MatteLoop v0.3.0

MatteLoop 0.3.0

The first release with an application-level settings surface, a German
interface, and a consistent answer to the question "does the window tell me the
truth?" — which, in several places, it did not.

Twenty-six issues closed since 0.2.1.

New

A Preferences surface. MatteLoop had no application chrome at all: no menu
bar, no toolbar, not a single action. A narrow gear button now sits beside
Render Video and opens Preferences, reachable with Cmd+, / Ctrl+, and never
disabled — preferences stay available while a render runs and before any video
is loaded. (#50)

A German interface. Every user-visible string is translated, with English as
the primary language and German as the second. Number and date formatting
follows the selected interface language rather than the system locale, so an
English interface on a German machine no longer reads 6,042 s inside English
labels. The choice is in Preferences and applies at the next start, together
with the locale, so words and numbers can never disagree. (#49, #108)

Compute acceleration moved to Preferences. It describes this machine's
graphics hardware and is identical for every clip, but it sat in the
Segmentation section between Model and Edge treatment, where it read like a
creative decision. Edge treatment stays in the inspector, because it changes
what the render produces and depends on the clip. (#85)

Replace the open clip by dropping a video on the window. Previously a drop
worked only when nothing was open; once a clip was loaded the same gesture was
silently ignored, with no highlight and no message. The drop now goes through
exactly the same confirmation as the button. (#88)

Reset the render parameters to their defaults. #27 fixed the bug where
scrolling the inspector changed whatever field the pointer passed over; the
damage it left could not be undone, and an fps of 11 or an alpha threshold of
0.4 that nobody chose followed the user into every later session. Validation
could not rescue that: those are legal values inside their ranges. (#56, #110)

Clear the output directory. Until now a directory chosen once could not be
returned to the source folder from the interface at all. (#50, #110)

Work is no longer destroyed without asking

• Deleting a saved cut set removed it immediately — its segmented frames and
  its saved transform with it, including externally edited frames that
  re-running segmentation cannot reconstruct. Now one confirmation for every
  deletion, identifying the set and naming what recreating it costs. (#59)
• Replacing the source, or closing the window, discarded unsaved transform
  edits with no warning. Both paths now ask. (#67)
• Rebuilding the open cut could overwrite edits made while the reuse probe
  was still running, and switching cut sets bypassed the confirmation
  entirely. (#107)

The interface no longer states what is not true

• A failed render closed its dialog and left the previous Render complete
  banner on screen, pointing at the older file. After minutes of unattended
  work, the window asserted success. (#61)
• Zero meant the opposite of zero: Maximum size showed 0.000 MiB where
  zero means no limit, and told a screen reader the same wrong thing. (#65)
• Manage Workspaces was always enabled and did nothing without a video open
  — no dialog, no message, no reason. (#89)
• Reset and Clear looked available while doing nothing, and Reset blamed the
  wrong section for invalidating the preview. (#110)
• The repair advice named a Windows-only package on every platform, so a
  macOS user with a broken runtime was handed a command that reinstalls
  nothing. (#109)

Correctness

• A render could target the wrong source. A delayed cut-reuse probe could
  finish after the source had been replaced, and the job then ran the previous
  video's file under the new video's identity. Requests now carry the source
  they were built from and are refused if it changed. (#60)
• The result player could disagree with the file an export would produce —
  a restored trim ignored on first load, a paused result vanishing, external
  edits framed by obsolete bounds, and a preview that cropped the very cutout it
  exists to let you judge. (#63)
• A lost segmentation child was reused forever. After a crash, every retry
  failed instantly against the dead process until the model or provider changed
  or the application restarted. (#62)
• Cancelling took effect promptly. Quitting during stalled inference hung
  for about two minutes; a stalled download ignored Cancel for up to a minute;
  a cancelled encode kept writing frames. (#64, #62, #111)

Platform

• Every Transform field was invisible in the running application. Under the
  macOS style a form without an explicit growth policy gives a compact field
  zero pixels, so trim, crop and resize could not be typed into at all — while
  the tests and the generated screenshots, which run under Fusion, showed
  277-pixel fields nobody had. The screenshots are now captured under the style
  that ships. (#79)
• The bundle reports its own version. Every release so far shipped
  CFBundleShortVersionString = 1.0, carried no CFBundleVersion, used a bare
  matteloop as its identifier, and the Windows executable had no version
  resource at all. The window title said nothing either — empty on macOS. All of
  it now derives from one value, written before the bundle is signed. (#75)
• Qt's own dialog buttons are translated in the packaged application, which
  needed the Qt catalogues to actually be in the bundle — on both platforms,
  whose layouts differ. (#108)

Build and supply chain

• Every GitHub Action is pinned to a commit hash and kept current by Dependabot;
  one pin already referenced a commit GitHub no longer resolves. Every CI run is
  locked, and the uv version itself is pinned. (#117)
• The media-stack build tools install from a hash-verified lockfile. This was
  the one path where an unpinned transitive dependency could run code on the
  runner that produces the artifact users download. (#119)
• The packaged entrypoint no longer execs a payload derived from its
  arguments. (#118)
• The guardrail ratchet no longer freezes modules that are nowhere near the
  line budget. (#58)

Known limitations

• CFBundleVersion is still absent on macOS: Nuitka does not write it, and
  adding it after the build invalidates the ad-hoc signature, which macOS then
  reports as a damaged application. It matters only for updater frameworks that
  compare it. (#75, #74)
• With the output directory inside a cloud-synced folder such as OneDrive, a
  render can fail with frame … changed while it was read: the working set
  currently lives inside the output directory, where a sync client rewrites it.
  Choose a local directory until #106 lands.
• On Windows the title bar reads the product name twice — MatteLoop 0.3.0 - MatteLoop — because the window title and the application display name are
  both set, and Windows composes them. The executable's Product name and
  description are still Nuitka's defaults. Cosmetic, and tracked in #133.

Getting it open

These builds are unsigned, by decision, so both systems warn on first launch.
The warning is about the missing signature, not about the download.

• Windows — SmartScreen: More info, then Run anyway.
• macOS 15+ — open System Settings → Privacy & Security, find the
  message naming MatteLoop, and choose Open Anyway. The old right-click
  Open gesture no longer produces an override on any macOS this project
  supports.

The MatteLoop-*-sources-* archives are the complete corresponding sources for
the LGPL libraries inside the application — FFmpeg, libwebp and Qt — published
here as their licences require. They are not needed to run MatteLoop.