Plug-ins: heavy filters, allowed at install and run in the background (G17)

A filter plug-in gets 50 M instructions and a minute for each run.
Filters that order a plotter's paths, pack shapes or run a simulation
need minutes, and the app shouldn't freeze while they compute.

A filter's manifest may now ask for "budget": "heavy" (Budget): each run
gets HEAVY_FUEL (1 G instructions) and HEAVY_WALL_TIME_MS (300 s). Only a
filter may ask. plugin.install refuses such a filter without allowHeavy:
true, and plugin.inspect returns the entry a module would have without
installing it. Install Plug-in… and File › Open ask the user and install
on OK; the plug-in store keeps the answer, and folder loads skip heavy
filters with a note, since they ask nobody.

The app runs a heavy filter on a thread of its own (plugin_runs), not in
Background Save's queue, with the status bar and a progress window
(Cancel, Continue in Background) that it shares with Background Export
(export_progress::window). FilterRun splits plugin.run: prepared on the
session, run on any thread, its output handed in, and the next
plugin.run with the same params applies that output instead of running
the plug-in again, so the edit stays one guarded, journaled command. A
result whose document or plug-in changed meanwhile is dropped, and the
status bar says to run it again. A cancelled plug-in run is now
EngineError::Cancelled.

What a filter keeps with the document (#3720) goes with the run: it is
given _context.documentData when the run is prepared, and the
documentData of its output is applied with its objects, in the same undo
step, when the run is handed in (FilterRun::finish).

Tests: plugins/tests/abi.rs (100 M loop steps out of a light budget,
within a heavy one; folders skip heavy filters), manifest.rs, engine
tests_plugins.rs (consent, inspect, the store, hand-in, a handed-in
run's document data, cancel) and
ui-egui tests_plugin_runs.rs (installing asks, no Preview, a background
run as one undo step, a stale result kept out, the progress window).
CRAFT_UI_HEAVY_FILTER_WASM=<folder> writes a test filter to try in the
app. Its strings and messages have rows in each complete catalog
(COMPLETE_MESSAGES).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HhvnnnD5fTFupK8WWq35un

crates/plugins/src/runtime.rs

@@ -14,6 +14,20 @@ pub const ABI_VERSION: i32 = 1;
 /// Fuel handed out per slice; between slices the host checks the deadline.
 const FUEL_SLICE: u64 = 20_000_000;
 
+/// Instructions a heavy filter's run may use besides [`Limits::fuel_per_byte`] for each byte of
+/// input ([`crate::Budget::Heavy`]): 20 times a light one's. Its output's size can't add to it:
+/// the host learns that only once the run has ended.
+pub const HEAVY_FUEL: u64 = 1_000_000_000;
+
+/// Wall-clock budget of a heavy filter's run, in milliseconds (native builds).
+pub const HEAVY_WALL_TIME_MS: u64 = 300_000;
+
+/// A heavy run's budget as people read it: (minutes it may take, times the instructions a light
+/// run gets).
+pub fn heavy_terms() -> (u64, u64) {
+    (HEAVY_WALL_TIME_MS / 60_000, HEAVY_FUEL / Limits::default().fuel_base.max(1))
+}
+
 /// Resource limits for running plug-ins.
 #[derive(Clone, Debug, PartialEq)]
 pub struct Limits {
@@ -156,6 +170,12 @@ impl Plugin {
             e => e,
         })?;
         p.manifest = Manifest::parse(&text)?;
+        // A heavy filter's runs get the larger budget, which the host lets the user allow or
+        // refuse before installing it.
+        if p.manifest.budget == crate::Budget::Heavy {
+            p.limits.fuel_base = p.limits.fuel_base.max(HEAVY_FUEL);
+            p.limits.wall_time_ms = p.limits.wall_time_ms.max(HEAVY_WALL_TIME_MS);
+        }
         // The other exports must exist with the right types.
         live.func::<i32, i32>("vc_alloc")?;
         live.func::<RunArgs, i64>("vc_run")?;