#5176 made ±100% move the edge by max(radius, feather, 2σ smooth), at
least 1 px. Measured in the reference application (a 100 px square,
Radius/Feather/Smooth each varied, Shift Edge -100/-50/+100):
- A hard selection does not move at all, at any Shift Edge.
- On a feathered edge the result is a fixed per-pixel curve, the same at
2, 5 and 10 px feather: the pixel's odds a/(1-a) are multiplied by
49^(shift/100). At -100% a 50% pixel becomes 2%, at -50% 1/8, at
+100% 98%. The fit holds within ±0.05 in log-odds on every sample.
So Shift Edge is now that curve, applied last as before. It needs no
neighbours, so the morphology callback and the halo/spread it added are
gone, with the ignored benchmark that timed it (matting::morph itself
stays for Select › Modify and the mask view).
Tests: a hard edge is unchanged at ±50/±100%; seven measured
before→after coverage pairs; a feathered edge is pulled in; the engine
refine tests now check the hard edge stays and a feathered one moves.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
UPDATE_APP (native builds; craft-update is a native-only dependency) carries our 128 px icon and accent (#2f7bf5, its colour in ArtCraft Launcher). The updater, the self-update
helper and craft-update's startup prompt all get them through crate::UPDATE_APP; the
prompt draws the icon, the accent and "by ArtCraft" (craft-update's default developer).
craft-update is pinned to storytold/craft-libs main at 1065653e7 (#434).
Clippy fixes for Rust 1.99 in untouched code (same logic):
- apps/photocraft/src/app_dirs.rs
- crates/codecs/src/codecs/via_image.rs
- crates/engine/src/canvas_geom/tests.rs
- crates/ui-egui/src/panels/blend_preview.rs
* packaging: Flatpak finds and prints to CUPS printers
The Print dialog listed no printers in the Flatpak: the runtime has libcups but not
lpstat/lp, the sandbox couldn't reach the CUPS socket, and driverless network printers
(lpstat -e) need Avahi. Bundle lpstat/lp/lpoptions from CUPS 2.4.20 (Apache-2.0,
statically linked, licence installed) and grant --socket=cups and
--system-talk-name=org.freedesktop.Avahi in both manifests.
* print: lp takes the job only when CUPS lists a printer; the only printer by default; ~/.cups read-only
Review (CodeRabbit) on bundling lp in the Flatpak:
- With lp present but CUPS down or empty, the job failed on lp instead of reaching the
IPP route and the print portal. lp_route now gives up the route when lpstat lists no
printer, before anything is submitted.
- With no printer named, no default and one queue, IPP picked it but lp failed. lp_route
names the only printer.
- The sandbox ignored the user's default printer, saved options and client.conf server:
grant ~/.cups read-only in both manifests.
* print: no printers for lp means the portal, not IPP; bounded listing; CUPS socket wrapper
Review:
- When lp is there but CUPS lists no printer, the job went to the IPP route, whose
server detection ignores ~/.cups/client.conf and could print to a local default
printer instead of the configured server. It now goes to the print portal, or fails
with no portal.
- The lpstat listing before a job is bounded (10 s, then lp takes the job as before)
and runs outside SPOOLER, which guards only Windows driver calls.
- Flatpak mounts the host's CUPS socket at /var/run/cups/cups.sock whatever path
client.conf or CUPS_SERVER names; the CUPS tools now run through a wrapper that
points a socket path missing in the sandbox there, leaving server names alone.
* packaging: redirect a custom CUPS socket only when it is the one Flatpak mounted
Review (CodeRabbit): Flatpak picks the socket it mounts at /var/run/cups/cups.sock
with stricter rules than CUPS (flatpak-run-cups.c: a socket CUPS_SERVER, else the
first line spelled exactly "ServerName /path" in ~/.cups/client.conf, else the
default), while CUPS reads the keyword in any case and takes the last ServerName. The
wrapper now redirects only when CUPS' socket is the one Flatpak chose, so a job can't
reach a different server; otherwise CUPS fails on the missing path.
* print: a printer listing past its deadline kills and reaps lpstat
Review: the 10 s limit stopped waiting but left a hung lpstat and its thread
running, so repeated print attempts could pile them up. photocraft now runs the two
lpstat listings itself (craft-print's lpstat_command and an equivalent lpstat -e,
parsed by printers_parsed) and kills and reaps each one at the shared deadline. The
output is read on a thread that ends with the process, so nothing outlives the job.
* packaging: never redirect a CUPS_SERVER the sandbox was given
Review (CodeRabbit): Flatpak picks the socket it mounts from the host's CUPS_SERVER,
so one set by flatpak run --env or an override may not be what it mounted. The
wrapper now leaves any CUPS_SERVER alone and redirects only a client.conf socket that
matches Flatpak's choice; otherwise CUPS fails on the missing path instead of
reaching a different server.
* packaging: point CUPS at the mounted socket only when it is the one Flatpak chose, else fail
Review (CodeRabbit): with a custom socket listed first and the default last in
~/.cups/client.conf, Flatpak mounts the custom one at /var/run/cups/cups.sock while
CUPS picks the last line, finds that path, and talks to the custom server. The
wrapper now compares CUPS' socket with Flatpak's choice even when the path exists:
equal, CUPS is pointed at the mount; different, the tool fails with an error instead
of reaching another server.
Also (CodeRabbit):
- A printer named in the job goes to lp even when CUPS lists none: listing can be
forbidden while printing is not, and the portal can't honour a name.
- A failed lpstat -e (CUPS unreachable, listing forbidden) means the list can't be
told, so lp takes the job, instead of an empty list sending it to the portal.
- A listing longer than 1 MiB counts as no answer, instead of growing without bound.
- The kill test checks the process with kill -0, which works on every Unix.
- docs/printing.md: the only-printer fallback is on the lp and IPP routes, and the
portal is Linux only.
Main's noop_step now takes the step's params (an Arrange that cannot move the layer is a no-op too); it is public for the CLI's run and batch, which pass them.
Row strips of a very wide source still allocated whole 256-row tiles
across the full width for every few rows (about 293 MiB per strip of a
300000 px RGBA8 source). Blocks are now whole tiles, at most 4096 px wide
and 1 Mpx in all, and their tiles move into the result without a copy.
Port behavior and regression coverage into current modules; preserve current upstream behavior.
Port grouped gradient browsers and style previews into current modular sidebar/options controls. Keep current transactional stop preview, drag/drop ownership and sidebar activation semantics; add compact Properties preset picker without replacing stop engine. Preserve accessibility Role metadata and all approved regressions.
Port behavior and regression coverage into current modules; preserve current upstream behavior.
Reconcile captured Pen and Freeform targets with current resumed-subpath, Type Path, Path Operation and draft recovery behavior. Valid source-owned tab switches commit to captured original target; invalid snapshots cancel with a diagnostic; refused commits retain draft and suppress automatic retries. Preserve current Saved(index) API and hidden-work-path protections, register all new ownership/gesture tests and add original-target tab-switch/deleted-target cases. Includes verified compile/API corrections from prior checkpoints.
The cap is now a function of the stored value and the target, so native
tests check values below, at and above it; the native-only assertions are
gated to native targets.
Rounding the strip height up to the compositor's 256-row tile let a very
wide source (300000 px) composite 76.8 Mpx in one strip. Strips are now as
many rows as fit in the budget, at least one; the equivalence test also
covers strips off the tile grid.
Port behavior and regression coverage into current modules; preserve current upstream behavior.
Port transparent-margin trim into current authorized streaming export report, retaining skipped-layer reasons and stable numbering. Measure alpha in bounded render bands, including masks/effects; keep empty-layer canvas and source document immutable. Preserve original regressions.
Port behavior and regression coverage into current modules; preserve current upstream behavior.
Add bounded deterministic suggestions via current error/session/control modules while preserving authorization/modal checks. Register hints and all original tests; fix scrollbar choice import and updated PSD image fixture field found by 100-head check.
Port behavior and regression coverage into current modules; preserve current upstream behavior.
Current compositor already preserves plain CMYK inks, tagged profile separation and uncropped merge bounds. Keep stronger native CMYK/Lab paths and current merge API; apply profile context to style rasterization and retain approved tagged-CMYK regression fixtures.
Port behavior and regression coverage into current modules; preserve current upstream behavior.
Port visibility preference, choice registration, live panel style and canvas override. Keep current animated camera and toolbar exclusions. Relocate misplaced persistence regression to prefs tests; retain current parity score counts.
Port behavior and regression coverage into current modules; preserve current upstream behavior.
Preserve current spatial Mixer Brush Alt-click sampling and live transaction architecture; add compatible point-sample command without foreground mutation. Retain sample across automatic reload until foreground changes and preserve all new regressions.
Port behavior and regression coverage into current modules; preserve current upstream behavior.
Port arbitrary-stop editor into current responsive dialog. Preserve source interpolation and exact model colors; unchanged dense imported snapshot lists roundtrip while edited lists retain 256-stop cap. Retain both validation guards and all original regression tests. Correct saved-path callers, floating-window and crop fixtures found by frozen 88-head all-target check.
Port behavior and regression coverage into current modules; preserve current upstream behavior.
Integrated independent exact shape paints and atomic pattern clipboard snapshots into current modules, preserving current soft-mask coverage, shape cache keys and gradient stop caps. Shared bounded COW pattern sampling now retains minification filtering; shapes/clipboards resolve lazy catalog entries to full pixels. Preserved CPU/GPU/depth/model regression matrices; also corrected missing glow-test enum imports found by the 80-head check.
Port behavior and regression coverage into current modules; preserve current upstream behavior.
Integrated bounded atomic CSH set parsing, unique shape/group naming and native Shapes panel import with inline-data authorization guards; preserved duplicate-name, inner-hole, malformed-second-record and preferences-reload regressions. Combined independent catalog additions and retained current parity metadata.
Port behavior and regression coverage into current modules; preserve current upstream behavior.
Added Alt guide rotation in current ruler/tool-input modules and engine Move Guide, retaining click-versus-drag selection, deletion on either ruler, colors, ruler-origin units and snapping. Selection follows the new orientation/index after a successful turn; original guide-turn/deletion regressions retained.
Port behavior and regression coverage into current modules; preserve current upstream behavior.
Ported Behind paint across engine/render and shared options-bar/canvas mode menus, preserving Clear and current popup ownership. Added localized responsive picker title/width and File Info multiline fields without dropping ordered fields, Browse or camera metadata; ported Pen anchor repositioning, copy cursor, grayscale-target sampling and authorized select-under-cursor dispatch into current modules with original regressions.
The default Memory Usage is 8 GiB per document, above the 4 GiB a
wasm module can address, so on the web the History budget could never
be reached and trimming never ran.
Performance::effective_memory_usage_mb caps the stored preference at
1536 MB on wasm32 and returns it unchanged elsewhere. The History
budget, the transform budget and the canvas allowance in the UI read
it. The stored preference and its default are untouched, so a saved
8192 still loads and still means 8192 on desktop.
History counted a document's pixel tiles but not the file bytes a
smart object embeds (SmartSource::Embedded). A document of large
embedded sources was far over its memory budget without trimming
ever noticing, and every Replace Contents kept the old bytes alive in
the undo states unaccounted.
The four counters (add, remove, bytes_with and the uncounted walk)
now visit one shared list of blocks: the tiles as before plus each
embedded source's Arc, keyed by address. States, snapshots and
duplicated layers that share an Arc count it once, and trimming the
last state that holds an old source releases it.
The cache estimated an entry at channels * 4 bytes a pixel, four times
too much for 8-bit, always kept a single oversize entry, recovered a
poisoned lock by disabling itself, and nothing ever cleared it.
Count each entry's real tile bytes once when it is cached, and do not
cache a source larger than the whole budget (as the stage cache does).
Web builds keep 4 entries and 384 MiB instead of 32 and 1 GiB, and the
smart filter stage cache 256 MiB instead of 768 MiB. A poisoned lock
is recovered rather than ignored.
Edit > Purge > All now clears the cache and reports it, and enables on
it alone. Closing a document that has smart objects clears it too:
entries are shared by content hash, so other documents just decode
again on their next re-render.
The first re-render of a smart object (Free Transform commit, Image
Size, a filter edit) flattened its source into one full-size RGBA
float buffer (16 bytes a pixel) and then converted it into a second
f32 vector before the surface was built, about 32 bytes a pixel on top
of the decoded document.
Composite the source in strips of about a megapixel straight into the
target pixel format instead. RGB, Grayscale and the depth conversions
give the same pixels as before (checked bit for bit, including masks,
blend modes and layer effects). CMYK and Lab composite natively in the
banded compositor and land up to 16 and 1 steps (8-bit) off the buffer
path, so sources in those modes keep the buffer path.
A 4096x4096 RGBA8 source now peaks +191 MiB (12.0 B/px) instead of
+655 MiB (41.0 B/px); tests/smart_source_peak.rs holds it under 16 B/px.
Port behavior and regression coverage into current modules; preserve current upstream behavior.
Ported hanging punctuation into current line placement and kerning modules, preserving forced breaks, bounded edge-tip row merging, justified-last-line behavior, area exclusions and independent Roman orientation shaping; kept PSD/engine/UI regression coverage.
Port behavior and regression coverage into current modules; preserve current upstream behavior.
Ported upright Roman classification, independent unkerned/unligated em advances and tab reflow into current Para/VerticalPiece shaping modules; preserved area and paragraph flow; retained vertical geometry and PSD BaselineDirection regressions.
Port behavior and regression coverage into current modules; preserve current upstream behavior.
Ported mappings and smart Save into current modules, preserving bounded authorized playback; migrated legacy PAT by committing validated per-pattern assets before atomic authoritative index; preserved same-ID replacements and builtin edits; added temporary-store interruption, corruption, duplicate ID/name and restart regression coverage. Current all-target compilation passed before final ownership guard refinement; focused tests pending.
Port behavior and regression coverage into current modules; preserve current upstream behavior.
Preflight existing render-cap helper before allocation, retain post-render completeness checks, and preserve the oversized Trim/Duplicate atomic-refusal regression.
