PhotoCraft reference surface (measured from 47f9306)

PhotoCraft is a Rust clean-room image editor. This addon does not link to or launch it in wave 1. Its engine command vocabulary comes from crates/engine/src/commands.rs:97-109,207-219,838-936, plus literal CommandSpec, cmd!, filter_cmd!, and style_cmd! declarations throughout crates/engine/src. dev/extract_catalog.clj currently extracts 271 distinct source-visible IDs, 147 with a source parameter token and 124 with a pointer to their source file rather than a machine-readable description. The runtime registry has additional generated/indirect entries, so this is not a complete engine.commands dump. Unknown IDs refuse; do not interpret absence as proof that the reference cannot execute an ID. commands.rs:934-1006 composes 60+ extension registries. commands.rs:838-933 generates two command IDs per adjustment kind (32 IDs extracted).

crates/ui-egui/src/control.rs:1-35 documents the desktop control methods. The extractor reads this source and records 28 UI, engine, app, and jobs method names. docs/control-protocol.md:1-37 and apps/photocraft/src/control_server.rs:12-17,50-86 specify loopback TCP JSON lines: the first request on each connection must authenticate using a 64-hex-character token, and each subsequent request and reply is one JSON line carrying id. crates/automation/src/rpc.rs:1-50 defines a separate headless JSON-lines server with doc.*, batch, methods; it is not the desktop control channel and is not conflated with the catalog here. crates/automation/src/headless.rs:15-49 exposes in-process engine sessions with denied filesystem authority by default.

Wave 1 uses source metadata, a pure JSON-lines/auth codec, and an injected transport port only. Planned wave 2 adapters: a cljw client of the program's own control TCP wire (not a shell wrapper); a Rust cdylib linking PhotoCraft engine crates in-process, hosted by a cljrs sidecar analogous to hive-kdenlive's native layout. The GUI is not started here; neither CLI nor reference engine was built here. Source-extracted metadata should be replaced or cross-checked against a live engine.commands dump once the reference builds.

Security: the token stays out of process arguments; app.open/app.save operate within granted automation roots (docs/control-protocol.md:67-85). A command's parameter doc is descriptive, not an executable schema; validation beyond command existence and JSON-object params remains the reference engine's responsibility, never an approximate validator.