* feat(images): move deleted image files to the macOS Trash (#499)
Trash mode on macOS now calls -[NSFileManager trashItemAtURL:resultingItemURL:error:]
through ctypes (no dependency), in utils/trash_macos.py. Before any move it refuses
what it cannot show to be recoverable, already in the review dialog: network
volumes, read-only volumes, iCloud Drive and File Provider folders (cloud-sync),
a trash folder inside an output root (by file identity), and files macOS would
refuse for permission (no-permission). A refused move keeps the file and logs the
NSError; a move macOS reports done but whose place cannot be shown goes under
errors as trash-unconfirmed, keeps its records and stops the job.
The native proof runs in portability.yml's new native-trash job on macos-latest
and macos-15-intel (PM_NATIVE_TRASH=macos). Windows still reports no-trash (#500).
* test(trash): resolve the temp folder and wait for a busy image to be released (#499)
The permission tests keyed their lstat fakes by the unresolved temp path, but the
backend resolves paths (/var -> /private/var on macOS, 8.3 short names on Windows),
so on those runners the fakes never matched (portability run 40954618922; reproduced
on Linux with a symlinked TMPDIR). The native test's detach first proves this
process holds nothing under the mount, then retries the plain detach until macOS
releases a volume it has just written a trash folder to (macos-15-intel), and
still fails after a forced detach.
* test(trash): count a volume that unmounted after a busy detach as detached (#499)
On macos-15-intel a detach that reported "Resource busy" finished afterwards, so
the retry found no such volume (portability run 40957282805). The loop now checks
os.path.ismount before each attempt.
Maintainer ruling (a): Windows never uses the Recycle Bin, because it deletes
files larger than the bin's capacity permanently and IFileOperation's
PreDeleteItem guard cannot detect it (native probe runs 40951037575,
40953347904). Each file in the Delete review now reads "Moving files to the
Recycle Bin isn't available on Windows: files larger than the bin's capacity
would be deleted permanently." (code windows-recycle) instead of "This drive has
no trash.", and the summary line drops its "yet": "Moving to the trash is not
available for these files; each one lists why."
* feat(trash): a freedesktop trash backend that renames without replacing or refuses (#480)
* feat(images): remove a file's records and hide it with a removal mark (#480)
Deletes every record of one file under every recorded spelling (image links,
tags, auto-tag marks, pending review items, category, collection memberships,
favorite) in one transaction. A Needs review item that is kept keeps its
annotation rows (ON DELETE RESTRICT). The image_removals table hides an exact
file (locator, size, mtime_ns) until it changes; linking skips a marked file,
and an explicit tag, category, favorite or collection write shows it again.
* feat(images): review and apply Delete images as a reviewed plan job (#480)
POST /prompt_manager/images/delete/preview reviews both modes; the
maintenance apply takes {token, mode}. Library mode removes the records and
writes the removal mark; trash mode moves the file first and removes its
records only after a successful move. The workspace listing, the output scan,
the duplicate find and Tag output images skip marked files.
* feat(images): Delete… in the Images selection bar, inspector and viewer (#480)
The concept's Remove links… place, D159: one review per selection that asks
each time (nothing preselected) whether to remove the files from the library
only or also move them to the trash. The browser test server uses a fake
trash.
* test(images): portable delete tests, the native no-trash proof, D159 in TESTING.md (#480)
* perf(images): cache the removal marks so a listing page reads no extra table (#480)
The marks reload only when this process writes or clears one, or a restore
replaces the database. The route snapshot gains the preview route.
* test(images): the full inspector specs expect D159's Delete… in the panel and the viewer (#480)
* fix(images): the delete review starts nothing without a chosen mode, and dims its primary until then (#480)
An aria-disabled primary ignores every activation, a chosen one starts once,
and the apply helper refuses a missing mode. Tests cover a forced click, a
double click, Enter and Space on the primary, Enter in the dialog and a
submit event, and the server refusing an apply without an exact mode.
Vito Sansevero