Add native eraser and drawing composition candidate

[KyleMit]

The native drawing candidate needs chronological erasing, coherent painted snapshots and a reliable visual-ink observation for Clear. This unit adds fixed-grid checkpoints/output, bounded PNG alpha observation and renderer recovery that preserves canonical History and Undo. The latest repair admits the finite iOS PNG metadata observed in an actual Clear snapshot while retaining strict image validation.

Candidate behavior

• Retain the canonical 1000-operation log, strict v3 page/brush/eraser readers and explicit legacy readers. Keep paper and coloring outlines outside transparent ink.
• Bind Export/Clear snapshots to drawing identity, epochs, decoded-image readiness and command/input leases. Reject stale callbacks and retain history after failed observation.
• Preserve ordered simultaneous contacts in one Undo group and the shared Audio owner's contact, interruption and Settings leases.
• Keep incomplete replay prefixes hidden and require Android's URI/grid-validated full decoded-image callback.
• Continue PNG work through React Native's public idle-task API with an owned timer fallback and settle-once cleanup.
• Accept ordered singleton RGBA8 sBIT and the observed eXIf/iDOT forms. This is bounded metadata handling, not general TIFF or every PNG format support. CRC, chunk order, contiguous IDAT, zlib/Adler, IEND, trailer, cancellation, allocation and deadline checks remain enforced.

Exact source and review

Current head b922bf1, tree f16ba84a9f310e90a3ee111024c49205b87a4b8e, parent 650c00b. Integration base is 5bd34d3. The two-path SVG follow-up moves luminance masking to the typed style supported by both installed renderers. The real composed-browser journey had stopped on React's unknown DOM maskType console error after Eraser, before save/reopen/export. Actual installed ReactDOM/SVG tests now enforce standard luminance CSS, no unknown-prop error, transparent erased ink, preserved surrounding ink and paint after erasing. Sibling Brush, Contacts, Audio and coloring-page reviews remain independent.

Original eraser review remains 2 used / 1 remaining in Claude conversation 521329d3-e4cd-42f4-8823-dfd4f2d199e6. Both earlier rounds and provenance are preserved; the remaining round is held for exact-source native evidence. N1 remains exhausted 3/0 and source-only. This PR does not accept a framework or complete the campaign.

Validation

• Current b922bf1: 387 files / 8,702 tools tests passed, direct exit zero, 56.40 seconds, unchanged default suite. Native TypeScript, check, lint, formatting and 51 focused tests passed. Two deliberate regressions—restoring the direct DOM prop and changing the mask to alpha—failed their intended checks; the original source restored exactly and five artwork tests passed. The normal commit and single nonforce GitHub push passed. The first publication guard queried the preserved local clone origin rather than GitHub; that failure remains recorded, and the corrected explicit GitHub pre/post checks verified 650 → b922bf1. Recorded test processes closed. Current-head CI and composed runtime qualification are pending; the original Claude budget remains 2 used / 1 held.

• Historical pre-SVG source 650c00b: 387 files / 8,700 tools tests passed, direct exit zero, 54.31 seconds, default worker configuration. 82 focused tests, native TypeScript, repository check, lint, formatting, native-source and topology checks passed. Normal commit hooks and nonforce push passed; recorded processes are closed.

• The captured iOS PNG exercises the production decoder. Positive and malformed/order/duplicate controls cover the metadata repair. Scheduling and cancellation controls remain meaningful; modeled ordering does not establish native latency.

• Historical 650 native compile CI passed for the shipping Capacitor shells. Those jobs do not compile this experimental drawing candidate. Historical 650 Tests CI passed. ADR Integrity passed; topology proof was skipped. Draft status remains.

• Historical failed fixtures, native/resource observations and preflight sequencing faults remain preserved. No cap, source guard or native-module exception was relaxed.

Native evidence and remaining gates

A private composed candidate at 86d0ab1f9622bbc67173c997780e320c34270bb4 completed an ordinary optimized iOS simulator journey: Blue Crayon on Sunshine, Clear, one Undo, Save, catalog reopen and local PNG export. Its saved JSON and 3072×2304 PNG were retained and independently read. The share preview was dismissed without delivery. This is a narrow one-stroke workflow. There are 21 remaining product-source differences between that candidate and this public head, so it does not establish whole-public-app native acceptance.

The historical pre-SVG source 650c00b completed an ordinary optimized Android Release journey on an API28 emulator: Blue Crayon on Sunshine, natural Clear preserving the coloring page, one Undo, Save, catalog reopen and local PNG export. The actual v3 saved JSON and opaque 1024×768 PNG were retained. An independent full PNG CRC/zlib/scanline decode agrees on all 3,145,728 RGBA bytes. This establishes that narrow workflow; full drawing fidelity and whole-app acceptance remain pending. The captures also expose system-navigation overlap over controls/status, which remains an open product defect. The current SVG follow-up has no new browser or native runtime evidence; the current public iOS runtime journey is pending.

Full Crayon/Magic/contact/history/coloring fidelity, failure recovery, lifecycle, audio, accessibility, performance, signing and release gates remain open. Startup-inclusive RSS failures of 298.875, 308.09375 and 263.31 MiB remain above the unchanged 256-MiB ceiling. The 60-second SMALL gate, mandatory observer and independent sealed-reference raw-RGBA comparator remain required.

Historical 650 Android visuals

These captures belong to 650c00b and the narrow API28 workflow above. The visible system-bar overlap remains unresolved.

Clear preserves Sunshine	One Undo restores Blue Crayon

Saved picture reopened	Actual exported PNG

Historical visuals

These c813 workflow images are source-bound reference observations, not current-head acceptance.

Historical be88 reopen fault (reference only)	Historical c81312 reopen ready

Historical c813 paired eraser retains Magic and page	Historical c813 one Undo restores both Crayon strokes

Construction and limits.

[KyleMit]

Independent review by the claude rival agent, round 1, of pull request 2742.

Scope. I read the product source at head be88bc2 under experiments/native-architecture/src and followed each production caller. That covered:

• Input: the contact responder, cohort and touch boundary.
• History: the v3 model, parser, Clear/page/rainbow rules, and the one-Undo cohort commit.
• Rendering: RasterInk checkpoint planning, InkScene masks, Crayon/Magic Ink, InkArtwork scope and CrayonGlaze, plus outlines above live and exported ink.
• Capture: svgCapture, FixedInkCapture and PictureCapture, plus the DrawingSurface capture/lease plumbing.
• Clear check: the native PNG alpha decoder (base64, chunk/CRC, inflate/Adler, work slicing) and the observation controller.
• Recovery: renderer Retry and the generation guards.
• Audio: the controller, the expo-audio loader, contact sound leases, the settings store and sheet, and AppState teardown.
• Native patches: the react-native-svg SvgView backdrop patch and the expo-audio media-reset patch.

I did not review validation and topology plumbing beyond noting it. I left the known CI failures (joint-lock freeze literal, SVG nlink2, the fullRGBA deep equality) alone and do not suggest weakening any pin.

Verification. I ran two small scratch checks in my own sandbox, then deleted them:

1. A node strip-types script against planInk.
2. A happy-dom vitest mount of the real DrawingScreen, with a control case. Its ScrollView mock fires onContentSizeChange when a child is added or removed, standing in for RN layout behaviour.

I ran no device, browser suite, server or performance command, and asked the handler for nothing.

Findings.

1. Truncated strokes (blocking, reproduced). The new audio failure message, and its clearing on a later successful load, sits inside the ScrollView content. The onContentSizeChange → refreshGeometry → resize chain then settles the active cohort and drops the rest of the gesture. In the repro the committed stroke had 2 points; the control without the audio failure had 4.
2. Erased ink reappears briefly (suggestion, confirmed by script). After Undo or reopen moves back across an eraser layer, the visible frame shows the planner's unmasked capture prefix while the checkpoint is prepared, so erased ink is visible again until that finishes.

Checked with no defect found:

• Cohort capacity and Crayon seed reservation, and the one-Undo commit.
• Exact-key v1/v2/v3 parsing, including magic rainbow consistency with save round-trips.
• Clear's blank and no-history rule, and its observation identity checks.
• Ready-plan pinning, capture identity/deadline/cancel, and the export history recheck.
• Retry generation refusal; settings and command leases are released on every path.
• The PNG decoder's synchronous work limits, which stay under 8192 units on every charging path.
• Contact sound leases holding one loop until the last contact.

Not established. Neither finding was checked on a device. Native touch delivery, actual native PNG formats, Crayon BackgroundImage fidelity and the full draw/edit/save/reopen/export workflow remain unproven, as the handler stated. Nothing here counts as whole-product acceptance.

Verdict: not ready to merge as-is because of the stroke-truncation defect.

[KyleMit]

Independent review by the claude rival agent, round 2, of pull request 2742.

Round 2 verdict: both round-1 findings are fixed, and I found no new concrete defect in the delta. This round covered be88bc2 → 76969fe (c81312b plus the workflow-only 76969fe), reviewed against base 9f64c4c.

Round-1 finding 1 — stroke truncated by the audio message (blocking): fixed.

• DrawingScreen.useIdleMessage now freezes both the status notice and the sound/audio message at their pre-contact values while drawing is true. It publishes the new text in the render after the last lift.
• I re-ran my original round-1 repro unchanged against this head. It mounts the real DrawingScreen with a ScrollView mock that fires onContentSizeChange on child changes. With the audio load rejected mid-stroke, there were now 0 content-size changes during the stroke, and all four points (10,20 → 30,40 → 200,200 → 400,400) were committed. In round 1 only 2 points survived.
• The owner's new native-audio-layout-mounted.test.mjs also covers the recovery edge: the message clears on a successful load mid-stroke and the second stroke stays intact. It also checks that a genuine frame change still settles the cohort.
• One residual layout change mid-stroke remains: the Retry button appears on a renderer fault. That stroke is already being settled by the fault itself, so I am not raising it.

Round-1 finding 2 — erased ink visible again during preparation (suggestion): fixed.

• RasterInk now only renders the visible frame when plan.prefix.length === strokes.length. A partial capture prefix is never drawn to the visible paper.
• The paper is blank during preparation instead of showing un-erased ink. This matches the "render nothing" option I proposed.
• The new raster test walks loaded [crayon, erase, marker, erase] history and an Undo back to [crayon, erase]. It checks that no opacity-1 frame exists until the complete render is ready.

New source in the delta (Android DecodedPng readiness witness).

• I read it against the installed RN 0.86.3 ReactImageView/ImageLoadEvent and the react-native-svg ImageView Android sources.
  • Load event: onFinalImageSet fires for memory-cache hits too. Its payload carries the original source URI and the decoded imageInfo width/height, so the URI and 1024×768 grid check is meaningful.
  • Cache sharing: with resizeMethod="none" and no blur/tint, RN builds its request with no ResizeOptions and a null postprocessor. That plausibly shares the Fresco bitmap-cache entry that svg ImageView.draw reads from synchronously at toDataURL.
  • Pinning: the witness stays mounted, pinning that bitmap, for as long as each capture consumer needs it.
• Stale callbacks are refused in each consumer:
  • DecodedPng checks active and identity against the memoized source.
  • FixedInkCapture checks current.plan === plan.
  • RasterInk.imageFailed checks incomingRef and checkpointMatches.
  • PictureCapture routes through fail and isCurrent.
• Failure handling: wrong-grid and decode failures are terminal. A missing callback falls back to the existing 10 s deadlines. iOS and web keep the SVG onLoad owner.
• The drawingAudio.ts throwIfAborted replacement is equivalent.
• I ran the targeted suites in my sandbox: audio-layout, raster-ink, decoded-png and picture-capture, plus my repro. All 46 tests passed.

CI delta.

• fetch-depth: 0 is set on the Browserless job.
• PNPM_CONFIG_PACKAGE_IMPORT_METHOD: copy is scoped to the pnpm/setup step, which itself performs the install, so it takes effect.
• The freezeSource fallback only accepts a lock mismatch when the authenticated joint qualification binds the baseline to the reviewed topology lock and binds the actual lock and workspace hashes. Nothing is weakened.

Not established.

• Fresco cache-key equality between RN's request and svg's ImageRequest.fromUri, and actual native draw behaviour, are inferred from source. I did not run them.
• The handler's Android Release workflow, export decode and saved-file results at c81312b were not independently verified. I did not request the private receipts because they would not change this source verdict.
• None of this is whole-product, native-allocation, pixel or performance acceptance. The held gates listed by the handler remain open.