[shim9610]

Implements #18's opt-in review workflow: a person edits several charts and enters separate review comments, then an agent receives one durable batch, updates runnable source and publishes a validated complete next round.

• Add figgyplot.review.Session, native/Jupyter review controls, explicit dispositions and an all-Figure barrier. Publish checkpoints before closing approved views; failed submission preserves editable input.
• Capture binary renderer inputs before upload/transfer release, preserve actual baseline/approved SSOT and exact identity-addressed diffs, and automatically reclaim superseded completed checkpoints. Keep UI comments separate from targeted API comments.
• Provide durable work IDs, recovery, writer leases, isolated source/render validation, edit reconciliation and atomic round publication. Add a CLI/filesystem adapter, versioned feedback/event schemas, a packaged companion skill and a runnable controller example.
• Fix native buffered short-click text placement, inspector popup layering and properties/review-panel overlap. Centralize complete X11 test clicks and retain actual input/SSOT probes; record browser harness phases and stop CI at its first failure.
• Add independent visual feature oracles and exact restored-array checks, including native GPU readback, browser transfer bytes and committed negative controls.
• Guard duplicate interactive views, stale revisions and instances, cache ownership, storage failures and approval retries. Ordinary plotting and manual editing remain available independently.

API, architecture and integration requirements · Measured validation

Validation: CI #60 passed all 785 tests on 5c96e6a. The four shards passed 197/196/196/196 cases; their pytest runtimes were 868.22/817.64/458.05/413.72 seconds. The required PR / Linux integration check audited actual passing JUnit node IDs against every full collection plan: zero omissions, duplicates or nonpassing cases. A separate log audit also matched all four execution orders and retained all 642 original IDs. Local checks passed 209 focused cases, nine displayed WebGPU visual cases, 14 execution-contract cases with repository-local temporary files, and 131 preflight cases. Runtime files, correctness assertions, per-test deadlines and the 45-minute per-GPU-job limit are unchanged.

Execution evidence: CI #58 passed 470 of 771 cases before the 45-minute job deadline cancelled it; no assertion failure was reported and this is not a full-suite result. The same existing radial-detail WebGPU test's first GPU submission increased from 11.622 seconds in CI #56 to 42.342 seconds, while pipeline preparation increased from 0.501 to 0.660 seconds. The nine new browser visual checks occupied approximately 125 seconds of the logged interval. Four independent runners now execute disjoint quarters of the identical full ordered collection. Assertions and per-test deadlines are preserved. Measurements.

Execution-audit regression: CI #59 caught a sample pytest subprocess inheriting the parent collection root when its temporary directory was inside the checkout. The same layout reproduced the failure locally; an explicit temporary root now isolates the sample run. All 14 execution-contract cases pass with repository-local temporary files, and preflight passes all 131 cases. The complete execution audit was retained.

Regression evidence: the original nine feature cases accepted a single black pixel on white, and ten original restoration cases accepted zero arrays. They now exercise independent authored visual expectations and complete cache/upload/device-data verification. 112 deliberately wrong results must be rejected: 45 visual faults, nine substitutions through the actual replay test, 42 zero/reversed/wrong-dtype restore payloads, 14 incorrect device/transfer contents and two cache-writer input mutations. Device/transfer controls keep settings, cache and observed upload arguments correct. The original baseline test accepted all ten original resident-data faults. A later source-capture check also accepted both writer mutations when the expectation was recorded after the write; original snapshots now precede the cache writer and renderer. The strengthened checks reject these faults. Contract, before/after evidence and local results.

Test scope: original API/combination replay fixtures are retained. Nine independent scenes verify authored locations, colors, shapes and empty regions on native and displayed WebGPU output. Recovery compares complete column identities, dtype, shape, values and payload bits at cache/upload/transfer boundaries, plus actual native GPU sample readback; coverage includes matrix edges, mapped sizes/colors, point/grid vectors, shared-X fills and panel/overlay data. Four precision cases cover float32/float64, signed zero, a custom NaN payload and infinities. Native finite readback uses the packed pair-of-f32 representation's 2e-14 relative bound; native selection JSON reports nonfinite values as null, so exact nonfinite bits are checked at the lossless boundaries rather than claimed for that JSON observation. These finite scenes do not establish every feature combination, exact font rasterization or general usability.

This remains a draft for API and workflow review. The adapter runs on the rendering host through the agent's existing execution tools; it does not invoke a model vendor automatically. Builders must provide reproducible source inputs. One interactive view per Figure is supported in review mode. No release or version bump is included.