Pin stable-diffusion-native v0.3.0-4 and decode full VAEs on iOS Metal (#1047) - #2005

Summary

• Pins stable-diffusion-native v0.3.0-4 (prerelease; native commit 4a84ac24, manifest SHA-256 86c67491…33a1) and regenerates the bindings (sd_dart_graph_split_set_threshold, sd_dart_graph_split_threshold, sd_dart_graph_split_cuts).
• On iOS Metal the runtime splits graphs (threshold 2^26 elements), so ImageGenerationEngine.load no longer refuses a full VAE when sd_dart_graph_split_threshold exists and returns above 0 (StableDiffusionCalls.graphSplit, StableDiffusionRuntimeStatus.splitsGraphsOnMetal). A runtime without it keeps the refusal and the intrinsic-tiny route; its message names v0.3.0-4. The vaeDirectConvolution: true refusal (#1044) is unchanged.
• Part of #1047, 0.19.10 plan #1995.

Production-readiness scope

• User-facing scope: full-VAE recipes (SD-Turbo with its embedded VAE, external decoders) decode on iOS Metal without tripping the GPU watchdog.
• Supported platforms/paths: iOS Metal with the v0.3.0-4 runtime (the pin). Other platforms unchanged.
• Unsupported or intentionally unavailable paths: a runtime without the export throws LlamaUnsupportedException (iOS Metal full VAE) as before. Known limit: on iOS 26 the second engine dispose can leave about 2 GB resident, so later loads may fail the memory check (#2004); documented, not fixed here.
• Out of scope / follow-ups: #2004. llamadart_stable_diffusion_flutter is re-released at release prep: its ## Unreleased section (Package.swift pin and checksum already synced) becomes the next version, floor stableDiffusionAppleCompanionVersion = '0.19.10'. stableDiffusionCompatibleAppleCompanionTags is empty (the sync clears it), so no older Apple SD companion is admitted; release prep must either qualify v0.3.0-3 with a compatibility fixture or accept the exclusion (verify_release_docs_versions.dart already reports the pending bump). Final public-API DDP qualification at the PR head is pending (separate run).

Completeness checklist

• Declared scope is fully implemented, or explicitly reduced above.
• Unsupported platform/option combinations fail loudly with actionable diagnostics or are clearly documented as unavailable.
• Public API docs, README/website docs, examples, support matrices, and changelog entries are updated where relevant.
• Regression coverage covers the original issue plus key negative/version-skew paths where relevant.
• Validation coverage registry updated (capability_coverage.json reason for the iOS Metal VAE restriction); validation_coverage_test.dart passes.
• Security/privacy review completed: no secrets, tokens, signed URLs or secret-bearing paths added.
• Follow-up work is tracked in GitHub Issues (#2004).

PR type guidance

• Feature PR: API surface is internal (lib/src); docs, support matrix, skill, changelog updated; tests cover the split-runtime load, the old-runtime refusal, the probe, and the retained vaeDirectConvolution: true returns corrupt images on iPhone Metal #1044 refusal.

Test Plan

• dart run tool/prepare_workspace.dart
• dart format --output=none --set-exit-if-changed .
• dart analyze
• TMPDIR="$(mktemp -d)" dart test -p vm -j 1 --exclude-tags local-only (14497 passed)
• dart test -p chrome --exclude-tags local-only (4914 passed)
• coverage-lib: 93.93% line coverage
• dart test -p vm test/unit/tooling/ (including validation_coverage_test.dart and package_skills_test.dart), check_platform_boundaries.dart, python3 tool/native/test_sync_stable_diffusion_bindings.py, python3 tool/native/test_sync_native_release_pins.py, ./tool/docs/build_site.sh
• dart test -p vm --run-skipped -t local-only test/integration/stable_diffusion_runtime_hook_test.dart (macOS)
• Mutations: forcing the engine's splitsGraphsOnMetal check to false fails the split-runtime load test; forcing the probe's splitsGraphsOnMetal to false fails the probe test.

Matrix Evidence

Review Notes

• Independent review status: pending (high-risk; auditor required before ready).
• CI status / head SHA: pending, 3109f05df.

High-risk regression review

• Classification: high-risk (artifactConsumer, backendRuntime)
• Implementation task: this PR (worker, lane 1047-pin)
• Independent blocking QA task: pending
• Exact head / current base: 3109f05df / cde82afb0
• Production-branch deletion, bypass, or miswire proof: the engine's requiresIosTinyDecoder now also needs !runtime.splitsGraphsOnMetal; the flag comes only from the runtime probe (sd_dart_graph_split_threshold > 0). Tests cover both paths; mutating the flag fails them.
• Affected-family real-model/artifact evidence: SD-Turbo f16-q8_0 full VAE on iPhone 16 Pro (iOS 18.3) and iPhone 17 Pro, plus macOS Metal smoke above. Final public-API run at this head: pending.
• Explicit unavailable-family or other N/A evidence: iOS 26 second-dispose residency (#2004) is a known limit.
• Known PR-caused P1 regressions: 0
• Unresolved review threads: 0