- save() writes <config>/config.toml (atomic temp+rename), flat keys
at the top level and group/sub keys as [group] tables, values as
native TOML int/float/bool/string (non-finite doubles degrade to
strings and restore via the declared type)
- load() prefers config.toml; a legacy config.ini (C++ or pre-TOML
Rust builds) is read once and immediately re-persisted as TOML; the
INI file is left in place; a corrupt TOML is reported, never
silently discarded
- cd.yml: drop a stale oakengine comment (the crate is retired)
- NLE track growth is now a display concern: video/subtitle track
lists render reversed (a new track lands on top), audio lists render
in order (a new track lands at the bottom); the graph list always
appends. Track-add undo removes THIS track by id instead of blindly
removing the last one
- add_track returns the actual index of the new track (diffed against
the pre-command list) instead of assuming append-at-end
- status bar proxy segment reflects the real Use Proxy Media switch
instead of a static "Proxy: Off"
- proxy transcode PROGRESS events no longer invalidate the rendered
frame cache on every tick (only completion does) — progress updates
used to keep the playback cache permanently cold while generating
- effect library: live search box (name/type-id substring), Built-in
group header, and the addable-effects table is sorted alphabetically
(built-ins first, then OFX sub-category groups)
Real openfx-misc/CImg/Shadertoy bundles (148 plugins at
/Library/OFX/Plugins) all failed to load before; every failure was
silent. Root causes found one by one with a probe example + lldb:
- property suite rejected propSet on undefined properties and
propGetDimension on empty ones, and disallowed the index==size
append — OFX semantics are create-on-set and appendable dimensions
(this alone failed every plugin's describe)
- host property set missed the mandatory OfxPropType/OfxPropAPIVersion
and the capability props ofxs' fetchHostDescription reads with
throwOnFailure=true (IsBackground, TemporalClipAccess, MaxPages,
PageRowColumnCount, host SupportedContexts, ...) — one missing prop
aborted the read chain and left a half-initialised host description,
which made every temporal plugin refuse to load
- MultiThreadSuiteV1 lacked the five mutex functions (the plugin reads
past the short table — UB); implemented as a real counting-semaphore
registry
- the OfxHost struct was a stack local; ofxs keeps the POINTER past
setHost, so describe/render-time fetchSuite calls dereferenced a
dangling stack address (bus error once plugins actually loaded) —
the struct is now a leaked process global
- General is a standard OFX context and is no longer filtered out
(Roto/AppendClip/STMap declare only it)
- every scan/load/describe early-out now logs its reason; suite entry
points report non-OK statuses with caller location under
OAK_OFX_TRACE
- examples/scan_probe.rs: scans the real plugin dirs and prints
discovered/registered counts (also usable from CI)
Result: 148/148 plugins discovered, 134 registered as node types (the
remaining 14 need vendor suites — Vegas stereoscopic etc. — and are
logged, not silent)
- string tables live in assets/i18n/<lang>.yaml, loaded at runtime
(user pack dir ~/.oak/i18n, app bundle Resources/i18n, dev checkout)
with the compiled-in English/Chinese tables as fallback
- new status.proxy.on/off keys; inspector.params copy no longer says
"placeholder"; effect_library.group.builtin key
- bundle the packs as cargo-bundle resources; dev profile dep opt-level
dropped to 1 for faster iteration builds
- Thumbnails never appeared because the PNG was written to a .part
file with format inferred from the extension (always failing); the
writer now uses an explicit PNG encoder, and an e2e test proves the
pipeline yields real files.
- Mock engine: the CardSelected -> SelectionChanged echo no longer
re-expands a card the same click just collapsed.
- Dragging a clip moves its linked audio/video partners by the same
frame offset in a single undo entry; the dragged clip may change
tracks while partners keep theirs.
- Root view paints the near-black base so dock gaps match.
- Waveform trace follows the deep-green design color.
- actions.rs: reset the shortcut overrides in
save_writes_only_entries_that_differ_from_default (pre-existing
flake: a leaked override from a previous test poisoned the shared
lock under parallel test order).
- With a clip selected, the node editor shows that clip's context
chain (footage -> effects -> clip) instead of the global graph; the
clip's node is highlighted. No selection keeps the full graph.
- Node clicks in the graph select the node and expand/highlight the
matching effect card in the inspector; clicking an inspector card
highlights the node in the graph (single source of truth: the
engine's selected_graph_node).
- The Window menu lists every panel, checks the open ones, and toggles
visibility on click (closed panels reopen at their last dock target,
falling back to the default group) — a panel closed by accident
(e.g. the inspector) is one menu click away again. The menu refreshes
on dock structure events.
- OFX plugin scanning now covers the full standard location set:
per-user (~/.OFX/Plugins, ~/.local/share, ~/Library/OFX/Plugins on
macOS), system-level (/Library/OFX/Plugins, /usr/OFX/Plugins,
/usr/local, %ProgramFiles%\Common Files\OFX\Plugins), app-relative,
and the OFX_PLUGIN_PATH environment variable.
TrackPlaceBlockCommand::redo now homes the block's in point to the
placement target (capturing the original for undo): the Rust block
stores its position on the block, so a fresh clip that never had its
in point set always rendered at the timeline zero — the 'drops always
land at zero' bug. The original in point is captured on the first redo
and restored on undo, keeping the sync re-place round-trip exact. The
A/V drop test now asserts the clip lands at the drop frame.
- Footage drops no longer clamp to the sequence length — that clamp
squashed every drop on an empty or short timeline to frame zero.
Dropping past the end now extends the timeline, so the clip lands
where it is released.
- While dragging, a translucent ghost (35% opacity, accent border)
previews the resolved track, start frame and footage length at the
cursor; a new AppEngine::footage_length_frames (probed duration x
frame rate) feeds its extent, with a mock implementation for demo
mode.
- Main-process interact instances for the selected OFX effect card
(create on selection change, describe, destroy on deselect/close),
coexisting with the render-worker plugin instances per the OFX
multi-instance model.
- Program viewer composites the interact's overlay: draw into a GL
FBO via gl_bridge, read back, straight-alpha 'over' composite onto
the displayed frame; cached and only re-rendered on frame/time/
viewport/instance change or plugin redraw requests.
- Event forwarding: picture-area pointer maps through the contain-fit
letterbox inverse to OFX pen coordinates (pen_motion/down/up);
Keystroke to OFX key symbols (ASCII, navigation, F1-F35) for
key_down/up; a 50ms idle pump; global shortcut consumption keeps
precedence.
- e2e with the real test plugin: lifecycle marker assertions, pen/key
event records, and macOS GL overlay compositing verified (265 tests
green incl. gpui_widgets viewer suite).
- gl_bridge: macOS CGL offscreen context (process-wide singleton,
serialized GlGuard), real GL output textures/FBOs, glReadPixels
readback with vertical flip and format conversion; use_opengl now
really engages for OpenGLRenderSupported plugins (verified with real
GL rendering: C smoke 11/11, unit tests, GL e2e).
- OfxColor: color params get a swatch button plus a real picker popup
(RGBA sliders, live preview, hex input, undoable commit) replacing
the four spinboxes.
- Push buttons route kOfxActionInstanceChanged (UserEdited) per the
OFX contract; test plugin asserts the callback.
- Worker-side plugin progress flows to the main-process progress
dialog over the NDJSON control channel, with cancel propagation.
- OFX Interact host: NewInteract/Describe lifecycle, Draw/Pen/Key/Idle
action surface with proper in-args, DrawSuite v1 host implementation
sharing the gl_bridge context; interact test plugin verifies the
event stream and real GL drawing.
- Right-clicking an unselected clip selects it first (C++ parity) —
this is what made Cut/Delete appear to do nothing.
- Cut/Copy/Paste clipboard: clipboard_copy/cut/paste on the engine,
clipboard clips keep footage/range/speed/track kind and stay linked
in the pasted group; paste lands at the playhead as one undo entry.
- Dropping a video-with-audio footage places the video clip plus a
linked audio clip at the same range in ONE 'Add Clip' undo entry.
- Add Video/Audio Track buttons in the timeline toolbar and the track
header context menu; new sequences start with 2 video + 2 audio
tracks (not an undoable edit).
- oaknode Graph::add_entry now reclaims the slot from the free list —
before, a detached-then-reattached node left its slot in the free
list, so node_count undercounted and the next add_node silently
clobbered the restored node. This was the user's 'undo, redo, undo,
redo and the result changed' bug; regression covered by cycle tests
(move/trim/delete/split/add-track/linked-placement all converge).
- Dropping a video-with-audio footage now places a video clip AND a
linked audio clip at the same range in ONE undoable 'Add Clip' entry
(the links live on NodeCore.links, the canonical links_of storage;
auto-creates the missing track kind).
- The timeline toolbar gains 'Add Video/Audio Track' buttons and the
track-header context menu offers the same two entries above
Delete/Delete All Empty.
- create_sequence now starts every new sequence with the default
2 video + 2 audio track layout (driven directly through the add-track
commands, not through the undo stack). Tests updated for the new
default track counts.
FFmpeg 8 removed the standalone hardware decoders (h264_videotoolbox/
vaapi/nvdec/d3d11va no longer exist in its configure) — hardware decode
now only exists as a hwaccel attached to the software decoder. The new
oakcodec::hwdecode module therefore opens the regular decoder with the
platform's hardware device context attached (VideoToolbox on macOS,
VA-API then NVDEC on Linux, D3D11VA then NVDEC on Windows): FFmpeg
engages the matching hwaccel, decodes into hardware surfaces, and we
transfer them to system memory (NV12/P010) ahead of swscale.
- HardwareDecoding config switch, default ON by mandate; a checkbox in
Preferences > Rendering (EN/ZH); device creation failure skips to the
next candidate and finally to software; a decode-time failure on a
hardware session reopens it as software and retries once.
- hw_decoder_name() observability hook plus a HW_TRANSFERS counter so
tests can prove the hwaccel really engaged (not silently software).
- Verification: demo.mp4 H.264 decodes through VideoToolbox with a
transferred hardware surface, and the pixels match the software
decode within 0.05; switch off forces software.
- build-ffmpeg.sh also enables nvdec when ffnvcodec headers exist.
The C++ viewer Playback Resolution menu, wired end to end: the radio in
the viewer context menu reflects and sets the PlaybackDivider config,
proxy_render_size renders the preview at 480/divider long edge, and
changing the divider invalidates the cached and in-flight preview
frames. This is the escape hatch for machines that cannot keep up with
playback (measured: a debug build of the worker pool reaches only 11
fps vs 152 fps in release on 1080p H.264, which no amount of
scheduling can make realtime).
Two compounding causes behind 'playhead advances but the picture stays
frozen' and 'pause freezes the app':
- The wall-anchored clock teleported the playhead past the pre-render
window during any long stall (the first render after pressing play
costs seconds while the worker pool spins up: measured +104 frames in
one 4.1s block). The window then started behind and, with stale
in-flight frames occupying the workers, never converged.
RealClock::tick now clamps the advance to 2 frames/tick and
re-anchors the dropped time (NLE drop-frames semantics).
- Window frames the playhead had already passed stayed pending/in
flight, burning worker time on frames that could never be displayed.
update_preview_window now cancels them per tick via the new
JobDispatch::cancel_preview_frame, keeping the workers on frames
around the playhead.
Includes a production-shaped regression test (real 1080p media on the
timeline, actual cpu_frame display path) that failed with the exact
production signature (playhead 240 / displayed 0 / 36 stale slots)
before the fix and passes after.
The main-process sample showed the UI thread spending 100% of its time
in TicketArena::wait from the painted frame's synchronous render: every
cache-missed playhead frame sync-rendered inline, and the seek-priority
ticket then stole worker capacity from the pre-render window while the
blocked tick loop could not feed it — a self-reinforcing loop that made
playback unusably choppy.
On a playback miss the viewer now shows the last displayed frame while
the pre-render window warms up/catches up (paused monitors and the very
first frame keep the synchronous path). Adds a gpui test driving real
playback that requires the window to supply playhead frames, and the
real-footage bench_playback example used for the measurements
(152 fps aggregate on 1080p H.264 at 480p preview, decode-bound).
A claim mixing audio and video tickets is delivered as the video
message first and the audio message second, and the worker pops one
free-ring slot per ticket in that message order, checking each pop
against the assignment. The dispatcher however assigned slots in the
scheduler's interleaved frame order, so every audio ticket inside a
mixed batch mismatched, and each mismatch consumed a worker slot
without recycling it — cascading into the 'slot assignment mismatch'
flood and failed frames during playback.
Slot assignment now partitions the claim: video tickets first, then
audio. The mixed_audio_video integration test forces mixed claims
(queue depth > slot count with immediate releases) and fails with the
exact production signature when the fix is reverted.
Pressing play froze the app: the 120-frame pre-render window could
hold every shm slot in the pool (e.g. 8 workers x 3 F32 slots = 24 <
120). Once the wall-clock playhead outran the renders, the UI's
synchronous frame wait had no credit to dispatch, and the
slot-releasing cleanup runs on that same blocked UI thread — a hard
deadlock.
The window is now capped to (workers x slots - workers), reserving one
slot per worker so interactive (seek/sync display) and audio tickets
always dispatch. preview_window_capacity is exposed through
JobDispatch; a unit test pins the reserve math.
- preview_footage_media decodes the original from the footage's actual
first stream of the kind instead of hardcoded 0/1, fixing audio-first
and other atypical stream layouts (with a unit test).
- spawn_modal now probes for a nested window update and defers the
build instead of silently dropping the dialog — the phase-7
Preferences/Action Search fix applied centrally to every modal
(export, proxy settings, project manager, progress dialogs).
- The gpui_wgpu atlas no longer double-copies identity-format uploads,
leaving a single CPU staging copy (gpui RenderImage ownership) plus
the GPU upload on the onscreen path; the residual copy and the
IOSurface route to true zero-copy are documented in the M15 design.
- Audio tickets join the process backend: render_audio_batch wire
message, workers mix straight into shm slots (SLOT_FORMAT_AUDIO_F32),
ShmAudio payload with release semantics, crash isolation covers audio
renders; playback audio uses an async 4-chunk prefetch drained on the
UI tick (also fixes the sub-60fps chunk truncation bug); oversized
ranges and dispatcher outages fall back to in-process inline.
- Per-ticket slot formats: force_format is honored (exports request
F32 slots, dropping the BGRA8 round-trip and its 8-bit quantization);
segments grow on demand via worker-idle rebuild with generation
handoff; the scheduler filters over-capacity tickets.
- Adaptive defaults: 128-256MB/worker segment budgets drive slots per
worker, batch size follows workers/slots; bench_process example
measures throughput and adjacent-frame completion deltas
(e.g. 4 workers: 841 fps, 4.6ms mean delta).
With the C ABI facade (oakengine) retired, the frozen-ABI rationale is
gone. UndoCommand now boxes a Send Command trait (new/from_closures/
multi), dropping OakUndoCommandVtable, the userdata trampolines, the
refcount shell, the handle module, and all undostack_* handle exports.
The global facade loses its raw-pointer out-params (can_undo/can_redo
return bool, command_name returns String). oaktimeline/oaknode/
oakplugin/oaktask construct commands directly via UndoCommand::new.
oakundo src is now free of unsafe; behavior (ordering, idempotence,
done flags, groups, observers, 200-row cap) is unchanged and pinned by
the rewritten tests.
- Shortcut override layer over the action registry: <config>/shortcuts
file (id<TAB>keystroke, gpui syntax), loaded before bind_keys at
startup, saved as diff-only (all-default removes the file), conflict
resolution steals the key from its previous owner; rebind_keys
applies changes live (clear_key_bindings + bind_keys + menu rebuild).
- Preferences gains a Keyboard tab: menu-hierarchy action list,
name/path/shortcut filter, click-to-capture key editor (any key
assigns, Backspace unbinds, Esc cancels), Reset Selected/All,
Import/Export.
- Action Search on '/': modal listing 'Menu > Submenu > Action',
live filter, arrows + Enter dispatch through the same path as menu
clicks. Keystroke interception handles capture/search input ahead of
the global keymap; modal opening is deferred to avoid a nested
update_window failure.
- crates/oakengine moved to crates/oakengine.bk (excluded from the
workspace): the frozen C-ABI cdylib had no in-workspace consumers
left after the direct-rlib migration (M14); git history is the
authoritative backup.
- oakcommon: remove the CHandle module (no remaining users); config
store and shared value types are unaffected.
Part of the CHandle/unsafe cleanup: can_undo/can_redo/command_text/
command_is_done and command_init take raw pointers and are now unsafe
fn, with call sites wrapped in explicit unsafe blocks.
- New MulticamPanel: rows/cols angle grid with the current angle
highlighted, click-to-switch, 1-9 switch-and-split and cmd-1-9
switch-only shortcuts (focused-panel routed), deferred switch queue
during playback.
- src/oakui/multicam.rs: clip->connected-sequence resolution, multicam
state detection (selection then playhead fallbacks), per-angle frame
requests rendered through the process backend into an LRU cache.
- Timeline clip context menu Multi-Cam checkable item wired to
oaktimeline::multicam enable/disable with undo.
- Engine trait extended (real + mock); mock drives the real command
path with synthesized angle frames.
- WorkerPool thread pool deleted; RenderManager defaults to the
Processes backend (oak-worker children), Threads kept as a test-only
inline dispatcher; audio tickets stay in-process until S3.
- Onscreen path reads worker shm slots directly: BGRA8 slot format,
RenderedFrame::Shm wrapped into the display buffer (single disclosed
GPU-staging memcpy), scopes analyze BGRA8; the long-lived full-res /
thumbnail paths take the counted slot_to_vec copy and release.
- Playback pre-render window: forward 120 frames (configurable) fed to
the PreviewScheduler at Playback priority, interleaved across
workers, cached in shm slots until the playhead consumes them;
generation-based invalidation cancels and releases on edits.
- oaktask export and oak-cli run on private ProcessDispatchers (fixed
a pump-while-locked self-deadlock in the export loop); facade
get_frame handles ShmFrame payloads.
- Acceptance: preview path main_heap_frame_copies == 0 with spawned
workers, CLI transcode/render verified end to end.
- oaktimeline::multicam: clip_find_multicam (buffer/tex_in depth-1
lookup), multicam_enable/disable (rewire sequence<->clip through a
MultiCamNode), multicam_switch (split-preserving-links at the
playhead, each half owns an independent multicam copy, linked clips
switched together) as single undo commands with C++ labels.
- BlockSplitCommand now duplicates the clip's whole dependency graph
(copy_node_and_dependency_graph_minus_items) instead of just the
block core, matching the C++ BlockSplitCommand::prepare semantics;
undo detaches the copied subgraph, redo re-attaches identity-
preserving.
- oaknode: fix serializer dropping edges from the first-created node
(ptr=0 was not registered in id_map), restoring sequence_in edge
round-trips; multicam node and clip wiring serializer round-trip
tests.
Proxy: preview-path proxy substitution (global UseProxyMedia AND
per-footage enabled AND on-disk ready; export always uses originals),
proxy generate/delete/reveal/enable actions, ProxyDialog with global
and per-footage custom params, Tools menu + context-menu Proxy
submenus, progress in the status bar, OVE serialization of proxy
metadata and source_start_time.
Sync: timeline context-menu Synchronize by Source Time / by Waveform /
by Waveform (Adjust Speed) with ctrl-shift-w, cache-envelope
extraction with validity masks, reference/anchor selection and
single multi-undo application (replace-with-gap, speed adjust,
re-place) mirroring timelinewidget.cpp semantics.
Port the C++ menu/shortcut architecture (origin/main) to the Rust shell:
- src/actions.rs: action registry (123 entries with stable C++ ids,
i18n keys, default key bindings, routing targets) driving both the
menu bar and App::bind_keys; src/shortcuts.rs flat table removed.
- src/panels/commands.rs: PanelCommandHandler trait routing playback,
editing, zoom, markers etc. to the currently focused panel.
- make_menus rebuilt from the registry: full File/Edit/View/Playback/
Sequence/Window/Tools/Help trees aligned with the C++ main menu.
- src/menus/: shared context-menu infrastructure; right-click menus
for timeline (clip/empty/track head/ruler), project explorer,
viewers, node editor, inspector effect stack, with i18n EN/ZH.
Synchronize/Proxy/Multi-Cam entries exist but stay disabled pending
their engine wiring phases.
- graphops: reprobe_unprobed_footage resolves relative filenames against
the project dir and probes footage whose stream metadata is missing
(C++ saves and older Rust files), restoring durations and track kinds
- real: legacy footage is reprobed on open/adopt; a background worker
renders first-frame thumbnails (hash-cached PNGs) and the project
explorer data source attaches them as they complete
FootageBehavior now keeps the probed stream list (video/audio, per-stream
duration in rationals) instead of dropping it, and the probe CLI walks
that inventory to report real durations, frame rates and stream counts
rather than the previous zero placeholders.
The static FFmpeg's external codec libs pull in -lz, which on this
toolchain resolves to a copy whose install name is @rpath/libz.1.dylib
(zlib-ng-compat); without an LC_RPATH entry all three binaries died in
dyld at startup. The app/cli/worker build scripts now emit
-Wl,-rpath,/usr/lib.
Also: FFMPEG_DIR moves into the committed .cargo/config.toml as a
workspace-relative [env] entry — ffmpeg-sys-next's build script cannot
read .env files, and without it the crate silently linked the shared
Homebrew FFmpeg while oakffmpeg-link emitted the static transitive
flags (mixed linkage). docs/build.md updated.
Module-internal object references are Rust types now (values, Arc,
Mutex); CHandle remains only at the oakengine C-ABI boundary:
- oakundo: the global stack holds UndoStack/UndoCommand values
directly (stack token is the static's address)
- oaktimeline: marker/workarea boxes carry Arc<Mutex<T>>; commands
share the same allocation through Arc clones (readers in oakengine
stubs and the app's graphops updated to lock)
- oaktask/oakstorage: sessions, write-through bindings and the
database backend pass ProjectArc; the Session drops its manual
release bookkeeping; nodeutil keeps the CHandle<->Arc boundary
conversion (release_project restored for the app)
- oakcodec: handle.rs deleted outright (no facade entry needed it);
texture/block placeholders are unit structs
- oakrender: copier's project handle is an identity u64; alive-count
machinery removed; handle.rs is make_owned/get/get_mut only
- oakplugin: the instance registry is gone (its unregister key never
matched, leaking weak entries); handle.rs is the RefBox boundary type
- oaknode/oakcommon: only dead guard/borrow helpers removed; external
payload handles (texture/processor) documented as the boundary
Flake hunts landed along the way: the audio recording test serializes
on the shared manager lock with a normalized state; the autocacher
cancel test uses a slow producer so cancellation is deterministic.
- track headers: name + visible/mute/lock toggles, undoable through
graphops, honored by the montage (muted tracks are skipped) and by
the edit guards (locked tracks reject trims/moves/deletes)
- project explorer gains a panel title row; the tree/icons toggle is
now small icon buttons with tooltips
- new effect library dock panel (every addable effect; double-click
appends to the selected clip's chain)
- screenshots refreshed (zh/en, window/manager/preferences)
- oakengine is now cdylib-only (no rlib/staticlib consumers anywhere;
cargo tree verified) — the plugin/external C ABI layer; README and
docs updated
- cd.yml drops the dylib embedding/re-sign steps (the app no longer
links it)
- test race root-caused and fixed for good: the global undo stack lock
is now a re-entrant mutex (parking_lot) shared by every test that
drives the stack, including the previously unlocked node/render
families; the render-manager serial-ordering bug (an earlier repro
test initialized the global manager before the not-initialized test)
is fixed with a shared SERIAL guard and a manager shutdown
- 5 consecutive parallel runs clean; serial 209/209
- real.rs rewritten over module Rust APIs (Arc<Mutex<Project>> +
NodeId; the addref handle dance and renderer boxes are gone);
AppEngine trait and all panels untouched
- new app assembly layers: graphops (project/timeline/edit
primitives), effectchain (chain composition with undo groups),
renderops (montage build + ticket render + ExportTask export),
library via oakstorage directly
- module-side safe API additions: oakundo global value-semantic
push/undo/redo + from_closures, oakstorage project_arc_of
- deleted: src/oakui/ffi.rs, src/oakui/host_syms.rs, the dylib link
config in build.rs (only the gpui IOSurface framework link remains)
- the binary carries zero liboakengine references (otool/nm verified);
101 app tests green incl. the real-render and full-res e2e tests
- behavior improvements for free: sequences land in the project graph
(the facade scratch-project deviation is gone), footage drops take
one undo record, effect remove/reorder undo restores edges
- oak-cli: new engine.rs assembly layer maps every facade call to
module Rust APIs (oaknode graph/serializer, oaktimeline commands,
oakrender ticket arena, oaktask ExportTask, oakcommon config); the
ffi/optional/host layers and build.rs link config are gone
- oak-worker: the worker session + POSIX shm transport moved into the
crate (oakrender backend + serde_json control plane); no dylib
- both binaries carry zero liboakengine references (otool verified);
tests green (30 cli / 41 worker)
- oakundo::global: the process-global undo stack, grouping and a
command observer API; facade undo.rs becomes a thin forwarder
- oakstorage::writethrough: the binding table, snapshot thread, flush
and config resolution; it subscribes to oakundo's observer itself
- the remaining non-forwarding facade logic (TaskMeta, effect chains,
timeline composites, RendererBox, exporter path) is documented as
facade-owned with reasons
- facade exports unchanged; full suite stays green (the one
render_manager_not_initialized failure is pre-existing on the base
commit)
A fresh sequence has no tracks and a drop rejected with 'display track
does not exist'; wrong-kind drops also rejected. Dropping footage now
creates a matching track first (the Premiere convention), so the
drag-to-timeline path works on empty timelines too.
Mike-Solar