iris/effectcraft
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore: sync upstream (116 Commits) #18

Merged
alf merged 116 commits from chore/sync-upstream-20261104 into main 2026-11-04 08:26:40 +00:00
Conversation 0 Commits 116 Files changed 161 +12801 -869
alf commented 2026-11-04 08:26:39 +00:00
Owner
Copy link

Upstream-Sync von upstream/main (116 Commits). Fast-Forward.

  • 58ca9c1c OCIO: refuse a .csp LUT whose header claims an oversized table before reserving it (#2938)
  • 6572514e GPU: size the memory cap from the card's video memory on Linux (fixes #1487) (#1706)
  • 025c038a GPU: build effect kernels on first use, each family from a module of its own (fixes #1590) (#1705)
  • ff686265 #1605: Posterize and CC Grid Wipe match the CPU on AMD and Intel (#1836)
  • 8d20cf0c GPU.1: Preserve CPU parity in numerical effect kernels (#1490)
  • c4f386a2 Preview: debounce GPU memory pressure and recover the frame budget (#3025)
  • 389894e6 gpu: run Content-Aware Fill's PatchMatch and flow on the GPU (#1856)
  • 6df7eabe gpu: memory back-pressure for frames in flight (fixes OOM at 3–4 frames in flight) (#1550)
  • 08362b9c GPU: free effect working textures after each call instead of at frame end (#1523)
  • 2f31c22a fix(prefs): when recovering from a bad value, try only the settings' own pages one by one (#3010)
  • 5464a238 Mask feather: bound the variable feather's distance pass (#2947)
  • b7dee07c Path booleans: sparse winding numbers and bounded merge runs (#2946)
  • d16c720e Follow-up to #2981: a missing Chinese effect row draws English instead of failing the build, the font probe sees effect and category characters, coverage totals recounted
  • 3ae9c8db Merge PR #2981
  • b77db389 #2037: complete the Traditional Chinese effect-name catalog
Upstream-Sync von `upstream/main` (116 Commits). Fast-Forward. - 58ca9c1c OCIO: refuse a .csp LUT whose header claims an oversized table before reserving it (#2938) - 6572514e GPU: size the memory cap from the card's video memory on Linux (fixes #1487) (#1706) - 025c038a GPU: build effect kernels on first use, each family from a module of its own (fixes #1590) (#1705) - ff686265 #1605: Posterize and CC Grid Wipe match the CPU on AMD and Intel (#1836) - 8d20cf0c GPU.1: Preserve CPU parity in numerical effect kernels (#1490) - c4f386a2 Preview: debounce GPU memory pressure and recover the frame budget (#3025) - 389894e6 gpu: run Content-Aware Fill's PatchMatch and flow on the GPU (#1856) - 6df7eabe gpu: memory back-pressure for frames in flight (fixes OOM at 3–4 frames in flight) (#1550) - 08362b9c GPU: free effect working textures after each call instead of at frame end (#1523) - 2f31c22a fix(prefs): when recovering from a bad value, try only the settings' own pages one by one (#3010) - 5464a238 Mask feather: bound the variable feather's distance pass (#2947) - b7dee07c Path booleans: sparse winding numbers and bounded merge runs (#2946) - d16c720e Follow-up to #2981: a missing Chinese effect row draws English instead of failing the build, the font probe sees effect and category characters, coverage totals recounted - 3ae9c8db Merge PR #2981 - b77db389 #2037: complete the Traditional Chinese effect-name catalog
alf added 116 commits 2026-11-04 08:26:39 +00:00 
Preserve EffectCraft Wayland CSD, updated Linux package notices and the latest upstream implementation.
image's OpenEXR encoder writes 64x64 RLE tiles, which FilmCraft and other
scan-line readers refuse. Write the frames with the exr crate in scan lines
with ZIP, like comp.saveFrameAsExr.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The FreeBSD run of run_reads_commands_from_a_file_or_stdin hit a race: the CLI
exits with code 2 on the usage-error cases before the helper finishes writing
its standard input, so write_all fails with BrokenPipe and the unwrap panicked
at apps/effectcraft-cli/tests/it/cli.rs:139:61.

Ignore exactly BrokenPipe while writing the piped standard input and assert on
any other error kind, so an early exit keeps feeding the assertions below
instead of failing the harness.

Fixes #2794

Co-authored-by: rahul05ranjan <11793455+rahul05ranjan@users.noreply.github.com>
camera.solveStatus said `solved: true` for any stored solve, but the solver
keeps the frames it cannot resect as unsolved and interpolates the camera
there. `solved` now needs every frame, the same check camera.exportBlender
makes, and `partial` marks a solve with gaps, next to `solvedFrames`.
A tile boundary that lands exactly on an output pixel centre puts the tile
fraction at exactly 0 or 1, and the sample position at the source's geometric
edge — where sample_bilinear mixes in half a texel of the transparent outside.
The fold column comes out half-faded: a visible seam line along the mirrored
boundary, which sweeps the tile as Tile Center animates across pixel centres
(#2820). Both the CPU path and the GPU kernel switch to the clamped sampler,
which repeats the edge texel there; interior samples are untouched, and the
default single-tile identity mapping already sampled texel centres.

The regression test puts the folds exactly on pixel centres (tileWidth 50%,
centre on the layer, mirror on) and asserts the fold columns stay opaque and
equal the edge texels they mirror — it fails on the unfixed code at alpha 0.5.

Fixes #2820

Co-authored-by: rahul05ranjan <11793455+rahul05ranjan@users.noreply.github.com>
The frozen key hashes the chain keys, whose seed holds the session's
model, so mattes frozen with SAM 2.1 didn't match in a session on
Classic, such as a fresh effectcraft-cli render, and the frame was
segmented again with Classic. Accept the key under any Roto Brush model
too, as Object Matte has done since #1852. frozen_key is unchanged for
projects frozen today, and editing a stroke or a matte setting still
makes the frozen mattes stale.
With frozen mattes now used in a session without the model that froze
them, a second Freeze in such a session still segmented every frame
again, so it replaced the model's matte with the session engine's.
frame_matte, which only Freeze calls, now returns a frame's frozen matte
while the frozen mattes apply, and segments only frames that have none.
FilmCraft's EDL reader keeps source timecodes as media time and leaves the
rebase to the caller after probing. The probe now keeps the file's start
timecode (Footage::file_timecode), and an EDL import rebases each found
file's clips with filmcraft_interchange::rebase_source_timecode before the
layers are made, as FilmCraft's own import does.
Bodymovin 3.x and early 4.x write `cl` on a mask and `closed` on an `sh`
item, with no `c` in the path, so the import brought these masks and
paths in open. An open mask doesn't cut its layer, and masked solids
filled the frame. The path's own `c` still wins.

Fixes #2837.
Animator Opacity stacked by multiplying, so once one animator set 0 %
no animator below it could raise it again. Each animator now blends the
opacity left by the ones above it toward its own value. A single Opacity
animator gives the same result as before.

Fixes #2838.
The import now does the rebase FilmCraft's reader asks for, so passing the
reader's note on told people to do something already done. It is dropped
when every file the list uses at an hour or more of timecode was rebased,
and replaced by a warning naming the ones that weren't (the file is missing
or has no start timecode).
frame_matte looked up the frozen mattes for every frame, and that hashes
the whole serialized cache and recomputes its keys, so freezing a long
span again grew with frames times cache size. The Freeze job now
resolves the applicable cache once (applying_frozen) and passes it to
frame_matte.
A Lottie file can carry glyph outlines in `chars` for players that lack
the fonts. The import drops them and sets the text in installed fonts,
which can draw it in a fallback font. It now says so in the warnings,
naming the font families the glyphs were for.

Fixes #2844.
profile_of matched BT.2020 primaries before looking at the transfer, so
HDR10 and HLG footage got the Rec. 2020 profile and a managed project
decoded it with the 2.4 gamma. A PQ render of a solid that is 191,64,128
re-imported as 130,73,101, and HLG as 156,36,97.

Map BT.2020 + PQ to Rec. 2100 PQ and BT.2020 + HLG to Rec. 2100 HLG, the
profiles Interpret Footage already offers. A PQ and an HLG ProRes render
now read back into an sRGB project as the solid they came from.
A run reads the project, edits it and writes the whole file back, so two
at once silently dropped the edits of whichever saved first. A run that
saves over the file it opened (--save, or --save-as the same file) now
holds an OS lock on `.<name>.lock` next to the project from before its
read until it exits. The next run says so on stderr, waits, then edits
what the first one saved. Ported from filmcraft-cli
(storytold/filmcraft#3926).

The OS drops the lock however the process ends, so a crash leaves nothing
stale. If the lock can't be taken the run warns and saves as it did
before. A missing project stops the run before it opens anything, with
the same error opening gives, so a project created in between is never
saved without the lock. The desktop app and `mcp` don't take this lock.
A `chars` entry with an empty or whitespace-only `fFamily` listed an
empty name, so the warning read "of Sans, , Serif".
Which clips use an hour or more of timecode was decided in seconds, so in a
29.97 fps drop-frame list a clip cut at 01:00:00;00 (3599.996 s) was left
out, and a missing file it used went unnamed. The hour is now 01:00:00:00 at
the sequence's rate and drop-frame setting.
Timewarp's Adjust Time By = Speed showed source time t x speed(t) / 100,
using only the Speed value at the current frame. With Speed keyframed
(a speed ramp), the source jumped to another part of the footage at the
change, and while Speed eased down it ran backwards or held still.

An animated Speed (keyframes or an expression) is now integrated over
layer time from 0 through the effect host's param_at, on a fixed
sub-frame grid with a bounded sample count. A static Speed keeps the
exact previous formula, so the Timewarp goldens are unchanged.

Local: effectcraft-effects time_fx lib tests (8), timewarp golden,
clippy -p effectcraft-effects. Full cargo xtask ci deferred to GitHub CI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Follow-up to #2823: box each of several objects around its whole matte on correction frames

With several objects, a correction frame's box came from the model's cut
of that object's strokes on the frame alone. A stroke on part of the
object boxed only that part, and SAM 2 followed only that part from
there on. Each object's matte is now carried to the frame with its own
strokes, from its first prompted frame or its nearest tracked frame, by
the walk Chain::ensure uses (now Chain::carry). These mattes are not
cached, since object keys hold tracked results.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Follow-up to #2823: carry corrections before the base from the base outwards

Prompt frames were visited in ascending order, but before the base the
carry walks towards it, so each correction there re-walked from the
root. Visit each side from the base outwards and sort the prompts back
into frame order for the tracker.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Follow-up to #2823: find an object's carry root in one pass over its strokes

The root search scanned every frame's strokes from the prompt frame to
the base, for every prompt. Take the object's foreground stroke on the
way that is nearest the base in one pass instead; the root is the same.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M13.35: reproduce an earlier object correction losing tracked matte

* M13.35: carry earlier object corrections from valid tracked mattes

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: FredApps <FredApps@users.noreply.github.com>
Every MP4 export said BT.709 whatever the Output color space, in the
colr box and in the bitstream, so Rec. 2020, P3, PQ and HLG renders
were labelled as BT.709.

Move the ProRes colr mapping to output_codes and use it for every movie
path: the nclx colr box, FilmCraft's H.264 ColorConfig (VUI), and new
colour fields in effectcraft-hevcenc (VUI) and effectcraft-av1enc
(color_config), which wrote 1-1-1 as constants. The matrix stays BT.709,
the coefficients every path converts with. Default renders don't change.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The dialog was a fixed 600 points wide inside a scroll area, so a row
wider than that in another language (French "Conserver la fréquence
d'images en cas d'imbrication ou dans la file d'attente de rendu", the
French and Spanish Lock Aspect Ratio row) pushed OK past the right edge,
reachable only by scrolling sideways.

The dialog now measures the widest row of its three tabs (as it already
measured their heights) and takes that width, or 600 points if that is
more, capped by the window as before. English keeps 600 points.
Restore GNOME Wayland window controls without bundled fonts
SAM 2's instance now reads wgpu's environment variables, as the render context's does, so a driver such as
Mesa's Dozen (WGPU_ALLOW_UNDERLYING_NONCOMPLIANT_ADAPTER=1) is visible to it, and WGPU_POWER_PREF applies.
An adapter without compute shaders is refused before a device is made on it, so the CPU takes over with one
line instead of a validation error per kernel. The refused adapter is kept for the life of the process, as
the device on it was: dropping it crashed the tests on WSL2's GL driver. Gpu::shared no longer repeats
"SAM 2 compute:" in its errors.
Comp::unique_layer_name and Project::numbered_item_name each stripped
every trailing digit before numbering. Both use one helper now,
numbered_name, which replaces a trailing number only when a space sets
it off (Red Solid 1 -> Red Solid 2); digits that end a word stay.
layer.addTextAnimatorProperty, layer.addTextSelector and
text.animatorFontAxes take `animator: uid|index`, counted from 1 as the
code and `#n` references do, but the parameters didn't say so and
`animator: 0` failed with only "no animator 0". The parameters now say
1-based, and the error says what the value can be.
- `dialog.comp.view` is the scroll area's viewport (its clip rect). Cut
  by the content's max rect, it lost the scrolled amount at the bottom.
- When the dialog's width changes, the pass laid out at the old width is
  discarded and a repaint requested.
- The measured width keeps room for a vertical scroll bar. Without it,
  switching the language with the dialog open left the two scroll bars
  trading places every frame: the UI never settled and OK was clipped
  every other frame.
- `content_width` becomes `dialog_width`, which returns the dialog's
  width, so the 600-point rule is in one place.

Tests: the view keeps its place when the dialog scrolls, and switching
to French and back with the dialog open settles with OK inside it.
animator_uid matches a uid before an index, so an animator whose uid
equals an index is picked over the one at that position. The four
commands that take `animator` (layer.addTextAnimatorProperty,
layer.addTextSelector, text.addSelector, text.animatorFontAxes) now say
so; text.addSelector also said only `uid|index` before. The test gives a
second animator uid 1 and checks that `animator: 1` picks it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The drag branch asked what was under the pointer when the drag was recognised, by which
time a quick drag has already reached the art, so no gesture started at all.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A box's own pixels had to be opaque, but the high-pass that measures its
grain reads 3 px around it, and a transparent pixel there is black once
unpremultiplied. A blur earlier in the stack pads the layer with
transparent pixels, so boxes along that border measured the edge as
strong, smooth colour grain, and Match Grain drew 12 px colour cells
from a clean source on the frames that picked them. Boxes now need their
3 px surround opaque too (a summed-area table keeps the check O(1) per
candidate). Remove Grain picks its boxes the same way.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Cut the fix down: a click off every mesh makes nothing only when the art it resolves to
already has a mesh with that outline. The nearest-art fallback in `region` stays, so a
near miss beside separate art still meshes it. `mesh::outline` is as it was and the
`newMesh` option of puppet.addPin is back.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A 3D model layer keeps its file's materials, so it has no Base Color,
Metallic, Roughness or Emissive. material.set refused them with "no
Material Options property matched (..., baseColor, metallic, roughness,
...)", naming the parameters it had just refused, and next to a
parameter the layer has it dropped them and reported success.

A parameter that none of the given layers has now fails the command
(nothing is set), naming it and the properties the first layer has. A
value of the wrong type is its own error. The parameter list says which
layer kinds take which.
A source with no box-sized area clear of transparent pixels (a small
layer inside a blur's padding) got no sample boxes, and
grain_stats_boxes then measured the whole image, edge included. With no
clean box Match Grain now matches no grain, as After Effects applies
none when its samples hold transparent areas. Compensate for Existing
Noise took the same route through the layer's own boxes, so a layer
with no clean box now has nothing taken off. grain_stats_boxes keeps
its empty-list fallback.
The bitstream check read ffprobe's first-frame tags from the MP4, which
ffmpeg can fill from the colr box when a stream says nothing itself. Copy
the video out as a bare h264, hevc or obu stream first, so only the SPS VUI
or AV1 color_config counts.
The text listing printed enum values as bare numbers, which are 0-based
where After Effects scripting counts from 1, so Range Selector Shape 2
read as Ramp Up was Ramp Down. Print the label from the property's
options, as props --json already lists them: "0 (Square)".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
One comp-space path: the pivot is the anchor where it shows and a flipped
parent reverses the turn, so the separate parent-space frame and the moved
parent_to_comp go. Under uneven or skewed parents the layer's edge tracks the
pointer slightly less exactly. The empty-layer marker goes back to main's.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Session::crypto_coverage returns the coverage of one Cryptomatte ID over the layer, read from
the probe Session::crypto_probe_job keeps: at most max_side samples on the long side, each at
the centre of its cell, or None until the probe is built. It is what the Cryptomatte
eyedropper's hover highlight will draw.

Tests cover the coverage of an ID from the kept probe and the cost of a highlight with six
ranks.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
panels::crypto_pick is the eyedropper's viewer side; it is wired in by the next commit. Armed,
the hover names the ID under the cursor and highlights its coverage, a click replaces the
Selection with it, Shift adds, Alt or Ctrl (Option or Cmd on a Mac) removes. Each pick is one
undo step, "Pick Cryptomatte".

The probe the hover needs is built off the UI thread, one at a time for the app
(EffectcraftApp::crypto_probe_busy, re-arming included), not while playing and not until a
scrub has settled for 100 ms; meanwhile the chip says so. Session::crypto_probe_ready asks for
readiness without changing anything; a job is asked for only when it starts.

Clicks made meanwhile are queued, own the build and are made in order at the end of the pass,
after its keys and edits. A click is the frame, point, resolution and project revision its
press saw. If any of them changed before it is made (an edit, Ctrl+Z, a nudge, a frame step),
it and every click waiting with it are dropped and the status says "Pick not made". A pick's
own change of the revision doesn't count as an edit for a click still held. Losing the window
focus drops a held press. A click that takes the focus from the Selection field waits for the
field to commit and is made on top of it.

The overlay takes drags too: a click that drifts picks at its press, and one dragged further
than 24 points picks nothing ("Drag cancelled the pick"). Presses and releases are read from
the pass's events in order rather than from egui's end-of-pass click state, since a slow pass
can hold a whole click. Space, the Hand and the Zoom tool keep their clicks, the middle button
pans, and a right-click is passed on under viewer::FORWARDED_SECONDARY for the viewer to open
its context menu (the viewer side is in the next commit). Errors show in the chip in red,
without the command's prefix, wrapped to the viewer's width.

The hovered ID's coverage (Session::crypto_coverage) is drawn as a texture through the layer's
effect-space transform, rebuilt only when the hovered ID, frame or revision changes, and
exposed to the test harness as viewer.cryptoPick.highlight.

Supporting changes:
- EffectcraftApp::say sets the status line and restarts its 5 s; each status message now gets
  its own 5 s, also when the same text is shown again.
- Points snap to the centre of the shown frame's pixel at the exact 1/n scale the viewer
  renders (frames::render_scale; the frame key keeps 0.333 for Third, which named the next
  row's ID). Cache Frames When Idle renders at that exact scale too, so idle-cached frames are
  on the grid the pick reads.
An eyedropper next to the Cryptomatte effect's Selection arms the viewer pick, and the status
line says how to use it. It stays armed until Esc or the button (Esc in a text field or a menu
only ends that); disarming, New, Open and Revert end it and let go of the session's probe.

The app runs the pick's bookkeeping at the start and end of each pass, the viewer hands the
pointer to the pick while it is armed and opens its context menu for a right-click the pick
forwarded, and a Selection cut off by a narrow Effect Controls panel shows whole on hover.

UI tests: ui_crypto_pick (arming, hover, clicks, modifiers, drags, waiting clicks, status,
highlight) and ui_crypto_pick_undo (one undo step per pick, the probe kept over undo).
effects-parity.md and gaps.md: the Selection is picked in the viewer. control-protocol.md: the
viewer.cryptoPick element ids. footage.md: a paragraph on the eyedropper.
A solve with unsolved frames drew the same block as a full one, so it
looked complete. It now gets one more line in the warning colour,
"Partial solve: N of M frames solved", under the status line, and the
editor grows by that line only then. The line is an automation element,
so agents can read it too.
The Esc that closed New Solid or Composition Settings also disarmed the
eyedropper. An open dialog now takes Esc like a focused text field or an
open popup, so that Esc only closes the dialog and the next one disarms.
long_sequence asserts both instead of logging a finding.
clicks_queued_while_reading_are_one_step_each_and_undo_in_order relied on
a blurred 4K plate being slow to read, and failed when the IDs were read
while the clicks were still being pressed. The probe's ID read is now held
(the Held footage from ui_crypto_pick) until the clicks are checked, and
the test asserts that the build reached that read and that nothing was
made while it was held.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The "while reading" sections of the waiting-click, in-order and undo/redo
tests now hold the build with the Held wrapper until their asserts are
done, instead of relying on a 4K plate being slow to read.

The undo tests use the shared helpers from ui_crypto_pick.rs, so they now
go through crypto_exr with k = 1 rather than a copy without it.
The panel catalog said 作業領域 for Work Area while the four menu rows say ワークエリア. The installed After Effects 2026 settles it: Edit > Preferences > Previews reads キャッシュ範囲: ワークエリアと現在の時間.

The row draws the Content-Aware Fill panel range menu and the Time Span form, so a reader met both words for
one thing depending on where they looked. One row, no other change.

Co-Authored-By: DeepSeek V4.1 Flash <noreply@deepseek.com>
Unselected layers parented to, or track-matted by, a layer that moved into the
new composition kept ids that no longer exist in the outer comp. The command's
default name was always "Pre-comp 1"; it now picks the lowest unused number.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RDvxCS8xcR28VArjzn1x7U
# Conflicts:
#	apps/effectcraft-cli/tests/it/cli.rs
# Conflicts:
#	crates/lottie/src/tests.rs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add 308 Traditional Chinese effect names and 21 category labels, written from the English source with Taiwan creative-software terms. Update the completeness tests to require the zh-hant table and recount the localization docs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Winding numbers were dense vectors up to each segment's path index, and the
topology keeps one per segment, so memory grew with the square of the path
count. They now store only the nonzero (path, winding) pairs.

tidy_segments re-checked the whole run on every merge attempt, so a long
chain of collinear pieces cost quadratic time. A run now merges at most 64
pieces; longer runs leave a few extra joints on the same line or curve.
* Mask feather: bound the variable feather's distance pass

Every flattened segment scanned its box grown by the largest feather radius,
so a path with many vertices and a radius spanning the mask revisited every
pixel once per segment. The pixel visits are now counted first; past a
budget of 2^31 the flattened polyline is thinned (every other point, arc
lengths kept) until it fits, and only a degenerate case falls back to the
hard mask.

* clippy manual_is_multiple_of
* GPU: free effect working textures after each call instead of at frame end

A GPU frame keeps its encoder open while the CPU renderer runs layers with GPU
effects (Gpu::effects -> run_chain). Each call's Enc handed its textures back
to the shared pool, where they waited for every open encoder, so all effect
intermediates of a frame stayed allocated until the frame ended (17.7 GB by
layer 17 of a heavy 4K comp, then OOM). Effect calls now borrow a pool owner
(Enc::lent) that is given back once the call's work is submitted or
discarded; its kept textures are trimmed to the pool budget, so the rest are
freed after each call.

* GPU: one pool budget for idle effect calls, trimmed at the end of a render

Review of #1523: each idle lent owner kept up to POOL_BUDGET of textures of
its own, outside the shared accounting, and there were as many idle owners as
effect calls ever ran at once (16 frame threads: ~12 GB after a 4K render).

Giving a lent owner back now moves its kept textures to the shared free list,
so one POOL_BUDGET bounds what the free list and every finished effect call
keep. They skip Pool::release's wait for open encoders: only the lent Enc
recorded work on them, and that work is submitted or discarded. Each lend is
a fresh owner id, so a lease that outlives its call (an image handed to
another encoder) is released through Pool::release; this does not rely on
the result being read back.

Accelerator::render_end (called when an export ends) drops the kept textures.

* GPU: evict the pool's oldest free textures, guard escaped leases

Review of #1523 (follow-up to 0a884fb6):

- Pool::make_free rejected a texture when the free list was full and never
  evicted, so once sizes that no longer occur (per-frame blur bounds, padded
  layer sizes) filled the budget, every later free was a drop and every take
  an allocation. It now evicts the least recently freed textures until the
  new one fits.
- A lease read by another Enc (dispatch, copy, readback, display) or handed
  to a cache is marked escaped and always released through the guarded
  Pool::release, so a lent call can no longer reuse a texture that a still
  open encoder reads.
- Docs: POOL_BUDGET caps the free list only; textures waiting for open
  encoders and those of live Encs are outside it.
- export_async calls render_end from a drop guard, so the pool is also
  trimmed when an export panics or its future is dropped.
- Tests use a private context with its own pool budget instead of a global
  override; new tests for stale sizes and an image read by an open encoder.

* GPU: evict only stale pool sizes, count evicted textures until the GPU frees them

Evicting the least recently freed texture for every newcomer thrashed when a frame
frees more than the budget in a repeating order (blur/glow intermediates): each free
evicted the size the next call takes first, so misses came back to the old level and
evict + reallocate raised the peak.

The free list now evicts only sizes nobody asked for in the last 2 output frames
(Accelerator::frame_end, called by the export per frame); otherwise the incoming
texture is dropped and the kept set keeps hitting. Evicted bytes count against the
budget until the work submitted so far is done, so evictions run at most one budget
ahead of the GPU.

* GPU: lower the shared pool budget to 256 MB

On 4K RTX 3090 runs 256 MB matches the old code's peak reserved on d_blurglow
(9204 MB) and is 256-512 MB above it on c_effects (6592 vs 6080 MB), while
staying faster.

* GPU: end frames on the multi-frame render paths, route recording through Enc::record

Only the export pipeline called frame_end, so off export (preview, remote
frames) the pool's clock stood still, no size went stale and a full free
list dropped every newcomer. passes::comp_frame (exports), remote frames
and the preview workers now end each frame; test without pool_frame_end.

Docs: the frame clock is coarse with many frames in flight; dying only
throttles eviction, approximately; no cache path escapes images. Enc::record
is the single way to get the encoder outside context.rs and marks the
images it names (Enc::uses).

* GPU: wait for the empty submission while evicted pool textures still count

stale_sizes_do_not_starve_a_steady_size failed with 0 hits and 20 misses on
hardware adapters: pool_frame_end submitted an empty batch and then only did a
non-blocking Poll, and the queue's work-done callback did not run before the
next frame, so Pool::dying never drained and make_free stopped evicting stale
sizes.

While dying is non-zero, pool_frame_end now waits on that empty submission for
up to the readback timeout (the pool lock is already released). A wait timeout
just moves on and does not retire the context or its readbacks; other poll
errors still retire them. Without dying textures it keeps the cheap Poll.

Enc::crop records through Enc::record(&[src, &dst]) so both pooled images are
registered like on every other recording path (review).

* GPU: do not repeat the pool frame-end wait until evicted textures drain

A wait that frees none of the evicted bytes (timeout, or a WebGPU poll that
does not block) marks the pool stalled; later frames only poll until dying
drops. Test covers the no-repeat and partial-progress cases; dying decrement
saturates.

* Remote frames: end a pending frame that a new render replaces

A render arriving while a multi-pass frame waits for readbacks dropped that frame without
`frame_end`, so the GPU pool's clock skipped it. Errors return before `frame_begin`.

* Render: end the frame even when a comp frame panics

`passes::comp_frame` called `frame_end` only after a normal return, so a frame that
panicked (or whose future was dropped between passes) never aged the GPU pool.

* GPU pool: log the reuse rate at render end; test reuse across effect calls and frames

Log cumulative hits/misses (and reuse %) once per render before trimming. Tests
cover reuse within an open frame across effect calls, and across repeated frames.

---------

Co-authored-by: Matej Kozlovský <MatejKozlovsky@users.noreply.github.com>
Co-authored-by: bflatastic <bombayapirat@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: FredApps <153173854+FredApps@users.noreply.github.com>
* GPU: free effect working textures after each call instead of at frame end

A GPU frame keeps its encoder open while the CPU renderer runs layers with GPU
effects (Gpu::effects -> run_chain). Each call's Enc handed its textures back
to the shared pool, where they waited for every open encoder, so all effect
intermediates of a frame stayed allocated until the frame ended (17.7 GB by
layer 17 of a heavy 4K comp, then OOM). Effect calls now borrow a pool owner
(Enc::lent) that is given back once the call's work is submitted or
discarded; its kept textures are trimmed to the pool budget, so the rest are
freed after each call.

* GPU: one pool budget for idle effect calls, trimmed at the end of a render

Review of #1523: each idle lent owner kept up to POOL_BUDGET of textures of
its own, outside the shared accounting, and there were as many idle owners as
effect calls ever ran at once (16 frame threads: ~12 GB after a 4K render).

Giving a lent owner back now moves its kept textures to the shared free list,
so one POOL_BUDGET bounds what the free list and every finished effect call
keep. They skip Pool::release's wait for open encoders: only the lent Enc
recorded work on them, and that work is submitted or discarded. Each lend is
a fresh owner id, so a lease that outlives its call (an image handed to
another encoder) is released through Pool::release; this does not rely on
the result being read back.

Accelerator::render_end (called when an export ends) drops the kept textures.

* GPU: evict the pool's oldest free textures, guard escaped leases

Review of #1523 (follow-up to 0a884fb6):

- Pool::make_free rejected a texture when the free list was full and never
  evicted, so once sizes that no longer occur (per-frame blur bounds, padded
  layer sizes) filled the budget, every later free was a drop and every take
  an allocation. It now evicts the least recently freed textures until the
  new one fits.
- A lease read by another Enc (dispatch, copy, readback, display) or handed
  to a cache is marked escaped and always released through the guarded
  Pool::release, so a lent call can no longer reuse a texture that a still
  open encoder reads.
- Docs: POOL_BUDGET caps the free list only; textures waiting for open
  encoders and those of live Encs are outside it.
- export_async calls render_end from a drop guard, so the pool is also
  trimmed when an export panics or its future is dropped.
- Tests use a private context with its own pool budget instead of a global
  override; new tests for stale sizes and an image read by an open encoder.

* GPU: evict only stale pool sizes, count evicted textures until the GPU frees them

Evicting the least recently freed texture for every newcomer thrashed when a frame
frees more than the budget in a repeating order (blur/glow intermediates): each free
evicted the size the next call takes first, so misses came back to the old level and
evict + reallocate raised the peak.

The free list now evicts only sizes nobody asked for in the last 2 output frames
(Accelerator::frame_end, called by the export per frame); otherwise the incoming
texture is dropped and the kept set keeps hitting. Evicted bytes count against the
budget until the work submitted so far is done, so evictions run at most one budget
ahead of the GPU.

* GPU: lower the shared pool budget to 256 MB

On 4K RTX 3090 runs 256 MB matches the old code's peak reserved on d_blurglow
(9204 MB) and is 256-512 MB above it on c_effects (6592 vs 6080 MB), while
staying faster.

* GPU: end frames on the multi-frame render paths, route recording through Enc::record

Only the export pipeline called frame_end, so off export (preview, remote
frames) the pool's clock stood still, no size went stale and a full free
list dropped every newcomer. passes::comp_frame (exports), remote frames
and the preview workers now end each frame; test without pool_frame_end.

Docs: the frame clock is coarse with many frames in flight; dying only
throttles eviction, approximately; no cache path escapes images. Enc::record
is the single way to get the encoder outside context.rs and marks the
images it names (Enc::uses).

* GPU: cap in-flight frame memory on Vulkan and DX12 (#1550)

wgpu destroys a dropped texture or buffer only once the submissions
that used it have completed and the device is maintained. With several
4K frames in flight on an export or effect-heavy render, frames can
record and drop working textures faster than the GPU retires them,
accumulating freed-but-not-destroyed allocations until a 4-8 GB adapter
runs out of memory (#879).

Add a memory gate (MemCap) checked every 8 effect steps or layers:
- Default cap of 3 GiB on discrete GPUs (low enough for 4-8 GB cards
  while leaving headroom above the 1.5 GiB upload cache and 256 MB
  shared pool) and 2 GiB on integrated/software adapters, overridable
  via EFFECTCRAFT_GPU_MEMCAP_MB (0 disables).
- Compare total_allocated_bytes against non-reclaimable bytes (upload
  cache, pool free list, live leases, staging, zeros) with hysteresis
  and a post-wait floor so the gate only drains when a wait can free
  dropped allocations and does not spin when caches or other open
  encoders hold memory over the cap.
- Submit and wait on the current Enc's own SubmissionIndex via a
  dedicated poll_wait helper (serialized by poll_lock) so a timeout
  simply carries on without retiring the context or its readback pool.

* GPU: warn on invalid EFFECTCRAFT_GPU_MEMCAP_MB, register crop sources, require GPU in the mem-cap child test

- memcap: an EFFECTCRAFT_GPU_MEMCAP_MB value that is not a whole number
  of MiB or overflows 64 bits now logs a warning and uses the default
  cap (it used to fall back silently, or wrap on overflow). Unset still
  means the default and 0 still turns the gate off.
- Enc::crop records through Enc::record, so a foreign source lease is
  marked escaped like in copy_into.
- The mem-cap child test starts its GPU through require_gpu, so
  EFFECTCRAFT_REQUIRE_GPU=1 fails when the GPU does not start, and
  prints a skip line (with the adapter name when the backend has no
  allocator report), which the parent passes on.

* GPU: do not repeat the pool frame-end wait until evicted textures drain

A wait that frees none of the evicted bytes (timeout, or a WebGPU poll that
does not block) marks the pool stalled; later frames only poll until dying
drops. Test covers the no-repeat and partial-progress cases; dying decrement
saturates.

* Remote frames: end a pending frame that a new render replaces

A render arriving while a multi-pass frame waits for readbacks dropped that frame without
`frame_end`, so the GPU pool's clock skipped it. Errors return before `frame_begin`.

* Render: end the frame even when a comp frame panics

`passes::comp_frame` called `frame_end` only after a normal return, so a frame that
panicked (or whose future was dropped between passes) never aged the GPU pool.

* GPU memcap: warn once when kept memory alone is over the cap; test the edge frames

A frame whose non-reclaimable memory exceeds the cap never waits when reclaimable
bytes stay below the hysteresis (waiting cannot free the kept set) and now logs
that once. Tests cover a frame over the cap, two frames that fit one at a time, and a
dropped frame giving its memory back.

---------

Co-authored-by: Matej Kozlovský <MatejKozlovsky@users.noreply.github.com>
Co-authored-by: FredApps <153173854+FredApps@users.noreply.github.com>
* gpu: run Content-Aware Fill's PatchMatch on the device

Content-Aware Fill's synthesis is the stage that makes the tool slow: at
1920×1080 with a 300×200 hole, PatchMatch costs ≈ 1.1 s per frame on the CPU,
and it is what Object, Surface and every refining frame spend their time in.

Add a `FillBackend` trait to `effectcraft-raster` whose stages (the membrane
solve, the flow fields, PatchMatch) default to the CPU reference, and
`Accelerator::inpaint()` on the compositor, which is how the engine asks for a
device backend. `effectcraft_gpu::inpaint` implements PatchMatch: the
multi-scale pyramid, the EM rounds, the propagation (a two-pass checkerboard
instead of the CPU's scan order), the random search, the SSD, the
histogram-based σ² and the weighted vote, as compute kernels in
`shaders/inpaint.wgsl`.

The fill's frames are read back to the CPU before it runs (analyses composite
on the CPU by design), so the backend is about the fill's own work; the
orchestration, the flow-guided propagation and the per-frame flow control stay
on the CPU. Only the hole's bounds cross back to the CPU, which is what makes
the offload pay.

Measured on an Intel Arc (MTL) iGPU, 1920×1080, 300×200 hole:

  CPU 1087 ms   GPU 397 ms   (2.7×, 41.0 dB PSNR against the CPU's synthesis)

The membrane (harmonic) solve deliberately stays on the CPU: the same
measurement has it at ≈ 90 ms on the device against ≈ 55 ms on the CPU,
because a fill's full-frame data movement (upload, the known pyramid, a copy)
does not shrink with the hole, while the relaxation does. The device takes only
the stage where its parallel search pays; `membrane_tex` still runs on the
device inside PatchMatch, where it is the coarsest level's start and never
crosses back.

Closes #1839.

* gpu: fix the fill's vote histogram and run its flow on the device

Review follow-ups on the Content-Aware Fill GPU port, plus the fill's flow.

Fixes:

* imp_hist kept about one sample in 256: each of the 256 threads scanned a
  strided subset of the pixels and retained only those whose bin selected it,
  so the vote's sigma² came from a sample correlated with the pixel index (and
  a small hole usually fell back to 1.0, making the weights near-uniform). One
  workgroup now accumulates the whole population through shared atomic bins,
  with a test that pins the sample count.
* imp_pm_prop and imp_pm_rand were dispatched over grow(near, 1) but with
  near's origin, so the ring's left column and top row were never written
  (NaN under test, stale pooled data in production) while a strip past it was.
  `over` now derives the shader's origin from the box it sizes the dispatch
  from, so a dispatch's region and its origin can no longer disagree.
* Gpu::inpaint() requires its kernels to have built. Otherwise every stage
  paid an upload and a failed dispatch to fall back to the CPU, while the fill
  still reported the GPU path.
* imp_rnd's XOR chain parenthesises its multiplicative terms: WGSL's grammar
  makes each XOR operand a unary expression, so `a * b ^ c * d` is rejected
  by spec-compliant parsers (naga accepts it).
* FillBackend documents that its stages may be called concurrently.
* The coarsest membrane's sweep count (64, against the CPU's 200) is now
  justified: matching 200 measured ~6% slower over the fill with no change in
  the result.

And the flow: Gpu::flow runs block_flow's coarse-to-fine search, sub-pixel fit
and vector median on the device. The luma is the CPU's (flow::luma_pair), so
the field matches block_flow's to a float rounding and the propagation sees
the same motion; the hole completion stays on the CPU with the membrane. A
four-frame 1920x1080 fill goes from 1.27x to 1.42x against the CPU, and the
device path is covered for holes from 16x16 to 300x200.

* gpu: keep the fill vote's histogram range on HDR input

imp_hist binned every distance at a fixed 256 bins per unit and clamped to
1023, so the vote's sigma2 topped out at 3.998. A 32-bpc frame's channels can
exceed 1, and masked_frame forwards them unclamped: a patch distance of 1600
then reported sigma2 ~ 4, exp(-1600/(2*sigma2)) rounded to zero in f32, and
imp_pm_vote kept the prior image instead of synthesising.

The histogram now reports the largest finite distance it saw (atomicMax on the
float bits, carried in bin 0's unused .g channel). SDR input keeps the fixed
0..4 range with identical bins; HDR input is re-binned over the observed range
and percentile() maps the bin centre back through it. Nothing clamps the input.

Also group over/sweeps/pm_level's arguments into small structs: the workspace
denies too_many_arguments and the lint policy (#2496) does not allow new
#[allow]s. No behaviour change on those paths.

* engine: don't report Edge Blend fills as device fills

Edge Blend calls only the membrane, which the GPU backend leaves to the CPU
reference, so run_plan's "Filling (GPU)" status was wrong for it whenever a
backend was present. Object and Surface still run the flow and PatchMatch on
the device and keep the label.

CodeRabbit's #1856 finding.

* gpu: run the fill's device stages inside error scopes

An allocation or validation failure inside patch_image/flow_image left an
invalid texture whose later use raised an uncaptured error, retiring the
shared compositor instead of falling back to the CPU for that frame. Wrap both
stages in Gpu::within_memory, whose scopes are native thread-local, so the
fill's rayon workers do not share them.

---------

Co-authored-by: FredApps <153173854+FredApps@users.noreply.github.com>
Co-authored-by: FredApps <153173854+FredApps@users.noreply.github.com>
Co-authored-by: @skylartaylor <26588250+skylartaylor@users.noreply.github.com>
Co-authored-by: FredApps <153173854+FredApps@users.noreply.github.com>
Posterize: round_away decided half-way by subtracting, and drivers may fuse the
product that feeds it into one fma (AMD does), skipping the product's rounding.
A straight value of 5/6 at level 4 gives 5/6 * 3 = 2.5 exactly in f32 on the
CPU but 2.49999994 fused, so the GPU rounded a level down. round_away now
compares x with t +/- 0.5 (exact for integer t), which no driver can fuse, and
the level divide uses an fma-corrected division (div_rn) like the CPU's.

CC Grid Wipe: the cell lookup floor(q / cs) used WGSL's division, which may be
off by 2.5 ULP; at q = 7, cs = 3.5 AMD and Intel return just under 2 and pick
the neighbouring cell. It uses div_rn too.

New test: posterize matches the CPU exactly on every 8 bpc premultiplied colour
and alpha at three levels (59715 of 65280 pairs differed before at level 4).

RX 6900 XT, Vulkan: effectcraft-gpu 222 passed; the one failure left is CC Hex
Tile, fixed by #1776. DX12 + FXC (on #1571): both tests pass.

Co-authored-by: 00xJ0 <56056764+00xJ0@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: FredApps <153173854+FredApps@users.noreply.github.com>
* #1590: build effect kernels on first use instead of with the GPU context

GpuContext::new built every compute pipeline up front: the compositor's own
kernels and ~208 effect kernels. In Chrome on Windows that kept the GPU
process busy past its watchdog, so the device was lost ~60 s after every load
(#1590); on DirectX 12 with FXC the window took over a minute to appear (#613).

The compositor's kernels are still built up front and required. Effect kernels
are built the first time a dispatch asks for one, inside the same error scopes,
so one a compiler rejects still renders its effects on the CPU. unavailable_kernels
lists the failures so far; build_all_kernels builds the rest.

RX 6900 XT, Windows: Vulkan context 0.27 s, all effect kernels 0.9 s, GPU tests
77 s -> 26 s; on #1571's DX12/FXC, context ~66 s -> 1.96 s, tests 1306 s -> 252 s,
same results.

Co-Authored-By: Claude <noreply@anthropic.com>

* #1590: compile each kernel family as a shader module of its own

Building effect kernels on first use was not enough in Chrome: the page and
its frame workers each create a device, every one compiled its required
kernels against the single ~460K-character module, and Dawn compiles the
module again for each pipeline, so the GPU process still passed its watchdog
and the device was lost ~64 s after load (RX 6900 XT, Chrome 155).

Each kernel family (FAMILIES) is now common.wgsl + kernels.wgsl + its own file
and the files it borrows functions from (at most ~120K characters), built with
the family's first kernel; the compositor's kernels, sky and classic3d use
small modules of their own.

Chrome 155 on Windows / RX 6900 XT, release web build, default flags: main
loses the device at ~64 s (60.7 s with ?nogpuworkers); with this, two 100 s
runs keep it, and both frame workers get the GPU. Native Vulkan tests
unchanged (212 passed, the 3 failures that main has, #1605).

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: 00xJ0 <56056764+00xJ0@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: FredApps <153173854+FredApps@users.noreply.github.com>
On Linux, the discrete-GPU memory cap now comes from the card's video memory: min(3 GiB, ¾ of amdgpu's `mem_info_vram_total`), so a 2 GB RX 550 gets 1.5 GiB. The card is matched by PCI address, falling back to the smallest card with the same ids.

Also folds in CodeRabbit follow-ups from #1856 (PatchMatch flags buffer limit preflight), #1490 (arbitrary-map index wrap), #1836 (round_away for |x| >= 2^23) and #3025 (saturating FrameCache byte accounting).

Fixes #1487

Co-authored-by: FredApps <153173854+FredApps@users.noreply.github.com>
OCIO: refuse a .csp LUT whose header claims an oversized table before reserving it (#2938)
Some checks failed
ci.yml / OCIO: refuse a .csp LUT whose header claims an oversized table before reserving it (#2938) (pull_request) Failing after 0s
Details
nix.yml / OCIO: refuse a .csp LUT whose header claims an oversized table before reserving it (#2938) (pull_request) Failing after 0s
Details
packaging-lint.yml / OCIO: refuse a .csp LUT whose header claims an oversized table before reserving it (#2938) (pull_request) Failing after 0s
Details
sonarcloud.yml / OCIO: refuse a .csp LUT whose header claims an oversized table before reserving it (#2938) (pull_request) Failing after 0s
Details
ci.yml / OCIO: refuse a .csp LUT whose header claims an oversized table before reserving it (#2938) (push) Failing after 0s
Details
nix.yml / OCIO: refuse a .csp LUT whose header claims an oversized table before reserving it (#2938) (push) Failing after 0s
Details
packaging-lint.yml / OCIO: refuse a .csp LUT whose header claims an oversized table before reserving it (#2938) (push) Failing after 0s
Details
sonarcloud.yml / OCIO: refuse a .csp LUT whose header claims an oversized table before reserving it (#2938) (push) Failing after 0s
Details
58ca9c1c1b
alf merged commit 58ca9c1c1b into main 2026-11-04 08:26:40 +00:00
alf deleted branch chore/sync-upstream-20261104 2026-11-04 08:26:40 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
  
herkunft/alpha-feedback
Aus Rückmeldungen der Alpha-Tester

  
status
blockiert
 Wartet auf etwas anderes

  
status
zu-testen
 Gebaut, aber noch nicht im echten Einsatz geprüft

  
typ
bug
 Fehler

  
typ
docs
 Dokumentation

  
typ
enhancement
 Verbesserung einer vorhandenen Funktion

  
typ
feature
 Neue Funktion

  
typ
idea
 Idee, noch nicht entschieden

No labels
herkunft/alpha-feedback
status
blockiert
status
zu-testen
typ
bug
typ
docs
typ
enhancement
typ
feature
typ
idea
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
iris/effectcraft!18
No description provided.