ScanStudio 0.7.0-beta.15

ScanStudio v0.7.0-beta.15

This release focuses ScanStudio on Apple Silicon Macs and makes interrupted
rolls, saved output, and release verification easier to trust.

Everything that changed

• Fix real scanner connection failure reported in #111: the bridge now resolves
  identity through CoolscanPy's public discovery API and opens that exact ID.
  It no longer requires a nonexistent Device.info property. Missing,
  ambiguous, unsupported, and disconnected devices still fail closed.

• Diagnostic preview evidence reads the real public device capabilities, so
  known holder capacity is preserved and unknown direct-USB capacity uses the
  existing bounded diagnostic limit. A regression exercises the real driver open
  and Device implementation with only enumeration/service creation substituted.

• Early Stop requests remain latched from job acceptance through batch
  reservation and retry. CoolscanPy 0.7.6 releases a held preview session when
  a lazy batch stops or closes before dispatch, retaining ownership if child
  shutdown cannot be confirmed.

• Device eject uses the pinned driver’s confirmed-absence result directly,
  avoiding a redundant status probe that could turn success into a false error.

• Beta.14 publication was cancelled after this integration defect was reported;
  beta.15 includes that unreleased work plus the connection correction.

• Live short-strip QA on 2026-09-06 (LS-5000 ED, firmware 1.03, SA-30, C-41)
  found and fixed four app problems. A configured hardware bridge that fails
  to start is now a visible "Scanner discovery failed" error whose "Look
  Again" performs a real rescan, instead of a silent simulator-only list.
  After a hardware failure left the bridge quarantined, "Connect" reported a
  process exit that had not happened; it now names the quarantined state and
  tells the operator to quit and reopen, and the connection-lost guidance no
  longer promises that no power-cycle is needed. A refused frame after
  completed frames now shows the scanner's own reason in the batch summary,
  and a bounded exposure-meter refusal keeps its "Exposure control stopped
  safely" guidance even when the driver reports it as a roll mismatch.
  Amber buttons are readable when disabled or in an inactive window.

• ScanStudio now targets Apple Silicon (M-series, arm64) only, on macOS 14 or
  newer. Windows/Linux app ports and their duplicated source, build tooling,
  CI, and release jobs are retired. Intel DMGs are no longer built. Existing
  releases retain their original assets and historical support evidence.

• Public download and support guidance directs users of other platforms to
  upstream NegPy, whose published releases include nkscan-backed Coolscan
  scanning. Scanner and holder compatibility remains an upstream question.
  No nkscan implementation code or profiles were copied into ScanStudio.

• Package entry points reject Intel/Rosetta hosts and unsupported architecture
  requests. App, engine, Python, libusb, DMG names, and new updater metadata
  must agree on arm64. Releases publish one DMG, SHA256SUMS, and latest.json.

• Resume requires a successful current pending-frame read. A failed read,
  cancellation, project replacement, or reconnect cannot dispatch stale frames.
  Competing resume, scan, preview, and project actions are excluded while
  recovery or approval is pending. Stopped batches require fresh previews.

• Saved completion counts follow durable receipts, including when a previously
  completed frame is rescanned or the engine exits. Review imagery and project
  edits survive loss of live scanner registration without authorizing motion.

• The inspector distinguishes settings for future scans from existing files,
  exposes recorded output paths in Finder, reports missing files, and separates
  Master capture, raw/infrared exports, and processed positives/previews.
  Crop guidance explains when a retained master is needed for re-rendering.

• The preceding UX audit also fixes project/preview overlap, compact Mac window
  layout, project-launcher cancellation and progress, frame-detail keyboard pan,
  unsaved-frame analysis actions, misleading comparison labels, light appearance,
  and stop-action wording. Obsolete app-port fixes remain in Git history.

• Packaged acceptance now exercises preview, a partial stop, reopen, a real
  simulator process kill, destination refusal, and resume. It fully decodes
  the saved TIFF/JPEG images and checks dimensions, bit depth, receipt hashes,
  file identity, and preservation of completed outputs.

• The central package gate runs this acceptance on relocated apps, the macOS 14
  runner, signed packages, and mounted DMG contents. Signature verification runs
  afterward to detect accidental changes to the signed bundle.

• Main requires the complete verification gate, including for administrators.
  PR verification replaces duplicate feature-branch push runs. Release
  publication still requires successful same-run verification of the exact
  tagged commit, pinned tag objects, signing, notarization, and provenance.

• The root, app, bridge, driver, and release READMEs are fully rewritten
  around working installation, scanning, recovery, development, and release
  paths, with checked commands and links.

• The Mac acceptance guide prepares a supervised full-roll run and continuous
  observation, with separate software and physical-image evidence.

Validation

• Local Apple Silicon: 529 Rust engine unit tests and all available integration
  suites passed. The two tests requiring external real-image evidence remain
  explicitly ignored. No physical result is inferred from these tests.
• All 78 XCTest tests and 518 Swift Testing tests passed, including recovery
  races and recorded-output presentation.
• All 393 bridge tests passed, including seven real-facade cancellation
  regressions. All 178 driver facade tests passed, including held-session
  cleanup and retained ownership when child shutdown cannot be confirmed.
• All 107 root policy/acceptance tests and two packaging-policy tests passed.
  GitHub Action pin, release structure, source identity, scanner-contract, and
  hardware-support documentation checks passed.
• Packaged simulator acceptance decoded nine saved outputs and checked their
  receipts, partial-stop recovery, process interruption, and overwrite refusal.
• Attended short-strip hardware run, 2026-09-06, on a Developer ID-signed local
  build of commit 7b8dbe0 (this release's fixes minus the presentation-only
  batch-summary change): Nikon LS-5000 ED firmware 1.03, SA-30, a six-frame
  C-41 strip. Explicit preview found six frames in 19.4 s. Five frames were
  captured at 4000 ppi, 16-bit RGB + infrared, 4× sampling, ICE Legacy, in
  149–188 s each; every archive TIFF (5959×3946, 16-bit RGB), infrared TIFF,
  positive TIFF, and preview JPEG decoded and matched its receipt's SHA-256,
  byte length, inode, and volume. Frame 6 was refused by the driver's bounded
  exposure-meter controller ("meter pass 3 final controller refused:
  nonconverged") and produced no output; no automatic retry occurred. The
  first cold launch timed out the bridge handshake and recovered through
  "Look Again". Details are in docs/reviews/next-improvements-2026-09-06.md.
• The tagged workflow independently requires the full Swift, Rust, bridge, and
  CoolscanPy suites; arm64 packaging; macOS 14 execution; and updater checks
  before producing and publishing the signed release. Any failed, cancelled,
  or skipped required job prevents publication.

Platform support and installation

Download ScanStudio-0.7.0-beta.15-macOS-arm64.dmg for an Apple Silicon Mac
running macOS 14 (Sonoma) or newer. The release workflow Developer ID-signs,
notarizes, and staples both the app and DMG. Copy ScanStudio to Applications.
The app contains the hardware bridge, bundled runtime and libusb, corresponding
GPL source, and license notices.

Intel Macs, Windows, and Linux are retired ScanStudio platforms. Consult
NegPy downloads and
upstream compatibility guidance.
A downloadable package does not guarantee a particular scanner configuration.

Known limitations

The final physical full-roll acceptance run is not part of this software audit.
The 2026-09-06 short-strip run is not a full-roll pass: one of six frames was
refused by the exposure-meter controller because its metering window stayed
saturated after three bounded passes, and the driver reports that refusal as a
roll mismatch. The first cold launch of a freshly signed build timed out the
10-second bridge handshake and needed "Look Again". An earlier attempt on the
same strip lost its idle USB handle after about sixteen minutes of holding the
preview reservation, then failed a bulk read; both are recorded, not fixed.
Positive renders use the default blind exposure estimator and showed a strong
magenta cast and visible dust at 100% with ICE Legacy on this strip; no
reference scan exists to grade them.
The LS-5000 color-roll workflow remains Beta with limited retained hardware
coverage. Additional firmware, holders, adapters, and macOS configurations need
supervised evidence. LS-40/LS-50 and FireWire models remain unsupported for
scanning; physical validation issues are not represented as completed.

Simulator images cannot prove real focus, framing, color, infrared repair, or
film transport. The destination-refusal check does not reproduce full-disk or
mid-write volume failures. Continuous monitoring does not authorize automatic
physical rescans, refeeding, or competing commands while a scan is active.
Use the Mac acceptance guide for the final full-roll
run and recovery procedure.