Preserve existing PDF catalog entries and full object generations. Accept literal null trailer entries while failing closed on encrypted/hybrid/ambiguous or unreadable history. Validate visibility variants atomically before document edits, suppress stale unsupported canvas overrides, and preserve conservative content cropping without overcropping empty optional-content stubs.
Local full CI: all 9 gates passed, 3063 tests passed and 6 skipped, all 16 WASM-safe crates checked. Independent qpdf/preservation/Poppler checks passed for17 supported inputs;6 refusal cases stayed refused. All11 additional Prev controls passed. GitHub CI and CodeRabbit passed on00d5fa5c; CodeRabbit confirmed the Prev finding addressed. Author history preserved; no native format changes.
Reject a non-null Prev entry that cannot be read as an offset instead of silently treating it as the end of the guarded trailer chain. Keep absent/null end markers and readable numeric offsets unchanged.
Reproduced CodeRabbit discussion_r4366245854 with an independent probe and a failing native regression before the fix. The synthetic regression covers seven unreadable value types plus absent/null and integer/real history controls.
Validation: all 9 cargo xtask ci gates passed (3063 tests passed, 6 skipped; 16 WASM-safe crates). One unrelated GPU test was labelled leaky by nextest in that run and passed cleanly in an isolated rerun. Independent checks: 17 original supported PDF variants still pass qpdf, logical preservation and Poppler pixels; 6 original refusal cases remain refused. All 11 additional Prev controls pass (7 refused, 4 accepted).
Integrate current main (d8d78851) without rewriting the contributor's commits, retaining craft-libs 9f75d3dc.
Accept literal null trailer entries while rejecting actual or ambiguous encryption/hybrid markers. Structurally inspect bounded xref/trailer history instead of adopting trailer-looking comments. Preflight all selected source variants before editing/undo; preserve reset-to-defaults. Suppress stale unrewritable canvas overrides rather than revealing source content. Keep conservative all-content crop fallback without overcropping layerless/null stubs.
Validation: cargo xtask ci, all 9 gates passed; 3062 tests passed, 6 skipped; all 16 WASM-safe crates checked. 17 supported variants passed independent qpdf, logical preservation and Poppler pixel checks; 6 unsupported/repair-only cases refused. Direct-harness Claude Opus 5 reviewed the exact main-relative delta with no blocking findings.
No native-format changes or unrelated layer features. Synthetic regression fixtures are generated in test code.
A menu row only reacted over its text because the column used a plain top-down layout. The test renders a menu column with a short Preferences row and clicks near the right end of the row, expecting the dialog to open. Without the justified layout the click misses and the test fails.
The start screen showed only the first ten presets and had no A6 sheet. The test checks that the start screen paints a card for each print preset, that A6 exists at 105 x 148 mm, and that the Properties page-size list agrees. Without the fix it fails because the B5 card is cut off by take(10) and there is no A6.
The Help menu's links were greyed out when no document was open, because UI commands outside app. and window. needed a document. The test checks every help.* UI command is enabled with an empty session while another UI command (view.rulers) stays disabled. Without the help. exemption it fails on "help.discord must work from the start screen".
The conflict was in links.rs, where main's atomic relink work (b050343a) and
this branch's path gate both changed `update`. Kept main's mechanism (build the
replacement with relinked_asset, then insert it) and this branch's gate (a link
craft-docpath refuses is missing and never read).
relinked_asset now takes the path to read and the link to record separately.
Previously they were one argument, safe only because update passed the raw stored
link; passing the resolved path to the old signature would have rewritten every
relative link to an absolute one on each refresh.
Also passes None for the document in main's embedded-status test, where the asset
has no link so the document is irrelevant.
craft-libs#169 is merged, so the fork pin is no longer needed. Pinned to
storytold/craft-libs 82a24b00 (main after the merge) rather than the older
12281d07, which predates resolve_absolute and the Windows colon refusal.
Scratch exports from running the app and the CLI land in outputs/. It is
not ignored, so `cargo xtask assets` — which scans tracked and untracked
files alike — reports every PNG and PDF in it as an asset with no row in
ASSETS.md, and the check cannot pass on a machine that has ever run the
app with an output directory.
Merges upstream/main into the branch, resolving 12 conflicted files, and reconciles where the two sides meant different things — notably the format version, where both had independently defined version 2 (EPS sources here, pinned paragraph defaults on main), so a document without EPS was being written as version 1 and re-upgraded on load.
Verified locally against main b17efb2d: cargo test --workspace --no-fail-fast 2869 passed / 0 failed, cargo fmt --check clean, cargo clippy --workspace --all-targets -D warnings clean, xtask layers and wasm ok.
Hamza's diagnosis of the forgotten OpenGL failure, with the filter reordered so it covers any backend and does not hold another machine's record against this one, plus a regression test.
No workflow runs on this PR: every one is path-filtered and apps/designcraft/src/gpu/backend.rs matches none. Verified locally on 653f83b8 instead — cargo test --workspace --no-fail-fast: 2847 passed, 0 failed, 5 pre-existing ignores; cargo fmt --check clean.
Builds on the fix in this branch, which spotted that a failed OpenGL was
being forgotten because `failed` is filtered to this platform's
candidates and OpenGL is no candidate off Windows.
Rather than spare OpenGL from the filter, run the filter before the
previous start's backend is added. A stored entry that is no candidate
here came from another machine and still says nothing, so it is dropped
as before; the backend a start was actually running on is added
afterwards and stays, whichever backend it is. That keeps the same crash
out of the next instance without naming OpenGL or the platform, and
without holding a failure recorded on someone else's machine against
this one.
Adds the regression test: on macOS, where Metal is the only candidate, a
start left on OpenGL has to keep it out of the instance, while a stored
OpenGL entry that never ran here is dropped.
The merge compiled, but six tests showed where the two branches meant
different things. Fixes, in order of consequence:
- Format version: both branches had independently defined version 2 —
here for retained EPS sources, on main for pinned Keep Lines Together
and drop cap defaults, with an `upgrade` that runs below 2. Writing 1
for documents without EPS then re-ran that upgrade on load and rewrote
their paragraph styles, so saving and reloading changed the document.
EPS now asks for version 3 and everything else stays at 2.
- place.drop into a frame: main turned Auto-Fit off so that resizing a
frame crops rather than refits, and this branch had carried the older
FillProportionally along while moving the geometry out of the edit.
Main's behaviour is the intended one.
- save() compacts unreferenced assets now, so the format test has to
place its EPS for the version sniff to see it at all.
- EPUB entries are named from the asset's file stem (asset_path), not
its bare id: images/logo-<id>.png.
- Command parameters are validated strictly, so the PDF page test sends
each command only the parameters it takes.
- The relink batch's "commits once" check read a process-wide revision
counter, which a test running beside it can advance; the single undo
step is what actually shows it committed once.
The EPS place tests move to cmd/file/eps_place_tests.rs: they write real
files, and main's file-system guard reads src files without seeing inline
#[cfg(test)] modules, but exempts _tests.rs ones.
Four sites already on main that `cargo xtask ci` cannot get past with the
current toolchain; each rewrite is the one clippy suggests and changes no
behaviour. `!x.is_some_and(f)` becomes `x.is_none_or(!f)`, and pdf_bounds
folds `!(a && b) || !c` into `!(a && b && c)` by De Morgan.
Unrelated to the merge they are committed beside; separated so that merge
stays a merge.
Resolve 12 conflicted files. Where both sides changed the same code:
- format: keep main's bounded-read load_zip (MAX_ENTRIES, read_entry) and
this branch's u64 version reporting, so a version above u32::MAX is named
as written rather than clamped. Both sides had fixed the same truncation.
- render: main's natural_size supersedes image_natural_size (it already
reads an EPS bounding box and also handles PDF pages); callers in table
and data merge now use it.
- images: keep the DSC-aware header scan and (atend) trailer lookup, take
main's classic-Mac line endings, and carry its overflow guard into
parse_box. eps_proxy draws main's simple rectangles before falling back
to the placeholder, still over a retained EPS source.
- engine/file: take main's placement shape (add_asset, crop box geometry,
place cursor, finite_rect, object effects) and keep this branch's
validate_placement in both branches; edit() works on a clone and commits
only on Ok, so validating inside it stays all-or-nothing.
- engine/links: keep building the replacement before edit() so a file that
cannot be read leaves the document untouched, and move main's crop_pdf
refresh into relinked_asset, which both relink and update go through.
- engine/export: EPS preview warnings join the font-embedding warnings
rather than shadowing them.
- idml: an EPS element keeps ActualPpi (its pixels are a preview raster);
main's PDF exclusion is unchanged.
Cargo.lock regenerated. Tests and doc strings from both sides kept.
Reject page selections that cannot fit the target index type before conversion, and return an error for the largest direct PPTX page index.
Validated the combined main and PR tree with all seven cargo xtask ci stages (1,967 passing tests), four actual WASM export-page regressions, and successful FreeBSD, Windows ARM64, and packaging workflows.
PDFW / #875: route document, booklet and book-merge exports through the
guarded shared PDF writer while retaining application export policy.
Validated the exact integration with all seven local CI gates, paired native
and WASM exports, and fresh FreeBSD and Windows ARM64 hosted checks.
Merge current main into the text editing and layout work, retaining the original contributor commits. Preserve generated and linked stories, incoming text references, local IDs and locked frames when threading.
Keep pending formatting and text colours consistent, isolate deferred control clipboard input, and handle inherited IDML frame properties with bounded column allocations. Add focused state-preservation and round-trip regressions and correct the socket and swatch test fixtures.
M2; refs #84.
Route AppKit termination through the existing unsaved-document close transaction using the immutable winit patch. Restore pending prompts from hidden or minimized windows and preserve answers across repeated requests.
Validation: all six local gates, native cancellation/retry/save smoke, and hosted platform checks.
Fixes#544.
PR #623.
Force actual failed recovery publication at the reserved destination so privileged runners exercise the intended retention path. Keep the normal writer, publication order and existing assertions; enable these fixtures across platforms.
Validation: all six local gates and the FreeBSD root VM workspace build/tests.
PR #627.
Checkpoint the latest document state during App::on_exit after honoring current quit approvals. Keep incomplete or stale plans, clear recovery for clean documents and report unavailable or failed storage.
Follow-up to #545; cancelable macOS Dock Quit remains open in #544.
PR #617.
Keep recovered snapshots available through a second crash before autosave. Track checkpoint ownership across folders and restarted IDs; Save, Close and Revert clean only checkpoints owned by that document.
Follow-up to #506 and the retention concern in #380.
PR #616.
Prepare and stage every chapter before a book update writes files. Preserve imported IDML sources, reject open native chapters and report completed paths after a later write failure.
Follow-up to #485.
PR #615.
Route desktop writes and CLI raster exports through the engine atomic writer. Add actual-caller regressions for reader visibility, private modes, symlinks and valid long filenames.
Follow-up to #485.
PR #614.
Preserve document paths, revisions and collection contents when persistence fails. Rebase Save a Copy paths without changing the open document.
Follow-up to #485.
PR #613.
* ci: simplify testkit dependency match for Clippy
* UI: keep menus and dialogs reachable at larger scales
* UI: share viewport-aware scrolling across menus
Incorporate @aiongg's shared menu-button, anchor-aware sizing, and
reopen-reset work from #279 (717ddb6), retaining #281's clipped-submenu
and scrollbar interaction fixes.
Use the wrapper for workspace, zoom, and panel menus as well as the
menu bar. Preserve checkbox dismissal and cover anchor placement,
scroll reset, and very short viewports with regression tests.
---------
Co-authored-by: skylartaylor <26588250+skylartaylor@users.noreply.github.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* ci: simplify testkit dependency match for Clippy
* IDML: resolve table styles and shared cell edges
* Compose: size table cells by baseline and physical bounds
---------
Co-authored-by: Brandon Thomas <echelon@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* #89: preserve browser import context and PDF options
* #91: reject PDF pages before narrowing on Wasm
---------
Co-authored-by: Brandon Thomas <echelon@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
skylar taylor-barrick