ntk 8.6.0 → 8.8.0

package/lib/app.js

@@ -1,7 +1,17 @@
 import { connectionGone } from './cleanup.js';
 import Clipboard from './clipboard.js';
 import { CursorCache } from './cursor.js';
-import { GLError, backendFor, glCapabilities, glError, nativeRefreshRate, resolveGLPolicy } from './gl.js';
+import {
+  DIRECT_SAMPLES,
+  GLError,
+  backendFor,
+  glCapabilities,
+  glError,
+  nativeRefreshRate,
+  requestedSamples,
+  resolveGLPolicy,
+  warnDirectSamples
+} from './gl.js';
 import { chooseGLXConfig } from './glx.js';
 import Picture from './picture.js';
 import Pixmap from './pixmap.js';
@@ -620,6 +630,13 @@ export default class App {
    * fbconfig with an alpha channel. Direct needs no round trip to answer —
    * there are no fbconfigs in it, only a window the GPU draws for.
    *
+   * What a backend cannot do, the answer says rather than drops: `samples`
+   * is the colour samples per pixel the returned config really has, which
+   * on the direct backend is 0 today whatever the spec asked for (issue
+   * #341, `DIRECT_SAMPLES` in lib/gl.js). A `SAMPLES`/`SAMPLE_BUFFERS`
+   * request that cannot be met also warns once per connection, because an
+   * aliased edge is otherwise found months later in a screenshot.
+   *
    * @param {object} [spec] GLX attributes, e.g. `{ DEPTH_SIZE: 24 }`
    */
   async chooseGLConfig(spec = {}) {
@@ -638,6 +655,11 @@ export default class App {
         `direct rendering: screen ${screenNum} has no 32-bit visual, so a GL window cannot have an alpha channel`
       );
     }
+    // asked for multisampling this backend cannot give? say so once, then
+    // answer honestly below rather than dropping the attribute (issue #341)
+    const wantSamples = requestedSamples(spec);
+    if (wantSamples > DIRECT_SAMPLES) warnDirectSamples(this, caps.flavor, wantSamples);
+
     return {
       backend: 'direct',
       // which direct pipeline this connection runs: 'dri3' or 'appledri'
@@ -649,6 +671,9 @@ export default class App {
       class: 4, // TrueColor; the only class these buffers can be read as
       doubleBuffer: true, // a swap chain, always
       depthSize: spec.DEPTH_SIZE ?? 16,
+      // no flavor can allocate a multisampled window buffer yet; said out
+      // loud so a caller can supersample instead of assuming MSAA
+      samples: DIRECT_SAMPLES,
       screen: screenNum,
       fbconfig: null,
       device: caps.device,

package/lib/gl.js

@@ -467,6 +467,68 @@ export function glCapabilities(app) {
   return app._glCaps;
 }
 
+/**
+ * How many colour samples per pixel a direct-backend window has. Zero, on
+ * both flavors, and this is the one place that says so.
+ *
+ * Not because multisampling is exotic on a GPU — it is nearly free there —
+ * but because the sample count belongs to the pixel format the `x11-dri`
+ * addon builds one layer below ntk: `EGL_SAMPLES` on the EGLConfig behind
+ * the GBM surface (`dri3`), `kCGLPFASamples`/`kCGLPFASampleBuffers` on the
+ * CGL pixel format (`appledri`). Its `Gpu` and `apple.Context` take a depth
+ * size and no sample count, and its GL table has neither
+ * `renderbufferStorageMultisample` nor `blitFramebuffer`, so there is not a
+ * multisampled framebuffer for ntk to resolve by hand either. Nothing here
+ * can conjure one — what it can do is not pretend, which is why
+ * `chooseGLConfig` reports `samples` on every backend and says so out loud
+ * when the spec asked for more than it got (issue #341).
+ *
+ * When the addon grows the option this becomes what it reports, and the
+ * request travels the rest of the way without another change here.
+ */
+export const DIRECT_SAMPLES = 0;
+
+/**
+ * The sample count a GLX-vocabulary spec asks for: `SAMPLES` when it names
+ * one, 1 for a bare `SAMPLE_BUFFERS` (multisample, width up to the driver),
+ * and 0 when it asks for no multisampling at all — which is also what a
+ * config object from `chooseGLConfig` reads as, since it carries neither.
+ */
+export function requestedSamples(spec = {}) {
+  const samples = Number(spec.SAMPLES) || 0;
+  if (samples > 0) return samples;
+  return Number(spec.SAMPLE_BUFFERS) > 0 ? 1 : 0;
+}
+
+/**
+ * Say — once per connection, on the console — that a multisample request
+ * cannot be honoured here.
+ *
+ * A downgrade rather than a failure: the window renders, its edges alias.
+ * That is exactly the kind of thing an app finds out about six months later
+ * from a screenshot, so it is worth one warning and a `samples` field to
+ * branch on. Once per connection because every window would otherwise say
+ * it again.
+ */
+export function warnDirectSamples(app, flavor, wanted) {
+  if (app._warnedDirectSamples) return;
+  app._warnedDirectSamples = true;
+  console.warn(
+    `ntk: this GL request asks for SAMPLES=${wanted}, and the direct backend` +
+      `${flavor ? ` (${flavor} flavor)` : ''} cannot give a window a multisampled buffer, so it has ` +
+      'samples: 0 and its edges will alias.\n' +
+      '\n' +
+      '  The sample count belongs to the pixel format x11-dri builds one layer below\n' +
+      '  ntk (EGL_SAMPLES on dri3, kCGLPFASamples on appledri), and it takes no such\n' +
+      '  option yet — there is nothing here to ask with.\n' +
+      '\n' +
+      '  Branch on config.samples (or gl.samples) rather than on having asked. For\n' +
+      "  multisampling today: indirect GLX honours SAMPLES (glPolicy: 'indirect'),\n" +
+      '  where the server picks an fbconfig that has it — or supersample in your own\n' +
+      '  draw code. See docs/context-gles.md#multisampling.'
+  );
+}
+
 /**
  * The backend `getContext('opengl')` should use right now, synchronously.
  *

package/lib/glx.js

@@ -131,7 +131,15 @@ const legacyProps = {
   BLUE_SIZE: 'blueBits',
   ALPHA_SIZE: 'alphaBits',
   AUX_BUFFERS: 'numAuxBuffers',
-  LEVEL: 'level'
+  LEVEL: 'level',
+  // Not among GetVisualConfigs' fixed properties, but a server that has
+  // multisample visuals sends these as (tag, value) pairs after them, which
+  // x11 decodes under their attribute names. Mapped to themselves so a
+  // SAMPLES request is filtered on this path too rather than passing
+  // through unexamined — a spec that asks for multisampling and gets a
+  // visual without it is the failure this whole field exists to stop.
+  SAMPLE_BUFFERS: 'SAMPLE_BUFFERS',
+  SAMPLES: 'SAMPLES'
 };
 
 // attributes compared as "at least this much"; the rest must match exactly
@@ -219,8 +227,11 @@ function matchLegacy(configs, spec) {
  *   `null` means "don't care". `screen` picks the X screen (default 0),
  *   `visual` pins a specific visual id and skips the search.
  * @returns {Promise<{visual: number, depth: number, class: number,
- *   doubleBuffer: boolean, depthSize: number, fbconfig: number|null,
- *   config: object}>}
+ *   doubleBuffer: boolean, depthSize: number, samples: number|null,
+ *   fbconfig: number|null, config: object}>} `samples` is the colour
+ *   samples per pixel the chosen config has — 0 for no multisampling, and
+ *   `null` only in the pinned-`visual` case, where no fbconfig was looked
+ *   at to know.
  */
 export async function chooseGLXConfig(app, spec = {}) {
   const GLX = app.display.GLX;
@@ -255,6 +266,9 @@ export async function chooseGLXConfig(app, spec = {}) {
       class: info.visual.class,
       doubleBuffer: !!toNumber(want.DOUBLEBUFFER),
       depthSize: toNumber(want.DEPTH_SIZE) || 0,
+      // the caller pinned the visual, so nothing was chosen and no fbconfig
+      // was read: unknown, which is not the same claim as "none"
+      samples: null,
       screen: screenNum,
       fbconfig: null,
       config: {}
@@ -272,6 +286,7 @@ export async function chooseGLXConfig(app, spec = {}) {
       class: info.visual.class,
       doubleBuffer: !!cfg.DOUBLEBUFFER,
       depthSize: cfg.DEPTH_SIZE || 0,
+      samples: cfg.SAMPLES || 0,
       screen: screenNum,
       fbconfig: cfg.FBCONFIG_ID,
       config: cfg
@@ -292,6 +307,7 @@ export async function chooseGLXConfig(app, spec = {}) {
       class: info.visual.class,
       doubleBuffer: !!cfg.doubleBufferMode,
       depthSize: cfg.depthBits || 0,
+      samples: cfg.SAMPLES || 0,
       screen: screenNum,
       fbconfig: null,
       config: cfg

package/lib/index.js

@@ -51,6 +51,7 @@ import { DEFAULT_MASK_POLICY } from './maskcluster.js';
 import {
   DEFAULT_SHADOW_POLICY,
   blurCoverage,
+  blurScale,
   gaussianKernel1d,
   shadowReach,
   shadowSigma
@@ -286,9 +287,12 @@ export {
   // caller drawing shapes ntk's shadow properties never see. `blurCoverage`
   // *bakes* the two separable passes into a surface's pixels — unlike
   // `picture().setBlurFilter()`, whose kernel the server re-runs on every
-  // composite, which a cached shadow pays for once per frame
+  // composite, which a cached shadow pays for once per frame — and runs a
+  // wide one at reduced scale, which `blurScale` names for a caller that
+  // would rather draw its shape small in the first place (issue #338)
   DEFAULT_SHADOW_POLICY,
   blurCoverage,
+  blurScale,
   gaussianKernel1d,
   shadowReach,
   shadowSigma,

package/lib/renderingcontext_cgl.js

@@ -43,7 +43,15 @@
 
 import { connectionGone } from './cleanup.js';
 import Drawable from './drawable.js';
-import { GLError, backendFor, glError, loadDriAddon } from './gl.js';
+import {
+  DIRECT_SAMPLES,
+  GLError,
+  backendFor,
+  glError,
+  loadDriAddon,
+  requestedSamples,
+  warnDirectSamples
+} from './gl.js';
 
 /** pacing fallback where the display's rate is not known (see App#frameInterval) */
 const FALLBACK_FRAME_INTERVAL = 1000 / 60;
@@ -115,6 +123,17 @@ does not make it retroactive. Either:
       );
     }
     this.depth = depth;
+
+    /**
+     * Colour samples per pixel — 0 here, as on every direct flavor
+     * (`DIRECT_SAMPLES`). A config asking for more is a request this
+     * pipeline cannot pass on, so it is answered rather than dropped: the
+     * warning fires once per connection, and draw code branches on this.
+     */
+    this.samples = DIRECT_SAMPLES;
+    const wantSamples = Math.max(requestedSamples(config), Number(config.samples) || 0);
+    if (wantSamples > DIRECT_SAMPLES) warnDirectSamples(app, 'appledri', wantSamples);
+
     this._screen = config.screen ?? 0;
     this._clientId = caps.appleClientId ?? dri.apple.clientId();
 

package/lib/renderingcontext_gles.js

@@ -17,7 +17,15 @@
 // is proven.
 
 import Drawable from './drawable.js';
-import { GLError, backendFor, glError, loadDriAddon } from './gl.js';
+import {
+  DIRECT_SAMPLES,
+  GLError,
+  backendFor,
+  glError,
+  loadDriAddon,
+  requestedSamples,
+  warnDirectSamples
+} from './gl.js';
 import { GLSwapchain } from './glswapchain.js';
 
 /**
@@ -98,6 +106,16 @@ does not make it retroactive. Either:
     }
     this.depth = depth;
 
+    /**
+     * Colour samples per pixel — 0 here, as on every direct flavor
+     * (`DIRECT_SAMPLES`). A config asking for more is a request this
+     * pipeline cannot pass on, so it is answered rather than dropped: the
+     * warning fires once per connection, and draw code branches on this.
+     */
+    this.samples = DIRECT_SAMPLES;
+    const wantSamples = Math.max(requestedSamples(config), Number(config.samples) || 0);
+    if (wantSamples > DIRECT_SAMPLES) warnDirectSamples(app, caps.flavor, wantSamples);
+
     const policy = app.glPolicy;
     this.gpu = sharedGpu(app, dri, {
       format: depth === 32 ? dri.FORMAT.ARGB8888 : dri.FORMAT.XRGB8888,

package/lib/renderingcontext_opengl.js

@@ -30,6 +30,14 @@ class RenderingContextOpenGL {
     this.contextId = 0;
     /** the config chosen (or passed in), see app.chooseGLXConfig */
     this.config = null;
+    /**
+     * Colour samples per pixel the config in use has: 0 until the config is
+     * resolved, and 0 afterwards unless the spec asked for multisampling and
+     * the server had an fbconfig with it. The direct contexts carry the same
+     * field, so draw code can decide whether to antialias itself without
+     * knowing which backend it is on.
+     */
+    this.samples = 0;
     this.visual = 0;
     this.error = null;
 
@@ -75,6 +83,9 @@ class RenderingContextOpenGL {
     this.ready = (async () => {
       const cfg = await this._resolveConfig(config);
       this.config = cfg;
+      // a config passed in by hand may be the fbconfig itself rather than a
+      // chooseGLXConfig result, so read either shape
+      this.samples = cfg.samples ?? cfg.config?.SAMPLES ?? cfg.SAMPLES ?? 0;
       this.visual = cfg.visual;
       if (window.visual && window.visual !== cfg.visual) {
         console.warn(

package/lib/shadow.js

@@ -33,17 +33,31 @@
 // cached copy composites as a plain mask rather than re-running a kernel on
 // every frame.
 //
+// ## Why a wide one runs small
+//
+// Two passes still cost `2 * taps * w * h`, and both grow with sigma: the
+// ten shadows on react-x11's configurator come to 118M multiply-accumulates,
+// which is 596ms of a first paint on software RENDER, and 73% of it is two
+// wide ones (issue #338). A gaussian carries no detail finer than about σ/2
+// px, so that work is spent resolving what the result cannot hold — past
+// σ 8 the coverage is shrunk by 2 or 4 first, blurred at `sigma / scale`,
+// and resolved back, which is `scale` off the kernel and `scale²` off the
+// area for a difference of three levels of 8-bit alpha at worst.
+// `blurScale` picks it, `scaleSigma` / `maxScale` bound it, and the surface
+// that comes back is the size it always was, still with no filter on it.
+//
 // ## What of this is public
 //
-// The bake and the maths around it — `blurCoverage`, `shadowSigma`,
-// `shadowReach`, `gaussianKernel1d` and `DEFAULT_SHADOW_POLICY` — are
-// re-exported from `lib/index.js` (issue #335). A toolkit that draws its own
-// shapes (react-x11 paints a `<box>`'s `boxShadow` itself, because the
-// rounded rect is a path it already has and the result goes through its own
-// paint cache) needs exactly this and nothing else: the alternative on the
-// public surface, `picture().setBlurFilter()`, sets a k×k filter that the
-// server re-runs on *every* composite, which is invisible until someone
-// profiles a real display. The surfaces and the cache below stay private —
+// The bake and the maths around it — `blurCoverage`, `blurScale`,
+// `shadowSigma`, `shadowReach`, `gaussianKernel1d` and
+// `DEFAULT_SHADOW_POLICY` — are re-exported from `lib/index.js` (issues
+// #335 and #338). A toolkit that draws its own shapes (react-x11 paints a
+// `<box>`'s `boxShadow` itself, because the rounded rect is a path it
+// already has and the result goes through its own paint cache) needs exactly
+// this and nothing else: the alternative on the public surface,
+// `picture().setBlurFilter()`, sets a k×k filter that the server re-runs on
+// *every* composite, which is invisible until someone profiles a real
+// display. The surfaces and the cache below stay private —
 // they are the 2d context's bookkeeping, not a primitive.
 import { Surface } from './surface.js';
 
@@ -61,11 +75,26 @@ import { Surface } from './surface.js';
  * - `maxPixels` — the largest coverage surface built for one shadow. Beyond
  *   it the shadow is dropped rather than turning one drawing into a
  *   multi-megabyte allocation; the drawing itself is unaffected.
+ * - `scaleSigma` — the σ a reduced-scale blur is not allowed to fall below.
+ *   A gaussian carries no detail finer than about σ/2 px, so a wide one does
+ *   not need full resolution to resolve it: past twice this, coverage is
+ *   shrunk by the largest power of two that keeps σ/scale at or above it,
+ *   blurred there, and resolved back — `scale` off the kernel and `scale²`
+ *   off the area, which is where a first paint's time goes (issue #338).
+ *   What the shrink costs is set by that reduced σ and not by the ratio: 4
+ *   holds the difference from an exact blur inside three levels of 8-bit
+ *   alpha, where 3 is worth four levels and 2 is worth seven.
+ * - `maxScale` — how far the shrink may go whatever the floor allows, so a
+ *   `maxSigma`-wide blur cannot resample its way down to a thumbnail.
+ *   `maxScale: 1` blurs everything at full resolution, which is what 8.6
+ *   did, and is the setting for a caller that needs the exact kernel.
  */
 export const DEFAULT_SHADOW_POLICY = {
   cacheBytes: 4 << 20,
   maxSigma: 32,
-  maxPixels: 8 << 20
+  maxPixels: 8 << 20,
+  scaleSigma: 4,
+  maxScale: 4
 };
 
 /** the policy for one app, merged over the defaults */
@@ -123,6 +152,130 @@ export function gaussianKernel1d(sigma, reach = shadowReach(sigma)) {
   return values;
 }
 
+/**
+ * The scale a blur of this sigma is run at: 1, 2 or 4 by default, meaning
+ * "shrink the coverage by this much, blur at `sigma / scale`, resolve back".
+ *
+ * A gaussian is a low-pass filter — it carries nothing finer than about σ/2
+ * px — so resolving a wide one at full resolution spends most of its time on
+ * detail the result cannot hold. Shrinking first takes `scale` off the
+ * kernel and `scale²` off the area it runs over: at σ 21 over 552×396, k = 4
+ * turns 55.5M multiply-accumulates into 0.9M, which on a software-RENDER
+ * server (XQuartz) is most of a first paint (issue #338).
+ *
+ * The scale is a power of two so that each shrink is an exact 2×2 average,
+ * and it is capped both by `maxScale` and by the σ floor `scaleSigma`, which
+ * is what keeps the reduced blur wide enough to still be a gaussian — the
+ * difference from an exact blur is set by that reduced σ, and stays inside
+ * three levels of 8-bit alpha at the 4 the policy defaults to. σ under
+ * `2 * scaleSigma` gets 1: below that the two resampling composites cost
+ * more than the kernel they save.
+ *
+ * Exported for a caller that draws its own shapes and can therefore skip the
+ * shrink entirely: draw the shape into a surface `1 / scale` the size (its
+ * padding scaled with it), blur at `sigma / scale`, and composite through a
+ * `1 / scale` picture transform. See docs/surface.md#baking-a-blur.
+ */
+export function blurScale(sigma, policy = DEFAULT_SHADOW_POLICY) {
+  const floor = policy.scaleSigma ?? DEFAULT_SHADOW_POLICY.scaleSigma;
+  const max = policy.maxScale ?? DEFAULT_SHADOW_POLICY.maxScale;
+  if (!(sigma > 0) || !(floor > 0) || !(max > 1)) return 1;
+  let scale = 1;
+  while (scale * 2 <= max && sigma / (scale * 2) >= floor) scale *= 2;
+  return scale;
+}
+
+/**
+ * The smallest a shrunk coverage surface is allowed to get on either side.
+ *
+ * Nothing a shadow builds comes near it — a blur wide enough to be scaled at
+ * all pads by 24px a side — but `blurCoverage` takes any a8 surface, and a
+ * hand-built sliver shrunk to a couple of pixels would come back as a smear
+ * rather than a blur.
+ */
+const MIN_SCALED_SIDE = 16;
+
+/** the scale `blurCoverage` will actually use: the policy's (or the
+ * caller's), snapped down to a power of two and to what the surface can be
+ * shrunk to without losing its shape */
+function resolveScale(shape, sigma, requested) {
+  const wanted =
+    requested === undefined ? blurScale(sigma, shadowPolicyOf(shape.app)) : requested;
+  let scale = 2 ** Math.floor(Math.log2(wanted));
+  const side = Math.min(shape.width, shape.height);
+  while (scale > 1 && side / scale < MIN_SCALED_SIDE) scale /= 2;
+  return scale;
+}
+
+/**
+ * Shrink coverage by exactly 2, server-side, destroying the input.
+ *
+ * The transform maps a destination pixel centre to `2 * (i + 0.5)` in the
+ * source, which lands the bilinear sample exactly between two texels in each
+ * axis: the 2×2 box average, with no weight of the original left out. Which
+ * is why the scale is a power of two — one bilinear tap of a 4× shrink would
+ * sample every fourth texel and simply not see the pixels in between.
+ */
+function halveCoverage(surface, R) {
+  const width = Math.max(1, Math.ceil(surface.width / 2));
+  const height = Math.max(1, Math.ceil(surface.height / 2));
+  const small = new Surface(surface.app, { width, height, format: 'a8' });
+  const picture = surface.picture();
+  picture.setFilter('bilinear');
+  R.SetPictureTransform(picture.id, [2, 0, 0, 0, 2, 0, 0, 0, 1]);
+  R.Composite(R.PictOp.Src, picture.id, 0, small.picture().id, 0, 0, 0, 0, 0, 0, width, height);
+  surface.destroy();
+  return small;
+}
+
+/**
+ * Resolve shrunk coverage back to `width` × `height`, destroying the input.
+ *
+ * Bilinear again, and this is where the error of the whole scheme lives: the
+ * blurred coverage is reconstructed linearly between samples `scale` px
+ * apart, and what a straight line misses between two samples of a gaussian
+ * goes as the curvature there — `1 / σ'²`, in the reduced surface's own
+ * sigma. So the bound is a property of the σ the blur ran at, which is what
+ * `scaleSigma` pins: three alpha levels at σ' 4, seven at σ' 2 (measured
+ * against Xorg; a server whose bilinear rounds less is a level better).
+ *
+ * It happens once, into an ordinary surface: what comes back carries no
+ * filter and no transform, so every composite of it afterwards is a plain
+ * mask, exactly as it was before the shrink existed.
+ */
+function expandCoverage(small, width, height, scale, R) {
+  const out = new Surface(small.app, { width, height, format: 'a8' });
+  const picture = small.picture();
+  picture.setFilter('bilinear');
+  R.SetPictureTransform(picture.id, [1 / scale, 0, 0, 0, 1 / scale, 0, 0, 0, 1]);
+  R.Composite(R.PictOp.Src, picture.id, 0, out.picture().id, 0, 0, 0, 0, 0, 0, width, height);
+  small.destroy();
+  return out;
+}
+
+/** the two separable passes themselves, at whatever scale they are run —
+ * `shape` in, blurred copy out, input destroyed */
+function bakeBlur(shape, sigma, R) {
+  const { app, width, height } = shape;
+  const kernel = gaussianKernel1d(sigma);
+  const scratch = new Surface(app, { width, height, format: 'a8' });
+  const out = new Surface(app, { width, height, format: 'a8' });
+
+  const pass = (src, dst, params) => {
+    src.picture().setFilter('convolution', params);
+    // Src, not Over: each pass replaces the destination, which was cleared
+    // to transparent on creation. Over would accumulate the sharp copy's
+    // coverage under the blurred one and give the shadow a hard core.
+    R.Composite(R.PictOp.Src, src.picture().id, 0, dst.picture().id, 0, 0, 0, 0, 0, 0, width, height);
+  };
+  pass(shape, scratch, [kernel.length, 1, ...kernel]);
+  pass(scratch, out, [1, kernel.length, ...kernel]);
+
+  shape.destroy();
+  scratch.destroy();
+  return out;
+}
+
 /**
  * Blur an a8 coverage surface, returning a new one holding the result.
  *
@@ -138,8 +291,16 @@ export function gaussianKernel1d(sigma, reach = shadowReach(sigma)) {
  * bakes instead. `shape` must be a coverage surface with the blur's reach as
  * padding on all four sides, or the result ends in a straight line where the
  * kernel ran out of pixels; see docs/surface.md.
+ *
+ * A wide blur does not run at full resolution. Past σ 8 the coverage is
+ * shrunk by a power of two, blurred at `sigma / scale` and resolved back —
+ * `scale³` off the work, for a difference of at most three levels of 8-bit
+ * alpha (issue #338). `scale` overrides that: `{ scale: 1 }` is the exact
+ * path 8.6 took, and a larger one is snapped down to a power of two. Which
+ * scale the policy picks is `blurScale(sigma)`; the size of what comes back
+ * never changes with it.
  */
-export function blurCoverage(shape, sigma) {
+export function blurCoverage(shape, sigma, { scale } = {}) {
   if (!(sigma > 0) || !Number.isFinite(sigma)) {
     throw new Error(
       `blurCoverage: sigma must be a finite number above 0, got ${sigma}. ` +
@@ -155,26 +316,23 @@ export function blurCoverage(shape, sigma) {
         'the blur runs on alpha, so an argb32 surface would lose its colour.'
     );
   }
-  const app = shape.app;
-  const R = app.display.Render;
+  if (scale !== undefined && (!Number.isFinite(scale) || scale < 1)) {
+    throw new Error(
+      `blurCoverage: scale must be a finite number of 1 or more, got ${scale}. ` +
+        'It is how much the coverage is shrunk before the blur runs on it, ' +
+        'so 1 is "blur at full resolution"; anything else is snapped down to ' +
+        'a power of two. Leave it out to take the scale from the app\'s ' +
+        'shadowPolicy (scaleSigma / maxScale).'
+    );
+  }
+  const R = shape.app.display.Render;
   const { width, height } = shape;
-  const kernel = gaussianKernel1d(sigma);
-  const scratch = new Surface(app, { width, height, format: 'a8' });
-  const out = new Surface(app, { width, height, format: 'a8' });
-
-  const pass = (src, dst, params) => {
-    src.picture().setFilter('convolution', params);
-    // Src, not Over: each pass replaces the destination, which was cleared
-    // to transparent on creation. Over would accumulate the sharp copy's
-    // coverage under the blurred one and give the shadow a hard core.
-    R.Composite(R.PictOp.Src, src.picture().id, 0, dst.picture().id, 0, 0, 0, 0, 0, 0, width, height);
-  };
-  pass(shape, scratch, [kernel.length, 1, ...kernel]);
-  pass(scratch, out, [1, kernel.length, ...kernel]);
+  const k = resolveScale(shape, sigma, scale);
+  if (k === 1) return bakeBlur(shape, sigma, R);
 
-  shape.destroy();
-  scratch.destroy();
-  return out;
+  let small = shape;
+  for (let step = k; step > 1; step /= 2) small = halveCoverage(small, R);
+  return expandCoverage(bakeBlur(small, sigma / k, R), width, height, k, R);
 }
 
 /**

package/lib/window.js

@@ -3719,6 +3719,9 @@ export default class Window extends Drawable {
    * connection selected and nothing else adds to it behind the caller's
    * back. It resolves rather than returning undefined because the promise is
    * the whole interface: an awaited no-op still has to mean "you have it".
+   *
+   * `deselectInput(mask)` is the inverse, and the only thing that lowers the
+   * mask again — `off()` drops the listener and leaves the selection.
    */
   selectInput(mask) {
     const added = mask & ~this.eventMask;
@@ -3736,6 +3739,92 @@ export default class Window extends Drawable {
     });
   }
 
+  /**
+   * The bits of the event mask something in this process still needs: the
+   * union over every event name with a live listener, plus what ntk's own
+   * machinery requires. `deselectInput` refuses exactly these, so
+   * `mask & wnd.heldEventMask` asks "would that be refused?" without making
+   * the request.
+   *
+   * Not a subset of `eventMask`. A listener implies a bit whether or not
+   * this connection ever selected it — an adopted window selects nothing
+   * (issue #322), and ntk's own map/unmap/destroy handlers listen without
+   * asking for anything.
+   */
+  get heldEventMask() {
+    let held = 0;
+    for (const name in xevents.mask) {
+      const bit = xevents.mask[name];
+      // 0 marks an event that arrives regardless of any selection
+      if (bit && this.listenerCount(name) > 0) held |= bit;
+    }
+    // the redraw cycle is driven by intercepting Expose, whether or not
+    // anyone listens for it: a double-buffered window that stops selecting
+    // Exposure stops repainting (see _enableBackingStore)
+    if (this._backing) held |= x11.eventMask.Exposure;
+    return held;
+  }
+
+  /**
+   * Stop selecting `mask` — the inverse of `selectInput`, and the only way a
+   * window's event mask ever goes down (issue #318).
+   *
+   * `on(name, fn)` raises the mask as a side effect and `off()` does not
+   * lower it again, so a window that stops needing an event goes on being
+   * sent it until it is destroyed. For most masks that is invisible; for
+   * PointerMotion it is 32 bytes per motion event — 2 KB/s at 60 Hz, and
+   * 8 KB/s where the motion is XI2's — for as long as the pointer is over
+   * the window. A viewer that hides its chrome, a toolbar that unmounts, a
+   * window that goes to a background tab: they know when they stop needing
+   * hover, and this is how they say so.
+   *
+   * Bits a live listener still needs are kept rather than cleared, because
+   * dropping PointerMotion out from under an `on('mousemove')` is the one
+   * bug this API can have. Several names share one bit — `map`, `unmap`,
+   * `resize`, `reparent`, `gravity`, `circulate` and `destroy` are all
+   * StructureNotify — so losing the last `map` listener does not make the
+   * bit free. It resolves with the bits it kept for that reason, `0` when it
+   * cleared everything it was asked to:
+   *
+   *   const kept = await wnd.deselectInput(x11.eventMask.PointerMotion);
+   *   if (kept) ... // something in this process is still listening
+   *
+   * Two selections it will therefore not clear: StructureNotify, held by
+   * ntk's own map/unmap/destroy bookkeeping on every window, and Exposure on
+   * a double-buffered one. XI2 is selected separately and keeps its own
+   * inverse — `selectXI2([])` (see lib/xi2.js).
+   */
+  deselectInput(mask) {
+    const clear = mask & this.eventMask & ~this.heldEventMask;
+    const kept = mask & this.eventMask & ~clear;
+    // asking to drop what is not selected, or only what is spoken for, is a
+    // request that would change nothing
+    if (clear === 0) return Promise.resolve(kept);
+    this.eventMask &= ~clear;
+    // no motion means no hints, so no frame owes the server the QueryPointer
+    // that re-arms one. A poll already in flight is left alone, as
+    // setMouseHintOnly leaves it: its answer is a real position.
+    if (clear & (x11.eventMask.PointerMotion | x11.eventMask.PointerMotionHint)) {
+      this._hintRearm = false;
+    }
+    // A window the server has already taken, or a connection on its way out:
+    // there is no selection left to lower, and node-x11 throws at a request
+    // from then on (issue #321). The tracked mask is lowered all the same —
+    // it says what this connection holds, and it holds nothing.
+    if (this._destroyed || connectionGone(this.X)) return Promise.resolve(kept);
+    return new Promise((resolve, reject) => {
+      this.X.ChangeWindowAttributes(this.id, { eventMask: this.eventMask }, (err) => {
+        if (!err) return resolve(kept);
+        // the request failed as a whole, so the server kept the mask it had:
+        // take the bits back rather than leave `eventMask` denying a
+        // selection this connection still holds — the next on() reads it to
+        // decide whether a write can be skipped
+        this.eventMask |= clear;
+        reject(err);
+      });
+    });
+  }
+
   /**
    * Add this window to our save-set (X ChangeSaveSet). A window manager
    * reparents clients into frames it owns; without the save-set, the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ntk",
-  "version": "8.6.0",
+  "version": "8.8.0",
   "description": "Desktop UI toolkit for X11 with canvas-like 2d and OpenGL rendering",
   "author": "Andrey Sidorov <sidorares@yandex.ru>",
   "license": "MIT",