# Karuiya 0.9.1 RC (Build codex43-rc2)

## Codex-43 RC2 endpoint-security cache hardening

- Keeps preview pixels, JPEG/PNG encoding, asynchronous QML loading, LRU
  limits and disk-cache behavior unchanged, while giving disposable internal
  images the Karuiya-only `.karcache` suffix.
- Makes FFmpeg's existing MJPEG/image2 output explicit so thumbnails and
  paused-preview stills remain byte-compatible without relying on a filename
  extension.
- Reuses immutable per-export shape assets instead of repeatedly rewriting the
  same PNG payload during chunk planning.
- Does not change user-saved PNG/JPEG files, Player/QML lifecycle, Undo/Redo,
  project format 25, edit results, export codecs, A/V synchronization or UI.

This RC addresses Apex One Behavior Monitoring false positives that terminated
the process while it created and retired bursts of internal `.jpg` cache
files. Endpoint behavior must still be confirmed on the target Apex One PC
before publication.

# Karuiya 0.9.1 RC (Build codex43-rc1)

## Codex-43 RC1 public-package license alignment

- Removes the unused Qt Virtual Keyboard runtime and plugin from the Windows
  onedir package.
- Removes the unused Qt PDF runtime and image-format plugin. Karuiya does not
  provide a PDF import or preview feature.
- Adds fail-closed build and release checks for all four forbidden runtime
  paths, so a later PyInstaller or PySide6 collection change cannot silently
  reintroduce them.
- Aligns the public version, update serial, third-party inventory, notices,
  source-companion references, usage terms and privacy description with the
  actual 0.9.1 package.
- Keeps the external LGPL FFmpeg and ffprobe binaries byte-identical to 0.9.0.
- Does not change Player/QML lifecycle, Undo/Redo, cut boundaries, project
  format 25, editing results, export commands, A/V synchronization or the
  accepted UI theme.

Codex-43 RC1 is a release candidate until the clean onedir, corresponding
source companion, checksums and Windows acceptance checklist have all passed.
See `CODEX_43_WINDOWS_ACCEPTANCE_CHECKLIST.md`.

# Karuiya 0.9.0 RC (Build codex41-rc1)

## Codex-41 RC1 non-blocking runtime cache cleanup

- Moves completed-export/current-frame temporary-tree deletion and paused-
  still/timeline-thumbnail/Quick-Canvas image eviction off the Qt GUI thread
  onto one bounded daemon worker.
- Drops every in-memory cache/export reference before physical deletion, so a
  delayed antivirus or file-handle operation cannot block the next export.
- Uses unique paths, in-memory enqueue validation, worker-side owner-marker
  revalidation and queue deduplication. A full or
  failed queue never falls back to synchronous GUI deletion; the existing
  launcher supervisor remains the authoritative post-process cleanup path.
- Leaves abandoned adaptive-split planning files inside their registered export
  tree for final collection, avoiding a new delayed-delete/reuse race.
- Keeps Player/QML lifecycle, Undo/Redo, editing behavior, export commands,
  accepted UI theme, public version 0.9.0, update serial 50 and project format
  25 unchanged.

## Codex-40 RC1 flat workspace seam restoration

- Restores the Codex-36/37/38 flat panel, inspector and timeline surfaces by
  removing Codex-39's experimental outlines.
- Keeps one subtle divider below the project/export header and removes the
  responsive 3-4 px gap that previously disconnected it from the workspace.
- Draws only the center pixel of each 7/9 px splitter handle, preserving its
  full drag target while forming a clean T-junction between preview and tools.
- Keeps Codex-39's bounded post-GUI cache cleanup, exit-code classification,
  Player/QML lifecycle, history, project format and export behavior unchanged.

## Codex-39 RC1 shutdown and visual-separation hardening

- Removes recursive cache deletion and per-image unlink operations from the Qt
  GUI shutdown path. The launcher now performs bounded cleanup only after the
  GUI child has exited.
- Moves transient Quick Canvas and paused-frame images to the writable user
  cache under LocalAppData instead of the onedir application folder.
- Registers active export temporary directories for the same post-child cleanup
  path, so closing during an export cannot block the GUI on chunk deletion.
- Records the 18-second emergency shutdown as exit code 124 instead of a false
  successful exit code 0.
- Keeps the accepted neutral graphite palette, while adding subtle one-pixel
  separators to the workspace header, major panels, inspector groups, timeline
  controls and right-panel tabs. Player/QML rendering colors are unchanged.

## Codex-38 public release hardening

- Freezes the accepted Codex-37 RC2 editor, Player/QML lifecycle, Undo/Redo,
  project format 25 and export behavior for the first public package.
- Builds the standard Windows onedir from an exact Python 3.14.6 x64 runtime
  and a hash-locked PySide6/PyInstaller dependency set.
- Bundles only the verified external LGPL FFmpeg engine. The optional GPL
  extension, GPL FFmpeg binaries and its installer/cryptography dependency are
  disabled and excluded from version 0.9.0.
- Adds exact per-file component manifests, third-party notices, corresponding
  source evidence, Qt library replacement instructions and a fail-closed
  release verifier.
- Hardens update checking to direct HTTPS endpoints, rejects credential-bearing
  or HTTPS-to-HTTP redirected URLs, and performs no update communication while
  the official endpoint is unset.
- Keeps the eight-language runtime catalogs and user-visible behavior from
  Codex-37 RC2 unchanged.

## Codex-37 RC2 dynamic localization hardening

- Fixes untranslated runtime labels in the Razor guide, default marker names
  and audio-stream selector.
- Localizes application-generated names for new text, color-matte, shape and
  imported SRT layers, plus suggested effect/export preset names. Existing
  project names and user-authored text remain byte-for-byte unchanged.
- Fixes additional presentation-only leaks in text alignment summaries, layer
  tooltips, preview-performance diagnostics, waveform cache summaries and
  timeline fade-drag badges.
- Keeps color-matte automatic names localized after a color change without
  overwriting a name that the user customized.
- Expands the full UI gate to create real markers, streams, text, mattes,
  shapes and subtitles in every translated locale and to inspect all
  application-owned combo entries before staged shutdown.
- Keeps the Player/QML lifecycle, Undo/Redo data, cut behavior, FFmpeg export,
  project format 25 and public version 0.9.0 unchanged.

See `CODEX_37_RC2_RELEASE_NOTES.md` and `CODEX_37_RC2_TEST_REPORT.md`.

## Codex-37 RC1 eight-language user interface

- Adds complete application catalogs for English, Japanese, Simplified Chinese,
  Korean, Spanish, Brazilian Portuguese, French and German.
- Selects the Windows display language automatically on first use. Unsupported
  languages, including Traditional Chinese until a dedicated catalog exists,
  use the complete English fallback.
- Adds **View > Language** with all language names shown as endonyms. A manual
  choice is applied safely on the next launch.
- Keeps Japanese compatibility values inside existing project/settings branches
  while translating only Qt presentation roles. Project format 25, FFmpeg
  commands, decimal formatting, filenames, media paths, subtitle content and
  user preset names are unchanged.
- Includes translated Qt standard dialogs and QML canvas tooltips. Public onedir
  builds contain only compiled `.qm` assets and a checked runtime manifest; TS
  files and review catalogs are excluded.
- Uses a bounded translation cache and direct template formatting in timeline
  paint/drag paths, so localization does not add per-clip path resolution or
  unbounded memory growth.
- Keeps the Codex-28 Player/QML lifecycle, Undo/Redo implementation, cut
  boundaries, image-only sequences, export engine and all Codex-36 RC2 icons
  frozen.

See `CODEX_37_RC1_RELEASE_NOTES.md` and `CODEX_37_RC1_TEST_REPORT.md`.

## Codex-36 RC2 application and project icons

- Replaces the application and `.karprj` project artwork with the supplied
  1024x1024 transparent PNG sources.
- Provides 32-bit alpha ICO resources at 16, 20, 24, 32, 40, 48, 64, 96, 128
  and 256 pixels for Windows shell, window, taskbar and executable use.
- Refreshes the persistent project-icon cache and current launch command when
  Karuiya already owns the `.karprj` association. It never claims an extension
  currently owned by another application.
- Keeps all Codex-36 RC1 editing, image-only sequence, Player/QML, Undo/Redo,
  export and project-format behavior unchanged.

See `CODEX_36_RC2_RELEASE_NOTES.md` and `CODEX_36_RC2_TEST_REPORT.md`.

## Codex-36 RC1 image-only independent sequences

- Allows a new project to start from still images without creating or promoting
  a reference-video path. The independent sequence is initialized at 1920x1080,
  exact 30/1 fps and NDF timecode.
- Fits the first image to the whole sequence canvas while preserving aspect
  ratio. Multi-image startup imports append the images in source order as
  five-second sequence clips instead of creating overlapping overlays.
- Saves image-only projects with an empty reference-video path and defends both
  normal load and offline-placeholder restoration against treating an image as
  a video reference. Save, edit, save and a second reload remain supported.
- Keeps the established first-video initialization path, Codex-28 Player/QML
  retirement lifecycle, Undo/Redo and all MP4/MOV/MKV export commands frozen.
- Keeps project format 25 and public version 0.9.0.

See `CODEX_36_RC1_RELEASE_NOTES.md` and `CODEX_36_RC1_TEST_REPORT.md` for the
implementation boundary, automated evidence and acceptance focus.

## Codex-35 RC2 fixed-cache MOTW recovery

- Repairs `Zone.Identifier` only after the existing fixed FFmpeg cache has the
  expected complete file set and the affected artifact matches its trusted
  SHA-256. This recovers source launch when endpoint security reattaches MOTW
  to `BUNDLE_LICENSE.txt`, an executable or a DLL.
- Still rejects tampered bytes, missing or extra files, redirected paths and
  invalid metadata before FFmpeg can run. Runtime and audit-broker MOTW checks
  remain unchanged as a second validation boundary.
- Preserves the Codex-35 RC1 editing, preview, export and project-format logic.

See `CODEX_35_RC2_RELEASE_NOTES.md` and `CODEX_35_RC2_TEST_REPORT.md`.

## Codex-35 RC1 editing and export additions

- Adds an opt-in black drop shadow for visual layers. Text uses a lightweight
  glyph shadow so large SRT projects do not allocate a blur graph per subtitle;
  other visual layers use a bounded, padded blur work surface only when enabled.
- Paints a pending I/O range as soon as both points are set. Starting a new I
  selection removes the abandoned pending range, and queue registration hands
  the same blue overlay to the saved queue range.
- Renames the former canvas export choice to `シーケンスの解像度`, makes it the
  new-project default without changing the established quality defaults, and
  migrates legacy `キャンバス` values on load.
- Adds a `2160p（4K UHD）` / 3840x2160 export preset. Selecting it explicitly is
  the only time the 4K scale and capacity cost are added.
- Preserves custom odd-sized sequence geometry while editing, then pads at most
  one right/bottom pixel only for chroma-subsampled video delivery so H.264,
  ProRes and FFV1 cannot fail on an invalid output size.
- Keeps the emergency legacy software canvas effect-free. The normal Qt Quick
  preview and FFmpeg export render shadows; the fallback avoids rasterizing a
  native QGraphicsVideoItem during Player retirement.
- Keeps the Codex-34 RC6.3 Player/QML retirement barrier, project format 25 and
  MP4/MOV/MKV export corrections unchanged.

See `CODEX_35_RC1_RELEASE_NOTES.md` and `CODEX_35_RC1_TEST_REPORT.md`.

## Codex-34 RC6.3 normalized-MKV leading-audio correction

- Fixes normalized Matroska output whose first PTS-zero audio packet could be
  written after several seconds of copied video packets while `dynaudnorm`
  filled its initial lookahead window.
- Adds `-max_interleave_delta 0` only to the normalized MKV final concat, so
  the muxer waits for both streams before writing the leading packets.
- Preserves copied video packets and decoded audio samples byte-for-byte.
- Does not change MP4, MOV, unnormalized MKV, intermediate chunks, single-pass
  export, Player/QML, editing behavior or project format 25.

See `CODEX_34_RC6_3_RELEASE_NOTES.md` and
`CODEX_34_RC6_3_TEST_REPORT.md`.

## Codex-34 RC6.2 lossless-MKV silence correction

- Fixes an FFmpeg format negotiation difference between ordinary FLAC chunks
  (`s32`, 24-bit) and chunks containing only generated silence (`s16`, 16-bit).
- Pins only the lossless MKV profile to `-sample_fmt s32`, preserving the
  existing 24-bit audio quality and making every chunk's Matroska CodecPrivate
  contract identical.
- Retains the fail-closed chunk compatibility check; no mismatch is ignored.
- Keeps the RC6 MP4 exact-audio fix and the RC6 MOV BT.709 declarations.  MOV
  pixels are not converted, and the explicit declarations are more portable
  than the untagged RC5 output.
- Does not change Player/QML, editing, project format, MP4 or MOV commands.

## Codex-34 RC6.1 source-launcher correction

- Replaces the quoted `%~dp0` directory argument whose trailing backslash made
  Windows append a literal quote to the source root during fixed-cache setup.
- Passes the lexical source root as `%~dp0.` in both `run.bat` and
  `build_exe.bat`, preserving the cache preparer's reparse-point inspection
  without placing a backslash immediately before the closing quote.
- Adds a real `cmd.exe` regression using a path with spaces and Japanese
  characters.  Static BAT inspection alone is no longer the release gate.
- Keeps every RC6 MP4, MOV, MKV, Player/QML, editing and project-format change
  exactly as implemented in RC6.

## Codex-34 RC6 long-export format correction

- Keeps the RC5 MP4/H.264 video chunks unchanged, while creating one exact
  48 kHz FLAC audio sidecar per chunk.  Final MP4 joins those sidecars and
  encodes AAC once, eliminating cumulative 1024-sample AAC tail padding.
- Declares limited-range BT.709 color characteristics after the final pixel
  format stage.  ProRes MOV now matches the preview interpretation without a
  pixel-value conversion or measurable render cost.
- Ignores inherited `major_brand` tags for Matroska compatibility checks while
  retaining strict brand checks for ISO-BMFF outputs such as MP4 and MOV.
- Removes inherited source metadata from chunk and final outputs, preventing
  harmless input tags from changing across a large chunk set.
- Reserves worst-case FLAC sidecar space in MP4 long-export disk preflight.
- Uses a validated, content-addressed LGPL FFmpeg cache for source development
  and build checks.  RC folder changes no longer create a new executable path;
  frozen releases continue to use only their bundled engine.
- Keeps the RC5 video path, encoder selection, Player/QML lifetime management,
  Undo/Redo, project format 25 and existing editing results unchanged.

See `CODEX_34_RC6_RELEASE_NOTES.md` and `CODEX_34_RC6_TEST_REPORT.md`.

## Codex-34 RC5 multi-segment export content correction

- Fixes completed chunk files whose timestamps, frame counts and decode checks
  were valid but whose video content held one frame after an internal segment
  boundary while audio continued.
- Replaces unbounded FFmpeg `overlay` EOF retention with `eof_action=pass` and
  `repeatlast=0`.
- Pads each finite video layer explicitly before its time-dependent effects,
  then trims it to the current composition segment.  This preserves the final
  boundary frame without allowing retention to cross into the next segment.
- Extends the bundled-FFmpeg regression fixture from two to four consecutive
  video segments and checks their decoded colors, so a third-segment content
  freeze cannot pass on frame count or duration alone.
- Adds `tpad` to the audited LGPL/GPL common-filter requirement.  The bundled
  LGPL FFmpeg already provides and passes this filter.
- Keeps RC4's independent video/audio concat, final stream-copy video path, AAC
  timing rebuild, encoder policy, Player/QML lifecycle, project format 25 and
  all editing results unchanged.

See `CODEX_34_RC5_RELEASE_NOTES.md` and `CODEX_34_RC5_TEST_REPORT.md`.

## Codex-34 RC4 A/V concat deadlock correction

- Separates every multi-segment video concat from its matching audio concat.
- Removes the cross-stream segment-boundary wait that kept FFmpeg alive with several gigabytes of decoder/filter state.
- Preserves the existing exact segment durations, 30000/1001 frame rate, AAC timing rebuild, output encoder selection, hardware-decode policy and 149-stage large-project plan.
- The logged 26.727-second/28-input stage now completes with both `h264_mf` and `libopenh264`: 801 video frames, 26.726700 seconds of video and 26.727000 seconds of audio.
- Keeps Codex-28 Player/QML lifetime management, preview, Undo/Redo, relink, editing results and project format 25 unchanged.

See `CODEX_34_RC4_RELEASE_NOTES.md` and `CODEX_34_RC4_TEST_REPORT.md` for the diagnosis and verification record.

## Codex-34 RC3 export runtime stabilization

- Bounded one FFmpeg render stage to a target of 35 media inputs independently of the Windows command-line limit.
- Disabled per-input hardware decoding above 12 inputs while preserving the selected output encoder, including short non-chunked jobs and a measured-input rebuild guard.
- Added a 240-second post-start progress-stall watchdog with bounded hardware-to-software fallback and one software retry.
- Restored the exact selected frame rate after concat/xfade and now rejects mismatched completed output.
- Holds a video layer's final frame only to the enclosing composition-segment boundary, preventing one-layer transparent flashes.
- Disabled negative-timestamp shifting for intermediate chunks, then rebuilds AAC sample PTS once during final MP4 concatenation while keeping video stream-copied.
- Limits final MP4 audio to the planned duration, preventing repeated AAC priming/padding and non-monotonic DTS at chunk boundaries; MOV/PCM and MKV/FLAC remain full stream-copy.
- Kept Codex-28 Player/QML lifetime management, Undo/Redo, project format 25 and existing editing results frozen.

See `CODEX_34_RC3_RELEASE_NOTES.md` and `CODEX_34_RC3_TEST_REPORT.md` for the focused diagnosis and verification record.

## Codex-34 RC2 large-project export stabilization

- Windowsで3,000クリップ級の書き出しコマンドが上限へ達する前に、編集結果を保った安全な範囲へ自動分割します。
- コマンド長はUnicodeを含む実際のCreateProcessWと同じUTF-16単位で測定し、24,000単位を目標、30,000単位を安全停止上限とします。
- トランジションのカット位置や必要な前後余白では分割せず、分割前後の期待尺が一致することも確認します。
- 素材の存在確認と絶対パス解決をクリップ単位ではなくユニーク素材単位で行い、大規模プロジェクトの書き出し準備停止を抑えます。
- MP4／MOV／MKVの各チャンクは最終連結前にffprobeで互換性と映像・音声の長さを検査し、不一致時は連結を開始しません。
- Codex-28由来のPlayer／QML寿命管理、Undo／Redo、プレビュー再生、プロジェクト形式25は変更していません。

## Codex-34 RC1 fixed ExportProfile hardening

- Added fixed, auditable profiles for H.264/AAC MP4, ProRes 422 LT/422/HQ with PCM MOV, and FFV1/FLAC MKV.
- Added optional GPL-only CPU H.264/libx264 and CPU HEVC/libx265 MP4 profiles. The standard package still contains no GPL engine.
- Output extension, muxer, video/audio codec, pixel format, faststart, chunk files, final concatenation, validation and storage estimates now follow the selected profile.
- Completed outputs are checked with ffprobe for the expected container, codecs and pixel format before the existing full video/audio decode validation.
- Dense jobs are automatically chunked at no more than 500 estimated composition segments, with a lower adaptive limit when color/blur filters raise native-memory cost; MOV and MKV use their own chunk formats.
- A non-chunked standard MP4 job in automatic mode can retry once with the next smoke-proven H.264 encoder on the same audited engine. Fixed HEVC/ProRes/FFV1 profiles never change codecs implicitly.
- The normal export dialog remains limited to progress, one current-process message, elapsed time and destination. Full commands and stderr remain in the session log.
- Codex-28 Player/QML lifetime management, Undo/Redo, cut-boundary behavior and project format 25 remain frozen.

## Inherited Codex-33 RC2 preview handoff correction

- An asynchronous thumbnail or paused-still fallback now replaces the live VideoOutput only after the QML Image reports `Image.Ready`.
- The correction adds no decoder, Player, timer, cache, or texture allocation. Codex-28 Player/QML lifetime management remains frozen.
- A brief blank during an arbitrary cold seek on an already loaded Player remains a known issue; changing that path requires a separate performance and lifetime review.

状態: 公開ハードニング作業中。対応FFmpegソース、第三者台帳の実物照合、署名済みGPL配布、
clean onedir、Windows実機耐久試験が完了するまで公開不可。

## 公開版ハードニング

- 公開バージョン、内部ビルドID、更新番号、プロジェクト形式を単一定義へ統合
- PyInstaller 6.21.0のonedir構成へ移行し、Qt共有ライブラリを`_internal`へ分離
- Qt Multimediaのプレビュー用バックエンドと、外部FFmpeg CLIの責務を分離
- 公開版に必要な第三者通知、Qt差し替え手順、コンポーネント台帳を追加
- 更新URL未設定時の自動確認を無効化
- 配布前にLGPL構成、ライセンス資料、ハッシュを検査するリリースゲートを追加
- オフライン素材の自動誤照合を拒否し、手動再リンク時は既知メタデータ差を確認
- 書き出し通常画面を進捗と現在処理へ簡素化し、完全な診断をセッション別ログへ保存
- 完成ファイルの全映像・全音声decode検査を追加
- 標準LGPL engineと利用者選択GPL engineを別folder・別hash trustへ分離
- GPL engineの自動導入を禁止し、署名済みmanifest検証に成功した場合だけ追加可能化
- FFmpeg hardware監査を終了可能なJob Object境界へ移し、`Karuiya.exe`のQt読込前
  内部モードへself-host（別broker EXEと重複Python runtimeは非同梱）
- 色調補正を両engine共通の`lutyuv`＋`colorchannelmixer`へ移行
- 背景ぼかしを両engine共通の`gblur`へ移行し、旧2パスぼかしの分散から互換sigmaを算出
- `lutyuv`の色差中立値・bit depth・alpha保持を補正し、背景ぼかしの内部解像度を強度別に適応
- 大量の共通filter nodeがOSハングを起こす前に、推定メモリ512 MiBで警告、1 GiB超で安全停止
- 現RCのGPL拡張はCPU H.264、CPU HEVCと`perspective`を利用者向け対象とする
- GPLなしの新規プロジェクトでは4点変形とCPU H.264／HEVCを非表示、既存設定は読み取り専用で保持

## 変更していない領域

Codex-28由来のPlayer/QML寿命管理、Undo/Redo、カット境界、保存形式、
プロジェクト形式25および既存編集結果には変更を加えていません。

固定ExportProfileと構成区間数に応じたチャンク化は書き出し領域だけへ追加しました。
正式採用には、各形式のWindows実プロジェクト長尺試験とGPL拡張の署名済み導入試験が必要です。
