Resecta 1.3.0

Highlights

• If you redacted with Search in 1.2.0: on a page whose text carries a ligature, an emoji or a letter written with a separate accent mark, a box placed from a Search match could sit beside part of the match, and verification could still pass it. In 1.3.0 a box covers the whole match, and verification fails when part of a match is left uncovered. Open any such redacted copy and look at the edges of each box, or redact the original again with this version.
• Photos and images: JPEG, PNG and HEIC images open from Photos (up to 20 at a time), from Files or by a drop. Each becomes one page of a new PDF, redrawn from its pixels, so the photo's metadata, such as its location, is not carried into it.
• Password-protected PDFs open once you enter the password. The import checks run on the unlocked document, and the redacted copy is not password-protected; the app says so at import and on the Share card.
• Stricter import: a document the app cannot read in full, or one carrying JavaScript or a launch action, is refused rather than opened unscanned, and a file over 50 MB is refused by its size before it is read.
• Hidden text: Searchable Redaction recognizes more ways a page can hide text, in a hidden layer or in near-white, nearly transparent or covered ink, and exports such a page as an image only.
• Marking: Mark Whole Page covers the page on screen with one region, and a double-tap returns to the fit zoom. A region drawn by hand is checked line by line, as the page text reads it.
• Verification results are a grouped list: the headline shows how many checks passed, names the outcome and says what to do next, and each problem row links to its page.
• Removed: code that no shipped build reached, including the face, barcode and signature detectors, the freeform and polygon drawing tools, and the search sheet's disabled diagnostics.

A password-protected PDF opens with its password, a photo or an image becomes one page of a new PDF you can redact, and a document the app cannot read in full, or whose pages it cannot render, is refused at import rather than opened unscanned. In the editor, Mark Whole Page covers the page on screen with one region and a double-tap returns to the fit zoom. Verification re-runs each applied search and scan on the original page and the OCR check reports a term's start or end read beside a box, so a box placed off its text no longer passes every check; the results list groups each check by its outcome and counts only passing checks as passed. The app opts into Apple's hardened-process protections in their reporting mode, the engine's public surface narrows to the document-runner API, and the surfaces no shipped build reached — the search sheet's disabled diagnostics, the in-editor importer, the paused-detection resume path, and the face, barcode, and signature detectors — are removed.

Added

• Search: when the text could not be fitted to the printed word, a box is drawn wider than the word; the results sheet names the pages holding such a box, and the page in view says so above the page, before and after the boxes are applied, asking to keep such a box wide: shrinking it back to the word can leave part of the word readable.
• Editor: the iPhone overflow menu offers Mark Whole Page for the page in view, on one-page documents too — or Unmark Whole Page, checked, on a marked page — through the page bar's own toggle.
• At the accessibility text sizes the page bar's counter shows its position above its region count, each on one line, instead of wrapping a letter at a time.
• Password sheet: when a refused password holds an accented letter, a line beneath the refusal says such a password may not open the document in Resecta even when it is correct (Known Issues KI-12).
• Settings: a "Rate Resecta on the App Store" row under Support opens the App Store's review page for the app.
• Acknowledgements: the third-party data and typeface notices the app ships (the repo-root NOTICE) are bundled and readable in-app, from the first-launch gate beside the EULA and Privacy Policy and from Settings.
• Photos and images (JPEG, PNG and HEIC) can be opened from the system Photos picker (up to 20 at a time, in the order chosen), from Files, or by a drop onto an open document; each image becomes one page of a new PDF, redrawn from its decoded pixels at 300 pixels per inch, so the image's embedded metadata is not carried into the document.
• Page bar: Mark Whole Page covers the page on screen with one region, through the same path a drawn region takes, and no search term is captured from it; on a marked page the control reads Unmark Whole Page and removes it, each way one undo step, and it keeps its place when the count changes; it is hidden on a one-page document, where the … menu keeps it.
• Double-tap an empty part of the page to return to the fit zoom.
• Import: a password-protected PDF can be opened by entering its password; the import checks run on the unlocked document, and the redacted copy is not password-protected. The password is held in memory while the document is open and released when the session closes; the failed-state card beneath the password sheet reads as locked rather than damaged. A document that was encrypted — one opened with a password, or one carrying only an owner password — shows a notice at import and a caption on the Share card saying the redacted copy carries neither the password nor the original's usage restrictions.
• With Differentiate Without Color on, every region of a multi-region selection also carries a dashed outline.

Changed

• Tapping an empty part of the page clears the region selection; with Add to Selection on, a tap on empty page changes nothing.
• Tapping one region of a selected group without moving it selects only that region; dragging it still moves the group.
• Holding a region opens its menu; to move a region, select it, then drag it.
• The long-press menu on a region of a selected group acts on the whole selection — Delete N Regions and Deselect All — and leaves the selection as it was.
• Undo and Redo name region steps with the controls' word, Region (Add Region, Duplicate Region, Delete Regions, Move Region, Resize Region), and Redo names the action it repeats.
• A search apply's undo step is named by the regions it creates, not counting results already covered.
• Duplicate selects the copy.
• A one-page document shows the page bar with its region count; the page arrows are hidden there. The counter reads "0 regions" on a page with none, drawn and spoken.
• A document dropped over an open one that holds drawn regions or selected matches asks before replacing it; Cancel keeps the open document. With the Search sheet up, such a drop is refused until the sheet is dismissed.
• With Add to Selection on, a capsule above the page bar reads "Adding to selection · N selected" with a Done button that turns the mode off.
• At the largest accessibility text sizes the drawing caption no longer covers the bottom of the page: the capsules' text stops growing at Accessibility 1.
• Editor toolbar on iPhone: one Undo button — tap to undo, touch and hold for Undo and Redo with the step's name — and Redact as a teal scissors button beside it; Settings moves into the … menu, which lists the selection actions first and Home last, and the separate More menu is gone. At the largest text sizes Redact moves into the … menu and Undo stays in the bar. The document's name is no longer drawn clipped in the bar.
• The "match nearby" notice says Mark, matching the Marked N notice.
• With VoiceOver on, the Rectangle tool is disabled with a hint pointing to Search and Scan.
• Deleting several selected regions happens at once, as one undo step, and a "Deleted N regions." notice offers Undo; a delete from the … menu or ⌘⌫ ends Add to Selection.
• A run of arrow-key nudges is one undo step.
• Deleting selected regions from a hardware keyboard takes Command-Delete.
• The Discard selections confirmation is an alert with a Cancel button.
• Verification: a page read both from its text layer and by OCR (a text layer over a page image) is counted under each route, and when every page was read both ways the Search Re-check and Detection Sweep details say "Text was read from the output's text layer and by OCR from the rendered pages."
• A light haptic on adding or resizing a region.
• Share: when annotations in the original document — a black box, a stamp, an unapplied redaction mark — cover text that no redaction box covers, the share confirmation names those pages before the file is shared, whatever the verification result. Annotations are not part of the page image, so that text is visible in the exported file. On a scanned page, where the printed text is in the page image, any such annotation that no redaction box covers is named; on a rotated page an annotation is compared with the boxes as the page is shown.
• The App Store rating prompt asks once per app version, after the first share of a document whose checks passed, instead of after the third export.
• Home: the app's mark replaces the document glyph; the three entries — Open a Document, Import Photos and Try the Sample — are cards of one size, centred on the screen, without link lines. VoiceOver reads each entry's title and description with a hint, the masthead as a heading and the trust words as one line; under Reduce Motion a press shades the card instead of shrinking it, and under Reduce Transparency the cards are opaque. The first-launch agreement fades into the home screen and keeps I Agree pinned while its text scrolls beneath; the app-switcher placeholder shows the mark on the home screen's grey; the verification progress screen's trust words read as one line.
• Search sheet: the recent-search recall chips, the per-term section headers of the results list and the saved-search names are marked privacy-sensitive, matching the result rows and the saved-query previews.
• Import: a fil...

Resecta 1.2.0

Added

• Saved searches: a Delete All control in the saved-search list, one per interface, matching the Custom Terms and Saved Regexes controls; the Settings reset dialog names all three stores.
• Search re-check. Verification gains a check that re-runs each search you applied — the same text, pattern, or term list with the same options, except that OCR is always on — on the redacted output through the search engine, and reports per search how many matches it found, how many you applied, and how many remain in the text the app can read. In Secure Rasterization the output has no text layer, so the check reads the rendered pages with OCR and says so. Pages the check could not read are listed rather than counted as clear. Both modes end with this re-check and the detection sweep below; Secure Rasterization output now runs a 7-layer check and Searchable Redaction a 12-layer check.
• Detection sweep. Verification ends with a check that runs the app's detectors on the redacted output through the search engine — your applied scan's categories and every other category at the current preset, except names and addresses, which are not swept — and reports what remains, minus the items you chose to leave unredacted, with the pages they are on. In Secure Rasterization the check reads the rendered pages with OCR and says so; pages it could not read are listed rather than counted as clear.

Changed

• Verification results: the two informational notes that every run carried — page content outside the redacted regions, and the writer's fixed metadata fields — now read as passing checks with a detail line; the results screen no longer carries the "Automated detection did not run" line — the Detection Sweep row reports what the structured detectors observed on the output, and names and addresses are not swept, which the row states in its collapsed line.
• Verification: the words fully inside a manual region on a page with a text layer are carried into the term checks, so a word you covered by hand that is still readable elsewhere on the output is reported as Attention Needed; a manual region on a page without a usable text layer is noted in the string-search check.
• Stepping through matches. As you step through matches with Previous/Next on the parked Search/Scan strip, each match is centred on the page; the page bar steps aside while you step and returns when the sheet expands.
• Diagnostics export: the coverage snapshot share writes inside the per-session directory with complete protection at write time and is withheld while the screen is captured, matching the audit export.
• Verification: the OCR check now reports a redacted term that is still readable outside every redacted region as Attention Needed on both output modes, naming the text on the results screen; it was an informational note before.
• Verification: the text-layer checks report pages without per-page mode data as not checked instead of passing them.
• Verification: a page written as image-only that still carries a text layer now fails the spatial check instead of being skipped; characters whose position could not be measured are reported as not checked; the text-extraction check reads each page's own output mode.
• Verification: the metadata check confirms the producer field carries the fixed value and warns when it does not.
• Export: the creation and modification timestamps the system PDF writer adds are rewritten to a fixed value, like the producer tag; the metadata check confirms all three.
• Documentation: shorter code of conduct; README/CONTRIBUTING/SECURITY trimmed and corrected.
• Documentation: the README links the App Store listing and resecta.app.
• Temporary files: the orphan sweep also runs when the app returns to the foreground; a region change removes the previous output file at once; closing a session removes any leftover intermediate file.
• Documentation: storage wording for Custom Terms and saved regexes, the supported-versions table, the outbound-links and export-metadata passages, and the audit-lint check ids; the documented-counts check runs in the pull-request gate.
• Sharing: a verification result in which a check could not run on part of the output routes Share through the same slide-to-confirm as a skipped verification, listing what those checks reported.
• Verification: the operator re-extraction check scans the decoded operator text in its normalized form as well, as the string search already does, so a term spelled with a compatibility character is reported by both checks.
• Verification results: the text a check names for review and the searches the re-check lists are marked privacy-sensitive, matching the search and review surfaces.
• Saved regexes: the add row and your own patterns now sit above the built-in list.
• Trust strip reads "On-device" again, matching the home screen's tagline.
• Import: the annotation notice also counts filled form fields; their values are drawn by the viewer but are not carried into the output.
• Search: when a regular expression is refused and its shape is one a built-in detector covers, the reason names that detector.
• Verification Details. The details list on the results screen opens from a card that summarises the run. Checks that need review, failed, carry a warning or were skipped stay grouped under a Findings header and informational notes under a Notes header; a passing check with nothing more to show is a compact row with a check mark, and checks that did not pass show a status tile with a shape badge, with rows that need review or failed tinted. Check titles drop the "Layer N:" prefix and a check's run time moves into its expanded detail. A check's detail text no longer repeats its summary line, and the spatial check's edge-touch warning lists every page it links.
• Scan: names are also recognised after a role or field label's colon, beside a caption's "v.", after a sign-off or a salutation; words such as Plaintiff or DL no longer surface as names alone.
• Scan: context keywords match whole words only; the bare word "number" is no longer a phone cue (phrases such as "phone number" are), so a labelled account number with no phone cue is not read as a phone.
• Scan: a card number no longer starts inside a letter-led token.
• Scanned pages: digit groups joined by spaces, hyphens, dots, slashes or parentheses are read as digits when any group in the run has a clearly read digit.
• Search: pages with many matches no longer drop results, and a cancelled search's results stay out of the next.
• Search: bounded repetition such as (-\d{4})? is accepted; a refused pattern shows its reason and a plain-text option, and the re-check lists it as not checked; literal always-flag terms match ligature and full-width forms.
• Documentation: a public threat model (THREAT-MODEL.md) with a dated security-posture table; the security policy gains a note on report classes, the machine-readable policy pointer and an advisory-history line.
• Documentation: the README, threat model, engineering notes, security policy, known-issues list and contributing guide re-read against the 1.2.0 tree and corrected; the contributing guide shortened to the gates that exist; the package README's module notes corrected.
• Documentation: the privacy policy's on-device detection paragraph revised and its image-import note dated to the releases that opened images; the agreement's scope paragraph and one heading corrected.

Removed

• Image input: this release opens PDF files only; 1.0.0 and 1.1.0 also opened JPEG, PNG and HEIC images from Files or a drop. The Files picker lists PDFs, a dropped image is declined with the unsupported-format message, and that message now names PDF; the first-launch agreement screen and the empty sidebar say PDF, and the Paranoid Mode note no longer mentions Live Photos.

Fixed

• Searchable Redaction: on pages stored with a rotation, the text layer is rebuilt along the source lines and reads in the source's order; the spatial check reads the layer along the axis its lines run on. The rebuilt layer on such pages was previously assembled across lines and could run off the page.
• A page with an unsupported size or scale factor is reported as unsupported page geometry instead of a memory failure.
• Temporary files: the foreground sweep leaves the open document's session directory in place, and a session directory removed behind the app is re-created before the next export.
• Redact: the regions, terms and settings a run uses are read once when the run starts, and a region drawn while the run is starting is included in that run; the changed-since-verification notice follows the regions the run burned; an import is declined while a run is pending, and closing the document cancels a pending run first.
• Search: the live preview's count honours the text-layer classification and counts multi-term AND mode by page.

Security

• Links inside an imported document are not followed when tapped in the editor, and data detectors are turned off for the document the editor shows.
• Import: a document that carries JavaScript or a launch action in its catalog's name tree, in its open action, in a page's additional actions, or in an annotation's action is refused at import, as a document with those entries at the top of the catalog already was. The refusal names active content instead of a damaged file.
• Redact: a page whose rotation is not a right angle is refused before rendering, and the render follows the rotation the viewer displays.
• Export: the file identifier the system PDF writer adds is rewritten to a value derived from the file's own contents, so it carries nothing about the device, the build or the moment of export; the metadata check confirms it. Two exports of identical content carry the same identifier.
• Searchable Redaction: a page whose unmarked text shows no ink (white on white, invisible, or under a box drawn into the page) is exported as an image only; the re...