[K-Arthur]

Lane

• App

What and why

A school-lab ai.enabled: off policy painted the Settings switch Off while leftover settings.ai.enabled: true still let the browser ONNX path download and run. Native IPC already refused; the webview gate did not. Quick background removal also treated leftover RGB in transparent PNG pixels as a subject, and k-means could drop an inset cutout when that leftover had similar luminance.

This PR overlays the admin policy on the engine master switch, uses source alpha as the cutout mask when transparency is substantial (including partial alpha on soft edges), and makes inspector AI handlers refuse the user switch (not only the panel hide). Enhance dialog user-facing copy no longer uses em dashes.

Follow-up on the independent review of ea05833, the re-review of 76db63fcc, and the re-review of a3c4d67ce:

1. k-means edge-touching cutouts. When transparency is substantial, k-means and auto use source alpha as the mask. An edge-touching subject is kept. PASS.
2. Soft edges. Fully transparent pixels (a = 0) are background; partial alpha stays. PASS.
3. Policy fail-closed. Unreadable/unparseable policy is AI off + notice. Startup hold-off before models. Auxiliary webviews included. PASS. SettingsContext no longer makes a second policy IPC call.
4. Enhance goldens. Fixture waits for .editor-tabs__dirty-dot. PASS.
5. Copy. Full preview sentence. PASS.
6. Color vectorize small hues, without stealing the picture. Outliers need at least 0.25% of samples (minimum 4 pixels). When a slot is needed, the less common colour of the closest pair is replaced and its count is merged into the survivor. Before that choice, entries are recounted by nearest-pixel assignment; a remaining count tie keeps the higher-chroma colour. That stops median-cut equal splits from replacing the logo red with a blended pink bucket at 3 colours. Photo-like and logo tests at 3 and 4 colours, plus a dedicated red-ties-pink logo case at k=3, assert the dominant colours survive; the small blue triangle still does.
7. Rounded-corner screenshots. hasMeaningfulTransparency no longer trips on any a < 255 pixel. Alpha is the mask only when a real share of pixels is a = 0 (8%) or much of the border is (40%). A 40x40 with 16 transparent corners still segments (256 subject pixels), matching master.

Not applied: at 3 colours in the reds-blue-green sample, a 64 px blue still takes the slot that kept the red and dark-red quadrants (8192 px each) apart. A "do not evict a far-larger, distinct pair" rule would also refuse the logo's blue triangle: red vs the blended pink is itself above the 0.018 Oklab hue threshold (dist² about 0.033). Recount + chroma already keeps the logo red; collapsing two large distinct reds to keep a small blue remains the hue-preservation trade-off at k=3.

Related: #190, #197

Inventory (entry points, models, gating)

Feature	Entry points	Models / path	Gate
Image trace / vectorize	Vectorize dialog, selection bar, insertTraceGroup	Native varve-trace first; TS rasterTrace fallback. Not ONNX.	Not AI-gated (WASM path must work with AI off).
Quick background removal	Inspector, export, batch	Heuristic (flood / chroma / k-means / border / edge)	Always available.
AI background removal	Inspector, export, batch	Bundled u2netp; optional u2net / isnet / …	assertAiFeaturesEnabled + policy overlay. AI-off falls back to Quick.
Generative fill / inpaint	Fill / inpaint dialog	Local LaMa-class ONNX	Same master switch + worker snapshot.
Enhance / upscale	Enhance dialog, command palette	CPU always; AI 4x only when on	Pixel-art and CPU admitted with AI off.
Line art, OCR, denoise, colorize, font detect, text detect, DETR crop, frame interpolation, lens-blur depth, semantic search	Inspector / Settings	Per-feature ONNX	Panel hide plus handler aiEnabled / formatAiUserError.

No new models, no cloud/network calls, no bundle growth. LICENSE, stable.json, and release-manifest.json are untouched.

Feature results

Feature	What I tested	Before	After
Admin AI policy	leftover on + policy off; unreadable file; IPC throw; Tauri hold-off	Webview ONNX could still run. Unreadable policy failed open.	Overlay matches native IPC. Fail-closed + startup hold-off. Auxiliary windows included.
Quick bg-remove	leftover RGB; edge-touching 20x10; partial-alpha 64; 40x40 with 16 corner a=0	Edge-touching cutout was wrong at ea05833. 40x40 corners kept 1584 at 76db63f (alpha shortcut).	Substantial transparency uses alpha (edge-touch + soft edges). Sparse corners still segment (256).
Color vectorize	red+blue triangle at 3/4/6/8; photo-like teal field at 3/4; red logo with hole+blue at 3/4; logo red tied with blended pink at k=3	Master dropped the blue triangle. 76db63f stole logo red for 1-px noise. a3c4d67 kept dominant counts but the logo circle went pink when red tied pink.	Blue triangle kept. Dominant photo teal and logo red survive, including the equal-count pink-blend case.
Inspector AI / Enhance	existing units + visual 7/7 + settings 30/30	Em dashes; fragment hint	Colons/periods; full preview sentence.

Enhance goldens

Preview crop pixels unchanged. Import dirties the tab; the fixture waits for .editor-tabs__dirty-dot. Other diffs vs master are the caption colon, inspector subpixel fields, and the dark scrollbar.

Product decisions

• AI stays on by default; missing settings key is on; unreadable settings fail closed.
• Vectorize stays available with AI off.
• Admin policy on still overrides a user's own off.

Check command

pnpm verify:plan then targeted Tiers 0-2 for the touched packages. Website tokens.test.ts empty-style / semantic-token failures are master (#215).

After 5666d662f:

• packages/engine/src/rasterTrace.test.ts: 24 passed
• @varve/engine: 5628 passed, 19 skipped
• cargo test -p varve-trace: 78 passed; clippy -D warnings clean
• Push checkpoint passed (format, lint, engine typecheck, rust-test/clippy varve-trace)

Checklist

• My commits are signed off (git commit -s)
• I could not fix a CI failure (explain above): website token-test on master is fix(website): retokenize realtime collaboration page #215, not this change