document: reindex properties

Cargo.lock

@@ -31,6 +31,13 @@ dependencies = [
  "nanobrush-geometry",
 ]
 
+[[package]]
+name = "nanobrush-document"
+version = "0.1.0"
+dependencies = [
+ "mb3-dat",
+]
+
 [[package]]
 name = "nanobrush-geometry"
 version = "0.1.0"

Cargo.toml

@@ -1,5 +1,5 @@
 [workspace]
-members = ["crates/mb3-dat", "crates/mb3-txt", "crates/nanobrush-cli", "crates/mb3-obj", "crates/nanobrush-geometry"]
+members = ["crates/mb3-dat", "crates/mb3-txt", "crates/nanobrush-cli", "crates/mb3-obj", "crates/nanobrush-geometry", "crates/nanobrush-document"]
 resolver = "3"
 
 [workspace.package]

README.md

@@ -76,3 +76,5 @@ The asset-free Nix check `nix build .#checks.aarch64-darwin.rust --no-link` runs
 `nix run .#nanobrush -- inspect FILE` prints a JSON summary; `validate FILE` checks structure. Convert with `convert INPUT OUTPUT --to txt`, `--to dat-201501280`, or `--to dat-201512200`. Inside the dev shell, use `cargo run -p nanobrush-cli -- ...`. Existing outputs require `--force`; source aliases and output symlinks are refused.
 
 [TXT compatibility](docs/RUST_TXT.md) documents strict UTF-8 input, BOM output, finite numbers and computed-data consistency. [CLI usage and publication](docs/CLI.md) covers limits, exit codes and atomic saves. Full Cargo tests require hydrated converter fixtures; Nix checks and the native package build exclude assets.
+
+OBJ export is available through `convert INPUT OUTPUT --to obj --allow-lossy`; add `--compute` to explicitly rebuild native brush/patch geometry first. `preflight INPUT --to FORMAT` prints grouped compatibility/loss JSON. Legacy TXT decoding is explicit with `--text-encoding latin1`. See the [ten-task ledger](docs/PROGRESS_2026-10-26.md), [geometry policy](docs/GEOMETRY.md) and [property-edit API](docs/PROPERTIES.md).

crates/nanobrush-document/Cargo.toml

@@ -0,0 +1,10 @@
+[package]
+name = "nanobrush-document"
+version = "0.1.0"
+edition.workspace = true
+rust-version.workspace = true
+publish = false
+[dependencies]
+mb3-dat = { path = "../mb3-dat" }
+[lints]
+workspace = true

crates/nanobrush-document/src/lib.rs

@@ -0,0 +1,314 @@
+//! Explicit transactional table reordering/removal over the existing world model.
+use mb3_dat::{Limits, Property, Uv, World};
+use std::fmt;
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum Error {
+    Index,
+    DuplicateOrder,
+    InvalidSlots,
+    Limit,
+    Allocation,
+    Overflow,
+}
+impl fmt::Display for Error {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "property edit: {self:?}")
+    }
+}
+impl std::error::Error for Error {}
+type Result<T> = std::result::Result<T, Error>;
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub struct Report {
+    pub dropped_string_names: usize,
+    pub dropped_uv_names: usize,
+    pub dropped_string_values: usize,
+    pub dropped_uv_values: usize,
+}
+struct Budget {
+    items: usize,
+    bytes: usize,
+    limits: Limits,
+}
+impl Budget {
+    fn items(&mut self, n: usize) -> Result<()> {
+        self.items = self.items.checked_add(n).ok_or(Error::Overflow)?;
+        if self.items > self.limits.max_items {
+            Err(Error::Limit)
+        } else {
+            Ok(())
+        }
+    }
+    fn vec<T>(&mut self, n: usize) -> Result<Vec<T>> {
+        self.bytes(
+            n.checked_mul(std::mem::size_of::<T>())
+                .ok_or(Error::Overflow)?,
+        )?;
+        let mut v = Vec::new();
+        v.try_reserve_exact(n).map_err(|_| Error::Allocation)?;
+        Ok(v)
+    }
+    fn bytes(&mut self, n: usize) -> Result<()> {
+        self.bytes = self.bytes.checked_add(n).ok_or(Error::Overflow)?;
+        if self.bytes > self.limits.max_owned_bytes {
+            Err(Error::Limit)
+        } else {
+            Ok(())
+        }
+    }
+    fn string(&mut self, s: &str) -> Result<String> {
+        if s.len() > self.limits.max_string_bytes {
+            return Err(Error::Limit);
+        }
+        self.bytes(s.len())?;
+        let mut out = String::new();
+        out.try_reserve_exact(s.len())
+            .map_err(|_| Error::Allocation)?;
+        out.push_str(s);
+        Ok(out)
+    }
+    fn table(&mut self, names: &[String], order: &[u32]) -> Result<(Vec<String>, Vec<u32>)> {
+        self.items(names.len())?;
+        self.items(order.len())?;
+        if order.len() > i32::MAX as usize {
+            return Err(Error::Overflow);
+        }
+        let mut map = self.vec(names.len())?;
+        map.resize(names.len(), u32::MAX);
+        let mut out = self.vec(order.len())?;
+        for (new, old) in order.iter().enumerate() {
+            let slot = map.get_mut(*old as usize).ok_or(Error::Index)?;
+            if *slot != u32::MAX {
+                return Err(Error::DuplicateOrder);
+            }
+            *slot = new as u32;
+            out.push(self.string(&names[*old as usize])?);
+        }
+        Ok((out, map))
+    }
+}
+fn validate<T>(slots: &[Property<T>], map: &[u32]) -> Result<usize> {
+    let mut previous = None;
+    let mut kept = 0;
+    for slot in slots {
+        if previous.is_some_and(|n| n >= slot.index) {
+            return Err(Error::InvalidSlots);
+        }
+        previous = Some(slot.index);
+        let id = map.get(slot.index as usize).ok_or(Error::InvalidSlots)?;
+        if *id != u32::MAX {
+            kept += 1;
+        }
+    }
+    Ok(kept)
+}
+struct Update {
+    strings: Vec<Property<String>>,
+    uv: Vec<Property<Uv>>,
+}
+/// New tables select old indices in the desired order. Omitted indices explicitly
+/// remove names and associated values. All validation/allocation precedes mutation.
+pub fn remap(
+    world: &mut World,
+    string_order: &[u32],
+    uv_order: &[u32],
+    limits: Limits,
+) -> Result<Report> {
+    let mut b = Budget {
+        items: 0,
+        bytes: 0,
+        limits,
+    };
+    let (strings, sm) = b.table(&world.string_properties, string_order)?;
+    let (uv, um) = b.table(&world.uv_properties, uv_order)?;
+    let mut report = Report {
+        dropped_string_names: world.string_properties.len() - strings.len(),
+        dropped_uv_names: world.uv_properties.len() - uv.len(),
+        ..Report::default()
+    };
+    let mut count = 0usize;
+    for brush in &world.brushes {
+        b.items(1)?;
+        count = count
+            .checked_add(brush.planes.len())
+            .ok_or(Error::Overflow)?;
+    }
+    b.items(count)?;
+    let mut updates = b.vec(count)?;
+    for p in world.brushes.iter().flat_map(|b| &b.planes) {
+        b.items(p.strings.len())?;
+        b.items(p.uv.len())?;
+        let ns = validate(&p.strings, &sm)?;
+        let nu = validate(&p.uv, &um)?;
+        report.dropped_string_values = report
+            .dropped_string_values
+            .checked_add(p.strings.len() - ns)
+            .ok_or(Error::Overflow)?;
+        report.dropped_uv_values = report
+            .dropped_uv_values
+            .checked_add(p.uv.len() - nu)
+            .ok_or(Error::Overflow)?;
+        let mut ss = b.vec(ns)?;
+        for s in &p.strings {
+            let index = sm[s.index as usize];
+            if index != u32::MAX {
+                ss.push(Property {
+                    index,
+                    value: b.string(&s.value)?,
+                });
+            }
+        }
+        ss.sort_unstable_by_key(|p| p.index);
+        let mut us = b.vec(nu)?;
+        for s in &p.uv {
+            let index = um[s.index as usize];
+            if index != u32::MAX {
+                us.push(Property {
+                    index,
+                    value: s.value.clone(),
+                });
+            }
+        }
+        us.sort_unstable_by_key(|p| p.index);
+        updates.push(Update {
+            strings: ss,
+            uv: us,
+        });
+    }
+    world.string_properties = strings;
+    world.uv_properties = uv;
+    for (p, u) in world
+        .brushes
+        .iter_mut()
+        .flat_map(|b| &mut b.planes)
+        .zip(updates)
+    {
+        p.strings = u.strings;
+        p.uv = u.uv;
+    }
+    Ok(report)
+}
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use mb3_dat::{Brush, Document, Plane, Version};
+    fn world() -> World {
+        World {
+            string_properties: vec!["unused".into(), "a".into(), "b".into()],
+            uv_properties: vec!["uv".into()],
+            brushes: vec![Brush {
+                planes: vec![Plane {
+                    p0: [1., 2., 3.],
+                    strings: vec![
+                        Property {
+                            index: 1,
+                            value: String::new(),
+                        },
+                        Property {
+                            index: 2,
+                            value: "value".into(),
+                        },
+                    ],
+                    uv: vec![Property {
+                        index: 0,
+                        value: Uv {
+                            u: [1., 0., 0.],
+                            v: [0., 1., 0.],
+                            u_scale: 1.,
+                            u_shift: 0.,
+                            v_scale: 1.,
+                            v_shift: 0.,
+                        },
+                    }],
+                    ..Default::default()
+                }],
+            }],
+            ..Default::default()
+        }
+    }
+    #[test]
+    fn reorder_remove_empty_values_and_geometry_preserved() {
+        let mut w = world();
+        let p = w.brushes[0].planes[0].p0;
+        let r = remap(&mut w, &[2, 1], &[], Limits::default()).unwrap();
+        assert_eq!(w.string_properties, ["b", "a"]);
+        assert_eq!(
+            w.brushes[0].planes[0].strings,
+            [
+                Property {
+                    index: 0,
+                    value: "value".into()
+                },
+                Property {
+                    index: 1,
+                    value: String::new()
+                }
+            ]
+        );
+        assert_eq!(w.brushes[0].planes[0].p0, p);
+        assert_eq!(
+            r,
+            Report {
+                dropped_string_names: 1,
+                dropped_uv_names: 1,
+                dropped_uv_values: 1,
+                dropped_string_values: 0
+            }
+        );
+        let d = Document {
+            world: w,
+            version: Version::V201512200,
+        };
+        assert_eq!(
+            mb3_dat::decode(
+                &mb3_dat::encode(&d, &Limits::default()).unwrap(),
+                &Limits::default()
+            )
+            .unwrap(),
+            d
+        );
+    }
+    #[test]
+    fn explicit_drop_counts_and_roundtrip_permutation() {
+        let mut w = world();
+        let original = w.clone();
+        remap(&mut w, &[2, 0, 1], &[0], Limits::default()).unwrap();
+        remap(&mut w, &[1, 2, 0], &[0], Limits::default()).unwrap();
+        assert_eq!(w, original);
+        let r = remap(&mut w, &[], &[], Limits::default()).unwrap();
+        assert_eq!(r.dropped_string_values, 2);
+        assert!(w.brushes[0].planes[0].strings.is_empty());
+    }
+    #[test]
+    fn errors_are_transactional_including_late_slots() {
+        for order in [vec![1, 1], vec![9]] {
+            let mut w = world();
+            let before = w.clone();
+            assert!(remap(&mut w, &order, &[0], Limits::default()).is_err());
+            assert_eq!(w, before);
+        }
+        let mut w = world();
+        w.brushes[0].planes[0].strings[1].index = 99;
+        let before = w.clone();
+        assert!(remap(&mut w, &[0, 1, 2], &[0], Limits::default()).is_err());
+        assert_eq!(w, before);
+        for l in [
+            Limits {
+                max_items: 1,
+                ..Limits::default()
+            },
+            Limits {
+                max_owned_bytes: 1,
+                ..Limits::default()
+            },
+            Limits {
+                max_string_bytes: 1,
+                ..Limits::default()
+            },
+        ] {
+            let mut w = world();
+            let before = w.clone();
+            assert!(remap(&mut w, &[0, 1, 2], &[0], l).is_err());
+            assert_eq!(w, before);
+        }
+    }
+}

crates/nanobrush-geometry/src/brush.rs

@@ -131,8 +131,8 @@ pub fn contours(brush: &mb3_dat::Brush, policy: Policy, limits: ComputeLimits) -
         });
         let start = (0..face.len())
             .min_by(|a, c| {
-                for d in 0..3 {
-                    let order = vertices[face[*a]][d].total_cmp(&vertices[face[*c]][d]);
+                for (left, right) in vertices[face[*a]].iter().zip(vertices[face[*c]].iter()) {
+                    let order = left.total_cmp(right);
                     if !order.is_eq() {
                         return order;
                     }

docs/CLI.md

@@ -1,6 +1,6 @@
 # Native inspection, validation and conversion — F31
 
-The `nanobrush` executable is built from `crates/nanobrush-cli`, backed by the strict [TXT](RUST_TXT.md) and [DAT](RUST_DAT.md) libraries. It supports TXT and DAT versions 201501280/201512200. MAP/VMF/OBJ, geometry evaluation, user-interface replay and the editor application remain future work.
+The `nanobrush` executable is built from `crates/nanobrush-cli`, backed by the strict [TXT](RUST_TXT.md) and [DAT](RUST_DAT.md) libraries. It supports TXT and DAT versions 201501280/201512200, computed OBJ export, explicit recoding and opt-in native geometry computation. MAP/VMF codecs, user-interface replay and the editor application remain future work.
 
 Run from the repository:
 

docs/FINDINGS.md

@@ -161,3 +161,15 @@ The [Rust DAT codec](RUST_DAT.md) reads and writes both recovered layouts with c
 ## F30/F31 — TXT serialization and native CLI
 
 The [TXT codec](RUST_TXT.md) implements the latest grammar and old property-free subset with bounded UTF-8 parsing, canonical BOM output, finite round-trip decimals and consistent computed arrays. The [CLI](CLI.md) inspects/validates and converts TXT plus both DAT versions, refusing silent loss and publishing validated outputs with explicit no-clobber/force behavior. [E04](experiments/txt-cli-2026-10-21.md) covers 58 exact DAT→TXT→DAT round trips through the real process, seven TXT outputs, 16 direct TXT→DAT pairs and nine invalid/lossy source rejections.
+
+## F32 — Native export and explicit recoding
+
+[OBJ export](OBJ.md) matches all four computed converter OBJ captures. [CLI preflight](CLI.md) reports grouped target incompatibilities/losses; explicit OBJ acknowledgement reuses atomic source-preserving publication. Latin-1 TXT input is opt-in, bounded and distinct from UTF-8 output or CP1252. See the [ten-task ledger](PROGRESS_2026-10-26.md).
+
+## F33 — Analytic native geometry
+
+[Geometry contracts](GEOMETRY.md) define normalized equations, bounds, strict convex brush reconstruction, tensor-quadratic Patch9 sampling, computed worlds and stable nearest-hit rays. Analytic fixtures establish this native policy only. Interior side, epsilons, seam normals and invalid-object behavior still need native-editor comparison.
+
+## F34 — Transactional property edits
+
+[Property editing](PROPERTIES.md) explicitly reorders/removes name tables and sparse values, preserving empty versus absent and reporting dropped data. All planning/validation/allocation precedes mutation. This is not a measured replacement for host interrupt ownership/UV-lock semantics.

docs/OBJ.md

@@ -4,4 +4,4 @@
 
 Computed geometry is required; no clipping/tessellation is performed here. Polygons need at least three vertices; malformed patch array counts and non-finite geometry fail. This is structural export, not a manifold/convexity check. Editable planes/anchors, property tables, UVs and stored normals are absent from OBJ. The CLI must explicitly acknowledge those losses before publication.
 
-Limits cover encoded bytes, aggregate geometry/face elements and requested deduplication-map storage (two key/index slots per unique vertex as a conservative accounting unit, excluding allocator overhead). Reservations are fallible. Formatting uses Rust round-trip decimals, so arbitrary float text need not match historical .NET printing even though the four captures match. No original executable or asset is modified.
+Limits cover encoded bytes, aggregate geometry/face elements and requested deduplication-map storage (two key/index slots per unique vertex as a logical accounting unit, excluding hash-table capacity/control overhead and allocator overhead). Reservations are fallible. Formatting uses Rust round-trip decimals, so arbitrary float text need not match historical .NET printing even though the four captures match. No original executable or asset is modified.

docs/PROGRESS_2026-10-26.md

@@ -13,4 +13,10 @@ Scope: extend native headless formats and geometry. Each stage is independently
 | 7 | P5.17 | Patch9 tessellation | Complete: tiled tensor-quadratic positions, analytic derivatives, OBJ-consistent normals, shared-position seam policy and bounded allocations/work. Planar/curved/multi-tile/degenerate/limit tests pass. |
 | 8 | P5.18 | Computed world pipeline/CLI | Complete: fallible editable-data copying, aggregate work/storage/position budgets, complete-or-error derived data and explicit `--compute`. Mixed-world/property/DAT/late-failure/global-limit and CLI cube→OBJ tests pass. |
 | 9 | P5.19 | Nearest-hit ray queries | Complete: bounded double-sided computed-surface queries, normalized rays, stable object/face/quad ties and winding normals. Cube/inside/miss/range/tie/patch/backface/budget tests pass. |
-| 10 | P5.20 | Property table edits/reindexing | Pending |
+| 10 | P5.20 | Property table edits/reindexing | Complete: explicit reorder/drop maps, sparse string/UV reindexing, removal counts and allocation-before-mutation. Inverse permutation, empty values, DAT, geometry preservation and early/late/budget rollback tests pass. |
+
+## Final validation
+
+All ten stages have targeted passing tests and separate terse commits. Final macOS ARM64 validation: 82 Rust tests (67 unit, 13 integration, two doctests) pass in debug and release; formatting and Clippy with warnings denied pass. Asset-free Nix Rust/setup checks and the native CLI package build pass; setup retains 52 Python regressions. All four OBJ captures match, existing DAT/TXT fixture tests remain green, and all 1,082 hydrated Xet/LFS assets match their unchanged staged identities. Packaged CLI smoke checks exercised computed OBJ preflight and explicit Latin-1 input.
+
+Native geometry remains an adopted, analytically tested policy. Native-editor comparison, Linux/Intel execution, broader numerical/fuzz/performance qualification, visibility/selection interactions and renderer integration remain open. The remaining broad parent TODOs were kept open; ten scoped child tasks are checked.

docs/PROPERTIES.md

@@ -0,0 +1,7 @@
+# Native property-table editing
+
+`nanobrush_document::remap` takes explicit old-index lists for the new string and UV tables. Reordering updates every retained sparse slot; omission removes a name and all its values, with separate dropped-name/value counts. Empty values remain present. Geometry, computed arrays, anchors and the computed flag are unchanged. Names may be Unicode or index-distinct duplicates, as in DAT; the target codec remains responsible for ASCII/TXT-name compatibility.
+
+Orders must contain unique in-range indices; old slots must be unique, sorted and in range. The entire new name/slot plan is validated and fallibly allocated before any mutation. Errors leave the world unchanged, including late slot errors. Aggregate planning item/byte and string limits use `mb3_dat::Limits`, conservatively counting old maps and new names as well as visited records/slots. No implicit usage sorting, unused-name pruning or UV transform occurs. Renderer/document revision invalidation belongs to a future command layer.
+
+Tests cover permutation/inverse identity, explicit removal counts, UV reindex/removal, empty values, unchanged coordinates, DAT round trip, duplicate/out-of-range orders, late invalid slots and resource-failure rollback. This is a native editing API, not a measured replacement for the host's property interrupt behavior.

docs/README.md

@@ -40,3 +40,5 @@ The original planning backlog contained 197 tasks across 17 phases; source-resea
 ## Maintaining this plan
 
 Give each new finding an ID, source version/hash, confidence, and reproducible observation. Link it to a specification, a TODO item, and a validation case. Store original and generated payloads under Xet-filtered `assets/` or `references/` paths; keep original investigation prose, manifests, scripts, specifications, and Rust source in code Git. Update this index when splitting a large specification into its own document.
+
+The [2026-10-26 ten-task ledger](PROGRESS_2026-10-26.md) extends the native stack with preflight reports, explicit Latin-1 input, [computed OBJ export](OBJ.md), [geometry/brush/Patch9/ray kernels](GEOMETRY.md), computed-world CLI integration and [transactional property editing](PROPERTIES.md). These native geometry policies remain separate from unverified editor parity.

docs/RUST_TXT.md

@@ -12,7 +12,7 @@ assert_eq!(mb3_txt::decode(&bytes, &Limits::default())?, world);
 # Ok::<(), mb3_txt::Error>(())
 ```
 
-`decode` / `encode` work on bytes; `read` / `write` support standard Rust I/O, short operations and `Interrupted`. Input must be UTF-8, with an optional leading BOM. Output is canonical **UTF-8 with a BOM**, LF line endings and shortest round-tripping finite f32 decimals. Invariant number formatting preserves finite f32 values, signed zero and subnormals. Comments, whitespace, original decimal spelling and brush/patch interleaving are not retained: the model stores brushes and patches separately, and the writer emits brushes first. Names, their original table order, unused names, property indices, empty versus absent values, and all explicit geometry arrays are retained.
+`decode` / `encode` work on bytes; `read` / `write` support standard Rust I/O, short operations and `Interrupted`. Default input must be UTF-8, with an optional leading BOM. Explicit Latin-1 decoding is described below. Output is canonical **UTF-8 with a BOM**, LF line endings and shortest round-tripping finite f32 decimals. Invariant number formatting preserves finite f32 values, signed zero and subnormals. Comments, whitespace, original decimal spelling and brush/patch interleaving are not retained: the model stores brushes and patches separately, and the writer emits brushes first. Names, their original table order, unused names, property indices, empty versus absent values, and all explicit geometry arrays are retained.
 
 The parser accepts line/block comments, exact case-sensitive keywords, signed decimal integers, decimal-point/exponent floats, ordinary strings and the six supplied escape forms (`\r`, `\n`, `\t`, `\'`, `\"`, `\\`). Single quotes inside strings must be escaped, as in the supplied grammar. Strings may contain Unicode directly; general `\u`, hex and unknown escapes are rejected. Non-nested block comments terminate at the first closing delimiter. Line comments may end at EOF. Unknown fields, trailing objects/text, malformed punctuation and duplicate property names/slots are errors. Sparse slots can arrive out of index order and are sorted after parsing; writer input requires unique increasing indices.
 
@@ -52,6 +52,6 @@ Native Unicode output follows the recovered grammar/encoding contract; a broad n
 - **Nine** invalid or silently lossy TXT source fixtures are rejected, including duplicate names/slots, bad indices, missing computed arrays, syntax errors and ignored polygons.
 - The property-optimization fixture retains `[unused, rare, common]`, while the original CLI emitted `[common, rare]`; Unicode source fixtures retain `é`, while DAT conversion refuses replacement and the historical BOM-less path drifted.
 
-Twelve unit tests cover lexer errors, comments, exponent syntax, escapes/UTF-8, finite extremes, signed zero, proper-prefix truncations, all resource policies, array consistency, streaming I/O, 3,000 bounded deterministic mutations and rejection of recursive-looking syntax. Five integration tests require hydrated E02 fixtures. Coverage-guided fuzzing, large real TXT files, explicit legacy Latin-1 recoding, native-editor interoperability and cross-platform execution remain open. See [E04](experiments/txt-cli-2026-10-21.md) for reproduction.
+Twelve unit tests cover lexer errors, comments, exponent syntax, escapes/UTF-8, finite extremes, signed zero, proper-prefix truncations, all resource policies, array consistency, streaming I/O, 3,000 bounded deterministic mutations and rejection of recursive-looking syntax. Five integration tests require hydrated E02 fixtures. Coverage-guided fuzzing, large real TXT files, native-editor interoperability and cross-platform execution remain open. See [E04](experiments/txt-cli-2026-10-21.md) for reproduction.
 
 Explicit legacy input is now available through `Encoding::Latin1`, `decode_with_encoding` and `read_with_encoding`; the CLI uses `--text-encoding latin1`. ISO-8859-1 byte values map directly to Unicode, including C1 controls; this is not CP1252. UTF-8 BOM conflicts fail. Limits apply to raw and expanded UTF-8 bytes, and transcoding storage is subtracted from decoder ownership allowance. Parse error offsets in this mode refer to expanded UTF-8 bytes. Output stays BOM-prefixed UTF-8; no heuristic fallback occurs.

docs/TODO.md

@@ -1,6 +1,6 @@
 # Exhaustive work list
 
-Baseline: 2026-10-21. The setup and extraction implementation is complete; checked items are verified in [SETUP.md](SETUP.md). The single-repository layout supersedes the initial separate-dataset proposal. Findings F01–F31 are in [FINDINGS.md](FINDINGS.md). The [investigation method](REVERSE_ENGINEERING.md) defines evidence requirements; [technical direction](TECHNICAL_DIRECTION.md) describes proposed boundaries.
+Baseline: 2026-10-21. The setup and extraction implementation is complete; checked items are verified in [SETUP.md](SETUP.md). The single-repository layout supersedes the initial separate-dataset proposal. Findings F01–F34 are in [FINDINGS.md](FINDINGS.md). The [investigation method](REVERSE_ENGINEERING.md) defines evidence requirements; [technical direction](TECHNICAL_DIRECTION.md) describes proposed boundaries.
 
 Each task ID is stable. Split tasks into child IDs as evidence grows. Record dependencies, output documents/code, validation evidence, and remaining limitations when checking a task off. New discoveries extend this list. P0–P2 establish preservation; P3–P9 establish behavioral contracts; P10–P16 implement and prove the rewrite. P10's GPU spike should happen early alongside source research, before renderer architecture is locked.
 
@@ -136,6 +136,8 @@ Each task ID is stable. Split tasks into child IDs as evidence grows. Record dep
 
 - [x] P5.19 Implement bounded deterministic native nearest-hit ray queries over computed brush/patch surfaces ([GEOMETRY.md](GEOMETRY.md)).
 
+- [x] P5.20 Implement transactional native property table reorder/removal and sparse reindexing with explicit loss counts ([PROPERTIES.md](PROPERTIES.md)).
+
 ## P6 — File formats and converters
 
 **Depends on:** P3 oracle where available, P5 document model. **Exit:** standalone format specifications, declared compatibility subsets, fixture corpus, and native codecs.

docs/parity.md

@@ -45,3 +45,7 @@ Keep the broad parent TODO tasks open until their promised behavioral evidence e
 ## TXT and CLI implementation (E04)
 
 The native TXT codec and CLI cover all 58 E02 DAT outputs through exact DAT→TXT→DAT reconstruction, seven text outputs through canonical semantic round trips, 16 direct TXT-input/DAT-output pairs and nine rejected malformed/lossy text inputs. Original formatting, guessed encodings, ignored arrays and property optimization are explicit differences in F30. CLI no-clobber/force publication, alias/symlink guards, validation before I/O and exit streams are tested separately in F31. Legacy external formats, editor behavior and other-platform execution remain open.
+
+## Ten-task extension — 2026-10-26
+
+[Ledger](PROGRESS_2026-10-26.md): preflight, explicit Latin-1, computed OBJ/CLI, analytic geometry, strict convex brushes, native Patch9 evaluation, bounded world computation, deterministic rays and transactional property editing. OBJ has four exact reference goldens. Geometry/property APIs use documented native contracts with analytic tests; native editor parity, visibility/selection semantics and broad numerical/performance qualification remain unverified.

docs/validation.md

@@ -31,3 +31,9 @@ Both Apple Silicon Nix derivations built successfully: the asset-free Rust check
 [TXT compatibility](RUST_TXT.md), [CLI workflow](CLI.md) and [E04](experiments/txt-cli-2026-10-21.md) record the implementation. Full debug and release suites each pass **58 Rust tests**: 44 unit tests, 12 fixture/process integration tests and two doctests. All 58 DAT outputs survive exact DAT→TXT→DAT reconstruction through the real executable, seven converter TXT outputs canonicalize stably, 16 direct TXT→DAT pairs match and nine invalid/lossy TXT source fixtures are rejected. The TXT suite adds 3,000 bounded mutations and streaming/array/encoding limits; CLI tests cover publication races, aliases, symlinks, no-clobber and preserving existing destinations on encoder failure.
 
 Formatting/Clippy pass. Both Apple Silicon Nix checks and the asset-free `nanobrush` package build pass; the Rust check runs 44 unit tests/two doctests, while setup retains all 52 Python regressions. The packaged executable’s help and JSON inspection of the property fixture ran successfully. Converter fixture identity/semantic checks and all 1,082 hydrated asset hashes pass; original captures are unchanged and tests/code remain ordinary Git. Other-platform execution, native-editor interoperability, crash-durability/failure matrices and coverage-guided fuzzing remain open.
+
+## Ten-task native extension — 2026-10-26
+
+See [the stage ledger](PROGRESS_2026-10-26.md), [OBJ](OBJ.md), [geometry](GEOMETRY.md) and [property edits](PROPERTIES.md). Final debug/release suites each pass 82 Rust tests: 67 unit, 13 integration and two doctests. This includes four exact OBJ goldens, existing 58 DAT/TXT CLI round trips, analytic brush/patch/ray cases, resource failures and transactional property edits. Formatting/Clippy pass. Both Apple Silicon asset-free Nix checks and the CLI package build pass; the setup suite retains 52 Python regressions. Packaged CLI computed-export preflight and explicit Latin-1 inspection ran successfully.
+
+Converter evidence identities and all 1,082 hydrated Xet/LFS asset hashes pass unchanged. Authored code/tests/docs remain ordinary Git. Native geometry numeric/interior/seam/picking policies are documented choices, not measured editor parity. Other-platform execution and broader legacy/real-document/fuzz/hardware qualification remain open.