From 05955c08b4fd025f1a09882df72e6dbff1a8148a Mon Sep 17 00:00:00 2001
From: Brandon Thomas <brandon@storyteller.ai>
Date: Wed, 14 Oct 2026 10:15:34 -0400
Subject: [PATCH 1/5] Release 0.10.0

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.lock | 72 +++++++++++++++++++++++++++---------------------------
 Cargo.toml |  2 +-
 2 files changed, 37 insertions(+), 37 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 38999ed0..ce8fe123 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1143,7 +1143,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "cpal",
  "effectcraft-engine",
@@ -1168,7 +1168,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-automation"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "effectcraft-engine",
  "effectcraft-host",
@@ -1180,14 +1180,14 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-av1enc"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "filmcraft-av1",
 ]
 
 [[package]]
 name = "effectcraft-cli"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "cpu-time",
  "effectcraft-automation",
@@ -1203,7 +1203,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-color"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "proptest",
  "serde",
@@ -1211,7 +1211,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-effects"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "effectcraft-color",
  "effectcraft-geom",
@@ -1228,7 +1228,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-engine"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "effectcraft-color",
  "effectcraft-effects",
@@ -1261,7 +1261,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-export"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "effectcraft-av1enc",
  "effectcraft-color",
@@ -1291,7 +1291,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-expr"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "boa_engine",
  "effectcraft-color",
@@ -1308,7 +1308,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-geom"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "proptest",
  "serde",
@@ -1316,7 +1316,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-gpu"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "bytemuck",
  "effectcraft-color",
@@ -1338,14 +1338,14 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-hevcenc"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "filmcraft-hevc",
 ]
 
 [[package]]
 name = "effectcraft-host"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "effectcraft-engine",
  "effectcraft-export",
@@ -1370,7 +1370,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-interchange"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "effectcraft-color",
  "effectcraft-keyframe",
@@ -1389,7 +1389,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-keyframe"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "effectcraft-color",
  "effectcraft-geom",
@@ -1401,7 +1401,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-lottie"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "effectcraft-color",
  "effectcraft-effects",
@@ -1418,7 +1418,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-media"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "effectcraft-model",
  "effectcraft-pdf",
@@ -1445,7 +1445,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-model"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "effectcraft-geom",
  "image",
@@ -1457,14 +1457,14 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-opusenc"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "filmcraft-opus",
 ]
 
 [[package]]
 name = "effectcraft-path"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "effectcraft-geom",
  "effectcraft-keyframe",
@@ -1476,7 +1476,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-pdf"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "effectcraft-raster",
  "effectcraft-svg",
@@ -1490,7 +1490,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-plugin"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "effectcraft-effects",
  "effectcraft-keyframe",
@@ -1502,7 +1502,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-project"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "effectcraft-color",
  "effectcraft-geom",
@@ -1515,14 +1515,14 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-psd"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "miniz_oxide 0.8.9",
 ]
 
 [[package]]
 name = "effectcraft-raster"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "effectcraft-color",
  "effectcraft-geom",
@@ -1531,7 +1531,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-render"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "effectcraft-color",
  "effectcraft-effects",
@@ -1553,7 +1553,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-script"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "boa_engine",
  "effectcraft-engine",
@@ -1570,7 +1570,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-segment"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "miniz_oxide 0.8.9",
  "ndarray",
@@ -1579,7 +1579,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-svg"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "effectcraft-geom",
  "effectcraft-path",
@@ -1591,7 +1591,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-text"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "effectcraft-keyframe",
  "harfrust",
@@ -1603,7 +1603,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-time"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "proptest",
  "serde",
@@ -1611,7 +1611,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-track"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "effectcraft-raster",
  "effectcraft-segment",
@@ -1623,7 +1623,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-ui-egui"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "craft-ui",
  "effectcraft-color",
@@ -1655,11 +1655,11 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-vp9enc"
-version = "0.9.2"
+version = "0.10.0"
 
 [[package]]
 name = "effectcraft-web"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "effectcraft-engine",
  "effectcraft-export",
@@ -6469,7 +6469,7 @@ checksum = "e450f9b2ed1dff33c94c12589a87338689467b9c4f5d8a5710bd09a847d2c8a7"
 
 [[package]]
 name = "xtask"
-version = "0.9.2"
+version = "0.10.0"
 dependencies = [
  "serde_json",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index 47c8d417..9f4e9d17 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/*"]
 
 [workspace.package]
-version = "0.9.2"
+version = "0.10.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"

From c280506ba0261cc1c34656857907d18410f4cdcd Mon Sep 17 00:00:00 2001
From: DWAA1660 <dwatnip123@gmail.com>
Date: Wed, 14 Oct 2026 20:51:09 -0600
Subject: [PATCH 2/5] fix(config): isolate atomic writes and preserve long
 filenames

Create each atomic write through its own exclusively created temporary sibling and keep its open file handle until writing finishes. Concurrent writers publish complete files without truncating or following an existing temporary entry; failed writes or renames clean up their own staging file.

Keep the temporary basename bounded independently of the destination name so previously supported long project filenames still save. Retain the concurrent-writer and symlink regressions and add a 251-byte filename overwrite regression that checks exact bytes and staging cleanup.

Fixes #1233

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/engine/src/config.rs         | 46 ++++++++++++++------
 crates/engine/src/tests_settings.rs | 66 +++++++++++++++++++++++++++--
 2 files changed, 95 insertions(+), 17 deletions(-)

diff --git a/crates/engine/src/config.rs b/crates/engine/src/config.rs
index c333c973..00e7377b 100644
--- a/crates/engine/src/config.rs
+++ b/crates/engine/src/config.rs
@@ -164,32 +164,50 @@ impl ConfigStore for DirConfig {
     }
 }
 
-/// The temporary file an atomic write of `path` goes through.
-pub fn temp_path(path: &Path) -> PathBuf {
-    let mut name = path.file_name().map(|n| n.to_os_string()).unwrap_or_default();
-    name.push(".tmp");
-    path.with_file_name(name)
+/// A new, empty temporary file next to `path` for an atomic write of it, and its path. The name
+/// is unique to this process and this write (`.effectcraft-<pid>-<n>.tmp`) and the file is created
+/// exclusively, so two writers never share one and nothing already at that name (a file, a
+/// symbolic link) is opened or followed (#1233). It ends in `.tmp`, so a file left by a hard
+/// kill never counts as an auto-save. Its bounded name does not include the destination's name,
+/// so a valid long destination name still fits the filesystem's component limit.
+fn create_temp(path: &Path) -> std::io::Result<(std::fs::File, PathBuf)> {
+    use std::sync::atomic::{AtomicU64, Ordering};
+    static NEXT: AtomicU64 = AtomicU64::new(0);
+    let mut last = None;
+    for _ in 0..16 {
+        let n = NEXT.fetch_add(1, Ordering::Relaxed);
+        let tmp = path.with_file_name(format!(".effectcraft-{}-{n}.tmp", std::process::id()));
+        match std::fs::OpenOptions::new().write(true).create_new(true).open(&tmp) {
+            Ok(f) => return Ok((f, tmp)),
+            Err(e) if e.kind() == std::io::ErrorKind::AlreadyExists => last = Some(e),
+            Err(e) => return Err(e),
+        }
+    }
+    Err(last.unwrap_or_else(|| std::io::Error::other("no free temporary file name")))
 }
 
 /// Write `data` to `path` atomically: write a temporary file next to it, flush it to disk, then
 /// rename it over `path`. A crash at any point leaves either the old file or the new one, never a
-/// torn file.
+/// torn file, and concurrent writers each publish a whole file of their own.
 pub fn atomic_write(path: &Path, data: &[u8]) -> std::io::Result<()> {
-    atomic_write_with(path, data, |tmp, data| {
+    atomic_write_with(path, data, |f, data| {
         use std::io::Write;
-        let mut f = std::fs::File::create(tmp)?;
         f.write_all(data)?;
         f.sync_all()
     })
 }
 
-/// [`atomic_write`] with an injectable temp-file writer (tests simulate a crash mid-write). A
-/// failed write removes the temporary file and leaves `path` untouched.
-pub fn atomic_write_with(path: &Path, data: &[u8], write: impl FnOnce(&Path, &[u8]) -> std::io::Result<()>) -> std::io::Result<()> {
-    let tmp = temp_path(path);
-    if let Err(e) = write(&tmp, data) {
+/// [`atomic_write`] with an injectable temp-file writer (tests simulate a crash mid-write); it is
+/// given the temporary file, already created. A failed write or rename removes the temporary
+/// file and leaves `path` untouched.
+pub fn atomic_write_with(path: &Path, data: &[u8], write: impl FnOnce(&mut std::fs::File, &[u8]) -> std::io::Result<()>) -> std::io::Result<()> {
+    let (mut f, tmp) = create_temp(path)?;
+    let written = write(&mut f, data);
+    // Closed before the rename (Windows can't rename an open file).
+    drop(f);
+    if let Err(e) = written.and_then(|()| std::fs::rename(&tmp, path)) {
         let _ = std::fs::remove_file(&tmp);
         return Err(e);
     }
-    std::fs::rename(&tmp, path)
+    Ok(())
 }
diff --git a/crates/engine/src/tests_settings.rs b/crates/engine/src/tests_settings.rs
index 458c886f..65e39b46 100644
--- a/crates/engine/src/tests_settings.rs
+++ b/crates/engine/src/tests_settings.rs
@@ -5,7 +5,7 @@ use std::sync::Arc;
 
 use serde_json::json;
 
-use crate::config::{ConfigStore, DirConfig, MemoryConfig, atomic_write, atomic_write_with, temp_path};
+use crate::config::{ConfigStore, DirConfig, MemoryConfig, atomic_write, atomic_write_with};
 use crate::prefs::{PREFS_FILE, Prefs};
 use crate::shortcuts::{DEFAULT_PRESET, Keymaps, normalize};
 use crate::{Session, autosave};
@@ -548,6 +548,66 @@ fn frontend_commands_are_bindable_with_panel_scope() {
 
 // ---------------------------------------------------------------- auto-save / recovery
 
+/// The names in `d`, sorted.
+fn names(d: &std::path::Path) -> Vec<String> {
+    let mut v: Vec<String> = std::fs::read_dir(d).unwrap().map(|e| e.unwrap().file_name().to_string_lossy().into_owned()).collect();
+    v.sort();
+    v
+}
+
+#[cfg(unix)]
+#[test]
+fn atomic_write_overwrites_a_long_valid_filename() {
+    let d = tmp("atomic-long-name");
+    // The old `<name>.tmp` fits a 255-byte component limit for this 251-byte project name.
+    // Including the full name plus a process id and counter made an otherwise valid save fail.
+    let name = format!("{}.ecproj", "x".repeat(244));
+    assert_eq!(name.len(), 251);
+    let f = d.join(&name);
+    std::fs::write(&f, b"original project").unwrap();
+    let replacement = b"replacement project\0bytes\xff";
+    atomic_write(&f, replacement).unwrap();
+    assert_eq!(std::fs::read(&f).unwrap(), replacement);
+    assert_eq!(names(&d), [name], "no temporary file is left after overwriting the project");
+    let _ = std::fs::remove_dir_all(d);
+}
+
+#[test]
+fn concurrent_atomic_writes_each_publish_a_whole_file() {
+    // Writers of the same file used to share one `.tmp`: they truncated each other's data and
+    // the later rename failed once the first had moved it away (#1233).
+    let d = tmp("atomic-concurrent");
+    let f = d.join("shared.ecproj");
+    for round in 0..10 {
+        let contents: Vec<Vec<u8>> = (0..8u8).map(|w| vec![b'a' + w; 256 * 1024 + usize::from(w) * 1000]).collect();
+        std::thread::scope(|sc| {
+            for c in &contents {
+                let f = &f;
+                sc.spawn(move || atomic_write(f, c).expect("every writer succeeds"));
+            }
+        });
+        let got = std::fs::read(&f).unwrap();
+        assert!(contents.contains(&got), "round {round}: the file is one writer's whole data ({} bytes)", got.len());
+        assert_eq!(names(&d), ["shared.ecproj"], "round {round}: no temporary file is left");
+    }
+    let _ = std::fs::remove_dir_all(d);
+}
+
+#[cfg(unix)]
+#[test]
+fn atomic_write_does_not_follow_a_link_at_the_old_temp_name() {
+    let d = tmp("atomic-link");
+    let f = d.join("p.ecproj");
+    let victim = d.join("victim.txt");
+    std::fs::write(&victim, b"keep").unwrap();
+    // The temporary name used to be `<name>.tmp`, opened with File::create (following links).
+    std::os::unix::fs::symlink(&victim, d.join("p.ecproj.tmp")).unwrap();
+    atomic_write(&f, b"new project").unwrap();
+    assert_eq!(std::fs::read(&victim).unwrap(), b"keep", "the link's target is untouched");
+    assert_eq!(std::fs::read(&f).unwrap(), b"new project");
+    let _ = std::fs::remove_dir_all(d);
+}
+
 #[test]
 fn atomic_write_survives_a_crash_mid_write() {
     let d = tmp("atomic");
@@ -555,12 +615,12 @@ fn atomic_write_survives_a_crash_mid_write() {
     atomic_write(&f, b"version 1").unwrap();
     // The writer dies halfway through the temporary file.
     let r = atomic_write_with(&f, b"version 2 is much longer", |tmp, data| {
-        std::fs::write(tmp, &data[..5])?;
+        std::io::Write::write_all(tmp, &data[..5])?;
         Err(std::io::Error::other("power cut"))
     });
     assert!(r.is_err());
     assert_eq!(std::fs::read(&f).unwrap(), b"version 1");
-    assert!(!temp_path(&f).exists(), "the partial temp file is cleaned up");
+    assert_eq!(names(&d), ["p.ecproj"], "the partial temp file is cleaned up");
     // A temp file left by a hard kill doesn't count as an auto-save.
     std::fs::write(d.join("p auto-save 1.ecproj.tmp"), b"junk").unwrap();
     assert!(autosave::existing(&d, "p").is_empty());

From 2c08f675c22fc9fbf9a300a60deadee9944ce3c4 Mon Sep 17 00:00:00 2001
From: DWAA1660 <dwatnip123@gmail.com>
Date: Wed, 14 Oct 2026 21:15:40 -0600
Subject: [PATCH 3/5] fix(engine): preserve edits when applying background
 analyses

Merge each offloaded property-group result against the snapshot the job started from. Preserve disjoint live edits, group identity and child changes; refuse conflicting results without changing the document or undo/redo history.

Record an apply rejection on its originating job so completion logs and waiting control commands report failure. Keep concurrent jobs' outcomes separate and retain the correct completion position when the bounded log rolls over.

Add actual-worker regressions for conflicts, disjoint edits, concurrent analyses and undo/redo, plus control completion/error regressions.

Fixes #1249

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/engine/src/lib.rs               |   3 +
 crates/engine/src/offload.rs           | 180 ++++++++++++++++++++++++-
 crates/engine/src/tests_mask_warp.rs   | 156 +++++++++++++++++++++
 crates/ui-egui/src/control.rs          |  17 ++-
 crates/ui-egui/tests/ui_web_offload.rs |  42 ++++++
 5 files changed, 388 insertions(+), 10 deletions(-)

diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index 80956687..96e09b57 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -495,6 +495,8 @@ pub struct Session {
     /// Offloaded jobs that ended, newest last (kind, error): how a caller waiting for one
     /// (`wait: true` over the control channel in the browser) learns its outcome.
     pub offload_log: Vec<(offload::JobKind, Option<String>)>,
+    /// Number of older completion entries evicted from the bounded offload log.
+    pub offload_log_start: usize,
     /// Generic background tasks (Content-Aware Fill, Scene Edit Detection), see [`jobs`].
     pub tasks: Vec<jobs::Task>,
     /// Finished tasks, newest last (Progress panel, `jobs.list`).
@@ -598,6 +600,7 @@ impl Default for Session {
             offload: None,
             offloaded: vec![],
             offload_log: vec![],
+            offload_log_start: 0,
             browser: None,
             storage: None,
             tasks: vec![],
diff --git a/crates/engine/src/offload.rs b/crates/engine/src/offload.rs
index 561ebe6c..bd1fec8a 100644
--- a/crates/engine/src/offload.rs
+++ b/crates/engine/src/offload.rs
@@ -171,6 +171,20 @@ pub enum JobKind {
 }
 
 impl JobKind {
+    /// The corresponding `jobs.list` id, also used by waiting control commands.
+    pub fn job_id(self) -> &'static str {
+        match self {
+            JobKind::Render => "render",
+            JobKind::Warp => "warp",
+            JobKind::WarpPlan => "warpPlan",
+            JobKind::Camera => "camera",
+            JobKind::RotoFreeze | JobKind::RotoPropagate => "roto",
+            JobKind::Track => "track",
+            JobKind::MaskTrack => "maskTrack",
+            JobKind::ContentFill => "contentFill",
+        }
+    }
+
     /// The undo step an analysis result becomes.
     pub fn label(self) -> &'static str {
         match self {
@@ -699,6 +713,9 @@ pub struct OffloadedJob {
     /// Segmentations received (Roto Brush propagation).
     pub segs: u64,
     started: web_time::Instant,
+    /// The analysed group as the job started: its result is merged with what changed since
+    /// ([`merge_group`]).
+    base: Option<Box<PropGroup>>,
 }
 
 /// A Render Queue job running in a worker (see [`crate::render_queue::RenderJob`]).
@@ -730,6 +747,7 @@ impl Session {
         }
         let id = next_id();
         let inbox = Arc::new(Inbox::default());
+        let base = self.project.comp(comp).and_then(|c| c.layer(layer)).and_then(|l| l.props.find_group(uid)).cloned().map(Box::new);
         let req = WorkerRequest { id, project: self.project.to_json(), files: footage_files(&self.project), job };
         off.start(req, inbox.clone())?;
         self.offloaded.push(OffloadedJob {
@@ -742,6 +760,7 @@ impl Session {
             progress: OffloadProgress::default(),
             segs: 0,
             started: web_time::Instant::now(),
+            base,
         });
         self.events.push(Event::ProjectChanged { revision: self.revision });
         Ok(())
@@ -779,7 +798,7 @@ impl Session {
                         j.progress.done = done;
                         j.progress.total = total;
                     }
-                    WorkerReply::Group { comp, layer, group, message } => results.push((j.kind, comp, layer, group, message)),
+                    WorkerReply::Group { comp, layer, group, message } => results.push((j.id, j.kind, comp, layer, group, message, j.base.clone())),
                     WorkerReply::Fill { plan, files } => fills.push((plan, files)),
                     WorkerReply::WarpPlan { key, summary } => effectcraft_effects::warp_stab::store_summary(key, *summary),
                     WorkerReply::Segs { segs } => {
@@ -802,7 +821,7 @@ impl Session {
                 Err(e) => self.events.push(Event::Toast { message: format!("Content-Aware Fill: {e}"), error: true }),
             }
         }
-        for (kind, comp, layer, group, message) in results {
+        for (id, kind, comp, layer, group, message, base) in results {
             let uid = group.uid;
             let r = self.edit(kind.label(), None, |p, _| {
                 let g = p
@@ -810,12 +829,31 @@ impl Session {
                     .and_then(|c| c.layer_mut(layer))
                     .and_then(|l| l.props.find_group_mut(uid))
                     .ok_or_else(|| crate::EngineError::Other("the analysed property was removed during the analysis".into()))?;
-                *g = *group;
+                // Edits made while the job ran stay (#1249): only what the analysis changed is
+                // taken from its result.
+                *g = match base {
+                    Some(base) => merge_group(&base, g, &group).ok_or_else(|| {
+                        crate::EngineError::Other(format!(
+                            "“{}” was changed during the analysis where its result changes it too, so nothing was applied: analyse again",
+                            g.name
+                        ))
+                    })?,
+                    None => *group,
+                };
                 Ok(())
             });
             match r {
                 Ok(()) => self.events.push(Event::Toast { message, error: false }),
-                Err(e) => self.events.push(Event::Toast { message: format!("{}: {e}", kind.label()), error: true }),
+                Err(e) => {
+                    // Completion consumers read the job's error, not its toasts. Keep an apply
+                    // rejection on the originating job; Done logs and reports it just like a
+                    // WorkerReply::Failed, without failing another concurrent analysis.
+                    if let Some(job) = self.offloaded.iter_mut().find(|j| j.id == id) {
+                        job.progress.error = Some(e.to_string());
+                    } else {
+                        self.events.push(Event::Toast { message: format!("{}: {e}", kind.label()), error: true });
+                    }
+                }
             }
         }
         let mut done = vec![];
@@ -830,6 +868,7 @@ impl Session {
             self.offload_log.push((kind, p.error.clone().or_else(|| p.cancelled.then(|| "stopped".to_string()))));
             if self.offload_log.len() > 32 {
                 self.offload_log.remove(0);
+                self.offload_log_start = self.offload_log_start.saturating_add(1);
             }
             if let Some(e) = p.error {
                 self.events.push(Event::Toast { message: format!("{}: {e}", kind.label()), error: true });
@@ -880,6 +919,76 @@ impl Session {
     }
 }
 
+/// `live` if only it changed since `base`, `result` if only that did (or both the same way);
+/// `None` when both changed it differently.
+fn pick<T: PartialEq + Clone>(base: &T, live: &T, result: &T) -> Option<T> {
+    if live == base {
+        Some(result.clone())
+    } else if result == base || result == live {
+        Some(live.clone())
+    } else {
+        None
+    }
+}
+
+fn node_uid(n: &effectcraft_project::Node) -> Uid {
+    match n {
+        effectcraft_project::Node::Prop(p) => p.uid,
+        effectcraft_project::Node::Group(g) => g.uid,
+    }
+}
+
+/// Merge an analysis `result` into the `live` group (#1249). `base` is the group as the job
+/// started. The group's own fields and each property are taken from whichever side changed
+/// them, groups are merged child by child (matched by uid), and a child added or removed by one
+/// side is added or removed. `None` when both sides changed the same field or property
+/// differently, one side removed a child the other changed, or both reordered or added and
+/// removed children differently: a conflict.
+pub(crate) fn merge_group(base: &PropGroup, live: &PropGroup, result: &PropGroup) -> Option<PropGroup> {
+    use effectcraft_project::Node;
+    if live == base {
+        return Some(result.clone());
+    }
+    if result == base || result == live {
+        return Some(live.clone());
+    }
+    let header = |g: &PropGroup| PropGroup { children: vec![], ..g.clone() };
+    let mut out = pick(&header(base), &header(live), &header(result))?;
+    let ids = |g: &PropGroup| g.children.iter().map(node_uid).collect::<Vec<_>>();
+    let (bi, li, ri) = (ids(base), ids(live), ids(result));
+    // The children's order and set: from the side that changed them.
+    let order = if li == bi {
+        ri
+    } else if ri == bi || ri == li {
+        li
+    } else {
+        return None;
+    };
+    fn find(g: &PropGroup, u: Uid) -> Option<&effectcraft_project::Node> {
+        g.children.iter().find(|n| node_uid(n) == u)
+    }
+    // A child one side removed must be unchanged on the other, or that side's edit would be lost.
+    for u in bi.iter().filter(|u| !order.contains(u)) {
+        let b = find(base, *u);
+        if [find(live, *u), find(result, *u)].into_iter().flatten().any(|n| Some(n) != b) {
+            return None;
+        }
+    }
+    for u in order {
+        let node = match (find(base, u), find(live, u), find(result, u)) {
+            (Some(Node::Group(b)), Some(Node::Group(l)), Some(Node::Group(r))) => Node::Group(merge_group(b, l, r)?),
+            (Some(b), Some(l), Some(r)) => pick(b, l, r)?,
+            // Added by one side, or by both alike.
+            (None, Some(l), None) => l.clone(),
+            (None, None, Some(r)) => r.clone(),
+            (None, Some(l), Some(r)) if l == r => l.clone(),
+            _ => return None,
+        };
+        out.children.push(node);
+    }
+    Some(out)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -892,6 +1001,69 @@ mod tests {
         a
     }
 
+    /// A group with properties `a` (uid 2) and `b` (uid 3) and a sub-group (uid 4) holding `c`
+    /// (uid 5).
+    fn group() -> PropGroup {
+        use effectcraft_keyframe::Value as KV;
+        use effectcraft_project::{Node, Property};
+        let mut sub = PropGroup::new(4, "sub", "Sub");
+        sub.children.push(Node::Prop(Property::new(5, "c", "C", KV::Scalar(0.0))));
+        let mut g = PropGroup::new(1, "fx", "Effect");
+        g.children.push(Node::Prop(Property::new(2, "a", "A", KV::Scalar(0.0))));
+        g.children.push(Node::Prop(Property::new(3, "b", "B", KV::Scalar(0.0))));
+        g.children.push(Node::Group(sub));
+        g
+    }
+
+    fn set(g: &mut PropGroup, uid: Uid, v: f64) {
+        g.find_mut(uid).unwrap().value = effectcraft_keyframe::Value::Scalar(v);
+    }
+
+    fn get(g: &PropGroup, uid: Uid) -> f64 {
+        match g.find(uid).unwrap().value {
+            effectcraft_keyframe::Value::Scalar(v) => v,
+            ref v => panic!("{v:?}"),
+        }
+    }
+
+    #[test]
+    fn analysis_results_merge_with_edits_made_meanwhile() {
+        use effectcraft_project::Node;
+        let base = group();
+        // The user changes `a` and switches the effect off; the analysis writes `b` and `c`.
+        let mut live = base.clone();
+        set(&mut live, 2, 1.0);
+        live.enabled = false;
+        let mut result = base.clone();
+        set(&mut result, 3, 2.0);
+        set(&mut result, 5, 3.0);
+        let m = merge_group(&base, &live, &result).unwrap();
+        assert_eq!((get(&m, 2), get(&m, 3), get(&m, 5), m.enabled), (1.0, 2.0, 3.0, false));
+        // Unchanged on either side: the other side wins whole.
+        assert_eq!(merge_group(&base, &base, &result).unwrap(), result);
+        assert_eq!(merge_group(&base, &live, &base).unwrap(), live);
+        // Both changed `b`, differently: a conflict (nothing is applied). The same way: fine.
+        let mut both = live.clone();
+        set(&mut both, 3, 9.0);
+        assert!(merge_group(&base, &both, &result).is_none());
+        set(&mut both, 3, 2.0);
+        assert_eq!(get(&merge_group(&base, &both, &result).unwrap(), 3), 2.0);
+        // The analysis adds a child (a result group) while the user edits `a`: both kept.
+        let mut added = result.clone();
+        added.children.push(Node::Group(PropGroup::new(6, "out", "Output")));
+        let m = merge_group(&base, &live, &added).unwrap();
+        assert!(m.find_group(6).is_some() && get(&m, 2) == 1.0);
+        // The analysis drops the sub-group the user didn't touch: dropped.
+        let mut dropped = result.clone();
+        dropped.children.retain(|n| !matches!(n, Node::Group(g) if g.uid == 4));
+        let m = merge_group(&base, &live, &dropped).unwrap();
+        assert!(m.find_group(4).is_none() && get(&m, 2) == 1.0);
+        // …but if the user changed something in it, that's a conflict.
+        let mut touched = live.clone();
+        set(&mut touched, 5, 7.0);
+        assert!(merge_group(&base, &touched, &dropped).is_none());
+    }
+
     #[test]
     fn protocol_round_trips() {
         let mut s = Session::default();
diff --git a/crates/engine/src/tests_mask_warp.rs b/crates/engine/src/tests_mask_warp.rs
index e08ce2e6..137feb1c 100644
--- a/crates/engine/src/tests_mask_warp.rs
+++ b/crates/engine/src/tests_mask_warp.rs
@@ -412,6 +412,162 @@ impl Deferred {
     }
 }
 
+/// #1249: a setting changed while the analysis runs in a worker survives its result, which
+/// used to replace the whole effect with the copy the job started from.
+#[test]
+fn an_edit_made_during_an_offloaded_analysis_survives_its_result() {
+    let (mut s, clip, solid) = setup(shaky);
+    s.execute("edit.clear", json!({"layers": [solid.0]})).unwrap();
+    s.execute("layer.select", json!({"layers": [clip.0]})).unwrap();
+    s.execute("effect.apply", json!({"effect": "Warp Stabilizer"})).unwrap();
+    set_param(&mut s, clip, "stabilization/smoothness", json!(37.5));
+    let off = std::sync::Arc::new(Deferred::default());
+    s.offload = Some(off.clone());
+    s.execute_checked("warp.analyze", json!({"layer": clip.0})).unwrap();
+    // While the job runs: another setting of the same effect.
+    set_param(&mut s, clip, "stabilization/smoothness", json!(12.5));
+    let fx = |s: &Session| s.active_comp().unwrap().layer(clip).unwrap().props.prop("effects/#1/stabilization/smoothness").unwrap().value.clone();
+    off.run(s.footage.clone());
+    assert!(s.poll_offload());
+    assert!(!s.drain_events().iter().any(|e| matches!(e, crate::Event::Toast { error: true, .. })), "applied without a conflict");
+    let st = s.execute("warp.status", json!({})).unwrap();
+    assert_eq!(st["analyzed"], true, "the analysis landed: {st}");
+    assert_eq!(fx(&s), KV::Scalar(12.5), "the edit made during the analysis stays");
+    // One undo step takes the analysis back and keeps the edit.
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(fx(&s), KV::Scalar(12.5));
+    assert_eq!(s.execute("warp.status", json!({})).unwrap()["analyzed"], false);
+}
+
+fn point_track_pose(f: u32) -> ([f64; 2], f64, f64) {
+    ([150.0 + 2.0 * f as f64, 110.0 + f as f64], 0.0, 1.0)
+}
+
+/// Hold an actual point-tracking worker request so commands can edit its target before the
+/// serialized worker reply is delivered.
+fn held_point_track() -> (Session, LayerId, Uid, std::sync::Arc<Deferred>) {
+    let (mut s, clip, solid) = setup(patch_frames(point_track_pose));
+    s.execute("edit.clear", json!({"layers": [solid.0]})).unwrap();
+    s.execute("layer.select", json!({"layers": [clip.0]})).unwrap();
+    let tracker = s.execute("track.motion", json!({})).unwrap()["tracker"].as_u64().unwrap();
+    s.execute("track.setPoint", json!({"point": 1, "center": point_track_pose(0).0, "featureSize": [36, 36], "searchSize": [80, 80]})).unwrap();
+    let off = std::sync::Arc::new(Deferred::default());
+    s.offload = Some(off.clone());
+    s.execute_checked("track.analyze", json!({"direction": "forward"})).unwrap();
+    assert_eq!(off.kinds(), [crate::offload::JobKind::Track]);
+    (s, clip, tracker, off)
+}
+
+fn tracked_center(s: &Session, clip: LayerId, tracker: Uid) -> Uid {
+    s.active_comp().unwrap().layer(clip).unwrap().props.find_group(tracker).unwrap().track_points().next().unwrap().get("featureCenter").unwrap().uid
+}
+
+#[test]
+fn offloaded_conflict_preserves_state_and_reports_completion_failure() {
+    let (mut s, clip, tracker, off) = held_point_track();
+    let center = tracked_center(&s, clip, tracker);
+    s.execute("prop.set", json!({"layer": clip.0, "prop": center, "value": [180.0, 140.0]})).unwrap();
+    s.execute("prop.renameGroup", json!({"layer": clip.0, "prop": tracker, "name": "Redo survives"})).unwrap();
+    assert!(s.undo());
+    let before = s.project.clone();
+    let state = serde_json::to_value(&s.state).unwrap();
+    let steps = |s: &Session| {
+        let entries =
+            |v: &[(String, std::sync::Arc<effectcraft_project::Project>)]| v.iter().map(|(label, p)| (label.clone(), p.to_json())).collect::<Vec<_>>();
+        (
+            entries(&s.history.undo),
+            entries(&s.history.redo),
+            s.history.branches.iter().map(|b| (b.parent.to_json(), entries(&b.steps))).collect::<Vec<_>>(),
+            s.history.merge_key.clone(),
+        )
+    };
+    let history = steps(&s);
+    let inbox = s.offloaded(crate::offload::JobKind::Track).unwrap().inbox.clone();
+    off.run(s.footage.clone());
+    let (done, replies): (Vec<_>, Vec<_>) = inbox.take().into_iter().partition(|r| matches!(r, crate::offload::WorkerReply::Done));
+    assert_eq!(done.len(), 1);
+    for reply in replies {
+        inbox.push(reply);
+    }
+    s.drain_events();
+    assert!(s.poll_offload());
+    let pending = s.offloaded(crate::offload::JobKind::Track).unwrap();
+    assert!(pending.progress.error.as_ref().is_some_and(|e| e.contains("nothing was applied")));
+    assert!(!pending.progress.finished);
+    assert!(s.offload_log.is_empty(), "the error is kept before completion is logged");
+    // The current completion remains identifiable after the bounded log evicts an old entry.
+    s.offload_log = vec![(crate::offload::JobKind::Warp, None); 32];
+    for reply in done {
+        inbox.push(reply);
+    }
+    assert!(s.poll_offload());
+    assert!(std::sync::Arc::ptr_eq(&s.project, &before), "a rejected result changes no document content");
+    assert_eq!(serde_json::to_value(&s.state).unwrap(), state);
+    assert_eq!(steps(&s), history);
+    let errors: Vec<_> = s
+        .drain_events()
+        .into_iter()
+        .filter_map(|e| match e {
+            crate::Event::Toast { error: true, message } => Some(message),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(errors.len(), 1, "the apply rejection is reported once: {errors:?}");
+    assert!(errors[0].contains("nothing was applied"));
+    assert_eq!(s.offload_log.len(), 32);
+    assert_eq!(s.offload_log_start, 1);
+    let (kind, error) = s.offload_log.last().unwrap();
+    assert_eq!(*kind, crate::offload::JobKind::Track);
+    assert!(error.as_ref().is_some_and(|e| e.contains("nothing was applied")), "a rejected result must report failure to JobWaiter");
+    assert!(s.redo());
+    assert_eq!(s.active_comp().unwrap().layer(clip).unwrap().props.find_group(tracker).unwrap().name, "Redo survives");
+}
+
+#[test]
+fn offloaded_disjoint_edit_reports_success_and_keeps_one_undo_step() {
+    let (mut s, clip, tracker, off) = held_point_track();
+    s.execute("prop.renameGroup", json!({"layer": clip.0, "prop": tracker, "name": "Live track"})).unwrap();
+    s.execute("prop.setGroupEnabled", json!({"layer": clip.0, "prop": tracker, "value": false})).unwrap();
+    let undo = s.history.undo.len();
+    off.run(s.footage.clone());
+    s.drain_events();
+    assert!(s.poll_offload());
+    let layer = s.active_comp().unwrap().layer(clip).unwrap();
+    let track = layer.props.find_group(tracker).unwrap();
+    assert_eq!(track.name, "Live track");
+    assert!(!track.enabled);
+    assert_eq!(track.track_points().next().unwrap().get("featureCenter").unwrap().keys.len(), 25);
+    assert_eq!(s.history.undo.len(), undo + 1);
+    assert_eq!(s.offload_log.last(), Some(&(crate::offload::JobKind::Track, None)));
+    assert!(!s.drain_events().iter().any(|e| matches!(e, crate::Event::Toast { error: true, .. })));
+    let applied = s.project.to_json();
+    assert!(s.undo());
+    let track = s.active_comp().unwrap().layer(clip).unwrap().props.find_group(tracker).unwrap();
+    assert_eq!(track.name, "Live track");
+    assert!(!track.enabled);
+    assert!(track.track_points().next().unwrap().get("featureCenter").unwrap().keys.is_empty());
+    assert!(s.redo());
+    assert_eq!(s.project.to_json(), applied);
+}
+
+#[test]
+fn offloaded_conflict_does_not_fail_a_concurrent_analysis() {
+    let (mut s, clip, tracker, off) = held_point_track();
+    let effect = s.execute("effect.apply", json!({"effect": "Warp Stabilizer", "layers": [clip.0]})).unwrap()["effects"][0].as_u64().unwrap();
+    s.execute_checked("warp.analyze", json!({"layer": clip.0, "effect": effect})).unwrap();
+    assert_eq!(off.kinds(), [crate::offload::JobKind::Track, crate::offload::JobKind::Warp]);
+    let center = tracked_center(&s, clip, tracker);
+    s.execute("prop.set", json!({"layer": clip.0, "prop": center, "value": [180.0, 140.0]})).unwrap();
+    off.run(s.footage.clone());
+    assert!(s.poll_offload());
+    let track = s.offload_log.iter().find(|(kind, _)| *kind == crate::offload::JobKind::Track).unwrap();
+    assert!(track.1.as_ref().is_some_and(|e| e.contains("nothing was applied")));
+    let warp = s.offload_log.iter().find(|(kind, _)| *kind == crate::offload::JobKind::Warp).unwrap();
+    assert!(warp.1.is_none(), "the other analysis completed successfully: {warp:?}");
+    assert_eq!(s.execute("warp.status", json!({"layer": clip.0, "effect": effect})).unwrap()["analyzed"], true);
+    assert!(s.active_comp().unwrap().layer(clip).unwrap().props.find(center).unwrap().keys.is_empty());
+}
+
 /// M13.32: where jobs run elsewhere (the browser), `warp.status` never solves the
 /// stabilization plan on the page's thread (seconds for a long Subspace Warp clip): the
 /// analysis job sends the plan's summary with its result, and a settings change has the plan
diff --git a/crates/ui-egui/src/control.rs b/crates/ui-egui/src/control.rs
index bb45d110..15493ad7 100644
--- a/crates/ui-egui/src/control.rs
+++ b/crates/ui-egui/src/control.rs
@@ -68,8 +68,8 @@ pub struct JobWaiter {
     pub result: Value,
     /// Ids of the jobs it started (`jobs.list` ids: `render`, `track`, `roto`…).
     pub jobs: Vec<String>,
-    /// Length of [`effectcraft_engine::Session::offload_log`] when it started.
-    pub log_len: usize,
+    /// Absolute completion-log position when it started (including evicted entries).
+    pub log_cursor: usize,
 }
 
 /// Commands that block with `wait` (and its default).
@@ -86,7 +86,7 @@ fn execute_engine(app: &mut EffectcraftApp, id: &str, params: Value) -> Result<O
         return app.session.execute_checked(id, params).map(ok).map_err(|e| e.to_string());
     }
     let before: Vec<String> = app.session.jobs().into_iter().map(|j| j.id).collect();
-    let log_len = app.session.offload_log.len();
+    let log_cursor = app.session.offload_log_start.saturating_add(app.session.offload_log.len());
     let mut p = params.clone();
     p["wait"] = json!(false);
     let result = app.session.execute_checked(id, p).map_err(|e| e.to_string())?;
@@ -94,7 +94,7 @@ fn execute_engine(app: &mut EffectcraftApp, id: &str, params: Value) -> Result<O
     if jobs.is_empty() {
         return Ok(ok(result));
     }
-    Ok(Outcome::AwaitJobs(JobWaiter { command: id.to_string(), params, result, jobs, log_len }))
+    Ok(Outcome::AwaitJobs(JobWaiter { command: id.to_string(), params, result, jobs, log_cursor }))
 }
 
 impl JobWaiter {
@@ -108,8 +108,13 @@ impl JobWaiter {
     pub fn finish(self, app: &mut EffectcraftApp) -> Value {
         let s = &mut app.session;
         s.poll_render();
-        let errors: Vec<String> = s.offload_log.iter().skip(self.log_len).filter_map(|(_, e)| e.clone()).collect();
-        if let Some(e) = errors.first() {
+        let error = s
+            .offload_log
+            .iter()
+            .skip(self.log_cursor.saturating_sub(s.offload_log_start))
+            .filter(|(kind, _)| self.jobs.iter().any(|id| id == kind.job_id()))
+            .find_map(|(_, e)| e.as_ref());
+        if let Some(e) = error {
             return json!({"ok": false, "error": e});
         }
         let mut r = self.result;
diff --git a/crates/ui-egui/tests/ui_web_offload.rs b/crates/ui-egui/tests/ui_web_offload.rs
index cc49325f..67ec6a9f 100644
--- a/crates/ui-egui/tests/ui_web_offload.rs
+++ b/crates/ui-egui/tests/ui_web_offload.rs
@@ -219,3 +219,45 @@ fn waiting_commands_reply_when_their_offloaded_job_ends() {
     let v = reply.try_recv().expect("immediate reply");
     assert_eq!(v["result"]["rendering"], true, "{v}");
 }
+
+/// Completion errors belong to the waiting command's jobs, including when several
+/// different analyses complete in the same UI frame.
+#[test]
+fn waiting_commands_report_only_their_own_completion_errors() {
+    use effectcraft_engine::offload::JobKind;
+    use effectcraft_ui_egui::control::JobWaiter;
+
+    for (kind, job_id) in [
+        (JobKind::Render, "render"),
+        (JobKind::Warp, "warp"),
+        (JobKind::WarpPlan, "warpPlan"),
+        (JobKind::Camera, "camera"),
+        (JobKind::RotoFreeze, "roto"),
+        (JobKind::RotoPropagate, "roto"),
+        (JobKind::Track, "track"),
+        (JobKind::MaskTrack, "maskTrack"),
+        (JobKind::ContentFill, "contentFill"),
+    ] {
+        let other = if kind == JobKind::Track { JobKind::Warp } else { JobKind::Track };
+        let mut app = EffectcraftApp::new(Session::default());
+        app.session.offload_log = vec![(kind, Some("old error".into())), (other, Some("unrelated failure".into())), (kind, None)];
+        let waiter = || JobWaiter { command: "analysis".into(), params: json!({}), result: json!({"running": true}), jobs: vec![job_id.into()], log_cursor: 1 };
+        let result = waiter().finish(&mut app);
+        assert_eq!(result, json!({"ok": true, "result": {"running": false}}), "{kind:?}");
+        app.session.offload_log.push((kind, Some("nothing was applied".into())));
+        let result = waiter().finish(&mut app);
+        assert_eq!(result, json!({"ok": false, "error": "nothing was applied"}), "{kind:?}");
+    }
+}
+
+#[test]
+fn waiting_command_sees_its_error_after_the_completion_log_rolls_over() {
+    use effectcraft_engine::offload::JobKind;
+    use effectcraft_ui_egui::control::JobWaiter;
+    let mut app = EffectcraftApp::new(Session::default());
+    app.session.offload_log = vec![(JobKind::Warp, None); 31];
+    app.session.offload_log.push((JobKind::Track, Some("nothing was applied".into())));
+    app.session.offload_log_start = 1;
+    let waiter = JobWaiter { command: "track.analyze".into(), params: json!({}), result: json!({}), jobs: vec!["track".into()], log_cursor: 32 };
+    assert_eq!(waiter.finish(&mut app), json!({"ok": false, "error": "nothing was applied"}));
+}

From 26ed1a35bfebb9286817cf5a1e92a49e774e69f8 Mon Sep 17 00:00:00 2001
From: ".CooCoo" <RobertLeeLW@gmail.com>
Date: Thu, 15 Oct 2026 01:09:25 -0700
Subject: [PATCH 4/5] fix(pdf): prevent overflow in EPS integer arithmetic

Use checked division and remainder for EPS integer operators so i64::MIN with a divisor truncating to -1 cannot panic. Preserve the existing zero-divisor fallback and normal truncation behavior.

Add public EPS parse regressions covering extreme, fractional and ordinary operands.

PR #1223
---
 crates/pdf/src/ps.rs           | 18 ++++--------------
 crates/pdf/src/tests_import.rs | 22 ++++++++++++++++++++++
 2 files changed, 26 insertions(+), 14 deletions(-)

diff --git a/crates/pdf/src/ps.rs b/crates/pdf/src/ps.rs
index 65e352cb..4401ace9 100644
--- a/crates/pdf/src/ps.rs
+++ b/crates/pdf/src/ps.rs
@@ -700,20 +700,10 @@ impl Interp {
                             a / b
                         }
                     }
-                    "idiv" => {
-                        if b as i64 == 0 {
-                            0.0
-                        } else {
-                            ((a as i64) / (b as i64)) as f64
-                        }
-                    }
-                    "mod" => {
-                        if b as i64 == 0 {
-                            0.0
-                        } else {
-                            ((a as i64) % (b as i64)) as f64
-                        }
-                    }
+                    // `checked_*` give 0 both for a zero divisor and for the one overflowing
+                    // case, `i64::MIN / -1` (`/` and `%` panic on it in every build).
+                    "idiv" => (a as i64).checked_div(b as i64).unwrap_or(0) as f64,
+                    "mod" => (a as i64).checked_rem(b as i64).unwrap_or(0) as f64,
                     "atan" => a.atan2(b).to_degrees().rem_euclid(360.0),
                     "exp" => a.powf(b),
                     "max" => a.max(b),
diff --git a/crates/pdf/src/tests_import.rs b/crates/pdf/src/tests_import.rs
index 532e32cb..add447e3 100644
--- a/crates/pdf/src/tests_import.rs
+++ b/crates/pdf/src/tests_import.rs
@@ -376,3 +376,25 @@ fn postscript_radix_numbers_outside_2_to_36_are_not_numbers() {
         let _ = parse(src.as_bytes());
     }
 }
+
+#[test]
+fn postscript_idiv_and_mod_of_i64_min_by_minus_one_give_zero() {
+    // `i64::MIN / -1` and `i64::MIN % -1` overflow, and `/` and `%` panic on them in debug and
+    // release builds. `as i64` turns any dividend at or below -2^63 into `i64::MIN` and turns
+    // a divisor of -1.5 into -1.
+    for (prog, want) in [
+        ("-9223372036854775808 -1 idiv", 0),
+        ("-9223372036854775808 -1 mod", 0),
+        ("-99999999999999999999 -1.5 idiv", 0),
+        ("2 63 exp neg -1 mod", 0),
+        // The result is 0 for a divisor that truncates to 0. Other quotients are truncated
+        // toward zero, and a remainder has the sign of the dividend.
+        ("7 0 idiv", 0),
+        ("7 0.5 mod", 0),
+        ("-7 2 idiv", -3),
+        ("-7 2 mod", -1),
+    ] {
+        let doc = eps(format!("{prog} {want} eq {{ 0 0 10 10 rectfill }} if\n").as_bytes());
+        assert_eq!(shape_names(&doc).len(), 1, "{prog}");
+    }
+}

From 0311bdc34d0dc10c2d18ff7875b4f52d483e5e27 Mon Sep 17 00:00:00 2001
From: Moein Saharkhiz <142007707+onlymoein@users.noreply.github.com>
Date: Thu, 15 Oct 2026 04:13:41 -0400
Subject: [PATCH 5/5] fix(automation): avoid replaying edits after lost replies

Retry only explicitly read-only control queries after connection failures. Report ambiguous edit outcomes without resending mutations, reconnect on the next explicit call, and reject request-ID exhaustion without overflow.

Add loopback regressions for lost and malformed replies, read-only retries, playback queries versus edits, and unknown methods.

Fixes #1247
---
 crates/automation/src/bridge.rs |  17 +++--
 crates/automation/src/tests.rs  | 122 ++++++++++++++++++++++++++++++++
 docs/agents.md                  |   5 ++
 3 files changed, 139 insertions(+), 5 deletions(-)

diff --git a/crates/automation/src/bridge.rs b/crates/automation/src/bridge.rs
index eab1c01d..77d69dd0 100644
--- a/crates/automation/src/bridge.rs
+++ b/crates/automation/src/bridge.rs
@@ -1,5 +1,5 @@
 //! Blocking client for the desktop app's JSON-lines control channel (`docs/control-protocol.md`).
-//! One persistent loopback connection, reconnected once if the app went away.
+//! One persistent loopback connection. Only explicitly read-only queries can be resent.
 
 use std::io::{BufRead, BufReader, Write};
 use std::net::{TcpStream, ToSocketAddrs};
@@ -50,16 +50,20 @@ impl BridgeClient {
 
     /// Call a control method; returns the reply's `result`, or the app's `error` as [`Error::App`].
     pub fn call(&mut self, method: &str, params: Value) -> Result<Value> {
+        let retry_read =
+            matches!(method, "engine.commands" | "ui.menu.list" | "ui.inspect" | "ui.elements" | "ui.viewer.locate" | "ui.viewer.hit" | "ui.timeline.locate")
+                || (method == "ui.playback" && params["action"] == "status");
+        let unknown = |error| Error::Bridge(format!("`{method}` request outcome is unknown: {error}; inspect the app before retrying"));
         let mut last = Error::Bridge("not attempted".into());
         for attempt in 0..2 {
             if self.conn.is_none() {
                 self.conn = Some(self.connect()?);
             }
             let id = self.next_id;
-            self.next_id += 1;
+            self.next_id = self.next_id.checked_add(1).ok_or_else(|| Error::Bridge("control request id space exhausted".into()))?;
             let Some((r, w)) = self.conn.as_mut() else { continue };
             let line = format!("{}\n", json!({"id": id, "method": method, "params": params}));
-            // `Ok(Err(_))`: the connection is dead before a reply (safe to resend once);
+            // `Ok(Err(_))`: transmission/reply failed (the app may have applied the request);
             // `Err(_)`: a timeout or bad reply (never resent: the app may have run the request).
             let res = (|| -> Result<std::result::Result<Value, Error>> {
                 if let Err(e) = w.write_all(line.as_bytes()) {
@@ -80,8 +84,11 @@ impl BridgeClient {
                 Ok(Ok(v)) if v.get("ok").and_then(Value::as_bool) == Some(true) => return Ok(v.get("result").cloned().unwrap_or(Value::Null)),
                 Ok(Ok(v)) => return Err(Error::App(v.get("error").and_then(Value::as_str).unwrap_or("error").to_string())),
                 Ok(Err(e)) => {
-                    // Stale connection (app restarted): reconnect and resend once.
                     self.conn = None;
+                    if !retry_read {
+                        return Err(unknown(e));
+                    }
+                    // A read-only query can be repeated after a stale connection or lost reply.
                     last = e;
                     if attempt == 1 {
                         break;
@@ -90,7 +97,7 @@ impl BridgeClient {
                 Err(e) => {
                     // The stream may still deliver the late reply: start fresh next call.
                     self.conn = None;
-                    return Err(e);
+                    return Err(if retry_read { e } else { unknown(e) });
                 }
             }
         }
diff --git a/crates/automation/src/tests.rs b/crates/automation/src/tests.rs
index 6bb6fbc5..6e622b37 100644
--- a/crates/automation/src/tests.rs
+++ b/crates/automation/src/tests.rs
@@ -511,6 +511,128 @@ fn bridge_rejects_non_loopback() {
     assert!(Backend::bridge("localhost:9877").is_ok());
 }
 
+/// The app applies the first request but loses its reply. The next connection can be either
+/// an automatic retry or an explicit follow-up; the returned counts distinguish them.
+fn lost_reply_server(first_reply: Option<&'static str>) -> (String, std::thread::JoinHandle<()>) {
+    let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+    let addr = listener.local_addr().unwrap().to_string();
+    let worker = std::thread::spawn(move || {
+        let mut session = Session::default();
+        let mut mutations = 0;
+        for attempt in 0..2 {
+            let (stream, _) = listener.accept().unwrap();
+            stream.set_read_timeout(Some(std::time::Duration::from_secs(5))).unwrap();
+            let mut output = stream.try_clone().unwrap();
+            let mut input = String::new();
+            BufReader::new(stream).read_line(&mut input).unwrap();
+            let request: Value = serde_json::from_str(&input).unwrap();
+            let result = if request["method"] == "engine.execute" {
+                mutations += 1;
+                session.execute(request["params"]["command"].as_str().unwrap(), request["params"]["params"].clone()).unwrap()
+            } else if request["method"] == "ui.inspect" || (request["method"] == "ui.playback" && request["params"]["action"] == "status") {
+                json!({"mutations": mutations, "requests": attempt + 1, "comps": session.project.comps().count()})
+            } else {
+                mutations += 1;
+                json!({"mutations": mutations})
+            };
+            if attempt == 1 {
+                writeln!(output, "{}", json!({"id": request["id"], "ok": true, "result": result})).unwrap();
+            } else if let Some(reply) = first_reply {
+                writeln!(output, "{reply}").unwrap();
+            }
+        }
+    });
+    (addr, worker)
+}
+
+#[test]
+fn bridge_does_not_replay_a_mutation_when_its_reply_is_lost() {
+    let (addr, worker) = lost_reply_server(None);
+    let mut backend = Backend::bridge(&addr).unwrap();
+    let error = backend.exec("comp.new", json!({"width": 64, "height": 48, "duration": 1})).unwrap_err();
+    assert!(error.to_string().contains("outcome is unknown"), "{error}");
+    let state = backend.control("ui.inspect", json!({})).unwrap();
+    assert_eq!(state["mutations"], 1, "the first command was applied exactly once");
+    assert_eq!(state["comps"], 1);
+    worker.join().unwrap();
+}
+
+#[test]
+fn bridge_retries_read_only_queries_after_a_lost_reply() {
+    let (addr, worker) = lost_reply_server(None);
+    let mut backend = Backend::bridge(&addr).unwrap();
+    let state = backend.control("ui.inspect", json!({})).unwrap();
+    assert_eq!(state["requests"], 2);
+    assert_eq!(state["mutations"], 0);
+    worker.join().unwrap();
+}
+
+#[test]
+fn bridge_reports_unknown_outcome_after_a_malformed_mutation_reply() {
+    let (addr, worker) = lost_reply_server(Some("{invalid reply"));
+    let mut backend = Backend::bridge(&addr).unwrap();
+    let error = backend.exec("comp.new", json!({"width": 64, "height": 48, "duration": 1})).unwrap_err();
+    let message = error.to_string();
+    assert!(message.contains("outcome is unknown") && message.contains("bad reply"), "{message}");
+    assert_eq!(backend.control("ui.inspect", json!({})).unwrap()["comps"], 1);
+    worker.join().unwrap();
+}
+
+#[test]
+fn bridge_does_not_assume_an_unknown_method_is_read_only() {
+    let (addr, worker) = lost_reply_server(None);
+    let mut backend = Backend::bridge(&addr).unwrap();
+    let error = backend.control("future.customOperation", json!({})).unwrap_err();
+    assert!(error.to_string().contains("outcome is unknown"), "{error}");
+    assert_eq!(backend.control("ui.inspect", json!({})).unwrap()["mutations"], 1);
+    worker.join().unwrap();
+}
+
+#[test]
+fn bridge_playback_edits_and_default_toggle_are_not_replayed() {
+    for params in [json!({}), json!({"action": "toggle"}), json!({"action": "play"}), json!({"action": "stop"})] {
+        let (addr, worker) = lost_reply_server(None);
+        let mut backend = Backend::bridge(&addr).unwrap();
+        let error = backend.control("ui.playback", params).unwrap_err();
+        assert!(error.to_string().contains("outcome is unknown"), "{error}");
+        assert_eq!(backend.control("ui.inspect", json!({})).unwrap()["mutations"], 1);
+        worker.join().unwrap();
+    }
+}
+
+#[test]
+fn bridge_playback_status_can_be_retried() {
+    let (addr, worker) = lost_reply_server(None);
+    let mut backend = Backend::bridge(&addr).unwrap();
+    let state = backend.control("ui.playback", json!({"action": "status"})).unwrap();
+    assert_eq!(state["requests"], 2);
+    assert_eq!(state["mutations"], 0);
+    worker.join().unwrap();
+}
+
+#[test]
+fn bridge_connect_failure_can_be_retried_when_the_app_starts() {
+    let reserved = TcpListener::bind("127.0.0.1:0").unwrap();
+    let addr = reserved.local_addr().unwrap();
+    drop(reserved);
+    let mut backend = Backend::bridge(&addr.to_string()).unwrap();
+    let error = backend.control("ui.inspect", json!({})).unwrap_err();
+    assert!(error.to_string().contains("cannot connect"), "{error}");
+    assert!(!error.to_string().contains("outcome is unknown"), "nothing was sent");
+    let listener = TcpListener::bind(addr).unwrap();
+    let worker = std::thread::spawn(move || {
+        let (stream, _) = listener.accept().unwrap();
+        stream.set_read_timeout(Some(std::time::Duration::from_secs(5))).unwrap();
+        let mut output = stream.try_clone().unwrap();
+        let mut input = String::new();
+        BufReader::new(stream).read_line(&mut input).unwrap();
+        let request: Value = serde_json::from_str(&input).unwrap();
+        writeln!(output, "{}", json!({"id": request["id"], "ok": true, "result": {"ready": true}})).unwrap();
+    });
+    assert_eq!(backend.control("ui.inspect", json!({})).unwrap()["ready"], true);
+    worker.join().unwrap();
+}
+
 #[test]
 fn script_ui_and_history_tools() {
     let mut sess = Session::default();
diff --git a/docs/agents.md b/docs/agents.md
index 1bec71d5..ed0073d4 100644
--- a/docs/agents.md
+++ b/docs/agents.md
@@ -52,6 +52,11 @@ Desktop, Cursor and the like) take the same `command` and `args`.
 - **Bridge** (`["mcp", "--bridge", "9877"]`): drives a running `effectcraft --control 9877`, so you
   see every change live. Bridge mode adds `screenshot` and the `ui_*` tools.
 
+After a broken connection, the bridge retries explicitly read-only control queries once.
+Engine commands, UI edits and unknown methods whose transmission or reply fails report an
+unknown outcome: the app may already have applied them. Inspect the app before explicitly
+retrying. A later call reconnects; timeouts and malformed replies are never automatically resent.
+
 ### From an installed release
 
 The release packages ship `effectcraft-cli` alongside the desktop app, so no build is needed: