Advance Blender 5.2 web parity through M12-03D

docs/status/M11-14.md

@@ -0,0 +1,64 @@
+# M11-14 Status
+
+status: done
+task: close render, compositor, and media cancellation/restart/resource recovery
+updated: 2026-08-17 America/New_York
+
+## Scope
+
+Schema 1 evidence fixes one report for each of `RENDER`, `COMPOSITOR`, and `MEDIA`.
+Every report binds real source bytes, a domain-specific cancellation code, a domain-specific
+budget code, generation 1/2 identity and output hashes, positive release receipts, zero
+owned resources after release, and a non-empty recovered output. The suite parser rejects
+undeclared fields, missing or duplicate domains, published cancellation results, restart
+drift, budget mutation, and incomplete release.
+
+The Chromium production-path case opens real Blender Main fixtures for Render and
+Compositor and decodes a real H.264 fixture for Media. Render reads an actual WebGL RGBA8
+frame, Compositor executes the real Main GraphIR into Float32 output, and Media generates
+the initial RGBA8 proxy frame. This task closes only bounded lifecycle behavior; it does not
+claim full Eevee/Cycles parity, arbitrary compositor nodes, frame-exact long-video decode,
+or complete audio/video rendering.
+
+## Evidence
+
+- `WEB_TEST_PORT=5592 npm --prefix web run test:render-compositor-media-recovery` passed:
+  protocol negatives 3/3, Blender 5.2 Eevee reference checker, Blender 5.2 Compositor
+  golden checker, and Chromium 1/1.
+- Render used `m11_render_reference.blend`, rejected a pre-cancelled open with
+  `OPEN_CANCELLED`, preserved the active Main, restarted WebEngine at generation 2, and
+  reproduced the same scene identity and WebGL output SHA-256. Aggregate texture overflow
+  returned `GPU_TEXTURE_BUDGET_EXCEEDED` without replacing the retained texture; dispose
+  reported positive released bytes/resources followed by zero owned textures.
+- Compositor used `m11_compositor_allowlist.blend`, returned `COMPOSITOR_CANCELLED` from the
+  periodic executor check, rejected width 8193 with `COMPOSITOR_BUDGET_EXCEEDED` before
+  cache mutation, reproduced GraphIR/Float32 output after Worker restart, and cleared the
+  LRU to zero.
+- Media probed and decoded `sequencer-probe.mp4`, rejected a pre-cancelled proxy decode with
+  `SEQUENCER_CANCELLED`, rejected a cache one byte below the frame size with
+  `SEQUENCER_BUDGET_EXCEEDED`, cleared the first cache, then re-probed and re-decoded the
+  H.264 source before reproducing the source/decode/profile identity and RGBA8 payload
+  SHA-256 in a rebuilt session.
+- Regression passed: full Node 193/193, typecheck, lint, production build (75 modules),
+  render resource budget unit 3/3 plus Chromium main/Offscreen 3/3, Compositor golden unit
+  3/3 plus Chromium 1/1, media proxy cache unit 3/3 plus Chromium 1/1, status consistency,
+  release evidence, and `git diff --check`.
+
+## Artifact Hashes
+
+- evidence protocol: `a1b0b36cf93173347d55a955ff2e02f3666f7c28ef7f06442b86f0ee2b272286`
+- Chromium production suite: `ef9cd58ce3bbd522c72075e82d6423387b61039509996851d8d5ebf3a0d86789`
+- media proxy cache: `7a1dbf8e838c47e2b99bc8932997e79d3c3cf2636b6285ace083800d833e2e64`
+- GPU texture store: `a87adefa67b243cfd0cfcad0573a1b646f1e8be8abd0a187e1dc29cab2954d44`
+- compositor cache: `3ce4819dadb2d6de7305c3676b2708689cd8be95e6fa7894651d6a02c4658b31`
+- unit: `3cec4a33f28a76423a9678bcb61244cc463f5f2f5939c3f0b6865d34063e1f55`
+- Chromium spec: `1578848eda7cb26cdf1584fa13f4cc2e252e782959d489dc4454e45c8d06595a`
+- golden manifest: `87f17b0437d819e00c4a0902146d6549cf713482667ead627a45ba2b46050247`
+- package: `0e731a5c826a999eef372f875c6c5ce9d697fd369a929025370a74cf18a93582`
+
+## Rollback
+
+Remove the recovery protocol, browser suite, unit/Chromium tests, M11-14 golden manifest,
+and package command. Restore the media proxy generator signature, Compositor cache clear,
+and GPU texture release receipt only if no later caller depends on them. Remove the three
+family lifecycle slices, restore M11 to 13/14, and move the queue back from M12-01A.

docs/status/M12-01A.md

@@ -0,0 +1,59 @@
+# M12-01A Status
+
+status: done
+task: inventory Blender 5.2 AssetMetaData, tag, and catalog fields
+updated: 2026-08-17 America/New_York
+enablingTask: true
+parityStateChange: false
+
+## Scope
+
+The machine inventory freezes the Blender 5.2 storage and public API surface needed before
+designing a full-parity Web catalog schema. It covers every `AssetMetaData` DNA member,
+the `AssetTag` storage and collection operations, actual `AssetMetaData` RNA properties,
+Blend read/write participation, `AssetCatalog` semantic/runtime fields, catalog definition
+file version/record order, path hierarchy rules, and the current Web v1 interface snapshot.
+
+This task deliberately does not create the desktop catalog fixture, Web schema v2,
+migrations, IndexedDB behavior, or a new verified parity slice. In particular, a source
+inventory is not evidence that Web preserves or writes the inventoried fields.
+
+## Findings
+
+- `AssetMetaData` has 14 DNA members: 10 persisted semantic/UI members, custom
+  `IDProperty` metadata, one runtime type pointer, one derived tag count, and ABI padding.
+  The real Blender runtime exposes 10 RNA properties.
+- `author`, `description`, `copyright`, and `license` are optional dynamic strings. Empty
+  values are valid Blender state; the existing Web v1 manifest currently requires non-empty
+  author/license and has no description/copyright fields.
+- `catalog_id` is the authoritative RFC4122 identity. `catalog_simple_name` is a read-only
+  recovery copy and cannot replace the UUID-to-path mapping.
+- Catalog hierarchy is implicit in a cleaned UTF-8 slash path. CDF v1 records
+  `UUID:path:simple_name`; no parent UUID is stored. Duplicate paths are legal and resolve
+  deterministically by first-loaded state and UUID.
+- Existing Web v1 directly represents catalog ID, tags, author, and license, but misses seven
+  inventoried metadata semantics and models hierarchy as an explicit `parentId` graph.
+
+## Evidence
+
+- `npm --prefix web run test:asset-catalog-inventory` passed on the first complete run:
+  `dna=14 rna=10 tag=3 catalog=3 gaps=7 next=M12-01B`.
+- The checker binds eight source SHA-256 values, extracts the RNA property declarations,
+  launches `Blender 5.2.0 LTS --factory-startup --background`, compares the actual runtime
+  property identifiers/types/read-only flags, verifies Blend IO markers and CDF v1 format,
+  and uses the TypeScript AST to freeze the current Web interfaces.
+- The inventory manifest SHA-256 is
+  `194d5fd0fef5044f5e82a51931a061e226445f0f53410af9dc0594c70a79e936`;
+  the checker SHA-256 is
+  `38839f47dbe82ad7931e5e444e124e87b64a604d9358be6d71cce7769439e57b`.
+
+## Next Task
+
+`M12-01B`: generate a desktop Blender 5.2 catalog v1 fixture and canonical JSON from the
+inventoried fields. Do not begin Web schema v2 until that desktop artifact is verified.
+
+## Rollback
+
+Remove the inventory manifest, checker, package command, and this status entry; restore
+M12-01A to pending and move `nextTask` back from M12-01B. No parity ledger rollback is
+needed because this enabling task did not change a family slice.

docs/status/M12-01B.md

@@ -0,0 +1,55 @@
+# M12-01B Status
+
+status: done
+task: generate a Blender 5.2 catalog v1 fixture and canonical desktop report
+updated: 2026-08-17 America/New_York
+enablingTask: true
+parityStateChange: false
+
+## Scope
+
+The locked Blender 5.2 runtime generates a catalog definition v1 file and a `.blend`
+containing Object, Material, and World assets. A separate Blender process reopens the
+fixture and exports one canonical JSON report from the inventoried AssetMetaData fields.
+The report covers catalog hierarchy, assigned and nil catalog UUIDs, optional empty text,
+ordered tags, active tag, preferred import method, custom ID properties, and Blender's
+automatically generated Object `dimensions` metadata.
+
+This is an enabling desktop baseline. It does not define Web schema v2, migration behavior,
+stable Web asset IDs, or catalog mutation parity, and it does not change a ledger slice.
+The read-only `catalog_simple_name` remains empty because Blender's RNA catalog UUID setter
+clears it outside an Asset Browser context; the fixture records that behavior rather than
+inventing a recovery name.
+
+## Evidence
+
+- `npm --prefix web run test:asset-catalog-v1-fixture` passed from a fresh temporary
+  directory: `catalogs=3 assets=3 metadata=complete next=M12-01C`.
+- The checker verified the locked Blender version and every artifact hash, regenerated the
+  CDF and `.blend`, opened the generated file in a second Blender process, and compared its
+  canonical report exactly with the checked-in report. It then reopened the checked-in
+  fixture in another Blender process and repeated the exact comparison.
+- Catalog definition v1 contains three deterministic UUID/path/simple-name records, including
+  one nested path. The canonical report contains three assets across MATERIAL, OBJECT, and
+  WORLD, preserves tag order and custom metadata, and records an uncataloged nil UUID.
+
+## Artifact Hashes
+
+- generator: `4156ec6293562d44f87ad5a268de52fbfa31a65da8263a67a2bc45bf22999307`
+- canonical exporter: `3dbccd8df54d8686aa526f7967f58fd1008336c4c5b1deed01a136ba15aa3e41`
+- checker: `c2813aa36482eff0b23ca0209f488cfe70ea11e4f39cc6c6036d6c47bbc8e17b`
+- desktop `.blend`: `8facfe82e3ca0a0605c139ef5bdcbb82d27a6953a6add4e008b68af90bc1211f`
+- catalog definition: `a72f542acb2d2239951a2b20cda0f92305e1d6d8222f84072ad1aab52e3e4c98`
+- canonical report: `6fc6def0b9d0e4f51ef40c1d87a1f17074f6340c126a01aee49e5e53271c961e`
+- manifest: `1ee0abf961b82195e5fb586eb9e59302e4f7f839615f1ebbdf5cdcba8b60accd`
+
+## Next Task
+
+`M12-01C`: define Web catalog schema v2, stable catalog/asset identity, and bounded text and
+collection limits from the verified desktop baseline.
+
+## Rollback
+
+Remove the M12-01B generator, exporter, checker, fixture, CDF, canonical report, manifest,
+package command, and this status entry. Restore M12-01B to pending and `nextTask` to
+M12-01B. No parity ledger rollback is required.

docs/status/M12-01C.md

@@ -0,0 +1,50 @@
+# M12-01C Status
+
+status: done
+task: define Web catalog schema v2, stable identities, and budgets
+updated: 2026-08-17 America/New_York
+enablingTask: true
+parityStateChange: false
+
+## Scope
+
+Schema v2 represents Blender catalogs with canonical RFC4122 UUIDs and cleaned slash paths;
+hierarchy is derived from `parentPath`, matching CDF semantics instead of retaining the Web v1
+`parentId` graph. Asset identity binds Blender's `AssetWeakReference` fields
+(`asset_library_identifier`, `relative_asset_identifier`) into a SHA-256 Web ID. A Blender
+rename changes the relative identifier and therefore the stable ID, matching Blender's weak
+reference behavior rather than promising an identity Blender does not provide.
+
+All text budgets use UTF-8 bytes. Catalog/tag recovery strings keep Blender's 63-byte payload
+limit, dynamic metadata permits empty strings, and catalog, asset, tag, custom-property,
+custom-array, per-string, and aggregate-text counts are bounded. The positive schema fixture
+is generated from the verified M12-01B desktop canonical report through production protocol
+code. This task does not implement v1 migration, legacy-reader policy, IndexedDB migration, or
+catalog mutation.
+
+## Evidence
+
+- `npm --prefix web run test:asset-catalog-v2` passed 4/4.
+- The suite binds the desktop canonical report and Blender 5.2 weak-reference source, regenerates
+  schema v2 from the desktop report, parses the generated golden, and verifies deterministic
+  local/external identity hashes and exposed UTF-8/collection budgets.
+- `npm --prefix web run typecheck`, `npm --prefix web run lint`, and `git diff --check` passed.
+
+## Artifact Hashes
+
+- protocol: `0949838efb2f69466368185b80bb1d2e851672d78311fcd5270eb0814576e5d7`
+- generator: `b20e7dbd8508ca8ecf17d7da507b45b1225315bac7759c55c7b324683d660881`
+- unit suite: `73038022124ddc7e683602b47a4804297b3a64ecd4819160c7ec086d2f6190ae`
+- schema golden: `2abe279cebbffd1341dc61b1fdc5366dd1f6f42769ba36171782019ca61fb929`
+- manifest: `612892b03a689ebe19804e495bd29744634ab43a3b29fff41adc2d7a5d0b67b9`
+- Blender weak-reference source: `ace3d6468bcdb2f6190431e967495794b7afa35758fd82fc3941b1ce7d374635`
+
+## Next Task
+
+`M12-01D`: define and verify schema v1 to v2 forward migration.
+
+## Rollback
+
+Remove the schema v2 protocol, generator, unit suite, M12-01C golden/manifest, package command,
+and this status entry. Restore M12-01C to pending and `nextTask` to M12-01C. No parity ledger
+rollback is required.

docs/status/M12-01D.md

@@ -0,0 +1,48 @@
+# M12-01D Status
+
+status: done
+task: define and verify schema v1 to v2 forward migration
+updated: 2026-08-17 America/New_York
+enablingTask: true
+parityStateChange: false
+
+## Scope
+
+The forward migration first validates the current production schema v1 manifest and rejects
+undeclared fields before conversion. Canonical UUIDs are preserved; legacy catalog IDs map
+deterministically through RFC 4122 UUIDv5 with a fixed namespace. The v1 parent graph becomes
+Blender cleaned slash paths, and assets receive SHA-256 IDs from Blender weak-reference identity.
+
+Logical revision is preserved. Author/license/tag/source bindings, optional source paths,
+preview receipts, and the complete library dependency graph survive migration. Metadata absent
+from v1 receives explicit defaults recorded in the migration report. The report binds canonical
+source/target hashes and every legacy-to-v2 catalog/asset identity mapping.
+
+## Evidence
+
+- `npm --prefix web run test:asset-catalog-migration` passed 3/3.
+- A schema v1 fixture with three catalogs, two asset kinds, one preview, two source bindings,
+  and two dependent libraries migrated to the checked-in schema v2 golden and exact report.
+- Repeating the migration on a cloned source produced byte-equivalent semantic objects and the
+  same source/target SHA-256 values. A canonical source UUID remained unchanged.
+- M12-01C regression, typecheck, lint, and `git diff --check` passed.
+
+## Artifact Hashes
+
+- migration protocol: `6d74bc5605f94e05208eda82830192d38f88066dfc409058555a8876c785f226`
+- generator: `954d15c02d68e3f644b57c8c4c136ce09bd037a0af2012bf74b97f681c77dd60`
+- unit suite: `6b927e7a8238e4e0a77cc0fdf783b099d8add22c5f875df2299012eb32730186`
+- v1 fixture: `1cc43d181afefd63b53cb9c3626bb58195fad20187d6e534adc1ecbe65f75da5`
+- v2 fixture: `38e5d1771b3d2d63ce5e10268eac4513f2043b0cbf71ab1799c1868bc2aa97fb`
+- migration report: `57b972c1bbb9ae326c3f264c225c21546682442ff3194fbc343e1c46a2cd410a`
+- manifest: `fea9e01b51f64a7e9c15dcfc521b3e84636525ffbe0a849f7a6f1b0be2b02e9d`
+
+## Next Task
+
+`M12-01E`: define the read-only/block policy when a schema v1 reader encounters schema v2.
+
+## Rollback
+
+Remove the migration protocol, generator, unit suite, M12-01D fixtures/report/manifest, package
+command, and this status entry. Restore M12-01D to pending and `nextTask` to M12-01D. No parity
+ledger rollback is required.

docs/status/M12-01E.md

@@ -0,0 +1,45 @@
+# M12-01E Status
+
+status: done
+task: define schema v2 behavior for a schema v1 reader
+updated: 2026-08-17 America/New_York
+enablingTask: true
+parityStateChange: false
+
+## Scope
+
+A native schema v1 document remains `READY`. A valid schema v2 document exposed to a v1
+reader yields a bounded `READ_ONLY` snapshot for metadata inspection, while catalog writes,
+asset writes, and save all return `ASSET_SCHEMA_DOWNGRADE_BLOCKED`. Unknown future schema
+versions return non-recoverable `PROTOCOL_MISMATCH` with no snapshot.
+
+Every result binds a canonical source SHA-256. Inspection does not mutate or downgrade the
+source document, and no write path can serialize the lossy read-only projection. This task
+defines compatibility behavior only; it does not implement IndexedDB migration or catalog
+mutation parity.
+
+## Evidence
+
+- `npm --prefix web run test:asset-catalog-legacy-reader` passed 4/4.
+- Generated evidence covers v2 read-only metadata, all three write/save blocks, native v1
+  readiness, future-schema rejection, equal source hashes, and source object immutability.
+- M12-01C/D regressions, typecheck, lint, and `git diff --check` passed.
+
+## Artifact Hashes
+
+- compatibility protocol: `5d51029b232e03f08fc0778d4933910b2a54818b4d653fbcc185c8d764641349`
+- error contract: `309ab84d5c755a69466ddb73e4b54e87caf62cbcac0f10f34d904e9f6f4a5f34`
+- generator: `208f568db092e1712095d77ab28db92d5a1eb11fe62813b237ce466f9268fd4e`
+- unit suite: `f6477222412044e6784b64c1be83dc9bd6050fe6a955ba5430a4ea963b20dbb4`
+- compatibility report: `3c2f9241b56ad5bd742dc4152dec703bdc56eef4e6d8d60e6edf163c4571ad54`
+- manifest: `cf55ea1f9430df04fb55bf07c68c1b2099b044b0da0fdb07a7251b13c459724b`
+
+## Next Task
+
+`M12-01F`: add duplicate ID, cyclic parent catalog, overlong text, and unknown-field negatives.
+
+## Rollback
+
+Remove the compatibility protocol, generator, unit suite, M12-01E report/manifest, error code,
+package command, and this status entry. Restore M12-01E to pending and `nextTask` to M12-01E.
+No parity ledger rollback is required.

docs/status/M12-01F.md

@@ -0,0 +1,40 @@
+# M12-01F Status
+
+status: done
+task: reject duplicate IDs, catalog cycles, oversized text, and unknown fields
+updated: 2026-08-17 America/New_York
+enablingTask: true
+parityStateChange: false
+
+## Scope
+
+The negative matrix executes production schema v2 and migration parsers against duplicate
+catalog/asset IDs, a legacy parent cycle, an inconsistent v2 `parentPath`, 64-byte UTF-8
+simple-name/tag values, and unknown top-level/nested fields in both v1 and v2. The byte cases
+use multi-byte text to prove limits are not JavaScript character counts.
+
+Every failure returns a stable asset error code. The valid v2 fixture is parsed after each
+negative case to prove the failed input did not poison parser state. This task adds negative
+evidence only and does not change catalog parity status.
+
+## Evidence
+
+- `npm --prefix web run test:asset-catalog-negatives` passed 2/2 with 9/9 negative cases.
+- Duplicate/cycle/parent/unknown cases returned `ASSET_MANIFEST_INVALID`; both 64-byte UTF-8
+  payloads returned `ASSET_BUDGET_EXCEEDED`.
+- Typecheck, lint, and `git diff --check` passed.
+
+## Artifact Hashes
+
+- unit suite: `3a11605ac8666c8c4e1e2e85ccfd423115915820d0de6f92bdf72dff1f01ce41`
+- negative cases: `74672fa0aec248fd5d9a265743ef4dfe4d417fce8a24622b8b3d6be2f95c8874`
+- manifest: `127b2b605ac79a891cd6ab516ee031c02624a512e1043b111bfac2ebf1d8278d`
+
+## Next Task
+
+`M12-01G`: prove an IndexedDB migration failure preserves the old transaction and index.
+
+## Rollback
+
+Remove the M12-01F negative suite, golden/manifest, package command, and this status entry.
+Restore M12-01F to pending and `nextTask` to M12-01F. No parity ledger rollback is required.

docs/status/M12-01G.md

@@ -0,0 +1,47 @@
+# M12-01G Status
+
+status: done
+task: preserve the old catalog index when an IndexedDB migration fails
+updated: 2026-08-17 America/New_York
+enablingTask: true
+parityStateChange: false
+
+## Scope
+
+The production IndexedDB migration prepares schema v2 with the existing schema v1 parser and
+migrator before opening a write transaction. It then rechecks the source row and atomically
+writes the v2 index and migration receipt while deleting the v1 row. A concurrent source change
+returns `REVISION_CONFLICT`; a transaction failure returns `STORAGE_TRANSACTION`.
+
+The browser suite injects failures after the v2 target write and after the v1 source delete.
+After each abort it closes and reopens the database, proving the database version, complete v1
+index, unrelated legacy migration row, absent v2 row, and absent receipt are byte-for-byte
+equivalent to the baseline. A subsequent retry commits the v2 index and receipt together.
+
+## Evidence
+
+- `WEB_TEST_PORT=5593 npm --prefix web run test:asset-catalog-indexeddb-migration` passed the
+  M12-01D production migration unit suite 3/3, the M12-01G artifact binding unit 1/1, and
+  Chromium 1/1.
+- Both `AFTER_TARGET_PUT` and `AFTER_SOURCE_DELETE` returned `STORAGE_TRANSACTION`; reopening
+  IndexedDB after either fault produced the exact pre-migration snapshot.
+- The successful retry preserved revision 7 and the M12-01D source/target hashes, removed only
+  the v1 row, and retained the unrelated migration row.
+- Typecheck and `git diff --check` passed.
+
+## Artifact Hashes
+
+- production IndexedDB migration: `283a08bccb5ea301bd2aef8f01d4496972e3962f75e340479336c50e3539ba57`
+- browser suite: `82c40f38898277b4053a9654537ec9c21bc01a784d1091831e139361575a81e9`
+- artifact unit: `a4366a16f28b91b3ff213e0232308eaecd392731f27972cfa49a11568eb0feca`
+- manifest: `2596067956211698f1b7a07d9423411e2db830b72e6b78593354953a568738e7`
+
+## Next Task
+
+`M12-01H`: prove catalog ordering and asset identity survive page and Worker restarts.
+
+## Rollback
+
+Remove the IndexedDB migration module, M12-01G unit/browser suites, manifest, package command,
+and this status entry. Restore M12-01G to pending and `nextTask` to M12-01G. No parity ledger
+rollback is required.

docs/status/M12-01H.md

@@ -0,0 +1,47 @@
+# M12-01H Status
+
+status: done
+task: preserve catalog order and asset identity across page and Worker restarts
+updated: 2026-08-17 America/New_York
+enablingTask: true
+parityStateChange: false
+
+## Scope
+
+The production catalog index loader validates the stored schema v2 manifest, recomputes its
+canonical SHA-256, and compares it with the committed migration receipt before publishing a
+snapshot. The snapshot exposes persisted catalog order, asset order, stable asset IDs, Blender
+weak-reference components, revision, and manifest identity.
+
+A page migrates the M12-01D v1 fixture, reloads, and reads the same database again. Two separate
+module Workers then open the database in sequence, with generation 1 terminated before
+generation 2 starts. All four contexts must return the same complete snapshot.
+
+## Evidence
+
+- `WEB_TEST_PORT=5594 npm --prefix web run test:asset-catalog-restart` passed Node 5/5 and
+  Chromium 2/2, including the full M12-01G abort/reopen regression.
+- Initial page, reloaded page, Worker generation 1, and Worker generation 2 returned exactly the
+  same 3 catalog IDs in order, 2 asset IDs in order, weak-reference components, revision 7, and
+  manifest SHA-256.
+- A stored receipt whose target hash or revision drifts from the parsed v2 index is rejected as
+  `ASSET_MANIFEST_INVALID` before a snapshot is published.
+- Typecheck, lint, and `git diff --check` passed.
+
+## Artifact Hashes
+
+- production IndexedDB reader: `283a08bccb5ea301bd2aef8f01d4496972e3962f75e340479336c50e3539ba57`
+- restart Worker: `e6007d352555be046b89d0becd719692652ee0418cc97087bf7599155f2a538e`
+- browser suite: `7945ff38dd474a74c265594b66534a280eb69407509137e60d41f1bea3b3c19b`
+- artifact unit: `eb22b5cc852fa47d9bdd30afec2977facfca0dfa554e7ce738dc1bf8c4bf2122`
+- manifest: `59138eb83d63ae0d397b152e587fbe005d02bc2d229ee484c279b452ea3f2eae`
+
+## Next Task
+
+`M12-01I`: bind the schema fixture, migration report, and hashes into M12-01 evidence.
+
+## Rollback
+
+Remove the restart snapshot reader, Worker/browser/unit suites, M12-01H manifest, package
+command, and this status entry. Restore M12-01H to pending and `nextTask` to M12-01H. No parity
+ledger rollback is required.

docs/status/M12-01I.md

@@ -0,0 +1,44 @@
+# M12-01I Status
+
+status: done
+task: bind the schema fixture, migration report, and hashes into M12-01 evidence
+updated: 2026-08-17 America/New_York
+enablingTask: true
+parityStateChange: false
+
+## Scope
+
+The M12-01 aggregate evidence binds all eight predecessor manifests in exact queue order and
+recursively verifies their declared source and artifact hashes. It separately binds the locked
+Blender 5.2 desktop canonical fixture, Web schema v2 golden and protocol, schema v1/v2 migration
+fixtures, production migration report, IndexedDB transaction implementation, and restart Worker.
+
+The checker recomputes canonical source and target manifest SHA-256 values, matches them to the
+migration report, verifies revision and preserved counts, and compares the persisted restart
+catalog/asset order with the target fixture. This closes the schema/migration evidence section;
+it does not claim catalog mutation or preview parity.
+
+## Evidence
+
+- `WEB_TEST_PORT=5595 npm --prefix web run test:asset-catalog-m12-evidence` passed the Blender
+  5.2 inventory and regenerated fixture checks, schema v2 4/4, migration 3/3, legacy-reader 4/4,
+  negatives 2/2, transaction/restart Node 5/5, Chromium 2/2, and final aggregate checker.
+- The final checker reported `subtasks=8 catalogs=3 assets=2 next=M12-02A`.
+- Source revision 7 and target revision 7 canonical hashes match the production migration report;
+  all A-H task links and recursive artifact hashes resolve without gaps.
+- Typecheck, lint, status consistency, and `git diff --check` passed.
+
+## Artifact Hashes
+
+- M12-01 evidence: `2b99f64a207c2ffb966963be8a2150feef67d5bf78946939d3a49a6335b55bc3`
+- aggregate checker: `7d0d9f5390648d4af79a8da6226627edb1bf99945bae1a7b1acfb2c5e2419a8b`
+- package command: `a810fec6a9a24cad94cb01475f9529ac2f85da827d391a70ab7ddb57421003f8`
+
+## Next Task
+
+`M12-02A`: inventory Blender preview image dimensions, color space, and no-preview state.
+
+## Rollback
+
+Remove the M12-01 aggregate evidence, checker, package command, and this status entry. Restore
+M12-01I to pending and `nextTask` to M12-01I. No parity ledger rollback is required.

docs/status/M12-02A.md

@@ -0,0 +1,43 @@
+# M12-02A Status
+
+status: done
+task: inventory Blender preview dimensions, color semantics, and no-preview state
+updated: 2026-08-17 America/New_York
+enablingTask: true
+parityStateChange: false
+
+## Scope
+
+The machine inventory binds Blender 5.2 PreviewImage DNA, slot enum, BKE/RNA implementation,
+Blend reader, asset preview generator, render-size constants, current Web v1/v2 preview protocols,
+and two runtime fixtures. It records both ICON and PREVIEW slots, persisted dimensions/flags/pixel
+arrays, runtime-only state, and absent-pointer behavior.
+
+Preview pixels are packed 32-bit RGBA with four byte components and Blender's deferred load path
+premultiplies alpha. PreviewImage has no persisted or RNA color-space field, and float access only
+divides byte components by 255 without a color transform. The inventory therefore records color
+space as unknown instead of assuming sRGB.
+
+## Evidence
+
+- `npm --prefix web run test:asset-preview-inventory` launched locked Blender 5.2 twice and
+  reported `slots=2 rna=9 absent=3 loaded=8x8 next=M12-02B`.
+- The checked-in asset fixture reopened with Object, Material, and World `preview == null`.
+- A real 8x8 PNG loaded through Blender's preview API produced an 8x8 PREVIEW slot, 32x32 ICON
+  slot, 64/256 image packed/float counts, and 1024 icon packed pixels.
+- Typecheck, lint, status consistency, and `git diff --check` passed.
+
+## Artifact Hashes
+
+- inventory: `a4427426d94afdf1a2ccf5379d76d1797f8604a742a3f0d15bdca629272864bd`
+- checker: `c9cc83d21bac5f34c6d68cb1225dffcd92a5ec76c158ddce909b620cbbcb245c`
+- package command: `04f832a3c5773c8cc5294ecdcf175478eed9710496e48c63698d79043384e328`
+
+## Next Task
+
+`M12-02B`: define preview source/content SHA-256, MIME, dimensions, and generator identity.
+
+## Rollback
+
+Remove the M12-02A inventory, checker, package command, and this status entry. Restore M12-02A
+to pending and `nextTask` to M12-02A. No parity ledger rollback is required.

docs/status/M12-02B.md

@@ -0,0 +1,48 @@
+# M12-02B Status
+
+status: done
+task: define preview source, content, dimensions, MIME, and generator identity
+updated: 2026-08-17 America/New_York
+enablingTask: true
+parityStateChange: false
+
+## Scope
+
+The schema binds source bytes and encoded content as separate SHA-256/length/MIME identities.
+Encoded content additionally binds width, height, RGBA8, explicit sRGB, and alpha mode. Generator
+identity binds name, Blender version, executable hash, generator script hash, and canonical
+settings hash. A domain-separated canonical hash covers the complete record.
+
+The locked Blender 5.2 generator re-encodes a real 8x8 PNG with explicit PNG RGBA8, compression,
+display, view-transform, exposure, and gamma settings. The source and content encodings have
+different hashes and lengths while a second Blender process confirms decoded pixels are exact.
+
+## Evidence
+
+- `npm --prefix web run test:asset-preview-identity` passed 3/3 protocol tests and the locked
+  Blender generator checker.
+- Two independent generation runs matched the checked-in 513-byte content SHA-256 exactly; the
+  261-byte source has a different SHA-256, and decoded pixel maximum error is zero.
+- Source bytes, content bytes, generator settings, dimensions, identity hash, and unknown fields
+  each have fail-closed negative coverage.
+- Typecheck and `git diff --check` passed.
+
+## Artifact Hashes
+
+- protocol: `2a1d877af42424014097c669e9d44c21b27e3171be185320554693cbefcd7438`
+- generator: `753a26be90f7d97828737ebc3a4ab88275a7c655b4f9992406c7c35fba6535ce`
+- checker: `4d8ece1a5440d202f4e79a48f1f26bc75b3fb11a02d821b8ebc5aee14b11e41a`
+- unit suite: `5b7b3ccaf410d627365579fa82bf2b48fed9ef17144aad963cdbd4bb7fbd4b5a`
+- identity golden: `1b1eb8416ce4aa4d83b0dc42b9cb375f1da965e3f0cb9650991289fc619a0a7b`
+- content PNG: `ff139c4a1c5d388c78c5168dfd3272e80ea0d1b15b3743e29a38cd908e8c70e7`
+- manifest: `096f125461b963ee2c414f98f6bb00f02034a380a0cc9c43e0d84754324adb17`
+
+## Next Task
+
+`M12-02C`: enforce MIME, pixel, byte, and compression-ratio budgets before preview decode.
+
+## Rollback
+
+Remove the preview identity protocol, generator/checker, unit suite, M12-02B goldens, package
+command, error code, and this status entry. Restore M12-02B to pending and `nextTask` to M12-02B.
+No parity ledger rollback is required.

docs/status/M12-02C.md

@@ -0,0 +1,46 @@
+# M12-02C Status
+
+status: done
+task: enforce MIME, pixel, byte, and compression-ratio budgets before preview decode
+updated: 2026-08-17 America/New_York
+enablingTask: true
+parityStateChange: false
+
+## Scope
+
+The schema 1 pre-decode planner accepts only the M12-02B content identity and an exact
+`ArrayBuffer` payload. It checks the 16 MiB encoded-byte limit before hashing, then binds the
+content SHA-256, declared MIME to the PNG/WebP container header, header dimensions to the identity,
+and dimensions to pixel and RGBA8 decoded-byte budgets. The final gate limits decoded-to-encoded
+compression ratio to 100 before any browser image decoder or decoded allocation is invoked.
+
+PNG dimensions come only from a valid signature and first IHDR header. WebP dimensions come only
+from a size-bound RIFF/WEBP VP8X, VP8L, or VP8 header. Unsupported headers, content drift, and
+dimension drift fail closed; a rejected input does not affect a following valid preview plan.
+
+## Evidence
+
+- `npm --prefix web run test:asset-preview-decode-budget` passed 5/5 M12-02B/C protocol tests.
+- The positive 513-byte Blender-generated PNG plans 64 pixels and 256 decoded RGBA8 bytes without
+  calling a decoder.
+- Eight negative cases cover payload hash/length drift, MIME mismatch, dimension mismatch,
+  over-width/height and decoded-byte budget, compression ratio, encoded-byte budget, and corrupt
+  container signature. The checked-in small preview passes immediately after each rejection.
+- `npm --prefix web run typecheck`, `npm --prefix web run lint`, and `git diff --check` passed.
+
+## Artifact Hashes
+
+- decode protocol: `3d1c491af2503a7a6012541ed43400d680f8e666cc12a54db284aeb6ac18ff63`
+- unit suite: `1a65df86d568ae8defd7cd9242f426ac900d92637eb3bed2cbb4a0fae2e86c20`
+- package commands: `8563916637fc3cb29b53432ae9b80d1dcf6269f2f5c092b595e72c6b0ada55ab`
+- manifest: `934b3ca29d905ad2f5c46f35acff4cf4b9ea291c423fb3aad4afe7e9f10e6244`
+
+## Next Task
+
+`M12-02D`: commit a catalog preview reference only after its content-addressed payload is durably
+written to OPFS.
+
+## Rollback
+
+Remove the preview decode planner, unit suite, M12-02C manifest, package command, and this status
+entry. Restore M12-02C to pending and `nextTask` to M12-02C. No parity ledger rollback is required.

docs/status/M12-02D.md

@@ -0,0 +1,49 @@
+# M12-02D Status
+
+status: done
+task: commit a catalog preview reference only after verified OPFS persistence
+updated: 2026-08-17 America/New_York
+enablingTask: true
+parityStateChange: false
+
+## Scope
+
+The production coordinator first runs the M12-02C pre-decode gate, writes the content-addressed
+preview to OPFS, reads it back, and repeats identity verification. Only then may one IndexedDB
+transaction advance the catalog revision and write both the v2 preview reference and an M12-02D
+head receipt. The receipt binds project, asset, base/current revision, base/current manifest hash,
+preview identity, payload identity, and OPFS path.
+
+The transaction rereads and compares the complete source catalog row before publication. A stale
+revision or changed row returns `REVISION_CONFLICT`; OPFS and transaction faults return
+`STORAGE_TRANSACTION`. An OPFS payload left by a failure is unreferenced, never presented as a
+committed catalog preview.
+
+## Evidence
+
+- `WEB_TEST_PORT=5596 npm --prefix web run test:asset-preview-opfs-commit` passed the artifact unit
+  test 1/1 and the real Chromium OPFS/IndexedDB test 1/1.
+- `BEFORE_OPFS_WRITE`, `AFTER_OPFS_WRITE`, and `AFTER_CATALOG_PUT` faults all preserved the complete
+  revision 7 catalog and left no commit receipt. Only the latter two left an unreferenced payload.
+- Success persisted and reread the 513-byte payload before advancing the catalog to revision 8;
+  closing and reopening IndexedDB reproduced the same preview and receipt and rehashed OPFS bytes.
+- `npm --prefix web run typecheck`, `npm --prefix web run lint`, and `git diff --check` passed.
+
+## Artifact Hashes
+
+- commit coordinator: `36418e480b108eb885b5d8da6633174ed1face1fa62742a64372a45280e727a2`
+- Chromium suite: `043b9b06d4c0275938cc1d4f9837df95f58f281130f3c0f2b90c10540244592e`
+- unit suite: `f489a1d9a4c5fb24a99bce6d31841534c7cf3981b53076a0d9e19d106e9d0d74`
+- manifest: `34fe6c6ab097e58f7b648dd84cb919ecb407a5742e387c513bb3ed53db50eed6`
+- package commands: `7363a8a03cb5f6b1d6bf40d8eabc90b9d48e91aeb4787b175deb4f242c676243`
+
+## Next Task
+
+`M12-02E`: deduplicate identical preview content without allowing different asset metadata to
+overwrite the shared payload.
+
+## Rollback
+
+Remove the OPFS/catalog commit coordinator, Chromium and unit suites, M12-02D manifest, package
+command, and this status entry. Restore M12-02D to pending and `nextTask` to M12-02D. No parity
+ledger rollback is required.

docs/status/M12-02E.md

@@ -0,0 +1,45 @@
+# M12-02E Status
+
+status: done
+task: deduplicate identical preview content without merging asset metadata
+updated: 2026-08-17 America/New_York
+enablingTask: true
+parityStateChange: false
+
+## Scope
+
+Two catalog assets with distinct Blender weak-reference identities and distinct catalog metadata
+may bind the same verified preview content. The M12-02D coordinator keys OPFS storage only by the
+content SHA-256, while catalog entries and preview identity hashes remain asset-specific. A second
+commit of identical bytes reuses the existing payload after a full readback/hash check.
+
+No catalog metadata is derived from or stored inside the shared payload record. Each transaction
+updates only its targeted asset's preview field and advances the guarded catalog revision.
+
+## Evidence
+
+- `WEB_TEST_PORT=5597 npm --prefix web run test:asset-preview-dedup` passed the artifact unit test
+  1/1 and real Chromium OPFS/IndexedDB test 1/1.
+- Two distinct asset/identity hashes committed at revisions 8 and 9; the second commit reported
+  `deduplicated=true` and the OPFS content directory contained exactly one final file.
+- Both catalog entries referenced the same 513-byte/hash payload while their complete non-preview
+  metadata remained byte-for-byte equal to their different baseline records.
+- Database reopen reproduced revision 9, the second asset head receipt, and the shared preview;
+  stored payload bytes rehashed to the declared content digest.
+
+## Artifact Hashes
+
+- Chromium suite: `4e53b7a35eb109b152bd6dc0c3348dcb08879d17619968d37fc761c67aa38b40`
+- unit suite: `e023fdd33e0f40c1331dfdd73cd287dc684256b9d134971ab17db8cfe2a83835`
+- manifest: `7d25f1d8335481795257c643c8589d1607a865634b27a7e5d145a57ce2a92a62`
+- package commands: `5a83676e821bb768f6d3e282ea4728413cf84c5f3d57672fc664fac3883873e5`
+
+## Next Task
+
+`M12-02F`: quarantine corrupt preview content while keeping asset metadata readable.
+
+## Rollback
+
+Remove the deduplication Chromium/unit suites, M12-02E manifest, package command, and this status
+entry. Restore M12-02E to pending and `nextTask` to M12-02E. The shared coordinator and parity
+ledger do not require rollback.

docs/status/M12-02F.md

@@ -0,0 +1,49 @@
+# M12-02F Status
+
+status: done
+task: quarantine corrupt preview content while keeping asset metadata readable
+updated: 2026-08-17 America/New_York
+enablingTask: true
+parityStateChange: false
+
+## Scope
+
+The preview inspector validates payload byte length and SHA-256 independently from the catalog.
+Healthy bytes return `READY`. Missing or mismatched bytes return a structured
+`ASSET_SOURCE_HASH_MISMATCH` quarantine receipt; present corrupt bytes are copied, verified, and
+then removed from the content-addressed namespace before the receipt is published.
+
+The catalog row and its preview provenance are not rewritten on corruption. Consumers receive the
+complete parsed asset metadata together with `preview=null/data=null`, so a broken optional image
+cannot make the asset name, type, catalog, license, tags, or source metadata unreadable. A matching
+quarantine receipt is stable across database reopen.
+
+## Evidence
+
+- `WEB_TEST_PORT=5598 npm --prefix web run test:asset-preview-quarantine` passed the artifact unit
+  test 1/1 and real Chromium OPFS/IndexedDB test 1/1.
+- The checked-in 513-byte PNG first returned `READY`; same-length byte tampering then returned
+  `QUARANTINED` with a different actual SHA-256 and stable error code.
+- The corrupt file was absent from the SHA-256 namespace and present as a verified 513-byte file in
+  the quarantine directory. Database reopen returned the exact same receipt without reading it.
+- Catalog revision 8, the target asset metadata/reference, and the unrelated asset all remained
+  exactly unchanged.
+
+## Artifact Hashes
+
+- quarantine protocol: `a5f3330dbd16d9f578d85d9504c980fffea85b834b77340a307ce21ce9b1cb04`
+- Chromium suite: `d8e1d0741765e8f8bfd47b45cf03213d8629efdbbf77dfd33846785a3ec80c27`
+- unit suite: `79c836c7a3be4e9f305a962775444c766577cca87fa6d1698811e75eb21f2d9a`
+- manifest: `d1a9feeb98c5332b1a14a14c5b813d75a29f172601590e1b5cde254c5059a7c5`
+- package commands: `77b5cd3d3af68ac390d8fbdb9b2f64764fb4521a1d2bf22cd8a89e40d69424f6`
+
+## Next Task
+
+`M12-02G`: reclaim a preview payload only after its final project-scoped reference is removed,
+without touching another project's copy.
+
+## Rollback
+
+Remove the quarantine protocol, Chromium/unit suites, M12-02F manifest, package command, and this
+status entry. Restore M12-02F to pending and `nextTask` to M12-02F. Catalog and parity ledger data
+do not require rollback.

docs/status/M12-02G.md

@@ -0,0 +1,47 @@
+# M12-02G Status
+
+status: done
+task: reclaim preview payload only after the final project-scoped reference is removed
+updated: 2026-08-17 America/New_York
+enablingTask: true
+parityStateChange: false
+
+## Scope
+
+Preview reference removal is a guarded catalog mutation: it validates the v2 row, checks the exact
+base revision, clears only the target asset's preview, advances revision, and commits a manifest
+hash receipt. Payload reclamation happens only after that reference transaction has completed and
+only when the committed manifest has zero remaining references to the content hash.
+
+OPFS payload ownership remains project-scoped (`projects/<projectId>/assets/sha256/...`). Therefore
+collection can target only the requested project's file and cannot delete an equal-hash payload
+owned and referenced by another project. Non-preview asset metadata is preserved.
+
+## Evidence
+
+- `WEB_TEST_PORT=5599 npm --prefix web run test:asset-preview-reference-gc` passed the artifact unit
+  test 1/1 and real Chromium OPFS/IndexedDB test 1/1.
+- Project A began with two references to one deduplicated payload. Removing the first at revision
+  9->10 returned `RETAINED`, one remaining reference, and kept the file.
+- Removing the final reference at revision 10->11 returned `COLLECTED` and removed project A's
+  payload. Project B's equal-hash payload remained present and its preview returned READY/513 bytes.
+- Reopening project A reproduced revision 11, two null preview references, and unchanged metadata.
+
+## Artifact Hashes
+
+- reference GC: `76b9d8ccd3e7992356f33adc694001f9b0ff364788234389eacdb09198d1415e`
+- Chromium suite: `2e9e9b47883997092c5afb0fb7859a484754764de19006e24a8ff2bdeb24f35a`
+- unit suite: `c5de3122b5d8aab17daf0179cb4f5bb0b5d299408818849cbe7b18e40a47706e`
+- manifest: `3449f2ea9488f66ea5e3f5f2423413e8e290d8ffed3b3d941bdeee3f76addd0a`
+- package commands: `7d1db0932fbe7405ffdbd44b770ce7bf9815b9dfb829c1906a06bfff635ae702`
+
+## Next Task
+
+`M12-02H`: compare desktop/browser preview pixels with explicit metrics and pass both main-thread
+and Offscreen display paths.
+
+## Rollback
+
+Remove the reference-GC protocol, Chromium/unit suites, M12-02G manifest, package command, and this
+status entry. Restore M12-02G to pending and `nextTask` to M12-02G. Catalog and parity ledger data
+do not require rollback.

docs/status/M12-02H.md

@@ -0,0 +1,51 @@
+# M12-02H Status
+
+status: done
+task: compare desktop/browser preview pixels and pass main-thread and Offscreen display paths
+updated: 2026-08-17 America/New_York
+enablingTask: false
+parityStateChange: true
+
+## Scope
+
+The display path validates the content identity, encoded SHA-256, image header, dimensions, decoded
+byte budget, and compression ratio before invoking a decoder. It then decodes with disabled browser
+color conversion and alpha premultiplication, draws with copy composition and no smoothing, and
+publishes a receipt bound to the identity, content, backend, dimensions, RGBA8 hash, and alpha count.
+
+Blender 5.2 deterministically regenerates the 8x8 `SRGB/RGBA8/STRAIGHT` reference. Main-thread
+Canvas2D and a dedicated Worker OffscreenCanvas execute the same production display implementation
+and match all 256 reference bytes. This closes only the bounded preview display slice; arbitrary
+profiles, Asset Browser UI, and library operations remain outside this task.
+
+## Evidence
+
+- `WEB_TEST_PORT=5600 npm --prefix web run test:asset-preview-display` passed the evidence unit 1/1,
+  Blender 5.2 desktop regeneration/hash checker, and Chromium main-thread/Offscreen test 1/1.
+- Desktop, main-thread, and Offscreen output SHA-256 was
+  `c2ff81750b41193ce1a06d47d0ff18168a756136dbf0f2586cd0638d4bf0ef00`.
+- Both browser paths reported 8x8, 256 RGBA8 bytes, 64 non-transparent pixels, and closed bitmap
+  ownership. Their MAE, RMS, P95, maximum channel error, bad-pixel ratio, and alpha coverage delta
+  were zero; foreground IoU was 1.
+- A one-channel mutation returned `BLOCKED/RENDER_REFERENCE_MISMATCH` under the same metric contract.
+
+## Artifact Hashes
+
+- display runtime: `e4a46a40291427afc185caf016b02120ea71639ab4ab4ac250a5c3de28ee8d28`
+- Offscreen Worker: `6322562f54b608b7eaac4ca3bc0f8d861f47bb8e9b37b3c2ae3d61163108724f`
+- desktop checker: `d03d766e69ea0547be2c247b5d7ef8fd5ceab6b399dc996eba711fa0cac0ca54`
+- desktop report: `cdf841f5d27362f6df380772ada8b7b1427d051a8b46b5c2c20aab0b597c25d0`
+- Chromium suite: `340d386c6a854c44cd6f6207e3699f870b8ded2aada4747afd6ff1103c719520`
+- unit suite: `f10a05900c4d1282251f7a76e7c413a18602910f55fe8400f1713f548eba3873`
+- manifest: `30e6e4b6f53e07768d2ae8d853fe08a5c0782f8608320a72e41db77f6d87f2c4`
+- package commands: `2510242fbc0c2da787f558365733a4db6faf9f490e2594f69dc978920ed09f21`
+
+## Next Task
+
+`M12-03A`: inventory the data-block and dependency closures for append, link, and library override.
+
+## Rollback
+
+Remove the display runtime, Worker, desktop checker/report, unit/Chromium suites, M12-02H manifest,
+package command, completed ledger slice, and this status entry. Restore M12-02H to pending and the
+queue to M12-02H.

docs/status/M12-03A.md

@@ -0,0 +1,55 @@
+# M12-03A Status
+
+status: done
+task: inventory append, link, and library override data-blocks and dependency closures
+updated: 2026-08-17 America/New_York
+enablingTask: true
+parityStateChange: false
+
+## Scope
+
+The machine inventory separately records Append, Link, and Library Override entry points,
+selectable data-block roots, non-root ID roles, direct/indirect/transitive/embedded dependency
+classes, terminal ownership actions, and override reference/hierarchy/property-operation fields.
+
+The exact closure is an actual Blender Main ID pointer graph walked by
+`BKE_library_foreach_ID_link`, not a hard-coded Object-to-Mesh table. The inventory therefore
+preserves cross-library and override-only dependency distinctions needed by later ownership and
+invalidation contracts. It does not perform a library mutation or add a parity slice.
+
+## Findings
+
+- Blender 5.2 exposes 36 selectable library data-block collections. Screen and WorkSpace are
+  append-only; Library is source/transitive metadata, while embedded Key IDs follow their owner.
+- Append can keep linked, reuse local, make local, or copy local after classifying direct,
+  indirect, and liboverride-only dependencies. Recursive cross-library localization is explicit.
+- Link retains the source `Library`, direct `ID_TAG_EXTERN`, indirect `ID_TAG_INDIRECT`, and
+  transitive parent-library relationships without localization.
+- Override retains a linked reference alongside a local override and hierarchy root. Its 17 RNA
+  fields cover reference/root flags, property paths, operations, and local/reference subitems.
+- Current Web metadata represents only library source, dependency IDs, and read-only state; eight
+  per-ID ownership, override, and invalidation semantics remain absent and mutation stays blocked.
+
+## Evidence
+
+- `npm --prefix web run test:library-operation-inventory` passed with
+  `roots=36 appendOnly=2 operations=3 overrideFields=17 gaps=8 next=M12-03B`.
+- The checker binds nine Blender/Web source files and one real nested-library fixture by SHA-256,
+  verifies link/append action and dependency-walk tokens, launches Blender 5.2, and compares the
+  actual append/link operator properties, library collections, nested source, and override RNA.
+
+## Artifact Hashes
+
+- inventory: `0dcb16233b52b3c0be2373f489d6bf3c771c9d6564993ff98b5d63dcd322fef7`
+- checker: `1581490d1923578293202d27a1c379eb2a8c5e13be418547d148cf09c6a783fd`
+- package commands: `a7cf339b0cf6fab17ef63e9394b2e540af60327f7bf1f7fe95823d182e0d3e63`
+
+## Next Task
+
+`M12-03B`: define source library ID, owner, read-only state, and invalidation token for all three
+operations.
+
+## Rollback
+
+Remove the library operation inventory, checker, package command, and this status entry. Restore
+M12-03A to pending and the queue to M12-03A. No parity ledger rollback is required.

docs/status/M12-03B.md

@@ -0,0 +1,47 @@
+# M12-03B Status
+
+status: done
+task: define source library identity, owner, read-only state, and invalidation tokens
+updated: 2026-08-17 America/New_York
+enablingTask: true
+parityStateChange: false
+
+## Scope
+
+Schema 1 derives `sourceLibraryId` from a canonical source locator and source `.blend` SHA-256.
+Each operation binding then fixes one source data-block, its operation-specific owner and read-only
+state, source generation/revision, dependency-closure SHA-256, and a hash-derived invalidation token.
+
+APPEND owns a writable local Main ID. LINK remains owned by the matching source library and is
+fully read-only. LIBRARY_OVERRIDE owns a writable local override while retaining a read-only linked
+reference and hierarchy root. This is a pure protocol task and does not mutate Blender Main.
+
+## Evidence
+
+- `npm --prefix web run test:library-operation-identity` passed 6/6.
+- Stable source identity changes when either locator or source bytes change.
+- APPEND/LINK/LIBRARY_OVERRIDE produce distinct invalidation tokens for the same source root and
+  reject owner substitution, read-only drift, reference substitution, unknown fields, and forgery.
+- Source library/hash, generation, revision, and dependency closure drift each return
+  `REVISION_CONFLICT`; the unchanged state revalidates the original binding exactly.
+- The one initial test expectation was corrected to the actual fail-fast exact-schema code, then
+  the complete suite was rerun successfully.
+
+## Artifact Hashes
+
+- protocol: `5371133bd98e05935cd75bab582abedec32a36559af8d212f0bc8a534ef19451`
+- golden bindings: `b39c0f26697ac688c1203ae4e3e27d8a02686c7c9da9afc438c89a0b4d69370f`
+- unit suite: `0e5b2c82d481180eb8eb22de16ad8cdef5e58fa7423c26011faaffbac788e547`
+- manifest: `f388aedb9c0901932cf90c058f2f2b83259d9797cd6b144566a25e37a348c64b`
+- package commands: `48cf41f0d0041bf4f497bc2a454cfa9469874eded1775cea50fe3249d4e0b59e`
+
+## Next Task
+
+`M12-03C`: create a desktop single-Object append fixture and record stable Object, Mesh, Material,
+and Image mappings.
+
+## Rollback
+
+Remove the library operation identity protocol, golden, unit suite, manifest, package command, and
+this status entry. Restore M12-03B to pending and the queue to M12-03B. No parity ledger rollback is
+required.

docs/status/M12-03C.md

@@ -0,0 +1,50 @@
+# M12-03C Status
+
+status: done
+task: create a desktop single-Object append fixture and stable dependency mapping
+updated: 2026-08-17 America/New_York
+enablingTask: true
+parityStateChange: false
+
+## Scope
+
+Blender 5.2 creates a source library containing one Object whose dependency closure is one Mesh,
+one Material, and one packed Image. A clean desktop Main appends only the Object, saves the target,
+reopens it, and exports the same canonical graph before and after reopen.
+
+The fixture records stable source-to-local mappings, ownership, read-only state, dependency edges,
+geometry/UV/material structure, and packed-image metadata and Float32 pixel SHA-256. Container hashes
+remain session-bound Blender artifacts; the canonical semantic report must reproduce exactly.
+
+## Evidence
+
+- `npm --prefix web run test:library-append-desktop` passed.
+- The generator appended one selected Object and resolved four stable local IDs with three dependency
+  edges.
+- Object, Mesh, Material, and Image all have null library pointers, no library override, writable
+  `LOCAL_MAIN` ownership, and identical source/local stable names.
+- Save/reopen preserved 4 vertices, 4 edges, 1 polygon, 4 loops, `UVMap`, the material slot, packed
+  2x2 sRGB RGBA image metadata, and Float32 pixel SHA-256
+  `6f0f8c231d65149e69e6ed12d370bcfa095ef90adc202065492ea8c8ef17e45a`.
+- A new temporary source/target pair reproduced the canonical report after normalizing only the
+  session-bound `.blend` container hashes.
+
+## Artifact Hashes
+
+- generator: `b9d8e3bd24966b0d7d419382d7ef0b35ae8def9ee2c2236dfd3ad1a90aebe66f`
+- checker: `6f8cc0d51be19423cf6fb7203c3c16f8d27e0fbb3b5b357bad5dec6c5ceb432d`
+- source `.blend`: `5b60d02926efd588a6ca300ba31414cdf37dbc48786c17b383a70319057c0606`
+- target `.blend`: `5cde4927f47e33f0338de38184ce5ba971825fcefd1d8dc6feb48d41a6cdb60c`
+- desktop report: `b1d7b8b9e832d18d69081f63981062800e0f00f0c9aec025b18274510ed76e2a`
+- manifest: `cbfbd8c919125108334dd24925b9ef8e69880983515e56841e6ead4a2b182aed`
+- package commands: `b68f2bce48fcd42e4cc1399b47ba33c35495248a6c0405c2280b5b73e3ce581a`
+
+## Next Task
+
+`M12-03D`: append the same closure into WASM Main with one transaction and local ownership.
+
+## Rollback
+
+Remove the desktop append generator/checker, source and target fixtures, golden report/manifest,
+package command, and this status entry. Restore M12-03C to pending and the queue to M12-03C. No
+parity ledger rollback is required.

docs/status/M12-03D.md

@@ -0,0 +1,52 @@
+# M12-03D Status
+
+status: done
+task: append one dependency closure through WASM Main in one transaction
+updated: 2026-08-17 America/New_York
+enablingTask: false
+parityStateChange: false
+
+## Scope
+
+The browser Worker validates a source-hash-bound APPEND binding and sends one Object closure to
+the authoritative Blender Main. Blender's native link/append context recursively imports the
+Object, Mesh, Material, and packed Image, verifies that every resulting ID is local and writable,
+and publishes one SceneIR revision. The existing Main history transaction is used for rollback and
+undo/redo; the source is never treated as a linked read-only snapshot.
+
+## Evidence
+
+- `EM_CACHE=/home/mes123456/workinf_Blender_Wasm/.emcache cmake --build build_web_blender6 --target web_engine -- -j2` passed;
+  the generated module exports `_web_engine_append_library_object`.
+- `npm --prefix web run typecheck` passed.
+- `WEB_TEST_PORT=5194 npm --prefix web run test:library-main-append` passed in Chromium.
+- The test opens a clean `.blend`, appends the desktop fixture closure through `WebEngineClient`,
+  verifies `transactionCount=1`, four `LOCAL_MAIN` mappings, stable Object/Mesh/Material/Image
+  IDs, the material-to-image dependency, and a single revision increment.
+- A stale base revision returns `REVISION_CONFLICT`; a second append colliding with the local IDs
+  returns `ASSET_MANIFEST_INVALID` without changing the revision. Undo removes the closure, redo
+  restores it, and a saved buffer reopens with the same local image and Object dependency.
+- The Worker closure check accepts both the reader's `material.imageIds` representation and the
+  Blender node-level `imageId` representation; it does not infer ownership from a preview.
+
+## Artifact hashes
+
+- test: `7130453cbc81f22eb1bcf598ff3745672ac8177dccb11cef667f5b68b43e87c6`
+- worker: `e3bb430e401144bf17cdcbd0de13cde0a4f904f1f9ff9d5b10a73d90f0d4c648`
+- protocol: `bfd98561cbe797d7b8f07c92c53a25460c839a64ab7222b7795cf58d54dff8d7`
+- source `.blend`: `5b60d02926efd588a6ca300ba31414cdf37dbc48786c17b383a70319057c0606`
+- clean target `.blend`: `9b1ecbcc3d7f8079ee5469de64193ffcaa0a7b01e0f2ac340bbb18aa88734a63`
+- WASM JS: `9c831d0351ac9d0714cce3b1da748cba416ced3086e3c59595cf24ac4da459ed`
+- WASM binary: `7821f408687e455c6f4e185fc3741c199c1c60d409836a2fe1b32f521d81e0ea`
+- Main append API: `5a71260c542fa559f73c6b82e23e72d39bd2844f5ebe12c6edc809a49d79791b`
+- Main append implementation: `d0c484ab62e6ec051c8c2f67c49d750a456578aaccc2aa4f461026307af0db95`
+
+## Next task
+
+`M12-03E`: append undo/redo/save/reopen and the desktop canonical report must agree.
+
+## Rollback
+
+Remove the M12-03D Worker/e2e test, package command, WASM append export and Main append entrypoint,
+restore the material closure check, and move the machine queue back to `M12-03D`. No V1 release
+ledger rollback is required.

docs/status/N-019.md

@@ -1,8 +1,8 @@
 # N-019 灯光与渲染
 
 状态：`BLOCKED`（Camera/Light/World/Scene metadata、Camera/Light/World 有界 Main 写回、
-Three exposure/shadow 映射和一条有界 Blender reference 图像指标闭环已落地；Scene 颜色管理
-writer、全域渲染等价和高级后端仍未实现）
+Three exposure/shadow 映射、一条有界 Blender reference 图像指标和 Render 故障生命周期闭环
+已落地；Scene 颜色管理 writer、全域渲染等价和高级后端仍未实现）
 
 ## 已验证切片
 
@@ -49,6 +49,10 @@ writer、全域渲染等价和高级后端仍未实现）
     绑定同一 provenance 并公开 output MIME/byte length/output SHA-256/result SHA-256。真实
     loopback server 由 Blender 5.2 headless 打开 fixture 并输出 PNG；source、settings、build
     和 output 篡改均在提交或消费前结构化拒绝。
+14. M11-14 Render fault lifecycle：真实 Eevee `.blend` 在 Chromium WebEngine/Main 打开后生成
+    非空 WebGL RGBA8 输出；预取消 open 返回 `OPEN_CANCELLED` 且不替换当前 Main，Worker
+    generation 2 重开保持 scene identity 和输出 SHA-256。纹理 aggregate budget 超限不替换
+    已加载资源，`GPUTextureStore.dispose()` 返回正数 byte/resource 回执并归零所有 owned texture。
 
 ## 仍然阻断
 
@@ -75,5 +79,6 @@ WEB_TEST_PORT=5548 npm --prefix web run test:render-resource-budget
 WEB_TEST_PORT=5552 npm --prefix web run test:render-reference
 WEB_TEST_PORT=5556 npm --prefix web run test:render-routing
 WEB_TEST_PORT=5560 npm --prefix web run test:server-render-job
+WEB_TEST_PORT=5592 npm --prefix web run test:render-compositor-media-recovery
 WEB_TEST_PORT=5319 npm --prefix web run test:e2e -- --grep "N-019 Scene exposure"
 ```

docs/status/N-020.md

@@ -1,7 +1,8 @@
 # N-020 Compositor
 
-状态：`BLOCKED`（GraphIR、有界 CPU executor、真实 Main graph reader、四节点 WebGPU golden
-与 Unsupported 全图执行门已落地；完整节点参数映射、通用 WebGPU、HDR golden 和服务端执行未实现）
+状态：`BLOCKED`（GraphIR、有界 CPU executor、真实 Main graph reader、四节点 WebGPU golden、
+Unsupported 全图执行门和故障生命周期闭环已落地；完整节点参数映射、通用 WebGPU、HDR golden
+和服务端执行未实现）
 
 ## 已验证切片
 
@@ -35,6 +36,10 @@
    完整 graph；即使 Unsupported 节点未连接到 Composite，也返回
    `COMPOSITOR_NODE_UNSUPPORTED`。真实 Blender 5.2 Main fixture 的 Glare node name/type/
    `blenderType`、graph JSON 与 revision 在失败前后完全不变；预置 cache 不能绕过该门。
+10. M11-14 Compositor fault lifecycle：真实 Main graph 的 CPU executor 周期取消返回
+    `COMPOSITOR_CANCELLED`，8193 像素超尺寸输入在分配/缓存前返回
+    `COMPOSITOR_BUDGET_EXCEEDED`。generation 2 重开保持 GraphIR identity 与 Float32 output
+    SHA-256，LRU `clear()` 返回已释放字节并把 entries/bytes 归零。
 
 ## 仍然阻断
 
@@ -54,4 +59,5 @@ WEB_TEST_PORT=5320 npm --prefix web run test:e2e -- --grep "N-020 CPU compositor
 npm --prefix web run test:compositor-main-reader
 WEB_TEST_PORT=5562 npm --prefix web run test:compositor-node-golden
 WEB_TEST_PORT=5565 npm --prefix web run test:compositor-unsupported-gate
+WEB_TEST_PORT=5592 npm --prefix web run test:render-compositor-media-recovery
 ```

docs/status/N-021.md

@@ -2,8 +2,8 @@
 
 状态：`BLOCKED`（strip schema、真实 Main reader、确定性时间编辑、长媒体有界索引/seek/cache、
 三类实际 runtime codec probe、source/decode-bound 首帧 proxy cache、三类迟到结果 revision
-gate、最终编码 server-export 路由和实时 AudioContext 恢复门已落地；Main 写回、完整媒体
-解码/渲染、音频波形、A/V sync、实际混音和真正服务端编码 job 仍未实现）
+gate、最终编码 server-export 路由、实时 AudioContext 恢复门和媒体故障生命周期闭环已落地；
+Main 写回、完整媒体解码/渲染、音频波形、A/V sync、实际混音和真正服务端编码 job 仍未实现）
 
 ## 已验证切片
 
@@ -63,6 +63,10 @@ gate、最终编码 server-export 路由和实时 AudioContext 恢复门已落
     mute 将 gain 归零，unmute 恢复 0.75，close 再归零并断开节点。API/构造器缺失与 resume
     failure 分别稳定返回 `SEQUENCER_AUDIO_DEVICE_UNAVAILABLE` 和
     `SEQUENCER_AUDIO_RESUME_FAILED`，不会误报输出启用。
+17. M11-14 Media fault lifecycle：真实 H.264 先通过 HTMLMedia probe 并解出 8x8 RGBA8 frame；
+    预取消 proxy decode 返回 `SEQUENCER_CANCELLED` 且不发布 payload。低于一帧的 cache budget
+    返回 `SEQUENCER_BUDGET_EXCEEDED` 且 entries/bytes 保持 0；首会话 clear 返回正数释放字节，
+    重建会话后 source/decode/profile identity 和 payload SHA-256 保持不变。
 
 ## 仍然阻断
 
@@ -86,4 +90,5 @@ WEB_TEST_PORT=5573 npm --prefix web run test:sequencer-media-cache
 WEB_TEST_PORT=5576 npm --prefix web run test:sequencer-media-revision
 WEB_TEST_PORT=5579 npm --prefix web run test:sequencer-final-export
 WEB_TEST_PORT=5586 npm --prefix web run test:sequencer-audio-recovery
+WEB_TEST_PORT=5592 npm --prefix web run test:render-compositor-media-recovery
 ```

docs/status/N-023.md

@@ -3,6 +3,97 @@
 状态：`BLOCKED`（asset catalog、来源/许可证元数据、真实 Main library inventory、库依赖与
 IO 安全门已落地；Append/Link/Override Main、非 GLB 本地导入和跨桌面重导入未实现）
 
+## 完整对标盘点基线
+
+M12-01A 已从 Blender 5.2 DNA、RNA、Blend IO、AssetCatalog/CDF 源码及真实 RNA runtime 盘点
+14 个 `AssetMetaData` DNA 字段、10 个公开 RNA 属性、3 个 `AssetTag` 存储字段和 3 个 catalog
+持久语义字段。M12-01B 随后用锁定 Blender 5.2 生成 3 条 CDF v1 catalog、Object/Material/World
+资产和 canonical JSON，并由独立 Blender 新进程精确重开复验。M12-01C 以 Blender UUID/path
+和 AssetWeakReference 定义 Web schema v2 stable identity，并冻结 UTF-8 文本及条目预算。三项均为
+`enablingTask`。M12-01D 又完成 v1→v2 无损前向迁移，保留 revision、source、preview 与 library
+graph，并输出确定性 ID mapping/hash report。四项只冻结完整对标输入与迁移，不增加本节已验证
+slice。M12-01E 又固定 v2 对 v1 reader 的 read-only/write-block/future-reject 策略。五项仍不改变
+`parityStatus=BLOCKED`。
+
+M12-01F 已补齐 duplicate catalog/asset ID、legacy parent cycle、v2 parentPath drift、UTF-8
+simple-name/tag budget 和 v1/v2 unknown-field 共 9 类稳定负例；该 enabling evidence 不改变 slice。
+
+M12-01G 已让 v1→v2 IndexedDB index migration 在同一 readwrite transaction 中提交 target、
+receipt 和 source delete；写 target 后或删 source 后注入失败均 abort，关闭并重开后旧 v1 index、
+无关 migration 行和数据库版本精确不变。该 enabling evidence 仍不改变 slice。
+
+M12-01H 又证明初始页面、reload 和两个顺序重建的独立 Worker 读取相同 catalog/asset 顺序、
+AssetWeakReference stable identity、revision 和 manifest SHA-256；receipt/hash drift 在发布前阻断。
+该 enabling evidence 仍不改变 slice。
+
+M12-01I 将 A-H 八项任务链、Blender 5.2 desktop fixture、Web v2 fixture、production migration
+report、canonical 双 hash 和 IndexedDB fault/restart artifact 递归绑定为一个 READY evidence。
+M12.1 schema/migration 已收口，但仍是 enabling evidence，不把 catalog mutation/preview 计为完成。
+
+M12-02A 已盘点 PreviewImage 的 ICON/PREVIEW 双槽、持久尺寸/rect/flag、RGBA8 packed pixel、
+premultiplied alpha、runtime deferred/invalid 状态和真正的 null pointer。原生结构/RNA 没有颜色空间
+字段；现有 Web v1/v2 也缺 slot/colorSpace/alpha/generator 语义。本项仍是 inventory evidence。
+
+M12-02B 定义 source/content 各自的 byte length、MIME、SHA-256，并让 content 绑定尺寸、RGBA8、
+sRGB/alpha profile，generator 绑定 Blender version/executable/script/settings。真实 Blender 两次重编码
+确定性相同，source/content 编码不同但解码像素 exact；本项仍是 enabling identity evidence。
+
+M12-02C 在任何图像 decoder 或 decoded allocation 前依次检查 identity、16 MiB encoded bytes、
+content SHA-256、PNG/WebP header、identity-bound dimensions、16,777,216 pixels、64 MiB RGBA8
+decoded bytes 和 100:1 compression ratio。8 类失败均 fail-closed，随后小 preview 可立即恢复；
+本项仍是 enabling budget evidence，不把 preview storage/display 计为完成。
+
+M12-02D 先把 content-addressed preview 写入 OPFS 并回读复验，再用一次 revision/full-row guarded
+IndexedDB transaction 提交 catalog v2 preview reference 和 hash receipt。OPFS 前后及 catalog put
+后的三处 fault 都保持旧 catalog；重开后 revision、receipt 和 payload hash 一致。本项仍不把
+dedupe、损坏隔离或 viewport display 计为完成。
+
+M12-02E 又让两个不同 Blender weak-reference identity 和不同 metadata 的 asset 共享相同 content
+SHA-256；第二次写入只复验并复用 OPFS payload，物理文件计数为 1，两个 catalog entry 的完整
+non-preview metadata 不变，revision 9 重开一致。本项仍不把损坏隔离或 display 计为完成。
+
+M12-02F 将同长度但 SHA-256 漂移的 bytes 从 content-addressed namespace 移入复验后的 quarantine
+文件，并写入与 catalog revision/reference 绑定的 receipt。catalog 本身及另一 asset 均不变；重开后
+仍可读取完整 metadata，只把 preview/data 返回 null。本项仍不把 reference GC/display 计为完成。
+
+M12-02G 在 catalog reference transaction 完成后按 committed manifest 计数：同项目仍有一个引用时
+保留 payload，最后一个引用删除后才回收。OPFS project namespace 保证另一项目的同 hash payload
+和 READY preview 不受影响；revision 11 重开 metadata 不变。本项仍不把 display 计为完成。
+
+M12-02H 已把 Blender 5.2 确定性重编码的 `SRGB/RGBA8/STRAIGHT` preview 固定为逐字节 reference，
+主线程 `HTMLCanvasElement` 与独立 Worker `OffscreenCanvas` 共用生产 decode/display 实现。两条路径
+均先通过 M12-02C 的 identity/header/预算门，再以禁用色彩转换和预乘的 `ImageBitmap` 解码；输出
+256-byte RGBA8 hash 与 desktop reference 完全一致，MAE/RMS/P95/max/bad-pixel/alpha 指标均为零，
+前景 IoU 为 1。该项新增一个已验证 preview display parity slice，但不扩大到任意尺寸、色彩空间、
+asset browser UI 或 Append/Link/Override。
+
+M12-03A 已分别冻结 Append、Link 与 Library Override 的数据块/闭包边界。真实 Blender runtime
+公开 36 类 selectable root，其中 Screen/WorkSpace 为 append-only；Library 是来源/传递依赖元数据，
+Key 等 embedded ID 随 owner 进入闭包。Append 由实际 ID pointer graph 区分 direct、indirect、
+cross-library、override dependency 与 reusable local；Link 保留 `ID.lib`、EXTERN/INDIRECT 和
+`Library.runtime.parent`；Override 另记录 linked reference、local owner、hierarchy root、property/
+operation 与 system dependency。该 inventory 仍不创建 ownership contract 或 Main transaction。
+
+M12-03B 已定义 schema 1 library operation identity。`sourceLibraryId` 同时绑定 canonical source
+locator 与 `.blend` SHA-256；APPEND 只能由 `LOCAL_MAIN` owner 持有且可写，LINK 只能由匹配的
+`SOURCE_LIBRARY` owner 持有且 root/reference 均只读，LIBRARY_OVERRIDE 由 `LOCAL_OVERRIDE`
+持有、local 可写但 linked reference 只读。invalidation token 还绑定 operation、root、owner、
+source generation/revision 与 dependency-closure hash；任一漂移稳定返回 `REVISION_CONFLICT`。
+
+M12-03C 已生成真实 Blender 5.2 desktop 单 Object append fixture。选中的 Object 自动带入 Mesh、
+Material 和 packed Image 依赖，四个 ID 在 target Main 中均无 source library/override 指针并映射为
+可写 `LOCAL_MAIN` owner。新 Blender load 路径重开 target 后，3 条依赖边、4/4/1 geometry、UVMap、
+material slot、2x2 sRGB RGBA image 和 Float32 pixel SHA-256 均与 source canonical report 一致。
+本项只冻结 desktop 权威 fixture，不提前声明 WASM Main append、undo/redo 或完整 append parity。
+该合同没有提前执行 Append 或开放 writer。
+
+M12-03D 已把同一 source-hash-bound closure 送入 WASM Worker 的 authoritative Blender Main。Native
+link/append context 递归导入 Object、Mesh、Material 和 packed Image，Main commit 前核对 source
+locator、root、closure 与 base revision；四个 ID 均无 `ID.lib`/override、映射为可写 `LOCAL_MAIN`，
+并只产生一个新的 SceneIR revision。stale revision 与 local ID collision 在 Main mutation 前阻断，
+失败路径回滚完整 history state。该项只证明单 transaction Main append，undo/redo/save/reopen 与
+desktop canonical report 的联合一致性仍由 M12-03E 验证。
+
 ## 已验证切片
 
 1. N-023-A：版本化 manifest 覆盖 catalog、asset kind/tag、preview、author、license、
@@ -29,11 +120,13 @@ IO 安全门已落地；Append/Link/Override Main、非 GLB 本地导入和跨
    已完成；大 bundle 性能仍未实现。
 9. VDB 独立资源库包含 generated/official/source/derived/report/manifest/license，14 条记录逐项绑定
    byte length 与 SHA-256；官方 sphere 使用 CC-BY-4.0 和 Git LFS 权威 hash，未放入仓库工作树。
+10. N-023-A（preview display）：Blender 5.2 desktop RGBA8 reference、主线程 Canvas2D 与
+    OffscreenCanvas 的像素 SHA-256 精确一致；错误像素返回 `RENDER_REFERENCE_MISMATCH`。
 
 ## 仍然阻断
 
-- N-023-B：Append/Link/Library Override、reload/relocate 和真实 Main transaction；只读 library
-  inventory 已完成。
+- N-023-B：Append undo/redo/save/reopen、Link/Library Override、reload/relocate 和完整真实 Main
+  parity；M12-03D 的单 transaction append 已有独立证据，但不解除本项阻断。
 - N-023-C/D：GLTF/OBJ/PLY/STL、USD/Alembic import/export/save/reopen/desktop reimport。
 - N-023-E：真实 zip decoder/fuzz、OPFS quota/recovery、license/source offer 发布审计和大文件
   流式性能；archive 路径冲突、双向字节预算与确定性 range plan 已完成。
@@ -44,6 +137,23 @@ IO 安全门已落地；Append/Link/Override Main、非 GLB 本地导入和跨
 ```bash
 WEB_TEST_PORT=5323 npm --prefix web run test:e2e -- --grep "N-023 asset"
 npm --prefix web run test:library-main-reader
+npm --prefix web run test:asset-catalog-inventory
+npm --prefix web run test:asset-catalog-v1-fixture
+npm --prefix web run test:asset-catalog-v2
+npm --prefix web run test:asset-catalog-migration
+npm --prefix web run test:asset-catalog-legacy-reader
+npm --prefix web run test:asset-catalog-negatives
+npm --prefix web run test:asset-preview-inventory
+npm --prefix web run test:asset-preview-identity
+npm --prefix web run test:asset-preview-decode-budget
+npm --prefix web run test:asset-preview-opfs-commit
+npm --prefix web run test:asset-preview-dedup
+npm --prefix web run test:asset-preview-quarantine
+npm --prefix web run test:asset-preview-reference-gc
+npm --prefix web run test:asset-preview-display
+npm --prefix web run test:library-operation-inventory
+npm --prefix web run test:library-operation-identity
+npm --prefix web run test:library-main-append
 npm --prefix web run test:vdb
 npm --prefix web run test:vdb-native
 ```

docs/status/parity-ledger.json

@@ -72,7 +72,7 @@
       "v1RequiredSlices": ["B-world-scene-render-delta-roundtrip", "B-C-nanovdb-float32-wgsl-bounded-ray-integration"],
       "v1ExcludedSlices": ["A", "B", "C", "D", "E", "B-C-nanovdb-production-viewport-paging-advanced-material", "E-volume-desktop-chromium-pixel-golden"],
       "roadmapStatus": "planned",
-      "completedSlices": ["A-camera-light-world-scene-reader-partial", "A-main-camera-dof-properties-partial", "A-main-light-world-properties-partial", "A-white-balance-integrity-gate", "B-three-exposure-shadow-mapping-partial", "B-bounded-kelvin-linear-light-color", "B-world-scene-render-delta-roundtrip", "B-volume-material-manifest-boundary", "B-C-nanovdb-float32-wgsl-bounded-ray-integration", "D-final-render-server-routing-fail-closed", "D-server-render-source-build-settings-output-hash-binding", "E-bounded-realtime-blender-reference-image-metrics"],
+      "completedSlices": ["A-camera-light-world-scene-reader-partial", "A-main-camera-dof-properties-partial", "A-main-light-world-properties-partial", "A-white-balance-integrity-gate", "B-three-exposure-shadow-mapping-partial", "B-bounded-kelvin-linear-light-color", "B-world-scene-render-delta-roundtrip", "B-volume-material-manifest-boundary", "B-C-nanovdb-float32-wgsl-bounded-ray-integration", "D-final-render-server-routing-fail-closed", "D-server-render-source-build-settings-output-hash-binding", "E-bounded-realtime-blender-reference-image-metrics", "E-render-fault-lifecycle-recovery"],
       "blockedSlices": ["A", "B", "C", "D", "E", "B-C-nanovdb-production-viewport-paging-advanced-material", "E-volume-desktop-chromium-pixel-golden"],
       "acceptance": ["web:test:lighting-roundtrip", "web:e2e:N-019 Scene exposure"],
       "dependencies": ["N-018"]
@@ -86,7 +86,7 @@
       "v1RequiredSlices": ["B-real-main-exposure-invert-cpu-chain", "D-unsupported-node-preservation-gate"],
       "v1ExcludedSlices": ["A", "B", "C", "D", "E"],
       "roadmapStatus": "planned",
-      "completedSlices": ["A-graph-resource-cycle-schema", "A-main-graph-structure-reader-partial", "A-main-exposure-default-invert-parameter-reader", "B-bounded-cpu-executor-partial", "B-real-main-exposure-invert-cpu-chain", "B-webgpu-constant-exposure-invert-golden-partial", "B-D-unsupported-full-graph-execution-block", "C-image-operation-budget-cancel-partial", "C-content-addressed-frame-lru-cache", "D-unsupported-node-preservation-gate"],
+      "completedSlices": ["A-graph-resource-cycle-schema", "A-main-graph-structure-reader-partial", "A-main-exposure-default-invert-parameter-reader", "B-bounded-cpu-executor-partial", "B-real-main-exposure-invert-cpu-chain", "B-webgpu-constant-exposure-invert-golden-partial", "B-D-unsupported-full-graph-execution-block", "C-image-operation-budget-cancel-partial", "C-content-addressed-frame-lru-cache", "C-E-compositor-fault-lifecycle-recovery", "D-unsupported-node-preservation-gate"],
       "blockedSlices": ["A", "B", "C", "D", "E"],
       "acceptance": ["web:test:compositor-main-reader", "web:e2e:N-020 CPU compositor"],
       "dependencies": ["N-019"]
@@ -100,7 +100,7 @@
       "v1RequiredSlices": ["B-real-main-cross-still-frame-resolution", "C-runtime-codec-probe-gate"],
       "v1ExcludedSlices": ["A", "B", "C", "D", "E"],
       "roadmapStatus": "planned",
-      "completedSlices": ["A-strip-resource-schema", "A-main-strip-timeline-reader-partial", "B-deterministic-move-trim-split-partial", "B-source-frame-seek", "B-active-frame-dependency-resolution", "B-cross-transition-progress-input-resolution", "B-real-main-cross-still-frame-resolution", "C-runtime-codec-probe-gate", "C-runtime-image-sound-movie-byte-decode-probe", "C-source-decode-bound-movie-proxy-cache", "C-seek-scrub-decode-revision-gate", "C-audio-context-suspend-device-mute-recovery", "D-final-export-server-routing-fail-closed"],
+      "completedSlices": ["A-strip-resource-schema", "A-main-strip-timeline-reader-partial", "B-deterministic-move-trim-split-partial", "B-source-frame-seek", "B-active-frame-dependency-resolution", "B-cross-transition-progress-input-resolution", "B-real-main-cross-still-frame-resolution", "C-runtime-codec-probe-gate", "C-runtime-image-sound-movie-byte-decode-probe", "C-source-decode-bound-movie-proxy-cache", "C-seek-scrub-decode-revision-gate", "C-audio-context-suspend-device-mute-recovery", "C-media-fault-lifecycle-recovery", "D-final-export-server-routing-fail-closed"],
       "blockedSlices": ["A", "B", "C", "D", "E"],
       "acceptance": ["web:test:sequencer-main-reader", "web:e2e:N-021 sequencer"],
       "dependencies": ["N-020"]
@@ -128,7 +128,7 @@
       "v1RequiredSlices": ["C-glb-export-usd-analysis-gates", "E-archive-path-conflict-compressed-budget-range-plan", "E-nanovdb-opfs-tamper-rollback-quota-recovery"],
       "v1ExcludedSlices": ["A", "B", "C", "D", "E", "E-nanovdb-large-bundle-performance"],
       "roadmapStatus": "planned",
-      "completedSlices": ["A-catalog-asset-license-source-schema", "A-content-addressed-opfs-capability", "A-preview-content-signature-dimension-verification", "A-vdb-external-resource-license-sha-catalog", "B-library-dependency-order-partial", "B-main-library-inventory-reader", "C-glb-export-usd-analysis-gates", "E-archive-path-ratio-budget", "E-archive-path-conflict-compressed-budget-range-plan", "E-nanovdb-http206-range-hash-streaming-boundary", "E-nanovdb-http-retry-if-range-body-resume", "E-nanovdb-opfs-atomic-binding-worker-reopen-bundle-lru", "E-nanovdb-opfs-tamper-rollback-quota-recovery", "E-nanovdb-gpu-resident-page-lru"],
+      "completedSlices": ["A-catalog-asset-license-source-schema", "A-content-addressed-opfs-capability", "A-preview-content-signature-dimension-verification", "A-preview-desktop-browser-main-offscreen-display", "A-vdb-external-resource-license-sha-catalog", "B-library-dependency-order-partial", "B-main-library-inventory-reader", "C-glb-export-usd-analysis-gates", "E-archive-path-ratio-budget", "E-archive-path-conflict-compressed-budget-range-plan", "E-nanovdb-http206-range-hash-streaming-boundary", "E-nanovdb-http-retry-if-range-body-resume", "E-nanovdb-opfs-atomic-binding-worker-reopen-bundle-lru", "E-nanovdb-opfs-tamper-rollback-quota-recovery", "E-nanovdb-gpu-resident-page-lru"],
       "blockedSlices": ["A", "B", "C", "D", "E", "E-nanovdb-large-bundle-performance"],
       "acceptance": ["web:test:library-main-reader", "web:test:vdb-faults", "web:e2e:N-023 asset"],
       "dependencies": ["N-022"]

docs/status/release-evidence.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 4,
   "source": "docs/status/parity-ledger.json",
-  "sourceSha256": "0a9b4c1026c42b5f77869f222b1531601ed229184a1d1737e74047c7b3406730",
-  "generatedAt": "2026-08-17T08:22:00.415Z",
+  "sourceSha256": "c8d73374c338f46c2016f6089d99efdd7b3331fc0100d64dad0f416fe66e3eb6",
+  "generatedAt": "2026-08-17T15:09:53.894Z",
   "families": [
     {
       "id": "N-015",
@@ -277,7 +277,8 @@
         "B-C-nanovdb-float32-wgsl-bounded-ray-integration",
         "D-final-render-server-routing-fail-closed",
         "D-server-render-source-build-settings-output-hash-binding",
-        "E-bounded-realtime-blender-reference-image-metrics"
+        "E-bounded-realtime-blender-reference-image-metrics",
+        "E-render-fault-lifecycle-recovery"
       ],
       "blockedSlices": [
         "A",
@@ -324,6 +325,7 @@
         "B-D-unsupported-full-graph-execution-block",
         "C-image-operation-budget-cancel-partial",
         "C-content-addressed-frame-lru-cache",
+        "C-E-compositor-fault-lifecycle-recovery",
         "D-unsupported-node-preservation-gate"
       ],
       "blockedSlices": [
@@ -372,6 +374,7 @@
         "C-source-decode-bound-movie-proxy-cache",
         "C-seek-scrub-decode-revision-gate",
         "C-audio-context-suspend-device-mute-recovery",
+        "C-media-fault-lifecycle-recovery",
         "D-final-export-server-routing-fail-closed"
       ],
       "blockedSlices": [
@@ -456,6 +459,7 @@
         "A-catalog-asset-license-source-schema",
         "A-content-addressed-opfs-capability",
         "A-preview-content-signature-dimension-verification",
+        "A-preview-desktop-browser-main-offscreen-display",
         "A-vdb-external-resource-license-sha-catalog",
         "B-library-dependency-order-partial",
         "B-main-library-inventory-reader",