The max_total and Budget docs now say the budget counts bytes consumed
from gzip, and that unused lookahead from the initial gzip read (chunks
of up to 64 KiB) is not counted.
The recovery stage is now created, opened and, when opening fails, removed through
the retained recovery directory handle. A failed open no longer leaves an empty
stage under .removing, and the removal is not recursive. A rollback failure now
names the recovery stage ID next to the pack's last known path.
A call that timed out left the app's request future running, so an app that releases a request when its future is dropped (the desktop ControlRequest abandons a request nobody waits for) ran the call late, after the page had been told it failed. call() now drives the request future itself and drops it when the timer wins.
The desktop control protocols name the base64 PNG of ui.screenshot differently (pngBase64, png_base64, png, base64), so screenshot() gave the page a different shape in each app. It now also puts the PNG in data and leaves the app's own field where it is.
The timer handle is kept as the environment returned it: Node returns an object, not a number, so a numeric id never cleared the timer and it fired after its closure was dropped.
The deny-list paragraph and the chrono calendar exception now live in the Rust rules. CLAUDE.md imports AGENTS.md, and the workspace-lints requirement stays with the new-crate notes.
* craft-print: a job can be cancelled until it starts reaching the spooler
On Windows a job asks the printer's driver for its capabilities before
anything is sent. A networked printer in power save can hold that query
for a long time, and an app had no way to give up on the job without
risking it printing later (storytold/wordcraft#5710; CodeRabbit on
storytold/wordcraft#5732).
A Cancel token, passed to the new submit_cancellable, moves a job from
pending to cancelled or to sending. The job checks it at the last point
before anything reaches the spooler: on Windows after the driver has
answered, before the job file is written; on macOS and Linux before lp
starts. A cancelled job returns an error and is never sent; a job already
being sent completes. submit and submit_with_progress are unchanged, and
Error keeps its one variant so callers that match on it still compile.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* craft-print: a job turns to sending with the provider held; the job file waits for it
Review: marked as sending before it took the PrintTicket provider, a job
could then wait behind another job's driver call that a sleeping printer
held, and an app that waits only for jobs being sent would wait on it.
The job now turns to sending only once it holds the provider, right
before printing, and writes its file only after that, so a cancelled job
leaves no copy of the document behind.
A test-only hold in the driver call lets the Windows spooler test cancel
a job while its driver doesn't answer: the cancel wins and, once the
driver answers, the job stops instead of reaching the paused queue.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* craft-print: the DEVMODE conversion comes before a job turns to sending
CodeRabbit on #622: winprint converts the ticket to a DEVMODE, a driver
call a sleeping printer can stall, before it creates the native job, so
a job stalled there had already turned to sending and couldn't be
cancelled. The conversion now runs first, with the provider held, while
the job can still be cancelled; the provider stays held until the first
copy's own conversion, so no other job comes between them.
Tests: the Windows spooler test also cancels a job held in that
conversion; the CUPS test gives a spooler that can't start, so any
attempt to start it would change the error. README: cancellation in the
progress section.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* craft-print: clarify cancellation during winprint conversion repeat
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* craft-font-catalog: run the Unix font-folder tests only on Unix
Five tests build an Os::Unix FontEnv from Unix paths (/home/me, <dir>/sys/fonts</dir>).
Windows doesn't treat those paths as absolute, so the tests failed there. Production code
is unaffected: on Windows FontEnv::from_process picks Os::Windows, whose folders never go
through the Unix path logic. FontEnv's docs now say its paths follow the host's path rules.
The font-store workflow, which already triggers on crates/font-catalog, now also runs
craft-font-catalog's clippy and tests on Linux and Windows.
Refs #619
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* craft-font-catalog: keep the store override and no-store tests on Windows
These assertions don't depend on Unix path rules, so they now sit in their own
ungated test.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* craft-font-catalog: verify store override precedence
Exercise the override with platform defaults present on every OS variant.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The live spooler test only checked that printer_queues() reports
two_sided as unknown, which would still pass if it called printers() and
cleared the field (CodeRabbit on #618). A test-only per-thread counter in
two_sided(), the one PrintCapabilities query printer discovery makes,
now shows printers() querying the test queue's driver (the control) and
printer_queues() querying none.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
On Windows, printers() reads each driver's PrintCapabilities to report
two-sided support before it returns. A networked printer in power save
can hold that query for a long time, so a Print dialog showed no printer
at all, not even the ones that were awake (storytold/wordcraft#5710,
storytold/wordcraft#5645, storytold/wordcraft#5413).
printer_queues() returns the same queues and default from EnumPrinters
and GetDefaultPrinter with two_sided unknown, and makes no driver call.
Submission still checks the job's options with the driver. On other
platforms it is printers(). printers() is unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
zip's `deflate` feature pulls in deflate-flate2-zlib-rs (and zopfli). Cargo
unifies flate2's features across the whole app, so on Windows every flate2
user in an app depending on craft-update switched to zlib-rs, whose level 1
is a static-Huffman quick mode that can produce output larger than its input
(Lightcraft's 16-bit ZIP TIFFs on Windows came out bigger than uncompressed).
Use `deflate-flate2` with flate2's default miniz_oxide backend instead; the
updater only reads Deflate zips, which that covers.
A blank name falls back to the default label only when no letter or
digit is left ("{name} 2" gives "2"); the docs and the rustdoc of
labels::named said a letter. A test pins both cases.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The accessibility section said a group's top border band is never
announced. Where no drag bar is drawn the band is the group's one move
handle and has the node.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Keep both craft-web-api and craft-web-host in the workspace list, the
README and the lockfile. Point the host README at the command API that
landed in #413, and the command API README at these host messages.
Co-authored-by: Cursor <cursoragent@cursor.com>
A page host can report a new dirty state while post_dirty's event is still
dispatching. Remember the state first so that later report wins, and restore
the previous state only when the send fails and nothing else recorded one.
Co-authored-by: Cursor <cursoragent@cursor.com>
A group's drag bar and its top border band were both buttons with
move_group_label, so a screen reader heard every group twice, and every
group and column bar had the same name. The band, which only drags, is
now out of the accessibility tree and keyboard focus (unless no bar is
drawn), and a `{name}` in move_group_label or move_column_label stands
for what the handle moves: the logical label of the panel the group
shows, or the titled panels a column's groups show, joined by ", ". A
blank title leaves the placeholder out with the brackets, quotes or
separator around it. Labels without it, today's defaults included, are
used unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
wasm-bindgen throws "closure invoked recursively" when an FnMut closure
is called while it runs, before its body can queue the message. The
listeners only read their captures, so they are Fn; the handler's state
stays behind the Inbox's RefCell.
A page host dispatches its events synchronously, so it can answer (a
saved for the save the handler just posted) while the handler is still
running. The nested borrow_mut then panicked. Both transports now hand
messages to an Inbox that queues each one and drains the queue one call
at a time, in order; nothing is dropped. The new test fails with the old
borrow ("already borrowed").
FileData::size() reads a Blob's length from the Blob; a host's size
field is no longer trusted for an app's size check. lib.rs gets the
crate-level deny of unwrap, expect, panic and the like.
The messages between a Craft app's web build and the page that hosts it
(ready, host, open, save, saved, dirty, failed, handoff, handoff-done),
as proposed on #358. The contract part (message kinds, the version, the
?host=parent / data-host="page" switch, file-name clean-up) builds
everywhere and is tested natively; the web module (wasm32) is the bridge
an app's web shell calls: same-origin parent only, files as bytes or a
Blob without copying, saves as a transferred ArrayBuffer, dirty repeats
suppressed. Compatible with the bridges shipped before it: optional
fields stay optional, and a host treats an unknown ready.version as 1.
CI: the package repair between ffmpeg install tries gets a time limit
too, so a blocked configure script cannot use up the job's time.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
CI: time-limit and retry the ffmpeg install. A stalled apt mirror used
up the oracle job's 20 minutes on #442, #443 and #447 before any test
ran, and its log is only printed when the step fails. Each try now gets
3 minutes, up to three tries, and a timed-out install prints why.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Ogg track tests set their files' serial numbers instead of writing
the files until ffmpeg happens to pick the wanted order. They rewrite
each page's serial and checksum, so both orders run with one ffmpeg call
and do not depend on ffmpeg's serials being random.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Ogg track tests no longer depend on chance. Each writes its file
until the serial numbers are in the order it asks for, in both orders,
so the reversed order that told the old code apart always runs. A file
this ffmpeg cannot write goes through `skip`, which fails the test when
oracles are required.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A track index in an Ogg file means the same stream everywhere: the
file's order, as `tracks` lists them. Streams the native path does not
read fell back to symphonia with the same index, but symphonia orders
tracks by serial, which ffmpeg picks at random. A file could decode the
wrong track, or fail on a FLAC stream listed before an Opus one.
The tests write each file eight times, so both serial orders occur, and
cover a track with no mask comment next to one with a mask.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Each FLAC stream in an Ogg file reads its own channel mask comment. The
tags symphonia's reader collects do not say which track they are from,
so a track could get another track's mask. The masks now come from
craft-media's Ogg demuxer, by serial, which is symphonia's track ID.
The Ogg layout test also covers 7 channels with no comment and a zero
mask.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
FLAC in Ogg reads its layout the way a FLAC file does: from the mask
comment, or else the one decoders assume for the count. Without this, a
6-channel stream with no comment reported back surrounds in Ogg and side
surrounds in a FLAC file.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- FLAC files read their layout from the channel mask comment, or else
the one decoders assume for the count, which is what the writer omits
the comment for
- an unbuilt format is Unsupported before the layout is checked
- FLAC encode no longer reserves half the PCM size up front
- flac-encode's lib tests stream a file and compare it with encode
- the seek test compares samples after the seek
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
No change in output: the 74 oracle test streams are byte-identical.
- The Wasted case is handled in one function, without the unreachable arm
and the wrapper round 8 added.
- The bitstream writer uses predict::fold, the tested copy, not its own.
- STREAMINFO's MD5 may be 0 (RFC 9639 §8.2), so the comment no longer says
the RFC requires it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Tests only; each was confirmed to fail on a mutated encoder.
- Every sample rate code in the frame header table.
- Signals that reach the Rice parameter and LPC shift limits, where a
value past the limit gives a file decoders refuse.
- ENCODE_EXTENSIONS lists flac.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Refuse a linear predictor whose prediction leaves the i32 range. Such a
stream is valid, but symphonia adds the prediction to the residual as an
i32, which panics in a debug build. The round 8 residual limit made this
reachable at 24 bits; without the override, 13 of 240 clipped 32-bit test
streams failed in a debug build and none do now, for 0.09% more bytes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Code wasted bits (RFC 9639 §9.2.2): low bits that are zero in every
sample of a subframe were stored anyway, so 16-bit audio exported at 24
or 32 bits grew by the padding.
- Allow residuals up to the 32-bit limit (§9.2.7.3). The limit was half
that, so at 32 bits a transient forced its whole block to verbatim.
- README: 32-bit FLAC codes stereo channels independently.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Test the high bits of STREAMINFO's total sample count, and that a total
past 36 bits is left unknown.
- README limits: the usual 5- and 6-channel layouts depend on the mask
comment too; say what is outside the streamable subset.
- Comments: 32-bit code 0 does not decode everywhere and leaves the
subset; the oracle test helper is in craft_media_testkit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
FredApps
dotCooCoo
Helen Kwok
ashandClaude Opus 5.5
Zinadin ZidanandClaude Opus 5.5
alehelandClaude Opus 5.5
skylar taylor-barrick