src/production.rs

production.rs 98.5 KiB Download Raw

1	//! Bounded orthographic production rendering. GPU work runs on the native
2	//! current context, one request per UI update; sampling/filtering/PNG I/O run
3	//! on the worker. The worker never waits for a preview acknowledgment.
4	use crate::{
5	equipment,
6	preview::{self, Mat4, PreviewCharacter, PreviewControls},
7	project::CameraFraming,
8	render_job::{ImageBuf, RenderEvent},
9	};
10	use glow::HasContext;
11	use std::{
12	path::{Path, PathBuf},
13	sync::{
14	atomic::{AtomicBool, Ordering},
15	mpsc, Arc, Mutex,
16	},
17	thread,
18	};
19
20	pub const SCALE: u32 = 8;
21	pub const MAX_HIGHRES: u32 = 2048;
22	pub const PASSES: [&str; 6] = [
23	"highres",
24	"detail",
25	"target-res / diffuse",
26	"depth",
27	"normal",
28	"specular",
29	];
30	pub const NEAR: f32 = 0.05;
31	pub const FAR: f32 = 40.;
32	#[derive(Clone)]
33	pub struct Draw {
34	pub positions: Arc<Vec<[f32; 3]>>,
35	pub normals: Arc<Vec<[f32; 3]>>,
36	pub uvs: Arc<Vec<[f32; 2]>>,
37	pub vertex_colors: Arc<Vec<[f32; 4]>>,
38	pub indices: Vec<u32>,
39	pub color: [f32; 4],
40	pub albedo: Option<Arc<equipment::Texture>>,
41	pub shiny: Option<Arc<equipment::Texture>>,
42	pub specular: f32,
43	pub cutoff: f32,
44	pub flat_normals: bool,
45	}
46	#[derive(Clone)]
47	pub struct Scene {
48	pub draws: Vec<Draw>,
49	pub view: Mat4,
50	pub projection: Mat4,
51	pub width: u32,
52	pub height: u32,
53	}
54	#[derive(Debug)]
55	pub struct Buffers {
56	pub width: u32,
57	pub height: u32,
58	pub diffuse: Vec<u8>,
59	pub normal: Vec<u8>,
60	pub specular: Vec<u8>,
61	pub depth: Vec<f32>,
62	}
63	#[derive(Debug)]
64	pub struct Target {
65	pub diffuse: ImageBuf,
66	pub normal: ImageBuf,
67	pub specular: ImageBuf,
68	pub depth: Vec<u16>,
69	pub depth_preview: ImageBuf,
70	}
71	/// Content fingerprint of a source file used for a production job.
72	#[derive(Debug, Clone, PartialEq, Eq)]
73	pub struct SourceFingerprint {
74	pub path: String,
75	pub sha256: String,
76	}
77
78	#[derive(Clone)]
79	pub struct RenderJob {
80	pub character: PreviewCharacter,
81	pub sex: String,
82	pub preset: Option<equipment::Preset>,
83	pub target_width: u32,
84	pub target_height: u32,
85	pub fps: u32,
86	pub framing: CameraFraming,
87	pub output: PathBuf,
88	pub project_id: String,
89	pub project_name: String,
90	pub body_model: SourceFingerprint,
91	/// SHA-256 of the encoded `.ppe` bytes when rendering equipment; None for body.
92	pub preset_sha256: Option<String>,
93	}
94	#[derive(Debug, Clone, PartialEq)]
95	pub struct ClipPlan {
96	pub source_name: String,
97	pub token: String,
98	pub frames: u32,
99	}
100	#[derive(Debug, Clone, PartialEq)]
101	pub struct Plan {
102	pub clips: Vec<ClipPlan>,
103	pub images: u32,
104	pub passes: u32,
105	pub files: u32,
106	}
107	pub fn plan(body: &PreviewCharacter, fps: u32) -> Result<Plan, String> {
108	if fps == 0 \|\| fps > 240 {
109	return Err("fps moet 1–240 zijn".into());
110	}
111	let clips = if body.clips.is_empty() {
112	vec![ClipPlan {
113	source_name: String::new(),
114	token: "clip000-bind".into(),
115	frames: 1,
116	}]
117	} else {
118	body.clips
119	.iter()
120	.enumerate()
121	.map(\|(i, c)\| {
122	let duration = c.duration;
123	if !duration.is_finite() \|\| duration < 0. \|\| duration * fps as f32 > 100000. {
124	return Err("ongeldige of te lange animatie".into());
125	}
126	// Exporter float timestamps commonly put a nominal 1-second
127	// endpoint one ULP above 1. Do not duplicate that terminal pose.
128	let samples = f64::from(duration) * f64::from(fps);
129	let nearest = samples.round();
130	let samples = if (samples - nearest).abs()
131	<= 4. * f64::from(f32::EPSILON) * samples.max(1.)
132	{
133	nearest
134	} else {
135	samples
136	};
137	Ok(ClipPlan {
138	source_name: c.name.clone(),
139	token: clip_token(i, &c.name),
140	frames: samples.ceil().max(1.) as u32,
141	})
142	})
143	.collect::<Result<Vec<_>, String>>()?
144	};
145	let frames = clips
146	.iter()
147	.try_fold(0u32, \|n, c\| n.checked_add(c.frames))
148	.ok_or("te veel frames")?;
149	let images = frames.checked_mul(36).ok_or("te veel beelden")?;
150	let passes = images.checked_mul(6).ok_or("te veel passes")?;
151	let files = images.checked_mul(4).ok_or("te veel bestanden")?;
152	if files > 500000 {
153	return Err("batch groter dan 500000 uitvoerbestanden".into());
154	}
155	Ok(Plan {
156	clips,
157	images,
158	passes,
159	files,
160	})
161	}
162	#[derive(Debug, Clone, Copy, PartialEq, Eq)]
163	pub struct Sample {
164	pub clip: usize,
165	pub frame: u32,
166	pub pitch: i32,
167	pub yaw: u32,
168	}
169	pub fn samples(plan: &Plan) -> impl Iterator<Item = Sample> + '_ {
170	plan.clips.iter().enumerate().flat_map(\|(clip, c)\| {
171	(0..c.frames).flat_map(move \|frame\| {
172	[-30, 0, 30].into_iter().flat_map(move \|pitch\| {
173	(0..12).map(move \|y\| Sample {
174	clip,
175	frame,
176	pitch,
177	yaw: y * 30,
178	})
179	})
180	})
181	})
182	}
183
184	pub fn clip_token(index: usize, name: &str) -> String {
185	let slug: String = name
186	.chars()
187	.map(\|c\| {
188	if c.is_ascii_alphanumeric() {
189	c.to_ascii_lowercase()
190	} else {
191	'-'
192	}
193	})
194	.take(48)
195	.collect();
196	format!(
197	"clip{index:03}-{}",
198	if slug.is_empty() { "animation" } else { &slug }
199	)
200	}
201	pub fn output_path(
202	sex: &str,
203	set: &str,
204	clip: &str,
205	frame: u32,
206	pitch: i32,
207	yaw: u32,
208	map: &str,
209	) -> Result<PathBuf, String> {
210	if !["male", "female"].contains(&sex)
211	\|\| !(set == "body" \|\| equipment::valid_name(set))
212	\|\| !equipment::valid_name(clip)
213	\|\| ![-30, 0, 30].contains(&pitch)
214	\|\| yaw >= 360
215	\|\| !yaw.is_multiple_of(30)
216	\|\| !["diffuse", "normal", "depth", "specular"].contains(&map)
217	{
218	return Err("ongeldig uitvoerpad/token".into());
219	}
220	Ok(PathBuf::from(sex)
221	.join(set)
222	.join(clip)
223	.join(format!("f{frame:06}"))
224	.join(format!("p{pitch:+03}_y{yaw:03}_{map}.png")))
225	}
226	pub use crate::camera::matrices as camera;
227
228	fn point(m: &Mat4, p: [f32; 3]) -> [f32; 3] {
229	std::array::from_fn(\|i\| m[i] * p[0] + m[i + 4] * p[1] + m[i + 8] * p[2] + m[i + 12])
230	}
231	fn normalize(v: [f32; 3]) -> [f32; 3] {
232	let l = v.iter().map(\|x\| x * x).sum::<f32>().sqrt();
233	if l > 1e-10 {
234	v.map(\|x\| x / l)
235	} else {
236	[0., 0., 1.]
237	}
238	}
239	fn normal(m: &Mat4, n: [f32; 3]) -> [f32; 3] {
240	let a = [m[0], m[1], m[2]];
241	let b = [m[4], m[5], m[6]];
242	let c = [m[8], m[9], m[10]];
243	let cross = \|a: [f32; 3], b: [f32; 3]\| {
244	[
245	a[1] * b[2] - a[2] * b[1],
246	a[2] * b[0] - a[0] * b[2],
247	a[0] * b[1] - a[1] * b[0],
248	]
249	};
250	let x = cross(b, c);
251	let y = cross(c, a);
252	let z = cross(a, b);
253	let det = a.iter().zip(x).map(\|(a, b)\| a * b).sum::<f32>();
254	if det.abs() < 1e-12 {
255	return normalize(n);
256	}
257	normalize(std::array::from_fn(\|i\| {
258	(x[i] * n[0] + y[i] * n[1] + z[i] * n[2]) / det
259	}))
260	}
261	pub fn scene(
262	job: &RenderJob,
263	clip: &str,
264	time: f32,
265	pitch: f32,
266	yaw: f32,
267	cache: &mut equipment::TextureCache,
268	) -> Result<Scene, String> {
269	let body = &job.character;
270	let mut draws = Vec::new();
271	if let Some(preset) = &job.preset {
272	let controls = PreviewControls {
273	clip_name: clip.into(),
274	time,
275	..Default::default()
276	};
277	for layer in equipment::layers_cached(
278	preset,
279	usize::from(job.sex == "female"),
280	body,
281	&controls,
282	cache,
283	)? {
284	let m = layer.model;
285	draws.push(Draw {
286	positions: Arc::new(layer.mesh.positions.iter().map(\|p\| point(&m, *p)).collect()),
287	normals: Arc::new(layer.mesh.normals.iter().map(\|n\| normal(&m, *n)).collect()),
288	uvs: Arc::new(
289	layer
290	.mesh
291	.uvs
292	.into_iter()
293	.map(\|[u, v]\| [u, 1. - v])
294	.collect(),
295	),
296	vertex_colors: Arc::new(Vec::new()),
297	indices: layer.mesh.indices,
298	color: layer.mesh.color,
299	albedo: layer.albedo,
300	shiny: layer.shiny,
301	specular: layer.specular,
302	cutoff: 0.5,
303	flat_normals: false,
304	});
305	}
306	} else {
307	let bones = preview::sample_skin_matrices(body, clip, time);
308	let mut positions = Vec::with_capacity(body.positions.len());
309	let mut normals = Vec::with_capacity(body.positions.len());
310	for (i, p) in body.positions.iter().enumerate() {
311	let mut m = preview::identity();
312	if !bones.is_empty() && body.weights.len() == body.positions.len() {
313	m = [0.; 16];
314	let joints = body.joints.get(i).copied().unwrap_or([0; 4]);
315	for (j, w) in joints.into_iter().zip(body.weights[i]) {
316	let b = bones.get(j as usize).ok_or("ongeldige skinjoint")?;
317	for k in 0..16 {
318	m[k] += b[k] * w;
319	}
320	}
321	}
322	positions.push(point(&m, *p));
323	normals.push(normal(
324	&m,
325	body.normals.get(i).copied().unwrap_or([0., 1., 0.]),
326	));
327	}
328	let positions = Arc::new(positions);
329	let normals = Arc::new(normals);
330	let uvs = Arc::new(body.uvs.clone());
331	let colors = Arc::new(body.colors.clone());
332	if body.surfaces.is_empty() {
333	draws.push(Draw {
334	positions,
335	normals,
336	uvs,
337	vertex_colors: colors,
338	indices: body.indices.clone(),
339	color: body.base_color,
340	albedo: None,
341	shiny: None,
342	specular: 0.,
343	cutoff: 0.001,
344	flat_normals: !body.source_normals_complete,
345	});
346	} else {
347	for surface in &body.surfaces {
348	draws.push(Draw {
349	positions: positions.clone(),
350	normals: normals.clone(),
351	uvs: uvs.clone(),
352	vertex_colors: colors.clone(),
353	indices: body.indices[surface.first..surface.first + surface.count].to_vec(),
354	color: surface.color,
355	albedo: surface.albedo.clone(),
356	shiny: None,
357	specular: 0.,
358	cutoff: surface.cutoff,
359	flat_normals: surface.flat_normals,
360	});
361	}
362	}
363	}
364	let (view, projection) = camera(
365	crate::camera::resolve(body, job.framing).framing,
366	yaw,
367	pitch,
368	job.target_width as f32 / job.target_height as f32,
369	);
370	Ok(Scene {
371	draws,
372	view,
373	projection,
374	width: job.target_width * SCALE,
375	height: job.target_height * SCALE,
376	})
377	}
378
379	impl Scene {
380	pub fn validate(&self) -> Result<(), String> {
381	if self.width == 0
382	\|\| self.height == 0
383	\|\| self.width > MAX_HIGHRES
384	\|\| self.height > MAX_HIGHRES
385	\|\| self.draws.len() > 4096
386	\|\| self
387	.view
388	.iter()
389	.chain(&self.projection)
390	.any(\|v\| !v.is_finite())
391	{
392	return Err("ongeldige GPU-scène/afmetingen".into());
393	}
394	for d in &self.draws {
395	if d.positions.len() > 1_000_000
396	\|\| d.positions.len() != d.normals.len()
397	\|\| d.indices.len() > 3_000_000
398	\|\| !d.indices.len().is_multiple_of(3)
399	\|\| d.indices.iter().any(\|i\| *i as usize >= d.positions.len())
400	\|\| d.positions
401	.iter()
402	.chain(d.normals.iter())
403	.flatten()
404	.chain(d.uvs.iter().flatten())
405	.chain(d.vertex_colors.iter().flatten())
406	.chain(d.color.iter())
407	.any(\|v\| !v.is_finite())
408	\|\| !d.specular.is_finite()
409	\|\| !d.cutoff.is_finite()
410	{
411	return Err("ongeldige of te grote GPU-geometrie".into());
412	}
413	for t in [d.albedo.as_ref(), d.shiny.as_ref()].into_iter().flatten() {
414	if t.width == 0
415	\|\| t.height == 0
416	\|\| t.width > 2048
417	\|\| t.height > 2048
418	\|\| t.rgba.len() != t.width as usize * t.height as usize * 4
419	{
420	return Err("ongeldige GPU-texture".into());
421	}
422	}
423	}
424	Ok(())
425	}
426	}
427
428	#[derive(Default)]
429	pub struct GpuRenderer {
430	program: Option<glow::Program>,
431	vao: Option<glow::VertexArray>,
432	vbo: Option<glow::Buffer>,
433	ebo: Option<glow::Buffer>,
434	fbo: Option<glow::Framebuffer>,
435	colors: Vec<glow::Texture>,
436	depth: Option<glow::Renderbuffer>,
437	extent: [u32; 2],
438	}
439	impl GpuRenderer {
440	/// # Safety
441	/// A native OpenGL 3.3 context must be current on this thread.
442	pub unsafe fn destroy(&mut self, gl: &glow::Context) {
443	self.destroy_target(gl);
444	if let Some(x) = self.program.take() {
445	gl.delete_program(x);
446	}
447	if let Some(x) = self.vao.take() {
448	gl.delete_vertex_array(x);
449	}
450	if let Some(x) = self.vbo.take() {
451	gl.delete_buffer(x);
452	}
453	if let Some(x) = self.ebo.take() {
454	gl.delete_buffer(x);
455	}
456	}
457	unsafe fn destroy_target(&mut self, gl: &glow::Context) {
458	for x in self.colors.drain(..) {
459	gl.delete_texture(x);
460	}
461	if let Some(x) = self.depth.take() {
462	gl.delete_renderbuffer(x);
463	}
464	if let Some(x) = self.fbo.take() {
465	gl.delete_framebuffer(x);
466	}
467	self.extent = [0, 0];
468	}
469	unsafe fn init(&mut self, gl: &glow::Context) -> Result<(), String> {
470	if self.program.is_some() {
471	return Ok(());
472	}
473	let p = gl.create_program()?;
474	let mut shaders = Vec::new();
475	for (kind, source) in [
476	(glow::VERTEX_SHADER, VERTEX),
477	(glow::FRAGMENT_SHADER, FRAGMENT),
478	] {
479	let shader = gl.create_shader(kind)?;
480	gl.shader_source(shader, source);
481	gl.compile_shader(shader);
482	if !gl.get_shader_compile_status(shader) {
483	let error = gl.get_shader_info_log(shader);
484	gl.delete_shader(shader);
485	for s in shaders {
486	gl.delete_shader(s);
487	}
488	gl.delete_program(p);
489	return Err(error);
490	}
491	gl.attach_shader(p, shader);
492	shaders.push(shader);
493	}
494	gl.link_program(p);
495	let result = if gl.get_program_link_status(p) {
496	Ok(())
497	} else {
498	Err(gl.get_program_info_log(p))
499	};
500	for s in shaders {
501	gl.detach_shader(p, s);
502	gl.delete_shader(s);
503	}
504	if let Err(e) = result {
505	gl.delete_program(p);
506	return Err(e);
507	}
508	self.program = Some(p);
509	self.vao = Some(gl.create_vertex_array()?);
510	self.vbo = Some(gl.create_buffer()?);
511	self.ebo = Some(gl.create_buffer()?);
512	Ok(())
513	}
514	unsafe fn target(&mut self, gl: &glow::Context, w: u32, h: u32) -> Result<(), String> {
515	if self.extent == [w, h] {
516	return Ok(());
517	}
518	self.destroy_target(gl);
519	self.fbo = Some(gl.create_framebuffer()?);
520	gl.bind_framebuffer(glow::FRAMEBUFFER, self.fbo);
521	for slot in 0..3 {
522	let t = gl.create_texture()?;
523	self.colors.push(t);
524	gl.bind_texture(glow::TEXTURE_2D, Some(t));
525	gl.tex_parameter_i32(
526	glow::TEXTURE_2D,
527	glow::TEXTURE_MIN_FILTER,
528	glow::NEAREST as i32,
529	);
530	gl.tex_parameter_i32(
531	glow::TEXTURE_2D,
532	glow::TEXTURE_MAG_FILTER,
533	glow::NEAREST as i32,
534	);
535	gl.tex_image_2d(
536	glow::TEXTURE_2D,
537	0,
538	glow::RGBA8 as i32,
539	w as i32,
540	h as i32,
541	0,
542	glow::RGBA,
543	glow::UNSIGNED_BYTE,
544	None,
545	);
546	gl.framebuffer_texture_2d(
547	glow::FRAMEBUFFER,
548	glow::COLOR_ATTACHMENT0 + slot,
549	glow::TEXTURE_2D,
550	Some(t),
551	0,
552	);
553	}
554	let d = gl.create_renderbuffer()?;
555	self.depth = Some(d);
556	gl.bind_renderbuffer(glow::RENDERBUFFER, Some(d));
557	gl.renderbuffer_storage(
558	glow::RENDERBUFFER,
559	glow::DEPTH_COMPONENT24,
560	w as i32,
561	h as i32,
562	);
563	gl.framebuffer_renderbuffer(
564	glow::FRAMEBUFFER,
565	glow::DEPTH_ATTACHMENT,
566	glow::RENDERBUFFER,
567	Some(d),
568	);
569	gl.draw_buffers(&[
570	glow::COLOR_ATTACHMENT0,
571	glow::COLOR_ATTACHMENT1,
572	glow::COLOR_ATTACHMENT2,
573	]);
574	if gl.check_framebuffer_status(glow::FRAMEBUFFER) != glow::FRAMEBUFFER_COMPLETE {
575	return Err("productie-FBO onvolledig".into());
576	}
577	self.extent = [w, h];
578	Ok(())
579	}
580	/// Render and read back unlit color, view-space normals, scalar specular and
581	/// the actual depth attachment. All four use the same winning surface.
582	/// # Safety
583	/// `gl` is current on the UI thread. GL state is reset for egui painting.
584	pub unsafe fn render(&mut self, gl: &glow::Context, scene: &Scene) -> Result<Buffers, String> {
585	if scene.width == 0
586	\|\| scene.height == 0
587	\|\| scene.width > MAX_HIGHRES
588	\|\| scene.height > MAX_HIGHRES
589	{
590	return Err("highres moet 1–2048 pixels zijn (8× target)".into());
591	}
592	scene.validate()?;
593	let previous = gl.get_parameter_i32(glow::FRAMEBUFFER_BINDING);
594	let mut vp = [0; 4];
595	gl.get_parameter_i32_slice(glow::VIEWPORT, &mut vp);
596	let result = (\|\| {
597	self.init(gl)?;
598	self.target(gl, scene.width, scene.height)?;
599	gl.bind_framebuffer(glow::FRAMEBUFFER, self.fbo);
600	gl.draw_buffers(&[
601	glow::COLOR_ATTACHMENT0,
602	glow::COLOR_ATTACHMENT1,
603	glow::COLOR_ATTACHMENT2,
604	]);
605	gl.viewport(0, 0, scene.width as i32, scene.height as i32);
606	gl.disable(glow::SCISSOR_TEST);
607	gl.disable(glow::CULL_FACE);
608	gl.disable(glow::BLEND);
609	gl.enable(glow::DEPTH_TEST);
610	gl.depth_mask(true);
611	gl.depth_func(glow::LESS);
612	gl.clear_depth_f32(1.);
613	gl.clear_color(0., 0., 0., 0.);
614	gl.clear(glow::COLOR_BUFFER_BIT \| glow::DEPTH_BUFFER_BIT);
615	let p = self.program.ok_or("shader ontbreekt")?;
616	gl.use_program(Some(p));
617	gl.uniform_matrix_4_f32_slice(
618	gl.get_uniform_location(p, "u_view").as_ref(),
619	false,
620	&scene.view,
621	);
622	gl.uniform_matrix_4_f32_slice(
623	gl.get_uniform_location(p, "u_projection").as_ref(),
624	false,
625	&scene.projection,
626	);
627	gl.bind_vertex_array(self.vao);
628	gl.bind_buffer(glow::ARRAY_BUFFER, self.vbo);
629	gl.bind_buffer(glow::ELEMENT_ARRAY_BUFFER, self.ebo);
630	for (slot, size, offset) in [(0, 3, 0), (1, 3, 3), (2, 2, 6), (3, 4, 8)] {
631	gl.enable_vertex_attrib_array(slot);
632	gl.vertex_attrib_pointer_f32(slot, size, glow::FLOAT, false, 12 * 4, offset * 4);
633	}
634	for draw in &scene.draws {
635	if draw.positions.len() != draw.normals.len()
636	\|\| draw
637	.indices
638	.iter()
639	.any(\|i\| *i as usize >= draw.positions.len())
640	\|\| draw.indices.len() > i32::MAX as usize
641	{
642	return Err("ongeldige GPU-geometrie".into());
643	}
644	let mut data = Vec::with_capacity(draw.positions.len() * 12);
645	for (i, pos) in draw.positions.iter().enumerate() {
646	data.extend_from_slice(pos);
647	data.extend_from_slice(&draw.normals[i]);
648	data.extend_from_slice(&draw.uvs.get(i).copied().unwrap_or([0.; 2]));
649	data.extend_from_slice(&draw.vertex_colors.get(i).copied().unwrap_or([1.; 4]));
650	}
651	gl.buffer_data_u8_slice(
652	glow::ARRAY_BUFFER,
653	std::slice::from_raw_parts(data.as_ptr().cast(), data.len() * 4),
654	glow::STREAM_DRAW,
655	);
656	gl.buffer_data_u8_slice(
657	glow::ELEMENT_ARRAY_BUFFER,
658	std::slice::from_raw_parts(
659	draw.indices.as_ptr().cast(),
660	draw.indices.len() * 4,
661	),
662	glow::STREAM_DRAW,
663	);
664	gl.uniform_4_f32(
665	gl.get_uniform_location(p, "u_color").as_ref(),
666	draw.color[0],
667	draw.color[1],
668	draw.color[2],
669	draw.color[3],
670	);
671	gl.uniform_1_f32(
672	gl.get_uniform_location(p, "u_specular").as_ref(),
673	draw.specular,
674	);
675	gl.uniform_1_f32(gl.get_uniform_location(p, "u_cutoff").as_ref(), draw.cutoff);
676	gl.uniform_1_i32(
677	gl.get_uniform_location(p, "u_flat").as_ref(),
678	i32::from(draw.flat_normals),
679	);
680	let mut temp = Vec::new();
681	for (unit, name, texture) in [
682	(0, "u_albedo", draw.albedo.as_ref()),
683	(1, "u_shiny", draw.shiny.as_ref()),
684	] {
685	gl.active_texture(glow::TEXTURE0 + unit);
686	gl.uniform_1_i32(gl.get_uniform_location(p, name).as_ref(), unit as i32);
687	gl.uniform_1_i32(
688	gl.get_uniform_location(p, &format!("{name}_enabled"))
689	.as_ref(),
690	i32::from(texture.is_some()),
691	);
692	if let Some(image) = texture {
693	let t = gl.create_texture()?;
694	temp.push(t);
695	gl.bind_texture(glow::TEXTURE_2D, Some(t));
696	gl.tex_parameter_i32(
697	glow::TEXTURE_2D,
698	glow::TEXTURE_MIN_FILTER,
699	glow::NEAREST as i32,
700	);
701	gl.tex_parameter_i32(
702	glow::TEXTURE_2D,
703	glow::TEXTURE_MAG_FILTER,
704	glow::NEAREST as i32,
705	);
706	gl.tex_parameter_i32(
707	glow::TEXTURE_2D,
708	glow::TEXTURE_WRAP_S,
709	glow::REPEAT as i32,
710	);
711	gl.tex_parameter_i32(
712	glow::TEXTURE_2D,
713	glow::TEXTURE_WRAP_T,
714	glow::REPEAT as i32,
715	);
716	gl.tex_image_2d(
717	glow::TEXTURE_2D,
718	0,
719	if unit == 0 {
720	glow::SRGB8_ALPHA8 as i32
721	} else {
722	glow::RGBA8 as i32
723	},
724	image.width as i32,
725	image.height as i32,
726	0,
727	glow::RGBA,
728	glow::UNSIGNED_BYTE,
729	Some(&image.rgba),
730	);
731	} else {
732	gl.bind_texture(glow::TEXTURE_2D, None);
733	}
734	}
735	gl.draw_elements(
736	glow::TRIANGLES,
737	draw.indices.len() as i32,
738	glow::UNSIGNED_INT,
739	0,
740	);
741	for t in temp {
742	gl.delete_texture(t);
743	}
744	}
745	let pixels = scene.width as usize * scene.height as usize;
746	let mut maps = Vec::new();
747	gl.pixel_store_i32(glow::PACK_ALIGNMENT, 1);
748	for slot in 0..3 {
749	let mut data = vec![0; pixels * 4];
750	gl.read_buffer(glow::COLOR_ATTACHMENT0 + slot);
751	gl.read_pixels(
752	0,
753	0,
754	scene.width as i32,
755	scene.height as i32,
756	glow::RGBA,
757	glow::UNSIGNED_BYTE,
758	glow::PixelPackData::Slice(&mut data),
759	);
760	flip_rows(&mut data, scene.width as usize * 4, scene.height as usize);
761	maps.push(data);
762	}
763	let mut depth = vec![1f32; pixels];
764	let bytes = std::slice::from_raw_parts_mut(depth.as_mut_ptr().cast(), pixels * 4);
765	gl.read_pixels(
766	0,
767	0,
768	scene.width as i32,
769	scene.height as i32,
770	glow::DEPTH_COMPONENT,
771	glow::FLOAT,
772	glow::PixelPackData::Slice(bytes),
773	);
774	flip_rows(&mut depth, scene.width as usize, scene.height as usize);
775	let error = gl.get_error();
776	if error != glow::NO_ERROR {
777	return Err(format!("productie-GL fout 0x{error:x}"));
778	}
779	let specular = maps.pop().unwrap();
780	let normal = maps.pop().unwrap();
781	let diffuse = maps.pop().unwrap();
782	Ok(Buffers {
783	width: scene.width,
784	height: scene.height,
785	diffuse,
786	normal,
787	specular,
788	depth,
789	})
790	})();
791	gl.bind_framebuffer(
792	glow::FRAMEBUFFER,
793	std::num::NonZeroU32::new(previous as u32).map(glow::NativeFramebuffer),
794	);
795	gl.viewport(vp[0], vp[1], vp[2], vp[3]);
796	gl.bind_vertex_array(None);
797	gl.use_program(None);
798	gl.active_texture(glow::TEXTURE0);
799	gl.disable(glow::DEPTH_TEST);
800	gl.disable(glow::SCISSOR_TEST);
801	gl.enable(glow::BLEND);
802	gl.pixel_store_i32(glow::PACK_ALIGNMENT, 4);
803	result
804	}
805	}
806	fn flip_rows<T>(data: &mut [T], stride: usize, height: usize) {
807	for y in 0..height / 2 {
808	let split = (height - 1 - y) * stride;
809	let (a, b) = data.split_at_mut(split);
810	a[y * stride..(y + 1) * stride].swap_with_slice(&mut b[..stride]);
811	}
812	}
813	const VERTEX: &str = r#"#version 330
814	layout(location=0)in vec3 a_position;layout(location=1)in vec3 a_normal;layout(location=2)in vec2 a_uv;layout(location=3)in vec4 a_color;
815	uniform mat4 u_view;uniform mat4 u_projection;out vec3 v_normal;out vec3 v_view_position;out vec2 v_uv;out vec4 v_color;
816	void main(){v_color=a_color;v_normal=mat3(u_view)a_normal;v_uv=a_uv;vec4 position=u_viewvec4(a_position,1.0);v_view_position=position.xyz;gl_Position=u_projection*position;}
817	"#;
818	const FRAGMENT: &str = r#"#version 330
819	in vec3 v_normal;in vec3 v_view_position;uniform bool u_flat;in vec2 v_uv;in vec4 v_color;uniform vec4 u_color;uniform float u_cutoff;uniform vec3 u_light_direction; // deliberately unused: production maps are unlit
820	uniform float u_specular;
821	uniform sampler2D u_albedo;uniform sampler2D u_shiny;uniform bool u_albedo_enabled;uniform bool u_shiny_enabled;
822	layout(location=0)out vec4 diffuse;layout(location=1)out vec4 normal;layout(location=2)out vec4 specular;
823	vec3 encode_srgb(vec3 x){return mix(x12.92,1.055pow(max(x,vec3(0.0)),vec3(1.0/2.4))-0.055,step(vec3(0.0031308),x));}
824	void main(){vec3 n=normalize(v_normal);if(u_flat){n=normalize(cross(dFdx(v_view_position),dFdy(v_view_position)));if(!gl_FrontFacing)n=-n;}vec4 c=u_colorv_color;if(u_albedo_enabled)c=texture(u_albedo,v_uv);if(c.a<u_cutoff)discard;float s=u_specular;if(u_shiny_enabled)s=dot(texture(u_shiny,v_uv).rgb,vec3(0.2126,0.7152,0.0722));diffuse=vec4(encode_srgb(clamp(c.rgb,0.0,1.0)),c.a);normal=vec4(n0.5+0.5,c.a);specular=vec4(vec3(clamp(s,0.0,1.0)),c.a);}
825	"#;
826
827	fn image(w: u32, h: u32, rgba: Vec<u8>) -> ImageBuf {
828	ImageBuf {
829	width: w,
830	height: h,
831	rgba,
832	}
833	}
834	fn linear(x: u8) -> f32 {
835	static LUT: std::sync::OnceLock<[f32; 256]> = std::sync::OnceLock::new();
836	LUT.get_or_init(\|\| {
837	std::array::from_fn(\|i\| {
838	let v = i as f32 / 255.;
839	if v <= 0.04045 {
840	v / 12.92
841	} else {
842	((v + 0.055) / 1.055).powf(2.4)
843	}
844	})
845	})[x as usize]
846	}
847
848	fn srgb(x: f32) -> u8 {
849	let v = if x <= 0.0031308 {
850	x * 12.92
851	} else {
852	1.055 * x.powf(1. / 2.4) - 0.055
853	};
854	(v * 255.).round().clamp(0., 255.) as u8
855	}
856	impl Buffers {
857	pub fn validate(&self) -> Result<(), String> {
858	let pixels = (self.width as usize)
859	.checked_mul(self.height as usize)
860	.ok_or("te veel pixels")?;
861	if self.width == 0
862	\|\| self.height == 0
863	\|\| self.width > MAX_HIGHRES
864	\|\| self.height > MAX_HIGHRES
865	\|\| self.diffuse.len() != pixels * 4
866	\|\| self.normal.len() != pixels * 4
867	\|\| self.specular.len() != pixels * 4
868	\|\| self.depth.len() != pixels
869	\|\| self
870	.depth
871	.iter()
872	.any(\|d\| !d.is_finite() \|\| !(0.0..=1.0).contains(d))
873	{
874	return Err("ongeldige GPU-mapafmetingen/data".into());
875	}
876	Ok(())
877	}
878	}
879	pub fn detail_map(raw: &Buffers) -> Result<Vec<u8>, String> {
880	raw.validate()?;
881	let w = raw.width as usize;
882	let h = raw.height as usize;
883	let mut out = vec![0; w * h];
884	for y in 0..h {
885	for x in 0..w {
886	let i = y * w + x;
887	let mut edge = 0f32;
888	for (nx, ny) in [
889	(x.saturating_sub(1), y),
890	((x + 1).min(w - 1), y),
891	(x, y.saturating_sub(1)),
892	(x, (y + 1).min(h - 1)),
893	] {
894	let j = ny * w + nx;
895	let a = raw.diffuse[i * 4 + 3] as f32 / 255.;
896	let b = raw.diffuse[j * 4 + 3] as f32 / 255.;
897	edge = edge.max((a - b).abs());
898	if a > 0. && b > 0. {
899	for c in 0..3 {
900	edge = edge.max(
901	(linear(raw.diffuse[i * 4 + c]) - linear(raw.diffuse[j * 4 + c])).abs(),
902	);
903	edge = edge.max(
904	(raw.normal[i * 4 + c] as f32 - raw.normal[j * 4 + c] as f32).abs()
905	/ 255.,
906	);
907	}
908	edge = edge.max(((raw.depth[i] - raw.depth[j]).abs() * 200.).min(1.));
909	}
910	}
911	out[i] = (edge * 255.).round().clamp(0., 255.) as u8;
912	}
913	}
914	Ok(out)
915	}
916	pub fn detail_image(raw: &Buffers, detail: &[u8]) -> ImageBuf {
917	let mut rgba = Vec::with_capacity(detail.len() * 4);
918	for (i, v) in detail.iter().enumerate() {
919	rgba.extend_from_slice(&[v, v, v, raw.diffuse[i 4 + 3]]);
920	}
921	image(raw.width, raw.height, rgba)
922	}
923	pub fn resolve(raw: &Buffers, detail: &[u8], w: u32, h: u32) -> Result<Target, String> {
924	raw.validate()?;
925	if w == 0 \|\| h == 0 \|\| w > MAX_HIGHRES / SCALE \|\| h > MAX_HIGHRES / SCALE {
926	return Err("ongeldige target-afmetingen".into());
927	}
928	if raw.width != w * SCALE
929	\|\| raw.height != h * SCALE
930	\|\| detail.len() != raw.width as usize * raw.height as usize
931	{
932	return Err("ongeldige 8× resolve-afmetingen".into());
933	}
934	let count = w as usize * h as usize;
935	let mut diffuse = vec![0; count * 4];
936	let mut normals = diffuse.clone();
937	let mut specular = diffuse.clone();
938	let mut depth = vec![0u16; count * 2];
939	let mut depth_preview = diffuse.clone();
940	for y in 0..h {
941	for x in 0..w {
942	let i = (y * w + x) as usize;
943	let mut closest = 1f32;
944	let mut coverage = 0f32;
945	for dy in 0..SCALE {
946	for dx in 0..SCALE {
947	let j = ((y * SCALE + dy) * raw.width + x * SCALE + dx) as usize;
948	let a = raw.diffuse[j * 4 + 3] as f32 / 255.;
949	coverage += a;
950	if a > 0. && raw.depth[j].is_finite() {
951	closest = closest.min(raw.depth[j]);
952	}
953	}
954	}
955	let alpha = (coverage / (SCALE * SCALE) as f32 * 255.)
956	.round()
957	.clamp(0., 255.) as u8;
958	if alpha == 0 {
959	continue;
960	}
961	let mut color = [0.; 3];
962	let mut n = [0.; 3];
963	let mut shiny = 0.;
964	let mut sum = 0.;
965	// One coherent front-surface cluster; never average foreground with a rear
966	// surface. Edges get extra weight, and any thin covered feature survives.
967	for dy in 0..SCALE {
968	for dx in 0..SCALE {
969	let j = ((y * SCALE + dy) * raw.width + x * SCALE + dx) as usize;
970	let a = raw.diffuse[j * 4 + 3] as f32 / 255.;
971	if a == 0. \|\| raw.depth[j] > closest + 0.0025 {
972	continue;
973	}
974	let weight = a * (1. + 4. * detail[j] as f32 / 255.);
975	sum += weight;
976	for c in 0..3 {
977	color[c] += linear(raw.diffuse[j * 4 + c]) * weight;
978	n[c] += (raw.normal[j * 4 + c] as f32 / 255. * 2. - 1.) * weight;
979	}
980	shiny += raw.specular[j * 4] as f32 * weight;
981	}
982	}
983	if sum <= 0. {
984	return Err("ongeldige depth/coverage in GPU-resultaat".into());
985	}
986	n = normalize(n);
987	let d = (closest.clamp(0., 1.) * 65535.).round() as u16;
988	for c in 0..3 {
989	diffuse[i * 4 + c] = srgb(color[c] / sum);
990	normals[i * 4 + c] = ((n[c] * 0.5 + 0.5) * 255.).round().clamp(0., 255.) as u8;
991	specular[i * 4 + c] = (shiny / sum).round().clamp(0., 255.) as u8;
992	depth_preview[i * 4 + c] = (d >> 8) as u8;
993	}
994	for map in [
995	&mut diffuse,
996	&mut normals,
997	&mut specular,
998	&mut depth_preview,
999	] {
1000	map[i * 4 + 3] = alpha;
1001	}
1002	depth[i * 2] = d;
1003	depth[i * 2 + 1] = u16::from(alpha) * 257;
1004	}
1005	}
1006	Ok(Target {
1007	diffuse: image(w, h, diffuse),
1008	normal: image(w, h, normals),
1009	specular: image(w, h, specular),
1010	depth,
1011	depth_preview: image(w, h, depth_preview),
1012	})
1013	}
1014
1015	fn safe_parent(root: &Path, relative: &Path) -> Result<PathBuf, String> {
1016	let relative = relative
1017	.to_str()
1018	.ok_or("ongeldig uitvoerpad")?
1019	.replace('\\', "/");
1020	let relative = crate::project::portable_relative(&relative)?;
1021	let relative = relative.as_str();
1022	let canonical = root.canonicalize().map_err(\|e\| e.to_string())?;
1023	let path = root.join(relative);
1024	let parent = path.parent().ok_or("uitvoermap ontbreekt")?;
1025	let mut prefix = root.to_path_buf();
1026	for part in Path::new(relative)
1027	.parent()
1028	.unwrap_or(Path::new(""))
1029	.components()
1030	{
1031	prefix.push(part);
1032	if !prefix.exists() {
1033	std::fs::create_dir(&prefix).map_err(\|e\| e.to_string())?;
1034	}
1035	let real = prefix.canonicalize().map_err(\|e\| e.to_string())?;
1036	if !real.starts_with(&canonical) {
1037	return Err("uitvoer verlaat projectmap".into());
1038	}
1039	}
1040	if !parent
1041	.canonicalize()
1042	.map_err(\|e\| e.to_string())?
1043	.starts_with(canonical)
1044	{
1045	return Err("onveilig uitvoerpad".into());
1046	}
1047	Ok(path)
1048	}
1049	fn atomic_file(
1050	root: &Path,
1051	relative: &Path,
1052	write: impl FnOnce(&mut std::fs::File) -> Result<(), String>,
1053	) -> Result<(), String> {
1054	let path = safe_parent(root, relative)?;
1055	static TEMP_SEQ: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
1056	let temp = path.with_extension(format!(
1057	"part-{}-{}",
1058	std::process::id(),
1059	TEMP_SEQ.fetch_add(1, Ordering::Relaxed)
1060	));
1061	let mut owned = false;
1062	let result = (\|\| {
1063	let mut file = std::fs::OpenOptions::new()
1064	.write(true)
1065	.create_new(true)
1066	.open(&temp)
1067	.map_err(\|e\| e.to_string())?;
1068	owned = true;
1069	write(&mut file)?;
1070	file.sync_all().map_err(\|e\| e.to_string())?;
1071	std::fs::hard_link(&temp, &path).map_err(\|e\| e.to_string())?;
1072	Ok(())
1073	})();
1074	if owned {
1075	let _ = std::fs::remove_file(temp);
1076	}
1077	result
1078	}
1079	fn encode_rgba_png(img: &ImageBuf, diffuse_srgb: bool) -> Result<Vec<u8>, String> {
1080	if img.width == 0
1081	\|\| img.height == 0
1082	\|\| img.width > MAX_HIGHRES / SCALE
1083	\|\| img.height > MAX_HIGHRES / SCALE
1084	\|\| img.rgba.len() != img.width as usize * img.height as usize * 4
1085	{
1086	return Err("ongeldige PNG-afmetingen".into());
1087	}
1088	let mut cursor = std::io::Cursor::new(Vec::new());
1089	{
1090	let mut encoder = png::Encoder::new(&mut cursor, img.width, img.height);
1091	encoder.set_color(png::ColorType::Rgba);
1092	encoder.set_depth(png::BitDepth::Eight);
1093	if diffuse_srgb {
1094	encoder.set_source_srgb(png::SrgbRenderingIntent::Perceptual);
1095	}
1096	let mut writer = encoder.write_header().map_err(\|e\| e.to_string())?;
1097	writer
1098	.write_image_data(&img.rgba)
1099	.map_err(\|e\| e.to_string())?;
1100	writer.finish().map_err(\|e\| e.to_string())?;
1101	}
1102	Ok(cursor.into_inner())
1103	}
1104
1105	fn encode_depth_png(w: u32, h: u32, depth: &[u16]) -> Result<Vec<u8>, String> {
1106	if w == 0
1107	\|\| h == 0
1108	\|\| w > MAX_HIGHRES / SCALE
1109	\|\| h > MAX_HIGHRES / SCALE
1110	\|\| depth.len() != w as usize * h as usize * 2
1111	{
1112	return Err("ongeldige 16-bit depthafmetingen".into());
1113	}
1114	let samples: Vec<u8> = depth.iter().flat_map(\|x\| x.to_be_bytes()).collect();
1115	let mut cursor = std::io::Cursor::new(Vec::new());
1116	{
1117	let mut encoder = png::Encoder::new(&mut cursor, w, h);
1118	encoder.set_color(png::ColorType::GrayscaleAlpha);
1119	encoder.set_depth(png::BitDepth::Sixteen);
1120	let mut writer = encoder.write_header().map_err(\|e\| e.to_string())?;
1121	writer
1122	.write_image_data(&samples)
1123	.map_err(\|e\| e.to_string())?;
1124	writer.finish().map_err(\|e\| e.to_string())?;
1125	}
1126	Ok(cursor.into_inner())
1127	}
1128
1129	/// Atomically publish an RGBA8 target PNG; returns the SHA-256 hex of the file bytes.
1130	pub fn write_rgba(root: &Path, relative: &Path, img: &ImageBuf) -> Result<String, String> {
1131	let diffuse_srgb = relative
1132	.file_name()
1133	.and_then(\|p\| p.to_str())
1134	.map(\|p\| p.ends_with("_diffuse.png"))
1135	.unwrap_or(false);
1136	let bytes = encode_rgba_png(img, diffuse_srgb)?;
1137	let digest = crate::digest::sha256_hex(&bytes);
1138	atomic_file(root, relative, \|file\| {
1139	use std::io::Write;
1140	file.write_all(&bytes).map_err(\|e\| e.to_string())
1141	})?;
1142	Ok(digest)
1143	}
1144
1145	/// Atomically publish a 16-bit gray+alpha depth PNG; returns SHA-256 hex.
1146	pub fn write_depth(
1147	root: &Path,
1148	relative: &Path,
1149	w: u32,
1150	h: u32,
1151	depth: &[u16],
1152	) -> Result<String, String> {
1153	let bytes = encode_depth_png(w, h, depth)?;
1154	let digest = crate::digest::sha256_hex(&bytes);
1155	atomic_file(root, relative, \|file\| {
1156	use std::io::Write;
1157	file.write_all(&bytes).map_err(\|e\| e.to_string())
1158	})?;
1159	Ok(digest)
1160	}
1161
1162	/// Atomic no-clobber publication of already encoded bytes under the run root.
1163	pub(crate) fn publish_bytes(root: &Path, relative: &Path, bytes: &[u8]) -> Result<(), String> {
1164	atomic_file(root, relative, \|file\| {
1165	use std::io::Write;
1166	file.write_all(bytes).map_err(\|e\| e.to_string())
1167	})
1168	}
1169
1170	fn write_json(root: &Path, name: &str, value: serde_json::Value) -> Result<(), String> {
1171	use std::io::Write;
1172	let data = serde_json::to_vec_pretty(&value).map_err(\|e\| e.to_string())?;
1173	atomic_file(root, Path::new(name), \|f\| {
1174	f.write_all(&data).map_err(\|e\| e.to_string())
1175	})
1176	}
1177
1178	pub struct GpuRequest {
1179	pub scene: Scene,
1180	reply: mpsc::SyncSender<Result<Buffers, String>>,
1181	}
1182	impl GpuRequest {
1183	pub fn fail(self, error: String) {
1184	let _ = self.reply.send(Err(error));
1185	}
1186	/// # Safety
1187	/// `gl` must be current on this UI thread.
1188	pub unsafe fn service(self, renderer: &mut GpuRenderer, gl: &glow::Context) {
1189	let result = renderer.render(gl, &self.scene);
1190	let _ = self.reply.send(result);
1191	}
1192	}
1193	#[derive(Default)]
1194	struct Pending {
1195	pass: Option<RenderEvent>,
1196	progress: Option<RenderEvent>,
1197	terminal: Option<RenderEvent>,
1198	}
1199	#[derive(Clone, Default)]
1200	pub struct Mailbox(Arc<Mutex<Pending>>);
1201	impl Mailbox {
1202	pub fn publish(&self, event: RenderEvent) {
1203	if let Ok(mut state) = self.0.lock() {
1204	match event {
1205	RenderEvent::Pass { .. } => {
1206	state.pass = Some(event);
1207	state.progress = None;
1208	}
1209	RenderEvent::Step { .. } => state.progress = Some(event),
1210	_ => state.terminal = Some(event),
1211	}
1212	}
1213	}
1214	pub fn drain(&self) -> Vec<RenderEvent> {
1215	let mut events = Vec::new();
1216	if let Ok(mut s) = self.0.lock() {
1217	events.extend(s.pass.take());
1218	events.extend(s.progress.take());
1219	events.extend(s.terminal.take());
1220	}
1221	events
1222	}
1223	}
1224	pub struct RenderThread {
1225	pub mailbox: Mailbox,
1226	pub gpu: mpsc::Receiver<GpuRequest>,
1227	pub cancel: Arc<AtomicBool>,
1228	pub handle: Option<thread::JoinHandle<()>>,
1229	}
1230	impl Drop for RenderThread {
1231	fn drop(&mut self) {
1232	self.cancel.store(true, Ordering::Relaxed);
1233	}
1234	}
1235	/// Where a production batch writes: a fresh run directory, or an existing
1236	/// incomplete run that is recovered after contract and checksum verification.
1237	#[derive(Debug, Clone, PartialEq, Eq)]
1238	pub enum RunTarget {
1239	Fresh,
1240	Resume(PathBuf),
1241	}
1242
1243	pub fn spawn(job: RenderJob, ctx: Option<eframe::egui::Context>) -> RenderThread {
1244	spawn_target(job, RunTarget::Fresh, ctx)
1245	}
1246
1247	/// Resume a selected incomplete run (see `resume`).
1248	pub fn spawn_resume(
1249	job: RenderJob,
1250	run_dir: PathBuf,
1251	ctx: Option<eframe::egui::Context>,
1252	) -> RenderThread {
1253	spawn_target(job, RunTarget::Resume(run_dir), ctx)
1254	}
1255
1256	fn spawn_target(
1257	job: RenderJob,
1258	target: RunTarget,
1259	ctx: Option<eframe::egui::Context>,
1260	) -> RenderThread {
1261	let mailbox = Mailbox::default();
1262	let output = mailbox.clone();
1263	let cancel = Arc::new(AtomicBool::new(false));
1264	let flag = cancel.clone();
1265	let (tx, gpu) = mpsc::channel();
1266	let handle = thread::spawn(move \|\| {
1267	let mut emit = \|event\| {
1268	output.publish(event);
1269	if let Some(ctx) = &ctx {
1270	ctx.request_repaint();
1271	}
1272	};
1273	let result = execute_target(job, target, &tx, &flag, ctx.as_ref(), &mut emit);
1274	if let Err(error) = result {
1275	if flag.load(Ordering::Relaxed) {
1276	emit(RenderEvent::Cancelled);
1277	} else {
1278	emit(RenderEvent::Failed(error));
1279	}
1280	}
1281	});
1282	RenderThread {
1283	mailbox,
1284	gpu,
1285	cancel,
1286	handle: Some(handle),
1287	}
1288	}
1289
1290	/// The immutable export contract of a job: validated/resolved job, plan,
1291	/// set token and the exact `render.json` document.
1292	pub struct Contract {
1293	pub job: RenderJob,
1294	pub plan: Plan,
1295	pub set: String,
1296	pub render_doc: serde_json::Value,
1297	}
1298
1299	/// Validate a job and build its `render.json` contract without touching disk.
1300	pub fn contract(mut job: RenderJob) -> Result<Contract, String> {
1301	job.framing.validate()?;
1302	let pivot = crate::camera::resolve(&job.character, job.framing);
1303	job.framing = pivot.framing;
1304	if job.target_width == 0
1305	\|\| job.target_height == 0
1306	\|\| job.target_width > MAX_HIGHRES / SCALE
1307	\|\| job.target_height > MAX_HIGHRES / SCALE
1308	{
1309	return Err("8× highres vereist targetafmetingen 1–256".into());
1310	}
1311	if !["male", "female"].contains(&job.sex.as_str()) {
1312	return Err("ongeldig geslacht".into());
1313	}
1314	if let Some(p) = &job.preset {
1315	p.validate()?;
1316	if !p.applies[usize::from(job.sex == "female")] {
1317	return Err("equipment niet geldig voor dit geslacht".into());
1318	}
1319	if p.attachments.is_empty() {
1320	return Err("equipment heeft geen onderdelen".into());
1321	}
1322	}
1323	let plan = plan(&job.character, job.fps)?;
1324	let output_bytes =
1325	u64::from(plan.images) * u64::from(job.target_width) * u64::from(job.target_height) * 16;
1326	if output_bytes > 16 * 1024 * 1024 * 1024 {
1327	return Err("batch groter dan 16 GiB ongecomprimeerde targetmaps".into());
1328	}
1329	let set = job
1330	.preset
1331	.as_ref()
1332	.map(\|p\| p.name.as_str())
1333	.unwrap_or("body")
1334	.to_string();
1335	if job.project_id.is_empty() \|\| job.project_id.len() > 128 {
1336	return Err("project.id ongeldig voor export-identiteit".into());
1337	}
1338	if job.project_name.len() > 256 {
1339	return Err("project.name te lang voor export-identiteit".into());
1340	}
1341	if !crate::digest::is_sha256_hex(&job.body_model.sha256) {
1342	return Err("body_model.sha256 ongeldig".into());
1343	}
1344	crate::project::portable_relative(&job.body_model.path)?;
1345	match (&job.preset, &job.preset_sha256) {
1346	(None, None) => {}
1347	(Some(p), Some(hash)) if p.name == set && crate::digest::is_sha256_hex(hash) => {}
1348	_ => return Err("equipment fingerprint past niet bij de job".into()),
1349	}
1350	let equipment_preset = job.preset.as_ref().map(\|p\| {
1351	serde_json::json!({
1352	"name": p.name,
1353	"sha256": job.preset_sha256.as_ref().expect("checked"),
1354	})
1355	});
1356	let clips_json = plan
1357	.clips
1358	.iter()
1359	.enumerate()
1360	.map(\|(i, c)\| {
1361	serde_json::json!({
1362	"name": c.source_name,
1363	"token": c.token,
1364	"frames": c.frames,
1365	"duration": job.character.clips.get(i).map(\|c\| c.duration).unwrap_or(0.),
1366	})
1367	})
1368	.collect::<Vec<_>>();
1369	let render_doc = serde_json::json!({
1370	"format_version": crate::export_set::OUTPUT_META_VERSION,
1371	"status": "incomplete",
1372	"project": {"id": job.project_id, "name": job.project_name},
1373	"sex": job.sex,
1374	"set": set,
1375	"body_model": {"path": job.body_model.path, "sha256": job.body_model.sha256},
1376	"equipment_preset": equipment_preset,
1377	"target": [job.target_width, job.target_height],
1378	"fps": job.fps,
1379	"highres_scale": SCALE,
1380	"framing": job.framing,
1381	"pivot_source": pivot.source,
1382	"near": NEAR,
1383	"far": FAR,
1384	"normal_space": "view (+Y up), PNG rows top-down",
1385	"camera_distance": 10,
1386	"yaw_zero": "camera on -Z",
1387	"pitches": [-30, 0, 30],
1388	"yaw_step": 30,
1389	"sampling": "clip -> frame (t=frame/fps) -> pitch -> yaw -> pass; ceil(durationfps) snapped within 4f32_epsilon*max(1,samples) of an integer to omit floating terminal duplicates; root motion retained",
1390	"alpha": "straight, opaque/cutout, coverage resolve",
1391	"diffuse": "unlit sRGB albedo × vertex color, linear-light detail resolve",
1392	"depth": "16-bit gray+alpha; distance=near+(sample/65535)*(far-near)",
1393	"specular": "linear scalar; body defaults zero",
1394	"pass_order": PASSES,
1395	"saved_maps": ["diffuse", "depth", "normal", "specular"],
1396	"clips": clips_json,
1397	"images": plan.images,
1398	"passes": plan.passes,
1399	"png_files": plan.files,
1400	});
1401	Ok(Contract {
1402	job,
1403	plan,
1404	set,
1405	render_doc,
1406	})
1407	}
1408
1409	/// Saved map tokens in per-image publication order.
1410	pub const SAVED_ORDER: [&str; 4] = ["diffuse", "depth", "normal", "specular"];
1411
1412	/// Every planned target PNG (relative, `/`-separated) in render order, four per image.
1413	pub fn planned_paths(plan: &Plan, sex: &str, set: &str) -> Result<Vec<String>, String> {
1414	let mut out = Vec::with_capacity(plan.files as usize);
1415	for s in samples(plan) {
1416	for map in SAVED_ORDER {
1417	let path = output_path(
1418	sex,
1419	set,
1420	&plan.clips[s.clip].token,
1421	s.frame,
1422	s.pitch,
1423	s.yaw,
1424	map,
1425	)?;
1426	out.push(path.to_str().ok_or("ongeldig PNG-pad")?.replace('\\', "/"));
1427	}
1428	}
1429	Ok(out)
1430	}
1431
1432	#[cfg(test)]
1433	fn execute(
1434	job: RenderJob,
1435	gpu: &mpsc::Sender<GpuRequest>,
1436	cancel: &AtomicBool,
1437	ctx: Option<&eframe::egui::Context>,
1438	emit: &mut dyn FnMut(RenderEvent),
1439	) -> Result<(), String> {
1440	execute_target(job, RunTarget::Fresh, gpu, cancel, ctx, emit)
1441	}
1442
1443	fn execute_target(
1444	job: RenderJob,
1445	target: RunTarget,
1446	gpu: &mpsc::Sender<GpuRequest>,
1447	cancel: &AtomicBool,
1448	ctx: Option<&eframe::egui::Context>,
1449	emit: &mut dyn FnMut(RenderEvent),
1450	) -> Result<(), String> {
1451	let Contract {
1452	mut job,
1453	plan,
1454	set,
1455	render_doc,
1456	} = contract(job)?;
1457	let planned = planned_paths(&plan, &job.sex, &set)?;
1458	std::fs::create_dir_all(&job.output).map_err(\|e\| e.to_string())?;
1459	let mut session = match target {
1460	RunTarget::Fresh => {
1461	let stamp = std::time::SystemTime::now()
1462	.duration_since(std::time::UNIX_EPOCH)
1463	.map_err(\|e\| e.to_string())?
1464	.as_nanos();
1465	let root = job
1466	.output
1467	.join(format!("run-{stamp}-{}", std::process::id()));
1468	std::fs::create_dir(&root).map_err(\|e\| e.to_string())?;
1469	let session = crate::resume::RunSession::fresh(&root)?;
1470	write_json(&root, "render.json", render_doc.clone())?;
1471	session
1472	}
1473	RunTarget::Resume(dir) => {
1474	let total = plan.passes;
1475	crate::resume::RunSession::resume(
1476	&job.output,
1477	&dir,
1478	&render_doc,
1479	&planned,
1480	&mut \|done, all\| {
1481	emit(RenderEvent::Step {
1482	index: 0,
1483	total,
1484	label: format!("Controle bestaande uitvoer: {done}/{all} PNG's"),
1485	})
1486	},
1487	)?
1488	}
1489	};
1490	let root = session.root.clone();
1491	// Internal unique names select every source clip, even duplicate display names.
1492	for (i, c) in job.character.clips.iter_mut().enumerate() {
1493	c.name = format!("render-clip-{i}");
1494	}
1495	let mut completed = 0u32;
1496	let mut png_sha256 = std::collections::BTreeMap::<String, String>::new();
1497	let mut cache = equipment::TextureCache::default();
1498	let result = (\|\| {
1499	for (index, sample) in samples(&plan).enumerate() {
1500	let clip = &plan.clips[sample.clip];
1501	let frame = sample.frame;
1502	let pitch = sample.pitch;
1503	let yaw = sample.yaw;
1504	let paths = &planned[index * 4..index * 4 + 4];
1505	if cancel.load(Ordering::Relaxed) {
1506	return Err("geannuleerd".into());
1507	}
1508	let pose = format!(
1509	"{} {set} · {} f{frame}/{} · p{pitch} y{yaw}",
1510	job.sex, clip.source_name, clip.frames
1511	);
1512	if paths.iter().all(\|p\| session.verified.contains_key(p)) {
1513	for p in paths {
1514	png_sha256.insert(p.clone(), session.verified[p].clone());
1515	}
1516	completed += PASSES.len() as u32;
1517	emit(RenderEvent::Step {
1518	index: completed,
1519	total: plan.passes,
1520	label: format!("{pose} · al aanwezig, checksums kloppen"),
1521	});
1522	continue;
1523	}
1524	let key = if job.character.clips.is_empty() {
1525	String::new()
1526	} else {
1527	format!("render-clip-{}", sample.clip)
1528	};
1529	emit(RenderEvent::Step {
1530	index: completed,
1531	total: plan.passes,
1532	label: format!("{pose} · highres"),
1533	});
1534	let scene = scene(
1535	&job,
1536	&key,
1537	frame as f32 / job.fps as f32,
1538	pitch as f32,
1539	yaw as f32,
1540	&mut cache,
1541	)?;
1542	let (tx, rx) = mpsc::sync_channel(1);
1543	gpu.send(GpuRequest { scene, reply: tx })
1544	.map_err(\|_\| "GPU-service gesloten")?;
1545	if let Some(ctx) = ctx {
1546	ctx.request_repaint();
1547	}
1548	let raw = loop {
1549	match rx.recv_timeout(std::time::Duration::from_millis(100)) {
1550	Ok(result) => break result?,
1551	Err(mpsc::RecvTimeoutError::Timeout) => {
1552	if cancel.load(Ordering::Relaxed) {
1553	return Err("geannuleerd".into());
1554	}
1555	}
1556	Err(_) => return Err("GPU-service gestopt".into()),
1557	}
1558	};
1559	completed += 1;
1560	emit(RenderEvent::Pass {
1561	index: completed - 1,
1562	total: plan.passes,
1563	label: format!("{pose} · highres"),
1564	image: Some(image(raw.width, raw.height, raw.diffuse.clone())),
1565	});
1566	if cancel.load(Ordering::Relaxed) {
1567	return Err("geannuleerd".into());
1568	}
1569	emit(RenderEvent::Step {
1570	index: completed,
1571	total: plan.passes,
1572	label: format!("{pose} · detail"),
1573	});
1574	let detail = detail_map(&raw)?;
1575	completed += 1;
1576	emit(RenderEvent::Pass {
1577	index: completed - 1,
1578	total: plan.passes,
1579	label: format!("{pose} · detail"),
1580	image: Some(detail_image(&raw, &detail)),
1581	});
1582	if cancel.load(Ordering::Relaxed) {
1583	return Err("geannuleerd".into());
1584	}
1585	emit(RenderEvent::Step {
1586	index: completed,
1587	total: plan.passes,
1588	label: format!("{pose} · target-res / diffuse"),
1589	});
1590	let target = resolve(&raw, &detail, job.target_width, job.target_height)?;
1591	for ((map, preview), rel) in [
1592	("diffuse", target.diffuse),
1593	("depth", target.depth_preview),
1594	("normal", target.normal),
1595	("specular", target.specular),
1596	]
1597	.into_iter()
1598	.zip(paths)
1599	{
1600	if cancel.load(Ordering::Relaxed) {
1601	return Err("geannuleerd".into());
1602	}
1603	emit(RenderEvent::Step {
1604	index: completed,
1605	total: plan.passes,
1606	label: format!("{pose} · {map}"),
1607	});
1608	debug_assert!(rel.ends_with(&format!("_{map}.png")));
1609	let kept = session.verified.contains_key(rel);
1610	let digest = if kept {
1611	session.verified[rel].clone()
1612	} else {
1613	let bytes = if map == "depth" {
1614	encode_depth_png(job.target_width, job.target_height, &target.depth)?
1615	} else {
1616	encode_rgba_png(&preview, map == "diffuse")?
1617	};
1618	session.publish(rel, &bytes)?
1619	};
1620	png_sha256.insert(rel.clone(), digest);
1621	completed += 1;
1622	let pass = if map == "diffuse" {
1623	"target-res / diffuse"
1624	} else {
1625	map
1626	};
1627	emit(RenderEvent::Pass {
1628	index: completed - 1,
1629	total: plan.passes,
1630	label: if kept {
1631	format!("{pose} · {pass} (bestaand bestand behouden)")
1632	} else {
1633	format!("{pose} · {pass}")
1634	},
1635	image: Some(preview),
1636	});
1637	}
1638	}
1639	Ok(())
1640	})();
1641	match result {
1642	Ok(()) => {
1643	if png_sha256.len() as u32 != plan.files {
1644	return Err(format!(
1645	"checksumtelling {} wijkt af van geplande {} PNGs",
1646	png_sha256.len(),
1647	plan.files
1648	));
1649	}
1650	let identity = crate::export_set::complete_identity_json(&render_doc)?;
1651	write_json(
1652	&root,
1653	"complete.json",
1654	serde_json::json!({
1655	"format_version": crate::export_set::OUTPUT_META_VERSION,
1656	"status": "complete",
1657	"identity": identity,
1658	"passes": completed,
1659	"png_files": plan.files,
1660	"png_sha256": png_sha256,
1661	}),
1662	)?;
1663	emit(RenderEvent::Finished {
1664	saved: Some(root.display().to_string()),
1665	});
1666	Ok(())
1667	}
1668	Err(error) => {
1669	let name = if cancel.load(Ordering::Relaxed) {
1670	"cancelled.json"
1671	} else {
1672	"failed.json"
1673	};
1674	let _ = write_json(
1675	&root,
1676	name,
1677	serde_json::json!({
1678	"error": error,
1679	"completed_passes": completed,
1680	"total_passes": plan.passes,
1681	"png_files_done": png_sha256.len(),
1682	"png_files": plan.files,
1683	"attempt": session.attempt,
1684	}),
1685	);
1686	Err(error)
1687	}
1688	}
1689	}
1690
1691	/// Real readback regression: nearest-surface depth/normal/specular, preserved
1692	/// texture × vertex albedo/alpha and independence from opposed light directions.
1693	/// # Safety
1694	/// Run on a current disposable native context.
1695	pub unsafe fn map_regression_probe(gl: &glow::Context) -> Result<(), String> {
1696	let triangle = \|z, normal, color, specular\| Draw {
1697	positions: Arc::new(vec![[-0.9, -0.9, z], [0.9, -0.9, z], [0., 0.9, z]]),
1698	normals: Arc::new(vec![normal; 3]),
1699	uvs: Arc::new(vec![[0.; 2]; 3]),
1700	vertex_colors: Arc::new(Vec::new()),
1701	indices: vec![0, 1, 2],
1702	color,
1703	albedo: None,
1704	shiny: None,
1705	specular,
1706	cutoff: 0.001,
1707	flat_normals: false,
1708	};
1709	let mut renderer = GpuRenderer::default();
1710	let mut scene = Scene {
1711	draws: vec![
1712	triangle(-0.5, [0., 0., 1.], [1., 0., 0., 1.], 0.75),
1713	triangle(0.5, [1., 0., 0.], [0., 1., 0., 1.], 0.),
1714	],
1715	view: preview::identity(),
1716	projection: preview::identity(),
1717	width: 32,
1718	height: 32,
1719	};
1720	let result = (\|\| {
1721	let raw = renderer.render(gl, &scene)?;
1722	let i = 16 * 32 + 16;
1723	if raw.diffuse[i * 4..i * 4 + 4] != [255, 0, 0, 255]
1724	\|\| (raw.depth[i] - 0.25).abs() > 1e-5
1725	\|\| raw.normal[i * 4..i * 4 + 3] != [128, 128, 255]
1726	\|\| raw.specular[i * 4].abs_diff(191) > 1
1727	{
1728	return Err(format!(
1729	"GPU map winner mismatch: color {:?} depth {} normal {:?} spec {}",
1730	&raw.diffuse[i * 4..i * 4 + 4],
1731	raw.depth[i],
1732	&raw.normal[i * 4..i * 4 + 4],
1733	raw.specular[i * 4]
1734	));
1735	}
1736	scene.draws.reverse();
1737	let reverse = renderer.render(gl, &scene)?;
1738	if reverse.diffuse != raw.diffuse
1739	\|\| reverse.normal != raw.normal
1740	\|\| reverse.depth != raw.depth
1741	{
1742	return Err("GPU map winner depends on submission order".into());
1743	}
1744	scene.draws = vec![triangle(-0.5, [0., 0., 1.], [0.5, 0.75, 1., 1.], 0.)];
1745	scene.draws[0].vertex_colors = Arc::new(vec![[0.5, 1., 0.5, 1.]; 3]);
1746	scene.draws[0].albedo = Some(Arc::new(equipment::Texture {
1747	content_hash: 99,
1748	width: 1,
1749	height: 1,
1750	rgba: vec![128, 255, 64, 192],
1751	}));
1752	let expected = [
1753	srgb(linear(128) * 0.25),
1754	srgb(0.75),
1755	srgb(linear(64) * 0.5),
1756	192,
1757	];
1758	// Production intentionally has no lighting input. This optional conventional
1759	// uniform is optimized out now; a future accidental lighting term using it
1760	// must fail these actual GPU readbacks under opposed light directions.
1761	for light in [[0., 0., 1.], [0., 0., -1.], [1., 0., 0.]] {
1762	let p = renderer.program.ok_or("missing probe program")?;
1763	gl.use_program(Some(p));
1764	gl.uniform_3_f32(
1765	gl.get_uniform_location(p, "u_light_direction").as_ref(),
1766	light[0],
1767	light[1],
1768	light[2],
1769	);
1770	let output = renderer.render(gl, &scene)?;
1771	let pixel = &output.diffuse[i * 4..i * 4 + 4];
1772	if pixel.iter().zip(expected).any(\|(a, b)\| a.abs_diff(b) > 1) {
1773	return Err(format!("diffuse is lit or alpha/vertex/texture lost under {light:?}: {pixel:?} vs {expected:?}"));
1774	}
1775	}
1776	let detail = detail_map(&raw)?;
1777	let target = resolve(&raw, &detail, 4, 4)?;
1778	if target.diffuse.width != 4
1779	\|\| target.depth.len() != 32
1780	\|\| target
1781	.normal
1782	.rgba
1783	.chunks_exact(4)
1784	.filter(\|p\| p[3] > 0)
1785	.any(\|p\| {
1786	let n = p[..3]
1787	.iter()
1788	.map(\|x\| (x as f32 / 255. 2. - 1.).powi(2))
1789	.sum::<f32>()
1790	.sqrt();
1791	(n - 1.).abs() > 0.03
1792	})
1793	{
1794	return Err("target map dimensions/normals invalid".into());
1795	}
1796	let mut flat = Scene {
1797	draws: vec![triangle(-0.5, [1., 0., 0.], [1., 0., 0., 1.], 0.)],
1798	view: preview::identity(),
1799	projection: preview::identity(),
1800	width: 32,
1801	height: 32,
1802	};
1803	flat.draws[0].flat_normals = true;
1804	let derived = renderer.render(gl, &flat)?;
1805	if derived.normal[i * 4..i * 4 + 3] != [128, 128, 255] {
1806	return Err(format!(
1807	"flat normals are not geometry-derived: {:?}",
1808	&derived.normal[i * 4..i * 4 + 4]
1809	));
1810	}
1811	println!("Production GPU maps PASS: nearest depth=0.25, normal=[128,128,255], specular=191, albedo texture×vertex={expected:?}, alpha preserved, diffuse identical under 3 opposed lights; target maps valid; missing source normals use actual GPU triangle derivatives");
1812	Ok(())
1813	})();
1814	renderer.destroy(gl);
1815	result
1816	}
1817
1818	#[cfg(test)]
1819	mod tests {
1820	use super::*;
1821	struct Temp(PathBuf);
1822	impl Temp {
1823	fn new() -> Self {
1824	let p = std::env::temp_dir().join(format!(
1825	"paperdoll-production-{}-{}",
1826	std::process::id(),
1827	std::time::SystemTime::now()
1828	.duration_since(std::time::UNIX_EPOCH)
1829	.unwrap()
1830	.as_nanos()
1831	));
1832	std::fs::create_dir(&p).unwrap();
1833	Self(p)
1834	}
1835	}
1836	impl Drop for Temp {
1837	fn drop(&mut self) {
1838	let _ = std::fs::remove_dir_all(&self.0);
1839	}
1840	}
1841	fn body() -> PreviewCharacter {
1842	preview::load_gltf_file(
1843	&Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/bodies/test-body-male.glb"),
1844	)
1845	.unwrap()
1846	}
1847	fn raw(w: u32, h: u32) -> Buffers {
1848	let n = (w * h) as usize;
1849	Buffers {
1850	width: w,
1851	height: h,
1852	diffuse: [255, 0, 0, 255].repeat(n),
1853	normal: [128, 128, 255, 255].repeat(n),
1854	specular: [191, 191, 191, 255].repeat(n),
1855	depth: vec![0.25; n],
1856	}
1857	}
1858	#[test]
1859	fn job_counts_every_clip_frame_angle_and_exact_order() {
1860	let mut b = body();
1861	let mut c = b.clips[0].clone();
1862	c.name = "../A \u{2603}".into();
1863	c.duration = 0.5;
1864	b.clips = vec![c.clone(), c];
1865	let p = plan(&b, 3).unwrap();
1866	assert_eq!((p.images, p.passes, p.files), (144, 864, 576));
1867	let s = samples(&p).collect::<Vec<_>>();
1868	assert_eq!(s.len(), 144);
1869	assert_eq!(
1870	s[0],
1871	Sample {
1872	clip: 0,
1873	frame: 0,
1874	pitch: -30,
1875	yaw: 0
1876	}
1877	);
1878	assert_eq!(s[11].yaw, 330);
1879	assert_eq!(s[12].pitch, 0);
1880	assert_eq!(s[35].pitch, 30);
1881	assert_eq!(s[36].frame, 1);
1882	assert_eq!(s[72].clip, 1);
1883	assert_ne!(p.clips[0].token, p.clips[1].token);
1884	assert!(p.clips.iter().all(\|c\| equipment::valid_name(&c.token)));
1885	assert_eq!(
1886	PASSES,
1887	[
1888	"highres",
1889	"detail",
1890	"target-res / diffuse",
1891	"depth",
1892	"normal",
1893	"specular"
1894	]
1895	);
1896	b.clips.clear();
1897	let p = plan(&b, 12).unwrap();
1898	assert_eq!((p.images, p.files), (36, 144));
1899	}
1900	#[test]
1901	fn floating_terminal_timestamp_does_not_duplicate_the_loop_endpoint() {
1902	let mut b = body();
1903	b.clips.truncate(1);
1904	b.clips[0].duration = f32::from_bits(1f32.to_bits() + 1);
1905	assert_eq!(plan(&b, 2).unwrap().clips[0].frames, 2);
1906	b.clips[0].duration = 1.00001;
1907	assert_eq!(plan(&b, 2).unwrap().clips[0].frames, 3);
1908	}
1909	#[test]
1910	fn planner_rejects_invalid_or_unbounded_inputs() {
1911	let mut b = body();
1912	assert!(plan(&b, 0).is_err());
1913	assert!(plan(&b, 241).is_err());
1914	for duration in [f32::NAN, f32::INFINITY, -1., 10000.] {
1915	b.clips[0].duration = duration;
1916	assert!(plan(&b, 12).is_err());
1917	}
1918	}
1919	#[test]
1920	fn output_tokens_only_four_target_maps() {
1921	let expected = PathBuf::from("male/body/clip000-walk/f000012/p-30_y330_diffuse.png");
1922	assert_eq!(
1923	output_path("male", "body", "clip000-walk", 12, -30, 330, "diffuse").unwrap(),
1924	expected
1925	);
1926	for map in ["diffuse", "normal", "depth", "specular"] {
1927	assert!(output_path("female", "sword", "clip000-bind", 0, 30, 0, map).is_ok());
1928	}
1929	for map in ["highres", "detail", "shiny", "../x"] {
1930	assert!(output_path("male", "body", "clip000-bind", 0, 0, 0, map).is_err());
1931	}
1932	for token in ["../escape", "A", "a/b", "a\\b", ".", "a b"] {
1933	assert!(output_path("male", token, "clip000-bind", 0, 0, 0, "diffuse").is_err());
1934	}
1935	assert!(output_path("male", "body", "walk", 0, 1, 0, "depth").is_err());
1936	assert!(output_path("male", "body", "walk", 0, 0, 360, "depth").is_err());
1937	}
1938	#[test]
1939	fn resolve_preserves_thin_foreground_and_matching_maps() {
1940	let mut r = raw(8, 8);
1941	r.diffuse = [0, 255, 0, 255].repeat(64);
1942	r.depth.fill(0.75);
1943	r.diffuse[..4].copy_from_slice(&[255, 0, 0, 255]);
1944	r.depth[0] = 0.25;
1945	let d = detail_map(&r).unwrap();
1946	assert!(d.iter().any(\|x\| *x > 0));
1947	let t = resolve(&r, &d, 1, 1).unwrap();
1948	assert_eq!(t.diffuse.rgba, [255, 0, 0, 255]);
1949	assert_eq!(t.specular.rgba, [191, 191, 191, 255]);
1950	assert!((t.depth[0] as i32 - 16384).abs() <= 1);
1951	let n = &t.normal.rgba;
1952	let len = (0..3)
1953	.map(\|c\| (n[c] as f32 / 255. * 2. - 1.).powi(2))
1954	.sum::<f32>()
1955	.sqrt();
1956	assert!((len - 1.).abs() < 0.01);
1957	r.diffuse.fill(0);
1958	r.diffuse[..4].copy_from_slice(&[255, 0, 0, 255]);
1959	let t = resolve(&r, &detail_map(&r).unwrap(), 1, 1).unwrap();
1960	assert_eq!(t.diffuse.rgba[3], 4);
1961	assert_eq!(t.depth[1], 1028);
1962	assert_eq!(t.normal.rgba[3], 4);
1963	assert_eq!(t.specular.rgba[3], 4);
1964	}
1965	#[test]
1966	fn invalid_map_dimensions_and_depth_fail_without_panics() {
1967	let mut r = raw(8, 8);
1968	r.normal.pop();
1969	assert!(detail_map(&r).is_err());
1970	assert!(resolve(&r, &[0; 64], 1, 1).is_err());
1971	let mut r = raw(8, 8);
1972	r.depth[0] = f32::NAN;
1973	assert!(resolve(&r, &[0; 64], 1, 1).is_err());
1974	let r = raw(8, 8);
1975	assert!(resolve(&r, &[0; 63], 1, 1).is_err());
1976	assert!(resolve(&r, &[0; 64], 0, 1).is_err());
1977	assert!(resolve(&r, &[0; 64], 257, 1).is_err());
1978	}
1979	#[test]
1980	fn atomic_pngs_roundtrip_no_overwrite_or_temp_deletion() {
1981	let t = Temp::new();
1982	let p = Path::new("map_diffuse.png");
1983	write_rgba(&t.0, p, &image(1, 1, vec![128, 64, 32, 192])).unwrap();
1984	let original = std::fs::read(t.0.join(p)).unwrap();
1985	assert!(write_rgba(&t.0, p, &image(1, 1, vec![0; 4])).is_err());
1986	assert_eq!(std::fs::read(t.0.join(p)).unwrap(), original);
1987	let mut reader = png::Decoder::new(std::io::Cursor::new(original))
1988	.read_info()
1989	.unwrap();
1990	assert!(reader.info().srgb.is_some());
1991	let mut out = vec![0; reader.output_buffer_size().unwrap()];
1992	reader.next_frame(&mut out).unwrap();
1993	assert_eq!(out, [128, 64, 32, 192]);
1994	write_depth(&t.0, Path::new("depth.png"), 1, 1, &[16384, 32896]).unwrap();
1995	let mut reader = png::Decoder::new(std::io::BufReader::new(
1996	std::fs::File::open(t.0.join("depth.png")).unwrap(),
1997	))
1998	.read_info()
1999	.unwrap();
2000	assert_eq!(reader.info().bit_depth, png::BitDepth::Sixteen);
2001	assert_eq!(reader.info().color_type, png::ColorType::GrayscaleAlpha);
2002	assert!(reader.info().srgb.is_none());
2003	let mut out = vec![0; reader.output_buffer_size().unwrap()];
2004	reader.next_frame(&mut out).unwrap();
2005	assert_eq!(out, [64, 0, 128, 128]);
2006	let tmp =
2007	t.0.join("blocked.png")
2008	.with_extension(format!("part-{}", std::process::id()));
2009	std::fs::write(&tmp, b"keep").unwrap();
2010	// A foreign/stale temp (e.g. left by a crashed process with a reused PID)
2011	// is never deleted or reused; per-write unique temp names still publish.
2012	write_rgba(&t.0, Path::new("blocked.png"), &image(1, 1, vec![0; 4])).unwrap();
2013	assert_eq!(std::fs::read(tmp).unwrap(), b"keep");
2014	let temps = std::fs::read_dir(&t.0)
2015	.unwrap()
2016	.filter_map(\|e\| e.ok())
2017	.filter(\|e\| e.file_name().to_string_lossy().starts_with("blocked.part-"))
2018	.count();
2019	assert_eq!(temps, 1, "own temp files are removed, foreign ones kept");
2020	assert!(write_depth(&t.0, Path::new("bad.png"), 1, 1, &[0]).is_err());
2021	assert!(write_rgba(&t.0, Path::new("bad.png"), &image(257, 1, vec![0; 1028])).is_err());
2022	assert!(write_rgba(&t.0, Path::new("../escape.png"), &image(1, 1, vec![0; 4])).is_err());
2023	}
2024	#[cfg(unix)]
2025	#[test]
2026	fn output_rejects_escaping_symlinks() {
2027	let root = Temp::new();
2028	let outside = Temp::new();
2029	std::os::unix::fs::symlink(&outside.0, root.0.join("link")).unwrap();
2030	assert!(write_rgba(
2031	&root.0,
2032	Path::new("link/sub/x.png"),
2033	&image(1, 1, vec![0; 4])
2034	)
2035	.is_err());
2036	assert!(!outside.0.join("sub").exists());
2037	}
2038	#[test]
2039	fn latest_mailbox_is_bounded_and_retains_terminal() {
2040	let m = Mailbox::default();
2041	for i in 0..1000 {
2042	m.publish(RenderEvent::Pass {
2043	index: i,
2044	total: 1000,
2045	label: i.to_string(),
2046	image: Some(image(1, 1, vec![0; 4])),
2047	});
2048	}
2049	m.publish(RenderEvent::Step {
2050	index: 999,
2051	total: 1000,
2052	label: "working".into(),
2053	});
2054	m.publish(RenderEvent::Cancelled);
2055	let events = m.drain();
2056	assert_eq!(events.len(), 3);
2057	assert!(matches!(&events[0], RenderEvent::Pass { index: 999, .. }));
2058	assert!(matches!(&events[2], RenderEvent::Cancelled));
2059	assert!(m.drain().is_empty());
2060	}
2061
2062	#[test]
2063	fn fixed_body_and_equipment_camera_agree_and_body_is_not_a_draw() {
2064	let temp = Temp::new();
2065	let mut job = RenderJob {
2066	character: body(),
2067	sex: "male".into(),
2068	preset: None,
2069	target_width: 64,
2070	target_height: 96,
2071	fps: 12,
2072	framing: CameraFraming {
2073	height_milli: 3100,
2074	center_y_milli: 1200,
2075	pivot_y_milli: Some(1200),
2076	},
2077	output: temp.0.clone(),
2078	project_id: "test-project".into(),
2079	project_name: "Test".into(),
2080	body_model: SourceFingerprint {
2081	path: "assets/body/test.glb".into(),
2082	sha256: crate::digest::sha256_hex(b"test-body"),
2083	},
2084	preset_sha256: None,
2085	};
2086	let mut cache = equipment::TextureCache::default();
2087	let b = scene(&job, "walk", 0.5, 30., 90., &mut cache).unwrap();
2088	let mut preset = equipment::Preset::new("sword".into());
2089	let fixture =
2090	Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/equipment/sword.obj");
2091	equipment::import_obj(&mut preset, &fixture).unwrap();
2092	let joint = job
2093	.character
2094	.joint_names
2095	.iter()
2096	.position(\|n\| n == "RightHand")
2097	.unwrap();
2098	preset.bind(0, &job.character, 0, joint).unwrap();
2099	let count = preset
2100	.attachments
2101	.iter()
2102	.map(\|a\| a.meshes.len())
2103	.sum::<usize>();
2104	job.preset = Some(preset);
2105	let e = scene(&job, "walk", 0.5, 30., 90., &mut cache).unwrap();
2106	assert_eq!(e.draws.len(), count);
2107	assert_eq!(b.view, e.view);
2108	assert_eq!(b.projection, e.projection);
2109	assert_eq!((e.width, e.height), (512, 768));
2110	assert_eq!(e.projection[5], 2. / 3.1);
2111	let center = point(&e.view, [0., 1.2, 0.]);
2112	assert!(center[0].abs() < 0.0001 && center[1].abs() < 0.0001);
2113	assert!((center[2] + 10.).abs() < 0.0001);
2114	let early = scene(&job, "attack", 0., 30., 90., &mut cache).unwrap();
2115	let late = scene(&job, "attack", 0.5, 30., 90., &mut cache).unwrap();
2116	assert_eq!(early.view, late.view);
2117	assert_eq!(early.projection, late.projection);
2118	assert_ne!(early.draws[0].positions, late.draws[0].positions);
2119	let mut invalid = e.clone();
2120	invalid.view[0] = f32::NAN;
2121	assert!(invalid.validate().is_err());
2122	}
2123	#[test]
2124	fn body_import_retains_texture_material_and_linear_vertex_color() {
2125	let temp = Temp::new();
2126	let source = std::fs::read(
2127	Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/bodies/test-body-male.glb"),
2128	)
2129	.unwrap();
2130	let glb = gltf::binary::Glb::from_slice(&source).unwrap();
2131	let mut json: serde_json::Value = serde_json::from_slice(&glb.json).unwrap();
2132	let mut bin = glb.bin.unwrap().into_owned();
2133	while !bin.len().is_multiple_of(4) {
2134	bin.push(0);
2135	}
2136	let position = json["meshes"][0]["primitives"][0]["attributes"]["POSITION"]
2137	.as_u64()
2138	.unwrap() as usize;
2139	let count = json["accessors"][position]["count"].as_u64().unwrap() as usize;
2140	let offset = bin.len();
2141	for _ in 0..count {
2142	for value in [0.25f32, 0.75, 0.5, 0.5] {
2143	bin.extend(value.to_le_bytes());
2144	}
2145	}
2146	let view = json["bufferViews"].as_array().unwrap().len();
2147	json["bufferViews"]
2148	.as_array_mut()
2149	.unwrap()
2150	.push(serde_json::json!({"buffer":0,"byteOffset":offset,"byteLength":count*16}));
2151	let accessor = json["accessors"].as_array().unwrap().len();
2152	json["accessors"].as_array_mut().unwrap().push(
2153	serde_json::json!({"bufferView":view,"componentType":5126,"count":count,"type":"VEC4"}),
2154	);
2155	json["meshes"][0]["primitives"][0]["attributes"]["COLOR_0"] = serde_json::json!(accessor);
2156	json["buffers"][0] = serde_json::json!({"uri":"geometry.bin","byteLength":bin.len()});
2157	json["images"] = serde_json::json!([{"uri":"albedo.png"}]);
2158	json["textures"] = serde_json::json!([{"source":0}]);
2159	let material = json["meshes"][0]["primitives"][0]["material"]
2160	.as_u64()
2161	.unwrap() as usize;
2162	json["materials"][material]["pbrMetallicRoughness"]["baseColorTexture"] =
2163	serde_json::json!({"index":0});
2164	json["materials"][material]["pbrMetallicRoughness"]["baseColorFactor"] =
2165	serde_json::json!([0.5, 0.75, 1., 1.]);
2166	std::fs::write(temp.0.join("geometry.bin"), bin).unwrap();
2167	std::fs::write(temp.0.join("body.gltf"), serde_json::to_vec(&json).unwrap()).unwrap();
2168	write_rgba(
2169	&temp.0,
2170	Path::new("albedo.png"),
2171	&image(1, 1, vec![128, 255, 64, 192]),
2172	)
2173	.unwrap();
2174	let body = preview::load_gltf_file(&temp.0.join("body.gltf")).unwrap();
2175	assert_eq!(body.colors[0], [0.25, 0.75, 0.5, 0.5]);
2176	assert_eq!(body.surfaces[0].color, [0.5, 0.75, 1., 1.]);
2177	assert_eq!(
2178	body.surfaces[0].albedo.as_ref().unwrap().rgba,
2179	[128, 255, 64, 192]
2180	);
2181	assert_eq!(body.colors.len(), body.positions.len());
2182	assert_eq!(body.uvs.len(), body.positions.len());
2183	assert!(body.surfaces[0].flat_normals);
2184	json["meshes"][0]["primitives"][0]["attributes"]
2185	.as_object_mut()
2186	.unwrap()
2187	.remove("NORMAL");
2188	std::fs::write(temp.0.join("body.gltf"), serde_json::to_vec(&json).unwrap()).unwrap();
2189	let missing = preview::load_gltf_file(&temp.0.join("body.gltf")).unwrap();
2190	assert!(!missing.source_normals_complete);
2191	let job = RenderJob {
2192	character: missing,
2193	sex: "male".into(),
2194	preset: None,
2195	target_width: 1,
2196	target_height: 1,
2197	fps: 12,
2198	framing: CameraFraming::default(),
2199	output: temp.0.clone(),
2200	project_id: "test-project".into(),
2201	project_name: "Test".into(),
2202	body_model: SourceFingerprint {
2203	path: "assets/body/test.glb".into(),
2204	sha256: crate::digest::sha256_hex(b"test-body"),
2205	},
2206	preset_sha256: None,
2207	};
2208	assert!(
2209	scene(
2210	&job,
2211	"",
2212	0.,
2213	0.,
2214	0.,
2215	&mut equipment::TextureCache::default()
2216	)
2217	.unwrap()
2218	.draws[0]
2219	.flat_normals
2220	);
2221	}
2222	#[test]
2223	fn complete_and_cancelled_batches_have_truthful_atomic_outputs() {
2224	for stop in [false, true] {
2225	let tmp = Temp::new();
2226	let mut b = body();
2227	b.clips.clear();
2228	let job = RenderJob {
2229	character: b,
2230	sex: "male".into(),
2231	preset: None,
2232	target_width: 1,
2233	target_height: 1,
2234	fps: 12,
2235	framing: CameraFraming::default(),
2236	output: tmp.0.clone(),
2237	project_id: "test-project".into(),
2238	project_name: "Test".into(),
2239	body_model: SourceFingerprint {
2240	path: "assets/body/test.glb".into(),
2241	sha256: crate::digest::sha256_hex(b"test-body"),
2242	},
2243	preset_sha256: None,
2244	};
2245	let flag = AtomicBool::new(false);
2246	let (tx, rx) = mpsc::channel::<GpuRequest>();
2247	let gpu = std::thread::spawn(move \|\| {
2248	for request in rx {
2249	let _ = request
2250	.reply
2251	.send(Ok(raw(request.scene.width, request.scene.height)));
2252	}
2253	});
2254	let mut labels = Vec::new();
2255	let result = execute(job, &tx, &flag, None, &mut \|event\| {
2256	if let RenderEvent::Pass { label, .. } = event {
2257	labels.push(label);
2258	if stop && labels.len() == 3 {
2259	flag.store(true, Ordering::Relaxed);
2260	}
2261	}
2262	});
2263	drop(tx);
2264	gpu.join().unwrap();
2265	let run = std::fs::read_dir(&tmp.0)
2266	.unwrap()
2267	.next()
2268	.unwrap()
2269	.unwrap()
2270	.path();
2271	assert!(run.join("render.json").exists());
2272	assert_eq!(run.join("complete.json").exists(), !stop);
2273	assert_eq!(run.join("cancelled.json").exists(), stop);
2274	assert_eq!(result.is_ok(), !stop);
2275	let meta: serde_json::Value =
2276	serde_json::from_str(&std::fs::read_to_string(run.join("render.json")).unwrap())
2277	.unwrap();
2278	assert_eq!(meta["format_version"], 3);
2279	assert_eq!(meta["project"]["id"], "test-project");
2280	assert_eq!(
2281	meta["body_model"]["sha256"],
2282	crate::digest::sha256_hex(b"test-body")
2283	);
2284	assert_eq!(meta["framing"]["pivot_y_milli"], 1460);
2285	assert_eq!(meta["pivot_source"]["kind"], "neck");
2286	assert_eq!(meta["pivot_source"]["joint_name"], "Neck");
2287	assert_eq!(
2288	meta["saved_maps"]
2289	.as_array()
2290	.unwrap()
2291	.iter()
2292	.map(\|v\| v.as_str().unwrap())
2293	.collect::<Vec<_>>(),
2294	["diffuse", "depth", "normal", "specular"]
2295	);
2296	if !stop {
2297	let complete: serde_json::Value = serde_json::from_str(
2298	&std::fs::read_to_string(run.join("complete.json")).unwrap(),
2299	)
2300	.unwrap();
2301	assert_eq!(complete["format_version"], 3);
2302	assert_eq!(complete["status"], "complete");
2303	assert_eq!(complete["png_files"], 144);
2304	let checksums = complete["png_sha256"].as_object().unwrap();
2305	assert_eq!(checksums.len(), 144);
2306	for (rel, digest) in checksums {
2307	assert!(crate::digest::is_sha256_hex(digest.as_str().unwrap()));
2308	let bytes = std::fs::read(run.join(rel)).unwrap();
2309	assert_eq!(digest.as_str().unwrap(), crate::digest::sha256_hex(&bytes));
2310	}
2311	let opened = crate::export_set::ExportRun::open(&run).unwrap();
2312	let sample = opened
2313	.load_map(
2314	"clip000-bind",
2315	0,
2316	-30,
2317	0,
2318	crate::export_set::MapKind::Diffuse,
2319	)
2320	.unwrap();
2321	assert_eq!(sample.width(), 1);
2322	}
2323	let frame = run.join("male/body/clip000-bind/f000000");
2324	assert!(frame.join("p-30_y000_diffuse.png").exists());
2325	assert_eq!(frame.join("p-30_y000_depth.png").exists(), !stop);
2326	assert!(!frame.join("p-30_y000_highres.png").exists());
2327	assert!(!frame.join("p-30_y000_detail.png").exists());
2328	if !stop {
2329	assert_eq!(labels.len(), 216);
2330	for labels in labels.chunks_exact(6) {
2331	for (label, pass) in labels.iter().zip([
2332	"highres",
2333	"detail",
2334	"target-res / diffuse",
2335	"depth",
2336	"normal",
2337	"specular",
2338	]) {
2339	assert!(label.ends_with(pass));
2340	}
2341	}
2342	}
2343	}
2344	}
2345
2346	// ---- Resume (design §7/§12.6) ----
2347	fn resume_job(out: &Path) -> RenderJob {
2348	let mut b = body();
2349	b.clips.clear();
2350	RenderJob {
2351	character: b,
2352	sex: "male".into(),
2353	preset: None,
2354	target_width: 2,
2355	target_height: 2,
2356	fps: 12,
2357	framing: CameraFraming::default(),
2358	output: out.to_path_buf(),
2359	project_id: "resume-project".into(),
2360	project_name: "Resume".into(),
2361	body_model: SourceFingerprint {
2362	path: "assets/body/test.glb".into(),
2363	sha256: crate::digest::sha256_hex(b"resume-body"),
2364	},
2365	preset_sha256: None,
2366	}
2367	}
2368	/// Deterministic pose-dependent fake GPU output (view matrix drives the colour).
2369	fn fake_raw(scene: &Scene) -> Buffers {
2370	let mut b = raw(scene.width, scene.height);
2371	let v = ((scene.view[0] * 97. + scene.view[2] * 31. + scene.view[6] * 13.).abs() * 50.)
2372	as u32
2373	% 200;
2374	for px in b.diffuse.chunks_exact_mut(4) {
2375	px[1] = v as u8;
2376	px[2] = (255 - v) as u8;
2377	}
2378	b
2379	}
2380	/// Run a job; cancel after `stop` completed Pass events (None = run to the end).
2381	fn drive(
2382	job: RenderJob,
2383	target: RunTarget,
2384	stop: Option<usize>,
2385	) -> (Result<(), String>, Vec<RenderEvent>) {
2386	let flag = AtomicBool::new(false);
2387	let (tx, rx) = mpsc::channel::<GpuRequest>();
2388	let gpu = std::thread::spawn(move \|\| {
2389	for request in rx {
2390	let reply = fake_raw(&request.scene);
2391	let _ = request.reply.send(Ok(reply));
2392	}
2393	});
2394	let mut events = Vec::new();
2395	let mut passes = 0;
2396	let result = execute_target(job, target, &tx, &flag, None, &mut \|event\| {
2397	if matches!(event, RenderEvent::Pass { .. }) {
2398	passes += 1;
2399	if stop == Some(passes) {
2400	flag.store(true, Ordering::Relaxed);
2401	}
2402	}
2403	events.push(event);
2404	});
2405	drop(tx);
2406	gpu.join().unwrap();
2407	(result, events)
2408	}
2409	fn runs(out: &Path) -> Vec<PathBuf> {
2410	let mut v = std::fs::read_dir(out)
2411	.unwrap()
2412	.map(\|e\| e.unwrap().path())
2413	.collect::<Vec<_>>();
2414	v.sort();
2415	v
2416	}
2417	fn checksums(run: &Path) -> serde_json::Value {
2418	let c: serde_json::Value =
2419	serde_json::from_slice(&std::fs::read(run.join("complete.json")).unwrap()).unwrap();
2420	c["png_sha256"].clone()
2421	}
2422	fn tree(run: &Path) -> std::collections::BTreeMap<PathBuf, String> {
2423	let mut out = std::collections::BTreeMap::new();
2424	let mut stack = vec![run.to_path_buf()];
2425	while let Some(dir) = stack.pop() {
2426	for e in std::fs::read_dir(dir).unwrap() {
2427	let p = e.unwrap().path();
2428	if p.is_dir() {
2429	stack.push(p);
2430	} else {
2431	out.insert(
2432	p.clone(),
2433	crate::digest::sha256_hex(&std::fs::read(&p).unwrap()),
2434	);
2435	}
2436	}
2437	}
2438	out
2439	}
2440	#[cfg(unix)]
2441	fn inode(p: &Path) -> u64 {
2442	use std::os::unix::fs::MetadataExt;
2443	std::fs::metadata(p).unwrap().ino()
2444	}
2445
2446	#[test]
2447	#[cfg(unix)]
2448	fn cancel_resume_cancel_again_then_complete_equals_uninterrupted_run() {
2449	let reference_dir = Temp::new();
2450	let (ok, _) = drive(resume_job(&reference_dir.0), RunTarget::Fresh, None);
2451	ok.unwrap();
2452	let reference = checksums(&runs(&reference_dir.0)[0]);
2453	assert_eq!(reference.as_object().unwrap().len(), 144);
2454
2455	let tmp = Temp::new();
2456	// An earlier completed run in the same output must stay byte-identical.
2457	drive(resume_job(&tmp.0), RunTarget::Fresh, None).0.unwrap();
2458	let earlier = runs(&tmp.0)[0].clone();
2459	let earlier_tree = tree(&earlier);
2460	std::thread::sleep(std::time::Duration::from_millis(2));
2461	let (first, _) = drive(resume_job(&tmp.0), RunTarget::Fresh, Some(40));
2462	assert!(first.is_err());
2463	let run = runs(&tmp.0).into_iter().find(\|r\| *r != earlier).unwrap();
2464	let cancelled: serde_json::Value =
2465	serde_json::from_slice(&std::fs::read(run.join("cancelled.json")).unwrap()).unwrap();
2466	let done_first = cancelled["png_files_done"].as_u64().unwrap();
2467	assert!(done_first > 0 && done_first < 144);
2468	assert_eq!(cancelled["attempt"], 0);
2469	let first_file = run.join("male/body/clip000-bind/f000000/p-30_y000_diffuse.png");
2470	let first_inode = inode(&first_file);
2471	assert!(crate::export_set::ExportRun::open(&run).is_err());
2472
2473	let found =
2474	crate::resume::candidates(&tmp.0, &contract(resume_job(&tmp.0)).unwrap().render_doc)
2475	.unwrap();
2476	assert_eq!(found.len(), 1);
2477	assert_eq!(found[0].state, "geannuleerd");
2478	assert_eq!(found[0].journaled as u64, done_first);
2479	assert!(found[0].blocked.is_none());
2480
2481	// Second attempt: cancelled again after more work.
2482	let (second, events) = drive(resume_job(&tmp.0), RunTarget::Resume(run.clone()), Some(60));
2483	assert!(second.is_err());
2484	// Progress resumes at the verified work, not at zero, and skipped images are labelled.
2485	let first_step = events
2486	.iter()
2487	.find_map(\|e\| match e {
2488	RenderEvent::Step { index, label, .. } if label.contains("al aanwezig") => {
2489	Some(*index)
2490	}
2491	_ => None,
2492	})
2493	.unwrap();
2494	assert_eq!(first_step, 6);
2495	let cancelled2: serde_json::Value =
2496	serde_json::from_slice(&std::fs::read(run.join("cancelled.json")).unwrap()).unwrap();
2497	assert_eq!(cancelled2["attempt"], 1);
2498	assert!(cancelled2["png_files_done"].as_u64().unwrap() > done_first);
2499	assert!(run.join("attempt-000-cancelled.json").exists());
2500	assert_eq!(
2501	inode(&first_file),
2502	first_inode,
2503	"verified PNG was rewritten"
2504	);
2505
2506	// Third attempt completes.
2507	let (third, _) = drive(resume_job(&tmp.0), RunTarget::Resume(run.clone()), None);
2508	third.unwrap();
2509	assert!(!run.join("cancelled.json").exists());
2510	assert!(run.join("attempt-001-cancelled.json").exists());
2511	assert_eq!(inode(&first_file), first_inode);
2512	assert_eq!(checksums(&run), reference);
2513	crate::export_set::ExportRun::open(&run).unwrap();
2514	let log = std::fs::read_to_string(run.join(crate::resume::RESUME_LOG)).unwrap();
2515	assert_eq!(log.lines().count(), 2);
2516	assert_eq!(tree(&earlier), earlier_tree);
2517	// A completed run is no longer offered and cannot be resumed.
2518	let doc = contract(resume_job(&tmp.0)).unwrap().render_doc;
2519	assert!(crate::resume::candidates(&tmp.0, &doc).unwrap().is_empty());
2520	let (again, _) = drive(resume_job(&tmp.0), RunTarget::Resume(run.clone()), None);
2521	assert!(again.unwrap_err().contains("al voltooid"));
2522	}
2523
2524	#[test]
2525	#[cfg(unix)]
2526	fn crash_recovery_regenerates_missing_corrupt_and_keeps_unjournaled_identical_files() {
2527	let reference_dir = Temp::new();
2528	drive(resume_job(&reference_dir.0), RunTarget::Fresh, None)
2529	.0
2530	.unwrap();
2531	let reference = checksums(&runs(&reference_dir.0)[0]);
2532
2533	let tmp = Temp::new();
2534	assert!(drive(resume_job(&tmp.0), RunTarget::Fresh, Some(60))
2535	.0
2536	.is_err());
2537	let run = runs(&tmp.0)[0].clone();
2538	// Simulate a hard crash: no terminal marker, torn last journal line.
2539	std::fs::remove_file(run.join("cancelled.json")).unwrap();
2540	let journal = std::fs::read_to_string(run.join(crate::resume::JOURNAL)).unwrap();
2541	let mut lines = journal.lines().map(str::to_string).collect::<Vec<_>>();
2542	let torn: serde_json::Value = serde_json::from_str(lines.last().unwrap()).unwrap();
2543	let torn_path = run.join(torn["path"].as_str().unwrap());
2544	let last = lines.pop().unwrap();
2545	let keep = lines.join("\n") + "\n" + &last[..last.len() / 2];
2546	std::fs::write(run.join(crate::resume::JOURNAL), keep).unwrap();
2547	let torn_inode = inode(&torn_path);
2548	// Corrupt one journaled PNG, delete another, leave a foreign temp file.
2549	let frame = run.join("male/body/clip000-bind/f000000");
2550	let corrupt = frame.join("p-30_y030_normal.png");
2551	std::fs::write(&corrupt, b"not a png").unwrap();
2552	let missing = frame.join("p-30_y060_depth.png");
2553	std::fs::remove_file(&missing).unwrap();
2554	let stale = frame.join("p-30_y090_diffuse.part-999999-0");
2555	std::fs::write(&stale, b"partial").unwrap();
2556
2557	let doc = contract(resume_job(&tmp.0)).unwrap().render_doc;
2558	let found = crate::resume::candidates(&tmp.0, &doc).unwrap();
2559	assert_eq!(found[0].state, "afgebroken");
2560
2561	drive(resume_job(&tmp.0), RunTarget::Resume(run.clone()), None)
2562	.0
2563	.unwrap();
2564	assert_eq!(checksums(&run), reference);
2565	crate::export_set::ExportRun::open(&run).unwrap();
2566	assert!(missing.exists());
2567	assert_eq!(
2568	std::fs::read(frame.join("p-30_y030_normal.png.corrupt-a001-0")).unwrap(),
2569	b"not a png"
2570	);
2571	assert_eq!(std::fs::read(&stale).unwrap(), b"partial");
2572	assert_eq!(
2573	inode(&torn_path),
2574	torn_inode,
2575	"identical unjournaled file was replaced"
2576	);
2577	let log: serde_json::Value = serde_json::from_str(
2578	std::fs::read_to_string(run.join(crate::resume::RESUME_LOG))
2579	.unwrap()
2580	.lines()
2581	.next()
2582	.unwrap(),
2583	)
2584	.unwrap();
2585	assert_eq!(log["previous_marker"], serde_json::Value::Null);
2586	assert_eq!(log["damaged_journal_lines"], 1);
2587	assert_eq!(log["unjournaled_existing"], 1);
2588	assert_eq!(log["missing"].as_u64().unwrap(), 144 - 60 / 6 * 4 + 1);
2589	assert_eq!(log["quarantined"].as_array().unwrap().len(), 1);
2590	}
2591
2592	#[test]
2593	fn unjournaled_different_file_is_quarantined_not_overwritten() {
2594	let tmp = Temp::new();
2595	assert!(drive(resume_job(&tmp.0), RunTarget::Fresh, Some(6))
2596	.0
2597	.is_err());
2598	let run = runs(&tmp.0)[0].clone();
2599	// A planned PNG appears that the journal never recorded and that differs.
2600	let foreign = run.join("male/body/clip000-bind/f000000/p-30_y030_specular.png");
2601	std::fs::create_dir_all(foreign.parent().unwrap()).unwrap();
2602	std::fs::write(&foreign, b"foreign").unwrap();
2603	drive(resume_job(&tmp.0), RunTarget::Resume(run.clone()), None)
2604	.0
2605	.unwrap();
2606	crate::export_set::ExportRun::open(&run).unwrap();
2607	assert_eq!(
2608	std::fs::read(foreign.with_file_name("p-30_y030_specular.png.corrupt-a001-0")).unwrap(),
2609	b"foreign"
2610	);
2611	}
2612
2613	#[test]
2614	fn resume_refuses_mismatch_foreign_dirs_unknown_journal_and_locked_runs() {
2615	let tmp = Temp::new();
2616	assert!(drive(resume_job(&tmp.0), RunTarget::Fresh, Some(12))
2617	.0
2618	.is_err());
2619	let run = runs(&tmp.0)[0].clone();
2620	let before = std::fs::read(run.join("cancelled.json")).unwrap();
2621	// Contract drift: FPS, body bytes, target size.
2622	let mut job = resume_job(&tmp.0);
2623	job.fps = 24;
2624	let err = drive(job, RunTarget::Resume(run.clone()), None)
2625	.0
2626	.unwrap_err();
2627	assert!(err.contains("fps"), "{err}");
2628	let mut job = resume_job(&tmp.0);
2629	job.body_model.sha256 = crate::digest::sha256_hex(b"edited body");
2630	let err = drive(job, RunTarget::Resume(run.clone()), None)
2631	.0
2632	.unwrap_err();
2633	assert!(err.contains("body_model"), "{err}");
2634	let mut job = resume_job(&tmp.0);
2635	job.target_width = 3;
2636	let doc = contract(job.clone()).unwrap().render_doc;
2637	let found = crate::resume::candidates(&tmp.0, &doc).unwrap();
2638	assert!(found[0].blocked.as_ref().unwrap().contains("target"));
2639	assert!(drive(job, RunTarget::Resume(run.clone()), None).0.is_err());
2640	// Refusals leave the run and its marker untouched.
2641	assert_eq!(std::fs::read(run.join("cancelled.json")).unwrap(), before);
2642	assert!(!run.join(crate::resume::RESUME_LOG).exists());
2643	// Directory not directly inside the output directory.
2644	let other = Temp::new();
2645	let err = drive(resume_job(&other.0), RunTarget::Resume(run.clone()), None)
2646	.0
2647	.unwrap_err();
2648	assert!(err.contains("uitvoermap"), "{err}");
2649	// Locked by a running worker.
2650	let lock = std::fs::OpenOptions::new()
2651	.write(true)
2652	.open(run.join(crate::resume::LOCK))
2653	.unwrap();
2654	lock.lock().unwrap();
2655	let err = drive(resume_job(&tmp.0), RunTarget::Resume(run.clone()), None)
2656	.0
2657	.unwrap_err();
2658	assert!(err.contains("run.lock"), "{err}");
2659	let doc = contract(resume_job(&tmp.0)).unwrap().render_doc;
2660	assert!(crate::resume::candidates(&tmp.0, &doc).unwrap()[0]
2661	.blocked
2662	.is_some());
2663	drop(lock);
2664	// Journal naming a path outside the plan.
2665	use std::io::Write;
2666	let mut j = std::fs::OpenOptions::new()
2667	.append(true)
2668	.open(run.join(crate::resume::JOURNAL))
2669	.unwrap();
2670	writeln!(
2671	j,
2672	"{}",
2673	serde_json::json!({"path":"../escape.png","sha256":crate::digest::sha256_hex(b"x")})
2674	)
2675	.unwrap();
2676	let err = drive(resume_job(&tmp.0), RunTarget::Resume(run.clone()), None)
2677	.0
2678	.unwrap_err();
2679	assert!(err.contains("onbekend pad"), "{err}");
2680	}
2681	}