immutable failures/passes and current evidence: [local evidence archive], [local evidence archive], [local evidence archive], [local evidence archive]. External cross-check: https://helpx.adobe.com/photoshop/desktop/use-grids-measurement-guides/alignment-grids-guides/show-or-hide-non-printing-extras.html; the installed factory preset is the complete mapped-key authority.

History refresh/check outputs: [local evidence archive] and [local evidence archive]. Output files exist before refresh; audit logs remain outside the indexed evidence tree.

Evidence: [local evidence archive].

Request: align Photato’s menu bar and menu items with Photoshop 2026. Inspect the running app before deciding titles, order, groups, submenus and shortcuts. Preserve Photato branding and clearly unavailable commands. Menu placement must not claim functionality that is absent.

Evidence: [local evidence archive]. Re-read development rules/status, verified all 251 prior tested Swift hashes and preserved affected files before editing. A first AGENTS.md lookup at the workspace root found no file; read the actual native-root instructions instead. This read failure changed no files.

1. Compare all twelve native Photoshop menus and relevant submenus, using the original untouched Untitled-1 only for read-only inspection. Capture accessibility trees and screenshots; inspect inherited source command inventory but treat live macOS Photoshop as the layout authority. Then implement one native menu definition with command bindings, unavailable placeholders and regression coverage. Verify the packaged UI and document intentional platform/product differences.

2. Captured all twelve Photoshop menu trees through accessibility and exported its active shortcut summary via Keyboard Shortcuts → Summarize. The set is “Photoshop Defaults (modified).” Attempting to inspect defaults produced a warning about losing unsaved shortcuts; canceled that warning and the settings dialog without accepting any preference change. An initial Summarize click used an index changed by a refreshed AX tree and reached a scroll control; refreshed the tree and used the correct button. The first default-set helper expected the main dialog and failed on the warning; preserved the warning and cleanup evidence. No user document changed. Initial menu screenshots are unavailable, though the settings dialog screenshot works; separator positions remain a reviewed approximation, not visual certification.
3. Extracted 800 static menu entries across twelve menus, excluding device names, recent user paths, installed third-party plugin entries and OS-managed services/search/text-input content. Native menus preserve observed order, titles (normalizing three dots to a typographic ellipsis), hierarchy and 101 primary shortcuts from the captured active set. Preserved alternative shortcuts separately rather than concatenating them. Added explicit product entries for native PSD export, clipboard creation, Apple Intelligence, existing simple adjustments and IAP support. Unsupported commands have nil actions and remain disabled. Corrected Shift-Command-E export collision, moved Feather under Modify, Gaussian Blur under Blur, layer creation/rasterization into submenus, and sorted Window panels as observed. Kept canonical identifiers stable when context changes mask/clipping/alignment titles.
4. Added cancellable native Fill and Gaussian Blur parameter dialogs so menu ellipses do not execute the old immediate fixed defaults. Fill currently offers foreground/background/black/gray/white at Normal/100%; blur retains the existing 0–100px renderer and lacks Photoshop preview/pixel qualification. Extended existing store entry points with optional parameters; preserved the exact prior EditorStore by reconstructing and verifying its previously recorded SHA-256. New tests check the independent captured hierarchy, shortcut reservation, action targets, disabled placeholders, text clipboard routing, fill choice/history and blur radius/error behavior. A few exploratory guessed source paths were absent; rg located the actual files before edits. No native tests have run yet for this checkpoint.

5. Focused regression passes 39 tests, 0 failures/skips, in 0.560 seconds, including all five new menu tests. The golden catalog checks 800 static entries and 101 primary keys; action-routing checks specifically prevent pixel Invert from creating an adjustment layer, keep Generative Fill distinct from Apple Intelligence, preserve text cut/copy/paste routing and reserve Shift-Command-E for the unavailable Merge Visible command. Added a machine-readable menu report before final full/optimized tests. Captured all 254 Swift source/test hashes before the full run. Full and package/live verification are in progress.

6. First full run executes 565 tests with one failure in 105.077 seconds: the older mask menu test expects the pre-alignment labels “Enable Layer Mask” / “Link Layer Mask.” The independent Photoshop AX capture uses “Enable” / “Unlink”; preserved the old test and failed output, then updated only those expectations. The other 564 tests pass. Also clarified report counts: AppKit assigns submenuAction to menu parents, so separate bound leaf commands (135) from all entries with actions (212). Preserved the first full-run source hashes and report before the repaired full run. No production source changed for either repair.

7. The repaired 565-test full run passes. Final routing review finds two semantic issues before release: ordinary raster Place Image must remain available without being mislabeled Place Embedded (which implies a Smart Object), and Layer Via Copy must not silently duplicate an entire layer when only pixels are selected. Added an explicitly named Place Image entry, increasing the catalog to 801 entries. Layer Via Copy now enables only for the supported single whole-layer case and rejects pixel-selection/multilayer cases; a sixth menu test pins these boundaries and undo. Kept all preceding source/report versions and full-run hashes. Final full/optimized tests now qualify this production guard.

8. Final full regression passes 566 tests, 0 failures/skips, in 104.994 seconds. Optimized regression passes 113 tests with no failures/skips, including all six new menu tests and the prior layout/gradient/PSD checks. Revalidated all 254 tested Swift source hashes (133 application / 121 test). The final menu report separates 77 menu parents, 136 bound leaf commands and 588 unavailable leaf commands; 101 primary shortcuts are assigned, including disabled commands whose keys must remain reserved. Updated the persistent AGENTS menu-parity rule, README, plan and 78 command-matrix paths/labels/shortcuts. Functional status remains separate from menu presence. Universal packaging and live checks follow.

9. Universal arm64/x86_64 packaging with macOS14 minimum succeeds. Desktop FileProvider metadata causes one local signature retry; the existing cleanup/retry succeeds, and the clean ZIP signature verifies independently. All ten packaged diagnostics and the package verifier pass. Optimized tests take 2.860 seconds, with zero failures/skips. Preserved the prior ZIP and every replaced root artifact before fixed-output runs. The final binary SHA-256 is a2af77998c317a32418338fc5e4672b17ea544a090dc25193a24f8ae15f5ac50; ZIP SHA-256 is b93babc81d98d49d5b1fa9d039510c171b8a8729792891fd503d640e6007095a. The live app is a clean extraction of that ZIP, checked on macOS27.0.1 Apple Silicon. Intel/macOS14/macOS26 runtime execution remains unqualified.
10. Live verification captures all twelve packaged menu trees. All 789 identified descendants appear in the same order as the independent expected inventory; the twelve top-level headings account for the remaining entries. AppKit adds system dictation/character/full-screen/window entries. Created only a disposable 32×24 white Untitled-2: Command-N opens New Document; Shift-Command-E leaves export closed; Option-Shift-Command-W opens the native Export panel and is canceled. Shift-F5 opens Fill with five contents; cancel leaves the document, Black commits a black canvas, and Command-Z restores white. Filter → Blur → Gaussian Blur opens the radius dialog and cancels. Select All then Shift-F6 opens Feather; cancel and undo restore the test state. Layer Via Copy is enabled for a whole layer and disabled with selected pixels. Closed Untitled-2 after undo without saving; both original Untitled-1 documents remain. No Photoshop preference change, IAP transaction or external publication occurred.
11. Preserved two live automation recoveries: a stale Fill control index was rejected without action, then refreshed; a helper expected the menu bar but received the still-open Layer tree after Select All. That tree already proved disabled Layer Via Copy; used its exposed Cancel action and completed cleanup. Saved 18 observations, three screenshots, both cleanup trees and a hash-bound live verification. Black/white screenshots were inspected visually; no Photoshop pixel-equivalence claim is made for Fill or Blur. Menu separators and pixel geometry remain unqualified because Photoshop menu screenshots were unavailable. The active reference shortcut set is modified; alternate keys, factory-default confirmation, settings implementation, recent documents, contextual behavior and many commands remain open.
12. Finalized docs/MENU_PARITY.csv separately from functionality status, the reference manifest, current status and plan. release-verification.json binds 254 tested Swift files, the package, immutable failed/passing logs, final artifact copies and live evidence. StoreKit behavior is unchanged; prior integration passes are historical. A documentation patch failed its whitespace-sensitive context match and changed nothing; retried at the stable step anchor. The evidence index refresh/check completes this checkpoint. Full Photoshop feature, output and preference parity remains incomplete.

Evidence: [local evidence archive], [local evidence archive], [local evidence archive], [local evidence archive], docs/MENU_PARITY_REFERENCES.json. The source fixture captures menu labels/hierarchy and declared Photato adaptations, not Adobe code or artwork. Existing partial operation bindings are not certifications of complete Photoshop workflows.

Commands and outputs: commands run from the native root. Earlier focused/optimized filter spellings were not retained in a standalone command transcript; their reproducible filters below are reconstructed from the preserved test-suite names, not presented as recovered original shell text. The focused run predates the sixth test, so rerunning it against the final tree increases its count. Full attempts are preserved as full-tests.log (one failure), full-tests-02.log (repair) and full-tests-03.log (final routing). Do not overwrite those evidence files when reproducing.

RUN=[local evidence archive]
# Reproduction filters; write future results to new paths.
./scripts/test.sh --filter 'ClipboardWorkflowTests|ColorBalanceWorkflowTests|CurvesWorkflowTests|GradientMapWorkflowTests|HueSaturationWorkflowTests|LayerLayoutWorkflowTests|LevelsWorkflowTests|PhotoshopMenuTests|TonalStepsWorkflowTests'
./scripts/test.sh
./scripts/test.sh -c release --filter 'Gradient|PSDMergedSampleTests|CloneSampling|LayerLayout|PhotoshopMenu'
./scripts/build-app.sh
# Recorded final evidence commands:
python3 "$RUN/package-snapshots.py" > "$RUN/package-snapshots.log" 2>&1
python3 scripts/verify-app-package.py > "$RUN/verify-app-package.log" 2>&1
python3 "$RUN/verify-live-ui.py" > "$RUN/verify-live-ui.log" 2>&1
python3 "$RUN/preserve-artifacts.py" final-artifacts > "$RUN/preserve-final-artifacts.log" 2>&1
python3 "$RUN/finish-step.py" > "$RUN/finish-step.log" 2>&1

History refresh/check outputs: [local evidence archive] and [local evidence archive]. Both files were created before refreshing the inventory, and audit outputs remain in the excluded directory.

Scope: step053 was progress: original Photoshop references established behavior and changed the implementation plan. Re-read recording rules and current status, revalidated all 245 existing Swift hashes, and preserved affected sources/metadata. Implement six alignments/eight distributions in Swift with atomic undoable translations and shared native controls, retaining the macOS14 universal requirement and the full parity objective.

Evidence: [local evidence archive]. Start with original references and the measured differences from Rust; acquire fresh holdouts before qualification. Preserved failed and passing attempts separately. This checkpoint completes the bounded layout implementation and verification; the overall Photoshop parity goal remains open.

1. Added two fresh original input documents: five unequal layers including negative coordinates, and a fresh padded single layer. The first generator attempt wrote its PSDs but failed while making relative-path metadata; retained the failed script/output directory, resolved the output path and regenerated in a new directory. Both repaired inputs reproduce byte-identically. Acquired six new Photoshop holdouts through the real UI, restored Selection target/Paint Bucket and returned to the original Untitled-1. All six match the earlier model, including explicit Canvas left alignment at visible x4 due to transparent storage padding.
2. Added pure Swift layout types and exact integer-rational placement, sparse nonzero-alpha content bounds, atomic subtree translations and async imaging preparation. Whole-pixel moves retain content, affine geometry, linked/unlinked raster and vector masks, selection and history. Added shared native controls in Move/Properties and fourteen Layer menu commands, plus Select → All Layers (Option-Command-A). Canvas fill layers reject explicitly; their unbounded/masked semantics remain unfinished. General Photoshop group/type/shape/mask behavior remains unqualified despite native invariants.
3. Bundled 26 original reference pairs with hashes and independent expected bounds (52 small PSD fixtures plus metadata); no installed artwork/presets or user imagery. Twelve new core/imaging/AppKit tests cover exact placement/composition/export/reopen, all native depths and editable types, groups, sparse alpha, invalid bounds, locks, selection, undo/redo, cancellation, stale preparation and menu shortcuts. The first compile failed because a test helper returned a byte array as Data; preserved source/log and corrected the return conversion. The first executing run passes 12 tests, 0 failures/skips, in 6.068 seconds. Extended linked/unlinked vector-mask and public union-validation checks before full regression. Two source reads failed (an unmatched History glob and a guessed Mask.swift filename); searches found the actual files, with no mutations from those reads.

4. The initial full run passes 557 tests, 0 failures/skips, in 108.476 seconds. A new consecutive-command Photoshop check then exposes an untested state difference: moving a padded raster trims its transparent storage extent before the next selection alignment. Acquired a two-command reference without an intermediate save. The new native regression fails (1 test / 1 assertion, 0.321 seconds), proving that matching isolated results was insufficient. Preserved the pre-fix code and initial full-suite source hashes. Added sparse bit-preserving crop and storage-frame correction only after nonzero layout moves; stationary anchors retain their original extent. Raster/vector masks keep document geometry, editable type/shape layers stay editable, and history restores the complete original raster.
5. Automatic approval review initially rejected the isolated regression because it believed the full suite remained active. Its tool had returned exit0; a sandboxed process read was denied, then an authorized process-name inspection confirmed no compiler/test runner (the only Swift-path match was an older PhotoCraft GUI). The normal test command was then approved and ran; no build was run concurrently and no approval bypass was used. The repaired focused suite passes 14 tests, 0 failures/skips, in 6.701 seconds, including all 26 original placements/stored bounds, a consecutive sequence, and six depth/link-state crop/mask cases. Kept the failed/passing results separately; final full/release and live checks follow.

6. The corrected full suite passes 559 tests, 0 failures/skips, in 107.327 seconds. Static review finds repeated subtree/ancestor reconstruction in the new layout path that could make 512-layer selection expensive. Replaced it with one parent lookup and one owner assignment per affected layer, retaining prevalidation and atomic commit. Added a 512-layer AppKit/Core workflow check with informational timing and exact once-only translation assertions. Preserve the second full-run source hashes; the final 560-test run and optimized regression now qualify this change. Added fixture attribution and updated package verification to require the new layout metrics while keeping historical gradient test provenance separate.

7. Final regression passes 560 tests, 0 failures/skips, in 107.561 seconds; optimized regression passes 107 tests, 0 failures/skips, in 2.880 seconds. The new module contributes 6 Core / 4 Imaging / 5 AppKit tests. All 251 tested Swift files (131 application / 120 test) still match the captured hashes. Twenty-six single-operation references match 1,123,200 merged RGBA pixels, and the separate consecutive-command reference adds 43,200, for 1,166,400 total; composition and PSD exports are exact within this corpus. The optimized 512-layer test measures 140 availability checks in 66.82 ms and availability plus edit in 68.70 ms, with every layer moved exactly once. This is one sample, not p95 or a Photoshop performance comparison.
8. Universal packaging succeeds for arm64/x86_64 with macOS14 deployment targets. Preserved the prior ZIP, all fixed-name artifacts, and historical metrics before replacement. Generated ten diagnostic outputs from a clean extracted signature-verified ZIP; package checks verify architectures, minimum OS, supplied icon, license integrity and absence of bundled reference PSDs. Desktop FileProvider metadata caused two intermediate local signature checks to fail; the existing bounded cleanup/retry completed successfully and the independent clean ZIP signature passes. Existing Sendable/build-system warnings remain in the build log; they are not hidden. No Swift builds/tests ran concurrently.
9. Live, opened the original four-layer probe in the clean package, selected all layers with Option-Command-A, verified all fourteen menu commands, and executed horizontal center alignment from Layer. Exported a unique PSD, selected the canvas and aligned left through Properties, then exported the two-command result. Three undos restore the original stored geometry. Undo clears multiselection; explicitly reselected the layers before applying horizontal spacing from the Move popover. On a fresh single-layer probe, Selection disables alignment without a pixel selection; explicit Canvas enables all six alignments and keeps distribution disabled. Toolbar left alignment produces the measured x4 padding result. Four uniquely named live exports independently match 172,800 merged RGBA pixels and every stored/visible layer bound/content hash using a Python decoder separate from Swift. The decoder adds bounded original-probe ZIP/8-bit prediction support without changing the historical reader. Screenshots show all controls; complete Photoshop typography/contrast/spacing parity is not claimed. Closed only disposable imported documents, retained the exports, and verified Photato Untitled-1 and the user's original Photoshop Untitled-1 remain unchanged.
10. Updated the README, current status, command matrix, plan and layout reference manifest, retaining step053 as historical research. Bound original fixtures, failed/passing tests, live evidence and all tested source hashes to the release binary/ZIP in the final verification. Canvas fill-layer layout remains explicitly unavailable; general Photoshop masks/groups/type/shapes/hidden/clipped/lock/depth semantics, tie ordering, more operation sequences, global target persistence, linking and selection/history parity remain open. Native invariants for these content types do not certify Photoshop behavior. Intel/macOS14/macOS26 runtime checks and the full functionality/byte/shortcut/preferences/AI goal remain incomplete. Additional exploratory reads used incorrect NativeDocument and saved DEVLOG paths; corrected lookup paths or used the current record, without changing source from those failures.

Evidence: [local evidence archive], [local evidence archive], [local evidence archive], [local evidence archive], [local evidence archive], [local evidence archive], [local evidence archive], docs/LAYER_LAYOUT_REFERENCES.json.

The binary SHA-256 is d6bcc2cdab0bf24298b3f5d317ba883c5aab06ffd7955490526300c739a4c119; ZIP SHA-256 is 9aa0f9a2788f6fbab032bb934eaf8ba351320248be3fd4058bf39e58550e509d. All procedural test images are original MIT OR Apache-2.0 data; no Adobe artwork, installed preset content or user image is bundled. Upstream Rust remains unchanged. The app and local documentation have not been published.

Commands and attempts: all paths below are relative to the native root. Every retry uses a separate log; source snapshots bind the earlier full runs to their earlier implementations. Focused attempt01 is a compile failure; focused02 passes twelve tests; sequence-before-fix fails one assertion; focused03 passes fourteen; full-tests/full-tests-02/full-tests-03 pass 557/559/560 respectively. Final optimized tests include all fifteen layout tests. Formatting is recorded in format.log, format-02.log and format-03.log. Source and fixture extraction, independent live decoding and metadata validation are retained as run-local scripts.

RUN=[local evidence archive]
python3 "$RUN/generate-holdout.py" "$RUN/inputs-02" > "$RUN/generate-holdout-02.log" 2>&1
python3 "$RUN/generate-holdout.py" "$RUN/reproduced-inputs-02" > "$RUN/reproduce-holdout-02.log" 2>&1
python3 "$RUN/extract-fixtures.py" > "$RUN/extract-fixtures-01.log" 2>&1
./scripts/test.sh > "$RUN/full-tests-03.log" 2>&1
./scripts/test.sh -c release --filter 'Gradient|PSDMergedSampleTests|PSDMerged|CloneSampling|LayerLayout' > "$RUN/release-tests.log" 2>&1
./scripts/build-app.sh > "$RUN/build-app.log" 2>&1
python3 "$RUN/preserve-artifacts.py" before-package-artifacts > "$RUN/preserve-before-package.log" 2>&1
python3 "$RUN/package-snapshots.py" > "$RUN/package-snapshots.log" 2>&1
python3 scripts/verify-app-package.py > "$RUN/verify-app-package.log" 2>&1
python3 "$RUN/verify-live-exports.py" > "$RUN/verify-live-exports.log" 2>&1
python3 "$RUN/preserve-artifacts.py" final-artifacts > "$RUN/preserve-final-artifacts.log" 2>&1
python3 "$RUN/finish-step.py" > "$RUN/finish-step.log" 2>&1

History audit output is kept outside the indexed run tree, and both output files are created before their references enter this entry: [local evidence archive] and [local evidence archive]. Refresh/check validates the surviving history and explicit references; it does not reconstruct unknown early edits or claim complete Photoshop parity.

Scope: previous turn implemented and verified Classic RGB16 Gradient Map, classified as progress. Re-read recording requirements and current status; revalidated all 245 tested Swift hashes and the step-052 ZIP. The two remaining Classic sample differences stay tracked. Advance another confirmed Photoshop/PhotoCraft gap: all 14 layer alignment/distribution commands and related toolbar/Properties controls are currently absent/disabled.

Evidence: [local evidence archive]. Read upstream crates/engine/src/layer_multi_cmds.rs, native transforms/history/selection/UI, and current Adobe alignment/distribution documentation. Two initial reads used guessed filenames that do not exist (GeometryEditing.swift, LayerTree.swift); subsequent searches locate actual files, with no changes lost. Photoshop behavior takes precedence over source comments where they differ.

Plan: acquire original Photoshop results for all six alignment and eight distribution operations, determine selection/canvas/rounding/content-bound behavior, implement atomic native whole-pixel translations retaining layer/mask structure and undo, connect menus/Move/Properties, then run module/full/optimized, file and live UI checks. Record unsupported edge cases and keep full functionality/pixel/shortcut/preferences gates open.

References: Adobe feature catalogue, Adobe alignment, Adobe distribution, accessed 2026-10-08. Adobe describes six edge/center alignments and six edge/center distributions plus two spacing operations. These docs alone do not qualify rounding, masks or enablement; measure the installed app.

1. Generated three original 240×180 RGB8 PSD inputs (four unequal rectangles, one layer, overlapping rectangles), with four transparent pixels of storage padding on every side. Reproduced all three byte-identically; added a separate two-layer enablement probe without replacing the original generator. Input/PSD/reference hashes and original-data provenance are retained. No installed Adobe content or user document is used.
2. Acquired separate Photoshop-saved results for all six Align and eight Distribute commands, both overlap spacing directions, whole-canvas pixel selection, explicit Canvas center, multi-layer selection alignment and a bounded-selection right alignment: 20 operations, plus the unmodified bounded-selection input. Selection bounds were read from Properties as x29/y29/w112/h62; the pointer’s nominal rectangle is not substituted for the observed values. Saved menu trees establish default single-layer and two-layer enablement.
3. Preserved acquisition failures and repairs in [local evidence archive]: initial Open/Save transitions were too early, and the selected-pixel menu is renamed Align Layers to Selection. Bounded AX state checks replaced optimistic transitions. A stale menu obscured the final disposable-document close prompt; the exposed Cancel action revealed it, and only the named two-layer probe was discarded. No original input file was overwritten.
4. Independently decoded layer raw/RLE channels, stored/visible bounds and merged channels in Python, separate from the native PSD decoder. All reference layers preserve their visible RGBA hashes. The proposed exact-fraction arithmetic predicts every measured placement; independent opaque recomposition matches 864,000 merged pixels across 20 references. Seven cases differ from the modeled Rust arithmetic. These are research checks, not native test passes or a shipped layout implementation. The model was derived from this set; fresh holdouts remain required.
5. Measured rules: default multi-layer alignment uses visible content in these probes; half-pixel alignment rounds toward the larger coordinate. Overlapping even spacing sorts by leading edges and allows negative gaps. Pixel-selection alignment uses the imported padded extent in the measured cases. A single layer needs a pixel selection or explicit Canvas target; distribution requires at least three selected layers in the installed app (all eight commands disabled with two), despite broader wording in Adobe’s guide. Group/mask/type/shape/hidden/lock/depth semantics are not qualified.
6. Restored Photoshop’s Align To Selection and original Paint Bucket tool, closed every disposable probe and verified the untouched original Untitled-1. Saved cleanup AX/screenshot and the final capture helpers. All 245 Swift source/test hashes, the universal app binary and ZIP still match step052; its 545 full / 92 optimized passing tests are historical and were not rerun for research-only work. New verification: [local evidence archive].
7. Updated current status, the plan and docs/LAYER_LAYOUT_REFERENCES.json. The implementation plan now separates pure layout planning, asynchronous visible/stored bounds, atomic hierarchy/mask translations and shared menu/toolbar/Properties controls. Native layout implementation, regression tests and release/live verification are the next development step; the existing disabled command matrix remains accurate. Overall feature/pixel/shortcut/preferences parity remains incomplete.

8. The first history refresh/check attempt failed with “History inventory is stale”: its log paths were inside the indexed artifacts tree and changed the inventory during execution. Preserved both original outputs and recorded the stderr from the tool result. Subsequent audit output is placed under the script’s excluded development-history-audit directory; no native code or evidence was deleted.
9. The corrected audit passes with 53 milestones, 2,009 evidence files, 1,380 logs and no missing explicit references. These counts describe the surviving inventory; they do not erase the previously documented gaps in early per-edit history. Final audit outputs are [local evidence archive] and [local evidence archive].
10. Adding the final log references exposed a second audit-order issue: refresh03 referenced check03 before that file existed, so check03 correctly reported a stale inventory once the file was created. Both attempt03 logs remain in the excluded audit directory. Created the final output files before refreshing their references, then reran as attempt04. This repair changes recording order only.

Commands and immutable outputs:

python3 [local evidence archive] [local evidence archive] > [local evidence archive]
python3 [local evidence archive] [local evidence archive] > [local evidence archive]
python3 [local evidence archive] > [local evidence archive]
python3 [local evidence archive] [local evidence archive] > [local evidence archive]
python3 [local evidence archive] [local evidence archive] > [local evidence archive]
python3 [local evidence archive] [local evidence archive] > [local evidence archive]
python3 [local evidence archive] > [local evidence archive]
touch [local evidence archive] [local evidence archive]
python3 scripts/audit-development-history.py > [local evidence archive] 2>&1
python3 scripts/audit-development-history.py --check > [local evidence archive] 2>&1

Scope: previous turn completed the step-051 research audit (51 milestones, 1,903 evidence files, 1,334 logs, no missing references), classified as progress. Re-read the recording requirements, current status and gradient code. Preserve macOS14 support and the unchanged step-050 release while deriving remaining Classic RGB16 rounding and validating an isolated native Swift candidate against Photoshop-saved references.

Evidence: [local evidence archive]. Development in progress; production parity is unproven.

1. Revalidated all 242 Swift source/test hashes and exported independently saved controls/opaque rows for fifteen references. A macOS14-targeted optimized Swift sweep tests 3,072 precision/scale/operation-order combinations. Integer-scaled stop values with Double midpoint mapping and weighted-sum linear interpolation reproduce the previously unresolved linear ramp exactly. Unlike the prior unscaled candidate, the arithmetic keeps the signed-fraction numerator exact until final conversion. No epsilon or per-pixel correction is used; Int128 is unnecessary.
2. Compiled a complete isolated Swift candidate (uniform cubic, segment bounds and output conversion). All fifteen existing 4,097-position reference rows match with zero working-level error. These are candidate results, not production test passes. Generated six new boundary/holdout documents using a distinct deterministic seed, extreme midpoint values and coincident stops, plus separate byte reproductions, before app integration.
3. Acquired all six new references in Photoshop: verified Classic and unchecked Reverse/Dither, toggled Reverse on/off, saved distinct reference files, closed every probe and returned to the original Untitled-1 unchanged. The independent control check failed because Photoshop clamps out-of-range midpoints to 5…95, while retaining every other tested control. The shell sequence incorrectly continued to the native checker without its missing JSON input, which failed at startup; both failure logs are retained. Preserved the exporter, explicitly validated only the observed midpoint normalization and reran with new logs. These four normalized probes cannot be described as preserving every original control.
4. The new references prove later-stop ownership at coincident positions. Corrected that candidate rule; a larger midpoint-operation sweep (24,576 combinations across all linear references) reduces the remaining candidate errors to two single-working-level positions across 21 full ramps. Partial-smoothness and coincident tests retain explicit independent expected output. Production integration is warranted by the large measured improvement; the two residuals remain declared incomplete parity, with no per-pixel exceptions.
5. Extracted a 21-case original reference corpus and four Photoshop-saved PSD fixtures, with provenance and hashes. Five new core/imaging tests fail against the pre-change app with 122 assertions in 3.210 seconds, establishing the regression baseline. Preserved those outputs. Added a separate native RGB16 Classic Gradient Map lookup, retaining the existing GradientRamp for fill/paint and all other methods/depths. It prepares 4,097 samples once, preserves alpha/reverse/dither flow, clamps midpoint controls, handles coincident and one-position segments, and uses only macOS14-available Double/Int arithmetic. Updated the old primary-color test expectations to the independently measured output grid. Full parity remains open.
6. First integration run executes 32 focused tests with three failures in the earlier tone tests: those tests assumed a Classic black-to-white ramp was numerically identical to the tone coordinate. The new renderer correctly applies the measured one-working-level output conversion. All new Classic core/imaging tests pass, including exact 114,700-pixel merged compositions and exports. Preserved failing logs/artifacts and updated the tone tests to use the separately Photoshop-rendered identity lookup for expected colors; their 131,072 independent tone coordinates and reverse/invalid-input coverage remain intact. No production fallback or tolerance was added for this repair.
7. The repaired focused run passes 32 tests in 6.645 seconds. Captured all 245 Swift source/test hashes before broad validation. Full regression passes 545 tests in 98.577 seconds, zero failures/skips. Optimized regression then passes 92 tests in 2.196 seconds, zero failures/skips. Universal packaging succeeds with arm64/x86_64 macOS14 targets. The unchanged RGB8/float bit-vector tests still pass; the two known Classic rounding residuals remain explicitly measured in the new tests.
8. Preserved the previous release ZIP, regenerated all ten diagnostic layouts from a clean signature-verified extraction, and inspected the Gradient Map workspace. Package checks pass for both architectures, minimum OS, supplied icon and licenses. Desktop FileProvider metadata briefly caused two local signature checks to fail; the packaging script's existing bounded clear/retry succeeds, and the clean ZIP signature verifies independently. Existing unused-state, Sendable and SwiftPM build-system warnings remain in retained logs.
9. Live, opened the original coincident-stop RGB16 probe in that clean package, verified Classic/Reverse off/Dither off and exported through File → Export Layers to PSD. Closed it and returned to Photato Untitled-1. Photoshop's first Open helper was interrupted by a UI-state change; inspected the existing Go to Folder sheet and resumed it. Photoshop opens the export without warnings, retains editable controls, recalculates after Reverse on/off and saves a distinct file. Both exported/recalculated files match all 16,388 merged RGBA pixels and controls independently. All disposable probes are closed; the user's original Photoshop Untitled-1 remains unchanged.
10. Final release verification binds all 245 tested Swift files, original fixtures, failure/repair/full/optimized logs, live outputs, diagnostics and the current binary/ZIP hashes. Updated attribution, README, status, command matrix, plan and reference manifests. StoreKit and performance were unchanged and not rerun. The history inventory refresh/check below completes the record; it does not establish complete Photoshop parity.

Evidence: [local evidence archive], [local evidence archive], [local evidence archive], [local evidence archive], docs/CLASSIC_GRADIENT_RESEARCH.json. All new procedural images are original MIT OR Apache-2.0 test data, excluded from the app; no Adobe code, installed preset library or user document was copied. Host execution remains macOS27.0.1 Apple Silicon; Intel/macOS14/macOS26 runtime checks remain open.

Commands: from the native root, RUN abbreviates this checkpoint. Preserved each changed diagnostic source under its numbered prior name before rerunning. The standalone compiles use -target arm64-apple-macosx14.0; production tests and builds use the project scripts. The shell pipeline initially continued after the boundary exporter failed; its missing-input native failure is retained separately, and subsequent dependent steps checked completion before proceeding.

RUN=[local evidence archive]
python3 "$RUN/export-reference-data.py" > "$RUN/export-reference-data.log" 2>&1
xcrun swiftc -O -target arm64-apple-macosx14.0 "$RUN/LinearArithmetic.swift" -o [local workspace] > "$RUN/linear-compile-01.log" 2>&1
[local workspace] "$RUN/references.json" "$RUN/linear-arithmetic-01.json" > "$RUN/linear-arithmetic-01.log" 2>&1
xcrun swiftc -O -parse-as-library -target arm64-apple-macosx14.0 "$RUN/ClassicCandidate.swift" -o [local workspace] > "$RUN/candidate-compile-01.log" 2>&1
[local workspace] "$RUN/references.json" "$RUN/native-candidate-01.json" > "$RUN/native-candidate-01.log" 2>&1
python3 "$RUN/generate-boundary-probes.py" "$RUN/boundaries-01" > "$RUN/generate-boundaries.log" 2>&1
python3 "$RUN/generate-boundary-probes.py" "$RUN/reproduced-boundaries" > "$RUN/reproduce-boundaries.log" 2>&1
python3 "$RUN/export-boundary-data.py" > "$RUN/export-boundary-data.log" 2>&1
[local workspace] "$RUN/boundary-references.json" "$RUN/native-boundaries-01.json" > "$RUN/native-boundaries-01.log" 2>&1
python3 "$RUN/export-boundary-data.py" > "$RUN/export-boundary-data-02.log" 2>&1
[local workspace] "$RUN/boundary-references.json" "$RUN/native-boundaries-02.json" > "$RUN/native-boundaries-02.log" 2>&1
xcrun swiftc -O -target arm64-apple-macosx14.0 "$RUN/LinearArithmetic.swift" -o [local workspace] > "$RUN/linear-compile-02.log" 2>&1
[local workspace] "$RUN/all-references.json" "$RUN/linear-arithmetic-02.json" > "$RUN/linear-arithmetic-02.log" 2>&1
xcrun swiftc -O -parse-as-library -target arm64-apple-macosx14.0 "$RUN/ClassicCandidate.swift" -o [local workspace] > "$RUN/candidate-compile-02.log" 2>&1
[local workspace] "$RUN/all-references.json" "$RUN/native-all-02.json" > "$RUN/native-all-02.log" 2>&1
xcrun swiftc -O -target arm64-apple-macosx14.0 "$RUN/LinearArithmetic.swift" -o [local workspace] > "$RUN/linear-compile-03.log" 2>&1
[local workspace] "$RUN/all-references.json" "$RUN/linear-arithmetic-03.json" > "$RUN/linear-arithmetic-03.log" 2>&1
xcrun swiftc -O -parse-as-library -target arm64-apple-macosx14.0 "$RUN/ClassicCandidate.swift" -o [local workspace] > "$RUN/candidate-compile-03.log" 2>&1
[local workspace] "$RUN/all-references.json" "$RUN/native-all-03.json" > "$RUN/native-all-03.log" 2>&1
python3 "$RUN/install-fixtures.py" > "$RUN/install-fixtures.log" 2>&1
python3 "$RUN/preserve-artifacts.py" before-focused-artifacts > "$RUN/preserve-before-focused.log" 2>&1
scripts/test.sh --filter 'ClassicGradientMap' > "$RUN/pre-fix-tests.log" 2>&1
python3 "$RUN/preserve-artifacts.py" after-prefixed-artifacts > "$RUN/preserve-after-prefixed.log" 2>&1
scripts/test.sh --filter 'ClassicGradientMap|GradientMapTests|GradientMapTone|GradientMapRender|GradientMapWorkflow|GradientStripes' > "$RUN/focused-tests-01.log" 2>&1
python3 "$RUN/preserve-artifacts.py" before-focused-repair-artifacts > "$RUN/preserve-before-focused-repair.log" 2>&1
scripts/test.sh --filter 'ClassicGradientMap|GradientMapTests|GradientMapTone|GradientMapRender|GradientMapWorkflow|GradientStripes' > "$RUN/focused-tests-02.log" 2>&1
python3 "$RUN/preserve-artifacts.py" before-full-artifacts > "$RUN/preserve-before-full.log" 2>&1
scripts/test.sh > "$RUN/full-tests.log" 2>&1
python3 "$RUN/preserve-artifacts.py" before-release-artifacts > "$RUN/preserve-before-release.log" 2>&1
scripts/test.sh -c release --filter 'Gradient|PSDMergedSampleTests|PSDMerged|CloneSampling' > "$RUN/release-tests.log" 2>&1
scripts/build-app.sh > "$RUN/package-build.log" 2>&1
python3 "$RUN/preserve-artifacts.py" before-package-artifacts > "$RUN/preserve-before-package.log" 2>&1
python3 "$RUN/package-snapshots.py" > "$RUN/snapshots.log" 2>&1
python3 scripts/verify-app-package.py > "$RUN/package-check.log" 2>&1
python3 "$RUN/verify-live.py" > "$RUN/live-files-verification.log" 2>&1
python3 "$RUN/verify-release.py" > "$RUN/release-verification.log" 2>&1
python3 "$RUN/finish-docs.py" > "$RUN/finish-docs.log" 2>&1
python3 scripts/audit-development-history.py
python3 scripts/audit-development-history.py --check

Remaining: two one-working-level positions (new random linear ramp index 864 and extreme-midpoint half-smooth ramp index 2089); no per-pixel exceptions. Continue resolving arithmetic, other interpolation methods, Smooth, fill/paint pixels, profiles, shortcuts/preferences and professional workflows. The full goal remains active.

Documentation audit: logs retained under [local evidence archive] All new application/test source and packaged hashes are bound by the release verifier.

Scope: the previous turn made verified progress with RGB16 tone mapping. Re-read recording requirements, current status and source; revalidated every one of the 242 tested Swift source/test hashes and the step-050 ZIP hash. Start from the unchanged 540/87-tested build. Investigate remaining Classic ramp errors independently from tone coordinates; preserve Smooth and other full-parity gaps.

Evidence: [local evidence archive]. Inspect saved 4,097-position gradient rows to distinguish coarse lookup construction from continuous interpolation. The identity output's one-working-level deficit except every sixteenth index suggests an intermediate lookup/rounding stage; this is a hypothesis, not an implementation rule.

1. Ran independent Python candidate sweeps against the Photoshop-saved 65-color Classic ramp. Coarse lookup intervals of 2–64 positions did not improve on continuous interpolation; reject that simple table hypothesis. Working-grid input reconstruction and fixed fractions still leave a 380-working-level maximum error. Inspecting worst samples identifies cubic overshoot beyond the two segment colors. Clamping each output channel to those two endpoints reduces the maximum to one working level (1,890 of 4,097 pixels still differ in the best candidate). This is empirical diagnostic evidence; production remains unchanged pending independent cases and rounding qualification. Preserved candidate scripts/reports and the first segment analyzer before adding the bounded-output candidate.

2. Generated eight original RGB16 Classic probes: ascending/descending linear identity, smoothed identity, 65-color linear palette, offset endpoints, constant color, uneven three stops and a changed midpoint. Acquired every reference in Photoshop by verifying Classic, toggling Reverse on/off, saving a distinct file and closing it. Initial CUA access had expired; rebinding the app restored access before opening the first file. No document/import warnings appeared; the original Untitled-1 remains unchanged. All inputs regenerated into a new directory. The independent inspector now compares controls/pixels and multiple rounded/bounded candidates; no production source has changed.

3. All eight acquired controls and reproduced inputs validate independently. Fitted slopes of the uneven three-stop reference identify uniform-parameter cubic coefficients: neighboring color differences divided by two, without native stop-distance scaling. Integer midpoint placement reduces the changed-midpoint error to one working level. A final-output bucket conversion reproduces neutral and 65-color ramps, but arbitrary stops still differ. Solving every linear-output bin for feasible endpoint values then identifies a signed fractional stop expansion. Combining these rules matches all 36,873 opaque-row RGB pixels across nine ramps (eight new plus the prior 65-color smooth palette), with zero working-level differences. This is an independent Python candidate, not production Swift output. Generated six further deterministic holdouts with arbitrary colors/positions, partial smoothness, changed midpoints and signed-fraction tie boundaries before considering implementation.

4. Captured all six holdouts and regenerated them separately. The last Open action reached the panel before its path sheet was ready; inspected the existing dialog and resumed it without reopening/restarting. All probes are closed and the original Photoshop document is unchanged. The first candidate fails tie colors and odd-span/30% midpoints. Revised nearest-midpoint rounding and downward color ties eliminate those errors; five holdouts then match, while the random linear palette retains seven one-working-level differences. The failed and repaired candidate reports/scripts remain separate.
5. Exact rational arithmetic validates full RGBA output, including the half-alpha fourth row, for fourteen of the fifteen reference ramps. The random linear palette differs at three positions (12 pixels across four rows), up to two stored levels; mathematical exactness alone does not reproduce Photoshop’s floating rounding. An isolated Swift typecheck rejects Int128 at the macOS14 target because it requires macOS15; retained the failure and rejected raising the deployment requirement. Compare equivalent Double operation orders without epsilon adjustments before choosing a native implementation.

6. Tested 450 then 900 equivalent Double-operation configurations, including interpolation split at the midpoint; the best still differs at five opaque pixels. No epsilon or per-pixel exceptions were introduced. Preserved the earlier scripts/reports. Removed an inert false branch from the rational diagnostic after preserving its source, added a distinct output argument, and reran it; the two reports are identical. The final research verifier confirms all fourteen new input reproductions/settings, all fifteen ramp comparisons and exact prediction of two separately acquired 65,536-pixel colored matrices. It also confirms every current Swift source/test hash and app/ZIP hash still matches step 050. No app source changed, no package was rebuilt and no native, StoreKit or performance suite was rerun.
7. Added a Classic research manifest with the measured equations, complete/failed cases, deployment constraint and remaining gates. Updated status, plan, command matrix and Smooth cross-reference without converting research outcomes into native pass claims. Recorded CUA acquisition/cleanup and the two UI timing repairs. Refresh/check of the history inventory completes this research checkpoint.

Evidence: [local evidence archive], [local evidence archive], [local evidence archive], [local evidence archive], docs/CLASSIC_GRADIENT_RESEARCH.json. All new probes are original procedural data under MIT OR Apache-2.0. No Adobe source, installed preset library or user document was copied into the application. Research fixtures remain local evidence, excluded from the app.

Commands: from the native root; RUN abbreviates this checkpoint. Each analyzer refuses reusing its report filename. The analyzer source versions before each adjustment are preserved under descriptive names; reports/logs retain the tested version's sequence. The Int128 command intentionally tests the required deployment target and fails on availability; it is not a failed application build.

RUN=[local evidence archive]
python3 "$RUN/analyze-lookup.py" > "$RUN/lookup-analysis-01.log" 2>&1
python3 "$RUN/analyze-segments.py" > "$RUN/segment-analysis-01.log" 2>&1
python3 "$RUN/analyze-segments.py" > "$RUN/segment-analysis-02.log" 2>&1
python3 "$RUN/generate-probes.py" "$RUN/inputs-01" > "$RUN/generate-probes.log" 2>&1
python3 "$RUN/generate-probes.py" "$RUN/reproduced-inputs" > "$RUN/reproduce-probes.log" 2>&1
python3 "$RUN/inspect-probes.py" > "$RUN/probes-analysis-01.log" 2>&1
python3 "$RUN/analyze-output-quantization.py" > "$RUN/output-quantization-01.log" 2>&1
python3 "$RUN/analyze-color-precision.py" > "$RUN/color-precision-01.log" 2>&1
python3 "$RUN/fit-uneven-slopes.py" > "$RUN/uneven-slopes-01.log" 2>&1
python3 "$RUN/analyze-uniform-cubic.py" > "$RUN/uniform-cubic-01.log" 2>&1
python3 "$RUN/fit-linear-bounds.py" > "$RUN/linear-bounds-01.log" 2>&1
python3 "$RUN/analyze-signed-fraction.py" > "$RUN/signed-fraction-01.log" 2>&1
python3 "$RUN/generate-probes.py" "$RUN/holdout-01" --holdout > "$RUN/generate-holdout.log" 2>&1
python3 "$RUN/generate-probes.py" "$RUN/reproduced-holdout" --holdout > "$RUN/reproduce-holdout.log" 2>&1
python3 "$RUN/analyze-holdout.py" > "$RUN/signed-fraction-holdout-01.log" 2>&1
python3 "$RUN/analyze-holdout.py" > "$RUN/signed-fraction-holdout-02.log" 2>&1
python3 "$RUN/verify-rational-candidate.py" > "$RUN/rational-candidate-01.log" 2>&1
xcrun swiftc -typecheck -target arm64-apple-macosx14.0 "$RUN/int128-availability.swift" > "$RUN/int128-arm64-typecheck.log" 2>&1
python3 "$RUN/search-double-order.py" > "$RUN/double-order-01.log" 2>&1
python3 "$RUN/search-double-order.py" > "$RUN/double-order-02.log" 2>&1
python3 "$RUN/verify-rational-candidate.py" > "$RUN/rational-candidate-02.log" 2>&1
python3 "$RUN/verify-research.py" > "$RUN/research-verification.log" 2>&1
python3 scripts/audit-development-history.py
python3 scripts/audit-development-history.py --check

Documentation audit: logs retained under [local evidence archive] Current production remains the 540/87-tested universal step-050 build; research counts do not add native test passes.

Next: translate the measured Classic RGB16 behavior into an isolated Swift candidate, retaining macOS14 support, and compare it against these independent references. Resolve rare linear rounding, then qualify coincident stops/extreme midpoints and integrate with core, imaging and workflow tests. Continue the remaining interpolation, Smooth, full functionality, exact pixels, shortcuts/preferences and runtime gates; the overall goal stays active.

Scope: implement the independently qualified integer coordinate rule in the shared native transfer. The previous goal turn made progress by acquiring sixteen original references, deriving the RGB16 weights/4,097-position rule and validating it against a separate random holdout in all five methods. Read the current recording rules, status, contribution requirements, reference manifest and core/imaging tests. The current app remains the 535/82-tested step-048 build at the start.

Evidence: [local evidence archive]. Preserve initial source/tests/verifier/reference metadata; pin independent regression vectors and Stripes references, add reverse/partial-alpha Photoshop evidence, then verify focused/full/optimized tests, packaging and live export. Smooth interpolation and other ramp errors remain separate open requirements.

1. Preserved the prior transfer, tests, package verifier and tone reference manifest. Generated two reverse-enabled RGB16 Stripes holdouts with opaque and varying-alpha samples, opened each in Photoshop 2026, verified Stripes/Reverse, toggled Reverse off/on to recalculate, saved distinct references and closed them. The original user Untitled-1 remains unchanged. Generalized the diagnostic control reader with an explicit expected-reverse argument; its default remains false. Extraction verifies controls and records source/fixture hashes in fixture-manifest.json. The 131,072 tone vectors derive from Photoshop's saved identity outputs, independently of the proposed equation. Three PSD fixtures retain Photoshop's actual merged images. All are original procedural data under MIT OR Apache-2.0.
2. Captured 224 existing native RGB8/float outputs as exact Float32 bits before changing production source. Added three core and two imaging regressions for the independent tone vectors, reverse/alpha/invalid-input handling, unchanged other depths, full composition, native archive and PSD export. The pre-fix build succeeded; all five tests ran with 10 assertion failures in 3.096 seconds. The legacy-depth test already passes. Forward Stripes differs on 531/65,536 pixels; reverse opaque and partial-alpha each differ on 527 pixels. Maximum stored RGB errors are 47,103/47,103/46,603 levels; alpha is exact. Retained focused-before.log and focused-before-build.log, and preserved previous root artifacts before running.
3. Implemented RGB16 working-grid reconstruction and the independently measured fixed-weight 4,097-position coordinate rule in GradientMapTransfer. Kept RGB8/float branches and downstream reverse/dither/alpha behavior unchanged. Updated the older primary-color test's floating luma expectations to the qualified RGB16 grid. The new independent-vector regression remains the source of expected behavior; no expected reference pixels were regenerated from the implementation.
4. The initial formatter command failed because swift-format was not on PATH; xcrun locates the Xcode tool and formatting then succeeds. That command's chained artifact preservation was skipped, but the focused rerun was mistakenly launched separately. The pre-fix assertion/build logs survive; its fixed-name PSD/metrics outputs were overwritten and are not claimed as retained artifacts. Recorded this preservation failure rather than reconstructing evidence. The focused repair passes 30 tests, zero failures/skips in 3.641 seconds: all 131,072 tone vectors pass in both input representations, all 196,608 full Stripes RGBA pixels/export pixels match Photoshop, and all 224 other-depth vectors retain their bits. Earlier RGB8 continuous-ramp residuals remain unchanged. Preserved passing root outputs before formatting/full validation; added fixture attribution.

5. Captured all 242 Swift source/test hashes after formatting. Full validation passes 540 tests, zero failures/skips in 95.322 seconds; optimized validation passes 87 tests, zero failures/skips in 1.942 seconds, with separate logs and artifact preservation. Updated the package verifier to require the current 540/87 results while retaining 535/82 as historical stop-limit evidence. Preserved the previous release ZIP before packaging. A diagnostic search used a nonexistent run-local Python glob; the reader is under the project scripts directory. This read-only lookup failure changed no evidence or source.

6. The universal arm64/x86_64 build succeeds with both deployment targets macOS14. Preserved the old clean ZIP and rolling metrics before rebuilding/diagnostics. The existing Sendable/unused test-state/build-system deprecation warnings remain in build logs. Added an output-directory option to the run-local probe generator after preserving its original source, then regenerated both inputs for independent byte comparison. The package diagnostics and live export checks are now in progress. Corrected a draft optimized-runtime transcription from 2.107 to the actual logged 1.942 seconds before publication.

7. Generated ten diagnostic layouts from a clean, signature-verified ZIP extraction; visually inspected Gradient Map workspace and expanded Gradient Fill editor. These are offscreen checks. Live, opened the original reverse-alpha input in that same packaged app, verified Stripes/Reverse/Dither, exported through File → Export Layers to PSD and closed it. The first Go to Folder shortcut preceded the ready Open panel; repeating after observing the panel succeeded. Photoshop opened the export without warning, with editable Stripes controls and Reverse checked. Toggled Reverse off/on, saved a separate recalculated PSD and closed it. Both apps returned to Untitled-1; the user’s Photoshop document remains unchanged.
8. Independent file inspection passes: both live exported/recalculated PSDs match all merged RGBA bytes of the 65,536-pixel reference and preserve all decoded Gradient Map controls. Both generated inputs reproduce byte-identically. The package verifier passes 540 tests, both architectures, macOS14 targets, clean ZIP signature, supplied icon and license integrity. Updated status, README, command matrix, plan and tone/Smooth manifests; StoreKit and performance were unchanged and not rerun. Final source/binary binding and development-history audit follow.

9. The final release verifier passes and binds all 242 source/test hashes, focused/full/optimized logs, independent fixtures, live files/observations, ten diagnostic images and binary/ZIP hashes. Application Swift count remains 127; tests increase to 115 source files. The failed pre-fix run is retained separately. Documentation-history inventory refresh/check completes this checkpoint; it does not substitute for runtime tests or recover the overwritten pre-fix fixed-name exports noted above.

Evidence: [local evidence archive], [local evidence archive], [local evidence archive], [local evidence archive], docs/GRADIENT_MAP_TONE_REFERENCES.json. The captured RGB8/float fixture is previous native behavior, not Photoshop provenance. Binary SHA-256: 9ff9580c98b487f454703953a840f8383eeba2a60ff884999a5c769c56cfcbc5. ZIP SHA-256: 21a1e9473dd7c48249fa16058549cce4a8d1a2e168f5dd4d59d7177aaba3c079. Host remains macOS27.0.1 / Apple Silicon; Intel and macOS14/26 execution have not been tested.

Commands: executed from the native root; RUN abbreviates this unique checkpoint. Each test/build attempt has separate logs. The run-local build-other-depths script records its complete compiler arguments/object hashes. The first formatter invocation used swift-format directly and failed with exit127; its reconstruction is labeled formatter-attempt-01.log. Its repair below used xcrun. Before each fixed-output rerun, the preservation helper retains changed files and references existing identical copies, except for the explicitly recorded failed preservation step above. Do not reuse these output paths.

RUN=[local evidence archive]
python3 "$RUN/prepare-probes.py" > "$RUN/prepare-probes-01.log" 2>&1
python3 "$RUN/extract-fixtures.py" > "$RUN/extract-fixtures-01.log" 2>&1
python3 "$RUN/build-other-depths.py" > "$RUN/other-depths-build-01.log" 2>&1
python3 "$RUN/preserve-artifacts.py" before-focused-artifacts > "$RUN/preserve-focused.log" 2>&1
scripts/test.sh --filter 'GradientMapTone' > "$RUN/focused-before.log" 2> "$RUN/focused-before-build.log"
scripts/test.sh --filter 'GradientMap|GradientStripes' > "$RUN/focused-after.log" 2> "$RUN/focused-after-build.log"
python3 "$RUN/preserve-artifacts.py" before-full-artifacts > "$RUN/preserve-full.log" 2>&1
xcrun swift-format format -i Sources/PhotoCraftCore/GradientMap.swift Tests/PhotoCraftCoreTests/GradientMapTests.swift Tests/PhotoCraftCoreTests/GradientMapToneTests.swift Tests/PhotoCraftImagingTests/GradientMapToneRenderTests.swift
scripts/test.sh > "$RUN/full-tests.log" 2> "$RUN/full-build.log"
python3 "$RUN/preserve-artifacts.py" before-release-artifacts > "$RUN/preserve-release.log" 2>&1
scripts/test.sh -c release --filter 'Gradient|PSDMergedSampleTests|PSDMerged|CloneSampling' > "$RUN/release-tests.log" 2> "$RUN/release-build.log"
python3 "$RUN/prepare-probes.py" "$RUN/reproduced-inputs" > "$RUN/reproduce-inputs.log" 2>&1
scripts/build-app.sh > "$RUN/package-build.log" 2>&1
python3 "$RUN/preserve-artifacts.py" before-package-artifacts > "$RUN/preserve-package.log" 2>&1
python3 "$RUN/package-snapshots.py" > "$RUN/snapshots.log" 2>&1
python3 "$RUN/verify-live.py" > "$RUN/live-files-verification.log" 2>&1
python3 scripts/verify-app-package.py > "$RUN/package-check.log" 2>&1
python3 "$RUN/verify-release.py" > "$RUN/release-verification.log" 2>&1
python3 scripts/audit-development-history.py
python3 scripts/audit-development-history.py --check

Documentation audit: logs are retained under [local evidence archive] The source hashes bind the tested implementation; subsequent edits are documentation and diagnostic records only.

Next: resolve Classic ramp lookup rounding and Linear/Perceptual/Smooth color conversion/interpolation using the independent references. This coordinate correction does not make continuous methods exact, implement Smooth, qualify exact dither, or finish the macOS runtime/shortcut/preferences/workflow gates. The overall Photoshop-equivalence goal remains active.

Scope: resume Smooth qualification from the tested step-048 build. The previous goal turn made concrete progress with stop-loss prevention, 535/82 passing tests, packaged/live checks and the 48-step documentation audit. Read the recording rules, current status, contribution requirements and previous probe/inspector sources. The first ramp source lookup used an incorrect path; the file inventory located GradientRamp in Sources/PhotoCraftCore/Gradient.swift. Adobe's gradient help was revisited; it describes the existing interpolation modes but does not provide a Smooth algorithm.

Evidence: [local evidence archive]. Acquire palettes of at most 100 stops, validate saved controls, and compare exact-stop samples before pursuing spline math. Native Smooth remains unsupported; no application change is assumed.

1. Added the bounded palette generator with three 65-stop gray/color/reversed-color ramps and a 98-stop, 32-color plateau probe. The first generator invocation had an extra closing parenthesis and failed before writing files; preserved generate-01.log and the broken source, repaired syntax, and generated inputs on attempt 02. Acquired all four via Photoshop: verified Smooth, toggled Reverse on/off, saved distinct references, and closed them. No import warnings appeared; returned to the original Untitled-1.
2. Added the independent bounded inspector and reproduced all four inputs byte-identically. All saved controls remain unchanged. Of 65 neutral samples, two differ by four stored RGB16 levels; of 65 chromatic samples, eight differ by up to four levels. Reversing palette order yields identical outputs for all 65 colors; plateau centers match all 32 corresponding color samples exactly. This supports separating conversion from neighbor interpolation at these sample positions, without proving a general conversion algorithm. Next compare identical palettes in Classic, Linear and Perceptual to locate shared conversion behavior. A preliminary scalar linear-quantization calculation did not reproduce the observed residuals; it is not a production candidate.

3. Added optional Classic/Linear/Perceptual control palettes and generalized the diagnostic control reader with an explicit expected-method argument (the Smooth default is unchanged). Preserved prior scripts. Acquired/reproduced all three controls: Classic retains all 65 sampled colors exactly; Linear/Perceptual differ at every sampled color, by up to 94 stored levels. The refreshed seven-case analysis passes all saved-control and input-reproduction checks. Added and compiled an isolated Swift diagnostic linked to the current release modules, without changing app sources. Its native Classic ramp matches all 65 exact-stop samples, but full composition differs at 61 samples by up to 11 full-range levels before PSD working-grid encoding. This identifies a separate possible RGB16 tone-coordinate rounding defect. Inspect that with independent colored source matrices before choosing a production correction. One Renderer source lookup used the nonexistent Compositor.swift name; inventory confirms Renderer.swift.

4. Generated two original 65,536-pixel colored/neutral RGB16 matrices, using a zero-smoothness black/white identity ramp and the 65-color Classic palette. Recalculated/saved both in Photoshop and closed them. The first independent reader rejected Photoshop's valid three-channel opaque save; preserved its failed log/source, then added an explicit opt-in opaque-RGB decode path that synthesizes alpha without changing default four-channel behavior. Both saved controls and regenerated inputs verify. Naive floating and common integer luma/rounding candidates failed; their complete measurements are retained.
5. A denominator search identified coefficients 4915/9667/1802 over 16384, rounded to 4096 positions: all 65,536 measured tone indices match exactly. Mapping those indices through the independently saved 4,097-entry Classic palette row reproduces every colored-matrix RGB pixel exactly. The identity ramp has a separate measured LUT rounding pattern, not yet a general production rule. Isolated Swift candidate measurements preserve the prior app: fixed coordinates lower the 65-color matrix mean maximum error from 215.689 to 89.338 stored levels, but 64,340 pixels still differ because ramp rendering remains approximate. Simply rounding the old floating tone raises the worst palette error to 996; reject that shortcut. The fixed-coordinate identity result has at most two stored levels of residual error. Acquire an independent random matrix across methods before implementing the shared coordinate rule.

6. Added a seeded pseudo-random holdout generator: one identity matrix, five method-specific 65-color matrices and a Stripes grayscale lookup reference. Recalculated/saved all seven through Photoshop, verifying Classic/Linear/Perceptual/Smooth/Stripes as appropriate, toggling Reverse on/off and closing every probe. No warnings or acquisition failures occurred. The user's original Untitled-1 remains unchanged. All seven inputs regenerate exactly and every saved control is preserved. The holdout's 65,536 tone indices match; all five 65,536-pixel reference lookups match byte for byte. Combined with the first matrix, there are 131,072 exact tone indices and 393,216 exact Photoshop-ramp lookup pixels. These are independent reference calculations, not native renderer results.
7. Saved the coefficient-denominator search as a reproducible diagnostic, including its rejected candidates. The research verifier reproduces the current generators' prior nine inputs, verifies the seven holdouts and confirms all 240 native Swift source/test hashes plus app/ZIP hashes remain identical to the tested step-048 build. The source counts remain 127 application and 113 test files. Two isolated Swift diagnostics were compiled/run against those release modules; their command arguments, object hashes and outputs are retained. No app source changed, no package was rebuilt and no native regression, StoreKit or performance suites were rerun. Previous 535/82 pass counts remain associated with step 048. Updated status, command matrix, plan, Smooth research and a new tone reference manifest; preserved the previous research manifest.

Evidence: [local evidence archive], [local evidence archive], [local evidence archive], [local evidence archive], docs/GRADIENT_MAP_TONE_REFERENCES.json. All sixteen input/reference pairs are original procedural data, contributed under MIT OR Apache-2.0. No Adobe code, preset library or user document was copied into the application. Local research artifacts remain excluded from publication by the existing release policy.

Commands: from the native root; RUN abbreviates this checkpoint. The first bounded generator invocation (generate-01.log) failed on syntax; the second below succeeded. The first coordinate analyzer failed on the four-channel assumption (coordinate-analysis-01.log); its repair wrote analysis-02. Earlier versions are preserved with descriptive before-* filenames. Do not reuse output paths. The two build-native scripts retain the complete swiftc argument lists in their logs and hash linked object files. Research verification logs its three current-generator reproduction commands.

RUN=[local evidence archive]
python3 scripts/generate-bounded-smooth-palettes.py "$RUN/inputs-01" > "$RUN/generate-02.log" 2>&1
python3 scripts/generate-bounded-smooth-palettes.py "$RUN/reproduced-01" > "$RUN/reproduce-01.log" 2>&1
python3 scripts/inspect-bounded-smooth-palettes.py "$RUN" "$RUN/analysis-01.json" > "$RUN/analysis-01.log" 2>&1
python3 scripts/generate-bounded-smooth-palettes.py "$RUN/inputs-02" --conversion-controls > "$RUN/generate-controls-01.log" 2>&1
python3 scripts/generate-bounded-smooth-palettes.py "$RUN/reproduced-02" --conversion-controls > "$RUN/reproduce-controls-01.log" 2>&1
python3 scripts/inspect-bounded-smooth-palettes.py "$RUN" "$RUN/analysis-02.json" > "$RUN/analysis-02.log" 2>&1
python3 "$RUN/build-native-controls.py" > "$RUN/native-controls-build-01.log" 2>&1
python3 scripts/generate-gradient-map-coordinate-probes.py "$RUN/coordinates-01" > "$RUN/generate-coordinates-01.log" 2>&1
python3 scripts/generate-gradient-map-coordinate-probes.py "$RUN/coordinates-reproduced" > "$RUN/reproduce-coordinates-01.log" 2>&1
python3 "$RUN/analyze-coordinates.py" > "$RUN/coordinate-analysis-02.log" 2>&1
python3 "$RUN/build-native-coordinate-candidates.py" > "$RUN/native-coordinate-build-01.log" 2>&1
python3 "$RUN/compare-coordinate-candidates.py" > "$RUN/coordinate-candidate-comparison-01.log" 2>&1
python3 scripts/generate-gradient-map-coordinate-probes.py "$RUN/coordinates-holdout" --holdout > "$RUN/generate-holdout-01.log" 2>&1
python3 scripts/generate-gradient-map-coordinate-probes.py "$RUN/holdout-reproduced" --holdout > "$RUN/reproduce-holdout-01.log" 2>&1
python3 "$RUN/verify-holdout.py" > "$RUN/holdout-verification-01.log" 2>&1
python3 "$RUN/search-tone-denominators.py" > "$RUN/tone-denominator-search.log" 2>&1
python3 "$RUN/verify-research.py" > "$RUN/research-verification.log" 2>&1
python3 scripts/audit-development-history.py
python3 scripts/audit-development-history.py --check

External reference check: Adobe's interpolation guide names the established Classic/Linear/Perceptual spaces; gradient editing help, accessed 2026-10-08, describes controls. Neither supplies the Smooth equation. The fixed-tone findings above come from the saved original reference documents, not those help pages.

Documentation audit: outputs retained under [local evidence archive] The historical source/package hashes match step 048; documentation and diagnostic additions do not imply another passing native test run.

Next: implement the verified RGB16 coordinate rule with pinned independent regression vectors, qualify reverse/alpha/native export behavior and preserve RGB8/float semantics. Then resolve Classic lookup rounding and Linear/Perceptual/Smooth color conversion/interpolation. The fixed-coordinate candidate alone still differs on 64,340 palette-matrix pixels, so it is an intermediate correction, not general parity. Smooth remains unsupported. Full functionality, exact pixels, shortcuts/preferences, AI capability and supported-Mac runtime requirements remain open; the goal stays active.

Initial scope: continue from step 047's measured stop/output differences, starting from the unchanged native step-045 release. The measured Photoshop stop limit expanded this checkpoint into a production export-preservation fix. Read recording rules, status, contribution requirements and prior neighbor evidence. The previous goal turn made progress by acquiring seven additional independent references, reproducing every input and isolating endpoint/color-conversion residuals. The next experiment samples dense original gray/color palettes exactly at their stop positions, so an interpolation fit does not absorb color-conversion error.

Evidence: [local evidence archive]. No production algorithm is assumed and Smooth remains unsupported at the start of this experiment.

1. Added scripts/generate-smooth-stop-probes.py with original 513-stop neutral/color palettes and a constant-gray control. Opened/recalculated/saved all three through Photoshop. The dense documents exceeded the helper's initial readiness observation twice; a fresh AX/screenshot showed Smooth and acquisition continued without reopening or altering the user's original document. All probes were closed.
2. Independent inspection in palette-inspection-01.json found that Photoshop retained only the first 100 color stops from each 513-stop input. Those palettes cannot be treated as unchanged 513-stop references. The two-stop constant-gray controls were preserved but their output differs by two stored RGB16 levels. This exposes a separate data-loss risk: native Gradient Map PSD export currently allows 1,000 color stops. Verify the 100/101 boundary with supported methods and opacity stops before choosing a compatibility guard. A documentation search found no authoritative limit statement, so the saved application records will be the evidence. One test-file lookup named a nonexistent file; the subsequent inventory located GradientMapRenderTests.swift.

3. Generated five additional Classic/Stripes boundary probes: 100/101 color stops at RGB16, 101 Stripes colors at RGB8 and 100/101 opacity stops at RGB16. Photoshop explicitly warned that excess color/transparency stops would be removed in the 101-stop cases. Accepted those warnings only for the disposable probes, saved new output files and returned to the user's Untitled-1. This corrects the earlier commentary's unsupported description of the truncation as silent. Independent scripts/inspect-gradient-map-limits.py verifies every saved list equals the first 100 original entries exactly; 100-entry lists retain all controls. Pinned the five original/saved records in the test JSON and documented their license.
4. Added three native regression tests for saved-record evidence, fresh/original-record export paths across all implemented methods, 100-stop round trips and preservation of complete native documents after failed PSD export at RGB8/16. Preserved 486 rolling root artifacts before tests. The unchanged writer failed 24 assertions across the three tests (focused-failure-01.log/build log), confirming the data-loss path. Added color/opacity guards before the original-record reuse shortcut in PSDGradientMap.write; read/native archive limits remain 1,000. The user-facing error identifies the relevant stop type and suggests reducing stops or saving a native document. Focused pass-02 verification succeeds: seven tests, zero failures, 0.267 seconds. Swift formatting was applied before the full suite.

5. Preserved changed rolling artifacts before full/optimized runs and bound all 240 Swift source/test files in tested-source-hashes.json. Full verification passes 535 tests, zero failures/skips, in 92.112 seconds; optimized gradient/matte/sampling verification passes 82 tests in 1.608 seconds. Existing RasterDecodeBudget Sendable, unused test-state and deprecated build-system warnings remain in the build logs; none originates in the new guard/tests. Preserved the previous release ZIP, then built the arm64/x86_64 macOS14 app successfully. Updated the package verifier to bind the new 535/82 runs while retaining older counts as historical evidence. All eight original palette/boundary inputs regenerate byte-identically. Fresh packaged diagnostics and live UI validation follow.

6. The clean ZIP-extracted app rejected both 101-color and 101-opacity Gradient Map exports before presenting a Save panel. Dismissed each error and saved complete native files. A 100-color-stop control exported successfully, opened in Photoshop with editable Classic controls and no warning, was recalculated via Reverse on/off, and saved separately. Closed every disposable document; both apps returned to Untitled-1, and the user's original Photoshop document remains unchanged. Package verification passed, including both architectures, macOS14 deployment, clean signature, supplied icon and licenses. Generated ten fresh packaged diagnostics and visually inspected Gradient Map workspace and expanded Gradient Fill editor; those are offscreen layouts, separately identified from the live actions.
7. Independent live-file verification initially assumed the native method enum serialized as lowercase classic; the archive stores Classic. Preserved the failed verifier and live-files-verification.log, corrected that diagnostic assumption and reran to a new log. Two source lookups used nonexistent NativeArchive.swift and prior verify-release.py paths; the subsequent inventories located the native document sources and showed the prior verifier was not a saved script. These lookup failures did not change production code or evidence.

8. The repaired live-file inspector passes: both native saves retain every original color/opacity control in Float32 form; the compatible native PSD preserves its original grdm bytes and Photoshop retains all 100 color stops and all other decoded controls after recalculation. Added a run-local release verifier, which passes and binds the full/optimized/focused logs, five pinned references, eight reproduced inputs, complete Swift source hashes, final binary/ZIP hashes and live observations. Copied ten diagnostics plus the current package report into final-artifacts. Updated README, status, command matrix, plan, stop-limit manifest and Smooth research; preserved prior manifests. StoreKit and performance checks were not rerun, and their prior results remain historical.

Evidence and release identity: [local evidence archive], [local evidence archive], [local evidence archive], docs/GRADIENT_MAP_LIMIT_REFERENCES.json. Binary SHA-256: a656217447f3b242f6927903e22705789c0fe73ef3a7b51c4479330ac34abaaf. ZIP SHA-256: 532ce5b706c751bc3ad86650e4b0fcb2c6bd6d54cf154e25424227016aa72ae5. The clean ZIP-extracted live app path is retained in ui-app.txt; it matches the tested package. Host: macOS27.0.1 / Apple Silicon. Intel and macOS14/26 runtime checks remain unperformed.

Commands: executed from the native project root; RUN below abbreviates this checkpoint's directory. These commands describe recorded attempts, not an instruction to overwrite their outputs. The pre-fix focused command failed as intended; its repaired successor passed. Generator and inspector output paths refuse reuse. Each full/optimized build log is separate from XCTest output. Snapshot commands, including both dual-flag invocations, are recorded verbatim by package-snapshots.py in snapshots.log.

RUN=[local evidence archive]
python3 scripts/generate-smooth-stop-probes.py "$RUN/inputs-01" > "$RUN/generate-01.log" 2>&1
python3 "$RUN/inspect-palettes-01.py" > "$RUN/palette-inspection-01.log" 2>&1
python3 scripts/generate-gradient-map-limit-probes.py "$RUN/limits-01" > "$RUN/generate-limits-01.log" 2>&1
python3 scripts/inspect-gradient-map-limits.py "$RUN" "$RUN/limits-verification-01.json" --fixture Tests/PhotoCraftImagingTests/Fixtures/gradient-map-stop-limits.json > "$RUN/limits-verification-01.log" 2>&1
scripts/test.sh --filter GradientMapStopLimitTests > "$RUN/focused-failure-01.log" 2> "$RUN/focused-failure-01-build.log"
scripts/test.sh --filter 'GradientMapStopLimitTests|GradientMapRenderTests' > "$RUN/focused-pass-02.log" 2> "$RUN/focused-pass-02-build.log"
scripts/test.sh > "$RUN/full-tests.log" 2> "$RUN/full-build.log"
scripts/test.sh -c release --filter 'Gradient|PSDMergedSampleTests|PSDMerged|CloneSampling' > "$RUN/release-tests.log" 2> "$RUN/release-build.log"
scripts/build-app.sh > "$RUN/package-build.log" 2>&1
python3 scripts/generate-smooth-stop-probes.py "$RUN/reproduced-palettes" > "$RUN/reproduce-palettes.log" 2>&1
python3 scripts/generate-gradient-map-limit-probes.py "$RUN/reproduced-limits" > "$RUN/reproduce-limits.log" 2>&1
python3 "$RUN/package-snapshots.py" > "$RUN/snapshots.log" 2>&1
python3 scripts/verify-app-package.py > "$RUN/package-check.log" 2>&1
python3 "$RUN/verify-live-limits.py" > "$RUN/live-files-verification.log" 2>&1
python3 "$RUN/verify-live-limits.py" > "$RUN/live-files-verification-02.log" 2>&1
python3 "$RUN/verify-release.py" > "$RUN/release-check.log" 2>&1
python3 scripts/audit-development-history.py
python3 scripts/audit-development-history.py --check

Documentation audit: refresh/check logs are retained under [local evidence archive] The inventory validates chronological anchors and explicit references without claiming to reconstruct missing original history. Earlier entries continue to distinguish reconstructed accounts from contemporaneous evidence.

Remaining/next: Gradient Map export limits are qualified against these five RGB8/16 boundary cases; Gradient Fill/GRD limits are not inferred. Smooth remains unsupported. Split exact-stop gray/color probes into chunks of at most 100 stops, verify saved controls, then continue independent interpolation qualification. General Photoshop functionality, exact pixels, shortcuts/preferences and the supported-Mac runtime matrix remain open. The overall goal stays active.

Scope: continue from the independently verified eight Smooth references and unchanged 532/79-tested native release. Previous goal turn made progress by documenting acquisition and proving saved color-stop working-grid normalization. Read recording rules, latest status, contribution requirements and the current native ramp. A source lookup used an incorrect Rust path and failed; use the file inventory before the next source lookup.

Evidence: [local evidence archive]. This investigation will separate positional easing from color-space conversion and neighboring-stop influence using original neutral ramps with plateaus and intermediate stops. No production algorithm is assumed. Restored CUA documentation and selected Photoshop; the user's original Untitled-1 is open and untouched.

1. Added scripts/generate-smooth-neighbor-probes.py, with five RGB16 cases: three/five stops spaced in analytical lightness, black/white plateaus and a narrowed two-stop interval. All colors are pre-normalized on the 0…32768 grid. Generated inputs-01, then opened each in Photoshop, verified Smooth, toggled Reverse on/off, saved a distinct reference and closed it. Verified return to the user's Untitled-1. No UI acquisition failed.
2. Added scripts/analyze-smooth-neighbors.py and generalized the diagnostic control reader's accepted stop counts via an explicit argument (the previous eight-case inspector defaults remain unchanged). The initial analyzer incorrectly assumed neutral R/G/B outputs were identical. Preserved analysis-01.log and its source; independent inspection found small channel differences (up to four full-range stored levels). The repaired analyzer verifies opaque sample rows and retains all three channels. Analysis-02 validates all five saved controls unchanged and all merged previews distinct from the stale inputs. Sampled results show near-linear middle regions with three/five collinear lightness stops and different boundary easing for plateau/narrowed cases; these are evidence of neighbor/endpoint influence, not a proven general rule.
3. Retained polynomial-gray-fit-01.json from a standard-library least-squares experiment. Cubic through degree-seven fits still leave residuals; no fitted polynomial is used in production. An additional Adobe documentation search did not expose the algorithm. Adobe's Firefly manifest reference independently documents Smooth and the RGB16 0…32768 component convention; it does not certify native rendering.

4. Acquired two further limited-gray plateau/narrowed references to separate near-black encoding precision from positional shape. Added the generator's --gray-boundaries mode without changing the original five cases, preserving the previous generator. All seven saved records retain the intended pre-normalized color stops and settings. Analysis-03 includes both sets, full opaque first-row RGB samples, normalized/red-derived analytical lightness and file hashes. Reproduced the five-plus-two inputs under distinct reproduced-01/02 directories; all seven hashes match.
5. A longer Bézier fit, using multiple starting points and a constrained midpoint tangent, still leaves measured residuals (bezier-fit-02.json). The gray plateau's candidate cubic is close but not exact; the initial narrowed-interval candidate misses considerably (boundary-fit-01.json). These remain experiments, not Swift implementation constants. Read the actual Rust crates/io/src/gradient_bake.rs; it implements only the older Classic/Linear/Perceptual approximation and offers no Smooth algorithm.
6. Added the run-local [local evidence archive]. Its first attempt incorrectly asserted that all flat regions exactly match saved stop codes; retained boundary-comparisons-01.log and the original script. The diagnostic now reports actual ranges and differences. Six of seven checked plateau regions match their input colors exactly; the high-gray region is uniformly 49341 while the saved stop is 49343. Scaled last-half comparisons differ on 4/1,025 and 3/1,025 opaque pixels, maximum two stored levels. [local evidence archive] preserves those residuals, seven exact regenerated input hashes and diagnostic script hashes. This distinguishes acquisition validation from unsupported equality claims.
7. Copied and ran the baseline verifier in this run: all 127 application Swift sources, 112 test Swift sources and app/ZIP hashes match the tested step-045 release. No native tests, StoreKit checks, packaging or performance runs were needed for this research-only change; 532/79 remain historical test counts for the unchanged implementation. Updated Smooth research/status/plan, preserved the previous research manifest, and refreshed/checked the history inventory. Validation outputs are retained under [local evidence archive]; there are 47 checkpoints and no missing explicit references.

Commands and outputs: generator, analyzer and fit commands run from the native project root. The first analysis failure was retained separately; the repaired analyzer ran to analysis-02 before the additional cases, then analysis-03 after them. Run-local scripts contain the exact exploratory fit/comparison code; polynomial-gray-fit-01.json retains a one-off least-squares result whose command is in this chat rather than a separate saved script.

python3 scripts/generate-smooth-neighbor-probes.py [local evidence archive] > [local evidence archive] 2>&1
python3 scripts/generate-smooth-neighbor-probes.py [local evidence archive] --gray-boundaries > [local evidence archive] 2>&1
python3 scripts/analyze-smooth-neighbors.py [local evidence archive] [local evidence archive] > [local evidence archive] 2>&1
python3 [local evidence archive] > [local evidence archive] 2>&1
python3 [local evidence archive] > [local evidence archive] 2>&1
python3 [local evidence archive] > [local evidence archive] 2>&1
python3 [local evidence archive] > [local evidence archive] 2>&1
python3 scripts/audit-development-history.py
python3 scripts/audit-development-history.py --check

Reproduction uses the two generator commands above with output directories reproduced-01 and reproduced-02 and logs reproduce-01.log/reproduce-02.log. Do not repeat any command into an existing output path. Input/reference data are original MIT OR Apache-2.0 probes; only saved Photoshop outputs serve as render references. All probes are closed and the user's original Photoshop Untitled-1 remains unchanged.

Reference: Adobe's manifest schema, accessed 2026-10-08, documents Smooth and RGB16's 0…32768 working components; it does not disclose interpolation math.

Next: measure neutral/color conversion at exact stop positions with a dense original palette before refining endpoint/interior spline rules. Smooth remains unsupported; no new native capability or full-parity claim is made. The overall goal stays active.

Scope: continue the full Photoshop goal by addressing the unsupported Smooth interpolation method, observed in Photoshop 2026 Gradient Map/Fill controls. Previous turn made verified progress: the RGB16 merged-matte correction, 532/79 tests and final native/Photoshop export comparison. Current baseline is that tested universal release. Read repository recording rules, status and the current gradient/map math and original probe generator before edits.

Evidence directory: [local evidence archive]. Start by independently comparing the existing Smooth two/three-stop references, then acquire new original probes to distinguish interpolation space, transfer shape, midpoint and endpoint behavior. Previously observed Smooth0/100 equality is only one setting pair; no unmeasured algorithm is assumed. Preserve every experiment and rejected candidate before introducing production math.

1. Read Adobe’s interpolation guide (Classic/Linear/Perceptual only) and Aspose’s official method enum (Smoo); neither supplies the Smooth algorithm. Independent decoding of existing samples confirms Smooth differs from Perceptual and the three-stop 0/100 references match each other. Retained row samples in existing-reference-samples.json.
2. Added scripts/generate-smooth-gradient-probes.py: original two-layer RGB16 4,097-position grayscale input plus five RGB8 probes for zero smoothness, midpoint20, limited gray range, red→blue and neutral-midpoint three-color behavior. An initial path-reporting error occurred after writing the first input; preserved it and generate-inputs.log, fixed absolute path normalization and generated a distinct inputs-02 set. A NumPy availability check failed (not installed); analysis uses the Python standard library. One source search named a nonexistent file; the existing Rust gradient_bake module confirms only the older continuous methods.
3. Acquired six Photoshop-saved outputs by opening each generated input, verifying Smooth controls, toggling Reverse on/off, Save As under a new name and closing the probe. Refreshed the Photoshop binding after an inactive-target error. One Open helper reached a temporarily unavailable Open button; a fresh panel state exposed the enabled button and the workflow continued. A new helper verifies readiness. The user’s Untitled-1 is preserved. Neutral RGB8 Smooth0 equals the existing Smooth100 reference in every stored byte. New RGB16 samples show a symmetric nonlinear transfer that differs from the existing Hermite spline; polynomial/easing fits are exploratory and are not production code. Planned two further RGB16 color-range probes to separate color-space conversion from positional easing.
4. Generated and acquired those additional gray-range/red→blue RGB16 outputs using the same UI sequence, then closed the disposable documents. There are now eight original research references. Extended the generator to reproduce all eight inputs in a separate directory; it refuses to overwrite an existing probe. The Photoshop output files, not the intentionally stale input previews, are the measured references. These original procedural probes are contributed under MIT OR Apache-2.0; no Adobe code or installed preset library is copied. Acquisition was on the same macOS 27.0.1 / Photoshop 2026 host; this step adds no multi-OS qualification.
5. Added scripts/analyze-smooth-gradient.py, using standard-library curve conversion and an exploratory lower-half parametric Bézier fit. Retained [local evidence archive] and its log. The fit has RMS normalized-lightness residual approximately 0.00006364 and maximum 0.00018872 on the chosen samples: this is not an exact algorithm. A simple rational control-point candidate and the existing Hermite transfer also miss measured values. Three-stop color behavior indicates further neighbor influence. Rejected shipping fitted constants or relabeling Perceptual as Smooth. Further investigation must distinguish positional interpolation, color-space conversion and neighbor tangents.
6. Added scripts/inspect-smooth-gradient-probes.py to independently decode the eight saved controls/composites, bind input/output hashes and verify regenerated inputs. The first run failed because three files contain changed RGB stop components. Preserved the failing inspector and reference-verification-01.log; saved-control-differences-01.json retains every observed change. All changes are exactly explained by conversion onto a 0…32768 working grid followed by full-range expansion (at most one stored component level). The repaired inspector records both input and saved controls, and asserts that exact normalization rather than accepting an arbitrary tolerance. [local evidence archive] passes: eight identical regenerated inputs, eight saved records with the expected normalized controls, eight composites distinct from stale previews, and exact neutral Smooth0/Smooth100 merged equality. This is a bounded research decoder; it does not verify every PSD field or base-layer channel.
7. Verified the unchanged release with [local evidence archive]. All 127 application Swift files, 112 test Swift files, the universal executable and ZIP hashes match step 045. Retained baseline-verification-01.json/log. No native tests, performance measurements, StoreKit checks or packaging were rerun for this research/documentation checkpoint; the previous 532 full / 79 focused optimized test results remain the implementation baseline. Updated docs/SMOOTH_GRADIENT_RESEARCH.json, status and the plan without changing command capability claims.
8. Completed this entry and refreshed/checked the development-history inventory. Both checks pass with 46 indexed milestones and zero missing explicit references; check outputs are preserved under [local evidence archive]. The inventory preserves its superseded version by content hash. Existing early-history limits remain: this is not a recovered full tool transcript, and missing historical logs/timestamps are not invented.

Checkpoint commands (from the native project directory; preserve existing outputs and choose fresh names before repeating):

python3 scripts/generate-smooth-gradient-probes.py [local evidence archive] > [local evidence archive] 2>&1
python3 scripts/analyze-smooth-gradient.py [local evidence archive] [local evidence archive] > [local evidence archive] 2>&1
python3 scripts/inspect-smooth-gradient-probes.py [local evidence archive] [local evidence archive] > [local evidence archive] 2>&1
python3 [local evidence archive] > [local evidence archive] 2>&1
python3 scripts/audit-development-history.py
python3 scripts/audit-development-history.py --check

The reference-verification-01 failure used the preserved earlier inspector and correspondingly numbered report/log paths. Some initial ad hoc sample/fit exploration has only the retained results and this narrative, not a complete command transcript. The generator's current eight-case reproduction is independently hash-checked against the earlier six-plus-two input sets.

Research sources: Adobe interpolation guide, Adobe Gradient Fill controls, Aspose interpolation enum and Aspose April 2026 release notes, accessed 2026-10-08. These document controls/method identifiers or vendor support; none supplied the Smooth rendering algorithm. Aspose's FOSS PSD tools explicitly exclude pixel rendering, and Photopea's public repository is an issue tracker, so neither was used as an algorithm source.

Remaining: Smooth is still unsupported and rejects on editable import. No application behavior changed in this checkpoint. The saved controls and composite samples are ready for further interpolation experiments; a fitted approximation is not Photoshop parity. The overall goal remains active.

Scope and baseline: investigate the measured one-level partial-alpha PSD white-matte difference before changing shared sample math. The Stripes release remains the application baseline (530 full / 77 focused optimized tests). Read the recording rules, current status, merged-sample code/tests, existing solid-fill quantization evidence and Stripes probe decoder. Photoshop RGB16 solid fills already use a 0…32768 working grid; this does not yet prove the matte rule for arbitrary raster samples.

Experiment record: [local evidence archive]. New inputs, Photoshop-saved outputs, measurements and failed attempts will be preserved here under distinct names. Inputs will cover alpha/color boundaries and varied samples, with unchanged straight layer channels checked separately from merged channels. No production code has changed at investigation start.

1. Added deterministic original matrix generation and an independent bounded Python layer/merged decoder. The input contains all 65,536 alpha codes, full-period RGB permutations and a boundary palette. Opened it through Photoshop 2026, toggled visibility off/on, and saved a distinct reference. The first CUA helper call required refreshing the app binding; it performed no document action. The user's Untitled-1 stayed open.
2. The first decoder attempt assumed negative layer count; Photoshop uses a positive count plus Mt16. Preserved the reproduced failure as analysis-01-failure.log, accepted the explicit marker and reran as analysis-02. Saved layer values exactly follow 0…32768 quantization. Ordinary grid rounding still differed on 8,385 pixels, exclusively half ties; analysis-03 proves subtracting the rounded distance from white matches every one of 65,536 pixels (262,144 stored RGBA samples). Full-range rounding, floor and continuous matting candidates remain recorded as rejected formulas. The reference is pinned in Tests/PhotoCraftImagingTests/Fixtures/photoshop-rgb16-matte-matrix.psd.

3. Added two regression tests and confirmed they fail against the old implementation: five focused tests, four assertions failed, including 100,869 differing matrix bytes. Implemented the RGB16-only integer matte rule and explicit full-range expansion in Sources/PhotoCraftImaging/PSDMergedSample.swift; straight layer channels, RGB8 and HDR matting paths are unchanged. Tightened the existing RGB16 Stripes comparison to require zero differences. The first repaired focused run matched the entire matrix and Stripes reference but exposed an older approximate 0.7 assertion (one failure in 11 tests); replaced the approximate expected pixel with the exact stored sample values. Both failed runs are preserved separately. Closed the saved Photoshop probe, returning to the user's unchanged original Untitled-1.
4. Before further tests, copied existing fixed artifact outputs to before-focused-artifacts and before-full-artifacts with SHA-256 manifests. Full suite command: scripts/test.sh, redirected to this run's full-tests.log and full-build.log. The final full suite passes 532 tests, zero failures/skips, in 91.525 seconds. The optimized command <code>scripts/test.sh -c release --filter 'Gradient|PSDMergedSampleTests|PSDMerged|CloneSampling'</code> passes 79 tests, zero failures/skips, in 1.609 seconds, with distinct release-tests.log/release-build.log outputs. Preserved changed full-suite artifacts before optimized tests.

5. Preserved the previous clean ZIP and its hash before scripts/build-app.sh (package-build.log). Added a dedicated RGB16 release verifier and updated the package checker to require the new 532/79 results while retaining the earlier milestones as historical evidence. Added original-fixture attribution and docs/RGB16_MATTE_REFERENCES.json. Packaging succeeds. Clean ZIP verification confirms arm64 + x86_64, macOS 14 deployment targets, ad-hoc signature, original icon and bundled licenses. The prior Desktop metadata caveat remains; no permanent repair is claimed.

6. Rendered ten fresh diagnostic layouts from the clean extracted final package, preserving exact commands and output in snapshots.log; visually inspected the Stripes workspace. Launched that exact app, opened the Photoshop matrix and used File → Export Layers to PSD to a new filename. Independent decoding confirms all 65,536 merged pixels and all straight layer samples match. Opened the native export in Photoshop without warning, toggled visibility off/on and saved a distinct recalculated output: all merged and layer channels still match. Closed disposable documents, leaving Photato on its own blank document and Photoshop on the user's original Untitled-1. [local evidence archive] binds binary/export/recalculation hashes and actions.
7. Updated current status, README, the porting plan and command matrix. Kept earlier Stripes measurements as a historical checkpoint with an explicit superseding reference. Preserved final artifacts and ran the package and RGB16 release verifiers. Binary SHA-256: 3e54935dd3f8bc2c5168bd53f06c10667630540eeefbc7a51ac1776f513e68ad; ZIP SHA-256: 92f33b7640666190b91e9b963c5afd5c6d643858d166d7939c0aa5e45137bc2e. Historical StoreKit integration and performance measurements were not rerun. The first history refresh flagged the inline optimized-test command as a file path; marked the command as code without a false file link and tightened the audit’s check mode to fail on missing references. One documentation read used the workspace parent instead of the native project and was repeated from the correct directory. Final history validation covers 45 milestones, with preserved attempts and no missing explicit references.

Remaining: this closes the measured RGB16 merged-white-matte discrepancy only. General RGB16 compositor/mask exactness, continuous RGB8 Gradient Map residuals, Smooth/dither, complete shortcuts/preferences/professional workflows and the supported-Mac runtime matrix remain open. The overall goal remains active.

Request: document every development step from the start of the port. This is a documentation/evidence change; the tested Photato implementation remains unchanged.

1. Audited all 43 existing development entries against the source inventory, plan, available build/test logs, module references and release evidence. Confirmed that the original source audit and first native milestone were already recorded; identified missing granular early history, rolling logs and misplaced later entries.
2. Preserved the pre-repair DEVLOG, plan, README, contribution guide and current rolling evidence in [local evidence archive]. This is a snapshot taken during this audit, not original implementation-time evidence.
3. Added an oldest-first index and stable IDs, moved the two gradient foundation/fill entries into their documented dependency order, and labeled/repositioned the later vector Save/Open note. Expanded the first milestone retrospectively using surviving records, including the initial code-signing and Gaussian-blur failures and the 24/25/29-test passing checkpoints. Did not invent an initial commit, missing test log or per-edit timestamps.
4. Added persistent recording instructions in AGENTS.md and the contribution guide. Each meaningful investigation, decision, change, failed attempt, test, live check and remaining gap must be recorded as work proceeds. Future attempts require distinct evidence paths and preservation before fixed-name outputs are overwritten.
5. Added scripts/audit-development-history.py and the generated history inventory, linking milestones to current evidence hashes and extracting embedded XCTest outcomes. The parser handles both singular and plural test/failure summaries so early failed runs remain visible. Updated README navigation and the plan's stale current-focus paragraph.
6. Documentation validation passed: python3 scripts/audit-development-history.py and python3 scripts/audit-development-history.py --check index 44 steps, 449 evidence files and 304 logs, with no missing explicitly named references. Verified 88 local links and the retained early-failure classifications. All 127 application source files, 112 test source files and the app/ZIP hashes still match [local evidence archive]. The audit result is retained in [local evidence archive]. No native tests are rerun for this documentation-only work; the 530-test/77-optimized-test result remains the prior implementation's evidence.

Known history limits: surviving narratives, source/fixture manifests and module logs cover the milestones, but they are not a complete tool transcript or commit history. Several generic full-test/release files have been overwritten, and some named logs were reused. Hashes identify the current surviving files, not their prior contents. Preserve those limits explicitly. The full Photoshop goal remains open; this audit adds no editing capability or pixel-equivalence claim.

Added native Stripes interpolation to the retained ramp and every shared gradient consumer: live/Classic tools, fills, maps, swatches and presets. Color and opacity stops hold until the next position; coincident stops choose the last entry. Midpoints and smoothness retain their saved values without affecting Stripes. GRD/GdFl/grdm use Photoshop's GIMs method code.

Acquired seven additional Photoshop-saved original probes and preserved the exact native inputs inspected there. Four RGB8 Stripes references match all 51,200 stored RGBA pixels. Independent Python decoding also confirms unchanged channels after Photoshop recalculated the native fill and coincident-stop map. RGB16 opaque colors and all alpha samples match; 928 of 2,048 pixels retain a one-level partial-alpha white-matte difference, totaling 3,712 changed stored bytes. This remains a measured gap. Smooth at 0 and 100 smoothness produced identical channels for the three-stop probe; its new curve remains unimplemented.

The saved probes exposed three compatibility defects: omitted zero angles were incorrectly interpreted as 90 degrees, an inactive noisePreSeed blocked fill import, and an empty all-white generated mask blocked map import. The fixes accept those specific representable cases, retain inactive seed metadata on edits, and keep active seeded dither and nontrivial unrepresented rasterized-vector settings explicit errors. Mutation tests guard the narrowed mask and descriptor handling.

Photoshop 2026 disabled Gradient Map in RGB32 and discarded the native adjustment when Keep Layers was chosen after its unsupported-data alert. Photato now gates pixel/layer creation and property editing to RGB8/16, and rejects editable RGB32 map PSD export with a useful alternative. Legacy native content remains archiveable and renderable. No Photoshop RGB32 output is counted as a reference, and earlier all-depth editable-PSD claims are superseded.

Added 10 tests: two core, six imaging and two app workflows. 530 full XCTest tests pass, zero failures/skips, in 91.219 seconds; 77 focused optimized tests pass in 1.510 seconds. The first full run caught an outdated expected matrix count (90 instead of 120 after adding a fourth method); the final full run includes that correction. Native PSD fill round trips now cover 60 depth/style/method combinations. Source files remain 127, with 29 connected tools; no Rust is linked into Photato.

Final packaged live checks opened the RGB8 Stripes PSD with editable controls, changed to Classic using the native picker, and restored Stripes/clean history with Command-Z. The legacy RGB32 map stayed visible with a disabled editor; both pixel and new-layer Gradient Map menus were disabled on a 32-bit pixel layer. Temporary Photato documents closed without saving, leaving its own blank document. Ten final offscreen layouts were rendered and the Stripes workspace and fill editor visually inspected. A new two-flag snapshot command initially let AppKit treat its output path as an input document and stalled in an error alert; a sampled stack identified this, and paired option values fixed the diagnostic invocation without source changes. The README command is corrected. The Desktop File Provider again added FinderInfo after packaging, so the clean ZIP extraction supplied the signature and live/snapshot evidence.

Photato branding, the supplied icon, native archive v8, IAP tips and optional local/Private Cloud Compute policies are retained. GRADIENT_STRIPES_REFERENCES.json records scope; GRADIENT_STRIPES_FIXTURES.json binds original probes; [local evidence archive] binds final source/test/package/layout evidence. Historical StoreKit and performance results were not rerun. Full Photoshop parity remains active, including Smooth, exact 8/16-bit output and dither, all preferences/shortcuts and professional workflows, large-image performance, and the supported-Mac runtime matrix.

Implemented Gradient Map as a retained native adjustment and a previewed pixel command. Image → Adjustments → Gradient Map supports preview, cancel, cancellable background apply and one undo step. Layer → New Adjustment Layer → Gradient Map creates editable content with a selection-derived mask. Properties and the pixel sheet expose Classic/Linear/Perceptual, Reverse, Dither, color stops, midpoints, smoothness and shared library presets. Save Preset retains the definition without committing a draft. A new session identity prevents a delayed preset write from changing a cancelled/reopened Gradient Map or Gradient Fill draft on the same layer.

The prepared spatial evaluator reuses retained native ramps, preserves input alpha, and gives ordered dither stable document coordinates through pixel commands and full/regional rendering. RGB8 tone lookup uses a 1/4096 grid after a 0.30/0.59/0.11 luminance calculation. RGB16 and linear-light RGB32 paths, masks and layer opacity have native consistency checks; they are not yet qualified against Photoshop. The ordered Bayer dither follows PhotoCraft and is not claimed to reproduce Photoshop's noise.

The bounded PSD grdm reader/writer handles v1 Classic and v3 Classic/Linear/Perceptual, RGB/HSB/grayscale stops, opacity records, reverse and smoothness. Unchanged supported source records retain their original bytes. Unknown methods, unsupported color models and noise maps reject explicitly. Native archive version 8 reads versions 1–8 and separates the new retained adjustment from older writers. Swift-only sources now total 127, with 29 connected workspace tools; no Rust is linked into the application.

Live computer use became available again. Generated an original 256×64 RGBA8 probe and saved five Gradient Map PSDs through Photoshop 2026. Its method menu exposes Perceptual, Linear, Classic, Smooth and Stripes, defaulting to Smooth. Native Smooth/Stripes remain unsupported. Saved method codes are independently inspected because an initial immediate save captured the preceding UI setting; those stale captures are preserved separately and excluded. The five canonical fixtures and hashes are recorded in GRADIENT_MAP_FIXTURES.json; a deterministic generator reproduces the original PNG byte for byte.

Compared the three supported saved composites against native rendering: Classic 38, Linear 285 and Perceptual 270 differing pixels out of 16,384 each, with a maximum difference of one 8-bit level and zero alpha differences. Classic's 2,048 grayscale pixels match exactly. These are bounded regression results, not byte-equivalence passes. One native RGB8 export was opened in Photoshop and retained editable Gradient Map controls: Classic, Dither, Reverse, 50% layer opacity, 75% smoothness and its mask. The exact inspected export is preserved separately because later tests generate new UUIDs. Photoshop recalculated export pixels were not compared. Temporary reference documents were closed and the user's original Untitled-1 remained open.

520 XCTest tests pass, zero failures/skips, in 87.631 seconds on the final Swift sources. 67 focused optimized tests pass in 1.221 seconds. The 12 new tests comprise four core, four imaging and four EditorStore workflows. An earlier 519-test full pass is retained before the last asynchronous-draft fix; the final suite includes it. Existing compiler warnings about the synchronous raster decode budget's Sendable conformance, an unused historical test variable, and SwiftPM's deprecated native build-system option remain recorded in build logs.

The first package attempt hit Desktop File Provider’s recurring FinderInfo race after copying the signed app. Packaging now writes the clean staged ZIP first and retries local metadata clearing/signature verification at most three times, failing if the app still cannot verify. The failed attempt is retained in [local evidence archive]. Desktop metadata returned after the live launch and was cleared again; the independently verified clean ZIP remains the authoritative distribution artifact.

Live Photato checks opened the original PNG, entered the Image-menu Gradient Map sheet, opened/cancelled nested Save Preset, opened the stop editor, edited a midpoint, closed its popover with Escape and cancelled the adjustment. A 35% input displayed as 34.999999; the fields now use at most two fractional places while retaining their underlying precision. The final validation was repeated after this display-only fix. The final packaged live recheck displays 35 correctly, creates an editable Gradient Map through the Layer menu with map/mask properties, and removes that layer with Command-Z. Photato is left open on its blank document.

The universal macOS14+ package keeps Photato branding, the maintainer-supplied icon, licenses, IAP tips and optional local/Private Cloud Compute integration. Final source/test hashes, reference controls/pixels, rendered layouts and package identity are bound in [local evidence archive]. Historical performance and StoreKit integration results were not remeasured. Full Photoshop parity remains active: Smooth/Stripes, exact output/dither, multistop and high-depth references, complete preferences/keyboard/pointer behavior, gradient effects and supported-Mac runtime qualification remain open.

Photato now has a shared native gradient library with searchable nested folders, multi-selection, rename, duplicate, delete, drag reordering and explicit Move To destinations. Window → Gradients, the Gradient tool and the fill editor use the same library. Properties and the fill editor expose Save Preset. Capturing a preset keeps its exact native color/opacity controls, midpoints, smoothness and interpolation, without changing document history or committing an in-progress fill draft. Clicking a preset recolors an existing Gradient Fill with any tool; double-click, the context command or a canvas drop creates a retained fill in one undo step. New fills capture foreground/background colors and use a mask when a selection exists. That last behavior is not yet qualified against Photoshop preset activation.

The bounded binary native archive stores stable IDs, flat validated folder records, selection/current preset, full-precision Swift definitions, GRD descriptors and original imported files. GRD alone quantizes position/midpoint controls, so native definitions are retained separately. Atomic background edits publish only after successful file replacement. Malformed imports, failed writes, cancellation, overlapping operations and cyclic moves preserve the previous committed state. Corrupt saved data is preserved rather than overwritten. Existing documents own their fill definitions and survive preset deletion.

Selected/all GRD export preserves unavailable noise/CMYK definitions and unknown descriptor fields. Renaming an unavailable record changes its name without enabling substitute rendering. Exporting an unchanged original imported root retains the whole original file byte for byte, including through a native save/reload. Duplicated groups preserve records but do not copy whole-file root metadata. Empty groups survive native persistence; an empty GRD export remains unavailable. Imports and native archives are bounded at 16 MiB and 64 MiB respectively, with count/depth validation.

508 XCTest tests pass, zero failures/skips, in 84.883 seconds on the final Swift sources. 55 focused optimized tests pass in 1.096 seconds. The 12 new tests comprise seven persistence/format cases and five EditorStore workflows, including 2,049 bit-identical restart ramp samples, a synthetic GRD with unknown root/wrapper/noise fields, exact capture before asynchronous edits, active-layer change protection, multi-selection and document independence. An earlier full run also passed before the final in-app feature-map wording update; the final suite includes that update. Offscreen native rendering caught and fixed a clipped Properties Save Preset button; the final Properties actions sit side by side. Move To destinations include collapsed and search-filtered folders, and default appending is labeled explicitly.

The universal macOS 14+ package retains Photato branding, the maintainer-supplied icon, licenses, IAP tip behavior and optional local/Private Cloud Compute paths. There are now 124 native Swift source files and 29 connected workspace tools. Source/test hashes, test-log identity, final package identity and rendered layouts are bound in [local evidence archive]. The earlier tool/fill verification manifests are historical; StoreKit integration and rendering performance were not remeasured.

Adobe's current preset-management and migration guides informed file/organization workflows. Live Photoshop remains inaccessible on the locked Mac; no live import, exact pixel, physical drag or full preference/shortcut parity is claimed. Library view modes, persistent collapse state, complete focus/keyboard behavior, recent presets, reset/replace choices, large-library performance, noise/CMYK/Lab rendering, on-canvas opacity, Gradient Map and gradient layer effects remain open. docs/GRADIENT_LIBRARY_REFERENCES.json records the implementation and remaining qualification. Full Photoshop parity remains the active goal.

The previous goal turn verified Photato branding and corrected Finder metadata on the local app bundle. This turn makes implementation progress toward the unchanged Photoshop 2026 goal: the Gradient tool is connected as the 29th native workspace tool. G selects it and Shift-G cycles Paint Bucket. The tool supports live Gradient Fill creation/editing and Classic painting into pixel layers or masks, with five shapes, retained Classic/Linear/Perceptual interpolation, reverse/dither, opacity and blend mode. The Classic Transparency switch is isolated from live gradient opacity stops. New live fills create a selection mask only when a selection exists. Captured colors/settings and immutable previews prevent in-flight edits from changing document state.

AppKit canvas interactions support Shift-projected 45-degree drags, endpoints, whole-line translation, click-to-add color stops, crossing/reordering stops, tear-off/Delete removal, midpoint adjustment and double-click stop-color editing. The native color sheet previews without touching the document and applies once or cancels. Escape or switching tools cancels a gesture; space-drag pans. Each completed edit uses the background transactional command path and is one undo step. Existing Gradient Fill controls continue to expose opacity stops and numeric editing. The preset popover currently contains three starter definitions; full persistent preset management remains the next step.

The Classic painter reuses native target expansion, mask coordinates, soft/rectangular selections and document-depth compositing. Its geometry is distinct from the retained fill-layer geometry. The unchanged Rust tool_gradient_t runs in an independent standalone generator: all 12,920 Float32 outputs match bit for bit, including zero-length, tiny, negative, diagonal and large-coordinate cases across five shapes. No Rust is linked into the app. This source oracle does not certify full Photoshop pixel output; native retained ramps also differ from the upstream pre-baked RGBA painting inputs.

496 XCTest tests pass, zero failures/skips, in 83.198 seconds on final Swift sources. 43 focused optimized tests pass in 1.039 seconds. The 12 new cases cover core geometry/depth/selection/mask/expansion/persistence/atomicity and native mouse/key preview/cancel/undo/stop editing. Initial pixel tests accidentally assumed a linear ramp at 100% smoothness; the literal linear tests now specify 0% smoothness. Native screenshot review caught a SwiftUI Menu failing to display its Canvas swatch; a native popover button fixes the preview. The final full suite was rerun after that change. Existing shared rendering/PSD/clipboard/mask tests remain part of the full suite; three old StoreKit integration results and older performance measurements were not rerun.

Universal macOS 14+ development packaging retains the Photato icon, licenses and optional AI paths. The build script now clears stale extended attributes and verifies the copied local app as well as its staging bundle. Final packaged captures, exact source/test hashes and ZIP/binary identity are recorded in [local evidence archive] and photato-package-check.json.

A fresh computer-use attempt reported the Mac locked and automatic unlock unavailable. Manual unlock was requested previously; no live Photoshop comparison is claimed. Adobe’s August 18, 2026 gradient-editing guide was checked. Persistent libraries/folders and GRD UI, Save Preset, on-canvas opacity, complete stop keyboard semantics/preferences, gradient consumers, Photoshop sample exactness, large-canvas latency and Intel/macOS14/26 runtime qualification remain open. The full goal remains active.

Added retained native Gradient Fill content/commands, captured foreground/background colors, selection masks, archive/clipboard storage, masks, cache invalidation, direct picking and document-space clone sampling. Added a native editor with color/opacity stops and midpoints, smoothness, styles, methods, angle/scale/offset/reverse/dither/alignment, live preview, canvas repositioning and one-step commit/undo. Menu, footer, thumbnail double-click and Properties routes are connected. Parameter geometry follows the source's frame/angle model; full affine warp and reflected angle behavior remain open.

Added strict GdFl descriptors and retained original bytes, including the current gradient interpolation enum. Forty-five depth/style/method round trips preserve tested controls and exact native composites. Five pinned psd-tools files were inspected: two editable gradient files import; three richer files reject unsupported profile/artboard semantics. The full CC 2018 transparent-gradient reference now matches every stored merged RGBA pixel (1,024), and native export emits identical merged pixels. Its minimal companion stores a blank white three-channel preview, not an image oracle.

The comparison exposed a pre-existing general PSD issue: merged channels need white matting in their storage space, with integer composite quantization before matting. Fixed export and flattened import; preserved straight layer channels and linear RGB/32 HDR. Added literal sample/plane/flattened-file checks. The initial full suite failed solely because the new test assumed the minimal preview was black; raw channel inspection established white and corrected that assertion. The next full suite passes 484 tests, zero failures/skips, 82.977 seconds. Fifteen tests are new (4 core, 8 imaging, 3 AppKit workflows). The final full rerun includes the swatch antialiasing and gap-copy adjustments plus removal of a duplicate PSD dispatch label; the optimized run and final offscreen snapshots qualify the same source.

The Mac remains locked; live Photoshop 2026 interaction and broad pixel equivalence are unverified. The active goal remains incomplete. Live and Classic Gradient tools, on-canvas stop handles, gradient preset library UI, Gradient Map/effects, noise, other color models and broader geometry/performance/platform qualification remain required.

Final optimized qualification: 67 selected tests pass in 1.411 seconds, covering gradients/oracles, Pattern Fill, PSD, merged matting and clone sampling. Final universal binary SHA-256 is 2686715a437ff4b0d01c877866f3d17c55d69caeb42dae6b4a7fed7a1dd1af86. ARM64/x86_64 and both macOS 14 minimum targets, clean extracted ZIP signature, icon, licenses and fixture exclusions pass. Final compact/expanded gradient editor snapshots were visually inspected. scripts/verify-gradient-fill.py records all 118 Swift source hashes, tests, fixtures, screenshots and package identity. Historical render timings and StoreKit integration results were not rerun or relabeled as current.

Ported five-style geometry, reversible handle mapping, retained color/opacity stops and midpoints, smoothness, Classic/Linear/Perceptual interpolation, HSB/grayscale conversion and deterministic dither. Corrected Swift Float angle constants to retain the executed source bits. Native retained-stop interpolation avoids the upstream 97-stop bake. The legacy ramp loses one ULP at a final green endpoint; native preserves that specified stop, matching the source PSD evaluator. This known two-value divergence is recorded rather than called byte-exact.

Added bounded GRD v5 reading/writing, fresh source-byte-identical exports and nested phry preset folders, preserving unsupported records during unrelated edits. Read-only inspection covers 183 default and 146 legacy installed presets, each library with 12 folders. All defaults and 88 legacy presets render; 47 CMYK and 11 noise entries remain unavailable with complete descriptors retained. Rebuilt supported exports match 69,647 sampled RGBA pixels. No installed Adobe preset data is bundled.

Added 13 tests; 18 focused release tests pass, including descriptor-consumer regressions. All 469 tests pass in the full native-service run (71.575 seconds). The first sandboxed full run passed 468 and failed the existing named-pasteboard test; the unchanged isolated test passed with macOS service access, then the full suite passed. Failed-run evidence is retained separately. Swift formatting passes. The renderer atlas has been visually inspected; it does not represent a connected Gradient workspace. Gradient layer/PSD/tool/preset-panel integration remains next. The previous render benchmarks and StoreKit integration evidence remain historical and are not relabeled as results for this build.

The gradient interpolation wire identifiers were also checked against the primary ag-psd descriptor source. Native exports use the gradientInterpolationMethodType enum, Gcls for Classic, and the gradientsInterpolationMethod content key; the gs99 style alias is read with the same enum type. Unsupported method codes remain explicit. Literal external identifiers are asserted independently of native reader/writer round trips. The full and focused release suites were rerun after this correction.

The previous goal pass was progress (editable Pattern Fill layers and embedded PSD transport). This pass is also progress, without changing the full Photoshop 2026 acceptance goal. Profiled a dedicated release benchmark before changing pixel arithmetic. A five-second native sample captured 2,814 render-stack samples; 1,372 were in the output pixel-write subtree, dominated by dictionary mutation/allocation work. Replaced optional-chained tile writes with Swift's direct default-subscript mutation. Native dictionary/array COW remains intact. This change alone reduced the same 24 MP Pattern Fill composite from 7,025.31 to 4,035.41 ms. The before binary and hash, profile, intermediate and final measurements are retained.

Prepared pattern samplers now cache premultiplied pixels up to 4 MiB per sampler, preserving the original interpolation order and all sample bits. Larger patterns retain sparse lookup rather than duplicating their full storage. Renderers can omit masks only after proving unit coverage across the rendered pixel centers. Fractional constants are not folded because their interpolation can differ by a Float ULP. General mask sampling and group mixing retain their previous paths; this prevents the optimization from changing continuous edge picking or bypassing existing group arithmetic. A regression exercises a low-opacity layer at the mask edge, where a mistaken identity shortcut would select the wrong layer.

Removed full-canvas pattern rasterization from Auto-Select. The native editor samples the requested stored pattern pixel directly, including affine placement, while keeping masks, opacity, ancestor and clipping checks. 100 content-pixel queries take 0.44 ms in the packaged release benchmark; this is a helper measurement, not end-to-end input latency. A native workflow test picks opaque/transparent positions and a fractional mask edge on a 6000×4000 document without editing its pixels or history.

456 package tests pass, zero failures/skips, in 71.48 seconds. The seven new tests comprise four core, two imaging and one native workflow case. 26 focused tests pass in release in 1.18 seconds, including all 17 Pattern Fill tests and two original Rust pattern oracles. Coverage includes retained COW snapshots/padding/hidden float values, 156,000 exact cached-versus-sparse channel values, preparation budget/cancellation, conservative affine mask bounds, 81 blend/depth cases and 3,420 direct-picking pixels. The Rust sampler test now asserts all 27,968 sample bits, rather than merely reporting their exactness beside a tolerance check; all match in debug and release on Apple Silicon. Earlier independent PSD, codec, group/mask and brush regressions remain green. No claim of global Photoshop output identity follows from these native/source checks.

Editable Pattern Fill performance: the same dense 24 MP RGB/16 scenario now takes median 2,486.49 ms for a changed scale/angle composite, down from 7,025.31 ms (64.6% less time, two samples per build). The parameter command takes 10.19 ms, full SDR packing 113.06 ms, and a one-pixel mask update 12.35 ms. All full/regional native Float32 checks agree exactly. The final benchmark peaks at 3,998,040,064 bytes, including reference buffers, versus 4,955,897,856 previously; process residency varies between runs. A separate foreground Paint Bucket benchmark improves from 1,636.82 to 955.42 ms, with regional composition 2,255.45 to 937.73 ms. These are native release measurements, not p95 or live Photoshop comparisons. See [local evidence archive]. Large-image rendering remains slower than interactive frame rates.

Both architectures rebuild with macOS 14 deployment. Fresh packaged Pattern Fill and Patterns captures were visually inspected. The reproducible package verifier confirms clean extraction, ad-hoc signature, universal architectures, minimum OS, Photato naming, original supplied icon and bundled licenses; it also ties the benchmark report to the final binary hash. Binary SHA-256: 3f175139d0b4b0134a7551dc727e71936ce757710dda155c5634e3737b30ed33; ZIP SHA-256: dacce99f482a1e92eb2866e0770e63d5962b12c48611f7271f6aa79ba2a13f7a. No source edits followed the full test suite; evidence/docs/verification tooling were updated afterward. The three prior StoreKit integration results remain historical. No App Store signing/notarization or Intel/macOS14/26 runtime qualification was performed.

No new live Photoshop UI comparison was performed during this CPU optimization pass. Full-canvas/group/feather/vector preparation, SDR packing, GPU acceleration, broad PSD/gradient/brush workflows, complete shortcuts/preferences and pixel-exact Photoshop 2026 behavior remain unfinished. The goal stays active, not blocked or complete. See RENDER_PERFORMANCE_REFERENCES.json, [local evidence archive], and [local evidence archive].

This pass is progress toward the unchanged full Photoshop 2026 goal. Added native document-owned pattern tiles and editable Pattern Fill content, scale/angle/absolute phase, Link with Layer, Snap to Origin, preview/cancel and canvas dragging. Entry points include Layer → New Fill Layer → Pattern, Layer Content Options, the Layers footer, thumbnail double-click and Properties. Clicking a preset changes the active fill or its draft. New fills use the selection mask when present and a reveal-all mask otherwise. Preview runs in the cancellable render worker; the final command is one transactional undo step. Tests caught and fixed the initial no-selection creation failure. No Rust runtime or FFI was added.

Pattern tiles survive global preset deletion, save/reopen, layer duplication and cross-document clipboard transfers. Conflicting preset identifiers are remapped without altering older layers; paste imports only referenced tiles. Linked layer movement follows the content, while unlinked patterns remain fixed; whole-image/canvas operations transform both. Native affine geometry retains nonuniform scale and reflections. PSD export requires these fills to be rasterized because PtFl cannot express them faithfully. Rasterization now resets canvas-fill offsets while preserving mask world coordinates, also fixing moved solid-fill rasterization. Direct fill Free Transform and complete content-options routing for other layer types remain open.

Added bounded PtFl ActionDescriptor parsing/writing and Patt/Pat2/Pat3 embedded pattern transport through the existing PAT codec. Native documents retain raw source blocks and reuse them when their pattern registry is unchanged. Mask-relative PSD phase is converted to/from native absolute placement using the original Rust fill-frame contract. This is source-derived behavior with synthetic masked/moved round-trip coverage; live Photoshop 2026 placement verification is still pending. Unknown settings, mismatched references, conflicting identifiers and excessive decoded storage reject explicitly. Rasterized layers do not retain stale PtFl tags.

449 package XCTest tests pass, zero failures/skips, in 72.10 seconds. The 17 new tests comprise five core, nine imaging and three native workflow cases; all 17 pass under release optimization in 0.27 seconds. Coverage includes registry ownership/collisions, archive/clipboard, inherited locks, geometry, masks, grouped/clipped composition, regional cache invalidation, malformed descriptors/embedded records, decode budgets, rasterization, exact native RGB/8/16/32 PSD round trips, independent ImageIO merged-image decoding, preview switching, cancellation, AppKit drag/Return/Escape and undo. The first failed atomicity test used the low-level mutating Command API incorrectly; it was corrected to exercise the actual transactional EditorSession boundary. No product-level transaction guarantee was weakened.

Three pinned, unmodified psd-tools PSDs provide independent interchange material under the repository's MIT notice. The 32×32 RGB/8 reference identifies Photoshop CC 2018 in XMP and matches every saved merged pixel exactly. Its CC 2019 minimal companion contains a completely clear merged preview; its editable content renders identically to the full fixture, but its merged data is explicitly excluded as a usable pixel oracle. The richer CC 2017 patterns file still rejects unsupported vogk shape-origin metadata. These older references do not establish Photoshop 2026 parity. They contain embedded pattern sample pixels, are attributed separately from read-only installed-library inspection, and are excluded from the app. See PATTERN_FILL_REFERENCES.json, [local evidence archive], and [local evidence archive].

Editable Pattern Fill performance: a dense 24 MP RGB/16 backdrop with a full-canvas pattern at 75% opacity takes median 10.10 ms for the parameter command, 7,025.31 ms for the changed scale/angle composite and 111.84 ms for SDR packing. A one-pixel mask edit recomposes regionally in 12.63 ms. Both samples match full native Float32 recomposition exactly. Peak residency is 4,955,897,856 bytes, including reference buffers. These are two release samples, not p95 or live Photoshop comparison; full-canvas preview latency and memory use remain unfinished. See [local evidence archive].

Both architectures compile with macOS 14 minimum. The 108-file Swift development package retains the supplied Photato icon. Packaged offscreen captures [local evidence archive] and [local evidence archive] were visually inspected: fill controls fit, mask/pattern thumbnails are visible, and both preset rows remain usable. scripts/verify-app-package.py reproduces clean ZIP extraction, signature, metadata, architecture/deployment, icon and bundled-license checks. Binary SHA-256: 2f6666769d5b120b14d5e4cbecb4de5eaf55f2e02c7d49147ee7503b945eae35; ZIP SHA-256: 6d58bcdc06369bb6c242b886d76d00ca9ce10675a2b63df0bb2d21ab5f5eaf53. No source changes followed the full test suite; documentation and verification tooling were updated afterward. StoreKit's three earlier integration results remain historical and unchanged. This is ad-hoc development signing, not an App Store release.

Fresh Photoshop computer-use access earlier in this pass reported a locked Mac and failed auto-unlock. No live control comparison or Photoshop opening of new exports is claimed. Pattern overlays/strokes, Pattern Stamp, brush textures, folders/drag-drop, broader PSD shape metadata, color modes, full shortcuts/preferences, exact Photoshop rendering and Intel/macOS 14/26 runtime qualification remain open. The full goal remains active, not blocked or complete.

This pass makes progress toward the unchanged Photoshop acceptance goal. Added a persistent native pattern library, seven original upstream CC0 procedural tiles, Edit → Define Pattern, Window → Patterns, search/thumbnails, rename/delete, PAT import/export and pattern Paint Bucket. Defining a preset uses the visible composite inside selection bounds at document depth, capped at 4000 × 4000. It changes global presets without changing document pixels or undo history. Library saves use an atomic binary archive that retains native high-depth samples; corrupt/unwritable libraries preserve their existing data. Preset selection is captured before asynchronous fills, so later library edits cannot change an in-flight fill or saved document pixels.

Ported the original deterministic pattern identifiers, wrapping premultiplied bilinear sampling, and scale/angle/phase math. Bucket UI uses the canvas-origin default placement; transformations are available in the core for later fill-layer workflows. Fills use existing matching, selections, pixel masks, cropped storage expansion, opacity/blending, cancellation and undo. Constant foreground conversion stays outside the pixel loop. There is no Rust runtime or FFI.

The bounded native PAT reader supports RGB, grayscale, indexed and packed one-bit planes; 8/16/32-bit samples; raw and PackBits compression; channel rectangles and transparency. Native PAT export is RGB, using source-exact PackBits packet boundaries for 8-bit planes and raw 16/32-bit channels. Unsupported modes/layouts reject explicitly. Modern Photoshop libraries exposed two real compatibility cases: a trailing 8BIM/phry hierarchy descriptor, and 16 exact repeated records inside the legacy library. The reader now validates the folder descriptor, flattens it with a visible import notice, and merges repeated IDs only when their names, dimensions, depth and all sample bits match. Conflicting identifiers, including differences in signed-zero bits, reject. The failing hierarchy regression is retained in [local evidence archive].

Added 21 tests: eight core/oracle, eight imaging and five app workflow tests. All 432 package tests pass, zero failures/skips, in 69.46 seconds; all 21 module tests pass in release in 0.09 seconds. The independent original-Rust harness yields seven exact IDs, 16,752 exact procedural sample values, and 27,968 exact sampler Float32 values in debug and release. Two complete generated PAT files match the original writer byte-for-byte, including long PackBits packet boundaries. The original Rust parser verifies every channel byte, ID, name and dimension of nine native-exported records after documented grayscale/index/bitmap normalization. Initial test expectations were corrected to account for document-depth quantization and PAT's decoded sparse storage; sample values remain tested directly. No Rust source was modified.

Read-only checks cover all seven installed Photoshop 2026 PAT libraries: 312 records, normalized into 296 entries after 16 repeated records are merged within their libraries. Every decoded sample and identifier/name survives native PAT export/reimport. Only hashes, names, dimensions and measurements are retained in the reports; no Adobe preset files or pixels are included in the repository or app. The original procedural built-ins retain CC0 attribution. See PATTERN_ORACLE.json, PATTERN_REFERENCES.json and [local evidence archive].

A release process fills half a dense 24 MP RGB/16 canvas with the Bricks pattern, default tolerance 32 and antialiasing. Median of two samples: Bucket including matching 1,960.98 ms, regional composition 2,340.13 ms, full SDR packing 111.95 ms. Peak residency is 3,505,160,192 bytes, including full-reference buffers; both full/incremental Float32 comparisons agree exactly. Input/cache creation, live interaction and p95 are excluded. Broad-fill responsiveness and GPU composition remain unfinished ([local evidence archive]).

The final 104-file Swift app builds for arm64 and x86_64 with macOS 14 minimum deployment. Visual inspection of the packaged workspace caught an oversized menu thumbnail; the swatch now sits outside the native menu label and the Patterns panel shows both built-in rows. The corrected offscreen capture is [local evidence archive]. Clean ZIP extraction verifies the ad-hoc signature, Photato names, original supplied icon and bundled licenses. The binary SHA-256 is e06064c4c77e376e71ae1c4cf66bea892f4f9b9d43daab46770317ee444bc11c; the ZIP SHA-256 is 9a50b97be18433dc912b417e980e567b361566f9fb8661f79d6fdef383413dca. The final post-suite changes affect only thumbnail placement and panel height; both architectures were rebuilt and the packaged layout was re-inspected. Three unchanged StoreKit integration results remain historical. This is a development package, not an App Store-signed release.

Pattern fill layers, embedded PSD patterns, overlays/strokes, Pattern Stamp, brush textures, preset folders, drag/drop, full preferences, additional color modes and byte-identical Photoshop rendering remain open. Native library selection changes persist when the library is next mutated; complete tool-preference persistence is pending. Fresh Photoshop computer-use access reported a locked Mac and failed auto-unlock, so no live PAT loading or pixel comparison was claimed and no timed-out AppleEvent was resent. This independent work keeps the full goal active; it is not blocked or complete.

Connected Magic Wand and Paint Bucket in the existing W/G toolbar groups, bringing the workspace to 28 connected tools and 97 Swift source files. Both expose tolerance 0–255, contiguous/global matching, antialiasing and current/all-visible-layer sampling. Magic Wand implements New/Add/Subtract/Intersect plus Shift/Option modifiers. Foreground Paint Bucket has opacity and 27 existing native blend modes; Option-click samples the current canvas preview. Sampling settings, foreground and document state are captured before background work. Escape cancels; successful edits commit through the existing transactional history.

Ported the original wand_region span flood and antialiasing math. Matching uses RGBA8 even for high-depth documents, as in the source. Native coverage combines with the current selection; fills preserve native pixel precision and blend in the existing RGB/32 linear-light domain. Current-layer/mask affine coordinates, cropped target storage, scalar masks and implicit mask outside values are supported. Shared target expansion preserves linked/unlinked mask document positions and existing retouch behavior. Added cancellation checks while constructing selection bounds. A deliberately failing regression caught gamma conversion during transformed float-mask interpolation; masks now interpolate scalar coverage directly. The failing-before-fix log is retained.

17 new tests comprise 12 core, one imaging and four native app/workflow cases. 411 package tests pass, zero failures/skips, in 67.87 seconds. The 17 module tests also pass in release in 0.11 seconds. An independent harness executes original Rust wand_region with storage adapters and its sequential row loops: 240 cases / 66,096 coverage bytes match exactly. Fixture hashes and methodology are in COLOR_REGION_ORACLE.json; no original Rust source was modified. Tests cover tolerance/alpha boundaries, narrow images, contiguous versus global regions, selection combination, high-depth quantization, transformed masks/rasters, all native blending modes, fractional selection/opacity, storage expansion, locks, immutable samples, cancellation, native/PSD persistence and undo. The full suite also checks shared retouch and geometry regressions.

The dense 24 MP RGB/16 release benchmark fills the left half of the canvas, with default tolerance and antialiasing. Median of two samples: Magic Wand 584.92 ms, Bucket including matching 1,636.82 ms, regional composition 2,255.45 ms, full SDR packing 112.25 ms. Peak 3,903,291,392 bytes, including full-reference buffers. Both full/incremental Float32 renders match exactly. Input/cache creation, outline construction, live latency, p95 and Photoshop performance are excluded. Large fills still need renderer optimization; this is a CPU implementation.

The universal arm64/x86_64 app builds for macOS 14. Offscreen inspection of both packaged tool layouts found an unavailable drop.square symbol; Paint Bucket now uses the supported drop.fill symbol. The application icon remains the maintainer-supplied Photato artwork. Packaging and clean ZIP metadata/signature checks retain the original source PNG and icon hashes. These are development builds with ad-hoc signatures, not App Store releases.

This is partial source/workflow parity. Averaged Magic Wand samples, Select and Mask, pattern bucket fills, transparency locking, the complete painting blend-mode set, channels/non-RGB modes and persistent preferences remain open. Exact Photoshop output and live comparison are unverified; earlier Photoshop reference access was blocked by the locked Mac, and timed-out AppleEvents were not retried. The full Photoshop goal remains active and incomplete.

Connected the native focus-tool group with independent round-brush/settings state, Strength and Sample All Layers. Sharpen exposes Protect Detail; Smudge exposes Finger Painting and captures foreground color at stroke start. Option at stroke start toggles Finger Painting. Source sampling and previews run off the main thread with immutable gesture settings, cancellation on Escape/tool change, inherited lock checks and one undo step. Sample All Layers can write onto an empty retouch layer without modifying the base. Only Normal mode is implemented in this source-port stage; additional blend modes and full brush/modifier behavior remain unfinished.

Ported PhotoCraft's Gaussian local blur, local-range-protected unsharp mask and stateful premultiplied Smudge pickup/laydown buffer. Sequential dabs operate on a Float32 document-grid working region before final selection/opacity mixing and storage quantization. Source/target transforms use the shared sampling infrastructure. Raster and scalar-mask storage can expand; mask alpha is ignored in favor of red-channel coverage. Working regions support up to 40 million pixels including the neighborhood halo, with 200 million footprint visits, 100,000 input points and 200,000 dabs as additional bounds. Larger work rejects atomically. Whole-canvas memory, broad affine/HDR/edge behavior and interactive performance still require qualification.

The independent Rust harness preserves all numerical methods, replacing only their application storage adapters. 73,572 Blur/Sharpen and 85,560 Smudge Float32 values (159,132 total) match exactly in debug and release on this Apple Silicon host; eight focus regions and six Smudge strokes/36 dabs include degenerate dimensions, alpha, hidden colors, HDR values, strength endpoints and finger painting. Tests allow a 2e-6 cross-compiler tolerance. These qualify source kernels, not the full source brush engine or Photoshop output.

A transparent-edge test exposed a defect in the original command's stroke blending: after an alpha-aware blur, straight-channel interpolation darkened newly revealed transparent samples. Native Blur now mixes each dab with premultiplied alpha, preserving full red chroma when blurring opaque red into transparency and avoiding hidden-green bleed. Kernel equations remain unchanged. The initial failed log is retained in [local evidence archive]; the final full and release logs are authoritative. This intentional improvement differs from the Rust command's uncorrected result.

Added 17 tests: four numerical-kernel, eight core, one imaging and four AppKit/workflow cases. All 394 package tests pass, zero failures/skips, in 67.47 seconds; all 17 new tests pass in release in 0.29 seconds. Tests cover every native pixel depth, source layer isolation, selections with fractional coverage, cropped transparent expansion, mask outside values/properties, finger painting, translated coordinates, malformed/oversized/cancelled work, immutable previews, gesture routing, independent settings, locks, native/PSD persistence and full/regional render equality. Existing toning, healing and clone regressions remain green.

A dense 24 MP RGB/16 release benchmark used a 300 px brush along (3000,2000) → (3600,2200), with two samples per tool, 50% Strength, Current Layer and Protect Detail enabled. Median edit/regional composition/full SDR packing: Blur 330.98/116.34/111.37 ms, Sharpen 207.67/94.64/108.32 ms, Smudge 151.98/96.41/107.04 ms. All six incremental/full native Float32 comparisons are exact. Peak residency is 3,595,665,408 bytes, including full-reference/comparison buffers. Initial input/cache preparation, live AppKit latency, p95 and Photoshop comparisons are excluded ([local evidence archive]).

Both universal release architectures compile for macOS 14. The packaged Blur, Sharpen and Smudge layouts were visually checked offscreen; a development snapshot-selector overlap was corrected before those captures. Clean ZIP extraction verifies architecture, minimum OS, ad-hoc signature, Photato branding/icon and licenses/attribution. The 93-file Swift implementation links no Rust code. Three unchanged StoreKit integration results remain historical. No App Store-signed release or open-source publication was made.

A fresh read-only attempt to access Photoshop through computer use again reported the Mac locked; no user document or timed-out AppleEvent was touched. Adobe's current tool guides are recorded in FOCUS_REFERENCES.json. Their R shortcut wording conflicts with the previously observed workspace's Rotate View assignment, so no speculative reassignment was made. Normal-only blending, advanced/timed brushes, mid-stroke modifier changes, complete persistent settings, channels/non-RGB modes, exact Photoshop pixels and Intel/macOS 14/26 runtime acceptance remain open. The full Photoshop goal is not complete.

Connected all three tools in the O group with independent brush/settings state. Dodge and Burn expose Shadows/Midtones/Highlights, Exposure and Protect Tones; Sponge exposes Saturate/Desaturate, Flow and Vibrance. All use cancellable background preview, captured settings, Escape/tool-switch cancellation and one-step undo/redo. O/Shift+O and bracket sizing route through the native canvas; Option at stroke start swaps Dodge/Burn for that stroke. This brings the workspace to 23 connected tools. Adobe's current tool guides are recorded in TONING_REFERENCES.json; timed Airbrush and the complete shortcut/preferences set remain open.

Ported PhotoCraft's empirical toning curves, luminance/gamut protection, saturation/vibrance and spacing-normalized per-dab strength. A working Float32 tile grid applies each dab to the previous result and quantizes integer targets only once after stroke-opacity/selection mixing. The existing carried-spacing sequence is shared with Clone/Healing/Spot Healing without changing their coverage behavior. This is the native round-tip path, not a port of all upstream brush dynamics. Pixels are edited in the native encoded RGB domain; Photoshop HDR/color-space qualification remains open.

Raster targets preserve transparency and storage frames, including a regression for brushes crossing a cropped layer edge. Fully transparent raster samples remain untouched instead of editing hidden channels or creating empty-layer undo steps; this differs from the original engine's unrestricted color-dab buffer. Pixel masks use scalar red independently of stored alpha and expand only when needed to edit their implicit outside coverage. Selection opacity is applied once after sequential dabs. Work is bounded by 100,000 input points, 200,000 dabs, 200 million footprint visits and 10,240 working tiles; invalid, non-finite or cancelled results cannot partially commit.

Added 13 tests: nine core, one imaging and three AppKit/workflow cases. All 377 package tests pass, zero failures/skips, in 65.25 seconds. All 13 new tests also pass in release in 0.24 seconds. An independent harness executes unmodified Rust numerical functions; only standalone enum serde traits are removed. 151,331/151,331 Float32 values match exactly in debug and release on this Apple Silicon host: 50,208 RGB cases (150,624 channels) and 707 per-dab strengths. Tests retain a 2e-6 cross-compiler tolerance. These are source equations, not Photoshop output references. Tests also cover all native depths, alpha/untouched samples, selections, pressure/flow, transformed targets, mask properties and expansion, cropped raster bounds, locks, immutable preview settings, native/PSD persistence, one-step undo and cancellation. The original Rust snapshot is unchanged.

A dense 24 MP RGB/16, 300 px brush stroke from (3000,2000) to (3600,2200) measured two release samples per tool. Median edit/regional composition/full SDR packing times: Dodge 116.26/113.51/113.16 ms, Burn 114.57/109.91/107.65 ms, Sponge 108.93/110.20/107.35 ms. All six regional/full native Float32 comparisons are exact. Whole-process peak residency is 3,492,954,112 bytes, including full-reference and comparison buffers; input/cache setup, live AppKit latency, p95 and Photoshop performance are excluded. See [local evidence archive].

The universal arm64/x86_64 app compiles for macOS 14. Offscreen packaged Dodge/Burn and Sponge layouts were visually inspected (toning-workspace.png, sponge-workspace.png). Clean ZIP extraction verifies both architectures, minimum OS, ad-hoc signature, Photato names, original supplied icon and bundled licenses/attribution. This is not live Photoshop qualification or an App Store-signed release. StoreKit's three unchanged integration results remain historical. Full Photoshop functionality, byte identity, advanced/time-based brushes, channel/color-mode support, persistent preferences and Intel/macOS 14/26 runtime acceptance remain unfinished.

Ported all three PhotoCraft inpainting paths into native Swift: multi-scale Wexler/PatchMatch completion with similarity-weighted votes (Content-Aware), overlap-feathered block synthesis (Create Texture), and ring-error proximity matching with a content-aware fallback. SplitMix64 seeds, candidate order, Float32 operation order and fixed 16-row propagation bands match the Rust numerical functions. PatchMatch/voting currently run sequentially; cancellation is checked through the pyramid, row bands, iterations, sampling and commit. The pipeline shares the previous membrane solver and round-tip coverage/painting infrastructure. There is no model download, external service or Rust runtime dependency.

Spot Healing operates in document coordinates regardless of the target's stored pixel frame. It synthesizes a domain two pixels beyond the stroke, fits gradients over a one-pixel expansion and known boundary ring, then applies coverage to the target. Current-layer and Sample All Layers contexts are captured before the stroke. The latter supports empty cropped retouch layers without modifying the original image. Mask sampling remains scalar independently of stored alpha. Existing off-canvas storage/mask positions survive target expansion. Entirely transparent image contexts return an exact no-op before synthesis. A search region with no surrounding pixels reports an error rather than inventing a black repair. Search regions are bounded to 4,194,304 pixels; public algorithm buffers require finite magnitudes at most 1e12 and one to four channels. These are documented implementation limits, not Photoshop equivalence claims.

Connected Spot Healing in the J group, three repair types, seven represented blend modes, Sample All Layers, shared brush controls, circular cursor and bracket keys. It has independent tool settings and requires no Clone Source. Dragging renders a temporary dark marker through the same round-tip coverage machinery; synthesis happens on release in a cancellable background command. Escape and tool switching discard the marker, successful repair commits one undo step, and sampled settings/context are immutable during an in-flight edit. Existing Clone Stamp and sampled Healing Brush workflows remain covered. Replace, advanced brush controls, channels/Quick Mask, persistent Photoshop preferences and exact Photoshop output remain open.

Added 14 tests (four algorithm, six core, one imaging, three AppKit/workflow). All 364 package tests pass with zero failures/skips in 64.27 seconds. All 14 new tests pass in release configuration in 0.35 seconds. The independent fixture generator executes unmodified Rust inpainting and membrane equations with an inert cancellation/progress shim and their existing sequential scheduling paths (selected via cfg; executed on the native host). 145,708/145,708 Float32 values and all six proximity-search outcomes (including no-match cases) match exactly on this Apple Silicon host in both debug and release; regression tolerance is 2e-6. Cases cover odd grids, 1/3/4 channels, multi-level refinement, missing/empty holes, periodic structure and deterministic outputs. The original Rust snapshot remains untouched. These fixtures qualify the source algorithms, not Adobe's implementation.

Command tests cover all three repair types at RGB/8/16/32, known-pixel preservation, blemish error reduction, mask alpha/scalar behavior, source/target translations, separate retouch layers, fractional selections, invalid/oversized/cancelled atomicity and native archive/undo. Imaging checks confirm native PSD round trips and exact regional/full native Float32 output. App tests drive actual synthesized click/drag/bracket/Escape events, marker cancellation, sampled settings, layer locks and undo/redo. The full test log remains authoritative; the 14-test release log independently checks optimized code. Existing StoreKit integration's three passing tests are historical and unchanged.

Release performance on a dense 24 MP RGB/16 image, median of two samples per type/brush size:

Each sample removes the original generated blemish; the final regional result matches full native Float32 output exactly. Peak verification-process residency is 2,255,290,368 bytes, including dense input, cache, full reference and comparison buffers. Source capture, initial composition, AppKit interaction, p95 and Photoshop speed/output comparisons are excluded. Further optimization is needed, including full display packing and parallel patch bands. Full measurements are in [local evidence archive].

The universal Apple Silicon/Intel app targets macOS 14. The first native offscreen snapshot exposed a compressed Type label; the toolbar now gives it explicit space beside the segmented picker. The final snapshot is [local evidence archive]. Clean ZIP extraction checks signatures, both slices/deployment targets, supplied icon, metadata and bundled attribution. Live Photoshop still cannot be inspected because CUA reports the Mac locked; no timed-out Photoshop request was resent. SPOT_HEALING_REFERENCES.json records Adobe's current guide and remaining output, selection-boundary, alpha/colour and runtime qualification. Full Photoshop parity remains unachieved.

Ported PhotoCraft's cascadic membrane/SOR solver and seamless-clone equations from crates/algo/src/poisson.rs. The native implementation validates dimensions, lengths and finite inputs, bounds individual repair regions to 4,194,304 pixels, checks cancellation and rejects numeric overflow without committing a partial result. Channels are solved independently in encoded sample space; existing RGB/32 resampling and final compositing retain the native linear-light behavior. Healed integer channels clamp to the unit interval; float RGB retains positive extended values. No Rust code is linked into Photato.

Clone Stamp and Healing Brush now share round-tip coverage, blending and atomic layer-storage expansion. Healing samples an immutable source and destination boundary, preserving sampled texture while correcting the colour mismatch. Current & Below / All Layers capture the destination document's visible context, so cross-document sampling can repair onto an empty cropped retouch layer. Pixel masks retain their outside scalar and geometry. Selections clip final paint; the solver's boundary is not selection-restricted, a remaining Photoshop qualification gap. Coverage lookups now reject out-of-grid coordinates before computing tile keys, preventing a right-edge sample from aliasing the next tile row. Existing Clone Stamp regressions pass.

The J group's Healing Brush is connected to Option-click sampling, the five shared Clone Source slots, aligned/restarted sources, transforms, overlays, pressure/spacing/hardness/opacity/flow, sampled layer policies and Ignore Adjustments. Clone and Healing settings are independent. Background preview uses the same immutable command as commit; Escape or tool switching cancels, and successful strokes add one undo step. The native options show seven implemented healing blend modes. Pattern, Replace and Diffusion are not implemented and remain in the in-app gap map and reference manifest. The workflow does not claim Spot Healing or generative removal.

Added 15 tests: 11 core, one imaging and three AppKit/workflow tests. All 350 package tests pass with zero failures/skips in 40.60 seconds. All 15 Healing tests also pass under release optimization in 0.23 seconds. The independent generator compiles the original Rust numerical functions unchanged, replacing only Rayon scheduling/interleaving with a sequential harness. 68,836/68,836 Float32 results across nine regions are bit-identical on this Apple Silicon host in debug and release; tests allow a 2e-6 cross-compiler tolerance. Known pixels retain their exact bits. This establishes the tested source equations, not Adobe's proprietary output. The original Rust snapshot is untouched.

Tests exercise analytic linear boundaries, disconnected holes, degenerate grids, invalid/overflow/cancelled inputs, source texture and destination colour at all depths, translated layer coordinates with scaled/rotated sources, mask semantics, cropped empty layers, fractional selections, memory-bound atomicity, preview/cancel/undo/redo, real synthesized mouse/key routing and native/PSD persistence. The initial imaging assertion expected an extra damage pixel at an identity transform; the correct tile-aligned damage is 64×64, and full/regional Float32 pixels agree. That earlier failed log is retained as healing-tests-before-region-expectation-fix.log; authoritative passing logs are full-tests.log and healing-release-tests.log.

A dense 24 MP RGB/16 release workload with a 300 px brush measures three repeated strokes: median repair 271.56 ms, regional composition 63.13 ms, full SDR packing 108.11 ms. Regional and full native render buffers match exactly. Peak benchmark residency is 2,278,539,264 bytes, including input, cached/full reference surfaces and comparison buffers. Source and initial-cache setup, live AppKit latency, p95 and Photoshop comparisons are excluded. These timings are a baseline for further optimization, not an interactive performance qualification ([local evidence archive]).

Both release architectures compile for macOS 14. The rebuilt app's Healing Brush workspace is visually checked in [local evidence archive]; this is offscreen native layout/overlay verification. Clean ZIP extraction verifies the universal binary, ad-hoc signature, supplied Photato icon, metadata and all bundled license/attribution files. The unchanged StoreKit integration's three passing results remain historical. Direct Photoshop comparison remains unavailable because CUA reports a locked Mac; no previously timed-out Photoshop request was resent. Adobe's current Healing Brush guide is recorded in HEALING_REFERENCES.json. Diffusion/Pattern/Replace, selection/alpha/colour-space behavior, advanced brushes, channels, persistent preferences, larger repair regions and Intel/macOS 14/26 runtime checks remain open.

Clone Stamp now grows cropped raster and pixel-mask storage in the existing sample grid. Newly allocated raster areas are transparent; mask padding retains the mask's exact implicit outside scalar. Existing samples, including hidden RGB, extended values, signed zero and decoded noncanonical samples, are copied without depth conversion. Raster storage rebasing compensates both linked and unlinked mask transforms; vector-mask paths stay in document space. Mask storage rebasing retains layer pixels and geometry. New paint is clipped to the canvas and active selection while retained off-canvas source data stays intact. No-op, transparent-source, zero-pressure, zero-opacity, out-of-canvas, invalid, oversized or cancelled edits never commit a new layer frame. The same mechanism drives preview and the one-step undoable command.

Cropped mask sources now carry their explicit outside coverage. Sampling treats masks as scalar red-channel values independently of stored alpha, including transformed bilinear sampling. The native source overlay shows this outside coverage and its inversion. Its outside fill excludes the stored image rectangle, so overlay opacity/blending is applied once. An initial bitmap test used a Y-up context; it now reproduces the actual flipped AppKit canvas and verifies both inside and outside samples, including half-opacity composition. The offscreen mask workspace is visually checked in [local evidence archive].

Added 12 tests: six Clone expansion, two storage expansion, two imaging/persistence and two native workflow tests. All 335 package tests pass, zero failures/skips, in 39.18 seconds. Small all-depth cases compare expanded targets exhaustively with full-size targets, preserve continuous outside coverage, test mask geometry and exact sample bits, and exercise selection/canvas clipping, preview/cancel, repeated source sampling across reframes, undo/redo, locks and bounded errors. Generated native-expanded-clone-{8,16,32}.psd files retain represented offsets and masks on native PSD reopen; these are self-generated interchange checks, not Photoshop-authored oracles. Original source/Rust tip vectors remain unchanged. No archive version change is required. The three StoreKit integration tests remain historical and unchanged.

The first dense 20.16 MP cropped-layer benchmark in a 24 MP RGB/16 canvas exposed a 1377.71 ms storage-expansion/paint cost. Expansion now copies full aligned COW tiles directly and moves other sample rows in contiguous segments, including safe handling of partial edge tiles and nonzero sparse defaults. The pre-optimization measurement is retained in [local evidence archive]; the final measurement is recorded in [local evidence archive].

Final dense cropped-layer release sample: expansion plus painting 98.52 ms, full composition 2259.56 ms, SDR packing 102.98 ms, peak process residency 1,345,667,072 bytes. The expansion/paint step is about 14.0× faster than the previous per-pixel copy in this one-shot comparison. Both the retained original sample and opaque cloned center are bit-exact; exhaustive smaller tests cover the rest of the copying semantics. Full-preview latency after a storage-geometry change remains unresolved. AppKit timing, p95, Photoshop comparison and history-memory behavior are excluded.

Photoshop's public Clone Stamp/Clone Source guides were reread. CUA again reported a locked Mac, so direct edge, mask, stroke and pixel equivalence remains unverified; no previously timed-out Photoshop operation was resent. Rich brush dynamics, channel/Quick Mask targets, persistent preferences and exact Photoshop transfers remain open. Geometry changes currently invalidate the regional preview cache, and large expansion still requires full composition. Universal macOS 14 Apple Silicon/Intel binaries, clean-extraction ad-hoc signature, supplied icon and bundled licenses are checked after packaging.

Added native CPU composition bounded to a document-coordinate rectangle. Flat and nested/grouped paths retain their original operation order, blend math, deterministic Dissolve coordinates, mask preparation and canvas-edge feather semantics. Temporary group-memory estimates count complete intersecting storage tiles, including unaligned boundary tiles. A sparse regional surface is merged only into its requested rectangle.

The immutable accepted preview cache pairs each document with its exact composite. COW tile comparisons skip shared buffers, compare changed samples by bits, and expand damage for affine sampling and mask feather. Layout, depth, structure or scalar metadata changes fall back to complete rendering. Metadata comparison also distinguishes signed zero. Background workers cannot replace the accepted cache after cancellation or a newer request; failed renders preserve the last valid pair. Selection-only changes can reuse pixels, while RGB/channel display and selection paths are still regenerated. Preview, cancel, completed edits, undo and redo all use the same path. The demo artwork footer now reads PHOTATO STUDIO, and its snapshot view traversal is explicitly isolated to the main actor.

All 323 package tests pass, zero failures/skips, in 38.0 seconds. The 13 new core/imaging/app tests exercise 81 blend/depth, 12 nested-group/depth and 30 adjustment/depth combinations plus transformed masks, vector/edge feather, sparse/default/signed-zero samples, metadata invalidation, cancellation, stale requests, channel views and failure recovery. They compare full Float32 pixel data, including alpha and hidden channels; they prove equality with the existing native renderer, not byte identity to Photoshop. Existing independent Photoshop reference tests retain their previously measured differences. The three StoreKit integration tests remain historical and unchanged.

The 24 MP RGB/16 release workload takes 2480.57 ms for full composition and 47.38 ms median for five incremental renders of the same 576 × 320 damage region. Full SDR display packing takes 112.14 ms median. Initial cache setup costs 2551.13 ms; source preparation 14.22 ms, stroke application 50.66 ms. The retained baseline, full reference and display buffers bring peak benchmark residency to 1,613,447,168 bytes; this is not the editor's measured steady-state footprint. Full Float32 comparison passes. The report excludes AppKit/overlay latency, p95 and Photoshop speed comparison ([local evidence archive]). The earlier one-shot benchmark is retained separately.

Remaining performance work: regional display packing, reuse/preparation of vector and feathered masks, type/shape surfaces, sparse damage sets, initial/deep group compositions, GPU kernels and live interaction qualification. The desktop's prior locked state and unanswered timed-out Photoshop render requests do not prevent headless implementation; no Photoshop request was resent. Universal macOS 14 packaging is rebuilt and checked from a clean ZIP extraction with the supplied icon and all license files. The packaged app produces a visually checked offscreen workspace image at [local evidence archive].

Connected Clone Stamp (S), Option-click source sampling and three sampling modes to native Swift painting. Added five shared source slots with weak document references, aligned/non-aligned anchors, cross-document sampling, mask sources, Ignore Adjustments, scale/rotation/flip/offset controls and the Window → Clone Source panel. The round brush supports hardness, spacing, flow, opacity, blend modes and pressure. A sparse scalar coverage buffer builds flow beneath an opacity ceiling. Every stroke reads an immutable source snapshot and commits atomically; dragging previews in background tasks, Escape/tool switching cancels, and one undo step restores the document. Closed or removed sources fail visibly. A source-generation token prevents a delayed commit from overwriting a replacement source's alignment. Offset edits retain the destination document when cloning between windows. Transformed RGB/32 source samples interpolate premultiplied linear light; integer-depth samples use encoded interpolation. A dedicated all-depth regression distinguishes the two domains.

Sixteen new tests pass (seven core, three imaging, six app); all 310 package tests pass with zero failures/skips. The generator executes unchanged Rust round-tip code for 6,168 independent samples. Tests verify opaque all-depth copying without within-stroke feedback, premultiplied transformed samples, fractional selection, flow ceilings, inherited locks, native/PSD pixel persistence, group-aware sampling, source slots, real synthesized mouse/key events and preview/commit/cancel/undo. A PSD test initially compared sparse storage rather than actual pixels; it now checks each pixel. The canvas event fixture now converts view coordinates to window coordinates before synthesis.

Adobe's current Clone Stamp and Clone Source guides define the behavioral target. The desktop remains locked, so direct Photoshop stroke outputs and live UI matching are unverified; no prior timed-out Photoshop render request was resent. Remaining work includes exact Photoshop dab placement/coverage/color behavior, full cropped-target and off-canvas expansion, advanced brush tips/dynamics, alpha/Quick Mask channels, video frames, persistent tool preferences and performance qualification. Source reuse and generated pixels are ephemeral tool state until committed; committed pixels use the existing native/PSD document paths. Universal Apple Silicon/Intel builds target macOS 14; the final clean ZIP verifies its ad-hoc signature, binary, supplied Photato icon, metadata and bundled license integrity. The unchanged three historical StoreKit integration tests were not rerun.

• Clone Stamp performance, one dense 24 MP RGB/16 release sample: source preparation 11.13 ms, localized 120 px round-brush stroke application 40.58 ms, full composite 2533.12 ms, peak process residency 990,478,336 bytes. Validation is included; AppKit interaction, overlays, p95, and Photoshop speed comparison are excluded. Complete canvas composition still prevents immediate large-document preview and needs incremental/tiled rendering ([local evidence archive]).

Added two native adjustment workflows: pixel-layer preview/cancel/background commit, editable masked adjustment layers, numeric and slider controls, a Threshold luminance histogram, coalesced undo, menus, native archives and strict PSD thrs/post records. Untouched records retain their original padding; edits write canonical records and discard stale adjustment tags. RGB/8 Posterize matches all 65,024 values produced by the original Rust function. Four independent MIT-licensed psd-tools PSD references exposed source differences: Threshold uses different luminance coefficients near boundaries, and the Rust Posterize path reduces RGB/16 input to RGB/8. Native high-depth Posterize now uses the measured 0…32768 grid. The original Rust source remains unchanged.

All 294 package tests pass, including 11 new core/imaging/app tests; the three unchanged historical StoreKit integration results were not rerun. The four 40,000-pixel saved references leave 1 / 4 / 1 / 3 differing pixels, respectively. A residual-pixel diagnostic identified an RGB/8 Threshold half-level tie at (131,109,99): luminance 114.5, threshold 115. Rounding ties to even, also consistent with the consulted psd-tools reference, removes its black/white discrepancy. The luminance histogram uses the same RGB/8 rounding. All nine remaining differing pixels occur at partially masked edges. Native RGB/32 persistence is tested, but its transfer lacks a direct Photoshop reference. Strict lint passes for modified Swift files, and an offscreen native snapshot verifies all six adjustment panels fit. Live interaction, complete color-mode behavior, and exact output parity remain open. The rebuilt universal app targets macOS 14 on both architectures; the clean ZIP verifies its ad-hoc signature, matching binary, supplied icon and all bundled licenses. This is a development build, not an App Store release.

Additional Hue/Saturation input-quantization and internal-lightness-rounding diagnostics did not improve the saved references and were not adopted. A read-only AppleScript version query returned Photoshop 27.2.0. A separate guarded request to flatten/save only generated test inputs timed out; no audit or outputs appeared, and a subsequent read-only document count also timed out. Its underlying AppleEvent completion is unknown; no duplicate render request was sent. The original user document was never intentionally edited. The unresolved live-render state must be checked before any retry.

Verified that the public app, menus, About window and universal executable are named Photato, and that the packaged icon derives from the supplied ../PhotatoIcon.png without altering the source artwork. The active Photoshop-parity work continues under that name.

The four pinned Photoshop adjustment references exposed a basic mismatch in the original Rust equations: Master lightness shifts toward black/white, while color-range lightness contracts toward the pixel's minimum/maximum channel. Master lightness now runs before hue/saturation; range contraction uses an algebraic RGB form without unstable HSV divisions. Range weights no longer fade artificially with low chroma. Grays, hidden RGB, excluded colors and true identity edits keep their exact samples. Range lightness clamps in stored order, and pure lightness edits avoid unnecessary HSL reconstruction.

Master and range saturation now apply sequentially. A native Swift adaptation of psd-tools' empirical 21×21 overlap grid and nonlinear positive-range contribution replaces additive saturation. The MIT notice is retained in LICENSE-psd-tools, the app's resources and Licenses & Credits. The table is prepared into the hue LUT outside the pixel loop; no Python, SciPy or Rust runtime is introduced. The positive boost remains an approximation: a reciprocal response capped at 100× avoids a singularity at +100 and improves the references without biasing every positive setting by 0.01. Neutral grid axes preserve exact no-effect behavior. This is measured progress, not a claim of the proprietary Photoshop algorithm.

All four exactness gates remain false. The combined reference has a substantial isolated residual; near-gray/high-saturation behavior, overlap interpolation, integer quantization and underlying composition remain open. Reference ceilings were tightened to the new measured behavior, with mean-error checks for all four files. Before and after reports are [local evidence archive] and [local evidence archive]. Temporary transfer prototypes compared processing order, chroma weighting, reciprocal boost, nonlinear contribution and overlap; their logged measurements are diagnostics, not whole-document acceptance results.

Four additional core tests cover distinct Master/range lightness endpoints, near-gray range hue/lightness, lightness-before-saturation, finite extremes and ordered overlap clipping. All 23 Hue/Saturation tests pass; the full package suite passes 283 tests, zero failures/skips. The three unchanged StoreKit integration tests remain historical. An initial test run caught an unintended extended-HSL saturation clamp change; the original hue-only behavior was restored and the passing full suite verifies it. Historical Rust vectors remain intact: cases 0, 1, 2 and 8 retain 2,980 RGB and 2,980 encoded-float samples, while contradicted cases are explicitly superseded by analytical and Photoshop-composite evidence. docs/HUE_SATURATION_ORACLE.json pins the reference source, hash, license and limits.

Native archives retain their version and parameters. Existing adjustment layers intentionally adopt the corrected rendering when reopened. Live controls and Photoshop invocation remain unverified while the desktop is locked; the saved references support continued headless work. The full Photoshop feature, pixel, shortcut, preference and platform gates remain open.

The universal Intel/Apple Silicon release verifies after clean ZIP extraction: macOS 14 deployment targets, ad-hoc signature, unchanged supplied icon, original notices and the added psd-tools license. No test PSDs or StoreKit fixtures are packaged. One current 24 MP RGB/16 release benchmark measures 3288.03 ms destructive application, 5830.10 ms two-layer composition and 1,018,888,192 bytes peak residency ([local evidence archive]). This remains too slow for immediate full-image slider feedback; UI latency, p95 and Photoshop performance are not measured.

Fetched and pinned four unmodified MIT-licensed psd-tools adjustment files at commit 1b8c1d404d1b976748e7dbbca33ed5898663371b. Their metadata records Photoshop 27.1 (Windows) saves; no live Photoshop session was available because computer-use revalidation found the Mac locked. The initial native reader rejected every file at hue2’s size check. All 16 records carry 36 extra bytes: six H/S/L colors matching the floored wrapped inner-band midpoint, saturation 100 and lightness 50.

The reader now represents the observed 100/136-byte forms and rejects noncanonical extensions. It preserves unchanged records exactly, including source padding; range edits regenerate derived color data. New PSD layers write the modern range colors, while new AHU presets keep the established 100-byte form. Bounded preset reads allow up to 136 bytes and detect excess input. Properties swatches now use the edited range midpoint instead of a fixed red/yellow/etc. sample. No new native storage fields or archive version are required.

Import exposed large differences between the original source equations and saved Photoshop composites. Colorize changed RGB lightness after creating the tint; applying lightness to HSL before RGB synthesis corrects washed-out highlights/shadows. Across the 40,000-pixel Colorize reference, maximum encoded error falls from 0.47039384 to 0.01142710 (97.6% reduction), and mean per-pixel maximum error from 0.04734646 to 0.00372146. 32,282 pixels still differ at document depth, so byte identity is not achieved. The unchanged ordinary lightness, combined and saturation transfers have maximum errors 0.94901961, 0.73731190 and 0.43629897 respectively; those are the next rendering corrections, not accepted parity tolerances.

Three new imaging tests pin file hashes, all 16 tags, native archive and unchanged PSD round trips, edited trailer regeneration, every truncated extension, all altered trailer bytes and independent ImageIO saved-composite comparison. A new core test distinguishes Colorize tint/lightness order at analytical endpoints across depths. Its float expectations are measured in linear light: near-black encoded residuals magnify input transfer rounding by 12.92. The old Rust Colorize/nonzero-lightness cases 9 and 10 remain in the fixture as historical evidence, but no longer define correct behavior; 7,450 RGB and 7,450 encoded-float source samples remain directly compared. Existing workflows also test bounded 136-byte AHU loading. These tests do not assert Photoshop equivalence using loose tolerances: the reference report explicitly records differing pixels and false exactness gates.

Provenance: [local evidence archive]; reproducible fetch: scripts/fetch-adjustment-fixtures.py; before/source-math/corrected measurements: [local evidence archive]. Reference implementation consulted: psd-tools HSL processing order. The original Rust snapshot is unchanged. Existing native Colorize layers with nonzero lightness intentionally use the corrected rendering order on reopen.

The full package suite passes 279 tests with zero failures/skips; the 19 Hue/Saturation test results are extracted from that run in [local evidence archive]. The earlier focused failure log is retained separately. The three StoreKit integration results remain historical because purchase code is unchanged. An offscreen native render confirms the edited 5°–25° inner band displays the derived orange swatch and its adjusted result; the numeric bounds, wheel and spectrum remain readable at the normal panel width. This is static layout evidence, not live interaction qualification.

The universal release package passes clean ZIP extraction, ad-hoc signature verification, both macOS 14 deployment targets, supplied-icon integrity and license/attribution checks. Test PSDs and StoreKit fixtures are absent from the app. This release includes the corrected Colorize order and extended hue2 records; the large-image performance samples remain historical and were not rerun for this correction.

Added independent Shadows/Midtones/Highlights values for Cyan/Red, Magenta/Green and Yellow/Blue (−100…100), with Preserve Luminosity enabled by default. Native Properties controls, the Adjustments panel, Layer → New Adjustment Layer and Image → Adjustments → Color Balance (⌘B) share the model. The pixel sheet supports preview/cancel and background application. New adjustment layers derive their mask from the selection; edits honor locks and coalesce slider undo. The shared draft guard prevents simultaneous adjustment, clipboard and transform mutations.

Ported PhotoCraft’s ColorBalance transfer and Rec.601 luma: triangular tonal weights, additive color shifts, gamut clamp and optional luminosity ratio. RGB/32 samples use the existing native encoded↔linear adapter and linear partial-coverage mixing. Neutral edits intentionally bypass the source’s unconditional clamp/reconstruction, retaining original HDR and signed-zero samples; hidden RGB and alpha remain unchanged. Color Balance’s source equations are approximations; the proprietary Photoshop transfer, HDR behavior, gamut boundaries and byte-identical results are not qualified.

Added strict PSD blnc reads/writes for nine signed shorts and one luminosity byte, accepting the 19-byte and padded 20-byte forms. Values and flag validation reject malformed input. Unchanged source bytes, including optional padding, survive. Edits replace stale settings, rasterization/content changes remove stale tags, and the layer stays editable with masks/groups/clipping at RGB/8/16/32. Non-sRGB adjustment profiles, CgEd metadata and unrepresented color modes still reject explicitly. No invented Color Balance preset format was added.

Eleven tests cover 15,840 RGB and 15,840 encoded-float samples generated by executing unchanged Rust equations, a Python-packed binary record independent of the Swift writer, every truncated length, all nine invalid signed fields, flag/extra bytes, odd-length PSD alignment, ImageIO decode, masks/opacity/linear float mixing, stale tags, native archive, neutral/hidden samples, overflow rollback, selection placement, preview/cancel/background commit/cancellation/undo, slider coalescing, locks and ⌘B menu wiring. Source hashes and the intentional neutral HDR exceptions are in COLOR_BALANCE_ORACLE.json. The focused suite passes; these references establish source-port behavior, not Photoshop equivalence.

References: Adobe Color Balance controls, Adobe feature catalogue, Adobe PSD specification, and the psd-tools ColorBalance reader. Computer-use revalidation confirms the Mac is still locked; direct Photoshop output and live interaction qualification remain pending.

The full package suite passes 275 tests with zero failures/skips. The three unchanged StoreKit integration results remain historical. An offscreen 990×820 native render now includes Color Balance beneath Levels at the normal 298-pixel panel content width; all labels, numeric fields, sliders, Preserve Luminosity and reset buttons are visible without clipping. This verifies static layout only, not live keyboard, pointer or Photoshop behavior ([local evidence archive]).

Universal arm64/x86_64 packaging passes, both deployment targets remain macOS 14, and a clean ZIP extraction verifies the ad-hoc signature, supplied icon and licenses. Color Balance performance on one dense 24 MP RGB/16 release sample: 2564.78 ms destructive application, 5175.56 ms complete pixel + adjustment-layer composition, and 1,369,194,496 bytes peak process residency. This is not immediate slider feedback at that size; incremental/tiled rendering remains necessary. UI latency, p95 and Photoshop performance comparison are excluded ([local evidence archive]).

Added native Master and six-range Hue/Saturation, with independent master/Colorize parameter storage, 0–100 Colorize saturation and four wrapped range/falloff bounds. Ported the original HSL conversions, 4096-sample additive hue-range tables and near-gray range weighting. Identity, excluded colors and hidden RGB retain exact samples. Native float samples are decoded to linear light before the source transfer and encoded back; extended results remain finite or fail transactionally on overflow. Exact Photoshop HSL/HDR behavior remains unqualified.

Connected Image → Adjustments → Hue/Saturation (⌘U), editable adjustment layers, the Adjustments panel, Properties and a preview/cancel sheet. The controls include Master/six-color selection, before/after swatches, H/S/L sliders, Colorize, a draggable range/falloff wheel, numeric degrees, range/all resets and AHU preset load/save. The current selection becomes a new layer’s mask; slider/wheel edits coalesce for undo. Desaturate (⇧⌘U) applies the HSL saturation=-100 operation to selected pixels on the active raster layer as one background transaction. Existing legacy saturation layers remain unchanged.

Implemented strict 100-byte version-2 hue2/AHU import/export, preserving both active and inactive settings and unchanged source padding. Invalid values/order/version/length reject; imports retain masks, clipping and groups at RGB/8/16/32, and edits or rasterization replace/remove stale tags. Eight native mathematical preset definitions match the installed Photoshop 2026 files byte for byte when encoded; no Adobe files are bundled. Independent Python packing supplies the binary oracle.

Fifteen tests cover core math/storage/ranges, imaging/PSD and app workflows. The unchanged Rust functions and match arm generate 8,940 RGB and 8,940 encoded-float references. Native behavior intentionally differs for Colorize saturation below 25 (zero must be achromatic) and five explicitly indexed no-effect HDR inputs where Rust changes the original samples. These are pinned separately rather than hidden by relaxed tolerances. References: HUE_SATURATION_ORACLE.json, PHOTOSHOP_HUE_SATURATION_PRESETS.json and [local evidence archive]

Added deterministic offscreen native control rendering with --snapshot-adjustments. The first render exposed radial/vertical striping from individual hue strokes; native conic/linear gradients corrected it. The inspected 990×820 artifact contains all three adjustment editors at the default 298-pixel content width, with readable controls and no clipped fields. AppKit startup needed the existing elevated test environment; a stalled sandboxed helper was terminated. This render neither captures the desktop nor verifies live Photoshop interactions. The Mac remains locked. Prominent-color detection, contextual Adjust Colors, targeted image sampling and exact live behavior remain pending.

The full package suite passes 264 tests with zero failures/skips; the three existing StoreKit integration results remain historical and were not rerun. Universal release packaging and clean ZIP extraction verify both macOS 14 deployment targets, the ad-hoc signature, Photato branding, unchanged supplied icon and retained licenses. A single dense 24 MP RGB/16 release sample takes 3178.66 ms for destructive Hue/Saturation and 5812.19 ms for complete pixel + adjustment-layer composition, with 1,135,296,512 bytes peak process residency. Immediate slider feedback at this size still requires incremental/tiled rendering. The measurement excludes UI latency, p95 and Photoshop comparison ([local evidence archive]).

Added the native RGB/channel Curves model and ported the source's natural cubic spline/4096-sample transfer. Each component is applied before the composite curve. Validation permits 2–19 distinct increasing input coordinates and bounded 0…255 outputs; reversed and nonmonotonic output curves are supported. Identity edits, untouched channels, alpha and hidden colors retain their stored samples. Destructive edits respect transformed layer selection coverage, apply in the background and commit atomically with one undo. Float storage is decoded into linear light for the bounded source curve and partial-mask mixing; HDR extrapolation and exact Photoshop behavior remain unqualified.

The Properties editor and native ⌘M sheet expose a channel picker, histogram, grid, draggable/addable points, numeric coordinates, arrow/Shift-arrow movement, Delete, point selection, reset and preview/cancel. Input analysis shares the Levels worker, so changing the target curve does not invalidate the histogram. New Curves layers inherit the selection mask. The shared draft guard also prevents clipboard mutations and Free Transform during Levels/Curves previews. Remaining Curves interactions include freehand mode, eyedroppers, Auto, targeted image sampling, multi-point selection, full display options and live verification.

Implemented strict PSD point-mode curv and ACV version-1 bitmap/version-4 count codecs, with bounded extension records and byte preservation for unchanged source data. Unsupported freehand, additional active channels, conflicting records and incompatible profile/metadata semantics reject. Edits replace stale tags; rasterization and content changes remove them. PSD hierarchy, clipping and masks remain editable at 8/16/32 bits. Nine installed Photoshop preset definitions match the native mathematical settings; Adobe preset files are not bundled.

Four core, six imaging and four app tests cover independent Rust spline/combined tables, malformed and truncated binary fixtures, installed presets, PSD/ImageIO decode, alpha/masks/groups, native storage, point limits, locks, preview/cancel/background commit/undo, coalescing, bounded preset IO and ⌘M menu registration. An initial float test exposed encode/decode rounding amplified by steep curves: the final test compares the independent Rust table at the actual linear input and separately bounds the encoding round-trip. No production tolerance or Photoshop acceptance requirement was relaxed. References: CURVES_ORACLE.json, PHOTOSHOP_CURVES_PRESETS.json, [local evidence archive] These establish the current port's tested behavior, not Photoshop byte equivalence.

The full package suite passes 249 tests with zero failures/skips; the three existing StoreKit integration results remain historical and were not rerun. Both release architectures target macOS 14, and clean ZIP extraction verifies the ad-hoc signature, unchanged supplied icon, bundle metadata and license integrity. Curves performance, single dense 24 MP RGB/16 release sample: destructive application 2742.00 ms, complete pixel + Curves layer composition 5491.06 ms, whole-process peak residency 991,428,608 bytes. These full-image CPU operations remain too slow for immediate slider feedback at this size; tiled/incremental rendering is still needed. The sample uses Cross Process component curves and excludes UI latency, p95 and Photoshop comparison ([local evidence archive]).

Added full-resolution RGB/channel histograms to the native Levels editor. A renderer probe captures the actual input before the target adjustment, including prior adjustments, Pass Through/isolated groups and clipping chains. Own parameters, masks and upper layers do not contaminate the input histogram. Destructive Levels analyzes source pixels inside the document/selection, honoring layer coordinates and selection holes. Histogram calculation runs in a cancellable background task; identical input is retained during slider changes and stale completions cannot replace newer results. Float documents are analyzed in the linear sample domain used by their Levels evaluator. Visible pixels count once; fractional selection weighting and Photoshop histogram display exactness remain unqualified.

Read the installed Photoshop 2026 Levels presets and discovered that their version-3 ALV extension contains 62 records. The prior parser incorrectly borrowed the PSD channel-count limit of 56. The bounded reader now accepts up to 256 records and still rejects meaningful unrepresented extra channels. Eight native mathematical preset definitions match the installed records; unchanged ALV source bytes round-trip exactly. The application bundles native settings, not Adobe's files. Load/Save Levels Preset uses native file panels, bounded reads and security-scoped access. Evidence and source hashes: PHOTOSHOP_LEVELS_PRESETS.json.

Ported the source's automatic histogram clipping and median-neutralization estimator. Image → Auto Tone, Auto Contrast and Auto Color use ⇧⌘L, ⌥⇧⌘L and ⇧⌘B, honor selection/locks, run in the background and undo as a single named transaction. The Levels Auto menu offers the same three choices with independent shadow/highlight clipping percentages (default 0.10%). Pixel commands keep estimator precision; editable controls round gamma to hundredths. This is not Photoshop's full Auto Options dialog: target colors, Snap Neutral Midtones, Enhance Brightness and Contrast and saved defaults remain pending. Auto Color is the Rust approximation, not a claim of Photoshop's dark/light-color algorithm.

Eleven additional tests cover fifteen independent Rust histogram/auto cases, clipping/invalid/transparent samples, depth/selection/coordinates, transactional commands, grouped/clipped adjustment inputs, 62-record preset extensions and truncations, all eight installed presets, bounded native preset file reads, cache/cancellation/stale results and app command wiring. The full suite passes 235 tests with zero failures/skips on this Mac. The installed-preset reference test explicitly skips when Photoshop 2026 is absent; portable binary tests remain mandatory. The existing three StoreKit integration tests were not rerun because purchase code is unchanged.

References: Adobe automatic corrections, Adobe Levels and presets, and the read-only installed preset files. The Mac remains locked, so new live control/file-panel interactions and Photoshop rendering comparisons are not verified.

Universal arm64/x86_64 packaging, macOS 14 targets, icon/license integrity and clean ZIP signature pass. Levels analysis, single dense 24 MP RGB/16 flat-document release sample: direct pixel-layer histogram 576.24 ms, automatic estimator 0.026 ms, Auto Tone including analysis/application 3118.81 ms, and rendered adjustment-input histogram 3088.99 ms. Both histogram routes count all 24,000,000 pixels and agree. Whole-process peak residency is 1,296,924,672 bytes. These are single samples, not p95, grouped-document or live Photoshop comparisons ([local evidence archive]).

Added editable RGB/composite, Red, Green and Blue Levels, input black/white, gamma, output black/white and Reset. The Adjustments panel and Layer → New Adjustment Layer expose Levels; creation includes a white or selection-derived pixel mask. Image → Adjustments → Levels… uses ⌘L and a native sheet with background canvas preview, Preview toggle, Cancel and an undoable asynchronous Apply. Locks and incompatible edit targets disable the pixel command. Adjustment Properties now omits irrelevant Transform/Align controls. Undo labels identify Levels.

The original Rust levels_q, levels_float and LUT sampling functions generate 5,418 independent regression vectors. RGB/8 uses its whole-level input rounding; RGB/16 uses its 32768-step working scale. The integer compositor retains the source’s 4096-entry master-then-channel LUT and fitted shadow toe. This is source-math qualification within Float tolerance, not byte-identical Photoshop rendering. RGB/32 evaluates on linear-light samples and preserves extended values instead of using the source display LUT’s clipped interval; fractional selection/mask/opacity mixing also uses linear light. Identity edits preserve bits and alpha. Overflow fails transactionally rather than turning non-finite results into black.

PSD interchange now supports represented RGB levl records, empty adjustment caches, pixel/vector masks, opacity and clipping metadata. Version-2 records and the optional Lvls extension are bounded and validated; meaningful unrepresented extra channels reject. A Python-packed binary fixture is independent of the Swift writer, all truncations fail, unchanged source blocks survive, and parameter edits replace stale blocks. Native-created RGB/8/16/32 files also expose readable merged images through ImageIO. Non-sRGB adjustment profiles, additional CgEd data and unsupported parameter precision remain explicit limitations.

Twelve new tests cover the oracle, endpoints/hidden color/HDR, alpha, selection, native persistence, PSD records and corruption, mask/opacity composition, layer creation/edit/undo, preview/cancel/commit/cancelled work, locks and menu/shortcut wiring. All 224 package tests pass; prior three StoreKit integration tests qualify unchanged purchase code. Photoshop and live UI qualification remain unavailable while the Mac is locked. Histograms, Auto/Auto Options, eyedroppers, presets and full group/clip interaction qualification remain open.

References: Adobe Levels controls, Adobe file-format specification, local Rust crates/compose/src/adjust.rs and crates/io/src/adjust_map.rs. Reproduce fixtures with scripts/generate-levels-oracle.py; provenance is in docs/LEVELS_ORACLE.json.

Profiled dense native serialization and clipboard format preparation. A 1,048,576-pixel RGB/16 gradient/alpha document previously spent 1,398.61 ms encoding and 1,950.92 ms decoding its 33,841,297-byte property-list archive. Surface now encodes portable little-endian Float32 RGBA tiles, with lossless macOS zlib compression where smaller. Native archive version 7 retains previous model semantics and reads versions 1–6. A checked-in file produced by the unchanged version-6 release verifies actual migration. Older app builds cannot read new version-7 files. Both encode and decode enforce the 512 MiB file cap; a shared decode budget reserves each layer/mask's tile storage before expansion, including legacy tiles.

Binary sparse-default samples also preserve Float bits. Tests caught property-list numeric deduplication changing the sign of zero in a default pixel; default samples now use explicit bytes, as the tiles do. Seven new tests cover an independent Python/zlib oracle, raw little-endian samples, signed zero/subnormals/hidden and extended RGB, real legacy migration, all output depths and tile edges, malformed/truncated/trailing streams, invalid indices/versions and aggregate raster budgets. All 212 package tests pass with zero failures/skips; unchanged StoreKit integration retains its prior three passing tests.

CoreGraphics display/float/TIFF buffers now pack directly from tiles without per-pixel array creation or dictionary lookup. A single unmodified pixel-layer clipboard preview bypasses unnecessary composition/depth conversion. The same sparse constant-color 24 MP RGB/16 clipboard sample prepares native/TIFF/PNG in 203.81 ms, down from 6,729.88 ms, with identical native samples and unchanged external TIFF/PNG sizes. This is about a 33× improvement for that sample; pasteboard IPC, merged/selection copies and general workload percentiles are not included.

The dense one-megapixel archive now saves/loads in 94.05/21.07 ms and occupies 5,834,421 bytes. A dense 24 MP sample saves/loads in 2,070.68/488.37 ms, occupies 130,037,175 bytes and preserves native samples. Its image packing/encoding checks also succeed. The benchmark retains both documents and all outputs concurrently and reaches 2,423,128,064 bytes of process residency; this is not a per-operation memory budget or full large-document performance qualification. Exact measurements: [local evidence archive], performance-packing-after.json, performance-packing-24mp.json and performance-clipboard-24mp.json.

Universal arm64/x86_64 release, both macOS 14 deployment targets, original icon/license integrity and clean ZIP ad-hoc signature pass. Existing Photoshop PSD fidelity differences remain unchanged. No fresh live UI/Photoshop comparison was performed during this headless storage/performance checkpoint; previous live checks remain historical evidence. Full Photoshop functionality, preferences, shortcuts and byte equivalence remain open.

Implemented Cut, Copy, Copy Merged, Paste, Paste in Place, Paste Into/Outside and New from Clipboard. A pixel selection lifts coverage from the active content; no-selection Copy preserves selected editable layers and group subtrees, including off-canvas pixels, masks, clipping, opacity and type layout. Native clipboard data retains source coordinates and full sample precision. Paste remaps layer IDs, converts to destination depth, inserts above the active layer or into its group, and uses a single undo transaction. Paste Into/Outside converts destination coverage into an unlinked document-space mask. Standard AppKit responder routing keeps text-field clipboard behavior intact; image menu shortcuts match the documented Photoshop commands.

Clipboard preparation runs off the main thread. Cut writes the prepared clipboard before committing the validated edit; cancellation, write failures and stale document/clipboard state leave the document intact. Native clipboard archives are bounded and versioned. TIFF retains 8/16/32-bit components; PNG provides an SDR fallback. Tests use an isolated named macOS pasteboard and never modify the general clipboard. The coding-tool sandbox initially denied pasteboard service access; the approved native test run passes with that service available.

Sixteen new tests cover core/model/render/app behavior: fractional selection and transparency bounds, hidden and extended RGB, native archive damage, depth conversion, group remapping, masks, editable type layout, merged visible content, external TIFF/PNG precision/orientation, menu wiring, cancellation and failed Cut. Aligned pixels initially passed through interpolation, changing Float bits; direct sample reads corrected that. The first TIFF implementation promoted integer content to float, which was corrected to retain source precision. All 205 package tests now pass with zero failures/skips. Existing three StoreKit integration tests cover unchanged purchase code and were not rerun.

A single constant-color 24 MP RGB/16 release sample measured layer capture at 0.34 ms, preparation of all native/TIFF/PNG representations at 6,729.88 ms, and native decode plus paste at 0.40 ms. Native pixels remain exact. The corrected TIFF is 192,019,366 bytes versus 384,035,366 before the depth correction; this is a size/precision correction, not a measured speed improvement. This sparse-layer sample excludes pasteboard IPC and does not qualify dense/merged/selection copy latency, peak memory or p95 performance. Full image encoding remains a significant cost despite running in the background.

Universal arm64/x86_64 compilation, both macOS 14 deployment targets, retained icon/licenses and clean ZIP ad-hoc signature pass. Live Photato clipboard/branding checks and direct Photoshop output comparisons remain pending while the Mac is locked. Mask-channel/path clipboard, special Background Cut semantics, Adobe layered/vector/PDF interchange, clipboard preferences and exact selection/mask/effect/placement behavior remain open. Evidence: [local evidence archive], [local evidence archive], [local evidence archive] and [local evidence archive]. Full Photoshop parity is not achieved.

Added Layer → Layer Mask commands for Reveal/Hide All, Reveal/Hide Selection, From Transparency, Apply, Delete and dynamic enabled/link state. Properties and context menus expose Apply/Delete; Option-clicking the footer mask button creates a hidden mask. Creation retains editable layer types and fractional document-space selection coverage. Apply bakes pixel-mask density, feather, inversion and bounds into raster alpha while retaining vector masks, layer settings and hidden RGB. From Transparency separates alpha from pixel colors. Both expensive commands run as cancellable background transactions with undo; affine raster inputs retain transformed off-canvas pixels. Disabled-mask application explicitly confirms that the stored mask will be used. Nonpixel Apply/From Transparency still require separate rasterization, and direct Photoshop command-result qualification remains open.

Eleven new core/render/app tests cover the workflows across pixel depths, rejection/lock rules, cancellation, undo, native storage, PSD output and native menu wiring. A separate raw vector-alpha test isolates eight original PSD shape caches from color, blending and mask properties. Their stored alpha values are multiples of three, with current rasterizer errors of 9/255 to 36/255. Supersampling, curve flattening and sampling-grid probes did not establish a consistently better algorithm; production vector rendering is unchanged. Fresh controlled Photoshop 2026 primitive/phase references are still needed. Generated Apply Mask PSD inputs are qualification inputs, not independent Photoshop oracles.

All 189 package tests pass with zero failures/skips. Existing three app-hosted StoreKit tests cover the unchanged purchase implementation and were not rerun for these mask changes. A single 6000×4000 RGB/16 release sample measured Apply Mask at 2,121.62 ms and From Transparency at 1,889.94 ms, with 370.125 MiB of document raster storage in each result. This constant-color, fractional-alpha sample has no feather/affine transform and is not a p95 or peak-process-memory qualification. Universal arm64/x86_64 builds, both macOS 14 deployment targets, icon/license integrity and clean ZIP ad-hoc signature pass. Live Photato branding and new command checks remain pending while the Mac is locked; full Photoshop parity is not achieved. Evidence: [local evidence archive], [local evidence archive], [local evidence archive] and [local evidence archive].

Diagnosed the pinned original PSD corpus against its independently stored composites. Extending the last stored mask sample at coincident canvas edges reduces the heart fixture's maximum encoded channel error from 0.01441908 to 0.00839591. Implemented the correction for unscaled pixel masks in document coordinates, retaining outside-color falloff around cropped masks and existing off-canvas samples. Pixel and vector masks still have independent feather/density controls. Experiments changing CoreGraphics path normalization/flatness did not improve the vector references and were discarded.

Added three core regressions across pixel depths, density/inversion, cropped corners and off-canvas samples, plus an original-PSD edge/archive/save-reopen regression. PSD fill export normalizes layer origins; the save test compares mask placement in document coordinates and verifies all resulting composite pixels. All 177 package tests pass, zero failures. Universal Photato release, both macOS 14 deployment targets, original icon bytes, retained licenses and clean ZIP ad-hoc signature pass. Existing three local StoreKit integration tests qualify unchanged purchase behavior; they were not rerun for this rendering change.

The heart fixture still differs at 28,013 pixels; the other corpus and Photoshop vector/float-fill errors remain. This is a measured rendering improvement, not exact Photoshop parity. Affine-transformed mask boundary semantics require further reference qualification. The Mac remains locked, so new live checks and Photato branding visual verification are pending. Evidence: [local evidence archive], [local evidence archive], [local evidence archive]. Diagnostic logs retain the initial save-test coordinate assertion failure separately from the final passing suite.

Named the native application Photato. Updated the app/executable/ZIP name, native menus and About title, About's icon, support-window copy, transaction acknowledgement and user-facing error messages. Kept upstream PhotoCraft credits, the original Rust snapshot, internal Swift module/class names, development bundle/IAP identifiers and the .pcswift type/archive signatures intact. The package product is now Photato; the source directory remains PhotoCraftSwift/.

Copied the supplied root PhotatoIcon.png unchanged into Assets/PhotatoIcon.png. The build uses Apple's tools to generate standard/Retina icon renditions and bundles Photato.icns. Native ImageIO decodes all ten renditions (16–1024 pixels); the largest is pixel-identical to the supplied artwork. The icon compiler required access to local macOS services outside the coding-tool sandbox; the approved local build completed successfully.

All 173 package tests pass. Universal arm64/x86_64 output, macOS 14 minimum, packaged icon/metadata, retained licenses, unchanged document registration and clean ZIP ad-hoc signature verified. Evidence: [local evidence archive] and [local evidence archive]. The running Mac is locked, so About/menu/Dock visual verification is pending; requested manual unlock and left the previously running app alone. Photoshop-parity and App Store release gates remain open.

Replaced external donation destinations with native StoreKit 2 consumable tips, following the user's App Store distribution requirement. Help and About open a SwiftUI support window with App Store product descriptions and localized prices. Tips are optional, repeatable, one-time purchases and unlock no features. Removed the external funding template; old donationURL metadata is ignored. The three configured development IDs are provisional and not registered in App Store Connect.

Added verified-only transaction fulfillment, finish-once handling for concurrent duplicate delivery, a launch update listener, unfinished recovery at launch/activation/refresh, purchase restrictions, pending approval, cancellation, failure/retry and an approval-before-purchase-return regression. Unknown StoreKit errors remain failures instead of being guessed to mean cancellation. No payment account or production purchase was used.

173 package tests and 3 app-hosted StoreKit tests pass, zero failures/skips. Apple’s StoreKit service rejected the bare SwiftPM test runner, so a dedicated Xcode test host now compiles the production adapter/model and uses a local .storekit fixture. It checks the Xcode environment before purchases and clears simulated transactions. Repeat tips, unfinished recovery, pending approval recovery and failure/retry pass; the approval case took about 15 seconds in this local service. A simulated cancellation was reported by this OS as StoreKitError.unknown, so actual cancellation-dialog behavior remains part of sandbox/TestFlight qualification; deterministic cancellation policy tests pass. Test code/configuration are excluded from the shipped app.

Universal arm64/x86_64 release, macOS 14 minimum, bundled licenses and clean ZIP ad-hoc signature verified. Live Help/About entry points, unavailable-product message, reload, licenses, layer creation and undo-to-clean pass. App Store product registration, final prices, signed sandboxed archive, multi-OS runtime qualification and App Review remain release gates. This supersedes the earlier external-donation integration and does not complete the Photoshop-parity objective.

Ported bounded native ActionDescriptor transport from the Rust descriptor module, preserving ordered keys, ID representation, UTF-16 and double payload bits. An independently generated 643-byte fixture round-trips byte-identically; every truncation rejects. Added SoCo fill import/export, RGB/document-profile conversion, raw unchanged descriptor retention and stale-tag removal on rasterization. The existing native fill model now has a creation menu, selection/default mask and color Properties control with undo. Fixed inactive-app native color panel presentation during live testing.

Photoshop 2026 independently saved editable fill references at all three depths and a 64-color RGB/16 boundary matrix. The comparisons exposed and corrected linear RGB/32 descriptor handling and Photoshop's 0…32768 RGB/16 fill evaluation. RGB/8 and RGB/16 fills and the matrix match exactly. RGB/32 encoded channels still differ by up to 8.940697e-8; exactness remains false. Original seven-file corpus now imports five files, with two exact-at-depth and three non-exact; vowv and Txt2 inputs still reject. These are recorded regressions, not waived acceptance requirements.

162 tests pass, zero failures/skips. Universal arm64/x86_64 release, macOS 14 minimum and clean ZIP signature verified. Live fill creation, native RGB hex entry, canvas/thumbnail update and undo-to-clean pass. Original Photoshop user document preserved. Donation setup remains optional and unconfigured; original licenses/credits remain bundled.

Added document-space cubic Bézier geometry, bounded saved/work paths, vector masks and archive v6 (reads v1–v5). Pen click/drag creates corner/smooth anchors; Direct Selection edits anchors/handles, Path Selection moves components, Pen inserts anchors by De Casteljau subdivision and deletes existing anchors. Paths supports saved/work/mask targets, names, duplicates, compound operations, fill rules, inversion and path-to-selection. Vector masks multiply independently controlled pixel masks and follow linked layer/group transforms or all whole-canvas transforms. Native Layer > Vector Mask actions and Properties controls expose reveal/hide/current-path/delete/enable/link/density/feather.

PSD reads/writes vector-mask blocks, saved/work path resources and Unicode path names at RGB/8/16/32. Photoshop references caught vector-block padding and Unicode-name metadata that native self-round-trips could not. A byte-level path test pins the signed 8.24 coordinate contract. Cache channels from Photoshop are not applied twice. Unknown rich layer semantics and unrepresented path combinations still reject.

151 tests pass, zero failures: 17 additional geometry/rendering/PSD/app/file-lifecycle tests. Three independent Photoshop-saved fixtures qualify editable geometry and properties, with a measured 4/255 working-space composite bound. The largest encoded-sRGB difference is 0.02539 in RGB/32 feathered edges; this remains a fidelity gap, not full Photoshop equivalence. Live Pen/closure/mask creation/anchor drag/12 px feather/undo checks passed. Native Save testing exposed and fixed a pre-existing display-name-versus-UTI registration bug; the exact bundle type now has a disk-write regression.

Documentation correction, 2026-10-08: The following vector Save/Open follow-up was previously placed under the first migration milestone. Its exact check time was not recorded: Final release verification: universal arm64/x86_64, macOS 14 minimum and clean ZIP ad-hoc signature pass. Live native Save/Open now passes: [local evidence archive] reopens with the cubic work path, editable vector mask and 12 px feather intact.

Added a bounded, validated layer hierarchy with subtree grouping/ungrouping, duplicate/delete/reparent/reorder, inherited locks and visibility, group Move/Free Transform, group masks and undo. Children retain document coordinates. The Layers panel now supports multi-selection for grouping, indentation/disclosure, folder creation and drag destinations, Pass Through/isolated blending, clipping arrows/base underlining, the advanced clipping blend flag and native shortcuts. Native archive v5 reads v1–v4.

PSD now reads/writes raster groups and clipping at 8/16/32 bits, preserves nesting/collapse state and blend flags, and validates group dividers. Photoshop opened the generated nested hierarchy with editable masks and clipped layers. Four newly saved Photoshop references provide independent RGB/8 merged composites, including 32 alpha/opacity/blend cases. Those comparisons exposed and corrected the advanced clipping flag's ordering and fractional-alpha Pass Through clipping backdrop contribution. The matrices cover single Screen children with Normal/Multiply clipping; this empirical coverage is not proof of all multi-child, adjustment, nested-clipping, transparent-backdrop or high-depth group combinations.

134 tests pass with zero failures or skips: 24 new hierarchy/rendering/PSD/app tests. Cycles, malformed PSD dividers, excessive nesting and thin-canvas temporary tile budgets reject. Isolated group rendering is memoized to avoid repeatedly rebuilding clipping bases; temporary allocations remain bounded. Live native checks cover collapse/undo, subtree duplicate/undo, group Free Transform and clipping release/undo. Fixed transform Cancel/Apply keyboard shortcuts when focus remains in Layers, and improved folder icon visibility. Group rasterization and arbitrary multiselection transforms remain pending. Vector masks, rich layers, PSB and the full source corpus are still open.

Added bounded raw/RLE/ZIP/ZIP-prediction channels at 8/16/32 bits, depth-specific Lr16/Lr32 sections, neutral HDR conversion metadata, high-precision raster masks, flattened RGB input, and compressed pixel-layer export. Swift implements PSD layout/prediction/sample handling; DEFLATE uses the macOS system zlib. No Rust runtime or third-party package is linked. Saved alpha/spot channels and unrepresented rich layer semantics still reject explicitly.

Live Photoshop 2026 opened both high-depth exports with editable layers/masks. The first float export revealed a gamma mismatch that round-trip tests alone missed: Photoshop uses linear 32-bit samples. Corrected PSD transfer/profile handling and float layer composition, preserving extended and hidden RGB values. Native working samples remain sRGB-encoded. Older float development documents may change appearance at layer overlaps as a consequence of the corrected composition. Full HDR blend/adjustment/display fidelity remains open.

110 tests pass. Nine new tests cover 12 independent Python/zlib compression vectors, malformed ZIP streams, all depth/export-compression combinations, flattened inputs, HDR/negative/hidden samples, linear compositing, Apple high-depth PSD decoding and two new Photoshop-saved references. Those reference layers/masks agree within 0.00005 and recomposed channels within 0.0001. The original Photoshop Untitled-1 was left untouched. Groups, clipping, vectors, PSB and the full source corpus remain next.

Recorded the user’s intent to release the native Swift work as an upstream fork with voluntary donations. Added explicit upstream credit, native About/licenses UI, optional HTTPS fork/support links bundled from local release metadata, inactive GitHub funding template and contribution/publication guidance. Donation and fork URLs remain unset pending the maintainer’s choices, so no payment recipient is invented. The local Rust tree has no Git history; an actual upstream-history fork must be created when publishing. No repository was published or payment account enrolled. This does not replace the active Photoshop-parity objective.

101 tests pass, including absent/valid/invalid release destinations. Both architectures build; the clean ZIP signature, license copies and unset destination metadata verify after extraction. Live UI checks confirm Help → Open Source & Credits, the native About view, the bundled license sheet and hidden support controls without a configured recipient.

Added native mask transforms, outside coverage, enabled/link states, density and Gaussian feather (sigma equals mask radius, independent of selection feather). Brushes grow tightly cropped mask rectangles, honor selection bounds and preserve existing coordinates. Unlinked mask Move leaves layer pixels fixed; layer transforms preserve unlinked masks in document space, while whole-canvas transforms include them. Properties now switches to mask controls when the mask thumbnail is selected. Undo and native archive v4 retain all mask properties; v1–v3 remain readable.

Extended RGB/8 PSD raw/RLE import and raw export to raster masks, including real-mask metadata and both observed parameter orderings. Fixed a pre-existing reversal of Photoshop layer-record order. Preserve selected layer tags in the native document/export and accept ordinary ICC-managed Photoshop 2026 metadata while rejecting actual OCIO workflows. Rich vectors/groups/type/effects and unsupported compression/depth still reject explicitly. Affine mask PSD export remains pending; native storage is preserved.

Fetched seven MIT psd-tools files at a pinned commit with verified hashes. Their rich layers are not a full import pass. Created two separate fixtures through the actual Photoshop 2026 UI; the raster derivative and re-saved density/feather export are bundled with provenance and license. Photoshop visibly read 50% density and 1.5 px feather, and both stored Photoshop composites agree with the Swift renderer within the asserted 2/255 channel tolerance. Original user Photoshop document and public corpus files unchanged. 99 tests pass, including selection regressions, mask expansion and independent mask moves. Full Photoshop parity remains the active goal.

Ported PhotoCraft's GRAY8 selection combination and even-odd polygon scan conversion semantics to native Swift. Added ellipse/freehand/polygon tools, modifier and options-bar combinations, inverse, Gaussian feathering, and true coverage clipping for painting/fill/clear/adjustment/blur/mask creation. Canvas geometry resamples selection coverage. Native archive v3 stores coverage compactly and reads v1/v2. Added separate mask/content thumbnail targets, grayscale mask brush/fill/invert and transformed-mask stroke coordinates without rasterizing live type/shapes. Cancellable background selection commands reuse transactional editing.

87 tests pass. New tests cover source polygon/feather cases, fractional combinations, all pixel depths, geometry/undo/archive preservation, mask alpha independence and transformed coordinates, locked masks, freehand gesture completion, polygon closure/cancellation and target isolation. Clean builds resolved stale SwiftPM test objects after Core enum/layout changes; test targets now explicitly declare directly imported Core/Imaging dependencies. Live UI verified ellipse subtraction and ring Fill, coverage-to-mask, mask painting, thumbnail target switching, polygon Return closure and 20 px feathered Fill; all test edits were undone. Inspected Photoshop's selection flyout/Lasso options without editing its document. Advanced selection refinement, Quick Mask, density/feather/apply/disable mask controls and PSD mask fidelity remain open.

Added affine live type/shape geometry, raster/mask resampling, Free Transform handles and numeric options, image/canvas size sheets, resolution-only sizing, five whole-canvas turns, and one-step undo. Heavy operations are cancellable background transactions with stale-result protection. Native archive v2 reads v1 and preserves matrices/layout/resolution; ImageIO and the limited PSD codec preserve print resolution. Live inspection of Photoshop's size dialogs guided UI behavior. Fixed the physical-unit feedback loop found in native live checks. All 71 tests pass; both architectures build and the clean ZIP signature verifies. Dense 24 MP rotation measured 2825 ms and bicubic 24→6 MP resize 1445 ms in one release sample. Advanced transforms and selection/mask workflows remain open.

At the user's request, removed the macOS 27+ Image Playground block while preserving Apple Silicon/macOS 26+ eligibility and the framework's real availability check. Apple illustration/animation/sketch styles remain enabled; external providers remain excluded. Renamed the system image adapter and corrected the AI sheet, toolbar, help and generated-image status so cloud results are never labeled as generated on-device. Prompt refinement still uses the explicit local SystemLanguageModel. Updated the roadmap and acceptance policy to allow Private Cloud Compute alongside the planned offline image backend.

All 51 tests pass, including deterministic available-cloud/unavailable-service presentation, invalid prompt rejection and generated-layer undo. Both architectures build. Live UI verification confirms the new disclosure; macOS still reports Image Playground unavailable and the text model downloading/preparing. No live generation was possible or claimed. This supersedes the cloud-exclusion decision in the earlier log entry below.

Inspected the user’s open Photoshop 2026 UI without editing its document. Rebuilt the native workspace around the observed tool/options/tab/panel arrangement. Added 21 grouped tool slots with 59 entries, explicit unavailable states and a feature-map sheet; connected 11 supported tools, color spectrum, layer thumbnails/filter/drag reorder, adjustment properties, channel previews, pixel rulers and native canvas scrollers. Added crop/zoom UI, rectangle modifiers, Space pan, transparent New Document backgrounds and distinct document names. Document tabs switch native windows. All 49 tests pass, including seven new workspace tests. Live checks verified painting/undo, inert missing tools, shape flyouts, exposure, crop/undo, rulers and transparent document creation. Full/minimum/reference snapshots accompany the UI audit. Missing controls remain disabled and do not count as completed source parity.

Recorded the user's delivery order: finish PhotoCraft parity, then close professional Photoshop workflow gaps. Added a 12-family workflow map, a 40-case planned acceptance backlog, and a local AI integration/evaluation contract. Audited source-document contradictions: Pencil/Mixer/Patch, projective Smart Objects, optical kerning, atomic-save failure tests and recent-file persistence already have implementations despite older missing-feature claims. Their existing behavior belongs in the port.

Current Apple documentation revealed that macOS 27 Image Playground uses Private Cloud Compute even for styles previously generated locally. Corrected the earlier local-only assumption: block that backend on macOS 27 and unknown future versions, retain the separate on-device text gate, and test the platform policy plus the real presentation entry point. All 42 tests pass. The planned Core ML image backend has not been implemented or downloaded. No source command was promoted to complete.

Inspected source architecture and honest parity assessment; inventoried 24 crates and 626 unique source menu IDs. Created separate Swift package and modules for core, imaging/PSD, optional AI and the native app. Preserved original Rust files and licenses. Ported/tested blend math, sparse raster storage, document/history, basic editing, native I/O, a strict PSD subset and a functional native workspace. Generated 972 Rust blend oracles. Added 40 passing tests, including independent Apple PSD decoding, mutation cases, input limits, file lifecycle and generated-layer undo. Built arm64/x86_64 universal app with a macOS 14 target and weak-linked AI frameworks. Verified native editing/save and unavailable AI states live. Recorded full/minimum-size visual snapshots and a 24MP CPU baseline. Corrected canvas redraw, SDR preview tone mapping, imported-file protection, gesture history grouping, and bundle-signing interaction with Desktop sync.

Still open: all items in STATUS.md; this is not the user's completed 100% parity objective. Prioritize full PSD corpus/fidelity, remaining command semantics, rendering performance and recovery. No background continuation or automation has been created.

Initial implementation sequence — reconstructed on 2026-10-08

This expansion uses the original milestone narrative, the frozen source inventory, current porting plan and surviving early logs. It records the known work sequence; it does not recreate missing edit-by-edit history or assert exact times for undocumented actions.

1. Source discovery and requirements. Inspected the Rust architecture and its own parity limits; inventoried 24 crates / 257,925 source lines and 626 unique menu IDs. Preserved source hashes in docs/SOURCE_INVENTORY.json, created the command matrix and planned a native macOS 14+ port. The source is an extracted snapshot; no upstream base commit is available.
2. Native architecture. Created Package.swift and separate Core, Imaging, AI and application targets. Kept the original Rust tree and upstream notices. The plan defines value-based document/commands, native AppKit/SwiftUI interaction, independent optional AI and a universal deployment target.
3. Core implementation and differential evidence. Added sparse raster storage, pixel depths, blend math, document/layers, editing commands and transactional history. docs/BLEND_ORACLE.json records 972 executed Rust blend vectors and the generating source hash.
4. Imaging and format integration. Added native composition, raster I/O, text/shapes, blur/resize, the first strict PSD subset and native document persistence. The early imaging run at 2026-10-07 14:33:14 (local log time; zone not embedded) reports seven tests and one Gaussian-blur failure. A later integration run at 14:38:48 reports 24 tests with no failures; the 14:39:35 module run reports 25 with no failures. The surviving logs establish those outcomes, not every intervening source edit.
5. Native workspace and document lifecycle. Connected the canvas, tools, document controller, save/open/export and undo. The 15:06:11 workflow run reports 29 passing tests. The original milestone records live editing/save, full/minimum layouts, a 24 MP CPU baseline and repairs for redraw, preview tone mapping, imported-file protection and gesture history.
6. Optional AI and platform gating. Added the initial local prompt/image adapters and generated-layer undo. The 15:08:08 AI-integration run reports 29 passing tests. Later entries separately document the corrected macOS 27 cloud policy and the user's subsequent Private Cloud Compute authorization; do not apply today's policy retroactively to the initial build.
7. Packaging and qualification. Built both architectures with macOS 14 deployment settings and weak-linked optional frameworks. The early core log records a code-signing build failure with no test summary. The milestone records subsequent packaging/signature repairs and a 40-test pass, but this audit does not recover an immutable full 40-test log. That final count remains a historical narrative claim rather than a newly verified run.

Surviving early evidence: core build failure, imaging failure, 24-test integration, 25-test modules, workflow tests, AI integration, source inventory, and blend provenance. No private user documents or proprietary implementation code were added by this reconstruction.