mask.applyEffect, saveEffect and updateEffect read an `id` that isn't a
mask id as the selected mask (applyEffect {"id": "1"} changed mask 2);
mask.update, mask.component and mask.refineDetail cast `component` with
as-casts and fell back to component 0 or the last selection. They share
the strict opt_mask_id / opt_index helpers now.
photo.label read its label with str_param, which is None both when the
label is missing and when it isn't a string, and None meant "none": so
photo.label {} or {"label": 3} cleared the colour label of every selected
photo. Only "none" or null clear now; anything else that isn't a known
label is an error. Every caller in the app already passes a label.
mask_id read `id` with `as_u64().map(|v| v as u32)`, so text fell back to
the selected mask (mask.delete {"id": "1"} deleted it) and an id past
u32 wrapped onto another mask (4294967297 as u32 is 1). spot_index and
spot.select did the same with `index`, and a colour range's `component`
fell back to the first colour range part. They now refuse such values,
as the photo ids do; a missing or null value still means the selection.
Several commands read their photo parameters leniently. An `ids` that
wasn't a list of whole numbers (`"ids": 3`, `["3"]`) fell back to the
selection or the active photo, and an `id` that wasn't a whole number
(`"id": "5"`) fell back to the active photo, so a call meant for one
photo acted on another:
- ids: album.addPhotos / removePhotos / toggleTarget, library.select,
develop.set, denoise.queue, faces.index, mask.applyEffect (mask ids)
and app.export;
- id: photo.relink (relinked the active photo to the file),
photo.removeRegion / setRegion, faces.setName, stack.setTop / moveUp /
moveDown / split, library.findSimilar, the photo queries,
denoise.cancel (cancelled every photo) / status and ui.render.
They now refuse such values with an error, as Session::targets already
does for the other commands (shared cmd::photo_ids / photo_id). A
missing or null value still means the selection or the active photo.
The web import picker hard-coded a 13-extension accept list, so raws the engine imports (CR3, NRW, RAF, ORF, RW2, RWL, RAW, PEF, SRW, …) were silently filtered out of the dialog on Windows/Edge, which matches accept case-sensitively. Generate the list from EXTENSIONS, each extension in both cases. Fixes#2212.
On a profiled display the Grey and Sharpening-mask views rendered in the display's primaries, so
their histogram counted display-primary pixels, not the photo's sRGB ones. They now render in sRGB
like the clipping views (`Overlay::renders_in_srgb`) and are converted for the display after; they
show no photo colour, so nothing is lost.
The GPU equivalence test now covers Grey (mean/max LSB limits) and the shadow/highlight clipping
views (share of differing pixels, as for Visualize Spots: both renderers draw them with the same
`visualize::apply`, and a 1-LSB difference at 0/255 flips a pixel).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Reduced decoding is now opt-in: `files::load_vec_reduced` and the session's `reduced_loader` are used by grid
thumbnail jobs only; `load_bytes` / `load_vec` / `load_vec_pair` always decode the full image. A source developed
from a copy is marked (`DecodedSource::reduced`), so an export at a thumbnail's size reads the file again instead
of the cached thumbnail source, and Build Smart Previews never rebuilds a stale proxy from one.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A badge click no longer selects the photo first: stack.toggle opts into explicit_targets, so
`ids` skip the selection guard and the command refuses ids with no stacked photo. Compare keeps
its pair. Both badges announce Expand Stack / Collapse Stack.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Found while testing crates/engine/src/cmd/library.rs:1723 (parse_gps)
Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Found while testing crates/engine/src/cmd/library.rs:1723 (parse_gps)
Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The folder's mtime may not move from the save's listing to the list that follows (same clock tick on a fast machine), so the stale cache hid the bad files and problems came back empty - deterministic on a warm build. The test drops the cache as its own wild.json case already did (and as templates_changed documents).
The folder tree writes FolderNode.path with forward slashes on every platform, but tests_folder_drop built its widget ids from to_string_lossy, which gives backslashes on Windows: the 8 tests never found their rows there. row_path() normalizes the way tests_sync already does. Same class of fix in tests_export (path comparison) and an unused-import guard in catalog's staging tests (the module's only test is unix-only).
From review on #2327: the move is in the engine, so a script, the CLI or an
MCP client that rates the active photo out of a filtered view without `ids`
finds the next photo selected afterwards. The parameter text of the eleven
rating, flag and label commands now says so, where commands.list and the MCP
tools show it: without `ids`, the selection moves on when the edit takes the
active photo out of the view.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
With a filter showing one-star photos, taking the star off a photo took it
out of the view but left it the active photo: the grid highlighted nothing,
Detail kept showing it, and the next step (→, Shift+0–5 or Auto Advance)
started from the view's first photo, because `library.next` finds no place
in the view for an active photo the view doesn't show.
A rating, flag or label applied to the selection now does what a delete
already does when it takes the active photo out of the view: the photo after
it becomes active (the one before it at the end). That photo is the next one,
so `advance`, Shift+key and Auto Advance (keys and the Photo menu) don't step
past it. Commands that name their photos with `ids` leave the selection
alone, so Compare and Survey still show the photo they rate; a held view
keeps the photo, and the selection with it.
photo.pick, photo.reject, photo.unflag and photo.label now take `advance`
like photo.rate and photo.flag.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
write_file_durable creates parent folders, which broke the ui-egui test
exporting_keywords_says_why_it_failed. Write atomically with
safe_file::write_atomic so a missing folder is still an error.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
`face_download::Downloads::drop` gave a running download a second to stop,
with `Instant::now()` and `thread::sleep`, which panic on wasm32 ("time not
implemented on this platform"). The web host replaces its Session when the
library can't be opened, so with this branch an unreadable `catalog.log`
killed the page with the generic panic screen instead of showing the
library-problem window (found in a real-browser check of PR #1988). The wait
is skipped on wasm32, where there are no download threads; the cancel flags
are still set. Native test: an idle Downloads drops at once.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AbegtYaPuwqZ81pGfELsFK
A bad `orientation` was refused only on the refit path: "current" and an
unlocked "toggle" returned before the check, so {"aspect": "current",
"orientation": "bogus"} succeeded silently, and a value that isn't a string
fell back to the default. It is parsed first now, so every path refuses a
wrong word, a number, a boolean or null, and nothing changes (CodeRabbit on
PR #2280).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AbegtYaPuwqZ81pGfELsFK
photo.analyze takes burstGap (seconds, 0..86400, default 10) and
similarity (0..1, default 0.93); values out of range are refused before
anything is measured. The Assisted Culling dialog gets both sliders and
remembers them for the session.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
set_aspect always turned the ratio to the image's orientation, so a Custom
ratio taller than wide came out landscape on a landscape photo, and a
ratio picked after X (crop.rotateAspect) turned the crop back. A named
ratio now takes the crop's present orientation (landscape, or portrait
after X; a square crop follows the image), a custom [w, h] is used as
given, and crop.aspect takes orientation: "crop" | "given" to choose.
The window reapplies the remembered ratio to an untouched photo with
orientation "crop", as before.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AbegtYaPuwqZ81pGfELsFK
Found while testing crates/engine/src/cmd/cull.rs:23 (analyze: ids come from Session::targets, crates/engine/src/lib.rs:1205, which does not de-duplicate)
Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
GeoNames cities15000 holds towns of 15 000 people or more, so a photo in a
smaller town got the nearest larger one in City (Portofino → Rapallo,
5.3 km), another municipality. metadata.reverseGeocode takes maxDistance
(metres): past it, City and Sublocation stay empty, State and Country
still fill, and the reply names the town as nearestCity. Hostile values
are refused. The command help, the Fill Location tooltip and the parity
row say what the list holds. Default unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AbegtYaPuwqZ81pGfELsFK
Preserve upstream opaque RGB exports and real transparency while retaining watermark orientation/aspect and HDR JPEG size limits. Full local xtask ci passes.
Preset commands change the preset list outside pending_log, and a failed
presets.json write was only logged: unsaved() stayed None, so nothing
warned and the web backup (#1987) would zip a stale presets.json; on
desktop a full disk lost the preset silently. The failure is now kept
(presets_error), counted by unsaved() (plus one change), retried by
persist_if_dirty with the same back-off as failed appends, and cleared
once the write succeeds.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AbegtYaPuwqZ81pGfELsFK
CodeRabbit's docstring check counted the touched functions without doc
comments (read_with_progress, apply_prepared, inspect_report, result_dialog
and a test helper). Comments only.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RhZLBHaSnSko1eMByPibfh
Review of #2230: the skipped-image warnings were English text shown as is
in the result window. Skipped images are now data in the import and inspect
reports (`skipped`: image id and reason: missingFile, missingFolder,
missingRoot, incompletePath, masterSkipped) instead of warnings, and the
result window adds one line counting them through tr_format!, translated in
every UI language; the eight-warning cap is unchanged.
Reader-level tests now cover a missing folder and root record and a virtual
copy of a skipped master read from a catalog file.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RhZLBHaSnSko1eMByPibfh
Review of #1998. Each reload plan takes a ticket; apply skips a photo a
later-started reload has already been applied to, so an older read that
finishes last no longer restores the previous dimensions and content hash.
The app's background completion now commits through Session::execute_fn,
so the XMP sidecar auto-write (and the save) happen as for the command.
Regression tests: an_older_reload_does_not_replace_a_newer_one,
a_background_reload_writes_the_sidecar_with_auto_write_on.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Two more cases from the review of #1990: the end of a slider drag replayed
the crop Constrain Crop had fitted during the drag, so Auto Sync still
copied the active photo's fitted crop to the others; the end of an
interaction now starts again from the original crop when the drag didn't
edit the crop. And any section eye counted as a warp change, so turning
Light off could refit a hand-drawn crop: only the Geometry and Optics
eyes do now.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AbegtYaPuwqZ81pGfELsFK
A DNG that keeps reduced-resolution copies of its LinearRaw image (Lightroom merges keep 256, 512 and
2048 px ones) now develops a thumbnail or preview from the smallest copy that covers it, with the main
image's levels and colour and its crop scaled. A 23836 x 7078 drone panorama's 512 px render went from
38 s to 1.1 s. Copies are skipped when the main image has opcode lists, a linearization table or
black-level deltas, and for denoised photos.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Another maker's lens with the same specification ("Otherco 18-55mm f/3.5-5.6")
scores as high as the profile aliased "18-55mm f/3.5-5.6"; when it came first,
find_lens kept it and the exact-name check then refused it, so the alias was
never used. LensDb::find_lens_named ranks only the profiles named exactly so,
with the same maker and mount preferences (review on #2217).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Nikon DSLRs write no Exif LensModel, only the lens specification (maker note
0x0084, read into Metadata::lens_spec), so the lensfun-format lens database never
corrected their raws. A raw without a lens model is now looked up by a name built
from its specification ("24-70mm f/2.8", lightcraft_lensdb::spec_name), and a
profile is used only when one of its names is exactly that
(Profile::names_exactly): the specification fits every maker's lens with that
range, so a partial match or a maker-named entry is never taken. lensfun's own
database has no such names; a user aliases the one lens they own.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
CompatibleVersion, the profile digests, the lens profile's identity and its
default-strength scales, and CropConstrainToUnitSquare don't change the
rendering; a Lightroom raw sidecar listed all of them for every photo.
Look and unknown fields are still reported.
Split out of #2008.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
aiongg