[markm39]

Drawing and selecting content across a page break previously split the interaction between page engines. Zoom settling also retained expensive surfaces and old notebook callbacks. This adds a continuous document canvas with page-local persistence/export, ordered ink and external-overlay undo/redo, bounded visible-region rendering, and corrected zoomed tap coordinates. Version: 0.3.8.

Native loads now report confirmed completion, preserve dirty pages on failed capture, and reject stale captures. A native parser accepts the exact notebook payload selected by a host's recovery logic, avoiding a second read of an older file. The existing pooled canvas remains available. Native drawing, document composition, and UI rendering are implemented for iOS and Android.

Validation:

• Full local release validation passed: types, Jest, release automation, native serialization/eraser/selection/zoom smoke tests, package build/pack, example types, and iOS/Android bundle exports. After the lazy-initial-parse fix, all 148 Jest tests, types, and package build passed again.
• Host JVM document JNI regression passed with -Xcheck:jni, including cross-page/order/round-trip/invalid-input and 30,000-page cases. Zoom and document JNI checks now run in CI.
• Release iPad simulator tests in MathNotes and OpenNotes cover dense notes, zoomed interactions, cross-page ink/text/images, mixed history, rotated image crop/reset/lock, save/relaunch, and PDF output. The 0.3.8 OpenNotes full suite passed all nine tests, including its four performance workloads.
• MathNotes selected-payload native parser: dense tab workload averaged 4.572 CPU seconds and 690 MB peak physical memory over three trials, versus 6.447 seconds and 1,294 MB for direct JS parsing; repeated-visit memory check passed. These are workload CPU measurements, not tap latency. No physical-iPad or Android-device performance claim is made.

Simplify and security review findings were fixed: repeated initial JSON parsing, native callback retention, unsafe capture/load fallbacks, and stale-file selection. No remaining security finding in the shared-engine changes. Native parse input remains data and errors reject rather than authorizing a blank save.

File-size exceptions: existing native view/bridge classes, engine rendering/selection files, InfiniteInkCanvas, NativeInkCanvas, PooledCanvasSlot, useZoomableViewportGestures, and its existing pool test harness remain above 500 lines. Their private native state, exported selectors/JNI signatures, or shared hook/ref lifecycle are interdependent; splitting these safely would require a separate state/ABI or test-harness refactor and broaden this already substantial rendering change. New document codec, document canvas, native parser extension, zoom rendering, viewport callback/transition helpers, and regression files are separated. The legacy class boundaries are intentionally retained; no placeholder implementation is shipped.

Android limitation: example bundle and host JNI checks pass, but a full Android Gradle/device render run has not been performed in this environment. iOS simulator verification does not substitute for physical-device performance.

Additional native failure regression: a malformed drawing payload previously escaped the iOS typed C++ catch when linked with bundled Skia. All document bridge entry points now reject otherwise-unmatched exceptions. The OpenNotes Release XCTest passes retry, library return, relaunch, and reopening; the original notebook SHA256 is unchanged. The recovery screenshot was visually inspected. Simplify/security review of this boundary fix found no additional issues.