74 Commits

Include renames

Author	SHA1	Message	Date
dtourolle	8aa10cd249	Release 0.24.0	2026-10-07 07:27:52 -04:00
dtourolle	7966bf2dd8	Release 0.23.0	2026-10-04 22:28:19 -04:00
dtourolle	08b7d23e86	Release 0.22.1	2026-10-04 20:35:01 -04:00
dtourolle	16a5957aa7	Compile dr-ui on sixteen codegen units in release builds ... Slint expands the .slint files into ~27 MB of Rust, and at the workspace's single codegen unit LLVM optimised all of it on one thread: 13.5 minutes of a release build with the other cores idle. The override applies to dr-ui alone; the image crates keep one unit, and thin LTO still runs at link time.	2026-10-04 10:45:43 -04:00
dtourolle	5736a21a3a	Release 0.22.0	2026-10-04 08:13:35 -04:00
dtourolle	1a03cb52b4	Release 0.21.0	2026-10-03 17:06:49 -04:00
dtourolle	872e35670c	Log like a debug build on macOS, where a Mac user can find it ... Nobody working on DarkRoom has a Mac, so every macOS build is in the hands of someone who can send a log and cannot attach a debugger. Three changes make that log worth sending: - The desktop's default filter on macOS is `debug` for every `dr_*` crate, the desktop crate and `onnxruntime` (the runtime's own session log). - The state directory — the log and crash records — is `~/Library/Logs` on macOS rather than the `~/.local/state` Finder hides; Console.app lists it. Config and data keep the Unix rules. - A `diagnostic` cargo profile: release plus line tables, so a crash record's backtrace reads file:line. On macOS the tables are in the `.dSYM` beside the executable, which the bundle must keep.	2026-10-03 16:49:58 -04:00
dtourolle	d8304d7c82	Add dr-denoise: the learned demosaic and denoise, without the UI ... The noise model takes the best source the frame has: the body's measured table (the Canon EOS 6D's, from the library), the DNG's NoiseProfile, or the frame itself — read, row and column noise from its masked border, and only the shot gain estimated, from the quietest flat patches. Checked on 130 6D frames, the estimate is within 10 % from ISO 1000 up; the network loses under 0.3 dB for a sigma off by 15-20 %, so every Bayer body is eligible. Tiles of 1408 keep their central 1024 behind a 192-photosite halo, past the 185-photosite receptive field, and the frame is extended by reflection, which keeps every photosite's colour; a pattern that starts on another colour is read from one photosite up or left so the network sees RGGB, and nothing is cropped. The tests run every Bayer phase, tiled against whole, with a stand-in network of known reach. The model ships as models/denoise/mosaic-1408.onnx (LFS), trained in darkroom-denoise on the maintainer's own photographs, GPL like the code. denoise_raw runs a file end to end: on a 6D frame at ISO 8000 the result matches the training repository's own path to 2.5e-4 at worst, and takes 3.1 s on TensorRT fp16 (75 dB from f32) or 14.4 s on the CPU.	2026-10-03 11:15:50 -04:00
dtourolle	2fad846cd1	Release 0.20.0	2026-10-02 23:07:52 -04:00
dtourolle	825c5af20a	Release 0.19.4	2026-10-02 20:40:01 -04:00
dtourolle	2c947430e6	Release 0.19.3	2026-09-30 22:46:17 -04:00
dtourolle	fcccc2c2e0	Release 0.19.2	2026-09-29 21:31:58 -04:00
dtourolle	5ae742816d	Release 0.19.1	2026-09-28 19:58:04 -04:00
dtourolle	883b4aca10	Release 0.19.0	2026-09-27 19:50:46 -04:00
dtourolle	4bd8d86c00	Record where a linear DNG too large for one texture goes ... ARCH §5.3 still described only a tile cache nobody built; it now says what 0.19.0 tiles and what it does not: a linear DNG past PROXY_EDGE opens on a reduced copy, a finer render samples a full-resolution window, and the export is cut into halo-grown tiles. display-and- extension.md's FR-DSP-2 row said absent, outstanding.md said the halo had nothing to read it and that such a file fell to the embedded preview. rawler now builds from third_party, which ARCH's stack table and §3.2, the root Cargo.toml's comment ("two upstream crates ... for Android") and third_party/README.md's bump procedure did not know; the README also names each vendored crate's licence. panorama.md and the manual say a composite this wide develops and exports.	2026-09-27 19:42:42 -04:00
dtourolle	72aa7e98bf	Let rawler decode a linear DNG wider than 16 700 pixels ... rawler's allocation guard is sized in samples but worded in pixels, and a linear DNG passes width × 3. A 22927 × 8966 Lightroom panorama was refused as ">50000 px wide", and develop fell back silently to the embedded preview. Route rawler through third_party with the guard at 1.5 G samples and 200 000 per axis.	2026-09-27 17:33:19 -04:00
dtourolle	e22128c16b	Release 0.18.2	2026-09-27 08:23:04 -04:00
dtourolle	2cde287440	Hold every verdict write to a reviewed list of user actions ... FR-CULL-13 says evidence never writes a rating, flag, label or trash membership, and nothing enforced it. tools/traceability/src/verdicts.rs parses the shipped code with syn and enumerates every write: calls to the catalog setters and trash recorders, SQL that assigns those columns, sidecar Amendment::Judgement, and fields named rating/flag/label. Each site must be in ALLOWED with a reason, as Input (inside a Slint on_* closure, checked structurally), Relay (its callers are checked in turn), Carried (a verdict made elsewhere: sidecar and XMP pulls, sync merge, catalog mirrored to file, duplicates consolidation) or NotAVerdict. Unlisted sites and stale entries both fail `cargo test -p traceability`; `traces verdicts` prints the list. syn and proc-macro2 were already in the lockfile as proc-macro dependencies; this adds the edges, no new crate and no version change.	2026-09-27 07:20:38 -04:00
dtourolle	48c5e74fa8	Release 0.18.1	2026-09-26 21:29:26 -04:00
dtourolle	515d4eb59e	Release 0.18.0	2026-09-26 19:13:06 -04:00
dtourolle	5baaf9bac2	Release 0.17.0	2026-09-26 16:18:18 -04:00
dtourolle	5794f8c6ea	Release 0.16.0	2026-09-26 09:46:32 -04:00
dtourolle	cf84cec96f	Release 0.15.0	2026-09-25 07:51:31 -04:00
dtourolle	dc1add9dbb	Vendor wgpu-hal 29.0.4 and i-slint-renderer-skia 1.17.1, unmodified ... The Android develop view reads its frame back through memory (TD-1) because wgpu's Vulkan swapchain never pre-rotates, and a portrait window on this tablet's landscape panel then tears. The fix is a small patch to each of these two crates, and this commit is only the ground it lands on: both are byte-for-byte the crates.io sources the lockfile already resolved, so the commits that follow are the patch and nothing else. third_party/ is excluded from the workspace, or every path dependency under the root would become a member and `--workspace` would test and lint upstream code as ours. The README says how to carry the patches across a Slint or wgpu bump, which matters because a stale version here does not fail the build — cargo just warns and uses the unpatched crate.	2026-09-25 04:18:39 -04:00
dtourolle	10216355c1	Render the manual as one HTML page the application can carry ... The manual existed only as docs/manual/README.md, which the forge renders and nothing else does. An installed copy of the application, on a laptop with no network or on a tablet, had no manual it could open. `traces manual` renders the README to docs/manual/index.html with pulldown-cmark (already in the tree as Slint's Markdown parser, so this adds a dependency edge and no crate). The page is one file with an inline stylesheet that follows the system's light or dark preference, a contents list of every section and subsection, and the pictures by their relative media/ paths. Each heading carries the id the forge gives it, so README.md#rating-and-flagging and index.html#rating-and-flagging are the same link. A picture alone in its paragraph becomes a figure whose alt text is shown as the caption, and every picture reserves its 16:11 box before it loads, so a jump into the middle of the page lands where it aimed rather than a screenful above. Links to design documents, which the installed page has no copy of, point at the forge. The page is committed rather than rendered at build time, as the gesture book is: it is user-facing text reviewed in the diff, and the three packagers then only copy it. `traces manual-check` fails in CI when the committed page is not the render of the README, and the pre-commit hook regenerates it when the README is staged.	2026-09-24 22:32:30 -04:00
dtourolle	317a2f40bd	Release 0.14.1	2026-09-23 19:07:22 -04:00
dtourolle	7fa3176f88	Release 0.14.0	2026-09-21 11:32:41 +02:00
dtourolle	84fade99ec	Put the developer docs under docs/dev and index the folder for users first ... docs/ had 26 developer documents flat beside the manual, and the two audiences are very differently sized: most readers want the manual and the gesture reference, a few want the register, the designs and the measurements. The manual and gestures.md stay at the top; everything for someone changing the code moves to docs/dev/, and the two documents that name their own successors — the v0.1 milestone and the UI-refinement plan — go to docs/dev/archive/ rather than being deleted, since both are still cited. docs/README.md is the index, users first. Every reference follows: code comments, Cargo manifests, the workflows, the pre-commit hook, the bench and traceability tools (which locate the repo root by docs/dev/requirements.md now), packaging, the Docker READMEs, CLAUDE.md, CONTRIBUTING.md and the README. The matrix links one level deeper and is regenerated. Links out of the moved documents into the tree gain a level; a link checker over every Markdown file finds none broken.	2026-09-20 21:16:03 +02:00
dtourolle	681486196e	Release 0.13.6	2026-09-20 20:19:48 +02:00
dtourolle	08727cff5a	Release 0.13.5	2026-09-20 15:24:47 +02:00
dtourolle	8a897bbc01	Release 0.13.4	2026-09-20 14:03:58 +02:00
dtourolle	301e6f3828	Release 0.13.3	2026-09-20 13:01:41 +02:00
dtourolle	ef1afc254d	Release 0.13.2	2026-09-20 11:06:54 +02:00
dtourolle	9d04ff2154	Release 0.13.1	2026-09-19 22:06:06 +02:00
dtourolle	b502a8ef90	Release 0.13.0	2026-09-19 20:43:27 +02:00
dtourolle	d15c41e699	Add dr-inference-engine and route every model session through it ... One crate names the runtime, the providers and the devices; dr-face and dr-segment ask it for a session by role. It hands ort an API table once per process — from a libonnxruntime it dlopens when the app names a directory holding one, otherwise from tract — so the Rust build stays free of C on every target and a package can install the runtime as a file (docs/inference.md §3). Sessions live in a registry behind a Model handle that holds the bytes, not the session: every use refreshes a timestamp and a reaper unloads whatever sat idle past the decay. A scan that runs the detector on each image never lets it go idle; a click in the develop view lets the segmenter go after thirty seconds; a handle used after that reloads, and reloads on a higher rung if a compiled engine has landed meanwhile. The probe walks the platform's ladder by building strict sessions and timing them against the CPU provider, caches the choice against a fingerprint of the runtime, driver, hardware and models, and compiles engines for the selected rung in the background, smallest model first. Nothing in this commit turns the native path on: the apps still run on tract until they call init with a runtime directory.	2026-09-19 16:02:37 +02:00
dtourolle	231b4a54ab	dr-pano: the geometry, from features to cameras ... A new crate holding the CPU half of a merge (FR-MRG-10): the grayscale proxy with orientation, the XFeat decoder ported step for step from the reference detectAndCompute, mutual-nearest-neighbour matching, a robust pairwise homography with the focal length read off it, a hand-rolled Levenberg–Marquardt bundle adjustment over every rotation and the focal, the three output projections, and align(), which chains it all and names the frames it could not place rather than guessing (FR-MRG-5). Dependency-free without the xfeat feature — linalg.rs says why the dense algebra is hand-rolled — and tested on synthetic sweeps whose answer is known exactly. The noise test records the single-row degeneracy: one pixel of noise is a tenth of a percent of focal, which is a uniform stretch of the sweep, not a misalignment.	2026-09-19 15:24:12 +02:00
dtourolle	2917b7427d	Release 0.12.2	2026-09-19 10:15:46 +02:00
dtourolle	8012979a1e	Release 0.12.1	2026-09-13 20:10:03 +02:00
dtourolle	936490880b	Release 0.12.0	2026-09-11 09:33:36 +02:00
dtourolle	d920716a2b	Release 0.11.0	2026-09-07 22:31:53 +02:00
dtourolle	3dc7c184ee	Optimise for release only, since every edit pays for a dev build ... Dependencies were built at `opt-level = 2` even in dev, because wgpu and image decoding are slow without it. That is still true, and it is what this gives up: a debug run of the app, and the decode- and GPU-heavy tests, are slower than they were. What it buys is that nothing has to be optimised before it can be compiled. That cost was paid on every edit, in every worktree, whether or not anything was ever run — and there are sixteen worktrees, each with its own target directory and no shared cache, so it was paid sixteen times over. `[profile.release]` is untouched: `lto = "thin"` and `codegen-units = 1` still apply where the speed is actually wanted. If one crate turns out to be the one that makes a test unbearable, raise that crate alone rather than restoring the blanket rule; the manifest says how. Incremental compilation is now on as well, but that lives in `.cargo/config.toml`, which is untracked and per-checkout — so it is a local change on this machine, not part of this commit.	2026-09-06 20:17:53 +02:00
dtourolle	5fa4c0772b	Speak the sidecar format every other editor already reads ... FR-CAT-13 asked for standard XMP and nothing in the tree parsed or wrote a byte of it. `keywords.rs` mentioned `dc:subject` in a comment about what a keyword's text is for, `dr-export`'s metadata module said "neither is read by `dr-decode` today" about its own half, and `dr-preset-xmp` reads a different file for a different requirement. So a library imported from Lightroom could come in and never go back out: a one-way door, which is not a thing a photographer walks their archive through. `core/dr-xmp` reads and writes the properties the requirement names — `dc:subject`, `lr:hierarchicalSubject`, `xmp:Rating`, `xmp:Label` and the IPTC core fields — from whichever shape the file happens to use. A property may arrive as an attribute or as an element, inside a Bag, a Seq, an Alt or no container at all, because the specification is not what wrote the file; so one collector takes whatever is in a property and the declared shape decides only how many values survive. `xmp:Rating="-1"` is modelled as Adobe's rejection rather than folded into zero stars, since DarkRoom keeps those on two axes and the mapping belongs where both are visible. Writing is a rewrite rather than a serialisation, and that is the whole design. An XMP sidecar is a shared document: the file beside a raw carries somebody else's `crs:` settings and comments and namespaces, and rendering our record over it would be data loss on every photograph but the first. The rule is stated once, in the crate documentation and in `PROPERTIES`: DarkRoom owns exactly those properties, identified by namespace URI and never by prefix, and nothing else in the document. Everything unowned is copied through byte for byte. A `Description` left empty once our properties come out of it is withdrawn, which is what keeps a rewrite idempotent instead of adding a husk to the file on every save. Precedence is settled conservatively, because a standard XMP carries no revision and no device and there is nothing in it to order two edits by. Keywords union, following the rule `dr_catalog::merge` already makes for assignments; every other field is taken only where DarkRoom holds none, following `Version::merge`'s judgement rule, and a genuine disagreement is reported rather than resolved so a caller can offer the reload the requirement asks for. What is deliberately left open — when a reload may happen without asking — is written down in the module rather than picked silently. No new dependency: quick-xml was already in the tree for WebDAV and for Lightroom presets. Nothing above the crate calls it yet, and `outstanding.md` now says so along with the two smaller gaps, GPS and the filename convention.	2026-09-06 19:01:48 +02:00
dtourolleandClaude Opus 5	c1069ce07e	Release 0.10.1 ... A bug fix release. Nothing here changes what DarkRoom is for since 0.10.0; it changes how often it does the thing it already claimed to do. The edits that went missing. A subject or category layer was stored as identity alone, on the reasoning that the pixels were reproducible by re-running the model — true, but nothing re-runs one except a photographer pressing "find subjects". So a reopened photograph rendered without its local adjustments and then saved that state back, and a batch export wrote three hundred files without the edits their photographer had made, over a log warning. The coverage now travels in the sidecar. Export also learned to write the photograph rather than the canvas, and to carry the photograph's header when the export is made from develop. Face indexing was reading previews. It ran against a proxy and then recorded the result as though it had seen the photograph, so faces smaller than the proxy could resolve were not missed, they were *concluded absent*. Indexing now runs on the native render, runs made against proxies too small to find a face are forgotten rather than trusted, and a sweep that fails everything says so instead of reporting a clean pass. Where you were. The photo roll opens on the frame it opened with, develop returns you to the photograph you were editing, the grid keeps its place when another screen covers it, and the photographer's position now travels between devices rather than being rediscovered on each. Startup. The catalog opens on a worker and the bundled models unpack on one, so a launch is no longer a page-by-page read on the way to the first frame; the app says it is starting before there is anything to say it with. The People rail builds the rows you can see, keeps portraits off the blocking path, and withholds the empty groups that used to fill it. Segmentation gained the half it was missing: the colour gate decided what belonged to a category and had no way to decide where its edge fell, so a refined sky kept the model's blocky outline no matter how the control was set. A marker-based watershed now puts each contour onto a real edge, and the refinement is a per-layer slider. Coverage 70.4% -> 70.6% (127/180). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-30 21:33:16 +02:00
dtourolleandClaude Opus 5	23c3155128	Release 0.10.0 ... Three waves of work since 0.9.0. Culling gained the two instruments FR-CULL-3 asked for and never had: focus peaking, and a histogram that reads the sensor rather than the frame about to be displayed. Bursts group themselves. Masks can cover a whole category rather than one instance. The catalog now notices when it has been damaged and offers a way back -- restore a backup, or rebuild from the photographs, which were never at risk. A crash leaves a record. A log survives the process, on a path a tablet will hand back to adb, which is what makes the Android work debuggable at all. The APK compiles its own Java for the first time, so the app can receive a photograph from another application and hand one back. Memory pressure is answered in a stated order. A lost library root is reported rather than reported as an empty library. There is a benchmark suite now, so §8's promise that a regression fails the build is a mechanism rather than a sentence. Its first run says the catalog opens in 70ms against a 2s budget, and that thumbnail throughput does not obviously reach its target. Coverage 59.8% -> 69.8%, and it means more than it did: five requirements that were tagged on code that did not implement them are no longer, and the tool no longer counts its own test fixtures. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-30 16:52:05 +02:00
dtourolle	e8e96eed40	Measure the performance targets §8 has been promising, and fail on a regression ... docs/requirements.md §8 has said since it was written that performance is verified by "an automated benchmark suite against a synthetic 50k catalog, run per-commit … A regression beyond stated tolerance fails the build." There was none. No benches/, no [[bench]], no criterion, no synthetic catalog, and three CI workflows that between them measured nothing. Ten performance requirements could therefore be neither passed nor failed, and five of them carried a TRACES: tag regardless. tools/bench is the half of that promise that can be kept honestly on a runner with no GPU and no display. # The fixture Rows are cheap and pixels are not, so it builds fifty thousand catalog rows over a pool of a dozen real files, each referenced by several thousand of them. Everything the catalog half touches is rows and is exact at full scale; everything the pixel half touches is one file at a time and does not care how many rows point at it. Fourteen megabytes on disk instead of two terabytes, and neither half is flattered by the trade. It is reproducible from a seed, and a stamp beside it — seed, row count, source size, dr-catalog's schema version — rebuilds it rather than letting a run be compared against a baseline that describes a different library. # What it can now pass or fail NFR-P1, and R2's second sentence with it: Catalog::open plus the count, first window and timeline the grid cannot paint without. The interesting part turned out to be the open itself — schema::backfill runs three passes over the images table on every open, which is O(library) work on a path whose budget is stated in absolute seconds. Tagged TRACES: NFR-P1, on a gate that fails if it breaks. NFR-P3: thumbnail throughput on the embedded preview path, through the same per-image work spawn_thumbnail_sweep does and in the same shape — chunks of 96, lanes owning disjoint slices, the single thread that owns the store writing the finished chunk. Mirrored rather than called, because that function takes a RemoteBackend and would measure somebody's network. Tagged TRACES: NFR-P3. # What it deliberately does not claim NFR-P7 is the whole chain, and only the encode half of it runs without an adapter. So the export row is a one-sided gate — over two seconds in the encode alone violates the requirement; under it proves nothing — and there is no TRACES: NFR-P7 anywhere. NFR-P8 is about the application at idle, and the probe is a process holding the catalog and nothing else, so it records the catalog layer's share and carries no budget until somebody decides what that share should be. No tag there either. CONTRIBUTING.md asks that a requirement be closed by a test that would fail if the behaviour were removed, and two more plumbing tags is what this repository already has too many of. NFR-P8 also gets the answer §4.1 demands: RSS is exclusive of device-local GPU allocations and cannot be made otherwise, because such an allocation never enters the process's address space. The requirement should be restated as two figures, and docs/benchmarks.md says so. # Two gates, and why one of them steps aside off the reference desktop The budget is the requirement's own number and never moves. The baseline is what the reference desktop last measured, and drifting 15% past it fails the build even while still inside the budget — which is how performance rot actually arrives, never over the line, always a little worse. A budget written for twenty-four threads cannot be asserted on a two-core container. §8 names the reference desktop, not CI, so each metric declares whether its budget is machine-sensitive; those are asserted under --reference and reported everywhere else. Catalog open is not one of them: two seconds against an expected figure two orders of magnitude smaller is a threshold any machine can be held to. This is the trap core/dr-gpu/tests/frame_budget.rs already refuses — a red gate everybody learns to ignore. # The baseline ships with no numbers in it Every recorded field is null, because nobody has run it yet. Writing plausible-looking figures would make every later comparison a comparison against a guess, and the first real regression would be invisible. Run `dr-bench record --reference` on the reference desktop and commit the diff; until then the budget gate works and the report says the other one cannot. # CI .gitea/workflows/benchmark.yml, and its own workflow rather than a step in build-and-test.yml: a red "Build and test" says the code is wrong, a red "Benchmarks" says it got slower, and the second must not be reachable by retrying a flaky compile. The cpu job runs on every push and builds -p dr-bench alone — which is why that crate depends on no GPU and no UI crate. The gpu job is the frame budget that already exists and already skips without an adapter, on workflow_dispatch, because building wgpu on every commit to rediscover that the runner has no device is not a use of anybody's minutes.	2026-08-30 10:40:10 +02:00
dtourolleandClaude Opus 5	754ab91347	Bring a Lightroom library across, and start with something in the list ... Two halves of the same complaint: a preset sheet that opens on "No presets yet" is homework, and a photographer with ten years of presets in Lightroom has no way to bring them. `dr-preset-xmp` reads Camera Raw `.xmp`. The mapping turned out to be mostly a rename rather than a conversion, because Adobe and this pipeline already agree: exposure is in stops in both, and contrast, the four recovery controls, clarity, texture, vibrance and saturation are all ±100 in both. That is not imitation, it is the convention raw developers converged on — `highlights_shadows.yaml` cites it in as many words. Only sharpening needed arithmetic, Adobe's 0…150 against our 0…100. The white balance does not come across, and says so rather than guessing. Adobe writes absolute Kelvin for a raw file where ours is a relative nudge from what the camera recorded, so converting needs the *target image's* as-shot white balance — exactly what a preset cannot carry, since the same preset lands on a frame shot at 3200K and one shot at 7000K. A guess would be wrong on most images and invisibly so. A folder is read as readily as a file, nested, because that is the shape an exported preset folder is in and importing ninety files one at a time is asking someone not to bother. `dr_pipeline::starter` is six presets a first run begins with, written against this pipeline in its units and deliberately mild — a starting point, not a caricature. They are seeded when the library *file* does not exist rather than when the library is empty, so deleting all six does not hand them back on the next launch. Both of these name operations, and `ui_names_no_operation` was right to stop them living in `ui/`. That test exists because the failure is silent and cumulative, and it caught exactly what it was written for: a preset called "Punch" is a statement about contrast, clarity and vibrance, and a table mapping Adobe's vocabulary to ours is a statement about the pipeline. Neither is a fact about an interface. So the starter set went into `dr-pipeline`, and the importer into its own crate — between two walls, since `dr-pipeline` depends on nothing on purpose and XMP is real XML not worth hand-rolling. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-29 22:00:53 +02:00
dtourolleandClaude Opus 5	bbd26f05f9	Release 0.9.0 ... Thirty-five commits since 0.8.0, and two of them are the reason this is a minor rather than a patch. **Storage became pluggable.** A folder backend now sits beside the Nextcloud one behind the same seam, proved by a test rather than by a trait, and the launch screen offers three routes into a library instead of one. **Faces gained a confidence that means something.** A suggestion is scored against the people the user has actually named, the curve it came from is stated rather than implied, and a regroup runs roughly three times faster — the similarity scan and the merge engine both use the machine's own SIMD kernel now, measured on the tablet where the NEON path is the one that runs. Alongside those, the framing tools got the quality-of-life pass this release is named for: a crop can be held to a ratio, a straighten crops away the corners it exposed, an export can be pinned to an exact resolution with the common panel sizes offered as buttons, and dragging the crop rectangle no longer tracks the pointer at half speed. `pkgrel` returns to 1: a new `pkgver` is a new archive name, so there is nothing left for a release number to disambiguate. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-29 13:53:19 +02:00
dtourolle	f12aece07e	Make storage pluggable, and prove it with a folder backend ... `RemoteBackend` existed from the first release and bought nothing it was designed for. Seven files in `dr-ui` constructed a `NextcloudBackend` directly, an account *was* a server URL beside a DAV user id, the local cache directory was named after a hostname, and the launch screen knew that signing in meant a browser handshake. The trait was real; the seam was documentation. A trait over operations is only a quarter of it. Pluggable storage needs four things, and this adds the other three: - **Capabilities** — already there, and the reason the engine can drive two backends at the speed each actually runs at. - **Configuration** — `dr_sync::Account`: where a library lives, in whatever form its connector addresses, with no server in it. Loads every existing config unchanged (`backend` defaults to `nextcloud`, `endpoint` is stored under its historical `server` key), and `Account::namespace()` reproduces the old catalog directory byte for byte, because changing it would abandon a catalog, its thumbnail shards, and the sidecars holding unsynced offline work. - **Registration** — `BackendProvider` and `BackendRegistry`. `ui/dr-ui/src/remote.rs` is now the only file above `dr-sync` that names a connector. `Connection` (an account plus an optional `Secret`) replaces the credentials-and-user-id pair that was threaded through fifteen signatures in an order that could be swapped. `Secret`'s inner string is reachable only through `expose()` and its `Debug` prints `Secret(***)`, so the indirect leak — a `{:?}` on anything holding one — no longer compiles into a leak. Nextcloud is unchanged and keeps every peculiarity: propagating ETags, chunked upload v2, `oc:fileid`, the `oc:permissions` probe on a refused PUT, the 423 retry classification, Login Flow v2. Those are what the capability model exists to serve, not something to hide. `dr-sync-folder` is the second connector: a local disk, a network mount, an external drive, or a folder a Nextcloud client already syncs. No account, no credential — the route that works where no secrets daemon does. It declares `LocalEtags` rather than claiming propagation a POSIX directory cannot provide, which costs nothing because 50k `stat` calls are not 50k PROPFINDs. Identity is a path hash, not an inode: an inode survives a rename but differs between devices and is reused after a delete, so two machines would disagree about which photograph a thumbnail belonged to. Re-deriving a thumbnail is a cost; showing the wrong one is a bug. docs/storage.md is the contract — the traits, the four steps to add a backend, and what each connector declares. ARCH §8.0 and §8.4a, and FR-NC-13, say why.	2026-08-29 09:57:52 +02:00
dtourolleandClaude Opus 5	e997be8c72	Say which version this is: 0.8.0 ... A hundred commits since 0.7.0, and the face subsystem in them is not a set of fixes — it is the difference between a feature that was shipped and one that works. Clustering finished at all for the first time: the old agglomeration rescanned every live pair and recomputed average link from scratch after every merge, and on a real library it did not return. A sparse above-threshold graph, connected components and Lance-Williams sums put 1,813 faces at 0.28s, and the merge threshold moved to 0.80 because the old 0.90 was measured — not guessed — to leave a third of the library ungrouped. Faces are no longer indexed at any size or any sharpness. Both floors were measured over the real library with `face_index --quality`: 32 source pixels across the aligned crop, and a contrast-invariant sharpness that catches the large-but-blurred face whose confident, wrong embedding used to weld two people together. The crop is cut once and kept, so the People screen is no longer a derivative of a thumbnail cache entitled to evict anything at any moment. The screen itself became usable: the faces wrap into a grid instead of running off the edge, the header fits a phone, a group can be set aside, and a person's photographs are a button away — as a union or an intersection of several people. And face sync now reaches the other device. Re-indexed images re-export, shards written before the crop and index-time columns are repaired rather than failing every insert, people and the user's judgements about them cross the wire at all, and the pass says what it is doing while it does it. The Android versionCode follows without being restated — package.sh packs MAJOR*10000 + MINOR*100 + PATCH, so 0.8.0 is 800, above the 700 already on devices and therefore an upgrade rather than a refusal. `pkgrel` returns to 1, since this is a new version rather than a rebuild of the last one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-28 22:24:58 +02:00