fix(ean): consensus floor on edge decode to reject phantom barcodes

The per-scanline width-ratio EAN/UPC decoder is intentionally permissive so it can
recover blurred/curved codes, so a stray scanline over plain text or artwork
occasionally satisfies a checksum by chance — most often as UPC-E (8 digits are cheap
to fake). scan() previously reported the top-voted value unconditionally, so a real
photo of packaging text hallucinated a UPC-E. Require the winning value to clear an
absolute consensus floor (3 scanlines) and out-poll the runner-up 2:1; genuine
barcodes are crossed by dozens of agreeing lines and pass easily.

Verified on the real capture: the curved EAN-13 still decodes (36 agreeing lines),
while four non-barcode regions of the same frame (text, hand, wall) now correctly
report nothing. Adds testdata/real_scene_text.png + a must-not-decode regression and
examples/eanvotedebug.rs (per-scanline vote tally) for tuning.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: MagicalTux

Cargo.toml

@@ -58,3 +58,7 @@ required-features = ["cli"]
 [[example]]
 name = "scan1ddebug"
 required-features = ["cli"]
+
+[[example]]
+name = "eanvotedebug"
+required-features = ["cli"]

examples/eanvotedebug.rs

@@ -0,0 +1,40 @@
+// Diagnostic: per-scanline EAN/UPC edge-decode vote tally (to tune the consensus floor).
+use anyd::codes::ean::decode_edges;
+use anyd::scan1d::{ScanOptions, scan_edges};
+
+fn main() {
+    let path = std::env::args().nth(1).expect("usage: eanvotedebug <png>");
+    let rgba = oxideav_png::decode_png_to_rgba(&std::fs::read(&path).unwrap()).unwrap();
+    let (w, h) = (rgba.width as usize, rgba.height as usize);
+    let luma: Vec<u8> = rgba
+        .data
+        .chunks_exact(4)
+        .map(|p| ((p[0] as u32 * 299 + p[1] as u32 * 587 + p[2] as u32 * 114) / 1000) as u8)
+        .collect();
+    let frame = anyd::GrayFrame::new(&luma, w, h).unwrap();
+
+    let opts = ScanOptions::default();
+    let lines = scan_edges(&frame, &opts);
+    let mut tally: Vec<(String, usize)> = Vec::new();
+    let mut decoded = 0usize;
+    for c in &lines {
+        if let Some(sym) = decode_edges(&c.edges) {
+            decoded += 1;
+            let key = format!("{:?}|{}", sym.symbology, sym.text().unwrap_or_default());
+            if let Some(e) = tally.iter_mut().find(|(k, _)| *k == key) {
+                e.1 += 1;
+            } else {
+                tally.push((key, 1));
+            }
+        }
+    }
+    tally.sort_by_key(|(_, n)| std::cmp::Reverse(*n));
+    println!(
+        "frame {w}x{h}: {} scanlines, {decoded} decoded, {} distinct values",
+        lines.len(),
+        tally.len()
+    );
+    for (k, n) in &tally {
+        println!("  {n:4}  {k}");
+    }
+}

src/codes/ean/edge.rs

@@ -223,11 +223,21 @@ where
     (0..=max_off).step_by(2).find_map(|o| f(&w[o..o + len]))
 }
 
+/// Minimum scanlines that must agree on a value before it is reported. A genuine
+/// barcode is crossed by dozens of clean scanlines; unstructured texture (printed text,
+/// artwork) yields only a stray line or two that happen to slip past a checksum — most
+/// dangerously as UPC-E, whose eight digits are cheap to satisfy by chance.
+const MIN_CONSENSUS_VOTES: usize = 3;
+/// The winning value must additionally out-poll the runner-up by this factor, so a
+/// scanline set split between two readings is treated as unresolved rather than guessed.
+const DOMINANCE: usize = 2;
+
 /// Robustly read an EAN/UPC symbol from a frame by decoding every fine scanline
-/// ([`scan_edges`]) and taking the value that the most scanlines agree on. Consensus
-/// across scanlines is what makes a curved, blurred capture — where each individual line
-/// corrupts different thin features — decode reliably, and it also suppresses the rare
-/// false positive a single noisy line might slip past the checksum.
+/// ([`scan_edges`]) and taking the value the most scanlines agree on — provided that
+/// value clears a consensus floor and clearly out-polls any competitor. Consensus across
+/// scanlines is what makes a curved, blurred capture — where each individual line
+/// corrupts different thin features — decode reliably; the floor and dominance test are
+/// what stop a lone checksum-passing misread on non-barcode texture from being reported.
 pub fn scan(frame: &GrayFrame<'_>, opts: &ScanOptions) -> Option<Symbol> {
     let mut tally: Vec<(String, usize, Symbol)> = Vec::new();
     for cand in scan_edges(frame, opts) {
@@ -243,8 +253,11 @@ pub fn scan(frame: &GrayFrame<'_>, opts: &ScanOptions) -> Option<Symbol> {
             tally.push((key, 1, sym));
         }
     }
-    tally
-        .into_iter()
-        .max_by_key(|(_, n, _)| *n)
-        .map(|(_, _, s)| s)
+    tally.sort_by_key(|(_, n, _)| core::cmp::Reverse(*n));
+    let top = tally.first().map(|(_, n, _)| *n).unwrap_or(0);
+    let runner_up = tally.get(1).map(|(_, n, _)| *n).unwrap_or(0);
+    if top < MIN_CONSENSUS_VOTES || top < DOMINANCE * runner_up {
+        return None;
+    }
+    tally.into_iter().next().map(|(_, _, s)| s)
 }

testdata/real_scene_text.png

@@ -422,3 +422,31 @@ fn real_scene_curved_ean_edge_decode() {
     );
     assert_eq!(sym.symbology, anyd::Symbology::Ean13);
 }
+
+/// A region of the same capture holding only printed text and artwork — no barcode.
+/// The edge decoder is deliberately permissive per scanline (it must recover blurred
+/// codes), so individual lines occasionally satisfy a checksum by chance, most often as
+/// UPC-E. The cross-scanline consensus floor in [`anyd::codes::ean::scan`] must reject
+/// those: a live camera pointed at packaging would otherwise flash phantom barcodes over
+/// plain text. This pins that guard against the real texture that first exposed it.
+#[cfg(feature = "cli")]
+#[test]
+fn real_scene_text_is_not_a_barcode() {
+    use anyd::GrayFrame;
+    use anyd::scan1d::ScanOptions;
+
+    let bytes = std::fs::read("testdata/real_scene_text.png").expect("read fixture");
+    let rgba = oxideav_png::decode_png_to_rgba(&bytes).expect("decode PNG");
+    let (w, h) = (rgba.width as usize, rgba.height as usize);
+    let luma: Vec<u8> = rgba
+        .data
+        .chunks_exact(4)
+        .map(|p| ((p[0] as u32 * 299 + p[1] as u32 * 587 + p[2] as u32 * 114) / 1000) as u8)
+        .collect();
+    let frame = GrayFrame::new(&luma, w, h).expect("valid frame");
+
+    assert!(
+        anyd::codes::ean::scan(&frame, &ScanOptions::default()).is_none(),
+        "consensus floor must reject stray checksum-passing misreads on plain text"
+    );
+}