@photivra/engine 1.1.0 → 1.3.0

package/docs/CAPTURE_CORRECTED_SDR.md

@@ -1,6 +1,6 @@
 # Capture-bound corrections and SDR: #112 integration slice
 
-Release context: **package 1.1.0 candidate / root API 1.1.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_1_0.md).
+Release context: **package 1.2.0 candidate / root API 1.2.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_2_0.md).
 
 `calculateCaptureCorrectedSdr()` consumes the same immutable `SimulatedCapture` and explicit source/color/WB choice as `calculateCaptureSdr()`, then executes existing #117/#118 corrections before the existing SDR renderer. This bounded reference bridge does not replace the #111 composer, activate production stages, or complete #112/V1.
 

package/docs/CAPTURE_EXPORT_METADATA.md

@@ -1,6 +1,6 @@
 # Capture export metadata foundation (#16B)
 
-Release context: **package 1.1.0 candidate / root API 1.1.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_1_0.md).
+Release context: **package 1.2.0 candidate / root API 1.2.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_2_0.md).
 
 `createCaptureExportMetadataPair()` is a browser-safe, deterministic **semantic metadata projection**, not an image exporter or proof of RAW/JPEG pixel derivation. Both future writers consume its single shared object; each resource has a distinct caller-owned document UUID and saved-incarnation UUID. `imageDataPairing = "not-verified"` prevents metadata agreement being mistaken for image agreement.
 

package/docs/CAPTURE_SDR.md

@@ -1,6 +1,6 @@
 # Capture-to-SDR adapter
 
-Release context: **package 1.1.0 candidate / root API 1.1.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_1_0.md).
+Release context: **package 1.2.0 candidate / root API 1.2.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_2_0.md).
 
 Current integration: [processed camera output](PROCESSED_OUTPUT.md) documents
 the shared preview/export path and explicit plan 0.6.0 post-RAW activation.
@@ -18,3 +18,5 @@ The result exposes optional color and SDR calculation envelopes separately, with
 This is #112B, not full #112 closure. It does not execute correction profiles or activate production stages. Corrected planes may retain their explicit upstream transform history; no correction is inferred. #117/#118 execution and #111 ordered production integration require their own bound handoff. #16 remains the serializer owner and must not invent color/WB/quantization semantics.
 
 Implementation and fixtures are independently authored orchestration of existing Photivra APIs; no new equation, calibration, third-party material, dependency, service, IO or cost is introduced.
+
+For external megapixel masters already in resolved linear sRGB/D65, see the separate [bounded native SDR contract](NATIVE_CAPTURE_SDR.md). The reference limits above remain unchanged.

package/docs/DEVELOPERS.md

@@ -1,18 +1,18 @@
 # Developer guide
 
-This is the entry point for **@photivra/engine 1.1.0 candidate**, root API contract **1.1.0**. The candidate becomes an installable 1.1.0 distribution only after the owner tags and publishes it. Repository `main` may later describe newer development; use a published release's packaged docs or its exact tag for the stable contract. [Release notes and migration](RELEASE_1_1_0.md) explain the transition to aligned package/root versions.
+This is the entry point for **@photivra/engine 1.3.0 candidate**, root API contract **1.3.0**. The candidate becomes an installable 1.3.0 distribution only after the owner tags and publishes it. Repository `main` may later describe newer development; use a published release's packaged docs or its exact tag for the stable contract. [Release notes and migration](RELEASE_1_3_0.md) explain the transition to aligned package/root versions.
 
 Photivra is an Apache-2.0 ESM TypeScript calculation library with no runtime npm dependencies. It exposes explicit units, deterministic data, provenance and bounded scientific approximations. The package supplies no hosted API, renderer installation, UI, commercial camera calibration or automatic agent service. [Photivra's public site](https://photivra.com) is separate from the engine's license; public engine documentation is available here without an application account.
 
 ## Install and calculate
 
-After publication, install `npm install @photivra/engine@1.1.0`. During candidate review, use the verified tarball described in [release preparation](RELEASE_1_1_0.md).
+After publication, install `npm install @photivra/engine@1.3.0`. During candidate review, use the verified tarball described in [release preparation](RELEASE_1_3_0.md).
 
 ```ts
 import { calculateFieldOfView, ENGINE_API_VERSION } from "@photivra/engine";
 
 const horizontal = calculateFieldOfView({ focalLengthMm: 50, sensorDimensionMm: 36 });
-console.log(ENGINE_API_VERSION); // 1.1.0: matches the package version
+console.log(ENGINE_API_VERSION); // 1.3.0: matches the package version
 console.log(horizontal.value.degrees); // approximately 39.60, ideal infinity-focus geometry
 console.log(horizontal.provenance); // read assumptions/status with the value
 ```
@@ -23,7 +23,7 @@ Primitive calculations normally return `CalculationResult<T>` with `value`, `pro
 
 ## Find the operation by scientific task
 
-Every row applies to package/root API 1.1.0. Direct calculations are synchronous/browser-safe unless the row says otherwise. A listed primitive is not automatically an app feature or supported in every production combination. The [API reference](API_REFERENCE.md) resolves all root exports and exact signatures; the linked guides own equations, inputs, defaults, errors and limits.
+Every row applies to package/root API 1.3.0. Direct calculations are synchronous/browser-safe unless the row says otherwise. A listed primitive is not automatically an app feature or supported in every production combination. The [API reference](API_REFERENCE.md) resolves all root exports and exact signatures; the linked guides own equations, inputs, defaults, errors and limits.
 
 | Task | Start here / executable evidence | Qualified boundary |
 | --- | --- | --- |
@@ -61,6 +61,8 @@ Website navigation/documentation hosting belongs to [the app-side discovery tick
 
 ## Print planning
 
+The published 1.2.0 release added [registered linear statistics](PRINT_REGION_STATISTICS.md) and a separate [static contrast model reference](PRINT_CONTRAST_REFERENCE.md). The [combined #195/#196 review](PRINT_195_196_REVIEW.md) and [candidate ledger](validation/print-196-candidate-capabilities.json) list executed public-backend experiments and the remaining full release gates. None of these diagnostics supplies a universal quality score.
+
 Use [native-only Print planning](PRINT_PLANNING.md) for independently specified image size/viewing distance, explicit angular conventions, confirmed native crop and lab constraints. It returns no upscale recommendation and does not certify perceived quality or activate an exporter.
 
 The [regional Print detail diagnostic](PRINT_DETAIL_ASSESSMENT.md) measures one declared coherent sinusoidal fundamental in a selected linear-luminance ROI and records its exact source stage. Its [validation protocol](PRINT_DETAIL_VALIDATION.md) and [capability ledger](validation/print-detail-capabilities.json) distinguish mathematical conformance from blocked acquired-image, renderer and perceived-quality qualification.

package/docs/DIGITAL_OPTICS_FOUNDATION.md

@@ -1,6 +1,6 @@
 # Stray light and digital lens correction foundations
 
-Release context: **package 1.1.0 candidate / root API 1.1.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_1_0.md).
+Release context: **package 1.2.0 candidate / root API 1.2.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_2_0.md).
 
 Issues #114, #118 and #117 add standalone browser-safe primitives. They do not enable a production-plan stage, change the POC, or supply a calibrated camera/lens preset. The public root API advances from 0.94.0 to 0.95.0; each new profile/prepared-map schema is 0.1.0. Package, POC, production-plan and PSF versions are unchanged. This branch incorporates merged polygon-diffraction PR #157 and reconciles the root API increment with that predecessor.
 

package/docs/ENVIRONMENT_RAW_CAPTURE.md

@@ -1,6 +1,6 @@
 # Executed environment capture to native RAW
 
-Release context: **package 1.1.0 candidate / root API 1.1.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_1_0.md).
+Release context: **package 1.2.0 candidate / root API 1.2.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_2_0.md).
 
 `calculateEnvironmentSensorPhotoSignal()` executes one destination site's
 bounded environment exposure. `simulateEnvironmentSensorRawFrame()` applies that
@@ -50,9 +50,15 @@ the declared optical/provider envelope covers them.
   remains. Translation/parallax, world pose, breathing and distortion are absent.
 - Wavelength-resolved radiance with explicit air/vacuum basis. Any air photon
   energy context remains the existing sensor contract's responsibility.
-- Explicit unity field throughput with evidence and a limitation. Spatial
-  vignetting is not silently synthesized. Existing lens transmission/front-filter
-  inputs remain upstream of normalized PSF shape.
+- Explicit `unity` or `radial-illumination-vignetting` field throughput with evidence
+  and a limitation. The latter reuses the existing bounded radial profile and applies
+  attenuation once at every physical inverse-PSF source point, before normalized
+  PSF redistribution. Camera motion changes scene direction, not lens field position.
+  All taps, including zero-weight taps, must lie in the declared profile envelope
+  before any provider callback. Existing lens transmission/front-filter inputs remain
+  upstream of normalized PSF shape. This is an owned approximation, not calibrated
+  lens throughput or pupil vignetting. Production composition requires the explicit
+  `illumination-vignetting` fidelity effect, including a modeled-zero profile.
 - PSF is explicitly `not-applied` with evidence/limitation or `sampled-local`
   with the existing evidence-backed wavelength basis and local spatial model.
   Focal length, aperture and focus must match the optical bridge. The optional
@@ -185,3 +191,16 @@ The standalone adapter retains its conservative `productionPlanActivated: false`
 field: it cannot know whether a parent composer called it. The parent plan's
 actual stage results and executed lineage establish the bounded activation;
 no child source-truth flag is overwritten.
+
+## Additive field-throughput candidate
+
+Photo integration model 0.2.0 adds radial field-throughput input; unity arithmetic,
+provider/RAW resource limits and conservative verification flags remain unchanged.
+`test/environment-field-throughput.test.ts` independently integrates SI photon counts
+with radial attenuation, checks source-tap PSF weighting, exact unity-profile parity,
+physical field invariance under motion, profile ownership, full-frame preflight and
+replayable paired RAW/JPEG output. The production planner reports requested field
+attenuation as active or modeled-zero and blocks undeclared attenuation before callbacks.
+This candidate has not been tagged or published; the distribution version stays 1.2.0
+until the next release preparation. External chart/backend evidence belongs to its
+provider and does not become an engine calibration claim.

package/docs/EXPORT_ACCEPTANCE.md

@@ -1,6 +1,6 @@
 # Simulated Sensor RAW DNG / JPEG acceptance
 
-Release context: **package 1.1.0 candidate / root API 1.1.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_1_0.md).
+Release context: **package 1.2.0 candidate / root API 1.2.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_2_0.md).
 
 This record separates implemented export behavior, reproducible independent
 checks and external application acceptance for #16. The files are synthetic

package/docs/GENERIC_TIER_PRESETS.md

@@ -1,6 +1,6 @@
 # Generic equipment tier reference assets
 
-Release context: **package 1.1.0 candidate / root API 1.1.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_1_0.md).
+Release context: **package 1.2.0 candidate / root API 1.2.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_2_0.md).
 
 `resolveGenericEquipmentTierCatalog({ presetVersion: "1.0.0" })` returns immutable
 Consumer, Prosumer and Professional body/lens reference bundles. These are

package/docs/GEOMETRIC_PREPARATION_REUSE.md

@@ -1,6 +1,6 @@
 # Call-local geometry preparation reuse: #43
 
-Release context: **package 1.1.0 candidate / root API 1.1.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_1_0.md).
+Release context: **package 1.2.0 candidate / root API 1.2.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_2_0.md).
 
 `calculateGeometricSamplingPlan()` already parses and copies a complete transform
 list at its public boundary. It previously called the public scalar mapping API

package/docs/IMAGE_FORMATION.md

@@ -1,6 +1,6 @@
 # Image-Formation Contract
 
-Release context: **package 1.1.0 candidate / root API 1.1.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_1_0.md).
+Release context: **package 1.2.0 candidate / root API 1.2.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_2_0.md).
 
 Photivra's image-formation contract defines **scientific ownership, coordinate semantics, and dependency/coupling boundaries** for current and future camera effects.
 

package/docs/LINEAR_CAPTURE_ENCODING.md

@@ -1,6 +1,6 @@
 # Deterministic linear capture encoding: #15C
 
-Release context: **package 1.1.0 candidate / root API 1.1.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_1_0.md).
+Release context: **package 1.2.0 candidate / root API 1.2.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_2_0.md).
 
 `calculateLinearCaptureEncoding()` produces format-neutral unsigned 16-bit linear codes from one bounded inline `SimulatedCapture` plane. The exact plane/image-state identity is mandatory. The master stays unchanged; color, WB application, source reference value and upstream capture-saturation history accompany the encoded data. It neither chooses a file format nor invents a color conversion.
 

package/docs/MOTION_AND_SIGNAL.md

@@ -1,6 +1,6 @@
 # Motion and Signal Foundation
 
-Release context: **package 1.1.0 candidate / root API 1.1.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_1_0.md).
+Release context: **package 1.2.0 candidate / root API 1.2.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_2_0.md).
 
 ## Projected subject motion
 

package/docs/NATIVE_CAPTURE_SDR.md

@@ -0,0 +1,70 @@
+# Bounded native capture SDR execution
+
+`calculateNativeCaptureSdrPlan` and `createNativeCaptureSdrTask` are additive schema 0.1.0 APIs for authoritative external linear RGB manifests. They do not widen the unchanged `calculateCaptureSdr` or `calculateSdrRendering` reference guards. This is engine-declared tiling, with whole-capture identity and explicit ownership, rather than consumer request splitting.
+
+## Supported domain
+
+The selected `SimulatedCapture` plane must already be color-transformed linear sRGB/D65, exact profile version 0.1.0, co-sited RGB with resolved upstream WB or no WB required. All planes in the manifest must use external float32/float64 storage. The provider decodes declared little-endian bytes to the matching native typed numeric array. Precision is preserved; float32 is not promoted to a claim of original float64 fidelity. Reference white, signed values, headroom, capture saturation and source dynamic-range history stay distinct.
+
+XYZ, unresolved sensor/virtual RGB, pending WB, HDR, resampling, lens corrections and RAW generation are unsupported here. Complete color/WB through the engine-owned upstream contract before handing over this master. This executor never applies WB twice or generates a source from a preview. The upstream renderer/source still needs qualification; structural metadata is not proof of correct pixels or calibration.
+
+Coordinates are absolute top-left, +X right/+Y down in the plane's declared `oriented-active-capture` or `output` raster. Crop and physical orientation are already committed in the capture geometry and represented by the provider's plane. The executor preserves them without re-cropping, rotating, padding image edges or resampling. The output dimensions exactly equal the selected plane. Geometry includes later output intent even when the selected active-capture plane precedes that intent; this call does not execute that later crop.
+
+## Limits and ownership
+
+Maximum raster is 24,000,000 pixels, each dimension at most 16,384. Every tile is at most 256 × 32 pixels; right/bottom tiles use their actual remaining dimensions. A tile has RGB row stride in component samples, at least width × 3. Its length must exactly equal stride × height. Padding is ignored. The entire backing buffer, including offset/slack, is bounded to 32,768 components in the declared float precision. SharedArrayBuffer is rejected; provider must not mutate, detach or reuse its returned tile. No tile/output network, persistence or decoder is built into the engine.
+
+A task allocates one tightly packed Uint8Array or Uint16Array output only after admission planning. `maximumOutputBytes` must admit the exact width × height × 3 × bytes-per-code. The maximum retained output is 72 MB at 8 bits or 144 MB at 16 bits, decimal units. The input master remains external and is not retained/copied wholesale. At most one tile read is in flight.
+
+`maximumScratchPayloadBytes` is 1,441,792 bytes: one maximum float64 provider payload plus six bounded double-array payloads (packed input, parsed input, tone, gamut, transfer, codes). This counts logical numeric payloads, not JS array headers, temporary validation booleans, GC retention, decoder/GPU memory or platform overhead. It is **not** a heap/process/device peak guarantee. Callers must budget output plus measured runtime/decoder/source retention and reject unsupported devices before starting. No full-size floating-point diagnostic arrays are retained.
+
+## Processing and identity
+
+Each tile delegates to the unchanged bounded SDR reference. Exposure normalization → selected tone curve → gamut policy → sRGB transfer → nearest-ties-up integer quantization is pointwise, so tiling adds no halo, seam, altered rounding or second camera-science implementation. Counts are aggregated over actual image components; capture saturation is preserved in the plan and remains `not-consumed` in downstream rendering diagnostics. The reference's output encoding and external display-adaptation declaration accompany the output.
+
+The frozen plan retains the full parsed capture: creator/schema, source artifact/hash/history, scene/time, seed/noise/model/evidence, exposure/focus/WB, geometry/plane/color/transform identities, new output state ID and complete rendering profile. Every request and response must match capture ID, plane ID, source artifact/hash and exact rectangle. A digest match is an identity declaration, not verification of sample bytes: the provider owns authenticating the external artifact against its whole-file hash before decoding. No partial-file hash is relabeled as a full source hash.
+
+## Task lifecycle
+
+`ready → running → completed → transferred` is single-use. `run()` resolves without publishing a buffer. `takeOutput()` transfers the retained buffer once, along with its plan/encoding/diagnostics. Caller owns the returned mutable integer array; an immutable capture manifest does not make output bytes immutable. Dispose/cancel cannot revoke a transferred buffer.
+
+Before transfer, cancel/dispose aborts the provider signal, clears/releases any engine output, and prevents publication. `run()` rejects after a pending read/yield settles; providers must honor abort and release their resources. A non-cooperative pending callback cannot be forcibly stopped by this API. Caller must await settlement before reclaiming shared provider resources or launching replacement work on them. Failed tasks release partial output and abort the provider signal. A fresh admitted task is the recovery path; no automatic retry/fallback exists.
+
+The provider's required `yieldControl(signal)` must yield to the host event loop between tiles (for example an abort-aware timer, scheduler or worker handoff). A resolved promise alone does not let browser input/timer cancellation run. Host scheduling is external to the scientific package. Check current application capture identity before transferring/installing a completed output; a disposed older task cannot publish late.
+
+## Acceptance and release
+
+`test/native-capture-sdr.test.ts` compares the unchanged capture reference across tile edges, row padding, 8/16-bit encoding, upstream WB and all four committed orientations/off-center crops. It checks invalid/stale/oversized domains, finite image data, float precision, pending-read cancellation, between-tile cancellation, disposal, ownership transfer and recovery, plus independently predicted pixels in a 1.2 MP synthetic raster.
+
+See [the validation record](NATIVE_CAPTURE_SDR_VALIDATION.md) for measured host-specific evidence and [the technical review](NATIVE_CAPTURE_SDR_REVIEW.md) for the remaining human/source certification gates. Run `node --expose-gc scripts/benchmark-native-capture-sdr.mjs` after build for deterministic 6 MP/24 MP timing and sampled process memory at both 8 and 16 bits. Measurements are host-specific and use owned analytic samples, not licensed photographs or calibration. The packed example below runs through the real root package during consumer acceptance.
+
+```ts
+import { createSimulatedCapture, createNativeCaptureSdrTask, LINEAR_CAPTURE_RGB_PROFILE, resolveCaptureColorModel } from "@photivra/engine";
+const capture = createSimulatedCapture({
+  captureId: "native-example", sceneStateId: "analytic-scene", sceneTimeSeconds: 0,
+  geometry: { imagingArea: { widthMm: 36, heightMm: 24 }, nativeRaster: { pixelWidth: 2, pixelHeight: 1 }, orientation: "landscape" },
+  exposure: { focalLengthMm: 50, aperture: 4, shutterSeconds: .01, iso: 100 }, focus: { kind: "infinity" },
+  noise: { seedUint32: 0, realizationId: "none", model: { id: "analytic-noise-zero", version: "1" } },
+  source: { kind: "color-transformed-linear-master", artifactId: "analytic-source", sha256: "a".repeat(64), dynamicRangeHistory: "no-loss-declared" },
+  whiteBalanceIntent: null, adoptedWhiteXyz: null,
+  models: [{ profile: LINEAR_CAPTURE_RGB_PROFILE, scientificStatus: "calculated", publicEvidenceIds: ["photivra:analytic-example"] }],
+  planes: [{ id: "rgb", imageStateId: "linear-state", imageState: "color-transformed-linear-rgb", rasterBinding: "oriented-active-capture",
+    pixelWidth: 2, pixelHeight: 1, channelIds: ["red", "green", "blue"], colorProfile: LINEAR_CAPTURE_RGB_PROFILE,
+    encodingReferenceWhiteXyz: resolveCaptureColorModel().referenceWhiteXyz, referenceWhiteValue: 1, whiteBalanceApplication: "not-applicable",
+    captureSaturation: { kind: "not-modeled" }, appliedTransforms: [{ kind: "linear-color", profile: LINEAR_CAPTURE_RGB_PROFILE }],
+    storage: { kind: "external-float64", byteOrder: "little-endian", artifactId: "analytic-rgb", sha256: "b".repeat(64), sampleCount: 6 } }]
+}).value;
+// Digests here are synthetic identity placeholders, not verified artifacts.
+const task = createNativeCaptureSdrTask({ capture, sourcePlaneId: "rgb", outputImageStateId: "sdr-state", maximumOutputBytes: 6,
+  profile: { schemaVersion: "0.1.0", profileId: "neutral", profileVersion: "1", renderingExposureEv: 0, toneCurve: "identity",
+    gamutHandling: "clip-components", outputDynamicRange: "sdr", transferFunction: "srgb", bitDepth: 8, rounding: "nearest-ties-up", dither: "none" }
+}, {
+  async readTile(request) { return { ...request, rowStrideSamples: 6, samples: new Float64Array([0, .5, 1, 1, .5, 0]) }; },
+  async yieldControl() { await new Promise<void>(resolve => setTimeout(resolve, 0)); }
+});
+await task.run();
+const output = task.takeOutput();
+if (output.integerSamples.join(",") !== "0,188,255,255,188,0") throw new Error("Native SDR example failed");
+```
+
+Human review, merge, version/tag and npm publication are separate release steps. Consumer activation requires the published reviewed contract, a qualified native producer and measured device budgets. This API does not activate a production plan or qualify app fixtures, Print/JPEG delivery, GPU rendering or devices.

package/docs/NATIVE_CAPTURE_SDR_REVIEW.md

@@ -0,0 +1,37 @@
+# Native capture SDR candidate review
+
+Technical review date: 2026-10-03. Initial PR #216 head: `1bfdb87c6111299dda4649b03d787e6aff60cf15`; base: `a57bdecd73e1b64ab404415ae95494423756286a`. This record and its follow-up tests are AI-assisted draft material. They support, but do not supply, the substantive human review required by [repository instructions](../AGENTS.md) and [provenance policy](PROVENANCE.md#ai-assisted-work).
+
+## Scientific and execution assessment
+
+The new executor calls the existing `calculateSdrRendering` for every tile. Its supported exposure normalization, tone curve, gamut policy, transfer and quantization are component-local; no operation needs neighboring pixels or full-frame statistics. Consequently a tile partition preserves the reference arithmetic. The reference implementation and its 262,144-component guard are unchanged. New parity tests compare every integer component and aggregate diagnostics across 256-column/32-row boundaries using both declared float precisions, both bit depths, both tone curves and both gamut policies. Float32 comparisons use the actual float32-rounded source values; they do not assert float64 fidelity. Independent endpoint/tie and megapixel-coordinate tests supplement shared-implementation parity.
+
+The source parser enforces RGB channel order, plane dimensions/binding, transform history, external layout, finite positive reference white and capture identities. Planning adds the exact linear-sRGB/D65 profile/reference white, completed WB state, fresh output state, representable rendering scale, raster caps and output admission. A valid capture containing pending WB intent is deliberately rejected. Four oriented off-center active-capture cases now compare actual reference pixels as well as retained geometry. Later output crop intent stays in the capture; this API does not execute that crop on an active-capture plane.
+
+The [ICC sRGB registry](https://registry.color.org/rgb-registry/srgb), checked on the review date, supports the unchanged transfer constants, primary/white coordinates and 80 cd/m² encoding reference. These are mathematical/encoding facts, not a calibrated camera, perceptual gamut mapping or a display measurement. Exposure is post-capture rendering scale; positive per-channel Reinhard can alter chromaticity. Capture saturation, noise, source range history and physical exposure are retained separately from output clipping. No new physical equation, WB estimator, serializer, correction/resampler or production stage is introduced.
+
+## Source and resource assessment
+
+The change introduces no runtime dependency or copied third-party image, profile binary, calibration dataset or implementation. The benchmark generates a coordinate ramp directly into bounded tiles. Its source SHA declarations are explicitly synthetic placeholders. The ICC reference is used to check numerical facts; no reference prose/code/data is incorporated by this review. These observations do not certify original authorship, rights to distribute or absence of patent claims. Contributor review and DCO remain required.
+
+Admission precedes retained output allocation and tile acquisition. Provider backing storage is bounded, not just its visible view. Precision/rectangle/source identifiers and exact stride length are checked; padding is ignored and nonfinite image values fail. SharedArrayBuffer rejection now has a regression. Logical scratch is provider storage plus packed input, parser copy and four reference output arrays: `32768 × 8 + 256 × 32 × 3 × 8 × 6 = 1,441,792` bytes. JS allocation/GC overhead and provider/device memory are excluded. Retained output limits are 72 MB at 8 bits and 144 MB at 16 bits.
+
+The task keeps partial output private, clears it on failure/cancel/dispose, and transfers it once. Activity is checked after both acquisition and host yield. Added tests cover disposal while a yield is pending, late settlement, and real timer cancellation. A provider that ignores abort can still delay settlement; caller resource reuse requires draining the pending run. Host scheduling, artifact authentication and source/device admission remain caller responsibilities. Identity declarations do not authenticate supplied samples.
+
+## Compatibility and release assessment
+
+Package, lock root, citation and engine API are aligned at 1.2.0. Schema, model, POC and plan identities remain independent. The runtime diff adds a root module/export and version increment; it does not alter existing rendering equations or API contracts. Archived JPEG fixtures, manifest bytes/hashes and independent decoder evidence are unchanged. Golden replay uses the recorded creator, while a separate current-creator regression checks current exports and identical integer pixels.
+
+The follow-up corrects 49 current release-context headers to 1.2.0 and links them to the current release procedure. Historical introduction/measurement values are retained. The additional 24 MP/16-bit benchmark measures the maximum retained code buffer; see [validation evidence](NATIVE_CAPTURE_SDR_VALIDATION.md). No universal performance threshold follows from those measurements.
+
+Full local check and coverage passed with 1,739 tests on Node 26.8.1. Coverage: statements 91.94%, branches 88.36%, functions 99.62%, lines 91.89%. Build, generated reference/docs, packed typed consumers, package surface and image-formation benchmark passed. Local HTTP tests required port access outside the sandbox; package dry-run used a writable temporary npm cache. The original head passed all four Node CI jobs. Follow-up-head CI must also pass before merge. Repository search found no other open engine PR requiring version reconciliation. Public npm lists 1.1.0 as its newest version and no 1.2.0; the remote `v1.2.0` tag is absent as of this review.
+
+## Remaining owner gates
+
+- Substantive human scientific/source review of the final diff, supported domains, provider obligations and evidence. No human review submission was present during the initial inspection.
+- Contribution-specific DCO certification. Neither original PR commit contains `Signed-off-by`; this AI-assisted follow-up does not assert the contributor's certification. Resolve the complete candidate's certification before inclusion, without fabricating or silently rewriting sign-offs.
+- Green supported Node CI at the final reviewed head, then mark ready and merge through repository protections.
+- Verify final-main CI/tree, main/tag protections and npm trusted-publishing configuration before separately approved tagging/publication. Repository workflow checks those release prerequisites; this review does not verify account-side configuration.
+- Keep #215 publication acceptance and downstream producer/device activation pending until the reviewed distribution exists and their separate evidence is supplied.
+
+No merge, tag or publication is authorized by this review record. Follow [the release procedure](RELEASE_1_2_0.md) after the required owner gates.

package/docs/NATIVE_CAPTURE_SDR_VALIDATION.md

@@ -0,0 +1,34 @@
+# Native capture SDR validation
+
+This is owned synthetic mathematical/resource evidence for schema 0.1.0. It is not device/backend qualification, calibrated camera accuracy, source artifact authentication or human review. Public contract and limitations are in [bounded native SDR](NATIVE_CAPTURE_SDR.md).
+
+On 2026-10-03, Node 24.19.0 on darwin/arm64, the repository benchmark produced these sampled values. It yields with setImmediate and evaluates an analytic RGB ramp directly into bounded float64 tiles, so it does not allocate a full-size linear source. Source/digest declarations are synthetic placeholders. Baseline process memory is sampled before each raster; GC runs between cases but does not necessarily return resident memory to the OS. These are sequential runs in one process, not clean-start comparisons.
+
+| Raster | Codes | Elapsed | Output payload | Largest provider tile | Sampled peak RSS | Sampled peak heap |
+| --- | --- | --- | --- | --- | --- | --- |
+| 3000 × 2000 | 8-bit | 2.310 s | 18.0 MB | 196,608 bytes | 229.49 MB | 84.28 MB |
+| 6000 × 4000 | 8-bit | 9.120 s | 72.0 MB | 196,608 bytes | 317.54 MB | 93.44 MB |
+| 3000 × 2000 | 16-bit | 2.335 s | 36.0 MB | 196,608 bytes | 312.49 MB | 83.21 MB |
+
+Raw measurements, baseline values and output hashes are retained in [the machine-readable record](validation/native-capture-sdr-darwin-arm64.jsonl). Earlier development-candidate runs produced the same 8/16-bit output hashes; the retained record is from the aligned 1.2.0 candidate. The 16-bit hash describes typed-array backing bytes in this host's endian order, not a portable serialized format. No peak-allocation guarantee or CPU/device threshold is inferred from sampling. The 1,441,792-byte logical tile scratch bound excludes JS object/array/GC overhead; the measurements visibly exceed it. Provider/master/GPU/encoder retained costs remain external caller obligations.
+
+Regression acceptance compares exact integer pixels, encoding and aggregate clipping diagnostics against the unchanged reference for 259 × 33 rasters crossing all tile boundaries, at 8/16 bits. Additional tests cover upstream engine-resolved WB, all four oriented off-center capture geometries, ignored stride padding, float32/float64, Reinhard, independent sRGB rounding/tie endpoints, 1.2 MP global pixel coordinates, rejected source/color/state/resource inputs, stale rectangles/identities, oversized backing buffers and nonfinite image samples. Lifecycle tests cover pending-read and between-tile aborts, late completion, explicit output transfer, failed host yield, cancellation/disposal of ready/completed tasks, immutable setup/callback commitments and fresh-task recovery.
+
+Initial candidate validation: 1,735 tests passed under full coverage; statements 91.94%, branches 88.36%, functions 99.62%, lines 91.89%. Static/security/license/SPDX/identity/browser gates, build, generated documentation and packed consumer acceptance passed. The packed acceptance executes the new typed root-import example independently of the source checkout. Package dry-run passed with root exports only. CI repeats standard acceptance on Node 22.13/22/24/26 and the native-raster benchmark on Node 24.
+
+## Technical review follow-up
+
+The [review record](NATIVE_CAPTURE_SDR_REVIEW.md) documents scientific/source/execution assessment and outstanding human/DCO gates. The follow-up adds exact float32/float64 parity across both tone/gamut policies and code depths, reference pixels for all four off-center orientations, valid-container pending WB rejection, shared backing-buffer rejection, pending-yield disposal and actual timer cancellation. Full local checks and coverage passed with 1,739 tests on Node 26.8.1; the coverage percentages above are unchanged.
+
+On 2026-10-03, Node 26.8.1 on the same darwin/arm64 host, a sequential benchmark run after the test/consumer checks completed produced:
+
+| Raster | Codes | Elapsed | Output payload | Largest provider tile | Sampled peak RSS | Sampled peak heap |
+| --- | --- | --- | --- | --- | --- | --- |
+| 3000 × 2000 | 8-bit | 2.346 s | 18.0 MB | 196,608 bytes | 190.64 MB | 90.03 MB |
+| 6000 × 4000 | 8-bit | 9.114 s | 72.0 MB | 196,608 bytes | 258.82 MB | 80.96 MB |
+| 3000 × 2000 | 16-bit | 2.294 s | 36.0 MB | 196,608 bytes | 280.15 MB | 93.14 MB |
+| 6000 × 4000 | 16-bit | 9.167 s | 144.0 MB | 196,608 bytes | 412.14 MB | 80.92 MB |
+
+The [follow-up machine-readable record](validation/native-capture-sdr-darwin-arm64-node26-review.jsonl) preserves baselines, sampled peaks and hashes. All three earlier raster/code-depth hashes agree with the original Node 24 record. The new maximum 24 MP/16-bit backing-byte hash is `b4ab10fe9f6b8f083c5637561aa2a61fe447774b86504a8551b8cc784c815626`. Its host-endian interpretation and all earlier resource/source qualification limitations apply. Earlier measurements are retained; differences across runtimes/runs do not establish a performance improvement.
+
+The package/root candidate identity is 1.2.0, aligned with lock/citation and regenerated references. npm registry verification on 2026-10-03 found 1.1.0 as the latest published version and no 1.2.0 distribution. Follow [the 1.2.0 release procedure](RELEASE_1_2_0.md) after human review to run exact tag/publish gates. No existing published version is overwritten; implementation, human review, merge and publication are separate. #215's publication acceptance remains pending until that reviewed distribution exists. A consumer still requires a qualified authoritative RGB producer and measured device budgets before production activation.

package/docs/NUMERICAL_CORRECTNESS.md

@@ -1,6 +1,6 @@
 # Numerical Correctness and Physical Units
 
-Release context: **package 1.1.0 candidate / root API 1.1.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_1_0.md).
+Release context: **package 1.2.0 candidate / root API 1.2.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_2_0.md).
 
 Photivra is a scientific engine. Numerical behavior and physical-unit meaning are public-contract concerns, not implementation details.
 

package/docs/PERFORMANCE_BASELINE.md

@@ -1,6 +1,6 @@
 # Measured-performance baseline: #43 / #45
 
-Release context: **package 1.1.0 candidate / root API 1.1.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_1_0.md).
+Release context: **package 1.2.0 candidate / root API 1.2.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_2_0.md).
 
 This independent first slice records merged main `83a99a4c1ec525fd1add7cccff134fcee0f5159b`, root API 0.93.0, POC API 0.20.0, in `docs/benchmarks/2026-10-01-main-baseline.json`. No pending capture/output/correction/preset implementation is consumed. It does not close either issue or justify an optimization by itself.
 

package/docs/PHOTOGRAPHIC_EXPORT.md

@@ -1,6 +1,6 @@
 # Simulated Sensor RAW DNG / JPEG export
 
-Release context: **package 1.1.0 candidate / root API 1.1.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_1_0.md).
+Release context: **package 1.2.0 candidate / root API 1.2.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_2_0.md).
 
 Current producer-derived files and external closure gates are recorded in
 [Export acceptance](EXPORT_ACCEPTANCE.md). The new reproducible generator uses

package/docs/PHYSICS_FOUNDATION.md

@@ -1,6 +1,6 @@
 # Physics Foundation
 
-Release context: **package 1.1.0 candidate / root API 1.1.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_1_0.md).
+Release context: **package 1.2.0 candidate / root API 1.2.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_2_0.md).
 
 Photivra starts with analytical models that can be independently tested and whose assumptions can be stated explicitly.
 

package/docs/POC_API.md

@@ -1,6 +1,6 @@
 # Local POC Simulation API
 
-Release context: **package 1.1.0 candidate / root API 1.1.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_1_0.md).
+Release context: **package 1.2.0 candidate / root API 1.2.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_2_0.md).
 
 Photivra includes a minimal Node HTTP transport for proof-of-concept development and integration testing.
 

package/docs/POC_PROJECTION_REUSE.md

@@ -1,6 +1,6 @@
 # Request-local defocus projection reuse: #45
 
-Release context: **package 1.1.0 candidate / root API 1.1.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_1_0.md).
+Release context: **package 1.2.0 candidate / root API 1.2.0**. Subsystem/model versions and dated introduction or measurement records below are independent historical identities; they are not distribution versions. See [developer navigation](DEVELOPERS.md) and [release contract](RELEASE_1_2_0.md).
 
 The measured candidate reuses the focus-plane image distance already calculated
 inside `simulatePocCamera()` for its subject and defocus sweep. It is a small

package/docs/PRINT_195_196_REVIEW.md

@@ -0,0 +1,93 @@
+# Print #195 / #196 candidate evidence and release review
+
+Historical candidate record, retained without relabeling its original evidence. PR #217 subsequently received owner approval and was merged; see the [current engine acceptance audit](PRINT_196_ENGINE_ACCEPTANCE.md) for approval identity, additional native-capture evidence and engine/app gate ownership.
+
+This record accompanies the 1.2.0 candidate. It preserves the full #196 acceptance gate: bounded computational conformance does not close the device/backend, proof UI or natural-image perception obligations of the full new-UI release. Engine publication precedes dependent app integration; app acceptance is not treated as an engine dependency cycle. No tag or distribution is created. Historical 1.1.0 diagnostic ledgers and JPEG artifacts remain unchanged.
+
+## Planning acceptance (#195)
+
+The existing public planner is tested against an independent exhaustive sample-count search for stamp, book, home, gallery, billboard and distant large-sign conditions on one immutable retained source. Heavy off-center crops expose insufficient native sampling. Smaller-size alternatives recover only within the original exact integer aspect family. Zero physical dimensions are rejected and a corrected request recovers. Enlarged delivery dimensions do not create native sampling. These are planning checks, not source-quality claims. See `test/print-plan-acceptance.test.ts` and [the planning contract](PRINT_PLANNING.md).
+
+## New diagnostics and independent references
+
+The [linear statistics protocol](PRINT_REGION_STATISTICS.md) separates paired processing changes from independent-repeat temporal sample variance. The [contrast reference](PRINT_CONTRAST_REFERENCE.md) exposes a restricted static neutral D65 Gabor model estimate with explicit luminance and reference-observer conditions. It does not label a photograph visible, sharp or printable.
+
+| Experiment | Executed backend | Independent reference | Supported meaning |
+| --- | --- | --- | --- |
+| Registered differences and repeats | New bounded scalar statistics | Exact binary64 rational arithmetic / high precision RMS | Finite arithmetic and sample statistics, not acquisition calibration |
+| PSF/aperture detail | Public local PSF + spatial/spectral quadrature | Sparse complex transfer, midpoint aperture sum and continuous sinc | Owned neutral periodic signal; finite kernels; all orientations; off-center ROIs |
+| Photocharge noise | Public accumulated-charge / seeded realization | Poisson mean and variance-of-sample-variance moments | Independent seeded ideal photocharge, 4 sites, 32–256 repeats; no ADC/read noise |
+| Electronic noise and clipping stages | Public native RAW producer, including dark/photo Poisson, storage capacity, read noise and 12-bit ADC | Exact rational charge-injection stage predictions; compound Poisson/Gaussian moments; deterministic half-code error bound | Owned 2×2 electronic reference; independent repeats at 32–256 counts; signed pre-ADC signal and unsigned code clamp; no source radiometry or device calibration |
+| Source-to-capture handoff | Public production environment capture + native RAW + processed-output path | Independent 80-digit SI radiance-to-photoelectron arithmetic | Owned uniform 540–560 nm band; QE 0.4; transmission 0.85; 8 ms; 2×2 native; four radiance scales; no real source/device calibration |
+| JPEG processing changes | Public SDR/JPEG exporter, archived independent Pillow/libjpeg decode | Exact decoded neutral scalar paired differences | Exact preserved JPEG bytes, orientation, stage and source hashes; no automatic artifact classifier |
+| Subject depth / intentional defocus | Shared thin-lens geometry + public complex-pupil propagation + owned visible-plane provider | Separate finite complex DFT and ray-plane reference | 2/5/10 m overlapping static planes; 5 m focus; f/8,16,32; 500 nm; 9×9 ideal pupil; interior ROIs |
+| Pupil sampling pilot | Public finite complex-pupil propagation with separately varied pupil resolution and padding | Independently factored finite DFT; continuous shifted-pupil overlap integral; analytic focused circular-pupil transfer | 25 cycles/mm; 500 nm; 2/5/10 m; f/8,16,32; final padded 61×61 grid below 0.01 absolute transfer error; no all-frequency or device certificate |
+| Translation motion | Public local exposure timing + translation/parallax nodes + owned periodic plane accumulation | Closed finite geometric transfer and continuous exposure sinc | Constant depth/visibility; 2/5/10 m; camera/subject velocity 0/1 m/s; 20 ms; 2–32 nodes |
+| Changing source visibility | Public production environment capture + native RAW + processed-output path, with owned moving two-plane provider | Exact rational ray/interval occupancy and continuous-exposure visibility fraction | Foreground 2 m / background 10 m; static camera; point optics; 8 ms; native X/Y motion; 2–128 midpoint nodes; no PSF/depth-edge blur or device qualification |
+| Physical proof reference | Owned PDF wrapper around exact archived JPEG streams; existing public Print planner | Exact Fraction physical-unit/ROI reference; separate pypdf graphics-state/DCT inspection; rendered visual inspection | Same retained crop at two enlargements and same-scale q1/q32 comparison; nominal A4 geometry/ruler only; no actual printer/UI/device or perception qualification |
+| Static contrast reference | Restricted castleCSF equation adapter | Independent 80-digit Decimal arithmetic | Numerical model conformance only; no new psychophysics or individual observer calibration |
+
+All generator inputs and JSON expected outputs are committed under `test/fixtures/print-detail/`; tests pin reference SHA-256. References never import the engine or derive expected values from its output. Every new scene/provider is owned draft material, not a private app fixture or camera dataset. These test adapters execute the named public backend; they do not qualify an unnamed renderer or device by association.
+
+## Finite-focus propagation correction
+
+The depth experiment exposed that the complex-pupil reference used nominal focal length for image sample pitch even when finite focus metadata was present. Model 1.1.0 adds explicit `propagationDistanceMm` and returns the distance/source. Omission preserves all legacy kernel values. The owned principal-plane fixture explicitly passes the shared thin-lens image distance. Real exit-pupil geometry needs separate evidence. No blur-diameter-to-PSF approximation or duplicate camera equation is introduced. See [PSF foundation](PSF_FOUNDATION.md).
+
+The new depth test is a finite scalar pupil conformance test. Its 9×9 pupil grid is **not** a continuum convergence certificate. The new independent pilot demonstrates intensity aliasing in that unpadded reference, including absolute transfer errors above 0.14 at f/32. A separately padded 61×61 grid satisfies a candidate 0.01 transfer-error criterion only at the declared 25 cycles/mm frequency and nine depth/aperture combinations; see [the pupil sampling pilot](PSF_FOUNDATION.md). Existing 9×9 outputs are not retrospectively certified. All finite taps for every selected ROI must hit the same visible surface. Depth-edge diffraction/occlusion composition, moving visibility, lens distortion and corrections are unsupported by that experiment. A background explicitly marked intentional defocus never becomes failed source quality.
+
+The motion reference checks continuous-exposure convergence and separately composes camera and subject velocities. It does not use an endpoint chord as a PSF, change exposure from readout duration, or authorize one homography across depths. PSF/aperture tests independently check spatial quadrature convergence. Stochastic repeat-count checks use predeclared broad moment bands; random sample estimates need not converge monotonically and these bands are not confidence intervals for a photograph.
+
+### Linear/high-bit electronic readout qualification
+
+`test/print-region-readout-backend.test.ts` invokes `simulateSensorRawFrame()` with an owned 2×2 native reference and 12-bit ADC in the existing 16-bit container. Exact deterministic charge-injection experiments independently isolate storage saturation, pre-ADC upper saturation, final digital saturation and rounding without clipping. The Python rational oracle includes threshold contact and half-code ties; successful output at a boundary alone is not interpreted as an unknown clipping mechanism. Backend flags and exact stage values must match the independent declared experiment. Source radiometry stays explicitly unverified.
+
+The stochastic experiment uses photo mean 200 electrons, dark mean 8 electrons and read-noise RMS 0 or 2 electrons, with predeclared 32/64/128/256 repeats and independent capture/representation/realization IDs. For unclipped pre-ADC signal, the independent compound variance is `photoMean + darkMean + readRms²`; the fourth central moment is `photoMean + darkMean + 3 variance²`. Those moments determine the broad sample-mean/sample-variance conformance bands. After the 12-bit ADC, each decoded sample's rounding error is bounded by half a code times the declared gain; the RMS change is bounded deterministically without assuming independent uniform quantization noise. All observed upper/lower clipping flags must be false for that unclipped experiment.
+
+A separate zero-photo/zero-dark, 8-electron read-noise experiment verifies that negative electronic signal survives the pre-ADC stage. With zero black pedestal, the final unsigned code clamp produces a positive bias consistent with independent rectified-normal mean `sigma/sqrt(2 pi)`. The before/after comparison uses the same immutable capture and noise realization. Changing draws cannot stand in for a processing effect.
+
+The scalar diagnostic encoding is an explicit ideal neutral relative signal scaled by electrons per reference unit. It is conditional electronic model conformance, not a calibrated radiance/luminance transform or a claim that charge injection photographed a scene. Spatial texture, CFA color interpretation, real sensor read noise, temporal correlations, actual photo-source transport and display/render clipping remain separately unassessed. The native RAW producer's `upstreamRadiometryVerified: false` is preserved. This extends the public model evidence; it does not close actual capture/device qualification or certify the private app noise fixture.
+
+### Source-to-capture qualification and artifact identity
+
+`test/print-region-capture-backend.test.ts` executes the actual public production environment-capture plan, rather than injecting all photocharge directly. An owned uniform-radiance variant of the existing basic reference supplies a constant 540–560 nm spectral band. The independent Decimal SI oracle predicts generated photoelectrons from declared radiance, working f-number, transmission, native geometric aperture, wavelength, QE and duration at four radiance scales. The plan executes 32 frozen provider queries, binds actual RAW to processed output, preserves source transport/radiometry as unverified, and deterministically replays the same capture. A paired pre-ADC/decoded-16-bit diagnostic checks the half-code rounding bound with the same noise realization. Changing physical print dimensions leaves captured samples unchanged. This is bounded public computational backend qualification; it does not establish physical calibration, a megapixel producer, source headroom, or actual visibility transport.
+
+The PSF orientation references now hash the complete actual oriented scalar raster and give each orientation a distinct representation identity. Depth references hash a complete 200×200 Float64LE scalar artifact and extract the tested ROI from it. That artifact continues the selected ideal plane outside its qualified interior region; no depth-edge or other-surface rendering claim is made for those pixels. Every finite PSF tap for the selected ROI must still resolve to its declared visible surface. The ideal field-invariant pupil records the selected field coordinate explicitly. These are owned analytic references, not a reconstructed full 3D photograph or an actual-device calibration.
+
+### Changing-visibility source qualification
+
+`test/print-region-visibility-backend.test.ts` drives the actual public production capture path with an owned nearest-surface provider. A foreground half-plane at 2 m translates along world X or Y; its edge starts at −0.5 m and moves at 125 m/s during the 8 ms exposure. A uniform farther plane at 10 m supplies radiance wherever the near plane is absent. The two spectral radiance levels are 0.5 and 1.5 times the previously independently predicted flat-band source. Engine-owned outgoing rays drive metric near-plane intersections; the provider does not introduce a second camera projection or an endpoint blur kernel.
+
+A separate exact Fraction oracle derives source-aperture ray slopes, native-Y inversion, visibility transition times, finite midpoint occupancies and continuous-exposure source means. Tests use 2/4/8/16/32/64/128 time nodes and both motion axes. The 128-node cases exposed a Node 24 coverage timeout. Every query is checked with direct fail-fast conditions, and replay compares a SHA-256 digest of all finite serializable scientific results. After those harness improvements, both full capture/replay cases still took 6.5–6.7 seconds in CI coverage; the fixture therefore has an explicit 15-second deadline. It is a numerical qualification fixture, not a performance gate. All cases, independent bounds and replay checks remain; the regular suite retains its default five-second deadline. The finite/continuous source-scale error is bounded by the unit radiance step divided by node count; it need not decrease monotonically for a discontinuous edge. All 16N callbacks per complete native 2×2 capture must execute. Actual photoelectron expectations, RAW/processed-output binding and deterministic replay are checked. Each execution has an explicit capture identity, and its snapshot commits the selected time-node count.
+
+This qualifies only this owned moving-source provider and the named public integration path. The engine's `sceneVisibilityCalculated: false`, `providerTransportVerified: false` and `upstreamRadiometryVerified: false` remain unchanged: the engine has not acquired a general scene/transport solver. Point optics and the stated rectangular aperture are explicit. PSF/defocus at moving depth edges, rolling readout, camera translation/rotation, corrections, edge-grazing semantics, other geometry, source calibration and private renderer/device behavior require separate evidence. It does not certify full #196 or a printable depth proof.
+
+### Physical proof artifact and independent inspection
+
+The committed [two-page physical proof reference](../output/pdf/print-proof-reference.pdf) reuses the exact existing post-encoding JPEG streams and selected native 16×8 crop. Page 1 prints the same JPEG/crop at full-source widths of 1 and 4 inches. Page 2 compares quantizer-step 1 and 32 representations of the same capture and crop at identical physical scale. No fixture family, new source per print size, resampling or interpolation uplift is introduced. The older JPEG bytes, hashes, capture IDs and 1.1.0 creator identity remain unchanged.
+
+An offline ReportLab generator derives millimeters/PDF points using exact Fraction arithmetic. A separate pypdf inspector reads actual MediaBox, graphics transforms, clip rectangles, embedded image dimensions, original DCT bytes, default interpolation policy and the nominal 100 mm calibration line. It maps native top-down ROI corners through the actual PDF transform and compares independent physical-unit expectations at less than 0.0001 PDF point serialization tolerance. Public-root tests bind the pinned PDF/inspection/manifest hashes and compare the existing Print planner's retained raster, crop geometry and PPI to the independently inspected reference. The 16×8 crop remains 16×8 at both enlargements. Generator reproduction is deterministic, with image resources based on byte content rather than checkout paths. Both final pages were rendered and visually inspected.
+
+This is public artifact/geometry evidence, not a new runtime PDF exporter or a qualified product proof workflow. The source is the existing owned post-ADC grating, not physical source/optics qualification. PDF DeviceRGB appearance, viewing luminance, substrate, actual printer scale and user/device handling remain unqualified. The calibration line's actual printed length must be measured. There is no embedded font program, added runtime dependency or private code/asset. The independent inspector is an optional offline pypdf tool; normal Node CI verifies committed artifact/record integrity and engine geometry without requiring Python packages. Human/source review and full #196/#307 physical proof integration remain open.
+
+## Source and reuse review
+
+The castleCSF numeric model material is pinned to upstream `f4b0b722af83001d7af979281e06ca642d36e4e8`. MIT notices are retained in [the license](licenses/castleCSF-MIT.txt), `NOTICE` and `THIRD_PARTY.md`. No observational CSV or separately licensed dataset is incorporated. The public [primary paper](https://pmc.ncbi.nlm.nih.gov/articles/PMC10996938/) supplies scientific context; upstream numerical conformance does not supply a new observer experiment. Quadratic paraxial pupil phase and finite propagation are consistent with the scalar diffraction framework described by [Braat and colleagues](https://nijboerzernike.nl/_PDF/BraatProgOpt2007OwnVersion20080515.pdf); no text, figures, tables or implementation from that source are copied.
+
+Substantive human scientific/source and contribution-specific DCO review remains pending for this new change. Approval of PR #216 does not certify these new coefficients, adapter, protocols or owned test material.
+
+## Candidate checks
+
+On Node 26.8.1, all 2,065 tests in 159 files pass; the full suite also passes with coverage on Node 24.19.0. Coverage is 92.04% statements, 88.55% branches, 99.63% functions and 92.04% lines. Build, static/license/SPDX/identity/browser checks, generated references, documentation links, 67 strict packed documentation consumers and the 810-file package surface pass. The [evidence inventory](validation/print-196-candidate-evidence.json) pins generator/artifact and reviewed upstream source hashes. These observations do not replace supported Node CI or substantive human review of the exact candidate commit.
+
+## Engine and full new-UI release gates
+
+The [candidate capability ledger](validation/print-196-candidate-capabilities.json) records bounded support and missing qualification separately. The engine owns the bounded interpretation contract and publicly runnable qualification. The app owns production capture, physical proof, accessibility and device integration and consumes published engine APIs. The full new-UI acceptance below remains in scope, but cannot logically precede publication of its required engine contract. The requested release after completion still requires resolving the engine acceptance and human review gates; product gates remain explicitly outstanding:
+
+- Independently qualified active capture/backend evidence for the claimed source detail domain, including lens/field, source headroom and continuum/support convergence. Owned finite reference execution cannot certify a private production renderer or actual capture device.
+- Qualified actual-source high-bit/linear evidence for the claimed physical noise and tonal domain. The public electronic reference now covers modeled photo/dark/read noise, storage/pre-ADC/digital saturation, signed shadows and 12-bit rounding. Actual source transport, physical calibration and display/render clipping remain unassessed.
+- Backend evidence for subject/depth/occlusion across the actual supported coordinate/correction/viewpoint domain, and temporal visibility changes where claimed. Interior finite-plane references exclude depth-boundary composition.
+- A perception application whose actual stimulus, luminance, contrast, area and observer conditions match the supported model. A rectangular coherent grating or natural-image ROI is not automatically a Gaussian-envelope Gabor stimulus. Color, aliasing, halos and natural-image visibility remain independently unassessed.
+- Exact physical proof/comparison scale and immutable capture/region/output binding in the product integration required by #196/#307. The standalone engine tests cannot certify private UI scale, accessibility or device rendering.
+- Human scientific/source review, contribution DCO certification, exact-head CI, final-main release gates and explicit publication approval.
+
+Do not close #196, downgrade these gates, or describe the release as ready because computational tests pass. #195 can be closed on acceptance of its planning audit. #215 remains open until the approved distribution is published.