Merge main into the integration batch

apps/photocraft/src/services.rs

@@ -634,12 +634,6 @@ fn shell_word(s: &str) -> String {
     if s.bytes().all(|b| b.is_ascii_alphanumeric() || b"/._-+:,@".contains(&b)) { s.to_string() } else { format!("'{}'", s.replace('\'', r"'\''")) }
 }
 
-/// The release-check transport, or `None` inside Flatpak: `flatpak update` owns updates there.
-/// The sandbox has network (for the `--control` server), which does not change this.
-fn update_transport(flatpak_id: Option<&std::ffi::OsStr>) -> Option<photocraft_engine::updates_cmds::CheckFn> {
-    flatpak_id.is_none().then(crate::updates::service)
-}
-
 pub fn native(automation: Option<photocraft_automation::AuthorizedWorkspace>) -> Services {
     let clip: Rc<RefCell<Option<arboard::Clipboard>>> = Rc::default();
     let clip_unreadable: Rc<Cell<bool>> = Rc::default();
@@ -704,7 +698,7 @@ pub fn native(automation: Option<photocraft_automation::AuthorizedWorkspace>) ->
         inbox: None,
         open_url: Some(Box::new(|url: &str| open::that(url).map_err(|e| e.to_string()))),
         beep: Some(platform_beep),
-        check_updates: update_transport(std::env::var_os("FLATPAK_ID").as_deref()),
+        check_updates: Some(crate::updates::service()),
         clipboard_set_image: Some({
             let clip = clip.clone();
             guarded_clipboard_set(move |w: u32, h: u32, px: &[u8]| {

apps/photocraft/src/services/tests.rs

@@ -182,9 +182,8 @@ fn open_filters_keep_literal_extensions_on_windows_and_macos() {
 }
 
 #[test]
-fn flatpak_builds_have_no_update_transport() {
-    assert!(update_transport(Some(std::ffi::OsStr::new("ai.storyteller.photocraft"))).is_none());
-    assert!(update_transport(None).is_some());
+fn native_services_provide_update_transport() {
+    assert!(native(None).check_updates.is_some());
 }
 
 #[test]

crates/ui-egui/src/i18n/ar.tsv

@@ -546,6 +546,22 @@
 	Decontaminate	إزالة التلوث اللوني
 	Output	الإخراج
 	Refine Edge	تحسين الحافة
+	Clear Selection	مسح التحديد
+	Color Aware	مراعٍ للألوان
+	Decontaminate Colors	إزالة تلوث الألوان
+	Edge Detection	اكتشاف الحواف
+	Global Refinements	تحسينات عامة
+	High Quality Preview	معاينة عالية الجودة
+	Object Aware	مراعٍ للكائنات
+	Object Aware needs a segmentation model, which isn't available yet	يتطلب «مراعٍ للكائنات» نموذج تجزئة، وهو غير متوفر بعد
+	Real-Time Refinement	تحسين في الوقت الفعلي
+	Refine Edge Brush Tool	أداة فرشاة تحسين الحافة
+	Refine Hair	تحسين الشعر
+	Refine Hair needs hair detection, which isn't available yet	يتطلب «تحسين الشعر» اكتشاف الشعر، وهو غير متوفر بعد
+	Refine Mode	وضع التحسين
+	Select and Mask was closed: another layer was selected	تم إغلاق «تحديد وقناع»: حُدِّدت طبقة أخرى
+	Select and Mask was closed: its document is no longer the active one	تم إغلاق «تحديد وقناع»: لم يعد مستنده هو المستند النشط
+	View Mode	وضع العرض
 	Modify	تعديل
 	Border…	حدود التحديد…
 	Smooth…	تنعيم…

docs/releasing.md

@@ -20,11 +20,10 @@ in the manual check window. Concurrent requests share one check.
 HTTPS validates certificates and host names against the operating system's trust store.
 
 Tags must be semantic versions (`v0.8.0` or `0.8.0`); only published stable versions newer
-than the installed workspace version trigger a notice. The notice opens the official release
-page to choose an installer; installation remains a user action. Drafts and prereleases do
-not trigger it. Web/headless frontends and the Flatpak (no network in its sandbox; `flatpak update`
-owns updates there) have no update transport. No release-workflow changes
-are required: publishing a newer stable GitHub Release makes it discoverable.
+than the installed workspace version trigger a notice. Drafts and prereleases do not trigger it.
+Flatpak builds also check for releases; repository-managed installations are updated through
+their package manager. Web/headless frontends have no update transport. No release-workflow
+changes are required: publishing a newer stable GitHub Release makes it discoverable.
 
 ## Cutting a release
 
@@ -265,10 +264,9 @@ Why these formats:
 
   Sandbox permissions (justified in the manifest): Wayland with X11 fallback, IPC (X11
   shared memory), `dri` for the GPU, and read/write access to Pictures and Documents. Every
-  other file goes through the file-chooser and document portals. There's no network, so the
-  `--control` server is only reachable from inside the sandbox until the user runs
-  `flatpak override --user --share=network ai.storyteller.photocraft`. Host fonts are read from
-  `/run/host/fonts` and `/run/host/user-fonts`. Locally (on Linux, with `flatpak` and
+  other file goes through the file-chooser and document portals. Network access enables update
+  checks and makes the optional loopback `--control` server reachable from the host. Host fonts
+  are read from `/run/host/fonts` and `/run/host/user-fonts`. Locally (on Linux, with `flatpak` and
   `flatpak-builder`): `packaging/linux/package.sh --formats tar && packaging/linux/flatpak-bundle.sh`.
 - **Flathub**: `packaging/linux/flatpak/ai.storyteller.photocraft.yml` builds from source and
   is ready for a Flathub submission (it keeps the same runtime and `finish-args` as the bundle

packaging/linux/flatpak/ai.storyteller.photocraft.bundle.yml

@@ -22,9 +22,8 @@ finish-args:
   - --socket=fallback-x11
   # X11 shared memory (MIT-SHM). Without it the X11 fallback is slow or fails.
   - --share=ipc
-  # Network for the optional --control server: it listens on 127.0.0.1 in the sandbox, which with
-  # network shared is also reachable from the host's network namespace. The in-app update check
-  # is disabled under Flatpak (flatpak update owns updates), so this does not enable it.
+  # Network for update checks and the optional --control server. The server listens on 127.0.0.1,
+  # which with network shared is also reachable from the host's network namespace.
   - --share=network
   # GPU access for the wgpu compositor (Vulkan, or GL as a fallback).
   - --device=dri

packaging/linux/flatpak/ai.storyteller.photocraft.yml

@@ -23,9 +23,8 @@ finish-args:
   - --socket=fallback-x11
   # X11 shared memory (MIT-SHM). Without it the X11 fallback is slow or fails.
   - --share=ipc
-  # Network for the optional --control server: it listens on 127.0.0.1 in the sandbox, which with
-  # network shared is also reachable from the host's network namespace. The in-app update check
-  # is disabled under Flatpak (flatpak update owns updates), so this does not enable it.
+  # Network for update checks and the optional --control server. The server listens on 127.0.0.1,
+  # which with network shared is also reachable from the host's network namespace.
   - --share=network
   # GPU access for the wgpu compositor (Vulkan, or GL as a fallback).
   - --device=dri