Grid Changelog

Release history is tracked here beginning with 0.66.4. Earlier capabilities remain discoverable through featured guides.

Grid 0.76.0 — Upcoming (not released)

Summary

This draft covers recorded Media playback in the proposed authoring release. Other programs will add their changes as their scope settles.

What's New

Embedders can run full pure Core in a browser, load its source compiler separately, and retain model state across input edits. Worker cancellation and failure recovery are explicit, and native services remain outside the browser package. These are private local embedding packages. Core browser API

Saving recorded process traces avoids repeated serialization and a second full result buffer for hashing. Reading and importing original results retain their digest and byte-limit checks. Original monitor analysis now accepts native callable identities, and labels process-trace coverage separately from temporal monitor coverage. Recorded process results

An authored BPMN process can reserve two resources and compensate their completed effects in reverse completion order. Separate durable activity receipts share one native process marking, with original-receipt recovery, confirmed inverse effects and scope cancellation. Authored compensation

A decision-approved service effect can now wait for payment and compensate the original reservation on timeout. Reopening retains the deadline and both effect identities, and completion requires the withdrawal consumer’s confirmation. Payment and compensation

A native BPMN process can wait for a correlated payment or follow its interrupting timer to a different end event. Restart preserves the original deadline and the winning receipt. Payment workflow

Edit a BPMN task name, move a diagram shape or bind a flow to a different message and save the revised XML with its original extension markup. BPMN model editing

Import a set of related DMN models and call its decisions and services through native LIR. For example, a loan portfolio can pass each structured loan to a payment decision and return its exact monthly payment. The importer binds structured inputs, business knowledge models and service arguments by their authored names. Linked DMN models

Call an imported DMN invoice service with a price to receive its structured quote. The subtotal and discount decisions are evaluated inside the named call. Decision service

A DMN invoice can now return a structured quote with subtotal, discount and amount due. Values remain individually accessible after saving and reopening the compiled model. Boxed invoice quote

An invoice can pass its exact subtotal into a DMN UNIQUE discount table and use the selected discount in its final amount. The table report retains the matched rule identities, including overlaps. Discount invoice

DMN 1.6 decisions can share a 34-digit decimal subtotal, compare it against an exact threshold and return a nullable release decision. Invoice workflow

DMN tables can now return ordered lists of matching rules, select a declared output priority, or aggregate bounded integer outputs. Native BPMN workflows can retain supplied diagram geometry and enter and leave an embedded subprocess. For an authorized event task, select a single consumer to make its Boolean result the durable completion condition. See DMN decisions, BPMN workflows and consumer completion.

Native hosts can bind one BPMN task to an authorized service query. Retain its result, retry a known failure up to a fixed bound, cancel pending work, and recover the original attempt after restart without resending uncertain work. The same native API can post one authorized durable event-channel request, recover a lost receipt without reposting, and retain committed effects through cancellation. Retry requires proof of no effect. It reuses PROCESS and LIR; automatic service scheduling remains separate. See service tasks.

Connect a supplied DMN policy to a bounded BPMN process. Freeze an order's inputs and decision report, route it to fulfillment or review, and explain, complete, cancel or reopen the native instance. Policy edits create a new definition; existing instances retain their original policy. See decision routing.

GEDCOM graphs now include family links recorded on births, christenings and child-sealing ordinances. Each edge identifies the event that asserted it. GEDCOM graph import

Humdrum scores and rhythm spines can now express tuplets such as 3%2, longs and maximas. Grid retains their exact duration in whole notes. Humdrum import

MATH_BRAILLE can transcribe a standalone matrix to aligned six-dot Nemeth rows with the new nemeth-spatial profile. Mathematical braille

CIF validation can apply a static default once per observed row. An omitted value can therefore participate in parent and key checks, while an explicitly unknown value stays unknown. Static defaults

CIF dictionaries can provide an indexed default for an omitted item. Grid uses authored selector values to find the default and checks it against other data in the same scope. Indexed defaults

CIF dictionary validation checks a declared enumeration default against the item’s type, shape, and allowed states. The editor can insert a state from the same definition. Static DDLm defaults

Native-only literal compilation leaves the parser package registry idle. Rust embedders can cancel a native expansion through its module resolver. Native reader guide

GEDCOM imports retain unresolved family links when more than 64 warnings arise. The importer preserves original pointer locations in CR, LF and CRLF files and exposes the ordered text passages in a source citation. GEDCOM result fields

Follow IndoorGML state and OpenDRIVE road or junction references in the editor. IndoorGML preserves endpoints under an external base as unresolved, and OpenDRIVE keeps vendor metadata out of topology tables. Navigation XML

Grid offers field completion inside OSRM and Valhalla route responses. A Valhalla trip offers distance units, while an OSRM maneuver offers bearings and location. Navigation interchange

Import Benesh VBD key poses with benesh or PARSE_BENESH in Standard/Lite and Pro. Inspect the orientation of a named body part or the written stave coordinates of a hand or foot. The editor offers directions appropriate to each orientation axis. Supported pose syntax

Ahnentafel imports now expose ancestry-slot graphs and numbering hover, preserving isolated positions and missing links. Repeated names remain separate slots; no person identity or biological parentage is inferred. See the Ahnentafel profile.

Morse imports gain selected procedure signs, explicit ambiguous meanings and nominal mark/gap timing data. Symbol completion and hover explain the authored sequence without transmitting audio or executing procedures. See the Morse profile.

Import a bounded BPMN fulfillment process as a native token workflow. Begin and complete tasks explicitly, synchronize parallel branches, inspect blocked joins, and cancel or resume a saved instance. Source-linked reports retain the supplied XML identities; no task service or scheduler starts implicitly. See BPMN workflows.

UML XMI imports gain selected class and interaction tables, preserving authored attributes, message endpoints and unresolved links. Local identity completion, definition lookup and hover help navigate the source. This descriptive profile does not execute behavior, retrieve external models or certify UML/SysML conformance. See the XMI profile.

Open-PSA imports now retain scoped parameters and expressions, common-cause groups, substitutions, event trees, consequences and mission phases as native data. Inspect inherited metadata with its source owners, and import supplied products, statistical measures and curves without recomputing them. The editor adds scoped references, completion and contextual help. These descriptive imports do not execute model instructions or certify reported results. See the supported Open-PSA profiles.

Import a bounded DMN 1.5 pricing or eligibility table into native DECISION, compare scenarios and trace selected rows back to the supplied XML. The closed FEEL profile preserves exact integer, string and Boolean tests, explicit missing results, and saved-source/LIR replay. See DMN decisions.

Compare native decision policies directly in studies. DECISION calls and their reports now run as isolated EVALUATE targets, preserving hit policies and explicit conflict/no-match results. The shipping example retains selected rule labels alongside prices. See policy comparisons.

Discrete control models now compose in series, parallel and negative feedback, with explicit sample periods and initial states. Compare step or impulse responses, inspect numerical stability, and reproduce controller edits after reopen. The bounded SISO workflow preserves existing state-space simulator behavior. See discrete controls.

Native molecular queries and graph transformations

Write bounded molecular patterns with MOL_MATCH and mapped graph edits with MOL_TRANSFORM. Inspect source-linked atom mappings and typed products, reuse products in native molecular calculations, and reproduce results after input edits and reopen. The explicit-bond profile reuses the molecular engine; unsupported stereochemical, recursive and aromatic-transform semantics refuse.

Native SBML kinetic workflows

An explicit native importer now turns a bounded SBML Level 3 Version 2 Core model into ordinary REACTIONS source. It preserves constant compartment volumes, amount/concentration binding, fixed species and kinetic parameter scopes, and refuses unsupported features. Existing trajectory, numerical fit, calibration request, parameter-edit and saved-LIR paths operate on the imported model. See the contract and transfer example.

Native variational Poisson problems

Canonical model JSON can now declare a scalar P1 function space, trial/test integrals, coefficients and marked boundaries. The bounded dimensionless profile uses the existing FEM solver, producing potential, flux, reactions and residual reports. Boundary edits reuse native preparation; saved LIR retains the lowered problem for reproducible reopen. Unsupported forms and singular components refuse at admission. See the contract and complete example.

After you stop a native Media session, choose Open recording. The player opens paused so you can play the file, jump to a point on the timeline, or replay it from the beginning.

Reuse CAD descriptions

Experimental CAD blocks describe unit-checked rectangles, circles, slots, datums, profiles and extruded bodies through the existing description constructors. Local mounting-plate and enclosure libraries show reusable definitions and checked component placement. Explicit composition admission connects the enclosure to three native bodies, measurements and per-body STEP. Length INPUT edits accept compatible quantities while preserving the source's unit: entering 12.6cm for a millimetre input writes 126mm. Source edits use ordinary save and undo/redo. Retained case studies preserve typed measurements, publish through the existing artifact owner and support atomic adoption of an eligible case. The edited enclosure, retained cases and published artifacts reopen together after a process restart.

Finite discrete posterior inference

Define a small fault-and-sensor model and use DISCRETE_POSTERIOR to update its probabilities from observations. Reports retain the model, evidence and requested marginals; changes to inputs recompute through native execution, and saved LIR reproduces the workflow without debug data. Explicit bounds and impossible-evidence outcomes keep incomplete or invalid requests from appearing as posterior answers. This first profile supports finite observational conditioning, not causal counterfactuals or general probabilistic-language import.

Improvements

Server and Desktop now share model-session operations for reads, edits, tracing and reopening saved models. Runtime values and results use reusable Rust libraries, while HTTP AI adapters and disk-backed raster caching belong to the host. Shared compiler-cache files also use a host-owned storage adapter. The broader engine/domain extraction remains in progress. Industrial protocol and telemetry-ingress logic now has an independent reusable library. Native Geo formula implementations and resident kernels have dedicated libraries with compatible runtime imports. Rust embedders can omit the Geo formula provider with a Cargo feature. The reduced build names the missing domain on a Geo formula call. A second feature selects the Finance, Civic and industry formula providers. A reduced native engine can also omit bundled PROJ or select it independently for coordinate transformations. Server, Desktop and CLI retain the native providers. The native-cad feature lets embedders omit the entire CAD and Sketch library, including the resident model owner and STEP support. The native-games feature independently selects Games formulas and resident graph analysis. Music, Drawing and Image workbook functions can also be selected together with media-formulas. The native-life-sciences feature selects Bio and Molecular from compiler promotion through native execution. CAD and Games formula adapters, Music execution, computed drawings, Image formulas and Bio/Molecular formulas and region kernels also have reusable library owners. The compiler and Music execution share one lightweight notation parser; existing formulas and saved score formats are unchanged. Physics and discrete-control formulas also use shared library bindings. Finite-element region records and numeric execution share a FEM library; native admission and saved-model behavior remain unchanged. All 155 financial extensions, including exact curve construction, portfolio risk, attribution and option pricing, now share a reusable Finance library, preserving the existing numeric contracts and repricing reports. Excel-exact financial functions and the native quadratic-program solver retain their Core owners. Construction, real-estate, industry and professional metrics also use a reusable Operations library. Signal plan metadata and admission share the lightweight Signal contract library; DSP execution and output scheduling retain their existing owners. Bio, Molecular, Signal, Render, FEM and Operations structural validators also live with their domain libraries, while native admission and cancellation remain enforced by GIR. Thirteen of those validators now register from their domain libraries, preserving the mandatory native ownership checks and existing diagnostics. Eleven native validator adapters also use immutable typed registrations, retaining the original model storage and mandatory native checks. Planning schedules and controlled replacement repair also share the Operations library, preserving selected objectives and native commit authority. Render timing plans have a lightweight contract library. The scheduler now has one implementation shared by Runtime Core and Host, with device output services selected separately and existing deadlines and missed-frame behavior preserved. Simulation trajectory records also have a lightweight contract library, allowing Render validation to reuse them independently of Simulation execution. Signal and Operations now own their saved-model header layouts. The reader and writer use the same field order for both directions. Simulation structural checks now belong to its domain library, while the native adapter preserves operator limits and authored-callback admission. Media plan and callback-shape checks also share a portable library, preserving native source ownership and the existing image execution path. The Operations library executes Planning, routing, supply-chain, network-flow, packing, risk, inference and financial-replay regions and produces their typed results. Host and Desktop keep their existing response formats. Civic, statistical inference and time-series formulas register from their Civic library; native model fitting and prediction keep their original admission and execution services.

The Core source also includes explicit private-file licensed Source, Stream and LiveTable editing through the original Library operation, Source owner and table catalog. It retains predecessor receipts and refuses unread or unfinished original work. Compilation and installed recovery validation remain pending; this is a source checkpoint.

The Core source adds explicit migration of already captured ONCE values during a Library edit. The same original replacement operation freezes the retained value, without rerunning its formula or effect. Broader live-state migration and fresh effectful capture remain open; compilation and recovery validation are unrun.

The Core source adds retained retirement for an ordinary Source10 model and accounts existing files in its admitted model home. Original Source history, receipts and storage charges remain intact. Other Source profiles and compilation/lifecycle validation remain open.

The Core source extends retained retirement to recovered mapped Source roots. The original native owner stores the terminal fence and file debt while keeping the original Source certificate, history and receipts. Source12/13 adoption and physical purge remain open; compilation and lifecycle validation are unrun.

The Core source adds local persistent-worker controller handoff by moving the actual Host and worker custody. Receivers and unfinished calls keep their original Jobs operations and receipts, while stale dispatchers are fenced. Compilation and lifecycle validation remain unrun.

The Core source now connects restored initial-root observation to original retained output. A model with no committed output reports that explicitly. The reader does not execute formulas or consume grant units. Compilation and lifecycle checks remain unrun.

The Core source also connects selected enterprise grant operations to native session, model permission, source review, disclosure and original outcome audit owners. Recovery retains the original operations and receipts. Compilation and installed lifecycle/crash validation remain pending.

The Core source now includes an opt-in persistent Native Library profile that binds model, worker and grant ownership, retains original operations and receipts, and fences disposal obligations. Installed lifecycle and crash-recovery validation remains incomplete.

Replaying a recording uses the original recorded content and timestamps. It does not rerun the model's analysis or capture more frames.

Selected native Backbone authority integrations can prepare bounded peer snapshots and retire covered replication prefixes while preserving original receipts. This capability is off by default; full realtime coexistence assessment remains in progress.

Optional local Backbone diagnostics account for TLS stream traffic in both directions, including replies and retries. They remain separate from timing observation and do not change normal builds.

Selected native model memberships can declare a larger bounded scalar workload while retaining one evaluator and producer. Existing smaller limits remain in effect; the larger native recovery journey passes while numerical coexistence assessment remains pending.

An explicit native model fanout capability retains one source capture across a frozen audience. It requires every original recipient receipt before releasing native producer debt, alongside the existing native completion obligations. Full topology and comparative assessment remain in progress.

Bug Fixes

Native Tensor results with more than two axes now preserve their declared shape, including empty axes, when returned from a model. They match the Workbook fallback instead of gaining an extra array wrapper.

Input writes and resets survive restart when clients use different spellings for the same cell or named input. A formula edit that fails to compile now preserves saved input values after restart. A successful edit clears the override on the edited cell even when the input was saved as A1 and the formula editor uses R1C1.

The local connector lockfile now selects the current Media library so a locked build can use the pinned GStreamer SDK.

Compatibility and Migrations

Existing completed recordings can use the same playback path. Files up to 64 MiB are supported. Partial recordings retain their download action.

Known Issues

Persistent Native instances require the private-file Core custody profile and an unlimited Library. The final installed crash/reply-loss suite and Host binary/example checks are pending. Uncertain worker outcomes remain fenced. The licensed topology source now connects combined Source10/process execution, closed uncheckpointed process consumption and topology relocation through their original owners and receipts. Compilation, installed lifecycle/crash recovery and cost checks remain unrun under the no-build direction. Installed organization operations and broader effect/state migration remain open.

Recording access is scoped to the originating document incarnation.

Documentation Updated

Pure evaluation experiments now admit random and Latin hypercube sampled designs with bounded local axes, explicit count and seed, using the existing sampler. The reference includes a sampled quote example; fresh retained Host acceptance remains outstanding.

The Media reference and camera example guide describe playback ownership and file limits.

The native authority storage guide describes the selected peer-recovery API, bounds and compatibility.

The finite discrete inference reference and fault diagnosis example describe factor ordering, conditioning, retained reports and bounded execution.

Selected native Backbone development profile

The selected Core-local Backbone profile is complete: installed reference compatibility, all sixteen gateway compositions, joined no-report workflow faults and both native wallet/archive/grant recovery tests pass. The wallet uses the existing custody, Process, Ledger and grant owners through a versioned five-operation catalog; historical installed-payment operations retain their ABI. The local capability ledger retains the exact sources, prior failures and 21/21 required named passes. This adds no edition default or automatic wallet activation. SDK/provider/platform rollout remains separate, and P1–P6 remains closed.

Selected specialist data imports

Source adds semaphore positions and selected maritime hoists, TEI feature matrices, FMEA/bow-tie data, and geological orientation/GeoSciML Lite, Basic and geological-time profiles in Standard (Lite)/Pro. Payload highlighting, quoted CSV field assistance, local TEI/bow-tie navigation and declared feature-vocabulary checks accompany the imports. Inherited TEI constraints/defaults and general subsumption remain unvalidated; geological time frames and uncertainty are preserved without inferred ordering. These are descriptive subsets; native validation remains deferred. The profile reference states the encodings, examples and exclusions.

Quiver category diagrams

Import quiver version-0 diagrams as decoded JSON, base64 or share links. Higher cells retain their indexed references and expose native incidence graph tables. Decoded JSON supports local navigation and endpoint completion. Labels, styles and macro URLs remain data; no rendering or commutativity proof is implied. Native verification remains deferred. See the exchange contract.

FeynML diagram import

Import selected FeynML XML through feynman or PARSE_FEYNMAN. Ordered vertices, propagators and external legs become native entity-incidence graphs; unresolved endpoints remain explicit issues. Editor assistance includes diagram-local vertex navigation and completion. The profile covers 0.2.0.1 wrappers and standalone child/legacy diagrams while preserving existing Grid JSON records. Styles, particle inference, rendering and amplitudes remain outside this import. Native verification remains deferred. See the exchange contract.

CML reactions and mechanism annotations

The reactions and mechanism tags now import selected CML XML alongside their existing Grid JSON forms. Participant counts, scheme hierarchy, mechanism annotations and typed molecule-local references become native records and containment graphs, with matching editor navigation/completion. Explicit map contexts and per-link overrides disambiguate repeated atom IDs; partial sets retain endpoint incidence without invented pairings. Chemical balancing, kinetics, reference expansion and curved-arrow interpretation remain outside the profile. Native verification remains deferred. See the CML import contract.

gestureBot timed poses

Import gestureBot's five-joint timed-pose JSON through laban or PARSE_LABAN. Native data preserves seconds, sparse/source-order poses, sorted track indexes, overlaps and inert text/MIDI/audio cues. Editor choices distinguish head and arm vocabularies and exclude ambiguous place/normal poses. Existing Grid JSON records remain supported. Native verification is deferred; this does not add robot playback or full Labanotation support. See the timed-pose contract.

Legacy LabanotationSuite JSON

Import named gestures and poses from LabanotationSuite/Kinect-derived JSON. Authored member order, millisecond timestamps, sparse joint arrays and every gesture remain native data, with chronological indexes and membership graphs. The editor offers spaced field names, joint-array vocabulary and timing help. No initial-time reset, inferred movement durations or rotation playback is introduced. Native verification remains deferred. See the named-gesture contract.

MRV curved electron-flow data

Import Marvin XML through mechanism or reactions: explicit/compact atoms, bonds, curved-arrow geometry, weights and scoped endpoints become native tables and incidence graphs. The editor navigates compact atom tokens and qualified flow references. Unresolved endpoints remain issues without invented links. Chemical execution, electron-count inference and rendering are outside the profile. Native verification remains deferred. See the MRV contract.

Inherited TEI feature declarations

Feature XML now checks authored values against every local and inherited range, including multiple inheritance and shared ancestors. Cycles are rejected; missing bases stay explicitly unvalidated. The editor offers inherited feature names and navigates type/base-type references. Defaults are not synthesized. Native verification remains deferred. See the inheritance contract.

DAGitty causal graph data

Import explicit DAGitty documents through causaldag, including grouped edges, causal annotations, isolated variables and endpoint marks. The editor offers local variable navigation/completion. Native structural checks reject admitted cycle violations; no causal analysis or full MAG/PAG proof is claimed. Native verification remains deferred. See the contract.

CalChart formation data

Import selected CalChart JSON shows through choreography, retaining performer indices, formations, explicit curves, holds and descriptive continuity ASTs. The editor navigates numeric references and offers vocabulary choices. Missing links stay explicit; no movement or media is executed. Native verification remains deferred. See the contract.

Native graph projections

DAGitty and CalChart now emit scalar graph tables with native from/to endpoints. Rich DAGitty variable/relation metadata remains available separately. Their parser contracts advance to revision 3. Source review found this compatibility defect before native acceptance; compiler/runtime checks remain deferred.

Native graph constant admission now shares bounded ID, endpoint, scalar-property and direction validation with the resident data adapter. Native checks remain unrun. GRAPH(named_value) now has source wiring for reactive topology and direction, including derived graphs, bounded admission and source revision invalidation. Saved-LIR, failure/recovery and eight-profile comparisons are authored, awaiting native execution. See the live graph example.

Orbital message authoring

OMM/OEM payloads gain field, time-system and unit assistance using shared native-reader vocabulary. KVN choices follow OEM sections; OMM GP JSON keeps its fixed defaults, while XML supports existing scalar/unit values. Source mappings cover all three literal forms. Native validation and live editor QA remain deferred. See the orbital example.

RomanText analyses can be imported through roman literals and PARSE_ROMAN. Native records retain measures, alternate readings, beat spellings, keys, pedals and copy references. Editor assistance covers document headers, meter and minor-mode policies, and chord symbols. Pitches and repeated measures are not realized; native integration validation and rendered editor QA remain deferred.

Grid can read KiCad 7 schematics with circuit and PARSE_CIRCUIT. Inspect placed symbols, sheet pins and wire coordinates, or query the structural graph for symbol-library links. The editor can navigate those links and complete label shapes and symbol placement flags.

VS Code highlights all native format literal tags and aliases. Raw literals can show GEDCOM cross-references, FASTQ quality records, orbital message fields and other notation-specific tokens. Grid highlighting resumes after the matching closing delimiter.

In VS Code, hover and completion use the compiler to identify foreign literals. An XML example inside a RomanText note keeps RomanText assistance. For a standalone XML literal, VS Code can use the installed XML provider and map its edits back through Grid escapes.

Execution Grants source also connects retained retirement of pre-Source10 Native12/13 models through their existing Management, Host, worker, native, Source and grant owners. It retains original receipts/history and charges actual home files plus bounded Source debt without a replacement owner or new custody key. Compiler, lifecycle/crash and cost checks are unrun. Live legacy adoption, physical purge and broader state/effect migration remain implementation work.

Execution Grants source adds original pre-effect ONCE preparation in the existing native replacement owner, with reserved future snapshot debt, immutable file basis and actual Management/candidate/grant scopes. This is a prerequisite, not an activated effectful capture workflow. The subsequent bounded frozen-request profile joins original Jobs/worker dispatch fences and receipts. Its subsequent LIR/input-owner and bounded installed-driver source connections are described below. Broader grant-consumption and Source10/physical connections remain unimplemented. Compilation and runtime/fault checks are unrun.

Execution Grants source now joins original worker publications to the existing LIR and retained input-file owner for bounded frozen ONCE capture. Fresh claims bind the exact Jobs root, preventing duplicate admission into another namespace; model submission and physical worker custody have separate roles. Final-record DATA is produced without another evaluator or effect submission. The bounded installed driver now joins final Seal/publication below. Broader grant settlement and state profiles remain unimplemented; all native contracts are unrun.

Execution Grants source now retains returned capture and persistent-operation publications in the actual selected worker registry before replying. Failed commits retry the same publication through its original Jobs owner and fence; local handoff moves and binds those outgoing obligations with the same worker. Guest error details cannot act as worker control signals. Capacity refusal stays before dispatch; a crash that loses uncommitted output retains original uncertainty. Compiler, lost-reply/crash and cost checks remain unrun.

Execution Grants source adds atomic original/final capture snapshots in the existing Native store. A missing preparation file can recover from original bytes. Complete snapshot-bound Jobs inventories can close as proven unissued in one fenced transaction after an early crash, preserving started operations. Generic deletion refuses to refund retained capture debt. The subsequent bounded mounted replacement connection is described below; broader grant-settlement/profile composition remains open. Compiler and fault contracts are unrun.

Execution Grants source now connects bounded frozen nonpersistent ONCE capture through the installed replacement coordinator. Actual preclaim Host/fence/input proof, original Jobs/worker admission and held Native/file/outcome Seal lead to the existing selector publisher. Exact sealed Native bytes restore missing final files without rerunning effects. Explicit surrender and model stop preserve original known/uncertain outcomes. Protected worker packages wait for original operation admission before installation. Broader state/profile, original revision, post-revocation/asynchronous handoff, legacy adoption and physical purge work remains open. No builds or behavioral/crash checks ran; four new contracts, including three installed case profiles, are authored but unrun.

Execution Grants source now includes nonresident original captures in signed revocation and service shutdown. Fresh Native snapshots retain the full original primary/prerequisite grant scope, so catalog removal cannot hide affected pending operations. Actual Native/Jobs owners close only proven-unissued work, preserve known/uncertain outcomes and keep model publication and storage debt original. The already-open recovery transport supports stop/cancel after current admission is disabled. Historical unknown scopes fail closed. Three new contracts, including seven installed profiles and a signed transitive-grant/catalog-removal case, are authored but unrun; no builds or behavioral checks ran. Broader migration, revision/handoff and legacy storage work remains open. Cold stop/cancel custody is source-connected in the following increment.

Execution Grants source now reopens the exact original required Jobs custody for cold stop and pending cancellation using the held authentic Native snapshot. Disabled admission or a different current broker cannot redirect recovery; missing/replaced/corrupt original custody refuses. The existing resource drain uses the original effect route, preserving unrelated current-root same-name work and dedupe history. No new worker, grant owner or effect is created. Two authored contracts cover eleven storage/fence profiles and six installed fresh-process profiles, including actual returned Lua outcomes; all remain unrun. Syntax and documentation checks do not establish compilation or crash behavior. Broader execution continuation, migration, handoff and legacy accounting remain open.

Execution Grants source now replays returned captures using authentic original LIR, input files and Jobs outcomes before current compilation. Physical input and signed-release proof, complete original grant scope and current security remain required. Original values can Seal after commercial revocation without fresh admission or guest dispatch; clock, metadata and receipts stay original. The transport has no current-broker fallback. Twelve Rust inputs parse; a new four-profile installed contract is authored but unrun, including lost Seal reply and disabled-security/substitution checks. No builds ran. Original-term stopped publication/terminal completion and broader migration/handoff/legacy work remain implementation gaps.

Execution Grants source now connects sealed original results to stopped selector publication and final receipts without requiring a current compiler result or fresh commercial admission. Actual original Native, Jobs, file and resource owners preserve outcomes and debt; resource waits release Native/Jobs locks and reacquire fresh proofs afterward. Current security still applies. Broader queued continuation, state/effect migration, handoff and legacy accounting remain open. No builds ran; the new and extended recovery contracts are authored but unrun.

Execution Grants source now moves a bounded original capture queue, actual Host and unique worker in the existing consuming handoff capsule. The original Jobs control records successor acceptance; original effect digests, operations, worker generation and receipts remain unchanged. A crash cannot create a replacement worker owner or rerun uncertainty. Broader combined capture/receiver handoff and other program gaps remain open. New storage, installed and fresh-process contracts are authored but unrun; no builds ran.

Execution Grants source now accounts a live Native12/13 legacy Source/home baseline through current rights and its original Native, Source and file owners. The model stays live, retries keep one byte charge, and exact retirement carries the charge into the original retirement obligation without resetting quota. No key, custody upgrade or grant owner is created. Broader adoption and physical purge remain open; new source/recovery contracts are authored but unrun.

The Execution Grants SDK source now joins an ordinary Source10 model home's byte charge to its original Source and Native owners. Lost-reply recovery keeps the same operation and receipt without starting a Host. Pending or omitted accounting refuses current admission. Compilation, native fault/quota and cost checks are unrun; mapped-home accounting and broader storage disposition remain open. Home accounting

Execution Grants mapped-home accounting is now source-connected to its original Native recovery owner. The Source certificate stays immutable; exact earlier home charges and receipts are retained through retry and retirement. Cold receipt recovery starts no Host. Compilation and native/fault/quota/cost contracts remain unrun, and broader disposition/purge work stays open. Mapped home accounting

Execution Grants original ONCE capture now has a source connection for inline pure MAP work before and after the frozen original effect. Retained replay uses the original source, inputs and authenticated outcomes; nested pending results cannot be sealed as finals. Conditional/dependent effect requests remain open. Compilation and the authored native, crash and handoff contracts are unrun. Pure MAP capture

Execution Grants original capture now retains the exact originally verified package under its existing Native and Jobs owners. The source connection can complete returned work after a package change and continue a stateless request proven never to have started after process loss. Uncertain work keeps its original execution owner. Compilation and the authored native/crash/quota/cost checks remain unrun; broader receiver and state migration remains open. Original package recovery

Execution Grants capture recovery now selects the complete original grant graph from its Native snapshot when current prerequisites change. A smaller current graph cannot drop original grant leases or authorize fresh work through them. Final publication also checks the original saved release. Compilation and the authored installed, crash and isolation checks remain unrun. Original grant graph recovery

Execution Grants retained nonpersistent capture recovery now has a source connection after the entire root management catalog entry is removed. It uses the same original Native/Jobs/grant/file owners; fresh work needs a real current plan. Sealed receipt acknowledgement no longer admits executable code again. Compilation and the authored native/crash/isolation checks remain unrun. Capture without a catalog entry

Execution Grants static Graph edit migration now inspects exact image DATA through the existing Graph mutation/checkpoint owner without loading imported engines or evaluating formulas. Original publication authorities and audit history remain. Compilation and authored recovery/isolation checks are unrun; Graph state inside captured effects still needs its state-snapshot connection. Graph adjunct migration

Execution Grants local multi-model receiver handoff now has a source connection through complete original grant leases, the same physical worker and atomic per-scope Jobs controller histories. It also fixes existing-model dispatcher rebinding and refuses omitted queued models. Compilation and the authored native/lost-reply/crash contracts remain unrun. Combined capture/receiver and collective installed organization adapters remain open. Multi-model receiver handoff

Execution Grants collective native organization handoff now borrows every model's current security and original approved-review owners. Control changes require Edit and Run; accepted execution retains Run authority. Shared review stores use one writer with all original model fences. Compilation and authored native/fault checks remain unrun; installed collective worker custody/audit is still open. Collective organization authority

Execution Grants local receiver handoff now carries completed, fenced receiver history beside active models through the same original Jobs and physical worker owners. Original operations, outcomes, disposal and terminal receipts remain; retired lifetimes gain no new controller or execution rights. Compilation and authored native/lost-reply/crash contracts remain unrun. Mixed capture movement, installed collective custody/audit and storage disposition remain open. Completed receiver history

Execution Grants pending-controller upgrade recovery now preserves an older original handoff receipt when its exact original inventory and actual worker completeness still hold. Terminal-history checks remain required; no replacement operation or worker is issued. Compilation and the authored storage compatibility contract are unrun.

Execution Grants collective capture coordination now borrows each original grant graph through the same held lock union and all original Native rows/snapshots through one writer. Current catalogs cannot substitute original capture owners. Compilation and authored owner/recovery checks are unrun; combined worker/Jobs controller movement and installed collective custody remain implementation work. Collective capture owners

Bounded specialist enhancements

Standard and Pro add explicit RomanText copy/harmony resolution, supplied-board Xiangqi move interpretation, supplied-model DEXPI data-property validation and LandXML point-unit conversion. Written ABC repeats and selected ornaments, explicit LilyPond voices, UML state-machine tables, Ukrainian ALA-LC 2011, selected maritime complements, USC ranges, TEI symbol collections, signed augmented braille matrices, absent CIF Set defaults, SACM endpoint checks and CMU knitout settings extend their native profiles.

Each profile states its refusals and preserves the distinction between imported records and execution, proof or certification. See the specialist contract. BNE/MacBenesh score interchange is explicitly deferred and remains unavailable. Resuming it requires a documented file grammar and representative score files. No release or product publication is implied by these source changes.

Grid 0.75.0 — Upcoming (not released)

Summary

Grid 0.75.0 adds local Lineage comparison and manual conflict resolution for native model files, and reopens the workspace you used last when it starts. Home is now your workspace library, where you create, open, rename and delete workspaces, each backed by its existing model. It also includes calculation memory improvements and the approved refinements to working menus, status indicators, the App header and the App question area. Local SCM-style Lineage is complete. This is an incomplete draft for 0.75.0, which remains in development; the full release scope and source are not final.

What's New

Analyze imported native models

Bounded analysis profiles connect fault trees to probability and sensitivity reports, RDF datasets to explicit data-quality checks, and calibrated waveform samples to native tables and statistics. Static ordinary PNML nets compile into the same NET operations as authored models, with bounded count-state exploration available as an ordinary source library. These profiles retain explicit assumptions, source identity and unsupported cases; integration evidence remains in the notation completion ledger.

Compose nets, monitors and causal studies

NET reports now retain attempted checks and proposed token changes through a failed firing, while successful firings expose the complete change. Wide count nets share generated diagnostic data and result prefixes instead of expanding them repeatedly.

MONITOR and CAUSAL results expose typed Frames for ordinary queries and COLLECT, including native Result, Option and symbol values. Durable monitor checkpoints preserve nested native values, and explicit causal studies retain the actual input realizations and original definition for replay. Reading a definition or pure result starts no job, subscription or publication.

More native notation imports

Standard (Lite) and Pro add bounded readers for Penn Treebank, IPA/X-SAMPA, Roman harmonic analysis, Nashville numbers, figured bass, Braille ASCII, NORAD TLE, Formal SignWriting, DEXPI 1.3/2.0.1, CIF 1.1/2.0 data/dictionary files, Italian fixed-do and monophonic jianpu. LandXML survey XML, OMM GP JSON and CCSDS KVN/XML, Open-PSA fault trees, UML XMI, Unicode SignWriting and Knitout instruction data add six more bounded imports. Humdrum adds movable-do and polyphonic spine data; ECLI, USC/CFR citations, OEM KVN/XML ephemerides, SPICE text kernels and manual-token SiGML add seven further profiles. LandXML now exposes authored TIN vertices and faces with checked references, plus authored alignment control geometry, station equations and vertical profiles. Xiangqi accepts Chinese/WXF move descriptors. ALA-LC Russian uses the explicit 2012 letter table. IPA normalizes equivalent Unicode spellings with authored source spans; transliteration offers fifteen explicitly selected schemes. Literal tags have completion, hover and lexical payload highlighting. Literal tags remain discoverable when a function shares their spelling, such as roman and ROMAN(...). ABC handles major/minor key signatures and accidental propagation, LilyPond inherits dotted durations, and TEI exposes critical-apparatus witness references.

These are structural imports with explicit limits: BRF decodes cells without UEB/Nemeth translation, FSW does not render signs, and DEXPI does not infer pipe connectivity. VALIDATE_CIF explicitly checks supplied DDL1/DDL2/DDLm dictionaries, with incomplete results for unsupported rules. CIF gains local dictionary completion and navigation. FSW/SWU check the assigned ISWA 2010 repertoire; FSW gains valid variant completion and both encodings gain assignment hover. Direct hamnosys literals and PARSE_HAMNOSYS now import the pinned Hamburg character repertoire into native symbols and groups. Editor completion inserts published characters by name; hover identifies codepoints. Phonetic validation and font installation are not implied.

CIF dictionary validation now associates scalar and compound measured values with their standard uncertainties, checks exact agreement between parenthesized and separate values, and offers purpose completion and help in the editor. Lists and matrices align by position; tables align by key, with shape and uncertainty constraints checked. Explicitly linked measurements may belong to different declared Set categories in the same scalar scope; different Loop categories match through unique explicit links covering complete category keys. Row order does not establish correspondence. Dictionary validation also checks URI reference and DateTime syntax, with editor choices for both and URI table indices. References and offsets stay authored; leap-second history remains incomplete.

Explicit ueb1/ueb2 imports and BRAILLE_TRANSLATE now transcribe English plain text with pinned native Rust tables, bounded execution and editor highlighting. An optional forward style argument preserves explicit italic, bold and other pinned typeform spans through Unicode text corrections; signature help and hover explain its scalar offsets. Explicit backward-typeforms recovers indicator styles into decoded Unicode scalar spans, including contraction expansion. Layout, full UEB validation and contextual Nemeth remain outside those text profiles. Forward nonbreaking spaces now retain numeric-grouping semantics. Mathematical expressions now have a separate MATH_BRAILLE operation with fixed Nemeth and UEB Technical profiles over MathML text/native records. MathML adds Presentation elements, named entities and namespace-aware editor completion/hover. Unsupported braille outputs fail explicitly; page layout and full regional conformance are not implied. See the supported profiles and example.

DEXPI 2.0.1 exchange XML imports typed data and object graphs; TEI works with native DOM editing and XML export. XML references gain literal-local completion and checked identity renaming for bounded TEI, LandXML and DEXPI profiles. Rename refuses unresolved pointers, unknown extension vocabulary and unsafe scopes. The editor now preserves native-format symbols for navigation and keeps identity hovers separate from runtime cell values. Imported DEXPI metamodels and full TEI schema validation remain outside these bounded profiles.

Inspect and simplify Boolean policies

Import shared/boolean-policy.gs to simplify explicit two-valued policy text without writing a grammar or rewrite laws. It handles redundant branches, contradictions and common factors, and retains native status and derivations for inspection. Work is bounded and incomplete results are explicit. This local source library does not change live permissions or require Registry installation. See the contract and examples.

Native Tree execution now avoids constructing equality replacements that cannot shrink the tree and reuses bounded preparation. New saved transform results use evidence schema 6; existing schemas 3 and 5 remain readable, while older readers must be updated to read new results. Large policy parsing also uses less memory while retaining the same explanations and resource limits.

Reusable dynamics settings

Write scenario = conversion WITH settings to reuse checked parameter and initial-value settings without changing the original definition. DYNAMICS.CONFIGURE(conversion, settings) remains supported. A canonical example shows how to explicitly accept calibration results and map their parameter names into a separate forecast.

Studies with reusable calculations

EXPERIMENT now supports study-local EVALUATE targets and SCHEDULE targets for configured Planning values. Observe scalar results without creating global inputs or inventing a simulation clock. Direct CALIBRATION can fit a returned trajectory against observation times, retaining the existing bounded solver and explicit exact/linear alignment. See Studies for syntax, limits and executable examples. Definition reads remain inert; execution is an explicit operation.

Desktop and Linux native model files can compare the last accepted parent, current child and incoming definitions before a manual update. Conflicts in existing permitted overrides have explicit keep-child, take-parent and custom choices; unselected parts keep their accepted revisions. The approved comparison view is available in selected native file tools. Native operations now also create new child overrides and accept explicit PART membership/import changes, with complete dependency validation and saved-revision replay. Live updates, shared captures and remote authorities are outside this local scope.

Consistent editing diagnostics and local package imports

Code uses one diagnostic format for draft checks, compiler tools, analyzers and syntax-worker findings. Locations remain attached to the source that produced them, including proposed edits and generated code; stale results are refused. External editors using gridctl lsp can resolve locally installed domain and API packages. Domain definitions open in their verified source files, and API imports use local schema metadata without making API calls. Code reuses source analysis between requests on an unchanged draft. External editors also retain analyses for unrelated files, while imported definitions and package verification still refresh after edits. Larger valid models no longer lose editor assistance because a compiler storage check applies the wrong allowance. Resource limits remain in place.

Native service operator connections

The approved Document operators launcher in Network's Control plane offers all eight local operator views. Existing native services supply their original scope and receipts; selection and inspection are explicit. Ledger money, execution capacity and issuer settlement keep their separate owners. Missing or uncertain results remain visible, and notes stay with the original selection when navigating. Process inspections can read packed native models while retaining their metadata and resource limits. Production providers and payment rollout remain separate. Optimized native delivery now correctly keeps track of queued publications.

Recorded process simulation and reusable service flows

Describe recorded jobs with typed payloads, priority queues, finite waiting space, patience, routing and rework. Services acquire all required pools together, and shift calendars change availability without interrupting active work. Reusable FLOW components keep independent queues and share only explicitly mapped pools.

The existing experiment operation can select a process definition, freeze its inputs and compare staffing scenarios across independent seeded replications. Original outputs support inspection and verified replay after source replacement, restart and renamed import. Optional bounded traces become analytical Frames or explicit monitor inputs; incomplete runs and truncated traces never claim full coverage. The Experiments surface now authors named process/model-input bindings, compares numeric scenarios, pages original events and exposes trace publication, monitor analysis and captured replay. Existing simple-chain seeded answers remain unchanged. Coding is complete; current-tuple runtime checks were left unrun at the owner's direction. No throughput result is claimed.

Pick up where you left off

A new launch reopens the workspace you used last, in its folder and with its layer, view or sheet and editor panels as you left them. A launch while Grid is still starting waits and reopens it once Grid is ready. On the first launch, or when the last workspace is gone or no longer available to you, Grid starts an empty Untitled workspace in the Default folder and shows New; a notice says when a reopen failed. Reloads, explicit links and New window behave as before.

Workspaces in Home

Home is your workspace library. New workspace, Open workspaces…, Search workspaces, rename, delete and Save current workspace name what you work in, and Workspace setup starts a new one. Each entry shows its description, or Workspace when it has none. Chat, Pages, Data and Code are views of the same workspace; More → Open this workspace in chooses where it opens. On Desktop, the File menu's folder commands are now Open Workspace Folder... and Save Workspaces in Folder; their shortcuts and behavior are unchanged.

Screens that need an open workspace, such as Files, Replay, Research and the specialist surfaces, now say Open a workspace… or No workspace open. Each workspace is backed by the model it was before, so names, folders, saved files and links are unchanged. Code, the language reference and the Model API still say model, because they work with the model itself.

Computed graph query arguments

Reusable graph queries accept pure scalar expressions such as selection.id, base_cost + surcharge and pure helper calls. The compiler supplies private bindings so row matches reuse each argument's value. Graph handles remain named, bounds remain static, and volatile/effectful computed arguments are rejected.

Improvements

Explicit adapters now connect LP/MPS imports to native optimization reports, R formulas to portable fitting/prediction, and TextGrid/EAF/CoNLL-U/Brat annotations to queryable Frame/Graph tables. The import profiles preserve source identity, selected semantics and refusal boundaries: integer programs never silently relax, arbitrary R code is not executed, and annotation units are not implicitly converted. See format execution.

Resident tensor contractions add CUDA f32/f64 forward and reverse execution, with bounded reference-order arithmetic and atomic result publication. Local checks cover adapter types and the production indexing algorithm; NVIDIA device execution remains unverified because CUDA hardware is unavailable. Existing CPU and Metal contraction support is retained.

Compatible calculation stages now execute together, sharing private producers and reusable intermediate buffers within bounded groups. Published results remain independently owned.

Comparisons between literal numbers and logic over literal Booleans expose more constant conditions to the compiler without freezing editable inputs. Metadata-only model loading shares compiled expressions between independent calculation sessions, reducing duplicate storage. Numeric execution avoids repacking plain numbers between arithmetic steps; blank and error handling remain unchanged.

Working menus use distinct icons. Each System area has its own, and pages, sheets and surfaces get a default icon from their kind that differs from their siblings'. Collapsed menus show these icons with tooltips instead of initials, and the collapsed Pages menu omits an empty search. System health and live updates appear as status icons in its header. In the App header the save control and View actions are icons, and in the quiet frame a view starts directly below the header. Home's folders and Templates move into the window menu. The App question area is a single row that no longer covers the bottom of a view, and Browser history buttons use the same quiet presentation as the surrounding toolbar.

Source-library comparison recipes

New examples compare policy quotes, fitted predictions and resource schedules using existing EXPERIMENT calls and retained Frames. A numerical source library names portfolio variance, weighted Gram matrices and batched matrix application. Supply the .gs files with the importing model; no new runtime or syntax is required. Direct DECISION-to-EVALUATE calls remain a separate admission gap; the policy recipe uses an ordinary callable for its disjoint cases.

Bug Fixes

Discussion can retain more than two competing drafts for explicit review, within its existing browser storage limits. Reviewed conflicts no longer reappear when leaving the thread, and completing review returns keyboard focus to the composer. Older tabs refuse extended recovery records they cannot read. Reopening a thread checks its original command without treating normal refreshes as source edits. Successful edit recovery no longer invents a second draft on return. Ledger can finish checking an account already confirmed in another tab without submitting it again. Newly typed Discussion text also survives immediate reload without resubmitting the original message. Code keeps its footer controls reachable inside short split editor panes.

Process creation retains unfinished text across view changes without falsely reporting an authored-source conflict when only the runtime revision advances.

Matrix inspection accepts native tensors and preserves shape and element units while reading only the requested slice.

Notebook no longer enters a render loop when formula execution updates the workspace’s Undo controls. Run saves its intent before changing model source. Refreshed revisions no longer cause false conflicts for unchanged notebook data; returning to a completed Run can recover its retained receipt without executing it again.

Print Studio prevents overlapping Print and PDF export preparation. Cancelled or refused attempts permit retry without another preparation already running.

A formula that reuses one subexpression many levels deep no longer makes model preparation take exponentially longer. Such a formula keeps the general calculation path and produces the same results.

New no longer stays unavailable, waiting for the current workspace change, after you leave Home before its workspace list has loaded.

A window opened or reloaded while Grid is still starting no longer stays on Reconnecting…. It keeps checking and reopens its workspace once Grid is ready, without a reload; a brief outage no longer discards the window's workspace.

Desktop updates use refreshed archive and signature-verification dependencies. Tensor archive loading uses the fixed ZIP reader while retaining the same tensor calculation code.

Compatibility and Migrations

No formula-language or calculation-result changes. Existing files retain their current behavior. Saved Lineage updates retain explicit resolution and PART acceptance data; older readers refuse transformed revisions they do not support. Interface changes affect presentation only; commands, permissions and keyboard behavior are unchanged. Workspace wording renames no identifier, link, storage key, API, MODEL syntax or saved file; accessible names follow the new wording. The last workspace is remembered per account and site on this device.

Known Issues

Commercial Library prerequisites and same-owner Solution Copy/Fork now pass scoped native lifecycle, shared accounting and original-result crash-recovery checks. Signed pure Native/Python and core-Wasm Library journeys also pass. Persistent instances, broader topology/editing, installed organization operations and wider platform/cost work remain part of Execution Grants completion.

Full CEF integration was selected for 0.75.0 on October 30 and remains in development. Native local desktop rendering, remote streaming and independent portable browser Save must be completed and verified before these notes can describe their delivered behavior. The earlier frozen source does not include that implementation.

Lineage operations require saved native model revisions. Unresolved conflicts, incompatible retained state and missing dependency parts refuse before publication. The separately selected per-model process calculation backend does not support these Lineage operations; the normal in-process backend does.

Deferred to Later Releases

Shared captures, live updates, remote Lineage authorities and Loro remain outside the completed local SCM-style Lineage scope.

The remaining execution-grant, engine-tier, language-server and notation commitments still belong to 0.75.0. This draft does not defer them or declare the version complete.

Documentation Updated

New source-library recipes compose two service FLOW stages over shared staff and inspect recorded process results. Report helpers distinguish horizon completion, unfinished work and trace completeness, preserving unavailable Option metrics. Their fresh runtime acceptance remains outstanding; no new simulator is added.

The grammar reference covers the local Boolean policy library, its two-valued domain, model asset placement, retained results and bounded parser example.

The compiler tools reference describes the checked constant-condition boundary. The model lifecycle guide covers local Lineage comparison, overrides, explicit PART membership/import acceptance and manual update recovery. The interface layers guide describes where Grid opens, default page and sheet icons, the collapsed Pages search and Home's Library in the window menu. The product overview and quickstart define workspaces and models; the interface layers and desktop windows guides and the keyboard shortcuts use workspace wording for Home, search, saving and the Desktop folder commands, and the model home specification records the one-model backing and how a workspace folder differs from a workspace.

Native reader depth also includes CIF dictionary declarations, explicit DEXPI connectivity, ordered TEI text runs, ABC tuplets and bounded ICS visual-hoist transcriptions. These preserve declared alternatives and unresolved references; they do not imply full dictionary/schema validation or operational signaling.

CIF validation also checks DDL2 open ranges and explicit singleton endpoints. SiGML manual-sign elements gain contextual HamNoSys token completion and hover; phonetic sequence validation, broader braille preferences and page layout remain open. Fixed contextual Nemeth/UEB Technical transcription is available through MATH_BRAILLE.

DDL1 validation recognizes dictionary-only definitions, both uncertainty spellings, parent-side links and composite loop uniqueness. Referenced loop fields must share their source loop, and omitted _list applies the DDL1 no-loop default. CIF navigation and completion include child links and uniqueness fields. Explicit alternatives and replacements can satisfy required fields and references; compound selectors include all matching fields. Deprecated names produce warnings, and ambiguous substitutions remain incomplete.

SiGML manual imports now retain nested group tables and reject unmatched, crossed or unclosed group markers. Editor completion suggests the matching closing marker, and hover explains group pairs. This advances the SiGML parser contract to revision 2; full HamNoSys phonetic validation and animation remain outside the implemented profile.

CIF 2.0 adds Unicode identities, nested lists/tables, triple strings and text prefix/folding protocols under the existing cif tag. DDLm declarations and import tables are retained as data, with Unicode dictionary navigation and highlighting. CIF parser contract revision 3 separates new expansions from earlier cached results. Explicit DDLm validation adds scalar types, compound shapes, enumerations, exact ranges, aliases and category key/link checks. An optional native resource map composes recursive DDLm Contents templates and Full category subtrees, with source-only import-policy completion. Category-aware completion offers Full only where a Category scope is explicit. Methods and unsupported measurement/metamodel rules remain incomplete rather than claiming validity. No resources are fetched.

MathML authoring now completes and explains mathvariant values on token and mstyle elements. Checked edits preserve authored symbol classes through native records and fixed Nemeth/UEB Technical transcription, including saved-LIR reload.

TEI imports expose timeline/timepoint tables with authored and inherited interval metadata. Temporal completion and checked rename respect target kinds and local timeline scope; unresolved links remain explicit and no timestamps are inferred.

DDLm dictionaries can share scalar contents syntax through ByReference, including typed Table keys, forward chains and aliases. Missing/cyclic targets remain explicitly incomplete; local constraints and authored string identities are preserved.

FOLD imports now support explicit frame inheritance and per-frame native geometry tables, with parent completion/navigation in the editor. Styled grade-1 UEB is checked against the pinned upstream reference answers.

DDLm reference-dictionary attributes can use Implied contents and structure from the enclosing supplied definition. Editor choices explain the required context; missing or cyclic contexts remain incomplete instead of guessing from values.

PED/FAM now imports separated genotype pairs while preserving six-column pedigree results. Family-local parent completion, navigation, references and highlights work across literal forms; genotype calls remain unphased data without clinical or parentage inference.

DDLm dictionary-wide applicability rules now require, recommend or prohibit attributes in Dictionary, Category and Item scopes. Aliases and descendant categories resolve explicitly, legacy declarations are checked for conflicts, and editor choices explain the rules. This is bounded supplied-dictionary validation; it does not execute methods or certify the entire DDLm metamodel.

HamNoSys source glyphs now render with a scoped bundled webfont in Code. Character completion, native diagnostics and authored source remain unchanged; unrelated private-use text is not assigned the HamNoSys font.

WFDB headers now import as wfdb literals. READ_WFDB decodes explicitly supplied uncompressed signal bytes into channel values, retaining missing data, calibration and checksums. PARSE_WFDBANN imports MIT event annotations. Source field help and format completion explain the supported profile; multisegment signal assembly now accepts explicit constituent headers and bytes, preserving repeated segments and filling missing variable-layout channels with blanks. Changing-skew assembly, FLAC and AHA annotations remain outside it. See the WFDB contract.

Xigt interlinear corpora can now import directly through xigt literals or PARSE_XIGT. Grid preserves tiers and annotations, resolves explicitly selected text and exposes their relationships as native tables and graphs. Editor reference suggestions stay within the declared target tier. See the Xigt contract.

Grid 0.74.0 — Upcoming (not released)

Summary

Grid 0.74.0 completes the V3 compiler's admitted browser-local calculations, repairs View action arguments and compilation revisions, and adds the approved matching wide and narrow working menus. It also adds PLAN scheduling with simultaneous resources, optional work, setup and fixed appointments; EXPERIMENT scenarios; graph traversal policies; and distributed model coordination for selected native development profiles, including local installation transfer, disconnected missions, wallet and industrial observations. These notes describe the source candidate; packaged publication is a separate operation.

The source candidate also aligns Lite and Pro CSV/NDJSON imports: bounded 1,000-record inference, explicit full-file discovery, strict malformed-input refusal and complete nested schema metadata. This changes previously divergent reader defaults; imports can now refuse late unexpected fields or invalid options instead of silently ignoring them. See the file import contract.

What's New

Spatial behaviors can use reusable helpers for neighbor sensing, nearest agents, seeded draws and simulation clock reads. Checked context requirements survive imports and source-free bytecode while the existing workbook/agent clock and saved replica identity remain intact. These artifacts require a reader supporting compiled format minor version 28.

Spatial agent state can retain dates, datetimes, exact integers/decimals, complex values and scalar type tags. A complete stateSchema declares nullable columns and freezes their types before a run; original histories keep exact payloads through restart and portable import. Active state is bounded even when a step or column is not recorded.

The moving neighborhood SIR example combines authored movement, bounded nearest contacts, radius sensing and prevalence-dependent speed with workbook counts and infected person-time on one clock. Its recording stride retains complete population snapshots for the existing original Map/Scene playback. Operator deadlines and recording limits remain explicit. Large spatial histories also use fewer temporary result buffers during verification and portable import, while preserving existing digests and validation. See the authored reference models.

SOLVE can bind complete keyed numeric data with PARAMETER ... = rows BY key VALUE column. One or two fixed axes accept records, matrices, Tables and materialized local Frames; row order does not affect the result. KEYED.VALUES exposes the same checked alignment and shared column reads to ordinary formulas.

Ordinary hierarchies can use TREE.VIEW, TREE.WALK, TREE.FOLD and TREE.MAP_VALUES with existing callbacks and explicit resource limits. TREE.MATERIALIZE reconstructs data through a validated child-field adapter; resident Graphs require a connected root and explicit sibling order. Reusable Tree tools and complete examples cover rollups, configuration migration, simplification, translation and syntax inspection. See ordinary data hierarchies. Large inline hierarchy literals also compile faster by reusing verified type constraints, while retaining callable-storage safety checks. Resident TREE.SOLVE also accepts the existing schema-2 saturation and theorem-backed solvers through its authenticated execution path. These changes do not advance grammar-bound proof-engine graduation.

Graph rows can use bounded pure helpers, conditionals and Boolean predicates, including multiline WHERE and reductions over ordered captured path properties. External scalar captures settle once per operation. Composite rewrites combine property edits, creation, cascade deletion and identity merges against one original snapshot, then publish atomically. Existing simple property arithmetic retains its numeric behavior. These selected contracts require Graph v10. See row expressions and topology rewrites.

Ranked paths return exact bounded alternatives with explicit walk, trail or simple identity policies. Selective equality indexes are owned by the resident consumer and invalidated with their source; complete independent connected stars have a bounded physical specialization. Other complete connected base patterns with 2–12 edges and settled selector predicates can choose a cardinality-guided join order while preserving authored result order, multiplicity and exact identities. Prefix queries, rich predicates, groups and paths keep the existing matcher. Read-only Graph EXPLAIN reports resident index, complete-star and reordered-join selection; unavailable source/input state is explicitly deferred without executing the query.

Graph matches can assert require complete before return. The query either returns every match within its limit or reports GRID_GRAPH_MATCH_INCOMPLETE; exact-limit results must finish the search. This makes an explicit complete input available to existing Frame aggregation and ranking. Ordinary matches retain prefix limits. See complete matches.

Reusable SOLVE(parameters) and FIT(parameters) ON data definitions can be called with independent inputs, imported, or declared locally inside DO blocks. Named arguments and ordinary callable composition reuse the existing compiled runtime; explicit argument checks protect solver shapes and fitting inputs. See reusable FIT and reusable SOLVE.

Graph schemas now close with END, and filtered graphs use graph selected = source DO … END. Existing brace forms still work and keep their authored formatting; canonical AST rendering uses the new forms. Graph results and object-literal syntax are unchanged. See Graph authoring.

Complete Signal and Graph examples now demonstrate a playable synthesizer, capacity-aware dispatch routing and reactive service-failover previews. Typed graph rewrites accept structural .id predicates consistently with matches, without requiring a duplicate schema property. Graph views now share that identity behavior, and empty typed views remain valid rewrite inputs. Define reusable bounded graph matches with ordinary function parameters and apply them to original graphs or previews. Feedback and score composition can live in named DSP helpers; numeric sequences and music literals survive canonical source rendering. Reusable queries.

SOLVE and PLAN can request bounded conflict investigation with DIAGNOSE BUDGET. SOLVE includes variable bounds and distinguishes irreducible conflicts from unfinished investigation; PLAN reports partial-search dead ends separately from whole-plan infeasibility. PLAN also compares arbitrary subsets and orders of omission cost, tardiness cost and makespan directly. Configured PLAN(parameters) definitions construct independent inert instances from live arguments; the explicit Planning operation selects one to solve and publish. See SOLVE and PLAN diagnosis and configured PLAN instances.

SOLVE can prioritize goals with THEN, explicit absolute/relative degradation tolerances, and bounded stage allowances. Results separate completed priorities from unfinished candidates; hard requirements remain compulsory. See objective priorities.

SOLVE objectives can charge for shortages, target deviations and worst-case costs with weighted ABS and MAX expressions. Targets, coefficients and weights remain reactive, while REQUIRE stays compulsory. Indexed penalties compile to the existing sparse LP/MIP solver and expose only authored decisions in values. See optimization.

Calibration can reduce outlier influence with Huber or soft-L1 losses and search from several reproducible starting points. Experiments can explore bounded inputs with seeded random or Latin-hypercube designs, retaining exact sampled inputs for results and replay. Both use the existing compiled runtime.

FIT now accepts readable numeric transformations and category contrasts directly in PREDICTORS. Fitted models retain training centers, scales and category levels for reliable prediction. FIT and trajectory CALIBRATION share direct Table and materialized local Frame inputs, alongside column records and header matrices.

Define checked state machines with typed events, guarded transitions, atomic context updates and invariants. Pure INITIAL, STEP and REPORT members compose with formulas, reducers and existing state rules; emitted notices remain explicit data for the caller to handle. Validate saved instances with CHECK, reconstruct or migrate them explicitly with RESTORE, and use REPLAY or TRACE for bounded event sequences with progress, ordered emissions and an explicit stop-or-continue policy. Conservative diagnostics highlight shadowed transitions, overlapping UNIQUE guards and uncovered state/event cases. Native collection reducers preserve complete event records, matching the existing scan behavior; spreadsheet arrays retain their existing traversal. Pure DO locals and named callables also compose inside rule value actions.

Five more notation families land as first implementation slices over the same native compiled evaluator. SIMULATION declares resources, recurring sources, FIFO queues, services and sinks joined by chains; the definition is inert and RUN({seed, horizon, …}) is the explicit seeded, bounded run on the native discrete-event engine. NET declares count places and transitions with weighted CONSUME, READ, WHEN and PRODUCE clauses; FIRE returns a typed Result with the complete proposed marking or a disabled/error record, and ENABLED/REPORT explain without reserving tokens. MONITOR states response and absence obligations over correlated events with KEY, TIME and MATCH ALL|OLDEST; EVALUATE/REPORT match a finite trace once with inclusive sealed deadlines and declared coverage, so a missed deadline without coverage is indeterminate rather than violated. EINSUM contracts dense tensors with an explicit-output pattern in a reproducible reference order, and EINSUM.REPORT explains the same execution. CAUSAL declares typed acyclic mechanisms over explicit exogenous inputs; INTERVENE replaces whole equations before evaluation and GRAPH/REPORT expose the authored structure. Typed entities, routing and FLOW components belong to the separate simulation implementation.

NET now adds typed occurrences, explicit TAKE selections, dependent counts, EACH production, paged search and subnet ports that share only explicitly mapped places. An explicit Host owner commits the marking and retry receipt together. MONITOR adds distinct counts, prior evidence with revocation, sequences, cancellation ties and all-partition progress. Explicit durable attachment keeps matching state and receipts together, with bounded backfill and checkpoint recovery. CAUSAL components preserve qualified equation identities, and BATCH compares fixed scenarios over the same stable-ID rows. Explicit studies retain actual exogenous draws for replay and Frame publication. Formula reads start none of these live operations. Pure BATCH and finite MONITOR ordinary Frame result carriers remain in progress; no unchanged full-scale Performance budget is certified by these additions.

Correctness repairs wake all queues sharing a released simulation resource, validate restored NET markings before firing, and preserve the beginning of MONITOR coverage so missing history cannot prove a missed promise. Monitor work limits now count candidate scanning and retire completed or expired obligations. EINSUM preserves exact empty dimensions across contractions, with a compact shaped carrier for arbitrary-rank empty values and bounded output allocation. CAUSAL dependency graphs respect local shadowing while retaining genuine dependencies in binding initializers.

Literal EINSUM patterns now prepare with the model and reuse a bounded shape plan across same-shaped value edits. Fresh values remain checked, changed shapes rebuild the plan, and unprepared calls retain the reference fallback. EINSUM.REPORT exposes pattern preparation and shape-plan reuse. Plain calls avoid building report-only metadata.

Dense contractions now share f32/f64 reference arithmetic with the resident CPU Tensor and Training owners, including diagonal, broadcast and repeated-variable gradients. Optional pairwise reassociation validates the full result against reference tolerances. Homogeneous physical units normalize at admission, and long arithmetic checks cancellation before publishing. New covariance, attention and rank-four mechanics examples exercise the broader notation. An immutable general-rank Tensor carrier preserves shape, precision and units through typed transport. Mutable shaped inputs retain Workbook ownership while content generations reuse unaffected upstream resident contractions. Static patterns now specialize through immutable aliases, local bindings and helpers, including imported functions. Metal f32 contractions preserve reference arithmetic and resident reverse gradients, including signed zero and subnormal contributions. CPU f64 remains available; CUDA contractions remain unsupported. No target-machine end-to-end speed guarantee is claimed.

• Reusable decision tables. Define typed policies with labeled rules and FIRST, UNIQUE, ANY or ordered COLLECT selection. Policies compose through ordinary functions, higher-order calls, local scopes and imports. Match a row subject once and use its constructor payload in both the guard and output with MATCH subject WITH pattern. Inspect .REPORT for the selected result, attempted rules and evaluation failures. See decision tables.

Place fixed-size rectangles with LAYOUT, expressing left/right, above/below, contact, containment and non-overlap requirements directly. Read named coordinates and solver status from the result. Directional constraints use linear programming; unspecified contact choices use the existing integer solver when available. Dimensions and pins can follow numeric inputs; finite BOUNDS permit negative coordinates, and named requirements retain their labels in solver reports. Use COORDINATES local IN m to combine compatible lengths such as metres and centimetres, including typed input edits, and read coordinates in that unit. Fixed width/height tables can supply compatible quantities through INDEX; changed shapes and invalid unread cells refuse the calculation. Specify minimum/maximum directional gaps, an inset margin for containment, or a minimum shared-edge length that excludes corner-only contact. Reuse module-level or lexical LAYOUT(parameters) definitions with independent scalar inputs, named arguments, partial application and returned wrappers. Immutable values and transitive pure helpers retain their defining bindings; the bounded numeric callback profile uses ordinary callable transport and actual capture identity. Captures settle once per operation, and unused definitions perform no solve. Declare a rectangle per immutable typed key with RECTANGLE desk[person IN people], then refer to individual desks by key. Validated indexed results preserve family/key identities through solve, CHECK and QUERY; numeric edits retain structure, while key changes require readmission. Use typed LEFT/RIGHT, BOTTOM/TOP, center and size anchors in affine equality or inequality requirements with explicit finite bounds and validation. Declare numeric coefficient formals separately from length inputs. The v4 result retains typed entity metadata; independent CHECK evaluates actual geometry, and QUERY uses all hard affine requirements with explicit uncertainty at exact boundaries. Declare fixed-shape numeric, length or coefficient inputs with PARAMETER sizes SHAPE 1 BY 2; wrong shapes and invalid unread entries refuse. Expose named regions or anchors from a reusable layout and compose them with COMPONENT. Fixed translations and quarter-turns retain each child bound and requirement in one coupled solve. The v5 result keeps instance paths, local-to-parent poses and interface mappings; independent CHECK rejects forged component metadata. Use finite width/height and aspect intervals, fixed-size 0/90-degree choices, fixed obstacles and explicit collection non-overlap. Ordered arrangements, alignment, mirrored centers, snapping, finite Boolean alternatives and Manhattan/Chebyshev bounds retain the complete hard set. Scaled preferences use native priority reports; movement takes an explicit prior placement. Export independently checked local polygons and transform between explicitly bound compatible frames before native topology grounding. Read committed source-origin evidence with WHY, investigate bounded authored-group conflicts, or rank permitted finite numeric repair proposals. Supplied repairs have a search-free independent check and never apply themselves. Select VALIDATE to independently check v2 placements and use .CHECK to validate supplied coordinates without a solver. Stale identities and invalid geometry cannot become usable placements; backend status stays visible. Validated reusable layouts can declare directional QUERY clauses and ask whether a relation MAY, MUST or CANNOT hold. Bounded search returns independently checked witnesses or counterexamples and verified affine bounds; incomplete evidence stays undetermined, and an infeasible base is reported explicitly. See spatial layouts.

Graph views can react to model inputs, and bounded set rewrites can update properties in a new immutable result. Optional and negative match groups handle missing relationships; captured walks reuse Grid's THEN, OR, REVERSE and named path syntax with explicit hop limits and ordered node/edge results. See Graph authoring.

Build harmonic banks with static comprehensions, smooth and modulate pitch, shape notes with ADSR envelopes, and add bounded feedback echo. Grid Music scores can drive authored polyphonic DSP instruments with sample-accurate note boundaries and a fixed voice budget. See music and DSP.

System Setup guides you through installing the verified local AI starter, trying a prompt and selecting it for Chat, Grid Agent and new workbook AI questions. Leave and resume from System; restart recovery uses installed models and saved settings. Existing provider choices change only when you select the new default. Chat now accepts conversational replies without requiring a source proposal. Greetings and questions can return text; requested edits retain independent host validation and explicit Apply. This also corrects the authoring-only prompt previously sent to the default local model for every typed message. See Set up local AI.

System's Compilers view and Code's Build extension controls connect pinned local toolchains to source-snapshot compilation and gridoc retention. Keep source, settings, receipts and output together, then prepare the exact retained package for the existing activation review. Existing supported profiles include Python, Ruby, Rust and Go native capsule builds. Builds can share identical source files without conflicting in the gridoc artifact store. Native document Save also waits for automatic source persistence already in progress and keeps the current model connection live after writing the archive. File Save updates the saved label without clearing newer unsaved edits. Switch or deactivate extension workspaces without removing imports for retained gridoc builds; retained definitions preserve compilation without granting execution. Pilot profiles and native compatibility are unchanged. See Extension compilers.

An opt-in Apple-silicon model-owner profile now moves existing model signing custody into macOS Keychain without resetting model identity or delivery history. Explicit enrollment, renewal, interrupted-write recovery and revocation preserve the original native lifecycle and producer owners. Locked or changed custody refuses model bridge admission and signing. This profile trusts the OS; it does not establish a production installation or hardware rollback protection.

Compose native signal chains with local DO … END stages inside RENDER. Name controls and intermediate processors while retaining one DSP plan and the existing delivery owner. Reuse pure Grid DSP functions, derive controls inline, and blend independently processed branches with SIGNAL_MIX. Shared stages execute once per block with prepared buffers. Write graph patterns as (a:Account)-[e:Transfer]->(b:Account); labels abbreviate symbol-valued kind predicates and combine with existing schema checks and bounded matching. Omit unused node/edge names or select nodes directly, including isolated nodes. Use model inputs in predicates, seek by structural ID, compare bound properties, and branch from an earlier node with comma-separated paths. See Signal composition and typed graph patterns.

Choose classical, HC1, clustered or Newey–West covariance and confidence levels in linear FIT blocks. Give each calibration trajectory its own observation-error column, or use MINIMIZE with a custom model formula for penalties and validation scores. Both calibration forms use the existing retained compiled execution. See Studies.

Fit nonlinear formulas with named bounded parameters and native uncertainty reports. Calibrate simulation trajectories against timestamped observations, with explicit alignment, observation errors and per-row residuals.

Write numeric statistical models with name = FIT ON data … END, including explicit interactions, missing-data policy, named coefficients and prediction. Declare EXPERIMENT sweeps and CALIBRATION targets alongside model formulas; run them explicitly through the existing retained Host operations. Both assignment and declaration headers are supported. See Studies.

Write reaction networks with conversion = REACTIONS … END and governing equations with charging = EQUATIONS … END. Named species, explicit fluxes, captured parameters, differential states and algebraic variables lower to the existing native ODE/DAE solvers. Separate reactive solve formulas produce trajectories; reading definitions does not integrate. Assignment and declaration headers are equivalent. The first equation profile supports constant derivative coefficients and index-1 DAEs. The shared DAE solver also fixes constraint and convergence errors exposed by dense output sampling. See Dynamics.

Dynamics definitions also support reversible arrows, explicit MASS_ACTION rates, shared LET expressions, and adjustable parameters multiplying derivatives. Solve one definition with different named parameter and initial values, or request terminal values and native solver reports directly. Runnable enzyme, population, oscillator, and RC-circuit examples demonstrate the expanded syntax and its numeric assumptions.

Name a threshold with EVENT half_converted WHEN substrate = 5 FALLING, then request its first crossing with REACTION_EVENT or EQUATION_EVENT. The result includes time, named state and observations. DAE crossings use consistent algebraic states, including initial projection. Event declarations are passive and do not change ordinary solution calls.

Annotate dynamics states, parameters, and observations with physical units and declare the clock with TIME IS unit:s. Compatible scales convert automatically; incompatible governing equations are refused. Named solutions and event results retain unit metadata. Ordinary pure numeric functions can share rate laws and forces, including reactive lexical captures and imported helpers, while continuing to use the existing compiled solvers. Compose reusable definitions with COMPONENT, then couple qualified states through reactions or dynamic INPUT bindings. The parent integrates one combined model, retaining component observations, events, and unit conversions.

Reuse dynamics settings with scenario = DYNAMICS.CONFIGURE(model, settings). Immutable shared parameter and initial-value records retain reactive numeric inputs. Nested configurations and per-run overrides compose without modifying the original model; configurations remain model-local references.

Describe repeated compartments and populations with fixed indexed species or states, then write named reaction and equation rows over the same domains. Named INVARIANT clauses express conservation, bounds, and algebraic checks with an absolute tolerance. A failed check identifies its name and time and fails the operation without clamping or returning a successful partial result.

Use assignment syntax for notation blocks: allocation = SOLVE … END binds a reactive optimization result, and fabrication = PLAN … END binds a resident schedule reference. Declaration-first blocks remain equivalent alternatives. Reading or aliasing a plan reference does not run scheduling search. Plan names now occupy the module value namespace and must be unique.

Author native schedules with PLAN: name resources and activities, set calendars and dependencies, and use exact duration ticks. The existing Planning operation selects a plan by name and publishes its schedule through the same native compiled runtime. See Planning declarations.

Declare optimization models with named variables and constraints in a SOLVE block. Finite index domains and binder SUM express assignment and allocation models directly. Results expose named values, ordered axes and the existing solver report; reactive numeric parameters update through the same compiled runtime. Integer models require the MIP capability and refuse when it is unavailable. See named and indexed optimization for syntax and first-version limits.

• The remaining 21 admitted portable functions now execute through the shared native compiled-model evaluator, including SEQUENCE, SORT, UNIQUE, TEXTJOIN, XLOOKUP and XMATCH.
• Native and browser calculations retain the same value, error and array-shape contracts. Host resources and effects continue to require authorized Host operations.

Narrow working menus mirror their wide counterparts across Pages, Data, Chat, Code, System, and Network. Hover reveals full destination names.

Lineage DEFAULT overrides across compiler changes

Selected Lineage migration preserves named DEFAULT overrides across compiler allocation changes, including sticky blanks and reset behavior. Browser-enabled publication retains the original table snapshot and funded Process owners.

Terminal membership departure

The selected native membership development profile now joins terminal departure through original delivery, application, publication, Process and grant owners. A signed local closure proof and the original issuer settlement precede the authority's Left receipt; lost replies recover originals and uncertain work continues to hold its obligations. This bounded Core capability does not activate a service view or establish production custody or complete distributed model coordination.

Native cross-domain export mappings

The explicitly selected private-file native scalar gateway now connects an A-domain input to the existing compiled model and a separately authorized B-domain export. Independent source disclosure and destination publication/acceptance rights pin the complete admitted definition and flows. Frozen native intent, destination ciphertext/mapping and original receipts survive local recovery; quota pressure and durable revocation retain obligations with their original owners. Full or opaque signed provenance preserves bounded loop history. This profile adds no evaluator, execution/grant owner, worker or polling loop. Broader schemas/effects, multi-input batch boundaries, portable ownership, production custody, providers/SDKs and individually reviewed service views remain separate.

Selected composed native reference consumers now admit their input writers from authenticated retained definitions. Inspection text cannot substitute for the calculation; current endpoint rights and the original durable capture remain required.

Inherited Lineage changes now refuse while a native reference refresh is unresolved. Reconcile or explicitly unbind that original request before changing the definition. Completed captures and fenced outcomes remain inspectable after detachment and reopening, without carrying the old binding forward as authority.

Native device inbox ownership

The explicitly selected native device inbox now separates user/channel access, physical keys and retained-message reservations. Signed rotation keeps old ciphertext and receipts while pending originals finish; durable scoped revocation stops new work without taking another partition's rights or capacity.

A separate exact authorization can offer retained mail to the real saved model and original Process store while its evaluator is closed. Its signed receipt means retained for that model. Applying or executing the message still requires the existing Model/Process authorization and grant owner. External providers and SDKs, production custody selection, portable transfer and service-view presentation remain separate.

Disconnected native missions and authenticated return

The selected private-file development profile runs admitted native-operation Process images through the existing compiled runtime while the issuer is unreachable. Signed limits stop new work; genuine effect outcomes determine consumption and surrender. Authenticated return joins those originals to issuer settlement and activates one named online successor. Duplicate return changes no balance, and unknown effects must be reconciled by their original owner before return.

Original Model, Process, custody, grant and delivery histories survive the native return and nine hard-crash cuts. New departure reserves authority lifecycle slots and native return count/byte headroom without borrowing membership quotas. Forty valid paired native return samples meet the retained diagnostic budgets, with two compiler-presence exclusions and no source drift. Cross-node complete transfer, broader domain funding, production custody and the full platform matrix remain separate.

Simultaneous resources in PLAN

An activity can now reserve an operator and a machine together, choosing from alternatives for each named role. Write USING operator FROM [ana, ben] AND machine FROM [laser, mill], with optional demand per role. The compiler uses the existing simultaneous Planning runtime; calendars, capacities, precedence, repair and result publication keep their native behavior. Named reports retain the exact time scale across compiled-model reload. Scalar-only plans keep their existing payloads, and reading a plan reference does not run a solve.

Optional work and soft due dates in PLAN

Schedule lower-priority work with OPTIONAL PENALTY and charge lateness with DUE … PENALTY … PER. An explicit MINIMIZE total_cost combines makespan, omission costs and weighted tardiness through the existing scalar or simultaneous Planning runtime. Hard deadlines remain mandatory, and rates must convert exactly to native ticks. Reference reads still do not run scheduling.

Named optimization parameter axes

Use local PARAMETER profit[product IN products] = unit_profit views to write objectives as profit[product] * quantity[product]. One ordered axis maps a row or column vector; two map a matrix by rows and columns. Labels remain fixed while input values update reactively through the existing compiled solver. Complete array validation includes unused and cancelled reads. Explicit INDEX and both SOLVE block headers remain supported.

Scenarios and uncertainty in EXPERIMENT

Compare named scenario overrides across explicit or evenly spaced parameter sweeps. Seeded replications, per-run or per-step redraws, and chosen final-time quantiles use the existing compiled simulation runtime and result Frames. Definitions remain inert until explicitly run; live model inputs are unchanged and completed results retain native replay support.

Graph routes and DSP composition

Graph paths can be optional or negative, and optimal paths can follow an authored via route. Immutable rewrites can match multiple connected edges and check every resulting edit before publication. DSP filters accept sample-rate controls; pure helpers can process a bounded delayed feedback return. Explicit Render startup can pin matching-format WAV files and admit one live input. Model reads never open audio files or microphones. See the Graph reference and Signal reference.

Named parameter data in PLAN

Keep scheduling data in readable vectors and matrices with PARAMETER length[job IN jobs] = durations, then write length[:cut] in an activity. Text, symbol and integer keys follow declared domain order. Exact durations, penalties, capacities and other numeric fields are captured into the existing native definition at admission. Invalid shapes, unknown keys and mutable dependencies are refused. Explicit solve and repair operations retain their existing behavior.

Indexed resources and activities in PLAN

Write RESOURCE worker[person IN people] and ACTIVITY prepare[job IN jobs] to describe repeated scheduling structure once. Typed keys select members, AFTER prepare[job] connects matching jobs, and AFTER prepare[*] creates a barrier over all of them. Resource groups can use FROM [worker[*]], and calendars can address one member or the whole family. One or two finite axes expand into the existing native scheduling model; oversized expansions and invalid member references are refused. See indexed Planning declarations.

Simultaneous-resource PLAN search now skips branches whose optimistic cost cannot improve the current schedule. Fixed-slot workloads can prove optimality without exploring redundant activity orders, including after resident repair. Search budgets, optional penalties and canonical tie-breaking retain their meaning.

Reactive study settings and paired experiments

FIT and CALIBRATE now accept Grid expressions for numeric settings. EXPERIMENT adds equal-length DESIGN zip axes and named OBSERVE name = expression outputs. Studies expose existing integrator/time-unit settings; experiments also expose deterministic sensitivities, Monte Carlo selection, retained samples and source correlations. FIT remains reactive, while retained jobs capture their settings at explicit submission. See study notation.

Sequence-dependent setup in PLAN

Describe preparation that depends on the previous job: SETUP red labels an activity, and CHANGEOVER booth FROM red TO blue DURATION 15min reserves time before a blue job follows a red one. The reverse transition can take a different time. Scalar and simultaneous plans share native setup handling, including calendars, alternatives, indexed resources and resident repair. Durations accept immutable parameter data and must convert exactly to the plan's ticks.

Allowed combinations and fixed appointments in PLAN

Use CHOICE … DURING to offer specific resource combinations with finite occupancy windows, and FIXED AT to pin a work appointment. Indexed resource keys and immutable parameter data work in these clauses. The supported MINIMIZE omission_cost THEN tardiness_cost THEN makespan order prioritizes completing optional work before reducing lateness and finish time. All clauses use the existing v6 compiled runtime. See Planning choices and appointments.

Portable nonlinear fitted models

Nonlinear FIT results now carry their prediction formula with their fitted coefficients. Pass a model through a function, keep it in a record, select among models, or save and load its value in another model, then use the same MODEL.PREDICT(model, data) call. Prediction uses the existing compiled runtime and shared Table/Frame input contract. Imported programs are checked before execution; outer captures, arbitrary user functions and effects remain outside this profile. Older nonlinear result records need a refit to acquire their missing formula.

Transfer a native development installation locally

An explicitly selected Core profile moves a complete native model installation between two private local directories on the same filesystem. It preserves the original model, Process, key custody, grant accounting and outstanding deliveries. The source stops executing before files move; interrupted transfers resume their original preparation, and the destination verifies its complete original state before accepting ownership. Unknown effects are not resubmitted or refunded.

This is a private-file development capability. Keychain custody migration, cross-machine transport, external providers/SDKs and production installation remain separate. The coordination overview describes the selected scope.

Graph traversal policies

Paths can select trail AS traversal or simple AS traversal, and captured paths can project ordered edge properties such as trip.edges.minutes. Existing walks retain their defaults. Plural paths returns ranked route alternatives as a Frame using the existing objectives and explicit hop/output bounds. General row expressions remain separate, unfinished work.

Recover a never-issued native mission

The selected local development profile can close a reserved mission that never received execution rights and recover its original model, Process, grant and delivery owners into the successor named at departure. The issuer's original record proves non-issuance and returns the reserved capacity once. Recovery keeps older uncertain effects and pending deliveries intact; expiry, a missing record or a caller's claim cannot authorize it. External providers, cross-machine transport and production custody remain separate.

Shared numeric equations for fitting and prediction

Nonlinear FIT accepts checked numeric helpers and lexical LET, so one equation can serve ordinary calculations, fitting and dynamics. Computed arguments retain single evaluation, lexical names retain their scope, and exported fitted values retain prediction without helper source. Mutable/effectful captures and recursive helpers fail admission. Existing prediction programs remain supported; values with scoped locals require a consumer supporting numerical program version 2.

Reconcile original Ledger and Process outcomes

The selected local development profile can reconcile an escrow-backed Process with its original finalized ledger effect and execution-grant charge. Recovery after a lost reply or cancellation keeps the Process stopped and its history intact. Unknown outcomes cannot close capacity or trigger a replacement payment. Recipient surrender and issuer settlement preserve the original exact charge. External payment services, wallet lifecycle and production custody remain separate.

Local wallet lifecycle observations

The explicitly selected native wallet profile now reads money and execution capacity from their existing owners. It shows original allocation, reservation, consumption and surrender separately from confirmed issuer settlement. Unknown outcomes retain their reservation; a displayed balance grants no spending or execution rights. The original native ownership rules preserve history through Move/recovery and give Copy/Fork no inherited executable capacity.

This is a Core-local private-file development capability. It adds no Portfolio view, portable wallet manifest, payment service or production custody guarantee.

Local OPC UA observation delivery

The selected native development profile can deliver one admitted numeric OPC UA tag through an encrypted Ordered route into the existing model calculation. Source restart and lost replies retain the original observation and publication. Unsupported quality, conflicting retries and foreign checkpoints refuse.

Reading the calculated observation through a Process requires separate execution rights. An unknown outcome holds its original reservation until reconciliation; copying an observation or receiving it never creates another grant. This is a bounded local integration profile. Device certification, live provider rollout, other industrial protocols and production custody remain separate.

Local MQTT/Sparkplug observation delivery

The selected native development profile joins one admitted numeric Sparkplug metric to encrypted Ordered model delivery and separately authorized Process reads. Journaled observations retain their original identities through retry and restart. Birth aliases and wrapping protocol counters remain with their existing source owner; bad-quality death notifications refuse scalar delivery without inventing a replacement value. External brokers/devices, production deployment and wider protocol coverage remain separately scoped.

Local Modbus TCP observation delivery

The selected native development profile joins one admitted numeric Modbus TCP tag to encrypted Ordered model delivery and separately authorized Process reads. Journaled observations keep their identities through lost replies and restart; recovery does not substitute a new device read. Malformed responses refuse, and device exceptions remain pending source obligations. The legacy device hop is unauthenticated. Device writes, physical certification and production rollout remain separate.

Local BACnet and passive CAN/J1939 observation delivery

Selected native development profiles connect BACnet/IP and passive CAN/J1939 observations to encrypted Ordered model delivery and separately authorized Process reads. Journaled observations retain their identities through lost replies and restart. BACnet confirmed-COV release follows durable journal admission; partial J1939 transfers and capture loss cannot manufacture a delivered value. External device stacks, physical-bus certification, writes and production rollout remain separately scoped.

Native operator interface preparation

An explicitly selected native embedding can inspect original execution capacity, unknown-operation drain reasons and installed-key status, and surrender through the original fenced owner. The service transport retains exact original requests through lost replies and refused retries. The eight operator presentations are approved. Network's Control plane now offers an approved Document operators launcher for existing native Wallet allocations and Process operations. Selection and inspection are explicit, notes survive navigation, and delayed replies retain uncertainty. Other service connections, monetary balances and issuer settlement remain in progress. External providers and production deployment are unchanged.

Improvements

File import decoding now binds frozen fields once and fills typed column batches. CSV scans ordinary byte runs together; NDJSON avoids generic scalar row objects, and Pro batches struct and numeric-list construction. Strict validation still covers discarded rows, Unicode escapes, nested nullability and numeric exactness. These local source changes preserve the agreed reader behavior; packaged delivery and whole-product release performance remain separate.

CSV/NDJSON import buffering has also been reduced in the local source candidate. Leading row windows retain only selected rows while still rejecting malformed or incompatible later records. Pro constructs native columns without an intermediate IPC round trip and uses temporary disk storage for one remote fetch. The accepted inference and discovery rules are unchanged. Local memory measurements improved; performance remains below the historical native Polars reader. This does not claim packaged delivery or publication.

Named SOLVE models now retain sparse coefficients through compilation, compiled execution and report construction. Variable bounds are native, including negative and fixed bounds such as [-5, 3] or [-2, -2]. Large sparse models no longer allocate a full constraint matrix or turn bounds into extra rows. The named result keeps its fields; its nested report is v2 with compact CSR coefficients and actual variable bounds. Positional LP/MIP report calls retain their dense v1 format. Existing report views recognize both versions, and study comparisons refuse marginal predictions when native bounds change.

SOLVE now reads reactive costs, resource coefficients and signed bounds from fixed-shape numeric arrays with INDEX(data, row, column). Numeric index binders expand against checked dimensions; invalid shapes or values refuse the solve and recover after a valid update.

Portable capacity checks preserve the committed revision and allow a valid update to recover after a refused oversized request. Browser-local source inspection now uses a speed-optimized parser build.

The compiler front end does less repeated work on ordinary models. Statement heads, bracket indexes, LEFT/RIGHT text calls and ordinary MATCH lookups are read once instead of being parsed speculatively and then again, stored callable checks no longer rescan every binding, and lifted programs reuse their name tables. Function-heavy models parse several times faster and large models lift about three times faster, with far fewer allocations and the same results and diagnostics.

The native runtime now stores expressions in packed arenas and uses checked MIR facts to combine compatible number, Boolean, calendar, datetime and text calculations. Eligible calculations reuse intermediate buffers and share private producers. Existing compiled model files, results, coercion and lazy branches keep their contracts.

Model compilation uses fewer temporary allocations during type analysis. The compiler can also discard unused, self-contained numeric and Boolean work in constant IF expressions while preserving error and warning behavior.

Generators run by the authoring worker can now read a parsed grammar tree by name. The worker admits structural PATTERN declarations and TREE.MATCH with literal result and work limits, and refuses the other tree declarations, which it previously accepted but could not use. The invoice example finds its quantity and price this way.

Formatting a View no longer waits for its libraries. The formatter reads an element whose declaration is unavailable, such as a React import without its lock, by shape instead of leaving the file unformatted; compiling still requires the import and its lock. A contract phrase that begins with show, such as react-day-picker's show outside days, is now read as the element's phrase rather than as a show placement.

The same menu stays mounted when its width changes. Pages search expands when focused in the narrow menu. Long destination lists scroll vertically. System and Network retain their shared destinations with or without a loaded model; during passive takeover, area navigation returns to the page.

The selected private development profile for distributed model coordination now connects native and Node participants and real Grid models over Ordered and Latest HTTPS delivery. Original publications and receipts survive reconnects, key rotation and transport changes; signed retirement permits explicit provider payload reclamation. An additional selected stream lifecycle profile supports atomic subscription frontiers and fresh Latest baselines, signed supersession receipts, and fair explicit polling across bounded feeds. Rejoining retains old delivery debt; capacity limits refuse new work without discarding originals. Selected participant maintenance now compacts duplicate capture storage while preserving original retries and receipts. Departing receivers retain their closing frontier and late debt; native bulk custody survives audience replacement. The private provider contract is versioned with shared retention and replay conformance. Public-provider storage preparation adds separately selected native DynamoDB/S3 adapters with local fault coverage. Native public-provider integration now connects explicitly selected AWS SDK transports and authenticated HTTPS to signed public receipts, generations, receiver ACKs and retirement. Native and Node clients retain original custody through these paths. This is locally tested integration; no AWS provider has been deployed or published.

An explicit macOS trusted-OS profile now keeps external participant keys and enrollment in native Keychain and retains delivery state through the shared native storage owner. Certified rotation preserves outstanding captures; revocation, replaced keys and stale enrollment refuse. Restart fences retain the last operation time and enrollment generation. Native authority checkpoint maintenance also supports Keychain custody. Stronger hardware or hostile-OS guarantees remain unsupported, and no production installation is claimed.

An explicit native remote Process development role binds direct requests to certified model identity, original saved executable revisions and existing grant and custody owners. Completed outcomes and receipt acknowledgements survive source/target restart and adapter retirement. An uncertain external command is reconciled through its original owner and is never replaced. A separately selected private mailbox carrier now retains encrypted requests and outgoing outcomes through lost replies and crashes. Switching between admitted direct and mailbox routes preserves the original operation, receipts and single grant owner. Independent mailbox providers/SDKs and broader remote-service profiles remain separately scoped.

The explicitly selected private-file development profile now retains original keys and receipts through rotation and revocation. Revoked keys cannot start fresh work, while original owners can reconcile and close outstanding operations. Native recovery and same-volume installation moves retain those owners; fenced storage replacement preserves their original history. Production credentials and provider installation remain separate.

Bug Fixes

• Undo or Redo right after an edit no longer opens "Another session changed this model" when an update notice arrives while the change is saving. The change is kept; a real save from another session is still reported.

• Cell formats, conditional rules and visuals no longer disappear for a moment after the model source saves, so Fill formatting only down and similar commands work right after an edit.

• Lite file materialization now applies row limits and slices in order and preserves column names and types when a selection returns no rows. Default previews use 100 rows, matching Pro.

• Server Lite now uses embedded lightweight AI and CPU training, including the built-in small MLP trainer. Standalone AI/training and cloud ingress workers remain Pro-only; Lite no longer packages refusal executables. Explicit process selections with missing workers fail before the server starts.

• Server Lite image recipes no longer compile or bundle the Pro-only ADBC and Flight SQL warehouse adapters. Basic PostgreSQL and Redis support remains in both editions; Pro keeps both managed warehouse adapters.

• Desktop build recipes now explicitly match the bundled CLI's local solver and tensor selection to Lite or Pro. Lite omits the Pro-only HiGHS backend; Pro selects the full solver feature chain and tensor support, with GPU backends selected by platform. Commands such as source eval continue to execute on the selected host. This does not add standalone ETL or training services to the CLI.

• The product host's packed model admission admits models at the deployment's scale. It had been sized by the extension sandbox budget (64 MiB, 50 M work), so any model near 200,000 cells was refused with GRID_TREE_OPERATION_INTERRUPTED: packed image exhausted its original operation. The admission budget now follows GRID_LIMIT_PROFILE and its overrides, the admission ledger charges what admission actually requests (a 200k-cell model's ledger fell from 5.6 GB to 0.38 GB), and each cell's scalar program is compiled once instead of four times during admission. Decoding no longer builds a kernel-method validation index over every op: it builds one sized to the decision records, and none without them, which makes every load faster, packed or not.

AST.RENDER output now parses back to the same syntax. Infix operators keep their operator spelling instead of becoming function calls. Path routes and graph patterns keep their grouping and anonymous entities. Notes on any declaration survive. Forms such as CHOICES, DECISION Name(...) and EQUATIONS Name keep their authored spelling. Syntax that would come back different, or that nests deeper than the parser accepts, now refuses to render instead of rendering incorrectly.

• A line break inside an open call argument list, MATCH, array, object or comprehension continues the expression before or after a binary operator, as the language reference documents. SUM(1 + followed by 2) on the next line no longer fails with expected expression. A DO block nested in brackets keeps one binding per line.

• The formatter keeps a postfix spill marker, so A1 = B1# no longer formats to A1 = B1.

• A refused CHOICE declaration, such as one named with the reserved word Left, is reported once. A later generic CHOICE whose field names that family is withheld instead of reporting it again as an undeclared field type.

• Manual shared PART updates consume exact accepted captures of a newer source definition. Unselected groups retain their source revisions and values, and updates after partial detachment preserve cold replay and exact retry.

• Explicit shared republication installs its newly accepted values, preserving private inputs. Detachment and exact Original retry retain the accepted publication baseline without restoring older slot values.

• Selected native reference capture replays saved compositions from their retained compiler inputs, so inspection text cannot replace the effective calculation. Current custody, executable and endpoint/export checks remain required.

• Same-document shared exports can use a saved composed producer's authenticated retained inputs. Only accepted values enter the receiver; inherited definitions and ancestor access remain with their original owners.

• Exact native integer and decimal values retain their precision through Lineage definition replay and shared capture reconstruction.

• Selected native Lineage scalar profiles retain temporal values, percentages, basis points, angles, data sizes, built-in units and currencies through definition replay, shared publication, Copy/Fork, cold reopen and detachment. Private typed STATE and cached ONCE values remain distinct through inherited updates. Imported inputs with different units require explicit resolution instead of silently changing the inherited interface.

• Selected native Lineage publication can turn accepted same-document captures into read-only shared slots. Fresh captures update normal compiled-model dependencies; blank values, cold restart, exact retries and terminal unbind preserve the accepted result. After explicit unbind, native detachment can preserve the latest accepted values as local readonly definitions without losing private inputs. Same-document Copy/Fork keeps fresh capture provenance for later detachment without copying live bindings or Original receipts. Local producers can calculate shared exports through explicit local PART imports without transferring supporting definitions or private inputs. This development capability retains current custody checks; broader remote/resource integration and full Lineage acceptance remain open.

• Selected native Lineage publication and cold replay now share the canonical static-call, primitive-type, STATE and ONCE definition codec. Existing pure publication identities remain unchanged. Broader Lineage product integration and platform/cost verification remain in development.

• The native Lineage command interface now carries composition, update and detachment through the authenticated document gateway. Its web adapter retains the original request after a lost reply and requires current-window confirmation before adopting a committed model. The selected App owner verifies the native window and saved binding, replays the retained composed program, and adopts through the existing source/cell/stream path. A later Save cannot reuse an older Original as current-file authority. A same-lease native staging refusal releases the request for fresh review only after the owner establishes that no Original committed and no transaction is pending. Uncertain publication and adoption outcomes still retain the exact request. The independent CLI reports the same bounded refusal as JSON without rewriting the request file. The approved native authoring section supports reviewing composition, updates and detachment through those owners. The selected workspace shares an action guard across authoring, restore and file mutations, retaining uncertain operations when tools close and preventing normal navigation from discarding them. Exact retries respect other drafts; file tools refresh after full adoption. Encrypted, ancestor-chain, override and shared-binding controls remain outside this initial section.

• Selected native Lineage definitions now preserve local sheet identity through composition, replay, update and detachment. Equal cell addresses on different local sheets retain distinct owners; foreign workbook and machine references still require their separate admitted capabilities.

• Selected native Lineage retains Tensor declarations through compatible updates, detachment and cold recovery, including exact physical contracts and unchanged named input, DEFAULT and STATE values. Mutable shaped declarations keep their current overrides instead of being overwritten by promoted base formulas. Trainable, external and device resources retain their separate owners.

• Selected composed scalar models now retain authenticated definitions through participant exchange and cold replay. Composition, inherited updates and detachment reuse the original bounded exchange scan and native command receipt; pending work keeps recovery routes, and changed commands cannot take over.

• Configured native Registry collections retain explicit source failures and individual receiving receipts. Retrying the same source operations reconciles partial delivery through the existing native input writer; document reopen retains the Original under renewed certified owner epochs. This selected local profile adds no visual control or collection-wide atomic transaction.

• Named native Registry collections pin the current name owner, generation and exact selection before delivery. Publishing a collection name retains an accepted Registry selection in the existing native Original; retries and document reopen preserve receipts. Retargeted or retired names refuse collection use. Names grant no source-read or input-write permission.

• Rules can declare stable names with RULE <name> and join a Lineage PART through explicit membership. Inherited WHEN, EVERY and AT instructions execute with the child's own state and permissions. Named instruction updates preserve completed run accounting; action-only changes keep trigger history, and detachment retains child-owned state. Pending work must settle before an incompatible transition. Shared captures remain read-only to rule actions.

• Named-rule source patches now report edits in the rules section. Compatible selected Lineage updates retain child-owned range values, including local sheets, and newly added rules can target existing pure cells. Changed retained bases and pending work still refuse; removing nonempty rule history remains unfinished local work.

• Accepted local Lineage compositions can retire settled named rules while retaining child-owned history and run counters through Save and reopen. Reintroducing the same name retains accounting; pending work still refuses. Readonly shared captures now also retain local-sheet names such as Pricing!Price through publication and detachment.

• Selected native Lineage inspection separates creation ancestry, exact PART definition origins and retained capture/unbind state. Native CLI consumers preserve the original operation IDs and returned document leases. The approved inspection view is available in selected native file tools, and lineage prepare constructs authoring graphs through the native compiler. Saved sibling sources can be inspected without readmitting their runtimes, and the approved inspection remains available through the retained-restore file-tools wrapper.

• Selected native Lineage composition retains pure user-defined functions, including inherited calls, compatible replacements and source-free detachment. ONCE migration checks the actual transitive callable bodies before preserving cached values. This uses the existing native compiler and compiled-model runtime.

• Selected native Lineage callers can enroll their original Process/grant owners and detach inherited parts through the existing RPC. Cold reopening and exact retry preserve those owners; unsupported combined profiles still refuse.

• View actions carry current local arguments to the Host.

• Fresh and cold compilation preserve the intended revision behavior.

• Background Host updates preserve private Form drafts, focus and text selection.

• Capacity refusals preserve the committed state and permit valid recovery.

• 0bp and other zero unit literals read as zero with their unit instead of as an incomplete binary number.

• The then-branch of condition ? value : other accepts AND, OR and NOT expressions, matching THEN/ELSE.

• Reduction prefixes such as +/ values[1:3] apply to the complete index or slice chain.

• An ordinary MATCH(value, -5, 0) call whose lookup array is negated or parenthesized parses as a call instead of failing.

• DO blocks accept CRLF line endings between bindings.

• Quoted object keys decode escapes exactly like string values, so {"say \"hi\"": 1} and GETFIELD(o, "say \"hi\"") name the same field.

• A literal OFFSET past the last workbook row folds to #REF!, as a column past the last column already did.

• Very large unit-suffixed integers keep their digits instead of saturating.

• Long right-nested ^, ? : and OF chains report the parser depth limit instead of exhausting the native stack.

• Copying a deeply nested JSON report payload is refused at the compiler's depth limit instead of exhausting the native stack, and long numeric spellings decoded from wire payloads are charged to the same workspace budget as their copies.

Desktop shared-menu frames reserve the native titlebar strip above the left rail and retain the full navigation row at compact desktop widths.

Narrowing the workspace menu keeps its working destinations available. Search results retain page and group names for assistive technology.

macOS document staging validates the opened source file before copying, refusing final symlinks and special files. Archive formats and recovery ownership are unchanged.

The selected public-provider pilot now has a bounded native loopback host, explicit operator credential renewal, persistent API-request accounting and receipt-preserving resource/assessment tools. These are locally validated installation preparations. No AWS deployment or live regional assessment has been performed; paid execution and production hosting remain separate.

Compatibility and Migrations

• Custom Lite ETL plans must use rows for HEAD limits. The former Lite-only n option no longer overrides that setting; without rows, the limit is

  100. FRAME_VIEW also defaults to 100 rows, COLLECT honors an explicit row limit, and slices now apply their offsets. Public worksheet function signatures are unchanged. Both readers now use 1,000-record inference and reject late unexpected fields. Opt into full-file discovery when needed. Unknown reader options and malformed records are refused rather than silently ignored or repaired; see the file import guidance for migration.

• Existing Server Lite configurations that pin Pro worker commands must remove those pins or explicitly select embedded AI/training. Direct invocation of the removed Lite placeholders now finds no executable. Service opt-outs and basic PostgreSQL/Redis support remain available.

• Custom Server Lite scripts that directly invoke the bundled ADBC or Flight SQL executables must select Pro. PostgreSQL and Redis commands are unchanged.

• Lite CLI local checks that require mixed-integer solving now use the existing missing-backend diagnostic instead of bundling HiGHS. They do not silently relax integer constraints. Desktop builds require a CLI revision declaring the new lite/pro feature bundles; an older selected revision is rejected before compilation. Full standalone Pro service execution and the remaining engine-tier migration are separate work.

Existing native formulas and the 81-name portable admission catalog are unchanged. No source migration or new Host authority is introduced.

The V3 compiler's public data contracts now carry their final labels: grid.compiler.source.v3 for syntax artifacts, grid.compiler.native-expression.v3 for native stage results, and grid.compiler.wasm.v4 and grid.view.local.wasm.v3 for the browser packages. The earlier -dev1 labels and grid.compiler.wasm.v3 never shipped in a published release. An artifact that still carries one is refused as an unknown contract; produce it again with this release.

A VALIDATE clause must use one of the documented heads. A brace array such as VALIDATE {2, 3} or a bare VALIDATE 5 used to compile with the clause silently dropped, leaving the cell with no write contract. It now reports GRID_PRESENTATION_VALIDATE_CLAUSE; write a list as VALIDATE IN [2, 3].

No calculation behavior, model format, or evaluator changes are introduced by this menu update. Compact windows retain their layer-menu popup.

Distributed model coordination additions require explicitly selected native capabilities. Development profiles retain private-file keys; the separate macOS external-participant and authority profile trusts the OS and uses Keychain. They do not change ordinary calculation semantics or establish live public-provider deployment, universal production custody or complete distributed model coordination.

Known Issues

• Portable execution is limited to its admitted pure-call catalog; it does not grant browser access to Host resources or effects.
• Some transcendental results differ in the last floating-point bit between native and browser platforms.
• Very large browser-local source inspections remain synchronous. Browser memory usage still needs further review; no universal performance guarantee is made.
• This release makes no download-size or universal performance guarantee.

Title initials can be ambiguous; hover or use the wide menu to distinguish them. Conversation deletion controls are smaller than the primary navigation targets. Packaged desktop availability and website delivery remain separate operations.

Deferred to Later Releases

Planned work that did not ship in 0.74.0. Each item stays on the roadmap for a later release.

• Native and package size. The size target is unchanged; no size work was done in this release.
• Packaging boundaries for heavy native dependencies, which still add to startup memory.
• Faster import-scale commands that avoid an intermediate transfer format.
• Operator views for distributed model coordination and execution grants. The eight approved views stay inactive until their service connections, hosting and navigation are complete.
• Final validation evidence for execution grants, including fault and recovery runs on Linux.
• Moving a native installation between machines. Moving it on one machine ships in this release.
• The hosted cloud mailbox, the public provider and its SDKs, key-custody options beyond the macOS development profile, and Windows and Linux performance evidence for distributed model coordination.

Documentation Updated

Graph documentation now distinguishes bounded query prefixes from atomic rewrite edit limits, describes the current parameterized views and connected multi-edge rewrites, and corrects the query-planner description. TREE guidance distinguishes available features from outstanding feature-graduation evidence; the former cancellation and codec repairs are recorded as complete. These are documentation corrections, with no language or runtime change.

The compiler-tools guide describes portable call coverage, action arguments, draft preservation, platform-dependent floating-point precision, the tree functions and declarations the authoring worker admits, and what AST.RENDER guarantees about rendered text.

Public guides, the language feature matrix and release history now describe compiled models and native components in user terms and no longer link into internal records. A new distributed model coordination overview replaces twelve engineering guides in the public docs; those guides remain available to maintainers.

The interface-layers guide explains matching menus, title initials, retained selection, and narrow page search. Cloud and Dev editorial review and imports remain pending; Books and Pro remain on hold.

Grid 0.73.1 — 2026-10-15

Summary

Grid 0.73.1 brings the approved workspace navigation and motion changes together with native document Receiving fixes. This version identifies source changes; packaged publication is a separate operation.

What's New

• Pages has a wider menu for authored groups and pages, with search across page titles, namespaces, and group names. Keyboard navigation and existing history and unfinished-work guards remain available.
• The Grid mark opens Chat, Pages, Code, Data, and Home. A distinct stacked-pages icon controls the Pages menu; companion and global layouts retain their navigation.
• The menu pin remembers its setting across reloads and workspace changes, with a subtle icon color indicating the pinned state.
• Home puts System and Network directly in its desktop and compact workspace menus, including while a model remains open in the background.
• Cinematic transitions cover supported workspace and Search transitions. Saved Quick choices remain intact, and system reduced motion takes precedence.
• Reviewed dialogs, workspace menus, Pages drawers, Grid View Modal/Drawer/Menu surfaces and the grid context menu retain rounded panels and selected state through coordinated entry, exit and interrupted reopening.

Improvements

Review fixtures, recordings, source identities and local regression coverage accompany the workspace changes. Technical report QA includes received-document capture, archive Save and reopen.

The approved Media inspection R1 panel connects owner-admitted native camera sessions to Run/Stop, color preview, completed analysis and retained recordings. The built-in macOS camera flow includes authenticated artifact download and preserves annotation drafts. This remains selected native development; packaged Desktop verification and SDK distribution are separate.

Bug Fixes

Data takeover uses its built-in sheet tabs without a duplicate floating layer menu. Restoring workspace controls preserves the docked menu width and cell drafts.

Cinematic layer transitions preserve rounded corners. Search opens and closes as one panel, without the brief doubled-backdrop flash; rapid reopening continues from its current position. Resizing clears stale animation snapshots.

Reviewed surface handoffs connect the grid context menu to Plot selection and authored right drawers to their detail dialogs. Returning retains drafts and focus; leaving the overlay stack retires both panels together. Interrupted handoffs keep their rounded edges and current pose, with one backdrop in every motion mode.

Account and access settings use a full-screen takeover with one Close button. The header stays visible while the account controls scroll. Keyboard focus stays inside and returns to the opener on close.

Explicit native HTTP Receiving selection accepts its startup flag and routes selected Copy operations to the existing document owner. Technical report replay and retained PDF evidence preserve their exact bytes across checkout platforms.

Connection and extension dependencies include patched TLS, QUIC and WebAssembly components.

Compatibility and Migrations

These changes retain the same calculation behavior and existing model semantics. Motion falls back to direct navigation for unsupported captures. Investigation snapshots and review tooling included in this source revision do not establish additional product availability or performance guarantees.

Known Issues

Native/media, companion and oversized motion captures use direct navigation. Website imports and publication of these documentation updates remain pending.

Documentation Updated

The interface-layers guide describes Pages navigation, search, remembered pinning, and motion preferences. The technical report example documents explicit Receiving startup and local replay. Historical review and investigation records are retained.

Grid 0.73.0 — 2026-10-12

Summary

Grid 0.73.0 integrates signal equalizers and response inspection, optional Rerun simulation inspection, Media language and runtime development, and reproducible Typst publication tooling. This is a source candidate; packaged availability and native acceptance depend on the selected product.

What's New

• Portable browser compiler packages now use the shared native parser and compiled-model evaluator for explicitly admitted View-local computation, with imported grammar inspection, stale-safe local state and generated browser bindings. Host effects and shared model state remain with the authorized host.

• The live compiler inspector requires V3 owner reports and rejects retired V2 trees. Fresh native composition consumes V3 records directly while stored definition and historical Ledger formats keep their existing identities. The final legacy compatibility assertions now have original-fixture proofs, including all 129 unary owners at the original 128-edge syntax boundary.

• V3 inline Lua bodies now accept typed scalar lists and reductions. Eligible pure numeric/boolean scalar MAP calls use bounded automatic batches, with exact scalar fallback for stateful or unsupported bodies. New batch models require compiled model format minor 27; existing scalar source identities remain unchanged.

• Opt-in Luau and C/Rust/AssemblyScript core-WASM V2 Pilots add exact integer and null transport, reviewed shared host functions, sticky cancellation and bounded preparation. The explicit worker uses a bounded executor and commits independent results as they finish. Existing scaffold defaults remain V1; broader platform and Performance acceptance remains under development.

• Code retains analyzer errors and reviewable fixes when their source location is unavailable, without inventing an editor marker or navigation position. Environment refreshes and document ownership changes revoke obsolete analyzer findings and checked previews while preserving drafts.

• Signal EQ chains support bell, low/high shelf and notch filters with cell-driven frequency, Q and gain, plus native/HTTP response inspection.

• Optional simulation capture and Rerun export correlate poses, observations, accepted inputs, rule events and metrics on simulation time.

• Developing Media blocks and analysis functions share a native contract with explicitly selected GStreamer workers, source ownership and recording recovery. Catalog presence does not imply complete product availability.

• Opt-in Typst tooling retains source equation sheets, historical Symbolic displays and supported native Notebook captures in reproducible PDF bundles.

• Authored spatial reference models demonstrate simultaneous finite-capacity evacuation and seeded SIR contacts with workbook feedback and independent Euler curves. Deterministic runs use the existing saved Map/Scene journey.

• Authored Euler ensembles run with independent seeds and frozen external populations. Retain actual replica paths and explicitly select one geometry Frame with its workbook observations. Native saved playback retains and pages original replicas through restart and portable import. Approved Map and saved Scene replica pickers show the original seed and preserve replica selection through handoff and saved view data. Wider authoring and the full large-population performance envelope remain future work.

• Experimental Programmable CAD M2 now includes dependent workplanes/sketches, exact curved regions, approved source-preserving authoring and reference repair, targeted machining, body operations and exact rational placement through native saves and STEP. The face-sketched bracket and multi-body enclosure remain fully editable through code and workbench controls, including dependent dimensions, body selection, repair, history and restart. Local acceptance covers all 34 M2 requirements. Exact preview sampling and repeated-point placement meet the unchanged local performance budgets while retaining identical scene, measurement and STEP hashes. Profile/platform limits remain documented; Experimental maturity and product availability are unchanged.

Improvements

• Browser-local actions publish complete batches before notifying controls. Local CHECK steps replay and reset local state. Source-free compiler transactions can select and transform generated categories under one bounded allowance, with whole-module checks and atomic, stale-input and cancellation refusal.

• Ordinary compiler View execution and editor transactions use retained native owners. Old span-based execution adapters now require explicit historical Ledger-v1 build selection. Fresh V2 consumers are retired; versioned stored formats and historical verification remain isolated compatibility boundaries.

• Selected native distributed model coordination now admits issuer allocations into the original grant Owner, consumes them through actual compiled-model Process operations and settles authenticated surrender against original execution/effect receipts. Complete same-node handoff retains Model, Process, custody, accounting and pending delivery together; unknown outcomes keep their capacity reserved. Cross-node transfer and external SDK/provider implementations remain separate.

• Grid analyzers attach compiler-checked suggested fixes to the exact inspected payload. Review preserves invalid candidates and individual refusals; staging rechecks source and dependency identity before editing. Declared template slots splice owning module declarations and inspect each generated occurrence back to its retained template and input. Native callback, comprehension and SQL bindings preserve hygiene; mixed lists retain named arguments and spreads. Categories requiring unavailable import context still refuse.

• Explicit native coordination development adds secure Latest scalar input alongside Ordered delivery with separate stores and bounded attempt capacity. Latest skips delivery gaps without replaying stale model input; unresolved mutations and original Ordered ciphertext/receipts retain their identities across restart. The profile uses the existing pinned HTTPS/TCP transport. Public installation, other transport profiles and comparative Performance remain outside this increment.

• Authenticated hosted Forms use the shared combined submission and Undo/Redo controls. Native storage retains complete results and principal/source-bound history across service restart; lost replies reconcile the same submission. This development adapter requires ordinary durable hosted ownership and keeps organization/protected and selected distributed authority requirements intact.

• Independent CLI development adds signed native Process inspection and explicit reconciliation of an original operation revision. Lost replies retain the same root/operation; the CLI never automatically restarts or replays source. The complete V3 authority/reference and participant operator surfaces remain open.

• Internal coordination control development adds startup-selected bounded peer/seed rotation, request/body limits and restart-stable scheduling. Selected network waits release the existing control-store lock. Failure detection, production admission and measured performance remain unfinished.

• Internal coordination authority development adds indexed coordination-record CAS, original receipt recovery and signed snapshots of actual quorum-backed or explicitly observed reads. Local fixed-voter TLS/process recovery checks do not install a public service, complete the required operations, or establish production custody/performance.

• The developing native model bridge for distributed coordination can retain encrypted scalar input while a model is closed, apply it through the existing native compiled-model owner, and preserve its calculated export and original receipt across subscriber restart. The selected native and Node symbol SDK adds native encrypted direct delivery, durable local withdrawal and bounded gap/reconnect work. Original empty-fanout output can continue through the existing native retirement owners. Explicit permissions and native custody remain required. Symbol mailbox composition, renewal/rotation, full receipt retirement and comparative performance remain open.

• Added an internal native V3 decision Open operation installation with original pre-dispatch evidence, actual application ownership checks and existing Process acceptance journals. Recovery and public/remote routing remain unfinished.

• Internal native decision Open inspection now replays settled original issued results without live authority, key preparation, clock reads or quorum work. Pending and Unknown boundaries still refuse settled replay.

• Explicit Process Resume can restore original native Open received results and issued identities through the existing successor writer claim. Original deadlines remain binding; unresolved sends and partial issuance still refuse.

• Internal native decision Open now connects explicit stopped original-outcome lookup to Process inspection and reconciliation. Lost replies can recover exact existing issued results without another send or signature; Source stays stopped. A complete original native outcome can finish a valid partial result under its original issuer budget and fenced lookup. Missing quorum or native outcome ownership remains Unknown; conflicting prefixes and expired authority refuse.

• Internal stopped Open recovery now also restores original business rejections and finishes valid partial rejected results. The retained native rejection must match the original quorum outcome; missing or altered local records remain fenced. This adds no resubmission or automatic workflow continuation.

• Developing V3 decision Open replication now pins its signed deployment, verifies native source evidence on replay, and preserves the exact original envelope before dispatch and with the committed outcome. Native composition is covered with fixture transport/adapter; public installation, Process acceptance, other decision mutations and finality remain in development.

• Developing V3 decision Open source evidence now binds the original Process operation and completed input through guarded key custody. Recovery preserves the original signature. Validator admission and public adapters remain unfinished.

• Developing V3 native policy/input resources now bind verified deployment and durable Process provenance before Start. Their bootstrap fence preserves later operation fencing and reserves complete Open result capacity. Public installation and committed workflow proof remain unfinished.

• Developing V3 native decision input production now preserves exact completed Process values and verifies original durable history without re-inference. Public input references, policy producers and the complete workflow remain unfinished.

• Private V3 Open recovery retains the original command and signed deployment atomically with the original outcome; native issuance refuses deployment substitution and missing legacy packets. Public installation and full recovery remain unfinished.

• Developing native Open result issuance now requires the actual fenced issuer, original retained outcome and current native source/controller. Receipt identity pins the original outcome and deployment. Public installation and complete joined workflow proof remain unfinished.

• Developing native operation issuers can now hold the original pending Process writer through durable result append, preventing Stop from racing a later append. Original retained results remain inspectable. Public Decision Open installation and complete workflow composition remain unfinished.

• Developing native Open publication now binds durable retention and owned issuer capacity for its exact three outputs. Long-lived adapters can retain that budget using existing issuance and recovery semantics. Public issuance and complete installed composition remain unfinished.

• Developing native decisions now reserve original Open retention slots before dispatch and require their native token at publication. Competing operations share a bounded durable quota; timeout and Stop preserve uncertain originals. Public issuance and installed composition remain unfinished.

• Developing native decisions now freeze Open's original command, time and deployment before dispatch, and require the same packet at outcome publication. Lost replies and Stop preserve the original. Validator admission, public installation and complete recovery remain unfinished.

• Developing native decisions now retain Open's original business receipt with its reference and input in one durable transaction. Recovery preserves the original outcome and position. Public result issuance and live delivery remain unfinished.

• Developing native decision assessments now check the original input schema and canonical value codec, retaining readable input alongside its audit envelope. Private attachment requires both native packet bodies and committed input pins. Live delivery, public operations and complete installed proof remain unfinished.

• Developing native decisions now retain original input and deployment references atomically. Private assessment admission requires the original native input material in its accepted replay packet. Live delivery and public operations remain unfinished.

Selected V3 decision development preserves each reference’s original network, epoch and input association through durable native Process recovery. A committed Open reader supports human-only decisions and zero AI budgets. Public issuance, original AI input delivery and the complete installed workflow remain unfinished.

Selected V3 decision development authenticates the original native DecisionRef against the shipped Open producer and assessment export, then joins it to the actual committed decision scope and current seat permission. Original AI input delivery, disclosure, signing and public operations remain in development; the complete installed composition is unproven.

V3 development adds builtin <lua type="number"> tags, with string and boolean results and explicit reactive template operands. Lua-equipped runtimes need no USE line. Portable source is revalidated and prepared for each admitted model revision through the existing extension runtime. This scalar pilot does not complete TREE DSL producers or package Wasm language compilers.

Bounded compiler tools now share selected lexical work reservations and reuse private generated framing. Native refactoring reports compose exact serialized resource summaries while retaining complete input validation and sticky atomic refusal. Full original Performance acceptance remains in progress.

Compiler V3 development connects imported Grid syntax handlers, actual owning module/expression inspection and an independent Python generator to the native compiler. The pricing example composes live inputs, imported Process kernels and contextual Views. The literal, reference, operator, call and plain declaration constructors now return actual compiler owners and run under the same bounded native handler implementation. Quotation captures actual owners before semantic lowering; template expansion uses the same hygiene pass and returns owner artifacts with separate generated text and origins. Generate admits expanded modules directly. Handlers can inspect and rewrite constructed owners under the same cumulative budget, and their modules may also declare Processes while staging remains subject to native callable restrictions. Source, syntax, HIR, mir and lir module handlers now use the same native receiving contracts; missing host custody or resource providers refuse. Whole-compiler acceptance and original comparative Performance remain unfinished. Canonical inspection now returns those same owners with separate source locations, and Generate compiles owning module output directly in the isolated worker. Public checking and the native compilation entry points for the old projected canonical tree are retired. The syntax audit now uses actual owners in every mode; its projection/reconstruction branch is removed. The source-emission trait, generated callbacks, View and Process source generators, grammar-body reconstruction and temporary source buffers are removed. Native owning admission replaces those paths; historical Ledger and stored-definition formats retain their identities and restrictions. Native hosts can inspect source-free compiled snapshots by native root and operand path. Meaning retains the admitted program, resolved callable/capture identities and compilation revision after input buffers and the resolver are dropped. Changed artifacts or imports invalidate old selections; assignment proofs remain on their exact root. Revision-bound native stage origins, receiving links and available producing pass facts are retained. Unproved or invalidated facts remain partial or withheld. Complete call/value OF expressions keep native checks after owner transport and structural rewriting. Adjacent model FORMAT policies now retain their live inputs and metadata after portable owner transport. Contextual NEEDS continuations retain the control's disabled condition and reason. New ledger source bundles retain V3 owners; existing capture artifacts retain byte-exact historical verification through the same native compiler. The capture format changes bundle identity without changing the executable compiled model. Historical capture reports now have a versioned Ledger adapter; legacy module inspection can no longer produce sealed compilation inputs. Native owning-module construction also retains host extension manifest identities and importing context, refusing changed or revoked inputs before literal expansion. Native compilation expands those literals once; cold compiled-model loading and live input updates preserve their results without invoking the provider again. Projected reconstruction-service dispatch is removed; compiler capabilities belong to actual owning artifacts. Native definition capture also uses the complete V3 recognizer; the separate R1 parser is removed while stored definition identities retain their frozen codec. Native composition and input-state migration now compare actual compiler owners directly, preserving exact values, types and declaration policies without reconstructing legacy syntax. Existing authority and state-transfer checks remain. Internal native continuations also retain their storage budget through encoder buffer growth and final assembly, refusing before an over-budget allocation or output publication. Late execution-shape and dependency traversal also observe the retained work allowance and cancellation. Complete native resource coverage remains in progress. Selected native editor development now shares one logical allowance across index construction, behavior metadata and final publication. Numeric gestures can supply several missing component arguments together, preserve untouched formulas/comments, and validate one combined candidate. This remains internal work; public editor activation and complete physical-cost acceptance are open. Expression meaning now uses one production admission for source facts and compiled checks, including the host resolver context. Semantic queries reuse that program without building View editing catalogs. Check and compiled meaning now report a separate compilation revision for actual resolved inputs and emitted results, while preserving source and artifact revisions. Native hosts can retain one source compilation snapshot for repeated meaning queries without repeating imports or lowering. Source-free meaning, complete retained pass facts and selected resource acceptance remain in progress. Supported expression owners now render directly to source through AST.RENDER, including calls from registered handlers. Rendering preserves authored numeric spelling and uses approximate notation for synthesized numbers; it refuses unsupported or ambiguous spellings without granting compilation authority. Supported owners also expose free-name analysis and capture-avoiding substitution, including lexical binding order and shared owners used under different binders. Default AST.PARSE and AST.EXPRESSION inspection, including their authored and canonical aliases, now return the same actual compiler owners and separate source metadata. The editor's two inspection actions share this route. Selection retains validated source ranges, while rename uses the exact identifier range even after input or DEFINE. Published inspectors and analyzers now read generated owner fields and request semantic facts separately. Whole-module definition reflection now returns actual function and assignment owners, preserving declaration fields and the source boundaries selected by the native compiler. Distinct functions retain their identity even when their compiled bodies share storage. Legacy native projection and reconstruction, and remaining stage/edit consumers are still being migrated. Public artifact Check now resolves the same shipped modules as source Check. Native construction also rejects a View library lock returned for a different reference before retaining it.

Checked expression replacement and new signature arguments now use the same owning grammar as expression inspection. Stale revisions, malformed replacements and invalid edited programs retain their native refusals.

Plain owning modules, scalar assignments and functions also render to Grid source, retaining declaration modifiers and explicit compiler-handler annotations. Documentation attachments and contextual clauses still return an unsupported result. Saved owner JSON enters through AST.FROM_JSON, which checks the complete graph and child roles before returning data. Old projected capability discovery no longer advertises executable admission. Transported local Process references now satisfy static Process parameters while computed and serialized targets retain native refusals.

Compiler V3 TREE callbacks now produce members at their declared grammar sort, including tokens inside larger programs. Transform, translation and operational solver evidence carries the corrected behavior through chained values and cold replay. Older evidence retains its original bytes, work and origin behavior. Public fragment authority and checked-theorem restrictions are unchanged.

Email rules can construct a plain-text message from computed values or send an existing saved draft. Native document mail actions retain their exact intent through checkpointed continuation.

Execution Grant development adds a private lease-bound loader for verified pure Solution extensions, reusing the existing isolated runtime and failure cleanup. Finite extension installation uses the accepted-report contract. Startup catalog preparation now binds exact carried extension material and complete commercial approvals under shared input limits. Selected local loading, cold restoration, ONCE persistence, accepted-report publication and revocation cleanup now share that plan. Exact pure scalar reports retain and verify their installed extension code in replay material. Four signed native Luau journeys pass on local macOS ARM64, including cold restart and interrupted ONCE recovery. Broader platform, cost and lifecycle work remains pending.

Selected native Execution Grant APIs now compose organizational sessions, disclosure and fenced source review with commercial authority. Completed native checkpoints support authenticated observation without authorizing execution. Zero-outgoing-child completion now retains its original transaction, admits final evidence before ONCE, and checks canonical compiled-model identity during cold reopening. The local Library restoration route reads bounded plain/encrypted .gridoc DATA under current local rights and keeps original journal and cleanup owners. Portable restoration receipts now participate in source admission, preserving exact retries and refusing archive substitution. Selected provider retries now continue authenticated cold captures without loading or reevaluating a model. Startup refuses unfinished captures without native completion, and nonempty provider publication preserves its outgoing obligations with exact serialized body validation. Selected Library replacement captures new exact pure ONCE values in its native snapshot. Unlimited Libraries can use explicitly configured original engines and the durable effect broker. Portable Source models start with fresh local custody, verified Arrow Frame DATA receives a local resource home, and Solution DATA remains bound to its current signed source and local grants. Selected resource stop joins original workers and retains timed-out owners and active effect leases for retry. Initial-only mapped-root observation, unguarded enterprise HTTP profiles, volatile or effectful uncaptured ONCE, persistent ambient extension instances and FileID/ModelID ancestry transfers remain unsupported.

Signal contracts and DSP implementation are separated, with dedicated local checks and retained response evidence. Language documentation generation uses a standalone tool. Publication packaging explicitly selects renderer artifacts and binds them into desktop cache identity.

V3 internal ledger development adds a selected native validator connection for independent validation, indexed Raft application, original receipt inspection and signed majority finality. It remains outside product defaults; executable startup fencing, full-size packet transport, snapshot-generation replacement and complete operational evidence remain unfinished. An explicit native installer connects the five development ledger/wallet submission exports to durable Process records and original receipt/finality inspection. Remaining exports, product startup and the full gridoc wallet lifecycle are still unfinished.

Experimental Browser development

Selected Server source now keeps lifecycle and Save bound to the original native File owner and resumes interrupted creation only at its retained root. Cloud Save uses the exact admitted owner. Desktop Saved Resume selects the returned session, while exit and update retain uncertain Close custody and leave Package Center running on refusal. Selected macOS packaging now composes a signed container and verifies its child bundles. Approved source now connects Cloud File recovery and active lifecycle commands to the exact retained owner, and adds explicit Close, Reconcile and Resume import actions. Reconcile reads retained state; Resume import explicitly continues eligible creation at its original root. Complete native builds, signed packages, Chromium execution and cross-device Save/reopen remain unverified.

Internal Windows Browser source adds a private helper channel with bounded transfers and retained cancellation custody. Windows product integration, crash recovery and native execution remain unverified; Browser support is not enabled by this work.

Internal Desktop Browser startup now connects the existing native document and Receiving gateways to the selected Browser client. Physical engine operation and Save/resume remain unverified.

Internal Windows Browser engine source now selects a model-owned encryption key without DPAPI/App-Bound fallback. Windows helper integration, native execution and crash recovery remain unverified; Browser support is not enabled.

Browser command dispatch now requires an explicit compiler-checked path for each command. Existing operation behavior is preserved; physical platform operation remains unverified.

Internal Browser source now shares Linux/Windows owned-key validation and capture. Linux portable helper dispatch also covers session preparation. Platform packages and cross-device Save/resume remain unverified.

Windows ownership admission now inspects the opened lease file without following a final-component reparse point. Actual Windows execution and Browser crash-custody integration remain unverified.

Native document Browser Close now preserves known resumed generations for sibling sessions and after later refusal. Physical Save/resume remains unverified.

Selected Cloud Browser gateway source accepts verified Cloud sessions on eight Browser routes and 23 explicit native document operations (31 total). Current principal, configured origin and request context are checked before signed native authority. Cloud mode also rejects legacy private document routes before they can reach generic service-token handlers or document effects. Cloud document open/create, drafts, runtime, Save/close and retained checkpoint recovery reuse the organization-owned encrypted File owner. Locked File identity recovery uses retained writer custody; active lifecycle commands require the exact admitted document owner. Current signed authority is checked before effects and receipt handoff. The approved entry dialog uses explicit document IDs, without a catalogue or archive import. Physical Cloud Browser and complete nonempty draft/Save/reopen remain unverified; no deployment is claimed.

Internal Browser startup now recognizes the signed macOS host and reads shutdown records through protected file handles. Windows helper source validates its inherited private connection. Ordinary Hosted working storage rejects organization labels that require an authenticated encrypted document. Native engine execution and complete portable Save/restore remain unfinished.

The macOS helper now has explicit startup/shutdown composition and package preparation tooling. Abnormal helper exit retains profiles until native writer shutdown is confirmed. Windows source connects private credential startup and signed executable/package-description checks; complete package loading and whole-host crash recovery remain development. These paths are not activated.

Selected Browser App source now starts or resumes authored tabs once per admitted document. Fresh startup refuses a nonempty native session, and ambiguous saved sessions require resolution. Failed Save responses preserve known resumed generations across ordinary, Cloud and Receiving transports. Physical engine and complete Host/App execution remain unverified.

Selected macOS Browser source now carries document leases through native child startup. Windows source retains signed package and private-directory ownership through launch and credential admission. Source tools validate declared Windows SDK and native-link inputs. Selected macOS and Windows recovery source now preserves the recorded cleanup authority through root publication and interrupted retirement. Twelve macOS disposable-directory checks and selected platform source checks pass; Windows kernel cases compile but have not run. Real Keychain/profile cleanup, physical engine execution and full product builds remain unverified. Unrecorded staging and cross-engine recovery remain unsupported.

Selected native document Close now retains an exact acknowledgement through lost replies, preventing a retry from closing a reopened document. Ordinary, Receiving and Cloud owners keep the original admission; Cloud rechecks signed identity and current permissions before returning a receipt. Server transport now preserves the same exact owner through lost Close and acknowledgement replies, and rejects late open replies. Server locked-file recovery also retains its native challenge with the confirmed entry display identity. Source component checks pass; physical engine execution and recovery after host restart remain unverified.

Selected Windows Browser source now includes a native helper entry, shared control and display transport, private file storage and document ownership through Chromium child launches. The unsigned Build recipe preserves native outputs before packaging. The Windows host now uses the shared command protocol while retaining its actual process, package and file owners. Native readiness, completed I/O and whole-process shutdown are checked separately. The selected Host reuses portable Save/restore while retaining the same document locks across restart. Upload, download and website Save source now uses bounded private files and waits for native writer cessation before reading completed output. Signed Host package selection and native document registration are now connected in source, with retained directory ownership through the existing File participant. Profile cleanup and crash recovery remain development; real Windows engine, package and kernel execution remain unverified. Native download completion also waits for writer acknowledgement on selected macOS/Linux paths.

Selected V3 development connects distributed decision state and original outcomes to the indexed Raft transaction. Delayed reference bindings, accepted values, provenance and fencing share the native document WAL. Process service installation, production source/provenance owners and scheduling remain unfinished. No product activation or full operational completion is claimed.

Internal development Testing now includes authored Process composition over the native wallet/ledger submission cut and original-operation recovery. Room inspection now reports unavailable native resource authority instead of panicking. This adds no production installer; full distributed decision/reference composition remains unproven.

Selected native operation ingress now verifies nested issued references against their original retained producers and current native owner checks. Internal decision/reference declarations preserve exact counters and terminal inspection types; their production Process installation remains unfinished.

Selected decision development now derives accepted-output and frozen-Process commitments under the original native writer, with typed raw-output selection inside closed records and source choices. It preserves ledger evidence and refuses native handles as fact DATA. Production decision authority and adapters remain unfinished; this does not enable a new workflow operation.

Selected coordination development now checks separately signed decision-authority manifests against exact Registry certificates, policy and source/seat rights. Revocation, expiry and pinned epoch changes remain explicit. Production Process provenance, guarded signing and replicated admission still require integration; this component does not enable the proposed service exports. The selected Host also joins that permission to source coordinates from the real retained Process writer, keeping the original operation deadline in force. Native role/profile/disclosure, guarded signing and replicated evidence remain required.

Media recovery and measurement development

Selected Media recovery retains interrupted recording identity after temporary source cleanup while preserving incomplete status. Callback-scoped immutable Images use the existing native compiled model and kernels without expanding intermediate pixels into workbook values. Local synthetic crash/cancel and disk-full QA, paired backend Performance and built-in-camera observations are retained with explicit limits. Optional macOS packaging is a private draft; the isolated Media inspection R1 presentation is approved for later product wiring. Full isolation/native-pool evidence, long physical recovery, public packaging and product UI wiring remain unfinished.

Admitted camera activation development

Selected development packaging now activates an owner-admitted built-in macOS camera through the authenticated native document context. Local verification covers real Image analysis in the compiled model, formula Latest/Status and Stream, explicit Stop, immutable VP8/Matroska recording and finite RGBA decode. Same-name foreign documents, forged/body-substituted/replayed requests and stale generations refuse. Native File Close confirms camera child exit; failed teardown retains custody for an explicit retry. Camera recordings stay local, with no microphone or external AI image sending selected.

The existing Media inspection presentation remains active. Product Run/preview wiring, stronger coordination and commercial custody, trustworthy physical capture time for AI, native artifact readmission/portable archive handoff, packaging and Performance remain separate. This is a development capability, not publication of a live-media product. See Media activation.

Bug Fixes

Code restores imported component insertion choices and argument controls from the currently admitted import. Unsaved draft analysis inventories those imported declarations. Checked edits still refuse stale drafts, unavailable imports and changed parameter identities.

T.TEST preserves scalar type errors and existing error values in its tails and study-design controls, while retaining numeric and missing-argument behavior.

Undo remains available for committed Form actions when a later external effect fails, including when the viewer first observes the terminal failure.

Media recording recovery, immutable artifact ingress and source ownership now carry explicit bounded failure handling. Simulation inspection retains the accepted controls and events needed to diagnose changes across a captured run. HTTP JSON decoding preserves bounded handling of compressed responses. CAD inspection follows intermediate formulas and retains trusted source identity when parameter-driven datum coordinates change. JavaScript extension scaffolds use the patched archive-extraction dependency. Document source edits refresh model references from the selected producer. Initial Gridoc exports select the correct first-file binding intent, and saved input aliases resolve to their native identities during archive verification. Compiled backends now retain the publication adapter and template. Selected desktop packages preserve these exact private files outside the server bundle, so export receipts keep the adapter's identity and replay can load its template.

Canonical compiler imports refuse cyclic expression-owner links with AST/LIMIT before recursive reconstruction can overflow the native stack. Authored USE inspection emits each directive once with either LF or CRLF line endings.

The Executable Research example binds its bibliography profile to the current adapter version and source digest, with the matching pack resource hash.

Inline View JavaScript retains stable compiler identities across packaging feature sets.

Local consent and grant-inspection codec encoding retains its frozen deterministic bytes across packaging feature sets.

Seeded native distribution sampling preserves its frozen answers when unrelated workspace dependencies enable additional math features, retaining the existing RNG and draw order.

Direct native calls to compiler-owned video transforms and constrained solver reports return explicit context errors instead of reporting a missing implementation. Authored calculation behavior is unchanged.

Selected native Library editing and explicit cancellation use authenticated v2 routes with exact operation/revision/incarnation preconditions. Cold load and interrupted replacement recover from the actual native saved selector, preserving saved inputs, metadata and compatible ONCE state. All 107 selected local native checks pass. New uncaptured ONCE values and unsupported source/adjunct changes remain refused before intent; broader platform/cost evidence remains open.

Selected native decision ingress now replays original accepted role/profile evidence through the existing native executor and pins the compiled role and full actual responder identity. Staged native ownership replays outside the writer, then rechecks complete original history and fresh permission before attachment. It stops before original operation restoration. A separate native schema/placement join checks admitted exact fact types, canonical bytes and the authenticated native placement mapping against signed seat pins. Current disclosure, decision/input scope, key custody, replicated evidence and public operation installation remain unfinished. A selected quorum-backed scope reader now derives committed decision/input/epoch and seat versions from the actual Raft owner. It adds no public Process operation and does not prove original ASK input delivery or current disclosure permission.

Compatibility and Migrations

Signal v4 appends EQ classes using pinned FunDSP 0.23.0 while retaining existing v1–v3 arithmetic and wire contracts. Media selects module format minor 24; older readers reject unsupported Media modules. Existing function indices remain unchanged. Rerun and Typst require explicitly selected external tools. Publication preview controls remain isolated review candidates pending named-view approval.

Known Issues

Inherited-part signed consent and next-open integration are in development. Selected native library and saved registry next-open checks pass; broader owner, platform and performance scope remains unverified. This does not establish complete Model Lineage support. Selected ordinary native detachment now joins effective overrides and remaining pins to authenticated saved/chained replay and the existing Original preimage, commit and recovery owners. Full detachment removes source-following consent; partial detachment invalidates its old signed scope. Exact retries reuse the original outcome. Remaining inherited parts can now advance through the actual native source/child owners, retaining signed ancestry and private compiler proof. Renewed host-signed consent enables existing next-open updates across cold reopen; exact pins, unchanged-base overrides and state survive. Changed detached import baselines, changed override bases and frozen context retain their guards. No new UI action is exposed. Saved transformed Copy/Fork/Move now retain native proof, state and exact creation provenance through existing transactions. Partial and full transformed document Copy/import and receiving transfers use actual Local or Nonlocal proof and recovery/membership owners, retaining exact pins across receiving Save/Move and cold reopen. Ordinary non-transformed inherited document imports, pending composed Fork challenge resolution, picker activation, transformed upstream source publications, broader native/commercial owners, platforms and numerical Performance remain incomplete.

Distributed model coordination remains in development. Scalar connector publication and native mutation timing changes pass six genuine native Host and compiled-model tests and full Host checks with observation enabled and disabled. Optimized paired measurements, the 1 ms objective and complete V3 conformance remain unverified.

Media delivery and its shared representation and selected execution costs remain incompletely measured. Built-in macOS camera activation through the actual authenticated Desktop gateway/native document owner is locally verified; packaged publication acceptance remains unverified. Notebook publication requires supported native ownership; commercial and hosted model capture refuse. Detached Gridoc imports remain locked until explicit owner resolution. Copy of scheduled or graph/evidence models refuses when its required specialist owner is unavailable; ordinary process restart retains their existing native state. This version bump does not establish a published product release.

Documentation Updated

• Signal authoring and Media authoring.
• Simulation inspection and simulation language reference.
• Interface layers, function catalogs, API references, and local operation inventories.
• Technical report example.

Selected replay now captures the original native argument owner and authenticates retained reference producers outside the Process writer. Fresh attachment checks native capture identity; equal data cannot replace it. Decision-specific reference admission and original AI input delivery remain required before assessment signing and public operation installation.

Native compiler hosts can retain native HIR together with its expression pools, callable tables and pending dialect inputs. Consuming the retained result resumes the same MIR and compiled-model compilation after source and resolver disposal, without repeating imports or compiler handlers. Native handlers can retain HIR contributions under their actual invocation custody and typed receiving contracts. Later native checks still apply; serialized HIR claims cannot reconstruct that custody.

The obsolete native syntax::native_inputs development entry has been removed. General module tooling uses V3 SourceModuleArtifact; retained definition publications use native_definitions::retained, preserving valid stored identities without a separate import admission path.

Native compiler hosts can now retain complete native MIR and resume compiled-model emission without repeating source admission, handlers or lowering. Ordinary qualification shares that production path. Machine-qualified grid://… references retain their model metadata through owning syntax and MIR. HIR/MIR and source-produced lir contributions retain authentic receiving custody; cold request-bearing compiled models require its explicit host API context. Genuine host, portable, production and original physical acceptance remain separately open for the final candidate.

The compiler also emits stable operation ordering for implicit BLANK cells created by reactive rule targets, making repeated compilation reproducible.

The V3 development compiler now accepts declared source-expression handlers. Their generated expression uses the same parser and hygienic native linker as owning syntax; live interpolation inputs remain values and do not trigger recompilation. The source pricing example accompanies the existing syntax handler. hir, mir and lir handler admission/linking remain unfinished.

Retained native definition inputs preserve PART membership declarations through source-free admission. Composition still applies its native duplicate, ownership and authorization checks.

Native compiler artifact admission now bounds derived logical path expansion, including repeated long aliases and exponential alias chains. Type inference also avoids a debug-build stack overflow on long callable expressions. The obsolete resolver/symbolic-context entrypoints on the legacy module importer are removed; hosts pass those contexts to SourceModuleArtifact::admit.

Native compiler artifact admission now checks BODY slot contracts, foreign component type clauses and SURFACE names on unused declarations as well as placed ones. It also preserves standalone VALIDATE RECORD declarations after an assignment. These repairs retain the existing source grammar. Inferred Table children now retain their actual grammar until native presentation selects it, including columns, filters and empty sentences. Native labels and model key pickers also retain their defining operands. Direct named controls preserve their existing document IDs after owning transport. Large Views keep their existing capacity limits, and deep record type resolution no longer overflows the compiler stack. Full V3 and the native editor migration remain in development. The private editor now connects owning contract properties, slot blocks, action requirements and Table columns, builtin inferred/embedded controls, availability groups and region layouts, with original/candidate property validation sharing one operation. Inferred embedded and composite continuations also survive owning transport. Native Local declarations and reads now connect record defaults, validation and direct binding controls. Field references use their original source members; unsupported or escaped record uses retain review links. Model-member references retain their base tokens, lexical declarations stay separate from reads, and repeated controls share metadata computation while preserving reference publication limits. The private editor and imported View libraries now retain complete native modules and actual model declaration/expression relations. Their separate statement parser, View-only rebuild and selected scanner accumulator are removed. Direct model-input controls now retain native declaration identity, record defaults and accepted validation clauses. Original lexer trivia keeps comments outside edit ranges, and source loans cannot cross analysis results. Model aliases and sheet-qualified inputs now reach these controls through the native alias contract, preserving exact input ownership and refusing ambiguous alias chains. Private row and component controls now retain their containing declarations; validation edits recompile with comments and selection preserved. Stored and computed columns retain native row-field references without hiding model reads. Private validation edits now check native references and lexical scopes; record schema controls preserve field-rule protection and local/imported contract links. Private native field renames now update proven model uses atomically, preserving comments and defaults. Dynamic keys, record escapes and unported contexts retain explicit review links. Drawing from phrases now retain their element contract in compilation and Properties, while named pickers keep their current meaning. Private native drawing group edits preserve comments and child expressions under one operation. Numeric gestures also retain original syntax ownership and verify one combined candidate, while preserving comments through repeated edits. Private text, expression and page metadata edits now retain original source owners and CHECK references through one cumulative operation. Native page-name transactions also preserve public titles and routes while updating owned navigation and CHECK references. Private native outline and page duplication, deletion and reordering preserve page/shared ownership, source roles, parameterized routes and exact undo. Private native insertion and recorded CHECK authoring use actual component and row owners, preserve surrounding source, and validate the complete candidate. Named reset() and clear() actions work in drawer scopes while RESET/CLEAR target commands keep their existing behavior. Private native scalar and component option transactions preserve typed values, availability, optional defaults, comments and caller content under one operation. Native event, slot, caller-content and appearance edits now preserve payloads, scoped values, inline regions and Table column roles through that same operation. Theme and drawing option requests now share that native operation, including compiler-checked theme values and exact source ownership. Public native editor activation and specialized reference/control migration remain unfinished.

The obsolete general module reconstruction and finalization APIs are removed. Compiler tooling uses native SourceModuleArtifact admission. Historical inspection and stored standalone formats remain explicit compatibility contracts. Native foreign-contract validation now streams shared grammar boundaries without its former temporary token and clause collections.

Internal decision recovery Testing now covers rejected received-result Resume, original-deadline fencing and expired-authority replay through the existing native owners with validator transport partitioned. This changes no production semantics or public availability; the full distributed service remains unfinished.

Internal decision recovery now completes original local publication interrupted after quorum commit, using the original native source/input/reservation owners and current stopped-operation authority. Local native controls cover atomic publication, original result issuance and a second restart between them. Partial or missing ownership still refuses. Public installation and full service/platform/Performance evidence remain unfinished. The broader Process run retains one pre-existing industrial-package fixture failure; it is not a clean full-suite result.

Internal decision Open operations can now resume a known Pending result-completion obligation after interrupted local issuance, preserving the original command, deadline, authority and output budget. Native controls exercise repeated cold reopens, explicit settlement and stopped reconciliation after a resumed issuance crash. Public installation and full service/platform/Performance evidence remain unfinished.

Internal distributed decision preparation now carries signed controller state preconditions into durable Raft application through a separately selected profile. Stale candidates retain original rejections; matching-data foreign native owners cannot prepare commands. The internal native Open installer now selects this profile and preserves the original packet through result acceptance, rejection and cold recovery. Public Process routing, complete voting/Seal/Decide producers and full service evidence remain unfinished.

Internal controller inputs now authenticate the original pending Process wait, issued DecisionRef and applied Open mapping separately from assessment replay. The native proof fixture reaches a real second Cancel wait after accepted Open, then refuses effects. Controller signing, dispatch, receipts, recovery and public installation remain unfinished.

Internal controller development now freezes native Cancel command/source/envelope identity using a separate descriptor-bound vault purpose. That preparation-only fixture remains pre-dispatch; the selected native installer below now connects authoritative Cancel application, typed outputs and cold recovery. Complete configured distributed services remain unfinished. No new public language or UI activation is included.

Internal distributed-decision development now joins a real Cancel dispatch to its original authoritative Raft outcome and reserved native retention. The selected native installer below now connects typed Cancel results, cold completion and native Process routing. Configured product-binary deployment remains unfinished.

The selected native controller provider now routes Open and Cancel, reserves exact typed Cancel outputs before send, and connects original outcomes to Process result acceptance and cold completion. A public native embedding installer consumes actual admitted application/authority/custody owners and accepted Process input. Configured binary startup, Seal/Decide/workflow receipts and the full-service evidence remain unfinished.

The explicitly selected workflow-source-v2 profile connects native accepted-result Assess, original-assessment Vote, Seal and Decide with purpose-bound custody and workflow receipts. A dedicated configured host service connects pinned TLS/Raft, existing encrypted vault custody and native Process HTTP routing. The current service profile uses pure accepted Process results; native AI/human seats, other platforms and broader ledger/wallet completion remain separate.

Development CLI commands now carry native device, mailbox, selected signal and Ordered-symbol operations with original captures, receipts and pending obligations preserved. Native lifecycle inspection, explicit catalog recovery and original-root Process Resume are available in independent CLI main. This remains Unix development-file participant custody; configured public-service administration, production custody and broader platform/network/Performance verification remain unfinished. See the participant and recovery guide.

Owning compiler modules can now use AST.MEANING directly in Grid and through the on-demand compiler worker. Root inspection returns a compilation revision; exact native selections and bounded batches inspect bindings, types and available facts from current host admission. A batch compiles once. Changed inputs refuse stale selections, and partial or unknown facts remain explicit.

Native participant development now binds accepted AgentResponder output to its original compiled role/profile and exposes that assessment in workflow receipts. A new authored example derives its vote from the retained proposal. Separate selected human credentials answer only their original Process questions. Selected startup also supports mock inference through the native AgentResponder. Selected schema-4 startup now connects a sole native HumanVote seat, exact RequestApproval/Vote grants, authenticated ballot challenges and purpose-bound approval/ballot signing. Cast verifies the original accepted Authorize reference; workflow receipts include native approvals. Fresh Start is independent of service age while duplicates retain their original resource deadline. Local three-service QA completes the authored mock-proposal workflow after a 31-second delayed Start and preserves reply/approval/workflow receipts through pending and completed cold recovery with zero new inference calls. This is local service-thread evidence. Schema-5 mixed-source-v5 additionally connects one Agent and one Human seat, distinct native ballot and sealed-outcome consent, and original approval receipts. Its independent three-process proof preserves both pending consent challenges and completed receipts through cold recovery with zero new inference calls. Wider rosters and live inference remain separate.

Local native service endpoint transport development

The separate native endpoint and gridctl service route original authority, reference, membership and gateway requests to explicitly pinned native owner processes. Owner descriptor/export mismatches refuse; uncertain calls are never retried, and closing preserves native result/debt reports. This is local transport development: concrete owner entry points and real service-operation journeys remain unfinished, with no public service, production custody or Performance claim. See the transport guide.

Local native coordination authority development

An explicitly selected native authority now commits finite typed coordination CAS and retains original read captures and signed snapshots in the existing indexed Raft transaction. Independent CLI main verifies real operations and original recovery across voter restarts and quorum loss. This Unix local SDK profile adds no ordinary Host startup work. Other authority operations, model reference bindings, cluster membership/gateway owners, production custody and optimized Performance remain unfinished.

Exclusive native claims and registered authority actions

The selected local SDK authority now admits exclusive claims over separately registered subjects and finite exact registered submit actions. Claims retain one owner and ordered epoch/conflict outcomes; registered submits use the same typed coordination CAS and revision checks. Original signed requests, positions and receipts remain recoverable through gridctl main after all voters restart. Empty registrations preserve existing descriptors. Native handoff/fencing, allocation/settlement, full model reference bindings, membership/gateway owners, production custody and optimized Performance evidence remain separate work.

Recoverable native claim-fact handoff

The selected local coordination SDK authority can transfer an exclusive claim fact to an explicitly registered successor principal. It advances owner epoch and generation once, rejects stale or former owners and retains the original outcome through retries, follower recovery and all-voter restart. The native owner captures its own predecessor and frontier; requests cannot supply fencing proof. This single-caller development profile does not enroll the successor or transfer model execution, funded capacity or external-effect obligations. Full native allocation/settlement, model bindings, membership and gateway owners remain work.

Scoped native successor enrollment

The selected local coordination SDK authority can enroll Registry-signed successor endpoints at startup with handoff rights limited to named claim facts. Reciprocal transfers retain the same ownership history and original receipts across restart, follower recovery and quorum loss. Other service operations remain denied for these callers. Empty enrollment preserves the earlier single-caller profile; nonempty enrollment binds a new policy identity. This development profile does not transfer model execution, funded capacity or external-effect obligations.

Bounded native background workloads

The explicit native development profile can stage private bulk chunks, receive Ordered mailbox catch-up and fetch signed snapshots through the installed reference source owner with separate class capacity. Secure realtime delivery retains its own journals and slots. Original ciphertext, receiver receipts and source outcomes survive lost replies; atomic model application and native rights remain with their existing owners. Full P3 comparative Performance and platform evidence remain unmeasured.

Recoverable native authority workloads

The selected private-file native profile adds independent authority, original receipt and local checkpoint slots alongside secure realtime delivery. Complete indexed checkpoints retain Raft history and original outcomes and restore into a separately owned inactive store under installed custody and voter pins. Quorum loss retains original uncertainty while local receipt inspection and unrelated value delivery continue. Peer snapshot installation/log purging and full P4 comparative Performance remain separate work.

Native execution and funding preparation

Optional native execution-fence handoff now retains predecessor quiescence, named successor acceptance and original results across restart and later transfers. The selected standalone SDK authority can also install finite issuer-signed new V3 capacity pools and commit exact allocations through its existing Raft writer. Original allocation, exhaustion and proven-unissued closure receipts survive follower and all-voter restart through gridctl main. Closure returns units once only when the native authority proves it never issued execution rights. V1 grants remain unchanged. Native model-reference lookup matches exact original bind, refresh and unbind after later state changes.

The selected native development composition now admits recipient allocations, consumes them through the original compiled-model Process owner, and settles authenticated consumption/surrender against the original execution/effect receipt. Reservation uses an audited allocation count, preserving the 128-original bound without a whole-history scan. Legacy admission changes no retained handoff commitment. Same-node shared-store handoff is implemented; cross-node custody, remaining public service operations and broader V3 and numerical Performance acceptance remain separate.

Selected same-document lineage development now applies a complete captured PART to declared inputs through the native durable writer, preserving original provenance, restart deduplication and terminal unbind. Shared definition admission, remote membership/disclosure/freshness and automatic refresh remain unfinished. This internal owner path enables no new product control or complete MLI claim.

Shared-ownership development now reserves terminal-unbind byte and structural capacity and joins receiving ownership to current native custody and Registry rights. It can authenticate an original single-export challenge with the existing Registry and PinnedSigner owners. Production source signing/disclosure and remote accepted captures/application remain guarded pending enrollment and verification; this does not activate a shared-language profile or change the reviewed Updater Summary.

Selected Registry lineage metadata development

Explicit native metadata commands now connect to the genuine enrolled foreground Registry session. Durable report/name Originals retain exact bodies after Save/Move/reopen, with private-session highwater and current provider authorization. Authorized metadata selection joins separately held same-document exported-part capture and the existing native WAL and compiled-model writer. Remote sources, defined-collection names and multi-source assembly remain guarded. This internal work adds no visual control, public deployment or complete MLI claim. The reviewed Updater Summary is unchanged.

Selected disconnected exchange development

Selected internal native scalar exchange retains original mailbox packets and separates broker retention, recipient persistence, native application and terminal completion. Its yielding lifecycle scan inspects longer histories in bounded pages and preserves pending debt across the final page. Drained local withdrawal retains the caller's Original across reopen. The selected independent-provider model journal retains original ciphertext, receipts and recipient ACKs through its existing quota, signer and durable commit owner. Private local Testing exercises actual provider lost replies, cold retry and native application. Authenticated model-profile network delivery, remote shared collections and full Desktop lifecycle integration remain guarded. This changes no visual controls or reviewed Updater Summary and is not a public deployment claim.

One native model in two memberships

The explicit private-file development profile can attach two independently certified memberships to one native model and unchanged producer. Separate bounded output reservations let A apply while B is offline, replaying or full. Membership-qualified originals retain their ciphertext, signed receipts and native source retirement. Bounded scalar admission refuses unbounded kernels; P3/P4 background services keep their original owners. This introduces no execution entitlement, Copy, evaluator or automatic gateway. Paired P5 Performance budgets remain separate evidence.

Bounded native direct fanout development capability

The opt-in native private-file profile admits frozen audiences up to 1024 targets through independent bounded opaque relay branches. Original command positions, encrypted captures and destination receipts survive partial publication and recovery; slow/failing branches do not borrow healthy branch capacity. Original private bulk payloads map to retained chunks up to 4 MiB. The guide describes the native API and limits; functional evidence remains separate from comparative Performance and public endpoint/SDK rollout.

Original native authority reference capture

The explicitly selected native authority source can return its original signed reference value and challenge after a lost reply or restart. An independent consumer verifier admits the capture to the existing native binding owner; current rights, target fences and trustworthy elapsed freshness remain required. Selected Latest mailbox DATA preserves every original destination obligation. These development APIs do not install an evaluator, polling or a public provider. The guide describes their exact boundaries; full V3 delivery and model/SDK integration remain unfinished.

Native reference input application and original reconciliation

The selected native development adapter applies independently admitted signed captures through the existing validated compiled-model input writer and document WAL. Original retries retain the full source/provenance digest, survive WAL-only target reopen and preserve later local edits. Unbind fences pending refreshes, and a late response cannot reattach. Input validation refuses before commit. The selected local HTTP profile now connects this owner to authenticated native target admission and Process input delivery. Remote transport and independent SDK integration remain separate; it adds no evaluator or automatic refresh worker.

Local service snapshot functions

The seven CONSENSUS/REFERENCES snapshot getters read retained materialized values, exact revisions, positions, status and disclosure provenance. They use ordinary local record access in formulas and Process pure kernels, perform no service request and grant no rights. The canonical function catalog and corpus include their exact supported names. Effectful service and SDK installation remains separate work.

Selected transformed local lifecycle development

Selected native lineage development joins copied-archive named Fork resolution, receiving Upgrade/checked Restore and transformed upstream source publication to their existing compiler, native state, identity and durable recovery owners. Inspection text remains data; current custody and membership remain required. Ordinary inherited-document imports, unsupported owners, picker activation, other platforms and measured Performance remain separate work. This adds no visual control or complete Model Lineage claim and leaves the reviewed Updater Summary unchanged.

Core private-mailbox model continuation

The selected native development profile now uses Core's signed HTTPS mailbox client and existing participant store for original publications, private delivery, receipt upload and inspection. Trusted certificate renewal and key rotation keep outstanding ciphertext and ACK identities through direct/mailbox switches and restart. Nonempty native outgoing obligations continue through the recovered semantic/outbound owners, and signed native retirement waits for their confirmed original horizon. The lifecycle example describes the explicit calls and bounded private-file profile. Provider and external SDK implementations, broader schemas/effects and installed custody remain separate work; no public deployment or measured Performance claim follows.

Guarded definition owner development

A distinct native definition candidate preserves static call arguments, primitive type tags, STATE and ONCE through compiler construction and composition. Frozen pure publications retain their existing representation. The product admission guard remains closed for the new profile until its compiler, compiled-model and actual Host/state owners are verified; this is not shipped definition-family completion. Callable closures, physical types, resource/Process owners and commercial accounting integrations remain unfinished.

Selected local native reference workflows

The optional native reference service now connects startup-pinned source and consumer documents to authored ops:grid/references@1.1.0 workflows. Manual bind, refresh and unbind deliver accepted values through existing declared inputs; pure getters expose typed scalar/flat-array DATA. Version 1.0 remains unchanged. Authenticated activation accepts only externally Registry-signed certificates within the startup pins. Original receipt inspection, explicit Resume and replay read retained outcomes without recapture or renewed signing authority. Remote delivery, richer carriers, Every and governed source/bootstrap epoch migration remain separate work. See the authored example and implementation boundary.

Native compiler editor development

Public source analysis and all 24 View edit entry points now consume actual compiler owners with one cumulative allowance across original and candidate source. Native readers replace the remaining live projected editor paths; obsolete production helpers are excluded while required historical archive codecs remain. Existing input ceilings and conservative edit refusals are preserved. Full compiler V3 and physical Performance/browser acceptance remain in development. See the compiler tooling guide.

Compiler template transformations now observe native binding scopes, preserving capture avoidance and shared owners under distinct lexical environments. Module item splices preserve attached documentation, including empty splices and tied candidate groups. The existing limits remain; compact syntax is checked before large native expansion. Context-dependent categories and full compiler V3 acceptance remain in development.

Grid-authored payload diagnostics now accept the integral numeric offsets produced by the compiled model, retain exact submitted Unicode locations and refuse malformed ranges. Detached syntax cannot claim a submitted source location.

Template inspection also follows generated nodes when a native category has no printable preview, retaining the template and input that produced each node.

• Process template expansion preserves parameters, participant roles, rooms and local scopes. Generated function/Process interfaces keep their callers' named arguments and role mappings aligned, including forward calls.

• Explicit template capture/export intent selects actual native declarations. Private template names freshen before caller code is inserted; retained capture and export names keep their checked native scopes and interfaces.

• Ordinary V3 compilation excludes historical source-capture and projection support. Archived Ledger v1 data retains its explicitly selected adapter.

• The optional local native reference service connects all seven shipped Process operations to certified source/input rights, Every/await scheduling and original durable owners. Portable lifecycle history preserves bindings and receipts as DATA for independently admitted receiving inputs. Locked native Process-source admission now supports Copy, Move and compatible executable upgrade. Copy has its own instance and no borrowed execution or issuer history; Move and upgrade preserve original Roots and receipts. Stopped original effects settle through their existing owner, including after replacement and cold recovery. See the service guide for the selected schema, source-generation and transport boundaries.

• Retained compiler inspection keeps native View-local identity and available nominal and Process type facts, with actual producing-pass references for compiled assignment dimensions, bounds and validation proofs.

• Imported compiler templates preserve host-selected dependencies and foreign callable identity while freshening local aliases. Explicit captures check the native value/callable namespace, and definition imports support checked local exposure aliases.

Native remote Process recovery and recipient accounting

Selected native remote routes now recheck current authority immediately before request egress. The receiver reserves and records consumption through its existing grant owner and original journal, and refuses recovery with missing or changed funding. Repeated delivery observes already-dispatched original work even when an upgrade retires its adapter; an uncertain effect still needs the original owner's reconciliation. The development guide records the remaining production startup, certified custody/executable revision, mailbox and handoff connections. This does not claim complete V3 remote operations or change the reviewed Updater Summary.

Membership key and accounting preparation

Selected native memberships now require independent physical endpoint keys and explicit original-work reservations within the existing shared authority budget, with separate bounded lifecycle capacity. Original receipts still recover across renewal, departure and restart. Co-installed pools now retain only shared capacity, quota preparation/application bind one indexed generation, and native inspection returns coherent attachment/work/lifecycle counts. Local three-voter journeys verify pool exhaustion, A/B isolation, A leave capacity and original recovery. Terminal drain, general disclosure gateways and installed device identity/rotation/custody handoff are unfinished. This is a development implementation slice, not complete multi-domain service support. See the authority guide.

Configured native typed decision input

The optional decision service admits supported closed input DATA through the pinned compiler result type and existing native input owner. Numbers, booleans, exact integers and closed records retain the original Process and schema pins through cold recovery; pure results still cannot claim model-origin rights. This bounded development increment does not complete new mutation/consent profiles, terminal Process ownership or wallet/industrial composition.

Private-file authority generation maintenance

Selected native development custody can retain a complete final authority checkpoint, durably fence its predecessor, install the original inactive image and reclaim redundant logs from that retired predecessor. Original outcomes and term/vote history remain preserved through replacement and recovery. Explicit inspection and retired-log reclamation commands now use those same native owners and reconcile the original receipt after a lost reply. Active voter peer snapshots and log purge remain refused; service-view adapters and individual presentation reviews remain open. See the storage contract.

• Compiler tooling documents the original 129-node depth compatibility difference and retains an audited history of repairs and unresolved findings. Depth, fixture sizes and Performance budgets remain unchanged.

• Public owning compiler transformations share bounded accounting through native imports. Raw decoding and generated buffers debit storage before allocation; complete report copies preserve retained inputs and origins, including deep metadata. Borrowed validation and copies of retained owners spend inspection work and physical storage while preserving complete output bounds. Native model renames retain every binding and scope, including shared-owner shadowing. Cancellation prevents partial publication. Original limits and fixture sizes remain unchanged.

Compiler tools can now refactor source-free owning modules through actual native binding identities. Rename, helper extraction, signature changes and caller updates produce compiler-checked transactions; application reconstructs their derivation and preserves the original on stale inputs, capture, unproved affected uses, cancellation or forged facts. The native binding inventory is revision-bound, and shared owning nodes are joined by actual consumer occurrence. Compiler validity does not imply behavioral equivalence.

Lineage native execution-owner development

An internal native entry joins composition, upstream upgrade and partial/full detachment to the original native Process, V3 grant and fence owners. Native publication snapshots and reopens the same Process table manager, preserving original records and consumption. Missing owners or unresolved work refuse before staging; lifecycle metadata grants no source or execution rights.

Candidate NativeDocument composition, upgrade and detachment wiring shares this owner path while retaining compiler preflight and normal compiled-model readmission. Candidate cold Registry admission reinstalls original native owners before the existing signed-consent next-open upgrade. New product enrollment and detachment RPC remain guarded: current shared predicate/equality compilation failures prevent the required current-source caller and recovery verification. Consent and copied history cannot supply missing execution capabilities; unavailable owners still refuse.

This development path adds no visual control or automatic grant discovery. Browser/native-reference combinations and licensed-source definition composition retain their guards. Full native route/participant composition, platform/package QA and whole-profile Performance remain separate. The reviewed Updater Summary is unchanged.

Compiler V3 inspection retains unresolved imports and contextual operands while checking cold-loaded and generated artifacts against actual receiving-host authority. Supplied grammar, stage labels and serialized proof claims cannot authorize import reads or model execution.

The Compiler V3 pricing example now composes all five source, syntax, hir, mir and lir module stages with imports, a Process snapshot plan, a View and a host-admitted API query. Discounts use the full validated zero-to-100 range. Cold-loaded models and live quantity/price changes execute without recompiling the handler. Cold owning import binding inspection now borrows the same bounded grammar operation as its caller.

Configured escrow service development

The optional native escrow role joins the finite no-report workflow to closed startup pins and authenticated product routes. Local QA uses three actual host processes, mocked inference, separate outcome/spending approval receipts, native settlement/finality and idempotent accounting. Full process killing and cold inspection preserve original receipts and make zero new AI calls with business signing custody unavailable. This is source-bound evidence from the prior proven compiler baseline plus the exact new runtime overlay; current shared compiler compilation remains unreconciled. General composition, pending-stage operator recovery and broader platform/Performance work remain separate. The reviewed Updater Summary is unchanged.

Native compiler API receiving authority

Native contributed modules can retain live API requests through actual HIR, MIR and source-produced lir owners. Receiving publication rechecks the exact installed host package, and cold compiled-model API admission requires an explicit provider context. Exported request values retain producing effects; requests cannot supply runtime connection, credential or execution authority. Existing acceptance limits remain.

Grid 0.72.0 — Upcoming (not released)

Summary

Grid 0.72.0 adds consented assistant actions in open views, view access for Process roles, and richer saved spatial experiments. Live physics can exchange readings and controls with model cells. This is a prepared candidate release; availability depends on the selected product and native owner.

What's New

• A per-view assistant switch exposes the open view's supported actions. Access starts disabled and lasts for the tab session.

• SHARE VIEW <view> WITH <role> grants Process roles read access; TO ACT also permits supported actions. Process Start offers Read / Act choices within the source-defined permissions.

• Saved spatial experiments retain table and Frame population inputs for inspection and replay after source changes or restart. Supported native documents can run and inspect experiments under their existing owner.

• Recorded experiment runs can be opened in Scene views, with playback controls, camera navigation, and saved view preferences.

• Live physics observe and drive bindings connect body readings and controls to model cells and rules.

• Engineers can explicitly capture a live physics session and export it to a local Rerun recording, correlating poses, observations, accepted inputs, rule events and metrics on simulation time. The optional SDK is separate from product execution; the included support-removal case explains a faulty cleanup rule across several signals. The explicit export command supports focused plots; an existing multi-body controller recording explains speed changes and accepted corrections.

• Signal EQ chains add bell, low/high shelf and notch filters with cell-driven frequency, Q and gain. Native/HTTP response inspection reports magnitude, phase and delay for the same published linear controls used by playback.

Improvements

Selected connector accessors are admitted only when needed. Numeric region planning reuses statistics across comparable region sizes, and temporal captures retain changes between snapshots. Native selects use the approved shared geometry throughout the application.

Wide single-pane Pages, Chat and Code headers keep their controls aligned with the desktop window controls. A compact hamburger menu opens the workspace controls on click, tap or keyboard activation; hovering highlights the button. Code's working tabs share the row and retain a visible selected tab and its Close button when opening the frame narrows the strip. macOS headers use tighter spacing beside the stoplights. Data, narrow and companion layouts retain their existing presentation.

Bug Fixes

Saved Chat history survives delayed refreshes. Email search context survives delayed sync, obsolete sync errors clear, and pending mutations respect changed permissions. Table record details remain selected while a query is pending. Recorded Scene preferences survive native draft migration. Account credential continuity and bounded CAD preview/save behavior are repaired.

Compatibility and Migrations

An opt-in local technical report pilot uses Typst to publish one complete beam calculation report from a saved Grid source revision, with a regenerable vector preview and reproducible PDF. It requires explicitly supplied native tools and Typst 0.15.1; the Documents editor and its existing exports retain their current behavior.

Existing record-array experiments and retained JSON remain supported. Saved experiments verify owned input bytes and refuse missing or changed data rather than substituting live inputs. Receiving and commercial document owners do not support the new native experiment adapter.

View access requires explicit consent or a run-scoped grant. Removing a view grant withdraws access; interrupted Process commands are not automatically resent. Browser integration uses WebMCP where the browser provides it.

Known Issues

Recorded Scene playback is bounded to the supported WGS84 trajectory data; general three-dimensional state and metric projection remain outside that contract. Native experiment matrices are limited to 256 runs. The broader spatial simulation contract remains in development.

Windows native lifecycle write capabilities remain disabled. Optional connected lifecycle, Execution Grants, archive Keychain custody, enterprise-general, CUDA, and FLINT capabilities require explicit packaging selection. This candidate does not newly enable them.

Documentation Updated

The simulation guide documents saved population inputs, recorded playback, and live physics cells. The programmable CAD guide, view guide, language feature reference, and diagnostics reference reflect the bounded capabilities and current behavior. The interface guide explains the compact workspace menu, deliberate reveal and Code tab behavior.

Grid 0.71.2 — Upcoming (not released)

Summary

This release completes the selected native model lifecycle implementation: file binding and ancestry, Copy/Fork/Move, retained versions and Restore, and consented automatic upgrades. Availability depends on the active native owner and platform capabilities. These notes describe source development; they do not announce a published Desktop package.

What's New

• Distinct Model ID and authenticated File ID, with locked mismatch recovery.
• Copy, Fork and Move actions that record model and file ancestry.
• Named program revisions and retained-version Restore.
• Signed connected updates and retained update data for disconnected use.
• Password-protected Save and encrypted upgrades using an explicitly unlocked archive key; optional macOS Keychain retention requires selected packaging.

Improvements

The optional native ledger owner can now commit a locally certified contract result and its spending authority changes in one transaction, retaining the original receipt through duplicate delivery. This development route does not activate a validator, wallet workflow, replicated service or finality capability. Fact admission, complete dispatch and operational evidence remain unfinished.

Persistence writers now share staged file publication, explicit uncertain-write outcomes and bounded copying. Desktop and hosted document operations share a storage-family policy catalog while retaining their existing database snapshots, identity checks and recovery owners. This introduces no archive or database format migration.

Selected revocation and Library/Solution unload and deletion reuse the existing bounded training and facade cleanup under their model publication fences. Failed revocation cleanup retains its durable pending stop for an authorized retry.

The selected Solution catalog can carry explicit entitlement facts and independent local approvals. Startup binds their exact releases and signed requirement graph; current admission and revocation use the complete existing grant lease set. Cycles, unused extras and identity substitutions refuse.

Commercial recovery and reopen use a dedicated authenticated session tied to the current document, model, incarnation, file, revision and operation. The frontend adopts that session only after the native owner proves the completed publication. Completed reads retain the original accounting owner.

The Core development API can prepare signed pure extension code for a Solution with exact payload verification and importer-scoped manifest pins. Preparation creates no grant or runtime installation. Exact extension commercial facts now join current Owner checks and canonical report-charge preparation, including shared release sets. Executable extension dependencies remain unsupported until their isolated model lifecycle owners are joined.

Bug Fixes

Interrupted commercial publication retains the original operation and sole outbound owner. Terminal cleanup completes before admitting committed output, and unchanged completed files reopen through their existing authority. Stale window claims and session selectors refuse admission or reads.

Compatibility and Migrations

Version labels alone do not authorize an upgrade. Updates require verified publisher authority, compatible state, an allowed version range and explicit consent. File-ID mismatches remain locked until the supported recovery action completes. Lifecycle operations preserve the single native evaluator.

Experimental Browser development

Internal native Browser source now accepts verified Cloud identity through selected private document entries and preserves current File authorization before stale-session cleanup. The selected Browser client also reconnects when its Receiving document lease changes, preserving unsaved text and focus. Public Cloud Browser support remains incomplete and unactivated; this source work does not announce product availability.

Internal Windows Browser source also gains fresh private profile-directory custody alongside its process owner. Windows kernel execution and the complete provider/package integration remain unverified and unactivated.

Compiler V3 development

Comments and parentheses around a backtick template now preserve interpolation in View text, including confirmation messages and download filenames. Literal-only headings and paths retain their existing checks.

Implicit action identities now follow canonical template-label syntax and recognized client events. Comments, parentheses around template expressions, and equivalent key escapes no longer rename these actions. Existing unkeyed template/event touch and outcome IDs change; literal-label and explicit-key button IDs keep their previous rules.

Private record bounds now measure the JSON-serialized literal value against the 64 KiB limit, including direct and imported literals. Comments and grouping no longer consume the limit. Large literal values that previously bypassed the source-width check are refused; unused bounds and the 8 MiB total constraint limit retain their existing rules.

Native compiler checks cover these acceptance changes on the V3 development branch, including PAGE titles and Needs reasons. Complete V3 View admission, the pricing DSL proof and cumulative performance verification remain unfinished.

Known Issues

Evaluated commercial files with a changed File ID remain locked; recovery of copied finite-grant histories and transfer to another accounting owner are unsupported. Windows lifecycle write capabilities remain disabled. Persistent archive-key access still needs verification in a correctly provisioned, signed macOS application. Session-only keys require unlocking after process restart.

Documentation Updated

See model identity and versions for the operation semantics and capability limits. The lifecycle investigation retains the implementation and local validation records.

Grid 0.71.1 — 2026-10-06

Summary

This patch repairs Linux server startup and includes Execution Grant storage and recovery corrections, with continued native model and file-lineage work. Linux Server is published. macOS and Windows builds remain on hold. Marketplace purchasing remains unconfigured.

What's New

The Execution Grant changes add no new features. Native model and file-lineage development remains subject to the supported platform and capability boundaries described in the model lifecycle guide.

Improvements

Unsupported recovered observation requests refuse before creating an execution host or changing resident state.

Bug Fixes

• Compare validated raw Source SHA-256 hex with its prefixed native digest consistently, so valid original-storage metadata is accepted.
• Write fresh Source10 transactions using the checksum envelope required by their existing reader and recovery implementation.
• Validate commercial native creation against its actual journal snapshot reservation and directory identity, rather than an ordinary editor receipt.
• Preserve specific recovered-operation errors after all enclosing authority checks succeed; enclosing proof failures still take precedence.
• Quote the Linux Supervisor environment using its actual parser grammar, so structured logging settings no longer prevent the server from starting.
• Update the WebAssembly engine and enterprise token-validation dependencies to address upstream security advisories.

Compatibility and Migrations

The Execution Grant changes add no schema, dependency, evaluator, default capability or automatic migration. Existing malformed transaction files are not silently repaired or adopted. Existing authority, custody, hash and directory-identity checks remain required. The local --observe-library option is explicitly unsupported; omit it to use existing authenticated root recovery.

Known Issues

Execution Grants remain development tooling. Marketplace purchasing is unconfigured, and recovered checkpointed observation requires a future native-frame publisher. Integrated resource and Performance assessment remains separate and unmeasured by this patch; no support or budget claim is added.

Documentation Updated

Execution Grants guide documents the fixes and the explicit unsupported-observation boundary. Model lifecycle guide describes model identity, file ancestry and supported native lifecycle operations.

Grid 0.71.0 — 2026-10-05

Summary

This development line adds explicit reactive templates for tagged literals and system-level Runtime Links for external Python installations.

Grid 0.70.0 was not released; its work is included here. That brings React into Views, the Network → APIs workspace, System → Logs, persistent Browser surfaces on macOS, extension literals, frozen Gallery catalogs and native App records. It also carries the consolidated development of organizational security, governed records and workflows, commercial execution rights, industrial connectivity and coordination layer-based connected and disconnected execution. That program is not yet complete or validated. Core's existing execution-grant foundation is not a purchasable or default-enabled licensing product, and the commercial increments below retain their development status. Manufacturing, Sensitive Research, Care and Defense Logistics are planned as Solutions using these shared capabilities.

The Linux Server 0.71.0 image is published, but its deployment failed startup verification and is awaiting a packaging repair. macOS and Windows desktop Builds are still pending; desktop publication is not yet claimed. The product source is frozen at release-0.71.0-source-8; subsequent 0.71.1 Execution Grants and File Lineage changes on main are outside this release.

What's New

<json template>{"total": {{Quantity * UnitPrice}}}</json> follows its input dependencies through the normal compiled formula runtime. start="[[" end="]]" overrides the format’s defaults when needed. Compilation parses static structure and lowers native construction; it does not install a template interpreter in the model. Existing literals keep their current behavior.

Built-in adapters cover text, JSON, YAML, TOML, CSV/TSV and HTML/XML/SVG. Static keys, headers and markup names remain fixed. Additional formats can declare a template export; a constant parser alone does not enable reactive insertion. See reactive templates for supported contexts and current limitations.

System → Runtime Links connects installed Python runtimes to extensions across models. Check an executable, save its configuration, and apply it for the next extension workspace activation or host start. The system owns runtime paths; models keep portable extension dependencies. Packaged Java and .NET runtimes continue to need no separate setup.

Gridoc lifecycle development distinguishes logical Model ID from bound File ID, records model and file ancestry, and keeps identity mismatches locked for an authorized decision. The approved management workspace connects to native Version, Copy/Fork and supported Move owners. Explicit connected-origin support acquires signed updates for compatible application at next open and retains update data for disconnected use. Receiving-model mutation and commercial root recovery integration are still in progress; encrypted automatic upgrades need an independent archive credential owner. These changes are development work, not a statement of complete platform or packaged-product support. See model identity and versions.

Browser surfaces on macOS 14 or later can select incognito = false to retain cookies and site storage between application sessions. Each model/surface and workbench has its own profile, and its sign-in popups use that profile. Private sessions remain the default. Reopening loads the configured start page; tab history and sessionStorage do not survive closing the page. This is device-local persistence: browser profiles do not yet travel with a gridoc.

Extensions can declare notation tags activated through scoped imports. Compilation turns those literals into native values; formatting and syntax inspection preserve the original notation. The first package imports UTF-8 GEDCOM 5.5.1 and 7.0 genealogy records, retaining uncertain dates and relationship qualifiers and providing tables for native graphs. Export and pedigree rendering are outside this delivery. See extension literals.

Operational logging now has startup configuration for platform output, rotating local files, or off, with severity and per-stream storage limits. Server operators can inspect retained output through the admin API; desktop access is restricted to the owning workbench. System → Logs provides recent output, filtering, manual refresh, and routing, severity, rollover and retention settings. Changes apply on restart; durable audit records and crash reporting remain separate.

API services now live in Network → APIs, with Services for installation, credentials and requests, and Activity for redacted calls, jobs and subscriptions. Import a schema or define multiple HTTP operations with fields, example URLs and response samples. The configured agent can draft a definition for review, explain failed checks, or prepare a model-use prompt. Test installed APIs with labeled inputs, compare operation summaries when preparing a new version, and review the normalized definition before installing it. You can check a received JSON response separately without making another provider request. Code retains model source and pinned imports; saved Code API links offer a handoff to Network. This is authored development work, not a published desktop update.

Security development workstreams formerly labeled 0.67 and 0.68 now share one delivery plan, begun as the 0.70 line, and its cross-feature testing campaign. These historical branch labels are separate from the main-line 0.67.0 and 0.68.0 release notes. Organizational permission, commercial rights, review approval and coordination layer ownership remain independent checks. Solutions supply domain behavior; Core supplies enforcement and execution. See the Security and Execution development guide.

Manufacturing and sensitive-research gap reviews now have separate Solution proposals and shared platform task cards. Business definitions, workflows and role experiences remain in Solutions; related-record transactions, disclosure, retention, key recovery and governed external operations extend common platform owners. This is a planning update, not newly delivered MES, laboratory or regulated-research functionality.

An experimental Core embedding API admits signed unlimited extension rights and keeps finite report allowances on one offline owner. No marketplace, seller onboarding or purchase button is enabled by this work.

A View can now hold React wherever an outline line is not enough. A line that is one <jsx> block is a React subtree: it sees the model values it names, each local with its setter, and imported components by their tag names. An indented block beneath it becomes its children, and a named action it calls runs as an ordinary action, so React can write the model. Every setting an imported component declares is now a phrase, including refs, component-valued settings and callbacks, whose values are written as <js>. A surface can respond to the keyboard, the window and its own lifecycle with on key, on resize, on visible, on mount and on unmount; FOR … IN <js>…</js> filters a list in the browser; and an element may place itself where the data can stop it, which renders a hierarchy to any depth the data has.

A surface whose whole body is one <jsx> block holding a Component program is a Component surface declared in source. You no longer list what it reads and writes: the compiler takes the names from the program's own calls. Convert to SURFACE in Code reviews an existing Component in that form, shows the declared and derived contracts side by side, and leaves the program unchanged. Eject to Component now produces the View's outline as readable JSX that you can extend with ordinary React. On a build that does not run custom JavaScript in place, such as the default desktop build, a View like this is offered as a sandboxed app; publishing one works again, and its package carries the code editor only when the View uses it. See the Views reference.

Improvements

The explicit General enterprise server package adds protected Source, atomic record updates with exact retries and history, independent Human record review, and durable Human workflows. Operators select enterprise-general at Build and prepare the documented encrypted Linux environment, identity provider and archive. Ordinary packages keep their existing entry points and capability selection. Commercial licensed execution, Defense and wider industrial workflows remain outside this MVP. See the enterprise operator guide.

Frozen Process definitions now show retained ASK turns beside their exact steps in Sequence and Diagram. An explicit saved-record check shows each step’s saved values and completed receipts, with distinct frame and occurrence identities. Start setup offers explicit Installed methods selection; choosing a method preserves its reviewed identity and starts work only when you press Start.

Process participants can use saved author, explain and research profiles with their configured provider, instructions and limits. Native source tools and final author checks charge the existing Process budget; compiled Evaluate cases use the same harness. The default model binding stays unchanged, and conflicting or unsupported profile choices refuse before dispatch.

Native regression coverage exercises continuing sessions and remote operation owners together, including disclosure withdrawal, FRESH, pending restart and replay that makes no new provider calls.

Template syntax inspection, formatting and canonical reconstruction retain custom delimiter choices without executing extension code.

Process and model-publication records share more serialization code while preserving JSON encoding, byte limits and receipt identities.

Grid services defer constructing unused missing-model sessions until needed. Tensor-enabled hosts retain startup device validation.

• Formatting shared Process fields preserves the recipient list and keeps the complete investigation example valid. The selected Process author adapter rejects incomplete or ambiguous JSON before checking generated source; its final checks now reserve the root's tool budget and retain exact evidence for call-free replay. Broader product profile integration remains in development.
• Installed simulation environments can explicitly branch an immutable state or reset it to the original population and seed. These operations keep their ancestry and consume the same Process budget; live document owners refuse them.
• A failed Process operation that already changed something retains its receipt and requires explicit owner recovery before further operations. Reporting and independent siblings can finish; replay cannot bypass the requirement.
• Remote Process execution remains under development. The receiving-owner foundation preserves original operation records across worker restarts and fences expired workers. An internal authenticated connection transfers original receipts without retrying uncertain effects. Source-side checks fence cancelled writers and require the original durable attempt before connecting. The native journal pins the selected route and retains original remote receipts for recovery. A selected native adapter can pass verified results through the existing source acceptance path while preserving both original receipts. Explicit receiver acknowledgement preserves the separate source and receiver receipts, and a lost acknowledgement response can be recovered without repeating the effect. Selected pending remote operations can reopen with their original route and obligation; resuming does not send a request or renew the budget. Native hosts can install exact remote routes alongside local operations; missing remote authorization refuses before the Process starts. Completed remote results can be inspected and replayed from their original receipts without contacting the receiver or repeating effects, including after reopening the source. A collection can retain a declared remote failure, replay it after reopening, and acknowledge the original failed receipt without turning it into a successful result or repeating the effect. An explicit stopped-operation check now connects to the original remote owner to recover its outcome while keeping the Process stopped. Checks preserve the original lookup limits and never repeat the effect, including after a lost reply or cold reopening. An explicit acknowledgement of a recovered stopped outcome keeps the Process stopped and retains its evidence until the original receiver confirms the outcome, after which the run can be removed. A lost confirmation can be recovered without repeating the effect. End-to-end remote execution remains under development.
• With an installed native session owner, Process EACH loops continue each member's conversation and preserve separate histories. Loops that make no model calls keep the conversation protected without spending call quota. Session-member collections now use the same bounded lanes and retain results with their original ownership. A fresh session turn resets conversation history under the existing ownership and budget. Snapshots can pass through child Process parameters while retaining their exact session type. A member can supply a fresh child conversation with its immutable setup and private inputs, without copying its conversation history or spending its continuing-call quota. Native session adapters also preserve shared scalar inputs and withdrawals across accepted turns and reopening, including changes made under an existing conversation claim. Anonymous inputs retain their identity without gaining a retractable name. Session-member loops and collections can now share and withdraw named inputs through the original durable owner. Exact session snapshots also support sharing and withdrawal before a loop or collection, including an empty snapshot. A stale, busy or incompatible recipient refuses the whole batch. Installed native session adapters may also select a context policy: it preserves setup and current inputs, records omitted history, and keeps complete accepted exchanges available for later turns and replay. Native disclosure receipts also preserve original media bytes and timing, with receiving-profile checks and withdrawal before later delivery. An explicitly installed media/session grant now connects authored sharing to the original media owner and the receiving profiles; revocation prevents later delivery of retained media. Individually addressed members retain one claim across sequential and repeated turns. These scopes and member loops can resume a saved human question after restart without repeating accepted model calls or renewing quota, including runs with explicit fresh turns. Private child and snapshot-control recovery preserve original setup, receipts and human questions across native owner restarts. Captured rejected answers, including FRESH answers, retain their original failure records and quota across restart. Native interruption tests now cover a durable response, acceptance, or captured failure committed immediately before session acknowledgement. Recovery preserves the original call count and quota through repeated restarts. Claimed-member shares and withdrawals now resume from their original receipts, including controls around fresh turns, without reapplying changes or renewing quota. Room admission now keeps private session members separate from public room roles. Inspection can replay retained local operation results without a live provider or changes to the original run. If an accepted model response is missing, inspection now refuses before calling a supplied live responder. Native session inspection now uses the original read-only owners and includes dynamic members and fresh children. Public-room restart and interruption checks preserve original calls, quota and unknown-outcome fences. Unknown runs retain their original evidence after reopening; audiences spanning independent owners are rejected.
• Installed document owners expose revision-bound assessments and disputes; dependent documents retain their contents and show the disputed input.
• Native learning trials retain repeated runs, discarded alternatives and unknown costs. Explicit adoption pins the compiled plan used by new episodes, and memory consolidation preserves the original evidence behind a lesson.
• Selected Libraries and Solutions now share bounded resident tracking for signed revocation. The host checks each affected model's saved and live identity before stopping it; ordinary calculation does not participate in this tracking. Selected source-Solution prerequisites participate in that tracking. Pending stops are retained before drainage so interruption cannot restore admission after restart; broader source and job reconciliation remains unfinished.
• Selected report callbacks now hold per-grant leases against signed revocation, while reports on unrelated grants remain independent. Retained but unstarted reservations recheck current rights and model state before first execution; reconstructed management also checks durable revocation before a retained reservation can reach its model-restoration callback; explicit recovery remains separate from permission to run new work.
• Development lifecycle requests now bind the model's incarnation as well as its exact compiled image. Delayed requests cannot target a successor that reuses a deleted Library's name. Signed issuer-status observations retain their sequence and digest across restart without issuing capacity or replacing the original purchase reservation.
• A Core development API now verifies a bounded, complete graph of signed Solution dependencies against separately trusted publisher keys. This checks package integrity; selected execution additionally requires current rights.
• Dependency source compilation keeps package-local imports isolated, avoiding collisions between packages with the same filenames. It uses the existing compiler and compiled formula engine, with explicit local admission for public or unlimited physical prerequisites. Finite prerequisites and portable imports remain unsupported.
• A development-only dependency-rights inspector binds those exact packages to signed commercial facts and rechecks current unlimited grants and local policy. Its observations alone are not execution permits; selected management holds all required grant leases through fresh admission and effects.
• Administrator-owned dependency catalogs now prepare exact signed graphs and frozen prerequisite policies under shared startup limits. Preparation alone cannot approve consent or execute dependent code. Selected consent, signing, activation and execution now check current prerequisites, while exact accepted delivery replay preserves the original receipt without adding capacity again.
• In-progress recovery work distinguishes an interrupted first publication from a completed model whose files were later lost. The schema-8 migration is explicit: legacy history never becomes permission to recreate files, and startup never migrates or resets an existing journal automatically.
• Bounded scalar Solver report evidence is under integration for the Lamp-works reference journey. It uses the existing compiled formula engine and must retain actual objective dependencies; broader Solver forms remain unsupported. This is not yet a packaged developer preview or a global-optimality certificate.
• Development lifecycle coverage now checks that stopped licensed Libraries retain queued Stream events without allowing source ingress to reopen them. Authenticated reopen resumes consumption; deletion retires subscriptions. Healthy subscribers on the same source can now process retained events despite another licensed model's cold-admission refusal. The overall operation remains incomplete; broader backlog isolation and resource recovery remain work.
• Interrupted Library admission now clears partial compiled formula state before or after isolated-service attachment, including previously obtained runtime handles. Ordinary calculation does not perform these admission checks.
• Private Library replacement recovery now validates saved execution bindings before publication or acknowledgment, and interrupted restoration discards its replay cursor. The replacement endpoint remains disabled.
• Library restoration now cleans up partial licensed runtime state on errors or unwinding, including its collection replay cursor. A cleanup failure stops the selected host rather than letting uncertain state remain usable.
• Cold licensed loading now checks saved execution bindings against the admitted compilation, refusing substituted input mappings and inconsistent contracts before restoration. Warm calculation does not repeat these checks.
• Failed finite Solution restoration now discards partial runtime state before another load or report can reuse it. Saved state and paid reports remain available for recovery; ordinary calculation is unchanged.
• Licensed Library and Solution reopening now refuses saved inputs that cannot be bound, instead of silently skipping them. Fresh report hydration uses the same check, preserving saved state and allowance on refusal.
• All 29 advertised local execution-grant actions now have shared success contracts and frozen client examples, including checkpoint and revocation observations. Signed authority remains independently verified; provisioning and the complete cross-repository product are still unfinished.
• Proof and signing-input replies now have bounded, request-bound client contracts. They reject wrong identities, signing domains and malformed encodings while preserving the required separate signature and authority checks.
• Shared client contracts now distinguish consent preparation, cancellation, inspection, initial/refill activation and terminal closure. Recovery clients can compare exact retained receipts without mistaking an acknowledgment for current execution rights or payment evidence.
• Grant inspection replies now have a shared client/host contract that preserves large counters exactly, checks allowance conservation and matches the expected owner. Revocation and recovery remain explicit; a snapshot is not permission to execute.
• Shared client contracts now check licensed model load, unload and deletion replies against the expected identity and executable image. Solution deletion explicitly retains paid evidence and its protected ID. Existing wire formats and lifecycle effects are unchanged.
• Authenticated local capability discovery lets Core clients inspect their permitted, mounted grant operations without loading models or reading the owner store. Bounded, request-bound replies omit unsupported operations and do not substitute for grant, model or allowance checks.
• Finite report replies now have a shared typed host/client contract with frozen fixtures for all five operation states. Clients can reject unrelated replies and inconsistent result IDs without changing existing wire fields or statuses.
• Core clients and the selected host now share a bounded typed error contract and frozen conformance fixtures. Existing error codes and HTTP statuses are unchanged; malformed or mismatched replies cannot masquerade as valid failures. This does not enable a new route or automate purchases, retries or refunds.
• Private replacement now clears old model-local HTTP job authority and caches before publication or reload, preserving shared caches and other models' work. Deadline-aware cleanup retains consistent partial progress for retry without initializing unused services. Broader lifecycle integration remains unfinished.
• Private replacement preparation now advances live external request identities, including zero-revision entries and unchanged-source edits. Conflicting new requests refuse recovery rather than silently altering a prepared snapshot.
• Experimental lifecycle cancellation can bound publication-lock and worker completion waits without adding checks to ordinary calculation. Full replacement cleanup integration remains unfinished; a cancelled status alone does not prove its worker has stopped.
• Training workers now retain unfinished-work ownership independently of status, allowing model-scoped cleanup to wait for cancelled work without scanning job history. Queued disposal and unwinding retire ownership; job IDs refuse exhaustion. Private replacement waits for training retirement before publishing or reloading.
• Training-job cancellation now looks up only the affected model's active jobs, without scanning other models or retained terminal history. An unused training store stays uninitialized during cleanup; progress updates do not query the index.
• Temporal result-cache cleanup now removes the departing model's indexed keys instead of parsing every cached key. Shared connector results, other models' histories and exact cache keys are preserved; cache reads do not query the index.
• Capability-ticket cleanup now looks up the departing model's ownership rather than scanning all tickets and owners. Other models retain their claims on shared tickets. The expanded index is allocated only when capability work uses it.
• Managed rule-run IDs now stop at exhaustion rather than wrap and reuse old identities. Pending events remain intact, existing effects can still recover, and unrelated rules continue. This check runs at managed-run admission, not during ordinary formula calculation.
• Extension runtimes retain validated manifest identities and export bindings at installation instead of rebuilding them for every invocation. Compact indexed records avoid repeated export scans and package-name copies while preserving complete binding and live-policy checks.
• Selected hosts can verify signed unlimited package rights before installation. Ordinary installation refuses packages marked as requiring admission. native embedders can now retain sealed verified Library material for later admission; installation still checks current rights and refuses revocation. A closed Library-model compiler now retains exact source/executable identity. A separate authenticated Library loading route now persists customer-authored models with exact package/source/executable identity. Model-local service selection and coordinated revocation use the existing compiled formula engine and fences; cold reopening requires fresh admission, while warm retry preserves inputs. Cold reopening restores saved rule history and pending effects with their original identities; malformed known fields refuse before loading. Warm retry does not resurrect already-completed effects from an older saved checkpoint. Independently authorized unload stops the matching resident and reclaims its admission slot without deleting saved source or inputs. It remains available after revocation; editing needs separate lifecycle work.
• A separate opt-in model-deletion journal retains exact retry identities and staged cleanup progress across restart without changing allowances. Selected hosts connect it to independently authorized Library deletion: protective records survive unfinished cleanup, and completed retries leave replacement models untouched. The journal must be provisioned explicitly; ordinary deletion still refuses licensed models. Cleanup Performance and full lifecycle auditing remain unfinished.
• Authenticated Library and Solution loads now respect unfinished lifecycle recovery, even before a protective marker is saved. A lost journal acknowledgment cannot be bypassed by loading again or omitting the journal at startup. These checks occur at admission, not during calculation. Report dispatch observes the same pending work: fresh execution refuses, while retained retries use recovery-only handling—even for unexecuted reservations.
• Library replacement preparation now shares durable retry history and model exclusion with deletion, so a prepared deletion cannot race a replacement. This is an internal development API, not an enabled editing endpoint. The lifecycle journal uses schema 11, or schema 12 for explicitly selected native source-publication receipts. Earlier metadata needs explicit migration; unsupported execution never silently resets or recreates a store. New image/snapshot storage is reserved with intent, and actual byte lengths are checked before writing or recovering publication. Completed/cancelled receipts retain their charges; final full deletion releases them safely. New admitted replacements reclaim terminal preparation snapshots and obsolete indexed images under fresh model authority, preserving current/incoming images, receipts and paid history. Storage quota is released only after durable cleanup; partial cleanup and uncertain commits remain recoverable. The two-image and two-snapshot limits remain unchanged. Legacy/auxiliary-file accounting and remaining integration are still unfinished; replacement is not yet mounted. Selected reopening of legacy images now refuses symlinks, special files, incomplete compressed streams and trailing data, while comparing exact admitted bytes through bounded buffers. Ordinary loading is unchanged. Fresh selected loads prepare bounded record/image bytes before shared-loader effects and fail on initial or ONCE-state persistence errors. This is not yet whole-home storage accounting; ordinary persistence behavior is preserved. A new internal owner API reserves exact initial payloads against the same model/owner capacity budget, survives restart and preserves retained-evidence charges. Fresh Library/Solution HTTP loads now use this reservation and require a configured lifecycle journal; capability discovery reflects that requirement. Initial writes now use fixed pending files with exact-byte recovery support; failed retries cannot generate additional temporary names. ONCE-state saves verify the compiled image without rewriting it. Initial-load routing to journal-backed recovery remains unfinished. The owner now retains the exact prepared first record atomically with its storage reservation. Private recovery restores those bytes without regenerating timestamps or metadata order, requires fresh write permission and refuses to overwrite a changed visible record. Explicit recovery routing and broader mutable-record accounting still need integration. The owner journal also supports bounded record updates: reserve exact candidate bytes before writing, preserve both snapshots through uncertainty, and retire the old snapshot only after verified durable publication. This internal protocol now has a journal-backed host writer/recovery adapter, including fresh file durability checks before snapshot retirement and pending-update admission refusal. HTTP load failures retain journal intent and files for recovery; Fresh authorized cold-load retries can now finish retained record updates before hydration, validating both snapshots and refusing newer metadata or missing images. Initial missing-file recovery remains unfinished. Required-persistence activation failures no longer retain an uncommitted ONCE candidate in the host's memory; durable recovery files remain untouched by that shared-loader failure path. Cold Library/Solution loading can now persist uncaptured ONCE values through the same journal-backed writer when the complete current snapshot and saved files match. It refuses newer metadata or missing files instead of rolling back edits or reconstructing an old image. Fresh report requests now use that same persistence path after capture-subject and use-policy authorization; retained report recovery does not execute it. Reports whose selected outputs depend on unsealed ONCE state remain unsupported by the existing evidence contract. Core now includes frozen, signed finite/unlimited initial-delivery test transcripts with separate trusted scope and public test-key pins for downstream conformance. They are not production keys or proof of a complete commerce flow. Frozen refill and closed-without-issuance transcripts now include retained signed history and correctly signed rejection examples for downstream verifiers. Preparation snapshots retain exact saved-state identity for recovery, refuse publication over intervening input/metadata edits, and avoid overwriting later inputs when a publication response is lost. Internal replacement authorization separates recovery from permission to execute, preserving stop/recovery after revocation. Candidate-record preparation refreshes compiler metadata while preserving saved inputs and user metadata, refusing edits that strand saved input bindings. Internal publication recovery now prevents stale in-memory source from overwriting a visible replacement after a lost response; an unreadable publication outcome stops the selected host for explicit recovery. The private coordinator now joins durable publication to saved-input and same-source rule-schedule restoration. Interrupted restoration stops the partial runtime; revoked published recovery finishes stopped, and completed retries leave later customer edits untouched. Publication and restoration now share the operation deadline; expiry retains recoverable state rather than renewing drain time, with separate safety cleanup for partial residents. Explicit cancellation now proves the old saved state remains before clearing pending work, and retains recovery material if its own acknowledgment is lost. Replacement also refuses outstanding rule events/effects and unreadable saved scheduling state rather than dropping them. Saved rule run IDs are retained across source edits and rule removal/reintroduction; uncheckpointed live run history refuses replacement. Retained Predicate evidence is checked against the candidate before new intent or publication recovery, without repairing or rewriting the journal during preparation. Incompatible edits refuse while preserving the original evidence. Graph replacements likewise check saved patches and semantic checkpoints before intent. Compatibility metadata is made durable before the new source, while retaining the old source for safe interruption and cancellation. Local process-loss tests cover eleven combined Graph/Predicate/durable-map interruption points, preserving saved inputs, audit evidence and receipt identity on recovery. Source-authored map state survives changed cell bindings, with subsequent mutations invalidating the new consumers; completed retries stay cold. These tests do not establish machine power-loss durability or public-endpoint recovery. Collection checkpoint identity reuse across reload is corrected, so delayed saves cannot acquire authority over a re-registered model. Private replacement now refuses unsaved collection changes before intent and preserves normal-save retry; settled registrations fence delayed exports before preflight. Saved collection files now receive bounded read-only integrity checking and candidate replay before intent. Broader combined-state and performance verification remain unfinished. Saved Planning/Routing mutations are now checked through read-only native replay before replacement intent/publication, preventing invalid histories from first being discovered after the new source is visible. Source-changing operational edits and output destination reconciliation remain unfinished. Host editing integration is unfinished and no replacement endpoint is enabled.
• Solutions can carry the same signed required-admission marker. Ordinary installers and catalog loading refuse these artifacts; selected verification checks the exact signed release and current grant. The selected source-module adapter binds compiled compiled formula and report evidence to that signed source. Actual authenticated host integration and portable-template admission remain unfinished.
• Finite allowances apply to durable accepted results, with restart recovery, duplicate protection and fenced cancellation. Calculation itself is unmetered.
• Provisioning development APIs verify signed challenges, owner consent and commerce/delivery receipts against exact identities and terms. The complete authenticated acquisition and activation workflow remains unfinished.
• Independent CLI and Registry development tools now support carried-file consent, initial delivery, checkpoint acknowledgment and refill for a provisioned local owner. The issuer retains signing intent and exact issuance history before exporting rights; the CLI checks approved signing scope and model identity. Marketplace purchasing remains unconfigured. The grant protocol is provider-neutral; Grid Cloud's Stripe subscription billing remains separate.
• Initial delivery verification binds the seller's signed offer, publisher policy, target consent and issued rights, including strict carried-file support checking. Receiving a file alone does not authorize installation.
• Selected-owner consent records survive restart and retain the same signed proof on retry. Cancellation and explicit resumption preserve original terms and nonce; authenticated product integration remains unfinished.
• Explicitly selected local hosts expose authenticated grant/consent inspection and consent cancellation under exact operator permissions. Approved Solution and unlimited Library plans can prepare/resume consent after signed artifact preflight; Solutions additionally compile their declared source. The endpoint also exports retained consent transcripts and verifies/retains detached enrolled-signer responses without importing private keys. A separate loopback-only delivery route atomically activates the initial rights against retained consent and the verified package. Library activation creates no finite allowance and installs no globally available code. Separate model loading and publication permissions remain required. These development endpoints do not enable purchasing.
• Initial delivery installs its allowance and consumes consent atomically. Concurrent retries cannot add another allowance or restore used capacity.
• An issuer-confirmed unissued purchase can be closed locally with a permanent consent record and recoverable signed receipts. Unlike cancellation, it cannot be resumed or activated later. Separate authenticated local permissions govern closing and recovery; neither action resets capacity or performs a refund.
• Aggregate checkpoint verification checks capacity conservation and history. Owner APIs support detached checkpoint signing and proof recovery without changing live balances or importing a private key. A selected host route now connects capture, signing, recovery and issuer acknowledgment retention under separate exact grant permissions and startup-enrolled public keys. The selected owner retains issuer acknowledgments across restart without restoring spent or uncertain capacity. Delayed receipts cannot rewind the accepted checkpoint; authenticated product integration remains unfinished.
• Refill verification binds the exact signed offer, consent and new allowance to retained checkpoint history. Offline files cannot substitute a new allocation or stale issuance history. The selected owner activates refills atomically and returns retained receipts on retry, without restoring spent or uncertain units. The selected local host connects this through a separate authenticated route and startup-approved verified Solution. Full hosted model execution and broader deployment policy integration remain open.
• Checkpoint capture retains a consistent snapshot and its signed output across restart and retries. Privacy hashing runs at capture, not during calculation or each report acceptance.
• Signed revocation notices can stop future admission through an independently authorized local route, with bounded retained history and proof recovery. Existing reservations and balances survive. A trusted embedding hook verifies the notice before draining residents and commits only after successful drain; exact retries still drain. The selected host uses a bounded admission index and shared load/revoke lease to drain affected Library models before commit; no per-calculation revocation check is added.
• An independently authorized local loading route can persist an activated signed Solution through the existing model fence and compiled formula loader. It reuses verified compilation, refuses source/image substitution, and preserves the allowance across retries. A separate report route connects exact transaction permissions and current research policy to durable result acceptance. Repeated requests recover the same result without charging again; commercial revocation preserves recovery rights, not security permission. Full model lifecycle integration remains unfinished development work.
• Licensed Solution records retain exact grant, owner and signed release identity. Restart requires authenticated reopening; ordinary source replacement, ownership transfer, cloning, export/import, deletion and report publication refuse the licensed record. Warm calculation still uses the existing engine.
• Independently authorized Solution unload stops resident code while preserving saved inputs and already-paid reports. Exhaustion and commercial revocation do not prevent stopping; retained report recovery still requires current security permission and does not reload code or consume another unit. This is not permanent suspension. A separate selected Solution deletion route now retires active code and inputs while preserving paid evidence under a protected recovery-only tombstone. The model ID remains reserved; evidence purge and reuse require separate retention work. Integrated failure and Performance auditing remain unfinished.

Frozen Gallery catalogs and native App records

Gallery can capture a bounded collection into the existing immutable artifact store and select it through acknowledged setup. Reviews and previews then use retained bytes after live files change or disappear. Capture admits at most 256 files and 64 MiB; thumbnails and bulk review retain their live workflow.

A version-2 App Table can explicitly enable native record forms on a new empty authored table. The existing record owner supplies signed create, versioned update, deletion and read-only command receipt recovery. React, Vue, Svelte and Solid use the shared renderer with a capable host. Populated-table migration, other governed owners and unsupported sandbox transports refuse editing.

Bug Fixes

Unix Grid services accept incoming HTTP connections when the listener becomes ready, avoiding the idle accept loop’s fixed polling delay.

Dedicated Process storage is claimed when a Process operation uses it. Ordinary workbook use leaves the unused store unclaimed; selected storage still refuses conflicting owners and earlier writers. Stores that contain ordinary host data retain the host's startup ownership.

Reading ordinary model metadata no longer creates an unused table database. Saved Live Models remain available when their existing storage is reopened.

Structured serialization preserves native record keys instead of exposing their internal key/value rows.

Programmatic surface/page navigation and run exits retain their route and URL until component agreement. Stale approval and speculative suspended renders cannot take over the committed route's options or focus callbacks.

Closing Pages/App beside Code and replacing it with Browser await the App pane's component decisions. Refusal, changed ownership or a newer close prevents stale removal while primary Code buffers remain in place.

New-model creation carries component agreement through its discard dialog and starter read. Changed work and newer creation intents invalidate old approval; older dialog actions cannot confirm or cancel a newer request.

Folder creation and current-folder merge await component agreement and recheck current folder data. Workspace handoff no longer depends on when React executes an updater; stale targets or conflicting inputs leave the workspace intact.

Scenario departure confirmation rejects approval after its private session or draft revision changes, including changes within the same controller object.

Library deletion of the open model waits for component agreement. A successful response from a previous account/folder cannot clear the current workspace, and work changed while deletion was pending remains visible with guidance to open or create a model. Retention does not undo the server deletion.

Folder switching and signout await registered component decisions. Cross-folder search opens only after acceptance and uses the current folder callback, keeping an older pending search from reviving after a newer intent.

Opening models and examples waits for registered component decisions and rejects stale approval if a private draft changes during the read or a newer open is admitted. Refusal retains the current workspace.

Exported View hosts reject stale destination, Back and source replacement approvals after their component owner or editing session changes.

Published View confirmation respects local component refusal and rejects host approval after the draft or owner changes.

Undo stays with the visible surface while a React replacement is suspended. An abandoned render cannot redirect history commands.

Published Views can report draft checkpoints while still dirty, canceling pending host departure decisions after another edit or owner replacement. Only protection metadata crosses the frame boundary; drafts remain intact. Selected checkpoint clients require an exact host receipt tied to the loaded frame. Reload fences old reports and approvals while preserving drafts. Built-in and exported connectors share the same frame lifetime logic. Once framed protection is selected, a boolean-only report cannot clear it, including after reload.

Grid Views and Builder share visible-owner keyboard history routing. IME, hidden and inert targets cannot run Undo or redirect it to an enclosing editor. Printed Views block outer source history, while native text/select controls retain priority. Each editor keeps its existing history stack.

Code Builder keyboard Undo/Redo and focused header commands now use the same source history as its toolbar. Code/Builder switches retain the editor; nested owners and text fields keep priority, and saving or replacement retires old commands. Running View actions retain their own history.

Packaged UI host guards share an asynchronous close question with other surface owners. Changed dirty reports, frame loads and retirement cancel stale approval, including a dirty/clean/dirty cycle. Loading a frame does not discard its draft protection. Private child refusal still requires transport work.

In-process Grid Views cancel stale departure approval when a retained Form, table draft or observable nested component owner changes during confirmation. The host rechecks a View that has already accepted while another surface is still deciding. Proposals stay intact, and a fresh request checks current work.

Desktop window close now respects in-process surface editors that require Save, Discard or recovery before leaving. Their refusal cannot be overridden by the native discard question, even when they report no unsaved values. Cooperating drafts and Live/scenario work share one question. Changes to the protected editing session cancel stale approval before its close retry. Packaged iframe child refusal and durable local-draft recovery remain separate work.

Sheet model history now joins the shared surface owner contract, so custom controls and the workspace header can reverse the same existing edits. Nested editors keep priority, inactive panes cannot replay the stack, and resetting history retires callbacks from the previous editing session. Shared surface registrations also forward asynchronous history completion and refuse busy or retired owners. The existing edit and persistence paths remain authoritative.

Code Builder's source Undo/Redo buttons now share the editor's history service and follow its actual availability, including read-only and saving states. Replacing a source model retains history ownership on the editor container; callbacks from the previous model cannot undo the replacement. These controls preserve Monaco's existing stack and grouping, with no new global history or persistence.

View actions that only change the page now stay pending until navigation finishes and report a refused transition accurately. Standard buttons and custom React controls receive the same explanation. If an action already saved a model or local change, that change remains successful and its notice explains that later navigation failed. A delayed result from a closed owner cannot replace a newer action's result. Separate Form input saves and earlier viewer effects are not rolled back by a navigation refusal.

Required commercial metadata cannot be bypassed by removing its detached descriptor or entering through ordinary extension installation. This behavior is part of the new admission contract, not a retrofit to existing free packages.

Compatibility and Migrations

• Compiler V3 branch preview, not included in the frozen 0.71.0 product source: direct predicate targets use cell addresses and explicit qualifiers. A1, R1C1, and $A$1 share predicate state in the same context, including declarations, field reads and reactive mutations. Named aliases remain independent. MODEL.TAGS displays direct cells with canonical A1 labels. Models that depended on reference spelling to separate predicate state must use distinct targets. Whole-range and computed membership behavior remains.

Templates are explicit opt-in syntax. Existing tagged literals and constant extension parsers retain their behavior.

Private child decision state for packaged surfaces is prepared internally and bound to the published local owner registry and optional built-in/exported child transport. An internal opt-in shell profile now connects private preparation, one host question and final validation with bounded deadlines. Core App keeps the profile off during asynchronous route, layer and Back caller migration; existing checkpoint reports do not establish private child veto there.

Existing ordinary manifest serialization is unchanged. New required-admission metadata is rejected by older strict readers. native embedders constructing PackageManifest or DomainPackManifest literals must supply commercial_admission: None for ordinary packages. Default Lite and Pro builds do not enable the grant owner. The development report adapter now requires sealed signed-source compilation and binding; callers cannot construct it from asserted release labels. Its private semantic request digest additionally binds source and compiled formula. Replaying an older development request through this changed constructor is not supported; preserve the original operation and use authorized recovery rather than issuing new work to disguise an identity conflict.

The private, unreleased allowance store requires schema 8 for incarnation-bound operations, retained issuer status and durable revocation obligations alongside terminal consent closure, consent and checkpoints. Older development stores are refused without reset; no automatic migration is provided. Preserve existing state rather than recreating its owner identity. The selected development owner now requires private Unix store permissions and refuses symlink-backed or multiply linked files. Non-Unix owner startup is explicitly unsupported pending equivalent storage protection.

Licensed hosted records now carry the private grid-execution-grant-model/2 binding. Ordinary records remain unchanged; current builds without execution grants reject marked records. Older hosts predating the binding are unsupported for licensed storage. Previously unmarked development models are not silently migrated or granted authority by retrying load; preserve their state for explicit recovery.

Existing Views are unchanged except for two cases. A whole line that is a <jsx> block used to display its text as code and is now a React subtree; a model value holding JSX text still displays as code. An element that places itself inside a FOR, IF or MATCH used to be GRID_VIEW_RECURSION and now expands, to at most 32 levels; an unconditional self-placement is still refused. Inline <js> reads a model value by its exact name without USING, which remains for renaming, transport statuses and SCRIPT exports. A View that places a <jsx> line or an imported element needs a trusted workspace, as imported elements already did. Re-importing a React library produces mapping version 2 contracts with more phrases; locked version 1 contracts keep working, and the js"…" string form still parses. Existing Component surfaces keep working and are never converted for you. In the SURFACE form a Component program must write each symbol name as a string literal, and a write to a formula or STATE is a compile error where it was a blocked write at run time.

Known Issues

Markup subtree splicing, dynamic structural names, JSX, music, temporal, exact numeric and coordinate construction are outside the current adapter set. Website tutorial review and publication remain separate work.

Portable browser Save/Resume remains unfinished. Persistent Browser surfaces are available only on macOS 14 or later; other platforms explicitly refuse that setting. Closing or deleting a surface retains its device-local website data.

Full signed provisioning/consent, authenticated management, other package-kind adapters and complete scale qualification remain unfinished. Local component measurements are not general model-performance or hostile-device security claims. Registry issuance and Cloud commerce are separate integrations; no release date or publication is implied by this document.

Documentation Updated

The language reference, reactive template guide, extension literal contract and canonical reactive template example describe the new syntax and execution timing.

The package guide describes the reserved manifest field and development status. The Core implementation record and crate READMEs document trust boundaries, offline recovery, retained component measurements and remaining integration. The Views reference describes <jsx> lines, code-valued phrases, surface events, recursive elements and the Component form; the feature matrix and the diagnostics catalog are regenerated.

Same-model Back/Forward now waits for component agreement and revalidates it before adopting the destination. Cross-model reopening remains unfinished.

Cross-model browser history now uses the existing guarded model reader and adopts the destination folder with its model; native acceptance remains open.

Surface entry shares component agreement and reports eventual acceptance; Find, next steps and bound-element reveals wait for that result.

Custom-app page changes now await shared component agreement. The packaged host reports the parent’s actual result and drops replies to replaced frames.

Layer switches now share surface navigation agreement. Editor commits, exact Data/source reveals, Chat context and layer menus wait for acceptance; late results cannot close a reopened picker or revive a superseded move. Automatic admission and installed browser/native coverage remain in progress.

Automatic model homes now honor the same navigation decision as layer and surface changes, retaining the current view until acceptance and committing departing editor contents before unmount.

Home, Help and Advanced screens now wait for shared navigation agreement. Menus and search destinations honor the accepted result, and returning to the model preserves its existing route.

Code tabs, Back/Forward, area changes, split replacement and surface explorer files now honor shared navigation agreement while preserving editors, drafts and forward history until acceptance.

Code source sections, explicit source reveals, compiler panel changes and new View entry now keep the current editor until shared navigation agreement. History and caret moves publish with the accepted destination.

Opening an authored definition or a Connections/Extensions declaration now waits for shared agreement before replacing Code content or publishing its location. Accepted editor delivery proceeds without another prompt.

Source caret handoffs wait for the matching editor revision and section. Code parse-error jumps preserve an applicable section and await shared agreement; new View entry waits before changing Whole model and creation state.

Conversion and reviewed Process/formula source drafts now wait for navigation agreement before staging Code changes. Refused handoffs keep their reviews open; source, editor selection and dirty state publish with accepted navigation.

Code area entry and older Model/I/O/Research/Replay view commands now await shared navigation agreement. Editor selection, App return context, research intent and accompanying panels remain intact on refusal and publish with acceptance.

Console model deletion now checks shared agreement before dispatch. Late acknowledgement preserves replacement work and command context.

AI suite native-history continuation

The historical 0.68 AI suite continues on this development line. The selected prediction batch owner retains up to 1,024 original rows in sequential chunks. Same-workbook archive replacement now has bounded original-evidence inventory and physical execution fencing in source; ordinary deletion stays refused. Four actual-host archive transaction tests and 133 final owner contracts pass. Paired Performance verification remains pending. This is not a completed or released V2 suite. The approved Predict next-run setup R2 card now labels the next model/input/Run setup and explains that retained results stay unchanged. All 24 matched review cases and 91 Predict component tests pass; full shell/accessibility evidence remains separate.

The selected Evaluate inspector now preserves a drafted human rating and note when observing an interrupted save, and checks the exact workbook, run and case identity before accepting review metadata. Observation never retries the write or recomputes scores. An unconfirmed save now explains the recovery action and keeps the rating and note instead of displaying a raw network error. Focused component tests pass. Source-bound native checks also verify pre-dispatch refusal, a lost reply after an actual committed save, and exact review/history recovery after an abrupt restart on the selected synchronous persistence profile. The complete Document journey, current complete native source and default buffered persistence remain unfinished.

Native evaluation now joins the retained source membership of prepared aggregates and deduplicated rows, including nested preparation and training selections. Eight native lineage contracts and 29 connection/admission contracts pass on an exact captured Pro source commit. Five additional native Pro preparation contracts verify all eight steps, empty/global aggregates and generated source membership through reopened Frames. Unrelated range origins remain unknown. Complete native HTTP delivery, full App journeys and paired Performance remain outstanding. The complete unadapted Pro host and storage guard now compile on a separately captured primary source. Exact binaries and their source hashes are preserved; compilation does not establish App delivery or cold-recovery behavior.

The canonical Demand Pipeline now declares explicit row and time limits for both native training steps: all 504 selected rows and 10 seconds per candidate. The live native journey exposed the missing bounds; a profile alone was refused. The complete local Demand journey now passes on the retained full Pro owners, including all six Pipeline operations and 32 held-out model calls, exact forecast publication, reopen/narrow/dark/Print and native preparation edge cases. The intermittent Evaluate setup refusal and broader suite delivery remain open.

Native AI publication now preserves structured outputs and verifies their exact values before binding. The complete selected Document journey passes all fourteen behavior groups, including exact published objects, review recovery, reopening and Print. Three native contracts verify nested values, integer extremes and refusal of lossy representations. The inspector also preserves the focused review field and cursor when resized. These checks bind the recorded full Pro source and synchronous persistence profile. General complex Frame/compiled formula consumers, default buffered durability and ordinary-path/structured Performance remain unfinished; previously published results are not rewritten and the complete AI suite is not yet done.

Document, Demand and Review approval/decline now also pass on one preserved native source. Selected scalar publication stays within the existing native/API budget; the earlier historical numbers remain recorded. Development adds a durable App save acknowledgement for AI run/attempt/plan references and clear uncertainty handling. Selected native reference contracts pass in buffered and synchronous modes, including persistence refusal. Process waits for the current saved selection before Start and for the matching configuration receipt before refreshing its plan; uncertain setup replies retain the open fields and prevent Start or another save. An uncertain Process selection save likewise blocks Start and subsequent selection writes while preserving the open setup. Current App crash/lost-reply recovery now passes the selected Process plan-reference cases on preserved full native/App source, including acknowledged restart, committed lost reply and an actual storage refusal. Unsubmitted Process setup fields now survive scoped departure and return within the app session. Changed saved setup or compiled process identity requires explicit review/save before Start. Focused contracts pass; live native verification of this later source, configuration durability, embeds, cold-restart setup recovery and broader reference/admission recovery remain separate work.

Writable native document setup saves now use the existing source transaction, preserve the input contract and support Undo and Redo. They wait for the matching saved configuration and refreshed plan; conflicting Code drafts remain in place. Lost or uncertain replies retain the setup and stop further saves until inspection. An unchanged source no longer confirms a different resolved configuration. Focused checks pass, while live native failure/restart, other configuration routes and the complete AI suite remain in development.

Predict, Train and Evaluate now use confirmed setup saves on supported App hosts. Run stays unavailable until the matching save completes, even if the workbook shows the edited configuration first. Newer edits and focus stay in place; an uncertain reply stops another save and asks you to reopen for inspection. Training also waits for the current saved configuration and explains when it needs inspection in Code. Live native failure/restart checks and wider suite delivery remain unfinished.

Native document Process and Tasks now preserve document ownership through Chat, source tools and Evaluate case selection. An unavailable native capability refuses before a hosted workbook with the same name can be read or changed. Switching documents also retires prior requests during loading. Native execution adapters and complete suite delivery remain in development.

Process plan and run selections now require a matching save reply before another Start or reference write. Delayed older updates preserve the last confirmed choice, revision and setup draft. Missing or uncertain replies require reopening for inspection. Native admission and restart recovery remain in development.

Native surface Code configuration Apply now waits for source confirmation and retains TOML comments, formatting and newer drafts. Undo and Redo restore the saved source. Code can repair invalid setup; running still requires valid saved configuration. Uncertain completion stops further saves until inspection. Live native failure/restart verification and complete suite delivery remain unfinished.

The HTTP binary now fixes its buffered or synchronous record-persistence setting at startup; changing the environment later requires a restart. This removes repeated setting reads during edits. Focused startup contracts pass, while configuration durability and full native failure/recovery verification remain unfinished.

Canonical Review approval and decline now pass on the retained complete Pro source graph, including both abrupt native restart cuts under explicit synchronous presentation storage. Approval preserves one original document publication; decline preserves none. Resume, reopen and Print add no model calls or publication. Default buffered crash recovery, persistence-failure behavior and wider suite delivery remain unfinished.

Native Process Evaluate source now admits reviewed role-free or human-only Process comparisons of a trained candidate. Its selected continuation follows the original parent stop and verifies per-case retained receipts and call accounting. Actual-App cancellation now physically drains the first HUMAN comparison without starting another case; an explicit original-outcome check records the failed operation once and keeps the parent cancelled. Native input evidence retains the admitted v1/v2 value identity, including operation-package source inventories. Unowned model connections and workbench Resume without the original native parent control refuse. Explicit original source Resume now reattaches the original case after a hard restart with no redispatch or lookup. Actual-App cancellation and successful four-case completion retain their outcomes when reopened. Native model-connection coverage, broader recovery/App QA and paired Performance remain development work.

Saved native Process evaluation now derives the v1/v2 input identity from original owner-authenticated frozen admission, with no replay or current-source fallback. Legacy unselected v1 remains supported; selected missing/unsupported authority refuses. Focused native contracts, HTTP metadata checking and an updated disposable host link pass. Actual saved v1/v2 scoring passes, including v2 after hard restart, with exact original receipts and zero model calls or extra roots. The selected cached graph is not full-current-product proof; paired Performance remains open. Range membership now compares exact retained bindings: different ranges report unknown pending an authoritative lineage join, instead of treating unrelated columns as training overlap. Retained historical results keep their original observations.

Native source Process evaluation now resolves reviewed saved-default or named provider/model choices through the existing encrypted AI settings owner. Empty and local-only bindings read no credential store; corrupt selected authority refuses and keyless servers borrow no unrelated key. Focused native contracts and separate actual App named/default local-server restart/Resume journeys pass, preserving accepted answers without repeated model requests. Selected compatible credential rotation also refuses the original responder without redispatch. Interrupted native replies now keep their charged call and settle the original unknown evaluation without starting another case or request. Two native crash-cut contracts and the repaired actual App journey pass, with exact original evidence and no repeated work on reopening. Credential-change recovery UX, broader profiles, the full current product graph and paired Performance remain development work.

The canonical Review workbook now refreshes its captured plan after acknowledged destination-review input writes. Start uses that inspected identity while keeping setup and selection; uncertain earlier starts retain their original retry key. Approval and decline pass separate actual App journeys on the retained native QA graph: approval publishes the exact reviewed document and its bound Frame is readable; decline keeps the draft and writes nothing. Reopening and Print add no model calls or publication. Canonical abrupt restart, full current product provenance and paired Performance remain open.

Native cold conversation inspection was repaired after the canonical Review restart check exposed an empty suspended history. The existing durable records now retain bounded display details for accepted and captured contributions, with bytes reserved before dispatch. Older records keep explicit replay/Resume. Native crash-cut/restore Testing passes four contracts. Canonical approval and decline pass both abrupt restart cuts on the retained native QA graph with synchronous presentation storage explicitly selected; original question, conversation, receipts and call counts survive, with one approval publication and none on decline. Full product provenance and paired physical costs remain open.

Process reopening now restores a saved run selection that arrives after the panel mounts, while preserving a newer explicit selection and Resume drafts and focus. All 104 focused component checks pass. The restart checks traced lost selection to the default host's buffered presentation writes: a recent resident acknowledgement can precede durable persistence. This does not alter the retained Process run. Exact published Frame inspection after restart passes in the selected synchronous profile; buffered presentation, persistence-failure semantics and broader acceptance remain separately scoped. This evidence does not complete the suite or full product verification.

Development adds owner-bound native document Process plan and current-outline inspection using the existing sequence and diagram presentation. Start stays unavailable until native execution is connected. Scripted client/UI checks pass; current native compilation, execution and restart recovery remain unfinished.

Development connects native Process source inspection and draft editing/creation to the selected document. Apply keeps the change in Code for review and explicit Save; it does not publish source or start a run. Scripted control and transport checks pass. Current full native compilation, execution and restart verification remain unfinished, alongside the remaining AI suite delivery contracts.

Development aligns native workbook table ownership within a document while keeping separate documents isolated. This prepares shared storage for the remaining Process integration. Current native execution and recovery checks remain unfinished.

Development isolates Process service cleanup on the shared executor. Releasing a service stops and retires its own work while other services continue; saved recovery evidence is kept. This supports the remaining native document Process integration and does not yet enable document Process runs.

Development source snapshot checks now catch stale compiler metadata and refresh changed inputs without changing their bytes. Native execution and lifecycle verification remain unfinished.

Process Start now stops preparation if the panel closes or its owner, process setup or permission changes while selected tools are loading. An uncertain already-sent Start still retries its original attempt. Native execution and durable recovery work remain unfinished.

Process now keeps a returned run through its selection-save confirmation. If confirmation fails, confirming that known run sends no additional Start. Lost Start replies still retry the original attempt. Device-restart recovery and complete native Process delivery remain in development.

Development now connects AI reference saves to the owning native document. Canonical AI data slots are admitted for those saves, while ordinary input writes and input reset retain their existing scope. Current native execution and storage/restart verification remain unfinished; this change does not enable native inference or Process Start.

Development source now retains a native AI reference through compatible Code edits and refuses edits that change its surface kind or slot identity. Native compilation and storage/restart verification still need completion.

Native document Process execution is connected in source to the physical member: authoring, Start, retained history, inspection, Human replies, Cancel/Remove and explicit Resume/replay/fork use the existing canonical runtime, signed desktop identity, shared executor and document model.db. Historical controls restore frozen plans, arguments and accepted turns; current source edits do not replace them. Saved provider/API/MCP choices stay inside the physical context, and the backend checks the root before credential access. Replay calls no provider; a fork creates a distinct run and preserves the original completion. Scoped Start keeps its exact request and returned run through confirmed workbook selection; reopening inspects them without starting work. Conflicting saved copies retain the existing refusal and draft behavior. Live device-store and hard-restart acceptance remain unverified.

All six AI factories are connected in source: Capture uses physical data; Train uses existing document jobs and artifacts; Select retains the exact pin receipt; Predict admits exact member models; Evaluate supports fresh inference, saved predictions and compiled Process comparisons; Publish commits the Frame input, complete native semantic state and receipt together in the existing WAL. Pending compiled Evaluate restores its captured source and case service through the original physical parent. These implementations share the existing workers, case coordinator, receipts and report format.

Current production types and behavior remain unverified. The affected native and transport contracts are authored but unrun; frontend checks could not start because the repository Vitest installation is absent. Native saved compiled-case operation delivery and document-scoped installed-component inspection/Start are connected in source. Native installations use the original trusted catalogue with an explicit document scope and retain exact provenance in the original root. Evaluate subject selection and setup eligibility now tolerate native table-key reordering while preserving exact model and plan identity checks. All 47 affected Evaluate tests pass, including the mounted selection and acknowledgement regression. The original intermittent Demand failure remains unverified. Native trained worksheet formulas now connect to the original native inference worker and compiled formula calculation in source, including changed inputs and physical pinned/exact/latest selection. Registry publication, pin and archive refresh the existing document projection. Their native behavior and current types remain unverified; the execution contract is authored but unrun. Remaining language and UI contracts, supported/installed/default-buffered acceptance and paired physical costs remain open. Closed canonical journeys remain credited. This does not complete the AI suite or imply external documentation publication. Books/Pro remain on the owner’s hold.

Native Dataset Capture, Predict and saved compiled-case Evaluate now connect to the physical workbook's source/preparation, Process service, history, results and rating paths in source. The UI passes its admitted document owner through these calls. Predict examples and retained Dataset batches reuse the existing inference/chunk engine, with physical table receipts, calibration inspection and retained results. Final batch Frame publication reuses the document custody fence on Unix. Saved scoring reuses the existing report engine and executes no new Process or provider call. Fresh Evaluate and its Human/Stop/Continue controls now select the original physical case service, source and inference custody in development source. Continue checks the retained principal, owner and sequence; nested cases retain their original Process parent control. Direct native Publish, destination discovery and formula setup/preparation now use the existing physical input writer and original document source resolver. The existing controls retain their admitted native owner; formula preparation returns a Code draft without saving source or running inference. Direct Train/Select authoring now selects the original physical job service, single-fit trainer and registry; the existing UI retains native context through budgets, data preparation, Start, status, Stop and exact selection. Legacy array training retains its original interpretation. Native external registration, rename and archive now select the original document registry. Uploaded artifact and sidecar digests are verified; registration uses the existing provider validator and publication key, while rename/archive reuse the original registry transactions. Current product types/execution and formula consumer invalidation remain unverified. This change adds no recovery store, test artifact directory or compiler cache. Core documentation is authored; Cloud/Dev import and publication remain outstanding, and Books/Pro remain on hold.

Process turn metadata now retains exact numeric compiler node coordinates within its frozen plan. Repeated prompts and loop iterations can be associated with their original ASK step. Existing inspection storage and byte accounting remain shared; older traces omit the optional coordinate. Full node inspection UI is unfinished. The four existing Process UI suites pass 140 tests; current native execution and paired costs remain unverified.

Native Process pending-operation inspection now identifies its exact frozen step. The existing outcome control forwards the original run and operation revision through signed physical document ingress to the canonical service. Unsupported stopped reconciliation remains refused. Installed-method picker selections now retain their exact catalogue, contract and artifact through the original Start request; the picker remains unmounted pending its named-view proposal. Two actual native coordinate contracts pass. Four affected UI/transport/gateway files pass 146 tests; the picker and bounded Start request files pass 39 tests. Native host acceptance, approved inspection/picker UI and paired physical costs remain open.

Selected record-only replay now projects one frozen page's computed values and completed source-operation receipts with original node coordinates, frames and repeated occurrences. Stale selectors refuse and bounded or unmatched views are withheld whole. Ordinary replay and live-run storage stay unchanged. Four new native compiler/runtime contracts and 107 affected transport tests pass; visible UI, complete native owner delivery and paired physical costs remain open.

Settled native AI inspection now restores original issued references and receipts from the existing read-only journals under the exact current document grant. Repeated inspection adds no AI factory, dispatch, lookup or retained mutation; changed grants and foreign ownership refuse. Two focused native host library contracts pass. Physical endpoint acceptance and the pending visible presentation remain separate work.

New native range captures now retain their resolved worksheet and column span. Train/Evaluate source membership can compare captures with different row bounds through the existing retained lineage owner, including selected training rows and prepared descendants. Unrelated columns/sheets/owners and unattested legacy cross-range sources remain unknown. Existing exact-bind and historical comparisons are preserved, including prepared ancestry with legacy captures. Caller-supplied attestation refuses before capture. Both focused native Frame/catalog contracts pass, including both legacy/current prepared comparisons. Complete native capture, full Pro/installed acceptance and paired physical costs remain open.

Native Capture now passes physical range, values, Table, Frame and asset delivery, including original-owner settled replay without another capture. Numeric Predict also passes with the exact physical artifact and committed inputs. Plain input records and sequence fields freeze as the evaluator's data forms. The combined pipeline's source-coordinate mapping defect in multi-column range Capture is corrected. Its seven-operation Process workflow now completes with correct predictions and fresh/saved reports. The full contract also passes direct Capture/Predict, fresh and saved scoring, manual ratings, revision-checked publication, one scheduled rule firing, inert formula drafting, Train/Select and uploaded registration/rename/archive. Primary physical AI delivery is complete; UI, installed/supported-profile acceptance and paired costs remain separate.

Process zero-field records now recognize the existing compiled formula empty-object identity in closed type checks and bounded result/prompt/inspection projection. Decoded JSON and retained physical records keep their existing carrier. The correction keeps {} distinct from [] and rich typed artifacts, without changing ordinary workbook evaluation. Both focused compiler/runtime cases pass, including exact native codec round trips. This closes the empty-record feature; full suite acceptance remains separate.

Grid 0.69.0 — Upcoming (not released)

Summary

This development release introduces a Symbolic Mathematics workbench for exact algebra and polynomial calculus, with source-owned saved calculations, ordered worksheets and explicit domain conditions. Optional native algebra operations remain package-specific.

Programmable CAD now includes the experimental rectangular-plate workflow with up to eight circular or slotted openings: draw, edit, save, reopen, measure and export exact STEP through native geometry. The broader M2 modeling roadmap remains deferred.

What's New

Models can now simulate rigid-body physics. Declare a world of balls, boxes, and capsules with PHYSICS_WORLD({...}) (or simPhysicsRegions in model JSON), and bind a body's starting position, velocity, material, or the world's gravity to ordinary model cells. A world runs only when you ask for it: through POST /api/models/:id/simulate/physics, or as a Rigid-body physics experiment that sweeps those bound cells. Each run is recorded, replays to the same result, can be saved as a playback frame, and opens in a 3D playback when you inspect it. Example model 06-rigid-body-loading-dock.json shows crates sliding down a ramp. A physics region can also run as a live session: it steps in real time, you click a body to push it, and stopping it records the session with its inputs so the replay can be verified.

A solid designed in the Sketch surface can be a physics body. Publish collider to cell writes the solid's collision shape into a cell, and a body names that cell with shape: { kind: "cell", symbol }. A solid with flat faces is published as the exact convex pieces the Sketch surface already uses for interference checks, so a concave part keeps its notches; cylinders, cones, spheres and capsules are published as those shapes. Physics also gains cylinder_y, cone_y and compound shapes for writing such bodies by hand.

Physics results are now identical on every computer: the same world gives the same bits on macOS and Linux, on Arm and x86-64, so a run or live session recorded on one machine verifies on another. Live sessions also scale to thousands of bodies: the view receives compact binary frames on one streamed response, carrying only the bodies that moved, and draws bodies that share a shape in a single pass.

Code now has an APIs work area with searchable services and operations, URL/file/paste schema import, connection credentials, and a focused request tester. Request drafts survive navigation within the current model session. Copy a pinned import into model source, inspect responses and traces, or open Network → External APIs for calls, jobs, and subscriptions.

The new Symbolic Mathematics workbench factors, differentiates, integrates polynomials, solves and substitutes through Grid’s native mathematics. Save fresh named calculations with local assumptions, then inspect exactness, conditions, solution bindings, root multiplicities and certificate-bound derivation metadata. Calculations and expression bookmarks reopen with the model. Ordered worksheets combine algebra, differentiation and exact polynomial antiderivatives while retaining local assumptions, domain conditions and a single work budget; their complete recipe is saved as an ordinary formula. Polynomial antiderivatives use a zero integration constant and are checked by exact differentiation before an answer is published. Worksheet point evaluation accepts exact rational values and checks earlier domain restrictions: cancelling x/x still refuses a later evaluation at 0. Chosen points are retained when the worksheet is saved and reopened. Reopen a saved local worksheet to edit its original input, reorder literal steps or adjust assumptions. Updating keeps its name and preserves surrounding source; shared step recipes remain editable in Code. Complete and conditional worksheets now offer follow-up steps that reopen the original recipe with its input, earlier steps and assumptions intact. Review the draft before updating the saved worksheet; a point value is always explicit. Continue from complete legacy results with guided follow-up calculations, supplying local assumptions explicitly for each new draft. A bounded session trail supports historical display comparison and JSON export, preserving conditions and truncation notices. Select captures for a printable offline report with typeset mathematics, conditions, source identities and any captured formula. Native mathematical typesetting presents exact fractions, powers and relations, with conventional subtraction and original text available. Exact algebraic roots show their defining polynomial and certified isolation interval or rectangle. Solution values stack beneath their variables in narrow result panels. Approximation displays keep value, enclosure, precision and rounding together. Guided exact matrix entry supports up to 8 rows and columns, with native mathematical display. Saved matrices offer determinant, rank, row reduction, inverse, nullspace and linear-system drafts. These computations retain their existing native capability requirements; construction itself needs no optional backend, and unavailable computation is refused before source publication.

The ordinary desktop package does not include the optional native algebra backend. Guided polynomial systems, Gröbner bases, multivariable GCD and exact matrix computations require a separately admitted capability; their authoring controls do not make those computations available in every package.

Scientific Image now imports single-file NIfTI-1 scalar volumes, including bounded gzip files, with native intensity scaling and preserved spatial metadata. Save prepared orthogonal header calibration, browse stored slices, and measure regions or volume boxes. Sheared transforms remain inspectable without automatic physical calibration. The importer keeps the current 1,000,000-voxel admission; anatomical reorientation and DICOM remain future work.

Scene adds depth-aware vertex picking, two-point native distance measurements, and saved annotations tied to their source capture. Statistics adds complete multivariable prediction profiles with mean-response and new-observation intervals, leverage and extrapolation diagnostics. Gallery adds collection-wide current-byte review filters and a next-unreviewed workflow across native batches. Advanced controls remain folded; each guide describes its admission and ownership limits.

Scientific Image can now copy an exact selected file-backed plane into a fresh, immutable model image for threshold masks, labels and saved measurements. Reviewed spatial volumes gain native 3D connected-component labels with face, edge or corner connectivity and preserved stored axes. Statistics adds multivariable leverage and Cook’s distance to its folded fit review. Gallery can pin a verified image and compare subsequent selections side by side with shared zoom and linked panning for equal-size decoded images. Each workflow retains its source identity and explicit save ownership; advanced settings stay folded.

Scientific Image can also copy a complete single-channel stored stack into immutable model data, retaining shape, file provenance and reviewed calibration. Native 3D threshold masks use original intensity units and feed connected-region labeling without replacing the source. Statistics adds guided comparison of three–six independent groups with native one-way ANOVA, pooled pointwise mean intervals and observed eta squared. Ready-to-open examples expose the same native formulas. Source size, sample limits and statistical assumptions remain explicit in each guide.

Statistics group comparisons now show native mean intervals on an explicit shared axis, retaining exact estimates and endpoints for inspection. Scene can frame both saved measurement endpoints or center either endpoint while preserving the viewing angle. These navigation actions require the matching source capture; historical measurements keep their recorded values.

Guided nonlinear designs now admit smooth equality and inequality requirements with native SQP, feasibility restoration and measured local stopping results. Statistics offers an explicit Welch method for independent groups with unequal variances, preserving native probabilities and separate pointwise mean intervals. TIFF stacks can copy one selected channel into immutable model data. Scene can review current endpoint slots from a historical measurement before recording a new native distance, retaining the original capture.

The workbenches now make saved setups easier to reuse. Scientific Image measures volume boxes up to one million voxels and reopens saved regions as editable new measurement drafts, preserving their originals. Optimization copies current guided nonlinear designs and resource plans into reviewed fresh reports with their original settings. Statistics optionally compares every group pair with native pooled or Welch tests and complete-family Holm adjustment. Scene exports exact measurement tables with original endpoint coordinates and capture identity. Gallery resumes saved pending reviews after exact-byte and saved-history checks, restoring the note, decision and unverified reviewer label without writing until the existing review save is explicitly requested. Calibrated complete Image volume boxes also retain native intensity-volume integrals separately from raw sample sums and geometric volume; unavailable data or calibration never yields a silently partial integral. Statistics now analyzes aligned repeated conditions without dropping participant rows, with an explicit uncorrected omnibus test and a pointwise condition-mean chart. Optional paired condition comparisons preserve row alignment and native raw outcomes, with complete-family Holm adjustment independent of the omnibus result. Optional Greenhouse–Geisser correction adds native epsilon, corrected degrees of freedom and probability while retaining the uncorrected result and paired comparisons. Copied nonlinear Optimization designs can optionally use current solution coordinates as reviewed starting values. Gallery offers explicit removal of individual saved review records while preserving their asset files. Scene measures three-point angles in degrees or radians, retaining the center point and original capture alongside saved distances. Saved Image measurements export completely to CSV or JSON without reopening their source. Saved Scene measurements remain readable, printable and exportable without geometry; Gallery releases prior audio/video players when changing files or leaving the view.

Statistics optionally adds simultaneous Bonferroni intervals for every declared group or condition pair, retaining exact native endpoints separately from Holm probabilities. Image can jump directly to a known pixel and search the complete saved-region history. Scene exports every native scalar/vector sample with original capture identity. Reopened Optimization solutions retain their original report name and support complete historical JSON and CSV export.

Statistics also offers explicit Huynh–Feldt correction alongside the original omnibus result and optional Greenhouse–Geisser correction. Scene can inspect a known native vertex directly; Image keeps the selected stored coordinate while browsing adjacent slices or channels when the native grid matches.

New development workbenches provide native Optimization reports and solution comparison, Statistics reports with authored assumptions, Scientific Image slice/region inspection, scientific Scene viewing, and Files-backed Gallery review. These are bounded workflows; native and full-application validation remain in progress. Their dedicated guides describe retention, source identity and save acknowledgement limits.

The workbenches now lead with the everyday task. Optimization offers guided resource planning, refreshes after saving an assumption and retains the exact displayed solution. Statistics creates one-sample summaries and two-sample comparisons from model samples, with readable summaries and distribution bars. Scientific Image adds a sampled whole-image overview, stable contrast and native region measurements, including mean, summed intensity and calibrated rectangle area. Region drafts survive browsing. 3D Scene adds source selection and image export, with simple camera exploration and an explicit Save view action. Gallery loads bounded thumbnails and supports Keep/Reject keyboard review. Advanced settings and identity details appear on demand.

Guided Optimization also authors minimum-cost plans, minimum and exact requirements, quantity bounds and whole-unit decisions. Statistics adds paired comparisons with native difference summaries and intervals; the native T.TEST implementation now honors paired, pooled and Welch designs. Gallery selects a bounded set of exact byte versions for one guarded review save and plays explicitly verified local video/audio with browser controls. Historical T.TEST probabilities can change under the corrected designs; insufficient samples, incomplete pairs and zero standard error return native errors instead of invented probabilities.

Scientific Image draws polygon and freehand regions around irregular features and measures their native pixels. Saved outlines retain mean, summed intensity, pixel count and calibrated area alongside rectangular regions.

The new Ledger surface keeps double-entry books and draws each account as a T-account, with debits on the left and credits on the right. Accounts and posting lines live in native tables. An entry posts only when its debits equal its credits, and it is written whole in one transaction. Amounts are stored as exact whole minor units. Voiding an entry or archiving an account keeps the rows and removes voided lines from every balance. The Ledger creates its columns on first use and applies later schema versions as additive upgrades that never drop or rewrite data.

The table store now enforces the Ledger's rules for every writer, including the Table surface, model rules and imports into existing tables. Posted lines cannot change, each entry's open lines must balance, a new line must name a current account, and deletes void or archive rows instead of removing them. A unique line key refuses a second copy of an entry. Show all postings opens an account's complete history with its running balance. Ledgers created earlier today keep working and offer the upgrade in a banner; it checks existing entries before adding the rules.

Ledger 2.0 adds optional original-currency amounts and explicit exchange rates, reviewed multi-currency revaluation entries, permanent period closing enforced by the native table store, and self-declared posting authors. Date filters, clearer entry details and a complete trial-balance report with CSV export make review easier. Each capability is selected separately; existing single-currency books keep working. Closing preserves balances and history, with corrections posted into an open period.

Any native table can now declare its columns and write rules in source, with a columns object on its table declaration. A deploy provisions them, and a later deploy may add columns or rules but never drops or loosens one. Rules cover fixed values, soft deletes, references to another table's key and balanced groups, either as equal debit and credit totals or as signed amounts that total zero. A referenced key cannot be changed or hard-deleted while rows still name it. Table reads now skip soft-deleted rows unless they ask for them, and pivots accept a filter.

Workplane discovery is explicitly selected, not background geometry discovery. Blank-part and reusable mounting-plate starters prepare local source on explicit selection, without automatically saving or granting geometry authority.

Builder mode in Code now arranges Grid Views by direct manipulation while the View stays ordinary source. Drag outline rows and new elements into place, move a selection of elements together, move elements into another page, and wrap elements in a section, a Form or a named region layout. Properties rebinds a placed control to another model value and edits a page's title and path. A theme editor sets accent, density, corner radius, font, colour mode and content width on the View's THEME line. Each change is one Undo step. The compiler writes and checks the source, and asks for review before a change that alters scope, such as wrapping fields in a Form.

Views can keep part of their content beside every page in a shell drawer: DRAWER left "Filters" or DRAWER right, written before the first page. An element's key now keeps its local and remembered values with that element when other elements are inserted before it.

Grid models can now hold music. Write a score as notation text in a music"…" literal or an input, and the new Score surface engraves it as publication-style notation: beams, key-aware accidentals, ties, slurs, tuplets, grace notes, dynamics and hairpins, lyrics, chord symbols, repeats, up to four voices per staff and braced grand staves, in page or panorama view. Play previews it in the browser with a moving playhead. With keyboard note entry, select a note and type letters, arrows and note values; each change rewrites the notation input and the model recalculates. MUSIC_* functions transpose with correct spelling, extract parts and measures, publish note and MIDI tables, check measure lengths, and import and export MusicXML for exchange with other notation software. Parts named after an instrument take its clef, sound, playable range and transposition: transposing parts read at written pitch with a Concert pitch toggle, and notes outside an instrument's range are marked in red. Render audio writes the performance to a WAV file in the model's Files, voiced by instrument family with repeats, dynamics and articulations. Bind a Media surface to that file to see its waveform and spectrum and annotate it; while Media plays, the score's playhead follows along. Export MIDI writes a Standard MIDI File for sequencers and other notation programs, Import MusicXML brings scores from other notation software (including compressed .mxl files) into an editable notation input, and crescendos and diminuendos now shape the loudness of playback. Scores also carry ottava lines, pedal marks, glissandi, tremolos, rolled chords, cue notes, swing, drum-kit staves and guitar tablature with tunings and chosen strings. Notes can be entered with the mouse, selected as a range, and copied and pasted. A Mixer sets each part's volume, mute and solo. Name a SoundFont (.sf2) from the model's Files to render audio with its recorded instruments instead of the built-in sounds. Document setup chooses the paper, staff size and margins, multi-measure rests and manual breaks shape parts, and a full score can leave resting staves out of each system.

Improvements

Custom React controls can now share the owning View's declared actions, Form drafts, validation, conflict recovery and acknowledged Undo/Redo history with standard controls and built-in events. Explicit custom Submit uses the same Form owner as a standard button; ordinary events continue to run without saving. Custom action feedback can observe the same pending, settled and refusal outcomes, including failures of later effects, without another state store. Custom local drafts can register with the existing navigation owner; nested editors retain their own refusal, and leaving after a delegated discard prompt releases departed controls before the host receives the new page. Published View controls also preserve local draft refusals before requesting another destination or Back. The host remains responsible for the final discard prompt, and a canceled destination is reported to the caller. App design and Document editing expose their existing histories through the same optional service contract. Nested Views retain separate authority and focused history. Form input batches and subsequent actions remain separate commits, so action Undo reverses its declared targets rather than all previously saved fields. Arbitrary model writes do not gain automatic action Undo.

System and Network are now layers in the same shape as Code: each keeps a list of areas on the left, shows one area at a time and returns to the area you last used. System gathers health, processes, runtime counters and Version & updates, which shows the installed desktop version, the serving Grid service, when Grid last checked for an update and the next available release with its notes. Network separates overview, machines, pairing, latency, external APIs, control plane and activity, and adds Registry for this machine's Grid Registry connection: the active registry and its identity pin on desktop, and the enrollment posture on servers. The restart-schedule editor is gone because the route it called no longer exists; supervised programs and the restart window now come from live diagnostics.

Version & updates now saves how often Grid checks for updates on its own: every hour, once a day, or only when you ask. It also shows the Grid service's version, commit and uptime, and flags a host whose version differs from the Grid service. In Network, Registry changes the registry in place with the same verified editor as Setup, and a new Configuration area shows the coordination layer, LAN, external API egress and participant settings in effect, without secrets or seeded peer addresses.

On servers, Processes can restart a supervised program. An operator unlocks Operator actions with the server's admin token and confirms the restart. The supervisor watchdog then restarts the program and waits for it to report ready. The token stays in the page's memory and is never saved, and the last restart's result is shown to everyone who can see Processes. Logs explains that program output goes to the platform's log stream and, on Fly, gives the fly logs command for the machine.

Document avoids redundant initial processing and whole-editor transaction rerenders while keeping complete rich content, formatting, search and Undo/Redo available. Accessibility semantics identify its multiline editor. Dense opening still exceeds the retained performance allowance and remains unfinished.

Document JSX ejection now preserves recursive rich blocks, merged/formatted tables, supported styles and page hints. Live references retain native display formats, units and pending/stale/failed states. Authored prose/tasks are snapshots; review history still requires Word export and native publication owns Word pagination. Ejection captures acknowledged visible content and retains pending/recovered/conflicting drafts in the native editor until resolved. Editing pauses only while that source save is underway. /Image opens the existing image URL picker; cancel retains the slash text, and insertion remains one saved change with Undo/Redo. Find and Outline now reveal targets inside collapsed toggles without changing document content or Undo history, including in read-only documents. Closing navigation returns typing focus to visible content, preventing subsequent edits to a newly hidden match.

App framework exports preserve job and connector payloads, wait for successful completion before feedback or navigation, and follow changes to the live model connection. Feedback saves must be acknowledged before navigation. A mounted continuation resumes failed feedback or routing without repeating an already completed job or connector. The downloaded source still requires an embedding host for model data and native operations.

Exported App number/text inputs retain editable drafts, compatible type tags and locale/percentage parsing. Saves wait for matching input receipts, preserve newer drafts and expose explicit recovery across changed connections. File reads retain selection/owner/revision guards. Ordered Submit operations show partial outcomes instead of continuing after an uncertain save. Exported Toggle, Select, Segmented control, Slider and Date input use the same acknowledged-save and draft-recovery behavior. Newer pending choices stay available for Save; date writes preserve date/datetime metadata, including after a reset. Clearing an optional date restores its declared default. Exported Table/Detail selection now keeps original source positions through sorting, filtering and paging, preserves distinct typed record keys and uses acknowledged keyboard/mouse selection. Exported Tabs and Accordion retain pending choices and recovery while showing the acknowledged panel. Tabs provide keyboard navigation; closing an Accordion writes an empty text selection. Exported Modal, Drawer and Menu visibility now follows acknowledged Boolean state. Failed closes retain reachable recovery controls, and focus restoration follows the current connection and explicit close outcome. Exported navigation also honors home inclusion and authored tab, pill and list styles.

Deck blocks support custom percentage positions and sizes, keyboard nudges and drawing order. Positions survive acknowledged saves, recovery, Undo/Redo, audience presentation, print and editable PowerPoint export. Invalid positions remain available for correction. Pointer and touch dragging/resizing now preview locally and save one acknowledged change on release, with explicit cancellation and Undo/Redo. Embedded MP4 plays in presenter and audience views, retains original video bytes in PowerPoint export and uses matching posters in print/PDF. Codec support varies by browser and PowerPoint. Native PowerPoint import now admits a bounded blank-layout subset of editable text, images and styled tables with source appearance, acknowledged append, recovery and Undo. Unsupported content refuses the whole file before any write. Import an unchanged new Grid PowerPoint export to append editable slides with captured values, inactive source bindings and acknowledged save/recovery/Undo. Imports require matching appearance in the Grid roundtrip lane; altered Grid payloads are refused and never fall back to the bounded native import. Captured and imported Deck tables now offer direct cell editing. Apply saves one exact value with recovery and Undo/Redo, preserving every other cell and source appearance. + Static table creates a table without model bindings; native captured/static tables also support row and column insertion/removal through the same save and Undo behavior. Imported table structure stays fixed. Unapplied text stays visible in the mounted view across read-only, source and owner changes. Presenter media controls keep their native keyboard behavior. Audience video pauses on presenter disconnect and waits for explicit playback after reconnection.

Native Table-backed Kanban adds explicit whole-Table/saved-view card search, bounded result pages and exact-record opening through existing guarded edits. Loaded-page Find and board ordering retain their existing behavior.

Local Kanban card edits now wait for a matching saved response. Failed or stale writes retain the newest board for export, explicit retry or confirmed saved-copy recovery in the current session. Unknown metadata survives edits, and print flows all lists without clipping or navigation controls in either theme. Named-array cards with stable IDs now use guarded input receipts and retain failed or uncertain changes for explicit recovery. Column configuration also waits for confirmation; deleting a list preserves its cards under Unmapped cards. Legacy arrays remain readable until suitable IDs are authored.

Find cards searches full loaded-card text without filtering or reordering the board. Read-only and receipt-unavailable cards open complete mapped details as a snapshot; writable results keep their existing acknowledged editor. Native Table Find identifies its current loaded-page scope. Comments and change history remain usable when an HTTP origin lacks browser UUID generation.

Local Kanban boards and named-array views expose cards whose stored list is missing from the configuration. Inspect Unmapped cards, retain the original list ID, and deliberately choose a configured list in the editor. Print includes these cards; local reassignment keeps the existing acknowledged save and recovery behavior.

Native Table-backed Kanban cards can opt into file attachments, shared comments and retained change history through a mapped activity column. Guarded record updates preserve concurrent changes; failed activity saves retain a local copy. Downloads verify file identity, and print includes the full activity for the loaded cards. Local-board and named-array cards also retain conversation, attachment references and edit history through their acknowledged owners. Named-array boards create stable cards and reorder by drag or keyboard; guided activity setup changes only configuration, preserving existing data and files.

Planning schedules gain an editor for activities, dependencies, resources, availability, changeovers and solve budgets. Save a complete draft through the native solver, inspect feasible/infeasible/budget results, and retain failed drafts. Accepted definitions survive reopening and archive restoration; stale model or host identities refuse a save without silently replacing the draft.

Map adds freehand lines, keyboard coordinate entry and shared comments alongside note pins. Annotation saves check the model acknowledgement, retain failed drafts and detect conflicting edits. Undo restores deleted annotations with their comments. Reading and print preserve the review without editing controls. Comment names are display labels; notifications and verified attribution are not included. New version 2 reviews should be edited only in current Grid apps.

Layout can duplicate any block into a free slot while keeping its size, content and live bindings. Edit the copy independently, undo or redo it, and retry a failed save without creating another copy. The focused block supports Ctrl/Cmd+D.

Charts can format each series independently. Show revenue as USD and margin as percent on separate axes, with formatted tooltips and raw values available in the data table. Editable JSX output keeps these formats and fixes pie, scatter, negative-bar, missing-value and right-axis rendering.

Calendar now edits native Table records as well as named event arrays. Saves wait for acknowledgement and preserve drafts on failure or conflict. Refresh inside a failed editor checks the current record without replaying the save; explicit discard protects unsaved changes. Record paging and partial-print labels make the loaded scope clear.

Compiler-tool development now includes reconstruction of canonical expression trees into compiler-owned types and field-derived module inspection before compiler finalization. Single-statement reconstruction now follows the compiler's own field annotations. Typed declaration reconstruction now covers contracts, predicates, decision packages, policies, and recursive logical paths. Local function reconstruction recomputes provisional analysis from edited bodies. Module field reconstruction follows the same generated compiler inventory. Choice and generic schemas rebuild through the compiler’s declared-type grammar. This is internal groundwork; whole-module reconstruction and a complete executable syntax model remain unfinished.

Supported canonical grammar-bound declarations now replay the compiler’s native admission in edited input order. Detached trees receive the same lexical grammar and helper checks, and a supported algebra edit compiles and executes through compiled formula. Grammar-body reconstruction and the complete syntax model remain unfinished; this does not introduce another parser or evaluator.

The workspace frame has warmer Grids surfaces, refined spacing, and a colored account control. Pages replaces App in the main navigation, and Code moves into More. A compact, colored Live/Scenario control and an icon-only Open beside control leave more room in the top bar. The existing model divider, Undo/Redo, document toolbar, and other workspace tools remain. Thin navigation is now the default: its quiet 44-pixel rail reveals labels at 68 pixels while you use it. A visible Quiet handle keeps navigation within reach when the frame rests. Moving near it reveals a cue while the layer stays still. Click, tap, pause over the handle, or use F6 to open the full frame. The controls can recede after five seconds without workspace interaction. Keep workspace controls visible pins them open for the current workspace session; Return to full canvas closes them deliberately. Editing and gestures in Grid-hosted content, plus workspace menus, defer automatic closing. Wide, unsplit Data, Pages, and Chat views share supported toolbars with the handle; other layouts keep a compact host row. Native window controls remain available. Home, Help, System, and Network retain the full frame. Existing navigation preferences are preserved, and reduced motion applies layout changes directly.

The plus below Search opens an inline New canvas with Grid or Web search, quick writing, Chat, and the shared sheet and surface types. Your panes stay mounted out of view; Back or Close returns to them. Choosing a type or selecting Create document saves through the existing model protections. Start chat explicitly begins a conversation and sends your message. Desktop opens URLs and Web searches in a reference Browser within the canvas; its quieter address toolbar also accepts Web searches, and Back to New returns to your drafts. The web edition opens a normal browser tab. Browsing does not create a model surface. Queries and unfinished writing or Chat drafts remain available when you close New, change layers, or visit other models. Unfinished New drafts are saved locally by account and model; after reloading or restarting, choose a Resume action in New. Failed recovery saves remain visible and warn before leaving the page. Desktop Browser supports the address shortcut while a page has focus, reflects native navigation history, and opens popup links in separate isolated Browser windows that preserve their opener. Colon-containing searches and local HTTP addresses are recognized correctly.

Desktop adds Check for Updates… in Help, Search Grid and the native menu. Quiet checks at startup and every hour show an Update button in the left sidebar when a newer version is available. The button remains after choosing Later. Check on demand, see when Grid is up to date, and retry a failed check. Downloading and installing still require Update and relaunch.

Discussion can post directly to a bound native Table. Sends wait for the host's insertion receipt, retain drafts through live table updates, and distinguish a failed send from a failed refresh. Older messages load in bounded pages. Guarded message edits preserve drafts on conflict. Mentions and explicit browser-local viewer read status help review loaded conversations; choosing a viewer name does not sign in or send notifications. Native table threads also offer explicit shared collaboration on hosts with signed model editor accounts: join for account-based reactions and synchronized read state, choose a recipient for an in-app inbox notification, and inspect a retained delivery receipt after an uncertain outcome. Explicit cancellation resolves an already committed receipt or fences a late send before clearing an unresolved intent; its full native/browser verification remains pending. Author names remain source labels. Authenticated posting receipts, dense-opening and broader resource verification remain unfinished.

Native Table-backed Kanban adds guarded creates, edits, moves and confirmed deletes while preserving the exact record and unrelated fields. Pivot adds native grouped measures, subtotals, bounded axis pages and exact-group drill-through. Matrix / Tensor inspects native shapes, aligned comparisons and explicit sparse artifacts. Media / Signal adds verified playback, native waveform/spectrum windows, retained timed annotations and acknowledged selection inputs. These new inspection workflows remain under development verification; their limits and evidence are recorded in the built-in surface completion ledger.

Layout dashboards can combine charts, tables, values, notes, and shared model inputs. Selecting a chart point or table record can update the same declared input, so native formulas keep the dashboard linked. Diagram adds searchable properties, relationship filters, neighborhood exploration, directed traces, and retained native path reports.

Editable diagrams add named, nested groups. Move a group with its contents, then ungroup or delete the container while keeping the nodes and connections. Groups remain intact through saved reopening, auto-layout, print and JSX snapshot export. Grouped documents require Diagram data version 2 support.

Molecule adds interactive 3-D inspection of native elements and recorded bonds, atom details, and explicitly started trajectory playback. Sequence and Variant add linked read/annotation tracks and named genotype columns, preserving exact coordinates, missing values, and source provenance.

Experiments adds retained calibration progress, cancellation and authored residual inspection. Reopen and publish original results without running again, and carry terminal calibration journals in workbook archives. Retained AI outputs can be explicitly mapped to existing workbook inputs with durable original-command recovery on supported native owners. Archive, binding and selected-cost verification remain tracked in the surface completion ledger.

Process document capabilities can be selected once from a room, bound locally and passed to a child workflow. Start requires both read and revise rights for that selected document; selecting it performs no read. The durable Process store also retains collected member failures and concurrent lane turns across restart. Broader product collection workflows remain under validation.

After a failed CAD save, Check saved revision and keep proposal can restore editing without discarding the proposed dimensions or source. It performs only a read and permits a retry only if the saved basis is unchanged; changed designs are never silently overwritten. Circle and slot refusals now include readable guidance while preserving diagnostic codes.

Process can save model choices and run limits separately for each plan. Reopening restores the setup without starting work; incomplete explicit model selections show guidance before Start. Connection review reveals the current provider and model without inference, and a direct AI setup action opens account settings.

Process diagrams open at a readable step size. A step picker and Previous/Next controls navigate longer workflows without changing execution order. The selected step stays centered on narrow screens, and long cards scroll without overlapping.

Spatial-agent JSON simulations now sample trajectory output automatically when stride is omitted, retain the final frame, and refuse output that exceeds bounded row or retained-payload limits. Authored arrays of agents can now run pure behaviors on the workbook's Euler simulation clock: population counts and STOCK feedback read the same completed snapshot, and sampled agent history returns separately. Failed or cancelled runs leave the workbook unchanged. Immutable model-owned geometry Frames can supply complete populations, captured once with explicit source/record limits and a retained source revision. Mutable tables retain native CRS-tagged geometry and supply complete transactional populations using real primary keys, without simulated writeback. Direct behavior lambdas can use SIM_AGENT_RANDOM(stream) for repeatable draws keyed by the run seed, agent identity, step and stream. A corrected random key separates step/stream roles and preserves full identity bytes; native seeded SIR draws change from earlier builds. GEO_MOVE_TOWARD now moves native points toward same-CRS targets in ordinary formulas and pure authored behaviors, without overshoot. WGS84 uses geodesic metres; other CRSs retain their coordinate units. Invalid geometry, mixed CRSs and invalid distances refuse. Native JSON movement and SIR now share Geo's WGS84 metre distances and retain other CRSs' coordinate units. Their index is reused within a population version, and nearest-k ties follow stable identity. Older WGS84 JSON speeds/contact radii expressed as degrees require adjustment; seeded SIR results can change with this metric correction. Direct authored agent lambdas now use NEIGHBORS_WITHIN and NEAREST_AGENTS over all populations' previous snapshots, with stable nearest ties and caller exclusion limited to its own population. Nearest results are capped at 1024 rows. Authored runs can record geometry-bearing playback Frames with workbook observations at matching steps. Inspecting retained experiment output offers WGS84 Map scrubbing without rerunning the model. Portable contextual behaviors, dedicated Sim lowering and Scene presentation remain in development.

Native CAD source editing preserves its existing admission behavior after the runtime's cached-image update; the host compilation mismatch is corrected.

Explain expression now shows direct cell and rectangular-range reads even when this source has no definition for them. It displays the authored reference beside its canonical target and keeps dependency coverage marked partial.

Inspect import syntax shows the local path, alias or exposure list, and View renames recorded by the compiler's USE recognizer. Inspection remains available without loading the imported module. Resolver-free inspection still reports an unresolved-import diagnostic and does not claim whole-module completeness; imported contents and source rewriting are outside this slice.

Inspect requirements now shows authored REQUIRES aliases, the selected network or secret form, the quoted selector, and the written network method at their source locations. Syntax inspection does not grant capabilities or rewrite these declarations.

Inspect presentation clauses shows an assignment's FORMAT, PRESENT, and VALIDATE clauses in written order while preserving the assignment's existing syntax shape. Standalone field contracts show their ordered record keys and validation body. Bound ## notes show each authored line and its statement, including after coordination finalization for retained assignments. Numeric range validation shows authored endpoints and an optional step separately from its effective bounds. The inspector retains source locations and keeps incomplete presentation forms explicitly marked. Population, team, room, process and consumed-plan declarations now expose their retained names, roles and pure operands as structured, source-located syntax. Member access, predicate payloads and numeric sequences now retain their compiler-recognized source structure. Grammar-bound bodies expose their canonical parse trees, and component calls retain original arguments before substitution. Process bodies expose nested compiler-retained statements and expressions and authored records behind generated process expansions. Broader logical and contextual View syntax coverage remains unfinished. Path declarations now preserve written aliases, case and parentheses before compilation expands them. Conditional and guard expressions retain their branches and optional fallback; infix operators retain ordered operands and source locations rather than appearing as generated function calls. These inspection records do not yet support rendering or substitution.

Compiler-owned numeric patches preserve comments and unrelated code. Principal orientation and offset proposals apply together in one source transaction. The experimental graphical CAD sketch connects rectangle, circle and axis-slot proposals, whole-shape edits, explicit openings and thickness to compiler-owned source transactions. Escape and Cancel work from focused properties, and Apply retains keyboard focus. Changing named opening checkboxes preserves existing openings controlled directly by source. Saved native wireframes use the shared 3D renderer; measurement and exact STEP remain separate native operations. The bounded eight-opening STEP allowance is selected from native source and topology checks, while older callers retain their limits. Current native-process, optimized and platform acceptance remain pending; this workflow is Experimental.

Interface refinements

Sharing has clearer empty guidance and generated-link confirmation. Chat history marks the current conversation and keeps Refresh focused while loading. Saved input scenarios present recorded values in a grouped, readable review. Physics playback keeps Play/Pause stable beside the timeline, and Score groups its part controls with larger touch targets. Waiting Process requests retain answer focus while sending and keep refused answers ready for retry. Hover, keyboard focus and restrained transitions follow the current theme and reduced-motion preference.

Code inspection now puts run and generation settings behind a named disclosure, keeps the selected syntax node clear, and groups supported operations with their refusal reasons. Optional settings retain their drafts when folded.

Gallery comparisons show readable identities on narrow screens. Image volume setup has clearer grouping and larger touch controls. Statistics comparison options align naturally, and wide comparison tables support keyboard scrolling. Stopping these review requests returns focus to their initiating action while retaining unfinished settings.

Navigation/context panels and the cell inspector reveal without moving focused controls. Code’s secondary disclosures have restrained opening feedback and clear turning markers. Closing remains immediate; reduced motion removes animations.

Credential actions show calm feedback in one place and keep Save focused through pending and successful completion. Refused values remain available for retry; repeated activation cannot duplicate a save.

Bug Fixes

Model tables, frames, and other per-model data now survive restarting Desktop or the server. Neither set a location for them before, so each runtime process used a new temporary folder and rows added since the last start were lost.

Desktop also keeps model history and AI agent-run records across restarts, as the server image already did. AS_OF and WHY could not see edits made before Desktop last started, and actions that need recorded history were refused.

A reusable ELEMENT whose body declares a local inside a nested block now works when it is placed more than once. The second placement used to miss that local, so a control such as a Toggle bound to it reported a missing local value.

This development build improves editing and navigation recovery. Canceling Home folder creation returns focus. Input-method confirmation no longer commits partial Data source names or App page metadata, opens a Help search result, or reveals Code View source. It also leaves a partly composed capability catalog query in Search and keeps rapid catalog page turns on the requested cursor. App's page list now supports arrow-key traversal and reveals its selected page. Code's copied LaTeX feedback follows the current source, and Help explains unavailable links without leaving the reader.

New feedback keeps an interacted Undo visible. Learning setup preserves answer drafts through an equivalent model refresh, and Network speed results stay tied to the selected route. Network Activity tabs now support arrow-key selection. Media configuration offers an explicit way to retain an unacknowledged draft; editing an annotation moves focus into its text field. These are locally checked fixes; packaged and native journeys remain under review.

The editor's save guard now recognizes datum edits; applying a dirty workplane proposal no longer silently returns without submitting it. Reusable sketch definitions can describe mixed native line/arc entity records without the compiler requiring those different shapes to have identical fields. Numeric and callable-storage checks remain in force. Selected endpoint-solid admission now accounts for numeric addition/subtraction in reusable geometry definitions. This fixes the mounting-plate example's center + radius formulas without changing formula evaluation, native limits or ordinary CAD admission. Native volume and exact-export checks now pass for the reference part; complete host/editor acceptance remains pending.

GEOM_POLYGON_TRIANGULATE_STEINER and GEOM_POLYGON_TRIANGULATE_STEINER_MESH now check every Steiner point before triangulating. A point outside the polygon, on one of its rings, or inside a hole returns a #VALUE! error that names the point. A point outside the polygon's bounding box used to reach the triangulator out of range, and a point on a ring or inside a hole was left out of the mesh without notice.

GEOM_POLYGON_TESSELLATE and GEOM_POLYGON_TESSELLATE_MESH no longer hang when the minimum area is blank or 0. For some polygons the refinement never finished and its memory use kept growing. A blank or zero minimum area now refines down to one ten-thousandth of the polygon's area.

The iTriangle-backed polygon builtins now cut a hole whichever way its ring is wound: GEOM_POLYGON_TRIANGULATE_ROBUST, GEOM_POLYGON_TRIANGULATE_STEINER, GEOM_POLYGON_TRIANGULATE_DELAUNAY and GEOM_POLYGON_TESSELLATE, their _MESH variants, GEOM_POLYGON_CONVEX_DECOMPOSE and GEOM_POLYGON_CENTROID_NET. A hole wound in the same direction as the exterior ring used to be filled in as if it had not been given, which is how the cookbook's own example was written. A model that passed such a hole now gets a mesh with the hole empty. Polygons without holes, and holes that were already being cut, give the same results as before. The Earcut-backed GEOM_POLYGON_TRIANGULATE family was not affected.

GEOM_IS_VALID and GEOM_VALIDITY_DETAIL no longer report a small polygon far from the coordinate origin as having zero area. A valid ring a few centimetres across at projected-coordinate magnitudes, such as a 1 cm square near (10,000,000, 10,000,000), was diagnosed as ring has zero area because its area was summed about the origin and rounded away. A ring is now reported as having zero area exactly when all of its vertices lie on one line.

GEOM_POLYGON_AREA and GEOM_POLYGON_CENTROID are now accurate for polygons far from the coordinate origin, such as projected coordinates in metres. Both summed the polygon about the origin, where the products of large coordinates round away the polygon's own size. A 3 cm² ring near (10,000,000, 10,000,000) had an area of 0, and the centroid of a 50 m parcel there was 14 m off on each axis; at Web Mercator coordinates for San Francisco it was 1.7 m off. Both are now summed about the polygon's first vertex. The centroid also no longer falls back to the average of the vertices for every polygon under a fixed area of 1e-12 square units, which caught polygons about a ten-millionth of a degree across; only a ring whose area is negligible against its own extent is treated as flat. Results at the origin are unchanged to within rounding. Elsewhere they move to the correct value, by more the farther the polygon is from the origin relative to its size.

Compatibility and Migrations

Server Builds add GET /admin/v1/supervisor and POST /admin/v1/supervisor/restart to the admin plane, which stays off unless GRID_ADMIN_TOKEN is set. A restart request is written to /data/grid/config/restart-request.json (GRID_SUPERVISOR_RESTART_REQUEST_FILE) and expires after two minutes. The supervisor watchdog now reads that file on each health pass. An image whose Grid service cannot write there reports the failure to the operator; nothing is restarted.

Self-hosted servers that do not use the reference image should set GRID_MODEL_TABLES_ROOT to a durable folder on their data volume. Tables lost before this build cannot be recovered.

Desktop history and agent-run records start with this build; entries from earlier sessions were never retained and cannot be recovered.

A Grid View page's locals, named actions and ELEMENTs now belong to that page, whether its lines are indented under PAGE or written flat after it. Previously another page could read them. Such a reference is now GRID_SURFACE_SCOPE, and the message says to declare the value before the first PAGE to share it across pages. drawer is now a reserved declaration name in Views.

A module imported with the legacy .grid extension is now checked like a .gs library. An executable model statement in it is GRID_LIBRARY_EXECUTABLE_STATEMENT instead of being imported silently. Grid View libraries keep their own rules.

A View STYLE rule that assigns a theme property (--accent, --surface-accent, --radius, --gap, --font or --content-width) now produces the GRID_VIEW_THEME_OVERRIDE warning, because it overrides the THEME line. Reading the property with var() is not reported.

A literal given to a View phrase that only reads a value, such as Table view, Detail selected or rows, or Repeater filter, is now GRID_ELEMENT_PHRASE_TYPE. It used to be accepted and ignored. Bind a local or model value instead.

The Grid service's View undo journal needs a durable model table root. A host with neither GRID_MODEL_TABLES_ROOT nor GRID_DESKTOP_ROOT set now refuses to list, replay or retain journal entries with VIEW_UNDO_UNAVAILABLE. Before, it kept a history that disappeared on restart. Desktop and the reference server image set the root.

The Pages label and More → Code entry point preserve existing model-layer links, starting preferences, Code tabs, and APP source definitions. No saved model conversion is needed.

The datum edit extends the existing wire protocol without changing earlier edit ordinals. No saved-document migration or build configuration change is included.

GRID_BACKBONE_REACTIVE and GRID_BACKBONE_HOME_ROUTING are removed. Neither had any effect: coordination layer delivery always recalculates dependent cells and fires rules, and a cross-model reference always goes to the machine named in its grid:// address. Remove them from environment files at your convenience; leaving them set is harmless. The grid_backbone_cross_model_fault_total metric is also gone. It always reported 0, so delete any dashboard or alert that reads it.

The dependency refresh moves map surfaces to MapLibre GL 6, which requires WebGL2; browsers limited to WebGL 1 can no longer render map surfaces. The Scene surface and physics playback now share one 3D renderer (three.js), which also requires WebGL2; without it the Scene surface shows its approximate vector projection and physics playback shows a table of final positions. Scene images, picking and measurements are unchanged. The collision library that CAD interference checks share with physics now computes with software math, which is what makes physics results the same on every platform. Contact and straight-line sweep results are bit-identical to before; sweeps of rotating parts can differ by about one part in 10^8, inside their own convergence tolerance, with no measurable change in speed. The pinned Node.js toolchain is 24.21.0 and the native toolchain is 1.98.1 across local, container, and workflow builds. native dependencies move to rustls 0.23.45, h2 0.4.19, quinn-proto 0.11.18, tokio-postgres 0.7.18, rkyv 0.8.18, wasmtime 49.0.1, and tract 0.22.4, and the document editor moves to Tiptap 3.31.3, closing the advisories published against the earlier versions. No saved-document migration is included.

Signing and encryption libraries move to ed25519-dalek 3, sha2 0.11, argon2 0.6, chacha20poly1305 0.11, and aes-gcm 0.11. Their output is byte-identical to the earlier versions, so existing password-protected stores, backups, saved AI settings, package signatures, and PEM keys keep working unchanged. The Redis connector moves to redis 1.7, AI features to AI SDK 7, and error reporting to Sentry 11. DOMPurify moves to 3.4.16 to close a newly published sanitiser advisory.

The interface moves to React 19.3, and the sheet grid moves to Glide Data Grid 6.0.4-alpha24, the first Glide build that supports React 19. Column headers keep their spreadsheet behaviour: clicking the header of a column that is already selected still selects just that column, and Cmd-click or Ctrl-click still toggles it within a multi-column selection. The repository builds with TypeScript 6.0.3; the in-app View editor still checks code with the TypeScript 5.9.3 bundled in its editor.

The native dependencies take their current compatible releases, and six move a major version: ONNX and TensorFlow Lite inference to tract 0.23, the statistics library to statrs 0.19, WebSocket clients to tungstenite 0.30, PostgreSQL TLS to tokio-postgres-rustls 0.14, base64 to 0.23 and the benchmark harness to criterion 0.8. Statistical functions return the same values as before, seeded random and dice functions keep their sequences, and tables, frames and vector indexes written by earlier builds still open. The API server's Prometheus metrics now come from @prometheus-io/client, the maintained successor of prom-client: metric names, labels and the scrape format are unchanged, and the default Node.js metrics gain nodejs_eventloop_utilization_summary and nodejs_eventloop_utilization_histogram.

The H3 library moves to h3o 0.11 and the poker evaluator to rs_poker 5.1. H3 cell identifiers, parents, children, disks, rings, distances and polygon fills are unchanged; H3_CENTER and H3_BOUNDARY coordinates can differ by up to 1e-10 degrees and H3_AREA_M2 in the last few significant digits. Poker rankings and comparisons are unchanged.

The solar library moves to solar-positioning 0.6, which corrects its delta-T estimate from 2015 onward. SOLAR_DELTA_T changes for those years (December 2050 goes from 85.87 s to 79.62 s). Positions computed without an explicit delta-T for dates from 2015 on move by up to 0.015 degrees; positions with an explicit delta-T, and all earlier dates, are unchanged. Sunrise, solar noon and sunset times move by 0.2 to 0.3 s typically, and by up to minutes at high latitudes and twilight horizons.

GEOM_POLYGON_TESSELLATE and GEOM_POLYGON_TESSELLATE_MESH with a blank or zero minimum area now return a coarser mesh, typically a few thousand triangles where a call that finished used to return tens of thousands. Pass a minimum area to control the mesh size. A minimum area below one millionth of the polygon's area, or a higher limit for a polygon more than a thousand times longer than it is wide, now returns a #NUM! error that states the smallest supported value. Results for other minimum areas are unchanged.

Known Issues

The native AI Process model/human review journey now passes with deterministic loopback model responses, including revision rounds, a child result, explicit human approval and malformed-output refusal. Full operation publication/recovery, fresh Process evaluation and the canonical AI workbooks remain under validation.

Compiler, typed-wire and frontend checks are recorded separately from unrun native-host, platform and optimized-performance work. No new capability has been promoted to Supported. These notes are a development draft, not a release readiness statement. Review the updater summary again when the bounded workflow and its current evidence are complete. No product publication is authorized.

Documentation Updated

The interface-layers guide describes the System and Network areas, Version & updates with its update schedule, Processes operator restarts and logs, and the Network Registry and Configuration areas. The HTTP API reference documents the supervisor admin routes.

The interface-layers guide describes Pages, More → Code, the compact context control, and the icon-only companion entry point, with an updated walkthrough.

The new Ledger guide describes the Accounts and Journal tables, what the table store enforces, posting, account history, voiding, reversing, account archiving and schema upgrades, with an example model that declares its tables in source. The relational authoring guide describes declaring table columns and write rules. The assignments reference describes how table mutations behave on tables with write rules.

The new Music Notation guide describes the notation, the MUSIC_* functions, the Score surface, its keyboard and mouse note entry, the mixer, sample libraries and document setup, with an example model.

The programmable-CAD guide describes workplane properties and their ownership limits. The 0.69.0 delivery checklist preserves the broader M2 roadmap and records the remaining graphical-authoring and evidence work.

The Views reference has a Builder mode section listing each gesture and the source it writes, and documents shell drawers, page-scoped declarations and element keys. The language reference describes checking of legacy .grid definition imports, and the self-hosting guide explains the undo journal's table-root requirement.

Reusable Grid Views

CHECK recordings keep independent private drafts in reusable component instances and preserve edits while moving between Repeater pages. Tree checks now accept tree and treeitem roles; recording retains Tree item navigation and selection. Source analysis recognizes the declared row alias in Repeater bodies and Tree key, parent and label expressions. Tree draft-lifetime and row-activation recordings pass fresh native replay. Scoped-slot components retain separate page drafts and caller-owned state through source-package export and import. Their recorded ownership and navigation traces pass fresh native replay. Private record refactoring now finds Tree row-slot declarations and keeps same-named row and scoped-slot parameters separate from outer record fields. Shared-rule refusals link to their local contract declarations. Repeated scoped fills keep nested row drafts separate when component instances reuse row keys, while caller-owned slot state remains shared. Source component verification accepts the compiler’s pure row projection and retains external capture refusal.

ELEMENT definitions can state parameter permissions and callback types, use trailing literal defaults, and supply values to caller-owned scoped slots. .gridcomponent packages preserve and recheck those interfaces. Existing bare parameters remain compatible. App-template export refuses richer interfaces it cannot retain. The inspector compares source-derived reads, direct/action write targets, trust and uniquely matched presentations with accepted source. A short tutorial and composition cookbook accompany the full reference.

Naming a stored collection path now preserves editable View rows. For example, Lines = Order.shipping.lines can be passed to a reusable line-item editor; edits still update Order under its original validation contract. Chained paths and keyed nested rows retain their ownership. Two-argument FILTER selections also preserve these editors, including named filters and filtered keyed parents. Edits check the current original collection: missing or duplicate keys reject the whole edit, including duplicates hidden by the filter. An edit may move a row out of the displayed result. Row-shaping calculations, ambiguous paths and independently constrained aliases remain read-only.

Managed View actions now retain inputs used only by validation bounds in their event snapshot, including dependencies of computed bounds. A changed limit or record-field constraint is checked with the proposed write instead of silently falling back to its default. Managed rules writing validated records receive the same correction.

Record-list editors and pickers now preserve identity fields spelled ID or Id, including nested and structured edits. Native keys retain their original types. An exact id takes precedence; ambiguous variants are refused.

Properties can add omitted component arguments and remove trailing optional overrides while preserving defaults and caller content. Record-field rename now groups proven member uses, aliases and field-validation references in one source edit. The inspector links unresolved uses and refuses partial renames. Stored record values are not migrated by source edits.

Named record contracts reuse validation across model record inputs and nested paths. They expand to the existing native rules, including live bounds and atomic proposed-batch checks. Private record locals can reuse literal rules while keeping component instances separate. Invalid private drafts stop Form submission before model writes or actions. Private record collections can apply the same rules with VALIDATE ROWS: a rejected edit names its row and field and keeps the table-cell draft for correction. Model row contracts check root and nested input collections against live proposed-batch bounds. A rejected write leaves its input unchanged and identifies the first failing row per field clause. Definitions-module imports retain reusable contracts, private includes and immutable library bounds; caller variables cannot replace them. View libraries also retain shared rules for their private drafts and can export contracts for caller model inputs. Same-named caller rules do not replace library rules. Source component packages now retain private record/row rules, nested includes and closed library bounds. Import renames those rules with the component and refuses missing closure or captured model values. Re-export keeps the selected rules once.

Flat model row edits now retain native key and value types, including currency, dates and exact numeric text. Type changes during an edit keep the draft and require explicit reapplication. Blank and error scalar fields remain repairable.

Table drafts remain separate across model partitions and source changes that retarget the same displayed alias to another owning record or stored list. Changing a native table key from an exact number to text with the same displayed digits also keeps their drafts separate. The same protection follows enclosing order and batch keys into repeated private state and child table drafts. Model pickers over supported native record lists retain exact numeric keys, dates and semantic tags through single selection, multiple selection and Form submission. Selecting a different field such as a name also preserves the owning row ID for cell edits.

Exact bigint and decimal comparisons keep adjacent values distinct at the decimal range boundary. The largest decimal no longer compares equal to a larger bigint through floating-point rounding, preventing false duplicate row identities during native edits.

Newly compiled native model pickers share native's equality rules for selected rows, range selection and removal. Exact and ordinary numeric keys can match without confusing them with text, and native duplicate checks no longer depend on displayed values. Range anchors follow row IDs when selected values repeat. One-field native records also keep every row when displayed in a View.

Renaming a model row now rejects blank or duplicate identities, including keys owned by rows hidden by a filter. Rejection preserves the entire owning value.

Unsaved table edits now survive filtering, paging and the disappearance of a parent row. Returning to the same row restores its draft and original value types. Pending saves finish while hidden, and rejected saves remain available for retry. Hidden edits also participate in the View's navigation protection.

Grid View specification audit fixes

A review of Grid Views against their specification found 111 places where the two disagreed. Nearly all are now resolved. A few remain in progress, including pushing table filters that use private values down to server paging.

Buttons no longer stay busy. A click that THROTTLE, DEBOUNCE or SERIAL LATEST skips reports that it was skipped, and a click with no result after 30 seconds fails with a message and runs its ELSE. A follow-up step that fails after an action committed is reported as that, not as a refusal. Editing conflicts say "Changed by someone else. Your draft has been kept." and offer Reapply.

Source that used to be accepted and then ignored is now either honoured or explained. Examples: an ELSE in the wrong place, duplicate page names, undoable or pacing phrases on arrows that write no model value, and viewer actions whose file name or tone can never work. Backtick templates now work in every text position, including confirm. Buttons accept tone, class and help. class takes several names. A named action that nothing calls produces a warning, and a misspelled phrase suggests the nearest one.

Automatic controls follow the documented precedence: an explicit element, then a binding's PRESENT, then a library policy, then the built-in default. Choices of four or fewer show as segmented buttons. Selectable tables need a key. edit id on a native table and computed columns over a resident table are now refused instead of misbehaving. Page parameters keep their types through navigation and deep links. Status words such as pending combine with AND, OR and NOT in any guard.

The Grid Views specification now documents every diagnostic the compiler and the Code layer report. It also records four new owner decisions: Builder-mode editing of View source, remembered locals, actor identity on writes, and a shared undo journal. All four are now available. On a host that keeps the journal, a signed-in account that reopens a View finds its earlier undoable actions under Earlier beside Undo and Redo while that View's own Undo history is empty. Undoing one there replays it through the host under the same account.

Analysis preserves unavailable saved region, field/location and component choices instead of displaying a different result. Retained probes show unavailable values when their exact native result identity no longer matches, including in print. Analysis viewer edits now require a matching advancing save response. Failed or uncertain edits keep selections and probes through session reopening; exporting and explicitly loading the saved viewer resolve the draft without automatic replay. The development definition editor is separate from viewer state; durable restart recovery and the complete native authoring journey remain unverified.

The native plate-conduction example includes an Analysis tab, a triangular mesh, conductivity and boundary conditions in one source model. Analysis authoring has bounded native inspection, guarded native save and a selected visual definition editor that preserves complete physics definitions and uses the existing solver. Mesh/material/load/boundary controls, native rectangle preparation and draft mesh transfer are implemented. The repaired native host preserves accepted definitions, ordinary inputs and viewer data across graceful restart and archive restore. Existing saved Analysis definitions with numeric material keys reopen without rewriting their records. Full-App browser authoring and broader performance/resource verification remain in development.

The definition editor can also import an exported recovery copy, preserving unfinished field text. It confirms replacement and checks the current saved definition before adopting local values. Changed model/source/region/content refuses replacement; matching content uses fresh process authority for any later explicit save. Desktop/narrow browser download/import journeys are checked with controlled native responses; the separate real native lifecycle now covers bounded saves, restart and archive restore. Full-App browser acceptance remains outstanding.

Research artifact browsing now keeps search and results in view. Advanced filters and policy review context open when needed, retain unfinished values when closed, and make applied restrictions visible. Invalid date ranges reopen the fields that need correction. Focus, hover and pressed states remain clear in either theme.

Matrix answers now present row-reduced matrices and zero-based pivot columns separately. Underdetermined systems show their particular solution and nullspace basis, with the solution family explained beside them. Native dimensions and singular or inconsistent outcomes remain visible; bounded captures clearly retain omissions. All calculation authority continues to come from the selected native runtime.

The symbolic workbench now guides polynomial equation systems, Gröbner generator lists and ordered variables for multivariable GCD. Users choose the solve domain or monomial order, review the complete source and save through the existing formula owner. Adding or removing an entry preserves keyboard focus. Native capability, isolated-solution and computation limits remain explicit; the workbench installs no algebra backend.

Grid 0.68.0 — Upcoming (not released)

Summary

Prepared Dataset snapshots can open a new Predict or Train surface with the data already selected. Model setup and execution remain explicit. Predict can also open Evaluate with a finished batch's original model and cases, so selected checks score saved results without another inference call. Native Dataset results now show a paged column table beside preparation, with capture history and an identified Print view of the selected window. Train's Try this version opens an empty Predict example for the exact registered candidate, without replacing the current model selection. Evaluate now names missing reference columns and input mappings before running, with setup guidance for unavailable models or missing input metadata. Result inspectors now expose exact model versions, ordered inputs, separate case and training-data identities, and clearly labeled whole-run usage on demand. Structured output can now be configured with named fields and types in Predict and Evaluate; JSON remains available for nested objects and lists.

Unnamed Train models now stay separate across workbooks. Evaluate also retains the model setup error when inference could not start, alongside unattempted-case coverage and unavailable scores. Native one-example predictions now use the answer card even though their inputs are retained as a snapshot.

Train, Predict and Evaluate now keep their run selections usable when configuration edits or fast model registration advance the workbook revision without changing the saved selection. Comparison tables now keep the common-case count beside each measure, making coverage readable in a narrower workspace. Workbook publication remains an incomplete authoring workflow; normal authoring retains AI results but cannot yet bind them to workbook inputs.

AI coordination work continues with product controls for pending operations. Create process offers guided-debate, population-survey, population-collection, list-review and backup-answer starters: choose a workflow, review its generated source, Save, and bind models before Start. An API read and assessment starter selects an installed read, collects its parameter expressions, and generates a read-then-agent workflow without copying connection credentials. The backup-answer starter tries a structured answer and invokes a fresh backup only after a known failure; an uncertain outcome stops the workflow. The population-collection starter selects one successful answer and retains named outcomes for the population. Authored workflows can collect all outcomes or a requested number of successes while keeping member contexts separate. The population-survey starter runs each member in a fresh child conversation and returns named answers only when every member succeeds. Participants now lets you rebind local population roles to another declared or imported population and edit AI/human responders in the same team. Shared teams are copied for the selected plan; changes open as a draft for review and Save. Small literal lists in EACH, including named immutable local lists and aliases, now reserve their known size, allowing multi-step child workflows that previously exceeded conservative frame limits. Inspection shows the bound, which is checked before any iteration action. Conditional local task lists reserve their larger branch, allowing an agent to select a shorter or fuller workflow within the original budget. Known lists also retain their bounds when passed through reusable process parameters and helpers; oversized replacement inputs are refused before the receiving process starts its body. Selected procedures can now be passed to another process through PROCESS parameters, allowing reusable wrappers around a brief or reviewed answer. Both alternatives are checked before execution; the selected choice stays out of ordinary data. Independent choices can be composed in one call, such as choosing a drafting method separately from an optional independent review. The receiving workflow itself may also be selected from compatible procedures. Later decisions can reuse an earlier selected method—for example, letting an escalation rule override the routine review choice without repeating it.

What's New

The process panel exposes pending-operation status and an explicit outcome check. The formal Process surface also presents the selected compiled plan as a Sequence or Diagram without executing it.

Improvements

Predict, Train and Evaluate now identify prepared data by its source surface and capture date. Browse or refresh the snapshot list, then open a compact retained row preview before choosing your mapping and running.

Train candidates now include optional Data and model evidence: original feature order, data lineage, retained row selections, preprocessing, artifact feature weights and available uncertainty calibration. Evidence stays tied to the candidate when you edit the next training setup.

Evaluate keeps comparison controls available when a report has missing scores, and explains missing summaries and zero shared cases. Printing preserves the subject, trial, slice and comparison you were reviewing.

Process surfaces remember the workflow you choose when reopened. Removed or renamed workflows stay clearly identified until you choose another, so Start never silently switches to the first workflow.

Create process remains available after the first workflow. Add another workflow from Design and start, review its draft in Code, and Save before starting it. Existing saved plans remain available.

Predict and Evaluate now have a History view for reopening earlier results. Browse the current surface or the workbook, then select a retained run without changing your next-run setup or executing a model. History is paged and loads only when opened.

Evaluate now presents retained classification results as per-class scores and a labelled confusion matrix instead of raw JSON. Details appear on demand, larger class sets stay paged, and unavailable precision or recall is distinguished from zero. Print identifies the retained population and any partial class window.

Predict now guides batch setup before Run: choose a retained snapshot, map its inputs, and review row, call and time limits under Configure. Over-budget selections explain what to change. Saved limits are honored and selected data is never silently shortened or used to raise the budget.

The native Process evaluation foundation can retain and restore its original source and imports for undispatched cases. Restoration checks the original plan and starts no work. Retained case intents can also recover the original native run after a lost Start response, checking its exact inputs without another model call. The native evaluation journal now binds each row and trial, retains human waits and uncertain outcomes, and rejects stale progress updates. Fresh Process evaluation in the service and UI remains under development.

New Process starts default to one contribution at a time, with the host default shown in Run limits. Existing runs keep their admitted limits, including when a lost Start response is retried after the update.

The compiler includes exact AI workbench operation declarations for authoring pipelines with native-issued artifact references. The execution adapters and durable Process integration remain in development; import does not enable them. The native owner bridge now checks artifact provenance, preserves original attempt identities and retains drained result receipts. Owner-specific installation and bounded execution integration remain unfinished. The Dataset capture adapter reuses full-data native capture and retains original Process deadlines, cancellation and snapshot identities. The selected preview now connects capture and Predict under explicit principal/workbook startup grants and durable Process storage. Predict reserves model calls against the whole Process and retains exact model/input identities and row failures. The other four AI operations and end-to-end pipeline verification remain in development. Capture and Predict recovery can explicitly check the original retained outcome without repeating work or resuming a stopped workflow. Availability is scoped to the exact operation and current workbook grant.

Native issuer development adds journaled issuance, disk evidence storage and authenticated restoration of saved references. Product durable service recovery remains in development; the new disk behavior tests are not yet executed.

Native room resources now bind once and retain identity across child processes when an issuer and resource installer are explicitly supplied. Room inspection shows metadata without exposing the native value. Product service installation and durable recovery remain under implementation.

Native process development adds scoped issued-value references for snapshots and receipts. Their inspection data cannot be copied to manufacture authority. Native Start now supports matching these values and passing them through child processes to another operation when an issuer is installed. Product service installation and durable issuer recovery remain in development.

Restart-and-verify development now includes strict provider-response validation for command identity, expiry and health observations, plus bounded native settlement of an accepted restart and transport through the existing API gateway. A lost command response now retains bounded original-key outcome checks without automatically repeating the command. Restart execution is not yet available through the product. Native completion now writes typed Completed/Refused results with the completed receipt retaining its original issuer identity. Native snapshot and health results now validate freshness and the original receipt binding; their bounded HTTP transport is now available internally. Native observation owner scheduling now permits one bounded retry for transient failures and connects validated results to issued values. Product installation and durable recovery remain pending. The fixed service package now exposes its typed operation and resource requirements to the compiler, without granting execution authority. Native service requests and result writers now bind to the durable operation journal; reopening an earlier execution cannot create a fresh execution guard.

The operation runtime can require evidence of a prior accepted result, retain it through child processes and restore it after interruption without repeating the original request. Product restart commands remain under implementation.

Process API steps can run in selected MATCH and conditional arms, including nominal payload arguments; inactive arms never send requests.

Recoverable API runs now retain operation-owner journals and automatically repair saved-result and acknowledgement gaps after a restart, without repeating requests.

An empty Workbench Process surface now offers Create process. Name the process and supply an example input, then review and Save the generated Code draft. Existing workbook source is preserved; execution still requires Start.

Saved operation results can finish validation after a restart without repeating the API request. Original deadlines and cancellation still apply before the process advances.

Installed operations can require a human decision tied to an exact snapshot. The reply form shows the action, target, version and expiry. Changed snapshots, expired decisions and reuse are refused, including after recovery. The bundled restart/verify adapter remains under development.

The owner sees request and outcome-check counts while an operation waits. Read-only surfaces show its state without execution controls. Concurrent or outdated checks are refused rather than spending another provider attempt. The built-in API read adapter remains GET/HEAD-only. Durable API commands and the complete restart/verify workflow are still under development.

The selected host now has a durable operation journal that retains command intent and receipts across restart. This is supporting runtime work; the complete recoverable API-command workflow remains unavailable.

With recoverable process storage selected, an API read followed by an agent or human step can resume using the accepted result without repeating the request. Interrupted reads without an accepted result remain Unknown.

Adapters that require accepted human input now receive its original respondent, question and context identity through aliases and child processes. Copied or model-generated values cannot satisfy that requirement.

Workbench Process surfaces now offer Add step, with Value and Contribution first and coordination templates revealed on demand. Additions preserve the existing final result and become Code drafts for explicit review and Save.

Process editing now supports nested Add step and an Arrange step section for inserting before, moving and removing authored statements. Moves keep their scope and inline comments. The compiler checks every draft before explicit Save.

Participant setup can add an AI profile or authenticated human role and prepare its Team binding. Shared Teams are copied for the selected plan, preserving the responders used by other plans. These changes also require review and Save.

Inspect logical policy structure

Compiler tools now expose logical rules, facts, laws, evidence claims and query publications as structured compiler records. The Inspect logical policies example follows a policy's conditions and evidence authority. Source locations and diagnostics stay tied to the inspected text. Expanded implicit syntax and other retained fragments remain explicitly incomplete; inspection does not grant rewriting or establish policy correctness.

Inspect every authored source setting

Compiler tools now show model headers, strictness settings and evidence timestamps as separate structured occurrences, including earlier values replaced later in the source. Inspect source settings demonstrates querying those occurrences from Grid. Exact comments and formatting remain attached to the source; unrecognized trailing text stays visibly incomplete. Ordinary parsing retains its existing final-setting behavior, and inspection does not grant policy rewriting.

Inspect declarations and policies

Compiler tools now show choice members, type parameters, constructor declarations and fields at their own source locations, preserving duplicate members and authored type text. Nested type applications and their arguments now have individual source locations, so tools can inspect array<Item> without splitting a string. Inspect choice declarations demonstrates this structure. Constructor expressions, record-field tags and type annotations outside choice fields remain unfinished; declaration inspection does not grant rewriting support.

Inspect unit syntax now follows authored UNIT declarations and compound unit: choice-field tags through the same grammar that resolves units. Tools can inspect written scales, atoms, products, quotients and powers at their source locations. Invalid unit expressions remain visibly incomplete, and inspection does not grant rewriting support.

Compiler tools now retain the original expressions in top-level FORMAT policies, including reactive calls, repeated declarations and exact source locations. Inspect format policies shows the generated fields without hidden policy assignments. Per-assignment formatting and validation clauses remain explicitly incomplete, and policy inspection does not grant rewriting support.

Compiler tools now show symbol Price as a structured declaration with its authored name and source location. Inspection follows the compiler's retained statement identity, so synthetic assignments and internal identity calls no longer appear as authored syntax. Exact comments and spelling stay in the source; rendering and substitution remain explicitly unsupported for these declarations.

Compiler tools now expose decision-package contracts and exchange-rate instructions as structured compiler records. Inspect contracts and currencies shows package inputs and outputs, required flags and normalized currency pairs. Original text and declaration locations remain available. Package bodies still lack individual clause locations and source ordering, so they remain explicitly incomplete. Inspection grants neither package execution nor rewriting support.

Keep bounded Predicate checks out of ordinary parsing

Ordinary compilation and source inspection now use a specialization of the same parser that does not charge Predicate-fragment work. Explicit bounded fragments retain their work limits and refusal behavior. Language behavior and syntax-tool capabilities remain unchanged; broader performance findings remain under review.

Bug Fixes

• Grid Views preserve Tree selection and expansion through native row updates, validate record-field Form edits, and retain nested semantic values on Save. Code and Builder retain the selected authored node. Complete View printing fits drawings to the page and excludes Code workspace chrome. Drawing updates and Tree expansion avoid repeated copying and rendering of unchanged content.

Print Studio opens and reopens without crashing when launched from a surface. Print preparation is mounted only while the dialog is open.

Evaluate now recognizes equal numeric results across native-frame and Process JSON representations. Exact-match, field-equality and classification checks preserve large integers and keep text labels distinct from numbers.

Native Dataset capture now reads compact and reopened workbooks correctly, including saved input overrides and rows outside the visible grid. Pending external data still requires an explicit refresh before capture.

Process drafts no longer show a false unavailable error in Code on a Process host. Visual editing works after a run is selected, and the browser Code editor can Undo and Redo a visual draft even on its first opening.

Process Diagram cards now accept clicks on their inspection and editing buttons while graph dragging and edge creation remain disabled.

The Process panel no longer polls unselected history or suspended and completed runs. Selected active work remains observable; Refresh discovers other changes.

Compatibility and Migrations

No source-language changes or migrations. Installed operation contracts remain authoritative; the controls do not grant additional provider capabilities.

Known Issues

Selected recoverable operation storage currently has 128 journal slots and a 4 MiB logical reservation per slot. Automatic retirement is unfinished; removing a process does not reclaim its operation-owner evidence.

Durable command execution and the complete service-recovery workflow are not yet available. This candidate has not been published.

Documentation Updated

• Agent/API workflow: pending-operation controls and the current read-adapter boundary.

Native issued-value recovery now selects a journal at root admission and reopens its authenticated records before decoding saved values. Frozen Start retains original issuer limits and room resource references; recovery does not rebind resources, renew authority, or dispatch accepted operations. Missing journal capability or changed limits refuses recovery. Volatile issued roots remain nonrecoverable. Product service installation and durable command reconciliation remain outstanding; this does not close the service product walkthrough.

Ordinary API steps in an issued-value process decode argument framing through that process's selected registry, then apply the existing data-only boundary. Nominal and issued resources remain invalid ordinary API parameters, including when nested. This uses a bounded validation walk at operation ingress and adds no value serialization or issuer work to ordinary cell evaluation. The host regression is compile-checked only; live service installation remains pending. Native room recovery is tested to retain original resources without rebinding, and to refuse altered references or revoked resource admission.

Native service restart episodes are now checkpointed in the original operation journal before egress and before outcome publication. The checkpoint retains the original command digest, first dispatch time, consumed attempts/lookup slots and accepted provider identity. Pending recovery checks the original binding and snapshot and durably removes any stale redelivery grant: a fresh original-key lookup is required before considering another identical request. An uncertain checkpoint write prevents further execution. Compaction preserves the checkpoint; older journals without it cannot restore a pending restart.

This path supports only an unstopped Pending owner with matching counters. InFlight/Unknown commands remain sealed for separate reconciliation; no deadline, identity, authority or attempt reservation is renewed. Product service installation and source pending-continuation integration are still outstanding. The host implementation and regression cases are compile-checked only, not executed.

The native operation owner now supports an explicitly installed, lookup-only reconciliation action after source execution has stopped. Reconciliation consumes an original lookup attempt within the original outcome-retention deadline and fences a distinct Reconciling state before I/O. A found result preserves the stop cause and cannot resume authored source. Pending provider replies grant no redelivery permission. Recovery of an interrupted lookup retains its consumed attempt and returns Unknown without automatic provider work. The adapter hook refuses by default; ordinary settlement does not grant reconciliation capability. The service gateway and product controls still need to install this capability.

The native fixed service adapter and gateway now implement stopped-command reconciliation. The installer supplies the original journal owner/episode and authenticated original snapshot. The adapter reconstructs the same command key and digest, consumes the original remaining lookups, and cannot POST or perform ordinary settlement. The durable guard requires separate current lookup authority and a Reconciling attempt fence. HTTP checks that authority before preparation and immediately before egress, with a complete request window inside the original lookup retention. Finding an outcome never removes the source stop cause.

An interrupted attempt remains consumed even if its adapter checkpoint was not written; retained provider acceptance cannot be replaced by a later response. Reconciliation checkpoints are stored in the same original operation journal. This native integration and its host regressions are compile-checked only. The product installer, original-input restoration and visible recovery controls remain pending; no live service command capability is enabled by this change.

Native stopped-service recovery now assembles from original owner-retained arguments, not replacement JSON. Restoration requires a journaled issuer in the same root namespace, the exact installed restart descriptor and resource generation, native resource/snapshot provenance, and matching provider, account and connection. Snapshot freshness is checked at the original command admission time; recovery does not renew it. Retained approval data is checked for consistency but grants no new human consent or execution permission.

The native recovery entry point connects this restoration to the fixed installed service package, lookup-only durable guard/gateway, issued result writer and original operation owner. Current lookup authorization is still required. Host implementation and regression coverage are compile-checked only. Initial product service installation, storage selection, pending continuation and visible recovery controls remain incomplete; this entry point is not yet exposed through them.

Durable source operations now require two explicit native selections: the installed environment must admit durable execution/recovery for the exact descriptor, and the root must carry a combined durable execution journal. Missing or volatile storage refuses before any workflow turn or operation, including earlier agent steps. The existing disk process journal declares its combined storage capability. Package import alone supplies neither selection; the default API environment still refuses durable operation admission.

This enables the runtime admission contract needed by the service installer; the product service environment, shared journal selection and pending continuation remain unfinished. Native execution regressions pass; host integration remains compile-checked only. The check is selected at admission/drive boundaries and adds no ordinary per-cell work. Selected-path performance remains unmeasured.

Native service integration now supports sharing the process-owned operation journal, with exact identity checks and bounded retention. This is an internal integration step; it does not enable service restart workflows in the product.

Native process storage can now retain scoped issued-value journals with bounded admission and strict recovery of existing evidence. Service workflow installation and the complete product walkthrough remain in development.

Service integration now authenticates issued snapshots when constructing human approval prompts and reserves enough durable storage for the declared restart attempts. The complete product service workflow remains in development.

The native service environment now assembles snapshot reads, approved restart and verification with scoped resources and durable evidence. Product installation and recovery controls still need integration; no completed service walkthrough is claimed.

Recoverable Process Start can now select the native service environment through explicit host grants scoped to an owner, model, resource and installed API digest. Ordinary connections grant no command rights, and unrelated API reads remain available. The full service walkthrough and pending recovery remain unfinished.

Development QA now includes a fictional local service and scripted analyst for the approval → restart → verify example. The walkthrough documents matching receipts, one applied command and declined approval; product execution and recovery completion remain unverified.

The native service recovery path now restores retained pending commands to Waiting without repeating a restart. Explicit outcome checks retain the original command, approval and deadline. Product verification and stopped-command controls remain under development.

The development process panel can now inspect a stopped service command's original identity, request/check counts and retained outcome. Reading this evidence neither repeats the command nor resumes the workflow. Provider reconciliation controls and live product verification remain unfinished.

An explicitly granted Check original command outcome action now connects stopped process runs to their original service lookup. It preserves the command's lookup budget and the workflow's stopped status; concurrent or stale checks do not duplicate requests. Live product verification remains outstanding.

Development QA can simulate a lost restart response while retaining the original command outcome. Provider tests pass; live recovery verification is outstanding.

The selected native AI Process preview now connects Evaluate to retained cases and original prediction or trained-version artifacts. Saved-result scoring makes zero model calls; fresh evaluations preserve exact versions, comparisons, trials and separate judge-call accounting. Subject and judge work honor the original workflow cancellation. Missing execution evidence remains unknown. Publication and version selection are connected below; full native journey QA remains unfinished.

The selected native AI Process preview now wires all six bundled operations. Publication requires a reviewed workbook input and expected revision; model selection requires an exact candidate and expected pin. Original receipts survive lost replies and later changes without repeating writes. Stopped-outcome lookup recognizes all six owners. These capabilities still require explicit host installation; full product journey QA remains unfinished.

Known pending AI operations can now be restored with explicit Process Resume after a host restart. The original wait, limits and owner identity are preserved; Resume cannot dispatch the operation again. Check reads its original outcome before the workflow continues. Pipelines without participants show that no model connections need restoring. Unknown dispatches remain stopped. Native restart QA remains in development; live automatic advancement is connected below.

Live AI pipeline steps can now advance while the Process surface is closed. Capture, Predict, Train and Evaluate notify the shared Process executor after owner work drains; it checks the original receipt before continuing. Duplicate notifications cannot repeat work, advance another step or revive cancellation. Recovered waits still require an explicit Check, and uncertain outcomes remain stopped. Native journey QA and measured performance evidence remain outstanding.

Train now creates evaluation setup from the completed candidate's retained columns and task, even after editing or reopening. Classification candidates get classification checks. Changed held-out partitions and older results without mapping ask for explicit setup instead of borrowing the current editor's values.

Process evaluation groundwork now compiles frozen cases against retained imports and preserves exact structured input shapes through the native owner. Fresh Process evaluation is not yet available through the AI service or surface; isolated ownership, recovery and native journey QA remain in progress. The isolated case input component now preserves private native values and case provenance through ordinary Process Start and explicit recovery. It does not yet enable the fresh evaluation journey. Case preparation now refuses live writes and Room access throughout the selected Process and its children. A registry-owned write is not treated as isolated just because its descriptor says OwnedWrite. Fresh evaluation execution and native journey QA remain unfinished. The internal case executor now uses native Process admission for model and human cases. It preserves the original attempt, keeps credentials out of retained case receipts, and releases execution capacity while waiting for a human. Evaluation case receipts now wait for physical execution to drain and retain evidence before updating counts. Lost acceptance can recover through the durable owner store without another model call. Comparisons retain the original Process identity and each case’s exact execution identity. Cancelled native cases retain their outcome instead of being reported as unattempted. The public fresh-evaluation journey still needs parent-run coordination and UI integration. Native owners can now receive an event when a child Process completes or stops, including a late subscription after completion. Human waits and cancellation requests do not masquerade as settled results. The evaluation owner still needs to connect these events to its retained cases and overall limits.

Process sources that use COLLECT or an effectful process MATCH now compile into validated Process artifacts instead of refusing at compile time. A MATCH runs exactly one arm on the existing sequential runtime and keeps unselected RUN steps inert. COLLECT over a collective role refuses at compile time. Existing Process artifacts keep their identities.

The internal Process owner now runs COLLECT members in bounded lanes: up to the root's concurrency are started at once and interleave on the owner's thread (a root with concurrency one, the host default for new Starts, runs them in order). Each member settles one owner-issued Completion, and a malformed answer or a declared known provider failure becomes a Failed outcome instead of stopping the run, so the known-failure fallback sample runs end to end with scripted responders. Once a numeric target is reached or becomes impossible, no member starts new work: calls already in flight finish as unselected values, started members are cancelled before their next call, and the report keeps values in membership order with acceptance ordinals. Unknown work, cancellation, deadlines and limits still stop the run without a report, even after the target is reached. A durable Process root can now recover a COLLECT after a restart without calling a settled member again, reproducing the same outcomes, when its journal retains captured member failures. The host's durable store does not do that yet, so it still refuses COLLECT at Start, and product hosts are not yet wired for it.

An internal browser operation owner now proves the select-a-filter contract against a local test driver. It checks the exact observed control, sends one command per call with a one-use identity, and keeps a lost or unverifiable action Unknown instead of retrying it or reporting no effect. This is not a supported browser capability: no Desktop browser engine is qualified yet, and Start refuses without a qualified driver.

An internal owner for shared documents and work items now saves a revision only against its exact current base. A writer whose base is out of date changes nothing on the document: its content is kept as a proposal, and the current version is shown only to someone allowed to read it. If a save's acknowledgement is lost, repeating the same request returns the original save instead of a conflict. This is not yet available from Processes or Desktop: no host installs the owner and the READ/REVISE document spellings are not implemented yet.

The same owner now records checks, disputes and supersessions against exact revisions. A revision that declared it depends on the validity of a superseded or withdrawn revision reports that it needs review; a dispute or a plain citation does not. Nothing is rewritten or retracted, and no new work starts.

Shared workspaces in the same internal owner now keep named branches. A set of changes to several files commits all together or not at all, and only against the exact version it was written for; if someone else changed the branch first, the changes are kept for review instead of overwriting theirs. Merging branches never picks a side silently: a file changed differently on both branches needs an explicit decision.

In builds that include Processes, this owner now keeps its documents and workspaces in the model's durable artifact store, and a save interrupted by a crash or restart is finished exactly once or cleanly abandoned. It is still not available from Processes or Desktop. The general artifact download refuses shared-document and workspace records, so their text can only be read through the owner's own access checks.

Reserve document results before starting work

Shared-document processes now reserve result capacity from their checked workflow bounds before starting. Repeated full-size reads leave room for later edit outcomes, and oversized workflows are refused before model calls or document changes. Reading a valid 64 KiB document now leaves separate space for revision metadata and escaped text. This covers document issuance; restart restoration and fresh product verification remain unfinished.

Apply the selected Process workflow

Create process now accepts the selected guided debate, document review, population, list review, backup-answer or API-assessment starter through the authenticated API. Previously those forms sent supported fields that the API rejected before reaching the compiler. Population changes in Participants now reach the compiler too. Applying still creates only a Code draft: review and Save it, then explicitly Start.

Bind document journals to their installed documents

Shared-document Start now selects a journal for the exact installed document authorities. The previous catalog/individual identity mismatch refused the first resource binding before any agent work. Single-owner journals remain strict; unknown authorities and changed catalogs are refused. Document restoration remains unavailable.

Grid 0.67.1 — Upcoming (not released)

Summary

Grid 0.67.1 brings shared Code/Builder source editing, initial Tree support, and more reliable nested semantic values. It incorporates the unpublished 0.67.0 milestone, including the earlier unpublished 0.66.9 work. These notes describe the prepared release; publication is not yet recorded.

What's New

Atomic source transactions validate source hashes, selected nodes and the combined result while preserving expressions and source formatting. Initial Tree support includes native relationship checks, bounded inspection, keyboard navigation, keyed rows, stored input/local record state bindings and Form staging. Whole-record View writes preserve supported nested native scalar tags. Declared Views open in the source-backed Builder, and canceled drawing edits retain their proposal. These additions have focused local test coverage; that does not establish full product acceptance.

Improvements

Compiler syntax inspection

Syntax inspection preserves authored calls such as FORMULATEXT(A1), BODY(bump) and AST.DEFINITION(bump) before the compiler resolves them into values. Their arguments and source spans stay inspectable, alongside final compiler diagnostics and inferred function metadata. Inspect function structure demonstrates the preserved reflection call.

This capture runs only for requested inspection and does not clone the compiler arena. Some declaration families, recognition-time source transformations and nested token structure remain incomplete. Deeply nested expression inspection now reports its depth limit reliably.

Relationships, qualitative assertions, logical paths and knowledge-graph options now expose their retained compiler fields. Inspect relationships and paths shows endpoint, direction, payload and path records. Where parsing has already expanded lists or named paths, inspection explicitly reports incomplete source structure and preserves the original text.

Tree patterns, theories, algebras, transforms, translations, solvers and theorems now expose their compiler-owned declaration structure, including parameters, clauses, policies and source locations. Inspect tree patterns demonstrates field navigation. Grammar-owned fragment text stays explicitly incomplete; inspection preserves compiler diagnostics and does not authorize execution.

Workspace navigation

Appearance → Navigation now offers three layouts. Standard keeps the current labeled rail, Thin uses a narrower row of icons down the left, and Collapsed places navigation in a dropdown at the top left. Hover with a mouse, click, tap, or use the keyboard to open the dropdown; Home, the model layers, Advanced, Help, Appearance, and Account stay available.

Narrow or short windows use the dropdown automatically, preserving your choice for when there is more room. Browsers remember the setting on this device, and desktop retains it in the app profile. The setting leaves the open model and your work in place. Browser tabs share the latest saved choice and recover it when reopening a workspace; delayed tab events cannot replace a newer choice.

Keyboard focus follows navigation when resizing replaces the rail with its dropdown. Escape closes a hover-opened menu without taking focus from your draft. Long companion and Return to model labels fit their available space while retaining the full accessible and hover labels. At widths up to 800 pixels, the title and model context occupy a separate row; desktop reserves a separate strip for native window controls and removes that extra strip in macOS fullscreen.

Search from anywhere

Search, next to Home, opens a spacious search overlay from every layer. Press Command+K on macOS or Ctrl+K on Windows and Linux. Browse grouped navigation or type to rank results, then filter by Navigation, Models, Views, Cells, Commands, or Help.

Search finds saved model metadata across accessible folders, current Live model views, cells and source declaration names, loaded cell values and formulas, available contextual commands, and public documentation text. Loading notices and warnings identify incomplete folder or documentation results. A private Scenario offers navigation only, keeping its data and command scope isolated from Live.

The search retains keyboard selection, handles input-method composition, and transfers focus correctly when a result opens another dialog. Narrow windows keep search available beside the collapsed navigation. Catalog/document loading and indexing happen only while search is open. It does not load other models' source for full-text search or evaluate unloaded cell values.

Bug Fixes

Nested numeric tags, including mixed currencies, remain intact in computed records. Tagged scalar values compare with their underlying numbers or text, so filtering a tagged amount against an ordinary number works without discarding its currency. Nested URLs and other typed strings retain their presentation identity. Datetimes with explicit offsets remain temporal values through record edits and saved inputs.

Compatibility and Migrations

AST.PARSE now preserves authored reflection calls and their arguments instead of exposing compiler-materialized values. The source text and revision remain exact; unsupported syntax families still report their limitations.

Standard navigation remains the default. Thin and Collapsed change the frame without changing the model or its calculations. No migration is required for the navigation setting; profiles without a saved choice use Standard. Search reuses existing navigation and command actions; it does not change model calculations or the source/runtime contract.

Known Issues

Compiler syntax inspection remains incomplete; large and long-tail inspection performance still needs work.

Tree requires a compatible native host; legacy App export targets refuse it. Whole-record View edits refuse unsupported scalar carriers and lossy field-type changes. Field validation remains limited to the implemented ownership rules.

Complete Code/Builder, Tree, Form and drawing interaction/export journeys have not been verified in a packaged application. The retained drawing feedback measurement exceeds its 50 ms p95 target; Tree measurements do not establish its full frame and resource budgets. The completion record retains the specific open work and measured limits. The focused native semantic value audit is complete for the covered families; it does not establish UI or export coverage.

Visual QA of the navigation density changes in a newly built native desktop application remains unverified.

Documentation Updated

The compiler tools guide and function example explain source retention before finalization and its remaining limits.

The interface layers guide describes the three navigation layouts, responsive behavior, input methods, saved preferences, and global search scope and shortcuts. The Views guide and completion record describe the shipped source capabilities and explicitly unverified interactions.

Grid 0.67.0 — Upcoming (not released)

Summary

Grid 0.67.0 brings computed drawings into Views and Code, completes the current View authoring journey, and adds native validation for model-input record fields. It also incorporates the compiler tools and workspace improvements developed on the unpublished 0.66.9 milestone.

What's New

Computed drawings in Views and Code

Use Drawing, shape, Group, Graphic, Label, Overlay and Handle elements in the existing UI language. Geometry and appearance use native Grid expressions. Overlay controls retain ordinary View behavior, and handles change explicit writable point inputs through revision-guarded atomic writes. Forms stage handle changes until Save; private previews leave shared inputs unchanged.

Code's Draw workspace supports selection, placement, grouping, transforms and checked source edits. Derived expressions retain their ownership; Add transform preserves the original geometry formula. Reusable and imported elements remain linked to their source definitions. Artwork SVG exports the graphics layer; View print includes ordinary controls.

This is the initial drawing delivery. Further performance work and broader acceptance coverage are scheduled for 0.67.1; the full original graphics plan is not described as completed.

Record field validation

Declare exact VALIDATE FIELD paths on writable model-input records. Native checks validate proposed whole-record and field writes atomically. Forms show path-specific errors, and Code prepares checked field-rule edits while refusing schema changes that would leave rules behind.

Improvements

Syntax inspection now follows compiler expression definitions, reducing the risk of compiler changes being omitted from tooling. Existing syntax formats and model behavior are preserved. The parser also retains authored item boundaries and exact intervening text. Complete nested source-syntax retention remains in progress.

Completeness reporting follows the compiler's program fields, so new fields must declare whether their source structure is represented. Syntax inspection also avoids redundant copies of source text and node data, and reuses parser-owned separator information instead of repeatedly parsing source gaps.

Inspect graph paths, partitions, patterns and fixed points as nested compiler declarations, including their objectives, selectors, seeds and bounds. The AST shows the retained intent instead of internal lowering calls. New supported fields flow from the compiler definitions; source locations stay separate from field data, and transformation support remains explicitly discoverable.

Function inspection now derives its structure from compiler records, with inferred signatures, captures and dependencies kept separately as metadata. Code's checked signature editor follows the generated fields, and a function-inspection example shows how to use them from Grid. Existing whole-source queries using flat function attributes should follow the updated compiler-tools guide.

Assignment, rule, table-mutation and solver inspection now derives from compiler statement records. Follow generated fields to tensor shapes and precision, modifiers, schedules and solver goals. Target locations remain separate from semantic data, and plain named assignments retain their rendering behavior. Code adds an assignment-type example and recognizes generated named bindings for checked renaming. Queries using flattened statement attributes or fixed child positions should follow the updated guide. Tensor values now show their authored expression and source location: the compiler records provenance when it adds execution metadata, so inspection needs no helper-name filtering.

Rule inspection now follows the compiler's own trigger, action, schedule and policy records. Fields link to nested structure, so compiler extensions no longer need matching handwritten rule visitors. RESET and CLEAR omit their internal placeholder values. Queries using earlier flattened rule/schedule attributes need to follow the generated fields described in the compiler-tools guide.

View and schema inspection now follows compiler records as well. Explore named View items, guards, labels, arrangement rows and schema fields through generated structure. The inspector includes a View example and follows name links for readable labels. Unclassified fragments remain visible as incomplete source.

Find elements and imported components by name or description in insertion and outline search. Selecting an outline result opens its source and Properties. Insertion follows refreshed contracts and placements, preserving equivalent drafts and clearing obsolete fields.

Inspect a generated record-form field to edit its nested source default. For a computed or referenced default, Properties explains the containing expression that owns the value. Cancel pending Properties, options, event, slot and record edits without losing drafts; late replies cannot replace a newer edit.

Drawing functions compose nested arrays through DRAW_GROUP, accept native color values, fill supported paths and geometry holes correctly, and render arc and ellipse strokes and linear gradients.

Bug Fixes

Repeated drawing rows retain keys and overlay drafts when another client changes record inputs. Native MERGE preserves stored fields when combining plain input objects with authored records.

Drawing gestures account for fitted previews, zoom and group transforms. Handle hit targets retain their screen size. Escape cancels unsent movement and pending validation, while already-dispatched writes retain their revision receipts. Successful Form Save/Discard clears obsolete handle feedback.

Saved Views load their compiled preview in Code after Save and reopen. Failed loads offer Reload preview. Print output excludes editor chrome and notices.

Compatibility and Migrations

Existing Canvas pixel configurations retain automatic normalization. New Graphic authoring defaults to unit grayscale and supports explicit unit/byte/auto ranges. Drawing paths support the absolute M/L/C/Z subset; relative commands are rejected. Native raster text returns an unsupported-operation error. Malformed drawing values produce errors instead of substituted coordinates or omitted segments. SVG values display as inert images. Valid older drawing values retain documented optional defaults; no model-source migration is required.

New drawing contracts, guarded handles and record field rules require matching native capabilities. Unsupported hosts refuse them without weakening guards. Record field rules do not extend to computed/default owners, private-local fields, array elements or resident-table rows. Spreadsheet formula export discloses that these native field contracts are not enforced there.

Known Issues

The large-drawing latency targets are not yet met or fully measured. A local development workload with 1,000 shapes and 20 overlays recorded p95 85.6 ms to a DOM update; this is not physical-paint or production-profile evidence.

Broader image/pixel/export, nested-control, older-host, source-cancellation and native capability-loss combinations, plus idle/retained-memory and historical ordinary-path measurements, remain scheduled for 0.67.1. Existing safety and validation limits remain enforced. Native GPU composition, animation timelines, shaders, advanced path editing and raster painting are outside this increment.

Documentation Updated

The shared View specification, guide, function reference, generated contracts, language registry and canonical examples describe this increment. Cloud and Dev review/import/publication work remains separately recorded. Books and Pro remain on hold. Source landing does not establish product or website publication.

Grid 0.66.9 — Upcoming (not released)

Summary

Compiler tools expose Grid expressions as immutable syntax values. Models can inspect formulas, construct source, substitute expressions without capturing variables, and request analysis or checked renames from the native compiler. This development milestone has working examples and has not been published.

What's New

AST.QUOTE captures an expression without evaluating it. AST.DEFINITION reflects local declarations. Traversal, constructors, rendering, and hygienic substitution operate on a versioned data format. AST.PARSE, AST.ANALYZE, AST.CHECK, and AST.RENAME use the host's compiler service. See compiler tools for supported forms and limits.

Improvements

Timed notifications now wait while you hover or focus an action, then use the remaining display time when you leave. Removed notifications no longer retain their timers.

Large Code workspaces prepare scoped source files with less repeated scanning. The full outline, scoped edits and Problems markers remain available. Opening a very large source file still needs further response work.

Long Notebooks now show one live editor at a time while keeping every block readable. Click another block or use its Edit action to move the editor there; shorter notebooks keep their direct editing layout. Unchanged blocks stay steady while you type. Notebook cards also follow the dark theme correctly. Opening a very large notebook remains an area for further work.

A continuous frame now joins Data, Code, App, Chat, and global screens. The Grid mark opens Home, a central left rail selects layers, and Help and appearance sit below. Data keeps its familiar editing tools inside the frame. Narrow windows use an anchored layer picker; desktop controls share one native titlebar. Resizing between the rail and compact picker closes an open navigation popup and returns keyboard focus to a visible control. Global screens use the same frame without reserving another empty ribbon row. The slimmer rail and top bar surround one rounded, inset workbench, with a clear active-layer marker and a quiet background behind Data's existing ribbon and grid. At phone widths, the model title has its own row above navigation and editing controls, so it remains readable beside the companion action. Back and Forward revisit layers and global screens in the current model. Open Chat beside places the existing conversation alongside Data, and Open App beside brings the model's App view alongside Code. Focus either pane to direct shared editing commands, resize the divider, or use tabs when space is narrow. App pages retain their own navigation and unfinished-work guards while Code keeps its editor. Closing Chat retains the conversation and draft; reopening restores the divider position in the current model session. Both panes remain in Live. The frame's Open beside menu also offers a Browser reference pane on Grid Desktop. It stays beside the model as you change layers, keeps page navigation separate, and never publishes reference-page data into formulas. Closing and reopening retains its address draft and resident page session; narrow tabs hide each native page independently.

Press a layer and drag through the rail to preview its purpose, then release over a destination to switch once. The stack follows your pointer; releasing on the current layer leaves your work in place. Escape or releasing outside the choices cancels. Focus a rail layer and press Alt+Down Arrow to explore with the keyboard, then Enter to accept. Reduced motion removes spatial movement. The previews are lightweight illustrations; they do not start hidden workspaces or transform live Browser content.

Data keeps its established ribbon, formatting tools, and grid layout. Clipboard reads, file drops, and paste preparation retain their original Data context and destination. Leaving that context cancels unfinished preparation; completed saves and formatting acknowledgements cannot repaint another model. Switching partitions also releases a previous cut's move behavior. Formatting-only rich paste now participates in Data Undo/Redo, including after a visit to another layer; failed saves remove the pending history step. Open definition in the Formula group follows an exact authored cell or named value into Code. Show in Data makes the return journey explicit while ordinary layer switches retain their working positions. Attach to Chat carries an exact value into an unsent question, preserving its draft and images, with an explicit return to its Data or Code origin. Reveal in App finds direct bindings in loaded declarative Views, offers a choice when several match, and highlights the accepted element. Unsupported mappings stay unavailable instead of guessing.

The Live context control can create one named private scenario beside Live for a supported portable workbook. Source, inputs, and manually advanced time belong to the copy. The shared layer and history controls follow the focused context. Compare with fixed At creation values, filter changed inputs or results, search the full comparison, and see typed differences while Live continues independently. Closing the pane hides it and retains its drafts, even while another companion is open. Live shows the retained scenario's name in its context control; choose it there to resume. Discard scenario… requires a separate confirmation. Explicitly reopen it or choose Refresh scenario to refresh private values. These experiments are ephemeral, expire after 15 idle minutes, and have no Apply to Live operation. Unsupported models are rejected; scenarios do not run external actions, jobs, connectors, Browser surfaces, JavaScript, imported View components, or AI Chat requests. Choosing a layer from Home or Help returns to Live and keeps the private copy available; Return to model restores the previous workspace context. Preparing a scenario preserves an open Live dialog and its unfinished edits. Select the ready scenario explicitly after closing the dialog. Live model actions remain unavailable while private work has focus; notifications and account controls remain accessible.

Undo and Redo stay in the shared top bar and follow the focused supported editor or surface, with tooltips identifying the editing context. They dim where history is unavailable. Visiting Home or Help preserves the open model's history; return to Data to undo or redo a cell edit. Chat composer Undo affects unsent text only when the browser exposes that history. Supported authored App views retain acknowledged Undo/Redo steps when you leave and return to the unchanged view; uncertain actions stay unavailable rather than skipping to older edits.

Five working examples cover model auditing, checked refactoring, an invoice language backed by native TREE values, and staged source generation. The Code workspace provides example scratchpads and explicit generation previews. A bounded native worker checks generated source and evaluates selected results in a fresh compiled formula model. Reviewed replacements are staged until explicitly saved. Editor help includes AST.QUOTE and dotted AST names.

Compiler-backed rename preserves untouched comments and formatting while refusing binding collisions and capture.

Select a source expression and choose Explain expression to inspect its resolved binding, contextual type, known effects, direct dependencies, and available units, bounds, and validation proofs. AST.MEANING exposes the same facts to Grid programs. Reports identify the exact source revision, refuse stale selections, and distinguish established facts from partial or unknown information.

Checked edit transactions now replace an expression, extract a function, or change a local function signature and update its resolved direct callers. Code shows focused before/after edits and resulting diagnostics, then rechecks the original draft before staging all changes together. AST.EDIT and AST.APPLY expose the same source-only workflow to Grid programs. Stale drafts, altered transactions, binding capture, and unsupported call uses are refused. Compilation checks validity and does not claim equivalent behavior.

Grid-authored analyzers inspect model source as data and return findings in Code’s Problems list and editor markers. Suggested fixes open a checked edit preview and require explicit staging and Save. Revisions, source locations, report sizes and suggested operations are validated; findings do not claim compiler validity or equivalent behavior. The included effects analyzer provides a reusable starting point.

Substitution now protects names across generated functions and modules, including forward and recursive references. Inserted expressions stay free of accidental capture by generated declarations, parameters, or local bindings. Incomplete or annotated source forms remain explicit refusals; existing source uses checked edits. The refactoring example demonstrates module generation.

Quoted templates now support named expression holes and argument or array list splices. Inspect expansion shows generated code beside retained template and input locations, explains renamed bindings, and follows compiler findings back to their origins. Inspection checks generated declarations without executing them. The new quoted-template example also works with the existing reviewed generation flow.

Bulk syntax tools select matching nodes and replace independent occurrences without repeatedly validating the entire tree for each lookup. Operation discovery explains whether a selected node supports rendering or lexical substitution before a tool attempts it. The checked-refactoring example now demonstrates these operations alongside rename and hygienic substitution.

The syntax inspector now exposes rule trigger policies and action targets, assignment schedules, solve goals, structured function signatures, graph and predicate schemas, and View outlines. It distinguishes complete inspection from safe source emission, and explicitly identifies clauses that still retain only source. Comments and formatting remain available in the exact authored text.

Bug Fixes

Network opens large machine lists faster. Find machines searches every peer by name, route, or status, and page controls keep all matches reachable. Refresh retains the current page where possible; speed tests retain all eligible routes.

App authoring avoids replaying its initial document and renders large outlines as you scroll, reducing opening and return-from-Preview work. Keyboard navigation, range selection and nested collapse reach the full outline, including in narrow Elements drawers. The canvas, recovered drafts and Undo/Redo remain available.

Code's Problems panel opens and closes large diagnostic lists faster, with continuous scrolling, keyboard access to every located problem and fix action, and retained focus and text selection. Editor markers keep the complete set of current diagnostics.

Dataset's preview-and-steps editor opens large results in pages of 20, with direct page navigation and access beyond the previous 200-row preview limit. Editing source names or output targets avoids rebuilding unchanged rows and type hints. CSV and Publish continue to use the full prepared result. For very large results, the first page appears while exact full-result column type hints finish checking in the background.

Shared tooltips now stay inside the window and cancel pending hints on Escape, scroll, or resize. Menus retain keyboard position during command updates, scroll without closing, and return focus before opening another dialog. Workspace buttons acknowledge hover and keyboard focus immediately, with reduced-motion support.

Command and model search now open the exact chosen result, retain selection through refreshed lists, respect input-method composition, and transfer keyboard focus reliably into the next dialog. Search fields expose their active result to assistive technology. Narrow windows retain equal gutters and keep keyboard selection visible; indexed search avoids repeating normalization while typing.

Home search avoids redrawing an unchanged model library when the picker opens or closes. Model previews retain their appearance with less rendering work in large libraries and search results.

Large Home libraries now render the visible rows and cards as you scroll, preserving rename drafts, pending actions, and keyboard traversal. Switching layouts keeps your place, and the toolbar fits narrow windows.

Chat prepares and displays focused source changes in large models faster, preserving exact line alignment, review context, and stale-source checks. Long Chat and side-rail conversations open at the latest messages, with older messages available in small groups. Revealed source reviews, text selection, and message actions stay in place as the conversation continues.

App builder outlines now support anchored range selection, separate selection and keyboard focus, parent/child navigation, and expand/collapse controls. Bulk actions use the same selection as the canvas. Context menus fit all window edges, retain focused commands, and let users scroll long lists. Menu dismissal preserves the intended grid selection without overriding a newer gesture.

Source-reflection formula edits now refuse both cell and range splicing, so the host can refresh reflected source through ordinary compilation.

Large Code files now open with less source navigation work while retaining the complete outline, source links and diagnostic markers. Dense initial opening still exceeds the local response target.

Compatibility and Migrations

Existing ARGS, BODY, and FUNCTION remain compatible. Bare embedded compiled formula runtimes must explicitly install the compiler service for compiler requests. Ordinary syntax data functions do not need that service.

Known Issues

Source-module syntax projection is incomplete and reports that explicitly. Rendering refuses declarations with unsupported modifiers and qualified references; use retained source or checked rename for those forms. Generation uses explicit reviewed authoring actions; automatic macro expansion is not provided. Range-source-edit and complete generation costs have local measurements. Worst-case latency remains inconclusive: identical-binary controls also fail the unchanged tail budgets on this shared workstation. No optimized-profile or zero-latency-regression claim is made.

Documentation Updated

• Compiler tools and syntax values
• Language feature matrix
• Function reference
• Model interface layers

Grid 0.66.8 — 2026-09-26

Summary

First published September 26, 2026. Grid 0.66.8 is available for macOS Apple silicon, Windows and the Linux server, as recorded in the release ledger.

This release includes the Code, Data, App, Chat, document, Deck and runtime improvements developed during the unreleased 0.66.7 milestone. Version 0.66.7 was closed without publication. AI Surface Suite integration is in progress; its canonical Process visual authoring and workbench adapters remain unfinished.

Grid Views brings interactive view declarations into model source, with pages, local state, reusable elements, model actions, layouts, and presentation choices. Code understands the View vocabulary and checks embedded JavaScript and CSS. Named local SCRIPT helpers are checked at each property or callback use with a known contract; type errors point to the helper reference in Grid. Imported native event signatures now provide member checks and completion inside JavaScript handlers, with declared event values captured for each callback. Kanban, Calendar and Map also expose typed event values and known row-field completion. Typing card. in a Grid handler offers its known fields; choosing a name containing spaces inserts the correct bracket syntax. Suggestions respect local parameters and shared component uses. Imported event contracts also supply nested-record and array-item suggestions in Grid expressions. Grid event handlers mark missing known-row fields and invalid scalar field reads. Calendar end-column settings work on their own indented line. View scripts can now use JSX for component-valued helpers, with Code diagnostics, preview loading and prepared packaged/framework exports. React comes from the renderer. Native contracts can select JSX adapters with declared properties, lens pairs, events and slots. Adapters retain refs through updates and can place declared style parts on their markup. Code completes lens/part names and marks invalid event calls at their source. Component imports use locked libraries; Code also completes and checks native props described by those contracts, with isolated types for each View. Full package declarations remain incomplete. The remaining View features are still being completed. Numeric selections can be cleared, conflicted selections retain your value for reapplication, and successful Form submissions discard their field drafts.

Code now extends draft feedback to local scopes and keeps independent problems visible when a named-function call has an argument or type error. Bounded iteration can stop on a convergence predicate and report why it finished, while pure helpers can accept callable parameters and invoke local lambdas.

Use color snapshots from camera and video connectors with the same AI setup as Chat and workbook functions.

What's New

Human editorial review and run limits

Draft a document with an agent, give feedback as its human editor, and accept, revise or decline through Processes. The walkthrough retains the decision and iteration limit explicitly; it does not publish the draft. Start now offers model-call and time limits, including time waiting for people. Waiting and completed runs show actual model-call, participant-turn and operation counts.

See the human-review guide.

Choose a workflow method

Bind a Boolean choice between two authored procedures, then RUN the selected method. Reusable processes can select their statically supplied procedures this way. Both alternatives are checked before Start, and only the chosen child runs. The brief-or-reviewed answer walkthrough shows the source and Desktop controls. Broader process-reference forms remain in progress.

• Run one View CHECK, retry failed checks, or cancel a run from Code. Progress and completed results appear while checks run in separate private copies, with direct links to failures and cleanup before another run.

• Repeated buttons and native-control events now retain their sibling ELSE handlers. Rejected changes keep their state and run the row's refusal actions; Code event edits keep the handler together without consuming neighboring content.

• Rename a Grid View page from Properties. Code updates declarative navigation and CHECK references in one Undo step, preserves its title and URL, and offers Whole model access for links across Views. Conflicting destinations and uneditable shared or imported references are refused with an explanation.

• New Grid View and reviewed App conversions each add source as one Undo step in the rich Code editor. Whole model stays open with the new View's inspector, preserving earlier history. Undo or redo the addition, then Save when ready. Cancel a conversion while Code loads; changed source or App revisions require a fresh review, and refused insertions never retry automatically.

• App-to-Code conversion now assigns usable declaration names to library components with spaces, reserved words or conflicting names. Component mapping shows original names and IDs, generated names and unsupported templates; Show source selects the complete declaration. Exported packages use the current Code name.

• App conversion retains node IDs, library records, workbench references and saved View placements. Dirty Forms inside a saved View protect parent navigation. Portable component round-trips preserve template identity without accumulating wrapper containers.

• Source component packages now carry closed local and imported Grid function dependencies. Imports rename their private helpers together, and native checks reject captured model state, authority and receiving-name conflicts.

• Export reusable components with their local element and named action helpers. Helpers travel as private nested source, including transitive dependencies, custom controls and action callbacks passed to local elements. Code and App Builder list them during import review. Receiving-model helpers stay separate, and each instance recompiles its own local state and actions.

• Review page names, routes, starting page and changed order when converting an App to Code. Show source selects the generated page. Navigation uses the same distinct names as the pages, including colliding or renamed App IDs; duplicate routes and remaining document differences stay visible.

• Import a .gridcomponent directly into App Builder with Import View component…. Choose model bindings, review the new View’s source, then Save and insert. Failed App saves retain the placement for recovery; App Undo keeps the reusable View in Code.

• Place a saved Code View inside an App with Insert View…. Review its bindings, choose its starting page, and run it in Preview. Placements keep their own local state, follow saved source updates, and protect unsaved Form edits. Added model bindings require a fresh review. React Eject to Component also preserves these placements, their App pages/theme, and nested unsaved-edit protection. Svelte/Vue/Solid downloads and published Apps can also carry captured Views and their static scripts; re-export to include later View source changes.

• Create a bound View directly when importing a source component in Code. Choose its name and model bindings, review the generated source, and add the element and View together as one Undo step before Save.

• Share stateful reusable elements between models through Code’s .gridcomponent source packages. Review source and parameter types, import into a draft, and Save to compile separate local state and actions for each instance. App Builder continues to use portable .gridui templates; shared helpers use Grid libraries.

• Reusable App components retain their library version, descriptions, parameter labels/defaults and slot labels when imported into Code and exported again. The export dialog starts with retained types and reviews those details. Grid arguments remain explicit; stale metadata requires repair before export.

• Import reusable App components directly into Code: choose a package and source name, review the generated element, then add it to the draft with Undo. The compiler checks names and supported content; Save applies the draft.

• Failed calculations in Code previews now link to their authored expressions and offer explicit value inspection. Problems shows the same source location. Native errors display their message, and known generated names become readable expressions. Private-copy failures retain separate source recovery.

• Select a View element in Inspect to open its accepted model values and explicit Why trace. Generated targets and dependencies show authored expressions and source lines; stale or ambiguous locations are withheld. Private-copy and unsaved Form values remain separate from live-model inspection.

• Conditional record defaults and selected/sorted row lists now retain matching field tags. Generated Forms keep currency, percentage and date controls; table date formatting retains its temporal carrier even after plain JSON replacement. Conflicting tags remain unset. Explicit Code column formats still override inherited policies, and removing an override restores inheritance.

• Native Form saves now check validation against all submitted values together, including computed bounds and defaults restored by clears. A rejected batch preserves every live input. The check uses the existing native evaluator on a detached snapshot. Missing/error operands, external work and unsupported snapshot capabilities refuse without committing. Forms offer Check values, retain rejected drafts and show native field messages. Save rechecks the batch. Private preview copies validate their own inputs; packaged Views require write permission for each checked input. Old hosts refuse instead of silently saving.

• Model text validation and text/Boolean equality now reach View controls with their declared messages. Invalid drafts are retained, related Form inputs validate together, and field messages and Save availability refresh when a dependency changes. Code edits the owning rule through the existing checked source transaction and Undo. Current hosts check computed operands and numeric/structured equality through the native proposed-input operation.

• Render View-local collections with direct stored-field keys, nested row lists and literal arrays. Lists update, page and print through the shared renderer; empty arrays show their empty sentence. Stable keys retain row Form drafts across reordering, and Properties edits row identity with source checks and Undo. Explicit JavaScript can prepare browser row data; invalid results show a source-bound error. Known local arrays support keyed inline editing, including tables inside keyed parent rows and reusable elements. Changes follow current parent and child keys through reorder, preserve neighboring data, and retain conflicting drafts for reapplication. Whole-local validation, reset, paging, formatting and nested table column Properties use the existing paths. Computed owners and nested model rows remain outside this private operation.

• Edit lists stored inside model records, such as Order.shipping.lines. Keyed scalar and record/list changes preserve current parent fields and other rows. Code edits the column source and the containing input's whole-value validation, with separate row-source and declaration navigation. Tables inside keyed model rows and shared elements also support scalar/record edits, preserving native types and current parent data. Missing or duplicate parent/row keys reject the write, and reordered parents retain drafts. Shared definitions expose checked column controls. Calculated owners remain outside this contract.

• Edit private table record/list fields as JSON with explicit Save/Cancel and conflict review. Blank fields keep their declared editor, sorting retains row identity, and writes preserve neighboring fields. Pair lists retain their shape. Print shows JSON values and whole-local validation still applies. Model input/default record lists also support these edits, preserving native types, exact/date text and matrix axes through the existing model action. Retained type details and conflicts expose hidden type changes. Unsupported native carriers and individual field contracts remain outside this editor; full native-host acceptance remains pending.

• Each keyed row now owns locals declared in its reusable components or directly in its body. Drafts survive reordering, paging and temporary removal, with independent inputs, actions, validation and reset. Nested rows remain separate; duplicate or missing keys explain the problem instead of combining state. Properties edits the shared declaration and preserves same-named outer locals.

• Enter mixed fractions and paste accounting, scientific or scaled numeric text into inputs and editable columns. Native format sections supply the sign, locale and units. Untouched values retain their precision; invalid or ambiguous text keeps the draft, and Forms wait for a repaired value before Save.

• Inspect validation from nested private tables and repeaters. Properties links stored row paths to the exact containing local and explains that its rule covers the whole local. Read-only lists and repeated body locals retain this source navigation and Code Undo behavior. Direct table columns no longer appear as undefined model names when their schema is known only at runtime. Individual field contracts remain outstanding.

• Table columns, row actions, pickers and repeated controls now expose the whole row source's validation contract and source navigation in Properties. Pickers distinguish their selected-value contract from their rows. Checked edits follow admitted aliases or View locals and share Code Undo; computed/native sources without a direct owner retain an explanation and navigation to Code. This does not add individual row or field validation.

• Inline table editing now follows plain aliases to their owning input/default or native table, including qualified cell addresses. Edits retain the model's atomic rule path. A local with the same name cannot accidentally redirect a model row edit. Editable fields retain headings, formats, widths and alignment through Code and Properties. Native numeric formats preserve precision and display units. Failed saves keep drafts for retry; changed row values require explicit reapplication, and sorting keeps drafts with their keyed row.

• Preview scalar and table-column patterns with Grid’s native formatter, including percentages, decimal places, negative sections and dates. Scalar displays honor host-resolved format policies, explicit control choices and View-local patterns. Sorting and editing retain original values. Numeric inputs honor host/declared patterns, show an unrounded editing value, and preserve values on untouched blur. Native plans supply decimal precision, locale and display-unit scaling; active drafts keep their units through format changes. Native entry plans also support fractions and decorated numeric paste across sections. Tables inherit model FORMAT policies from retained field tags, including reactive patterns and explicit column overrides. Policy changes preserve active editing units, and exact numeric strings retain their digits. Native-table semantic schema and declared local field tags supply the same policies; mixed/computed local field hints remain incomplete. Failed formatting offers retry; print and capture wait for the displayed formats or explain what needs attention.

• Declare interactive Views with inferred controls, pages, local state, and model-owned actions. Arrange named regions and choose controls with PRESENT.

• Reuse local or imported elements, including explicitly installed and pinned React libraries. Unsupported native contracts produce coverage reports.

• Export through the shared renderer, select a styling kit, or capture the current page as static HTML.

• Export reusable ELEMENTs from Code as .gridui App components. Choose concrete parameter types, prepare and review, then import into another App and bind its parameters. Named content slots and their defaults survive the round trip; Code offers checked add/update/remove controls and slot-name completion. Unsupported state or captured model bindings receive an explanation; source changes cancel pending exports and discard prepared downloads.

• Run declared CHECKs in private native model copies. Migrate an existing App to candidate View source with listed translation and comparison differences.

• Wrap or lift availability groups containing declarations through checked source review with Apply/Cancel. Condition-only changes stay direct; invalid references and duplicate names are refused.

• Review moves across repeater, page or declaration scopes before applying their exact source changes. Cancel keeps the draft; Apply shares Code Undo and refuses a changed draft or editor. Invalid references still prevent the move.

• Edit supported element properties from the source outline or preview selection. Each change preserves surrounding source and becomes one editor undo step.

• Edit shared options on custom automatic controls, or pin a caller-visible component to open its arguments and native properties. Labels, bindings, conditions and model access remain intact; library-private components explain their editing boundary. Closed composite calls accept shared layout phrases.

• Follow plain aliases and component arguments to input validation. Select a component's local contract and edit its shared definition with source navigation and Undo; individual instances keep separate state. Nested and transitive helper locals, including consumed caller content and native slots, expose their exact declarations. Unused helpers stay out of the selector; imported locals remain in their library source.

• Edit automatic table and map options without losing data bindings, columns, filters or paging. Table columns named like settings remain columns. Generated record forms expose shared options while keeping their fields and Save action; their schema stays with the owning input or local declaration.

• Select nested record fields and edit their source defaults with Code Undo. Plain aliases point to the input; component defaults remain shared definitions. Add, rename and remove fields or nested records in Properties, preserving surrounding comments and other defaults with one Undo step. Renaming changes stored keys; references elsewhere retain their spelling. Sensitive defaults stay in Code. Whole-record validation remains distinct from field rules.

• Edit table and picker columns from Properties: values, headings, presentation, ordering and keyed inline editing. Keep attached comments, row actions, filters and paging through checked source transactions. The panel explains implicit all-field display and the remaining field-validation editing boundary.

• Create row buttons and edit their captions, inline actions and requirements. Move or remove the full action, including nested steps and refusal handlers. Existing action keys remain intact; new buttons can have a stable key.

• Edit availability conditions and explanations together. Ordinary and direct native arrows have Action requirements controls, separate from component availability and with the selected native event's values listed. Add another requirement or remove one while keeping nested actions and refusal handlers. Named native and embedded handlers also have separate requirements sections, preserving each event's scope, neighboring handlers and slots. Each checked change shares Code's Undo history.

• Wrap controls or containers in an availability group. Edit its condition and explanation or page/View redirect together. Remove the wrapper while retaining contents, comments, multiline payloads and separate visibility. Inline regions expand in the same Undo step; declaration scope changes stay in Code.

• Edit reusable Grid elements’ arguments and shared options together, including availability. Bare calls gain parentheses when needed; caller content, imported definitions and remaining properties retain their meaning in one Undo step.

• Reorder, remove and copy pages with flat or nested content. Shared declarations between page headers remain once in source, with comments and payloads intact.

• Edit inline region contents in the inspector. Structural and native event/slot changes expand only the affected region, preserving conditions, comments and multiline payloads in one Undo step.

• Resize the View preview without losing form drafts. Navigate pages within the preview, with an explicit live mode for controls and route parameters that can change the model.

• Inspect draft elements in a private preview without discarding its state. Inspect copy pauses controls and opens source and Properties; resuming uses the same copy, including for Views that have never been saved.

• Assign a stable key to an existing table row action from Properties. Caption changes then retain its identity; nested requirements and refusal handlers stay intact, and the source change shares Code Undo.

• Preview new, unsaved Views in a private copy before their first Save, including Views converted from Apps. Live interaction becomes available after Save and requires an explicit mode selection.

• Stage input and local-state batches, restore defaults, advance native rule time manually and try supported actions in a private model copy. Reset discards the experiment; unsupported hosts and external actions report their limits. Computed button cells use guarded native touches in copies and CHECK runs, and named button targets now work in the live workbench.

• See host tool support, trust restrictions, required capabilities and unresolved dependencies beside the View. Inspect exact library locks, open Dependencies or Connections, refresh analysis and retry the preview without editing source. Failed checks and private-copy preparation offer source navigation and explicit recovery controls outside the disabled preview. Host authentication/access refusals retain their structured status. New runs and changed source/model environments discard older results; switching model, partition or environment returns the preview to Inspect.

• Diagnose observed script, library-loading and component failures beside the preview, with declaring-line navigation and bounded argument descriptions. Private drafts have their own source markers. Reports cannot mix between models, editors or preview copies; reset/reload rejects late errors from closed attempts. Sensitive locals redact messages and arguments. Rendering an error notice does not repeatedly retry the failing component.

• Check local bindings in declaration order and distinguish them from model names.

• See located errors for malformed binding lists and non-name binding targets.

• Keep unrelated missing-name diagnostics alongside named-function argument-count and type errors, including under strictness directives.

• Prefer the innermost supported scope when completing local names.

• Stop bounded iterations at the first satisfying state, including the initial state, and distinguish convergence from exhausting the bound.

• Pass pure callable helpers into named functions and lambdas, and invoke locally bound lambdas in LET and DO expressions.

• Choose Images for AI in Camera and video. Your current workbook stays open; attach the latest frame from Chat → Add source → Connected sources.

• Slow delivery keeps only the newest pending frame. Failures stop capture with a visible error; completed recordings do not restart automatically.

• Source identity, image hashes and arrival times stay with each attachment. Unknown capture times are not inferred, so this output supports snapshots.

• Choose Images and documents in local model setup to find a compatible image model. Details and installed models show whether their package accepts text or images. Chat’s image attachments link directly to this setup.

Independent reporting workflows

Use INDEPENDENTLY EACH to run a reporting process with fresh conversations for each assignment and pass the ordered reports to an editor. Desktop exposes the same authoring, model selection, Start and result inspection controls. The compiler rejects outer conversation sharing, carries, borrowed rooms and transitive external operations in these groups. Current scheduling is serial, with a 32-item ceiling; population generation and partial joins remain future work.

Improvements

System (formerly Monitoring) and Network now sit behind Advanced, beneath Code in the layer picker and in the global menu, keeping everyday workspaces more prominent. The Grid mark opens Home; Help sits at the far right with the appearance control and Advanced menu. An open model has its own return button, and the Data ribbon keeps its labeled commands.

• Repeated price edits in large lookup-driven ledgers reuse calculations for identical formulas while preserving exact changed-cell counts and samples. They also avoid rebuilding identical change notifications after checking the new values. The initial edit prepares this sharing; unsupported edits use the existing evaluator.

Process conversations now show completed replies while later turns are running. Follow a debate from the Processes panel, browse earlier turns, and cancel while keeping accepted replies visible. Late replies are marked unaccepted. This is turn-by-turn progress, not token streaming.

Completion prefers the innermost supported scope, including local bindings.

The image producer retains one newest pending frame when delivery is slow. Source errors stop capture and appear beside the connector controls. Connected sources shows stopped captures clearly, preserves your draft when a read is cancelled, and offers an Open Connectors shortcut for first-time setup. Choosing a model keeps your question and attachments. Open Grid Agent returns to Chat from any workbook layer.

Bug Fixes

• Legacy imports of the shipped politics, social-science and governance .grid modules work alongside their canonical .gs paths.
• App-to-View migration now chooses property aliases and writes metadata consistently across builds, including the default Badge style.
• Agent tool receipts now keep the same hash across builds when JSON object keys arrive in a different order.
• Choosing a worksheet after an Excel import now keeps that choice when later workbook updates arrive.
• Code analysis handles deeply nested expressions without overflowing its thread stack while checking callable types.
• Predicate facts can use room as a subject without being mistaken for a shared-room declaration.
• Repeated Views and App controls now keep labels, validation messages, tabs and page headings attached to their own instance. Control associations remain stable through value updates and keyed row reordering. Named-function semantic errors no longer suppress independent missing-name checks. Interval rules using SKIP MISSED now tolerate a tick just after the current deadline, preserving the schedule's phase while continuing to skip missed intervals. Previously, ordinary clock jitter could prevent these rules from firing.

Source fields are read-only when starting an existing workbook's declared connector, so editable controls no longer suggest that ignored changes apply.

Compatibility and Migrations

Code checks use the current draft without applying it. No migration is required. Plain ITERATE keeps its mandatory integer bound of at most one million steps. The new exit predicate is pure, and Tensor-resident iteration rejects UNTIL with a named diagnostic. Callable parameters require statically inferred function types; any cannot be invoked as a callable. Callables cannot be stored in cells, state, collections, or choice fields. Named recursion remains outside this change.

Requires Grid 0.66.8 Desktop Pro and the installed FFmpeg decoder. Asking about an image requires a vision-capable model. This adds neither audio/native video understanding nor recording storage, and does not publish additional model packages. Camera permissions and platform-specific device support still apply.

Known Issues

Syntax failures, external bindings, and unsupported scopes retain conservative limits. This change does not add general builtin argument validation, broader rename, or predictive AI suggestions.

Focused callable, bounded-iteration and scheduler regressions passed. Their scope and local cost measurements cover selected development scenarios; complete platform validation remains outstanding. Autonomous timer rules require the default in-process host residency; deployment solely into the optional process calculation pool does not activate timer rules.

These connector images do not carry original capture timestamps, so they cannot use timestamp-checked live observation or historical date queries. Physical camera permissions and packaged Windows/Linux behavior remain to be exercised.

Grid Views implementation is in progress. Its remaining features and validation remain unfinished.

TEAM and PROCESS declarations now compile into an inert, validated process artifact inside the compiled model. Desktop now selects the sequential runtime: save a team and process, choose its models in Agent → Tasks → Processes, and press Start process. Ordered, attributed replies and the final result are inspectable in the panel. The guided debate uses two speakers and a chair in one shared room. Other product packages do not enable the capability by default. Ordinary formulas, unaddressed ASK and the existing agent task API keep their current behavior. Internal compiler replay can reproduce the artifact from captured source and imports without consulting changed live libraries; this does not enable Start or provide durable process recovery. Libraries can be imported under multiple aliases while retaining separate team, process and captured-value namespaces in the internal artifact. Internal local turns now use bounded model I/O, share the existing agent model slot for each turn and preserve prepared conversation bytes. Queued cancellation and deadlines release their resources without stopping unrelated I/O. Internal HTTP Start now verifies installed signed local models outside the host lock, with frozen inputs, bounded I/O and one unchanged admission/execution deadline. Refused admission releases its resources; accepted retries keep their original run identity. This remains an internal verification capability. The internal operation runtime now records an attempt before invoking an adapter, retains uncertain outcomes across recovery, and keeps results until the process acknowledges them. Compiler resolvers can now provide exact installed ops: type packages: aliases share package-qualified identities, source-created types work through child workflows, and owner-only types can be matched without allowing source construction. Source replay freezes the imported metadata. Internal operation metadata now pins the adapter, owner, policies and execution limits under a distinct callable route. The owner rejects changed bindings and expanded limits before dispatch. Installed sequential operation exports now compile as typed PROCESS steps, including unbound calls and calls inside imported processes. Their descriptors survive saved-source replay and compiled-model save/load. A selected internal volatile environment now executes these calls through the operation owner, retaining typed results and acknowledging receipts only after process acceptance. Pending work suspends without polling or repeating dispatch; accepted results can feed agent context and ordinary calculations. The internal process service now starts these mixed workflows, binds authority for the caller and model, exposes pending work, and queues explicit settlement on its existing executor. Duplicate or stale settlement requests cannot spend another lookup or act on a later step. Cancellation preserves late results without accepting them. Combined durable recovery, product catalogue installation and API/browser adapters remain unfinished. Ordinary Start refuses operation calls without the selected environment. The alternating debate and draft/review/revise language examples now execute in that internal harness. They exercise reciprocal replies, chair guidance, fresh reviews, explicit child context and honest stopping results. Published named inputs retain proven source types without evaluating their values at Start, and ordinary Grid arrays keep their existing shape when crossing that boundary. Code also highlights the coordination vocabulary and offers scoped process completion, distinguishing data, participants, child targets and teams. Suggestions preserve statement order, loop scope and independent-group visibility. This does not enable product Start or process rename. The shared host log now supports bounded streaming recovery for the forthcoming durable process owner, preserving existing recovery-log compatibility. Durable process execution remains under implementation. Internal process and conversation updates now validate together before either advances, preventing a stale or mismatched context from partially accepting a turn or disclosure. This does not enable durable recovery or product Start. Internal execution now retains explicit loop, child and turn continuations, preparing for durable recovery while preserving existing language behavior. Internal checkpoint groundwork now preserves core values with bounded decoding; complete durable process recovery remains unfinished. Ordinary SUM also retains its numeric result contract in shared function inference and internal process kernels.

Internal process hosts can retain Start identities and results across restart. An explicitly selected recovery mode now resumes safe core workflows from their accepted turns, preserving provider history, shared context, captured inputs and the original deadline without repeating accepted inference. Uncertain calls remain unresolved, and cancellation survives restart. Returned answers also survive interruption before acceptance: resume validates the saved answer without calling the model again. Wider effect recovery and product Start remain unfinished.

Documentation Updated

• Grid Views: source authoring, layouts, exports, and explicit CHECK tooling.
• Native libraries: installed-package derivation and exact runtime pins.
• Interface layers: local scope diagnostics, semantic error coverage, and completion limits.
• Core concepts: the total expression core, bounded work, reactive shell, and tracked effects.
• Collections: early exits, completion reports, and the unchanged step ceiling.
• Named functions: callable parameters, local helpers, and compile-time safety constraints.
• Rules and schedules: timer residency and the distinction from Live Model table status.

The image input guide, AI setup guide and walkthrough, and canonical Camera images for AI example describe the new flows. Shared release history records the publication of 0.66.8 and earlier releases, while preserving unreleased milestones as historical entries.

Internal process development now supports typed human review steps. A human question pauses the process without holding an execution worker; an authorized reply continues the same process, and invalid input leaves the question open. Retries, cancellation and the original deadline are handled explicitly. This supports volatile runs and selected local recovery: questions survive restart, accepted replies are not requested twice, and duplicate submissions retain their original receipts. Explicit resume and the original deadline still apply. The selected internal app now provides a Processes panel for starting, inspecting, resuming and cancelling compiled workflows, discovering assigned questions after reload, and submitting typed human replies. Provider credentials stay on the server. Desktop selects the sequential runtime; media display remains unfinished.

Internal coordination development now has a shared type foundation for generic operation results: schemas preserve family identity and payload types, and can restrict construction to an owning service. Compiler inference retains those identities and payload relationships through function signatures and type lowering. Generic CHOICE declarations now retain checked type parameters and recursive schema metadata through compiled artifact save/load. Inferred constructors and constructor-pattern MATCH now execute through the shared evaluator, including values passed through functions, immutable named/cell bindings and recursive fields. Explicit family applications such as Maybe<number>.None() now work in values and patterns, retain their static contracts through save/load, and format as authored language. Internal process storage can now preserve nested source-created CHOICE values with exact schema identities and bounded decoding. Typed storage entrypoints also enforce the retained payload contract, including recursive generic fields. Source-created values now pass through typed workflow inputs, child processes and results, with readable inspection and restored arguments on recovery. Owner-issued operation results remain unfinished; this does not complete the AI coordination extension.

Internal coordination development now includes a shared-room owner for ordered conversation, history boundaries and material withdrawal. Public turn and process state changes can commit together, and uncertain calls retain their ownership. Fresh sequential room plans now run through Desktop's Processes panel.

Internal process development now executes PRIVATELY blocks through the existing native runner, including continuing histories, typed human suspension and recovery. Block-local names stay local and returned summaries have their own material identity. Room declarations and IN destinations now retain their source meaning through parsing, imports and formatting. Sequential public turns see prior accepted speakers; public sharing and withdrawal affect subsequent packets. Child processes explicitly borrow room members by role key. Accepted-turn receipt replay rebuilds the public transcript without repeating inference. Existing room handles, live inspection during model execution and independently durable room hosting remain unfinished. The internal runner now executes READ(room) to capture public room metadata, including messages, withdrawals and turn outcomes. Grid collection expressions can query the result. Reads perform no inference and reject oversized snapshots without truncating them; private histories and message bodies are excluded.

The selected internal Processes panel now displays room participants, message references, withdrawals and turn outcomes. Waiting, completed and failed runs can expose room metadata without an authored read. Final metadata survives record recovery; unavailable or oversized inspections carry explicit reasons. The panel also displays retained, ordered replies for the Desktop sequential subset. This does not complete API-operation adapters or the wider coordination language.

Combine an API read with an agent

Desktop processes can import an installed API package through ops:, call a single GET/HEAD query, share its checked result with an agent and return the combined data. The walkthrough includes the source and example OpenAPI definition. The adapter uses existing network policy and model credentials, with one bounded attempt and no implicit retries. Commands, pagination and recovery across host restart remain outside this slice.

Review a collection with a process

Use EACH chapter IN chapters for ordered agent reviews, or add WITH summary = "" for a running summary. Sequential turns keep conversation history; empty collections make no calls. The guide includes a runnable Desktop example and the current 32-item limit. Generated populations remain planned; independent fresh-child reporting is covered in the newsroom guide.

Preserve built-in calls in existing helpers

Data parameters such as value and index no longer hide VALUE(...) and INDEX(...). Local helpers already inferred as functions still take precedence. Ambiguous built-in-name parameters retain the built-in interpretation; use a distinct callback name when passing a function. Calls through named helpers or captured local functions retain their effects during callback checks. See named functions.

Grid 0.66.7 — Not released (superseded)

Summary

Grid 0.66.7 was not released. On September 25, 2026, the planned release was superseded by 0.66.8. This record preserves the development work; it does not claim published installers, an updater release, or completed full validation. Its user-facing changes carry forward for review in 0.66.8.

Code, Data, App, and Chat offer four ways to work with the same model. This development version builds on 0.66.6, including its shared desktop runtime, independent workbench windows, and source-conflict protections.

What's New

• App and Chat share the same unfinished question, including line breaks. Moving into Chat carries the current view and selected value, with a direct return. Documents combine writing and view commands in one set of tools. Same-model links show readable destination labels, and Back leaves a presentation's first slide for the preceding view at its retained reading position.

• App layouts start with a clear empty canvas and offer Add value, Add note, keyboard arrangement, collision-aware dragging, and Undo. Live values keep model formatting, narrow reading views stack cleanly, and Done waits for saves.

• App presentations fit the whole slide, offer a clear slide outline and Back/Forward history, and group editing and exports in View actions. Live presenter assumptions share formatted, acknowledged controls. Done waits for saved slide edits, including an immediate Undo.

• Read structured answers in App and Chat, with headings, lists, tables, and code. Compact assistance retains the preceding exchange while you ask a follow-up. Preview an excerpt's formatting before keeping it in a report; opening the destination now accepts its saved revision before insertion. Document slash commands accept full titles such as /heading 2.

• Enter percentages naturally in App and notebook controls: 6 means 6%, while the model retains 0.06. Formatted inputs preserve incomplete edits, failures, and existing unit tags; read-only model values are identified explicitly. Live document and notebook references retain model display formatting. Charts and Visuals open with one heading and their editing tools in View actions.

• Add images, a camera/window capture, video frames, selected image inputs, or earlier conversation attachments through one Add source picker. Reused observations retain their source and original timestamps. Narrow layouts keep the picker controls reachable while you browse.

• Use the same saved AI connection for Chat, Agent, and new workbook AI requests. Choose OpenAI, Claude, Vercel AI Gateway, your model server, or an installed local model. The runtime restores that choice after restarting; formulas with explicit model releases keep their own selections.

• Connect an existing model server from AI setup: enter its API address, discover models, and save your choice with an optional key. Grid remembers the connection for Chat and Agent, and keeps server credentials separate from hosted providers.

• Manage agent tasks from Chat with saved profiles, provider choices per task, shared call limits, cancellation and a draft–review–revise team. Review source proposals before applying them. Use AI setup shares the saved provider, installed model or model-server connection without another configuration. Attach images to a task or share them explicitly across its review team. Supported Unix hosts can retain images in recovery records; uncertain remote attempts are never retried automatically. This implementation still needs packaged/live-provider QA before a release claim.

• Deck adds structured model-connected presentations across App, Code, Data, and Chat. Use live scenario controls or a frozen presentation capture, share a render-only audience window, and export editable PowerPoint or print slides. Notes are private by default. See Deck presentations.

• Prepare Registry publications from Code for Libraries, Templates, Solutions, and pretrained Models. Select an artifact and existing signing key explicitly, run the CLI's local validation/signing dry-run, and inspect its exact receipt. Preparation runs as a native job with output, Stop, and session recovery while navigating Code. Signed publication bytes are retained locally; reopen and verify them after restarting, independently of later source edits or the signing key. Review a Registry destination and explicitly selected publisher credential to submit those exact bytes. Stop local work, refresh remote status, and recover saved submission state after restart without silently retrying. Enroll a publisher from an existing signing key, recover a lost enrollment response, and select its approved credential for publication. Browse all four artifact kinds in the configured Registry, inspect catalog metadata, copy exact coordinates and open their Registry pages. Reviewed Libraries and pretrained Models open directly in installation review with the exact version and Registry preserved. Templates and Solutions now offer source installation into a new folder, with native job output, Stop and recovery of the latest saved installation. Inspect installed source files and a Solution’s declared models and dependencies without evaluating or activating them.

• Create extension projects in Code using any of the ten CLI language profiles, choose a new folder, follow creation output and open the generated source. Creation supports Stop and recovery within the current app session; compiled languages require their documented toolchains. Open existing local extension source projects too. Edit source, manifests, and fixtures, retain drafts and Undo history across files and project tabs, save with external-change detection, and run the existing CLI validation and runtime-fit inspection directly from Projects. Review the project's development configuration to build and test once or watch declared files, inspect live output, and stop the development session. Add an inspected project’s exact import to the model and navigate between the import and its open source projects. Copied package imports use readable, collision-safe aliases. Prepare a preserved development workspace and activate it through Package Center; source changes never refresh active bytes implicitly. Include an existing workspace's packages, review which versions will be kept or replaced, and preserve a separate combined workspace with the same policy and advisory bindings for activation review. Saving source does not install, activate, or publish a package. On macOS, native Undo/Redo now follows the focused Code editor's retained history after file and project switches, while other text controls keep native editing behavior.

• Write longer Documents with named styles, paragraph formatting, Find/Replace, heading navigation, word counts, zoom, and image sizing. Set paper, margins, headers, footers, and page numbers, then export Word or PDF or inspect the exact PDF preview. Live values are frozen at capture time; unresolved values prevent export. Word round trips retain supported styles, paragraph spacing, numbering, image sizes, unequal table widths, merged cells, repeating headers, and page setup. Desktop exports use a native Save dialog. Located conversion notes identify simplifications; the editor remains a continuous writing view.

• Review Documents with text-anchored comments, replies, resolved threads, and tracked text edits. Accept or reject individual suggestions or all changes with Undo. Supported comments and text revisions survive Word exchange; PDF publishes proposed text without changing the editable review history. Formatting and structural revisions are not tracked.

• Import Word .docx files into editable Documents. Add headings, formatted text, lists, tables, links, and supported embedded images alongside existing content, with cancellation, conversion notes, autosave, and one-step Undo. Word page layout may differ; older .doc files must be saved as .docx first.

• Attach, paste, or drop PNG/JPEG images into Chat using the selected AI provider or a compatible local model. Workbook and connector requests share source metadata, content hashes, historical windows, and live freshness deadlines. Capture the visible Grid webview on macOS, use browser window/camera previews where supported, or choose a time range in a local video to gather two to eight frames with visible clip positions. Sampling stays on the device until Send. Preview sources stop when closed or when you leave the conversation. Choose Start observation to follow a camera, shared window or selected live image input with a question and bounded call budget. Stop explicitly, inspect timestamped answers, and revisit them in Tasks. Vision model packages require publication; native audio/video inference is not included. See the image input guide.

• Choose a personal starting layer while keeping the same model and calculations.

• Customize App navigation directly in App or Code: labels, groups, drag ordering, visibility, opening view, canvas width, and an unsaved preview. Create an Overview, Brief, or Exploration using the existing surface editors and selected bindings. Follow same-model view links, navigate Back/Forward, and find accepted model values. Keep a Chat answer as editable document or notebook content with chosen live references. Inspect live values and expand contextual assistance into the same Chat conversation. Custom apps can identify a selected model value for Grid's Context panel; returning from Chat restores the app's route and selection.

• Resume device-local Chat conversations and unfinished drafts. Recover from competing saves, export a conversation, and retry interrupted requests with the current model. Recent dialogue gives follow-up questions context.

• Author JSX surfaces beside a protected draft preview; follow preview diagnostics and supported elements back to their source.

• Catch undefined model names and misspelled literal JSX bindings while editing in Code, with source underlines, clickable problems, and spelling suggestions. Draft checks discard stale results and explain when scope information is limited. Preview and apply unambiguous spelling corrections with Quick Fix, then undo them as one edit. Contextual completion includes unsaved model declarations, namespace names, and function parameters at supported compiler-recognized reads.

• Keep working files and navigation history across Code areas, with shared editor content and independent split-editor views.

• Inspect values directly from Grid model definitions, follow available provenance back to source, and load missing values explicitly. Surface bindings retain scalar and bounded range inspection. Follow calculation dependencies within the inspector and return through a trail of values with checked provenance.

• Return to model and surface source locations with Back and Forward, including definition, search, Go to Line, and preview-to-JSX jumps. History restores the correct split editor and can reopen a closed second pane at its retained line.

• Follow recorded calculations through named formulas and sheet-qualified scalar cells when the runtime supplies exact mappings, with breakpoints and source links.

• Browse model connector declarations and the runtime catalog in Connections, inspect configuration requirements, and request health checks explicitly.

• Inspect model imports and desktop workspace packages in Dependencies, follow declarations to source, and review package exports and runtime requirements.

• Edit document blocks with menus, keyboard actions, drag handles, and Undo.

• Recover document drafts after interrupted or conflicting saves, with native storage for desktop recovery and appearance/starting-layer preferences.

Improvements

• App Context distinguishes changes saved to the live model from an older model archive, while keeping unapplied source changes and save failures visible.

• Code imports link directly to their installed packages, with keyboard focus and explicit slot choices when a package is installed more than once.

• Code preview recovery preserves local form state and keeps one inert image through consecutive source errors. Small preview updates no longer clone the entire rendered surface.

• Chat stores images separately from conversation text, so full-size attachments can be retained with unfinished drafts. Repeated images share storage, and editing text does not resend already saved image bytes.

• View whole model keeps your current source position, with Back returning to the scoped editor and Forward restoring the whole-model position.

• Code source navigation avoids repeated full-model scans when mapping outline entries, cursor positions, and diagnostics in larger models.

• Dependencies preserves catalog errors when the native folder picker is cancelled, and re-selecting the same workspace retries the catalog read.

• Code syntax palettes improve faint comments, strings, line numbers, and bracket pairs across themes while preserving Data’s existing editor appearance.

• Shared appearance and desktop controls across all four layers.

• Source links connect model views and authoring without changing calculations.

Bug Fixes

• Calendar model calculations reuse dependency analysis already available in the running model, reducing repeated work when opening large calendars.

• Undo and Redo refresh named formula results, so copying a restored formula's value does not retain the number from its previous definition.

• Grid context menus stay open when a separate source editor scrolls.

• Show in Data reliably selects the value opened from App, including unqualified references after visiting another worksheet. Returning to App retains the originating view and selected-value context.

• Package actions lock immediately while starting, poll status without overlapping requests, and preserve cancellation feedback when older responses arrive.

• Package Center retires stale workspace catalogs and responses, keeps acquisition disabled during catalog failure, and provides a direct catalog retry.

• Fixed missing runtime-error source links in Code previews on macOS, including click-handler and asynchronous errors; repairing the source restores the preview.

• API operation tests clear obsolete results when inputs change and prevent pending responses from appearing under a different model or operation.

• Document link and image dialogs reject outdated edits when the document changes while they are open. Cancel returns to the latest document.

• Narrow Code editors keep Problems and investigation controls visible, including narrow split panes. Status text has stronger contrast in the shared themes.

• Returning from connector or import source links no longer adds an extra Back stop. Connections and Dependencies retain selections and filters within the current model session while refreshing catalog data and discarding old checks.

• Code reference headings show the authored filename without internal session keys, while split editors retain their shared text and Undo history.

• Rapid source edits keep their scoped file and latest text while the editor waits for the host to acknowledge the changes.

• Applying a Chat proposal before opening Data no longer reports a false calculation failure because a spreadsheet viewport is absent. App and Chat keep real update failures visible with recovery actions.

• Applied proposals retain their completed state without a contradictory stale warning. Source review identifies the proposal's original baseline.

• App assistance no longer covers Context actions in narrow windows.

• Notebook drafts can retry failed saves without bypassing protection against conflicting edits.

• Appearance menus support keyboard navigation and return focus reliably when dismissed, including in narrow windows.

• Document block dragging uses captured pointer gestures with cancellation and Undo.

• Document value pickers dismiss when you move focus away, without pulling focus back from the next control.

• Desktop recovery survives changes to the app's local address after restart.

• Fresh desktop profiles initialize their local authority file before startup.

• Help now includes the AI setup, image-input, Code, Deck, and multiple-window guides, with reachable language-reference links and clearer end-user instructions.

Apple GPU inference now preserves F16 activation rounding during generation. It also retains precision through BF16 normalization and activation, and resolves equal-score token choices consistently. Tested SmolLM2 F16 and BF16 cached scores meet their original comparison limits; repeated requests agree.

Compatibility and Migrations

Data retains its existing layout. Documents and notebooks retain their surface identities. Existing model links remain supported; the layers do not create copies of the model or change formula results.

Known Issues

• Low-precision score ties can choose a different word from a full-precision reference even when numerical comparisons pass. CUDA and packaged-model validation remain unrun for these corrections.

This is an archived, unreleased development milestone. Full validation was not completed before the release was superseded. Subsequent integrated source requires its own validation. Local recovery is not cross-device backup; Chat requires a configured provider. Code's navigation and preview tools do not claim a complete debugger or support every possible JSX source mapping.

Documentation Updated

See the interface layers guide for supported behavior and current limitations.

App refinement

App now offers clearer surface actions, editable Next steps, and contextual commands for selected native objects. Numeric and text assumptions keep unfinished input intact and show save progress or failure. Action buttons wait for accepted writes before navigating. Notebook blocks gain drag ordering, keyboard movement, Undo/Redo, and focus restoration. App Builder, Layout, and Notebook preserve pending and failed edits when navigating. The forecasting example now continues from assumptions and a report into a native Deck presentation.

App’s forecasting example now connects a readable outlook, all three assumptions, a report with live references and explicit modeling limits, and a decision-focused presentation. App keeps arrangement in View actions, brings question context into the composer, and gives new starters clearer continuation links. Deck opens for browsing and presentation; Edit slides reveals its authoring controls.

App reading and presentation polish

Documents in App combine writing controls into one strip and move occasional tools into the Document menu. Live values read naturally inside prose while remaining inspectable and editable. Deck keeps Present prominent and groups capture and export controls in Presentation options. Shared menus retain theme, keyboard, and narrow-window behavior. Data's operational layout is unchanged. The forecasting example now includes a finished illustrative planning brief, reasoning, and presentation, with currency and percentage display formats.

Author complete Grid projects in Code

Code opens Library, Template, Solution, and pretrained Model source folders with their correct manifest. Grid .grid and .gs files share Grid syntax highlighting. Move from an opened project to Registry publication review and back without selecting the folder again; saved source context and editor history are retained. Save drafts and finish active project work before preparing publication. Create Libraries or Solutions from the source workspace. New Solutions include a Grid module, model template, and smoke tests. Synchronize saved artifact hashes and run Solution tests separately, with compiled/executed counts and output in Code. Create Templates with a Grid model and catalog metadata, check their declared files, and synchronize saved hashes before publication review.

Project JSX and TSX files can now preview against a model surface with live values, source inspection, and error recovery. Saving a file and applying a model interface remain separate; an explicit Surface studio handoff protects existing drafts.

Projects, Dependencies, and Registry now have separate destinations in Code, with working tabs and Back/Forward history. Source-to-publication and dependency-to-Registry handoffs retain their context and project drafts.

Dependency reviews now carry the exact requested import into Package Center and provide a direct return to Code. After package or runtime settings are reviewed, Code marks the previous resolver report stale and offers a fresh dependency check.

On macOS, Code preserves Control+Shift+M for moving keyboard focus out of the model editor. Command+Shift+M continues to open Problems.

Grid 0.66.6 — Not released (superseded)

Summary

Grid 0.66.6 was an unreleased development milestone. Its AI setup and multiple-window improvements carried forward through 0.66.7 into the 0.66.8 release. The notes below preserve that development history.

A shared AI & extensions window makes provider setup, local-model installation, extension discovery, and registry selection easier to find and use. Multiple workbench windows share one runtime while keeping separate drafts.

What's New

• File → New window opens another workbench on the same Desktop runtime.
• Desktop and Server startup reject conflicting storage or runtime identities; intentional job workers retain shared-queue operation with distinct identities.
• Browser tabs keep independent drafts and restoration state. Main-editor saves check the source version before replacing a model changed by another session. Reloaded drafts are preserved for review without automatically replacing another session's saved source.
• AI & extensions is available from the File menu, command palette, and Agent.
• Local-model search learns family shortcuts from your selected registry, with verified model details, memory/storage guidance, measured download progress, pause/resume, model trials, and storage management.
• Installed local models can power Grid Agent and be inserted into workbooks through the same existing AI capability.
• Compatible signed model variants can use Apple GPUs through Metal. Setup shows the device selected for each model and retains CPU compatibility.
• Local model releases can include verified companion and tokenizer files in one resumable installation, with the complete download size shown up front.
• Detailed releases check architecture, quantization, engine version and conversation-memory needs before downloading, including working space and headroom.
• Restricted model downloads explain publisher access and terms. New models for supported architectures can arrive through registry updates.
• Provider connection checks discover available models without generating text.
• Signed extensions can be discovered and installed into a chosen workspace.
• Registry settings persist and are checked against an independently supplied verification code before use.

Improvements

Storage ownership checks stay outside formula evaluation. Independent documents can complete their storage checks concurrently.

The selected extension folder carries into Package Center for activation. Registry setup links fill in verified connection settings. Provider keys stay masked, with available models and custom overrides in an optional disclosure. The setup screens adapt to narrow windows and the active Grid theme.

Bug Fixes

Desktop provisions private encrypted API-key storage on first use. Keyboard navigation skips controls hidden in collapsed disclosures. Registry switching keeps independent verification history for each identity.

TensorFlow Lite models retain fractional floating-point averages. Unsupported pre-folded average operations are rejected instead of returning rounded values.

Model publishers have explicit export recipes for numeric LightGBM and CatBoost classifiers and MiniLM embeddings. Classifier exports preserve probability column order and derive labels consistently, including negative class IDs. Compatibility remains specific to the model, export settings, and device.

Apple GPU inference avoids premature rounding in normalization and BF16 attention. The tested SmolLM2 and Qwen3 models now meet their original numerical tolerances; the previously passing model and precision combinations remain valid.

Compatibility and Migrations

Existing AI functions, provider APIs, model installation receipts, and package activation remain authoritative. No additional model evaluator is introduced. Existing explicit API-key storage settings continue to take precedence. Independent runtimes now need distinct node identities and non-overlapping writable folders. API-owned key and trust files must sit outside runtime-owned trees. Standalone APIs with writable configuration require the matching storage ownership companion. Status checks connect to the running instance without starting another runtime.

Known Issues

At this milestone, the multi-window changes had not been published in an installer. They are included in Grid 0.66.8; the validation limits below describe the original 0.66.6 development work. Close older Grid versions before sharing a data directory with this version; older processes do not honor the new ownership protocol. Save work before closing a session, and close other workbench windows before installing updates. Packaged multi-window UI QA on macOS, Windows and Linux remains unrun; native Windows module compilation does not establish live Windows behavior.

Local models require the Pro AI runtime; model and extension availability depends on the chosen registry. Windows public-registry storage is implemented and cross-compiled; Windows execution and packaged installation QA remain unrun. GPU use also requires a registry release that declares a compatible GPU variant; existing CPU releases stay CPU. Apple Neural Engine execution is not implemented. Hardware selection reflects supported runtime capabilities, not a speed benchmark. Connection checks establish authentication and model discovery, not generation quality or paid model access. The default catalog currently includes Qwen and Phi. The updated engine runs the prepared Gemma profile on CPU and Apple GPU, but its complete model release still needs curator review, signing, and publication. Gemma releases with companion files require updated registry readers and the new desktop with its matching installer. Signed extensions still require permission review and activation in Package Center.

Documentation Updated

The AI and extensions guide and setup walkthrough describe the complete flow. The multiple-windows guide covers Desktop ownership and browser sessions on Server. Cloud and Dev editorial review and publication remain outstanding.

Grid 0.66.5 — 2026-09-18

Summary

Grid 0.66.5 makes scientific and analytical work easier to inspect and preserve. Numerical reports explain methods, assumptions and unsuccessful calculations; guided research starters connect editable inputs, plots and saved scenarios. The patch also strengthens source editing, input recovery and portable archives so a delayed response or failed calculation does not silently replace your work.

What's New

• Readable numerical reports. Inspect fit coefficients, residuals, rank, conditioning and stopping reasons. Explicit options add weights, parameter bounds, fixed values, local intervals or seeded bootstrap intervals, with limitations and failed refits disclosed. ODE records show the selected method, controls, work and final state. Derivative reports distinguish automatic differentiation from numerical differences.
• Calendar-aware economic series. Paste and review dated observations, inspect gaps and incomplete periods, and save a reviewed input with Undo. Lags and annual changes align by calendar period. Regression tables name estimates and inference conventions and support complete HTML export.
• Finance and operations research. Exact regular-coupon curve bootstrapping includes repricing residuals. Solver reports show labeled decisions, resource usage, slack, marginal values, flow assignments and cut certificates where supported. Saved scenarios can retain results for explicit baseline comparison.
• Scientific data review. Review matrix axes, value contracts and labels before import. Explicit centered PCA and uncentered SVD preserve their method identity. Expression comparisons select Welch t or normal references; variant views distinguish passed, filtered and unknown records. Molecular workspaces offer named property methods, adapter availability and saved provenance.
• Guided investigations. Starters and examples cover biology, chemistry, physics, materials, petroleum and aerospace engineering, applied mathematics, economics, finance and operations research. They state assumptions and provide checks, editable inputs, plots or scenario exercises appropriate to the task.

Improvements

• An experimental CAD source tab exposes the narrow imported rectangular-pad author/edit/save/reopen/measure/STEP workflow. Revision checks reject stale edits and exports. This does not promote general programmable CAD support.
• Windows startup suppresses background consoles, and desktop network discovery starts only when requested. Packaged Windows verification remains separate.
• Plot loaded ranges or named X/Y vectors after reviewing data and axis labels. New selection plots use points or straight segments. Charts show their source and explain missing data or incompatible shapes; examples are explicit previews.
• Inspect dated series, scientific artifacts and structured reports without losing complete original values. Long formulas scroll within their source area. I/O opens structured inputs in the appropriate editor and distinguishes unavailable calculations from array-placement conflicts.
• Excel formula export preserves supported named inputs and intermediate dependencies using a supporting Grid Values worksheet. Export Excel values provides an explicit static alternative.
• Model authoring is directly available through Edit model. Expose named outputs with descriptions; ordinary workbench setup suggestions are optional.
• Repeated result reads and input updates avoid redundant decoding, copying and overlapping refreshes. Uniform-height grids avoid rebuilding full row layouts. These targeted changes do not establish a general performance ranking.

Bug Fixes

• Experiment outputs requested by cell address now bind to the intended model cell, consistently with experiment inputs and saved replay.
• Model opening, starter creation, library changes and result refreshes discard superseded replies. Older model values and errors no longer replace a newer selection or source revision.
• Saving distinguishes accepted source, available calculation and confirmed archive persistence. Failed refreshes retain accepted inputs, editor drafts and Undo, with explicit retry guidance. Unavailable results are withheld instead of being presented as current values.
• Dormant saved inputs survive source changes and archive restoration; Reset can discard them. Invalid dated series are rejected before mutating models, including series nested in typed collections and incoming provider batches. Rejected deliveries remain rejected on retry and after restart.
• Provider deliveries respect source ordering and later manual edits. Selected local-input batches recover through their durable state without repeatedly applying the same update. Background decoder failures and timeouts can recover using bounded retained response data.
• Multiline edits preserve exact whitespace through recompilation and Undo. A1-style field access retains dependencies; out-of-range negative indices no longer accidentally select a whole row or column. Unrepresentable addresses are diagnosed before they can collide with another cell.
• Root solvers, scalar minimizers and exhausted large curve fits report nonconvergence rather than returning an unfinished estimate as success. Whole-weight knapsack rejects fractional or malformed inputs. Portfolio functions reject incompatible dimensions and missing numeric positions.
• Regression rejects zero confidence, improves extreme interval precision and explains established complete separation. EXPM1 preserves small exponential differences. PDE options accept the documented ninth-argument record.
• Scientific archives recognize their writer's Frame and numeric-matrix encodings while retaining identity checks. Molecular adapter digest checks preserve decimal values and reject duplicate JSON keys. Sequence operations retain upstream alphabet errors.
• Compound unit parsing accepts forms such as m^3/s; petroleum conversions include psi, bbl, darcy, mD and cP. Physical-scale warnings explain known mismatches; unit_scales strict opts into enforcement.
• Chart failures release incomplete instances and expose a retry action.

Compatibility and Migrations

• New functions, reports and reviewed scientific operations require a matching updated runtime. Existing saved artifacts are not rewritten automatically.
• Existing curve-fit scalar/coefficient contracts remain available. Report defaults use equal weights and no constraints; explicit options select additional inference. Calls without uncertainty options retain schema v1. Local intervals are approximate individual parameter intervals, not simultaneous or prediction intervals. Constrained fits decline unsupported local inference.
• Existing BIO_OMICS_EMBED calls without a method keep uncentered SVD behavior. Older artifacts labeled sparse_pca are not retroactively centered. Use BIO_OMICS_EMBED_V2 when explicit method semantics must be enforced by the runtime. Corrected normal tails do not replace the distinct Welch t method.
• The original approximate curve-bootstrap function retains its results; exact regular-coupon bootstrapping is an explicit selection. Molecular provenance is additive; exact-object consumers should allow it.
• Explicit source addresses must fit columns A–XFC and rows 1–67,108,863. Previously unrepresentable addresses now fail explicitly. Use an underscore in descriptive names that resemble unsupported addresses.
• Root-solver iteration exhaustion now returns CALC. Whole-weight knapsack requires integral weights; use the mixed-integer formulation for fractional packing. Leading-minus/power precedence is unchanged; the grouping warning offers explicit alternatives without rewriting source.
• New petroleum unit names may conflict with custom declarations. Remove an equivalent declaration or rename a different convention. These conversions do not supply gauge offsets, reservoir factors or gas reference conditions.
• Formula exchange targets supported numeric calculations within a 100,000-cell budget, not complete Grid-to-Excel equivalence. Unsupported behavior receives diagnostics; use values export or a Grid document as appropriate. EXPM1 is not supported in formula exchange and has no implicit array overload.
• PDE eight-argument defaults and numeric sample counts remain supported. In the legacy ten-argument form, the final record replaces all options; its samples defaults to 101 and argument nine is not evaluated.
• New provider ordering and pending-batch journal records require an updated host for recovery. Older hosts refuse those records rather than silently ignoring the new state.

Known Issues

Portable molecular descriptors remain uncalibrated proxies, including their derived Lipinski flags. Use an explicitly supported adapter for a named calibrated method. Weak or nonlinear study designs can still produce misleading fit intervals even when a calculation converges.

The native chart-rendering discrepancy reported in the materials study remains under investigation. Source checks do not establish that a packaged application has resolved it. The agent-operated studies and synthetic examples do not establish comparative superiority or substitute for human research validation.

The experimental CAD editor does not preserve drafts across model switches or workspace closure, and does not refresh pinned imports. Its checkpoint is not a portable Grid-document archive. Copy unsaved work before leaving the editor. The selected workflow's earlier live investigation also retained background request errors; it does not establish an error-free packaged CAD experience.

Documentation Updated

• Function reference and error guidance
• Excel export and quickstart
• Molecular biology and computational chemistry
• Reviewed canonical examples and research starters with assumptions and checks.

Bundled documentation is prepared with this source. Website publication remains a separate operation.

Grid 0.66.4 — 2026-09-11

Summary

Grid 0.66.4 makes surface configuration and embedded code easier to read, edit, and format with explicit language blocks.

What's New

• New surface configurations use <toml>…</toml> blocks. Use <yaml> or <json> to author the same structured configuration in another format.
• New surface document seeds use <json> blocks. Component source continues to use <jsx> blocks, where braces retain their JavaScript meaning.

Improvements

• Documentation sites and the in-app reference share a changelog and capability highlights. Bundled docs describe included changes; websites distinguish upcoming changes from released features. Significant capabilities stay discoverable beyond their release date.
• Surfaces apply their existing configuration schema checks to resolved structured values as well as legacy TOML strings.
• Configuration saves, surface renames, duplication, and embed edits retain language blocks. YAML setting edits preserve comments on unchanged content.
• New generated data blocks use a two-space margin when the parsed value stays unchanged. Public examples use section spacing and concise intent comments.
• The formatter preserves authored data blocks and prefers them for multiline structured literals, retaining embedded comments and indentation.

Bug Fixes

• Keep quoted markup containing Grid expressions in its quoted form during formatting, preserving its evaluated meaning.
• Treat embedded blocks as single assignments when editing source, so assignment-like text inside code does not become an edit target.
• Preserve nested TOML quotes and use safe quoted forms when a payload contains its block's closing delimiter.

Compatibility and Migrations

Existing models with plain TOML configuration strings continue to work. Their next configuration save uses typed TOML; no bulk source migration is required. Short typed quotes remain supported.

The language already supported these tags. This update changes surface authoring, configuration handling, and formatting. It does not change how ordinary formulas calculate their results.

Known Issues

Programmable CAD development adds an Experimental source-editor path for straight-edged and whole-circle profile bodies with holes. The plate examples can be saved, parameter-edited, measured, reopened after a host restart and exported as native STEP. Checkpoint reopen rejects self-consistent compiled-source substitutions and formula-owned output overrides. Selected CAD source operations expose fixed-label outcome, work, duration and request-byte telemetry without activating it for ordinary formulas; request reservations are not geometry-memory metrics. The face-sketched holed-plate example combines dependent sketches with stable feature/edge face roles. Local editor/host tests cover both end-cap attachment directions, parameter edits, restart, unchanged STEP re-export and rejection of tampered attachment checkpoints. The circular example preserves exact rational curves and reports bounded analytic measurements; it has no mesh/collision certificate. Rectangular parts retain their existing limits. Arc/spline or mixed-curve solids, Boolean joins, general-angle frames, profile mesh/collision certificates and a supported performance envelope remain unfinished; this is not M2 completion or capability graduation. See the programmable CAD reference.

A separate native engineering API now prepares arc splits by partitioning the authored angle interval, preserving the original curve and reporting required constraint/reference repairs. Compiler-owned editing now preserves live formulas, comments, grouped records and profile order, with native whole-definition agreement tests. Draft-only admission now retains bounded arc descriptions, and native edit plans check complete candidates at captured inputs without granting solid or export authority. Split authored arc now sends the selected intent through native source saving, preserving draft status, live expressions, captured inputs and pinned imports. Native-request tests cover failed saves, history, restart and tamper refusal. Numeric sums/differences have bounded draft admission without changing formula semantics. This remains Experimental: it does not admit mixed-arc solids, establish a supported performance envelope or promote a capability.

A separate native engineering API now prepares exact representable parallel line and radial circle/arc copies with bounded resource checks, preserving original entities and constraints. Irrational or unrepresentable coordinates refuse rather than silently round. Create independent offset copy now connects this operation to native source saving and the workbench. It is not an associative offset, joined region or Supported capability. Native definition insertion now fences revisions and preserves old explicitly selected geometry, refusing implicit consumers and identity capture. Compiler-owned insertion now preserves original tokens, grouping and live expressions, with complete native/source agreement tests. These are independent copies with relative input edits, not persistent offset constraints. Native-request coverage preserves existing solid measurements/STEP and source-bound provenance, plus draft input/import capture, failed saves, history, restart and tamper refusal. Optimized platform evidence and connected-region/associative offsets remain unfinished.

Mixed line/arc certification now checks exact endpoint joins, intersections and hole containment, including slot-shaped boundaries. CAD.SKETCH can describe endpoint arcs, and the canonical slot description updates through ordinary compiled formula evaluation. Shared native profile extraction retains these curves for selected exact certification. A standalone native extrusion now produces exact rational slot and holed-region solids with certified volume, surface area and center of mass, exact signed-axis placement, and bounded lossless STEP where controls are exactly representable. Explicit native typed-source realization now binds complete design and body identity, resolves bound distances and retains source-bound reports with separate storage/payload limits. A selected native mixed-body API now composes these owners with existing rectangular, linear, circular and spline bodies. An internal Core resident recipe now regenerates slot dimensions and mixed cap-attached bodies through canonical compiled formula, with source-bound reuse and stale/ cancellation protections. Host source admission now selects endpoint solids and explicit geometry-free drafts, preserving existing checkpoint metadata. Focused recipe tests pass; the complete save/restart test still awaits its batched host run. The experimental Create authored slot implementation adds two exact semicircles and their tangent sides from two centers and a radius, preserving existing sketch geometry and constraints. Nonrepresentable tangencies refuse instead of rounding. Frontend intent/draft checks pass; native compilation and the slot-to-solid save/restart test remain pending disk headroom. This is not yet a verified end-to-end workflow. The coordinate editor now exposes endpoint-arc point fields for coordinated literal slot resizing; it retains formula/constraint ownership and never repairs tangency in the browser. Focused frontend checks pass, while native resize/restart coverage remains unrun. Associated slot editing and optimized evidence remain unfinished. Some two-arc caps and nonrepresentable STEP controls still refuse. Existing angle-based arcs are unchanged; no capability is promoted.

Native sketch-edit groundwork can prepare exact line-split definition edits, preserve selected profiles and coincident endpoints, and regenerate explicitly admitted linked-point geometry with native STEP. Ambiguous constraints and references require repair. Compiler-owned source-split preparation now preserves authored text and matches native-control results in local tests. The selected workbench command composes that projection with native equivalence checking and the existing atomic save transaction. Explicit native source/body-set admission now preserves verified point links through independent and face-attached bodies while leaving unrelated rectangles and circles on their existing paths. A separate native resident selection now preserves those descriptions through the existing compiled formula evaluator, dependency graph and result reuse. A selected native edit check now compares the complete candidate with the exact requested split at captured inputs, including preserved references and constraints; a different valid solid is rejected. Split authored line accepts a strict interior point and fresh child/joint IDs, preserves unaffected face attachments, and refuses affected constraints/references without saving. Interactive repair and broader sketch tools remain unfinished. Opt-in native whole-sketch mirror preparation now reflects line/circle/cubic coordinates exactly and preserves invariant constraints or identifies required repairs. Revision-checked definition candidates preserve unrelated records and external pins, and refuse affected references or topology consumers needing repair. A separate compiler projection preserves source comments, formulas and links when applying typed mirror-field changes; it does not reimplement geometry. Native preparation now derives those edits and rejects mismatched recompiled definitions. Provisional native-owner reads preserve the captured inputs and cancellation context through comparison and regeneration. The authenticated source transaction now powers Mirror authored sketch, preserving pinned imports and input overrides through atomic saving, undo/redo and restart. Unsupported constraints and affected references still require repair; no approximate reflection or Supported promotion is introduced. Native line trim/extend preparation now uses exact finite-boundary intersections, preserves directed-line constraints and reports endpoint/dimension/shared-point repairs. Trim/extend authored line now sends bounded selection intent to the native atomic source transaction; it preserves pinned imports and captured inputs, checks the complete recompiled definition and refuses invalid resulting solids. Eligible construction lines retain their flags. No browser intersection or approximate fallback is used. Save unfinished CAD draft now retains an unfinished typed sketch across restart without granting measurements or exports, even when an outline is closed. Sketch edits preserve draft status; Complete saved draft requires fresh native admission and regeneration. Opted-in undo/redo now preserves draft status across restart and revalidates restored solids. Drafts can now start with an empty sketch and no profiles, features or bodies, then grow through source edits before explicit completion. Create authored polygon now sends ordered vertices and fresh edge IDs to native exact boundary checks, with optional selected-profile creation. Compiler insertion preserves authored source, and saving compares the complete native definition at captured inputs. Drafts retain draft status; optional undo/redo and restart use the existing native transaction. Numeric text preserves signed zero without browser geometry. Create extrusion body now adds an explicit separate body from an existing profile, preserving holes, workplanes and length-parameter bindings. Blind/symmetric depths use the same native geometry and whole-definition save checks; draft completion remains explicit. Parameter expressions can retain bounded numeric division such as A1 / 8; captured input overrides and pinned imports survive save, restart and history. Unused parameters require staged draft authoring until bound to a feature. The existing extrusion form remains blind/symmetric. Up-to-face and Boolean targets remain unfinished; this is Experimental development, not graduation. Native extent-analysis foundations now cover two-sided spans and selected planar body/face limits. Native v2 data now retains target-aware extent intent and validates its parameter/body/face dependencies without changing old blind extrusion data. An explicitly selected native API now realizes independent two-sided extents through the existing linear/circular/supported-cubic producers, retaining holes, typed length parameters and parameter-only configurations. Native body sets can now resolve through-all New bodies from already-certified planar targets in dependency order, while retaining ordinary rectangle owners. Parameter-only configurations now also apply to mixed blind/extent sets without changing eligible old rectangle owners. Curved targets and configuration suppression, sketch-dimension or metadata overrides remain refused. An explicitly selected Core resident recipe now connects bounded source descriptions to native regeneration, measurements and STEP, retaining typed distances and body dependencies. A separate native host-library recipe now connects registry ownership, captured source/input checks and cancellation without changing the product's default recipe. Explicit native-host draft conversion now retains extent intent without geometry authority; completion requires fresh solid admission and regeneration. The source editor now offers explicit extent-capable full-source saving, with selection retained through parameter edits, undo/redo, draft completion and restart. Ordinary saves keep their previous recipe. The target-extent example exercises separate through-all bodies, not Boolean cuts or joins. Schema 7/8 checkpoints make older readers refuse these selected models; old ordinary checkpoint bytes and build settings are unchanged. Boolean targets remain unfinished. An internal native extent-edit candidate now preserves existing feature/body identity, parameters and target dependencies, with bounded resource and cycle checks. Compiler preparation now preserves comments, parameter/target intent and unchanged live expressions, refusing formula flattening. Internal host plans now compare complete candidates at captured inputs, preserve bounded feature labels and honor operation cancellation. Edit target-aware extrusion now connects those plans to pinned source saving, draft-aware history and native regeneration. It preserves feature/body identity and refuses formula flattening. Captured inputs/imports, storage failures, restart, undo/redo and tampered checkpoint recovery are exercised through real native requests. Selected extent models now retain temporarily unused parameters and face references, validating their values and exact current native face roles rather than deleting them. Ordinary blind-only admission is unchanged. The new request appends ordinal 15 without changing earlier meanings or checkpoint schemas. This remains Experimental, not full M2 completion or capability graduation. Native groundwork now composes face-attached workplanes with target-aware New bodies through exact dependency-ordered placement. Explicit source admission now selects a separate attached resident producer. Source-editor creation/editing, parent changes, undo/redo, restart, draft completion and tamper/storage recovery are exercised through real native requests. Optimized evidence remains outstanding. No supported envelope is widened. Create target-aware extrusion now offers a separate creation form for two-sided distances/length bindings and through-all body/direction intent. Native-derived plans and whole-definition comparison preserve captured inputs, pinned imports, draft status and optional history through durable saving and restart. Up to face now creates admitted linear New bodies using an existing revision-bound face reference and fresh native finite-face coverage proof. Attached datum composition now has native/resident and source-process save/restart coverage, including holed, circular and cubic profiles. This is Experimental, not capability graduation. Explicit extent drafts can now retain revision-bound up-to-face intent through editing, undo and restart. Draft measurement and export still refuse; explicit completion now requires fresh native proof rather than treating saved intent as authority. Selected source saving connects exact nonconvex/holed linear coverage and authored face-role proofs to source/input-bound regeneration, measurement, STEP and reuse, with stale-result and cancellation protection. Reference-free extent sources keep their prior producer after one bounded admission scan; ordinary source saves are unchanged. The real workbench workflow includes completion, new face-extent creation, restart, history and failed-save/tamper recovery. No capability is promoted. Attached models, curved coverage, optimized resource/performance evidence and the broader M2 deliverables remain open. Offset, slots and broader visual sketch creation remain unfinished. Native source history now supports undo/redo for saved source, parameter and sketch edits, including line splits. It retains pinned imports, survives restart and saves each restoration as a new revision without erasing live input overrides. History is bounded to 16 entries and 2 MiB of JSON snapshot payload. Recording is off by default; saving with it off clears earlier history. Incompatible or oversized restoration refuses rather than falling back. This remains Experimental, with optimized resource/performance evidence still outstanding. The source workbench can explicitly inspect authored sketch coordinates and radii, collect changes across entities, and regenerate/save them as one native transaction. Formula-owned, generated, projected and constrained geometry stays read-only through these scalar controls. This remains Experimental and does not complete topology-changing sketch tools or M2.

An internal CAD foundation now proves bounded line/cubic Bézier regions with holes and exact analytic area/centroid bounds. A selected native prototype adds local extrusion and bounded STEP while retaining exact spline carriers and checking their complete coefficients and oriented topology. Curves are not faceted; unrepresentable or lossy output refuses. Explicit native measurements add analytic volume/centroid bounds and adaptively certified surface-area bounds; exact placement covers the existing 24 signed-axis orientations, not general angles. Native typed-definition admission now binds authored identity and retained storage to the body's cached measurements. Selected native mixed-body sets add polynomial cap dependencies while preserving the older geometry families. Selected description admission now bounds line/cubic constructor work and bytes, including numeric error alternatives; description success is not a geometry proof. An explicitly selected internal resident API now regenerates spline bodies from authored code and reuses the existing ownership, capacity and export machinery. The existing source editor now selects this recipe for bounded line/cubic bodies and holes, including authored control-point edits, save/reopen and exact STEP. The spline-plate example has independent analytic area and centroid controls. Linked line/cubic descriptions now retain exact point links and endpoint coincidence. The existing line-split command can divide a straight edge next to a spline, preserving curve controls, holes and coincident metadata through the native source transaction. This verifies existing incidence rather than solving arbitrary constraints. Dependent sketches can now attach to an authored straight side of a spline-containing body after an exact whole-surface and edge proof, including sides of holes. Curved sides, general angles, mixed arcs and general spline constraint solving still refuse. This does not promote a capability; broader integration and the remaining M2 evidence are still open.

Windows first-launch reports include an unexpected terminal window, network permission prompts, and failure to reach the application. Corrections to background-process launching and automatic LAN discovery are prepared in source; they are not yet verified or delivered in a replacement Windows installer. A valid signature does not guarantee that SmartScreen recognizes a download.

A matching closing tag inside a payload ends the block, including inside an embedded string or comment. Use a safe quoted form for that content. Quoted markup can interpolate Grid expressions, so preserve the intended distinction between verbatim source and interpolated markup.

Documentation Updated

The surface guide, language reference, assignment reference, and AI authoring guide now teach language blocks and explain compatibility and interpolation. The style guide, surface specs, and canonical surface examples also use the new convention.