[Marc-André Moreau (mamoreau-devolutions)]

Propagate validated ResetGraphics extents into the session framebuffer and deliver exact packed desktop damage to ActiveX without rebuilding full image snapshots.

Coalesce only fully covered regions, preserve sparse updates with a 64-event and 256 MiB pixel-data budget, and backpressure without evicting accepted frame or static-channel payloads. Update retained GDI and RPC surfaces in place. Reuse framebuffer storage with fallible growth, and retain software cursor shape, position, visibility, and clipping across graphics resets. Keep V8 non-AVC negotiation and full-frame output fallback unchanged. Rejected oversized resets still destroy prior surfaces and are reported as unsupported without allocating a session framebuffer.

[Copilot]

Pull request overview

Adds dirty-region delivery for ActiveX while retaining full-frame fallback.

Changes:

• Propagates validated EGFX reset extents into session framebuffers.
• Adds packed desktop updates and retained partial-frame presentation.
• Introduces bounded damage queuing and related tests/documentation.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
crates/ironrdp-testsuite-extra/tests/client/output_channel.rs	Tests desktop-update validation.
crates/ironrdp-session/src/active_stage.rs	Resizes framebuffers after EGFX resets.
crates/ironrdp-egfx/src/compositor.rs	Validates output dimensions and memory limits.
crates/ironrdp-egfx/src/client.rs	Reports validated reset extents.
crates/ironrdp-client/src/rdp.rs	Adds packed dirty-region delivery.
crates/ironrdp-activex/src/rpc.rs	Applies partial updates to retained RPC frames.
crates/ironrdp-activex/src/control.rs	Queues, merges, presents, and invalidates dirty regions.
crates/ironrdp-activex/README.md	Documents the dirty-region pipeline.

[Marc-André Moreau (mamoreau-devolutions)]

The size/XXL warning is acknowledged. The diff has two conceptual review boundaries—EGFX reset/session propagation and ActiveX packed-damage presentation—but they form the end-to-end graphics path validated by this PR. This recovery was explicitly constrained to the existing PR branch and to preserving valid pushed work, so I did not create stacked branches, discard either boundary, or rewrite the existing commits. Both boundaries received separate protocol, implementation, documentation, and skeptical review passes; the retained findings are fixed at 82d445e88.

Note

Human-tuned, LLM-assisted content.

[Copilot]

🟡 Changes recommended

Direct frame dispatch can violate lifecycle ordering, and differing framebuffer extents still evict accepted updates.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 11/11 changed files
• Comments generated: 2
• Review effort level: Balanced

[github-actions]

The dirty-region pipeline is sound: packed updates are validated, covered-union coalescing preserves ordering, backpressure replaces payload eviction, and pointer-preserving reset is well tested. Two availability questions remain open: queue producers now block the RDP worker indefinitely on a UI-drained queue, and an oversized but protocol-valid ResetGraphics becomes a hard PDU error consumed only by capture-replay. The RPC retained frame can go stale after an extent change, and legacy oversized-frame discards need a reachability decision. One independent question covers damage regions cleared per ActiveStage call while packed delivery consumes them once per iteration. Remaining candidates are valid deduplication cleanups; the PR-scope concern is rejected as non-actionable and already answered.

1. [skeptical] Producers block the RDP worker thread indefinitely when the STA stops draining the event queue — medium 🟠 ❓ — crates/ironrdp-activex/src/control.rs
   queue_worker_event now parks Image, StaticChannelData, and AutoReconnecting producers on space_available with no timeout; the only exits are a UI drain, queue close, or a failed PostMessageW. Producers execute on the RDP worker's current-thread runtime, so a stalled or non-pumping STA wedges transport reads, input encoding, keepalives, and reconnect decisions where payloads were previously dropped or failed fast. The diff does not show that every teardown path reaches WorkerEventQueue::close, so a teardown deadlock cannot be ruled out.
2. [skeptical] Oversized but protocol-valid ResetGraphics now returns a PDU error that plausibly terminates live sessions — medium 🟠 ❓ — crates/ironrdp-egfx/src/client.rs
   handle_reset_graphics returns Err once materializable_output_size rejects the extent (a dimension above 32766 or output above the 256 MiB budget), after clearing surfaces and pending deltas. The new on_reset_graphics_rejected callback is implemented only by capture-replay; no ironrdp-client or ActiveX handler consumes it, so live clients observe a session-failing PDU error where oversized output previously degraded to dropped deltas. Confirm the intended live-client outcome and that no supported deployment negotiates such extents.
3. [skeptical] Discarded partial update leaves a stale previous-extent frame under new desktop-size properties — low 🟡 — crates/ironrdp-activex/src/rpc.rs
   retain_frame_region_with_limit inserts desktopwidth/desktopheight before validation, but the partial-update-without-matching-base path returns without touching live.frame, unlike the oversized path which clears it. After an EGFX reset changes the extent, a partial update arriving before the guaranteed full frame leaves a screenshot-visible frame of the old dimensions advertised with the new desktop size. Clearing live.frame on this discard path keeps the snapshot coherent.
4. [skeptical] Legacy full-frame updates above the 256 MiB queue budget are discarded with only a warning — low 🟡 ❓ — crates/ironrdp-activex/src/control.rs
   The Image arm drops any single update with more than MAX_PENDING_FRAME_PIXELS (~67M) pixels, logging only a warn. EGFX outputs are pre-validated to the same 256 MiB budget, and conformant legacy desktops cap at 8192x8192, which exactly equals the budget and passes the strictly-greater check, so the path may be unreachable defensive code. If larger extents are negotiable through the control, every frame is silently discarded and the display goes stale or black with no session-level signal; confirm reachability and prefer failing or signaling over a per-frame silent discard.