Resecta 1.2.0

Added

• Saved searches: a Delete All control in the saved-search list, one per interface, matching the Custom Terms and Saved Regexes controls; the Settings reset dialog names all three stores.
• Search re-check. Verification gains a check that re-runs each search you applied — the same text, pattern, or term list with the same options, except that OCR is always on — on the redacted output through the search engine, and reports per search how many matches it found, how many you applied, and how many remain in the text the app can read. In Secure Rasterization the output has no text layer, so the check reads the rendered pages with OCR and says so. Pages the check could not read are listed rather than counted as clear. Both modes end with this re-check and the detection sweep below; Secure Rasterization output now runs a 7-layer check and Searchable Redaction a 12-layer check.
• Detection sweep. Verification ends with a check that runs the app's detectors on the redacted output through the search engine — your applied scan's categories and every other category at the current preset, except names and addresses, which are not swept — and reports what remains, minus the items you chose to leave unredacted, with the pages they are on. In Secure Rasterization the check reads the rendered pages with OCR and says so; pages it could not read are listed rather than counted as clear.

Changed

• Verification results: the two informational notes that every run carried — page content outside the redacted regions, and the writer's fixed metadata fields — now read as passing checks with a detail line; the results screen no longer carries the "Automated detection did not run" line — the Detection Sweep row reports what the structured detectors observed on the output, and names and addresses are not swept, which the row states in its collapsed line.
• Verification: the words fully inside a manual region on a page with a text layer are carried into the term checks, so a word you covered by hand that is still readable elsewhere on the output is reported as Attention Needed; a manual region on a page without a usable text layer is noted in the string-search check.
• Stepping through matches. As you step through matches with Previous/Next on the parked Search/Scan strip, each match is centred on the page; the page bar steps aside while you step and returns when the sheet expands.
• Diagnostics export: the coverage snapshot share writes inside the per-session directory with complete protection at write time and is withheld while the screen is captured, matching the audit export.
• Verification: the OCR check now reports a redacted term that is still readable outside every redacted region as Attention Needed on both output modes, naming the text on the results screen; it was an informational note before.
• Verification: the text-layer checks report pages without per-page mode data as not checked instead of passing them.
• Verification: a page written as image-only that still carries a text layer now fails the spatial check instead of being skipped; characters whose position could not be measured are reported as not checked; the text-extraction check reads each page's own output mode.
• Verification: the metadata check confirms the producer field carries the fixed value and warns when it does not.
• Export: the creation and modification timestamps the system PDF writer adds are rewritten to a fixed value, like the producer tag; the metadata check confirms all three.
• Documentation: shorter code of conduct; README/CONTRIBUTING/SECURITY trimmed and corrected.
• Documentation: the README links the App Store listing and resecta.app.
• Temporary files: the orphan sweep also runs when the app returns to the foreground; a region change removes the previous output file at once; closing a session removes any leftover intermediate file.
• Documentation: storage wording for Custom Terms and saved regexes, the supported-versions table, the outbound-links and export-metadata passages, and the audit-lint check ids; the documented-counts check runs in the pull-request gate.
• Sharing: a verification result in which a check could not run on part of the output routes Share through the same slide-to-confirm as a skipped verification, listing what those checks reported.
• Verification: the operator re-extraction check scans the decoded operator text in its normalized form as well, as the string search already does, so a term spelled with a compatibility character is reported by both checks.
• Verification results: the text a check names for review and the searches the re-check lists are marked privacy-sensitive, matching the search and review surfaces.
• Saved regexes: the add row and your own patterns now sit above the built-in list.
• Trust strip reads "On-device" again, matching the home screen's tagline.
• Import: the annotation notice also counts filled form fields; their values are drawn by the viewer but are not carried into the output.
• Search: when a regular expression is refused and its shape is one a built-in detector covers, the reason names that detector.
• Verification Details. The details list on the results screen opens from a card that summarises the run. Checks that need review, failed, carry a warning or were skipped stay grouped under a Findings header and informational notes under a Notes header; a passing check with nothing more to show is a compact row with a check mark, and checks that did not pass show a status tile with a shape badge, with rows that need review or failed tinted. Check titles drop the "Layer N:" prefix and a check's run time moves into its expanded detail. A check's detail text no longer repeats its summary line, and the spatial check's edge-touch warning lists every page it links.
• Scan: names are also recognised after a role or field label's colon, beside a caption's "v.", after a sign-off or a salutation; words such as Plaintiff or DL no longer surface as names alone.
• Scan: context keywords match whole words only; the bare word "number" is no longer a phone cue (phrases such as "phone number" are), so a labelled account number with no phone cue is not read as a phone.
• Scan: a card number no longer starts inside a letter-led token.
• Scanned pages: digit groups joined by spaces, hyphens, dots, slashes or parentheses are read as digits when any group in the run has a clearly read digit.
• Search: pages with many matches no longer drop results, and a cancelled search's results stay out of the next.
• Search: bounded repetition such as (-\d{4})? is accepted; a refused pattern shows its reason and a plain-text option, and the re-check lists it as not checked; literal always-flag terms match ligature and full-width forms.
• Documentation: a public threat model (THREAT-MODEL.md) with a dated security-posture table; the security policy gains a note on report classes, the machine-readable policy pointer and an advisory-history line.
• Documentation: the README, threat model, engineering notes, security policy, known-issues list and contributing guide re-read against the 1.2.0 tree and corrected; the contributing guide shortened to the gates that exist; the package README's module notes corrected.
• Documentation: the privacy policy's on-device detection paragraph revised and its image-import note dated to the releases that opened images; the agreement's scope paragraph and one heading corrected.

Removed

• Image input: this release opens PDF files only; 1.0.0 and 1.1.0 also opened JPEG, PNG and HEIC images from Files or a drop. The Files picker lists PDFs, a dropped image is declined with the unsupported-format message, and that message now names PDF; the first-launch agreement screen and the empty sidebar say PDF, and the Paranoid Mode note no longer mentions Live Photos.

Fixed

• Searchable Redaction: on pages stored with a rotation, the text layer is rebuilt along the source lines and reads in the source's order; the spatial check reads the layer along the axis its lines run on. The rebuilt layer on such pages was previously assembled across lines and could run off the page.
• A page with an unsupported size or scale factor is reported as unsupported page geometry instead of a memory failure.
• Temporary files: the foreground sweep leaves the open document's session directory in place, and a session directory removed behind the app is re-created before the next export.
• Redact: the regions, terms and settings a run uses are read once when the run starts, and a region drawn while the run is starting is included in that run; the changed-since-verification notice follows the regions the run burned; an import is declined while a run is pending, and closing the document cancels a pending run first.
• Search: the live preview's count honours the text-layer classification and counts multi-term AND mode by page.

Security

• Links inside an imported document are not followed when tapped in the editor, and data detectors are turned off for the document the editor shows.
• Import: a document that carries JavaScript or a launch action in its catalog's name tree, in its open action, in a page's additional actions, or in an annotation's action is refused at import, as a document with those entries at the top of the catalog already was. The refusal names active content instead of a damaged file.
• Redact: a page whose rotation is not a right angle is refused before rendering, and the render follows the rotation the viewer displays.
• Export: the file identifier the system PDF writer adds is rewritten to a value derived from the file's own contents, so it carries nothing about the device, the build or the moment of export; the metadata check confirms it. Two exports of identical content carry the same identifier.
• Searchable Redaction: a page whose unmarked text shows no ink (white on white, invisible, or under a box drawn into the page) is exported as an image only; the results screen names the reason.
• Detection assets: each bundled table is checked against the size and SHA-256 digest the signed manifest lists for it at first load; a mismatch on any signature-gated table withholds all five signature-gated loaders and raises the degraded-detection banner, and a mismatch on one of the other tables, the classifier assets or the audit rule catalog raises the banner while the asset stays in use unless its own loader rejects it.
• Detection assets: every versioned table fences its wire version; a table from another schema is refused by name and, for all but the nickname and name common-word lists and the audit rule catalog, reported through the load diagnostics.
• Detection assets: the manifest signing key was rotated; the bundled public key's fingerprint is pinned by a test, and the data pipeline's KEY-MANAGEMENT.md describes how the key is held, backed up and rotated.
• Verification: outcomes a check could not fully verify — a page OCR did not read, characters without a measurable position, terms too short to search — take precedence over informational notes and reach the report as could-not-verify; a page with both in-region text and a redacted term outside every region reports the stronger of the two.
• Verification: an encrypted output fails the structure check, whether or not it opens without a password.
• Search: the regular-expression gate refuses more shapes whose matching time can grow exponentially; the gate's accept/reject checks run in the gating test suite.
• Custom terms: a slow always-flag term no longer uses up the page's time budget for the terms after it; a term that runs out of time is reported as not fully checked on that page.

Internal

• Polygon regions, which the editor does not offer in this release: a polygon that covers no pixel is reported as a failed fill, and the polygon commit path applies the rectangle tool's 10-point minimum size.
• CI: the engine host suite runs on demand only; the pull-request gate's base-branch lint set includes the silent-guard scanner, and a missing or failing scanner fails the gate; Scripts/release-flag-check.sh --archive checks an archived app for debug-only launch arguments and bundled test fixtures as a recorded release step; the app's unit suite runs on pull requests to main as a non-required check and both batched suites run weekly.
• Engine: the public surface is narrowed toward the document-runner API, whose symbols are pinned at compile time (EnginePublicSurfaceTests); many detection, search and model internals become internal.

Full changelog: v1.1.0...v1.2.0