diff --git a/.github/workflows/release-runtime.yml b/.github/workflows/release-runtime.yml
index 361010fc..e934b8fb 100644
--- a/.github/workflows/release-runtime.yml
+++ b/.github/workflows/release-runtime.yml
@@ -4,6 +4,8 @@ on:
   push:
     tags:
       - "v*"
+  pull_request:
+    branches: ["main"]
   workflow_dispatch:
 
 permissions:
@@ -25,6 +27,7 @@ jobs:
       - name: Checkout release source
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
+          fetch-depth: 0
           persist-credentials: false
 
       - name: Setup uv with Python 3.12
@@ -49,6 +52,8 @@ jobs:
             test "$actual_tag" = "$expected_tag"
             test "$GITHUB_REF_TYPE" = "tag"
             test "$GITHUB_REF_NAME" = "$expected_tag"
+            git show-ref --verify --quiet refs/remotes/origin/main
+            git merge-base --is-ancestor HEAD refs/remotes/origin/main
           fi
           echo "version=$version" >> "$GITHUB_OUTPUT"
           echo "source_date_epoch=$(git show -s --format=%ct HEAD)" >> "$GITHUB_OUTPUT"
@@ -87,7 +92,7 @@ jobs:
   publish:
     name: Sign, attest, and publish
     needs: macos-runtime
-    if: github.event_name == 'push'
+    if: github.event_name == 'push' && github.ref_type == 'tag'
     runs-on: ubuntu-latest
     permissions:
       attestations: write
@@ -97,6 +102,7 @@ jobs:
       - name: Checkout release source
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
+          fetch-depth: 0
           persist-credentials: false
 
       - name: Setup uv with Python 3.12
@@ -117,6 +123,8 @@ jobs:
           test "$actual_tag" = "$expected_tag"
           test "$GITHUB_REF_TYPE" = "tag"
           test "$GITHUB_REF_NAME" = "$expected_tag"
+          git show-ref --verify --quiet refs/remotes/origin/main
+          git merge-base --is-ancestor HEAD refs/remotes/origin/main
           echo "version=$version" >> "$GITHUB_OUTPUT"
           echo "tag=$expected_tag" >> "$GITHUB_OUTPUT"
           echo "tag_version=${version/+/-}" >> "$GITHUB_OUTPUT"
diff --git a/UPSTREAM_BASE.toml b/UPSTREAM_BASE.toml
index c9f70be5..19d6c8b3 100644
--- a/UPSTREAM_BASE.toml
+++ b/UPSTREAM_BASE.toml
@@ -1,7 +1,7 @@
 # Gloss downstream provenance. Update downstream.version for every downstream
 # release; update the upstream block only in a reviewed upstream sync PR.
 [downstream]
-version = "0.6.4+gloss.3"
+version = "0.6.4+gloss.4"
 runtime_api_version = 1
 
 [upstream]
diff --git a/babeldoc/__init__.py b/babeldoc/__init__.py
index b8b43ea2..5e384107 100644
--- a/babeldoc/__init__.py
+++ b/babeldoc/__init__.py
@@ -1,2 +1,2 @@
 # Gloss downstream release identity; see DOWNSTREAM.md.
-__version__ = "0.6.4+gloss.3"
+__version__ = "0.6.4+gloss.4"
diff --git a/babeldoc/const.py b/babeldoc/const.py
index e59ba0cd..2690dee5 100644
--- a/babeldoc/const.py
+++ b/babeldoc/const.py
@@ -7,7 +7,7 @@
 from pathlib import Path
 
 # Gloss downstream release identity; see DOWNSTREAM.md.
-__version__ = "0.6.4+gloss.3"
+__version__ = "0.6.4+gloss.4"
 
 CACHE_FOLDER = Path.home() / ".cache" / "babeldoc"
 
diff --git a/babeldoc/main.py b/babeldoc/main.py
index 3421035f..f3b1200c 100644
--- a/babeldoc/main.py
+++ b/babeldoc/main.py
@@ -27,7 +27,7 @@
 
 logger = logging.getLogger(__name__)
 # Gloss downstream release identity; see DOWNSTREAM.md.
-__version__ = "0.6.4+gloss.3"
+__version__ = "0.6.4+gloss.4"
 
 
 def create_parser():
diff --git a/docs/release-notes/v0.6.4-gloss.4.md b/docs/release-notes/v0.6.4-gloss.4.md
new file mode 100644
index 00000000..135c8b9e
--- /dev/null
+++ b/docs/release-notes/v0.6.4-gloss.4.md
@@ -0,0 +1,50 @@
+# BabelDOC 0.6.4+gloss.4
+
+This downstream release supersedes the unpublished `0.6.4+gloss.3` build and
+completes the managed runtime path used by the Gloss macOS application.
+
+## Performance and observability
+
+- Repeated fallback-font resource lookups are cached for the lifetime of each
+  isolated PDF worker.
+- Eligible single-part PDFs can reuse a private, bounded layout-IR session
+  cache. The cache key is derived inside BabelDOC from stable input bytes,
+  runtime version, page count, and parser-affecting options; clients cannot
+  choose cache paths or keys.
+- Progress and terminal results expose monotonic phase timings for launch,
+  parse, translation, typesetting, save, and final validation, together with a
+  stable layout-cache status.
+
+## Distribution
+
+- Release automation builds reproducible wheel, sdist, and exact-source
+  archives.
+- Native arm64 and x86_64 macOS archives contain a self-contained
+  `gloss-babeldoc` runtime and are smoke-tested after extraction.
+- The runtime manifest lists verified artifact digests and the executable path
+  for each architecture, and requires Gloss 0.8.0 or newer. Archives contain
+  only regular files and directories, including a real mode-0755 executable,
+  LICENSE, NOTICE, a runtime README, and its machine-readable version record.
+  A detached Ed25519 signature is mandatory, and the workflow fails closed if
+  the configured key is absent or does not match the pinned release public key.
+- Checksums, AGPL source, notices, machine-readable provenance, and GitHub
+  artifact attestations accompany the release.
+
+## Release reliability
+
+- The macOS Intel runtime uses the newest supported ONNX Runtime line that
+  publishes both x86_64 and arm64 wheels.
+- Internal Python framework directory aliases are safely materialized in the
+  runtime archive; dangling, cyclic, out-of-bundle, and special-file entries
+  remain rejected.
+- Both native runtime builds and their extracted smoke tests now run on pull
+  requests, before a release tag can be created.
+- Release tags must identify the matching project version and a commit contained
+  in the repository's `main` history.
+
+## Security
+
+- The XML control-character range is expressed unambiguously.
+- Reviewed CodeQL annotations document the MD5 and SHA-2 transforms mandated
+  by ISO 32000 encrypted-PDF compatibility without disabling those queries for
+  other application code.
diff --git a/pyproject.toml b/pyproject.toml
index db3c146d..e484baa3 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,7 +1,7 @@
 # Gloss downstream modification: release identity and runtime handshake, 2026-07-21.
 [project]
 name = "BabelDOC"
-version = "0.6.4+gloss.3"
+version = "0.6.4+gloss.4"
 description = "Gloss-maintained downstream of the BabelDOC document translator"
 license = "AGPL-3.0"
 readme = "README.md"
@@ -25,8 +25,7 @@ dependencies = [
     "huggingface-hub>=0.27.0",
     "numpy>=2.0.2",
     "onnx>=1.21.0",
-    "onnxruntime>=1.16.1,<1.24; python_version < '3.11'",
-    "onnxruntime>=1.16.1; python_version >= '3.11'",
+    "onnxruntime>=1.16.1,<1.24",
     "openai>=1.59.3",
     "orjson>=3.10.14",
     "charset-normalizer >= 2.0.0",
@@ -171,7 +170,7 @@ pythonpath = [".", "src"]
 testpaths = ["tests"]
 
 [bumpver]
-current_version = "0.6.4+gloss.3"
+current_version = "0.6.4+gloss.4"
 version_pattern = "MAJOR.MINOR.PATCH+gloss.NUM"
 
 [bumpver.file_patterns]
diff --git a/scripts/release/archive_runtime.py b/scripts/release/archive_runtime.py
index 45439b33..ad1b0489 100644
--- a/scripts/release/archive_runtime.py
+++ b/scripts/release/archive_runtime.py
@@ -9,6 +9,12 @@
 
 def create_archive(source: Path, output: Path, *, epoch: int) -> None:
     source = source.resolve(strict=True)
+    try:
+        output.resolve(strict=False).relative_to(source)
+    except ValueError:
+        pass
+    else:
+        raise ValueError("runtime archive output must be outside the source bundle")
     output.parent.mkdir(parents=True, exist_ok=True)
     with output.open("wb") as raw_output:
         with gzip.GzipFile(
@@ -29,6 +35,7 @@ def create_archive(source: Path, output: Path, *, epoch: int) -> None:
                     source.name,
                     source_root=source,
                     epoch=epoch,
+                    active_directories=frozenset(),
                 )
 
 
@@ -39,16 +46,31 @@ def _add_path(
     *,
     source_root: Path,
     epoch: int,
+    active_directories: frozenset[tuple[int, int]],
 ) -> None:
     if path.is_symlink():
-        resolved_path = path.resolve(strict=True)
+        try:
+            resolved_path = path.resolve(strict=True)
+        except (OSError, RuntimeError) as exc:
+            raise ValueError(f"runtime symlink cannot be resolved: {path}") from exc
         try:
             resolved_path.relative_to(source_root)
         except ValueError as exc:
             raise ValueError(f"runtime symlink escapes the bundle: {path}") from exc
-        if not resolved_path.is_file():
-            raise ValueError(f"runtime symlink must resolve to a regular file: {path}")
+        if not resolved_path.is_file() and not resolved_path.is_dir():
+            raise ValueError(
+                f"runtime symlink must resolve to a regular file or directory: {path}"
+            )
         path = resolved_path
+    if not path.is_file() and not path.is_dir():
+        raise ValueError(f"runtime entry must be a regular file or directory: {path}")
+    next_active_directories = active_directories
+    if path.is_dir():
+        directory_stat = path.stat()
+        directory_identity = (directory_stat.st_dev, directory_stat.st_ino)
+        if directory_identity in active_directories:
+            raise ValueError(f"runtime symlink creates a directory cycle: {path}")
+        next_active_directories = active_directories | {directory_identity}
     info = archive.gettarinfo(os.fspath(path), arcname=archive_name)
     if info.issym() or info.islnk():
         raise ValueError(f"runtime archive cannot contain links: {archive_name}")
@@ -70,6 +92,7 @@ def _add_path(
                 f"{archive_name}/{child.name}",
                 source_root=source_root,
                 epoch=epoch,
+                active_directories=next_active_directories,
             )
 
 
diff --git a/tests/test_release_tools.py b/tests/test_release_tools.py
index 731ab4c0..a6c3efa4 100644
--- a/tests/test_release_tools.py
+++ b/tests/test_release_tools.py
@@ -3,6 +3,7 @@
 import base64
 import hashlib
 import json
+import os
 import tarfile
 from pathlib import Path
 
@@ -17,8 +18,8 @@
 from scripts.release.sign_manifest import sign_manifest
 from scripts.release.sign_manifest import verify_manifest
 
-VERSION = "0.6.4+gloss.3"
-TAG_VERSION = "0.6.4-gloss.3"
+VERSION = "0.6.4+gloss.4"
+TAG_VERSION = "0.6.4-gloss.4"
 SOURCE_DATE_EPOCH = 1_750_000_000
 
 
@@ -125,6 +126,90 @@ def test_runtime_archive_rejects_symlinks_outside_bundle(tmp_path: Path) -> None
         )
 
 
+def test_runtime_archive_materializes_directory_symlinks_inside_bundle(
+    tmp_path: Path,
+) -> None:
+    bundle = tmp_path / "gloss-babeldoc-runtime"
+    resources = bundle / "_internal" / "Python.framework" / "Versions" / "3.12"
+    resources.mkdir(parents=True)
+    (resources / "Info.plist").write_text("framework metadata\n", encoding="utf-8")
+    framework = bundle / "_internal" / "Python.framework"
+    (framework / "Resources").symlink_to(
+        "Versions/3.12",
+        target_is_directory=True,
+    )
+
+    output = tmp_path / "runtime.tar.gz"
+    create_archive(bundle, output, epoch=SOURCE_DATE_EPOCH)
+
+    with tarfile.open(output, "r:gz") as archive:
+        alias = archive.getmember(
+            "gloss-babeldoc-runtime/_internal/Python.framework/Resources"
+        )
+        alias_file = archive.getmember(
+            "gloss-babeldoc-runtime/_internal/Python.framework/Resources/Info.plist"
+        )
+        assert alias.isdir()
+        assert alias_file.isfile()
+        assert archive.extractfile(alias_file).read() == b"framework metadata\n"
+        assert not any(
+            member.issym() or member.islnk() for member in archive.getmembers()
+        )
+
+
+def test_runtime_archive_rejects_directory_symlink_cycles(tmp_path: Path) -> None:
+    bundle = tmp_path / "gloss-babeldoc-runtime"
+    nested = bundle / "nested"
+    nested.mkdir(parents=True)
+    (nested / "back").symlink_to(bundle, target_is_directory=True)
+
+    with pytest.raises(ValueError, match="directory cycle"):
+        create_archive(
+            bundle,
+            tmp_path / "runtime.tar.gz",
+            epoch=SOURCE_DATE_EPOCH,
+        )
+
+
+def test_runtime_archive_rejects_unresolvable_symlinks(tmp_path: Path) -> None:
+    bundle = tmp_path / "gloss-babeldoc-runtime"
+    bundle.mkdir()
+    (bundle / "missing").symlink_to("not-present")
+
+    with pytest.raises(ValueError, match="cannot be resolved"):
+        create_archive(
+            bundle,
+            tmp_path / "runtime.tar.gz",
+            epoch=SOURCE_DATE_EPOCH,
+        )
+
+
+def test_runtime_archive_rejects_special_entries(tmp_path: Path) -> None:
+    bundle = tmp_path / "gloss-babeldoc-runtime"
+    bundle.mkdir()
+    fifo = bundle / "runtime.fifo"
+    os.mkfifo(fifo)
+
+    with pytest.raises(ValueError, match="regular file or directory"):
+        create_archive(
+            bundle,
+            tmp_path / "runtime.tar.gz",
+            epoch=SOURCE_DATE_EPOCH,
+        )
+
+
+def test_runtime_archive_rejects_output_inside_source(tmp_path: Path) -> None:
+    bundle = tmp_path / "gloss-babeldoc-runtime"
+    bundle.mkdir()
+
+    with pytest.raises(ValueError, match="outside the source bundle"):
+        create_archive(
+            bundle,
+            bundle / "runtime.tar.gz",
+            epoch=SOURCE_DATE_EPOCH,
+        )
+
+
 def test_release_manifest_has_strict_gloss_asset_contract(tmp_path: Path) -> None:
     for architecture in ("arm64", "x86_64"):
         filename = f"gloss-babeldoc-{TAG_VERSION}-macos-{architecture}.tar.gz"
diff --git a/uv.lock b/uv.lock
index d9d54621..ee4e915d 100644
--- a/uv.lock
+++ b/uv.lock
@@ -2,9 +2,15 @@ version = 1
 revision = 3
 requires-python = ">=3.10, <3.14"
 resolution-markers = [
-    "python_full_version >= '3.13'",
-    "python_full_version == '3.12.*'",
-    "python_full_version == '3.11.*'",
+    "python_full_version >= '3.13' and platform_machine == 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version >= '3.13' and sys_platform != 'darwin'",
+    "python_full_version >= '3.13' and platform_machine != 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.12.*' and platform_machine == 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.12.*' and sys_platform != 'darwin'",
+    "python_full_version == '3.12.*' and platform_machine != 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.11.*' and platform_machine == 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.11.*' and sys_platform != 'darwin'",
+    "python_full_version == '3.11.*' and platform_machine != 'x86_64' and sys_platform == 'darwin'",
     "python_full_version < '3.11'",
 ]
 
@@ -51,7 +57,7 @@ wheels = [
 
 [[package]]
 name = "babeldoc"
-version = "0.6.4+gloss.3"
+version = "0.6.4+gloss.4"
 source = { editable = "." }
 dependencies = [
     { name = "bitstring" },
@@ -69,8 +75,7 @@ dependencies = [
     { name = "numpy", version = "2.4.6", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version == '3.11.*'" },
     { name = "numpy", version = "2.5.1", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.12'" },
     { name = "onnx" },
-    { name = "onnxruntime", version = "1.23.2", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11'" },
-    { name = "onnxruntime", version = "1.27.0", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.11'" },
+    { name = "onnxruntime" },
     { name = "openai" },
     { name = "opencv-python-headless" },
     { name = "orjson" },
@@ -145,8 +150,7 @@ requires-dist = [
     { name = "msgpack", specifier = ">=1.1.0" },
     { name = "numpy", specifier = ">=2.0.2" },
     { name = "onnx", specifier = ">=1.21.0" },
-    { name = "onnxruntime", marker = "python_full_version < '3.11'", specifier = ">=1.16.1,<1.24" },
-    { name = "onnxruntime", marker = "python_full_version >= '3.11'", specifier = ">=1.16.1" },
+    { name = "onnxruntime", specifier = ">=1.16.1,<1.24" },
     { name = "onnxruntime-directml", marker = "extra == 'directml'", specifier = ">=1.16.1" },
     { name = "onnxruntime-gpu", marker = "extra == 'cuda'", specifier = ">=1.16.1" },
     { name = "openai", specifier = ">=1.59.3" },
@@ -600,7 +604,7 @@ name = "coloredlogs"
 version = "15.0.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "humanfriendly", marker = "python_full_version < '3.11'" },
+    { name = "humanfriendly" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/cc/c7/eed8f27100517e8c0e6b923d5f0845d0cb99763da6fdee00478f91db7325/coloredlogs-15.0.1.tar.gz", hash = "sha256:7c991aa71a4577af2f82600d8f8f3a89f936baeaf9b50a9c197da014e5bf16b0", size = 278520, upload-time = "2021-06-11T10:22:45.202Z" }
 wheels = [
@@ -863,7 +867,7 @@ name = "humanfriendly"
 version = "10.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "pyreadline3", marker = "python_full_version < '3.11' and sys_platform == 'win32'" },
+    { name = "pyreadline3", marker = "sys_platform == 'win32'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/cc/3f/2c29224acb2e2df4d2046e4c73ee2662023c58ff5b113c4c1adac0886c43/humanfriendly-10.0.tar.gz", hash = "sha256:6b0b831ce8f15f7300721aa49829fc4e83921a9a301cc7f606be6686a2288ddc", size = 360702, upload-time = "2021-09-17T21:40:43.31Z" }
 wheels = [
@@ -1266,7 +1270,7 @@ name = "macholib"
 version = "1.16.4"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "altgraph" },
+    { name = "altgraph", marker = "python_full_version < '3.11' or sys_platform == 'darwin'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/10/2f/97589876ea967487978071c9042518d28b958d87b17dceb7cdc1d881f963/macholib-1.16.4.tar.gz", hash = "sha256:f408c93ab2e995cd2c46e34fe328b130404be143469e41bc366c807448979362", size = 59427, upload-time = "2025-11-22T08:28:38.373Z" }
 wheels = [
@@ -1738,9 +1742,15 @@ name = "networkx"
 version = "3.6.1"
 source = { registry = "https://pypi.org/simple" }
 resolution-markers = [
-    "python_full_version >= '3.13'",
-    "python_full_version == '3.12.*'",
-    "python_full_version == '3.11.*'",
+    "python_full_version >= '3.13' and platform_machine == 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version >= '3.13' and sys_platform != 'darwin'",
+    "python_full_version >= '3.13' and platform_machine != 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.12.*' and platform_machine == 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.12.*' and sys_platform != 'darwin'",
+    "python_full_version == '3.12.*' and platform_machine != 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.11.*' and platform_machine == 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.11.*' and sys_platform != 'darwin'",
+    "python_full_version == '3.11.*' and platform_machine != 'x86_64' and sys_platform == 'darwin'",
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/6a/51/63fe664f3908c97be9d2e4f1158eb633317598cfa6e1fc14af5383f17512/networkx-3.6.1.tar.gz", hash = "sha256:26b7c357accc0c8cde558ad486283728b65b6a95d85ee1cd66bafab4c8168509", size = 2517025, upload-time = "2025-12-08T17:02:39.908Z" }
 wheels = [
@@ -1826,7 +1836,9 @@ name = "numpy"
 version = "2.4.6"
 source = { registry = "https://pypi.org/simple" }
 resolution-markers = [
-    "python_full_version == '3.11.*'",
+    "python_full_version == '3.11.*' and platform_machine == 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.11.*' and sys_platform != 'darwin'",
+    "python_full_version == '3.11.*' and platform_machine != 'x86_64' and sys_platform == 'darwin'",
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/d0/ad/fed0499ce6a338d2a03ebae59cd15093910c8875328855781952abf6c2fe/numpy-2.4.6.tar.gz", hash = "sha256:f3a3570c4a2a16746ac2c31a7c7c7b0c186b95ce902e33db6f28094ed7387dda", size = 20735807, upload-time = "2026-05-18T23:37:14.07Z" }
 wheels = [
@@ -1887,8 +1899,12 @@ name = "numpy"
 version = "2.5.1"
 source = { registry = "https://pypi.org/simple" }
 resolution-markers = [
-    "python_full_version >= '3.13'",
-    "python_full_version == '3.12.*'",
+    "python_full_version >= '3.13' and platform_machine == 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version >= '3.13' and sys_platform != 'darwin'",
+    "python_full_version >= '3.13' and platform_machine != 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.12.*' and platform_machine == 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.12.*' and sys_platform != 'darwin'",
+    "python_full_version == '3.12.*' and platform_machine != 'x86_64' and sys_platform == 'darwin'",
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/22/fd/89965aa4ac08c74998539fcbf24fa3540f3e15237fbeb6bcf9c908f4aade/numpy-2.5.1.tar.gz", hash = "sha256:a48a113e6afea91f5608793bafa7ef2ad481fefbda87ec5069f483de61cb9fa3", size = 20755553, upload-time = "2026-07-04T17:08:00.933Z" }
 wheels = [
@@ -1954,16 +1970,15 @@ wheels = [
 name = "onnxruntime"
 version = "1.23.2"
 source = { registry = "https://pypi.org/simple" }
-resolution-markers = [
-    "python_full_version < '3.11'",
-]
 dependencies = [
-    { name = "coloredlogs", marker = "python_full_version < '3.11'" },
-    { name = "flatbuffers", marker = "python_full_version < '3.11'" },
+    { name = "coloredlogs" },
+    { name = "flatbuffers" },
     { name = "numpy", version = "2.2.6", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11'" },
-    { name = "packaging", marker = "python_full_version < '3.11'" },
-    { name = "protobuf", marker = "python_full_version < '3.11'" },
-    { name = "sympy", marker = "python_full_version < '3.11'" },
+    { name = "numpy", version = "2.4.6", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version == '3.11.*'" },
+    { name = "numpy", version = "2.5.1", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.12'" },
+    { name = "packaging" },
+    { name = "protobuf" },
+    { name = "sympy" },
 ]
 wheels = [
     { url = "https://files.pythonhosted.org/packages/35/d6/311b1afea060015b56c742f3531168c1644650767f27ef40062569960587/onnxruntime-1.23.2-cp310-cp310-macosx_13_0_arm64.whl", hash = "sha256:a7730122afe186a784660f6ec5807138bf9d792fa1df76556b27307ea9ebcbe3", size = 17195934, upload-time = "2025-10-27T23:06:14.143Z" },
@@ -1990,42 +2005,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/b6/ca/862b1e7a639460f0ca25fd5b6135fb42cf9deea86d398a92e44dfda2279d/onnxruntime-1.23.2-cp313-cp313t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:e2b9233c4947907fd1818d0e581c049c41ccc39b2856cc942ff6d26317cee145", size = 17394184, upload-time = "2025-10-22T03:47:08.127Z" },
 ]
 
-[[package]]
-name = "onnxruntime"
-version = "1.27.0"
-source = { registry = "https://pypi.org/simple" }
-resolution-markers = [
-    "python_full_version >= '3.13'",
-    "python_full_version == '3.12.*'",
-    "python_full_version == '3.11.*'",
-]
-dependencies = [
-    { name = "flatbuffers", marker = "python_full_version >= '3.11'" },
-    { name = "numpy", version = "2.4.6", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version == '3.11.*'" },
-    { name = "numpy", version = "2.5.1", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.12'" },
-    { name = "packaging", marker = "python_full_version >= '3.11'" },
-    { name = "protobuf", marker = "python_full_version >= '3.11'" },
-]
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/d4/e4/5353d7e09ced4a8f473f843223fc75d726b2b5519dcefc12f22a6c92852d/onnxruntime-1.27.0-cp311-cp311-macosx_14_0_arm64.whl", hash = "sha256:8ba14a38c570087f3cdb8cfba33f7a38a1e826c1e5b29e17c28ceda0cc910016", size = 18416484, upload-time = "2026-06-15T22:43:43.894Z" },
-    { url = "https://files.pythonhosted.org/packages/ed/1f/a2117aa3f144fce88774efa37440d0ca72d0c9144854dfc0961f2b04c6fc/onnxruntime-1.27.0-cp311-cp311-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:2eb083321af8a236a84c7c140a7f4cecbfa2a987a18c07c78db471c20cd390ef", size = 16419330, upload-time = "2026-06-15T22:42:37.58Z" },
-    { url = "https://files.pythonhosted.org/packages/e0/cd/74bb804170ceb622fda9111df31a07b3024f7491472256d3a90b5391a4d2/onnxruntime-1.27.0-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:e4f7b0e90d2d212e2c2deaa6c8291616183ab815d3ec558ea12d3ac8b26d36f4", size = 18636930, upload-time = "2026-06-15T22:43:01.584Z" },
-    { url = "https://files.pythonhosted.org/packages/fe/8f/5b8e2b85e81735696887175dbaf6409f215683f5ca9d4928fbb038211d32/onnxruntime-1.27.0-cp311-cp311-win_amd64.whl", hash = "sha256:ff050e4f6bf7f12918fa14dcb047c0b02e295f35e86d42532552be4b3d54e977", size = 13356110, upload-time = "2026-06-15T22:43:32.172Z" },
-    { url = "https://files.pythonhosted.org/packages/b0/3a/4f568de678126b6a371a93862f015a82138359decd97fcac61fc84b5b774/onnxruntime-1.27.0-cp311-cp311-win_arm64.whl", hash = "sha256:75fbc1e1fb43a39a856c8209c544cca7817b5de7ac16b15b1bdf55d1cc67b9df", size = 13098635, upload-time = "2026-06-15T22:43:19.607Z" },
-    { url = "https://files.pythonhosted.org/packages/c3/b7/dd3a524ed93a820dff1af902d0412957ab12499953333e9daa01af5bc480/onnxruntime-1.27.0-cp312-cp312-macosx_14_0_arm64.whl", hash = "sha256:a14c2ce45312def86b77aea651f46565e45960cf5f0721bfdff449165086ab76", size = 18433506, upload-time = "2026-06-15T22:43:47.026Z" },
-    { url = "https://files.pythonhosted.org/packages/84/86/c3b6b17745a1997d784dadc9bd88d713d2e6721139a5a0e885b28cfb79b1/onnxruntime-1.27.0-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:c6fddce0539a4898c7bef35b052ffd37935b2190e35488eab99ce91887743ea1", size = 16438140, upload-time = "2026-06-15T22:42:40.666Z" },
-    { url = "https://files.pythonhosted.org/packages/26/81/24dd9b31b0fb912ee19ca53ac1c9764bfd79d58a2ccef564eb693be831a5/onnxruntime-1.27.0-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:7c65a7438632d55dfbc8a02ee60bd6cf7dd9d1ba05a43d4b851452f32338e194", size = 18658316, upload-time = "2026-06-15T22:43:04.012Z" },
-    { url = "https://files.pythonhosted.org/packages/4f/88/8ec9db1a4d126bb8b758992beb40d1249df171917d75f44a327eb5f20dda/onnxruntime-1.27.0-cp312-cp312-win_amd64.whl", hash = "sha256:20c321cf187ba496e648acf6b4cf90b4d398b0d17c2a77fdaeba365b908cc1c1", size = 13358769, upload-time = "2026-06-15T22:43:34.581Z" },
-    { url = "https://files.pythonhosted.org/packages/ae/9f/fdad359dfcba7e7cd8815569b304a596531d4efa77a75d77f8b4981891a2/onnxruntime-1.27.0-cp312-cp312-win_arm64.whl", hash = "sha256:d0d1f68868e2ef30ef70998ba9bbbc5c305e9b17041e3936751c1b8aa6aade06", size = 13104440, upload-time = "2026-06-15T22:43:22.893Z" },
-    { url = "https://files.pythonhosted.org/packages/fb/2b/54208fd03ad410480bc17edf4869376362da8bbf46fe186ddf4cb5cc20fe/onnxruntime-1.27.0-cp313-cp313-macosx_14_0_arm64.whl", hash = "sha256:b3e5b58b8c89c2b20e086e890aa9527377e5c240dc3ecc1640d18e07705eeb1c", size = 18432958, upload-time = "2026-06-15T22:42:53.105Z" },
-    { url = "https://files.pythonhosted.org/packages/ce/88/24fc51fcbb126da6d032372314e47b55c3faad58f2aa78c0e199ccd20b9c/onnxruntime-1.27.0-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:48b3d87eb560ff6a772240506f3c78d6d27c63cafedd5c775672e1194f968cfd", size = 16438180, upload-time = "2026-06-15T22:42:43.093Z" },
-    { url = "https://files.pythonhosted.org/packages/cb/19/14929c3c2fe0b79b41cce24463062bf3afa4cdd3c19dccf00319caa92bff/onnxruntime-1.27.0-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:6872443f236a554921cda6f318c900e2d0c226792cf3534d00e5057c6926e5d2", size = 18658445, upload-time = "2026-06-15T22:43:08.053Z" },
-    { url = "https://files.pythonhosted.org/packages/7f/76/59ed932b0244acd7bbbd6449480053a6d958ea66357f022f932872e19287/onnxruntime-1.27.0-cp313-cp313-win_amd64.whl", hash = "sha256:760021bca514d64a811837820d351a08a41741f16f8b4c26450da708fecf14e6", size = 13357856, upload-time = "2026-06-15T22:43:37.315Z" },
-    { url = "https://files.pythonhosted.org/packages/79/51/d1ec60ec7b1e2ae2d7340ba52b8a13529140039cd4407ba8dddbbc046582/onnxruntime-1.27.0-cp313-cp313-win_arm64.whl", hash = "sha256:2fdfa9df40a0ded0028ce6f9cd863264237f3970559dea2b81456e9ac4622b94", size = 13104412, upload-time = "2026-06-15T22:43:27.457Z" },
-    { url = "https://files.pythonhosted.org/packages/5e/7d/e6bb1c6445c94f708c38cd8fbb7bf0264108c33498b9445c93e60fe6d329/onnxruntime-1.27.0-cp313-cp313t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:54c0c4e9202c36c4ecdb1f3443f5dfbfd5ee3b54d1362c4b4c6134110e74fb32", size = 16443331, upload-time = "2026-06-15T22:42:45.649Z" },
-    { url = "https://files.pythonhosted.org/packages/72/1b/b18b31e806eabc41077810199fbbb36fbc2d5f19912416e5ccfbf73053d1/onnxruntime-1.27.0-cp313-cp313t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:1b215aa662c8f983f7d6dedafe65a9be72c26e5338e0fe98b3e0422c32c85428", size = 18670967, upload-time = "2026-06-15T22:43:10.621Z" },
-]
-
 [[package]]
 name = "onnxruntime-directml"
 version = "1.24.3"
@@ -2051,9 +2030,15 @@ name = "onnxruntime-directml"
 version = "1.24.4"
 source = { registry = "https://pypi.org/simple" }
 resolution-markers = [
-    "python_full_version >= '3.13'",
-    "python_full_version == '3.12.*'",
-    "python_full_version == '3.11.*'",
+    "python_full_version >= '3.13' and platform_machine == 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version >= '3.13' and sys_platform != 'darwin'",
+    "python_full_version >= '3.13' and platform_machine != 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.12.*' and platform_machine == 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.12.*' and sys_platform != 'darwin'",
+    "python_full_version == '3.12.*' and platform_machine != 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.11.*' and platform_machine == 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.11.*' and sys_platform != 'darwin'",
+    "python_full_version == '3.11.*' and platform_machine != 'x86_64' and sys_platform == 'darwin'",
 ]
 dependencies = [
     { name = "flatbuffers", marker = "python_full_version >= '3.11'" },
@@ -2098,9 +2083,15 @@ name = "onnxruntime-gpu"
 version = "1.27.0"
 source = { registry = "https://pypi.org/simple" }
 resolution-markers = [
-    "python_full_version >= '3.13'",
-    "python_full_version == '3.12.*'",
-    "python_full_version == '3.11.*'",
+    "python_full_version >= '3.13' and platform_machine == 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version >= '3.13' and sys_platform != 'darwin'",
+    "python_full_version >= '3.13' and platform_machine != 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.12.*' and platform_machine == 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.12.*' and sys_platform != 'darwin'",
+    "python_full_version == '3.12.*' and platform_machine != 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.11.*' and platform_machine == 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.11.*' and sys_platform != 'darwin'",
+    "python_full_version == '3.11.*' and platform_machine != 'x86_64' and sys_platform == 'darwin'",
 ]
 dependencies = [
     { name = "flatbuffers", marker = "python_full_version >= '3.11'" },
@@ -3080,9 +3071,15 @@ name = "scikit-image"
 version = "0.26.0"
 source = { registry = "https://pypi.org/simple" }
 resolution-markers = [
-    "python_full_version >= '3.13'",
-    "python_full_version == '3.12.*'",
-    "python_full_version == '3.11.*'",
+    "python_full_version >= '3.13' and platform_machine == 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version >= '3.13' and sys_platform != 'darwin'",
+    "python_full_version >= '3.13' and platform_machine != 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.12.*' and platform_machine == 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.12.*' and sys_platform != 'darwin'",
+    "python_full_version == '3.12.*' and platform_machine != 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.11.*' and platform_machine == 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.11.*' and sys_platform != 'darwin'",
+    "python_full_version == '3.11.*' and platform_machine != 'x86_64' and sys_platform == 'darwin'",
 ]
 dependencies = [
     { name = "imageio", marker = "python_full_version >= '3.11'" },
@@ -3180,9 +3177,15 @@ name = "scikit-learn"
 version = "1.9.0"
 source = { registry = "https://pypi.org/simple" }
 resolution-markers = [
-    "python_full_version >= '3.13'",
-    "python_full_version == '3.12.*'",
-    "python_full_version == '3.11.*'",
+    "python_full_version >= '3.13' and platform_machine == 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version >= '3.13' and sys_platform != 'darwin'",
+    "python_full_version >= '3.13' and platform_machine != 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.12.*' and platform_machine == 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.12.*' and sys_platform != 'darwin'",
+    "python_full_version == '3.12.*' and platform_machine != 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.11.*' and platform_machine == 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.11.*' and sys_platform != 'darwin'",
+    "python_full_version == '3.11.*' and platform_machine != 'x86_64' and sys_platform == 'darwin'",
 ]
 dependencies = [
     { name = "joblib", marker = "python_full_version >= '3.11'" },
@@ -3279,7 +3282,9 @@ name = "scipy"
 version = "1.17.1"
 source = { registry = "https://pypi.org/simple" }
 resolution-markers = [
-    "python_full_version == '3.11.*'",
+    "python_full_version == '3.11.*' and platform_machine == 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.11.*' and sys_platform != 'darwin'",
+    "python_full_version == '3.11.*' and platform_machine != 'x86_64' and sys_platform == 'darwin'",
 ]
 dependencies = [
     { name = "numpy", version = "2.4.6", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version == '3.11.*'" },
@@ -3333,8 +3338,12 @@ name = "scipy"
 version = "1.18.0"
 source = { registry = "https://pypi.org/simple" }
 resolution-markers = [
-    "python_full_version >= '3.13'",
-    "python_full_version == '3.12.*'",
+    "python_full_version >= '3.13' and platform_machine == 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version >= '3.13' and sys_platform != 'darwin'",
+    "python_full_version >= '3.13' and platform_machine != 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.12.*' and platform_machine == 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.12.*' and sys_platform != 'darwin'",
+    "python_full_version == '3.12.*' and platform_machine != 'x86_64' and sys_platform == 'darwin'",
 ]
 dependencies = [
     { name = "numpy", version = "2.5.1", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.12'" },
@@ -3498,7 +3507,9 @@ name = "tifffile"
 version = "2026.3.3"
 source = { registry = "https://pypi.org/simple" }
 resolution-markers = [
-    "python_full_version == '3.11.*'",
+    "python_full_version == '3.11.*' and platform_machine == 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.11.*' and sys_platform != 'darwin'",
+    "python_full_version == '3.11.*' and platform_machine != 'x86_64' and sys_platform == 'darwin'",
 ]
 dependencies = [
     { name = "numpy", version = "2.4.6", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version == '3.11.*'" },
@@ -3513,8 +3524,12 @@ name = "tifffile"
 version = "2026.7.14"
 source = { registry = "https://pypi.org/simple" }
 resolution-markers = [
-    "python_full_version >= '3.13'",
-    "python_full_version == '3.12.*'",
+    "python_full_version >= '3.13' and platform_machine == 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version >= '3.13' and sys_platform != 'darwin'",
+    "python_full_version >= '3.13' and platform_machine != 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.12.*' and platform_machine == 'x86_64' and sys_platform == 'darwin'",
+    "python_full_version == '3.12.*' and sys_platform != 'darwin'",
+    "python_full_version == '3.12.*' and platform_machine != 'x86_64' and sys_platform == 'darwin'",
 ]
 dependencies = [
     { name = "numpy", version = "2.5.1", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.12'" },