[dancancer]

Normal X3F rendering now feeds the shared preview/export engine and all four native clients (macOS, iOS, Android and Windows). Fresh edits use normal-v1; records without an X3F identity keep the existing legacy false-color rendering. Mode changes preserve ordinary adjustments and looks. Mac and iOS switches to normal also disable incompatible lens correction in one settings update, and normal lens tools cannot re-enable it.

The renderer pins x3fuse-core and the measured DP1S response. Merrill uses the verified Neutral profile; Quattro uses the verified AsShot/SPPA subset. Unsupported camera/settings combinations fail explicitly, with an explicit legacy recovery path. No SIGMA executable or proprietary library is needed at runtime.

Preview/reference caches, per-photo batch snapshots, relative white balance, exports and CLI recipe v7 carry the same X3F identity. Normal loads use LibRaw for identification only and unpack lazily if legacy is subsequently selected. CPU pixel conversion uses the bounded executor. Merrill chroma-offset workers, final highlight-repair rows and despeckle detection run in parallel while ordered accumulation/repair preserves output pixels.

Integration for merge

Source: 282da7856ae1d3dee3f1edf9c771174fb31e5e2d.
Base incorporated: ef21231f5b47da92ee756d318be5122dc51c2e35 (development, including batch-flow PR #158).

Merged into development as 9857b4794bfa4ba26559b39fd99c67a27c4d88d7. The exact development push Hosted CI run 41061004882 also passed contracts, all four platform model jobs and the aggregate CI result; its checkout SHA was verified.

• Preserved the new asynchronous collection preflight and moved validateAIInput(url, settings:) to MacCollectionExportPreparation.snapshot.
• Kept both sets of macOS localization entries.
• Added regressions for normal X3F AI rejection and mixed normal/legacy identities surviving preparation and per-photo freeze.
• bash RawLabMac/build.sh: macOS arm64 app and bundle checks passed.
• bash RawLabMac/tests/batch-selection-model.sh: 132 checks passed, including asynchronous cancellation/stale results, real per-photo native exports and the new X3F regressions.
• python3 scripts/localization/generate.py --check: all 30 catalogs byte-identical.
• bash RawLabMac/tests/batch-flow-ui.sh <isolated-output> plus actual native UI execution: a normal X3F completed collection preflight, automatic frozen-task launch and original-size JPEG export (1760×2640); journal confirmed per_target_frozen, normal-v1 and success.
• Independent read-only review of the merged Mac/iOS/Android/Windows batch paths found no missing X3F identity, settings or admission checks.
• Current-head Hosted CI run 41060368155 passed: static contracts, macOS/iOS/Android/Windows models and the aggregate CI result. The pull-request event checked out 31bcdb9f6c536da5f4531f1d307f5f8a931141e3, merging source 282da7856ae1d3dee3f1edf9c771174fb31e5e2d into base ef21231f5b47da92ee756d318be5122dc51c2e35. This model-only CI does not substitute for the source-bound native/UI evidence below.

Earlier platform validation

Source: 165a2a3cfae800a508b402c19e5209f6f0a36193, including development a3d6bded14f963cd8f5f44c11109c747bb978adc.

• macOS arm64: app/bundle build and 119 core/CLI/Rust CTests passed. Targeted normal/legacy, lazy-unpack, source replacement, cancellation, processing-session and white-balance regressions passed after the shared CPU conversion change. RGB16 pixels were byte-identical before/after optimization. Actual isolated UI mode round-trip, quick-preset panel and PNG16 export passed.
• iOS: device arm64 and simulator arm64/x86_64 frameworks built and verified; app/UI targets compiled. DP1S/Merrill/Quattro native workflows covered cache/modes, relative WB, auto exposure, HSL, JPEG/DNG and error recovery. Executed iOS 27 UI tests covered mode switch/export/reopen and failed-normal legacy recovery; exports retained native 1760×2640 dimensions.
• Android: both ABI APKs built, 391 JVM tests passed, one native X3F instrumentation test and three actual Compose UI flows passed. ABI libraries passed 16 KiB alignment checks.
• Windows x64: native renderer and WPF app built, managed editing models and eight selected native/Rust CTests passed. Actual engine checks covered mode/reference pixels, WB, exposure, PNG16/JPEG/DNG, GUI/CLI parity, errors, recovery and persistence. First-run/restart UIA checks passed.
• Historical Hosted CI run 41032808978 passed contracts at that draft revision. It is not current-head CI evidence.

Merrill performance follow-up

Source: 81d92d92be55ee581c1081213a76d20ca7a895cc. Measurements cover a complete native bridge decode of one original DP2 Merrill sample, excluding hashing/file writes.

• Apple M3 Max: median of five alternating fresh-process runs fell from 2.593 s to 1.587 s (38.8% lower). Pixels were byte-identical, including 1/2/4/8-thread checks.
• Windows VM without hardware FMA/AVX: one fresh decode per version fell from 168.49 s to 59.28 s. Pixels were byte-identical; this is a single-pair observation.
• Mac decoder tests: 247 passed, 3 ignored; targeted cancellation and Merrill workflows passed. Windows parallel tests: 4 passed, 1 ignored; bridge tests: 9 passed, 2 ignored; in-flight cancellation passed.
• Broader Mac core run: 111/113 passed. geometry_api and geometry_raw failures reproduced with unchanged C++ and pristine upstream Rust. Sixteen Windows native-oracle failures also reproduced identically upstream; these are recorded baseline limitations, not a claim of a fully green cross-platform oracle suite.

Lens-correction follow-up

Source: 8c53620a6e56f0a0c971e28d291a12adce185f2a.

• RawLabMac/tests/edit-model.sh and RawLab/tests/edit-memory.sh passed, including settings/persistence, profile preservation and returning to legacy. The new lens-switch assertion failed before the fix and passed afterward.
• Mac and iOS tests/x3f-workflow.sh passed native preview/export after switching a lens-enabled legacy edit.
• RawLab/tests/x3f-ui.sh: 3/3 executed iOS 27 simulator UI tests passed, including lens-enabled legacy → normal → Photos export → restart.
• Actual isolated Mac UI verified the same switch, disabled lens entry/tab, PNG16 export and persisted normal mode after restart.

Limits

DP1S remains a measured approximation; Quattro still differs visibly from SPP. Family dispatch does not establish every body/control combination. Merrill retains serial dependency stages and full-resolution development cost. Normal X3F uses the display-referred CPU path; GPU Auto falls back and Force reports unsupported.

Physical mobile devices, minimum-OS runtime coverage and normal-X3F GPU processing are not verified. Mobile/Windows native/UI suites were not repeated for the final batch integration; their previous source-bound evidence remains above. Capture EXIF may be absent when the OS cannot parse X3F. Windows input replacement while open remains unverified because LibRaw prevents deletion.

Original RAW checksums stayed unchanged. Logs, source manifests and UI screenshots are retained outside tracked source. Merge target is development; no release or deployment is included.