Add AppScreen.kiosk mounting a KioskShell sibling of AppShell in the same
AppWindow: a thin back bar + persistent PlayerBarSmall + a bottom NavRail of
6 tiles replace the HeaderBar/Sidebar, sharing every *State global verbatim.
The NavRail routes through the SAME NavState routes the desktop uses
(header-menu-navigate / request-settings / ContentView.search). Content
reuses the real Home/Album/Artist/Favorites/Search/Settings views (verbatim
subset of AppShell mounts) with the arithmetic content-height pattern to
avoid the layout-collapse footgun. Rust lands the Kiosk screen post-login
when the kiosk profile is active. Validated through the Slint 1.16.1
compiler (slintcheck stub); remaining routes + touch-interaction remap are
P2/P3.
cc
The per-track context menu in the Queue sidebar had two placeholder items
with no click handler: "Remove all after" and "Add to playlist". Wire both
end to end.
- QueueState gains remove-all-after(int) and add-to-playlist(int), resolved
from the page-local row index like remove-upcoming (search-filter aware).
- Core/player gain remove_upcoming_after(upcoming_index): truncates the
upcoming list in PLAY order (shuffle-aware, reuses remove_upcoming_track),
clears the stop-after marker if it lands in the removed range, and emits a
single QueueUpdated. The pre-existing remove_after (absolute-index, not
shuffle-aware) was dead code and stays only for its unit coverage.
- Add to playlist reuses the save-as-playlist picker handoff seeded with the
single row's track id.
cc
Tauri let the user rename how QBZ announces itself to Qobuz Connect;
the Slint port lost the UI entirely while keeping the persistence and
the announce path (same device_name key in qconnect_settings.db, read
by connect() -> bootstrap_remote_presence). Restored 1:1: a text row
in Settings > Playback next to the QConnect startup select (LineEdit
mirroring the ListenBrainz token row, placeholder = the resolved
default 'Qbz - {hostname}'), a new settings-string callback channel
through the settings chain, and a live-service setter so a rename
takes effect on the next connection without an app restart — exactly
Tauri's semantics (no live re-announce; the row description says so).
Trim-only validation like Tauri; empty clears the override. Two new
msgids across the 8 locales.
cc
The rail's 'View all' opens a dedicated page listing the recently
played albums (the dedicated album history from the #567 fix, cap 24).
Built on the AwardAlbumsView skeleton stripped to essentials: fixed
header + windowed AlbumCollectionView wired per the new sampler
contract, scroll-restore, shared scrollbar. Works offline (local
history — the AppShell arm deliberately skips the offline gate) with
mixed-source rows routing through the existing open-album funnel
(qobuz/plex/local) and source-split artwork dispatch mirroring the
rail's. Full nav integration: NavEntry::RecentAlbums round-trips
through last_nav so view persistence restores it (a local JSON read —
cannot crash-loop), ADR-004 back button via the standard record +
navigate + flags shape. Zero new msgids — title, empty state and the
View-all link all reuse existing strings across the 8 locales.
cc
Third and final hit of the 'Recursion detected' panic class
(i-slint-core properties.rs:583), this time crashing DiscoverBrowse on
startup view-restore (and crash-looping via persistence). Root cause
symbolized from the field backtrace: every .slint 'changed x =>'
compiles to a ChangeTracker whose watched expression evaluates
SYNCHRONOUSLY at component instantiation, and conditional/repeated
components instantiate from ensure_updated INSIDE whatever property
evaluation triggered them — so a windowing band that reads layout
results (viewport-y, flick.height, self.width, absolute-position) can
re-enter a property mid-evaluation. Timing-sensitive: needs the model
filling in the same pass that instantiates the grid, which startup
view-restore hits deterministically.
Class-kill, uniform on every windowed surface (owner mandate — no
survivor exceptions): band state is now plain properties written ONLY
by an 80ms sampler Timer (event-loop context, nothing on the property
stack) in the shared AlbumGrid, the horizontal Carousel and the search
grid. No changed handlers, no init-time reads; the ±1-viewport margin
absorbs the sampling cadence; consumers' declarative wiring unchanged
(inputs are polled, never observed — contract documented in-file).
Startup crash-chain watchdog ('perro policía'): a counter file armed
before risky init and cleared by the same liveness signals as the
renderer sentinel. One pre-liveness death -> next boot resets exactly
ui_prefs last_nav/last_view (the field-verified surgical bypass) with
a recovery toast; two -> additionally bypasses the session-persist
queue restore for that boot, and the exit save keeps the preserved
snapshot instead of clobbering it with the empty queue. Recovers this
incident and the #558 loop automatically. One msgid x8.
cc
ArtistCard grew for the Recommendations subtitle line, and Search
cards fill that same slot ('N albums') plus the Follow chip — but the
two Search carousel instantiations kept the 220px default, clipping
the chip. Pass card-height 256px, the same value Recommendations
sizes the identical stack with. ArtistCard itself untouched.
cc
Two Home bugs, one dropped port. #566: four configurator sections
(favoriteAlbums 'Library Albums', qobuzMixes, releaseWatch, topArtists)
were offered and persisted but had no HomeView render arm and no data
in load_home — enabling them produced an invisible row. All four were
genuine Tauri-Home features (DiscoveryView.svelte arms :632/:653/:660/
:666, loaded unconditionally), so this is the full port, not a trim:
own HomeState fields (separate lifecycle from ForYouState), shared
foryou fetch pipelines (favorite_album_cards / fetch_release_watch /
top_artist_cards extracted pub(crate), For You behavior untouched),
Home-scoped artwork targets, and HomeView arms mirroring ForYouView.
load_home joins the three fetches concurrently with the index — zero
added latency. A HOME_RENDERABLE guard next to descriptors_for is now
the single source of truth: an enabled id without a render arm can
never emit an invisible descriptor again.
#567: 'Recently Played Albums' starved because albums derived from the
24-track history (long albums collapse to ~4 distinct). recently.rs
now keeps a separate album history (dedupe by id at record time, own
24 cap) with additive migration from the legacy bare-array format;
tracks keep their cap; load()/load_albums() signatures unchanged.
Zero new msgids (all three titles reuse For You's). qbz-app tests
10/10; slintcheck green.
cc
PR #569 follow-through with the owner-corrected scope: on macOS BOTH
titlebar modes work (native bar, or traffic lights integrated in the
QBZ header) — what's broken is hot-applying the toggle: the overlay
window attributes are fixed at creation, but the .slint chrome
(no-frame, header drag+inset, Purchases placement) flipped reactively,
hiding the buttons one way and overlapping them the other.
Split pref from applied state: the toggle edits use-system-title-bar
(persisted), the chrome reads a new system-title-bar-active seeded at
startup; the handler mirrors pref->active live on Linux only (behavior
byte-identical there), macOS keeps the session value + the existing
restart toast. The hide-title-bar row is macOS-hidden (that part of
the PR was right); the system-bar toggle stays.
cc
Follow-through on 6a0c3d5e (state-visible hearts): the card-level
album 'favorite' arm was still add-only — a filled heart re-added and
toasted 'Added to favorites'. It now toggles, mirroring the header
arm: fav_cache-keyed, optimistic set_album_row_favorite + rollback on
error, cache written on success only, reco logging on ADD only (the
Capa B search-interaction record is now gated to adds, like tracks).
AlbumCard's menu item goes state-conditional (Remove from Library +
filled heart), and the now-playing '+' flyout album entry becomes
state-honest through a new NowPlayingState.album-favorite (seeded per
track in refresh_now_playing_meta, flipped live by
set_album_row_favorite — which now also syncs the open album page's
header heart, closing the stale-header undo loop). Favorites' own
intercepted unfavorite (fade + row removal) is untouched, both view
modes. One msgid x8 locales.
cc
Restores the Tauri-era Qobuz Connect startup setting, now in
Settings > Playback per owner request. Reuses the shared
qconnect-app::startup module (QconnectStartupMode +
compute_effective_startup, unit-tested) and Tauri's exact
qconnect_settings.db keys (startup_mode / last_known_state), so an
upgrading user's choice survives. last_known_state is written at the
manual toggle's success points only — internal teardowns (D5 offline
force-disconnect, bootstrap failure cleanup) never clobber the
remembered state, mirroring Tauri's command layer. Startup auto-connect
runs post-enter_shell (online sessions only, once per process) through
the same connect() path as the toggle, on Tauri's bounded retry
schedule, bailing silently under offline mode instead of toasting per
retry. Select row mirrors the quality-retries row; 5 msgids x8 locales.
cc
Ports PR #561 by @pbaart into the live gettext system (the PR
translated the retired Svelte catalog): full nl.po (1481 msgids, 13
plurals, msgfmt-clean, zero untranslated), 262 strings taken directly
from the contribution via the legacy-English bridge and the rest
translated using the contributor's terminology as the style guide
(nummer/afspeellijst/wachtrij/bibliotheek, informal je). qbz-i18n
registration (2-form plural, resolve_auto nl_NL->nl, 21/21 tests) and
the language dropdown at index 8 (Nederlands) across ui_prefs,
reseed_i18n_labels and state.slint — same shape as the ru/ja commits.
Dutch translation credit: pbaart (PR #561).
cc
Owner-corrected UX: the compact view keeps exactly TWO buttons — the
screen must serve fast. Upload moves from the advanced row to the
always-visible footer (with its uploaded-URL row un-gated so the link
shows in compact view too); level/search/refresh/auto-tail, the
diagnostics-bundle copy, open-file and clear stay behind [+]. Reverts
the open-expanded default from fe43c698.
cc
The compact-by-default state hid the Upload and diagnostics-bundle
buttons behind the [+] toggle, defeating the point of the new Share
logs entry (users looking to share logs saw only Copy all). The [-]
still collapses. The upload already ships the full diagnostics report
+ the last 200 redacted lines — no content change needed.
cc
Field-hit on LL Albums grouped (alpha): deriving each section grid's
content-offset from an absolute-position DELTA binding panics with
'Recursion detected' (i-slint-core properties.rs:583). Evaluating the
target-row chain through absolute-position can land inside the parent
layout solver's own pass, and the grid's height/columns read back
self.width — re-entry. The Timer-seed guard only covered init-time
reads, not binding-evaluation context. Grouped windowing needs
Rust-computed per-section offsets (backlog); the flat grids — the big
win — keep their windowing unchanged.
cc
Hardens the renderer auto-detect so users never need the manual
options (the anti-videogame-settings goal).
Ladder (phase 1): a failed start now walks one rung down instead of
jumping to GL — wgpu (default adapter) -> wgpu (opposite
PowerPreference) -> GL -> software. The alt rung exists because the
#542 family is an ADAPTER mixup, not a wgpu failure; its survival is
version-stamped at disarm time (renderer_wgpu_alt) so later starts arm
it directly. GL-rung failures continue to software through the
non-auto branch (the persisted 'gl' carries the 'auto-gl' sentinel
value; a user-picked gl arms the literal 'gl' — unambiguous).
Auto-degradations are version-keyed (renderer_auto_degraded): a new
build re-probes auto once, the ladder re-degrades within a start if
the stack is still broken; manual picks clear both markers.
Sentinel disarm reworked: was a fixed 5s timer that lost the race
against late startup crashes (#558's swapchain error loops forever);
now first real input / close request / clean exit, with a 30s
no-touch fallback. The 5s timer keeps only its DPR-persist duty.
User-picked 'software' no longer arms (it cannot fail to start).
Watchdog (phase 2, #555 diagnosis aid): background thread probes the
event loop's cross-thread dispatch latency every 2s (30s startup
grace, clamped against suspend, 10 consecutive >250ms probes flag
once). Detection only — never switches tiers; surfaces as the 'UI
Loop Latency' Diagnostics row + bundle line so field reports carry a
number. The #555 lag is renderer-independent, so this measures the
layer where it actually lives.
One msgid x7 (the degradation toast is now rung-generic).
cc
One sentence under the subscription notice so the always-visible
'Start offline' link is self-explanatory: QBZ works as an offline
player without a Qobuz account, with no access to the Qobuz library.
One msgid x7 locales.
cc
The 'Start offline' link was gated on has-previous-session and the
shell backstop refused to open without a recorded user, so a user who
never logged in (e.g. a purchases-only Qobuz account, #553) could not
use the app at all. The link is now always visible and the offline
shell falls back to the GUEST profile — user 0, the Tauri-era fallback
this port used to refuse — building a real per-user store set (local
library, mixtapes, prefs) under users/0. AppRuntime::activate_offline
already resolved user 0 and never persists it as the last-user marker,
so the guest never masquerades as a real session.
First real login takes possession: AppRuntime::activate renames the
users/0 data+cache dirs to the account's id when that account has no
profile on this machine yet (existing profiles always win — the guest
dirs stay parked, no merge). Best-effort, login never breaks on a
failed rename.
cc
The log uploader was reachable only through Settings > Developer >
Open log viewer, so users filing issues never found it and reports
arrived without logs. A pinned entry at the bottom of the settings
sub-nav (visible from every section) now opens the same log viewer
(copy + upload). One new msgid x6 locales.
cc
The Tracks tab is server-paginated (200 rows/page), so the new 8-option
sort dropdown (Default / Artist / Title / Year / Date added, mirroring
the Albums toolbar control) rides the SQL query through a validated
ORDER BY allowlist in search_with_filter_page (same pattern as the
albums page query), re-queries page 1 on change (gen-bumped, stale
in-flight pages drop), and persists in locallibrary_prefs. Every sort
key ends in id so LIMIT/OFFSET pagination is deterministic across
ties. The once-only Plex page-1 merge re-sorts client-side with a
comparator matching the SQL semantics. Group modes keep their
client-side visual reorder on top, unchanged. Zero new msgids — all
labels already exist.
cc
Tauri regression: the Svelte playbackService caught TrackUnavailable play
errors and called autoSkipToNext (bounded at 5 consecutive skips, issue
Tauri#467); the Slint port only logged and cleared the spinner, so the
queue cursor parked on the dead track and playback stopped.
play_audible's error arm now detects TERMINAL unavailability (substring
contract over the flattened ApiError Display: TrackUnavailable /
NonStreamable / NoQualityAvailable — transient errors keep NOT skipping,
the client already retries those), toasts, honors stop-after-this-song
on the failed track, and advances through the real machinery
(advance_to_playable + after_track_change, async recursion boxed).
Superseded fetches (user already picked another track) never skip.
Counter resets when audio actually starts. One new msgid x6 locales.
cc
Ports the band + hysteresis scheme into SearchResultsView's bespoke
AlbumGrid (no window-changed — search artwork is dispatched per loaded
page onto the directly-rendered model) and wires the Albums tab
instance to the view's Flickable.
cc
Grouped section grids now receive the windowing inputs when the surface
is windowed; each section's content-offset is the absolute-position
delta to the collection root — scroll-invariant (both live in the same
Flickable content) and exact in plain Flickable/for chains. Section
grids do not forward window-changed: grouped artwork stays full
dispatch, so windowing there is mount-only.
The band seed moves from init to a one-shot Timer a tick after mount:
evaluating the target bindings from init would pull absolute-position
while layout is still evaluating (the documented recursion panic).
Until it fires, the default [0,0] band keeps at most one row mounted
for a frame.
cc
Flips windowed on the four AlbumCollectionView consumers with their
scroll wiring and documented content-offset approximations. Mount-only:
artwork stays per-page full dispatch (index-keyed, append-only models),
so covers are already on the model when a card mounts. Load-more
triggers untouched (grid height formula is windowing-invariant).
cc
Column band from viewport-x (visible plus one viewport of margin each
side) with the same contract hysteresis as AlbumGrid; off-band cards
are same-footprint placeholder tiles. Element-count only, always on —
section loaders dispatch artwork for the whole strip up front, so a
card mounting later picks its cover from the model instantly. Covers
every Home/ForYou/Discover/Search strip through one component.
cc
Mirrors the LL albums pattern 1:1: artwork migrates from index-keyed
FavoriteAlbum{index} to id-keyed FavoriteAlbumById{id,gen} (re-sort
immune), a FAV_ALBUMS_GEN token guards stale applies, the band from the
windowed grid routes through a thread-local BandDispatcher (180ms
leading+trailing), covers far outside the window evict back to the
placeholder, and list/grouped modes keep full dispatch. The load path
no longer dispatches every favorite cover up front — the first window
report pulls only what is near the viewport.
cc
Split the row band into pure target props and a stored mounted band.
Expansion still follows the target immediately (cards mount before
reaching the visible area); contraction lags by one row, so a few-px
oscillation across a row boundary no longer mounts/unmounts a whole
row of AlbumCards per direction change. window-changed now fires only
when the mounted band actually moves. Non-windowed consumers
(Discover/Favorites/Labels/grouped) are behavior-identical.
cc
Owner feedback on the first smoke: the editor stacked 11 full-width
token rows. The tokens now render as compact inline cells (swatch with
its label underneath) grouped side by side — SURFACES/TEXT/ACCENT on
one line, STATUS/OTHER on the next — and ONE shared ColorPicker
expands below the grid for whichever token is open, so editing doesn't
reflow the swatches. The picker's external-change reseed (init +
changed-value guard) already handles switching tokens while open.
cc
Wire the custom-theme editor end to end. In AppearanceSettings, when the
"Custom" theme is selected, show a "Start from current theme" button, a "Dark
theme" polarity toggle, and a grouped token grid (SURFACES / TEXT / ACCENT /
STATUS / OTHER) of 11 base tokens. Each token is a swatch that toggles an
inline ColorPicker; edits route through AppearanceState.custom-set-token
(drag) and custom-set-token-hex (hex commit).
The crate::custom_theme controller reads the base straight from the editor
swatch properties (the in-memory source of truth, no per-drag disk reads),
sets the touched field, re-derives via qbz_theme::theme_from_base, pushes the
palette live and persists. seed_from_current snapshots the live Theme global
into the base; toggle_dark flips polarity; set_token_hex parses in Rust (Slint
cannot). main.rs registers the four callbacks.
Also harden the ColorPicker reseed guard: skip decompose when the fed-back
value equals our own emitted color, so a drag ending at v=0/s=0 no longer
resets the hue. New strings added to all 7 gettext catalogs (es Mexican/
neutral); msgfmt --check clean; full .slint tree validated via the slintcheck
stub.
cc
Add crates/qbz-ui/ui/primitives/ColorPicker.slint: a self-contained inline
HSV picker (no PopupWindow, so no z-order/positioning fight). A saturation/
value square (pure-hue base + white->transparent + transparent->black
overlays, draggable crosshair), a 7-stop hue strip with a draggable marker,
a live preview swatch, and an editable #rrggbb HEX field.
The picker owns its hue/sat/val so dragging s or v to an edge never loses the
hue; it seeds from `value` on mount and on external changes, guarded by a
`dragging` flag so the round-tripped color the parent feeds back mid-drag does
not fight the crosshair. HSV->RGB uses Colors.hsv; RGB->HSV and int->hex are
self-contained pure functions (Slint has no local bindings, so intermediates
are derived helper properties). Hex parsing is delegated to the parent via
`hex-committed` (Slint cannot parse a hex string). Emits `changed(color)` live
on every drag frame. Validated with the slintcheck stub.
cc
Append a "Custom" entry to the theme dropdown, right after "Auto (dynamic)"
(theme::CUSTOM_SLUG/custom_index, mirroring the AUTO_SLUG pattern). New
crate::custom_theme persists the CustomThemeBase to
<data_dir>/qbz/custom_theme.json (load/save mirror ui_prefs) and derives it
via qbz_theme::theme_from_base.
Startup: when the persisted theme slug is "custom", seed the editor swatches
from custom_theme.json and apply the derived palette (load_or_seed seeds the
OLED default the first time). The dropdown "theme" arm gains a Custom branch
with the same live-apply path. AppearanceState grows theme-is-custom, the 11
custom-* swatch colors, custom-is-dark, custom-open-token and the
custom-set-token / custom-seed-from-current / custom-toggle-dark callbacks
(handlers wired in a later commit).
cc
The random-album / random-artist / random-playlist / random-label
buttons all exist (1:1 with 1.x) but rendered as bare shuffle icons —
1.x had title tooltips, so users couldn't tell them apart from a
tracks-shuffle and reported the feature as removed (#554). CircleAction
already supports the shared tooltip overlay; set it on all seven
Library header actions. 7 msgids translated in all 7 locales.
Fixes#554
cc
Repoint the existing auto-theme Settings scaffold from the "System" theme to
the new dynamic "Auto (dynamic)" option:
- state.slint: add theme-is-auto (distinct from theme-is-system, which stays
the native OS-palette follow).
- AppearanceSettings.slint: gate the Source dropdown, image picker, detected-DE
hint and Regenerate button on theme-is-auto, and drop the placeholder
`unsupported` flag now that the rows are functional.
- translations: add "Auto theme generation failed" to all 7 catalogs and give
the es "Wallpaper Sync" string a proper Mexican-neutral translation.
cc
The current-row equalizer animated via animation-tick() on the strong
(wgpu) tier — every step is a full-window repaint, so a playlist view
with the playing row on screen sat at ~4.5% CPU on a 165 Hz monitor
for a three-bar affordance. The bars now always use the shared ~8fps
coarse clock (already the accepted look on the GL/software tiers) and
the AppShell timer additionally runs while audio plays; when the
playing row is not on screen nothing reads the property, so the tick
dirties no binding and costs nothing.
cc
The nav tab already reads Library, but the surrounding communication
kept the old Qobuz term: the Home/Discovery section "Favorite Albums",
the Add/Remove-favorites menu entries on every card/row surface, the
playlist context-menu "Favorite" verb, and the Favorites view's
empty/error states. Align all of it with the Library terminology
(9 msgids renamed, translated in all 7 locales). Routes, ids and the
genre-filter context string are untouched — this is copy only.
cc
The player has recorded a user-readable message on stream-open failure
since the Tauri era, but the drain lived in Tauri's polling loop and
was never ported to the Slint poll loop — record_stream_error had ZERO
consumers, so ALSA Direct/exclusive failures showed as a bar frozen at
0:00 with no explanation (#508, #534, #500). Drain the message each
tick and toast it. When running inside Flatpak/Snap and the failure is
ALSA-shaped, explain that direct hw: access is blocked by the sandbox
and point at PipeWire/System Default instead of showing the raw error.
2 new msgids translated in all 7 locales.
cc
Review follow-ups to the chevron z-order fix: disable the arrow
TouchArea on leaf rows (an enabled TouchArea consumes the click even
with a no-op handler, leaving a 20px selection dead-zone) and include
arrow hover in the row highlight so it doesn't flicker off over the
chevron.
cc
The startup sentinel only guarded explicit Settings overrides: an
auto-detected wgpu start that crashed pre-paint re-detected wgpu on the
next launch — an unrecoverable crash loop (#542 hit exactly this). Arm
the sentinel when auto-detect picks wgpu; if it survives to the next
start, persist the GL (compatibility) renderer instead of re-detecting,
and explain with a toast. Linux-only by design (macOS has no GL tier).
Also add the .po entries for the existing revert toast, which was
missing from all catalogs, plus the new degrade toast (7 locales).
cc
2.0 dropped the v1.x "added" sort. Restore it with the same semantics:
a positional proxy over the playlist's natural insertion order (the API
returns tracks oldest-first; no added-at timestamp is deserialized),
starting newest-first on first selection, re-click toggles direction.
New msgid translated in all 7 locales.
Fixes#546
cc
The full-row selection TouchArea was declared after the row layout, so it
sat on top of the chevron's TouchArea and swallowed every click — sub-genres
could never be expanded. Declare the row TouchArea first (bottom of the
z-order) so the arrow's TouchArea wins inside the chevron region, matching
the stopPropagation isolation the Svelte version had.
Fixes#545
cc
vicrodh