@photivra/engine 1.5.0 → 2.0.0

package/CHANGELOG.md

@@ -1,6 +1,390 @@
 # Changelog
 
-## 1.5.0 — release candidate
+## 2.0.0 — unreleased (prepared October 17, 2026)
+
+A major release.
+
+**In short.** 2.0.0 fixes correctness problems found in the first 2.0 review, makes several parts much faster without changing their output, and adds a large set of new features. Some of the fixes change numbers that 1.x produced, change stored identities (hashes and seeds), or reject input that 1.x accepted. Any of those can break existing users, so the version number goes from 1 to 2. Root exports grow from 1,227 to 1,668 symbols, and none is removed.
+
+What it contains:
+
+- the correctness fixes and bit-identical performance work of the first 2.0 review (#270–#288);
+- the 2.0 feature streams (#290–#304): sensor gain and fixed-pattern noise, colorimetry, RAW development fixes, optics, rolling shutter and flash, export formats, image processing, the `simulateCapture()` facade (a single simple entry point), and an opt-in WebGPU backend;
+- the completion work (#305–#323): the lean native RAW executor and further native RAW speed-ups, the `simulateCapture()` integration, the native RAW DNG writer, the agent guide, free-source citations, strict inputs everywhere, the licence cleanup, and the finished WebGPU backend;
+- the licence guard (#324) and the final pre-release review fixes (#325–#328 and this record's update).
+
+See [the 2.0.0 release record](https://github.com/Photivra/photivra/blob/main/docs/RELEASE_2_0_0.md) for the science evidence and the compatibility table.
+
+### Breaking changes
+
+Each item ends with its *Migration* (what an existing user must do). Several items only add new values to a type union. Those break only code that switches over every value of that type (an exhaustive switch).
+
+**Sensor and noise**
+
+- **Noise model `photivra-native-raw-noise` 0.4.0, with independent per-site seeds (#270, #283, #290).**
+  - *Why:* the old seed schedule, `seed + 2i`, gave neighbouring pixels a lag-1 noise correlation of about 0.84, so their noise was not independent.
+  - *What changed:* per-site charge and read-noise seeds are now `MurmurHash3_x86_32(captureSeed, absoluteNativeIndex, streamId)` (seed schedule `murmur3-capture-seed-native-index-stream-v2`). `createRandom` scrambles its seed with the MurmurHash3 `fmix32` finalizer.
+  - *Effect:* every realized RAW code and every recorded seed changes, including direct `simulateSensorChargeRealization`/`simulateSensorRawCode` calls. Result model versions: charge realization **3.0.0**, stochastic RAW code **4.0.0**, expected readout **2.0.0**.
+  - *Migration:* results stay deterministic for a given seed at any tile width, but 1.x realizations cannot be reproduced. Captures, plans and replays that carry noise model 0.1.0–0.3.0 are rejected. Re-capture with 2.0.0, and keep old outputs as historical artifacts.
+- **ISO now drives sensor gain; generic tier presets 2.0.0 (#290).**
+  - *What changed:* readout regimes `base`/`high` are replaced by one regime per ISO, `iso-<S>`, with 12-bit (consumer) or 14-bit ADCs (analog-to-digital converters). `presetVersion: "1.0.0"` is rejected. The producer rejects a regime whose `exposureIndexGain.exposureIndex` differs from `capture.exposure.iso`.
+  - *New required result fields:*
+    - `SensorChargeRealization` gains `fixedPatternNoiseProfileId`, `photoResponseGainFactor`, `darkCurrentFactor`, `hotPixel`, `photoSampledMeanElectronCount` and `darkSampledMeanElectronCount`.
+    - `SensorRawCodeSample` gains `fixedPatternNoiseProfileId`, `fixedPatternReadoutOffsetElectrons`, `adcIntegralNonLinearityOffsetCodes`, `adcCodeBeforeDigitalGain` and `digitalGain`.
+    - `SensorExpectedReadoutSignal` gains `adcIntegralNonLinearityOffsetCodes`, `digitalGain` and `expectedCodeAfterDigitalGain`. `expectedDigitalSaturation` now uses the code after digital gain.
+  - *Migration:* save selections and optical states with preset 2.0.0, and pick the `iso-<S>` regime that matches the capture ISO.
+- **Capacity assessments are bound to their charge (#273, #280).**
+  - *What changed:* an assessment must match the charge it is applied to, by exact equality of `totalExpectedStoredElectronCount`, on both readout paths. The stochastic path reports `digitalSaturationApplied` once the code reaches (`>=`) the digital saturation code.
+  - *Migration:* compute the assessment from the same charge you pass.
+
+**RAW development and DNG**
+
+- **RAW development output changes (#295).**
+  - *What was wrong and is now fixed:* white balance was applied twice with camera matrices that were not white-normalized. Normalization now uses the effective white rather than digital full scale. Clipped highlights stay neutral, and saturation flags are honoured.
+  - *DNG output changes:* WhiteLevel, AsShotNeutral, BlackLevel/CFAPattern phase (now relative to the ActiveArea origin) and DNGVersion (now 1.4).
+  - *Effect:* `simulationHash` and file hashes change. `diagnostics.captureSaturation` can be `"consumed-in-raw-development"`.
+  - *Migration:* re-develop and re-export; update stored hashes.
+- **New required RAW fields (#295).**
+  - `NativeRawOutput` requires `effectiveSaturationCodes` (one Uint16 per CFA phase).
+  - `SensorRawCaptureSample` requires `effectiveSaturationCode`, `systemConversionGainElectronsPerCode` and `readNoiseRmsElectrons`, each constant per CFA phase.
+  - *Migration:* hand-built RAW objects must supply them. `calculateEffectiveSaturationCode` computes the first.
+- **`createNativeRawDevelopmentTask` takes ownership of `input.raw` (#295).**
+  - Its arrays are detached (zero-copy `ArrayBuffer.transfer`, or copied where that is unsupported) and returned in `output.raw`.
+  - RAW integrity errors (spans, flags, white levels) now surface from `run()`, not at creation.
+  - The provider is now `{ yieldControl, onProgress? }`. A bare function is deprecated but still accepted in 2.x.
+  - *Migration:* copy the RAW first if you still need it, and handle integrity errors from `run()`.
+
+**Optics and geometry**
+
+- **Exact thin-lens depth-of-field limits (#271, #279, #293).**
+  - *What changed:* `calculateDepthOfField` (and `simulatePocCamera().depthOfField`) now uses the exact thin-lens formulas: near = s(H − f)/(H + s − 2f) and far = s(H − f)/(H − s), with far infinite (`null`) when s ≥ H. (s = focus distance, H = hyperfocal distance, f = focal length.) Model `thin-lens-depth-of-field` 1.1.0.
+  - *Example:* for 50 mm at f/8, c 0.03 mm, s 5 m, the limits move from 3.394595/9.486405 m to 3.389371/9.527439 m.
+  - It now rejects `circleOfConfusionMm ≥ focalLengthMm/aperture`.
+  - `calculateDefocusCircle` uses a numerically stable closed form (model 1.1.0). Values change in the last bits, and more where cancellation used to occur.
+  - *Migration:* update stored expectations. There is no option for the old approximation.
+- **Camera rotation sign on all three axes, and shake pitch sign (#276, #284).**
+  - *What was wrong:* 1.x produced the mirror image on every axis. Rotation mappings now follow the documented right-hand rule about camera +X/+Y/+Z.
+  - *Now:* positive yaw gives `deltaMm.x = +d·tan(yaw·t)`; positive pitch gives `deltaMm.y = −d·tan(pitch·t)`; positive roll rotates content counter-clockwise.
+  - *Effect:* everything built on the mappings changes with them: trajectories, temporal quadrature, rolling-shutter paths, aperture rays, environment radiance query and capture.
+  - `estimateCameraShakeBlur()` keeps its yaw sign, but its pitch `deltaYmm`/`deltaYPixels` flip sign. It rejects a per-axis rotation ≥ π/2 over the exposure.
+  - Rotation and stabilization provenance models go to 2.0.0.
+  - *Migration:* to reproduce 1.x mappings, negate all three angular-velocity components. To reproduce 1.x shake values, negate the pitch rate.
+- **Complex-pupil PSF zero padding and support bound (#276, #284, #293).** (PSF = point-spread function, how the lens spreads a point of light.)
+  - *What changed:* `calculateLensComplexPupilPsf()` pads each axis to M = max(grid, 2S − 1). That is the exact condition for no wrap-around (Goodman sampling Q > 2).
+  - *Effect:* pupils whose support exceeds (grid + 1)/2 samples get a larger kernel with different values (a full 5×5 disk becomes 9×9).
+  - Support wider than `propagationDistanceMm / apertureFNumber` throws `InvalidScientificInputError`. `sampling.declaredPupilDiameterMm` reports that bound.
+  - Model 2.0.0; tier envelopes re-baselined.
+  - *Migration:* read kernel geometry from the returned kernel, and fix profiles whose support contradicts their f-number.
+- **Crop rounding; crop models 2.0.0 (#276, #282, #293).**
+  - *What changed:* `calculateCenteredCrop` floors the shorter axis, and derives the longer one as round(short · L / S), capped at floor(L / cropFactor). A quotient within 4 ulps (units in the last place) of the next whole pixel counts as that pixel.
+  - *Effect:* the longer axis can be 1 px smaller than in 1.x (6000×4000 at 1.7× gives 3528×2352).
+  - `calculateSubjectFramingCrop` no longer reports a subject that fits as clipped.
+  - *Migration:* update stored crop dimensions.
+- **35 mm crop factor (#293).**
+  - *What changed:* the crop factor is now √(1872/(w² + h²)), and the diagonal avoids `Math.hypot`. Some `cropFactor35Mm`, `diagonalMm` and `equivalentFocalLength35Mm` values change by 1 ulp.
+  - *Migration:* none for archives; stored focal equivalents are accepted within 8 ulps.
+- **Type widenings (#296, #303).**
+  - `LensSampledPsfProfile.interpolation` is the union `LensSampledPsfInterpolation`.
+  - Front-of-lens filter `polarizationModeled` fields are `boolean`; filter `schemaVersion` is `"0.1.0" | "0.2.0"`; `compositionModel` gains a Stokes–Mueller value; results add `incidentPolarization`/`transmittedPolarization`.
+  - `PreparedGeometricMapping.schemaVersion` is `"0.1.0" | "0.2.0"`; the transform purpose union gains `"projection"`; `DigitalGeometricTransform` gains two variants.
+  - `SensorEnvironmentRadianceQuery.projection` can be `null` (only with a non-rectilinear mapping).
+  - `ProductionImageFormationBlockerCode` gains `missing-lens-field-mapping`.
+  - *Migration:* existing 0.1.0 profiles and documents work unchanged; update exhaustive switches.
+
+**Exposure, motion and flash**
+
+- **Flash, readout and metering unions (#297).**
+  - `FlashSyncCapabilityProfile.highSpeedSyncSupported` is `boolean`, with optional `highSpeedSync`. `schemaVersion` is `"0.1.0" | "0.2.0"`. 0.1.0 documents parse unchanged and cannot claim HSS (high-speed sync).
+  - `ProductionTemporalCaptureResult.readoutExposureSynchronization` adds `"electronic-rolling-shutter-line-linked"`.
+  - `CreateManualFlashIlluminationOverlayInput.resolvedSync` widens to `FlashOverlaySyncRegistration`.
+  - `ExposureMeteringPolicy` gains `highlight-priority`.
+  - Metering provenance `relative-pre-exposure-metering` is 1.1.0, with no change in value.
+  - *Migration:* update exhaustive switches; use a 0.2.0 sync profile for HSS.
+- **White-balance source `"color-temperature"` (#291).**
+  - `ResolvedWhiteBalanceState.source` and `CaptureWhiteBalanceIntent.source` gain this value.
+  - The `adopted-white-xyz-scaling` variant of `CaptureColorWhiteBalance` gains an optional `transform`, which is rejected on other kinds.
+  - *Migration:* add a case to exhaustive switches; existing serialized states still parse.
+
+**Serialization, validation and export**
+
+- **Stricter input validation (#276, #282, #293).**
+  - Canonical JSON rejects non-plain objects (Map, Set, Date, typed arrays, class instances and similar) and array holes, instead of hashing them as `{}`. Output for plain JSON is byte-identical.
+  - Root functions throw `InvalidConfigurationError` for null, primitive, array or missing sub-object input. Every calculator rejects unknown fields (next item).
+  - `estimatedResult`/`calibratedResult` require `quality`, and result factories reject empty provenance identities.
+  - `calculateSensorResponsivityPhotocurrent` always validates `operatingElectricalConditions` and returns them parsed.
+  - `serializeProductionImageFormationPlan` rejects objects whose version or fingerprint does not match.
+  - *Migration:* pass plain JSON, remove extra fields, and give factories a quality and a provenance.
+- **Every calculator rejects unknown input fields (#276).**
+  - *Why:* 1.x ignored an unknown field on 196 root functions, for example `calculateSignalToNoise()` and `calculateProjectedMotionBlur()`. A typo or a wrong unit suffix (`focusDistanceMm` for `focusDistanceM`) then fell back to a default without any error.
+  - *What changed:* every root function that takes an input object now throws `InvalidConfigurationError` for an unknown top-level field, most with the message `<name> input has unknown field "<field>".` `test/root-export-input-errors.test.ts` lists every root function. The record parsers follow in the next item.
+  - *Effect:* calls with extra fields now fail. `prepareImageFormationContext()` and `createProductionCaptureSnapshot()` still accept the `version` and `fingerprint` of a record they produced, and recompute both.
+  - *Migration:* remove extra fields, and fix misspelled or wrong-unit field names. To change an engine result and pass it back, copy only the documented input fields.
+- **Every record parser rejects unknown fields, at every level (owner decision, 2026-10-17).**
+  - *Why:* the `parse*()` parsers and the functions that take a whole record silently dropped fields they did not know. A misspelled or stale field in a stored profile was lost without any error.
+  - *What changed:* every `parse*()` record parser, and the 13 record-taking functions (`assessMtfOnlyPsfRenderability`, `assessRadiometryReadiness`, `assessSceneMaterialResponseFidelity`, `calculateEffectiveSaturationCode`, `createRollingShutterCaptureExposureSchedule`, `createTtlScaledFlashProfile`, `integrateDiscreteSpectralLineMeasure`, `prepareColorMatchingFunctions`, `prepareColorimetricSpectrum`, `resolveAntiAliasingSpatialKernel`, `resolveSceneIlluminationDiscreteLineMeasure`, `serializeProductionImageFormationPlan`, `validateCalculationQuality`), throws `InvalidConfigurationError` for an unknown field at any object level. The message names the path and the field, for example `sceneIlluminationProfile.sources[0].magnitude has unknown field "wattsPerSteradian".` Parsers that already had their own message keep it and add `Unknown field "<field>".` Each accepted schema version, and each `kind` of a record, has its own allowed fields, so a field of another version or kind is rejected too. Records the engine writes still parse: fixed flags such as `sceneRadianceCalculated: false` are accepted with their fixed value only, and a resolved boundary schedule may keep its derived `unitVectorNative` if it matches. `calculateEffectiveSaturationCode` accepts a `SensorRawCodeSample` plus the regime's `integralNonLinearity`, and nothing else. Scientific output is unchanged.
+  - *Effect:* stored profiles and records with extra fields no longer parse. Old schema versions (for example filter 0.1.0, flash sync 0.1.0, sensor architecture 0.2.0) still parse when they hold only their own fields. Nested records passed to calculators are checked by the same parsers, so extra nested fields fail there too.
+  - *Migration:* remove unknown fields from stored profiles and records; the error names the field.
+- **Read-only result envelopes (#276).**
+  - *Why:* a caller could change a result that another caller or a cache shared.
+  - *What changed:* every `CalculationResult` is frozen. The envelope, `provenance` (with `assumptions`) and `quality` are frozen all the way down; `value` is frozen at its top level. `CalculationResult` marks `value`, `provenance` and `quality` as `readonly`. Nested objects inside `value` and typed arrays stay mutable; domains that own their data (captures, RAW, export metadata, presets) already freeze it deeply.
+  - *Effect:* writing to a result throws a `TypeError` in strict-mode code (and fails silently in sloppy-mode scripts). The result factories also freeze the value, assumptions and quality objects you pass them. Every result costs a few `Object.freeze` calls (measured A/B against 28f8b61 on a shared 4-vCPU Xeon host, Node 24.21, medians of 3–5 alternating runs; indicative only):
+    - per-point mapping calls (`npm run bench:image-formation`): about 0.3–0.45 µs more per call, 1.2–1.9× slower; the batch mapping APIs 0.91–1.08× (within noise);
+    - `simulatePocCamera()` (`scripts/benchmark-composed-baseline.mjs`), which builds many internal results per request: 1.62–1.69× slower (11.9 → 19.6 µs per base request). Freezing only the envelope measured 1.15–1.28×; no freezing measured 0.97–1.20×;
+    - native environment RAW (`scripts/benchmark-v1-environment.mjs`): 0.84–1.08×, within noise, because its lean executor builds few envelopes;
+    - a generic deep freeze of `value` made a small scalar call about 3× slower and was not adopted. See `docs/API_STYLE.md` "Read-only results".
+  - *Migration:* copy a value before changing it (`{ ...result.value }` or `structuredClone(result.value)`). Use the batch mapping APIs in per-point loops.
+- **Consistent error classes (#276).**
+  - *Why:* the same kind of mistake threw different classes in different modules. For example a non-object input threw `InvalidScientificInputError` in some calculators and `InvalidConfigurationError` in others, and a negative flash guide number threw `InvalidConfigurationError`.
+  - *What changed:* one rule (`docs/API_STYLE.md` "Error classes"). A wrong shape is an `InvalidConfigurationError`: a non-object or non-array, a missing sub-object, an unknown field, an unknown kind, mode, policy or version string, or a malformed identifier. A bad number in a calculation is an `InvalidScientificInputError`. Defects inside a versioned record or options object stay configuration errors. About 190 throw sites moved from `InvalidScientificInputError` to `InvalidConfigurationError`. The scalar flash (`calculateFlashGuideNumber`, `calculateFlashPowerForDistance`, `resolveTtlFlashExposure` numbers), shutter-angle and video (`calculateShutterAngleExposureSeconds`, `calculateShutterAngleFromExposureSeconds`, `assessShutterAngleRule`, `resolveVideoFrameSequence` numbers), `calculateHighlightPriorityPlacementSignal` and `calculatePhotonEnergyFromWavelength` wavelength checks moved the other way. Internal seed-derivation errors are `InvalidScientificInputError` instead of a plain `RangeError`. Messages and `code` fields are unchanged. `test/error-class-consistency.test.ts` scans the source for violations.
+  - *Effect:* `instanceof` checks and `code` comparisons on these errors can change. `InvalidScientificInputError` still extends `RangeError` and `InvalidConfigurationError` still extends `TypeError`.
+  - *Migration:* catch both domain classes, or branch on `error.code`: `INVALID_CONFIGURATION` means fix the shape or field names, `INVALID_SCIENTIFIC_INPUT` means fix the value.
+- **Spectral channel binding format v2 (#276, #282, #293).**
+  - `SENSOR_SPECTRAL_RESPONSE_CHANNEL_BINDING_FORMAT` is `photivra-spectral-channel-response-canonical-json-v2` (sorted-key JSON of the parsed channel).
+  - v1 bindings from 1.5.0 and earlier are rejected with a version error.
+  - *Migration:* recompute the quadrature and reduction with 2.0.0.
+- **Print JPEG schema 0.2.0 and baseline JPEG encoder v2 (#274, #278, #298).**
+  - Print JPEG output gains `encoderId`.
+  - IFD0 always carries XResolution/YResolution/ResolutionUnit (72 dpi when `pixelsPerInch` is omitted — the Exif 2.32 value for unknown resolution) and YCbCrPositioning.
+  - The Exif IFD adds ExifVersion `"0232"`, FlashpixVersion and ComponentsConfiguration. The paired-export JPEG gets the same tags.
+  - `EXPORT_JPEG_ENCODER_ID` is `photivra-baseline-jpeg-444-v2`: correctly rounded DCT cosines and half-away-from-zero quantization. Bytes differ from 1.x only where a coefficient sat within about one ulp of a half-integer, and are now identical across V8 and JavaScriptCore.
+  - `maximumProviderReads` now caps exactly ⌈crop height/32⌉ × ⌈crop width/256⌉ crop-aligned strip reads, and fails before the first read when the cap is too small.
+  - *Migration:* treat JFIF units = 0, or the absence of `pixelsPerInch` in the XMP plan, as "no physical size"; size the read budget by the new formula.
+- **POC API 1.0.0 (#276, #282, #293).** (POC = the proof-of-concept `simulatePocCamera()` contract.)
+  - `POC_SIMULATION_API_VERSION` is **1.0.0**. `simulatePocCamera()` values change through depth of field, crop and shake pitch.
+  - The repository-only POC transport (not a package export) now returns: 400 for out-of-range aperture/focus and malformed JSON (fixed message); 413 `PAYLOAD_TOO_LARGE`; 422 `SIMULATION_RESULT_OUT_OF_RANGE` for non-finite results; 500 `INTERNAL_ERROR` with a fixed message; and a bodiless 204 preflight.
+  - *Migration:* handle 413, 422 and 500 as well as 400.
+- **Package contents (#293).**
+  - The manifest has no `prepare` or other install scripts. Git installs need `npm ci && npm run build`; contributors run `npm run hooks:install`.
+  - No longer shipped: declaration maps; docs other than USAGE, API_REFERENCE, QUICK_START, AGENT_GUIDE (#313), `llms.txt` (#313), `api/` and examples; and the unreachable `browser-native-reference-*` and `schema/{camera,scene}.js` modules.
+  - *Migration:* read the other guides in the repository.
+
+**Colorimetry: third-party coefficients removed (owner decision, 2026-10-17)**
+
+- **Own CIE 1931 colour-matching-function fit replaces the Wyman et al. (2013) coefficients.**
+  - *Why:* the Wyman, Sloan & Shirley paper is CC BY-ND. The owner decided to remove third-party numbers with any licence question.
+  - *What changed:* `estimateCie1931ColorMatchingFunctions` uses coefficients the engine fitted itself to the CIE 1931 2° data (same kind of model: a sum of piecewise Gaussians). The CMF source kind `"wyman-2013-cie-1931-multi-lobe-fit"` is now `"analytic-cie-1931-multi-lobe-fit"`, and `WYMAN_2013_CMF_DOMAIN_NANOMETERS` is now `ANALYTIC_CIE_1931_CMF_DOMAIN_NANOMETERS` (still 360–830 nm). The provenance model is `cie-xyz-spectral-integration-analytic-cmf`, and `COLORIMETRY_MODEL_VERSION` is 2.0.0. The fit is still an approximation, slightly closer to the CIE data (maximum error 0.0122/0.00733/0.0221 for x̄/ȳ/z̄, was 0.0140/0.00800/0.0222; see `docs/COLORIMETRY.md`).
+  - *Effect:* colour outputs change slightly. Illuminant A integrates to xy (0.4480, 0.4074), was (0.4463, 0.4087). `simulateCapture()` RAW codes move by up to about 0.5 % (mean +1 to +5 codes), so its pinned output digests changed.
+  - *Migration:* replace the old kind and constant names. Re-render anything that must match 2.0.0 colour exactly.
+- **Planckian locus computed from Planck's law; the Kim et al. (2002) spline is removed.**
+  - *Why:* the cubic-spline coefficients come from Kang et al. (2002), which is also claimed in a (lapsed) patent. The owner decided to remove them.
+  - *What changed:* the locus is the chromaticity of Planck's law integrated against the engine's analytic CMFs on 1 nm nodes, 1000–100000 K. The locus kind `"kim-2002-cubic-spline"` is now `"planck-analytic-cmf"`, the default of `resolveColorTemperatureWhiteBalance`. `KIM_2002_PLANCKIAN_LOCUS_RANGE_KELVIN` (1667–25000 K) is now `PLANCKIAN_LOCUS_RANGE_KELVIN` (1000–100000 K). `estimatePlanckianLocusChromaticity` keeps its name and uses the new locus. Resolved white-balance states record `planckianLocusModel: "planck-analytic-cmf"`, and states with `"kim-2002-cubic-spline"` are rejected.
+  - *Effect:* locus points move by up to 7.0e-4 in CIE 1960 uv from 2000 to 25000 K (1.4e-3 at 1667 K). The CCT of the daylight-locus point at 6504 K becomes 6516.6 K (was 6500.0 K), and Kelvin white-balance gains change by up to 0.5 %. A CCT/Duv search costs about 0.03 ms (0.02 ms with the spline; see Performance).
+  - *Migration:* replace `{ kind: "kim-2002-cubic-spline" }` with `{ kind: "planck-analytic-cmf" }` (or omit it for the default) and the range constant name. Re-resolve stored Kelvin/tint white-balance states. For a locus from tabulated CIE CMFs, use `{ kind: "planck-integration", colorMatchingFunctions, quadratureNodes }`.
+- **CIE94: the `cie94-textiles` preset is removed; callers pass their own factors.**
+  - *Why:* the textiles weights trace only to secondary web pages, not to a free primary source. The primary, CIE 116-1995, is not free.
+  - *What changed:* the formulas `"cie94-graphic-arts"` and `"cie94-textiles"` are replaced by one formula, `"cie94"`. By default it uses the formula's published reference conditions (k_L = k_C = k_H = 1, K₁ = 0.045, K₂ = 0.015, the old graphic-arts values). A new option, `cie94Factors: { lightness, chroma, hue, k1, k2 }` (type `Cie94ParametricFactors`), sets all five factors. It is validated and rejects unknown fields.
+  - *Effect:* the old formula names are rejected. Default results equal the old `"cie94-graphic-arts"` results. The result's `formula` and method id are now `"cie94"` and `"color-difference-cie94"`.
+  - *Migration:* replace `"cie94-graphic-arts"` with `"cie94"`. For textiles or other conditions, pass the factors explicitly from a source you have checked: `{ formula: "cie94", cie94Factors: { lightness, chroma, hue, k1, k2 } }`.
+
+### Added
+
+- **`simulateCapture()` (#300).** A full capture from a few options.
+  - Returns the image, packed RAW, the executed request and plan, provenance, and an `assumptions` list naming every default.
+  - Exposure modes: manual, aperture-priority, shutter-priority and program.
+  - White balance: by scene illuminant, auto, none, Kelvin/tint, or gains.
+  - Output: `srgb-8`, `srgb-16` or `jpeg`.
+  - Procedural chart presets (uniform, slanted edge, Siemens star, step wedge, grey ramp, checkerboard, point grid, caller-spectrum patches) with `resolveChartScene` and helpers.
+  - `SIMULATE_CAPTURE_FACADE_VERSION` 1.0.0; `docs/QUICK_START.md` (shipped) and `docs/examples/simulate-capture.mjs`.
+- **`simulateCapture()` uses the 2.0 features (#306, #307).** All opt-in. Without the new options, the 1.0 facade output is byte-identical at the same illuminance (the default illuminance changed; see *Free-source citations* below), apart from the colour-matching-function change under *Breaking changes*. Every choice is listed in `assumptions`.
+  - `output.format: "png"` with `colorEncoding` `srgb`, `display-p3` or `rec2020`. The unclipped linear development is converted through CIE XYZ, clipped once in the target gamut, and signalled with cICP. The `rec2100-pq` and `rec2100-hlg` encodings prepared for 2.0 were removed before release: pQ and HLG (ITU-R BT.2100) are not shipped in 2.0 because their patent holders offer only licence-on-request declarations (owner decision, 2026-10-17; see the patent review in `THIRD_PARTY.md`).
+  - Optional `gamutMapping: "perceptual"` (constant CIELAB L* and hue).
+  - `output.format: "dng"`.
+  - `output.demosaic` (`bilinear`) and `borderHandling` (`margin`, `mirror`).
+  - `lens.projection`, `lens.distortion` (radial or Brown–Conrady), `lens.vignetting` and `lens.psf`.
+  - `motion.angularVelocityRadPerSec` and `motion.shutter: "rolling"`.
+- **Native RAW DNG (#307).** `serializeNativeRawDng()` writes a lossless 16-bit CFA (colour filter array) DNG directly from packed native RAW.
+  - Tags: per-phase BlackLevel and CFAPattern from the ActiveArea origin; WhiteLevel from the effective saturation code; ActiveArea, DefaultCrop, Orientation, ColorMatrix1, ForwardMatrix1, AsShotNeutral, BaselineExposure and an optional NoiseProfile.
+  - It declares no linear master, and counts the saturation flags DNG cannot carry.
+  - `NATIVE_RAW_DNG_SCHEMA_VERSION` 1.0.0.
+- **Colorimetry (#291).**
+  - Analytic CIE 1931 colour-matching functions (the engine's own fit, labelled approximation) or caller-tabulated CMFs; `integrateSpectrumToXyz`.
+  - Planck radiance, illuminant A, CIE daylight with caller-supplied basis spectra, the Planckian locus from Planck's law, McCamy CCT, and nearest-locus CCT/Duv with its inverse. (CCT = correlated colour temperature.)
+  - Chromatic adaptation: Bradford, CAT16 and XYZ scaling, with a caller-supplied degree of adaptation. CAT02, the von Kries Hunt–Pointer–Estévez transform and a CIECAM02 degree-of-adaptation helper are not part of 2.0: no free source we could confirm prints the CAT02 or HPE matrix or the CIECAM02 formula for D (owner decisions, 2026-10-17). The `"cat02"` and `"von-kries-hpe"` transforms and `calculateDegreeOfAdaptation` prepared for 2.0 never ship, in `calculateChromaticAdaptationMatrix` or in `calculateCaptureColorTransform`. CAT16 has a free source, IS&T CIC24 2016 Eq. (15).
+  - CIELAB/LCh, and ΔE76, CIE94 and CIEDE2000.
+  - `estimateCameraColorMatrix`.
+  - RGB colour spaces (sRGB, Rec.709, Display P3, Rec.2020) and sRGB, BT.709 and BT.1886 transfers; gamut mapping. PQ and HLG (ITU-R BT.2100) are not shipped in 2.0 because their patent holders offer only licence-on-request declarations (owner decision, 2026-10-17; see the patent review in `THIRD_PARTY.md`). The PQ/HLG functions and constants prepared for 2.0 (`evaluatePqEotf`, `evaluatePqInverseEotf`, `PQ_CONSTANTS`, `evaluateHlgOetf`, `evaluateHlgInverseOetf`, `HLG_CONSTANTS`, `calculateHlgSystemGamma`, `prepareHlgReferenceDisplay`, `HlgReferenceDisplay`) never ship. `resolveRgbColorSpace("rec2020").sources` lists only ITU-R BT.2020-2.
+  - `resolveColorTemperatureWhiteBalance` turns Kelvin + tint into channel gains. `calculateCaptureColorTransform` takes an optional adaptation `transform`.
+- **Sensor (#290).**
+  - `createIsoGainReadoutRegimes()`: ISO-dependent analog and digital gain, with read noise per conversion gain.
+  - Regime fields `adc.digitalGain`, `adc.integralNonLinearity` and `exposureIndexGain`.
+  - Opt-in fixed-pattern noise (`parseSensorFixedPatternNoiseProfile`, `calculateSensorFixedPatternSite`, `SENSOR_FIXED_PATTERN_NOISE_MODEL`).
+  - A `log-linear-temperature-table` dark-current model.
+  - Tier `rollingReadoutTiming` and `fixedPatternNoise` assets.
+- **RAW development (#295).**
+  - `highlightMode` (`clip` or `reconstruct`) with diagnostics.
+  - Tone curves `extended-reinhard-luminance` and `naka-rushton-luminance`.
+  - `calculateEffectiveSaturationCode`.
+  - DNG ForwardMatrix1, BaselineExposure, NoiseProfile and AnalogBalance.
+  - Progress reporting on development and native SDR.
+  - `createPhotographicExportPair(input, { signal })`.
+- **Optics (#296, #303).**
+  - Fisheye and equirectangular projections (`calculateLensProjection*`, and an optional `projectionModel` on field of view).
+  - Brown–Conrady distortion and its inverse.
+  - Longitudinal chromatic aberration and Cauchy dispersion.
+  - Natural and mechanical vignetting.
+  - Polygon-pupil Fraunhofer PSF.
+  - Zernike/Seidel wavefronts and the Maréchal Strehl ratio.
+  - Centroid-aligned and rotational PSF interpolation.
+  - A linear polarizer (filter schema 0.2.0).
+  - Atmospheric haze.
+  - Focus breathing.
+  - Geometric mappings gain `brown-conrady` and `projection-remap` transforms (mapping schema 0.2.0). Environment capture accepts an optional `lensFieldMapping`, which the production plan composes.
+- **Motion, video and flash (#297).**
+  - Electronic rolling-shutter exposure schedules, so skew, partial exposure and flicker banding emerge in image formation.
+  - Video frame sequences and shutter-angle helpers.
+  - Flash guide number, pre-flash TTL (through-the-lens metering) and high-speed sync (sync schema 0.2.0).
+  - The `highlight-priority` metering policy.
+- **Export formats (#298).**
+  - `parseDngRawImage`: a bounded DNG/TIFF-EP reader (uncompressed and lossless JPEG, 8–16 bit), with `DNG_IMPORT_SCHEMA_VERSION` 1.0.0 and `DNG_IMPORT_LIMITS`.
+  - `parseLosslessJpeg` (ITU-T T.81 Annex H).
+  - `serializePngImage`: 8/16-bit RGB PNG with sRGB, iCCP or cICP for Display P3 and BT.2020 (sRGB, BT.709 or linear transfer); mDCV/cLLI metadata; deterministic in-house zlib. No PQ or HLG code points.
+  - `EXPORT_JPEG_ENCODER_ID`.
+  - AVIF and HEIC are not provided.
+- **Processing (#302).** All opt-in. See `docs/PROCESSING.md`.
+  - Bilinear Bayer demosaic profiles, AHD demosaicing and CFA-plane reconstruction. The Malvar–He–Cutler kernels prepared for 2.0 were removed before release (owner decision, 2026-10-17): Microsoft's US 7,502,505 is in force until about January 25, 2027, and its claim 1 closely matches the method. The `malvar-he-cutler-2004` kernel and the `simulateCapture()` option `output.demosaic: "malvar-he-cutler"` never ship. They may return after the patent expires (about 25 Jan 2027). Bilinear (the default) and AHD are unchanged, and the hash-lock tests confirm the default output is unchanged. See the patent review in `THIRD_PARTY.md`.
+  - `borderHandling: "mirror"` for RAW development.
+  - Noise-optimal HDR bracket merge, and conversion to float32 linear BT.2020 (`createHdrImageEncodingTask`, `transfer: "linear-float32"` only). Its PQ/HLG modes and their integer-code options were removed before release; the SDR outputs are unchanged, as the hash-lock tests confirm.
+  - Reinhard and Durand–Dorsey tone mapping, exposure fusion, focus stacking and known-rotation panoramas.
+  - Bilateral and non-local-means denoise, unsharp mask, and an explicitly synthetic film grain.
+  - A shared `ProcessingTask` contract.
+- **Opt-in WebGPU backend (#304).** See `docs/WEBGPU.md`.
+  - `createImageKernelAccelerator()` runs isoplanatic PSF convolution, native capture SDR and packed RAW development as `webgpu-f32`.
+  - Results are labelled with a float32 error bound stated in advance, and are never claimed to be bit-identical. The CPU float64 reference stays the default.
+  - Also `calculateIrradianceConvolution()` and its plan (schema 0.1.0), `ImageKernelExecutionError`, and the repository-only `npm run test:webgpu`.
+- **WebGPU image-formation stages and accuracy contract (#277).** See `docs/WEBGPU.md`.
+  - **Accuracy contract:** per-stage a-priori bounds, kept separate from method error, and `composeRelativeErrorBounds()` for chaining linear stages.
+  - **Sensor stage:** `simulatePackedSensorRaw()` (schema 0.1.0) is the per-site producer's charge, noise and ADC on typed arrays. It is bit-identical to `calculateNativeRawSite`. `accelerator.simulateSensorRaw()` runs it on `webgpu-f32` with the same seeded noise model (`photivra-native-raw-noise` 0.4.0, MurmurHash3 per-site seeds). The new `exact-except-flagged-sites` label means every unflagged site equals the reference exactly. Flagged sites are listed in `flaggedSiteIndices` and covered by a statistical-equivalence test.
+  - **Sensor stage, fixed-pattern noise and extra charge:** `PackedSensorRawInput` takes an optional `fixedPatternNoise` (a `SensorFixedPatternNoiseProfile` and its colour-site origin) and up to 8 `additionalChargeComponents` (Poisson or deterministic). The reference stays bit-identical to the per-site engine functions with both (tested), and `webgpu-f32` keeps the `exact-except-flagged-sites` guarantee (0 differing sites on SwiftShader).
+  - **Luminance tone curves on the GPU:** `renderNativeCaptureSdr` and `developNativeRaw` on `webgpu-f32` now run `extended-reinhard-luminance` and `naka-rushton-luminance` (exponent ≥ 1) instead of rejecting them. Their code bound is a running bound: a fixed per-sample formula evaluated from the kernel's own values, and the run's largest value is reported. On SwiftShader every code was within 1 of the reference.
+  - **Kernels from lens PSFs:** `resolveLensPsfConvolutionKernels()` (schema 0.1.0) resolves a `LensSampledPsfProfile` at each patch centre with `resolveLensSampledPsf` and maps its taps onto site displacements with the per-site quadrature's own inverse support. Equal pitches give exact site sampling; other pitches use bilinear splatting, a labelled approximation that is the adjoint of bilinear interpolation (tested). Several wavelengths give a weighted spectral kernel.
+  - **Scene radiance on the GPU:** `calculateChartRadianceBatch()` (schema 0.1.0) answers many radiance or spectral-integral queries on the engine's chart presets, using the planar provider's own `radianceAt`. `accelerator.evaluateChartRadiance()` runs it on `webgpu-f32`: the GPU classifies materials with a-priori bounds, flagged points are recomputed on the host, and every value is the reference rounded once to float32 (relative 2^-24; 0 misclassified points on SwiftShader). `mapEnvironmentDirectionsToChartPoints()` converts environment-direction queries.
+  - **Per-fixture rollout:** for every built-in chart preset, the GPU image-formation path's method error against the per-site engine is measured on sampled tiles and pinned in tests (`docs/WEBGPU.md`, "Per-fixture rollout"). With a synthetic, strongly field-varying PSF and 8-site patches it is 1.2–2.5 % of the tile peak, and larger at sub-site detail (16.8 % at a point-grid disk edge with 2 µm PSF samples; 24.9 % at the Siemens-star centre, where both paths alias). These are accuracy numbers, not speed.
+  - **Exposure and motion:** `calculateTemporalExposureSum()` (schema 0.1.0) is a weighted sum of shifted frames with per-row weights, for rolling or global readout. Sub-site shifts use bilinear interpolation, a labelled approximation. `accelerator.sumTemporalExposure()` runs it on `webgpu-f32` with a relative bound.
+  - **Timings:** the repository-only `npm run bench:webgpu` times the stages at 6–24 MP on the owner's hardware. No hardware timings have been measured yet.
+- **Optical-stage reuse (#288).** `NativeEnvironmentRawInput.opticalStage` returns an opaque optical stage. `createNativeEnvironmentSensorStageTask()` then re-runs only dark charge, capacity, noise and ADC after edits that come after the optics. Optical changes are refused.
+- **Opt-in parallel native environment RAW (#275).** `calculateNativeRawRowBands()` splits a capture into row bands, `createNativeEnvironmentRawPartitionTask()` runs one band (for example in a Web Worker or Node worker thread, with the caller's own provider), and `composeNativeEnvironmentRawPartitions()` joins the posted partitions. The merged output is byte-identical to `createNativeEnvironmentRawTask()` for the same input (`test/native-environment-partitions.test.ts`). No worker code is bundled. Measured with `scripts/benchmark-native-environment-workers.mjs` on a shared 4-vCPU host, 48×48 sampled PSF: 1.53 s on one thread, 0.66 s with 4 workers (2.3×); cheap default-optics sites gain much less.
+- **Batched light sampling (#275).** Optional `NativeEnvironmentRawProvider.evaluateRadianceBatch(queries, signal)` receives every radiance query of a tile (`NativeEnvironmentRadianceQuery`, in per-query callback order) and returns the results in order, synchronously or as a promise. Results are validated like per-query results, so the output is identical for the same results (`test/native-environment-batch.test.ts`). It is meant for GPU, WebAssembly or cross-thread providers; with a JavaScript provider on the CPU it is about as fast as per-query callbacks (48×48: default 0.29 → 0.27 s, 4 pupil rays 2.11 → 2.43 s).
+- **Smaller additions.**
+  - `PrintJpegInput.pixelsPerInch` (1–65535; #278).
+  - The `LensComplexPupilPsf.sampling` field (#284).
+  - `SENSOR_SPECTRAL_RESPONSE_CHANNEL_BINDING_FORMAT` (#293).
+  - A `"default"` export condition so Node ≥ 22.12 can `require()` the package; the `./package.json` export; JS source maps with inline sources; and declarations that type-check with `lib: ["es2022"]` alone (#293).
+
+### Free-source citations (owner decisions)
+
+The engine now relies on free-to-read sources wherever one was found. See the citation audit in the 2.0.0 release record.
+
+- **Numeric change: `simulateCapture()` exposure anchor.**
+  - *What changed:* the anchor no longer uses the reflected-light meter constant K = 12.5 cd·s/m² of a paid standard. It uses CIPA DC-004-2020 (free): standard output sensitivity S = 10/H and the camera equation H = 0.65·L·t/N², with an 18 % grey as the reference. This is equivalent to K = 10/0.65 ≈ 15.38 cd·s/m².
+  - *Effect:* `SIMULATE_CAPTURE_DEFAULT_ILLUMINANCE_LUX` changes from π·12.5·64·125/18 ≈ 17 453.29 lux to π·10·64·125/(0.65·100·0.18) = π·80 000/11.7 ≈ 21 480.98 lux, a factor of 10/(0.65·12.5) ≈ 1.231 (about 0.30 EV). The metered reference luminance for f/8, 1/125 s, ISO 100 changes from 1000 cd/m² to 80 000/65 ≈ 1230.77 cd/m², so `exposure.meteredSceneLuminanceCdPerSquareMeter` of the default grey card changes by the same factor. Default captures are brighter: the green RAW level of the 18 % grey card goes from about 10.6 % to about 13.1 % of RAW white. Auto-exposure modes resolve N²/t = 0.65·L·S/10 instead of L·S/12.5. The `illuminanceLux` and `exposure.referenceExposure` assumption texts change.
+  - *Unchanged:* with `illuminanceLux` set to the old default, every 1.0 facade output (samples, RAW codes, JPEG, request, scene digest) is byte-identical; a test checks that, and pins the new default digests.
+  - *Migration:* pass `illuminanceLux: Math.PI * 12.5 * 64 * 125 / 18` to reproduce earlier captures.
+- **Text-only output change: runtime strings.** No number changes.
+  - Provenance and assumption strings that named paid standards now name free sources: RGB colour-space `sources` (`srgb`: "W3C CSS Color Module Level 4 srgb"; `display-p3`: "W3C CSS Color Module Level 4 display-p3 (…)", "ITU-T H.273 ColourPrimaries 12"), the matrix-derivation assumption of `resolveRgbColorSpace`, the CIELAB assumptions, the daylight-locus assumption, the CCT Duv-sign assumption (now the engine's own convention), the HDR encoding assumptions (ITU-R BT.2100 PQ; BT.2020 matrices), the facade's PNG colour-encoding texts, and the illuminant A scene description.
+  - The `calculateCorrelatedColorTemperature` error for |Duv| > 0.05 is reworded.
+  - Limitation and error strings that used internal ticket numbers as model names (#12, #14, #85, #110) now name the model: exposure-window model, sensor pipeline, scene-radiance provider, and the scene-radiance-to-sensor-irradiance optical bridge (stabilization, extended-object projection, flash, temporal metering, RAW frame and production image-formation plan).
+  - *Migration:* code that matches these strings exactly must update them. Result model ids are unchanged.
+- **Documentation and tests.** The flash guide-number relations are derived in full from the inverse-square law and the camera equation (the guide-number measurement standard is no longer cited). Tristimulus integration cites Wyman, Sloan & Shirley (2013), Eq. 1; Planck's law cites the BIPM kelvin *mise en pratique*. CIE94 cites a free secondary source and is checked by closed-form cases computed in the test. The RGB↔XYZ derivation is written out in `docs/COLORIMETRY.md`, and a new test shows the engine's matrices equal the W3C CSS Color 4 matrices within 1e-12. The Duv sign (positive above the Planckian locus) cites Ohno's free CORM 2011 slides (slide 5); the engine documents it, and a new test checks that a greenish light has a positive Duv. The ISO-brightness test uses the DC-004 mid-grey reference (0.18 of white) instead of a paid saturation-speed ratio.
+- **Documentation: CAT16 matrix source (owner decision, 2026-10-17).** The CAT16 cone matrix now cites the free IS&T paper of Li et al. (2016), "A Revision of CIECAM02 and its CAT and UCS", CIC24, Eq. (15), doi:10.2352/ISSN.2169-2629.2017.32.208; its nine coefficients were checked against the engine. That paper does not print the CAT02 matrix, so CAT02 keeps its earlier sources. The patent review in `THIRD_PARTY.md` records that no patent was found claiming either matrix. Comments and docs only.
+
+### Fixed
+
+- Captures, packed RAW and export hashes (`simulationHash`, DNG/JPEG SHA-256) are now identical across the V8 and JavaScriptCore JavaScript engines. The POC hash corpus passes on every engine without overrides (#293).
+- ISO now changes RAW and developed brightness. Base-ISO white sits at ADC full scale, instead of code 20512 of 65535 (#290).
+- ADC round-half-up is exact (0.49999999999999994 rounds to 0). Poisson draws for means ≥ 1e9 have the correct variance (#290).
+- RAW development (#295) fixes:
+  - double white balance;
+  - AsShotNeutral written as the camera white squared;
+  - coloured clipped highlights;
+  - ignored saturation flags;
+  - WhiteLevel written as the ADC maximum;
+  - BlackLevel and CFA phase taken from the absolute origin instead of the ActiveArea;
+  - an unclear error when Web Crypto is missing.
+- Print and paired-export JPEG Exif carry every tag that Exif 2.32 makes mandatory for compressed images (#278, #298).
+- `Math.floor(x + 0.5)` rounding is replaced by exact rounding in SDR rendering, linear encoding and Print JPEG sRGB codes (#295, #298).
+- Auto ISO with Shutter or Aperture Priority picks a grid value equal to the ideal within `settingEquals` tolerance. Grid end points within tolerance are no longer reported as clamped (#272, #281).
+- Valid exit-pupil declarations are no longer rejected, and packaged docs no longer link to unshipped files (#293).
+- The illumination-vignetting solver for interior extremes uses a stable scaled quadratic (#296).
+- `resolveLensSampledPsf` no longer rejects an interpolated pupil throughput that floating-point weights lift a few ulps above 1 (#307).
+- `simulateCapture()` validates pupil sampling (4–64 angular samples, at most 256 rays) before doing any work (#306).
+- Colour, haze, projection and PNG inputs reject unknown fields in nested records too, as the 2.0.0 strict-records rule requires: XYZ and white points (`x`, `y`, `z` only), xy chromaticities (`x`, `y` only), CIELAB/LCh colours, CIEDE2000 `parametricFactors` (now as strict as `cie94Factors`), each Planckian `locus` kind, `wavelengthRangeNanometers`, the `createCieDaylightSpectrum` basis, RGB `primaries`, the haze `extinction` model, lens-projection `direction` and `imagePointMm`, and the PNG `colourEncoding`, `masteringDisplay` and `contentLightLevel`. Before, a typo such as `extinction.rayleighExponet` silently fell back to the default Rayleigh exponent 4. *Migration:* remove extra fields; a luminance `Y` beside an xy chromaticity is no longer accepted.
+- `calculateChromaticityFromCorrelatedColorTemperature` (and so `resolveColorTemperatureWhiteBalance`) throws `InvalidScientificInputError` when CCT + Duv lands outside x ≥ 0, y > 0, x + y ≤ 1. 2000 K with Duv +0.02 used to return x + y = 1.0595, a chromaticity the engine itself rejects as input, and a Kelvin white-balance state built on it.
+- `serializePngImage` no longer accepts `Object.prototype` names as code points: `primaries: "constructor"`, `transfer: "toString"` or `renderingIntent: "toString"` wrote reserved cICP or sRGB bytes. The lookups are now maps, and unknown `colourEncoding` fields are rejected.
+- `createHdrBracketMergeTask` never returns NaN or Infinity. Exposure times below 1 ns are rejected (at 10⁻¹⁷⁰ s, t² underflowed and the weights became 0/0; see `docs/PROCESSING.md` for why 1 ns keeps every quantity finite in float32), and a merge that still gives a non-finite or out-of-float32 value fails with `InvalidScientificInputError`.
+- `mapEnvironmentDirectionsToChartPoints` rejects directions that map to a non-finite chart point, such as the grazing (1, 0, −1e-320), which gave −Infinity and NaN, or a non-finite component.
+- `highlight-weighted` metering is now documented as a highlight-emphasis mean: about 0.5–0.8 EV darker than uniform metering in scenes with bright accents. Its behaviour is unchanged. The new `highlight-priority` policy is the one that places highlights (#297).
+- **A missing, null or non-object sub-object no longer escapes as a raw `TypeError` (pre-release review).** As "Stricter input validation" promises, these root functions now throw `InvalidConfigurationError` naming the part: `estimateCameraShakeBlur`, `calculateProjectedMotionBlur`, both camera-rotation mappings, every `src/output/capture-geometry.ts` transform and field-of-view function, `resolveVideoFrameSequence` (`rollingShutter: null`), `resolveTtlFlashExposure` (`guideNumber: null`, malformed zones), `simulateCapture` (`camera: { body: 1, lens: 1 }`, `output.whiteBalance.channelGains: null`), and, from a sweep of the motion, stabilization and exposure modules, the exposure-mode resolvers, ordinary and high-speed flash sync and overlays, `parseManualFlashProfile`, `meterRelativeExposure`, scene-radiance and temporal metering, `setExposureCompensationOnMeterTarget`, `calculateSensorGeometryMetrics` (`nativeRaster: null`), the capture-rotation trajectory, inverse-mapping and quadrature functions, `calculateStabilizedCaptureTemporalSamples`, extended-object projection and translation parallax. Valid input gives the same result. `test/helpers/sub-object-probe.ts` removes, nulls or replaces each nested object of a valid input in turn and requires a domain error.
+- **Nested objects reject unknown fields (pre-release review).** Before, an extra field was dropped silently, for example `angularVelocityRadPerSec: { yaw, pitch, roll: 5 }` in `estimateCameraShakeBlur`, which has no roll term. Now these throw `InvalidConfigurationError` naming the field: `estimateCameraShakeBlur` `angularVelocityRadPerSec`; `calculateProjectedMotionBlur` `positionM` and `velocityMps`; the camera-rotation mappings' `imagePointMm`, `angularVelocityRadPerSec` and `samplingPitchMicrometers`; `resolveVideoFrameSequence` `automation` and `rollingShutter`; the TTL `guideNumber`; `simulateCapture` `output.whiteBalance.channelGains`.
+  - A `simulateCapture` camera given as a preset object must have exactly the `GenericEquipmentTierPreset` shape: unknown fields at the top level, in `body`, in `lens` and in `lens.matchedReference` are rejected, and each body and lens profile is re-checked by its own strict parser. A copy of a catalog preset still gives the same capture as its tier id.
+  - `output.jpegQuantizationStep` is rejected unless `output.format` is `"jpeg"` (`format: "png", jpegQuantizationStep: 9999` used to succeed silently).
+  - *Migration:* remove the extra field; the error names it.
+- **`simulateCapture` scene digest covers caller spectra (pre-release review).** `scene.sourceSha256` (also the RAW source and spectral data-artifact checksum) ignored caller spectra, so a 3000 K and a 9000 K `spectrum` illuminant gave the same digest. The hashed scene description now includes each caller spectrum: tabulated data exactly as its (wavelength, value) pairs, a function spectrum sampled at 1 nm over 380–780 nm. This covers a `spectrum` illuminant, a `daylight` illuminant (its computed spectrum and the basis `datasetId`) and chart reflectance spectra (`uniform`, `patches`). Captures without caller spectra keep their digests (the pinned digests in `test/simulate-capture-integration.test.ts` are unchanged); captures with caller spectra get new digests. The images are unchanged.
+- **`simulateCapture` JPEG progress completes (pre-release review).** The `jpeg` stage counted 8 × 8 blocks, but the encoder reads 256 × 32 source tiles, so its last event stopped short (2 of 64 at 64 × 64). The total and the encoder's `maximumProviderReads` budget are now ⌈height/32⌉ × ⌈width/256⌉, and the last event has `completedTileCount === totalTileCount`. The image data is unchanged (identical from the quantization tables on); the JPEG file bytes change only because the embedded XMP `PrintExportPlan` records the corrected read budget, for images larger than 32 rows or 256 columns. The pinned 8 × 8 `jpegAuto` digest is unchanged.
+- Durand–Dorsey tone mapping (`createDurandDorseyToneMappingTask`) no longer lets one black pixel flatten the image. Pixels with luminance ≤ 0 were floored to log₁₀ = −30, which set the base range: one such pixel in a 4-decade ramp moved the compression factor from 0.180 to 0.022 and roughly quadrupled the run time. They are now left out of the bilateral filter and of the base range, stay 0 in the output, and report `baseLog10 = −Infinity`. An all-zero image returns zeros with compression factor 1. Output changes only for images that contain zero-luminance pixels; images without them are byte-identical (`test/processing-tone-mapping.test.ts`).
+- WebGPU accelerator (#277) fixes. GPU output values are unchanged:
+  - The `webgpu-f32` error bounds of the convolution and the temporal sum now cover weights below 2^-126. The host can round such a weight to zero and a GPU can flush it, so with samples up to 2^100 the reported bound could be exceeded (for example by 2^-60 against a bound near 2^-125). The bound gains a term 2·S_max × (the at-risk weights), which is 0 when no weight is that small (docs/WEBGPU.md).
+  - Convolution readback buffers are released after each band. Before, every band's readback stayed alive until the end, so GPU memory grew with the image instead of the band.
+  - A WebGPU device that arrives after acquisition was aborted is now destroyed instead of leaking.
+
+### Performance
+
+Unless marked otherwise, output is bit-identical to the code before the change, checked by committed hash and frozen-oracle tests. Timings come from the source PRs, on small fixtures, on a shared 4-vCPU Linux host under Node 24. They are indicative only.
+
+- **Native environment RAW (#285, #292, #294).**
+  - Changes: one finite-number pre-walk; a cached parse of engine-owned PSF profiles; one PSF parse per event instead of per site; no per-site serialization of shared state; site plans that keep only the frozen request and image-plane point.
+  - Native acquisition is 2.2–3.0× faster on the 2×2 workloads.
+  - With a large sampled PSF, CPU per site falls by about 30 %, and a site plan shrinks from about 25 to 8 MB.
+  - The native RAW identity walk is about 3× faster (73 → 46 µs per site).
+- **Native SDR** uses a typed-array kernel (about 10–13× faster; 24 MP 8-bit 33.9 → 3.3 s) and an exact LUT-based 8-bit sRGB quantization (#286, #295).
+- **RAW development** uses a typed kernel (#295):
+  - 10–15× faster at 1 MP; 24 MP in 3.8–4.6 s instead of 33–42 s;
+  - creation is O(metadata) (220 → 4 ms at 24 MP);
+  - 24 MP peak array memory falls from 389 to 229 MiB.
+
+  The output changes listed under Breaking changes are intentional and separate from this speed-up.
+- **JPEG (#286, #298):**
+  - an exact-order faster DCT and entropy coder (about 1.6–2.2×; #286);
+  - a growing output buffer instead of a zero-filled full budget (a 384-byte JPEG at a 256 MB budget: 256 MB / ~130 ms → 64 KiB / 0.02 ms);
+  - Print JPEG strip reads with an sRGB LUT (24 MP 1:1: 375,000 → 3,000 provider reads; 4 MP → 0.25 MP: 1,245 → 339 ms) (#298).
+- **Stabilization evaluation** is linear-time (16,000 samples: 3,100 → 222 ms). Native acquisition and development yield to the host about every 8 ms, now also between sites inside a tile, so `cancel()` takes effect after about one site (#287, #292).
+- **Optional optical-stage reuse** re-runs the sensor stage 5.0–11.4× faster than a full recompute (#288).
+- **Lean per-site executor (#305).** Native environment RAW (and so `simulateCapture()`) runs sites that match a self-verified template through a lean per-site executor.
+  - Same maths, same floating-point order, but without redundant per-site re-validation and result envelopes.
+  - Every data-dependent check remains, and falls back to the full engine functions. RAW, callbacks and errors are byte-identical.
+  - `simulateCapture()` 64×64: 6.0 → 0.87 s CPU; 128×128: 20.6 → 2.2 s. RAW stage 0.95 → 0.12 ms per site.
+  - Sampled-PSF and lens-mapped sites are lean-eligible too (#275 follow-up). Their kernels, tap points and mapped queries come from the full chain's own functions; the PSF quadrature's checks still run after each instant's callbacks, and the full quadrature decides when one fails. Output is byte-identical (`test/native-environment-lean.test.ts`). `simulateCapture()` 48×48 (`scripts/benchmark-native-environment.mjs`): 3×3 sampled PSF 11.9 → 1.96 s (6.1×); radial distortion 2.63 → 0.59 s (4.4×).
+  - Pupil-ray sites compute their rays with `calculateSensorApertureRays`' own core after one validation per template, and copy each ray for the provider key by key instead of with `structuredClone` (#275). Byte-identical (`test/aperture-ray-fast-path.test.ts`, lean tests). `simulateCapture()` 48×48 with 1×4 pupil rays: 2.19 → 1.26 s (1.7×).
+  - All #275 follow-ups together, same benchmark and host, main before vs after: sampled PSF 11.2 → 1.60 s (7.0×), radial distortion 2.66 → 0.46 s (5.7×), 1×4 pupil rays 2.32 → 1.15 s (2.0×), default optics unchanged within noise (0.33 vs 0.34 s); RAW and image SHA-256 identical in every case.
+- **CCT/Duv search by Newton root-find (owner approval 2026-10-17).** *Not bit-identical.*
+  - Changes: `calculateCorrelatedColorTemperature` solves d(uv distance²)/dT = 0 with the analytic temperature derivative of Planck's law (safeguarded Newton with bisection, bracketed by the cached coarse scan, converged to 1e-10 of T), instead of a golden-section search. Duv and the inverse use the analytic locus normal instead of finite differences.
+  - Speed (`scripts/benchmark-planckian-locus.mjs`, medians, same 4-vCPU host): CCT/Duv 366 → 31.3 µs (11.7×); chromaticity from CCT + Duv 22.5 → 16.5 µs; Kelvin white balance 21.3 → 18.6 µs.
+  - Results: CCT now agrees with a 50-digit reference root to 3.3e-12 relative. The old search was off by up to 6.0e-3 K below 25000 K and 0.089 K (1.2e-6 relative) above, so CCT changes by those amounts. Duv changes by at most 8.3e-16. The inverse moves xy by at most 9.3e-10 (1.4e-7 at exactly 1000 or 100000 K); at Duv = 0 it is unchanged. No pinned digest changed. Points whose nearest locus point lies just inside a range limit now resolve instead of failing.
+- **`simulateCapture` auto white balance (pre-release review).** `whiteBalance: "auto"` retained the optical stage, which took the first RAW pass off the lean per-site executor, and then re-ran the sensor stage. It now runs the lean RAW task twice: once to measure grey-world AWB, once with the measured intent. Image, RAW, JPEG, PNG, DNG, request and diagnostics are byte-identical to before on seven cases (chart, illuminant, tier, PNG/P3, DNG, rolling-shutter motion, pupil rays, mirror border) and the pinned `jpegAuto` digest. Only the `output.whiteBalance.auto` assumption text and the provenance contract list change: they now say the radiance queries are repeated (`diagnostics.providerEvaluationCount` still counts one pass). 96 × 96 Siemens star, same 4-vCPU host, Node 24.21, medians of 5: auto 12.9 → 3.86 s (3.4×); scene-illuminant 2.20 s before and 2.10 s after (unchanged within noise), so auto now takes about 1.8× a scene-illuminant capture instead of 5.9×.
+- **`simulateCapture` host yields (pre-release review).** The facade yielded with `setTimeout(…, 0)` about every 8 ms. Browsers clamp nested zero-delay timers to at least 4 ms (WHATWG HTML timer nesting rule), so a capture could sit idle for a large share of its run. It now yields with `scheduler.yield()` where available, else a `MessageChannel` message, else `setImmediate`, else `setTimeout` (`src/facade/host-yield.ts`; no import, browser-surface gate unchanged). Output is unchanged (digests identical). A 128 × 128 capture yields about 250 times. Node 24.21 (MessageChannel path, same 4-vCPU host, origin/main vs this change, two alternating rounds, medians of 5 each): sRGB 2.92/2.89 → 2.36/2.59 s, JPEG 2.72/2.80 → 2.62/2.79 s, PNG/P3 2.76/2.87 → 2.57/2.56 s. Node's timer floor is 1 ms, so the expected saving in Node is about 0.25 s per capture; the spread between rounds is of the same size, so treat the Node gain as small and noisy. The larger browser saving is expected from the 4 ms clamp but was not measured here.
+- **PNG encoder.** Bit-reversed fixed-Huffman codes, length and distance codes precomputed once (instead of reversing every symbol bit by bit), a preallocated output buffer, a rolling LZ77 hash, a one-byte check at the current best length before comparing a chain candidate, and one specialised loop per PNG filter (the adaptive heuristic sums costs with a lookup table instead of writing five candidate rows through a closure). Output bytes are unchanged: a SHA-256 over 789 cases (60 images, 8- and 16-bit, every filter and both compression modes, 30 raw zlib streams, 1200×900 images and an iCCP profile) matched before and after, and `test/png-encoder.test.ts` now pins a digest. 4000×3000 RGB, medians of 5 runs, before and after run back to back on the same shared 4-vCPU host, Node 24: 16-bit noise, default settings, 9.8 → 6.1 s; 8-bit gradient 3.3 → 1.0 s; 16-bit noise without filtering 6.8 → 4.3 s; 16-bit noise, stored 4.4 → 2.0 s. On noise the remaining time is mostly the LZ77 match search, which byte identity keeps as it is.
+- **PSF convolution kernels (`resolveLensPsfConvolutionKernels`).** Each patch now accumulates straight into one scratch map sized for the largest allowed radius and keeps a copy cropped to its own reach, instead of holding every tap of every patch and wavelength as a heap object until the end. Every cell receives its weights in the same order as before, so the kernels are bit-identical (21 profile cases and all 15 kernel calls in the existing tests, before/after SHA-256; `test/lens-psf-kernels.test.ts` checks a direct per-tap sum bit for bit). Measured with medians of 3 runs, Node 24, on a shared 4-vCPU host, with a 41×41-tap synthetic Gaussian profile. 384 patches × 8 wavelengths: 5.8 s and 2.06 GB peak RSS → 1.3 s and 111 MB. 1504 patches × 16 wavelengths (2 MB of output): out of memory at a 4 GB heap → 8.0 s and 113 MB.
+- **Sampled-PSF corner lookup.** `resolveLensSampledPsf` finds its interpolation corners by integer grid position instead of building partial coordinate objects and joined-string keys. It selects the same nodes, with the same weights, in the same order. `simulateCapture()` 64×64 with a 3×3×3-node sampled PSF: 6.46 → 4.88 s (medians of 5, interleaved, same host). Corner lookup falls from 1.46 s to 0.10 s of CPU profile. Image, RAW and request digests are identical, and so are 920 random `resolveLensSampledPsf` queries over a 7-axis profile.
+- **WebGPU:** no GPU speed-up is claimed for the WebGPU backend. On the software adapter it was slower than the CPU (#304).
+
+### Tests and tooling
+
+- Coverage rose from 92.4 % to 94.4 % of lines and from 88.7 % to 91.0 % of branches. `npm run coverage` scales timeouts under V8 coverage (#299).
+- New independent checks (#299): spot values beside the bit-identity hash locks, an independent camera-equation RAW oracle, a non-linear temporal-quadrature convergence test, and table-driven rejection tests for public parsers.
+- An informational, non-blocking macOS CI job runs the hash-lock tests (#299). `npm run test:webgpu` runs conformance on a real GPU (#304). It now also covers the sensor stage, the temporal sum, luminance tone curves, chart radiance and the per-fixture rollout (89 tests in three files) and passes on SwiftShader (#277). `npm run test:webgpu:hardware` and `npm run bench:webgpu:hardware` run them on a hardware adapter on Linux, macOS or Windows and refuse a software adapter; they have not been run on hardware.
+- Benchmark scripts that import `dist/` fail when the build is missing or stale (#292).
+- `NUMERICAL_CORRECTNESS.md` documents the cross-engine determinism policy and the test hash locks; `API_STYLE.md` documents naming conventions (#293, #299).
+- Plain-language rewrite of the source comments and docs: shorter sentences, jargon defined at first use, internal ticket chatter removed. Comments and prose only; the comment-stripped build is identical (#309–#312).
+- For AI agents: `llms.txt` and `docs/AGENT_GUIDE.md` ship in the package, and the API reference opens with a task-to-function index that its generator checks against the root exports (#313).
+- No CIE table values in tests (owner decision, 2026-10-17). The CMF, illuminant A, daylight and locus tests now check internal consistency, normalization, round trips and values computed from Planck's law and the daylight formula. The CIEDE2000 tests replace the Sharma et al. (2005) published pairs, whose data file carries no licence, with closed-form special cases computed from the formula. `scripts/fit-cie-1931-cmf.mjs` reproduces the CMF fit (it downloads the CIE table at fit time only), and `scripts/benchmark-planckian-locus.mjs` times the locus functions.
+- No unclear-licence test inputs (owner rule, 2026-10-17): the MurmurHash3 vectors copied from a Stack Overflow answer are replaced by the test's own reimplementation of SMHasher's verification procedure (SMHasher is MIT-licensed; no code copied; the expected value 0xB0F57EE3 is a published fact); the Bradford test follows ICC.1:2010 Annex E with computed D65/D50 whites instead of a secondary website's matrix; the CIE94 worked values from the colour-science documentation are replaced by closed-form cases; the longitudinal-chromatic-aberration test uses a synthetic glass (n_d = 1.5, V_d = 60) instead of catalogue values.
+- `docs/licenses/adobe-dng-patent-license-record.txt` records where the Adobe DNG patent licence was read (URL, date, page SHA-256), its exact required notice and a summary. It is not a copy of the licence: Adobe's Terms of Use do not clearly allow copying its website text.
+- Every test and helper file in `test/` now starts with `// SPDX-License-Identifier: Apache-2.0` (117 files that lacked it; all are the project's own work).
+- New CI job `licence scan`: ScanCode Toolkit 32.5.0 (hash-pinned in `.github/scancode-requirements.txt`) scans the repository, and `scripts/check-scancode-policy.mjs` fails on a non-Apache-2.0 licence finding or a foreign copyright holder unless the file and finding are on its reviewed allowlist. See `docs/DEVELOPERS.md`. The pull-request template now asks for the source, licence and patent check of new algorithms, constant sets, datasets and file formats.
+- `AGENTS.md` is reset to a short standard file with three rules: evidence-based changes, free-to-use sources only, and owner approval for anything that goes to production (#308, #313).
+
+## 1.5.0 — published October 7, 2026
+
+See [the 1.5.0 release record](https://github.com/Photivra/photivra/blob/main/docs/RELEASE_1_5_0.md) for the candidate review.
 
 - Add optional `NativeRawInput.tileWidth` (1–256 native sites) so bounded native RAW acquisition can use smaller execution chunks while preserving the existing 256-site default, physical sampling, absolute CFA coordinates, deterministic noise seeds, shutter timing, output payload and existing whole-event/resource caps.
 - Preserve the exact acquisition tile width through same-RAW validation and development. Reject invalid widths, inconsistent tile counts and stale plans instead of silently rebuilding a default-width plan.
@@ -10,13 +394,15 @@
 
 ## 1.4.0 — published October 4, 2026
 
+See [the 1.4.0 release record](https://github.com/Photivra/photivra/blob/main/docs/RELEASE_1_4_0.md) for the candidate review.
+
 - Add standalone evidence-bound ideal circular pupil rays and optional origin-aware bounded photo/RAW evaluation. Reuse shared focus and camera rotation, average normalized pupil irradiances before the existing sensor pipeline, and retain exact-once working-f-number throughput. Reject simultaneous sampled PSF, missing callbacks, invalid geometry and excessive budgets before provider work. Production depth/visibility composition remains unsupported. See `docs/SENSOR_APERTURE_RAYS.md`.
 
 - Add separate metadata-only packed native RAW, physical source-to-RAW and same-RAW reconstruction/SDR tasks with explicit 24 MP admission, bounded tiles, absolute CFA/seed identities, cancellation and single-transfer ownership. Preserve the reference RAW caps and scalar mathematics.
 - Add bounded post-SDR Print crop/area downsampling and original baseline JPEG encoding with an original sRGB ICC profile. Explicit source hashes remain caller declarations; platform save/share, printer appearance and physical device acceptance are separate.
-- Record complete one-megapixel constructed RAW → SDR → downsampled JPEG execution and independently decoded JPEG/ICC/area-filter controls. See [native RAW and Print contracts](docs/NATIVE_RAW_AND_PRINT.md).
+- Record complete one-megapixel constructed RAW → SDR → downsampled JPEG execution and independently decoded JPEG/ICC/area-filter controls. See [native RAW and Print contracts](https://github.com/Photivra/photivra/blob/main/docs/NATIVE_RAW_AND_PRINT.md).
 
-## 1.3.0 — published
+## 1.3.0 — published October 4, 2026
 
 - Add evidence-bound radial illumination throughput to bounded environment photo/RAW execution, validating every inverse PSF tap before provider callbacks and applying attenuation once in physical sensor coordinates. Production composition requires explicit vignetting fidelity. Preserve unity arithmetic, resource limits and unverified transport flags.
 
@@ -27,23 +413,24 @@
 - Add explicit complex-pupil propagation distance and result binding (model 1.1.0), preserving omitted-input nominal focal-plane kernel values. Finite-focus callers can pass the shared resolved image distance without implying qualified exit-pupil geometry.
 - Audit #195 planning acceptance across print/viewing scales, retained crops, invalid-input recovery and exact integer alternatives.
 
-## 1.1.0 — historical preparation notes
+## 1.1.0 — published October 3, 2026 (historical preparation notes)
 
 - Add a bounded regional coherent-sinusoid diagnostic and explicit stage/region/source identity. Independently validate Fourier modulation and angular projection using owned analytic references; preserve acquisition, system MTF, noise/artifact/perception qualification as unassessed. Full #196 acceptance remains blocked. See `docs/PRINT_DETAIL_ASSESSMENT.md` and `docs/PRINT_DETAIL_VALIDATION.md`.
 
 - Add native-only Print planning and conditional size queries. Independent viewing distance and explicit pixel/stroke/line-pair conventions derive density; advanced manual PPI creates a distinct plan. Preserve confirmed native crop/orientation and exact-ratio integer output, reconcile declared lab constraints, and return no recommendation for upscale or conflicts. Captured detail and delivery remain unassessed. See `docs/PRINT_PLANNING.md`.
 - Align package/root creator identity at 1.1.0 for this additive release. Existing APIs, archived records, fixtures and all independent schema/POC/production-plan versions remain unchanged. See `docs/RELEASE_1_1_0.md`.
 
-## 1.0.1 candidate — publication pending
+## 1.0.1 — published October 2, 2026
 
 - Expand Node support to maintained 22/24 LTS plus 26 Current, with patched-major CI and the existing 22.13 minimum job, reviewed lifecycle windows and updated tooling guidance. Keep Node 24 build/typings baseline.
 - Align the npm package and `ENGINE_API_VERSION` at 1.0.1 and enforce equality in source metadata, generated references and isolated packed consumers. Schema/model/POC/plan versions and scientific calculations are unchanged. New capture/plan creator identities and hashes can differ; archived records and acceptance artifacts retain their original versions. See `docs/RELEASE_1_0_1.md`.
 
-## 1.0.0 candidate — publication pending owner tag
+## 1.0.0 — published October 2, 2026
 
 - Prepare the stable public distribution after all 32 V1 feature/science items and defect #178 are reviewed and merged. Package/lock/citation become 1.0.0; root contract 0.116.0 and every independent model/schema/POC/plan identity remain unchanged. No scientific arithmetic, seed, fixture hash, exported signature or accepted execution envelope changes.
 - Reconcile human/agent/source guidance, actual bounded production integration and closed tier/performance/export/conformance acceptance. Add developer capability navigation, exact root-export reference, packed executable examples, strict documentation/consumer checks and exact owner tag/publish procedure.
 - Preserve synthetic/calibration/visibility/PSF/resolution limits and the recorded external-editor/hash/build limitations. Review compatibility/migration and owner handoff in `docs/RELEASE_1_0.md`; this entry does not certify npm publication.
+- The preparation evidence is in [the final 1.0.0 preparation audit](https://github.com/Photivra/photivra/blob/main/docs/RELEASE_AUDIT.md).
 
 ## Historical development — engine API 0.116.0
 

package/CITATION.cff

@@ -9,7 +9,7 @@ abstract: "An open TypeScript engine for the science and mathematics of photogra
 repository-code: "https://github.com/photivra/photivra"
 url: "https://photivra.com"
 license: "Apache-2.0"
-version: "1.5.0"
+version: "2.0.0"
 keywords:
   - photography
   - camera optics