Files

production.rs

9j: depth range = T-pose arm span + arm margin (per-sex .ppd override, GUI); depth_bits 8 (default)/16 x gray/rgb_bands/rgb_packed; schema 6/.ppda 3 (v5/v2 read as gray16); readers decode all; Render alles keeps live pass preview (t990u)

timfa Grok Bot · pushed by timfa · 7 days ago

673fde68 History

production.rs 115.0 KiB Download Raw

1	//! Bounded orthographic production rendering. GPU work runs on the native
2	//! current context, one request per UI update; sampling/filtering/PNG I/O run
3	//! on the worker. The worker never waits for a preview acknowledgment.
4	use crate::{
5	equipment,
6	preview::{self, Mat4, PreviewCharacter, PreviewControls},
7	project::CameraFraming,
8	render_job::{ImageBuf, RenderEvent},
9	};
10	use glow::HasContext;
11	use std::{
12	path::{Path, PathBuf},
13	sync::{
14	atomic::{AtomicBool, Ordering},
15	mpsc, Arc, Mutex,
16	},
17	thread,
18	};
19
20	pub const SCALE: u32 = 8;
21	pub const MAX_HIGHRES: u32 = 2048;
22	pub const PASSES: [&str; 6] = [
23	"highres",
24	"detail",
25	"target-res / diffuse",
26	"depth",
27	"normal",
28	"specular",
29	];
30	#[derive(Clone)]
31	pub struct Draw {
32	pub positions: Arc<Vec<[f32; 3]>>,
33	pub normals: Arc<Vec<[f32; 3]>>,
34	pub uvs: Arc<Vec<[f32; 2]>>,
35	pub vertex_colors: Arc<Vec<[f32; 4]>>,
36	pub indices: Vec<u32>,
37	pub color: [f32; 4],
38	pub albedo: Option<Arc<equipment::Texture>>,
39	pub shiny: Option<Arc<equipment::Texture>>,
40	pub specular: f32,
41	pub cutoff: f32,
42	pub flat_normals: bool,
43	}
44	#[derive(Clone)]
45	pub struct Scene {
46	pub draws: Vec<Draw>,
47	pub view: Mat4,
48	pub projection: Mat4,
49	pub width: u32,
50	pub height: u32,
51	}
52	#[derive(Debug)]
53	pub struct Buffers {
54	pub width: u32,
55	pub height: u32,
56	pub diffuse: Vec<u8>,
57	pub normal: Vec<u8>,
58	pub specular: Vec<u8>,
59	pub depth: Vec<f32>,
60	}
61	#[derive(Debug)]
62	pub struct Target {
63	pub diffuse: ImageBuf,
64	pub normal: ImageBuf,
65	pub specular: ImageBuf,
66	pub depth: Vec<u16>,
67	/// Unquantized normalized depth t (0..1) per pixel, for the export encoding.
68	pub depth_t: Vec<f32>,
69	pub depth_preview: ImageBuf,
70	}
71	/// Content fingerprint of a source file used for a production job.
72	#[derive(Debug, Clone, PartialEq, Eq)]
73	pub struct SourceFingerprint {
74	pub path: String,
75	pub sha256: String,
76	}
77
78	#[derive(Clone)]
79	pub struct RenderJob {
80	pub character: PreviewCharacter,
81	pub sex: String,
82	pub preset: Option<equipment::Preset>,
83	pub target_width: u32,
84	pub target_height: u32,
85	pub fps: u32,
86	pub framing: CameraFraming,
87	pub output: PathBuf,
88	pub project_id: String,
89	pub project_name: String,
90	pub body_model: SourceFingerprint,
91	/// SHA-256 of the encoded `.ppe` bytes when rendering equipment; None for body.
92	pub preset_sha256: Option<String>,
93	/// Depth PNG bit depth + encoding (project setting).
94	pub depth_format: crate::camera::DepthFormat,
95	}
96	#[derive(Debug, Clone, PartialEq)]
97	pub struct ClipPlan {
98	pub source_name: String,
99	pub token: String,
100	pub frames: u32,
101	}
102	#[derive(Debug, Clone, PartialEq)]
103	pub struct Plan {
104	pub clips: Vec<ClipPlan>,
105	pub images: u32,
106	pub passes: u32,
107	pub files: u32,
108	}
109	pub fn plan(body: &PreviewCharacter, fps: u32) -> Result<Plan, String> {
110	if fps == 0 \|\| fps > 240 {
111	return Err("fps moet 1–240 zijn".into());
112	}
113	let clips = if body.clips.is_empty() {
114	vec![ClipPlan {
115	source_name: String::new(),
116	token: "clip000-bind".into(),
117	frames: 1,
118	}]
119	} else {
120	body.clips
121	.iter()
122	.enumerate()
123	.map(\|(i, c)\| {
124	let duration = c.duration;
125	if !duration.is_finite() \|\| duration < 0. \|\| duration * fps as f32 > 100000. {
126	return Err("ongeldige of te lange animatie".into());
127	}
128	// Exporter float timestamps commonly put a nominal 1-second
129	// endpoint one ULP above 1. Do not duplicate that terminal pose.
130	let samples = f64::from(duration) * f64::from(fps);
131	let nearest = samples.round();
132	let samples = if (samples - nearest).abs()
133	<= 4. * f64::from(f32::EPSILON) * samples.max(1.)
134	{
135	nearest
136	} else {
137	samples
138	};
139	Ok(ClipPlan {
140	source_name: c.name.clone(),
141	token: clip_token(i, &c.name),
142	frames: samples.ceil().max(1.) as u32,
143	})
144	})
145	.collect::<Result<Vec<_>, String>>()?
146	};
147	let frames = clips
148	.iter()
149	.try_fold(0u32, \|n, c\| n.checked_add(c.frames))
150	.ok_or("te veel frames")?;
151	let images = frames
152	.checked_mul(preview::PRODUCTION_VIEWS)
153	.ok_or("te veel beelden")?;
154	let passes = images.checked_mul(6).ok_or("te veel passes")?;
155	let files = images.checked_mul(4).ok_or("te veel bestanden")?;
156	if files > 500000 {
157	return Err("batch groter dan 500000 uitvoerbestanden".into());
158	}
159	Ok(Plan {
160	clips,
161	images,
162	passes,
163	files,
164	})
165	}
166	#[derive(Debug, Clone, Copy, PartialEq, Eq)]
167	pub struct Sample {
168	pub clip: usize,
169	pub frame: u32,
170	pub pitch: i32,
171	pub yaw: u32,
172	}
173	pub fn samples(plan: &Plan) -> impl Iterator<Item = Sample> + '_ {
174	plan.clips.iter().enumerate().flat_map(\|(clip, c)\| {
175	(0..c.frames).flat_map(move \|frame\| {
176	preview::PRODUCTION_PITCHES
177	.into_iter()
178	.flat_map(move \|pitch\| {
179	(0..12).map(move \|y\| Sample {
180	clip,
181	frame,
182	pitch,
183	yaw: y * 30,
184	})
185	})
186	})
187	})
188	}
189
190	/// Production yaw values in degrees, atlas column order within one pitch.
191	pub fn production_yaws() -> [u32; 12] {
192	std::array::from_fn(\|i\| i as u32 * 30)
193	}
194
195	pub fn clip_token(index: usize, name: &str) -> String {
196	let slug: String = name
197	.chars()
198	.map(\|c\| {
199	if c.is_ascii_alphanumeric() {
200	c.to_ascii_lowercase()
201	} else {
202	'-'
203	}
204	})
205	.take(48)
206	.collect();
207	format!(
208	"clip{index:03}-{}",
209	if slug.is_empty() { "animation" } else { &slug }
210	)
211	}
212	pub fn output_path(
213	sex: &str,
214	set: &str,
215	clip: &str,
216	frame: u32,
217	pitch: i32,
218	yaw: u32,
219	map: &str,
220	) -> Result<PathBuf, String> {
221	if !["male", "female"].contains(&sex)
222	\|\| !(set == "body" \|\| equipment::valid_name(set))
223	\|\| !equipment::valid_name(clip)
224	\|\| !preview::PRODUCTION_PITCHES.contains(&pitch)
225	\|\| yaw >= 360
226	\|\| !yaw.is_multiple_of(30)
227	\|\| !["diffuse", "normal", "depth", "specular"].contains(&map)
228	{
229	return Err("ongeldig uitvoerpad/token".into());
230	}
231	Ok(PathBuf::from(sex)
232	.join(set)
233	.join(clip)
234	.join(format!("f{frame:06}"))
235	.join(format!("p{pitch:+03}_y{yaw:03}_{map}.png")))
236	}
237	pub use crate::camera::matrices as camera;
238
239	fn point(m: &Mat4, p: [f32; 3]) -> [f32; 3] {
240	std::array::from_fn(\|i\| m[i] * p[0] + m[i + 4] * p[1] + m[i + 8] * p[2] + m[i + 12])
241	}
242	fn normalize(v: [f32; 3]) -> [f32; 3] {
243	let l = v.iter().map(\|x\| x * x).sum::<f32>().sqrt();
244	if l > 1e-10 {
245	v.map(\|x\| x / l)
246	} else {
247	[0., 0., 1.]
248	}
249	}
250	fn normal(m: &Mat4, n: [f32; 3]) -> [f32; 3] {
251	let a = [m[0], m[1], m[2]];
252	let b = [m[4], m[5], m[6]];
253	let c = [m[8], m[9], m[10]];
254	let cross = \|a: [f32; 3], b: [f32; 3]\| {
255	[
256	a[1] * b[2] - a[2] * b[1],
257	a[2] * b[0] - a[0] * b[2],
258	a[0] * b[1] - a[1] * b[0],
259	]
260	};
261	let x = cross(b, c);
262	let y = cross(c, a);
263	let z = cross(a, b);
264	let det = a.iter().zip(x).map(\|(a, b)\| a * b).sum::<f32>();
265	if det.abs() < 1e-12 {
266	return normalize(n);
267	}
268	normalize(std::array::from_fn(\|i\| {
269	(x[i] * n[0] + y[i] * n[1] + z[i] * n[2]) / det
270	}))
271	}
272	pub fn scene(
273	job: &RenderJob,
274	clip: &str,
275	time: f32,
276	pitch: f32,
277	yaw: f32,
278	cache: &mut equipment::TextureCache,
279	) -> Result<Scene, String> {
280	let body = &job.character;
281	let mut draws = Vec::new();
282	if let Some(preset) = &job.preset {
283	let controls = PreviewControls {
284	clip_name: clip.into(),
285	time,
286	..Default::default()
287	};
288	for layer in equipment::layers_cached(
289	preset,
290	usize::from(job.sex == "female"),
291	body,
292	&controls,
293	cache,
294	)? {
295	let m = layer.model;
296	draws.push(Draw {
297	positions: Arc::new(layer.mesh.positions.iter().map(\|p\| point(&m, *p)).collect()),
298	normals: Arc::new(layer.mesh.normals.iter().map(\|n\| normal(&m, *n)).collect()),
299	uvs: Arc::new(
300	layer
301	.mesh
302	.uvs
303	.into_iter()
304	.map(\|[u, v]\| [u, 1. - v])
305	.collect(),
306	),
307	vertex_colors: Arc::new(Vec::new()),
308	indices: layer.mesh.indices,
309	color: layer.mesh.color,
310	albedo: layer.albedo,
311	shiny: layer.shiny,
312	specular: layer.specular,
313	cutoff: 0.5,
314	flat_normals: false,
315	});
316	}
317	} else {
318	let bones = preview::sample_skin_matrices(body, clip, time);
319	let mut positions = Vec::with_capacity(body.positions.len());
320	let mut normals = Vec::with_capacity(body.positions.len());
321	for (i, p) in body.positions.iter().enumerate() {
322	let mut m = preview::identity();
323	if !bones.is_empty() && body.weights.len() == body.positions.len() {
324	m = [0.; 16];
325	let joints = body.joints.get(i).copied().unwrap_or([0; 4]);
326	for (j, w) in joints.into_iter().zip(body.weights[i]) {
327	let b = bones.get(j as usize).ok_or("ongeldige skinjoint")?;
328	for k in 0..16 {
329	m[k] += b[k] * w;
330	}
331	}
332	}
333	positions.push(point(&m, *p));
334	normals.push(normal(
335	&m,
336	body.normals.get(i).copied().unwrap_or([0., 1., 0.]),
337	));
338	}
339	let positions = Arc::new(positions);
340	let normals = Arc::new(normals);
341	let uvs = Arc::new(body.uvs.clone());
342	let colors = Arc::new(body.colors.clone());
343	if body.surfaces.is_empty() {
344	draws.push(Draw {
345	positions,
346	normals,
347	uvs,
348	vertex_colors: colors,
349	indices: body.indices.clone(),
350	color: body.base_color,
351	albedo: None,
352	shiny: None,
353	specular: 0.,
354	cutoff: 0.001,
355	flat_normals: !body.source_normals_complete,
356	});
357	} else {
358	for surface in &body.surfaces {
359	draws.push(Draw {
360	positions: positions.clone(),
361	normals: normals.clone(),
362	uvs: uvs.clone(),
363	vertex_colors: colors.clone(),
364	indices: body.indices[surface.first..surface.first + surface.count].to_vec(),
365	color: surface.color,
366	albedo: surface.albedo.clone(),
367	shiny: None,
368	specular: 0.,
369	cutoff: surface.cutoff,
370	flat_normals: surface.flat_normals,
371	});
372	}
373	}
374	}
375	let (view, projection) = camera(
376	crate::camera::resolve(body, job.framing).framing,
377	yaw,
378	pitch,
379	job.target_width as f32 / job.target_height as f32,
380	);
381	Ok(Scene {
382	draws,
383	view,
384	projection,
385	width: job.target_width * SCALE,
386	height: job.target_height * SCALE,
387	})
388	}
389
390	impl Scene {
391	pub fn validate(&self) -> Result<(), String> {
392	if self.width == 0
393	\|\| self.height == 0
394	\|\| self.width > MAX_HIGHRES
395	\|\| self.height > MAX_HIGHRES
396	\|\| self.draws.len() > 4096
397	\|\| self
398	.view
399	.iter()
400	.chain(&self.projection)
401	.any(\|v\| !v.is_finite())
402	{
403	return Err("ongeldige GPU-scène/afmetingen".into());
404	}
405	for d in &self.draws {
406	if d.positions.len() > 1_000_000
407	\|\| d.positions.len() != d.normals.len()
408	\|\| d.indices.len() > 3_000_000
409	\|\| !d.indices.len().is_multiple_of(3)
410	\|\| d.indices.iter().any(\|i\| *i as usize >= d.positions.len())
411	\|\| d.positions
412	.iter()
413	.chain(d.normals.iter())
414	.flatten()
415	.chain(d.uvs.iter().flatten())
416	.chain(d.vertex_colors.iter().flatten())
417	.chain(d.color.iter())
418	.any(\|v\| !v.is_finite())
419	\|\| !d.specular.is_finite()
420	\|\| !d.cutoff.is_finite()
421	{
422	return Err("ongeldige of te grote GPU-geometrie".into());
423	}
424	for t in [d.albedo.as_ref(), d.shiny.as_ref()].into_iter().flatten() {
425	if t.width == 0
426	\|\| t.height == 0
427	\|\| t.width > 2048
428	\|\| t.height > 2048
429	\|\| t.rgba.len() != t.width as usize * t.height as usize * 4
430	{
431	return Err("ongeldige GPU-texture".into());
432	}
433	}
434	}
435	Ok(())
436	}
437	}
438
439	#[derive(Default)]
440	pub struct GpuRenderer {
441	program: Option<glow::Program>,
442	vao: Option<glow::VertexArray>,
443	vbo: Option<glow::Buffer>,
444	ebo: Option<glow::Buffer>,
445	fbo: Option<glow::Framebuffer>,
446	colors: Vec<glow::Texture>,
447	depth: Option<glow::Renderbuffer>,
448	extent: [u32; 2],
449	}
450	impl GpuRenderer {
451	/// # Safety
452	/// A native OpenGL 3.3 context must be current on this thread.
453	pub unsafe fn destroy(&mut self, gl: &glow::Context) {
454	self.destroy_target(gl);
455	if let Some(x) = self.program.take() {
456	gl.delete_program(x);
457	}
458	if let Some(x) = self.vao.take() {
459	gl.delete_vertex_array(x);
460	}
461	if let Some(x) = self.vbo.take() {
462	gl.delete_buffer(x);
463	}
464	if let Some(x) = self.ebo.take() {
465	gl.delete_buffer(x);
466	}
467	}
468	unsafe fn destroy_target(&mut self, gl: &glow::Context) {
469	for x in self.colors.drain(..) {
470	gl.delete_texture(x);
471	}
472	if let Some(x) = self.depth.take() {
473	gl.delete_renderbuffer(x);
474	}
475	if let Some(x) = self.fbo.take() {
476	gl.delete_framebuffer(x);
477	}
478	self.extent = [0, 0];
479	}
480	unsafe fn init(&mut self, gl: &glow::Context) -> Result<(), String> {
481	if self.program.is_some() {
482	return Ok(());
483	}
484	let p = gl.create_program()?;
485	let mut shaders = Vec::new();
486	for (kind, source) in [
487	(glow::VERTEX_SHADER, VERTEX),
488	(glow::FRAGMENT_SHADER, FRAGMENT),
489	] {
490	let shader = gl.create_shader(kind)?;
491	gl.shader_source(shader, source);
492	gl.compile_shader(shader);
493	if !gl.get_shader_compile_status(shader) {
494	let error = gl.get_shader_info_log(shader);
495	gl.delete_shader(shader);
496	for s in shaders {
497	gl.delete_shader(s);
498	}
499	gl.delete_program(p);
500	return Err(error);
501	}
502	gl.attach_shader(p, shader);
503	shaders.push(shader);
504	}
505	gl.link_program(p);
506	let result = if gl.get_program_link_status(p) {
507	Ok(())
508	} else {
509	Err(gl.get_program_info_log(p))
510	};
511	for s in shaders {
512	gl.detach_shader(p, s);
513	gl.delete_shader(s);
514	}
515	if let Err(e) = result {
516	gl.delete_program(p);
517	return Err(e);
518	}
519	self.program = Some(p);
520	self.vao = Some(gl.create_vertex_array()?);
521	self.vbo = Some(gl.create_buffer()?);
522	self.ebo = Some(gl.create_buffer()?);
523	Ok(())
524	}
525	unsafe fn target(&mut self, gl: &glow::Context, w: u32, h: u32) -> Result<(), String> {
526	if self.extent == [w, h] {
527	return Ok(());
528	}
529	self.destroy_target(gl);
530	self.fbo = Some(gl.create_framebuffer()?);
531	gl.bind_framebuffer(glow::FRAMEBUFFER, self.fbo);
532	for slot in 0..3 {
533	let t = gl.create_texture()?;
534	self.colors.push(t);
535	gl.bind_texture(glow::TEXTURE_2D, Some(t));
536	gl.tex_parameter_i32(
537	glow::TEXTURE_2D,
538	glow::TEXTURE_MIN_FILTER,
539	glow::NEAREST as i32,
540	);
541	gl.tex_parameter_i32(
542	glow::TEXTURE_2D,
543	glow::TEXTURE_MAG_FILTER,
544	glow::NEAREST as i32,
545	);
546	gl.tex_image_2d(
547	glow::TEXTURE_2D,
548	0,
549	glow::RGBA8 as i32,
550	w as i32,
551	h as i32,
552	0,
553	glow::RGBA,
554	glow::UNSIGNED_BYTE,
555	None,
556	);
557	gl.framebuffer_texture_2d(
558	glow::FRAMEBUFFER,
559	glow::COLOR_ATTACHMENT0 + slot,
560	glow::TEXTURE_2D,
561	Some(t),
562	0,
563	);
564	}
565	let d = gl.create_renderbuffer()?;
566	self.depth = Some(d);
567	gl.bind_renderbuffer(glow::RENDERBUFFER, Some(d));
568	gl.renderbuffer_storage(
569	glow::RENDERBUFFER,
570	glow::DEPTH_COMPONENT24,
571	w as i32,
572	h as i32,
573	);
574	gl.framebuffer_renderbuffer(
575	glow::FRAMEBUFFER,
576	glow::DEPTH_ATTACHMENT,
577	glow::RENDERBUFFER,
578	Some(d),
579	);
580	gl.draw_buffers(&[
581	glow::COLOR_ATTACHMENT0,
582	glow::COLOR_ATTACHMENT1,
583	glow::COLOR_ATTACHMENT2,
584	]);
585	if gl.check_framebuffer_status(glow::FRAMEBUFFER) != glow::FRAMEBUFFER_COMPLETE {
586	return Err("productie-FBO onvolledig".into());
587	}
588	self.extent = [w, h];
589	Ok(())
590	}
591	/// Render and read back unlit color, view-space normals, scalar specular and
592	/// the actual depth attachment. All four use the same winning surface.
593	/// # Safety
594	/// `gl` is current on the UI thread. GL state is reset for egui painting.
595	pub unsafe fn render(&mut self, gl: &glow::Context, scene: &Scene) -> Result<Buffers, String> {
596	if scene.width == 0
597	\|\| scene.height == 0
598	\|\| scene.width > MAX_HIGHRES
599	\|\| scene.height > MAX_HIGHRES
600	{
601	return Err("highres moet 1–2048 pixels zijn (8× target)".into());
602	}
603	scene.validate()?;
604	let previous = gl.get_parameter_i32(glow::FRAMEBUFFER_BINDING);
605	let mut vp = [0; 4];
606	gl.get_parameter_i32_slice(glow::VIEWPORT, &mut vp);
607	let result = (\|\| {
608	self.init(gl)?;
609	self.target(gl, scene.width, scene.height)?;
610	gl.bind_framebuffer(glow::FRAMEBUFFER, self.fbo);
611	gl.draw_buffers(&[
612	glow::COLOR_ATTACHMENT0,
613	glow::COLOR_ATTACHMENT1,
614	glow::COLOR_ATTACHMENT2,
615	]);
616	gl.viewport(0, 0, scene.width as i32, scene.height as i32);
617	gl.disable(glow::SCISSOR_TEST);
618	gl.disable(glow::CULL_FACE);
619	gl.disable(glow::BLEND);
620	gl.enable(glow::DEPTH_TEST);
621	gl.depth_mask(true);
622	gl.depth_func(glow::LESS);
623	// Geometry outside the fixed per-sex interval is clamped, not clipped
624	// away; production counts and reports clamped coverage.
625	gl.enable(glow::DEPTH_CLAMP);
626	gl.clear_depth_f32(1.);
627	gl.clear_color(0., 0., 0., 0.);
628	gl.clear(glow::COLOR_BUFFER_BIT \| glow::DEPTH_BUFFER_BIT);
629	let p = self.program.ok_or("shader ontbreekt")?;
630	gl.use_program(Some(p));
631	gl.uniform_matrix_4_f32_slice(
632	gl.get_uniform_location(p, "u_view").as_ref(),
633	false,
634	&scene.view,
635	);
636	gl.uniform_matrix_4_f32_slice(
637	gl.get_uniform_location(p, "u_projection").as_ref(),
638	false,
639	&scene.projection,
640	);
641	gl.bind_vertex_array(self.vao);
642	gl.bind_buffer(glow::ARRAY_BUFFER, self.vbo);
643	gl.bind_buffer(glow::ELEMENT_ARRAY_BUFFER, self.ebo);
644	for (slot, size, offset) in [(0, 3, 0), (1, 3, 3), (2, 2, 6), (3, 4, 8)] {
645	gl.enable_vertex_attrib_array(slot);
646	gl.vertex_attrib_pointer_f32(slot, size, glow::FLOAT, false, 12 * 4, offset * 4);
647	}
648	for draw in &scene.draws {
649	if draw.positions.len() != draw.normals.len()
650	\|\| draw
651	.indices
652	.iter()
653	.any(\|i\| *i as usize >= draw.positions.len())
654	\|\| draw.indices.len() > i32::MAX as usize
655	{
656	return Err("ongeldige GPU-geometrie".into());
657	}
658	let mut data = Vec::with_capacity(draw.positions.len() * 12);
659	for (i, pos) in draw.positions.iter().enumerate() {
660	data.extend_from_slice(pos);
661	data.extend_from_slice(&draw.normals[i]);
662	data.extend_from_slice(&draw.uvs.get(i).copied().unwrap_or([0.; 2]));
663	data.extend_from_slice(&draw.vertex_colors.get(i).copied().unwrap_or([1.; 4]));
664	}
665	gl.buffer_data_u8_slice(
666	glow::ARRAY_BUFFER,
667	std::slice::from_raw_parts(data.as_ptr().cast(), data.len() * 4),
668	glow::STREAM_DRAW,
669	);
670	gl.buffer_data_u8_slice(
671	glow::ELEMENT_ARRAY_BUFFER,
672	std::slice::from_raw_parts(
673	draw.indices.as_ptr().cast(),
674	draw.indices.len() * 4,
675	),
676	glow::STREAM_DRAW,
677	);
678	gl.uniform_4_f32(
679	gl.get_uniform_location(p, "u_color").as_ref(),
680	draw.color[0],
681	draw.color[1],
682	draw.color[2],
683	draw.color[3],
684	);
685	gl.uniform_1_f32(
686	gl.get_uniform_location(p, "u_specular").as_ref(),
687	draw.specular,
688	);
689	gl.uniform_1_f32(gl.get_uniform_location(p, "u_cutoff").as_ref(), draw.cutoff);
690	gl.uniform_1_i32(
691	gl.get_uniform_location(p, "u_flat").as_ref(),
692	i32::from(draw.flat_normals),
693	);
694	let mut temp = Vec::new();
695	for (unit, name, texture) in [
696	(0, "u_albedo", draw.albedo.as_ref()),
697	(1, "u_shiny", draw.shiny.as_ref()),
698	] {
699	gl.active_texture(glow::TEXTURE0 + unit);
700	gl.uniform_1_i32(gl.get_uniform_location(p, name).as_ref(), unit as i32);
701	gl.uniform_1_i32(
702	gl.get_uniform_location(p, &format!("{name}_enabled"))
703	.as_ref(),
704	i32::from(texture.is_some()),
705	);
706	if let Some(image) = texture {
707	let t = gl.create_texture()?;
708	temp.push(t);
709	gl.bind_texture(glow::TEXTURE_2D, Some(t));
710	gl.tex_parameter_i32(
711	glow::TEXTURE_2D,
712	glow::TEXTURE_MIN_FILTER,
713	glow::NEAREST as i32,
714	);
715	gl.tex_parameter_i32(
716	glow::TEXTURE_2D,
717	glow::TEXTURE_MAG_FILTER,
718	glow::NEAREST as i32,
719	);
720	gl.tex_parameter_i32(
721	glow::TEXTURE_2D,
722	glow::TEXTURE_WRAP_S,
723	glow::REPEAT as i32,
724	);
725	gl.tex_parameter_i32(
726	glow::TEXTURE_2D,
727	glow::TEXTURE_WRAP_T,
728	glow::REPEAT as i32,
729	);
730	gl.tex_image_2d(
731	glow::TEXTURE_2D,
732	0,
733	if unit == 0 {
734	glow::SRGB8_ALPHA8 as i32
735	} else {
736	glow::RGBA8 as i32
737	},
738	image.width as i32,
739	image.height as i32,
740	0,
741	glow::RGBA,
742	glow::UNSIGNED_BYTE,
743	Some(&image.rgba),
744	);
745	} else {
746	gl.bind_texture(glow::TEXTURE_2D, None);
747	}
748	}
749	gl.draw_elements(
750	glow::TRIANGLES,
751	draw.indices.len() as i32,
752	glow::UNSIGNED_INT,
753	0,
754	);
755	for t in temp {
756	gl.delete_texture(t);
757	}
758	}
759	let pixels = scene.width as usize * scene.height as usize;
760	let mut maps = Vec::new();
761	gl.pixel_store_i32(glow::PACK_ALIGNMENT, 1);
762	for slot in 0..3 {
763	let mut data = vec![0; pixels * 4];
764	gl.read_buffer(glow::COLOR_ATTACHMENT0 + slot);
765	gl.read_pixels(
766	0,
767	0,
768	scene.width as i32,
769	scene.height as i32,
770	glow::RGBA,
771	glow::UNSIGNED_BYTE,
772	glow::PixelPackData::Slice(&mut data),
773	);
774	flip_rows(&mut data, scene.width as usize * 4, scene.height as usize);
775	maps.push(data);
776	}
777	let mut depth = vec![1f32; pixels];
778	let bytes = std::slice::from_raw_parts_mut(depth.as_mut_ptr().cast(), pixels * 4);
779	gl.read_pixels(
780	0,
781	0,
782	scene.width as i32,
783	scene.height as i32,
784	glow::DEPTH_COMPONENT,
785	glow::FLOAT,
786	glow::PixelPackData::Slice(bytes),
787	);
788	flip_rows(&mut depth, scene.width as usize, scene.height as usize);
789	let error = gl.get_error();
790	if error != glow::NO_ERROR {
791	return Err(format!("productie-GL fout 0x{error:x}"));
792	}
793	let specular = maps.pop().unwrap();
794	let normal = maps.pop().unwrap();
795	let diffuse = maps.pop().unwrap();
796	Ok(Buffers {
797	width: scene.width,
798	height: scene.height,
799	diffuse,
800	normal,
801	specular,
802	depth,
803	})
804	})();
805	gl.bind_framebuffer(
806	glow::FRAMEBUFFER,
807	std::num::NonZeroU32::new(previous as u32).map(glow::NativeFramebuffer),
808	);
809	gl.viewport(vp[0], vp[1], vp[2], vp[3]);
810	gl.bind_vertex_array(None);
811	gl.use_program(None);
812	gl.active_texture(glow::TEXTURE0);
813	gl.disable(glow::DEPTH_TEST);
814	gl.disable(glow::DEPTH_CLAMP);
815	gl.disable(glow::SCISSOR_TEST);
816	gl.enable(glow::BLEND);
817	gl.pixel_store_i32(glow::PACK_ALIGNMENT, 4);
818	result
819	}
820	}
821	/// Covered highres pixels whose depth hit the fixed interval's near or far
822	/// plane (GL depth clamp), i.e. geometry outside `[depth_near, depth_far]`.
823	pub fn clamped_depth_pixels(raw: &Buffers) -> usize {
824	raw.depth
825	.iter()
826	.enumerate()
827	.filter(\|(i, d)\| {
828	raw.diffuse.get(i * 4 + 3).is_some_and(\|a\| a > 0) && (d <= 0. \|\| *d >= 1.)
829	})
830	.count()
831	}
832	fn flip_rows<T>(data: &mut [T], stride: usize, height: usize) {
833	for y in 0..height / 2 {
834	let split = (height - 1 - y) * stride;
835	let (a, b) = data.split_at_mut(split);
836	a[y * stride..(y + 1) * stride].swap_with_slice(&mut b[..stride]);
837	}
838	}
839	const VERTEX: &str = r#"#version 330
840	layout(location=0)in vec3 a_position;layout(location=1)in vec3 a_normal;layout(location=2)in vec2 a_uv;layout(location=3)in vec4 a_color;
841	uniform mat4 u_view;uniform mat4 u_projection;out vec3 v_normal;out vec3 v_view_position;out vec2 v_uv;out vec4 v_color;
842	void main(){v_color=a_color;v_normal=mat3(u_view)a_normal;v_uv=a_uv;vec4 position=u_viewvec4(a_position,1.0);v_view_position=position.xyz;gl_Position=u_projection*position;}
843	"#;
844	const FRAGMENT: &str = r#"#version 330
845	in vec3 v_normal;in vec3 v_view_position;uniform bool u_flat;in vec2 v_uv;in vec4 v_color;uniform vec4 u_color;uniform float u_cutoff;uniform vec3 u_light_direction; // deliberately unused: production maps are unlit
846	uniform float u_specular;
847	uniform sampler2D u_albedo;uniform sampler2D u_shiny;uniform bool u_albedo_enabled;uniform bool u_shiny_enabled;
848	layout(location=0)out vec4 diffuse;layout(location=1)out vec4 normal;layout(location=2)out vec4 specular;
849	vec3 encode_srgb(vec3 x){return mix(x12.92,1.055pow(max(x,vec3(0.0)),vec3(1.0/2.4))-0.055,step(vec3(0.0031308),x));}
850	void main(){vec3 n=normalize(v_normal);if(u_flat){n=normalize(cross(dFdx(v_view_position),dFdy(v_view_position)));if(!gl_FrontFacing)n=-n;}vec4 c=u_colorv_color;if(u_albedo_enabled)c=texture(u_albedo,v_uv);if(c.a<u_cutoff)discard;float s=u_specular;if(u_shiny_enabled)s=dot(texture(u_shiny,v_uv).rgb,vec3(0.2126,0.7152,0.0722));diffuse=vec4(encode_srgb(clamp(c.rgb,0.0,1.0)),c.a);normal=vec4(n0.5+0.5,c.a);specular=vec4(vec3(clamp(s,0.0,1.0)),c.a);}
851	"#;
852
853	fn image(w: u32, h: u32, rgba: Vec<u8>) -> ImageBuf {
854	ImageBuf {
855	width: w,
856	height: h,
857	rgba,
858	}
859	}
860	fn linear(x: u8) -> f32 {
861	static LUT: std::sync::OnceLock<[f32; 256]> = std::sync::OnceLock::new();
862	LUT.get_or_init(\|\| {
863	std::array::from_fn(\|i\| {
864	let v = i as f32 / 255.;
865	if v <= 0.04045 {
866	v / 12.92
867	} else {
868	((v + 0.055) / 1.055).powf(2.4)
869	}
870	})
871	})[x as usize]
872	}
873
874	fn srgb(x: f32) -> u8 {
875	let v = if x <= 0.0031308 {
876	x * 12.92
877	} else {
878	1.055 * x.powf(1. / 2.4) - 0.055
879	};
880	(v * 255.).round().clamp(0., 255.) as u8
881	}
882	impl Buffers {
883	pub fn validate(&self) -> Result<(), String> {
884	let pixels = (self.width as usize)
885	.checked_mul(self.height as usize)
886	.ok_or("te veel pixels")?;
887	if self.width == 0
888	\|\| self.height == 0
889	\|\| self.width > MAX_HIGHRES
890	\|\| self.height > MAX_HIGHRES
891	\|\| self.diffuse.len() != pixels * 4
892	\|\| self.normal.len() != pixels * 4
893	\|\| self.specular.len() != pixels * 4
894	\|\| self.depth.len() != pixels
895	\|\| self
896	.depth
897	.iter()
898	.any(\|d\| !d.is_finite() \|\| !(0.0..=1.0).contains(d))
899	{
900	return Err("ongeldige GPU-mapafmetingen/data".into());
901	}
902	Ok(())
903	}
904	}
905	pub fn detail_map(raw: &Buffers) -> Result<Vec<u8>, String> {
906	raw.validate()?;
907	let w = raw.width as usize;
908	let h = raw.height as usize;
909	let mut out = vec![0; w * h];
910	for y in 0..h {
911	for x in 0..w {
912	let i = y * w + x;
913	let mut edge = 0f32;
914	for (nx, ny) in [
915	(x.saturating_sub(1), y),
916	((x + 1).min(w - 1), y),
917	(x, y.saturating_sub(1)),
918	(x, (y + 1).min(h - 1)),
919	] {
920	let j = ny * w + nx;
921	let a = raw.diffuse[i * 4 + 3] as f32 / 255.;
922	let b = raw.diffuse[j * 4 + 3] as f32 / 255.;
923	edge = edge.max((a - b).abs());
924	if a > 0. && b > 0. {
925	for c in 0..3 {
926	edge = edge.max(
927	(linear(raw.diffuse[i * 4 + c]) - linear(raw.diffuse[j * 4 + c])).abs(),
928	);
929	edge = edge.max(
930	(raw.normal[i * 4 + c] as f32 - raw.normal[j * 4 + c] as f32).abs()
931	/ 255.,
932	);
933	}
934	edge = edge.max(((raw.depth[i] - raw.depth[j]).abs() * 200.).min(1.));
935	}
936	}
937	out[i] = (edge * 255.).round().clamp(0., 255.) as u8;
938	}
939	}
940	Ok(out)
941	}
942	pub fn detail_image(raw: &Buffers, detail: &[u8]) -> ImageBuf {
943	let mut rgba = Vec::with_capacity(detail.len() * 4);
944	for (i, v) in detail.iter().enumerate() {
945	rgba.extend_from_slice(&[v, v, v, raw.diffuse[i 4 + 3]]);
946	}
947	image(raw.width, raw.height, rgba)
948	}
949	pub fn resolve(raw: &Buffers, detail: &[u8], w: u32, h: u32) -> Result<Target, String> {
950	raw.validate()?;
951	if w == 0 \|\| h == 0 \|\| w > MAX_HIGHRES / SCALE \|\| h > MAX_HIGHRES / SCALE {
952	return Err("ongeldige target-afmetingen".into());
953	}
954	if raw.width != w * SCALE
955	\|\| raw.height != h * SCALE
956	\|\| detail.len() != raw.width as usize * raw.height as usize
957	{
958	return Err("ongeldige 8× resolve-afmetingen".into());
959	}
960	let count = w as usize * h as usize;
961	let mut diffuse = vec![0; count * 4];
962	let mut normals = diffuse.clone();
963	let mut specular = diffuse.clone();
964	let mut depth = vec![0u16; count * 2];
965	let mut depth_t = vec![0f32; count];
966	let mut depth_preview = diffuse.clone();
967	for y in 0..h {
968	for x in 0..w {
969	let i = (y * w + x) as usize;
970	let mut closest = 1f32;
971	let mut coverage = 0f32;
972	for dy in 0..SCALE {
973	for dx in 0..SCALE {
974	let j = ((y * SCALE + dy) * raw.width + x * SCALE + dx) as usize;
975	let a = raw.diffuse[j * 4 + 3] as f32 / 255.;
976	coverage += a;
977	if a > 0. && raw.depth[j].is_finite() {
978	closest = closest.min(raw.depth[j]);
979	}
980	}
981	}
982	let alpha = (coverage / (SCALE * SCALE) as f32 * 255.)
983	.round()
984	.clamp(0., 255.) as u8;
985	if alpha == 0 {
986	continue;
987	}
988	let mut color = [0.; 3];
989	let mut n = [0.; 3];
990	let mut shiny = 0.;
991	let mut sum = 0.;
992	// One coherent front-surface cluster; never average foreground with a rear
993	// surface. Edges get extra weight, and any thin covered feature survives.
994	for dy in 0..SCALE {
995	for dx in 0..SCALE {
996	let j = ((y * SCALE + dy) * raw.width + x * SCALE + dx) as usize;
997	let a = raw.diffuse[j * 4 + 3] as f32 / 255.;
998	if a == 0. \|\| raw.depth[j] > closest + 0.0025 {
999	continue;
1000	}
1001	let weight = a * (1. + 4. * detail[j] as f32 / 255.);
1002	sum += weight;
1003	for c in 0..3 {
1004	color[c] += linear(raw.diffuse[j * 4 + c]) * weight;
1005	n[c] += (raw.normal[j * 4 + c] as f32 / 255. * 2. - 1.) * weight;
1006	}
1007	shiny += raw.specular[j * 4] as f32 * weight;
1008	}
1009	}
1010	if sum <= 0. {
1011	return Err("ongeldige depth/coverage in GPU-resultaat".into());
1012	}
1013	n = normalize(n);
1014	let d = (closest.clamp(0., 1.) * 65535.).round() as u16;
1015	for c in 0..3 {
1016	diffuse[i * 4 + c] = srgb(color[c] / sum);
1017	normals[i * 4 + c] = ((n[c] * 0.5 + 0.5) * 255.).round().clamp(0., 255.) as u8;
1018	specular[i * 4 + c] = (shiny / sum).round().clamp(0., 255.) as u8;
1019	depth_preview[i * 4 + c] = (d >> 8) as u8;
1020	}
1021	for map in [
1022	&mut diffuse,
1023	&mut normals,
1024	&mut specular,
1025	&mut depth_preview,
1026	] {
1027	map[i * 4 + 3] = alpha;
1028	}
1029	depth[i * 2] = d;
1030	depth_t[i] = closest.clamp(0., 1.);
1031	depth[i * 2 + 1] = u16::from(alpha) * 257;
1032	}
1033	}
1034	Ok(Target {
1035	diffuse: image(w, h, diffuse),
1036	normal: image(w, h, normals),
1037	specular: image(w, h, specular),
1038	depth,
1039	depth_t,
1040	depth_preview: image(w, h, depth_preview),
1041	})
1042	}
1043
1044	fn safe_parent(root: &Path, relative: &Path) -> Result<PathBuf, String> {
1045	let relative = relative
1046	.to_str()
1047	.ok_or("ongeldig uitvoerpad")?
1048	.replace('\\', "/");
1049	let relative = crate::project::portable_relative(&relative)?;
1050	let relative = relative.as_str();
1051	let canonical = root.canonicalize().map_err(\|e\| e.to_string())?;
1052	let path = root.join(relative);
1053	let parent = path.parent().ok_or("uitvoermap ontbreekt")?;
1054	let mut prefix = root.to_path_buf();
1055	for part in Path::new(relative)
1056	.parent()
1057	.unwrap_or(Path::new(""))
1058	.components()
1059	{
1060	prefix.push(part);
1061	if !prefix.exists() {
1062	std::fs::create_dir(&prefix).map_err(\|e\| e.to_string())?;
1063	}
1064	let real = prefix.canonicalize().map_err(\|e\| e.to_string())?;
1065	if !real.starts_with(&canonical) {
1066	return Err("uitvoer verlaat projectmap".into());
1067	}
1068	}
1069	if !parent
1070	.canonicalize()
1071	.map_err(\|e\| e.to_string())?
1072	.starts_with(canonical)
1073	{
1074	return Err("onveilig uitvoerpad".into());
1075	}
1076	Ok(path)
1077	}
1078	pub(crate) fn atomic_file(
1079	root: &Path,
1080	relative: &Path,
1081	write: impl FnOnce(&mut std::fs::File) -> Result<(), String>,
1082	) -> Result<(), String> {
1083	let path = safe_parent(root, relative)?;
1084	static TEMP_SEQ: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
1085	let temp = path.with_extension(format!(
1086	"part-{}-{}",
1087	std::process::id(),
1088	TEMP_SEQ.fetch_add(1, Ordering::Relaxed)
1089	));
1090	let mut owned = false;
1091	let result = (\|\| {
1092	let mut file = std::fs::OpenOptions::new()
1093	.write(true)
1094	.create_new(true)
1095	.open(&temp)
1096	.map_err(\|e\| e.to_string())?;
1097	owned = true;
1098	write(&mut file)?;
1099	file.sync_all().map_err(\|e\| e.to_string())?;
1100	std::fs::hard_link(&temp, &path).map_err(\|e\| e.to_string())?;
1101	Ok(())
1102	})();
1103	if owned {
1104	let _ = std::fs::remove_file(temp);
1105	}
1106	result
1107	}
1108	fn encode_rgba_png(img: &ImageBuf, diffuse_srgb: bool) -> Result<Vec<u8>, String> {
1109	if img.width == 0
1110	\|\| img.height == 0
1111	\|\| img.width > MAX_HIGHRES / SCALE
1112	\|\| img.height > MAX_HIGHRES / SCALE
1113	\|\| img.rgba.len() != img.width as usize * img.height as usize * 4
1114	{
1115	return Err("ongeldige PNG-afmetingen".into());
1116	}
1117	let mut cursor = std::io::Cursor::new(Vec::new());
1118	{
1119	let mut encoder = png::Encoder::new(&mut cursor, img.width, img.height);
1120	encoder.set_color(png::ColorType::Rgba);
1121	encoder.set_depth(png::BitDepth::Eight);
1122	if diffuse_srgb {
1123	encoder.set_source_srgb(png::SrgbRenderingIntent::Perceptual);
1124	}
1125	let mut writer = encoder.write_header().map_err(\|e\| e.to_string())?;
1126	writer
1127	.write_image_data(&img.rgba)
1128	.map_err(\|e\| e.to_string())?;
1129	writer.finish().map_err(\|e\| e.to_string())?;
1130	}
1131	Ok(cursor.into_inner())
1132	}
1133
1134	fn encode_depth_png(w: u32, h: u32, depth: &[u16]) -> Result<Vec<u8>, String> {
1135	if w == 0
1136	\|\| h == 0
1137	\|\| w > MAX_HIGHRES / SCALE
1138	\|\| h > MAX_HIGHRES / SCALE
1139	\|\| depth.len() != w as usize * h as usize * 2
1140	{
1141	return Err("ongeldige 16-bit depthafmetingen".into());
1142	}
1143	let samples: Vec<u8> = depth.iter().flat_map(\|x\| x.to_be_bytes()).collect();
1144	let mut cursor = std::io::Cursor::new(Vec::new());
1145	{
1146	let mut encoder = png::Encoder::new(&mut cursor, w, h);
1147	encoder.set_color(png::ColorType::GrayscaleAlpha);
1148	encoder.set_depth(png::BitDepth::Sixteen);
1149	let mut writer = encoder.write_header().map_err(\|e\| e.to_string())?;
1150	writer
1151	.write_image_data(&samples)
1152	.map_err(\|e\| e.to_string())?;
1153	writer.finish().map_err(\|e\| e.to_string())?;
1154	}
1155	Ok(cursor.into_inner())
1156	}
1157
1158	/// Atomically publish an RGBA8 target PNG; returns the SHA-256 hex of the file bytes.
1159	pub fn write_rgba(root: &Path, relative: &Path, img: &ImageBuf) -> Result<String, String> {
1160	let diffuse_srgb = relative
1161	.file_name()
1162	.and_then(\|p\| p.to_str())
1163	.map(\|p\| p.ends_with("_diffuse.png"))
1164	.unwrap_or(false);
1165	let bytes = encode_rgba_png(img, diffuse_srgb)?;
1166	let digest = crate::digest::sha256_hex(&bytes);
1167	atomic_file(root, relative, \|file\| {
1168	use std::io::Write;
1169	file.write_all(&bytes).map_err(\|e\| e.to_string())
1170	})?;
1171	Ok(digest)
1172	}
1173
1174	/// Atomically publish a 16-bit gray+alpha depth PNG; returns SHA-256 hex.
1175	/// Encode depth pixels `(t, alpha)` (both 0..1) as a PNG in `fmt`.
1176	pub fn encode_depth_png_fmt(
1177	w: u32,
1178	h: u32,
1179	pixels: &[(f64, f64)],
1180	fmt: crate::camera::DepthFormat,
1181	) -> Result<Vec<u8>, String> {
1182	if w == 0 \|\| h == 0 \|\| pixels.len() != w as usize * h as usize {
1183	return Err("ongeldige depthafmetingen".into());
1184	}
1185	let mut samples = Vec::with_capacity(pixels.len() * fmt.bytes_per_pixel());
1186	for &(t, a) in pixels {
1187	// Transparent pixels carry no depth (alpha rule of the map contract).
1188	let t = if a > 0. { t } else { 0. };
1189	fmt.encode_pixel(t, a, &mut samples);
1190	}
1191	let mut cursor = std::io::Cursor::new(Vec::new());
1192	{
1193	let mut encoder = png::Encoder::new(&mut cursor, w, h);
1194	encoder.set_color(fmt.color_type());
1195	encoder.set_depth(fmt.bit_depth());
1196	let mut writer = encoder.write_header().map_err(\|e\| e.to_string())?;
1197	writer
1198	.write_image_data(&samples)
1199	.map_err(\|e\| e.to_string())?;
1200	writer.finish().map_err(\|e\| e.to_string())?;
1201	}
1202	Ok(cursor.into_inner())
1203	}
1204
1205	/// Atomically publish a depth PNG in `fmt` from `(t, alpha)` pixels; returns SHA-256 hex.
1206	pub fn write_depth_fmt(
1207	root: &Path,
1208	relative: &Path,
1209	w: u32,
1210	h: u32,
1211	pixels: &[(f64, f64)],
1212	fmt: crate::camera::DepthFormat,
1213	) -> Result<String, String> {
1214	let bytes = encode_depth_png_fmt(w, h, pixels, fmt)?;
1215	let digest = crate::digest::sha256_hex(&bytes);
1216	atomic_file(root, relative, \|file\| {
1217	use std::io::Write;
1218	file.write_all(&bytes).map_err(\|e\| e.to_string())
1219	})?;
1220	Ok(digest)
1221	}
1222
1223	pub fn write_depth(
1224	root: &Path,
1225	relative: &Path,
1226	w: u32,
1227	h: u32,
1228	depth: &[u16],
1229	) -> Result<String, String> {
1230	let bytes = encode_depth_png(w, h, depth)?;
1231	let digest = crate::digest::sha256_hex(&bytes);
1232	atomic_file(root, relative, \|file\| {
1233	use std::io::Write;
1234	file.write_all(&bytes).map_err(\|e\| e.to_string())
1235	})?;
1236	Ok(digest)
1237	}
1238
1239	/// Atomic no-clobber publication of already encoded bytes under the run root.
1240	pub fn publish_bytes(root: &Path, relative: &Path, bytes: &[u8]) -> Result<(), String> {
1241	atomic_file(root, relative, \|file\| {
1242	use std::io::Write;
1243	file.write_all(bytes).map_err(\|e\| e.to_string())
1244	})
1245	}
1246
1247	fn write_json(root: &Path, name: &str, value: serde_json::Value) -> Result<(), String> {
1248	use std::io::Write;
1249	let data = serde_json::to_vec_pretty(&value).map_err(\|e\| e.to_string())?;
1250	atomic_file(root, Path::new(name), \|f\| {
1251	f.write_all(&data).map_err(\|e\| e.to_string())
1252	})
1253	}
1254
1255	pub struct GpuRequest {
1256	pub scene: Scene,
1257	reply: mpsc::SyncSender<Result<Buffers, String>>,
1258	}
1259	impl GpuRequest {
1260	pub fn fail(self, error: String) {
1261	let _ = self.reply.send(Err(error));
1262	}
1263	/// # Safety
1264	/// `gl` must be current on this UI thread.
1265	pub unsafe fn service(self, renderer: &mut GpuRenderer, gl: &glow::Context) {
1266	let result = renderer.render(gl, &self.scene);
1267	let _ = self.reply.send(result);
1268	}
1269	}
1270	#[derive(Default)]
1271	struct Pending {
1272	pass: Option<RenderEvent>,
1273	progress: Option<RenderEvent>,
1274	terminal: Option<RenderEvent>,
1275	}
1276	#[derive(Clone, Default)]
1277	pub struct Mailbox(Arc<Mutex<Pending>>);
1278	impl Mailbox {
1279	pub fn publish(&self, event: RenderEvent) {
1280	if let Ok(mut state) = self.0.lock() {
1281	match event {
1282	RenderEvent::Pass { .. } => {
1283	state.pass = Some(event);
1284	state.progress = None;
1285	}
1286	RenderEvent::Step { .. } => state.progress = Some(event),
1287	_ => state.terminal = Some(event),
1288	}
1289	}
1290	}
1291	pub fn drain(&self) -> Vec<RenderEvent> {
1292	let mut events = Vec::new();
1293	if let Ok(mut s) = self.0.lock() {
1294	events.extend(s.pass.take());
1295	events.extend(s.progress.take());
1296	events.extend(s.terminal.take());
1297	}
1298	events
1299	}
1300	}
1301	pub struct RenderThread {
1302	pub mailbox: Mailbox,
1303	pub gpu: mpsc::Receiver<GpuRequest>,
1304	pub cancel: Arc<AtomicBool>,
1305	pub handle: Option<thread::JoinHandle<()>>,
1306	}
1307	impl Drop for RenderThread {
1308	fn drop(&mut self) {
1309	self.cancel.store(true, Ordering::Relaxed);
1310	}
1311	}
1312	/// Where a production batch writes: a fresh run directory, or an existing
1313	/// incomplete run that is recovered after contract and checksum verification.
1314	#[derive(Debug, Clone, PartialEq, Eq)]
1315	pub enum RunTarget {
1316	Fresh,
1317	Resume(PathBuf),
1318	}
1319
1320	pub fn spawn(job: RenderJob, ctx: Option<eframe::egui::Context>) -> RenderThread {
1321	spawn_target(job, RunTarget::Fresh, ctx)
1322	}
1323
1324	/// Resume a selected incomplete run (see `resume`).
1325	pub fn spawn_resume(
1326	job: RenderJob,
1327	run_dir: PathBuf,
1328	ctx: Option<eframe::egui::Context>,
1329	) -> RenderThread {
1330	spawn_target(job, RunTarget::Resume(run_dir), ctx)
1331	}
1332
1333	fn spawn_target(
1334	job: RenderJob,
1335	target: RunTarget,
1336	ctx: Option<eframe::egui::Context>,
1337	) -> RenderThread {
1338	let mailbox = Mailbox::default();
1339	let output = mailbox.clone();
1340	let cancel = Arc::new(AtomicBool::new(false));
1341	let flag = cancel.clone();
1342	let (tx, gpu) = mpsc::channel();
1343	let handle = thread::spawn(move \|\| {
1344	let mut emit = \|event\| {
1345	output.publish(event);
1346	if let Some(ctx) = &ctx {
1347	ctx.request_repaint();
1348	}
1349	};
1350	let result = execute_target(job, target, &tx, &flag, ctx.as_ref(), &mut emit);
1351	if let Err(error) = result {
1352	if flag.load(Ordering::Relaxed) {
1353	emit(RenderEvent::Cancelled);
1354	} else {
1355	emit(RenderEvent::Failed(error));
1356	}
1357	}
1358	});
1359	RenderThread {
1360	mailbox,
1361	gpu,
1362	cancel,
1363	handle: Some(handle),
1364	}
1365	}
1366
1367	/// The immutable export contract of a job: validated/resolved job, plan,
1368	/// set token and the exact `render.json` document.
1369	pub struct Contract {
1370	pub job: RenderJob,
1371	pub plan: Plan,
1372	pub set: String,
1373	pub render_doc: serde_json::Value,
1374	}
1375
1376	/// Validate a job and build its `render.json` contract without touching disk.
1377	pub fn contract(mut job: RenderJob) -> Result<Contract, String> {
1378	job.framing.validate()?;
1379	crate::camera::DepthFormat::new(job.depth_format.bits, job.depth_format.encoding)?;
1380	let pivot = crate::camera::resolve(&job.character, job.framing);
1381	job.framing = pivot.framing;
1382	if job.target_width == 0
1383	\|\| job.target_height == 0
1384	\|\| job.target_width > MAX_HIGHRES / SCALE
1385	\|\| job.target_height > MAX_HIGHRES / SCALE
1386	{
1387	return Err("8× highres vereist targetafmetingen 1–256".into());
1388	}
1389	if !["male", "female"].contains(&job.sex.as_str()) {
1390	return Err("ongeldig geslacht".into());
1391	}
1392	if let Some(p) = &job.preset {
1393	if job.character.is_static() {
1394	return Err(
1395	"statisch lichaam zonder skeleton: equipment kan niet aan een bot hangen".into(),
1396	);
1397	}
1398	p.validate()?;
1399	if !p.applies[usize::from(job.sex == "female")] {
1400	return Err("equipment niet geldig voor dit geslacht".into());
1401	}
1402	if p.attachments.is_empty() {
1403	return Err("equipment heeft geen onderdelen".into());
1404	}
1405	}
1406	let plan = plan(&job.character, job.fps)?;
1407	let output_bytes =
1408	u64::from(plan.images) * u64::from(job.target_width) * u64::from(job.target_height) * 16;
1409	if output_bytes > 16 * 1024 * 1024 * 1024 {
1410	return Err("batch groter dan 16 GiB ongecomprimeerde targetmaps".into());
1411	}
1412	let set = job
1413	.preset
1414	.as_ref()
1415	.map(\|p\| p.name.as_str())
1416	.unwrap_or("body")
1417	.to_string();
1418	// Refuse up front when the per-map atlas would exceed the PNG/GPU limit,
1419	// instead of rendering for hours and failing (or splitting) at the end.
1420	crate::atlas::AtlasLayout::for_plan(&plan, job.target_width, job.target_height)?;
1421	if job.project_id.is_empty() \|\| job.project_id.len() > 128 {
1422	return Err("project.id ongeldig voor export-identiteit".into());
1423	}
1424	if job.project_name.len() > 256 {
1425	return Err("project.name te lang voor export-identiteit".into());
1426	}
1427	if !crate::digest::is_sha256_hex(&job.body_model.sha256) {
1428	return Err("body_model.sha256 ongeldig".into());
1429	}
1430	crate::project::portable_relative(&job.body_model.path)?;
1431	match (&job.preset, &job.preset_sha256) {
1432	(None, None) => {}
1433	(Some(p), Some(hash)) if p.name == set && crate::digest::is_sha256_hex(hash) => {}
1434	_ => return Err("equipment fingerprint past niet bij de job".into()),
1435	}
1436	let equipment_preset = job.preset.as_ref().map(\|p\| {
1437	serde_json::json!({
1438	"name": p.name,
1439	"sha256": job.preset_sha256.as_ref().expect("checked"),
1440	})
1441	});
1442	let clips_json = plan
1443	.clips
1444	.iter()
1445	.enumerate()
1446	.map(\|(i, c)\| {
1447	serde_json::json!({
1448	"name": c.source_name,
1449	"token": c.token,
1450	"frames": c.frames,
1451	"duration": job.character.clips.get(i).map(\|c\| c.duration).unwrap_or(0.),
1452	})
1453	})
1454	.collect::<Vec<_>>();
1455	let (depth_near, depth_far) = crate::camera::depth_range(job.framing);
1456	let render_doc = serde_json::json!({
1457	"format_version": crate::export_set::OUTPUT_META_VERSION,
1458	"status": "incomplete",
1459	"project": {"id": job.project_id, "name": job.project_name},
1460	"sex": job.sex,
1461	"set": set,
1462	"body_model": {"path": job.body_model.path, "sha256": job.body_model.sha256},
1463	"equipment_preset": equipment_preset,
1464	"target": [job.target_width, job.target_height],
1465	"fps": job.fps,
1466	"highres_scale": SCALE,
1467	"framing": job.framing,
1468	"pivot_source": pivot.source,
1469	"near": depth_near,
1470	"far": depth_far,
1471	"depth_near": depth_near,
1472	"depth_far": depth_far,
1473	"depth_encoding": job.depth_format.encoding.token(),
1474	"depth_bits": job.depth_format.bits,
1475	"normal_space": "view (+Y up), PNG rows top-down",
1476	"camera_distance": crate::camera::CAMERA_DISTANCE,
1477	"yaw_zero": "camera on -Z",
1478	"pitches": preview::PRODUCTION_PITCHES,
1479	"yaws": production_yaws(),
1480	"yaw_step": 30,
1481	"sampling": "clip -> frame (t=frame/fps) -> pitch -> yaw -> pass; ceil(durationfps) snapped within 4f32_epsilon*max(1,samples) of an integer to omit floating terminal duplicates; root motion retained",
1482	"alpha": "straight, opaque/cutout, coverage resolve",
1483	"diffuse": "unlit sRGB albedo × vertex color, linear-light detail resolve",
1484	"depth": job.depth_format.description(),
1485	"specular": "linear scalar; body defaults zero",
1486	"pass_order": PASSES,
1487	"saved_maps": ["diffuse", "depth", "normal", "specular"],
1488	"clips": clips_json,
1489	"images": plan.images,
1490	"passes": plan.passes,
1491	"png_files": plan.files,
1492	});
1493	Ok(Contract {
1494	job,
1495	plan,
1496	set,
1497	render_doc,
1498	})
1499	}
1500
1501	/// Saved map tokens in per-image publication order.
1502	pub const SAVED_ORDER: [&str; 4] = ["diffuse", "depth", "normal", "specular"];
1503
1504	/// Every planned target PNG (relative, `/`-separated) in render order, four per image.
1505	pub fn planned_paths(plan: &Plan, sex: &str, set: &str) -> Result<Vec<String>, String> {
1506	let mut out = Vec::with_capacity(plan.files as usize);
1507	for s in samples(plan) {
1508	for map in SAVED_ORDER {
1509	let path = output_path(
1510	sex,
1511	set,
1512	&plan.clips[s.clip].token,
1513	s.frame,
1514	s.pitch,
1515	s.yaw,
1516	map,
1517	)?;
1518	out.push(path.to_str().ok_or("ongeldig PNG-pad")?.replace('\\', "/"));
1519	}
1520	}
1521	Ok(out)
1522	}
1523
1524	#[cfg(test)]
1525	fn execute(
1526	job: RenderJob,
1527	gpu: &mpsc::Sender<GpuRequest>,
1528	cancel: &AtomicBool,
1529	ctx: Option<&eframe::egui::Context>,
1530	emit: &mut dyn FnMut(RenderEvent),
1531	) -> Result<(), String> {
1532	execute_target(job, RunTarget::Fresh, gpu, cancel, ctx, emit)
1533	}
1534
1535	fn execute_target(
1536	job: RenderJob,
1537	target: RunTarget,
1538	gpu: &mpsc::Sender<GpuRequest>,
1539	cancel: &AtomicBool,
1540	ctx: Option<&eframe::egui::Context>,
1541	emit: &mut dyn FnMut(RenderEvent),
1542	) -> Result<(), String> {
1543	let Contract {
1544	mut job,
1545	plan,
1546	set,
1547	render_doc,
1548	} = contract(job)?;
1549	let planned = planned_paths(&plan, &job.sex, &set)?;
1550	std::fs::create_dir_all(&job.output).map_err(\|e\| e.to_string())?;
1551	for note in crate::resume::recover(&job.output)? {
1552	emit(RenderEvent::Step {
1553	index: 0,
1554	total: plan.passes,
1555	label: format!("Herstel: {note}"),
1556	});
1557	}
1558	let mut session = match target {
1559	RunTarget::Fresh => {
1560	let stamp = std::time::SystemTime::now()
1561	.duration_since(std::time::UNIX_EPOCH)
1562	.map_err(\|e\| e.to_string())?
1563	.as_nanos();
1564	let root = job.output.join(crate::resume::in_progress_name(
1565	stamp,
1566	std::process::id(),
1567	&job.sex,
1568	&set,
1569	));
1570	std::fs::create_dir(&root).map_err(\|e\| e.to_string())?;
1571	let session = crate::resume::RunSession::fresh(&root)?;
1572	write_json(&root, "render.json", render_doc.clone())?;
1573	session
1574	}
1575	RunTarget::Resume(dir) => {
1576	let total = plan.passes;
1577	crate::resume::RunSession::resume(
1578	&job.output,
1579	&dir,
1580	&render_doc,
1581	&planned,
1582	&mut \|done, all\| {
1583	emit(RenderEvent::Step {
1584	index: 0,
1585	total,
1586	label: format!("Controle bestaande uitvoer: {done}/{all} PNG's"),
1587	})
1588	},
1589	)?
1590	}
1591	};
1592	let root = session.root.clone();
1593	// Internal unique names select every source clip, even duplicate display names.
1594	for (i, c) in job.character.clips.iter_mut().enumerate() {
1595	c.name = format!("render-clip-{i}");
1596	}
1597	let mut completed = 0u32;
1598	let mut clamped_views = 0u32;
1599	let mut clamped_pixels = 0u64;
1600	let mut png_sha256 = std::collections::BTreeMap::<String, String>::new();
1601	let mut cache = equipment::TextureCache::default();
1602	let result = (\|\| {
1603	for (index, sample) in samples(&plan).enumerate() {
1604	let clip = &plan.clips[sample.clip];
1605	let frame = sample.frame;
1606	let pitch = sample.pitch;
1607	let yaw = sample.yaw;
1608	let paths = &planned[index * 4..index * 4 + 4];
1609	if cancel.load(Ordering::Relaxed) {
1610	return Err("geannuleerd".into());
1611	}
1612	let pose = format!(
1613	"{} {set} · {} f{frame}/{} · p{pitch} y{yaw}",
1614	job.sex, clip.source_name, clip.frames
1615	);
1616	if paths.iter().all(\|p\| session.verified.contains_key(p)) {
1617	for p in paths {
1618	png_sha256.insert(p.clone(), session.verified[p].clone());
1619	}
1620	completed += PASSES.len() as u32;
1621	emit(RenderEvent::Step {
1622	index: completed,
1623	total: plan.passes,
1624	label: format!("{pose} · al aanwezig, checksums kloppen"),
1625	});
1626	continue;
1627	}
1628	let key = if job.character.clips.is_empty() {
1629	String::new()
1630	} else {
1631	format!("render-clip-{}", sample.clip)
1632	};
1633	emit(RenderEvent::Step {
1634	index: completed,
1635	total: plan.passes,
1636	label: format!("{pose} · highres"),
1637	});
1638	let scene = scene(
1639	&job,
1640	&key,
1641	frame as f32 / job.fps as f32,
1642	pitch as f32,
1643	yaw as f32,
1644	&mut cache,
1645	)?;
1646	let (tx, rx) = mpsc::sync_channel(1);
1647	gpu.send(GpuRequest { scene, reply: tx })
1648	.map_err(\|_\| "GPU-service gesloten")?;
1649	if let Some(ctx) = ctx {
1650	ctx.request_repaint();
1651	}
1652	let raw = loop {
1653	match rx.recv_timeout(std::time::Duration::from_millis(100)) {
1654	Ok(result) => break result?,
1655	Err(mpsc::RecvTimeoutError::Timeout) => {
1656	if cancel.load(Ordering::Relaxed) {
1657	return Err("geannuleerd".into());
1658	}
1659	}
1660	Err(_) => return Err("GPU-service gestopt".into()),
1661	}
1662	};
1663	let clamped = clamped_depth_pixels(&raw);
1664	if clamped > 0 {
1665	clamped_views += 1;
1666	clamped_pixels += clamped as u64;
1667	emit(RenderEvent::Step {
1668	index: completed,
1669	total: plan.passes,
1670	label: format!(
1671	"Waarschuwing: {pose} · {clamped} highres-pixels buiten dieptebereik {:.2}–{:.2} m (geklemd)",
1672	render_doc["depth_near"].as_f64().unwrap_or(0.),
1673	render_doc["depth_far"].as_f64().unwrap_or(0.)
1674	),
1675	});
1676	}
1677	completed += 1;
1678	emit(RenderEvent::Pass {
1679	index: completed - 1,
1680	total: plan.passes,
1681	label: format!("{pose} · highres"),
1682	image: Some(image(raw.width, raw.height, raw.diffuse.clone())),
1683	});
1684	if cancel.load(Ordering::Relaxed) {
1685	return Err("geannuleerd".into());
1686	}
1687	emit(RenderEvent::Step {
1688	index: completed,
1689	total: plan.passes,
1690	label: format!("{pose} · detail"),
1691	});
1692	let detail = detail_map(&raw)?;
1693	completed += 1;
1694	emit(RenderEvent::Pass {
1695	index: completed - 1,
1696	total: plan.passes,
1697	label: format!("{pose} · detail"),
1698	image: Some(detail_image(&raw, &detail)),
1699	});
1700	if cancel.load(Ordering::Relaxed) {
1701	return Err("geannuleerd".into());
1702	}
1703	emit(RenderEvent::Step {
1704	index: completed,
1705	total: plan.passes,
1706	label: format!("{pose} · target-res / diffuse"),
1707	});
1708	let target = resolve(&raw, &detail, job.target_width, job.target_height)?;
1709	for ((map, preview), rel) in [
1710	("diffuse", target.diffuse),
1711	("depth", target.depth_preview),
1712	("normal", target.normal),
1713	("specular", target.specular),
1714	]
1715	.into_iter()
1716	.zip(paths)
1717	{
1718	if cancel.load(Ordering::Relaxed) {
1719	return Err("geannuleerd".into());
1720	}
1721	emit(RenderEvent::Step {
1722	index: completed,
1723	total: plan.passes,
1724	label: format!("{pose} · {map}"),
1725	});
1726	debug_assert!(rel.ends_with(&format!("_{map}.png")));
1727	let kept = session.verified.contains_key(rel);
1728	let digest = if kept {
1729	session.verified[rel].clone()
1730	} else {
1731	let bytes = if map == "depth" {
1732	let pixels: Vec<(f64, f64)> = target
1733	.depth_t
1734	.iter()
1735	.enumerate()
1736	.map(\|(i, t)\| {
1737	(f64::from(t), f64::from(target.depth[i 2 + 1]) / 65535.)
1738	})
1739	.collect();
1740	encode_depth_png_fmt(
1741	job.target_width,
1742	job.target_height,
1743	&pixels,
1744	job.depth_format,
1745	)?
1746	} else {
1747	encode_rgba_png(&preview, map == "diffuse")?
1748	};
1749	session.publish(rel, &bytes)?
1750	};
1751	png_sha256.insert(rel.clone(), digest);
1752	completed += 1;
1753	let pass = if map == "diffuse" {
1754	"target-res / diffuse"
1755	} else {
1756	map
1757	};
1758	emit(RenderEvent::Pass {
1759	index: completed - 1,
1760	total: plan.passes,
1761	label: if kept {
1762	format!("{pose} · {pass} (bestaand bestand behouden)")
1763	} else {
1764	format!("{pose} · {pass}")
1765	},
1766	image: Some(preview),
1767	});
1768	}
1769	}
1770	if png_sha256.len() as u32 != plan.files {
1771	return Err(format!(
1772	"checksumtelling {} wijkt af van geplande {} PNGs",
1773	png_sha256.len(),
1774	plan.files
1775	));
1776	}
1777	// Atlases + .ppda only after every loose map is published and verified
1778	// (also after a resume); complete.json stays the final marker.
1779	crate::atlas::write_atlases(
1780	&crate::atlas::AtlasJob {
1781	root: &root,
1782	render_doc: &render_doc,
1783	plan: &plan,
1784	sex: &job.sex,
1785	set: &set,
1786	cell_width: job.target_width,
1787	cell_height: job.target_height,
1788	png_sha256: &png_sha256,
1789	attempt: session.attempt,
1790	cancel,
1791	},
1792	&mut \|label\| {
1793	emit(RenderEvent::Step {
1794	index: completed,
1795	total: plan.passes,
1796	label,
1797	})
1798	},
1799	)
1800	})();
1801	match result {
1802	Ok(atlas) => {
1803	let identity = crate::export_set::complete_identity_json(&render_doc)?;
1804	write_json(
1805	&root,
1806	"complete.json",
1807	serde_json::json!({
1808	"format_version": crate::export_set::OUTPUT_META_VERSION,
1809	"status": "complete",
1810	"identity": identity,
1811	"passes": completed,
1812	"png_files": plan.files,
1813	"png_sha256": png_sha256,
1814	"atlas": atlas.to_json(),
1815	"depth_clamped": {
1816	"views": clamped_views,
1817	"highres_pixels": clamped_pixels,
1818	"note": "rendered this attempt; kept files from a resumed run are not re-counted",
1819	},
1820	}),
1821	)?;
1822	if clamped_views > 0 {
1823	emit(RenderEvent::Step {
1824	index: completed,
1825	total: plan.passes,
1826	label: format!(
1827	"Waarschuwing: diepte geklemd in {clamped_views} beelden ({clamped_pixels} highres-pixels buiten het vaste bereik)"
1828	),
1829	});
1830	}
1831	// Verify the finished build before it replaces the last good result.
1832	crate::atlas::AtlasSet::open_run(&root)
1833	.map_err(\|e\| format!("voltooide render faalt controle: {e}"))?;
1834	drop(session);
1835	let final_dir = crate::resume::promote(
1836	&job.output,
1837	&root,
1838	&crate::resume::result_dir_name(&job.sex, &set),
1839	)?;
1840	emit(RenderEvent::Finished {
1841	saved: Some(final_dir.display().to_string()),
1842	});
1843	Ok(())
1844	}
1845	Err(error) => {
1846	let name = if cancel.load(Ordering::Relaxed) {
1847	"cancelled.json"
1848	} else {
1849	"failed.json"
1850	};
1851	let _ = write_json(
1852	&root,
1853	name,
1854	serde_json::json!({
1855	"error": error,
1856	"completed_passes": completed,
1857	"total_passes": plan.passes,
1858	"png_files_done": png_sha256.len(),
1859	"png_files": plan.files,
1860	"attempt": session.attempt,
1861	}),
1862	);
1863	Err(error)
1864	}
1865	}
1866	}
1867
1868	/// Real readback regression: nearest-surface depth/normal/specular, preserved
1869	/// texture × vertex albedo/alpha and independence from opposed light directions.
1870	/// # Safety
1871	/// Run on a current disposable native context.
1872	pub unsafe fn map_regression_probe(gl: &glow::Context) -> Result<(), String> {
1873	let triangle = \|z, normal, color, specular\| Draw {
1874	positions: Arc::new(vec![[-0.9, -0.9, z], [0.9, -0.9, z], [0., 0.9, z]]),
1875	normals: Arc::new(vec![normal; 3]),
1876	uvs: Arc::new(vec![[0.; 2]; 3]),
1877	vertex_colors: Arc::new(Vec::new()),
1878	indices: vec![0, 1, 2],
1879	color,
1880	albedo: None,
1881	shiny: None,
1882	specular,
1883	cutoff: 0.001,
1884	flat_normals: false,
1885	};
1886	let mut renderer = GpuRenderer::default();
1887	let mut scene = Scene {
1888	draws: vec![
1889	triangle(-0.5, [0., 0., 1.], [1., 0., 0., 1.], 0.75),
1890	triangle(0.5, [1., 0., 0.], [0., 1., 0., 1.], 0.),
1891	],
1892	view: preview::identity(),
1893	projection: preview::identity(),
1894	width: 32,
1895	height: 32,
1896	};
1897	let result = (\|\| {
1898	let raw = renderer.render(gl, &scene)?;
1899	let i = 16 * 32 + 16;
1900	if raw.diffuse[i * 4..i * 4 + 4] != [255, 0, 0, 255]
1901	\|\| (raw.depth[i] - 0.25).abs() > 1e-5
1902	\|\| raw.normal[i * 4..i * 4 + 3] != [128, 128, 255]
1903	\|\| raw.specular[i * 4].abs_diff(191) > 1
1904	{
1905	return Err(format!(
1906	"GPU map winner mismatch: color {:?} depth {} normal {:?} spec {}",
1907	&raw.diffuse[i * 4..i * 4 + 4],
1908	raw.depth[i],
1909	&raw.normal[i * 4..i * 4 + 4],
1910	raw.specular[i * 4]
1911	));
1912	}
1913	scene.draws.reverse();
1914	let reverse = renderer.render(gl, &scene)?;
1915	if reverse.diffuse != raw.diffuse
1916	\|\| reverse.normal != raw.normal
1917	\|\| reverse.depth != raw.depth
1918	{
1919	return Err("GPU map winner depends on submission order".into());
1920	}
1921	scene.draws = vec![triangle(-0.5, [0., 0., 1.], [0.5, 0.75, 1., 1.], 0.)];
1922	scene.draws[0].vertex_colors = Arc::new(vec![[0.5, 1., 0.5, 1.]; 3]);
1923	scene.draws[0].albedo = Some(Arc::new(equipment::Texture {
1924	content_hash: 99,
1925	width: 1,
1926	height: 1,
1927	rgba: vec![128, 255, 64, 192],
1928	}));
1929	let expected = [
1930	srgb(linear(128) * 0.25),
1931	srgb(0.75),
1932	srgb(linear(64) * 0.5),
1933	192,
1934	];
1935	// Production intentionally has no lighting input. This optional conventional
1936	// uniform is optimized out now; a future accidental lighting term using it
1937	// must fail these actual GPU readbacks under opposed light directions.
1938	for light in [[0., 0., 1.], [0., 0., -1.], [1., 0., 0.]] {
1939	let p = renderer.program.ok_or("missing probe program")?;
1940	gl.use_program(Some(p));
1941	gl.uniform_3_f32(
1942	gl.get_uniform_location(p, "u_light_direction").as_ref(),
1943	light[0],
1944	light[1],
1945	light[2],
1946	);
1947	let output = renderer.render(gl, &scene)?;
1948	let pixel = &output.diffuse[i * 4..i * 4 + 4];
1949	if pixel.iter().zip(expected).any(\|(a, b)\| a.abs_diff(b) > 1) {
1950	return Err(format!("diffuse is lit or alpha/vertex/texture lost under {light:?}: {pixel:?} vs {expected:?}"));
1951	}
1952	}
1953	let detail = detail_map(&raw)?;
1954	let target = resolve(&raw, &detail, 4, 4)?;
1955	if target.diffuse.width != 4
1956	\|\| target.depth.len() != 32
1957	\|\| target
1958	.normal
1959	.rgba
1960	.chunks_exact(4)
1961	.filter(\|p\| p[3] > 0)
1962	.any(\|p\| {
1963	let n = p[..3]
1964	.iter()
1965	.map(\|x\| (x as f32 / 255. 2. - 1.).powi(2))
1966	.sum::<f32>()
1967	.sqrt();
1968	(n - 1.).abs() > 0.03
1969	})
1970	{
1971	return Err("target map dimensions/normals invalid".into());
1972	}
1973	let mut flat = Scene {
1974	draws: vec![triangle(-0.5, [1., 0., 0.], [1., 0., 0., 1.], 0.)],
1975	view: preview::identity(),
1976	projection: preview::identity(),
1977	width: 32,
1978	height: 32,
1979	};
1980	flat.draws[0].flat_normals = true;
1981	let derived = renderer.render(gl, &flat)?;
1982	if derived.normal[i * 4..i * 4 + 3] != [128, 128, 255] {
1983	return Err(format!(
1984	"flat normals are not geometry-derived: {:?}",
1985	&derived.normal[i * 4..i * 4 + 4]
1986	));
1987	}
1988	println!("Production GPU maps PASS: nearest depth=0.25, normal=[128,128,255], specular=191, albedo texture×vertex={expected:?}, alpha preserved, diffuse identical under 3 opposed lights; target maps valid; missing source normals use actual GPU triangle derivatives");
1989	Ok(())
1990	})();
1991	renderer.destroy(gl);
1992	result
1993	}
1994
1995	#[cfg(test)]
1996	mod tests {
1997	use super::*;
1998	struct Temp(PathBuf);
1999	impl Temp {
2000	fn new() -> Self {
2001	let p = std::env::temp_dir().join(format!(
2002	"paperdoll-production-{}-{}",
2003	std::process::id(),
2004	std::time::SystemTime::now()
2005	.duration_since(std::time::UNIX_EPOCH)
2006	.unwrap()
2007	.as_nanos()
2008	));
2009	std::fs::create_dir(&p).unwrap();
2010	Self(p)
2011	}
2012	}
2013	impl Drop for Temp {
2014	fn drop(&mut self) {
2015	let _ = std::fs::remove_dir_all(&self.0);
2016	}
2017	}
2018	fn body() -> PreviewCharacter {
2019	preview::load_gltf_file(
2020	&Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/bodies/test-body-male.glb"),
2021	)
2022	.unwrap()
2023	}
2024	fn raw(w: u32, h: u32) -> Buffers {
2025	let n = (w * h) as usize;
2026	Buffers {
2027	width: w,
2028	height: h,
2029	diffuse: [255, 0, 0, 255].repeat(n),
2030	normal: [128, 128, 255, 255].repeat(n),
2031	specular: [191, 191, 191, 255].repeat(n),
2032	depth: vec![0.25; n],
2033	}
2034	}
2035	#[test]
2036	fn job_counts_every_clip_frame_angle_and_exact_order() {
2037	let mut b = body();
2038	let mut c = b.clips[0].clone();
2039	c.name = "../A \u{2603}".into();
2040	c.duration = 0.5;
2041	b.clips = vec![c.clone(), c];
2042	let p = plan(&b, 3).unwrap();
2043	// 2 clips × 2 frames × 60 views.
2044	assert_eq!((p.images, p.passes, p.files), (240, 1440, 960));
2045	let s = samples(&p).collect::<Vec<_>>();
2046	assert_eq!(s.len(), 240);
2047	assert_eq!(
2048	s[0],
2049	Sample {
2050	clip: 0,
2051	frame: 0,
2052	pitch: -60,
2053	yaw: 0
2054	}
2055	);
2056	assert_eq!(s[11].yaw, 330);
2057	assert_eq!(s[12].pitch, -30);
2058	assert_eq!(s[24].pitch, 0);
2059	assert_eq!(s[36].pitch, 30);
2060	assert_eq!(s[59].pitch, 60);
2061	assert_eq!(s[60].frame, 1);
2062	assert_eq!(s[120].clip, 1);
2063	assert_ne!(p.clips[0].token, p.clips[1].token);
2064	assert!(p.clips.iter().all(\|c\| equipment::valid_name(&c.token)));
2065	assert_eq!(
2066	PASSES,
2067	[
2068	"highres",
2069	"detail",
2070	"target-res / diffuse",
2071	"depth",
2072	"normal",
2073	"specular"
2074	]
2075	);
2076	b.clips.clear();
2077	let p = plan(&b, 12).unwrap();
2078	assert_eq!((p.images, p.files), (60, 240));
2079	}
2080	#[test]
2081	fn floating_terminal_timestamp_does_not_duplicate_the_loop_endpoint() {
2082	let mut b = body();
2083	b.clips.truncate(1);
2084	b.clips[0].duration = f32::from_bits(1f32.to_bits() + 1);
2085	assert_eq!(plan(&b, 2).unwrap().clips[0].frames, 2);
2086	b.clips[0].duration = 1.00001;
2087	assert_eq!(plan(&b, 2).unwrap().clips[0].frames, 3);
2088	}
2089	#[test]
2090	fn planner_rejects_invalid_or_unbounded_inputs() {
2091	let mut b = body();
2092	assert!(plan(&b, 0).is_err());
2093	assert!(plan(&b, 241).is_err());
2094	for duration in [f32::NAN, f32::INFINITY, -1., 10000.] {
2095	b.clips[0].duration = duration;
2096	assert!(plan(&b, 12).is_err());
2097	}
2098	}
2099	#[test]
2100	fn output_tokens_only_four_target_maps() {
2101	let expected = PathBuf::from("male/body/clip000-walk/f000012/p-60_y330_diffuse.png");
2102	assert_eq!(
2103	output_path("male", "body", "clip000-walk", 12, -60, 330, "diffuse").unwrap(),
2104	expected
2105	);
2106	assert!(output_path("male", "body", "clip000-walk", 0, 60, 0, "depth").is_ok());
2107	assert!(output_path("male", "body", "clip000-walk", 0, 45, 0, "depth").is_err());
2108	assert!(output_path("male", "body", "clip000-walk", 0, 90, 0, "depth").is_err());
2109	for map in ["diffuse", "normal", "depth", "specular"] {
2110	assert!(output_path("female", "sword", "clip000-bind", 0, 30, 0, map).is_ok());
2111	}
2112	for map in ["highres", "detail", "shiny", "../x"] {
2113	assert!(output_path("male", "body", "clip000-bind", 0, 0, 0, map).is_err());
2114	}
2115	for token in ["../escape", "A", "a/b", "a\\b", ".", "a b"] {
2116	assert!(output_path("male", token, "clip000-bind", 0, 0, 0, "diffuse").is_err());
2117	}
2118	assert!(output_path("male", "body", "walk", 0, 1, 0, "depth").is_err());
2119	assert!(output_path("male", "body", "walk", 0, 0, 360, "depth").is_err());
2120	}
2121	#[test]
2122	fn resolve_preserves_thin_foreground_and_matching_maps() {
2123	let mut r = raw(8, 8);
2124	r.diffuse = [0, 255, 0, 255].repeat(64);
2125	r.depth.fill(0.75);
2126	r.diffuse[..4].copy_from_slice(&[255, 0, 0, 255]);
2127	r.depth[0] = 0.25;
2128	let d = detail_map(&r).unwrap();
2129	assert!(d.iter().any(\|x\| *x > 0));
2130	let t = resolve(&r, &d, 1, 1).unwrap();
2131	assert_eq!(t.diffuse.rgba, [255, 0, 0, 255]);
2132	assert_eq!(t.specular.rgba, [191, 191, 191, 255]);
2133	assert!((t.depth[0] as i32 - 16384).abs() <= 1);
2134	let n = &t.normal.rgba;
2135	let len = (0..3)
2136	.map(\|c\| (n[c] as f32 / 255. * 2. - 1.).powi(2))
2137	.sum::<f32>()
2138	.sqrt();
2139	assert!((len - 1.).abs() < 0.01);
2140	r.diffuse.fill(0);
2141	r.diffuse[..4].copy_from_slice(&[255, 0, 0, 255]);
2142	let t = resolve(&r, &detail_map(&r).unwrap(), 1, 1).unwrap();
2143	assert_eq!(t.diffuse.rgba[3], 4);
2144	assert_eq!(t.depth[1], 1028);
2145	assert_eq!(t.normal.rgba[3], 4);
2146	assert_eq!(t.specular.rgba[3], 4);
2147	}
2148	fn meta_framing(meta: &serde_json::Value) -> CameraFraming {
2149	serde_json::from_value(meta["framing"].clone()).unwrap()
2150	}
2151
2152	#[test]
2153	fn clamped_depth_counts_only_covered_pixels_on_the_planes() {
2154	let mut raw = Buffers {
2155	width: 4,
2156	height: 1,
2157	diffuse: vec![255; 16],
2158	normal: vec![0; 16],
2159	specular: vec![0; 16],
2160	depth: vec![0., 0.5, 1., 1.],
2161	};
2162	raw.diffuse[15] = 0; // uncovered background at far plane
2163	assert_eq!(clamped_depth_pixels(&raw), 2);
2164	}
2165
2166	#[test]
2167	fn invalid_map_dimensions_and_depth_fail_without_panics() {
2168	let mut r = raw(8, 8);
2169	r.normal.pop();
2170	assert!(detail_map(&r).is_err());
2171	assert!(resolve(&r, &[0; 64], 1, 1).is_err());
2172	let mut r = raw(8, 8);
2173	r.depth[0] = f32::NAN;
2174	assert!(resolve(&r, &[0; 64], 1, 1).is_err());
2175	let r = raw(8, 8);
2176	assert!(resolve(&r, &[0; 63], 1, 1).is_err());
2177	assert!(resolve(&r, &[0; 64], 0, 1).is_err());
2178	assert!(resolve(&r, &[0; 64], 257, 1).is_err());
2179	}
2180	#[test]
2181	fn atomic_pngs_roundtrip_no_overwrite_or_temp_deletion() {
2182	let t = Temp::new();
2183	let p = Path::new("map_diffuse.png");
2184	write_rgba(&t.0, p, &image(1, 1, vec![128, 64, 32, 192])).unwrap();
2185	let original = std::fs::read(t.0.join(p)).unwrap();
2186	assert!(write_rgba(&t.0, p, &image(1, 1, vec![0; 4])).is_err());
2187	assert_eq!(std::fs::read(t.0.join(p)).unwrap(), original);
2188	let mut reader = png::Decoder::new(std::io::Cursor::new(original))
2189	.read_info()
2190	.unwrap();
2191	assert!(reader.info().srgb.is_some());
2192	let mut out = vec![0; reader.output_buffer_size().unwrap()];
2193	reader.next_frame(&mut out).unwrap();
2194	assert_eq!(out, [128, 64, 32, 192]);
2195	write_depth(&t.0, Path::new("depth.png"), 1, 1, &[16384, 32896]).unwrap();
2196	let mut reader = png::Decoder::new(std::io::BufReader::new(
2197	std::fs::File::open(t.0.join("depth.png")).unwrap(),
2198	))
2199	.read_info()
2200	.unwrap();
2201	assert_eq!(reader.info().bit_depth, png::BitDepth::Sixteen);
2202	assert_eq!(reader.info().color_type, png::ColorType::GrayscaleAlpha);
2203	assert!(reader.info().srgb.is_none());
2204	let mut out = vec![0; reader.output_buffer_size().unwrap()];
2205	reader.next_frame(&mut out).unwrap();
2206	assert_eq!(out, [64, 0, 128, 128]);
2207	let tmp =
2208	t.0.join("blocked.png")
2209	.with_extension(format!("part-{}", std::process::id()));
2210	std::fs::write(&tmp, b"keep").unwrap();
2211	// A foreign/stale temp (e.g. left by a crashed process with a reused PID)
2212	// is never deleted or reused; per-write unique temp names still publish.
2213	write_rgba(&t.0, Path::new("blocked.png"), &image(1, 1, vec![0; 4])).unwrap();
2214	assert_eq!(std::fs::read(tmp).unwrap(), b"keep");
2215	let temps = std::fs::read_dir(&t.0)
2216	.unwrap()
2217	.filter_map(\|e\| e.ok())
2218	.filter(\|e\| e.file_name().to_string_lossy().starts_with("blocked.part-"))
2219	.count();
2220	assert_eq!(temps, 1, "own temp files are removed, foreign ones kept");
2221	assert!(write_depth(&t.0, Path::new("bad.png"), 1, 1, &[0]).is_err());
2222	assert!(write_rgba(&t.0, Path::new("bad.png"), &image(257, 1, vec![0; 1028])).is_err());
2223	assert!(write_rgba(&t.0, Path::new("../escape.png"), &image(1, 1, vec![0; 4])).is_err());
2224	}
2225	#[cfg(unix)]
2226	#[test]
2227	fn output_rejects_escaping_symlinks() {
2228	let root = Temp::new();
2229	let outside = Temp::new();
2230	std::os::unix::fs::symlink(&outside.0, root.0.join("link")).unwrap();
2231	assert!(write_rgba(
2232	&root.0,
2233	Path::new("link/sub/x.png"),
2234	&image(1, 1, vec![0; 4])
2235	)
2236	.is_err());
2237	assert!(!outside.0.join("sub").exists());
2238	}
2239	#[test]
2240	fn latest_mailbox_is_bounded_and_retains_terminal() {
2241	let m = Mailbox::default();
2242	for i in 0..1000 {
2243	m.publish(RenderEvent::Pass {
2244	index: i,
2245	total: 1000,
2246	label: i.to_string(),
2247	image: Some(image(1, 1, vec![0; 4])),
2248	});
2249	}
2250	m.publish(RenderEvent::Step {
2251	index: 999,
2252	total: 1000,
2253	label: "working".into(),
2254	});
2255	m.publish(RenderEvent::Cancelled);
2256	let events = m.drain();
2257	assert_eq!(events.len(), 3);
2258	assert!(matches!(&events[0], RenderEvent::Pass { index: 999, .. }));
2259	assert!(matches!(&events[2], RenderEvent::Cancelled));
2260	assert!(m.drain().is_empty());
2261	}
2262
2263	#[test]
2264	fn fixed_body_and_equipment_camera_agree_and_body_is_not_a_draw() {
2265	let temp = Temp::new();
2266	let mut job = RenderJob {
2267	depth_format: crate::camera::DepthFormat::GRAY16,
2268	character: body(),
2269	sex: "male".into(),
2270	preset: None,
2271	target_width: 64,
2272	target_height: 96,
2273	fps: 12,
2274	framing: CameraFraming {
2275	height_milli: 3100,
2276	center_y_milli: 1200,
2277	pivot_y_milli: Some(1200),
2278	depth_range_milli: None,
2279	},
2280	output: temp.0.clone(),
2281	project_id: "test-project".into(),
2282	project_name: "Test".into(),
2283	body_model: SourceFingerprint {
2284	path: "assets/body/test.glb".into(),
2285	sha256: crate::digest::sha256_hex(b"test-body"),
2286	},
2287	preset_sha256: None,
2288	};
2289	let mut cache = equipment::TextureCache::default();
2290	let b = scene(&job, "walk", 0.5, 30., 90., &mut cache).unwrap();
2291	let mut preset = equipment::Preset::new("sword".into());
2292	let fixture =
2293	Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/equipment/sword.obj");
2294	equipment::import_obj(&mut preset, &fixture).unwrap();
2295	let joint = job
2296	.character
2297	.joint_names
2298	.iter()
2299	.position(\|n\| n == "RightHand")
2300	.unwrap();
2301	preset.bind(0, &job.character, 0, joint).unwrap();
2302	let count = preset
2303	.attachments
2304	.iter()
2305	.map(\|a\| a.meshes.len())
2306	.sum::<usize>();
2307	job.preset = Some(preset);
2308	let e = scene(&job, "walk", 0.5, 30., 90., &mut cache).unwrap();
2309	assert_eq!(e.draws.len(), count);
2310	assert_eq!(b.view, e.view);
2311	assert_eq!(b.projection, e.projection);
2312	assert_eq!((e.width, e.height), (512, 768));
2313	assert_eq!(e.projection[5], 2. / 3.1);
2314	let center = point(&e.view, [0., 1.2, 0.]);
2315	assert!(center[0].abs() < 0.0001 && center[1].abs() < 0.0001);
2316	assert!((center[2] + 10.).abs() < 0.0001);
2317	let early = scene(&job, "attack", 0., 30., 90., &mut cache).unwrap();
2318	let late = scene(&job, "attack", 0.5, 30., 90., &mut cache).unwrap();
2319	assert_eq!(early.view, late.view);
2320	assert_eq!(early.projection, late.projection);
2321	assert_ne!(early.draws[0].positions, late.draws[0].positions);
2322	let mut invalid = e.clone();
2323	invalid.view[0] = f32::NAN;
2324	assert!(invalid.validate().is_err());
2325	}
2326	#[test]
2327	fn body_import_retains_texture_material_and_linear_vertex_color() {
2328	let temp = Temp::new();
2329	let source = std::fs::read(
2330	Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/bodies/test-body-male.glb"),
2331	)
2332	.unwrap();
2333	let glb = gltf::binary::Glb::from_slice(&source).unwrap();
2334	let mut json: serde_json::Value = serde_json::from_slice(&glb.json).unwrap();
2335	let mut bin = glb.bin.unwrap().into_owned();
2336	while !bin.len().is_multiple_of(4) {
2337	bin.push(0);
2338	}
2339	let position = json["meshes"][0]["primitives"][0]["attributes"]["POSITION"]
2340	.as_u64()
2341	.unwrap() as usize;
2342	let count = json["accessors"][position]["count"].as_u64().unwrap() as usize;
2343	let offset = bin.len();
2344	for _ in 0..count {
2345	for value in [0.25f32, 0.75, 0.5, 0.5] {
2346	bin.extend(value.to_le_bytes());
2347	}
2348	}
2349	let view = json["bufferViews"].as_array().unwrap().len();
2350	json["bufferViews"]
2351	.as_array_mut()
2352	.unwrap()
2353	.push(serde_json::json!({"buffer":0,"byteOffset":offset,"byteLength":count*16}));
2354	let accessor = json["accessors"].as_array().unwrap().len();
2355	json["accessors"].as_array_mut().unwrap().push(
2356	serde_json::json!({"bufferView":view,"componentType":5126,"count":count,"type":"VEC4"}),
2357	);
2358	json["meshes"][0]["primitives"][0]["attributes"]["COLOR_0"] = serde_json::json!(accessor);
2359	json["buffers"][0] = serde_json::json!({"uri":"geometry.bin","byteLength":bin.len()});
2360	json["images"] = serde_json::json!([{"uri":"albedo.png"}]);
2361	json["textures"] = serde_json::json!([{"source":0}]);
2362	let material = json["meshes"][0]["primitives"][0]["material"]
2363	.as_u64()
2364	.unwrap() as usize;
2365	json["materials"][material]["pbrMetallicRoughness"]["baseColorTexture"] =
2366	serde_json::json!({"index":0});
2367	json["materials"][material]["pbrMetallicRoughness"]["baseColorFactor"] =
2368	serde_json::json!([0.5, 0.75, 1., 1.]);
2369	std::fs::write(temp.0.join("geometry.bin"), bin).unwrap();
2370	std::fs::write(temp.0.join("body.gltf"), serde_json::to_vec(&json).unwrap()).unwrap();
2371	write_rgba(
2372	&temp.0,
2373	Path::new("albedo.png"),
2374	&image(1, 1, vec![128, 255, 64, 192]),
2375	)
2376	.unwrap();
2377	let body = preview::load_gltf_file(&temp.0.join("body.gltf")).unwrap();
2378	assert_eq!(body.colors[0], [0.25, 0.75, 0.5, 0.5]);
2379	assert_eq!(body.surfaces[0].color, [0.5, 0.75, 1., 1.]);
2380	assert_eq!(
2381	body.surfaces[0].albedo.as_ref().unwrap().rgba,
2382	[128, 255, 64, 192]
2383	);
2384	assert_eq!(body.colors.len(), body.positions.len());
2385	assert_eq!(body.uvs.len(), body.positions.len());
2386	assert!(body.surfaces[0].flat_normals);
2387	json["meshes"][0]["primitives"][0]["attributes"]
2388	.as_object_mut()
2389	.unwrap()
2390	.remove("NORMAL");
2391	std::fs::write(temp.0.join("body.gltf"), serde_json::to_vec(&json).unwrap()).unwrap();
2392	let missing = preview::load_gltf_file(&temp.0.join("body.gltf")).unwrap();
2393	assert!(!missing.source_normals_complete);
2394	let job = RenderJob {
2395	depth_format: crate::camera::DepthFormat::GRAY16,
2396	character: missing,
2397	sex: "male".into(),
2398	preset: None,
2399	target_width: 1,
2400	target_height: 1,
2401	fps: 12,
2402	framing: CameraFraming::default(),
2403	output: temp.0.clone(),
2404	project_id: "test-project".into(),
2405	project_name: "Test".into(),
2406	body_model: SourceFingerprint {
2407	path: "assets/body/test.glb".into(),
2408	sha256: crate::digest::sha256_hex(b"test-body"),
2409	},
2410	preset_sha256: None,
2411	};
2412	assert!(
2413	scene(
2414	&job,
2415	"",
2416	0.,
2417	0.,
2418	0.,
2419	&mut equipment::TextureCache::default()
2420	)
2421	.unwrap()
2422	.draws[0]
2423	.flat_normals
2424	);
2425	}
2426	#[test]
2427	fn complete_and_cancelled_batches_have_truthful_atomic_outputs() {
2428	for stop in [false, true] {
2429	let tmp = Temp::new();
2430	let mut b = body();
2431	b.clips.clear();
2432	let job = RenderJob {
2433	depth_format: crate::camera::DepthFormat::GRAY16,
2434	character: b,
2435	sex: "male".into(),
2436	preset: None,
2437	target_width: 1,
2438	target_height: 1,
2439	fps: 12,
2440	framing: CameraFraming::default(),
2441	output: tmp.0.clone(),
2442	project_id: "test-project".into(),
2443	project_name: "Test".into(),
2444	body_model: SourceFingerprint {
2445	path: "assets/body/test.glb".into(),
2446	sha256: crate::digest::sha256_hex(b"test-body"),
2447	},
2448	preset_sha256: None,
2449	};
2450	let flag = AtomicBool::new(false);
2451	let (tx, rx) = mpsc::channel::<GpuRequest>();
2452	let gpu = std::thread::spawn(move \|\| {
2453	for request in rx {
2454	let _ = request
2455	.reply
2456	.send(Ok(raw(request.scene.width, request.scene.height)));
2457	}
2458	});
2459	let mut labels = Vec::new();
2460	let result = execute(job, &tx, &flag, None, &mut \|event\| {
2461	if let RenderEvent::Pass { label, .. } = event {
2462	labels.push(label);
2463	if stop && labels.len() == 3 {
2464	flag.store(true, Ordering::Relaxed);
2465	}
2466	}
2467	});
2468	drop(tx);
2469	gpu.join().unwrap();
2470	let run = std::fs::read_dir(&tmp.0)
2471	.unwrap()
2472	.next()
2473	.unwrap()
2474	.unwrap()
2475	.path();
2476	assert!(run.join("render.json").exists());
2477	assert_eq!(run.join("complete.json").exists(), !stop);
2478	assert_eq!(run.join("cancelled.json").exists(), stop);
2479	assert_eq!(result.is_ok(), !stop);
2480	let meta: serde_json::Value =
2481	serde_json::from_str(&std::fs::read_to_string(run.join("render.json")).unwrap())
2482	.unwrap();
2483	assert_eq!(meta["format_version"], 6);
2484	let (near, far) = crate::camera::depth_range(meta_framing(&meta));
2485	assert_eq!(meta["depth_near"].as_f64().unwrap() as f32, near);
2486	assert_eq!(meta["depth_far"].as_f64().unwrap() as f32, far);
2487	assert_eq!(meta["near"], meta["depth_near"]);
2488	assert_eq!(meta["depth_encoding"], "gray");
2489	assert_eq!(meta["depth_bits"], 16);
2490	if !stop {
2491	let done: serde_json::Value = serde_json::from_str(
2492	&std::fs::read_to_string(run.join("complete.json")).unwrap(),
2493	)
2494	.unwrap();
2495	assert_eq!(done["depth_clamped"]["views"], 0);
2496	}
2497	assert_eq!(meta["pitches"], serde_json::json!([-60, -30, 0, 30, 60]));
2498	assert_eq!(meta["yaws"].as_array().unwrap().len(), 12);
2499	assert_eq!(meta["fps"], 12);
2500	assert_eq!(meta["project"]["id"], "test-project");
2501	assert_eq!(
2502	meta["body_model"]["sha256"],
2503	crate::digest::sha256_hex(b"test-body")
2504	);
2505	assert_eq!(meta["framing"]["pivot_y_milli"], 1460);
2506	assert_eq!(meta["pivot_source"]["kind"], "neck");
2507	assert_eq!(meta["pivot_source"]["joint_name"], "Neck");
2508	assert_eq!(
2509	meta["saved_maps"]
2510	.as_array()
2511	.unwrap()
2512	.iter()
2513	.map(\|v\| v.as_str().unwrap())
2514	.collect::<Vec<_>>(),
2515	["diffuse", "depth", "normal", "specular"]
2516	);
2517	if !stop {
2518	let complete: serde_json::Value = serde_json::from_str(
2519	&std::fs::read_to_string(run.join("complete.json")).unwrap(),
2520	)
2521	.unwrap();
2522	assert_eq!(complete["format_version"], 6);
2523	assert_eq!(complete["status"], "complete");
2524	assert_eq!(complete["png_files"], 240);
2525	let checksums = complete["png_sha256"].as_object().unwrap();
2526	assert_eq!(checksums.len(), 240);
2527	for (rel, digest) in checksums {
2528	assert!(crate::digest::is_sha256_hex(digest.as_str().unwrap()));
2529	let bytes = std::fs::read(run.join(rel)).unwrap();
2530	assert_eq!(digest.as_str().unwrap(), crate::digest::sha256_hex(&bytes));
2531	}
2532	let opened = crate::export_set::ExportRun::open(&run).unwrap();
2533	let sample = opened
2534	.load_map(
2535	"clip000-bind",
2536	0,
2537	-60,
2538	0,
2539	crate::export_set::MapKind::Diffuse,
2540	)
2541	.unwrap();
2542	assert_eq!(sample.width(), 1);
2543	// Atlases + .ppda: one per map, written before complete.json.
2544	for map in ["diffuse", "normal", "depth", "specular"] {
2545	let name = format!("male-body-{map}-atlas.png");
2546	assert!(run.join(&name).is_file(), "{name}");
2547	assert_eq!(complete["atlas"]["maps"][map]["file"], name);
2548	}
2549	assert!(!stop);
2550	let atlas = crate::atlas::AtlasSet::open_run(&run).unwrap();
2551	assert_eq!(atlas.ppda.fps, 12);
2552	assert_eq!((atlas.layout.width, atlas.layout.height), (60, 1));
2553	let loaded = atlas.load().unwrap();
2554	for (pitch, yaw) in [(-60, 0), (0, 150), (60, 330)] {
2555	for kind in crate::atlas::ATLAS_MAPS {
2556	assert_eq!(
2557	loaded.cell("clip000-bind", 0, pitch, yaw, kind).unwrap(),
2558	opened
2559	.load_map("clip000-bind", 0, pitch, yaw, kind)
2560	.unwrap()
2561	);
2562	}
2563	}
2564	} else {
2565	assert!(!run.join("male-body-atlas.ppda").exists());
2566	assert!(!run.join("male-body-diffuse-atlas.png").exists());
2567	}
2568	let frame = run.join("male/body/clip000-bind/f000000");
2569	assert!(frame.join("p-60_y000_diffuse.png").exists());
2570	assert_eq!(frame.join("p-60_y000_depth.png").exists(), !stop);
2571	assert!(!frame.join("p-60_y000_highres.png").exists());
2572	assert!(!frame.join("p-60_y000_detail.png").exists());
2573	if !stop {
2574	assert_eq!(labels.len(), 360);
2575	for labels in labels.chunks_exact(6) {
2576	for (label, pass) in labels.iter().zip([
2577	"highres",
2578	"detail",
2579	"target-res / diffuse",
2580	"depth",
2581	"normal",
2582	"specular",
2583	]) {
2584	assert!(label.ends_with(pass));
2585	}
2586	}
2587	}
2588	}
2589	}
2590
2591	// ---- Resume (design §7/§12.6) ----
2592	fn resume_job(out: &Path) -> RenderJob {
2593	let mut b = body();
2594	b.clips.clear();
2595	RenderJob {
2596	depth_format: crate::camera::DepthFormat::GRAY16,
2597	character: b,
2598	sex: "male".into(),
2599	preset: None,
2600	target_width: 2,
2601	target_height: 2,
2602	fps: 12,
2603	framing: CameraFraming::default(),
2604	output: out.to_path_buf(),
2605	project_id: "resume-project".into(),
2606	project_name: "Resume".into(),
2607	body_model: SourceFingerprint {
2608	path: "assets/body/test.glb".into(),
2609	sha256: crate::digest::sha256_hex(b"resume-body"),
2610	},
2611	preset_sha256: None,
2612	}
2613	}
2614	/// Deterministic pose-dependent fake GPU output (view matrix drives the colour).
2615	fn fake_raw(scene: &Scene) -> Buffers {
2616	let mut b = raw(scene.width, scene.height);
2617	let v = ((scene.view[0] * 97. + scene.view[2] * 31. + scene.view[6] * 13.).abs() * 50.)
2618	as u32
2619	% 200;
2620	for px in b.diffuse.chunks_exact_mut(4) {
2621	px[1] = v as u8;
2622	px[2] = (255 - v) as u8;
2623	}
2624	b
2625	}
2626	/// Run a job; cancel after `stop` completed Pass events (None = run to the end).
2627	fn drive(
2628	job: RenderJob,
2629	target: RunTarget,
2630	stop: Option<usize>,
2631	) -> (Result<(), String>, Vec<RenderEvent>) {
2632	let flag = AtomicBool::new(false);
2633	let (tx, rx) = mpsc::channel::<GpuRequest>();
2634	let gpu = std::thread::spawn(move \|\| {
2635	for request in rx {
2636	let reply = fake_raw(&request.scene);
2637	let _ = request.reply.send(Ok(reply));
2638	}
2639	});
2640	let mut events = Vec::new();
2641	let mut passes = 0;
2642	let result = execute_target(job, target, &tx, &flag, None, &mut \|event\| {
2643	if matches!(event, RenderEvent::Pass { .. }) {
2644	passes += 1;
2645	if stop == Some(passes) {
2646	flag.store(true, Ordering::Relaxed);
2647	}
2648	}
2649	events.push(event);
2650	});
2651	drop(tx);
2652	gpu.join().unwrap();
2653	(result, events)
2654	}
2655	fn runs(out: &Path) -> Vec<PathBuf> {
2656	let mut v = std::fs::read_dir(out)
2657	.unwrap()
2658	.map(\|e\| e.unwrap().path())
2659	.collect::<Vec<_>>();
2660	v.sort();
2661	v
2662	}
2663	fn checksums(run: &Path) -> serde_json::Value {
2664	let c: serde_json::Value =
2665	serde_json::from_slice(&std::fs::read(run.join("complete.json")).unwrap()).unwrap();
2666	c["png_sha256"].clone()
2667	}
2668	fn tree(run: &Path) -> std::collections::BTreeMap<PathBuf, String> {
2669	let mut out = std::collections::BTreeMap::new();
2670	let mut stack = vec![run.to_path_buf()];
2671	while let Some(dir) = stack.pop() {
2672	for e in std::fs::read_dir(dir).unwrap() {
2673	let p = e.unwrap().path();
2674	if p.is_dir() {
2675	stack.push(p);
2676	} else {
2677	out.insert(
2678	p.clone(),
2679	crate::digest::sha256_hex(&std::fs::read(&p).unwrap()),
2680	);
2681	}
2682	}
2683	}
2684	out
2685	}
2686	#[cfg(unix)]
2687	fn inode(p: &Path) -> u64 {
2688	use std::os::unix::fs::MetadataExt;
2689	std::fs::metadata(p).unwrap().ino()
2690	}
2691
2692	#[test]
2693	#[cfg(unix)]
2694	fn cancel_resume_cancel_again_then_complete_equals_uninterrupted_run() {
2695	let reference_dir = Temp::new();
2696	let (ok, _) = drive(resume_job(&reference_dir.0), RunTarget::Fresh, None);
2697	ok.unwrap();
2698	let reference = checksums(&runs(&reference_dir.0)[0]);
2699	assert_eq!(reference.as_object().unwrap().len(), 240);
2700
2701	let tmp = Temp::new();
2702	// An earlier completed run in the same output must stay byte-identical.
2703	drive(resume_job(&tmp.0), RunTarget::Fresh, None).0.unwrap();
2704	let earlier = runs(&tmp.0)[0].clone();
2705	let earlier_tree = tree(&earlier);
2706	std::thread::sleep(std::time::Duration::from_millis(2));
2707	let (first, _) = drive(resume_job(&tmp.0), RunTarget::Fresh, Some(40));
2708	assert!(first.is_err());
2709	let run = runs(&tmp.0).into_iter().find(\|r\| *r != earlier).unwrap();
2710	let cancelled: serde_json::Value =
2711	serde_json::from_slice(&std::fs::read(run.join("cancelled.json")).unwrap()).unwrap();
2712	let done_first = cancelled["png_files_done"].as_u64().unwrap();
2713	assert!(done_first > 0 && done_first < 240);
2714	assert_eq!(cancelled["attempt"], 0);
2715	let first_file = run.join("male/body/clip000-bind/f000000/p-60_y000_diffuse.png");
2716	let first_inode = inode(&first_file);
2717	assert!(crate::export_set::ExportRun::open(&run).is_err());
2718
2719	let found =
2720	crate::resume::candidates(&tmp.0, &contract(resume_job(&tmp.0)).unwrap().render_doc)
2721	.unwrap();
2722	assert_eq!(found.len(), 1);
2723	assert_eq!(found[0].state, "geannuleerd");
2724	assert_eq!(found[0].journaled as u64, done_first);
2725	assert!(found[0].blocked.is_none());
2726
2727	// Second attempt: cancelled again after more work.
2728	let (second, events) = drive(resume_job(&tmp.0), RunTarget::Resume(run.clone()), Some(60));
2729	assert!(second.is_err());
2730	// Progress resumes at the verified work, not at zero, and skipped images are labelled.
2731	let first_step = events
2732	.iter()
2733	.find_map(\|e\| match e {
2734	RenderEvent::Step { index, label, .. } if label.contains("al aanwezig") => {
2735	Some(*index)
2736	}
2737	_ => None,
2738	})
2739	.unwrap();
2740	assert_eq!(first_step, 6);
2741	let cancelled2: serde_json::Value =
2742	serde_json::from_slice(&std::fs::read(run.join("cancelled.json")).unwrap()).unwrap();
2743	assert_eq!(cancelled2["attempt"], 1);
2744	assert!(cancelled2["png_files_done"].as_u64().unwrap() > done_first);
2745	assert!(run.join("attempt-000-cancelled.json").exists());
2746	assert_eq!(
2747	inode(&first_file),
2748	first_inode,
2749	"verified PNG was rewritten"
2750	);
2751
2752	// Cancelled/unfinished builds never touch the last good result.
2753	assert_eq!(tree(&earlier), earlier_tree);
2754	// Third attempt completes and replaces the result folder.
2755	let (third, _) = drive(resume_job(&tmp.0), RunTarget::Resume(run.clone()), None);
2756	third.unwrap();
2757	let built = run.clone();
2758	let done = tmp.0.join("male-body-atlas");
2759	assert_eq!(earlier, done);
2760	assert!(!built.exists());
2761	assert_eq!(
2762	runs(&tmp.0),
2763	vec![done.clone()],
2764	"only the newest result remains"
2765	);
2766	let first_file = done.join(first_file.strip_prefix(&built).unwrap());
2767	let run = done;
2768	assert!(!run.join("cancelled.json").exists());
2769	assert!(run.join("attempt-001-cancelled.json").exists());
2770	assert_eq!(inode(&first_file), first_inode);
2771	assert_eq!(checksums(&run), reference);
2772	crate::export_set::ExportRun::open(&run).unwrap();
2773	let log = std::fs::read_to_string(run.join(crate::resume::RESUME_LOG)).unwrap();
2774	assert_eq!(log.lines().count(), 2);
2775	// A completed run is no longer offered and cannot be resumed.
2776	let doc = contract(resume_job(&tmp.0)).unwrap().render_doc;
2777	assert!(crate::resume::candidates(&tmp.0, &doc).unwrap().is_empty());
2778	let (again, _) = drive(resume_job(&tmp.0), RunTarget::Resume(run.clone()), None);
2779	assert!(again.unwrap_err().contains("uitvoermap"));
2780	let (gone, _) = drive(resume_job(&tmp.0), RunTarget::Resume(built), None);
2781	assert!(gone.is_err());
2782	}
2783
2784	#[test]
2785	#[cfg(unix)]
2786	fn crash_recovery_regenerates_missing_corrupt_and_keeps_unjournaled_identical_files() {
2787	let reference_dir = Temp::new();
2788	drive(resume_job(&reference_dir.0), RunTarget::Fresh, None)
2789	.0
2790	.unwrap();
2791	let reference = checksums(&runs(&reference_dir.0)[0]);
2792
2793	let tmp = Temp::new();
2794	assert!(drive(resume_job(&tmp.0), RunTarget::Fresh, Some(60))
2795	.0
2796	.is_err());
2797	let run = runs(&tmp.0)[0].clone();
2798	// Simulate a hard crash: no terminal marker, torn last journal line.
2799	std::fs::remove_file(run.join("cancelled.json")).unwrap();
2800	let journal = std::fs::read_to_string(run.join(crate::resume::JOURNAL)).unwrap();
2801	let mut lines = journal.lines().map(str::to_string).collect::<Vec<_>>();
2802	let torn: serde_json::Value = serde_json::from_str(lines.last().unwrap()).unwrap();
2803	let torn_path = run.join(torn["path"].as_str().unwrap());
2804	let last = lines.pop().unwrap();
2805	let keep = lines.join("\n") + "\n" + &last[..last.len() / 2];
2806	std::fs::write(run.join(crate::resume::JOURNAL), keep).unwrap();
2807	let torn_inode = inode(&torn_path);
2808	// Corrupt one journaled PNG, delete another, leave a foreign temp file.
2809	let frame = run.join("male/body/clip000-bind/f000000");
2810	let corrupt = frame.join("p-60_y030_normal.png");
2811	std::fs::write(&corrupt, b"not a png").unwrap();
2812	let missing = frame.join("p-60_y060_depth.png");
2813	std::fs::remove_file(&missing).unwrap();
2814	let stale = frame.join("p-60_y090_diffuse.part-999999-0");
2815	std::fs::write(&stale, b"partial").unwrap();
2816
2817	let doc = contract(resume_job(&tmp.0)).unwrap().render_doc;
2818	let found = crate::resume::candidates(&tmp.0, &doc).unwrap();
2819	assert_eq!(found[0].state, "afgebroken");
2820
2821	drive(resume_job(&tmp.0), RunTarget::Resume(run.clone()), None)
2822	.0
2823	.unwrap();
2824	let done = tmp.0.join("male-body-atlas");
2825	let rebase = \|p: &Path\| done.join(p.strip_prefix(&run).unwrap());
2826	let (frame, missing, stale, torn_path) = (
2827	rebase(&frame),
2828	rebase(&missing),
2829	rebase(&stale),
2830	rebase(&torn_path),
2831	);
2832	let run = done.clone();
2833	assert_eq!(checksums(&run), reference);
2834	crate::export_set::ExportRun::open(&run).unwrap();
2835	assert!(missing.exists());
2836	assert_eq!(
2837	std::fs::read(frame.join("p-60_y030_normal.png.corrupt-a001-0")).unwrap(),
2838	b"not a png"
2839	);
2840	assert_eq!(std::fs::read(&stale).unwrap(), b"partial");
2841	assert_eq!(
2842	inode(&torn_path),
2843	torn_inode,
2844	"identical unjournaled file was replaced"
2845	);
2846	let log: serde_json::Value = serde_json::from_str(
2847	std::fs::read_to_string(run.join(crate::resume::RESUME_LOG))
2848	.unwrap()
2849	.lines()
2850	.next()
2851	.unwrap(),
2852	)
2853	.unwrap();
2854	assert_eq!(log["previous_marker"], serde_json::Value::Null);
2855	assert_eq!(log["damaged_journal_lines"], 1);
2856	assert_eq!(log["unjournaled_existing"], 1);
2857	assert_eq!(log["missing"].as_u64().unwrap(), 240 - 60 / 6 * 4 + 1);
2858	assert_eq!(log["quarantined"].as_array().unwrap().len(), 1);
2859	}
2860
2861	#[test]
2862	fn contract_refuses_atlas_beyond_gpu_limit_before_rendering() {
2863	let tmp = Temp::new();
2864	let mut job = resume_job(&tmp.0);
2865	job.character = body();
2866	let total: f32 = job.character.clips.iter().map(\|c\| c.duration).sum();
2867	assert!(total > 0.);
2868	// ~100 frame rows of 256 px > 16384, while staying under the 16 GiB cap.
2869	job.fps = (100. / total).ceil() as u32;
2870	job.target_width = 256;
2871	job.target_height = 256;
2872	let err = contract(job).err().unwrap();
2873	assert!(err.contains("atlas") && err.contains("16384"), "{err}");
2874	assert!(std::fs::read_dir(&tmp.0).unwrap().next().is_none());
2875	}
2876
2877	#[test]
2878	#[cfg(unix)]
2879	fn crash_after_atlases_keeps_identical_and_quarantines_damaged_atlas() {
2880	let reference_dir = Temp::new();
2881	drive(resume_job(&reference_dir.0), RunTarget::Fresh, None)
2882	.0
2883	.unwrap();
2884	let reference_run = runs(&reference_dir.0)[0].clone();
2885	let tmp = Temp::new();
2886	drive(resume_job(&tmp.0), RunTarget::Fresh, None).0.unwrap();
2887	// Simulate a crash after the atlases/.ppda were published but before
2888	// complete.json (so still the in-progress build), one atlas damaged.
2889	let run = tmp
2890	.0
2891	.join(crate::resume::in_progress_name(1, 1, "male", "body"));
2892	std::fs::rename(&runs(&tmp.0)[0], &run).unwrap();
2893	std::fs::remove_file(run.join("complete.json")).unwrap();
2894	let diffuse = run.join("male-body-diffuse-atlas.png");
2895	let normal = run.join("male-body-normal-atlas.png");
2896	let normal_inode = inode(&normal);
2897	let good = std::fs::read(&diffuse).unwrap();
2898	std::fs::remove_file(&diffuse).unwrap();
2899	std::fs::write(&diffuse, b"damaged").unwrap();
2900	drive(resume_job(&tmp.0), RunTarget::Resume(run.clone()), None)
2901	.0
2902	.unwrap();
2903	let built = run;
2904	let run = tmp.0.join("male-body-atlas");
2905	let (normal, diffuse) = (
2906	run.join(normal.file_name().unwrap()),
2907	run.join(diffuse.file_name().unwrap()),
2908	);
2909	assert!(!built.exists());
2910	assert_eq!(inode(&normal), normal_inode, "identical atlas rewritten");
2911	assert_eq!(std::fs::read(&diffuse).unwrap(), good);
2912	assert_eq!(
2913	std::fs::read(run.join("male-body-diffuse-atlas.png.corrupt-a001-0")).unwrap(),
2914	b"damaged"
2915	);
2916	crate::atlas::AtlasSet::open_run(&run).unwrap();
2917	crate::export_set::ExportRun::open(&run).unwrap();
2918	// Byte-identical to an uninterrupted run (deterministic encoding).
2919	for name in [
2920	"male-body-atlas.ppda",
2921	"male-body-diffuse-atlas.png",
2922	"male-body-depth-atlas.png",
2923	] {
2924	assert_eq!(
2925	std::fs::read(run.join(name)).unwrap(),
2926	std::fs::read(reference_run.join(name)).unwrap(),
2927	"{name}"
2928	);
2929	}
2930	}
2931
2932	#[test]
2933	fn result_folder_swap_keeps_last_good_and_recovers_interrupted_swaps() {
2934	let tmp = Temp::new();
2935	drive(resume_job(&tmp.0), RunTarget::Fresh, None).0.unwrap();
2936	let done = tmp.0.join("male-body-atlas");
2937	let good = tree(&done);
2938	// A legacy run-* folder is left alone.
2939	let legacy = tmp.0.join("run-123-4");
2940	std::fs::create_dir(&legacy).unwrap();
2941	std::fs::write(legacy.join("x"), b"old").unwrap();
2942	// Cancelled re-render: last good result untouched, build stays resumable.
2943	assert!(drive(resume_job(&tmp.0), RunTarget::Fresh, Some(10))
2944	.0
2945	.is_err());
2946	assert_eq!(tree(&done), good);
2947	let doc = contract(resume_job(&tmp.0)).unwrap().render_doc;
2948	assert_eq!(crate::resume::candidates(&tmp.0, &doc).unwrap().len(), 1);
2949	// Crash after moving the old result aside but before placing the new one:
2950	// the old result is restored.
2951	let aside = tmp.0.join(".replaced-male-body-atlas-77");
2952	std::fs::rename(&done, &aside).unwrap();
2953	let notes = crate::resume::recover(&tmp.0).unwrap();
2954	assert_eq!(notes.len(), 1, "{notes:?}");
2955	assert!(!aside.exists());
2956	assert_eq!(tree(&done), good);
2957	// Crash after completing a build but before the swap: promoted, old removed.
2958	let fresh = Temp::new();
2959	drive(resume_job(&fresh.0), RunTarget::Fresh, None)
2960	.0
2961	.unwrap();
2962	let built = tmp
2963	.0
2964	.join(crate::resume::in_progress_name(9, 9, "male", "body"));
2965	std::fs::rename(fresh.0.join("male-body-atlas"), &built).unwrap();
2966	std::fs::write(tmp.0.join("male-body-atlas/marker-old"), b"1").unwrap();
2967	let notes = crate::resume::recover(&tmp.0).unwrap();
2968	assert_eq!(notes.len(), 1, "{notes:?}");
2969	assert!(!built.exists());
2970	assert!(!done.join("marker-old").exists());
2971	crate::atlas::AtlasSet::open_run(&done).unwrap();
2972	assert!(std::fs::read_dir(&tmp.0).unwrap().all(\|e\| !e
2973	.unwrap()
2974	.file_name()
2975	.to_string_lossy()
2976	.starts_with(".replaced-")));
2977	assert_eq!(std::fs::read(legacy.join("x")).unwrap(), b"old");
2978	}
2979
2980	#[test]
2981	fn unjournaled_different_file_is_quarantined_not_overwritten() {
2982	let tmp = Temp::new();
2983	assert!(drive(resume_job(&tmp.0), RunTarget::Fresh, Some(6))
2984	.0
2985	.is_err());
2986	let run = runs(&tmp.0)[0].clone();
2987	// A planned PNG appears that the journal never recorded and that differs.
2988	let foreign = run.join("male/body/clip000-bind/f000000/p-60_y030_specular.png");
2989	std::fs::create_dir_all(foreign.parent().unwrap()).unwrap();
2990	std::fs::write(&foreign, b"foreign").unwrap();
2991	drive(resume_job(&tmp.0), RunTarget::Resume(run.clone()), None)
2992	.0
2993	.unwrap();
2994	let done = tmp.0.join("male-body-atlas");
2995	let foreign = done.join(foreign.strip_prefix(&run).unwrap());
2996	let run = done;
2997	crate::export_set::ExportRun::open(&run).unwrap();
2998	assert_eq!(
2999	std::fs::read(foreign.with_file_name("p-60_y030_specular.png.corrupt-a001-0")).unwrap(),
3000	b"foreign"
3001	);
3002	}
3003
3004	#[test]
3005	fn resume_refuses_mismatch_foreign_dirs_unknown_journal_and_locked_runs() {
3006	let tmp = Temp::new();
3007	assert!(drive(resume_job(&tmp.0), RunTarget::Fresh, Some(12))
3008	.0
3009	.is_err());
3010	let run = runs(&tmp.0)[0].clone();
3011	let before = std::fs::read(run.join("cancelled.json")).unwrap();
3012	// Contract drift: FPS, body bytes, target size.
3013	let mut job = resume_job(&tmp.0);
3014	job.fps = 24;
3015	let err = drive(job, RunTarget::Resume(run.clone()), None)
3016	.0
3017	.unwrap_err();
3018	assert!(err.contains("fps"), "{err}");
3019	let mut job = resume_job(&tmp.0);
3020	job.body_model.sha256 = crate::digest::sha256_hex(b"edited body");
3021	let err = drive(job, RunTarget::Resume(run.clone()), None)
3022	.0
3023	.unwrap_err();
3024	assert!(err.contains("body_model"), "{err}");
3025	let mut job = resume_job(&tmp.0);
3026	job.target_width = 3;
3027	let doc = contract(job.clone()).unwrap().render_doc;
3028	let found = crate::resume::candidates(&tmp.0, &doc).unwrap();
3029	assert!(found[0].blocked.as_ref().unwrap().contains("target"));
3030	assert!(drive(job, RunTarget::Resume(run.clone()), None).0.is_err());
3031	// Refusals leave the run and its marker untouched.
3032	assert_eq!(std::fs::read(run.join("cancelled.json")).unwrap(), before);
3033	assert!(!run.join(crate::resume::RESUME_LOG).exists());
3034	// Directory not directly inside the output directory.
3035	let other = Temp::new();
3036	let err = drive(resume_job(&other.0), RunTarget::Resume(run.clone()), None)
3037	.0
3038	.unwrap_err();
3039	assert!(err.contains("uitvoermap"), "{err}");
3040	// Locked by a running worker.
3041	let lock = std::fs::OpenOptions::new()
3042	.write(true)
3043	.open(run.join(crate::resume::LOCK))
3044	.unwrap();
3045	lock.lock().unwrap();
3046	let err = drive(resume_job(&tmp.0), RunTarget::Resume(run.clone()), None)
3047	.0
3048	.unwrap_err();
3049	assert!(err.contains("run.lock"), "{err}");
3050	let doc = contract(resume_job(&tmp.0)).unwrap().render_doc;
3051	assert!(crate::resume::candidates(&tmp.0, &doc).unwrap()[0]
3052	.blocked
3053	.is_some());
3054	drop(lock);
3055	// Journal naming a path outside the plan.
3056	use std::io::Write;
3057	let mut j = std::fs::OpenOptions::new()
3058	.append(true)
3059	.open(run.join(crate::resume::JOURNAL))
3060	.unwrap();
3061	writeln!(
3062	j,
3063	"{}",
3064	serde_json::json!({"path":"../escape.png","sha256":crate::digest::sha256_hex(b"x")})
3065	)
3066	.unwrap();
3067	let err = drive(resume_job(&tmp.0), RunTarget::Resume(run.clone()), None)
3068	.0
3069	.unwrap_err();
3070	assert!(err.contains("onbekend pad"), "{err}");
3071	}
3072	}