• Layout: aspect-ratio follows Yoga's rules with min/max constraints on both
  axes. In a flex container the main size comes from the cross size (the
  authored one, or the stretched line for an item with neither size) and is
  bounded by the main-axis min/max; the cross size is then derived from that
  bounded main size (over an authored cross size, like Yoga) and bounded by
  its own min/max. An absolutely positioned item whose width or height comes
  from both insets drives the other through the ratio. A width: 100%; max-height: 100%; aspect-ratio stage now narrows, keeping its ratio, when
  its parent shrinks above the keyboard instead of keeping its width and
  overflowing under the status bar. Rust tests replay Yoga's
  YGAspectRatioTest reference cases.
• Android Modal: the navigation bar follows the app's light/dark appearance
  like React Native's Modal instead of the Dialog theme's black bar with light
  icons. An edge-to-edge (navigationBarTranslucent or
  statusBarTranslucent) modal gets RN's transparent, system-scrimmed bar
  (RN's translucent colours before Android 10) with icons for the app theme;
  a fitted modal paints the app window background; the declared
  navigationBarHidden hides it. Re-applied after each window configuration.
• iOS StatusBar: barStyle (light-content/dark-content), hidden and
  animated now drive the status bar like React Native. The active
  StatusBar nodes (visible route, open or opening modals) stack in mount
  order, the latest winning property by property; the host, brownfield and
  presented route controllers report preferredStatusBarStyle,
  prefersStatusBarHidden and preferredStatusBarUpdateAnimation, and each
  change calls setNeedsStatusBarAppearanceUpdate() (inside an animation
  when animated). With UIViewControllerBasedStatusBarAppearance NO the
  application status bar is driven instead, as RN does. The host template
  declares the key YES. Written without Xcode: PamStatusBarTests and the
  Mac checklist in docs/ios-parity.md must pass on a Mac.

• Android Modal: the StatusBar declared by a modal's content (or the
  screen's, for a modal without one) now reaches the modal's own window. A
  Dialog created after the bars last changed never received them, and every
  window configuration (enableEdgeToEdge) reset its icons to the app
  theme's: a dark full-screen modal in the light theme showed dark status bar
  icons on black. The config is kept and re-applied after each window
  configuration; a statusBarTranslucent modal keeps its transparent bar.

• Android VirtualizedList: a node of a mounted cell whose index changes
  under the same parent (a conditional sibling inserted or removed before
  it) keeps its views and is only re-ordered when its place changed. It used
  to be dematerialized and rebuilt with every following sibling: a Loops
  page swapping its poster for its player rebuilt ~55 views on every swipe
  (S10 settle frame 55-84 ms -> 20-27 ms, Loops p99 46-61 -> 27-29 ms). iOS
  already re-attaches the existing views.

• appearance.firstFrame ("php" default, "window"): with "window"
  the Android activity draws its themed window at once instead of holding
  the launch screen until PHP's first frame, and builds the native modules
  right after that first draw; iOS skips the launch cover. For apps whose
  first PHP frame only paints the background it shows the same pixels
  sooner (Galaxy S10 cold start, Zé Chat: TTID 316 -> 230-237 ms median).
• Android: a module call made before the native modules exist is queued
  and replayed in order once they are built, instead of blocking the PHP
  thread (calls complete asynchronously anyway).
• PHP SDK: the prebuilt component pack lists every component source; a
  staged bundle (manifest.sha256 beside the pack) boots from that listing
  without walking src/ or reading and fingerprinting each component
  (S10: component discovery 33 -> 3 ms of the first frame). Development
  trees and hot reload bundles carry no pack and keep validating.
• Android: release bundles live in content-addressed directories, so PHP's
  opcache no longer stats the source of every include
  (opcache.validate_timestamps=0 outside debug builds, which hot reload in
  place).
• Android VirtualizedList: history prepended above the rows (also when a
  bounded window drops rows at its other end) restarts the prefetch ramp of
  that side only, like appended pages; the rows laid out on the other side
  stay bound instead of being recycled and bound again.
• Android cell binds: the pool key of a cell view is a property bit set
  (no sorting/joining strings), image request identity is the immutable
  request itself (no joined signature), and drag and tap-effect programs
  are parsed once per distinct source (PamParseCache; iOS: drag configs).
• Android: ActivityIndicator no longer inflates the theme's
  AnimatedVectorDrawable it immediately replaces (15-25 ms on the UI thread
  for each new spinner, e.g. a list's "loading older rows" cell).

• KeyboardAvoidingView works inside Modal and BottomSheet surfaces.
  On Android a modal is its own Dialog window: the activity window never
  receives that window's IME, so a modal's KAV read a zero inset (and
  mounting one replaced the screen KAV's window-inset listeners, which its
  unmount then cleared). A KAV inside a modal now follows the IME of the
  modal's own window, frame by frame through WindowInsetsAnimation, and no
  longer touches the activity window's listeners.
• Engine: per-surface keyboard insets
  (Engine::set_surface_keyboard_inset,
  pam_native_engine_set_surface_keyboard_inset). The resize (RN
  height) and padding behaviors of a KAV inside a modal are laid out by
  the engine above that modal's keyboard (RN relativeKeyboardHeight,
  including keyboardVerticalOffset): the content box shrinks, so flexible
  and absolutely positioned descendants (a bottom palette) move above the
  keyboard. The root keyboard inset still never reaches a modal, and a
  modal's keyboard never moves the screen below it.
• Android: pan KAVs inside a modal translate natively against the dialog
  window's IME; an interactive BottomSheet keeps lifting itself and its
  KAVs only avoid what that lift leaves.
• iOS: modals publish the keyboard overlap measured in their own coordinate
  space; the engine lays out resize/padding/position KAVs inside a
  full-screen or dialog modal and the frames animate with the keyboard's
  duration and curve.
• Templates accept React Native's KAV behavior names: height (= resize)
  and position (= pan).

• Android: appending a page to a VirtualizedList (or raising the adaptive
  prefetch distance during a fling) no longer lays out and binds the whole
  prefetched area in one frame. The off-screen layout space shrinks at once
  but grows back by at most one row per layout pass, restarting from the
  viewport when rows are appended. On a Galaxy S10 a device-gallery grid
  fling went from p99 41 ms and ~5 missed vsyncs per run to p99 29 ms and
  none (jank 3.7% → 2.9%).
• Android: MediaLibrary::assets() and albums() sort through the SQL sort
  order (date_added DESC, date_modified DESC, _id DESC). MediaProvider on
  Android 11/12 ignored the structured sort columns and returned the oldest
  media first; pages are now newest first like the camera roll (iOS already
  sorted by creationDate descending).

• Keyed VirtualizedList sections for tabs over one list: rows set
  listSection (Element::listSection()) and the list activeSection
  (VirtualizedList::activeSection()). Unsectioned rows (header, sticky tab
  rail, footer) are always shown; rows of inactive sections stay mounted and
  hidden, so switching tabs is a property update: no PHP rebuild of the rows
  and no remount.
• Engine: every section of a contiguous block is laid out from the block
  origin, so row frames never depend on the active section, and a vertical
  list reuses the previous extent of rows off the dirty path (a section
  switch or one changed row no longer re-measures every row). Clean subtrees
  under a dirty node keep their previous frames in incremental layouts
  (they were dropped and re-sent).
• Android: the adapter lists only shared and active rows; holders of an
  inactive section are recycled into the shared pool while their views stay
  materialized (parked) with their decoded bitmaps, and binding them again
  reattaches the same views. Each section keeps its own scroll anchor while
  the rail is pinned; a first visit starts with the rail at the top. Parked
  rows not bound after a switch, and all of them under critical memory
  pressure, return to ordinary recycling.
• iOS: same contract: inactive sections are detached from the list and
  reattached on return, content size and windowing follow the active
  section, and each section keeps its own content offset while the rail is
  pinned.
• Protocol: ListSection (524) and ListActiveSection (525) property
  identifiers (append-only).
• Benchmarks: mount-scenarios adds chat-details tabs over one
  VirtualizedList (header, sticky rail, 40 rows with a photo per tab,
  switched back and forth 9 times) built by rebuilding the active tab
  (details) or with keyed sections (details-keep), with tap-to-commit and
  tap-to-frame latency. API 35 emulator (SwiftShader, benchmark build,
  4 runs, 28 returns to a visited tab):
  • native commit of a switch back: 1.9 -> 0.5 ms (median), p90 2.2 -> 0.5;
  • image decode / texture upload after a switch: 16.9 / 3.3 -> 0 / 0 ms;
  • tap to first presented frame: median 32.9 -> 28.4 ms, p90 40.7 -> 35.5;
  • the remaining latency is the PHP render of the screen (about 24 ms in
    both modes here, where the rows are inline template elements);
    memoized row components keep it to the rail.
• See migration notes.

• Android images decode at the display size: a source larger than its view
  is subsampled and then scaled in the same BitmapFactory pass to the
  smallest size that still covers the view (resizeMethod auto/resize),
  instead of keeping up to twice the view's pixels per edge. A 1080x1350
  photo in a 360 px grid cell now holds 360x450 pixels (was 540x675).
  Tiled (repeat) images only subsample; scale/none are unchanged.
• Android photos decode to Bitmap.Config.HARDWARE on API 28+ (GPU memory
  only: no heap copy and no texture upload in the first frame that draws
  them); opaque JPEGs use RGB_565 on API 26-27. Inline data: glyphs and
  images under 128x128 px stay ARGB_8888. Software canvases (shared-element
  snapshots, non-accelerated windows) draw a heap copy instead of failing;
  blur already copied. MediaStore thumbnails follow the same storage.
• Android decoded-image memory cache is sized from
  ActivityManager.memoryClass (1/8, 1/16 on low-RAM devices, 8-64 MiB)
  instead of a fixed 32 MiB.
• Android releases the bitmap of an Image hidden by an ancestor (a covered
  route, an inactive tab or page) or detached from the window, so the memory
  cache bound really bounds decoded images. Showing it again restores it in
  the same frame from the memory cache, or decodes it again without repeating
  load events. Animated, inline and non-memory-cacheable images are kept.
• Android mount: a new image drawable no longer requests a layout pass of the
  engine-sized ImageView (one ancestor re-measure per arriving photo), each
  ancestor is invalidated once per commit instead of once per laid-out
  descendant, and the view prewarm pools refill on idle after a commit drains
  them, so the next large subtree takes ready views. Commits emit
  PamCommit.mutations, PamCommit.lists and PamCommit.layout trace
  sections.
• iOS: network, media-cache, bundled asset://, pam-file:// and file://
  images decode through ImageIO at the size that covers the view (both
  edges; a portrait photo in a square cell was decoded to the cell's longest
  edge and upscaled), and small images are decoded off the main thread with
  preparingForDisplay(). The encoded media memory cache (1/32 of RAM,
  16-96 MB) and the inline glyph cache (2-8 MB) are sized from physical
  memory.
• No PHP API, protocol identifiers or dependency requirements changed.
  Rebuild the Android and iOS hosts; see migration notes.
• Measured on an API 35 emulator (SwiftShader, release-optimized benchmark
  build, 4 runs each) with a synthetic profile (header + 3-column grid of 30
  photos), a 20-row tab switch and a full-screen video page swap:
  • video page swap: worst frame p90 56.7 -> 34.1 ms (median 27.0 -> 16.2),
    slow frames 21 -> 16, slow UI-thread frames 16 -> 3, worst UI-thread
    frame 16.1 -> 5.7 ms;
  • tab switch: mount 9.1 -> 4.1 ms (median), worst UI-thread frame 11.7 ->
    4.5 ms, slow frames 12 -> 9;
  • profile first open: mount 6.6 -> 4.4 ms, worst UI-thread frame 404.8 ->
    262.3 ms (SwiftShader-bound first draw);
  • after a navigation tour: native heap 60-82 -> 32 MB, PSS 97-122 -> 72 MB
    (the emulator does not attribute GPU buffers to the app's PSS).

• Android lint (lintDebug, warnings as errors) passes with zero findings.
• Android: the process-scoped PamRuntime holds its Activity context only
  weakly (falling back to the application context) and drops it on detach,
  so a destroyed Activity is no longer retained through PamRuntimeHost
  (StaticFieldLeak).
• Android: PamNotificationCredentials.replace validates and seals every
  token first and clears and writes the store in a single commit; an invalid
  entry leaves the previous credentials intact instead of an emptied store.
• Android: the PamList.layout trace section is always closed, also when
  layout throws (UnclosedTrace).
• Android: the bottom-anchored window-sized modal child uses a named physical
  gravity constant (its left margin is the engine's physical x).
• Lint suppressions limited to verified false positives, each justified in
  place: WrongConstant on TextView.breakStrategy (Layout and LineBreaker
  constants are equal; LineBreaker is API 29, minSdk 26) and
  UnusedResources for the CLI-managed splash drawables.
• Rust: cargo clippy --all-targets -D warnings is clean on the toolchain in
  use (collapsible if in appearance.rs, app_icon.rs and mobile.rs;
  double_ended_iterator_last in layout.rs). No behavior change.

• Android: a hidden route mounted outside a Choreographer frame (a direct commit, not an engine batch) is laid out on the frame after the one that lays out its mount, as 1.25.0 intended. Before, its release callback ran in the very frame that mounted it (frame callbacks precede the traversal), so mount and first layout shared a frame.
• Android: an attached PamNavigationHost mounts a route straight through its route controller and restores its position with detachViewFromParent/attachViewToParent. A new screen enters the window once instead of being attached, detached for its fragment and moved back (three attaches and two detaches of the whole subtree).
• Android and iOS: a drag whose settle completes within the release (reduced motion, or system animations off) reports onGestureSettle after onGestureEnd, never before it.
• Android: a text input with a mask or currency format turns IME suggestions off (TYPE_TEXT_FLAG_NO_SUGGESTIONS); the IME composed over text the formatter rewrites on every keystroke. iOS: formatted fields turn autocorrection and spell checking off.
• Android 12+: a backdrop-filter container no longer redraws on every frame of an idle screen. It re-records what is behind it only in frames where something in the window changed; before, its own invalidation scheduled the next frame forever (continuous rendering, and a main thread that never went idle, which hung waitForIdleSync in tests).
• Android: a visible DevTools overlay moved to another window resumes its frame-rate loop there. iOS: the overlay's CADisplayLink (which retains its target) runs only while the overlay is in a window, so a removed overlay is released instead of ticking forever; showing it twice no longer adds a second display link.
• iOS parity written on Linux, not compiled: XCTest testReducedMotionDragSettleIsReportedAfterTheRelease and testVisibleDevToolsOverlayIsReleasedAfterLeavingItsWindow; validate on a Mac. New Android instrumented tests reducedMotionDragReportsItsSettleAfterTheEnd and backdropFilterRedrawsOnlyWhenTheWindowChanges.
• The Android instrumented suite is green and deterministic on API 26, 31, 35 and 36 with system animations on or off: frame-ordered assertions wait for rendered frames (awaitFrames) instead of waitForIdleSync/sleeps, tests that observe motion in flight enable animations through PamAnimationsEnabledRule, window captures wait for a stable composited frame, the layout-origin test expects edge-snapped sizes (1 px at density 2.75), the status-bar and transition-layer tests follow the 1.25.0 transition timing, the double-tap test dispatches both taps in one main thread message, the controlled-input echo test types into the field, the rapid formatted input test waits until the IME serves the focused field before its key burst, and the DevTools test no longer waits for an idle main thread (its snapshot checks use JUnit instead of Kotlin assert, a no-op on Android). The reload and crypto bridge tests no longer read the PHP report list while the runtime thread appends to it (a ConcurrentModificationException).
• No PHP API or protocol identifiers changed. See migration notes.

• Android device-gallery images (content://media/... photos and videos, including the Files collection MediaLibrary::assets() pages) up to 640 px load from the platform thumbnail cache (ContentResolver.loadThumbnail) and are downscaled to cover the cell, instead of reading the whole file into the heap and decoding it. Videos show a frame instead of failing to decode after reading up to 16 MiB. Natural size events still report the MediaStore width and height. Larger views and other sources keep the regular decode.
• iOS: ph:// photo-library sources of video assets draw their poster frame (previously an image error), matching Android.
• No PHP API, protocol identifiers or dependency requirements changed. Rebuild the Android and iOS hosts; see migration notes.
• Measured on a Galaxy S10 (Android 12) Create gallery, 4 columns, 14 flings: janky frames 7.9% → 4.0% (p99 61–81 → 44 ms); app-process GC time during a 14 s trace 1.12 s → 0.14 s.

• VirtualizedList/VirtualGrid cells include their root's margins, like React Native/Yoga: a content-sized cell's slot (row height, or column width in a horizontal list) is the root's margin box, and the root is inset by its margins on every side. An authored height (width horizontally) stays the root's own height and the margins are added around it; rowHeight of a horizontal list stays the slot extent. Applies to grid rows (the tallest margin box) and fullSpan cells. Before, the margins were dropped from the slot and the root sat at its top-left corner.
• Android and iOS size and position cell holders from the margin box (content size, item starts and the visible window on iOS).
• Sticky children of a ScrollView (and sticky virtual list cells on iOS) pin and are pushed by their margin box, like React Native's sticky header wrapper: a pinned header keeps its top margin above it.
• No PHP API or protocol identifiers changed. See migration notes.

• Navigator::prewarm($route, $params) mounts a screen ahead of navigation, hidden under the current one; a following push()/navigate() with the same route and params reuses it (same element, views and first layout), so the transition starts on the next frame. One prewarmed screen is kept; it is released after 4 s unused or by any other navigation. isPrewarmed(), cancelPrewarm() and the static Navigator::isPrewarming() (true while a prewarmed screen renders, so mount() can defer focus-only work to navigationFocused()) complete the API. Call it from a row's on:pressIn.
• Android: a route mounted hidden is measured and laid out on the frame after its mount (the push transition waits that frame), so mount and first layout never add up in one frame; a route moving inside its navigation host is reordered with detachViewFromParent/attachViewToParent instead of leaving the window, so a press in progress on the Inbox is no longer cancelled and kept-alive routes keep their views and list layout.
• Android: a hidden virtual list (!isShown) creates its cells within 5 ms per frame and finishes them on the following frames (10 ms once shown); cell extents are laid out at once. The first layout after a commit starts at initialScrollIndex instead of binding position 0 and scrolling a frame later. A list resting at its start whose rows all fit is no longer treated as "at its end" when its viewport shrinks (an Inbox banner no longer jumps the list to its last rows).
• Android: the outgoing screen of a navigation transition is drawn into a hardware layer for the duration of the animation instead of re-rendering its translucent subtree every frame.
• iOS parity (written on Linux, not compiled): PamNavigationHost.reorderRoute and PamRenderer.move reorder routes without removeFromSuperview, hidden PamVirtualListViews materialize visible cells within 5 ms per frame, and the outgoing route is rasterized during the transition. XCTest testReorderingAPrewarmedRouteKeepsItInTheWindow; validate on a Mac.
• Measured in Zé Chat on a Galaxy S10 (R8 build, cold process, phone lock held, five taps of ~95 ms on an Inbox row): the slide starts 15-32 ms after the finger lifts instead of ~100 ms, the commit frame drops from up to 44-49 ms to 21-26 ms on the UI thread and every other frame of the open stays under 16.7 ms. New PHP SDK cases and Android instrumented tests (reorderingAPrewarmedRouteKeepsItAttachedAndItsLayout, hiddenRouteIsNotLaidOutInTheFrameThatMountsIt); see migration notes.

PAM Native 1.24.0

Source commit: a3285bb99224c0b31af5490cc9602edbc1a3e098 ([skip ci]).

• Faster render pipeline, same frames: on the Zé Chat host benchmark suite
  (16 screens, nine interleaved processes per screen against 1.22.7/1.23.1,
  whose render path is identical) the summed per-screen medians fall 34%
  (570.8 to 375.5 ms) and the p90 across processes 38% (625.2 to 387.1 ms);
  per operation, the median falls 30% (1.80 to 1.26 ms). Every encoded frame
  of every benchmark is byte-identical to 1.22.7, and render counts and
  lifecycle hook counts are unchanged.
• Encoder: a subtree the previous frame already emitted is diffed in O(1)
  (only its root placement can change), so patches cost what changed instead
  of the tree size; constant element properties are encoded once per
  template element; long strings (inline images) are validated and copied
  once within a byte budget; node ids come from the binary digest.
• Renderer: compiled component call sites whose evaluated inputs did not
  change skip prop diffing, configuration, contract validation and
  decoration; native elements dispatch straight to the fast path from cached
  style entries (also with dynamic classes, alternating classes and
  environment-dependent styles, now cached per window/container/style
  environment); text-only children interpolate without child render data;
  method event handlers are built once per scope; render data is handed to
  children without copies.
• Runtime: component bookkeeping is updated in place (no quadratic copies
  for long lists); reused subtrees are retained from a cached state list;
  commit visits only components that need attach, resume or effects;
  discarded components and trees are freed without the cycle collector
  (released render references, weak state callbacks, no recursive closures).
  PHP's cycle collector runs between frames once 40,000 roots are buffered
  (PAM_NATIVE_FRAME_GC=0 keeps PHP's own scheduling, a number sets the
  budget) and at shutdown. The first runtime checkpoint is written after the
  runtime stays up for five seconds instead of in the first frame.
• Hot paths compile to dedicated opcodes (use function imports) and
  generated expressions read the missing-value sentinel directly (component
  cache format 6: caches are rebuilt once).
• Element exposes its encoding fields as read-only public properties
  (kind, properties, events, children, elementKey, domIdentity,
  identitySlot, reusable); TreeEncoder::frameNodes() returns the last
  frame's nodes. No protocol identifiers, wire format, Android or iOS code
  changed. See migration notes.

Completed validation

• Byte-identical frames: every encoded frame of the 16 Zé Chat host
  benchmarks (inbox, chat, feed, reels, stories, create, chat-details, profile,
  notifications, activity, calls, search, contacts, comments, social-list,
  forward) matches 1.22.7 byte for byte; render counts and mount, attach,
  resume, unmount and forget counts are unchanged on every benchmark.
• New differential encoder test: 400 frames whose patches, applied to the
  previous tree, must equal a fresh full frame (reused, moved, dropped and
  nested subtrees); environment-dependent styles re-resolve after density
  changes.
• PHP SDK suite, performance, visual DOM, navigation and fuzz scripts,
  release-workflow and hot-reload contracts, phpstan (singularity config),
  protocol parity, 552 PHP parses, Rust formatting, 207 Rust workspace tests
  and 216 JVM tests passed. Android and iOS code are unchanged.
• All 12 release assets have verified hashes; renderer, PHP SDK and AAR
  reproducibility and package budgets were verified.

• iOS: PamHeldPanGestureRecognizer imports UIKit.UIGestureRecognizerSubclass,
  which declares the touchesBegan/touchesMoved/reset overrides it uses;
  without it the iOS host does not compile ("method does not override any
  method from its superclass"). Found by a Linux Swift 6.4 pre-check (every
  Swift file parses; Foundation-only sources type-check); a full Xcode build
  still needs the Mac.
• No PHP API, protocol identifiers, Android code or dependency requirements
  changed. Rebuild the iOS host; see migration notes.

• Notification action endpoints authenticate per account while the app is
  killed: ActionEndpoint::bearerFromCredential('user_id', 'recipient_user_id')
  resolves natively the token of the account named by the push data, from the
  new Pam\Native\Notifications\NotificationCredentials store
  (set, remove, sync, clear).
• Android seals credentials with an Android Keystore AES-256-GCM key; iOS keeps
  them in the Keychain (this device only, after first unlock). Slots are keyed
  by a SHA-256 of the account id.
• A push whose account has no credential sends nothing and is dismissed;
  NotificationAction::$credentialMissing reports it. Credentials resolve only
  in headers.
• Android JVM and emulator (API 35) tests cover resolution, Keystore sealing,
  the per-account request and the dismissed no-credential case; the iOS
  XCTests need Mac validation. Rebuild the native hosts; see
  migration notes.

PAM Native 1.22.7

Source commit: 3364058fe27eace31400965a9a1b2172e0075762 ([skip ci]).

Accepted after native regression, community project and application UI validation.

Fix

Android scroll views consume contentOffsetX/contentOffsetY requests once
each requested position is reached. Later child layouts or insertions no
longer replay an initial offset after scrolling to the last page. Requests
still clamped by insufficient content remain pending until content grows.
Explicit property changes can request a new position. End anchoring, keyboard
clearance and tokenized scroll requests keep their existing contracts.

Completed validation

• All three new regressions failed on 1.22.6 and passed on Android APIs 26/36.
  They cover both axes, relayout after reaching the end, and delayed content
  that must satisfy a pending request before consuming it.
• Final instrumentation: 52 renderer tests and one separate-process reload
  test per API 26/36, including the twelve existing scroll-container tests.
• PHP SDK suite, 547 PHP parses, protocol parity, Rust formatting, 207 Rust
  workspace tests and 214 JVM tests passed.
• Fresh native-ui (API 26) and native (API 36) projects passed launch,
  edit/reload/restore and counter increment, with no runtime errors.
• Application UI on API 36 retained the selected photo after swiping in both
  directions, waiting for relayout, double-tap zoom, pan and reset. Two-image
  creation passed crop, filter, reorder and review without publishing.
• All 12 release assets have verified hashes. Renderer/PHP/AAR reproducibility
  and package budgets passed; the Linux CLI checksum was verified.

Upgrade and limits

Rebuild the Android host after updating. PHP remains ^8.5; numeric protocol/
ABI identifiers and third-party dependencies are unchanged. The 1.22.6 image,
reload, cache-recovery and initial-property improvements remain included.
See migration notes.

No iOS source changes are included, and UIKit execution was unavailable on
Linux. Native correctness and emulator UI tests do not measure FPS. Final app
integration is validated separately from this framework release. Validation uses direct local commands,
without GitHub Actions.

PAM Native 1.22.6

Source commit: 2aff2f3b49d3558503a1c9aee86cf97e7436c50e ([skip ci]).

The final V3 source passed the release gates and integrated Android cache-recovery QA.

Changes

• Typed ImageLoadEvent, ImageErrorEvent and ImageProgressEvent handlers
  receive decoded objects through the shared compiler event decoder. Direct
  callbacks and explicit event arguments work in generated and interpreted
  expressions. Existing string, untyped and zero-argument handlers keep their
  contracts, and forwarded event objects retain identity.
• Android applies initial rich-text effects once after the full property pass,
  avoiding repeated content, font, sizing and letter-spacing work. Initial
  PamContainer backgrounds similarly use the final authored properties.
  Incremental changes remain immediate; native controls, ImageBackground and
  custom views keep their existing paths. Drawing, ripple and clipping are
  unchanged.
• Android and iOS native bridges keep module completions within their original
  PHP request. Opaque native callback IDs prevent queued cleanup results or
  late callbacks from consuming reused PHP IDs after reload. Public module and
  wire contracts are unchanged.
• Prebuilt PHP class/template caches restore empty or truncated derived files
  from their unchanged bundle pack on first materialization. Repairs publish
  atomically and invalidate only the repaired opcode. Valid files are reused;
  failed pack reads remain retryable. Later renders do not reread the pack or
  repeat size checks.

Completed validation

• The PHP SDK suite, 547 PHP source parses, protocol parity, Rust formatting,
  207 Rust workspace tests and 214 JVM tests passed on the accepted V3 source.
  Android/Rust/Protocol sources are byte-identical to V2; the final PHP suite
  includes the new cache-recovery regression.
• Android APIs 26 and 36 each passed 37 renderer instrumented cases plus one
  reload regression in a separate instrumentation process: 38 cases per API.
  Coverage includes list/image continuity, native zoom and gesture handoff,
  initial text/background properties, text parity/clipping and rebind.
• The reload regression failed on published 1.22.5 when two shutdown timer
  results consumed new Linking callbacks. The final candidate delivered only
  the new entry's four results, including the typed canOpenUrl result. Its
  HTTPS fixture checks URL support without opening a URL or accessing a server.
• Cache regressions reproduce missing-class failures with empty/truncated
  class/template files and prove exact restoration, reuse of valid files,
  retry after a failed pack read and no additional reads per render.
• Fresh native and native-ui projects passed first launch, edit/reload/
  restore, source restoration and counter increment on API 36 and API 26.
  Both final V3 results contain at least two reload-ready events with distinct
  bundle versions, valid screenshots and no runtime errors.
• The 12 release assets have verified hashes: Android renderer, plugin API AAR,
  PHP SDK and Linux CLI, their four checksum files, and Android/PHP
  reproducibility and package-budget reports. Reproducibility and budget gates
  passed for renderer, PHP and AAR; the CLI has a verified checksum, not a
  separate claim of double-build reproducibility.

Application measurements and limits

The accepted initial-properties A/B kept all 157 PAM assets byte-identical.
The largest mount CPU interval changed from 21.020 to 18.609 ms, the largest
Recycler layout CPU interval from 44.064 to 39.893 ms, and its eleven binds
from 29.714 to 27.976 ms. The total observed mount CPU increased from 27.453
to 37.593 ms; this is evidence for reduced work in the selected intervals,
not a reduction in every opening cost.

Untraced steady scroll changed from 0/417 frames classified as jank (p95 10 ms)
to 1/420 (p95 11 ms), with GPU median/p95 at 4/5 ms in both. Cold p95 changed
from 133 to 105 ms while jank changed from 10/16 to 12/16 frames. A single pair,
shader work and scheduling limit attribution. Cold opening has not achieved
the 60 FPS target, and these samples do not establish universal FPS or
complete application parity.

The image-event application regression reproduced the old TypeError and
passed the two compiled editor/crop consumers on the candidate. A candidate
V1 device session also exported edited photos and confirmed one remote post
with HTTP 201. The final V3 APK then recovered an intentionally empty Feed
class on Android: 0 bytes became the original 22,665 bytes with the exact
original SHA-256, and Feed rendered after process restart without clearing
application data. Backend
media processing remains separate from SDK correctness and release acceptance.

Upgrade and platform scope

Update the SDK, rebuild/precompile the application bundle and rebuild the
native host. PHP remains ^8.5; third-party dependencies and numeric protocol/
ABI identifiers are unchanged. Existing 1.22.5 list and zoom fixes remain
included. See the migration guide.

Validation uses direct local commands without GitHub Actions. The iOS bridge
implements the same request-scoped callback mapping, but iOS execution was
unavailable on the Linux host. Cache size recovery does not detect arbitrary
same-size corruption or rebuild a damaged source pack. The device cache recovery evidence and source hashes are recorded in the release manifest.

PAM Native 1.22.5

Source commit: 6a333fd4122adb9598c69ef9fe3f852ebf70ba04 ([skip ci]).

Changes

• Android virtual lists retain mounted cells and decoded images when keyed rows
  move within the same list. Loading headers and page prepends no longer clear
  visible messages before RecyclerView applies its position changes. Cross-list
  moves keep their existing removal and materialization lifecycle.
• Native pinch and pan take over the currently displayed transform when they
  interrupt a zoom animation. Independent opacity animation continues and the
  image remains mounted.
• Adjacent native pan/pinch detectors share their content surface. An intervening
  View or Drag preserves separate targets. The iOS implementation follows the
  same shared-target and component-preserving transform contract.
• Optional GestureEvent::nativeScale, nativeTranslationX and
  nativeTranslationY report the applied transform for committing interrupted
  gestures. Translations use dp on Android and view points on iOS. Existing
  relative deltas and positional constructor arguments remain compatible;
  older runtimes and gestures without native transforms leave these fields null.

Validation

• Android instrumentation: 27/27 tests on API26 and 27/27 on API36, including
  view/bitmap continuity, pagination, delayed HTTP images, native zoom and
  off-center gesture takeover. The same-list continuity regression fails on
  published 1.22.4 and passes with this fix. Image completion alone passes both
  versions; the confirmed teardown was caused by same-list row moves.
• 214 JVM tests, the PHP SDK suite, 545 PHP source parses, protocol parity,
  Rust formatting and 207 Rust workspace tests passed.
• Fresh native and native-ui projects passed installation, first launch,
  edit/reload/restore, stable runtime PID and counter increment on API36/API26.
  Both produced two reload events without runtime errors; screenshots were
  inspected.
• Renderer, PHP package, plugin API AAR and Linux CLI checksums were verified.
  Reproducibility and package budgets passed for Android and PHP artifacts.
• Galaxy S10 chat continuity: ten matching history swipes changed fully empty
  timeline samples from 7/827 to 0/834 after the first three seconds.
• On the same test photo, the original zoom recording contained three empty
  photo frames among nine recorded frames. The corrected recording had zero
  empty photo frames among 123 recorded frames and 95 distinct measured image
  coverage values. A further two-finger/pan/rapid-double-tap recording had zero
  empty photo frames among 199 recorded frames; returning to 1× was confirmed.
  Recordings establish visual continuity, not frame rate. A separate debug
  frame sample reported 8 janky frames of 345 and p95 19 ms; this does not
  establish sustained 60 FPS or complete application parity.

Upgrade and limits

Rebuild the Android host after updating. No numeric protocol identifiers or
third-party dependency requirements change. See
the migration guide.

Validation used direct local commands without GitHub Actions. Three UIKit
regression tests are included, but Swift/UIKit execution was unavailable on the
Linux host. The iOS handoff covers CSS/program transforms on the shared photo
surface; a TapEffect owned by an ancestor and animating a child is outside this
coverage. End-to-end APNs/FCM delivery was not tested. Initial text/background
batching and rejected drawing experiments are not included in this release.

PAM Native 1.22.4

Android keyboard-aware Scroll follows keyboard animations and focus changes while preserving the authored viewport height, including Android 26–29 with adjustNothing.

Changes

• The existing keyboardVerticalOffset property adds focused-field clearance when keyboardInset is enabled. Default focused-field clearance remains 24 dp.
• Native focus changes reveal the current editor without PHP callbacks. Repeated unchanged insets and keyboard dismissal preserve manual scrolling.
• Android 26–29 Scroll and keyboard-avoiding overlays share one zero-width, non-focusable measurement window per root. Disabling, detaching or closing consumers releases their subscriptions; losing window focus suspends measurement, and returning restores it. Dialogs retain their compatible window-inset path.
• Deferred reveal callbacks ignore stale insets and prior focus targets. Removing a Scroll or its keyboard-aware property releases its inset/layout/animation observers.

No PHP API, protocol identifier or dependency requirement changes. Rebuild the Android host after updating the SDK. See docs/migration-1.22.4.md for guidance on using one keyboard-aware form container and retaining enough content extent.

Verification

Both community hosts passed on the final source commit after rebuild and installation.

• PHP SDK suite and syntax (545 files), Rust formatting/workspace (207 tests), and both Android engines passed for the unchanged PHP/Rust sources. Protocol parity was rechecked after the final Android patch.
• Android JVM 214/214 and instrumented-source compilation passed on the final commit. Existing keyboard/Scroll classes passed on API 26 and API 36.
• Final keyboard-aware instrumentation passed on both APIs: API 26 ran real keyboard focus/resize and shared Scroll/overlay lifecycle cases; API 36 ran animated-inset and real keyboard cases. Each platform executed two cases and skipped the other platform's case. The legacy test obtains its keyboard geometry independently from the system accessibility window and checks focus switching, 180 dp clearance, full viewport, late overlay mount, disable/re-enable, dialog focus/return, detach/reattach and hide.
• Physical Scroll-only Galaxy S10 acceptance: Login 180 dp, Signup default 24 dp and Recover 180 dp clearances, with the focused field visible and authored viewport preserved. Signup password step was not exercised.
• Android renderer and PHP archives reproduced byte-for-byte; the unchanged plugin API retains its clean rebuild match. Package-size budgets and independent report verification passed.
• Fresh community native (API 36) and native-ui (API 26) projects installed their declared Composer dependencies, including development dependencies, after manifest/metadata/dry-run checks. Both passed first launch, edited-source reload, restored-source reload and counter interaction in the same process on the final Android host. Installed PHP SDK files are byte-identical to the final candidate.

Source commit: f2f41c108382604e07707dc6db4c6b5be35aaeaa. The temporary Composer gate export contains 1,173 tracked source files and omits generated build output. Published packages contain no candidate path repository or rejected graphics experiment.

Validation runs directly through local commands, without GitHub Actions. Swift/iOS execution and end-to-end APNs/FCM delivery were not performed on this Linux host. This patch changes Android behavior only.

PAM Native 1.22.3

Android media, initial interaction setup, font packaging and development reload fixes.

Changes

• Media observes the route view lifecycle after attachment. Players created before a route resumes start when it becomes active; backgrounding, hidden routes and manual pause still stop playback.
• Initial press/gesture properties are configured together, reducing repeated gesture reconstruction while mounting virtualized rows. Later property updates retain their existing behavior.
• TTF/OTF assets are stored without ZIP compression so Android can map the original font bytes directly.
• Hot reload keeps the executing PHP bundle until the native worker confirms request shutdown. This fixes an observed exit255 during edit/restore, caused by deleting files needed by lazy autoloads in shutdown handlers. Reloads are serialized; obsolete bundles are removed after acknowledgement, and an existing immutable bundle is reused after Activity reattachment.

No PHP API, protocol identifier or dependency requirement changes. Regenerate the Android host with pam dev after updating the SDK.

Verification

• PHP SDK suite and protocol parity passed.
• Rust workspace tests, formatting, release CLI and Android engines for both ABIs passed.
• Full Android JVM suite: 214 tests passed, including bundle lifetime and malformed-bundle coverage.
• Android instrumented candidate gates: 10/10 passed on API26 and API36 (media lifecycle, initial interactions, recycler behavior and composed pan).
• Fresh community native and native-ui projects installed their declared Composer dependencies, including development dependencies, after manifest/metadata/dry-run validation. Native/API36 and Native-UI/API26 passed boot, source edit, source restoration and counter interaction in the same process, with two confirmed changed bundles, clean runtime logs and inspected PNG screenshots.
• Native source provenance was verified against final commit 2618ee88496e41d8f77d3871931359c52959804c; the clean export contains 1,168 files and excludes generated build outputs. The native template's earlier Composer export has byte-identical PHP SDK files; its Android host was rebuilt with the final functional fixes. Native-UI used the final export directly.
• Android font assets were verified as ZIP_STORED with unchanged source bytes. Release artifact reproducibility and size budgets passed.

Validation ran locally through direct commands, without GitHub Actions. iOS/Xcode execution and end-to-end APNs/FCM delivery were not performed in this Linux session. This patch changes Android behavior only.

• Device bundles omit the official SDK's host sources and documentation while retaining PHP, resources and Composer dependencies. Fresh native/native-ui templates stay within the development hot-reload limit without manual ignores.
• Pan gestures honor an explicit minimum hold duration before activation. The default zero-duration behavior remains immediate. This enables media reordering after a hold without dispatching move events to PHP beforehand.
• Android media keeps playback intent separate from host/attachment visibility. A late prepare or playback-rate update cannot start sound in the background; native pause controls remain respected after resume and hidden views pause.
• Drag can update a referenced numeric/clock label on the native UI thread, follow the absolute touch position and retain a continuous release position. Existing drag contracts keep their defaults. Android and iOS share the API; iOS source validation requires a macOS/Xcode host and was not run here.
• No protocol identifiers or dependency requirements changed.

• Navigation sends removal notifications when route instances are actually released, including reset, stack pruning and interrupted transitions. Kept-alive routes retain their state while parked; ordinary pushes do not remove them.
• Android p-intersect observes the drawn viewport through scrolling, detach and reattach. It emits only visibility transitions, allowing media to release decoders outside the viewport without PHP callbacks for every scroll pixel.
• ImageEditor::render(imageLayers: ...) composes private bitmap overlays, including a static GIF frame, with normalized geometry and bounded sequential decoding. Existing calls remain compatible; Android and iOS implementations share the contract. iOS source is included, but was not executed on this Linux host.
• Android development accepts PAM_NATIVE_ANDROID_DEV_PORT for concurrent projects. ADB maps the unchanged device port to the selected host port.
• No protocol additions or dependency changes.

App icons, a React Native-style splash and a shorter cold start. Zé Chat on a Galaxy S10 (Android 12, dark mode) showed ~1.7 s of a dark splash with no logo while React Native showed its own splash: the app declared no splash logo, and Android 12 draws the launcher icon there, which could only be PAM's generic icon.

• android.icon (new): adaptive launcher icon from foreground, background (colour or image) and monochrome layers. The manifest icon is now @drawable/pam_launcher; without android.icon it is the bundled PAM icon as before. Notification small icons keep pam_icon. See App icon.
• ios.icon (new): a 1024x1024 PNG written as AppIcon.appiconset with ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon. iOS uncompiled on the release machine; needs device validation.
• appearance.splash.android12Icon (new): "appIcon" keeps the launcher icon on the Android 12+ splash (no windowSplashScreenAnimatedIcon), the way a React Native/Expo theme does, and the logo only paints the API 26-30 starting window, so size may reach 288 dp (an xxhdpi 864 px bitmap). Default "logo" is unchanged.
• Android cold start: PHP boots right after the runtime is created. The native module registry (~13 ms of UI-thread work on the S10) is built while PHP boots; a module call that arrives earlier waits for it. Edge-to-edge and the bar colours, which do not change the boot metrics, are applied after the launch. The error overlay (~30 views, ~7 ms) is built the first time an error needs it.
• iOS: PamErrorOverlay builds its toast, inspector and fallback on first use. The module registry still starts with the runtime (the launch order differs from Android).
• Note for measurements: Android 12 shows the splash icon only for launches from the launcher; adb shell am start and notification launches get a plain splashBackground for every app.

Keep-alive routes give a stack navigator React Navigation tab-screen lifetime, and four Android fixes from the Zé Chat device QA on a Galaxy S10: carousels page one page per fling, a swipe past the last loop no longer pauses it, and decoded images and video players stop blocking scroll frames.

• Navigation: Route::screen(...)->keepAlive() (Router::keepAlive()). An app that draws its own bottom bar and switches tabs with navigate() lost the Feed scroll offset on every tab switch: the popped route was destroyed and rebuilt at offset zero. A kept-alive entry removed from the stack (navigate(), pop(), popToTop(), replace()) is now parked mounted and hidden, and a push or navigate with the same params reuses it with its state, native views and scroll offsets, without a visible jump. Kept-alive entries deeper in the stack stay mounted too. An optional RouteContext predicate limits it to some entries (the own-profile tab, not visited profiles); at most three entries per route are parked and reset() releases them. Parked screens get blur/focus events, not navigationRemoved(). PHP tests cover parking, reuse, deep entries, params and the predicate; instrumented tests cover the native host.
• iOS, navigation: PamNavigationHost.insert() reorders a moved route view instead of ignoring the move, so a parked route coming back on top is the transition destination (Android already moved it). Uncompiled here: needs Mac validation.
• Android, paging: Pressable pages consume ACTION_DOWN, so a paging HorizontalScrollView/ScrollView first saw the gesture at the intercepted move and paged from the dragged offset. A 700 px/250 ms fling on a feed carousel skipped two pages; a stale fling flag also skipped the snap of a later slow drag. The start page is now recorded in onInterceptTouchEvent. iOS already reads it in scrollViewWillBeginDragging.
• Android, lists: at its boundary a virtualized list released every drag to its parent even with no scrollable ancestor, so a row Pressable received the swipe as a press: each swipe up on the last Zé Chat loop toggled it to paused. The list now hands the drag only to an ancestor that can still scroll that way; otherwise it keeps it (overscroll), like React Native.
• Android, images: decoded bitmaps call prepareToDraw() on the decode thread, so the RenderThread texture upload (8.5 ms for a 1080x2042 photo) no longer lands in the scroll frame that first draws them.
• Android, video: MediaPlayer creation, data source, surface attach and detach, commands, progress polling and release run in order on one worker thread without a Looper (callbacks stay on the main thread). A feed settle that swapped the playing video blocked the UI thread 95-97 ms in binder calls to mediaserver. iOS is unaffected: AVPlayer item loading is already asynchronous.

Verified on the S10 (Zé Chat QA debug build, feed cold pass of 8 flings): the Feed keeps its offset across tab switches with no visible jump, and the remaining cold-pass jank is cell binding of the debug (JIT) build.

MediaPlayer on Android keeps the video's aspect ratio and a paused player stays paused. In Zé Chat on a Galaxy S10 a square (720x720) loop with resizeMode="contain" filled the whole portrait screen, stretched and upscaled (React Native letterboxes it), and the warm neighbour of the Loops pager (autoPlay false, muted) decoded and ran next to the visible loop: dumpsys media.player listed both players RUNNING.

• Android, fit: the TextureView fills the player box, so every frame is already stretched to the box; resolveVideoScale applied the fit scale on top of that. The view scale is now the displayed size divided by the box: contain letterboxes the whole frame, cover fills the box and crops the overflow (it over-zoomed one axis), fill keeps the stretch and center shows native pixels. Unit tests cover each mode.
• Android, paused players: MediaPlayer.setPlaybackParams with a non-zero speed starts a prepared or paused player, and every prepare applied the playback rate. The rate is applied only when it differs from 1, and a player that was not playing is paused again. Verified on the S10: one RUNNING player per Loops page, the warm neighbour PREPARED.
• iOS: unchanged. AVPlayerLayer.videoGravity already fits correctly and AVPlayer.rate is only set while playing.

A property that gives a node inside a virtualized-list cell its own native view, or takes it away, no longer rebuilds the whole cell on Android. In Zé Chat on a Galaxy S10 a double tap on a feed post liked it and its like button started its pop animation: that View had been flattened (no host property until the animation appeared), so the renderer dematerialized and rebuilt the entire post card. The media flashed for a frame, a carousel jumped back to page 1 while its dots stayed on page 2, the header's "⋯" could vanish and the double-tap heart, already playing on the UI thread, was dropped.

• Android: when a node's hosting flips (update() of a host property such as animation, nativeRef, opacity on a layout-only View) inside a mounted cell whose root is hosted, only that node is promoted or demoted in place (promote()/demote() with the hosted insertion index and the cell layout). The rest of the cell keeps its decoded images, players, scroll offsets and running motions. The cell is still rebuilt when the node is the cell root, the cell root is itself flattened, or the cell is not mounted (virtualCellHostingRepair, unit-tested). Verified on the S10: the double-tap heart plays its full ~700 ms and a carousel keeps its page.
• iOS: unchanged. It never flattens views, so the same update only applies the property to the existing view.

Safe areas are per presentation surface. On Android a full-screen Modal that was not statusBarTranslucent/navigationBarTranslucent showed an extra status-bar-tall gap at the top (and a doubled gap above the navigation bar): its Dialog window already starts below the status bar, and the SafeAreaView inside it padded the activity window's insets again. Zé Chat worked around it by making its modals translucent.

• Engine: every Modal/BottomSheet is laid out on its own surface (surface.rs). The surface viewport and the insets its SafeAreaViews see come from the window insets and a host surface policy, pam_native_engine_set_surface_policy (SurfacePolicy): 0 in-window (iOS) - full-screen and dialog modals get every inset; 1 system windows (Android 14 and older) - a non-translucent Dialog fits the system bars, so its viewport excludes them and its insets are zero, a translucent one is edge-to-edge and gets the real insets; 2 edge-to-edge windows (Android 15+ with target SDK 35+, where setDecorFitsSystemWindows(true) is ignored) - every Dialog gets the real insets. Bottom sheets never get the top inset (snap points resolve below the status bar), and neither does the active route of a navigation formSheet (and, on iOS, modal, a page sheet). position: fixed inside a modal now anchors to its surface. Incremental layout keeps the surface insets.
• Android: the host derives the policy from the release and target SDK (modalWindowSurfacePolicy) and passes it to the engine before the first frame. iOS: the bridge sets policy 0 explicitly.
• Tests: Rust surface::tests and layout tests (fitted, translucent, enforced edge-to-edge, sheets, content-sized dialogs, incremental relayout, sheet routes, FFI). Android PamSurfaceSafeAreaInstrumentedTest lays modals out with the real engine (debug-only JNI PamEngineLayoutProbe) and shows them in real Dialog windows: on API 31 the fitted window starts at the status bar and the header sits there once (it was twice); on API 36 the window is edge-to-edge and the SafeAreaView pads once; translucent and not, full screen and sheet, top and bottom. JVM PamModalSurfacePolicyTest. XCTest PamSurfaceSafeAreaTests (uncompiled on this release host).
• Apps: a translucent modal wrapped in SafeAreaView keeps rendering the same; the translucency is no longer needed to avoid the doubled gap.

Inline icon images (data:image/*, the masks behind an app's icon component) paint in the frame that lays them out and can no longer vanish. In Zé Chat on a Galaxy S10 (Android 12), the tab bar "Buscar" magnifier, the Inbox search field magnifier and the ▶ badge of explore videos sometimes stayed blank until the screen was rebuilt, and a reopened Profile painted its first frame with no icons at all.

• Cause (Android): a decode was shared through ConcurrentHashMap.computeIfAbsent and removed itself from the map in its completion stage. A tiny inline decode on the idle inline lane can finish before computeIfAbsent returns; the completion stage then runs inside the map update, remove() throws "Recursive update", and the future stored for that key is already failed and never removed. While the bitmap stayed in memory the 32 ms retry hid it; once photos evicted it (inline glyphs shared the 32 MiB photo cache), every later load of that key (same source, same 64 px bucket: the 22 dp tab magnifier and the 20 dp field magnifier share one) failed through the poisoned future, and after two retries the image stayed empty for good.
• Android: one load per decoded key is registered with putIfAbsent before its work starts and unregisters itself by identity when it completes, on any thread (InFlightImageLoads); a failed load is never reused. Inline sources up to 16 KiB decode synchronously on the UI thread in the layout pass (well under a millisecond for an icon mask), so an icon is in the first frame like a font glyph; they live in their own 4 MiB memory cache, which photos cannot evict and only a critical memory trim clears.
• iOS: data:image/* sources were not decoded at all (the image stayed empty) and tintColor on <Image> was ignored. Inline images now decode synchronously into their own cache (PamInlineImages), and tintColor renders the bitmap as a template in that color (Android imageTintList). Uncompiled on this release host; listed in docs/ios-parity.md for Mac validation.
• Tests: InFlightImageLoadsTest (a load finishing before share returns, a failed load, a throwing start, a shared pending load, the synchronous inline threshold) with NativeImagePriorityTest; XCTest PamInlineImageTests. Verified on the Galaxy S10 with Zé Chat: the reopened Profile, the tab bar and the Inbox paint every icon in their first frame.

The Android and iOS PHP runtimes have neither ext-sodium nor ext-openssl, yet the SDK called them directly: Update\UpdateVerifier (Ed25519 signature of signed OTA manifests) and LocalFirst\EncryptedJournal (AES-256-GCM) died with "Call to undefined function" on the device only. Both now go through Pam\Native\Crypto, which the native host backs on Android and iOS with the same bytes and decisions as libsodium and OpenSSL.

• PHP SDK: Pam\Native\Crypto::ed25519Verify(), aes256GcmEncrypt() (ciphertext . 16-byte tag) and aes256GcmDecrypt() (null when not authentic). ext-sodium/ext-openssl are used when loaded (desktop, server, tests); otherwise the host function pam_native_crypto(). With neither (a device host older than 1.19.0) they throw CryptoUnavailableException: UpdateVerifier refuses the update with InvalidSignature, and EncryptedJournal throws. Envelopes and signatures are unchanged: a journal sealed on desktop opens on a device and back.
• Android: PamCrypto.kt behind PamRuntime.onNativeCrypto (JNI, synchronous on the PHP worker). AES-256-GCM through the platform JCA/Conscrypt; Ed25519 verified in Kotlin on every API level with libsodium's rules (canonical S, no small-order R or public key, canonical public key, cofactorless equation); the platform Ed25519 (API 33+) skips the small-order checks, so it is not used. The 76 vectors take 235-291 ms on x86_64 emulators (under 10 ms per full verification). R8 keeps the callback.
• iOS: PamCrypto.swift installs the provider from PamRuntime: CryptoKit AES.GCM, and Curve25519.Signing after libsodium's encoding checks. Uncompiled here (Linux); PamCryptoTests to run on a Mac (docs/ios-parity.md).
• Why not compile the extensions: measured with the runtime's NDK flags, libsodium 1.0.20 is +267 KB (arm64-v8a) / +406 KB (x86_64) of code per ABI before ext-sodium's glue and its AES-256-GCM needs ARMv8 Crypto/AES-NI; OpenSSL 3.5's libcrypto is +4.2 MB per ABI. Either also needs a new PAM runtime and an iOS XCFramework rebuilt on a Mac.
• CLI: the extension audit now scans the SDK like any package (its own sources are clean and tests/runtime_audit.php keeps them so) and names the device-ready replacement in findings, e.g. sodium_crypto_sign_verify_detached() → Pam\Native\Crypto::ed25519Verify(), openssl_encrypt() → aes256GcmEncrypt(), sodium_bin2hex() → bin2hex().
• Not covered: Store\EncryptedStatePersistence (XSalsa20-Poly1305 secretbox) still requires ext-sodium and throws on the device, as before. HMAC/HKDF need nothing: hash_hmac()/hash_hkdf() are core.
• Tests: tests/Fixtures/crypto-vectors.json (scripts/generate-crypto-vectors.php: RFC 8032, GCM spec case 16, 76 Ed25519 and 48 AES-256-GCM vectors including S + L, every small-order encoding with and without the sign bit, non-canonical and off-curve keys, and mixed-order keys that separate cofactored from cofactorless verification) is replayed by tests/native_crypto.php (extensions, a fake of the host function, seeded random cross-checks, journal and OTA interop, fail-closed paths), the Android JVM test PamCryptoTest, the instrumented NativeCryptoInstrumentedTest and NativeCryptoBridgeInstrumentedTest (PHP → JNI → Kotlin through the real runtime) and the iOS PamCryptoTests. tests/device/crypto_runtime.php runs inside the Android PHP runtime. Passing on Android 8.0 (API 26) and Android 16 (API 36) x86_64 emulators.

First launch after installing or updating an Android app: the PHP bundle is one asset and the prebuilt component cache is one file. Zé Chat on a Galaxy S10, release-optimized .perf build, process start → first commit (fresh install each run; the phone was shared with other apps, so runs vary):

• Android CLI: pam-native build writes assets/pam-bundle.pnb instead of ~2,000 assets/pam/** PHP assets (and drops 1.14's pam-files.txt): an index (<sha256> <size> <p|a> <path>, c <compressed> <size> per chunk) and the PHP code (*.php, *.pam, pam-prebuilt/) as independently raw-deflated chunks of ~512 KB, stored uncompressed in the APK (noCompress "pnb"). Images, fonts, CSS and every other file stay plain assets/pam/ entries (asset://, fonts and Files.copyAsset read them from the APK as before) and are listed in the index with their SHA-256.
• Android host: the install starts with the process (PamBundleInstallProvider, before Application.onCreate and the Activity) instead of after the Activity is created. One sequential read of the pack feeds compressed chunks to 2-4 workers that inflate them and verify each file's size and SHA-256 against the index before writing it; plain assets are copied on their own thread; directories are created on first use. The index parser is hand-written (Regex parsing alone cost ~110 ms on a cold process). PamStartup (1.15.0) now waits for that install instead of running it. Staging, content-addressed activation, release pruning, OTA bundles and hot reload are unchanged. Debug/benchmark builds log bundleInstallMs (the unpack itself) and bundleWaitMs (how long startup waited for it).
• PHP SDK: PamPhpCompiler::prebuild() writes one pam-prebuilt/components/components.pack (PNC1, JSON index with every component's metadata, then class and template sources) instead of four files per component (904 files in Zé Chat). A component's class and template file (closures + template JSON in one opcode-cached file) are written from the pack the first time they are used: beside the pack when the bundle is writable (Android, per release), otherwise under PAM_NATIVE_STATE_DIR (a read-only iOS app bundle), keeping only the current pack's files. 1.14 prebuilt directories still load.
• iOS: the app runs PamBundle/ in place from the signed app bundle, so it has no install step to speed up; it gets the same single-file prebuilt cache (one bundle file instead of four per component). Uncompiled on this release host; listed in docs/ios-parity.md for Mac validation.
• What remains of the gap to a normal cold start: creating ~1,260 files on f2fs + file-based encryption (~135 µs each, serialized by the kernel, so more writer threads do not help) and the opcode compilation + file-cache writes of the first PHP run (~130 ms).

The mobile PHP runtime has no ext-mbstring (and no intl), so mb_* calls in apps and community packages (pam-native-calls's Calls::text()) died with "Call to undefined function" on the device only; Zé Chat carried its own partial polyfill. PAM Native now covers it in the SDK and warns at build time about the extensions it cannot cover.

• PHP SDK: src/Polyfill/mbstring.php is autoloaded by Composer before any application code and defines 41 mb_* functions (every one in common use: length/width, substr/strcut/str_split/strimwidth/str_pad/trim, the strpos and strstr families, case conversion with all MB_CASE_* modes, ucfirst, convert_encoding/variables, detect_encoding, check_encoding/scrub, ord/chr, numeric entities, settings) and the MB_CASE_* constants, each only when missing: a real ext-mbstring or an app's own polyfill loaded first wins. Pam\Native\Polyfill\Mbstring follows PHP 8.5's ext-mbstring, including malformed input, substitution modes, full Unicode case mapping (final sigma, Turkish ISO-8859-9), East Asian widths and the same ValueErrors, for UTF-8/16/32, UCS-2/4, ASCII, 8bit and every single-byte code page. Not covered: SJIS/EUC/BIG-5/GB18030/ISO-2022/UTF-7, mb_ereg*, mb_convert_kana, MIME headers, mb_send_mail.
• Why not compile ext-mbstring: +1.14 MB (arm64-v8a) / +1.16 MB (x86_64) of code and data per ABI (+2.1 MB of .so on x86_64 after page alignment, +0.63 MB compressed), measured with the runtime's NDK flags and no Oniguruma; it would also need a new PAM runtime release and an iOS XCFramework rebuilt on a Mac. intl (ICU, ~35 MB per ABI) stays out.
• CLI: staging an Android/iOS build runs Pam\Native\Tooling\MobileRuntimeAudit and prints a warning with file and line for each function or class (new, ::, extends, implements) of an extension the selected runtime does not compile (intl, iconv, zlib, gd, curl, dom...) that no bundled file or polyfill declares. Guarded uses, package tests/binaries and the SDK itself are skipped; findings never fail the build.
• Docs: docs/platform-runtime.md#php-extensions lists what Android and iOS have (identical sets), the polyfill coverage and the audit.
• iOS: same runtime extension set, so the PHP polyfill applies unchanged; no Swift change. Listed in docs/ios-parity.md for Mac validation.
• Tests: tests/mbstring_polyfill.php (recorded ext-mbstring results; with ext-mbstring on the host, every function compared over seeded valid and malformed strings in every encoding and substitution mode), tests/runtime_audit.php, and scripts/android-php-runtime-test.sh, which runs tests/device/mbstring_runtime.php inside the real Android runtime: passing on an Android 8.0 (API 26) x86_64 emulator and a Galaxy S10 (API 31, arm64-v8a). All 1.1M code points were also compared with ext-mbstring through every case mode, mb_strlen() and mb_strwidth().

• Plugins no longer declare a plugins.share.v1 capability for share. 1.16.0 accepted it at prepare, but the PHP runtime's Protocol::CAPABILITIES does not list it, so a plugin requiring it failed discovery at startup (pam-native-share-extension 0.3.0). Prepare now rejects it like any other unknown capability, and a test keeps the CLI's plugin capabilities within the runtime's. Gate share with pamNative.minimum 1.16.0 instead.

Plugins configure the content they receive from share sheets per application. Before, pam-native-share-extension hardcoded */* (Android SEND and SEND_MULTIPLE, iOS any file), so every app using it was offered for every share, PDFs included.

• Plugin manifests declare share (configKey, default accept and multiple) with the new plugins.share.v1 capability. Applications override accept/multiple under plugins.<configKey> in pam-native.json (new plugins section).
• Android prepare adds one SEND intent filter per accepted type to the launcher activity, with SEND_MULTIPLE only for the types in multiple, merged with android.shareTargets.
• iOS prepare replaces the plugin Share Extension's NSExtensionActivationRule: text/URL, image and movie counts for text/plain, image/*, video/* and */* (unchanged legacy rule), and a SUBQUERY type-identifier predicate for specific types such as application/pdf. Uncompiled on this release host; listed in docs/ios-parity.md for Mac validation.
• Prepare fails on a plugins key no installed plugin declares, duplicate configKeys, invalid MIME types and multiple types missing from accept. JSON schemas and docs/plugins.md describe the contract.
• Tests: resolution, merge, Android filters on the real manifest template, legacy/media/predicate activation rules, invalid configuration.

Telegram-style cold start: the system splash goes straight to the app's first PHP frame, with nothing in between, and that frame arrives sooner. Measured on a Galaxy S10 (Android 12), release-optimized .perf Zé Chat build, START to the first frame with content (screen recording) and Fully drawn, 3+ cold starts each (the shared .perf install was logged out, so the measured screen is Auth; it streams in two PHP frames like the Inbox snapshot streams in one):

• Android: the engine library and the bundle resolve on a startup thread from the top of PamActivity.onCreate; on API 30+ PHP boots before the rest of the native surface is built, with the window bounds and system-bar/cutout insets from WindowMetrics (below API 30 it boots from the held first pre-draw, once insets exist). The launch thread runs at display priority, which the PHP worker inherits.
• Android: the window's first draw is held (pre-draw) until the first PHP frame is committed, so the system splash / starting window stays up until the app has content. Released on runtime errors (the overlay or fallback must show) and after a 4 s safety timeout. A re-created Activity holds until its remount commits.
• Android and iOS: a surface's first batch mounts as soon as it reaches the UI thread instead of waiting for the next vsync / display-link tick.
• Android: while PHP boots, the UI thread prebuilds the first frame's views in 2 ms slices (containers, text, pressables, images, inputs, one list) and warms the spinner and scroll classes; the first commit takes them from the pool. ActivityIndicator's first instance cost 10–12 ms on the S10.
• iOS: the launch-screen cover is always installed (logo optional) until the first PHP frame, hidden on a fatal error and after 4 s; PHP boots with the window's safe area when the root view has not been laid out yet. Uncompiled on this release host; listed in docs/ios-parity.md.
• BottomSheet (Android): the first presentation was sized from displayMetrics.heightPixels before the dialog existed and never re-sized. It now estimates from the covered window and its insets and re-resolves on the first layout (and on width changes) within the same traversal. A fitted (base) sheet no longer subtracts the status bar twice and rests on the navigation bar; an edge-to-edge sheet (navigationBarTranslucent / statusBarTranslucent) resolves against the window minus the top inset and reaches the screen bottom. iOS already re-sized on layout.
• Navigation: Navigator::reset() followed one tick later by a push could land natively on the reset route while PHP's current route was the pushed one (a cold-start deep link opened the Inbox instead of the chat). When both reach the host in one commit, the new routes are created in node-id order and Android took the last inserted route as the destination, while the FragmentManager re-added each route after the previously added fragment's view. Route views now keep the engine's order and the destination is read from it, whatever the commit timing. iOS already used the route order.
• Tests: PamBottomSheetSizingTest; resetThenPushLandsOnThePushedRouteWhateverTheCommitTiming (fails on 1.14.2); XCTest testResetThenPushInOneCommitLandsOnThePushedRoute.

An autoFocus input in a Modal/BottomSheet presented while an overlay
before it closes gets the keyboard again. In Zé Chat, long-press on one's own
message → Editar opened the "Editar mensagem" sheet without the keyboard on a
Galaxy S10 (Android 12), 3 out of 3 times.

• Cause: removing the closing overlay shifts the sheet's index, so the engine
  emits a Move for it. The renderer detached and re-attached the moved view
  even though it kept its place among its host's views. Detaching a
  PamModalHost dismissed its Dialog and re-created the window 40 ms after
  it was shown, so the IME the autofocus pipeline had already requested was
  hidden (HIDE_UNSPECIFIED_WINDOW) and the new window had no focused
  editor (SOFT_INPUT_STATE_ALWAYS_VISIBLE is ignored).
• Android: move() leaves the view attached when its hosted position does
  not change; PamModalHost keeps its window across a detach that is undone
  in the same main-thread turn (a host that stays detached still closes it);
  the autofocus pipeline logs why it stops (PamAutoFocus).
• iOS: move() keeps the view in its superview when its sibling position
  does not change (removing it resigned the focused field). Uncompiled on
  this release host; listed in docs/ios-parity.md for Mac validation.
• Tests: PamSheetKeyboardInstrumentedTest.autoFocusInASheetMovedByItsClosingOverlayKeepsWindowAndKeyboard
  (fails on 1.14.1 with focus=false), passing with the rest of the
  render suite on an Android 12 (API 31) emulator; XCTest
  testMoveThatKeepsThePositionLeavesTheFocusedInputInPlace. Verified on the
  Galaxy S10: 3/3 openings with the keyboard up and the sheet above it.

Pinned sticky headers in VirtualizedList and VirtualGrid are real, interactive views (FlashList parity). Zé Chat's ChatDetails had to host its sticky tab bar in a ScrollView because a tap on the pinned tabs reached the row scrolling underneath.

• Android: the pinned header was a bitmap copy of the sticky cell drawn over the list (and re-captured on every frame), so presses, pressed state and accessibility went to the row below. It is now a real RecyclerView child: the layout manager ignores it (never scrapped or recycled while pinned), leaves it out of its child count and appends rows before it, so it stays the last child, drawn and hit-tested first. The cell's native views move into the pinned holder and back to their row (or unmount when the row is gone), so their state (a horizontal tab rail offset) survives pinning. A pinned holder owns every touch inside its bounds, its non-interactive background included. The next sticky cell still pushes it away. All of it runs inside the layout manager's scroll and layout passes: no PHP call and no bitmap copy per frame; rows keep virtualizing.
• iOS: ScrollView and VirtualizedList/VirtualGrid hosts hit-test their sticky children before the rows (zPosition only reorders drawing), so a press on a pinned header never reaches the row under it. Uncompiled on this release host; listed in docs/ios-parity.md for Mac validation.
• Tests: PamVirtualListStickyHeaderInstrumentedTest (press on the pinned button, background tap that no row receives, pressed state, accessibility visibility, push by the next header, VirtualGrid, stepping through the list with no blank row and exactly one mounted header, a commit while pinned), passing on an Android 12 (API 31) emulator; PamStickyHeaderPositionsTest; XCTest testPinnedVirtualListHeaderReceivesTouchesInsteadOfTheRowUnderIt.

Per-component render cost and first launch after install (Zé Chat inbox on a
Galaxy S10, release-optimized .perf build, against 1.13.3):

Host (scripts/benchmark-inbox-render.php / benchmark-chat-render.php,
PHP without JIT): inbox first render 9.6 → 2.7 ms, realtime row update
7.7 → 1.9 ms, filter back 6.7 → 1.7 ms; chat first render 17.8 → 7.1 ms,
incoming message 8.9 → 2.7 ms. Encoded frames are byte-identical.

• Templates: every node's directives, attribute classification, events and
  slot split are planned once; resolved styles/values are cached per (node,
  sheet environment, class list, ancestor chain, inherited styles); common
  native elements (View, Row, Column, Text, Image, Pressable...) and
  compiled component tags take fast paths that build each element as one
  object with precomputed constant properties, class tokens and inherited
  text styles. Native property conversions are memoized.
• Template expressions (and :class array literals) compile to plain PHP
  closures with the same grammar, eager evaluation order, missing-value
  rules and diagnostics; the closure-tree evaluator stays as reference and
  fallback (a differential test compares both).
• Encoder: memoized component subtrees (keyed rows and component elements)
  are reused through C-level array unions with their callbacks and encoded
  bytes, callback merging is incremental (was O(N) per reused subtree), and
  patches skip unchanged node objects.
• Build-time component cache: pam-native build and update bundles run
  PamPhpCompiler::prebuild() on the host, writing pam-prebuilt/components
  (class, runtime template, generated expressions) keyed by project-relative
  paths and validated by source/stylesheet fingerprints, so an installed or
  updated bundle compiles nothing at boot; an edited component (hot reload)
  still compiles into the writable cache.
• Android: the CLI writes assets/pam-files.txt; the first launch copies the
  bundle from that listing in parallel and verifies each file's SHA-256 while
  it streams (no AssetManager.list() walk). Debug/benchmark builds log
  bundleInstallMs (PamNativePerf).
• Runtime: press and gesture handlers that elements wrap to decode payloads
  (on:pressIn, on:pressOut, on:pressMove, on:doubleTap, image, media,
  input, modal and sheet events) now mark only their component, like
  on:press: one double tap or press-in re-renders one memoized row instead
  of the whole tree (no more HoldPressable workaround needed).
• Component snapshots and profiler spans are cheaper per render.

• Android: autoFocus on an input inside a presented BottomSheet opens the
  keyboard on Android 11-14 (Zé's "Editar mensagem" on a Galaxy S10, where
  1.13.1 still issued no show request). The interactive sheet window keeps
  adjustNothing with an unspecified soft-input state, so the system never
  shows the IME when the window gains focus, and a request made before the
  IME serves the remounted input is dropped by the client. While an
  autoFocus input is pending, its modal window now asks for
  SOFT_INPUT_STATE_ALWAYS_VISIBLE (the platform itself shows the IME for
  the focused editor on focus gain) until the IME is visible (4 s at most);
  the input asks again as soon as the IME creates its input connection; and
  focus/keyboard retries are bounded by wall-clock time (3 s), not by attempt
  counts that a long UI-thread frame could burn in one burst.
• PamAutoFocus logcat lines (focus gave up, waiting for window focus,
  connection created, show issued, IME visible) trace the path on devices.
• PamSheetKeyboardInstrumentedTest: Zé's flow (kept sheet presented under
  a closing transparent overlay, multiline natively-synced input remounted
  with a new key and autoFocus, a 1.2 s UI-thread stall), passing on an
  Android 12 (API 31) emulator with three-button navigation.

Zé Chat cold start on Android: a position: absolute; top: -200px child of
the root crashed every launch.

• Protocol: a layout frame's origin may be any finite value. CSS offsets and
  negative margins (top: -200px, left: -34px, margin-top: -14px) put a
  box outside its parent; only width/height must be finite and
  non-negative. The Android decoder read all four values as non-negative and
  threw ProtocolException("Layout value must be finite and non-negative");
  the iOS decoder had the same rule ("Invalid layout value"). Both now read
  origins as finite coordinates and sizes as finite non-negative extents.
• Rust: Layout::is_valid()/sanitized(). The layout engine sanitizes every
  frame it emits (negative origins are kept), the encoder refuses an invalid
  frame and decode_batch rejects one (ProtocolError::InvalidLayout).
  PROTOCOL.md documents the rule.
• Android: a rejected batch no longer cascades into "Node N cannot contain
  children". The engine had already retained the dropped batch, so later
  patches targeted nodes the host never created. The runtime now replays the
  retained tree: a rejected batch, or a commit that throws part-way, clears
  the renderer (PamRenderer.resetTree()) and applies a full remount. A
  failing remount is reported and not retried.
• iOS: a rejected batch replays the retained tree onto a fresh renderer on
  the same host view.
• Tests: one golden negative-origin batch pinned by Rust, Android and iOS;
  invalid frames (NaN/infinite origins, negative/infinite sizes) rejected on
  all three; engine negative offsets and margins; instrumented negative-origin
  mount and reset + remount of a half-applied tree.

Zé Chat device QA on 1.12.2 (Galaxy S10, Android 12).

• Android: autoFocus on an input inside a just-presented BottomSheet or Modal opens the keyboard, also when the input is remounted (a new key per open) in a re-presented or already-presented sheet. The renderer waited at most 200 ms for window focus and asked the IME once; on Android 11-12 a request from a window that is still gaining focus is dropped. It now waits for the input's own window focus (OnWindowFocusChangeListener), asks that window's insets controller (show(ime())) and the IMM, and re-asks until the IME is reported visible. The modal no longer moves focus to its first focusable (a header button) when an input already took it.
• Android: a <Modal transparent presentation="fullScreen"> whose flattened full-height Column ends in a short options sheet (Zé's OptionDialog) is a short sheet over the translucent backdrop again. Every child hosted by a full-screen modal was forced to MATCH_PARENT, which drew the sheet as an opaque full-screen window with its title at the top. Only a child spanning the modal fills the window now; a bottom-anchored child keeps its height at the window bottom and other children keep their frames.
• PamSheetKeyboardInstrumentedTest: remounted autoFocus input with a focusable header button (first open, re-open, remount in an open sheet), and a screenshot pixel test of the transparent options modal (backdrop over the screen above, white sheet in its 44 % frame).
• iOS needs no change for either issue beyond 1.12.2 (autoFocus retried after presentation; no layout-only flattening).

Cold start (Zé Chat on a Galaxy S10, release build): first PAM frame 870 ms -> 290-370 ms; the logged-in inbox shows its rows ~470 ms after launch.

• Component discovery no longer re-tokenizes every .pam file on each boot. An unchanged component (xxh128 of its source, the src/app.css location and every stylesheet it imported) reuses its cached class/tag, and its template tree is decoded lazily on first render. Zé Chat (103 components, 4.3 MB of source): 590 ms -> 16 ms per cold start. Editing a component or any CSS it imports still recompiles it.
• An unchanged dimensions event (hosts re-send the window on every surface bind, including right after boot) keeps the WindowMetrics instance and no longer invalidates and re-renders the whole tree. Android exports the full style environment in PAM_BOOT_METRICS so the first event matches.
• android.benchmarkApplicationIdSuffix and pam-native build --benchmark: the installable release-optimized variant (R8, non-debuggable, baseline profile, signed with the local debug key) is written to dist/<name>-<version>-android-benchmark.apk and can install beside production for cold-start measurements; such builds omit Firebase. run --release, benchmark and profile use the same package.
• The Android baseline profile covers the whole dev.pam.nativeapp host.
• Android: an OTA slot activated over an older APK bundle is discarded when a new APK ships a different embedded bundle, so a reinstall never keeps running the previous PHP release until pm clear.
• iOS parity: the component cache and lazy templates are shared PHP; the stale OTA slot rule (keyed on the embedded manifest.sha256) and the full PAM_BOOT_METRICS environment are ported. Uncompiled; needs Mac validation.

• Android: a BottomSheet with keyboardBehavior="interactive" (Zé's "Editar mensagem") rides above its own keyboard again. The sheet window keeps adjustNothing and read the IME from its content view, where a window fitting system windows (Android 11-14, the Galaxy S10) had already consumed the insets, so the field and Save button stayed behind the keyboard. The IME is now read on the dialog's decor view and followed frame by frame (WindowInsetsAnimation); the sheet's bottom edge is put on the IME top from the real window geometry (edge-to-edge or not).
• The covered window ignores the sheet's keyboard: a panning KeyboardAvoidingView (the chat composer) only avoids the IME of its own focused window, like the root host since 1.12.0.
• While the keyboard lifts a sheet, a tap on its upper part is no longer taken for a backdrop tap and dragging starts from the lifted position.
• autoFocus inside a sheet waits (up to 1 s) for the sheet window's focus before opening the keyboard.
• PamSheetKeyboardInstrumentedTest: tapped and auto-focused sheet inputs end directly above the IME with Save visible; the base composer and root IME inset stay at 0; Back settles the sheet.
• iOS: presented sheets follow keyboardWillChangeFrame with the keyboard's duration and curve, the screen below ignores the keyboard of an input inside a presented modal, and autoFocus inside a sheet runs once it is presented. Uncompiled; needs Mac validation.

• Android: taps inside a Pressable nested in another Pressable reach the view under the finger again. Hit-slop delegates (every Pressable registers a minimum-touch-target delegate, routed before child hit testing) used the platform TouchDelegate, which re-centres each event in its target: a Pressable panel inside a Pressable backdrop sent every tap to the child at its centre, so all tiles of Zé's message-actions overlay fired the 5th ("react"). Delegates now keep the touch position (clamped onto the target only for slop points) and large-enough targets are not delegated at all. PamNestedPressableInstrumentedTest taps 12 tiles in nested Pressables and in a re-opened Modal and expects 12 distinct ids.
• Bottom sheets (Android and iOS) start drag-to-close only when the scrollable under the finger is at its top (gorhom semantics), instead of checking the sheet's non-scrolling direct child; a downward drag inside a scrolled list scrolls it. PamSheetNestedScrollInstrumentedTest.
• iOS needed no hit-test change (UIKit hit testing never re-centres); the new PamNestedPressableTests and the sheet change are uncompiled and need Mac validation.

Keyboard, safe-area, input and text-fit fixes from Zé Chat device QA (Galaxy S10, Android 12, three-button navigation).

• Keyboard avoidance is laid out by the engine. Hosts report the visible IME height (pam_native_engine_set_keyboard_inset; Android WindowInsets IME, iOS keyboardWillChangeFrame) and a KeyboardAvoidingView behavior="pan" that ends a vertical container (a chat composer after a flexible timeline) is laid out directly above the keyboard while the flexible siblings shrink, like adjustResize / react-native-keyboard- controller. The composer is visible, tappable and reported at its real bounds; the timeline keeps its last rows above the composer. Modal content is excluded (modal windows resize themselves). See docs/android-safe-area.md.
• Android: a translated keyboard-avoiding container is lifted above siblings with a higher z-index (the composer was drawn under a z-index: 1 timeline); the root host's inset handling keeps running while a KAV is mounted; the IME height is reconciled from the settled window insets.
• Closing the keyboard with Back or the IME key while an input keeps focus blurs it, so on:blur handlers restore resting layout (the composer went under the navigation bar).
• A window covered by a dialog, BottomSheet or permission prompt keeps its safe-area insets and ignores that window's IME.
• Controlled inputs: a rendered value echoing an older change event never overwrites newer IME text (React Native mostRecentEventCount; dropped characters such as "qa teste" -> "qa test"); authored values still apply. Plain inputs no longer remove a digit on Backspace ("J6pKK..." -> "JpK"): the masked-input digit rule now applies only to formatted inputs. iOS has the same echo guard.
• Text keeps its measured (ceiled) pixel width and height when frames are snapped, and a parent snapped one pixel narrower than its fractional frame is no longer treated as a reduced viewport. Fixes clipped avatar initials ("QA" drawn as "Q") and ellipsized bold labels ("Curtir" -> "Cur...", "Salvar" -> "Salv...").
• Modals: the dialog is tracked before it is shown, Back (down and up) is owned by the modal window, legacy cancellation suppresses the navigator Back, and a sheet opened while the keyboard hides settles at the bottom.
• PHP error_log() and logged errors reach logcat (tag PamPHP) for the whole process lifetime, including re-attached Activities.
• Tests: PamKeyboardInstrumentedTest (composer above the IME, Back blur, stale echoes, Backspace burst, unfocused window insets, overlay -> sheet in one commit), PamTextClipInstrumentedTest (pixel tests), engine layout tests, JVM and XCTest echo tests. iOS changes are not compiled here and need Mac validation.

• :key (or key) on a p-for child is the loop identity exactly like p-key: the component instance, identity slot and native id follow the item, and duplicate keys are reported. Unkeyed loops keep one identity per iteration index.
• New device-path tests drive p-for loops of components (:key, p-key, unkeyed) through the runtime, decode the committed frames like a native host and dispatch presses by native node id with a pointer payload: every iteration runs its own callback on its own component instance across reorders and conditional siblings.

Unkeyed siblings keep their native identity when a conditional sibling appears or disappears (React-like reconciliation). Behaviour change: apps no longer need :key on every sibling of a p-if to avoid remounts.

• The tree encoder identifies unkeyed children by their static slot (template position or builder argument position) instead of their output index. A false p-if, the inactive p-if/p-else branch, If/Show/Match/ Await blocks, an empty p-for and null/false children passed to the Element API (View, Column, Row, Screen, SafeAreaView, Pressable, Grid, VirtualizedList, ...) leave a hole, so the siblings after them keep their identity: a sheet Modal no longer inherits the native host of a removed full-screen overlay Modal, and a VirtualizedList or TextInput after a conditional banner is not remounted (no empty timeline frame, focus and IME are kept).
• p-for children are identified by p-key (stable across reorders); unkeyed loops with more than one item log a one-time development warning.
• Slot content and component roots take the slot they are rendered at; slotted children mixed with positional children in PHP builders fall back to their position instead of colliding.
• Identities stay encoder-side: the wire protocol is unchanged and both Android and iOS apply the resulting moves by id. Unkeyed template nodes get new identities once after upgrading (a single remount on the first frame).

Lifecycle and mount-cost fixes from Zé Chat device QA.

• Android relaunch after Back at the root no longer stays on the splash/dark window. Embedded PHP is now process scoped: a destroyed PamActivity only detaches its surface and the next Activity re-attaches to the live runtime (renderer, modules and callbacks rebound) while the engine replays the retained tree as a full mount (pam_native_engine_remount), in order with the worker's batches. PHP state survives; nothing re-executes. Relaunch renders in ~60 ms on the API 36 emulator (PamActivityRelaunchInstrumentedTest, budget 1 s).
• Root cause of the 1.7.0 Scudo abort ("corrupted chunk header" on the PHP worker after the Activity stopped): the bridge stored request-allocated (emalloc) strings in PHP's persistent ini configuration hash and php_embed_shutdown freed them with free() (zend_hash_destroy ← php_shutdown_config). The ini defaults are now persistent strings, and shutting the runtime down never blocks the UI thread.
• CloseApp (Back at the root of a stack) follows React Native's invokeDefaultOnBackPressed(): Android 12+ moves the root task to the background instead of finishing it; older releases finish and re-attach.
• Native module results above the bridge limit (raised from 1 MiB to 32 MiB) reach PHP as a Failure with a clear message instead of being dropped, on Android and iOS.
• Android mount: no full-tree passes per commit. Hosted insertion indexes walk the host's children instead of every node, sibling lists use binary insertion (prepends were quadratic), only changed virtual lists are re-synced, StatusBar merging scans status-bar nodes only and touches the window/insets controller only when the merged state changed, host background is written on change, local modal triggers skip plain pressables, unmaterialized list rows skip layout work. Debug builds on the emulator: inline-keyboard tap 2.4 → 1.7 ms, timestamp refresh 1.9 → 1.6 ms (p50); release builds were already ~0.6 ms / ~0.8 ms. Batch decode stays on the PHP worker thread; prepending a 30-row page mounts no off-screen views and keeps the scroll anchor.
• Regression tests: virtual lists never draw a blank viewport when every visible cell changes props, is promoted to a host view, resized at the end or re-keyed in one commit (PamVirtualListRebindInstrumentedTest).
• iOS (written on Linux, bridge syntax-checked, Swift needs Mac validation): same remount bridge (pam_native_runtime_remount), PamRuntime.attach(hostView:)/detach(), PamNativeViewController re-attaches to the live runtime; renderer uses binary sibling insertion, dirty-list syncing and re-binds modal triggers only on structural or marker changes.

• iOS SQLite reuses compiled statements per database (32-entry LRU keyed by SQL, oversized one-off statements excluded, finalized on close), matching Android's SQLiteDatabase statement cache; pam-native-nitro upserts, batches and paged reads no longer re-prepare SQL on every call. Statements are reset right after use so cached reads never hold a WAL snapshot.
• iOS: onTextLayout and ellipsizeMode="marquee" on Text are owned by PamTextView (1.9.0); the 1.8.0 UILabel fallback no longer duplicates text-layout events or reconfigures PamTextView.
• Uncompiled on the release machine (no Xcode); needs Mac validation (SQLiteStatementCacheTests).

iOS rendering parity with the Android 1.2.0–1.7.0 releases (CSS paint and effects, typography, layout, components and the error overlay). See docs/ios-parity.md. Swift and the iOS bridge were written on Linux: the bridge was syntax-checked with the PHP headers, the Swift sources and the new XCTest suites are uncompiled and need Mac validation.

• Text: Text draws with a CoreText layout (PamTextLayout) that the Rust engine also uses to measure every text box (pam_native_ios_set_text_measurer, installed before the first frame): React Native iOS line-height rule (scaled by fontScale), pixel-ceiled sizes, first baselines, numberOfLines ellipsis modes, adjustsFontSizeToFit, nested spans with per-span press (SpanPress), text-shadow, font-feature-settings / font-variant-numeric, text-align: justify, on:textLayout and marquee. A bare fontFamily resolves bundled files by React Native conventions; <Icon> fonts load from asset://.
• CSS paint/effects: per-side border colors, per-corner radii, transform-origin and % translations, linear/radial/repeating gradients with premultiplied stops clipped to the radius, border-image gradient rings, multiple/inset/spread box-shadow as cached Core Animation shadow paths (outer shadows of overflow: hidden views live in a sibling layer), image filter/blurRadius (blur with opaque edges + color matrix), backdrop-filter: blur(), <Shimmer>. Filters on non-image views and backdrop color functions log a one-time debug diagnostic.
• Layout: the engine owns SafeAreaView insets from boot (window insets set before the worker starts, PAM_BOOT_METRICS exported, native insets never applied twice, geometry changes relayout), on:layout, ScrollView content size (previously never set on iOS), sticky headers in ScrollView and VirtualizedList, <ScrollView keyboardInset>, lists resting at their end stay there, scroll targets use the real viewport, and scrolled-out cell views are pooled by kind and property set.
• Components: MediaReadyEvent natural size/duration, on:mediaLoadStart, on:buffering; pressed-state translate in points; Toast::message() card; Modal backdropColor/animationType (incl. slide-fade)/ transparent; bottom sheets slide while the backdrop fades and resolve % snap points against the container minus the top inset.
• Runtime: LogBox-style error overlay (toast, scrollable inspector, Dismiss/Copy/Reload, queue and repeat counter, release fallback with retry, devErrorOverlay → PamDevErrorOverlay), coalesced events of removed nodes are dropped, media cache identities are hashed once with a fast hex encoder.
• CLI/host: appearance.splash builds the iOS launch screen (App/PamLaunch.xcassets, light/dark background, PNG logo) and the host keeps the logo until the first frame.
• PHP SDK, Rust workspace, CLI and protocol parity tests passed locally.

iOS parity for the 1.5.0 gestures/animations and the 1.1.x native modules. See docs/gestures.md, docs/animations.md and docs/native-capabilities.md.

• iOS motion runs on the main thread with no PHP round-trips while a finger moves: PressEvent coordinates for press/long press, delayLongPress, press-in/out delays (hold-to-record), on:doubleTap with deferred single press and TapEffect (heart burst), Drag (rubber band, drivers on nativeRef views, snaps with spring/timing settle, threshold/velocity release, haptic tick, groups, dragSnap), Swipeable, animation programs and presets, replayKey, per-property CSS transitions with spring(), per-keyframe easing, scroll begin/end drag and momentum end with page index, list pagingEnabled, on:textLayout, ellipsizeMode="marquee" and the slide-fade modal. The spring solver matches Android/PHP durations exactly.
• iOS native modules: Http::multipart() and upload transfers with progress and cancellation, Image::prefetch(), conversation notifications (communication notifications with avatar, inline reply, mark as read), durable Notifications::onAction() queue with native ActionEndpoint delivery, PushRendering for background (content-available) pushes with route suppression and PushMessage::$rendered.
• Screen::secure() on iOS: screenshots cannot be blocked, so secure mode shields every window while the screen is recorded/mirrored (UIScreen.isCaptured) and while the app is inactive (app switcher).
• iOS host: forwards APNs registration, background pushes and notification responses; declares remote-notification and INSendMessageIntent.
• Views with a transform are laid out through bounds/center on iOS.
• Tests: XCTest mirrors of the Android motion, drag, transfer and notification suites. Swift sources were parse-checked with Swift 6.1 and the pure motion and HTTP logic type-checked and exercised on Linux; the UIKit code was not compiled (no Xcode) and needs Mac validation.

LogBox-style runtime error overlay. See docs/error-overlay.md.

• Dismiss fixed: the old overlay grew with the stack until its Dismiss button was pushed under the navigation bar, and any committed frame silently cleared it. Dismiss now always closes the error, Back closes the inspector, a dismissed error is not re-shown until the runtime reloads (no re-show loop), and the overlay never swallows touches outside its toast.
• Debug builds: non-fatal errors show a compact bottom toast that expands into a full-screen, scrollable inspector: exception class and message in large text, app frame first with app-relative paths (/data/user/0/<pkg>/files/pam/releases/<hash>/ stripped), source snippet, collapsible framework/vendor frames, wrapped monospace stack, Dismiss / Copy / Reload, and ‹ 1 / N › for queued errors (repeats count as ×N). Fatal render/boot errors open the inspector directly. Respects safe areas and the light/dark appearance.
• Release builds never show stacks: non-fatal errors are logged only; fatal errors retry with a fresh runtime and then show a localized "Something went wrong" / "Algo deu errado" screen with Try again (event-handler errors no longer reload the whole app). pam-native.json devErrorOverlay: true (default, debug only), false, or "always".
• App::onError(Closure(Throwable, RuntimeError)) / offError(): crash reporting hook (Sentry, observability) for every uncaught error, with phase (boot, render, event, module), fatal(), classified frames and a fingerprint.
• Module failures reach the caller: SQLite::execute/query/executeMany/ transaction and Storage::get/set accept onError, and NativeModules::call/callRaw accept onFailure, so failures such as "Native module value is too large" go to that callback instead of the overlay. Without one they surface as a non-fatal Pam\Native\Modules\NativeModuleException (a RuntimeException).
• SQLite results over the 1 MiB bridge limit fail with an explicit size and paging hint; a native module that throws synchronously now completes with a failure instead of crashing.
• Diagnostics payload version 2 (phase, fatal, frames, appFrame, snippet, fingerprint); version 1 and plain-text errors still render.
• Android strings are translated to Portuguese (values-pt).

Fixes for the React Native parity releases (1.4.0+), found on a Galaxy S10.

• Release builds measured text with the estimator: R8 stripped the JNI text-measurement callback (PamRuntime.onMeasureText), so minified builds silently fell back to the portable estimator (wrong text box heights, e.g. line pitch not following fontScale). The callback is now kept, with a unit test that every JNI callback looked up by the bridge has a keep rule.
• SafeAreaView inset race: the runtime now starts with the window safe area already set in the engine (and the renderer in engine-managed mode) before the first PHP frame, reconciles insets right after the off-UI-thread start, and drops any native SafeAreaView padding applied earlier, so a root SafeAreaView is never inset twice or not at all and its descendants are never shifted.
• Text::rich()/<Span> and Icon no longer require ext-mbstring (absent from the Android PHP runtime).
• Regression tests: engine layout of the Zé chat header under a top-edge root SafeAreaView, renderer ordering (legacy frame → engine insets), lineHeight × fontScale 1.1 parity, ProGuard JNI contract.
• examples/layout_dump.rs prints engine frames for a captured render frame and window safe area.

React Native component parity on Android. See docs/react-native-components-parity.md.

• <Icon font name size color> / Pam\Native\UI\Icon: react-native-vector-icons glyph maps (assets/fonts/{Font}.ttf + {Font}.json, or Icon::register()) rendered as icon-font text, measured like React Native.
• Sticky headers (stickyHeader="true", Element::stickyHeader()) in ScrollView and VirtualizedList.
• VirtualizedList: multi-column rows and horizontal cells are content-sized too (tallest cell per row); fullSpan="true" (Element::fullSpan(), protocol ListFullSpan` 523) for header/footer rows in multi-column lists.
• :active now applies like :pressed; pressed-state transform: translate… is in points and applies to Pressable (React Native translateY: 1.1).
• MediaPlayer: on:mediaLoadStart, on:buffering, on:ready with MediaReadyEvent (natural size, duration); existing handlers keep working.
• Toast::message() in-app toast with title and message (react-native-toast-message styling, position, duration, colors, font). iOS shows the message with the system presentation.
• <ScrollView keyboardInset>: keyboard-aware bottom content inset.
• overflow: hidden clips to the padding box with inner radii, so border rings stay visible around clipped content (avatars), like React Native.
• Bottom sheets: backdrop fade and sheet slide animate independently; percentage snap points resolve against the container minus the top inset.
• A bare fontFamily resolves bundled files by React Native naming conventions ({Family}-{Weight}.ttf, _bold, …) without synthetic bold when an exact file exists.

Virtual list layout and scroll fixes (chat timelines).

• Behaviour change: single-column VirtualizedList cells without an authored height are now content-sized, like React Native FlatList cells. rowHeight/estimatedRowHeight remains the prefetch estimate and the extent of empty cells or cells whose content has no definite intrinsic height (e.g. percentage-sized media). Previously every such cell was clamped to the estimate, so variable rows (chat bubbles, comments) were clipped and overlapped. Multi-column grids keep the previous behaviour.
• Intrinsic and flex measurement wrap a column child's text at the child's own cross size (its horizontal margins and min-width/max-width), so capped content-sized boxes no longer clip their wrapped lines.
• Android: explicit scroll targets inside rich virtual cells are aligned with the adapter's per-cell pixel extents and the list's real native viewport (no accumulated rounding drift, no hidden end rows when host insets shrink the list). An initialScrollIndex applied in the same commit no longer overrides an explicit scroll request, and a list resting at its end stays there when its cells are re-measured or its viewport shrinks.
• CLI: a linked git worktree (whose .git is a file) is treated as a source checkout, so its locally built engine is no longer replaced by the release archive.

Render pipeline performance, part 3 (from a Galaxy S10 cold-start trace and the chat benchmark fixture). Chat fixture on an API 36 emulator, 3 runs (1.2.2 → this release): scroll jank 6.0% → 2.9%, scroll frame p90/p99 26/61 → 16/32 ms, typing frame p90 19 → 16 ms; app threads have no frame over 16 ms during scroll in a Perfetto trace (remaining jank is emulator composition).

• Images: cache identities are hashed once per source and hex-encoded without String.format, which serialised the three image threads on ICU locale locks and accounted for most of their CPU at cold start on device.
• Lists: image and pressable cell views are pooled too; recycled image views are cleared so a reused row never shows the previous row's pixels, and pressables drop pressed state and local trigger actions.
• OPcache: 128 MB shared memory, 16 MB interned strings and 16000 scripts so large apps fit, and freshly installed bundles are cached on first launch (bundles are activated atomically by rename).
• iOS: the PHP worker drains events and module results and renders once per batch through Runtime::deferRendering()/flush() (12 ms budget), and collects cycles only when idle.
• Android API 36 instrumented suite (268/268), Android unit, PHP SDK and Rust tests passed locally. The iOS bridge was syntax-checked only (no Xcode).

Gestures and animations on the UI thread (React Native Reanimated + gesture-handler parity for the Zé Chat rewrite). During a drag or an animation PHP receives no events; it gets the final semantic event only.

• Press: on:press/on:longPress handlers typed PressEvent receive x/y (RN locationX/Y) and pageX/pageY; untyped handlers keep the empty payload. Hold-to-record works with delayLongPress + on:longPress
  • on:pressOut.
• Double tap: on:doubleTap (+ doubleTapDelay) defers and cancels the single press natively; tapEffect (TapEffect) plays an animation centred on the tap (Reels heart burst) before PHP is notified.
• Drag (Pam\Native\Animation\Drag, :drag on a pan GestureDetector): bounded one-axis drag with rubber band, per-frame drivers on nativeRef views (opacity, translate, scale, rotate, borderRadius), snap points with spring or timing settle, distance/velocity thresholds, haptic tick, groups and programmatic dragSnap="index@request". GestureEvent gains snapIndex/thresholdReached; new on:gestureSettle (GestureSettleEvent).
• Swipeable (PHP and <Swipeable> tag): left/right action panels, spring open/close, one open row per group, closeRequest.
• Animation programs (Pam\Native\Animation\Animation): timing, spring, set, wait, sequence, with, then, delay, repeat and replay key(), attached with :animation on any element or <Animated :animation>; presets heartBurst, likeBounce, backToTop, shimmer, pulse, marquee, fadeInUp; replayKey; per-keyframe easing.
• CSS transitions keep per-property durations, delays and timing functions (delays no longer rejected) and accept spring(mass stiffness damping); Element::transition().
• Scroll: on:scrollBeginDrag, on:scrollEndDrag (velocity) and on:momentumScrollEnd with the page index (ScrollPhaseEvent); lists accept pagingEnabled (one item per page).
• Text: on:textLayout (TextLayoutEvent: wrapped and visible lines, truncation, line widths); ellipsizeMode="marquee".
• Modal: animationType="slide-fade" fades the backdrop while the content slides independently.
• Protocol: property IDs 509-522 and event kinds 70-75 (append-only).
• Tests: PHP SDK (new gesture/animation suite), Rust, Android unit (spring solver parity with PHP, release rules, bezier, programs) and Android API 26 instrumented suite 134/134, including drag/swipe/double-tap/paging/text layout/modal/program tests that assert no PHP event while the finger moves and UI-thread frame work within a 60 Hz budget (story drag p95 ~2 ms). iOS decodes the protocol only; its native implementation is pending.

React Native typography and layout parity (Android). See docs/typography.md.

• Exact text measurement: the engine measures every Text box with the Android text stack that draws it (pam_native_engine_set_text_measurer, PamTextLayout), following React Native: integer (ceil) font pixel sizes, hinted glyph advances, kerning, emoji/fallback fonts, CustomLineHeightSpan line heights, ceil widths, last-line heights and real first baselines. numberOfLines implies a tail ellipsis. iOS keeps the estimator.
• Behaviour change: includeFontPadding now defaults to true like React Native Android (single-line Roboto 14 sp is 49 px instead of 43 px at 2.625×). Opt out with include-font-padding: false (-pam-include-font-padding), includeFontPadding="false" or Text::includeFontPadding(false). Text nodes no longer force linear (subpixel) advances.
• Nested text: Text may contain text and nested Text/Span runs with their own size, weight, style, family, color, background, decoration, letter spacing and transform, rendered as one paragraph. on:press on a run makes it a link/mention (EventKind::SpanPress). PHP: Text::rich(). Whitespace inside Text follows JSX.
• hairline (= StyleSheet.hairlineWidth) and Ndpx device-pixel units in CSS; Pam\Native\PixelRatio (get, getFontScale, roundToNearestPixel, getPixelSizeForLayoutSize, hairlineWidth).
• Yoga layout semantics: border widths inset children and leaf content and grow content-sized boxes; align-items/align-self: baseline uses the first text baseline of container children recursively.
• on:layout / Element::onLayout() (LayoutEvent x/y/width/height relative to the parent), on mount and on frame changes, coalesced per frame.
• Safe areas: SafeAreaView insets are laid out by the engine for the window edges each view touches, at any nesting level (fixes a bottom-only nested SafeAreaView under a root without the bottom edge drawing under the navigation bar). WindowMetrics safe areas are correct from the first render (PAM_BOOT_METRICS) and Dimensions is re-sent when insets change. New android.safeAreaBottomFallback (dp) for devices reporting no bottom inset.
• appearance.splash (logo, darkLogo, size) for the Android 12+ SplashScreen icon and the legacy starting window.
• HttpResponse::date() no longer uses the PHP 8.5-deprecated DateTimeInterface::RFC7231 constant.
• Protocol (append-only): properties TextSpans (501) … ScrollKeyboardInset (508), events SpanPress (66), Layout (67), MediaBuffering (68), MediaLoadStart (69).

Native CSS visual effects on top of the 1.2.0 complete-CSS compiler and the 1.2.x render-pipeline work:

• CSS gradients: linear-gradient(), radial-gradient() and their repeating-* variants (angles, to <side>, magic corners, circle/ellipse, size keywords, explicit radii, at <position>, multiple and double-position color stops, hard stops) in background/background-image, layered over background-color and clipped anti-aliased to border-radius. Stops interpolate in premultiplied space like browsers (transparent fades never darken).
• <LinearGradient colors start end locations> with expo-linear-gradient semantics for React Native ports.
• border-image: <gradient> 1 paints a gradient stroke that follows border-radius (story rings).
• box-shadow: comma-separated lists, inset shadows and spread; CSS blur semantics (σ = blur / 2). Outer shadows use cached, downscaled ALPHA_8 nine-slice masks shared across views and now follow the child's full transform (scale/rotation).
• filter: blur() plus brightness(), contrast(), saturate(), grayscale(), sepia(), invert(), opacity() and hue-rotate(), composed at compile time into one color matrix (RenderEffect on API 31+, hardware layer paint before). blur() below API 31 is now a logged no-op instead of a fake elevation.
• backdrop-filter on containers (Android 12+): GPU blur/color matrix of the content behind the element, clipped to its radius.
• <Shimmer baseColor gradientColor duration enabled> skeleton primitive (Zé Chat shimmer port, shared frame clock, pauses off screen).
• <Image blurRadius> / filter: blur() on images now blur the bitmap once with opaque edges on every API level (React Native semantics) instead of a GPU blur that needed API 31.
• Protocol: append-only property IDs 492–500 (BackgroundGradient, BoxShadows, FilterColorMatrix, BackdropBlurRadius, BackdropColorMatrix, BorderGradient, ShimmerGradientColor, ShimmerDurationMs, ShimmerEnabled).
• Still diagnosed at compile time: conic-gradient(), gradient color hints, url() backgrounds, drop-shadow()/url() filters, non-neutral background-size/position/clip. iOS paints colors and the first outer shadow only; the new effects log a one-time debug diagnostic there.
• Behaviour change: background: <color> now also clears gradients and filter: <function> resets the other filter functions, as in CSS.
• PHP SDK, Rust workspace (152), Android unit/lint, Android instrumented API 36 full suite (123/123) and API 26 effects/paint/renderer suites (60, 2 API-31-only skips) passed locally. iOS/Xcode gates were not run.