Private crop prototype, based on candidate2491234; not promoted or release-qualified.
Open correction-crop.html on a local test server. It is included only in this isolated prototype package for testing; the reviewed candidate2491234 and its download/preview remain unchanged.

Input: a previously validated text correction sidecar and a separately prepared local static PNG page raster. The page raster is not necessarily the original Archive file. Its SHA-256 refers only to the selected local PNG bytes, never falsely to the multi-gigabyte original. No source filename or original PNG bytes enter the crop packet. The tool hashes and decodes the bounded selected file locally, without changing it.
Caps: PNG<=20MiB, each dimension<=8192, decoded pixels<=16*1024*1024. Crop<=512px per side, <=131072pixels and <=one-quarter page area. Output essential-chunk re-encoded PNG<=64KiB; JSONpacket<=100KiB. Input APNG animation is refused. Coordinates are integer decoded-PNG pixels with top-left origin; the correction's own locator must distinguish the real page.

Output contains only the small PNG derivative, page-raster hash/dimensions/byte count, region, processing declaration, asserted permission basis and correction digest. Canvas sRGB decoding/conversion is a transformation, not a byte-exact or color-exact rendering of the original. Source metadata is not copied into the derivative; only IHDR, IDAT and IEND chunks remain. Output CRC, PNG structure, byte/pixel bounds and image digest are checked on import; browser inspection additionally decodes and checks dimensions. The pure validator alone is not an image decoder or security sandbox.

A matching correction digest links content, not an authenticated creator or Archive admission. Page reference, region and permission are assertions; the importer cannot prove that another person's crop really came from that page. New exports wrap the crop in a canonical-content digest envelope binding region, permission assertion, page reference, correction reference and image. An editor can recompute an unkeyed digest, so this is change detection, not authenticated authorship. Legacy unwrapped crop packets remain inspectable with an explicit missing-provenance-digest warning and their original bytes are retained on reopen. Do not claim a signed or immutable chain. Preserve the text sidecar and prior versions separately. No submit/upload operation exists.

Tests use wholly synthetic images and records. No real personal/public Archive raster has been ingested. No native VoiceOver/WebKit, hostile decoder corpus, real first-reader or independent security review has been completed. Do not merge/promote/publish on these tests alone. Human review must inspect pixel boundaries and provenance before sharing. Unknown/private/family material stays local under Rosa; permissions assertions are not legal verification.

Local page-reference preview now outlines the selected region as X/Y/Width/Height fields change, including keyboard arrow updates. Independent view zoom and text-size sliders do not change exported pixels. Enlarged page view uses an explicitly scrollable, labeled region; this is not a screen-reader acceptance result.

Inspection contract: validateCrop/importCrop check bounded PNG structure and hashes, not successful image decoding or authenticated processing provenance. inspectCropPacket additionally returns explicit checks: legacy provenance missing versus unsigned envelope digest checked; image decoding NOT_PERFORMED; identity UNAUTHENTICATED; rights SELF_ASSERTED; admission NOT_PERFORMED. The browser UI separately decodes before exposing inspection/download, and displays its own observed decode result. A CRC/hash-valid invalid compressed PNG is not certified as an image by the structural library. A hosted receiver must not reuse the structural validator as a decoder or admission gate.
