[prakashUXtech]

Mac finish pass for the export-pack quality gate. Refs #5834

Covers #3477 and #4523 (export-pack, SuiteUI).

What changed

• Export button on a refused size (SuiteUI). ExportSheetRows.startBlock gives the reason Export can't start: either the run is past editing, or the Size row's readout is a refusal. The button now uses that reason for .disabled, .help and its control reason. Before, it only checked editable, so a refused size still left Export enabled.
• CLI refusals (SuiteKernel, CLI).
  • A schema issue in the export options is now a sentence, not a JSON pointer. For example: "Each side in pixels has to be at least 1."
  • The fake document rethrows the refusal as is.
  • The CLI maps ExportOptionRefusal to data (exit 65), not failed (exit 70).
  • The shape refusal tells CLI users to pass "stretch": true. It no longer says to unlock a ratio lock the CLI doesn't have.
• Design SVG (DesignModel). Design export now reads the suite options and refuses any size except 1x, in words. It used to ignore the size, write 1x and report ok.
• Photo Export keeps the source's metadata (bug 2). PhotoWindow.write now passes an export's encoded still through PhotoWindow.carryingMetadata, which uses the live StillMetadata. Photo's sheet has no metadata row, so the policy is the suite default .all. The orientation is dropped, because the decode already turned the pixels upright. Test: PhotoExportMetadataTests (gps-phone.jpg opened and exported through ImageIOCodec; GPS, Make, Model, DateTimeOriginal and Copyright kept, orientation dropped, no source copies nothing). Mutation plan: PhotoApp.PhotoWindow+Export.
• Headless export skips an 8-bit round trip (PhotoModel). PhotoHeadless.export used to turn the resampled buffer into 8-bit RGBA and then back into a linear buffer for core's encoder. Now exportBuffer hands the buffer to CoreRasterImageCodec.encode(buffer:) as is. At 48 MP that saves about 0.4 s. PNG bytes are unchanged (theAgentsJSONOptionsGiveTheSheetsPixels decodes the headless PNG and compares it to exportPixels).
• Library metadata tests. The three file tests that waited on XP-7 run again. StillMetadata and the gps-phone.jpg sample are both on dev.
• The CLI's Photo export keeps the source's metadata (bug 7, SuiteImaging, PhotoModel). New JPEGMetadata in SuiteImaging is a Linux-safe MetadataCarrying for JPEG. It copies the source's Exif APP1 onto the encoded still and edits the TIFF structure in place, with bounds checks. It removes each dropped tag (GPS IFD, serial numbers, maker notes and so on), sets a dropped Orientation to 1, and always clears the source's thumbnail and pixel-size tags. XMP and IPTC go along only when the policy drops nothing but the orientation. PhotoHeadless remembers an opened JPEG's bytes, and a JPEG export now runs through it with ExportRules.dropped(metadata) plus Orientation, since the decode already turned the pixels upright. No Package.swift change was needed: PhotoModel already links SuiteImaging, and ImageIO stays inside SuiteImageIO. PNG export carries no metadata yet, because core's PNG writer has no eXIf chunk.
• Goldens. The export-pack snapshot states now also check Golden/inspector/export-pack-<state>-<light|dark>.png. Golden/README.md says goldens must come from the macOS CI job, so no baselines are committed here. A missing baseline is recorded as a known issue, and CI records it.

Tests

• ExportPackRowsTests.aRefusedSizeBlocksExportAndSaysWhy and SuiteExportPackSnapshots.eachStateReadsItsSize: Export is blocked only in the refused state.
• CLIExportRefusalTests: the refusal kind is data with exit 65, there are no schema paths, and the shape refusal names stretch.
• DesignHeadlessExportOptionsTests: SVG refuses pixels, scale 2, long edge and unknown keys, and accepts none, {} and scale 1.
• FakeCanvasExportTests, LibraryExportMetadataWriteTests (re-enabled).
• PhotoHeadlessMetadataTests: all keeps GPS, camera, copyright, date and serial, with the orientation at 1. noLocation drops GPS and the serial (its bytes too) and keeps the rest. none keeps nothing identifying. A PNG export still writes, and an unreadable source copies nothing.
• Mutation plans: AfterGlowCLICore.Output, DesignModel.DesignHeadless, SuiteKernel.ExportOptions, SuiteKernel.FakeCanvasDocument, SuiteImaging.JPEGMetadata (3/3 caught), and PhotoModel.PhotoHeadless (adds metadataSkipped, caught). Two older entries in that plan, pngRoundTripExact and mergedNotKept, escape on this head. This branch didn't add them, and pngRoundTripExact targets the writePNG fallback that only runs when core throws unsupported.

Proof

• Proof: Export enabled on a refused size (bug 1) | SuiteExportPackSnapshots.screens() plus ExportPackRowsTests.aRefusedSizeBlocksExportAndSaysWhy on the macOS debug build: a 4:5 artwork set to 1080 × 1351 with Keep Ratio on | The Size row reads "1080 × 1351 doesn't keep the artwork's 4:5 shape. Unlock the ratio to stretch." and the Export button is greyed out next to it; the scale, pixels, long-edge, stretched and vector states keep Export enabled | suiteui-export-pack-refused-light.png / -dark.png; swift test --filter '...|SuiteExportPackSnapshots|ExportPackRowsTests': "✔ Suite ExportPackRowsTests passed", "Suite SuiteExportPackSnapshots passed after 5.997 seconds with 12 known issues" (the 12 are the unrecorded goldens)
• Proof: SVG ignores size and reports ok (bug 3) | .build/debug/afterglow design export d.design --format svg --json '{"size":{"pixels":[1080,1350]}}' on a 1440x1024 document | kind: data, exit 65, "SVG writes each frame at its own size, so it takes no size. Leave size out."; with no options it writes width="1440" height="1024" and ok | CLI output; DesignHeadlessExportOptionsTests
• Proof: CLI shape refusal names a ratio lock and exits failed (bug 4) | .build/debug/afterglow photo export p.ora --format png --json '{"size":{"pixels":[1080,1350]}}' on a 1600x1200 image | kind: data, exit 65, "1080 × 1350 doesn't keep the artwork's 4:3 shape. Pass "stretch": true with pixels to stretch." | CLI output; CLIExportRefusalTests
• Proof: refusals leak schema paths, exit 70 (bug 8) | afterglow photo export p.ora --json '{"size":{"pixels":[0,0]}}' and '{"size":{"scale":0}}' | "Each side in pixels has to be at least 1." and "A scale has to be more than 0.", both kind: data, exit 65, no /size/... path | CLI output; CLIExportRefusalTests, FakeCanvasExportTests
• Proof: Photo export drops GPS, Copyright and DateTimeOriginal (bug 2) | PhotoExportMetadataTests on the macOS debug build: gps-phone.jpg opened through ImageIOCodec, exported as JPEG and run through PhotoWindow.carryingMetadata | the written file keeps {GPS}, {TIFF}.Make and Model, {Exif}.DateTimeOriginal and Copyright, and drops Orientation; with no source the still is unchanged | "✔ Suite PhotoExportMetadataTests passed after 0.066 seconds."
• Proof: Photo export drops GPS, Copyright and DateTimeOriginal (bug 2), in the built app | journey PhotoJourneyTests/PhotoExportMetadataJourneyTests/testExportKeepsTheSourcesMetadata (11-02, through the journey wrapper, head ee56f92): Photo.app opens gps-phone.jpg, Export, JPEG, Export | the status bar reads "Exported gps-phone.jpg", and the written file read back with ImageIO keeps {GPS}, {TIFF}.Make, Model and Copyright and {Exif}.DateTimeOriginal, with Orientation 1. All six metadata assertions passed | photo-export-metadata-opened.png, -sheet.png, -exported.png. The run is marked failed by one app-audit contrast reading on photo.adjust.header (1.42:1) in the two shots without a sheet. That header is unchanged here, and dev's hosted journeys (full run 41307844351) show no such fault. On this Mac, macOS's Documents-folder privacy prompt for the freshly signed runner was on screen in those shots.
• Proof: Library metadata write tests disabled (bug 9) | the three re-enabled LibraryExportMetadataWriteTests on the macOS debug build, writing through the live StillMetadata carrier | all pass | "✔ Suite LibraryExportMetadataWriteTests passed after 0.209 seconds."
• Proof: metadata 'all' keeps nothing in the CLI (bug 7) | .build/debug/afterglow photo export gps-phone.jpg --format jpeg --out out-<m>.jpg --json '{"metadata":"<m>"}' for all, noLocation and none, each output read back with ImageIO | source: GPS 48.858055,2.294445, Make Generic, Model Phone One, Copyright (c) 2026 Test Owner, DateTimeOriginal 2026:10:01 12:34:56, serial SN-0042-BODY, Orientation 6. all: every one kept, Orientation 1, ok, exit 0. noLocation: no GPS and no serial, the rest kept, Orientation 1. none: none of them. With "pixels":[16,16] the 16x16 output keeps them too | CLI output; "✔ Suite PhotoHeadlessMetadataTests passed after 0.210 seconds" (5 tests)

Not fixed in this pass

• Slow real-size export (bugs 6 and 11). A release profile of the 4032x3024 scale-2 PNG (8064x6048) puts most of the time in core's PNG.write: 7.8 s for its single-threaded Deflate at level 1, against 2.4 s for the Lanczos resample, on a loaded Mac. A Photo Model can't call Darwin's zlib, because Models stay Linux-safe, and a deflate written in the app would copy engine work. So this case waits on perf(png): level-6 DEFLATE encode of 12 MP within its 2.5 s release budget creative-core#728 and a core bump. PhotoBudgetTests/realSizeExport (gated in release; the scale-2 PNG case has a 6 s budget) fails until then (13.1 s at release). The JPEG cases pass in release: 6000x4000 at 1x 1887 ms (3 s budget), long edge 2048 914 ms, 4:5 crop 526 ms, 4032x3024 at 1080x810 570 ms (1.5 s each). The audit's 6.87 s and 2.4 s were debug-build numbers. The 6000x4000 scale-2 case (53 s) shares the Deflate cost. Profile and details are on Photo export of a 24 MP image takes 5 to 53 s (scale 2 worst) #5976.
• HEIC and TIFF in Photo (bugs 5 and 10). These fall outside the beta-cut reasons (Export on a refused size, metadata, schema-path refusals, slow scale 2). They move to the issue's ## After beta section. Photo's sheet already lists only the formats it writes (PhotoExportSheetAdapter.formats).

Snapshots

suiteui-export-pack-refused-light.png and suiteui-export-pack-refused-dark.png: Export is now disabled, next to the refused readout. The other export-pack states are unchanged.

Notes

• Apple APIs: none new. .disabled and .help are already used on this button.
• Render budget (RenderBudgetExportPackTests): not re-timed in this pass, because the gate had no slot. This change adds one readout per render, the same work the Size row already does.
• Journeys: on 11-02 (FINISHER_JOURNEYS=1) only the export-metadata journey ran, narrowed to its class and run from a /tmp worktree. See the bug 2 proof line.
• Release budgets: PhotoBudgetTests/realSizeExport runs in a scratch release worktree (swift test -c release). The JPEG cases pass. The scale-2 PNG case fails at 13.1 s against 6 s, waiting on core (above).
• Earlier resumes (10-31 to 11-01): runs 1 to 11 of scripts/ci --changed passed every lint, the build and every suite this branch owns. Each printed CI: FAIL only on known flakes outside this branch: test(library): metadataPickInTwoBodies reads a nil LibraryShell.read in heavy runs #6123, FlareLayersFilesBudgetTests p95 fails under the parallel FlareModel run #6078, SegmentedTabsTests fade-length check fails under parallel load #6145, and HaloMovieWriterTests and Photo place decodes hitting their limits under load.
• 11-01 second resume: bug 7 is fixed through SuiteImaging's new JPEGMetadata (above), so Photo export drops all source metadata (GPS, Make, DateTimeOriginal) #5975's Package.swift change isn't needed for JPEG. Dev was merged in at 28e3c9a.
• scripts/ci --changed on 4756f0f (run 12, 11-01): every lint, the C4 ownership check, the mutation anchors, the build and every changed-scope suite passed (AfterGlowCLI, Design, Flare, Halo, Library, Photo, SuiteImaging, SuiteKernel, SuiteUI and the snapshots, 480 s). It printed CI: FAIL on one heavy test outside this branch: test(library): metadataPickInTwoBodies reads a nil LibraryShell.read in heavy runs #6123's RenderBudgetLibraryExportPackTests/metadataPickInTwoBodies ("LibraryShell.read?()"), the same order-dependent flake as runs 4, 7 and 8. There's still no literal CI: PASS, so the PR stays a draft.
• scripts/ci --changed run 13 (11-01, same head 4756f0f, dev unchanged): every lint, the build and every changed-scope suite passed again. Only RenderBudgetLibraryExportPackTests/metadataPickInTwoBodies (test(library): metadataPickInTwoBodies reads a nil LibraryShell.read in heavy runs #6123, "LibraryShell.read?()") failed in the heavy batch (226 tests, 2577 s). That makes three runs in a row that fail only on this flake. Still no literal CI: PASS, so the PR stays a draft.
• scripts/ci --changed run 14 (11-01, same head 4756f0f, dev unchanged at 5864f15): every lint, the build and every changed-scope suite passed. The heavy batch (226 tests, 3329 s) failed on two tests outside this branch: HaloMovieWriterTests/keyedRendersAsATwoSecondMovieMatchingFrameZero hit its 600 s limit (850 s under load), and RenderBudgetLibraryExportPackTests/metadataPickInTwoBodies failed (test(library): metadataPickInTwoBodies reads a nil LibraryShell.read in heavy runs #6123). Rerun alone through the gate, both pass (242 s and 6 s). creative-core#728 is still open, so the two slow-export boxes stay unticked. Still no literal CI: PASS, so the PR stays a draft.
• scripts/ci --changed run 15 (11-01, same head 4756f0f, dev unchanged at 5864f15, core#728 still open): every lint, the build and the changed-scope suites passed. In the heavy batch, two tests outside this branch hit their 600 s limit under load from the other lanes: HaloMovieWriterTests/keyedRendersAsATwoSecondMovieMatchingFrameZero (800 s) and GestureContractTests/photo(_:) with .remove (1652 s for the 18 cases). Once the result was a certain CI: FAIL, I stopped the run to free the shared gate. Still no literal CI: PASS, so the PR stays a draft.
• scripts/ci --changed run 16 (11-01, same head 4756f0f, dev unchanged at 5864f15, core#728 still open): every lint, the build and every changed-scope suite passed. The heavy batch (226 tests, 3528 s) failed on the same two tests outside this branch as run 14: HaloMovieWriterTests/keyedRendersAsATwoSecondMovieMatchingFrameZero hit its 600 s limit (910 s under load), and RenderBudgetLibraryExportPackTests/metadataPickInTwoBodies failed (test(library): metadataPickInTwoBodies reads a nil LibraryShell.read in heavy runs #6123, "LibraryShell.read?()"). Still no literal CI: PASS, so the PR stays a draft.
• scripts/ci --changed run 17 (11-01, head 9d6c9f8, dev 7346d79 merged in, core#728 still open): every lint, the build and every changed-scope suite passed. The heavy batch (3254 s) failed on one test outside this branch, RenderBudgetLibraryExportPackTests/metadataPickInTwoBodies (test(library): metadataPickInTwoBodies reads a nil LibraryShell.read in heavy runs #6123, "LibraryShell.read?()"). test(library): metadataPickInTwoBodies reads a nil LibraryShell.read in heavy runs #6123 also fails on a Photo branch, and the re-enabled Library metadata tests here open no window, so this branch doesn't cause it. Still no literal CI: PASS, so the PR stays a draft.
• scripts/ci --changed run 18 (11-01, head ee56f92, dev 2302a8e merged in, core#728 still open): dev's fix(suite): mac finish pass, the welcome tour ships real-size samples and a default Continue #5973 remade Sunset.png at 1600 x 1067, and that clashed with this branch's level-1 copy. I resolved it by rebuilding both copies with MAKE_SAMPLES=1 swift test --filter SampleMakerTests on the merged tree (committedSamplesMatchTheirMakeFiles passes). Every lint, the build and every changed-scope suite passed. The heavy batch (225 tests, 2780 s) failed on one test outside this branch, RenderBudgetLibraryExportPackTests/metadataPickInTwoBodies (test(library): metadataPickInTwoBodies reads a nil LibraryShell.read in heavy runs #6123, "LibraryShell.read?()"). Still no literal CI: PASS, so the PR stays a draft.
• 11-02 resumes (head ee56f92, dev 2302a8e unchanged since 11-01, checked on every resume): no new code. perf(png): level-6 DEFLATE encode of 12 MP within its 2.5 s release budget creative-core#728 and Suite SC-1c: round-trip, colour, asset, link and clipboard values #822 are still open, and so are test(library): metadataPickInTwoBodies reads a nil LibraryShell.read in heavy runs #6123 and its fix fix(suite): mac finish pass, the welcome's Library sample lands in the catalog #6178. Run 18's result on this exact head still stands, so the gate wasn't rerun and the PR stays a draft. The third 11-02 resume added the in-app journey proof for bug 2 and no code. The fourth 11-02 resume found dev, core#728, core#822, test(library): metadataPickInTwoBodies reads a nil LibraryShell.read in heavy runs #6123 and fix(suite): mac finish pass, the welcome's Library sample lands in the catalog #6178 all unchanged, and added nothing. The fifth 11-02 resume found the same, and added nothing.
• Supersedes: none. fix(suiteui): mac finish pass, apps use the kernel's easing directly and key picks refuse in a sentence #5874, the other open suiteui finish PR, shares no files with this one.