801 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
dtourolle	327decfab1	Fuse every detector's faces into one population per embedder ... Choosing "Thorough" made the library look empty. The detector setting writes under its own faces.model_id, and every reader of "the faces" keyed on that exact id: the clustering pass, the coverage figure, the sweep's work list, the shard export and import, and the sync merge's face matching. On the reference library that restarted coverage at 1,834 of 19,140, drew a People rail of 36 faces for a person with 520, queued a ~400 GB re-fetch on each device, and stranded the desktop's 3,583 confirmations under the old id: the tablet held the same faces under the new one and the merge refused to match them. Same photograph, same box, same embedder, two ids — that is one face, not two libraries. The embedder half of the id is now the key. embedder_of and embedder_sql give it to every query; writes keep the full id, so which detector drew a box stays on record. record_detections is unchanged and is where the generations meet: an image holds one pipeline's faces at a time, and a re-detection carries confirmations across by box overlap. The merge's match_faces applies the same rule within an embedder. The calibration is keyed on the embedder too, since the similarity space did not change. Shards travel every generation, each under its own id, and a peer adopts whichever it is sent — including a stronger detector's pass over an image it indexed itself with a weaker one, which is the re-detection its own sweep would otherwise queue, already done. Never downwards: a tablet on Fast keeps the desktop's Thorough faces. The sweep gains the same tail — images a weaker detector indexed, after the ones nothing has — driven by FaceDetector::supersedes, so choosing a stronger detector still improves the library over time without first making it disappear.	2026-09-19 10:49:28 +02:00
dtourolle	f8addbee53	Mark a file the decoder cannot open, so the sweep stops fetching it ... A decode failure in the face sweep was counted, logged at debug where nobody saw it, and left unmarked — so the next pass fetched the same file and failed the same way. For the 521 MB panorama behind rawler's panic that was half a gigabyte per sweep, on a tablet. It is now marked examined with nothing found and a zero edge, which is what a later "try again with a better decoder" pass would select on, and the warning names the file. The failure count is unchanged: it did fail.	2026-09-19 10:45:08 +02:00
dtourolle	c0b1e78f7c	Return a panic inside the decoder as an error, not as the end of the thread ... rawler panics on some input rather than returning Err — a DNG whose IFD claims a >50000 px image, which the reference library has: a 521 MB stitched panorama, IMG_4181-Pano.dng. On a worker thread a panic is the end of the thread, so the face sweep that met it stopped thirteen seconds in, three sweeps running on the tablet and three on the desktop, with "17301 image(s) to index" as the last word. FR-RAW-4 says a malformed file must not abort a batch, and that is this crate's promise whatever the library beneath it does: every entry point that calls into rawler now runs under catch_unwind, and a file that panics the decoder is one failed file with the panic's message in the error. Verified on the panorama itself: metadata reads, decode returns the error, the thread survives. The crash hook still records the panic, which is right — it is a defect in a dependency and the record is how it gets reported.	2026-09-19 10:45:07 +02:00
dtourolle	78cb00634e	Fetch the photographs around the open one ahead of the step to them ... Walking the photo roll was one download per frame: every step showed "Downloading…" over an empty canvas while tens of megabytes came down, and moving between a pair of near-identical frames paid that a dozen times. Now, once the opened photograph has landed, the ones around it are fetched into the originals cache while it is being looked at, so the next step is a disk read. A single worker serves the latest wish only, closest first and working outwards — next, previous, next-but-one, previous-but-one… — one file at a time. Each open replaces the wish, so a fast walk never leaves a trail of stale downloads competing with the one being waited on. A process-wide in-flight registry makes a click on a photograph that is still being fetched ahead wait for that transfer and read it from disk, rather than start a second download of the same file. How far each side is a setting under STORAGE — Off, 2, 5, 10 or 20, defaulting to 5 — and it is moot while "keep originals after opening" is off, since a fetch the cache would discard on arrival is transfer for nothing. Nothing is fetched ahead while offline. The transfers show in the activity list while they run and are removed when they end.	2026-09-19 10:36:50 +02:00
dtourolle	2917b7427d	Release 0.12.2	2026-09-19 10:15:46 +02:00
dtourolle	33e2e277a2	Set the Wayland app id late enough for it to take ... The launcher and the task bar have shown a generic tile for a working window since the call was written. set_xdg_app_id sat at the top of run(), on the reasoning that the app id is read when the surface is created — true, and beside the point: the call goes through Slint's global context, and there is no global context until something installs a platform. That is BackendSelector inside shared_gpu, or AppWindow::new falling back to the default, and both happen further down. Called before either, it returned NoPlatform and did nothing at all. It moves to just after the window is constructed, which is not the same as shown — run() is far below — so there is a platform to talk to and the surface does not exist yet. The failure was logged at debug, which is why a year of grey squares went unremarked: the whole symptom is invisible from inside the application. It is a warning now, naming the consequence.	2026-09-19 10:15:46 +02:00
dtourolle	9b627e7713	Let a catalog writer wait for its turn instead of losing its work ... SQLite's busy timeout defaults to zero, and nothing ever set one: the loser of a write race got SQLITE_BUSY at the moment it asked. WAL does not cover this — it makes one writer and many readers free, and this application constantly has two writers, the face sweep committing a batch while the derived sync imports shards or reclustering reads. The cost was not a retry but lost work. A sweep that had already paid for the detection and the embedding — seconds per image, the expensive part — discarded the result on "storing faces for 214: database is locked" and moved on to the next image. Both the desktop and the tablet logged runs of those on consecutive images, which is a face sweep quietly failing to store the faces it had just computed. Ten seconds, on every connection, set in configure() so that nothing can open the catalog without it — the figure the job runner's own tests have used for this reason since they were written. It is far longer than any transaction here, so it bounds pathology rather than making anyone wait.	2026-09-14 20:05:53 +02:00
dtourolle	8c3b62745a	Give makensis absolute paths, and one installer to find ... The first CI run of the Windows leg passed every step up to packaging and died in makensis with LicenseData: open failed "target-windows/installer/stage\LICENSE". CI sets CARGO_TARGET_DIR to the relative target-windows, and NSIS on a POSIX host translates the backslash in a File path only when a leading / tells it the path is a POSIX one; a relative name reaches it with the backslash intact. Locally the target was always /work/…, which is why it never showed. package.sh now resolves its directories with realpath first. It also removes any installer already in the output directory before writing the new one. That directory is cached between runs, so after a version bump a glob over it finds two, and the smoke test hands Wine both names joined by a newline as one path — which is what happened locally the moment the version moved to 0.12.1. v0.12.1	2026-09-14 01:12:33 +02:00
dtourolle	8012979a1e	Release 0.12.1	2026-09-13 20:10:03 +02:00
dtourolle	5e67f026ec	Merge: a catalog the server cannot damage for long, and backups on both sides ... fix/corrupt-remote-catalog-deadlock. The catalog on the server had been malformed since 7 September and every device declined to overwrite it, so collections and people stopped syncing everywhere at once; the damage came from two devices assembling chunks in one upload directory. Each chunked upload now has its own directory, the server keeps three generations of the catalog behind the current one, every push is verified before and after, a damaged copy that arrived whole is merged from the generation before it rather than pinned in place, and the catalog is backed up daily as NFR-R2 always asked.	2026-09-13 20:04:55 +02:00
dtourolle	eeee3d920a	Back the catalog up daily, not only before migrations ... NFR-R2 asks for the catalog to be backed up on a schedule and before schema migrations. Only the second half existed: every backup on disk was a pre-migration copy, and a library that never migrated was never backed up at all. A backup is now also taken at the end of a library sweep when the newest one is more than a day old — the moment the catalog is quiet and a day's collection and people edits have just been folded in — on its own thread and its own connection, so the copy of a 130 MB file is not spent on the UI. Whether one is due is read from the backup directory, not the catalog, so the ordinary case costs nothing. An empty catalog is skipped: there is nothing in it a rescan would not rebuild. Pruning to KEEP_BACKUPS applies as before.	2026-09-13 19:32:05 +02:00
dtourolle	f100db89ca	Verify the catalog snapshot before it is sent, and after it lands ... Two checks around the upload, both cheap next to what they prevent. Before: the snapshot is quick_checked before it leaves. It is the copy every other device merges from, and a damaged one costs each of them a download, a failed merge and a refusal to push. After: the staged upload's size on the server is compared to the bytes sent before it is rotated into place. A chunked upload is assembled server-side, and an assembly that goes wrong is a file of plausible size no device can open — caught here, on the device that caused it, for one listing; otherwise on every other device, after the fact. A mismatch, or a size the server will not confirm, discards the upload and leaves the current copy and its generations untouched.	2026-09-13 19:31:58 +02:00
dtourolle	2ce0fcc74a	Keep three generations of the catalog on the server ... The server held one copy of the catalog, overwritten in place on every push. When that copy was damaged there were two answers, both bad: refuse to touch it for ever, which is what every device did for a week, or overwrite it with ours, which loses whatever another device had added since — the escape hatch of the previous commit. A push now uploads to catalog.upload.sqlite, rotates catalog.sqlite to .1 (and .1 to .2, .2 to .3, dropping the oldest), and moves the upload into place. Rotation is server-side renames, oldest first so that every destination is empty when it is written to — move_to refuses to overwrite, by design — and a failure at any step leaves a gap in the generations and never a missing current copy. The only transfer is the upload itself. A damaged current copy that arrived whole now merges from the newest readable generation before ours goes over it, which loses nothing, and is kept as .1 by the ordinary rotation rather than by a separate 40 MB upload. NFR-R2 asks for the catalog to be backed up; this is the half of it that lives with the copy other devices read.	2026-09-13 19:31:58 +02:00
dtourolle	6f62ac09f8	Give every chunked upload its own directory on the server ... The upload directory was named from the destination path alone, on the reasoning that two files could then not collide. Two devices uploading the same file could, and did: both wrote 00001…00009 into one directory, and whichever MOVEd first assembled a mix of the two — a catalog of exactly the right size whose pages came from two different databases. SQLite called it malformed, every client declined to overwrite it, and collections stopped syncing on all of them for a week. A transfer that died on a phone's link left its chunks there for the next device to assemble in, by the same mechanism. The name now carries a nonce as well, so no two uploads share a directory, and a failed transfer deletes its own directory on the way out rather than leaving 5 MB chunks for the server to sweep eventually.	2026-09-13 19:31:58 +02:00
dtourolle	c1e0f09be7	Say where the face models were looked for when they are not found ... "The chosen detector is not installed" was the whole of what a user saw, on a machine where the files were three directories away from where the lookup went. The search order was in a doc comment and nowhere a user could read it. Now a missing pair logs the detector file it wanted and every directory it tried, which is what the first Windows install needed and what the next misplaced download will.	2026-09-13 19:20:30 +02:00
dtourolle	38a87c0bca	Put settings.json where the Android entry point said, not under / ... SettingsStore::open read XDG_CONFIG_HOME and HOME itself. Neither exists on Android, so it resolved to .config/darkroom relative to a working directory of /, and every settings edit on the tablet failed with "read-only file system" — the page reported the error and nothing said why. The doc comment claimed "the same resolution SessionStore does"; now it is, by calling the same function, which honours the directory android_main declares and takes the platform's config directory everywhere else. settings.json sits beside sessions.json on every platform, as the comment always said it did.	2026-09-13 19:05:51 +02:00
dtourolle	693195fa96	Replace a damaged catalog on the server instead of pinning it there ... The catalog sync refuses to upload when it cannot read the server's copy, because the upload is a read-modify-write and writing blind would discard another device's collections. That is the right rule for a timeout, a dropped connection or a newer schema — the remote is fine, only our view of it failed. A file SQLite calls malformed is not that. No device will ever read it again, so refusing to write over it preserves nothing — and every client declines in turn, pinning the damaged file in place for good. Collections and people then stop crossing between devices on all of them at once, each logging "catalog not pushed" on every pass. This library did exactly that from 2026-09-07, on the desktop and on a freshly installed phone alike, while 32 collections sat undelivered. Now a copy that arrived whole and still will not open is set aside under a dated name and replaced by ours. Whole is checked against the size the server advertises: a truncated download will not open either, and on a phone that is the far likelier story, so anything short — or any size the listing cannot confirm — is treated as the transport failure it is and the server's copy is left alone. A placeholder's size is not trusted for the comparison, since it means nothing. The report says when this happened, and the log line calls it "pushed over a damaged copy" rather than folding it into an ordinary push: it is the one push that discarded something.	2026-09-13 19:01:00 +02:00
dtourolle	43f70c4765	Build the Windows installer in CI ... The fourth leg of build-and-test.yml, in the shape of the Android one: an image workflow that builds docker/windows and pushes it tagged by the directory's tree id, and a job inside that image that lints the Windows target — the only place the cfg(windows) branches are ever compiled by CI — builds, runs the smoke tests docs/windows.md §6 specifies, packages, installs and uninstalls under Wine, and uploads the installer. Every step was run by hand in the same container first. The spec's open list closes with this: the four §3.2 items, the licence page, and the leg. What remains is what Wine cannot show, and §10 now lists it as the first real Windows run's checklist.	2026-09-12 07:34:10 +02:00
dtourolle	6609aa9acf	Ship the GPL text, and show it in the installer ... The repository declared GPL-3.0-or-later and carried no copy of it; the Arch package pointed at the system's shared text and nothing else needed one. The installer does: a licence page needs a file to show, and the moment before installation is where the terms can still change a decision. The standard text, at the root where every convention looks for it, converted to CRLF at packaging time because a Windows edit control draws a bare LF as nothing.	2026-09-12 07:34:10 +02:00
dtourolle	b396096787	Open the sign-in URL on Windows ... Login Flow v2 cannot complete without a browser, and the launcher had a branch for xdg-open, one for Android's Intent, and an honest Unsupported error for everything else — which on Windows stranded the flow on "approve the sign-in in your browser". rundll32 url.dll,FileProtocolHandler is ShellExecute on the URL and needs no crate; chosen over cmd /C start, whose quoting of & in a query string is a known trap. Not verified: Wine has no browser to open.	2026-09-12 07:34:09 +02:00
dtourolle	beb822dced	Keep secrets in Credential Manager on Windows ... The Secret Service store was keyring::Entry all the way down, and keyring 4's v1 feature set — the one the workspace already asks for — includes the Windows Credential Manager backend. So the Windows store is the same implementation with its cfg widened, and the crate as a target dependency. The one behavioural difference is that the availability probe always succeeds there, which is correct: Credential Manager is always present, so FR-NC-2's degraded mode does not arise. Until now a Windows build compiled, started, and failed at sign-in with the placeholder store's "no secret store is implemented".	2026-09-12 07:34:08 +02:00
dtourolle	ef1154af94	Resolve every base directory in one place, and on Windows ... Five sites each read XDG_*_HOME and fell back to $HOME/.local/… on their own, which is fine on Linux and wrong everywhere else: Windows sets neither variable, so every one of them degraded to a path relative to the working directory — for a Start Menu launch, C:\Windows\System32. The models lookup walked XDG_DATA_DIRS the same way. dr_plat::dirs now holds the rule per platform: XDG on Unix, the known folders on Windows — %APPDATA% for config, which roams, and %LOCALAPPDATA% for data and state, which do not — and the executable's own directory as the system data dir, which is where the installer puts the models. The Android overrides stay where they were; only the fallback behind them moved. Both rule sets are unit-tested on either host, and the Windows one was confirmed by running the application under Wine: its log landed in AppData\Local\darkroom\state and nothing was written anywhere else.	2026-09-12 07:34:05 +02:00
dtourolle	896188a489	Read the sidecars other editors write, and write them back on request ... FR-CAT-13 asked for standard XMP and `core/dr-xmp` answered the file: it has read and written `dc:subject`, `xmp:Rating`, `xmp:Label` and the IPTC core since 5fa4c07, under an ownership rule that leaves everything else in the document untouched. What nothing did was call it. No scan found an `.xmp` beside a raw, no catalog row was filled from one, no judgement wrote one back, and the "external modification detected, reload offered" clause had no mechanism. A library imported from Lightroom came in and could not go back out. The scan collects `.xmp` beside `.drsc` from the listings it was already paying for, and the pull reads each one whose ETag has moved. Both namings resolve: darktable's `IMG_0001.CR3.xmp` names its file exactly, Lightroom's `IMG_0001.xmp` names the stem, and under the stem the JPEG beside a RAW is the same photograph and takes the same document, as DarkRoom's own sidecar already does. Each is reconciled with the catalog winning — keywords union, a rating or label taken only where the catalog has none — because a standard XMP carries nothing that could say whether its value is newer. A genuine disagreement is not resolved; it is written to a table, and the settings page offers the sidecars' values against it. That button is the reload the requirement asks to be offered, and the ETag that moved is the detection it asks for: an `.xmp` edited elsewhere is exactly a file the pull's ordinary incrementality re-reads. Writing goes the other way behind a setting that starts off, since NFR-R4 makes writes beside somebody's originals theirs to switch on. With it on, a judgement or a keyword rewrites the sidecar of whichever spelling exists, or creates Lightroom's. The record is read from the catalog whole at that moment rather than carried from the gesture, so a rating and a keyword a second apart are two writes of one file that agree. And the file's own title, caption, copyright and hierarchy come through the rewrite: the catalog has no columns for them, `rewrite` replaces the owned set wholesale, and a record that said nothing about them would have deleted them from a Lightroom sidecar on every star. The rating's two axes cross the format's one field both ways: a rejection is Adobe's `-1` and stars are stars, and stars arriving on a rejected frame lift the rejection, since the file said it was worth a number. An unrated file says nothing and clears nothing, on the rule the `.drsc` merge keeps. `versions.label` finally has a reader and a writer, with the code table moved out of the query so the two cannot drift.	2026-09-12 01:08:11 +02:00
dtourolle	d3b6127db6	Let a photographer name the state they liked, and go back to it or look at it ... FR-DEV-5 asked for named snapshots of an edit state and FR-DEV-7 for a comparison against a chosen one, and neither existed. The history stack is per sitting and forgotten with it, on purpose — the gap that mattered was an automatically saved mis-drag with no way back, and that was closed first. What was left was the other half: a state the photographer wants to keep *because* it is worth keeping, which is a different thing from a step and is not served by making the steps last longer. A snapshot is an edit state, and an edit state is exactly what a sidecar version stores, so it is stored as one: a `[version]` block carrying `snapshot-of = <uuid>`. The parameters, the masks and their parts, the repairs and the film all arrive through the blocks that already carry them, a merge keys on the uuid as it does for any version, and a build that predates the key reads the block as a named version and keeps it — the right failure. Only the pointer is new. The one reader that has to know is `default_version`, which must never answer with a snapshot: a file whose edit is missing is not a file whose edit is one of its saved moments. The snapshots of an edit are listed by that pointer, oldest first, the same on every device. Writing them back removes what this sitting deleted and puts in what it holds, and leaves standing whatever it never saw — a snapshot the other device took since the photograph was opened here is not this device's to remove by not knowing about it. That is the rule the version merge already keeps, applied one level down, and it is why the save carries the deleted ids rather than replacing the list wholesale as the masks are. Each is re-pointed at the uuid the save settled on, because the default may have been fused onto its canonical identity since the snapshot was taken. Restoring is one history step, so undo takes it back whole, as a paste is. Taking and deleting are not steps: they change nothing about the photograph, and an undo that removed a snapshot would be undoing a decision to remember. Holding the eye beside one renders the snapshot and hands the edit straight back — the same suspension "Before" uses, against a point the photographer chose rather than the file. Two sessions on the same photograph get ids that cannot collide, stamped with the second and a random word, because the merge folds equal ids into one.	2026-09-12 01:08:10 +02:00
dtourolle	369eb8fbf0	Put the log and the crash records in one file, and show it before writing it ... NFR-OPS-1 asks for a diagnostics bundle — the log, the schema version, the GPU and driver, the app version — "with an explicit preview-and-consent step before anything leaves the device". The log and the crash records have existed since August; what did not exist was any way to hand them over that was not `adb pull` and a knowledge of where the state directory is, which on the tablet the requirement was written for is nobody. Nothing here sends anything, and that is the design rather than a gap: crash.rs already says why a transport built ahead of the consent is the shape of thing that gets switched on by default. The bundle writes one text file to a place the user can find, so that they can attach it. That is the moment it leaves, and it is theirs. So the consent guards the write, not a send. Preparing gathers everything into memory and shows what would be written — each section, its size, what was taken out, and where the file would go — and only the second press puts bytes on disk. A user who reads the preview and presses the other button has changed nothing anywhere. The gathered bundle is held between the presses so what is saved is exactly what was shown, not a second gathering that differs by whatever was logged while they were reading. One text file rather than an archive, because a `.txt` opens wherever the user is sitting and pastes into an issue, and because the preview can then be the file rather than a summary of it. Every line goes through the blunter of the two redactions on the way in, whatever the sink already did to it: the log's own rule keeps paths, since a path read over `adb` is context, but a file meant to be attached to a public report by someone who may not read it first is held to the crash record's rule instead. The About page's graphics line gains the driver, which the requirement names and the adapter has always reported. And docs/outstanding.md is corrected on both OPS requirements: it said crash reporting was a log::error! hook and NFR-OPS-1 had nothing behind it, and neither had been true since 2026-08-30.	2026-09-12 01:08:10 +02:00
dtourolle	4574c35236	Let a part be left out of a mask without being taken out of it ... A layer built from parts was missing the one control a correction most often wants: seeing what it did. The question a subtracted gradient raises is whether it took only the sky, and the question a stroke raises is whether it filled the shoulder — and the only way to ask either was to remove the part and look, which answered the question and lost the part. The layer's own ring answers a different question, about the adjustment, and hiding eight layers to check one correction is not an A/B anybody performs. So a part carries `hidden`. It is an edit and a history step, as the layer's switch is, and it is folded into the render fingerprint because hiding a part changes the mask as surely as removing it does. Where the mask is built the shown parts are walked rather than the parts, which is what makes a hidden base hand the fold to the first part that is shown — and a revealed layer whose every part is hidden clears its slice rather than leaving whatever the last rasterisation put there to be read back. `covers` asks the same shown parts, so a layer whose only adding part is hidden costs no slice at all. In the sidecar the key is `hidden`, in the part's block or, for the base, in the mask block — under a word that cannot be confused with the layer's `enabled`, which has always meant the layer. Absent means shown, so no file written before the switch existed reads any differently. The row wears the same ring the layer does, one row down, because it is the same question about a smaller thing.	2026-09-12 01:08:10 +02:00
dtourolle	9cc52fd72b	Bind the two develop gestures that were described and not bound ... FR-DEV-16's book said resetting a control and hiding a mask layer were reachable by pointer and by finger, and stopped there. The reason was honest: the generated rows have no focus, so "reset the focused control" named a thing the panel could not point at. But a photographer at the keyboard means something narrower than focus. They mean the slider they just dragged too far, and that is a thing the panel can remember. So the Adjustments global keeps the last control moved — two indices, written where the panel forwards the change and cleared when the next photograph opens, so a reset cannot reach back into the previous edit through an index that happens to be shared. R puts it back, through the same callback the track's double-click takes, and is silent until something has moved. The mask layer needs no such notion, because the panel already has a selection: the rows the edge controls point at. H hides or shows those, through the path the ring at the head of the row takes, so it is an edit and a history step exactly as the ring is. A mixed selection goes to shown, since the layer nobody can see is the one being asked about. Both tags now carry the key, and the book says so.	2026-09-12 01:08:09 +02:00
dtourolle	2836ec2881	Build the Windows installer in a container, and run it under Wine ... docs/windows.md specified it; this is §9 steps 1, 2 and 4 run, and the report in §10. A Debian trixie image with rustup, the MinGW cross compiler, NSIS and Wine; a build.sh in the shape of the Android one; a package.sh that stages the executable and the seven models behind the same LFS-pointer guard every other packager carries, then runs makensis; and the .nsi itself — per-user, no elevation, an uninstaller that leaves the library alone. Measured: the executable links first time once the link flags were right, imports only Windows system DLLs, prints its version under Wine, and the installer installs and uninstalls silently under Wine with the registry key and the models where §5.2 says. What Wine cannot show is the Start Menu shortcut: CreateShortcut is IShellLink and does nothing headless. Four claims in the spec's first draft were wrong and are corrected in place with the reasoning kept: the whole-archive winpthread flag breaks the link and was never needed; build scripts need a host gcc; bookworm's Wine lacks the bcryptprimitives.dll rustc's std imports, so the image is trixie; and NSIS's default stub is 32-bit, so the installer says amd64-unicode and needs no i386 Wine.	2026-09-12 00:54:11 +02:00
dtourolle	fa4dca327f	Give the desktop executable a version flag and a Windows identity ... Three things the Windows build showed the entry point was missing, and that a Linux build never asks for. `--version`, answered before the logger and the crash hook install: a binary built on a machine that cannot run the application — the Linux CI producing the Windows executable, checked under Wine — needs an exit that proves it starts without opening a window or touching the user's directories. It is the smoke test in docs/windows.md §6. A GUI-subsystem executable in release, or Windows keeps a console window open behind the application for the life of the process. Debug builds keep the console, which is where their log goes. A resource block, or Explorer, the Start Menu and the taskbar show the generic executable icon and the Details tab is empty. build.rs wraps the PNG every other platform uses into an .ico at build time — an ICO entry may be a PNG, so the wrapper is a 22-byte header — and hands it to winresource with the version cargo already knows. The crate is an unconditional build-dependency because a cfg(windows) on one is evaluated against the host, which here is Linux; the script itself returns before touching it on any other target.	2026-09-12 00:54:11 +02:00
dtourolle	0a2c49dd10	Guard two constants the Windows target leaves unused ... secrets.rs names the keyring service and desktop_client.rs the socket timeout, and every use of both sits under a cfg that a Windows build does not satisfy — the placeholder secret store has nothing to file under, and the Nextcloud client's named pipe is not opened yet. The first cross-compile reported both as dead code, which is a failed clippy job the moment the Windows leg runs with -D warnings. Guarded by the same cfgs as their users, with the reason beside each.	2026-09-12 00:54:10 +02:00
dtourolle	b718c70b11	Specify a Windows installer built by the Linux CI ... The tree is closer to Windows than a Linux-only project usually is: every image library, the TLS stack and the inference engine are pure Rust, and dr-plat already keeps the Linux-only code behind cfgs with a loud fallback where none exists for another platform. What remains is a short list above dr-plat — five XDG path lookups, an xdg-open, the secret store's third implementation, the models' lookup beside the executable — and none of it touches core, which is the NFR-PORT-3 test this would be the first real run of. docs/windows.md decides the GNU target over MSVC-via-xwin, Vulkan only as on every other platform, a per-user NSIS installer that leaves the library alone on uninstall, and a CI leg in the shape of the Android one. It is explicit about what a runner with no Windows can verify — that it links, is PE32+, starts under Wine and installs under Wine — and what it cannot, which is everything involving a real GPU driver. Three FR-PLAT-WIN requirements and a channel row record the decisions; the ordering puts a first cross-compile on the developer machine before any container exists, because the list of cfg gaps is a reading of the source and the compiler's list will be longer.	2026-09-11 23:30:16 +02:00
dtourolle	a2c7789007	Sign the Android build with a real key, and let package.sh use it too ... The release keystore now exists and its four secrets are loaded into Gitea, so CI produces an APK a device can update in place. Until now every build, CI and local alike, was signed with a throwaway debug key -- CI's fresh per run, the local one exactly as durable as the cache directory it lived in -- and the night that cache was cleared, no build anywhere could install over the tablet's copy. package.sh forwards KEYSTORE_PASS, KEY_PASS and KEY_ALIAS into the container and copies the keystore under the mounted target directory for the build, so a local release-signed build is one environment line. The doc records where the local copy of the key lives. v0.12.0	2026-09-11 23:22:28 +02:00
dtourolle	7c44740d9f	Skip the read-only-directory test where modes are not enforced ... `a_failed_overwrite_puts_the_original_back` makes the presets directory read-only and expects the overwrite to fail. CI's Desktop job runs in a container as root, and root is not refused by a mode: the write succeeds, the assertion fails, and build-and-test has been red on every push to master since the test arrived. The test now probes the refusal it depends on -- one write into the directory it just locked -- and skips where that write goes through. Probed rather than keyed on the uid, because what the test needs is the refusal itself, and a filesystem mounted without permission checks would pass a uid test and fail this one all the same.	2026-09-11 22:22:46 +02:00
dtourolle	4f31123b0c	Let the user choose which SCRFD finds their faces ... faces.md §12.3 measured what the cheapest detector costs: the small faces in every group shot, and a dog embedded a dozen times. Which trade is right depends on the machine doing the sweep — a desktop left overnight and a tablet on a battery want different answers — so the detector is now a per-device setting, Fast / Balanced / Thorough on the settings page beside the indexing button, persisted with the rest of the settings file. A detector is half of a model id. Every face, marker, shard and calibration is keyed on faces.model_id precisely so that a model change is a new id and a re-index rather than a silent change under existing data, and a detector change is a model change: it decides which faces exist and where the landmarks that align them land. So each choice names its own pipeline. 500M keeps the bare "w600k_mbf" every existing library was written under, so an upgrade disturbs nothing; the others are qualified. Choosing one restarts coverage from zero under the new id, the sweep re-detects, confirmed names carry across by box overlap, and the sync shards are keyed by the same id so a peer on another setting neither adopts nor pollutes them. The library controller carries the id into the sync the same way it carries the cache budget, because the sync starts from places that have no settings in reach. All three shape-fixed exports ship — APK, Arch, Flatpak — since a tablet has no other way to obtain the one it was not installed with; the APK grows by twenty megabytes for the choice.	2026-09-11 22:12:53 +02:00
dtourolle	adf5d6cdd9	Drop a rival pipeline's marker when an image is re-indexed ... record_detections replaces every face on an image whatever model found them, but left the other models' face_index rows standing. With one model that was unobservable. With a second pipeline it leaves an image marked "done" under the first with none of its faces behind the marker — the state the V12 repair existed to undo — and a user who switched back would find those photographs permanently empty. An image now holds the faces of whichever pipeline looked at it last, and only that pipeline's marker. Confirmed names still carry across by box overlap, since they were read before the replacement.	2026-09-11 22:12:40 +02:00
dtourolle	9d35addd86	Measure what the cheapest SCRFD actually costs in faces ... §1 chose scrfd_500m on FLOPs and never measured the recall it gave up. A dr-ui example now runs several detectors over the same sample of stored proxies, matches boxes by IoU against the first, buckets the result by face size, times each, and writes contact sheets of the disagreements in both directions — because a count of extra faces says nothing until someone has looked at whether they are faces. Over 400 proxies from the reference library: 2.5G finds 14% more faces for 12% more time, 10G a further 12% for 3.1× the time. The extras are small real faces. The 86 faces only 500M found are a dog a dozen times, a stop sign, a wheel and the backs of heads. Recorded in faces.md §12.3.	2026-09-11 22:12:39 +02:00
dtourolle	3d6d69ec90	Wrap the face-sweep repair match the way rustfmt wants it ... CI's Desktop job failed at the Format step on 16f3fb4: rustfmt puts the `match faces_without_proxy(...)` on its own line under the `let` and re-indents its arms, and the commit was written without running it. No code changes; only the layout of that one match in library.rs.	2026-09-11 22:00:38 +02:00
dtourolle	16f3fb41a3	Measure the faces already found rather than finding them again ... Every face stored before its quality was kept holds a unit vector, and V14 forgot the run marker of each image holding one so that the next sweep would look again. Looking again meant detecting again: a whole re-detection per image, with every suggestion on it thrown away and the confirmations carried across by box overlap, to recover one number. The sweep now has a measuring pass between the proxy repair and the un-indexed images. It lists every image holding an unmeasured face, fetches the original once, warps each stored face from the landmarks it already has, embeds it, and writes the raw vector and its length over the old row. Ids, boxes and identities are untouched; the marker is re-written fresh so the sync exports the measured vectors. A face whose landmarks no longer make a warp is dropped, as detection would have refused to store it. `faces_unindexed` leaves those images to the measuring pass, so the V14 deletion no longer costs a second detection.	2026-09-11 21:50:12 +02:00
dtourolle	8b3abdb787	Keep each face's quality, and never compare against a poor one ... The embedder's raw output has a length, and the length is a reading of how recognisable the crop was: a blur, an occlusion or a hard profile comes out short. Normalising threw it away. A short vector sits near the middle of the sphere and matches a little of everyone, which is how one bad crop bridges two people in a grouping pass. So the length is kept — the store now holds the raw vector, re-normalised on load, with the length beside it as `faces.quality` — and a face under MIN_GALLERY_QUALITY (14) is a probe: measured against the gallery and placed where it fits, but never what another face is measured against. Two probes are never paired, and a probe is nobody's evidence for a confidence. The People screen shows the number as "Quality 17.3", dimmed below the floor. Faces indexed before this stored unit vectors and have no reading; they are admitted to the gallery, and schema V14 forgets the run marker of every image holding one so the next indexing pass measures them. A peer's unmeasured shard faces are not adopted, or a sync would write that marker back.	2026-09-11 21:50:12 +02:00
dtourolle	a87139b838	Give every mask an eye and a colour, and put the brush where the mask is ... The first build of seeing a mask showed the selected layer's, in one global style, from a strip at the top of the panel. It answered the wrong question and answered it somewhere nobody looked. What a photographer asks of two masks is how they meet — where the sky's edge sits against the building's — and that needs both on screen at once, in colours that can be told apart. So each row of the stack has an eye, drawn in the colour its mask is shown in, and each mask has six swatches to choose that colour from. Several can be open at once; a new one comes up open, in the first colour nothing else is using. The style — tint, alpha, outline — is the one setting that stays global, above the stack, because three styles at once are three pictures that cannot be read against each other. Alpha now draws every shown mask, each in its colour, on black. In the pipeline a `Reveal` is a list of `(layer, colour)` rather than one layer, and every reveal block carries its own colour. The brush moves too. Select, Paint and Erase and the three sliders under them sat at the top of the panel, appeared only once a row was selected, and said nothing about which mask they acted on — so "how do I paint" and "how do I correct the model's outline" both had the same answer and nobody found it. They sit under the selected mask's parts now, beside the swatches, and on a subject or a category the hint says what a stroke there does: it becomes a part of this mask, joined to the model's, and can be taken out again. Eyes and colours are viewing state, on the session and not on the layer, so a photograph reopened has every eye closed — the stored-mask round-trip test asserts it.	2026-09-11 19:03:51 +02:00
dtourolle	936490880b	Release 0.12.0	2026-09-11 09:33:36 +02:00
dtourolle	d8b9b5a4bb	Let the release script write the release commit it was never trusted with ... Every release commit in the history reads `Release X.Y.Z` and none of them carries the message this script would have written, so nobody has ever passed it `--commit` — and the reason is in the message it wrote: a Co-Authored-By trailer naming an assistant, which no commit in this repository carries and none should. The trailer goes, and so does the paragraph above it: the script's own header already says why it exists, and a release commit is the one place a one-line subject is the whole convention.	2026-09-11 09:33:28 +02:00
dtourolle	ac0aea70ec	Show a mask as soon as it is made ... Choosing a category is asking what it selected, and for a subject or a category that question had no other answer on screen: the model's outline is not derivable from anything visible, a fresh layer carries no adjustment to judge it by, and the list it was chosen from says "architecture 23%" without saying which 23%. The control that draws the mask existed but had to be found and pressed, a panel's height away from the list the choice was made in. So a new layer arrives with its mask showing, from the resting position only. Somebody who has chosen the alpha or the outline keeps it, and nothing re-arms in the background — every caller is a press that asked for a new mask. That makes the canvas depend on how a layer arrived, which is correct and worth stating: a session that has just made a mask draws a frame that a session which read the same mask out of a sidecar does not. Viewing state is not edit state and does not travel in a file, and `a_stored_mask_renders_exactly_what_the_model_rendered` now says so at both ends.	2026-09-10 20:56:11 +02:00
dtourolle	5d175cc668	Let a press on the photograph reach the tool that was armed for it ... The brush did nothing, and neither did three other things nobody had tried lately: clicking a subject on the photograph to select it, placing a repair, and sampling a neutral. All four are TouchAreas over the canvas, and all four sat behind the pan/zoom area, which is full-canvas and enabled for everything but a crop. It took every press in the viewport and they were never offered one. Slint hit-tests siblings front-to-back (`send_mouse_event_to_item` visits children `TraversalOrder::FrontToBack`), a TouchArea answers `GrabMouse` on any press it is enabled for, and the first grab aborts the traversal. Front means *last declared*. Each of the four carried a comment saying it sat "above the pan/zoom area so a click reaches it first" — true of the order they were written in, and backwards. Nothing about the geometry decides this, so nothing about the geometry could have fixed it. The pan area is declared first now, as the backstop it always meant to be, and the rule it leaves behind is that the general case goes above the specific ones. `GradientHandles` is the other end of that rule and is why dragging a handle has worked all along while everything between it and the pan area did not. The order is asserted in a test, because this is a fault that compiles, passes every other test, and silently removes four tools at once.	2026-09-10 20:56:10 +02:00
dtourolle	76ad667fd6	Offer a mask that is nothing but a hand ... Every route to a layer began with a selection — a gradient, a band, a subject, a category — and painting was reachable only by making one of those and joining a painted part to it. So the answer to "brush a correction onto this corner of the sky" was "add a radial gradient you do not want, then paint into that", which is not an answer. Paint sits beside Linear and Radial and makes a layer whose base is a brush. It covers nothing until a stroke lands in it, so pressing it arms the brush and shows the mask as well: a row that appeared and changed no pixel, with the pointer still in "select", is indistinguishable from a button that did nothing.	2026-09-10 20:28:09 +02:00
dtourolle	c045702a47	Show the photographer the mask they are shaping ... Nobody can refine an edge they are not being shown. The only thing drawn on the canvas was the region overlay — a false-coloured picture of what the model *detected* — which knows nothing of a layer's feather, its falloff, its morphology, its invert or its opacity, and nothing at all about a gradient, a range or a stroke. Every control added for mask editing therefore acted on something invisible, which is why the whole feature reads as absent rather than as unfinished. A layer's finished mask now draws over the photograph in one of three styles: a tint for whether the right thing is selected, an alpha for where the edge is, an outline for whether that edge is registered against the detail the other two hide. The hard part is not the shader. A selection with no adjustment on it changes no pixel, so it is not active, so it holds no slice of the mask array and is never rasterised — and that is exactly the layer somebody wants to look at, for the whole of the time between choosing a subject and deciding what to do to it. So `MaskStack::rendered` is `active()` plus the layer being looked at, and the rasteriser, the composer and the distance-field builder all index by position in it. Which is also why the design's "two uniforms, no recompile" is not available: a uniform can select a slot, it cannot conjure one. The reveal is never on the graph. It reaches the pipeline as an argument to `compose_revealing`, and `compose_for` — which the exporter, the thumbnail and the neutral probe all call — has no way to ask for one. A flag on the graph would have been shorter, would have type-checked, and would have been one forgotten reset away from a red tint baked into an exported file. And the tools that shape a mask now arm. `Masking.tool` is an `in` property only Rust may write, and the handler wrote nothing back, so the strip reported "Select" however many times Paint was pressed and the paint area was never enabled — the brush, the parts and the whole of FR-DEV-19b reachable from no control in the application. The region overlay stands down while a mask is being shown, and its button now says what it hides: two overlays that look alike and mean different things is worse than either.	2026-09-10 20:28:06 +02:00
dtourolle	193b35a249	Start a category mask where the photograph can bear it ... Clicking "architecture" made a layer whose mask was gone. Every category layer began at STRICTNESS_DEFAULT, and that constant was fitted on the synthetic sky the refine tests build — its own note warns that a real photograph's noise "moves every crossing down together", which turns out to be a considerable understatement. Measured over seven ordinary frames, half scale removes 76% to 99.5% of `architecture`, 36% to 93% of `ground` and 18% to 91% of `vegetation`. Only sky, the category the number was calibrated against, survives it. An empty mask is indistinguishable from a broken one: the layer is listed, the adjustment moves, and no pixel changes. So what this looks like from outside is that the segmentation does not make masks at all. No smaller constant fixes it either, because a nat of evidence means different things over a smooth sky and over a stone facade — the useful position is above 5 on one frame and below 1 on the next. So the frame is asked instead: `Refinement::gentle` walks down from half scale and takes the first rung whose gate removes no more than a sixth of the category's weight, and the model's own outline when none of them does. One `apply` on a friendly photograph and four on an unfriendly one, paid when a layer is made rather than for eight categories nobody masked. The slider's reset went to 4 as well, so taking the control back to its "default" emptied the mask. It goes to zero now, which is the one position documented to mean something: exactly what the model weighted.	2026-09-10 20:27:40 +02:00
dtourolle	404fea47a8	Wrap the lines the merge resolution left long ... `cargo fmt --check` failed the desktop job, on three files and for one reason: routing the mask handlers through the `Masking` global was done by substituting the call prefix, which is a text edit rather than a Rust one. It left `window.global::<Masking>().on_part_join_picked(...)` on a line that had been short enough as `window.on_mask_part_join_picked(...)` and no longer was. Formatting only. The whitespace-stripped source is identical in the two `ui/` files; the third differs by the trailing commas rustfmt adds when it breaks a call across lines. The matrix moves with it, because the tags shift by a few lines and the check compares line numbers. v0.11.0	2026-09-08 08:57:32 +02:00
dtourolle	d920716a2b	Release 0.11.0	2026-09-07 22:31:53 +02:00
dtourolle	2d878c2117	Offer the film stock in its own group, and let its list scroll itself ... Two faults in one control, both reported from the tablet. The stock picker appeared in every group. It is not a parameter, so it is not a row, so the filter that hides every other control when a group is chosen never saw it — "Kodachrome" sat at the top of Light, of Colour and of Detail alike. Three places it does not belong, and the one it does no more prominent than the rest. The descriptor has said `Effect` and only `Effect` since the film moved there; nothing was asking it. So the panel now asks. It cannot ask directly — a generated panel may not know which operation a control belongs to — so the session answers, from what the operation declares it is about, and a stock re-declared as something else would move on its own. The flag is recomputed when the group changes as well as when the film does, which is the half that would have made it stale exactly when it mattered. And the open list was unbounded, so it made the develop column taller and the column scrolled as one: reaching Velvia dragged every slider below it off the screen, an answer given once pushing aside the controls used constantly. It now scrolls within a bounded height of its own. That viewport is counted rather than measured, for the reason the tool rail records a few files away: a viewport that asks a layout how tall it wants to be, while the layout takes its height from the viewport, is a cycle Slint settles by handing back the height it was given — and the content is then clipped in silence rather than scrolling. Every row here is one fixed height, so multiplying is exact. The group rule has a test. The scrolling does not, and cannot: it is a layout, and a layout fault is invisible to the compiler and to every assertion that can be written about it.	2026-09-07 20:42:15 +02:00