Fix/video pipeline hardening

[mathematicalmichael]

No description provided.

[Copilot]

Copilot review overview

🟡 Changes recommended

loadImageAsset's unconditional crypto.subtle.digest call breaks the published-work skybox loader on plain-HTTP static hosts (S3/BrightSign) that the README explicitly supports, a regression from the previous Image.src loader.

Review effort: Balanced
Findings: 1

Open (1)

• Skip crypto.subtle hash on insecure origins for published loads · New

What changed in this PR

This PR hardens the video export pipeline across the browser viewer and the Python checkpoint/encode server. On the browser side it makes frame capture more robust (reusable OffscreenCanvas with a promise-based PNG encoder and a synchronous fallback), introduces a skybox "render state/lock" so exports only start once the environment is loaded and the environment can't change mid-render, and folds actual face SHA-256 hashes into the resume signature. On the server side it adds an ffmpeg libx264 preflight, explicit full-range→limited-range BT.709 color tagging for new checkpoint segments, per-segment encoder stderr capture surfaced into the job's error, and replaces the legacy in-memory VIDEO_JOBS cancellation path with the durable store's pause_all.

Changes:

• Deterministic, hidden-tab-safe frame capture via OffscreenCanvas.convertToBlob() with re-render fallback, plus a skybox render-state/lock gating video export.
• BT.709 color conversion/tagging for new checkpoint jobs, encoder stderr diagnostics preserved into the job error, and an ffmpeg/libx264 startup preflight.
• New opt-in production-resolution soak test, an isolated capture regression test, and expanded color/restore test coverage; supporting README/makefile/package.json updates.

File	Description
viewer-skyboxes.js	Replaces loadImage with hashing loadImageAsset; adds render state/lock API and manifest-hash verification.
tesseract.js	Async OffscreenCanvas capture with fallback, hoists updateMaterials to module scope, adds syncViewerControlsFromState, wires render lock and environment into export.
studio/​server.py	Adds ffmpeg_encoder_error preflight, removes legacy VIDEO_JOBS/cancel_video, closes connections on validation/OSError.
studio/​video_resume.py	Injects colorProfile, emits BT.709 ffmpeg args, captures/consumes per-segment encoder stderr.
studio/​video_soak.py	New opt-in 1080p checkpoint/restart soak harness in temp storage.
studio/​test_video_resume.py	Asserts BT.709 encoder args and stderr diagnostics propagation.
studio/​test_video_resume_integration.py	Adds real-ffprobe BT.709 color assertions.
studio/​test_video_capture.cjs	New isolated capture test for pixel integrity and fallback re-render.
studio/​test_server.py	Adds libx264 preflight test, request timeouts, removes obsolete cancel test.
studio/​test_browser.cjs	Validates render-signature environment hashes and settings-restore flow.
README.md	Documents capture/color/skybox-lock behavior and new validation commands.
package.json /​ makefile /​ .gitignore	Add capture/encoder/soak test targets and ignore docs/.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

There are a couple of concrete correctness/clarity issues in the new export readiness/threading logic that should be addressed before approval.

Review effort: Lite
Findings: 1 · 1

Open (2)

• Export plan ignores missing identity required by render lock · New
• ffmpeg command passes duplicate -threads options in tests · New

Resolved since last review (1)

• Skip crypto.subtle hash on insecure origins for published loads

[Copilot]

Copilot review overview

🔵 Needs a closer look

It changes security-sensitive hashing, encoder subprocess/signal lifecycle, and connection handling across viewer and server, which warrants final human review despite no blocking defect being found.

Review effort: Balanced
Findings: None

Resolved since last review (2)

• Export plan ignores missing identity required by render lock
• ffmpeg command passes duplicate -threads options in tests