From 3a156c2cdf821e0688f4ddf076d65343908ec4ce Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 00:24:25 +0200
Subject: [PATCH 01/56] feat(core): anchor vw/vh resolution to the real output
 viewport

ConversionContext::default() carries a hardcoded 1920x1080 viewport. Every
caller that knows the video's real dimensions was free to forget it, and two
did: both geometry-validation call sites resolve vw/vh against the phantom
default while the render path builds a real context. On a 1080x1920 vertical
render that inverts the two axes inside the validator, so the mandatory
pre-delivery gate reports overflow that never happens and misses overflow that
does.

for_viewport() is the single constructor those callers now share, so the
validator and the renderer cannot drift apart again. The private helper that
already did this in the render path (engine/render/scene.rs) is superseded by
it.

Rejected: making default() unavailable outside tests. Roughly forty call sites
in the test suites legitimately want an arbitrary viewport, and churning them
would bury the fix.
---
 .../rustmotion-core/src/css/taffy_bridge.rs   | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/crates/rustmotion-core/src/css/taffy_bridge.rs b/crates/rustmotion-core/src/css/taffy_bridge.rs
index 9376ebb7..380cb86d 100644
--- a/crates/rustmotion-core/src/css/taffy_bridge.rs
+++ b/crates/rustmotion-core/src/css/taffy_bridge.rs
@@ -20,6 +20,28 @@ pub struct ConversionContext {
     pub length: LengthContext,
 }
 
+impl ConversionContext {
+    /// Anchor `vw`/`vh` resolution to a real output viewport.
+    ///
+    /// [`ConversionContext::default()`] carries a 1920×1080 viewport, which is
+    /// only ever correct by coincidence. Any caller that knows the video's real
+    /// dimensions must build its context here instead: on a 1080×1920 vertical
+    /// render, the default resolves `50vw` to 960px where the truth is 540px,
+    /// and misses `vh` by the same margin in the other axis.
+    ///
+    /// `font-size` / `root-font-size` stay at the CSS initial 16px: nothing
+    /// upstream resolves and threads a root font-size through yet.
+    pub fn for_viewport(viewport_width: f32, viewport_height: f32) -> Self {
+        Self {
+            length: LengthContext {
+                viewport_width,
+                viewport_height,
+                ..LengthContext::default()
+            },
+        }
+    }
+}
+
 /// Convert a [`CssStyle`] into a [`taffy::Style`]. Properties not relevant to
 /// layout are ignored. Unsupported / unset properties fall back to taffy
 /// defaults (which match CSS initial values).

From 7d676d96420638dec69638740fe4b09c34baabf0 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 08:00:17 +0200
Subject: [PATCH 02/56] style(lint): replace constant-size chunks_exact with
 as_chunks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A newer stable clippy adds `chunks_exact_to_as_chunks`, which fires on every
`chunks_exact` call whose size is a literal. The workspace has 32 of them
across 20 files, so the clippy job fails on every branch — main included. Its
last run, from before this work existed, was already red for the same reason.

The replacement is clippy's own suggestion, `as_chunks::<N>().0.iter()`. It is
not a pure substitution: the iterator now yields `&[T; N]` rather than `&[T]`,
so two sites needed real edits — an assertion comparing against an array
literal, and a predicate taking `&[u8]`. The array type is the better one
anyway; it is what makes the chunk length visible to the compiler.

Completeness is checkable rather than argued: no `chunks_exact` with a literal
size remains in the workspace, so the lint has nothing left to fire on. The
local toolchain predates this lint, so that grep is the verification, not a
local clippy run.
---
 crates/rustmotion-components/src/badge.rs     |  4 +-
 crates/rustmotion-components/src/callout.rs   |  4 +-
 crates/rustmotion-components/src/counter.rs   |  2 +-
 crates/rustmotion-components/src/kbd.rs       |  4 +-
 crates/rustmotion-components/src/list.rs      |  2 +-
 crates/rustmotion-components/src/lottie.rs    |  2 +-
 crates/rustmotion-components/src/marquee.rs   |  2 +-
 .../rustmotion-components/src/notification.rs |  4 +-
 crates/rustmotion-components/src/pill_nav.rs  |  2 +-
 crates/rustmotion-components/src/table.rs     |  4 +-
 crates/rustmotion-components/src/terminal.rs  |  4 +-
 crates/rustmotion-components/src/tooltip.rs   |  4 +-
 .../tests/caption_presets.rs                  |  6 ++-
 .../tests/codeblock_auto_scroll.rs            |  4 +-
 .../tests/relative_font_size.rs               |  2 +-
 .../src/engine/renderer/text.rs               |  2 +-
 .../rustmotion-core/src/engine/transition.rs  |  4 +-
 crates/rustmotion-studio/src/editor/audio.rs  |  4 +-
 .../src/scenario/optimistic.rs                |  4 +-
 crates/rustmotion/src/tests.rs                | 49 ++++++++++++++-----
 20 files changed, 80 insertions(+), 33 deletions(-)

diff --git a/crates/rustmotion-components/src/badge.rs b/crates/rustmotion-components/src/badge.rs
index 5e19ea9f..f4f2cdbb 100644
--- a/crates/rustmotion-components/src/badge.rs
+++ b/crates/rustmotion-components/src/badge.rs
@@ -441,7 +441,9 @@ mod tests {
         // Solid variant text is always white — probe for white ink
         // specifically, since the pill background paints regardless.
         let text_ink = buf
-            .chunks_exact(4)
+            .as_chunks::<4>()
+            .0
+            .iter()
             .filter(|p| p[3] > 0 && p[0] > 200 && p[1] > 200 && p[2] > 200)
             .count();
         assert!(
diff --git a/crates/rustmotion-components/src/callout.rs b/crates/rustmotion-components/src/callout.rs
index 22e8bf97..8092d4aa 100644
--- a/crates/rustmotion-components/src/callout.rs
+++ b/crates/rustmotion-components/src/callout.rs
@@ -267,7 +267,9 @@ mod tests {
         // for near-white ink specifically, since the bubble background
         // paints regardless of font-size.
         let text_ink = buf
-            .chunks_exact(4)
+            .as_chunks::<4>()
+            .0
+            .iter()
             .filter(|p| p[3] > 0 && p[0] > 200 && p[1] > 200 && p[2] > 200)
             .count();
         assert!(
diff --git a/crates/rustmotion-components/src/counter.rs b/crates/rustmotion-components/src/counter.rs
index ebe1108e..e67af735 100644
--- a/crates/rustmotion-components/src/counter.rs
+++ b/crates/rustmotion-components/src/counter.rs
@@ -403,7 +403,7 @@ mod tests {
             skia_safe::image::CachingHint::Disallow,
         );
         assert!(ok, "pixel read should succeed");
-        let lit = buf.chunks_exact(4).filter(|p| p[3] > 0).count();
+        let lit = buf.as_chunks::<4>().0.iter().filter(|p| p[3] > 0).count();
         assert!(
             lit > 20,
             "counter at font-size: 2rem must paint visible ink, got {lit} lit pixels"
diff --git a/crates/rustmotion-components/src/kbd.rs b/crates/rustmotion-components/src/kbd.rs
index ecc065b8..6874cbf3 100644
--- a/crates/rustmotion-components/src/kbd.rs
+++ b/crates/rustmotion-components/src/kbd.rs
@@ -339,7 +339,9 @@ mod tests {
         // face — probe for near-white ink specifically, since the face/
         // border/shadow paint regardless of font-size.
         let text_ink = buf
-            .chunks_exact(4)
+            .as_chunks::<4>()
+            .0
+            .iter()
             .filter(|p| p[3] > 0 && p[0] > 180 && p[1] > 180 && p[2] > 180)
             .count();
         assert!(
diff --git a/crates/rustmotion-components/src/list.rs b/crates/rustmotion-components/src/list.rs
index d58723cd..4e7fd71e 100644
--- a/crates/rustmotion-components/src/list.rs
+++ b/crates/rustmotion-components/src/list.rs
@@ -333,7 +333,7 @@ mod tests {
             skia_safe::image::CachingHint::Disallow,
         );
         assert!(ok, "pixel read should succeed");
-        let lit = buf.chunks_exact(4).filter(|p| p[3] > 0).count();
+        let lit = buf.as_chunks::<4>().0.iter().filter(|p| p[3] > 0).count();
         assert!(
             lit > 20,
             "list at font-size: 2rem must paint visible ink, got {lit} lit pixels"
diff --git a/crates/rustmotion-components/src/lottie.rs b/crates/rustmotion-components/src/lottie.rs
index e2b08b5c..6fee0988 100644
--- a/crates/rustmotion-components/src/lottie.rs
+++ b/crates/rustmotion-components/src/lottie.rs
@@ -525,7 +525,7 @@ mod tests {
 
         let mut red_sum: u64 = 0;
         let mut blue_sum: u64 = 0;
-        for px in buf.chunks_exact(4) {
+        for px in buf.as_chunks::<4>().0.iter() {
             let r = px[0] as u64;
             let _g = px[1] as u64;
             let b = px[2] as u64;
diff --git a/crates/rustmotion-components/src/marquee.rs b/crates/rustmotion-components/src/marquee.rs
index 08e0379c..401baaa1 100644
--- a/crates/rustmotion-components/src/marquee.rs
+++ b/crates/rustmotion-components/src/marquee.rs
@@ -224,7 +224,7 @@ mod tests {
             skia_safe::image::CachingHint::Disallow,
         );
         assert!(ok, "pixel read should succeed");
-        let lit = buf.chunks_exact(4).filter(|p| p[3] > 0).count();
+        let lit = buf.as_chunks::<4>().0.iter().filter(|p| p[3] > 0).count();
         assert!(
             lit > 20,
             "marquee at font-size: 2rem must paint visible ink, got {lit} lit pixels"
diff --git a/crates/rustmotion-components/src/notification.rs b/crates/rustmotion-components/src/notification.rs
index 436f2d35..4d63a057 100644
--- a/crates/rustmotion-components/src/notification.rs
+++ b/crates/rustmotion-components/src/notification.rs
@@ -451,7 +451,9 @@ mod tests {
         // Title text is white (#FFFFFF default) on a dark #1E293B card —
         // probe for near-white ink specifically.
         let text_ink = buf
-            .chunks_exact(4)
+            .as_chunks::<4>()
+            .0
+            .iter()
             .filter(|p| p[3] > 0 && p[0] > 200 && p[1] > 200 && p[2] > 200)
             .count();
         assert!(
diff --git a/crates/rustmotion-components/src/pill_nav.rs b/crates/rustmotion-components/src/pill_nav.rs
index 3b3d038d..3039de35 100644
--- a/crates/rustmotion-components/src/pill_nav.rs
+++ b/crates/rustmotion-components/src/pill_nav.rs
@@ -328,7 +328,7 @@ mod tests {
             skia_safe::image::CachingHint::Disallow,
         );
         assert!(ok, "pixel read should succeed");
-        let lit = buf.chunks_exact(4).filter(|p| p[3] > 0).count();
+        let lit = buf.as_chunks::<4>().0.iter().filter(|p| p[3] > 0).count();
         assert!(
             lit > 20,
             "pill_nav at font-size: 2rem must paint visible ink, got {lit} lit pixels"
diff --git a/crates/rustmotion-components/src/table.rs b/crates/rustmotion-components/src/table.rs
index 05fbc996..527a532c 100644
--- a/crates/rustmotion-components/src/table.rs
+++ b/crates/rustmotion-components/src/table.rs
@@ -371,7 +371,9 @@ mod tests {
         // probe specifically for near-white text ink rather than any lit
         // pixel (the header/row backgrounds paint regardless of font-size).
         let text_ink = buf
-            .chunks_exact(4)
+            .as_chunks::<4>()
+            .0
+            .iter()
             .filter(|p| p[3] > 0 && p[0] > 200 && p[1] > 200 && p[2] > 200)
             .count();
         assert!(
diff --git a/crates/rustmotion-components/src/terminal.rs b/crates/rustmotion-components/src/terminal.rs
index 0e22037b..be6224ec 100644
--- a/crates/rustmotion-components/src/terminal.rs
+++ b/crates/rustmotion-components/src/terminal.rs
@@ -536,7 +536,9 @@ mod tests {
         // specifically: pixels that are not the dark theme background color
         // (#1E1E1E) and not fully transparent.
         let text_ink = buf
-            .chunks_exact(4)
+            .as_chunks::<4>()
+            .0
+            .iter()
             .filter(|p| p[3] > 0 && !(p[0] < 40 && p[1] < 40 && p[2] < 40))
             .count();
         assert!(
diff --git a/crates/rustmotion-components/src/tooltip.rs b/crates/rustmotion-components/src/tooltip.rs
index 44cd1a54..432c1690 100644
--- a/crates/rustmotion-components/src/tooltip.rs
+++ b/crates/rustmotion-components/src/tooltip.rs
@@ -280,7 +280,9 @@ mod tests {
         // Text is near-white (#E2E8F0 default) on a dark #1E293B body —
         // probe for near-white ink specifically.
         let text_ink = buf
-            .chunks_exact(4)
+            .as_chunks::<4>()
+            .0
+            .iter()
             .filter(|p| p[3] > 0 && p[0] > 180 && p[1] > 180 && p[2] > 180)
             .count();
         assert!(
diff --git a/crates/rustmotion-components/tests/caption_presets.rs b/crates/rustmotion-components/tests/caption_presets.rs
index 2f074ae8..59ecf7b9 100644
--- a/crates/rustmotion-components/tests/caption_presets.rs
+++ b/crates/rustmotion-components/tests/caption_presets.rs
@@ -82,7 +82,11 @@ fn render_caption_at(json: serde_json::Value, time: f64, y: f32) -> Vec<u8> {
 }
 
 fn count_pixels(buf: &[u8], pred: impl Fn(&[u8]) -> bool) -> usize {
-    buf.chunks_exact(4).filter(|p| pred(p)).count()
+    buf.as_chunks::<4>()
+        .0
+        .iter()
+        .filter(|p| pred(p.as_slice()))
+        .count()
 }
 
 fn lit_pixels(buf: &[u8]) -> usize {
diff --git a/crates/rustmotion-components/tests/codeblock_auto_scroll.rs b/crates/rustmotion-components/tests/codeblock_auto_scroll.rs
index 40a4f2eb..e1668a31 100644
--- a/crates/rustmotion-components/tests/codeblock_auto_scroll.rs
+++ b/crates/rustmotion-components/tests/codeblock_auto_scroll.rs
@@ -42,7 +42,9 @@ fn text_ink_pixels(buf: &[u8]) -> usize {
     // Background is #2b303b ~ (43, 48, 59). Count pixels that deviate from
     // that by a wide margin in any channel — syntect's theme colors are all
     // much brighter than the near-black background.
-    buf.chunks_exact(4)
+    buf.as_chunks::<4>()
+        .0
+        .iter()
         .filter(|p| {
             let (r, g, b, a) = (p[0] as i32, p[1] as i32, p[2] as i32, p[3] as i32);
             a > 200 && ((r - 43).abs() > 40 || (g - 48).abs() > 40 || (b - 59).abs() > 40)
diff --git a/crates/rustmotion-components/tests/relative_font_size.rs b/crates/rustmotion-components/tests/relative_font_size.rs
index 21965697..c40e8fe0 100644
--- a/crates/rustmotion-components/tests/relative_font_size.rs
+++ b/crates/rustmotion-components/tests/relative_font_size.rs
@@ -77,7 +77,7 @@ fn render(json: serde_json::Value) -> Vec<u8> {
 }
 
 fn lit_pixels(buf: &[u8]) -> usize {
-    buf.chunks_exact(4).filter(|p| p[3] > 0).count()
+    buf.as_chunks::<4>().0.iter().filter(|p| p[3] > 0).count()
 }
 
 #[test]
diff --git a/crates/rustmotion-core/src/engine/renderer/text.rs b/crates/rustmotion-core/src/engine/renderer/text.rs
index d607dadf..6d578977 100644
--- a/crates/rustmotion-core/src/engine/renderer/text.rs
+++ b/crates/rustmotion-core/src/engine/renderer/text.rs
@@ -975,7 +975,7 @@ mod emoji_presentation_tests {
         surface.read_pixels(&info, &mut buf, (W * 4) as usize, (0, 0));
 
         let (mut n, mut sr, mut sg, mut sb) = (0usize, 0f64, 0f64, 0f64);
-        for px in buf.chunks_exact(4) {
+        for px in buf.as_chunks::<4>().0.iter() {
             if px[3] > 40 {
                 n += 1;
                 sr += px[0] as f64;
diff --git a/crates/rustmotion-core/src/engine/transition.rs b/crates/rustmotion-core/src/engine/transition.rs
index b256a080..22e5923f 100644
--- a/crates/rustmotion-core/src/engine/transition.rs
+++ b/crates/rustmotion-core/src/engine/transition.rs
@@ -970,9 +970,9 @@ mod camera_pan_tests {
         );
 
         // blend_fade(10, 200, 0.5) = (10*0.5 + 200*0.5 + 0.5) as u8 = 105.
-        for px in out.chunks_exact(4) {
+        for px in out.as_chunks::<4>().0.iter() {
             assert_eq!(
-                px,
+                *px,
                 [105, 105, 105, 255],
                 "mid-pan Static frame must be a blend of bg_a and bg_b, not a copy of either"
             );
diff --git a/crates/rustmotion-studio/src/editor/audio.rs b/crates/rustmotion-studio/src/editor/audio.rs
index 5b015479..6a232169 100644
--- a/crates/rustmotion-studio/src/editor/audio.rs
+++ b/crates/rustmotion-studio/src/editor/audio.rs
@@ -165,7 +165,9 @@ pub fn prepare(scenario: Arc<ResolvedScenario>, total_duration: f64) {
         match mixed {
             Ok(Some(pcm_bytes)) => {
                 let pcm: Vec<f32> = pcm_bytes
-                    .chunks_exact(2)
+                    .as_chunks::<2>()
+                    .0
+                    .iter()
                     .map(|b| i16::from_le_bytes([b[0], b[1]]) as f32 / 32768.0)
                     .collect();
                 let _ = tx.send(Cmd::Load(Arc::new(pcm), SAMPLE_RATE));
diff --git a/crates/rustmotion-studio/src/scenario/optimistic.rs b/crates/rustmotion-studio/src/scenario/optimistic.rs
index adf3ae3f..5cca75c0 100644
--- a/crates/rustmotion-studio/src/scenario/optimistic.rs
+++ b/crates/rustmotion-studio/src/scenario/optimistic.rs
@@ -312,7 +312,9 @@ mod tests {
             .expect("render")
         };
         let count_red = |rgba: &[u8]| {
-            rgba.chunks_exact(4)
+            rgba.as_chunks::<4>()
+                .0
+                .iter()
                 .filter(|p| p[0] > 180 && p[1] < 90 && p[2] < 90)
                 .count()
         };
diff --git a/crates/rustmotion/src/tests.rs b/crates/rustmotion/src/tests.rs
index 784e3d12..661687b4 100644
--- a/crates/rustmotion/src/tests.rs
+++ b/crates/rustmotion/src/tests.rs
@@ -539,7 +539,7 @@ mod component_smoke {
 
     /// Counts non-transparent pixels in an RGBA buffer (alpha > 0).
     fn nonzero_pixels(buf: &[u8]) -> usize {
-        buf.chunks_exact(4).filter(|p| p[3] > 0).count()
+        buf.as_chunks::<4>().0.iter().filter(|p| p[3] > 0).count()
     }
 
     #[test]
@@ -605,7 +605,8 @@ mod component_smoke {
         let late = render_new_at(&scene, 400, 300, 0.95, 1.0);
         // Total red intensity (sum of red channel) — alpha-attenuated pixels
         // contribute less to this sum even when premul keeps the count up.
-        let red_sum: fn(&[u8]) -> u64 = |buf| buf.chunks_exact(4).map(|p| p[0] as u64).sum();
+        let red_sum: fn(&[u8]) -> u64 =
+            |buf| buf.as_chunks::<4>().0.iter().map(|p| p[0] as u64).sum();
         let early_red = red_sum(&early);
         let late_red = red_sum(&late);
         assert!(
@@ -638,7 +639,7 @@ mod component_smoke {
     }
 
     fn red_sum(buf: &[u8]) -> u64 {
-        buf.chunks_exact(4).map(|p| p[0] as u64).sum()
+        buf.as_chunks::<4>().0.iter().map(|p| p[0] as u64).sum()
     }
 
     #[test]
@@ -718,7 +719,9 @@ mod component_smoke {
             }
         }));
         let count_mid = |buf: &[u8]| {
-            buf.chunks_exact(4)
+            buf.as_chunks::<4>()
+                .0
+                .iter()
                 .filter(|p| p[0] > 20 && p[0] < 220)
                 .count()
         };
@@ -744,7 +747,9 @@ mod component_smoke {
         }));
         let buf = render_new_at(&inverted, 400, 300, 0.5, 1.0);
         let flipped = buf
-            .chunks_exact(4)
+            .as_chunks::<4>()
+            .0
+            .iter()
             .filter(|p| p[0] < 50 && p[1] > 150)
             .count();
         assert!(
@@ -873,7 +878,8 @@ mod component_smoke {
             bleed: false,
         };
         let scene = vec![child];
-        let blue_sum = |buf: &[u8]| -> u64 { buf.chunks_exact(4).map(|p| p[2] as u64).sum() };
+        let blue_sum =
+            |buf: &[u8]| -> u64 { buf.as_chunks::<4>().0.iter().map(|p| p[2] as u64).sum() };
         let before = render_new_at(&scene, 400, 300, 0.5, 4.0);
         let mid = render_new_at(&scene, 400, 300, 1.5, 4.0);
         let after = render_new_at(&scene, 400, 300, 2.5, 4.0);
@@ -936,7 +942,7 @@ mod component_smoke {
     fn red_centroid_x(buf: &[u8], width: u32) -> Option<f64> {
         let mut sum_wx = 0.0_f64;
         let mut sum_w = 0.0_f64;
-        for (i, p) in buf.chunks_exact(4).enumerate() {
+        for (i, p) in buf.as_chunks::<4>().0.iter().enumerate() {
             let x = (i as u32 % width) as f64;
             let w = p[0] as f64;
             sum_wx += w * x;
@@ -1665,7 +1671,7 @@ mod svg_draw_on_tests {
 
     /// Count non-transparent pixels in RGBA buffer.
     fn lit(buf: &[u8]) -> usize {
-        buf.chunks_exact(4).filter(|p| p[3] > 0).count()
+        buf.as_chunks::<4>().0.iter().filter(|p| p[3] > 0).count()
     }
 
     /// Count non-transparent pixels in horizontal band [y0, y1) of a 100-wide canvas.
@@ -1831,7 +1837,9 @@ mod svg_draw_on_tests {
         );
         // resvg fills the rect red. Count red-dominant pixels.
         let red_pixels = buf
-            .chunks_exact(4)
+            .as_chunks::<4>()
+            .0
+            .iter()
             .filter(|p| p[3] > 0 && p[0] > p[2] && p[0] > p[1])
             .count();
         assert!(
@@ -2232,7 +2240,9 @@ mod audio_tests {
         let lit_at = |frame: usize| {
             crate::encode::video::render_frame_task(&scenario.video, &scenario, &tasks[frame])
                 .expect("render")
-                .chunks_exact(4)
+                .as_chunks::<4>()
+                .0
+                .iter()
                 .filter(|p| p[0] > 40)
                 .count()
         };
@@ -2556,7 +2566,14 @@ mod audio_tests {
                 }
             }))
         };
-        let red_sum = |pixels: &[u8]| pixels.chunks_exact(4).map(|p| p[0] as u64).sum::<u64>();
+        let red_sum = |pixels: &[u8]| {
+            pixels
+                .as_chunks::<4>()
+                .0
+                .iter()
+                .map(|p| p[0] as u64)
+                .sum::<u64>()
+        };
 
         let loud = paint_scene(make_child(), 200, 200, 0.0, 30);
         let quiet = paint_scene(make_child(), 200, 200, 0.5, 30);
@@ -2658,7 +2675,13 @@ mod motion_blur_trail {
 
     /// Find the maximum red channel value across all pixels.
     fn max_red(pixels: &[u8]) -> u8 {
-        pixels.chunks_exact(4).map(|p| p[0]).max().unwrap_or(0)
+        pixels
+            .as_chunks::<4>()
+            .0
+            .iter()
+            .map(|p| p[0])
+            .max()
+            .unwrap_or(0)
     }
 
     /// Make a red Shape with slide_in_left + motion_blur, positioned at the center.
@@ -3385,7 +3408,7 @@ mod world_view_regressions {
     fn avg_luma(buf: &[u8]) -> f64 {
         let mut sum = 0u64;
         let mut n = 0u64;
-        for px in buf.chunks_exact(4) {
+        for px in buf.as_chunks::<4>().0.iter() {
             sum += px[0] as u64 + px[1] as u64 + px[2] as u64;
             n += 3;
         }

From 8444e4e02c028378ba8c9642df81c7adbf924dfa Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 10:52:05 +0200
Subject: [PATCH 03/56] fix(paint): include box-shadow and descendant ink in
 the layer bounds (#223)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

bleed is derived only from node.css.filter (FilterFn::Blur / DropShadow in
filter_bleed, line 610). It ignores the node's own box_shadow, which step 5
paints *inside* this layer (line 411-418) at layout.x + dx - spread, width +
spread*2 — i.e. outside the border-box — and it ignores the whole subtree
painted at steps 9-10, which with the default overflow: visible may
legitimately extend past the parent box (absolutely-positioned children, a
child's own scale/pulse transform, a child glow, marquee, which CLAUDE.md
explicitly documents as "exempté (leur rôle est de bleed)"). The file's own
comment on filter_bleed (line 605-609) states the rule: "a *too-tight* one
would silently clip filter bleed, trading a perf bug for a correctness one".
Concretely: a card with box-shadow: 0 20px 40px rgba(0,0,0,.5) loses its
shadow the moment any fade_in drives opacity below 1.0, and regains it on
the frame opacity reaches 1.0 — a visible pop mid-entrance. The repo already
treats this exact invariant as load-bearing for overflow: hidden (test
overflow_hidden_does_not_clip_own_outset_box_shadow, line 2909); the opacity
layer violates it for the same shadow.

Fix: Compute the layer bounds from the union of: the border-box, the filter
bleed, the outset box_shadow extents (|offset| + blur*1.5 + spread per
shadow), and — when overflow is visible — the descendants' layout union.
Alternatively move the outset box-shadow painting outside the opacity layer
and multiply its paint alpha by opacity, and fall back to an unbounded layer
when overflow: visible and children exist.

Refs #220
---
 .../rustmotion-core/src/engine/paint_pass.rs  | 108 ++++++++++++--
 crates/rustmotion-core/tests/audit_ws_a.rs    | 133 ++++++++++++++++++
 2 files changed, 228 insertions(+), 13 deletions(-)
 create mode 100644 crates/rustmotion-core/tests/audit_ws_a.rs

diff --git a/crates/rustmotion-core/src/engine/paint_pass.rs b/crates/rustmotion-core/src/engine/paint_pass.rs
index 496cdea0..048b3c81 100644
--- a/crates/rustmotion-core/src/engine/paint_pass.rs
+++ b/crates/rustmotion-core/src/engine/paint_pass.rs
@@ -356,17 +356,28 @@ fn paint_node(canvas: &Canvas, node: &BoxNode, ctx: &PaintContext, tree_depth: u
         }
     }
 
+    // Hoisted from step 8 below: the layer-bounds computation right after
+    // this needs it too, to decide whether descendant ink painted outside
+    // the border-box (legitimate under `overflow: visible`) must stay
+    // reachable by the opacity/filter layer opened next.
+    let overflow = node.css.overflow.unwrap_or(Overflow::Visible);
+
     // 4. opacity / filter layer — one shared layer carries both the group
     // alpha and the CSS `filter` chain (applies to the node and its
-    // subtree). Bounded to the node's own box (padded by the filter chain's
-    // blur/drop-shadow bleed so those still bleed past the edge, unclipped):
-    // an unbounded `SaveLayerRec` sizes the layer against the current clip —
-    // usually the whole viewport — so every faded/filtered node allocates
-    // and composites a full-frame layer regardless of how small it is
-    // (measured on this repo's release binary, 1080x1920/60 frames, 30 small
-    // `opacity: 0.5` shapes, `--threads 1`: ~42-60s wall time unbounded vs.
-    // ~0.5s bounded — roughly two orders of magnitude, not a rounding
-    // error; cost scales with viewport area, not node size).
+    // subtree). Bounded to the node's own box, padded by: the filter
+    // chain's blur/drop-shadow bleed, this node's own outset box-shadow
+    // extent (painted inside this same layer at step 5, outside the
+    // border-box), and — when `overflow` leaves descendant ink free to
+    // paint past the border-box — the union of the whole subtree's layout
+    // boxes. An unbounded `SaveLayerRec` sizes the layer against the
+    // current clip — usually the whole viewport — so every faded/filtered
+    // node allocates and composites a full-frame layer regardless of how
+    // small it is (measured on this repo's release binary, 1080x1920/60
+    // frames, 30 small `opacity: 0.5` shapes, `--threads 1`: ~42-60s wall
+    // time unbounded vs. ~0.5s bounded — roughly two orders of magnitude,
+    // not a rounding error; cost scales with viewport area, not node
+    // size), so the bound stays tight to the content that can actually
+    // paint rather than falling back to the viewport.
     let opacity = node.css.opacity.unwrap_or(1.0).clamp(0.0, 1.0);
     let content_filter = node
         .css
@@ -381,18 +392,30 @@ fn paint_node(canvas: &Canvas, node: &BoxNode, ctx: &PaintContext, tree_depth: u
         if let Some(filter) = content_filter {
             paint.set_image_filter(filter);
         }
-        let bleed = node
+        let filter_bleed_px = node
             .css
             .filter
             .as_deref()
             .map(|list| filter_bleed(list, &length_ctx))
             .unwrap_or(0.0);
-        let bounds = Rect::from_xywh(
+        let shadow_bleed_px = node
+            .css
+            .box_shadow
+            .as_deref()
+            .map(|shadows| box_shadow_bleed(shadows, &length_ctx))
+            .unwrap_or(0.0);
+        let bleed = filter_bleed_px.max(shadow_bleed_px);
+        let mut bounds = Rect::from_xywh(
             box_layout.x - bleed,
             box_layout.y - bleed,
             box_layout.width + bleed * 2.0,
             box_layout.height + bleed * 2.0,
         );
+        if overflow == Overflow::Visible {
+            if let Some(descendants) = subtree_layout_bounds(node, ctx.layout) {
+                bounds = Rect::join2(bounds, descendants);
+            }
+        }
         let rec = SaveLayerRec::default().paint(&paint).bounds(&bounds);
         canvas.save_layer(&rec);
         true
@@ -448,8 +471,8 @@ fn paint_node(canvas: &Canvas, node: &BoxNode, ctx: &PaintContext, tree_depth: u
 
     // 8. clip overflow:hidden / clip — scoped to this node's own content and
     // its children only (see step 5-7's comment for why the box's own
-    // decorations must stay outside this clip).
-    let overflow = node.css.overflow.unwrap_or(Overflow::Visible);
+    // decorations must stay outside this clip). `overflow` was hoisted
+    // above step 4.
     let opened_overflow_clip = if matches!(
         overflow,
         Overflow::Hidden | Overflow::Clip | Overflow::Scroll | Overflow::Auto
@@ -632,6 +655,65 @@ fn filter_bleed(list: &[crate::css::style::FilterFn], ctx: &LengthContext) -> f3
     bleed
 }
 
+/// Conservative outward bleed (px) a node's own outset `box_shadow` list
+/// paints beyond its border-box — the same role `filter_bleed` plays for
+/// `filter`, and sized the same way (offset + spread pushes the shadow rect
+/// out, `1.5x` blur radius covers the Gaussian falloff). Inset shadows are
+/// clipped to the padding-box by `paint_box_shadow` and never bleed outward,
+/// so they are skipped here.
+fn box_shadow_bleed(shadows: &[BoxShadow], ctx: &LengthContext) -> f32 {
+    let mut bleed = 0.0f32;
+    for shadow in shadows {
+        if shadow.inset.unwrap_or(false) {
+            continue;
+        }
+        let offset = shadow
+            .offset_x
+            .resolve(ctx)
+            .abs()
+            .max(shadow.offset_y.resolve(ctx).abs());
+        let spread = shadow
+            .spread
+            .as_ref()
+            .map(|s| s.resolve(ctx).max(0.0))
+            .unwrap_or(0.0);
+        let blur_bleed = shadow
+            .blur
+            .as_ref()
+            .map(|b| b.resolve(ctx).max(0.0) * 1.5)
+            .unwrap_or(0.0);
+        bleed = bleed.max(offset + spread + blur_bleed);
+    }
+    bleed
+}
+
+/// Bounding box (viewport coordinates) of every descendant's own layout box,
+/// recursively — the same "leave the layer big enough to hold what can
+/// legitimately paint outside the border-box" contract as `filter_bleed`,
+/// applied to `overflow: visible` subtrees instead of a filter chain. Each
+/// descendant contributes only its plain layout rect (not its own
+/// filter/shadow bleed or transform): a tight bound for the common cases —
+/// absolutely-positioned children, `marquee`, a taller-than-parent flow —
+/// without walking the whole subtree's CSS.
+fn subtree_layout_bounds(node: &BoxNode, layout: &LayoutResult) -> Option<Rect> {
+    let mut bounds: Option<Rect> = None;
+    for child in &node.children {
+        if let Some(child_layout) = layout.get(child.id) {
+            let rect = Rect::from_xywh(
+                child_layout.x,
+                child_layout.y,
+                child_layout.width,
+                child_layout.height,
+            );
+            bounds = Some(bounds.map_or(rect, |b| Rect::join2(b, rect)));
+        }
+        if let Some(child_bounds) = subtree_layout_bounds(child, layout) {
+            bounds = Some(bounds.map_or(child_bounds, |b| Rect::join2(b, child_bounds)));
+        }
+    }
+    bounds
+}
+
 // ---- CSS filters ----
 
 /// Build a Skia `ImageFilter` chain from a CSS `filter`/`backdrop-filter`
diff --git a/crates/rustmotion-core/tests/audit_ws_a.rs b/crates/rustmotion-core/tests/audit_ws_a.rs
new file mode 100644
index 00000000..0eb5f7e5
--- /dev/null
+++ b/crates/rustmotion-core/tests/audit_ws_a.rs
@@ -0,0 +1,133 @@
+//! Regression tests for the workstream A (animation & paint) audit findings
+//! tracked in issue #220.
+
+use rustmotion_core::css::style::{
+    Background, BoxShadow, Color as CssColor, CssStyle, Display, FlexDirection, Position,
+    Size as CSize,
+};
+use rustmotion_core::css::taffy_bridge::ConversionContext;
+use rustmotion_core::css::units::{Length, LengthPercentage as CLP};
+use rustmotion_core::engine::box_tree::{BoxKind, BoxNode};
+use rustmotion_core::engine::layout_pass::run_layout;
+use rustmotion_core::engine::paint_pass::{paint_tree, NoopDispatcher, PaintFrame};
+
+fn test_frame(w: u32, h: u32) -> PaintFrame {
+    PaintFrame {
+        time: 0.0,
+        scenario_time: 0.0,
+        frame_index: 0,
+        fps: 30,
+        video_width: w,
+        video_height: h,
+        scene_duration: 1.0,
+        camera: None,
+    }
+}
+
+fn render_pixels(root: &mut BoxNode, w: u32, h: u32) -> Vec<u8> {
+    root.assign_ids(0);
+    let layout = run_layout(root, (w as f32, h as f32), &ConversionContext::default());
+    let mut surface = skia_safe::surfaces::raster_n32_premul((w as i32, h as i32)).unwrap();
+    paint_tree(
+        surface.canvas(),
+        root,
+        &layout,
+        &test_frame(w, h),
+        &NoopDispatcher,
+    );
+    let info = skia_safe::ImageInfo::new(
+        (w as i32, h as i32),
+        skia_safe::ColorType::RGBA8888,
+        skia_safe::AlphaType::Unpremul,
+        None,
+    );
+    let mut buf = vec![0u8; (w * h * 4) as usize];
+    surface.read_pixels(&info, &mut buf, (w * 4) as usize, (0, 0));
+    buf
+}
+
+fn root_node(w: f32, h: f32, background: &str, children: Vec<BoxNode>) -> BoxNode {
+    BoxNode {
+        id: 0,
+        kind: BoxKind::Container,
+        css: CssStyle {
+            display: Some(Display::Flex),
+            flex_direction: Some(FlexDirection::Column),
+            width: Some(CSize::Length(CLP::Px(w))),
+            height: Some(CSize::Length(CLP::Px(h))),
+            background: Some(Background::Color(CssColor::String(background.to_string()))),
+            ..Default::default()
+        },
+        children,
+        intrinsic: None,
+        source_path: None,
+        window: None,
+    }
+}
+
+fn probe(buf: &[u8], w: u32, x: usize, y: usize) -> (u8, u8, u8) {
+    let i = (y * w as usize + x) * 4;
+    (buf[i], buf[i + 1], buf[i + 2])
+}
+
+// ---- opacity layer must not clip the node's own outset box-shadow ----
+
+fn card_with_shadow(opacity: Option<f32>) -> BoxNode {
+    let css = CssStyle {
+        position: Some(Position::Absolute),
+        left: Some(CLP::Px(50.0)),
+        top: Some(CLP::Px(50.0)),
+        width: Some(CSize::Length(CLP::Px(100.0))),
+        height: Some(CSize::Length(CLP::Px(100.0))),
+        background: Some(Background::Color(CssColor::String("#ffffff".into()))),
+        box_shadow: Some(vec![BoxShadow {
+            offset_x: Length::Px(0.0),
+            offset_y: Length::Px(0.0),
+            blur: None,
+            spread: Some(Length::Px(20.0)),
+            color: Some(CssColor::String("#ff0000".into())),
+            inset: None,
+        }]),
+        opacity,
+        ..Default::default()
+    };
+    BoxNode {
+        id: 0,
+        kind: BoxKind::Container,
+        css,
+        children: vec![],
+        intrinsic: None,
+        source_path: None,
+        window: None,
+    }
+}
+
+#[test]
+fn opacity_layer_does_not_clip_own_outset_box_shadow() {
+    // 100x100 white card at (50,50) on a 200x200 black canvas, outset
+    // box-shadow (red, spread 20, blur 0 -> hard-edged halo rect from
+    // (30,30) to (170,170)). Probe point (100,45) sits in the halo band
+    // above the card, outside its own border-box. `opacity: 0.999` forces
+    // the opacity/filter SaveLayerRec open without visibly dimming the
+    // probed color.
+    let opaque = {
+        let mut root = root_node(200.0, 200.0, "#000000", vec![card_with_shadow(None)]);
+        render_pixels(&mut root, 200, 200)
+    };
+    let faded = {
+        let mut root = root_node(200.0, 200.0, "#000000", vec![card_with_shadow(Some(0.999))]);
+        render_pixels(&mut root, 200, 200)
+    };
+
+    let above_opaque = probe(&opaque, 200, 100, 45);
+    assert!(
+        above_opaque.0 > 200 && above_opaque.1 < 50,
+        "sanity: shadow halo must be visible without an opacity layer, got {above_opaque:?}"
+    );
+
+    let above_faded = probe(&faded, 200, 100, 45);
+    assert!(
+        above_faded.0 > 200 && above_faded.1 < 50,
+        "an opacity<1 layer must not clip the node's own outset box-shadow, got {above_faded:?}"
+    );
+}

From f46548b4a1a382a911d55286c9db2c3acab71995 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 10:52:18 +0200
Subject: [PATCH 04/56] fix(geometry): resolve vw/vh against the scenario
 viewport (#227)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ConversionContext::default() carries LengthContext { viewport_width: 1920.0,
viewport_height: 1080.0, .. } (rustmotion-core/src/css/units.rs:66-74), and
taffy_bridge::size_to_dim/lp_to_lp/lp_to_lp_auto resolve every vw/vh/rem/em
against it (taffy_bridge.rs:335-338). The renderer does NOT:
render_with_new_pipeline_iter (engine/render/scene.rs:554-558) and
render_scene_hits (scene.rs:792) both pass viewport_conversion_context(vw,
vh), whose own doc comment calls the 1920×1080 default a 78% error on a
1080×1920 vertical video. So on any non-1920×1080 scenario the mandatory
rustmotion validate gate checks a layout the renderer never produces: width:
"50vw" is measured as 960px by the validator and painted as 540px, 50vh as
540px vs 960px. The file header promises the opposite ("so the geometry it
checks matches what the renderer will actually paint"). The same file builds
a correct LengthContext with the real viewport at line 477 for its
transform-origin math, so the omission is confined to the layout pass. Both
the resting walk (:180) and the --strict-anim walk (:1347) are affected.

Fix: Make viewport_conversion_context public (or move it next to run_layout
in rustmotion-core) and call it from both geometry.rs sites:
run_layout(&built.root, viewport_f,
&viewport_conversion_context(viewport_f.0, viewport_f.1)). Better: stop
exposing ConversionContext at the run_layout signature at all — derive it
from the viewport argument inside run_layout, which makes the wrong context
unrepresentable.

Refs #220
---
 .../rustmotion/src/cli/commands/geometry.rs   |  12 +-
 crates/rustmotion/tests/audit_ws_b.rs         | 196 ++++++++++++++++++
 2 files changed, 206 insertions(+), 2 deletions(-)
 create mode 100644 crates/rustmotion/tests/audit_ws_b.rs

diff --git a/crates/rustmotion/src/cli/commands/geometry.rs b/crates/rustmotion/src/cli/commands/geometry.rs
index 929f592d..0fd7d069 100644
--- a/crates/rustmotion/src/cli/commands/geometry.rs
+++ b/crates/rustmotion/src/cli/commands/geometry.rs
@@ -177,7 +177,11 @@ pub fn validate_geometry(scenario: &ResolvedScenario) -> Vec<GeometryViolation>
 
             let root_css = render::root_style(scene.layout.as_ref(), view.view_type.clone());
             let built = build_scene_from_refs(children.iter(), viewport_f, root_css, None);
-            let layouts = run_layout(&built.root, viewport_f, &ConversionContext::default());
+            let layouts = run_layout(
+                &built.root,
+                viewport_f,
+                &ConversionContext::for_viewport(viewport_f.0, viewport_f.1),
+            );
 
             let camera = scene
                 .camera
@@ -1344,7 +1348,11 @@ pub fn validate_geometry_animated(scenario: &ResolvedScenario) -> Vec<GeometryVi
                     fps,
                 });
                 let built = build_scene_from_refs(children.iter(), viewport_f, root_css, anim);
-                let layouts = run_layout(&built.root, viewport_f, &ConversionContext::default());
+                let layouts = run_layout(
+                    &built.root,
+                    viewport_f,
+                    &ConversionContext::for_viewport(viewport_f.0, viewport_f.1),
+                );
 
                 walk_anim(
                     &children,
diff --git a/crates/rustmotion/tests/audit_ws_b.rs b/crates/rustmotion/tests/audit_ws_b.rs
new file mode 100644
index 00000000..6d8ee899
--- /dev/null
+++ b/crates/rustmotion/tests/audit_ws_b.rs
@@ -0,0 +1,196 @@
+//! Regression tests — audit round chantier/audit-2026-09, workstream B
+//! (geometry validator).
+//!
+//! Every test here drives the actual compiled `rustmotion` binary rather
+//! than calling `commands::geometry`/`commands::validate` in-process:
+//! `rustmotion::cli::commands` is a private module (`mod commands;` in
+//! `src/cli/mod.rs`), so the CLI subprocess — `validate --report <path>`,
+//! whose JSON is `commands::geometry::GeometryViolation`'s public `Serialize`
+//! output — is the only externally-observable contract for what the
+//! validator decided (mirrors `motion_path_strict_anim.rs`'s reasoning).
+//!
+//! One section per finding, in briefing order: viewport units, transform
+//! lengths, path rewriting, the three box-model checks, and helper reuse.
+
+use std::path::{Path, PathBuf};
+use std::process::{Command, Output};
+
+/// Minimal RAII scratch file — mirrors `motion_path_strict_anim.rs`'s
+/// `ScratchFile`.
+struct ScratchFile(PathBuf);
+
+impl ScratchFile {
+    fn new(label: &str) -> Self {
+        let unique = format!(
+            "rustmotion-audit-ws-b-{label}-{}-{}",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .expect("system clock before UNIX epoch")
+                .as_nanos()
+        );
+        Self(std::env::temp_dir().join(unique))
+    }
+}
+
+impl Drop for ScratchFile {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_file(&self.0);
+    }
+}
+
+/// Minimal RAII scratch directory — mirrors `skill_files_match_disk.rs`'s
+/// `ScratchDir`. Only the path-rewriting case needs a directory (a file plus a
+/// sibling asset file).
+struct ScratchDir(PathBuf);
+
+impl ScratchDir {
+    fn new(label: &str) -> Self {
+        let unique = format!(
+            "rustmotion-audit-ws-b-{label}-{}-{}",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .expect("system clock before UNIX epoch")
+                .as_nanos()
+        );
+        let path = std::env::temp_dir().join(unique);
+        std::fs::create_dir_all(&path).expect("create scratch dir");
+        Self(path)
+    }
+}
+
+impl Drop for ScratchDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn run_validate(
+    scenario_path: &Path,
+    report_path: Option<&Path>,
+    fix: bool,
+    strict_anim: bool,
+) -> Output {
+    let mut cmd = Command::new(env!("CARGO_BIN_EXE_rustmotion"));
+    cmd.arg("validate").arg("--file").arg(scenario_path);
+    if let Some(report_path) = report_path {
+        cmd.arg("--report").arg(report_path);
+    }
+    if fix {
+        cmd.arg("--fix");
+    }
+    if strict_anim {
+        cmd.arg("--strict-anim");
+    }
+    cmd.output().expect("failed to spawn `rustmotion validate`")
+}
+
+fn read_report(path: &Path) -> serde_json::Value {
+    let text = std::fs::read_to_string(path).expect("read report");
+    serde_json::from_str(&text).expect("report is valid JSON")
+}
+
+fn violations(report: &serde_json::Value) -> &Vec<serde_json::Value> {
+    report["geometry_violations"]
+        .as_array()
+        .expect("geometry_violations is an array")
+}
+
+fn count_kind(report: &serde_json::Value, kind: &str) -> usize {
+    violations(report)
+        .iter()
+        .filter(|v| v["kind"] == kind)
+        .count()
+}
+
+fn find_kind<'a>(report: &'a serde_json::Value, kind: &str) -> Option<&'a serde_json::Value> {
+    violations(report).iter().find(|v| v["kind"] == kind)
+}
+
+// ─── vw/vh must resolve against the scenario's real viewport ───────
+
+/// A `width: "90vw"` shape on a 1080×1920 scenario, positioned so its right
+/// edge crosses the viewport edge at EITHER candidate width — 972px (90% of
+/// the real 1080px-wide viewport) or 1728px (90% of the hardcoded
+/// `ConversionContext::default()` 1920px fallback). The violation fires
+/// either way; only the reported `bbox.w` distinguishes a correct
+/// measurement from the buggy one.
+fn vw_shape_scenario(x: f32) -> String {
+    format!(
+        r##"{{
+            "video": {{ "width": 1080, "height": 1920 }},
+            "scenes": [{{
+                "duration": 1.0,
+                "children": [{{
+                    "type": "shape",
+                    "shape": "rect",
+                    "position": "absolute",
+                    "x": {x}, "y": 100,
+                    "style": {{ "width": "90vw", "height": "50px" }},
+                    "fill": "#ff0000"
+                }}]
+            }}]
+        }}"##
+    )
+}
+
+#[test]
+fn resting_layout_measures_vw_against_the_real_viewport_width() {
+    let scenario = ScratchFile::new("rm05-resting-scenario");
+    let report = ScratchFile::new("rm05-resting-report");
+    std::fs::write(&scenario.0, vw_shape_scenario(200.0)).expect("write scenario");
+
+    let output = run_validate(&scenario.0, Some(&report.0), false, false);
+    assert!(
+        !output.status.success(),
+        "a shape whose right edge is past the viewport at either candidate width must block; \
+         stdout={} stderr={}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr)
+    );
+
+    let report_json = read_report(&report.0);
+    let violation = find_kind(&report_json, "viewport_overflow")
+        .expect("expected a viewport_overflow violation");
+    let width = violation["bbox"]["w"].as_f64().expect("bbox.w is a number");
+    assert!(
+        (width - 972.0).abs() < 2.0,
+        "90vw on a 1080px-wide viewport must resolve to ~972px (the real viewport), \
+         not 1728px (0.9 x the hardcoded 1920 default); report: {report_json}"
+    );
+}
+
+/// Same shape, repositioned so it overflows ONLY under the buggy
+/// 1920x1080 default (right edge 1778px vs an 1080px-wide viewport) and
+/// stays clean at the correct 972px width (right edge 1022px). Isolates
+/// the `--strict-anim` call site (`validate_geometry_animated`, geometry.rs
+/// ~1347) from the resting one above (~180): each builds its own box tree
+/// through `ConversionContext::default()` independently, so fixing only
+/// one would still leave this failing.
+#[test]
+fn strict_anim_also_measures_vw_against_the_real_viewport_width() {
+    let scenario = ScratchFile::new("rm05-strict-anim-scenario");
+    let report = ScratchFile::new("rm05-strict-anim-report");
+    std::fs::write(&scenario.0, vw_shape_scenario(50.0)).expect("write scenario");
+
+    let output = run_validate(&scenario.0, Some(&report.0), false, true);
+    let report_json = read_report(&report.0);
+    assert!(
+        output.status.success(),
+        "the real 1080px-wide viewport keeps this shape on-screen at every sample; \
+         stdout={} stderr={} report={report_json}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr)
+    );
+    assert_eq!(
+        count_kind(&report_json, "viewport_overflow"),
+        0,
+        "resting pass (line ~180) must be clean: {report_json}"
+    );
+    assert_eq!(
+        count_kind(&report_json, "animated_text_overflow"),
+        0,
+        "--strict-anim pass (line ~1347) must also be clean: {report_json}"
+    );
+}

From e34b4024d1fac2e4a0b2be0b1edfc74d418cabe6 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 10:52:41 +0200
Subject: [PATCH 05/56] fix(encode): publish the output only once the render
 succeeds (#234)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When render_frame_task fails mid-encode (line 613 sets pipe_error and
breaks), the code drops stdin and then *waits* for ffmpeg. ffmpeg sees a
clean EOF on pipe:0, finalizes the frames it already received, writes the
moov atom and exits 0. rustmotion then returns Err, but output_path now
holds a structurally valid MP4 containing only the first N frames. Because
ffmpeg_args emits -y (line 194), this also silently destroys a previously-
good render at the same path. A user scripting rustmotion render who checks
only file existence (or whose CI publishes the artifact) ships a truncated
video. No code path anywhere in src/cli or src/encode removes the output on
failure — only test code calls remove_file on outputs.

Fix: On the pipe_error path, call child.kill() and child.wait() before
returning, and let _ = std::fs::remove_file(output_path); on both the
pipe_error and !status.success() branches. Better still, have ffmpeg write
to a sibling scratch path and fs::rename onto output_path only after a clean
exit — the same promote-on-success discipline
video_audio.rs::partial_wav_path already applies to cached WAVs.

Refs #220
---
 crates/rustmotion/src/encode/video/ffmpeg.rs  |  93 ++++++++-
 crates/rustmotion/src/encode/video/formats.rs | 180 +++++++++++++++++-
 crates/rustmotion/tests/audit_ws_c.rs         | 117 ++++++++++++
 3 files changed, 383 insertions(+), 7 deletions(-)
 create mode 100644 crates/rustmotion/tests/audit_ws_c.rs

diff --git a/crates/rustmotion/src/encode/video/ffmpeg.rs b/crates/rustmotion/src/encode/video/ffmpeg.rs
index b91208c6..63d338ae 100644
--- a/crates/rustmotion/src/encode/video/ffmpeg.rs
+++ b/crates/rustmotion/src/encode/video/ffmpeg.rs
@@ -290,6 +290,27 @@ fn ffmpeg_args(
     args
 }
 
+/// Scratch path ffmpeg actually writes to; promoted (renamed) onto the
+/// caller's real `output_path` only after a clean exit with no `pipe_error`.
+/// Kept as a sibling of `output_path` (same directory, same filesystem, so
+/// the promotion is a plain rename) and keeps `output_path`'s own extension
+/// as the *final* extension — mirrors `video_audio::partial_wav_path`'s doc:
+/// ffmpeg picks its output muxer from the last extension, so a bare
+/// `.partial` suffix appended after it makes ffmpeg refuse to start with
+/// "Unable to choose an output format" instead of the encode failure this
+/// path exists to isolate.
+fn ffmpeg_partial_output_path(output_path: &std::path::Path) -> std::path::PathBuf {
+    let stem = output_path
+        .file_stem()
+        .and_then(|s| s.to_str())
+        .unwrap_or("output");
+    let name = match output_path.extension().and_then(|s| s.to_str()) {
+        Some(ext) => format!("{stem}.partial.{ext}"),
+        None => format!("{stem}.partial"),
+    };
+    output_path.with_file_name(name)
+}
+
 /// Encode using FFmpeg subprocess (for h265, vp9, prores, webm, mov, transparency).
 ///
 /// Software-only. Kept with its original signature so existing callers
@@ -531,6 +552,14 @@ fn encode_with_ffmpeg_hw_impl(
         }
     };
 
+    let partial_output_path = ffmpeg_partial_output_path(std::path::Path::new(output_path));
+    let partial_output_str =
+        partial_output_path
+            .to_str()
+            .ok_or_else(|| RustmotionError::NonUtf8Path {
+                path: partial_output_path.to_string_lossy().into_owned(),
+            })?;
+
     let mut cmd = std::process::Command::new("ffmpeg");
     cmd.args(ffmpeg_args(
         width,
@@ -541,7 +570,7 @@ fn encode_with_ffmpeg_hw_impl(
         transparent,
         hw_encoder.as_deref(),
         audio_input.as_deref(),
-        output_path,
+        partial_output_str,
     ));
     cmd.stdin(std::process::Stdio::piped());
     cmd.stdout(std::process::Stdio::null());
@@ -623,7 +652,18 @@ fn encode_with_ffmpeg_hw_impl(
         cb(EncodeProgress::Muxing);
     }
 
-    let status = child.wait().map_err(|e| RustmotionError::FfmpegWait {
+    // A `pipe_error` means the render already failed and `partial_output_path`
+    // will be discarded either way, so there is nothing left for ffmpeg to
+    // usefully finish — killing it here instead of waiting for it to
+    // gracefully encode and finalize a file nobody will ever read avoids
+    // burning time on a result already known to be thrown away.
+    let status = if pipe_error.is_some() {
+        let _ = child.kill();
+        child.wait()
+    } else {
+        child.wait()
+    }
+    .map_err(|e| RustmotionError::FfmpegWait {
         reason: e.to_string(),
     })?;
 
@@ -659,6 +699,7 @@ fn encode_with_ffmpeg_hw_impl(
 
     if let Some(e) = pipe_error {
         tee_stderr();
+        let _ = std::fs::remove_file(&partial_output_path);
         // A broken pipe means ffmpeg is already gone — its own error says why,
         // ours only says we could not keep writing. Carry both.
         return Err(match e {
@@ -672,11 +713,17 @@ fn encode_with_ffmpeg_hw_impl(
 
     if !status.success() {
         tee_stderr();
+        let _ = std::fs::remove_file(&partial_output_path);
         return Err(RustmotionError::FfmpegFailed {
             stderr: stderr_summary,
         });
     }
 
+    // Only now, with a clean exit and no pipe error, does `output_path` ever
+    // see this render's bytes — promote-on-success, the same discipline
+    // `video_audio::extract_audio_to_wav` already applies to its cached WAVs.
+    std::fs::rename(&partial_output_path, output_path)?;
+
     Ok(())
 }
 
@@ -789,7 +836,47 @@ pub fn concat_mp4_segments(inputs: &[std::path::PathBuf], output_path: &str) ->
 
 #[cfg(test)]
 mod tests {
-    use super::{ffmpeg_args, parse_encoder_names, select_hardware_encoder, HardwareSelection};
+    use super::{
+        ffmpeg_args, ffmpeg_partial_output_path, parse_encoder_names, select_hardware_encoder,
+        HardwareSelection,
+    };
+
+    // ── partial-output-path naming (pure) ────────────────────────────────────
+
+    #[test]
+    fn partial_path_keeps_the_original_extension_as_its_last_extension() {
+        let cases = [
+            ("/tmp/out.mp4", "/tmp/out.partial.mp4"),
+            ("/tmp/out.mov", "/tmp/out.partial.mov"),
+            ("/tmp/out.webm", "/tmp/out.partial.webm"),
+            ("out.mp4", "out.partial.mp4"),
+        ];
+        for (input, expected) in cases {
+            let got = ffmpeg_partial_output_path(std::path::Path::new(input));
+            assert_eq!(
+                got,
+                std::path::PathBuf::from(expected),
+                "input={input}: ffmpeg picks its muxer from the last extension, so it must \
+                 survive unchanged"
+            );
+        }
+    }
+
+    #[test]
+    fn partial_path_is_a_sibling_of_the_final_output_not_a_different_directory() {
+        let got = ffmpeg_partial_output_path(std::path::Path::new("/a/b/c/out.mp4"));
+        assert_eq!(
+            got.parent(),
+            Some(std::path::Path::new("/a/b/c")),
+            "the rename onto output_path must stay on the same filesystem"
+        );
+    }
+
+    #[test]
+    fn partial_path_falls_back_gracefully_with_no_extension() {
+        let got = ffmpeg_partial_output_path(std::path::Path::new("/tmp/out"));
+        assert_eq!(got, std::path::PathBuf::from("/tmp/out.partial"));
+    }
 
     /// Every option that describes the *output* has to sit after the last `-i`.
     /// Put one before it and ffmpeg attaches it to the following input instead,
diff --git a/crates/rustmotion/src/encode/video/formats.rs b/crates/rustmotion/src/encode/video/formats.rs
index ee06ab7a..8cad2f02 100644
--- a/crates/rustmotion/src/encode/video/formats.rs
+++ b/crates/rustmotion/src/encode/video/formats.rs
@@ -10,10 +10,52 @@ use crate::schema::ResolvedScenario as Scenario;
 use super::tasks::{build_frame_tasks, render_frame_task};
 use super::EncodeProgress;
 
-/// Encode frames as a PNG sequence (one PNG file per frame)
+/// Sibling scratch directory a PNG-sequence render writes into before being
+/// promoted onto `output_dir` — same reasoning as `partial_sibling_path`,
+/// applied to a directory instead of a single file: directories don't have
+/// an extension to preserve, so the suffix is the whole difference.
+fn partial_sibling_dir(output_dir: &str) -> std::path::PathBuf {
+    let path = std::path::Path::new(output_dir);
+    let name = path
+        .file_name()
+        .and_then(|s| s.to_str())
+        .unwrap_or("output");
+    path.with_file_name(format!("{name}.partial"))
+}
+
+/// Encode frames as a PNG sequence (one PNG file per frame).
+///
+/// Renders into a sibling scratch directory and promotes (renames) it onto
+/// `output_dir` only once every frame has been written — a mid-sequence
+/// failure used to leave a partial run's files sitting directly in
+/// `output_dir`, indistinguishable from a completed one to a caller that
+/// only checks the directory exists (the same shape a single-file output
+/// failing mid-encode has).
 pub fn encode_png_sequence(
     scenario: &Scenario,
     output_dir: &str,
+    quiet: bool,
+    transparent: bool,
+    on_progress: Option<&mut dyn FnMut(EncodeProgress)>,
+) -> Result<()> {
+    let partial_dir = partial_sibling_dir(output_dir);
+    let _ = std::fs::remove_dir_all(&partial_dir);
+    match encode_png_sequence_to_dir(scenario, &partial_dir, quiet, transparent, on_progress) {
+        Ok(()) => {
+            let _ = std::fs::remove_dir_all(output_dir);
+            std::fs::rename(&partial_dir, output_dir)?;
+            Ok(())
+        }
+        Err(e) => {
+            let _ = std::fs::remove_dir_all(&partial_dir);
+            Err(e)
+        }
+    }
+}
+
+fn encode_png_sequence_to_dir(
+    scenario: &Scenario,
+    output_dir: &std::path::Path,
     _quiet: bool,
     _transparent: bool,
     mut on_progress: Option<&mut dyn FnMut(EncodeProgress)>,
@@ -67,7 +109,7 @@ pub fn encode_png_sequence(
 
         for result in results {
             let (frame_num, rgba) = result?;
-            let path = format!("{}/frame_{:05}.png", output_dir, frame_num);
+            let path = output_dir.join(format!("frame_{:05}.png", frame_num));
             let img = image::RgbaImage::from_raw(width, height, rgba)
                 .ok_or(RustmotionError::PixelImage)?;
             img.save(&path)?;
@@ -77,11 +119,59 @@ pub fn encode_png_sequence(
     Ok(())
 }
 
-/// Encode frames as an animated GIF
+/// Sibling scratch path a single-file encoder (GIF today) writes to before
+/// being promoted onto `output_path` only after every frame is written
+/// successfully. Same discipline and the same reasoning as
+/// `video::ffmpeg::ffmpeg_partial_output_path`: kept in the same directory
+/// so the promotion is a same-filesystem rename, extension kept last since
+/// some downstream consumers of the output (players, `file`) pick behavior
+/// from it the way ffmpeg picks a muxer from its own output extension.
+fn partial_sibling_path(output_path: &str) -> std::path::PathBuf {
+    let path = std::path::Path::new(output_path);
+    let stem = path
+        .file_stem()
+        .and_then(|s| s.to_str())
+        .unwrap_or("output");
+    let name = match path.extension().and_then(|s| s.to_str()) {
+        Some(ext) => format!("{stem}.partial.{ext}"),
+        None => format!("{stem}.partial"),
+    };
+    path.with_file_name(name)
+}
+
+/// Encode frames as an animated GIF.
+///
+/// Writes to a sibling scratch path first and promotes (renames) it onto
+/// `output_path` only once every frame has been written without error —
+/// the same partial-then-rename discipline `video_audio::extract_audio_to_wav`
+/// and the ffmpeg encoder already apply. A GIF that fails midway through the
+/// frame loop (any `?` inside `encode_gif_to_path`) used to leave a
+/// truncated-but-existing file sitting at `output_path`, the same shape the
+/// ffmpeg-backed encoder and the PNG-sequence encoder had before adopting
+/// this same discipline.
 pub fn encode_gif(
     scenario: &Scenario,
     output_path: &str,
     quiet: bool,
+    on_progress: Option<&mut dyn FnMut(EncodeProgress)>,
+) -> Result<()> {
+    let partial_path = partial_sibling_path(output_path);
+    match encode_gif_to_path(scenario, &partial_path, quiet, on_progress) {
+        Ok(()) => {
+            std::fs::rename(&partial_path, output_path)?;
+            Ok(())
+        }
+        Err(e) => {
+            let _ = std::fs::remove_file(&partial_path);
+            Err(e)
+        }
+    }
+}
+
+fn encode_gif_to_path(
+    scenario: &Scenario,
+    partial_path: &std::path::Path,
+    quiet: bool,
     mut on_progress: Option<&mut dyn FnMut(EncodeProgress)>,
 ) -> Result<()> {
     let config = &scenario.video;
@@ -103,7 +193,7 @@ pub fn encode_gif(
     let gif_w = width.min(65535) as u16;
     let gif_h = height.min(65535) as u16;
 
-    let file = File::create(output_path)?;
+    let file = File::create(partial_path)?;
     let mut encoder = gif::Encoder::new(BufWriter::new(file), gif_w, gif_h, &[]).map_err(|e| {
         RustmotionError::GifEncoder {
             reason: e.to_string(),
@@ -243,6 +333,88 @@ mod tests {
     use crate::loader::load_scenario_from_source;
     use std::path::{Path, PathBuf};
 
+    // ── partial-output naming (pure) ─────────────────────────────────────────
+
+    #[test]
+    fn partial_sibling_path_keeps_the_extension_last() {
+        assert_eq!(
+            partial_sibling_path("/tmp/out.gif"),
+            PathBuf::from("/tmp/out.partial.gif")
+        );
+        assert_eq!(
+            partial_sibling_path("/tmp/out"),
+            PathBuf::from("/tmp/out.partial")
+        );
+    }
+
+    #[test]
+    fn partial_sibling_dir_stays_next_to_the_final_directory() {
+        let got = partial_sibling_dir("/a/b/frames");
+        assert_eq!(got, PathBuf::from("/a/b/frames.partial"));
+        assert_eq!(got.parent(), Some(Path::new("/a/b")));
+    }
+
+    /// A failed GIF encode must not leave a truncated file at `output_path`
+    /// — the real trigger used to prove this for the ffmpeg-backed encoder
+    /// (an odd width rejected by libx264) doesn't apply here (the `gif`
+    /// crate has no such constraint), so this drives the failure the one
+    /// way this pure Rust path can actually fail without external tools:
+    /// `total_frames == 0`.
+    /// That returns before any file is touched either way, so what this
+    /// test really pins is the *shape* of the fix — `encode_gif` must never
+    /// promote a partial onto `output_path` when its inner call errors —
+    /// exercised by asserting the scratch/partial path used internally is
+    /// never left behind either.
+    #[test]
+    fn encode_gif_leaves_no_partial_file_behind_on_an_empty_scenario() {
+        let json = r#"{"video": {"width": 8, "height": 8, "fps": 10}, "scenes": []}"#;
+        let scenario = load_scenario_from_source(None, Some(json)).expect("load");
+
+        let out = std::env::temp_dir().join(format!(
+            "rm_gif_no_debris_test_{}_{}.gif",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .unwrap()
+                .as_nanos()
+        ));
+        let partial = partial_sibling_path(out.to_str().unwrap());
+        let _ = std::fs::remove_file(&out);
+        let _ = std::fs::remove_file(&partial);
+
+        let result = encode_gif(&scenario, out.to_str().unwrap(), true, None);
+        assert!(result.is_err(), "an empty scenario has no frames to encode");
+        assert!(!out.exists(), "no debris at the final output path");
+        assert!(!partial.exists(), "no debris at the scratch path either");
+    }
+
+    /// Same property for the directory-based PNG-sequence encoder.
+    #[test]
+    fn encode_png_sequence_leaves_no_partial_dir_behind_on_an_empty_scenario() {
+        let json = r#"{"video": {"width": 8, "height": 8, "fps": 10}, "scenes": []}"#;
+        let scenario = load_scenario_from_source(None, Some(json)).expect("load");
+
+        let out_dir = std::env::temp_dir().join(format!(
+            "rm_png_seq_no_debris_test_{}_{}",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .unwrap()
+                .as_nanos()
+        ));
+        let partial_dir = partial_sibling_dir(out_dir.to_str().unwrap());
+        let _ = std::fs::remove_dir_all(&out_dir);
+        let _ = std::fs::remove_dir_all(&partial_dir);
+
+        let result = encode_png_sequence(&scenario, out_dir.to_str().unwrap(), true, false, None);
+        assert!(result.is_err(), "an empty scenario has no frames to encode");
+        assert!(!out_dir.exists(), "no debris at the final output directory");
+        assert!(
+            !partial_dir.exists(),
+            "no debris at the scratch directory either"
+        );
+    }
+
     /// Deterministic color for a given frame index: distinct enough across
     /// nearby indices that a swapped/misplaced frame is detected by a plain
     /// pixel comparison.
diff --git a/crates/rustmotion/tests/audit_ws_c.rs b/crates/rustmotion/tests/audit_ws_c.rs
new file mode 100644
index 00000000..e612794e
--- /dev/null
+++ b/crates/rustmotion/tests/audit_ws_c.rs
@@ -0,0 +1,117 @@
+//! Regression tests — audit round chantier/audit-2026-09, workstream C
+//! (encoding, audio, cancellation).
+//!
+//! Tests here only exercise the public API surface — `rustmotion::encode::...`
+//! — since this is an external integration test crate; regression tests for
+//! private helpers live next to them in their own `#[cfg(test)] mod tests`
+//! inside the `src/encode/` file that owns them, and are cross-referenced
+//! here by the behavior they cover.
+
+use std::path::PathBuf;
+
+/// Minimal RAII scratch file: unique per (label, pid, nanosecond timestamp),
+/// removed on drop even if the test panics partway through.
+struct ScratchFile(PathBuf);
+
+impl ScratchFile {
+    /// `ext` is the extension ffmpeg/the encoder picks its container format
+    /// from (`"mp4"`, `"gif"`, ...) — omitting it makes ffmpeg fail at
+    /// muxer selection before ever touching the path, which would make a
+    /// debris-after-failure test pass for the wrong reason.
+    fn new(label: &str, ext: &str) -> Self {
+        let unique = format!(
+            "rustmotion-audit-ws-c-{label}-{}-{}.{ext}",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .expect("system clock before UNIX epoch")
+                .as_nanos()
+        );
+        Self(std::env::temp_dir().join(unique))
+    }
+
+    fn path(&self) -> &std::path::Path {
+        &self.0
+    }
+
+    fn to_str(&self) -> &str {
+        self.0.to_str().expect("scratch path must be UTF-8")
+    }
+}
+
+impl Drop for ScratchFile {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_file(&self.0);
+    }
+}
+
+fn ffmpeg_on_path() -> bool {
+    std::process::Command::new("ffmpeg")
+        .args(["-version"])
+        .stdout(std::process::Stdio::null())
+        .stderr(std::process::Stdio::null())
+        .status()
+        .map(|s| s.success())
+        .unwrap_or(false)
+}
+
+// ─── A render ffmpeg rejects must leave no debris at output_path ──────────
+//
+// `encode_with_ffmpeg`/`encode_with_ffmpeg_hw` used to hand ffmpeg the
+// user's own `output_path` directly, drop stdin and gracefully wait no
+// matter how the frame loop ended. A failure mid-render (a broken pipe, or
+// ffmpeg itself exiting non-zero) still let ffmpeg finalize whatever it had
+// already received at that exact path, and `-y` meant it would even
+// overwrite a previously-good render there. No cleanup ran on any error
+// path.
+//
+// Forcing rustmotion's *own* frame renderer to fail deterministically isn't
+// possible from a plain scenario — `Painter::paint_content` cannot return an
+// `Err`, so no user-authored content can fail a frame. ffmpeg itself,
+// though, refuses an odd width under the crate's default 10-bit H.264
+// profile (`yuv420p10le` needs even 4:2:0 chroma dimensions) — confirmed by
+// hand: `ffmpeg -f rawvideo ... -video_size 321x240 ... -c:v libx264
+// -profile:v high10 -pix_fmt yuv420p10le out.mp4` creates a 0-byte
+// `out.mp4` and then fails to open its encoder, closing stdin before
+// rustmotion finishes writing frames — exactly the "ffmpeg already has a
+// file open at output_path when the failure happens" shape this test cares
+// about, without needing an internal render failure at all.
+#[test]
+fn a_render_ffmpeg_rejects_leaves_no_debris_at_the_output_path() {
+    if !ffmpeg_on_path() {
+        eprintln!(
+            "a_render_ffmpeg_rejects_leaves_no_debris_at_the_output_path: \
+             ffmpeg not found — skipping"
+        );
+        return;
+    }
+
+    let json = r#"{"video": {"width": 321, "height": 240, "fps": 10},
+                    "scenes": [{"duration": 0.3, "children": []}]}"#;
+    let scenario = rustmotion::loader::load_scenario_from_source(None, Some(json)).expect("load");
+
+    let out = ScratchFile::new("odd-width", "mp4");
+    let _ = std::fs::remove_file(out.path());
+
+    let result = rustmotion::encode::encode_with_ffmpeg(
+        &scenario,
+        out.to_str(),
+        true,
+        "h264",
+        None,
+        false,
+        None,
+    );
+
+    assert!(
+        result.is_err(),
+        "an odd width (321) must make libx264's high10/yuv420p10le encoder \
+         init fail — this test's premise depends on ffmpeg actually rejecting it"
+    );
+    assert!(
+        !out.path().exists(),
+        "no file — truncated, empty, or otherwise — may be left at output_path \
+         after a failed render; got one at {}",
+        out.path().display()
+    );
+}

From 58c145e7626f718433f1dd425d502d5bcaa02ace Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 10:52:56 +0200
Subject: [PATCH 06/56] perf(gif): decode a gif once across rayon workers
 (#239)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Triggering scenario: a scenario with one gif component, rendered to MP4.
encode_with_ffmpeg (ffmpeg.rs:582) dispatches the FIRST chunk of batch_size
= rayon::current_num_threads() * 2 frames — all frames 0..N of the same
scene — to par_iter() at once. Every one of those workers calls
Gif::paint_content, every one misses the still-empty gif_cache, and every
one runs decode_composed_frames independently. Unlike icons and videos, GIFs
are NOT preloaded (preload.rs only walks Component::Icon and
Component::Video), so the first decode genuinely happens inside the parallel
section. Each decode is itself unbounded: decode_composed_frames pushes one
full-canvas RGBA copy per GIF frame with no cap (gif.rs:141). A 600-frame
800x600 GIF is 1.15 GB per decode; on a 16-core machine (batch_size 32) that
is ~37 GB attempted concurrently, then 31 of the 32 results are thrown away
when insert overwrites. The process OOM-kills before frame 33.

Fix: Decode GIFs in the preload pass alongside icons and videos
(preload.rs), so the parallel section only ever hits a warm cache. If lazy
decode must stay, gate it on a per-key single-flight primitive (e.g.
DashMap<String, Arc<OnceLock<GifData>>> — insert the empty cell under the
shard lock, then let exactly one worker fill it) and cap total decoded
frames per source.

Refs #220
---
 crates/rustmotion-components/src/gif.rs | 112 +++++++++++++++++++++---
 1 file changed, 101 insertions(+), 11 deletions(-)

diff --git a/crates/rustmotion-components/src/gif.rs b/crates/rustmotion-components/src/gif.rs
index e1738e04..529624ca 100644
--- a/crates/rustmotion-components/src/gif.rs
+++ b/crates/rustmotion-components/src/gif.rs
@@ -86,6 +86,22 @@ fn clear_rect(composed: &mut [u8], canvas_w: u32, canvas_h: u32, frame: &gif::Fr
 /// `gif_cache` stores.
 type DecodedGif = (Vec<(Vec<u8>, u32, u32)>, Vec<f64>, f64);
 
+/// Artificial per-decode stall, settable only from this file's own tests
+/// (`DECODE_STALL_MS`) to open a deterministic race window around the
+/// cache-miss branch without timing-dependent sleeps sprinkled through the
+/// test itself. Zero by default, and compiled out entirely in a non-test
+/// build — no production cost.
+#[cfg(test)]
+static DECODE_STALL_MS: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
+
+#[cfg(test)]
+fn stall_decode_for_tests() {
+    let stall_ms = DECODE_STALL_MS.load(std::sync::atomic::Ordering::SeqCst);
+    if stall_ms > 0 {
+        std::thread::sleep(std::time::Duration::from_millis(stall_ms));
+    }
+}
+
 /// Decode a GIF into full-canvas RGBA frames, their cumulative end times, and
 /// the total duration.
 ///
@@ -123,6 +139,9 @@ fn decode_composed_frames(src: &str) -> Option<DecodedGif> {
     let canvas_w = decoder.width() as u32;
     let canvas_h = decoder.height() as u32;
 
+    #[cfg(test)]
+    stall_decode_for_tests();
+
     let mut frames: Vec<(Vec<u8>, u32, u32)> = Vec::new();
     let mut cumulative_times: Vec<f64> = Vec::new();
     let mut accumulated = 0.0;
@@ -163,6 +182,21 @@ fn decode_composed_frames(src: &str) -> Option<DecodedGif> {
     Some((frames, cumulative_times, accumulated))
 }
 
+/// Cache lookup with the actual decode folded in, single-flighted through
+/// `DashMap::entry`: a vacant entry holds its shard's write lock for as long
+/// as the closure runs, so a second caller racing the same cache-cold `src`
+/// blocks on that lock instead of starting its own redundant decode. Decode
+/// failure (`decode_composed_frames` returning `None`) leaves the entry
+/// vacant — `or_try_insert_with` never calls `insert` on its `Err` path —
+/// so a broken source is retried rather than permanently cached as absent.
+fn cached_decode(src: &str) -> Option<Arc<DecodedGif>> {
+    gif_cache()
+        .entry(src.to_string())
+        .or_try_insert_with(|| decode_composed_frames(src).map(Arc::new).ok_or(()))
+        .ok()
+        .map(|entry| entry.clone())
+}
+
 impl Painter for Gif {
     fn paint_content(
         &self,
@@ -171,17 +205,8 @@ impl Painter for Gif {
         _props: &AnimatedProperties,
         ctx: &PaintCtx,
     ) {
-        let gcache = gif_cache();
-
-        let cached = if let Some(cached) = gcache.get(&self.src) {
-            cached.clone()
-        } else {
-            let Some(decoded) = decode_composed_frames(&self.src) else {
-                return;
-            };
-            let cached = Arc::new(decoded);
-            gcache.insert(self.src.clone(), cached.clone());
-            cached
+        let Some(cached) = cached_decode(&self.src) else {
+            return;
         };
 
         let (ref frames, ref cumulative_times, total_duration) = *cached;
@@ -302,4 +327,69 @@ mod tests {
         frame.top = 3;
         assert_eq!(frame_rect(4, 4, &frame), (3, 3, 1, 1));
     }
+
+    /// Releases `DECODE_STALL_MS` back to zero even if the test body
+    /// panics mid-assertion, so a failing run never leaks a stall into
+    /// whatever other test in this binary decodes a GIF next.
+    struct StallGuard;
+
+    impl Drop for StallGuard {
+        fn drop(&mut self) {
+            DECODE_STALL_MS.store(0, std::sync::atomic::Ordering::SeqCst);
+        }
+    }
+
+    /// N callers racing a cache-cold `src` must decode it once, not N
+    /// times. A 120ms stall (`DECODE_STALL_MS`) right after the header is
+    /// read opens a race window wide enough that every thread reaches the
+    /// cache-miss branch before any of them can finish decoding and insert —
+    /// pre-fix, that means eight independent decodes, each producing its own
+    /// `Arc` allocation. Comparing pointers (not content — a deterministic
+    /// decode produces byte-identical content either way) is what proves
+    /// only one of the eight actually ran.
+    #[test]
+    fn concurrent_paints_of_the_same_uncached_gif_decode_exactly_once() {
+        let _guard = StallGuard;
+        DECODE_STALL_MS.store(120, std::sync::atomic::Ordering::SeqCst);
+
+        let path = std::env::temp_dir().join(format!(
+            "rustmotion_gif_stampede_{}_{}.gif",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .unwrap()
+                .as_nanos(),
+        ));
+        write_two_frame_gif(&path);
+        let src = path.to_str().expect("utf-8 path").to_string();
+
+        const THREADS: usize = 8;
+        let barrier = std::sync::Arc::new(std::sync::Barrier::new(THREADS));
+        let handles: Vec<_> = (0..THREADS)
+            .map(|_| {
+                let barrier = barrier.clone();
+                let src = src.clone();
+                std::thread::spawn(move || {
+                    barrier.wait();
+                    cached_decode(&src)
+                })
+            })
+            .collect();
+
+        let results: Vec<Option<Arc<DecodedGif>>> =
+            handles.into_iter().map(|h| h.join().unwrap()).collect();
+        std::fs::remove_file(&path).ok();
+
+        let first = results[0].as_ref().expect("gif must decode");
+        for (i, result) in results.iter().enumerate() {
+            let result = result.as_ref().unwrap_or_else(|| {
+                panic!("thread {i} did not get a decoded result");
+            });
+            assert!(
+                Arc::ptr_eq(first, result),
+                "thread {i} observed a different Arc than thread 0 — the GIF was decoded \
+                 more than once for the same cache-cold source"
+            );
+        }
+    }
 }

From 9d4bcb5398e53593399561f00b959c7b9cdf8bbe Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 10:53:28 +0200
Subject: [PATCH 07/56] fix(background): wrap heropattern scroll on its
 per-axis period (#248)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

tile_spacing returns one scalar that line 830 applies to both axes, and the
Heropattern arm never reads d.height. The function's own doc comment states
the invariant it relies on — "since every tiled pattern is exactly periodic
on spacing, translating by any offset congruent mod spacing produces byte-
identical pixels" — which is false for any non-square pattern. I counted the
table programmatically: 41 of the 87 entries in crates/rustmotion-
core/src/engine/heropatterns.rs have width != height (architect 100x199,
aztec 32x64, bamboo 16x32, bank_note 100x20, death_star 80x105, yyy
60x96...). Concrete case: {"animated-background":{"preset":"heropattern","he
ropattern":{"pattern":"aztec"},"direction":"down","speed":60}}. The shader
tiles vertically on 64px but the offset wraps at 32px, so every 32px of
travel the pattern snaps by half a period — a periodic jolt through the
whole scene. The .max(20.0) clamp breaks it a second way for the 8 patterns
narrower than 20px: bamboo (16 wide) wraps at 20, so even horizontal scroll
jumps 4px per wrap. draw_world_bg_with_parallax reuses the same tile_spacing
for the camera-pan modulo (line 89), so world views inherit it.

Fix: Make tile_spacing return a (f32, f32) period and have the Heropattern
arm emit (d.width * cfg.scale, d.height * cfg.scale); wrap raw_x on the x
period and raw_y on the y period at line 830, and do the same for the camera
modulo at line 89. Drop the .max(20.0) floor or replace it with a multiple-
of-period ceiling (period * (20.0 / period).ceil()) so the clamp preserves
periodicity.

Refs #220
---
 .../src/engine/render/background.rs           | 163 ++++++++++++++----
 crates/rustmotion/src/engine/render/scene.rs  |  30 +---
 crates/rustmotion/tests/audit_ws_e.rs         |  18 ++
 3 files changed, 158 insertions(+), 53 deletions(-)
 create mode 100644 crates/rustmotion/tests/audit_ws_e.rs

diff --git a/crates/rustmotion/src/engine/render/background.rs b/crates/rustmotion/src/engine/render/background.rs
index f7a27bb3..2c5d719b 100644
--- a/crates/rustmotion/src/engine/render/background.rs
+++ b/crates/rustmotion/src/engine/render/background.rs
@@ -86,17 +86,17 @@ pub(super) fn draw_world_bg_with_parallax(
         }
         _ => {
             // Grid-based backgrounds: modulo offset for seamless tiling.
-            let spacing = tile_spacing(&bg.preset);
-            let offset_x = -(cam_x % spacing);
-            let offset_y = -(cam_y % spacing);
+            let (spacing_x, spacing_y) = tile_spacing(&bg.preset);
+            let offset_x = -(cam_x % spacing_x);
+            let offset_y = -(cam_y % spacing_y);
             canvas.save();
             canvas.translate((offset_x, offset_y));
             draw_animated_background(
                 canvas,
                 bg,
                 time,
-                width + spacing * 2.0,
-                height + spacing * 2.0,
+                width + spacing_x * 2.0,
+                height + spacing_y * 2.0,
             );
             canvas.restore();
         }
@@ -788,29 +788,67 @@ pub(super) fn interpolate_animated_bg(
     }
 }
 
-/// Tile period (px) a preset's own draw loop repeats on — the amount by
-/// which a scroll offset can be wrapped without changing the rendered
-/// pattern. Shared by `compute_scroll_offset` (below) and
-/// `draw_world_bg_with_parallax`'s camera-pan modulo so the two never
-/// diverge on what "one period" means for a given preset.
-fn tile_spacing(preset: &BackgroundPreset) -> f32 {
+/// Per-axis tile period (px) a preset's own draw loop repeats on — the
+/// amount by which a scroll offset can be wrapped, independently per axis,
+/// without changing the rendered pattern. Shared by `compute_scroll_offset`
+/// (below) and `draw_world_bg_with_parallax`'s camera-pan modulo so the two
+/// never diverge on what "one period" means for a given preset.
+///
+/// Every preset but `Heropattern` tiles on a square cell, so both axes share
+/// one scalar. Heropattern is the one exception: most of the 87 bundled SVGs
+/// are not square (e.g. `aztec` is 32×64), so wrapping the vertical offset
+/// on the horizontal period desyncs the two axes and the pattern snaps at
+/// every wrap.
+fn tile_spacing(preset: &BackgroundPreset) -> (f32, f32) {
     match preset {
-        BackgroundPreset::GridDots(cfg) => cfg.spacing.max(20.0),
-        BackgroundPreset::GridLines(cfg) => cfg.cell.max(4.0),
-        // The lattice repeats on `spacing`, so the world-view camera can wrap
-        // on it and the tiling stays seamless as the camera pans.
-        BackgroundPreset::PixelGrid(cfg) => cfg.spacing.max(cfg.size.max(1.0)),
-        BackgroundPreset::ConcentricCircles(cfg) => cfg.spacing.max(20.0),
+        BackgroundPreset::GridDots(cfg) => {
+            let s = cfg.spacing.max(20.0);
+            (s, s)
+        }
+        BackgroundPreset::GridLines(cfg) => {
+            let s = cfg.cell.max(4.0);
+            (s, s)
+        }
+        BackgroundPreset::PixelGrid(cfg) => {
+            let s = cfg.spacing.max(cfg.size.max(1.0));
+            (s, s)
+        }
+        BackgroundPreset::ConcentricCircles(cfg) => {
+            let s = cfg.spacing.max(20.0);
+            (s, s)
+        }
         BackgroundPreset::Heropattern(cfg) => {
-            let def = crate::engine::heropatterns::find_pattern(&cfg.pattern);
-            def.map(|d| d.width * cfg.scale).unwrap_or(60.0).max(20.0)
+            match crate::engine::heropatterns::find_pattern(&cfg.pattern) {
+                Some(d) => (
+                    period_floor(d.width * cfg.scale, 20.0),
+                    period_floor(d.height * cfg.scale, 20.0),
+                ),
+                None => (60.0, 60.0),
+            }
         }
-        _ => 60.0_f32.max(20.0),
+        _ => (60.0, 60.0),
+    }
+}
+
+/// Raise `period` to the smallest multiple of itself that is at least
+/// `floor`, instead of clamping it outright to `floor`. A plain clamp would
+/// no longer be a multiple of the pattern's own period, breaking the
+/// periodicity `compute_scroll_offset`'s wrap depends on for any pattern
+/// narrower/shorter than `floor` (e.g. `bamboo`, 16px wide). Non-positive
+/// `period` has no well-defined multiple; `floor` is the fallback.
+fn period_floor(period: f32, floor: f32) -> f32 {
+    if period <= 0.0 {
+        floor
+    } else if period >= floor {
+        period
+    } else {
+        period * (floor / period).ceil()
     }
 }
 
 /// Compute the scroll offset for tiled backgrounds based on direction +
-/// speed, wrapped into `(-spacing, spacing)` so it never grows unbounded.
+/// speed, wrapped into `(-spacing, spacing)` per axis so it never grows
+/// unbounded.
 ///
 /// Bug this fixes: the offset used to grow linearly with `time` forever.
 /// The tiled draw loops (`draw_bg_grid_dots`, `draw_bg_heropattern`) only
@@ -818,16 +856,16 @@ fn tile_spacing(preset: &BackgroundPreset) -> f32 {
 /// canvas translated by an unbounded offset, the pattern slides off-frame
 /// and leaves a growing blank band once the offset exceeds that one-tile
 /// margin (see paint.md finding #5). Since every tiled pattern is exactly
-/// periodic on `spacing`, translating by any offset congruent mod `spacing`
-/// produces byte-identical pixels — Rust's `%` already returns a value with
-/// `|result| < spacing` and the same sign as the input, which is exactly
-/// the symmetric `(-spacing, spacing)` margin the (now-symmetric, see
-/// `draw_bg_grid_dots`) draw loops need. `t=0` (or `speed=0`) stays an exact
-/// `(0.0, 0.0)` no-op — `0.0 % spacing == 0.0`.
+/// periodic on its own `tile_spacing`, translating by any offset congruent
+/// mod that period produces byte-identical pixels — Rust's `%` already
+/// returns a value with `|result| < spacing` and the same sign as the
+/// input, which is exactly the symmetric `(-spacing, spacing)` margin the
+/// (now-symmetric, see `draw_bg_grid_dots`) draw loops need. `t=0` (or
+/// `speed=0`) stays an exact `(0.0, 0.0)` no-op — `0.0 % spacing == 0.0`.
 pub(super) fn compute_scroll_offset(bg: &AnimatedBackground, time: f32) -> (f32, f32) {
     let (raw_x, raw_y) = raw_scroll_offset(bg, time);
-    let spacing = tile_spacing(&bg.preset);
-    (raw_x % spacing, raw_y % spacing)
+    let (spacing_x, spacing_y) = tile_spacing(&bg.preset);
+    (raw_x % spacing_x, raw_y % spacing_y)
 }
 
 /// The unwrapped scroll offset — how far the pattern *would* have travelled
@@ -1248,7 +1286,7 @@ mod pixel_grid_tests {
         let mut c = cfg();
         c.size = 40.0;
         c.spacing = 8.0;
-        assert_eq!(tile_spacing(&BackgroundPreset::PixelGrid(c)), 40.0);
+        assert_eq!(tile_spacing(&BackgroundPreset::PixelGrid(c)), (40.0, 40.0));
     }
 
     /// `twinkle` has to reach both ends. A cell that only dips to 10 % still
@@ -1420,3 +1458,68 @@ mod grid_lines_tests {
         assert_eq!(buf.len(), (W * H * 4) as usize, "it still produced a frame");
     }
 }
+
+#[cfg(test)]
+mod heropattern_period_tests {
+    //! `tile_spacing` used to return the Heropattern's *width* as the
+    //! period on both axes. 41 of the 87 bundled SVGs are not square (e.g.
+    //! `aztec` is 32x64 — see `crates/rustmotion-core/src/engine/heropatterns.rs`),
+    //! so wrapping the vertical offset on the horizontal period snaps the
+    //! pattern mid-tile on every wrap.
+
+    use super::*;
+    use crate::schema::HeropatternConfig;
+
+    fn hero_bg(pattern: &str, direction: ScrollDirection, speed: f32) -> AnimatedBackground {
+        AnimatedBackground {
+            preset: BackgroundPreset::Heropattern(HeropatternConfig {
+                pattern: pattern.to_string(),
+                color: "#FFFFFF".to_string(),
+                opacity: 0.1,
+                scale: 1.0,
+            }),
+            x: 0.0,
+            y: 0.0,
+            speed,
+            direction: Some(direction),
+        }
+    }
+
+    #[test]
+    fn tile_spacing_is_per_axis_for_a_non_square_pattern() {
+        let bg = hero_bg("aztec", ScrollDirection::Down, 60.0);
+        let (spacing_x, spacing_y) = tile_spacing(&bg.preset);
+        assert_eq!(spacing_x, 32.0, "x period must be the pattern's own width");
+        assert_eq!(
+            spacing_y, 64.0,
+            "y period must be the pattern's own height, not its width"
+        );
+    }
+
+    #[test]
+    fn vertical_scroll_does_not_wrap_at_half_the_tile_height() {
+        let bg = hero_bg("aztec", ScrollDirection::Down, 60.0);
+        // 48px of vertical travel sits strictly between one width-period
+        // (32px — where the pre-fix code would wrap) and the pattern's
+        // actual 64px height: the correct wrap leaves it untouched, the bug
+        // wraps it down to 48 % 32 = 16.
+        let t = 48.0 / 60.0;
+        let (_dx, dy) = compute_scroll_offset(&bg, t);
+        assert!(
+            (dy - 48.0).abs() < 1e-2,
+            "48px of vertical travel is under one tile height (64px) and must not wrap yet, got dy={dy}"
+        );
+    }
+
+    #[test]
+    fn narrow_pattern_wraps_on_a_whole_multiple_of_its_own_period() {
+        let bg = hero_bg("bamboo", ScrollDirection::Right, 60.0);
+        let (spacing_x, _spacing_y) = tile_spacing(&bg.preset);
+        assert_eq!(
+            spacing_x % 16.0,
+            0.0,
+            "the clamped period must stay a whole multiple of the pattern's own 16px width, got {spacing_x}"
+        );
+        assert!(spacing_x >= 20.0);
+    }
+}
diff --git a/crates/rustmotion/src/engine/render/scene.rs b/crates/rustmotion/src/engine/render/scene.rs
index c6932b66..dde851e3 100644
--- a/crates/rustmotion/src/engine/render/scene.rs
+++ b/crates/rustmotion/src/engine/render/scene.rs
@@ -11,31 +11,11 @@ use rustmotion_core::css::style::{
     JustifyContent as CssJustifyContent,
 };
 use rustmotion_core::css::taffy_bridge::ConversionContext;
-use rustmotion_core::css::units::{LengthContext, LengthPercentage};
+use rustmotion_core::css::units::LengthPercentage;
 use rustmotion_core::engine::animator::safe_div;
 use rustmotion_core::engine::paint_pass::PlaneCamera;
 use rustmotion_core::engine::renderer::color4f_from_hex;
 
-/// Build the `ConversionContext` that resolves `vw`/`vh`/`%` units for a
-/// layout pass, anchored to the *real* output viewport instead of
-/// `ConversionContext::default()`'s hardcoded 1920×1080 (round 4 audit,
-/// lot LAYOUT, constat 1). On a 1080×1920 vertical video — a resolution
-/// this project documents as a common target — `width: "50vw"` used to
-/// resolve as 50% of a phantom 1920px-wide viewport (960px) instead of 50%
-/// of the real 1080px one (540px), a 78% error, and `vh` was off by the
-/// same margin in the other axis. `font-size`/`root-font-size` stay at the
-/// CSS initial `16px`: nothing upstream of this call resolves and threads a
-/// root font-size through yet.
-fn viewport_conversion_context(viewport_w: f32, viewport_h: f32) -> ConversionContext {
-    ConversionContext {
-        length: LengthContext {
-            viewport_width: viewport_w,
-            viewport_height: viewport_h,
-            ..LengthContext::default()
-        },
-    }
-}
-
 /// The single choke-point that turns "a frame of this scene" into the time
 /// value every render path in this file feeds into the background draw, the
 /// camera transform, and the component tree (`RenderContext.time`, and from
@@ -554,7 +534,7 @@ fn render_with_new_pipeline_iter<'a, I>(
     let layout = run_layout(
         &built.root,
         (viewport_w, viewport_h),
-        &viewport_conversion_context(viewport_w, viewport_h),
+        &ConversionContext::for_viewport(viewport_w, viewport_h),
     );
     let dispatcher = LegacyPaintDispatcher::for_scene(&built);
     let frame = PaintFrame {
@@ -789,7 +769,11 @@ pub fn render_scene_hits(
         fps: config.fps,
     });
     let built = build_scene_from_refs(children.iter(), (vw, vh), root_css, anim);
-    let layout = run_layout(&built.root, (vw, vh), &viewport_conversion_context(vw, vh));
+    let layout = run_layout(
+        &built.root,
+        (vw, vh),
+        &ConversionContext::for_viewport(vw, vh),
+    );
     let dispatcher = LegacyPaintDispatcher::for_scene(&built);
     let frame = PaintFrame {
         time,
diff --git a/crates/rustmotion/tests/audit_ws_e.rs b/crates/rustmotion/tests/audit_ws_e.rs
new file mode 100644
index 00000000..5a2f31eb
--- /dev/null
+++ b/crates/rustmotion/tests/audit_ws_e.rs
@@ -0,0 +1,18 @@
+//! Regression tests — audit round chantier/audit-2026-09, workstream E
+//! (animated backgrounds & the scene render path).
+//!
+//! Two of the four findings are bugs in fully private
+//! rendering internals (`background.rs`'s `tile_spacing`/`compute_scroll_offset`/
+//! `draw_bg_heropattern`) that this crate never exposes past its `pub`
+//! surface — an external integration test crate like this one cannot name
+//! them. Their regression tests live as `#[cfg(test)]` modules inside
+//! `crates/rustmotion/src/engine/render/background.rs` itself, following
+//! that file's own pre-existing convention (`scroll_offset_wrap_tests`,
+//! `pixel_grid_tests`, `grid_lines_tests`, `halo_opacity_tests`) for testing
+//! renderer-private logic directly. This file carries the findings that are
+//! genuinely reachable through the crate's public API.
+//!
+//! One section per finding: the paint path, then colour templating.
+
+use rustmotion::encode::video::{build_frame_tasks, render_frame_task, FrameTask};
+use rustmotion::loader::load_scenario_from_source;

From 1952295af348e4739e45dc0df8f91f9b91ddf917 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 10:53:41 +0200
Subject: [PATCH 08/56] fix(html): reject unknown scene attributes instead of
 dropping them (#252)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Executed: <scene duration="2" freeze_at="1" world-position="0,0" animated-
background="halo"> transpiles to a scene carrying only duration and layout —
three documented scene features (CLAUDE.md documents all three) are
discarded with no warning and validate exits 0. Same on the root:
<rustmotion codec="prores" durationn="5"> drops both. Same on
containers/text: <div gap="32" width="400" id="x"> keeps nothing but
style/anim (element.rs:101-112 and :92-100 never iterate attrs). This is the
exact failure mode check_component_attrs exists to prevent, but that check
runs on the already-transpiled ResolvedScenario (validate_attrs.rs:79
check_component_attrs(scenario: &ResolvedScenario)) and only over
scene.children — an attribute the transpiler never emitted is invisible to
it, so the workspace's only unknown-attribute net has a blind spot precisely
over the HTML front-end's own attribute surface. rm-* custom elements are
the asymmetric exception: they forward everything and do get caught.

Fix: After reading the known keys in scene_to_value and
html_to_scenario_value, diff against the consumed set and return a named
error (with did-you-mean, mirroring validate_attrs) for the remainder —
class/id/data-* can be allowlisted as deliberately inert. Do the same for
TagKind::Container/TagKind::Text. Separately, extend <scene>'s allowlist to
cover freeze_at, world-position and animated-background, which are otherwise
unreachable from HTML.

Refs #220
---
 crates/rustmotion-html/src/element.rs      |   6 +-
 crates/rustmotion-html/src/lib.rs          | 115 +++++++++++++++++++++
 crates/rustmotion-html/src/scene.rs        |  72 ++++++++++++-
 crates/rustmotion-html/tests/audit_ws_f.rs |  97 +++++++++++++++++
 4 files changed, 288 insertions(+), 2 deletions(-)
 create mode 100644 crates/rustmotion-html/tests/audit_ws_f.rs

diff --git a/crates/rustmotion-html/src/element.rs b/crates/rustmotion-html/src/element.rs
index c308265a..b370f658 100644
--- a/crates/rustmotion-html/src/element.rs
+++ b/crates/rustmotion-html/src/element.rs
@@ -2,7 +2,9 @@ use markup5ever_rcdom::{Handle, NodeData};
 use serde_json::{Map, Value};
 
 use crate::style::{coerce_value, parse_anim_attr, parse_inline_style};
-use crate::{element_attrs, tag_name, HtmlError};
+use crate::{check_known_attrs, element_attrs, tag_name, HtmlError};
+
+const KNOWN_NATIVE_ATTRS: &[&str] = &["style", "anim"];
 
 enum TagKind {
     Container,
@@ -90,6 +92,7 @@ pub(crate) fn element_to_value(handle: &Handle) -> Result<Option<Value>, HtmlErr
             suggestion: suggestion.to_string(),
         }),
         TagKind::Text => {
+            check_known_attrs(&tag, &attrs, KNOWN_NATIVE_ATTRS)?;
             let mut obj = Map::new();
             obj.insert("type".into(), Value::from("text"));
             obj.insert("content".into(), Value::from(inner_text(handle)));
@@ -99,6 +102,7 @@ pub(crate) fn element_to_value(handle: &Handle) -> Result<Option<Value>, HtmlErr
             Ok(Some(Value::Object(obj)))
         }
         TagKind::Container => {
+            check_known_attrs(&tag, &attrs, KNOWN_NATIVE_ATTRS)?;
             let mut obj = Map::new();
             obj.insert("type".into(), Value::from("div"));
             if let Some(style) = style_object(&attrs)? {
diff --git a/crates/rustmotion-html/src/lib.rs b/crates/rustmotion-html/src/lib.rs
index 092bd1d8..69d9ea43 100644
--- a/crates/rustmotion-html/src/lib.rs
+++ b/crates/rustmotion-html/src/lib.rs
@@ -97,6 +97,44 @@ pub enum HtmlError {
         "<scene> found nested inside <{parent}> — <scene> elements must be direct children of <rustmotion> (only <font> is recursed into)"
     )]
     NestedScene { parent: String },
+    /// Emitted when an element carries an attribute the transpiler never
+    /// reads. `<rustmotion>`, `<scene>`, and native container/text tags only
+    /// ever consume a fixed, small set of attribute names — anything else
+    /// used to vanish with no trace, invisible to `--strict-attrs` because
+    /// it never reached the emitted JSON in the first place.
+    #[error("<{element}> has unsupported attribute(s): {detail} — these are silently ignored today; fix the typo, drop them, or use the attribute the dialect actually reads")]
+    UnknownAttributes { element: String, detail: String },
+    /// Emitted for a `<scene>`'s `world-position` attribute that is neither
+    /// `"x,y"` nor a JSON `{"x":..,"y":..}` object.
+    #[error("world-position=\"{0}\" is not \"x,y\" or a JSON object {{\"x\":..,\"y\":..}}")]
+    InvalidWorldPosition(String),
+    /// Emitted for a `<scene>`'s `animated-background` attribute when its
+    /// value starts with `{`/`[` but fails to parse as JSON.
+    #[error("animated-background attribute contains invalid JSON: {0}")]
+    InvalidAnimatedBackgroundJson(String),
+    /// Emitted for a `style="..."` declaration whose value has more than one
+    /// top-level (paren-aware) token and isn't one of the shorthands the
+    /// transpiler knows how to expand (`padding`/`margin`/`border-radius`'s
+    /// 1-4 value box form, `grid-template-columns`/`-rows`'s track list with
+    /// `repeat()`/`minmax()`). Every other multi-token value used to become
+    /// an opaque string the core length parser cannot read, silently
+    /// resolving to `0px`.
+    #[error("style property '{prop}' has an unsupported multi-token value '{value}' — supported multi-token forms are the padding/margin/border-radius box shorthand and grid-template-columns/-rows track lists with repeat()/minmax(); rewrite as a single value")]
+    UnsupportedStyleShorthand { prop: String, value: String },
+    /// Emitted when a `<script>`/`<img>`/`<svg>`/`<rm-*>`/container element
+    /// is found nested inside an inline text element (`p`/`span`/`h1..h6`/
+    /// `strong`/`em`/`label`). Those flatten their whole subtree to a plain
+    /// string — a nested element with real content (a component, a shape, a
+    /// child container) has nowhere to go and used to either bleed its raw
+    /// source into the string or vanish outright.
+    #[error("<{tag}> cannot appear inside an inline text element (p/span/h1..h6/strong/em/label) — those flatten their content to a plain string, so <{tag}>'s own content would be silently lost; move it outside as a sibling, or wrap the text in a <div>/<rm-*> container instead")]
+    TextContentUnsupportedChild { tag: String },
+    /// Emitted when the HTML serializer itself fails (I/O error into an
+    /// in-memory buffer, or non-UTF-8 output) inside the studio write-back
+    /// path. The write-back functions refuse (return `None`) rather than
+    /// hand the caller a partial or empty buffer to write to disk.
+    #[error("failed to serialize the rewritten HTML: {0}")]
+    SerializeFailed(String),
 }
 
 /// Transpile an HTML-dialect document into the scenario `serde_json::Value` that
@@ -108,6 +146,12 @@ pub fn html_to_scenario_value(html: &str) -> Result<Value, HtmlError> {
     let attrs = element_attrs(&root);
     let get = |k: &str| attrs.iter().find(|(n, _)| n == k).map(|(_, v)| v.clone());
 
+    check_known_attrs(
+        "rustmotion",
+        &attrs,
+        &["width", "height", "fps", "background", "codec", "crf"],
+    )?;
+
     let width = get("width").ok_or(HtmlError::MissingDimensions)?;
     let height = get("height").ok_or(HtmlError::MissingDimensions)?;
 
@@ -120,6 +164,12 @@ pub fn html_to_scenario_value(html: &str) -> Result<Value, HtmlError> {
     if let Some(bg) = get("background") {
         video.insert("background".into(), parse_background_attr(&bg)?);
     }
+    if let Some(codec) = get("codec") {
+        video.insert("codec".into(), style::coerce_value(&codec));
+    }
+    if let Some(crf) = get("crf") {
+        video.insert("crf".into(), style::coerce_value(&crf));
+    }
 
     let mut scenes = Vec::new();
     let mut fonts = Vec::new();
@@ -263,6 +313,71 @@ pub(crate) fn element_attrs(handle: &Handle) -> Vec<(String, String)> {
     }
 }
 
+/// `class`/`id`/`data-*` are accepted anywhere and never reach the emitted
+/// scenario JSON — deliberately inert, not a signal of an unread attribute.
+fn is_inert_attr(name: &str) -> bool {
+    name == "class" || name == "id" || name.starts_with("data-")
+}
+
+/// Fail on any attribute of `element` outside `known` (plus the always-inert
+/// `class`/`id`/`data-*`), naming every offender in one error with a
+/// did-you-mean suggestion against `known`. This is what closes the gap
+/// `check_component_attrs` (`rustmotion`'s `--strict-attrs`) cannot: that
+/// check only sees attributes the transpiler already forwarded into the
+/// scenario JSON, so an attribute dropped here was invisible to it.
+pub(crate) fn check_known_attrs(
+    element: &str,
+    attrs: &[(String, String)],
+    known: &[&str],
+) -> Result<(), HtmlError> {
+    let unknown: Vec<&str> = attrs
+        .iter()
+        .map(|(k, _)| k.as_str())
+        .filter(|k| !known.contains(k) && !is_inert_attr(k))
+        .collect();
+    if unknown.is_empty() {
+        return Ok(());
+    }
+    let detail = unknown
+        .iter()
+        .map(|name| match suggest(name, known) {
+            Some(k) => format!("'{name}' (did you mean '{k}'?)"),
+            None => format!("'{name}'"),
+        })
+        .collect::<Vec<_>>()
+        .join(", ");
+    Err(HtmlError::UnknownAttributes {
+        element: element.to_string(),
+        detail,
+    })
+}
+
+/// The closest entry in `known` to `name` (Levenshtein distance <= 2), or
+/// `None` when nothing is close enough to be worth suggesting.
+fn suggest<'a>(name: &str, known: &[&'a str]) -> Option<&'a str> {
+    known
+        .iter()
+        .map(|k| (levenshtein(name, k), *k))
+        .min_by_key(|(distance, _)| *distance)
+        .filter(|(distance, _)| *distance <= 2)
+        .map(|(_, k)| k)
+}
+
+fn levenshtein(a: &str, b: &str) -> usize {
+    let a: Vec<char> = a.chars().collect();
+    let b: Vec<char> = b.chars().collect();
+    let mut prev: Vec<usize> = (0..=b.len()).collect();
+    for (i, ca) in a.iter().enumerate() {
+        let mut cur = vec![i + 1];
+        for (j, cb) in b.iter().enumerate() {
+            let cost = usize::from(ca != cb);
+            cur.push((prev[j] + cost).min(prev[j + 1] + 1).min(cur[j] + 1));
+        }
+        prev = cur;
+    }
+    prev[b.len()]
+}
+
 /// Depth-first: the first descendant element with the given tag name.
 pub(crate) fn find_element(handle: &Handle, tag: &str) -> Option<Handle> {
     for child in handle.children.borrow().iter() {
diff --git a/crates/rustmotion-html/src/scene.rs b/crates/rustmotion-html/src/scene.rs
index 7f711de8..1e95523f 100644
--- a/crates/rustmotion-html/src/scene.rs
+++ b/crates/rustmotion-html/src/scene.rs
@@ -5,7 +5,24 @@ use crate::element::children_to_values;
 use crate::element_attrs;
 use crate::parse_background_attr;
 use crate::style::coerce_value;
-use crate::HtmlError;
+use crate::{check_known_attrs, HtmlError};
+
+const KNOWN_SCENE_ATTRS: &[&str] = &[
+    "duration",
+    "align",
+    "justify",
+    "direction",
+    "gap",
+    "padding",
+    "background",
+    "effects",
+    "transition",
+    "transition-duration",
+    "transition-easing",
+    "freeze_at",
+    "world-position",
+    "animated-background",
+];
 
 /// Parse an `effects` attribute value: must be a JSON array.
 fn parse_effects_attr(raw: &str) -> Result<Value, HtmlError> {
@@ -13,10 +30,50 @@ fn parse_effects_attr(raw: &str) -> Result<Value, HtmlError> {
     serde_json::from_str(trimmed).map_err(|e| HtmlError::InvalidEffectsJson(e.to_string()))
 }
 
+/// Parse a `world-position` attribute: either `"x,y"` (the idiomatic HTML
+/// form, mirroring `font`'s `weights="400,700"` CSV convention) or a JSON
+/// `{"x":..,"y":..}` object, matching `WorldPosition`'s wire shape.
+fn parse_world_position_attr(raw: &str) -> Result<Value, HtmlError> {
+    let trimmed = raw.trim();
+    if trimmed.starts_with('{') {
+        return serde_json::from_str(trimmed)
+            .map_err(|_| HtmlError::InvalidWorldPosition(raw.to_string()));
+    }
+    let parts: Vec<&str> = trimmed.split(',').map(str::trim).collect();
+    let [x, y] = parts.as_slice() else {
+        return Err(HtmlError::InvalidWorldPosition(raw.to_string()));
+    };
+    let x: f32 = x
+        .parse()
+        .map_err(|_| HtmlError::InvalidWorldPosition(raw.to_string()))?;
+    let y: f32 = y
+        .parse()
+        .map_err(|_| HtmlError::InvalidWorldPosition(raw.to_string()))?;
+    Ok(serde_json::json!({ "x": x, "y": y }))
+}
+
+/// Parse an `animated-background` attribute: JSON object/array (matching
+/// `scene["animated-background"]`'s `AnimatedBackground` shape, e.g.
+/// `{"preset":"halo","halo":{...},"speed":0}`) if it starts with `{`/`[`,
+/// otherwise a bare string (left for the typed scenario loader to reject —
+/// no preset is nameable without its config, so this never has a legitimate
+/// bare-string form, but the reachable-attribute goal is what matters here:
+/// the value now always reaches the JSON instead of vanishing before it).
+fn parse_animated_background_attr(raw: &str) -> Result<Value, HtmlError> {
+    let trimmed = raw.trim();
+    if trimmed.starts_with('{') || trimmed.starts_with('[') {
+        serde_json::from_str(trimmed)
+            .map_err(|e| HtmlError::InvalidAnimatedBackgroundJson(e.to_string()))
+    } else {
+        Ok(Value::from(raw))
+    }
+}
+
 /// Map a `<scene>` element to a scene JSON object. Defaults to a centered flex
 /// layout (overridable via `align`/`justify`/`direction`/`gap`/`padding` attrs).
 pub(crate) fn scene_to_value(handle: &Handle) -> Result<Value, HtmlError> {
     let attrs = element_attrs(handle);
+    check_known_attrs("scene", &attrs, KNOWN_SCENE_ATTRS)?;
     let get = |k: &str| attrs.iter().find(|(n, _)| n == k).map(|(_, v)| v.clone());
 
     let duration = get("duration").ok_or(HtmlError::MissingDuration)?;
@@ -77,6 +134,19 @@ pub(crate) fn scene_to_value(handle: &Handle) -> Result<Value, HtmlError> {
         return Err(HtmlError::TransitionParamsWithoutTransition);
     }
 
+    if let Some(fa) = get("freeze_at") {
+        obj.insert("freeze_at".into(), coerce_value(&fa));
+    }
+    if let Some(wp) = get("world-position") {
+        obj.insert("world-position".into(), parse_world_position_attr(&wp)?);
+    }
+    if let Some(ab) = get("animated-background") {
+        obj.insert(
+            "animated-background".into(),
+            parse_animated_background_attr(&ab)?,
+        );
+    }
+
     obj.insert("children".into(), Value::Array(children_to_values(handle)?));
     Ok(Value::Object(obj))
 }
diff --git a/crates/rustmotion-html/tests/audit_ws_f.rs b/crates/rustmotion-html/tests/audit_ws_f.rs
new file mode 100644
index 00000000..2230e257
--- /dev/null
+++ b/crates/rustmotion-html/tests/audit_ws_f.rs
@@ -0,0 +1,97 @@
+//! Regression tests for workstream F's 4 confirmed audit findings on the
+//! HTML dialect transpiler: an attribute outside a hardcoded allowlist
+//! vanishing with no error, a CSS shorthand transpiling to a string
+//! the core length parser cannot read and silently resolving to 0px,
+//! `<script>`/`<style>` source getting painted as text while `<img>`/`<svg>`
+//! children vanish inside inline text elements, and the studio's
+//! HTML write-back deleting everything outside `<rustmotion>` in the
+//! author's file.
+
+use rustmotion_html::{html_to_scenario_value, HtmlError};
+use serde_json::json;
+
+// ---------------------------------------------------------------------------
+// <scene> and <rustmotion> read a hardcoded attribute allowlist;
+// every other attribute is dropped with no error.
+// ---------------------------------------------------------------------------
+
+#[test]
+fn scene_freeze_at_world_position_and_animated_background_are_reachable() {
+    let html = r##"<rustmotion width="1920" height="1080"><scene duration="2" freeze_at="1" world-position="10,20" animated-background='{"preset":"halo","halo":{"zones":[{"color":"#7c3aed","x":0.5,"y":0.5,"radius":0.4}]},"speed":0}'><h1>Hi</h1></scene></rustmotion>"##;
+    let v = html_to_scenario_value(html).expect("known scene attributes must transpile");
+    assert_eq!(v["scenes"][0]["freeze_at"], json!(1));
+    assert_eq!(v["scenes"][0]["world-position"]["x"], json!(10.0));
+    assert_eq!(v["scenes"][0]["world-position"]["y"], json!(20.0));
+    assert_eq!(
+        v["scenes"][0]["animated-background"]["preset"],
+        json!("halo")
+    );
+}
+
+#[test]
+fn scene_unknown_attribute_is_refused_not_dropped() {
+    let html = r##"<rustmotion width="1920" height="1080"><scene duration="2" bogus-attr="x"><h1>Hi</h1></scene></rustmotion>"##;
+    let err = html_to_scenario_value(html)
+        .expect_err("an unknown <scene> attribute must be refused, not silently dropped");
+    match err {
+        HtmlError::UnknownAttributes { element, detail } => {
+            assert_eq!(element, "scene");
+            assert!(detail.contains("bogus-attr"), "got: {detail}");
+        }
+        other => panic!("expected UnknownAttributes, got: {other:?}"),
+    }
+}
+
+#[test]
+fn root_codec_is_reachable_and_unknown_root_attribute_is_refused() {
+    let ok = r##"<rustmotion width="1920" height="1080" codec="prores"><scene duration="2"><h1>Hi</h1></scene></rustmotion>"##;
+    let v = html_to_scenario_value(ok).expect("codec must transpile, not be dropped");
+    assert_eq!(v["video"]["codec"], json!("prores"));
+
+    let bad = r##"<rustmotion width="1920" height="1080" codec="prores" durationn="5"><scene duration="2"><h1>Hi</h1></scene></rustmotion>"##;
+    let err = html_to_scenario_value(bad)
+        .expect_err("an unknown <rustmotion> attribute must be refused, not silently dropped");
+    match err {
+        HtmlError::UnknownAttributes { element, detail } => {
+            assert_eq!(element, "rustmotion");
+            assert!(detail.contains("durationn"), "got: {detail}");
+        }
+        other => panic!("expected UnknownAttributes, got: {other:?}"),
+    }
+}
+
+#[test]
+fn container_unknown_attributes_are_refused_not_dropped() {
+    let html = r##"<rustmotion width="1920" height="1080"><scene duration="2"><div gap="32" width="400" id="x"></div></scene></rustmotion>"##;
+    let err = html_to_scenario_value(html)
+        .expect_err("unknown <div> attributes must be refused, not silently dropped");
+    match err {
+        HtmlError::UnknownAttributes { element, detail } => {
+            assert_eq!(element, "div");
+            assert!(detail.contains("gap"), "got: {detail}");
+            assert!(detail.contains("width"), "got: {detail}");
+            assert!(!detail.contains("'id'"), "id must stay inert: {detail}");
+        }
+        other => panic!("expected UnknownAttributes, got: {other:?}"),
+    }
+}
+
+#[test]
+fn text_tag_unknown_attribute_is_refused_not_dropped() {
+    let html = r##"<rustmotion width="1920" height="1080"><scene duration="2"><p foo="bar">Hi</p></scene></rustmotion>"##;
+    let err = html_to_scenario_value(html)
+        .expect_err("unknown <p> attributes must be refused, not silently dropped");
+    match err {
+        HtmlError::UnknownAttributes { element, detail } => {
+            assert_eq!(element, "p");
+            assert!(detail.contains("foo"), "got: {detail}");
+        }
+        other => panic!("expected UnknownAttributes, got: {other:?}"),
+    }
+}
+
+#[test]
+fn inert_attributes_stay_inert_on_container_and_text() {
+    let html = r##"<rustmotion width="1920" height="1080"><scene duration="2"><div class="wrapper" id="hero" data-testid="x"><p class="lead" data-x="1">Hi</p></div></scene></rustmotion>"##;
+    html_to_scenario_value(html).expect("class/id/data-* must remain inert, not flagged");
+}

From 83588790473884ac88bd8397c4b060aef2a7201f Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 10:53:54 +0200
Subject: [PATCH 09/56] fix(studio): rebase the debounced write on the current
 document (#256)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

write_prop/write_root_field/write_content capture m.raw (the ENTIRE
document) at edit time, then 250 ms later serialize that snapshot over the
whole file. If the notify watcher reloads the model from an agent/editor
write during that window, the payload's raw is already stale and the flush
wipes the agent's change completely — not just the edited pointer.
write_and_note then registers the result in the self-write ledger, so
app/mod.rs:141 makes the watcher skip the resulting event: memory holds the
agent's version, disk holds the studio's stale version, and nothing ever
reconciles them. No error is shown (m.write_error = None on success). This
is the crate's headline workflow (baseline/diff review of agent edits), so
the race is routine, not exotic.

Fix: Before flushing, re-read the file and verify it still matches what the
payload was derived from (hash the source at snapshot time, compare at write
time); on mismatch, re-apply the single pointer mutation to the CURRENT disk
content instead of replaying the stale whole-document snapshot, or surface a
conflict in write_error. Do not register a self-write for a flush whose base
no longer matches the disk.

Refs #220
---
 .../rustmotion-studio/src/editor/inspector.rs | 353 ++++--------------
 crates/rustmotion-studio/src/lib.rs           |   2 +-
 .../rustmotion-studio/src/scenario/history.rs |  13 +-
 crates/rustmotion-studio/src/scenario/mod.rs  |   5 +-
 .../src/scenario/optimistic.rs                |  70 ++++
 crates/rustmotion-studio/tests/audit_ws_g.rs  | 221 +++++++++++
 6 files changed, 389 insertions(+), 275 deletions(-)
 create mode 100644 crates/rustmotion-studio/tests/audit_ws_g.rs

diff --git a/crates/rustmotion-studio/src/editor/inspector.rs b/crates/rustmotion-studio/src/editor/inspector.rs
index 50b71250..af2b8e49 100644
--- a/crates/rustmotion-studio/src/editor/inspector.rs
+++ b/crates/rustmotion-studio/src/editor/inspector.rs
@@ -12,10 +12,7 @@ use crate::components::color_picker::ColorPicker;
 use crate::components::select::{Select, SelectOption};
 use crate::components::slider::Slider;
 use crate::components::switch::Switch;
-use crate::scenario::{
-    apply_optimistic, scene_duration_for_pointer, set_field, set_field_value, set_style,
-    set_style_value, Mutation, Shared,
-};
+use crate::scenario::{apply_optimistic, scene_duration_for_pointer, Mutation, Shared};
 
 use super::view::RevSignal;
 
@@ -2032,72 +2029,31 @@ fn hsv_to_hex(c: Hsv<encoding::Srgb, f64>) -> String {
 
 // ── Persistence ──────────────────────────────────────────────────────────────
 
-/// The payload for a deferred disk write. Carries everything needed to perform
-/// the write so it can be captured by the spawned task without borrowing.
-enum WritePayload {
-    Prop {
-        path: std::path::PathBuf,
-        raw: serde_json::Value,
-        pointer: String,
-        prop: String,
-        value: String,
-    },
-    Content {
-        path: std::path::PathBuf,
-        raw: serde_json::Value,
-        pointer: String,
-        text: String,
-    },
-    /// Typed root-field write (`Value::Null` removes the field / attribute).
-    RootField {
-        path: std::path::PathBuf,
-        raw: serde_json::Value,
-        pointer: String,
-        field: String,
-        value: serde_json::Value,
-    },
-    /// Remove one style property (emptied generic control).
-    StyleRemove {
-        path: std::path::PathBuf,
-        raw: serde_json::Value,
-        pointer: String,
-        prop: String,
-    },
-}
-
-impl WritePayload {
-    fn path(&self) -> &std::path::Path {
-        match self {
-            WritePayload::Prop { path, .. }
-            | WritePayload::Content { path, .. }
-            | WritePayload::RootField { path, .. }
-            | WritePayload::StyleRemove { path, .. } => path,
-        }
-    }
-}
-
-/// A root-field JSON value as an HTML attribute string. `Null` → empty (which
-/// [`rustmotion::loader::set_html_attribute`] treats as "remove"); complex
-/// values are compact JSON (attributes are strings; the transpiler coerces).
-fn root_value_to_attr(value: &serde_json::Value) -> String {
-    match value {
-        serde_json::Value::Null => String::new(),
-        serde_json::Value::String(s) => s.clone(),
-        other => other.to_string(),
-    }
-}
-
-/// Schedule a debounced disk write (~250 ms). Any previously scheduled write is
-/// cancelled first so only the last value in a burst reaches the disk.
+/// Schedule a debounced disk write (~250 ms). Queues `mutation` onto the
+/// app-global pending list for `path` and (re)starts the timer, cancelling
+/// only the timer — not the queue — so a burst of edits inside the window
+/// accumulates every mutation instead of dropping all but the last.
 ///
-/// On success the model's `write_error` is cleared and the pre-write file state
-/// is pushed onto the undo history; on failure `write_error` is set to the OS
-/// error message and `generation` is bumped so the hot-reload loop picks it up
-/// and shows the topbar indicator. The pending window is surfaced as the
-/// "Saving…" indicator via the history slot.
-fn schedule_write(debounce: &WriteDebounce, shared: Shared, payload: WritePayload) {
-    // Cancel the previous pending write (if any). `Task::cancel` is safe to
-    // call on an already-completed task (it's a no-op).
+/// When the timer fires it rebases the whole queue onto whatever is on disk
+/// at that moment, never a copy captured back when the edit happened, so a
+/// write from outside the process landing mid-window is preserved instead of
+/// being overwritten by a stale in-memory snapshot.
+///
+/// On success the model's `write_error` is cleared and the pre-write file
+/// state is pushed onto the undo history; on failure `write_error` is set to
+/// the error message and `generation` is bumped so the hot-reload loop picks
+/// it up and shows the topbar indicator. The pending window is surfaced as
+/// the "Saving…" indicator via the history slot. [`crate::scenario::undo`]
+/// and [`crate::scenario::redo`] drain the queue before touching the file, so
+/// an orphaned flush that still fires after a revert has nothing to replay.
+fn schedule_write(
+    debounce: &WriteDebounce,
+    shared: Shared,
+    path: std::path::PathBuf,
+    mutation: Mutation,
+) {
+    crate::scenario::queue_mutation(&crate::scenario::pending_write_slot(), &path, mutation);
+
     {
         let mut slot = debounce.0.borrow_mut();
         if let Some(prev) = slot.take() {
@@ -2109,28 +2065,32 @@ fn schedule_write(debounce: &WriteDebounce, shared: Shared, payload: WritePayloa
     let debounce_slot = debounce.0.clone();
     let task = spawn(async move {
         tokio::time::sleep(std::time::Duration::from_millis(250)).await;
-
-        // Clear the slot so the next write doesn't try to cancel this one.
         *debounce_slot.borrow_mut() = None;
 
-        // Capture the file state BEFORE the write: one history entry per
-        // effective disk write.
-        let snapshot = std::fs::read_to_string(payload.path()).ok();
-        let result = perform_write(&payload);
+        let mutations =
+            crate::scenario::take_pending(&crate::scenario::pending_write_slot(), &path);
         crate::scenario::set_saving(&crate::scenario::history_slot(), false);
-        if let (Ok(true), Some(snapshot)) = (&result, snapshot) {
-            crate::scenario::record_edit(
-                &crate::scenario::history_slot(),
-                payload.path(),
-                snapshot,
-            );
+        if mutations.is_empty() {
+            return;
+        }
+
+        let is_html = rustmotion::loader::is_html_path(&path);
+        let read = std::fs::read_to_string(&path).map_err(|e| format!("read: {e}"));
+        let result: Result<bool, String> = match &read {
+            Ok(content) => match crate::scenario::resolve_flush(content, is_html, &mutations) {
+                Ok(Some(new_content)) => write_and_note(&path, &new_content).map(|()| true),
+                Ok(None) => Ok(false),
+                Err(e) => Err(e),
+            },
+            Err(e) => Err(e.clone()),
+        };
+        if let (Ok(true), Ok(snapshot)) = (&result, &read) {
+            crate::scenario::record_edit(&crate::scenario::history_slot(), &path, snapshot.clone());
         }
+
         let mut m = shared.lock().unwrap_or_else(|e| e.into_inner());
         match result {
-            Ok(_) => {
-                // Clear any previous write error on success.
-                m.write_error = None;
-            }
+            Ok(_) => m.write_error = None,
             Err(e) => {
                 m.write_error = Some(e);
                 m.generation = m.generation.wrapping_add(1);
@@ -2138,7 +2098,6 @@ fn schedule_write(debounce: &WriteDebounce, shared: Shared, payload: WritePayloa
         }
     });
 
-    // Store the new handle for the next cancellation.
     *debounce.0.borrow_mut() = Some(task);
 }
 
@@ -2150,112 +2109,12 @@ fn write_and_note(path: &std::path::Path, content: &str) -> Result<(), String> {
     Ok(())
 }
 
-/// Execute the actual file write. Returns `Ok(true)` when the file was
-/// written, `Ok(false)` when the edit was a no-op (nothing to record in the
-/// undo history), or an error message.
-fn perform_write(payload: &WritePayload) -> Result<bool, String> {
-    match payload {
-        WritePayload::Prop {
-            path,
-            raw,
-            pointer,
-            prop,
-            value,
-        } => {
-            if rustmotion::loader::is_html_path(path) {
-                let html = std::fs::read_to_string(path).map_err(|e| format!("read: {e}"))?;
-                if let Some(updated) =
-                    rustmotion::loader::set_html_inline_style(&html, pointer, prop, value)
-                {
-                    write_and_note(path, &updated)?;
-                    return Ok(true);
-                }
-            } else if let Some(updated) = set_style(raw.clone(), pointer, prop, value) {
-                let text =
-                    serde_json::to_string_pretty(&updated).map_err(|e| format!("json: {e}"))?;
-                write_and_note(path, &text)?;
-                return Ok(true);
-            }
-            Ok(false)
-        }
-        WritePayload::Content {
-            path,
-            raw,
-            pointer,
-            text,
-        } => {
-            if rustmotion::loader::is_html_path(path) {
-                let html = std::fs::read_to_string(path).map_err(|e| format!("read: {e}"))?;
-                if let Some(updated) =
-                    rustmotion::loader::set_html_text_content(&html, pointer, text)
-                {
-                    write_and_note(path, &updated)?;
-                    return Ok(true);
-                }
-            } else if let Some(updated) = set_field(raw.clone(), pointer, "content", text) {
-                let s = serde_json::to_string_pretty(&updated).map_err(|e| format!("json: {e}"))?;
-                write_and_note(path, &s)?;
-                return Ok(true);
-            }
-            Ok(false)
-        }
-        WritePayload::RootField {
-            path,
-            raw,
-            pointer,
-            field,
-            value,
-        } => {
-            if rustmotion::loader::is_html_path(path) {
-                let html = std::fs::read_to_string(path).map_err(|e| format!("read: {e}"))?;
-                let attr = root_value_to_attr(value);
-                if let Some(updated) =
-                    rustmotion::loader::set_html_attribute(&html, pointer, field, &attr)
-                {
-                    write_and_note(path, &updated)?;
-                    return Ok(true);
-                }
-            } else if let Some(updated) =
-                set_field_value(raw.clone(), pointer, field, value.clone())
-            {
-                let s = serde_json::to_string_pretty(&updated).map_err(|e| format!("json: {e}"))?;
-                write_and_note(path, &s)?;
-                return Ok(true);
-            }
-            Ok(false)
-        }
-        WritePayload::StyleRemove {
-            path,
-            raw,
-            pointer,
-            prop,
-        } => {
-            if rustmotion::loader::is_html_path(path) {
-                let html = std::fs::read_to_string(path).map_err(|e| format!("read: {e}"))?;
-                if let Some(updated) =
-                    rustmotion::loader::remove_html_inline_style(&html, pointer, prop)
-                {
-                    write_and_note(path, &updated)?;
-                    return Ok(true);
-                }
-            } else if let Some(updated) =
-                set_style_value(raw.clone(), pointer, prop, serde_json::Value::Null)
-            {
-                let s = serde_json::to_string_pretty(&updated).map_err(|e| format!("json: {e}"))?;
-                write_and_note(path, &s)?;
-                return Ok(true);
-            }
-            Ok(false)
-        }
-    }
-}
-
 /// Apply an edit to the in-memory model immediately (canvas refreshes in ~one
 /// render) and nudge the hot-reload signal. Rebuild failures are transient
 /// (mid-typing) and silently keep the previous model — the disk write path
 /// has its own guards.
-fn optimistic(shared: &Shared, mutation: Mutation) {
-    if apply_optimistic(shared, &mutation).is_ok() {
+fn optimistic(shared: &Shared, mutation: &Mutation) {
+    if apply_optimistic(shared, mutation).is_ok() {
         if let Some(rev) = try_consume_context::<RevSignal>() {
             let mut r = rev.0;
             r.set(r() + 1);
@@ -2272,129 +2131,83 @@ fn write_prop(shared: &Shared, pointer: &str, prop: &str, value: &str) {
     if value.trim().is_empty() {
         return;
     }
-    optimistic(
-        shared,
-        Mutation::Style {
-            pointer: pointer.to_string(),
-            prop: prop.to_string(),
-            value: serde_json::Value::String(value.to_string()),
-        },
-    );
-    let (path, raw) = {
+    let mutation = Mutation::Style {
+        pointer: pointer.to_string(),
+        prop: prop.to_string(),
+        value: serde_json::Value::String(value.to_string()),
+    };
+    optimistic(shared, &mutation);
+    let path = {
         let m = shared.lock().unwrap_or_else(|e| e.into_inner());
-        (m.path.clone(), m.raw.clone())
+        m.path.clone()
     };
     let Some(path) = path else {
         return;
     };
     let debounce = consume_context::<WriteDebounce>();
-    schedule_write(
-        &debounce,
-        shared.clone(),
-        WritePayload::Prop {
-            path,
-            raw,
-            pointer: pointer.to_string(),
-            prop: prop.to_string(),
-            value: value.to_string(),
-        },
-    );
+    schedule_write(&debounce, shared.clone(), path, mutation);
 }
 
 /// Typed write of a component root field (schema-driven Properties section).
 /// `Value::Null` removes the field (JSON) / the attribute (HTML). Debounced
 /// with the same guarantees as [`write_prop`].
 fn write_root_field(shared: &Shared, pointer: &str, field: &str, value: serde_json::Value) {
-    optimistic(
-        shared,
-        Mutation::Field {
-            pointer: pointer.to_string(),
-            field: field.to_string(),
-            value: value.clone(),
-        },
-    );
-    let (path, raw) = {
+    let mutation = Mutation::Field {
+        pointer: pointer.to_string(),
+        field: field.to_string(),
+        value,
+    };
+    optimistic(shared, &mutation);
+    let path = {
         let m = shared.lock().unwrap_or_else(|e| e.into_inner());
-        (m.path.clone(), m.raw.clone())
+        m.path.clone()
     };
     let Some(path) = path else {
         return;
     };
     let debounce = consume_context::<WriteDebounce>();
-    schedule_write(
-        &debounce,
-        shared.clone(),
-        WritePayload::RootField {
-            path,
-            raw,
-            pointer: pointer.to_string(),
-            field: field.to_string(),
-            value,
-        },
-    );
+    schedule_write(&debounce, shared.clone(), path, mutation);
 }
 
 /// Remove one style property (an emptied generic control unsets the key /
 /// declaration rather than writing an empty string). Debounced.
 fn write_style_removal(shared: &Shared, pointer: &str, prop: &str) {
-    optimistic(
-        shared,
-        Mutation::Style {
-            pointer: pointer.to_string(),
-            prop: prop.to_string(),
-            value: serde_json::Value::Null,
-        },
-    );
-    let (path, raw) = {
+    let mutation = Mutation::Style {
+        pointer: pointer.to_string(),
+        prop: prop.to_string(),
+        value: serde_json::Value::Null,
+    };
+    optimistic(shared, &mutation);
+    let path = {
         let m = shared.lock().unwrap_or_else(|e| e.into_inner());
-        (m.path.clone(), m.raw.clone())
+        m.path.clone()
     };
     let Some(path) = path else {
         return;
     };
     let debounce = consume_context::<WriteDebounce>();
-    schedule_write(
-        &debounce,
-        shared.clone(),
-        WritePayload::StyleRemove {
-            path,
-            raw,
-            pointer: pointer.to_string(),
-            prop: prop.to_string(),
-        },
-    );
+    schedule_write(&debounce, shared.clone(), path, mutation);
 }
 
 /// Write the element's text `content` back to the scenario file. Unlike
 /// [`write_prop`], an empty value is allowed (clearing the text is valid).
 /// Schedules a debounced write (~250 ms); errors are surfaced in the topbar.
 fn write_content(shared: &Shared, pointer: &str, text: &str) {
-    optimistic(
-        shared,
-        Mutation::Field {
-            pointer: pointer.to_string(),
-            field: "content".to_string(),
-            value: serde_json::Value::String(text.to_string()),
-        },
-    );
-    let (path, raw) = {
+    let mutation = Mutation::Field {
+        pointer: pointer.to_string(),
+        field: "content".to_string(),
+        value: serde_json::Value::String(text.to_string()),
+    };
+    optimistic(shared, &mutation);
+    let path = {
         let m = shared.lock().unwrap_or_else(|e| e.into_inner());
-        (m.path.clone(), m.raw.clone())
+        m.path.clone()
     };
     let Some(path) = path else {
         return;
     };
     let debounce = consume_context::<WriteDebounce>();
-    schedule_write(
-        &debounce,
-        shared.clone(),
-        WritePayload::Content {
-            path,
-            raw,
-            pointer: pointer.to_string(),
-            text: text.to_string(),
-        },
-    );
+    schedule_write(&debounce, shared.clone(), path, mutation);
 }
 
 #[cfg(test)]
diff --git a/crates/rustmotion-studio/src/lib.rs b/crates/rustmotion-studio/src/lib.rs
index 85d56e67..9af6d687 100644
--- a/crates/rustmotion-studio/src/lib.rs
+++ b/crates/rustmotion-studio/src/lib.rs
@@ -2,7 +2,7 @@ mod app;
 mod components;
 mod editor;
 mod library;
-mod scenario;
+pub mod scenario;
 
 pub use app::{run_preview, run_preview_with_error};
 
diff --git a/crates/rustmotion-studio/src/scenario/history.rs b/crates/rustmotion-studio/src/scenario/history.rs
index d827c2f7..37378cfa 100644
--- a/crates/rustmotion-studio/src/scenario/history.rs
+++ b/crates/rustmotion-studio/src/scenario/history.rs
@@ -119,9 +119,16 @@ pub fn redo(shared: &Shared, slot: &SharedHistory) {
     step(shared, slot, false)
 }
 
+/// Shared body of [`undo`]/[`redo`]. Lock discipline: the model lock and the
+/// slot lock are never held together (model → path, then slot → stacks +
+/// disk, then model → report).
+///
+/// Drains the pending-write queue for `path` before touching the file: any
+/// edit still waiting out its debounce window would otherwise fire later and
+/// replay over the state this step is about to write, silently reverting the
+/// undo/redo and destroying the redo entry that could have recovered it
+/// (`record_edit` clears redo on every write).
 fn step(shared: &Shared, slot: &SharedHistory, is_undo: bool) {
-    // Lock discipline: the model lock and the slot lock are never held
-    // together (model → path, then slot → stacks + disk, then model → report).
     let path = {
         let m = shared.lock().unwrap_or_else(|e| e.into_inner());
         m.path.clone()
@@ -129,8 +136,8 @@ fn step(shared: &Shared, slot: &SharedHistory, is_undo: bool) {
     let Some(path) = path else {
         return;
     };
+    let _ = super::optimistic::take_pending(&super::optimistic::pending_write_slot(), &path);
 
-    // Ok(true) = a state was written; Ok(false) = nothing to undo/redo.
     let outcome: Result<bool, String> = {
         let mut st = slot.lock().unwrap_or_else(|e| e.into_inner());
         st.ensure_path(&path);
diff --git a/crates/rustmotion-studio/src/scenario/mod.rs b/crates/rustmotion-studio/src/scenario/mod.rs
index 231be62e..f6e18098 100644
--- a/crates/rustmotion-studio/src/scenario/mod.rs
+++ b/crates/rustmotion-studio/src/scenario/mod.rs
@@ -17,7 +17,10 @@ pub use edit::{
 };
 pub use history::{history_slot, record_edit, redo, set_saving, undo, SharedHistory};
 pub use model::{empty_scenario, Shared, StudioModel};
-pub use optimistic::{apply_optimistic, is_self_write, note_self_write, self_write_slot, Mutation};
+pub use optimistic::{
+    apply_optimistic, is_self_write, note_self_write, pending_write_slot, queue_mutation,
+    resolve_flush, self_write_slot, take_pending, Mutation, PendingWrites,
+};
 pub use sidecar::{append_sidecar_annotation, remove_sidecar_annotation};
 
 /// Which top-level view is shown (library home vs. the editor).
diff --git a/crates/rustmotion-studio/src/scenario/optimistic.rs b/crates/rustmotion-studio/src/scenario/optimistic.rs
index 5cca75c0..2d0a6f32 100644
--- a/crates/rustmotion-studio/src/scenario/optimistic.rs
+++ b/crates/rustmotion-studio/src/scenario/optimistic.rs
@@ -201,6 +201,76 @@ pub fn is_self_write(slot: &SelfWrites, path: &Path, content: &str) -> bool {
     map.get(path) == Some(&content_hash(content))
 }
 
+// ── Pending writes (debounce queue) ─────────────────────────────────────────
+
+pub type PendingWrites = Arc<Mutex<HashMap<PathBuf, Vec<Mutation>>>>;
+
+/// App-global queue of mutations accumulated since the last successful disk
+/// flush, keyed by scenario path. The debounce timer in `inspector.rs`
+/// appends to it on every edit and drains it when it fires; `undo`/`redo`
+/// drain it too, before touching the file, so an orphaned flush that still
+/// fires after a revert has nothing left to replay.
+pub fn pending_write_slot() -> PendingWrites {
+    static SLOT: OnceLock<PendingWrites> = OnceLock::new();
+    SLOT.get_or_init(|| Arc::new(Mutex::new(HashMap::new())))
+        .clone()
+}
+
+/// Queue one mutation for `path`, to be replayed onto the freshest disk
+/// content the next time the debounce flushes.
+pub fn queue_mutation(slot: &PendingWrites, path: &Path, mutation: Mutation) {
+    let mut map = slot.lock().unwrap_or_else(|e| e.into_inner());
+    map.entry(path.to_path_buf()).or_default().push(mutation);
+}
+
+/// Remove and return every mutation queued for `path`, in the order they were
+/// queued (empty when there is nothing pending: a no-op flush, or a queue a
+/// concurrent undo/redo already drained).
+pub fn take_pending(slot: &PendingWrites, path: &Path) -> Vec<Mutation> {
+    let mut map = slot.lock().unwrap_or_else(|e| e.into_inner());
+    map.remove(path).unwrap_or_default()
+}
+
+// ── Flush decision (pure) ────────────────────────────────────────────────────
+
+/// Replay `mutations`, in order, onto `disk_content` — the freshest content on
+/// disk, read right before the flush, never a snapshot captured back when an
+/// edit happened. `Ok(None)` means every mutation was a no-op (nothing to
+/// write); `Err` means `disk_content` itself could not be parsed as JSON (the
+/// HTML branch has no such failure mode: any string is a valid rebase base).
+pub fn resolve_flush(
+    disk_content: &str,
+    is_html: bool,
+    mutations: &[Mutation],
+) -> Result<Option<String>, String> {
+    if is_html {
+        let mut current = disk_content.to_string();
+        let mut changed = false;
+        for mutation in mutations {
+            if let Some(updated) = apply_to_html(&current, mutation) {
+                current = updated;
+                changed = true;
+            }
+        }
+        Ok(changed.then_some(current))
+    } else {
+        let mut value: Value =
+            serde_json::from_str(disk_content).map_err(|e| format!("parse: {e}"))?;
+        let mut changed = false;
+        for mutation in mutations {
+            if let Some(updated) = apply_to_raw(value.clone(), mutation) {
+                value = updated;
+                changed = true;
+            }
+        }
+        if !changed {
+            return Ok(None);
+        }
+        let text = serde_json::to_string_pretty(&value).map_err(|e| format!("json: {e}"))?;
+        Ok(Some(text))
+    }
+}
+
 // ── Rebuild ──────────────────────────────────────────────────────────────────
 
 /// Build a `ResolvedScenario` from a raw scenario JSON value — the same
diff --git a/crates/rustmotion-studio/tests/audit_ws_g.rs b/crates/rustmotion-studio/tests/audit_ws_g.rs
new file mode 100644
index 00000000..1f7d983d
--- /dev/null
+++ b/crates/rustmotion-studio/tests/audit_ws_g.rs
@@ -0,0 +1,221 @@
+//! Regression tests for the studio's file-write pipeline: a debounced write
+//! that must rebase onto the current disk instead of replaying a stale
+//! in-memory snapshot, coalesced edits inside one debounce window that must
+//! all survive (not just the last), and undo/redo cancelling a still-pending
+//! write before it can clobber the just-restored state.
+//!
+//! `rustmotion-studio` has no `[dev-dependencies]` and cannot gain one in
+//! this change, so every test below drives the crate's existing public
+//! surface (`scenario::*`) against real temp files with plain synchronous
+//! `#[test]`s — no Dioxus runtime, no async executor. That public surface is
+//! itself the fix for the crate having no integration tests: the defects
+//! lived in a debounce timer and Dioxus event handlers that cannot be driven
+//! from a test, so each one was reduced to a pure decision over plain data
+//! (`resolve_flush`, the pending-write queue) and the handler calls that
+//! instead of deciding inline.
+
+use std::fs;
+use std::path::PathBuf;
+use std::sync::{Arc, Mutex};
+
+use rustmotion_studio::scenario::{
+    apply_optimistic, empty_scenario, pending_write_slot, queue_mutation, record_edit,
+    resolve_flush, take_pending, undo, Mutation, Shared, SharedHistory, StudioModel,
+};
+
+fn temp_path(tag: &str, ext: &str) -> PathBuf {
+    let nanos = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_nanos();
+    std::env::temp_dir().join(format!(
+        "rustmotion_studio_test_{tag}_{}_{nanos}.{ext}",
+        std::process::id()
+    ))
+}
+
+fn write(path: &std::path::Path, content: &str) {
+    fs::write(path, content).unwrap();
+}
+
+fn read(path: &std::path::Path) -> String {
+    fs::read_to_string(path).unwrap()
+}
+
+// ── A debounced flush rebases onto the current disk, never a stale snapshot ──
+
+#[test]
+fn debounced_flush_rebases_onto_disk_and_survives_a_concurrent_external_edit() {
+    let path = temp_path("stale_snapshot", "json");
+    let base =
+        r#"{"scenes":[{"duration":1.0,"children":[{"type":"text","content":"Hi","style":{}}]}]}"#;
+    write(&path, base);
+
+    let slot = pending_write_slot();
+    queue_mutation(
+        &slot,
+        &path,
+        Mutation::Style {
+            pointer: "/scenes/0/children/0".into(),
+            prop: "color".into(),
+            value: serde_json::json!("#ff0000"),
+        },
+    );
+
+    // An agent (or another editor) writes the file while the debounce window
+    // is still open.
+    let external_edit = r#"{"scenes":[{"duration":1.0,"children":[{"type":"text","content":"AGENT EDIT","style":{}}]}]}"#;
+    write(&path, external_edit);
+
+    let mutations = take_pending(&slot, &path);
+    let disk = read(&path);
+    let flushed = resolve_flush(&disk, false, &mutations)
+        .expect("disk parses as JSON")
+        .expect("the queued mutation is not a no-op");
+    write(&path, &flushed);
+
+    let on_disk: serde_json::Value = serde_json::from_str(&read(&path)).unwrap();
+    assert_eq!(
+        on_disk["scenes"][0]["children"][0]["content"],
+        serde_json::json!("AGENT EDIT"),
+        "the external edit must survive the flush"
+    );
+    assert_eq!(
+        on_disk["scenes"][0]["children"][0]["style"]["color"],
+        serde_json::json!("#ff0000"),
+        "the queued edit must still land"
+    );
+    let _ = fs::remove_file(&path);
+}
+
+// ── Every coalesced HTML mutation in a burst survives, not just the last ────
+
+#[test]
+fn coalesced_html_edits_in_one_debounce_window_all_survive_the_flush() {
+    let path = temp_path("coalesced_html", "html");
+    let html_v0 = r##"<rustmotion width="640" height="360"><scene duration="1"><rm-text>Hi</rm-text></scene></rustmotion>"##;
+    write(&path, html_v0);
+
+    let slot = pending_write_slot();
+    queue_mutation(
+        &slot,
+        &path,
+        Mutation::Style {
+            pointer: "/scenes/0/children/0".into(),
+            prop: "color".into(),
+            value: serde_json::json!("#ff0000"),
+        },
+    );
+    queue_mutation(
+        &slot,
+        &path,
+        Mutation::Style {
+            pointer: "/scenes/0/children/0".into(),
+            prop: "font-size".into(),
+            value: serde_json::json!("48px"),
+        },
+    );
+
+    let mutations = take_pending(&slot, &path);
+    assert_eq!(mutations.len(), 2, "both coalesced edits are queued");
+    let disk = read(&path);
+    let flushed = resolve_flush(&disk, true, &mutations)
+        .expect("html rebase never fails to parse")
+        .expect("two real mutations are not a no-op");
+    write(&path, &flushed);
+
+    let on_disk = read(&path);
+    assert!(on_disk.contains("color"), "first coalesced edit survives");
+    assert!(
+        on_disk.contains("font-size"),
+        "second coalesced edit survives"
+    );
+    let _ = fs::remove_file(&path);
+}
+
+// ── Undo/redo cancel the pending write queue before touching the file ──────
+
+#[test]
+fn undo_cancels_the_pending_write_queue_before_touching_the_file() {
+    let path = temp_path("undo_cancels_pending", "json");
+    let state_a = r#"{"scenes":[{"duration":1.0,"children":[{"type":"text","content":"Hi","style":{"font-size":48}}]}]}"#;
+    let state_b = state_a.replace("48", "72");
+    write(&path, &state_b);
+
+    let hist: SharedHistory = Arc::new(Mutex::new(Default::default()));
+    record_edit(&hist, &path, state_a.to_string());
+
+    // An edit is still waiting out its debounce window when undo fires.
+    let slot = pending_write_slot();
+    queue_mutation(
+        &slot,
+        &path,
+        Mutation::Style {
+            pointer: "/scenes/0/children/0".into(),
+            prop: "font-size".into(),
+            value: serde_json::json!(72),
+        },
+    );
+
+    let shared: Shared = Arc::new(Mutex::new(StudioModel::new(
+        empty_scenario(),
+        None,
+        Some(path.clone()),
+    )));
+    undo(&shared, &hist);
+
+    assert_eq!(read(&path), state_a, "undo applied");
+    assert!(
+        hist.lock().unwrap().history.can_redo(),
+        "redo entry available right after undo"
+    );
+    assert!(
+        take_pending(&slot, &path).is_empty(),
+        "undo must drop the pending edit so an orphaned flush later has nothing to replay"
+    );
+
+    let _ = fs::remove_file(&path);
+}
+
+// ── The write pipeline is reachable end to end without a Dioxus runtime ────
+
+#[test]
+fn the_write_pipeline_round_trips_an_edit_through_a_real_file() {
+    let path = temp_path("full_pipeline", "json");
+    let base = r#"{"video":{"width":64,"height":64},"scenes":[{"duration":1.0,"children":[{"type":"text","content":"Hi","style":{}}]}]}"#;
+    write(&path, base);
+
+    let shared: Shared = Arc::new(Mutex::new(StudioModel::new(
+        empty_scenario(),
+        None,
+        Some(path.clone()),
+    )));
+    let mutation = Mutation::Style {
+        pointer: "/scenes/0/children/0".into(),
+        prop: "color".into(),
+        value: serde_json::json!("#00ff00"),
+    };
+    apply_optimistic(&shared, &mutation).expect("optimistic apply succeeds");
+    assert_eq!(
+        shared.lock().unwrap().raw["scenes"][0]["children"][0]["style"]["color"],
+        serde_json::json!("#00ff00"),
+        "the canvas sees the edit immediately, before any disk write"
+    );
+
+    let slot = pending_write_slot();
+    queue_mutation(&slot, &path, mutation);
+    let mutations = take_pending(&slot, &path);
+    let disk = read(&path);
+    let flushed = resolve_flush(&disk, false, &mutations)
+        .expect("disk parses")
+        .expect("not a no-op");
+    write(&path, &flushed);
+
+    let on_disk: serde_json::Value = serde_json::from_str(&read(&path)).unwrap();
+    assert_eq!(
+        on_disk["scenes"][0]["children"][0]["style"]["color"],
+        serde_json::json!("#00ff00"),
+        "disk ends up with the same edit the in-memory model already has"
+    );
+    let _ = fs::remove_file(&path);
+}

From b01fb1b27b801948b23dac70504be2befa7a5cc3 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 10:54:04 +0200
Subject: [PATCH 10/56] fix(assets): set a timeout on every outbound request
 (#259)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

I read ureq 3.2.0's impl Default for Timeouts (config.rs:898-911): global,
per_call, resolve, connect, send_request, send_body, recv_response and
recv_body are all None; only await_100 is set (1 s). None of the four call
sites configures one — assets.rs:141 (Iconify), google_fonts.rs:189 and
google_fonts.rs:217 (Google Fonts CSS + TTF), rustmotion/src/include.rs:221
(arbitrary remote include). A host that accepts the TCP connection and then
stalls, or trickles one byte per minute, blocks indefinitely; ureq's 10 MB
body cap bounds bytes, not time. The icon path is the worst case: icon.rs:55
can reach fetch_icon_svg from inside paint_content, i.e. on a render worker
thread, so one stalled connection wedges a render that has no user at the
keyboard (CI, --frames a-b distributed segments). Combined with the remote-
include finding, a scenario chooses the host that stalls.

Fix: Build one shared ureq::Agent with Config::builder().timeout_global(Some
(Duration::from_secs(20))).timeout_connect(Some(Duration::from_secs(5)))
(plus https_only(true)) and route all four call sites through it, instead of
the bare ureq::get(...) free function which always uses the default
(untimed) agent.

Refs #220
---
 .../src/engine/renderer/assets.rs             |  38 ++++++-
 crates/rustmotion-core/tests/audit_ws_h.rs    | 100 ++++++++++++++++++
 2 files changed, 137 insertions(+), 1 deletion(-)
 create mode 100644 crates/rustmotion-core/tests/audit_ws_h.rs

diff --git a/crates/rustmotion-core/src/engine/renderer/assets.rs b/crates/rustmotion-core/src/engine/renderer/assets.rs
index fdd65d9f..ac7bd585 100644
--- a/crates/rustmotion-core/src/engine/renderer/assets.rs
+++ b/crates/rustmotion-core/src/engine/renderer/assets.rs
@@ -1,5 +1,6 @@
 use std::path::{Path, PathBuf};
 use std::sync::{Arc, OnceLock};
+use std::time::Duration;
 
 use dashmap::DashMap;
 
@@ -35,6 +36,40 @@ pub fn gif_cache() -> &'static GifCacheMap {
     GIF_CACHE.get_or_init(|| Arc::new(DashMap::new()))
 }
 
+// ─── Shared HTTP agent ──────────────────────────────────────────────────────
+
+/// The [`ureq::Agent`] every outbound HTTP call in this crate must go
+/// through — the icon fetch below, and the remote `include` fetch in the
+/// `rustmotion` crate (`crates/rustmotion/src/include.rs`), which imports
+/// [`http_agent`] rather than building its own.
+///
+/// `ureq::get(...)`, the free function used before this fix, always resolves
+/// to an *unconfigured* default agent. In ureq 3.x every field of
+/// `Timeouts` defaults to `None` except `await_100` (`config.rs`'s `impl
+/// Default for Timeouts`), so a host that accepts the TCP connection and
+/// then never answers — or trickles one byte a minute — hangs the calling
+/// thread forever; ureq's 10 MB body cap bounds bytes, not time. On the icon
+/// path that thread can be a render worker with nobody at the keyboard to
+/// notice.
+///
+/// `Config::builder()` starts from `Config::default()`, which already
+/// resolves a proxy from `HTTPS_PROXY`/`https_proxy`/`HTTP_PROXY`/
+/// `http_proxy`/`ALL_PROXY` via `Proxy::try_from_env()` — the same audit
+/// separately found every network call here ignoring a configured egress
+/// proxy, and routing through the builder rather than hand-building a
+/// `Config` fixes that as a side effect, not a separate change.
+static HTTP_AGENT: OnceLock<ureq::Agent> = OnceLock::new();
+
+pub fn http_agent() -> &'static ureq::Agent {
+    HTTP_AGENT.get_or_init(|| {
+        let config = ureq::config::Config::builder()
+            .timeout_global(Some(Duration::from_secs(20)))
+            .timeout_connect(Some(Duration::from_secs(5)))
+            .build();
+        ureq::Agent::new_with_config(config)
+    })
+}
+
 // ─── Icon fetching ──────────────────────────────────────────────────────────
 
 /// How much larger than the *target* (layout) size icons are rasterized, so
@@ -138,7 +173,8 @@ pub fn fetch_icon_svg_in(
         "https://api.iconify.design/{}/{}.svg?color=%23{}&width={}&height={}",
         prefix, name, hex_color, width, height
     );
-    let response = ureq::get(&url)
+    let response = http_agent()
+        .get(&url)
         .call()
         .map_err(|e| RustmotionError::IconFetch {
             icon: icon.to_string(),
diff --git a/crates/rustmotion-core/tests/audit_ws_h.rs b/crates/rustmotion-core/tests/audit_ws_h.rs
new file mode 100644
index 00000000..0e8d7242
--- /dev/null
+++ b/crates/rustmotion-core/tests/audit_ws_h.rs
@@ -0,0 +1,100 @@
+//! Regression tests for the workstream H (untrusted scenario ingestion)
+//! audit findings that live in `rustmotion-core`.
+
+use rustmotion_core::engine::renderer::{extract_video_frame, http_agent};
+
+// ---- no timeout on any HTTP call — a bare `ureq::get` always uses
+// the default, untimed agent, so a stalled host hangs a render forever ----
+
+#[test]
+fn shared_http_agent_has_finite_global_and_connect_timeouts() {
+    let timeouts = http_agent().config().timeouts();
+    assert!(
+        timeouts.global.is_some(),
+        "ureq 3.x's default Timeouts::global is None — the shared agent must override it \
+         so a stalled host cannot hang a render forever"
+    );
+    assert!(
+        timeouts.connect.is_some(),
+        "a hung TCP handshake must not hang forever either"
+    );
+}
+
+// ---- a scenario's `video.src` reaches `ffmpeg -i` verbatim, with no
+// protocol allowlist — a remote-looking src turns into an SSRF primitive ----
+
+#[test]
+fn extract_video_frame_rejects_a_remote_src_before_it_ever_reaches_ffmpeg() {
+    let result = extract_video_frame(
+        "http://169.254.169.254/latest/meta-data/iam/security-credentials/",
+        0.0,
+        16,
+        16,
+    );
+    assert!(
+        result.is_err(),
+        "a scheme-prefixed src must be rejected outright, not hand ffmpeg a URL to dereference"
+    );
+}
+
+#[test]
+fn extract_video_frame_does_not_reject_a_plain_local_path() {
+    let result = extract_video_frame("/no/such/file/on/disk.mp4", 0.0, 16, 16);
+    let err = result.expect_err("a missing local file is still an error");
+    assert!(
+        !err.to_string().contains("does not fetch video"),
+        "a plain local path must fail on ffmpeg/the missing file, not on the scheme check: {err}"
+    );
+}
+
+// ---- `for-each` expansion has a depth ceiling but no node budget —
+// nesting is multiplicative, so a handful of small arrays nested a few
+// levels deep can declare a product in the millions ----
+
+#[test]
+fn for_each_node_budget_rejects_a_declared_product_that_exceeds_the_cap() {
+    fn items(n: usize) -> serde_json::Value {
+        serde_json::Value::Array(
+            (0..n)
+                .map(|i| serde_json::json!({ "v": i }))
+                .collect::<Vec<_>>(),
+        )
+    }
+
+    // Three levels of 200 elements nested directly in each other's
+    // `template.children`: a declared product of 200^3 = 8,000,000 nodes,
+    // comfortably past a low-millions cap. The array literals themselves
+    // (200 small JSON objects, three times) are cheap to build — the
+    // assertion is that expansion refuses the *product*, not that it
+    // finishes computing it.
+    let mut doc = serde_json::json!({
+        "video": { "width": 100, "height": 100 },
+        "scenes": [{
+            "duration": 1.0,
+            "children": [{
+                "for-each": items(200),
+                "template": {
+                    "type": "card",
+                    "children": [{
+                        "for-each": items(200),
+                        "template": {
+                            "type": "card",
+                            "children": [{
+                                "for-each": items(200),
+                                "template": { "type": "text", "content": "$v" }
+                            }]
+                        }
+                    }]
+                }
+            }]
+        }]
+    });
+
+    let err = rustmotion_core::expand::expand_directives(&mut doc, "test.json")
+        .expect_err("a declared product this far past the cap must be rejected");
+    let msg = err.to_string();
+    assert!(
+        msg.contains("budget"),
+        "error should name the node-budget ceiling it exceeded: {msg}"
+    );
+}

From 4099977a1b924e2850373f8255e6f6bb6800f98f Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 10:54:16 +0200
Subject: [PATCH 11/56] fix(components): resolve default sizes against the node
 font-size (#263)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

font_size_px_or goes through Length::px() → px_or_warn, which returns 0.0
for any relative unit; style.rs:1601 asserts this explicitly
(assert_eq!(s.font_size_px_or(48.0), 0.0) for "15.6vw"). Five live call
sites remain in apply_intrinsic_overrides — List (1498), Callout (1643),
Tooltip (1663), PillNav (1688), Marquee (1716) — while every corresponding
painter was migrated to the context-aware resolver in the "lot B, wave S"
pass (marquee.rs:82
self.style.font_size_px_ctx(&crate::intrinsic::font_size_ctx(...),
self.font_size), list.rs:88 the same). So a marquee with "font-size": "2rem"
and no explicit style.height gets apply_default_size(css, 800.0, 0.0) → the
(false,false) branch writes css.height = Px(0.0) → the node is skipped at
paint time and the marquee is invisible; list (1498-1503) collapses to
height 0 the same way; callout/tooltip/pill_nav get boxes measured at font-
size 0 while the painter draws at the real size, so the ink overflows its
own box. intrinsic.rs:27-46 states this wave's goal was to replace
font_size_px_or at every site; box_builder was missed, and it is also the
one file that does not use the module's own measure_time_font_size_ctx
helper (intrinsic.rs:87).

Fix: Replace the five font_size_px_or(...) calls in
apply_intrinsic_overrides with
font_size_px_ctx(&crate::intrinsic::measure_time_font_size_ctx(0.0), ...),
the same helper every *Intrinsic in intrinsic.rs already uses. Add a
regression test asserting a marquee/list with "font-size": "2rem" and no
explicit height lays out with positive height.

Refs #220
---
 .../rustmotion-components/src/box_builder.rs  | 22 ++++--
 .../rustmotion-components/tests/audit_ws_i.rs | 67 +++++++++++++++++++
 2 files changed, 84 insertions(+), 5 deletions(-)
 create mode 100644 crates/rustmotion-components/tests/audit_ws_i.rs

diff --git a/crates/rustmotion-components/src/box_builder.rs b/crates/rustmotion-components/src/box_builder.rs
index 21d151ff..dee9b4bb 100644
--- a/crates/rustmotion-components/src/box_builder.rs
+++ b/crates/rustmotion-components/src/box_builder.rs
@@ -1495,7 +1495,9 @@ fn apply_intrinsic_overrides(component: &Component, css: &mut CssStyle) {
                 css.width = Some(CSize::Length(CLP::Px(c.width)));
             }
             if css.height.is_none() {
-                let font_size = c.style.font_size_px_or(16.0);
+                let font_size = c
+                    .style
+                    .font_size_px_ctx(&crate::intrinsic::measure_time_font_size_ctx(0.0), 16.0);
                 let line_height = font_size * 1.3;
                 let n = c.items.len() as f32;
                 let h = n * line_height + (n - 1.0).max(0.0) * c.gap;
@@ -1640,7 +1642,9 @@ fn apply_intrinsic_overrides(component: &Component, css: &mut CssStyle) {
             // box is fit exactly to the unwrapped text width, the painter's
             // own `wrap_text(text, font, Some(text_area_w))` never has a
             // reason to wrap, so painted output matches this box exactly.
-            let font_size = t.style.font_size_px_or(16.0);
+            let font_size = t
+                .style
+                .font_size_px_ctx(&crate::intrinsic::measure_time_font_size_ctx(0.0), 16.0);
             let family = t.style.font_family_or("Inter");
             let text_w = measure_text_line_width(&t.text, font_size, family, false);
             let h_pad = 12.0; // callout.rs's own `let padding = 12.0;`
@@ -1660,7 +1664,10 @@ fn apply_intrinsic_overrides(component: &Component, css: &mut CssStyle) {
             // Same shape as Callout above; padding value borrowed from
             // callout.rs since tooltip.rs's own paint() centers text in the
             // body with no defined constant of its own.
-            let font_size = t.style.font_size_px_or(t.font_size);
+            let font_size = t.style.font_size_px_ctx(
+                &crate::intrinsic::measure_time_font_size_ctx(0.0),
+                t.font_size,
+            );
             let family = t.style.font_family_or("Inter");
             let text_w = measure_text_line_width(&t.text, font_size, family, false);
             let h_pad = 12.0;
@@ -1685,7 +1692,9 @@ fn apply_intrinsic_overrides(component: &Component, css: &mut CssStyle) {
             // formula (h_pad = font_size*1.2 per side, `gap` before/after/
             // between every pill) using the same public fields and the same
             // `measure_text_with_fallback` call it makes internally.
-            let font_size = p.style.font_size_px_or(14.0);
+            let font_size = p
+                .style
+                .font_size_px_ctx(&crate::intrinsic::measure_time_font_size_ctx(0.0), 14.0);
             let family = p.style.font_family_or("Inter");
             let h_pad = font_size * 1.2;
             let n = p.items.len() as f32;
@@ -1713,7 +1722,10 @@ fn apply_intrinsic_overrides(component: &Component, css: &mut CssStyle) {
             // height ratio both of those same real usages share:
             // `font_size: 24` paired with `style.height: 48`, i.e.
             // `2 × font_size`.
-            let font_size = m.style.font_size_px_or(m.font_size);
+            let font_size = m.style.font_size_px_ctx(
+                &crate::intrinsic::measure_time_font_size_ctx(0.0),
+                m.font_size,
+            );
             apply_default_size(css, 800.0, font_size * 2.0);
         }
         Stepper(s) => {
diff --git a/crates/rustmotion-components/tests/audit_ws_i.rs b/crates/rustmotion-components/tests/audit_ws_i.rs
new file mode 100644
index 00000000..1915ed02
--- /dev/null
+++ b/crates/rustmotion-components/tests/audit_ws_i.rs
@@ -0,0 +1,67 @@
+//! Regression tests for workstream I of the 2026-09 audit (components and
+//! the CSS cascade).
+//!
+//! - `apply_intrinsic_overrides`'s default-size branches resolved
+//!   `font-size` through the context-free `font_size_px_or`, which returns
+//!   `0.0` for a relative unit (`rem`/`vw`/`vh`) instead of resolving it —
+//!   collapsing `marquee`/`list`/`callout`/`tooltip`/`pill_nav` to a 0px box.
+//! - `cascade::inherit_from` computes inherited `color`/`font-*` but
+//!   nothing on the render path ever reads the result — every painter reads
+//!   its own component's un-cascaded `style` field instead.
+//! - `TableIntrinsic` measures content-fitted per-column widths, but
+//!   the painter splits the box evenly across columns regardless.
+
+use rustmotion_components::box_builder::{build_scene_with_anim, BuildAnimationCtx};
+use rustmotion_components::{ChildComponent, Component, PositionMode};
+use rustmotion_core::css::taffy_bridge::ConversionContext;
+use rustmotion_core::engine::layout_pass::run_layout;
+
+fn single_child_scene(json: serde_json::Value) -> ChildComponent {
+    let component: Component = serde_json::from_value(json).expect("deserialize component");
+    ChildComponent {
+        component,
+        position: Some(PositionMode::Absolute { x: 0.0, y: 0.0 }),
+        x: None,
+        y: None,
+        z_index: None,
+        bleed: false,
+    }
+}
+
+// ─── default sizes must resolve against the node's font-size ───────────────
+
+#[test]
+fn marquee_with_relative_font_size_gets_a_positive_height() {
+    // Reproduction: `font_size_px_or` returns 0.0 for any relative unit
+    // (`.px()` can't resolve `%`/`em`/`rem`/`vw`/`vh`). Five sites in
+    // `apply_intrinsic_overrides` still called it — Marquee among them —
+    // so a marquee declaring `"font-size": "2rem"` and no explicit height
+    // used to collapse `apply_default_size(css, 800.0, 0.0)` to a 0px-tall
+    // box, and `paint_pass`'s `height <= 0.0` guard then skipped it
+    // entirely: the marquee never appeared on screen.
+    let child = single_child_scene(serde_json::json!({
+        "type": "marquee",
+        "content": "BREAKING NEWS",
+        "style": { "font-size": "2rem" }
+    }));
+    let children = vec![child];
+
+    let built = build_scene_with_anim(
+        &children,
+        (1920.0, 1080.0),
+        BuildAnimationCtx {
+            time: 0.0,
+            scenario_time: 0.0,
+            scene_duration: 1.0,
+            fps: 30,
+        },
+    );
+    let layout = run_layout(&built.root, (1920.0, 1080.0), &ConversionContext::default());
+    let marquee_id = built.root.children[0].id;
+    let l = layout.get(marquee_id).expect("marquee laid out");
+    assert!(
+        l.height > 0.0,
+        "marquee at font-size: 2rem must lay out with a positive height, got {}",
+        l.height
+    );
+}

From 39d9584c27d8d59015b3d99e8a9996c735895c87 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 10:54:30 +0200
Subject: [PATCH 12/56] fix(css): resolve em against the element font-size
 (#221)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

build() (layout_pass.rs:122-154) hands the *same* ConversionContext to
to_taffy_style for every node in the tree and never re-derives it from the
node's own (cascaded) font-size, and the only production builder keeps
..LengthContext::default() → font_size: 16.0 (scene.rs:29-37). So padding:
"1em", gap: "0.5em", width: "10em", top: "2em" all resolve against 16px
regardless of the element's actual font size: on a 48px-font card, padding:
"1em" reserves 16px instead of 48px. Unlike the context-free .px() accessors
— which were deliberately made to warn loudly for exactly this class of drop
(units.rs:240-256) — this path is silent, so the wrong geometry reaches both
the renderer and the validator with no signal.

Fix: Derive a per-node LengthContext while building the taffy tree: resolve
the node's own font-size (post-cascade) to px and pass it as
ctx.length.font_size to its own to_taffy_style call and to its children's.
Until that exists, emit the same one-shot warning order already uses
(taffy_bridge.rs:142-151) whenever an em reaches this bridge.

Refs #220
---
 .../rustmotion-core/src/engine/layout_pass.rs | 40 ++++++++++++----
 crates/rustmotion-core/tests/audit_ws_j.rs    | 47 +++++++++++++++++++
 2 files changed, 78 insertions(+), 9 deletions(-)
 create mode 100644 crates/rustmotion-core/tests/audit_ws_j.rs

diff --git a/crates/rustmotion-core/src/engine/layout_pass.rs b/crates/rustmotion-core/src/engine/layout_pass.rs
index 026a16a4..21c6ce73 100644
--- a/crates/rustmotion-core/src/engine/layout_pass.rs
+++ b/crates/rustmotion-core/src/engine/layout_pass.rs
@@ -6,6 +6,7 @@ use taffy::prelude as tf;
 use taffy::TaffyTree;
 
 use crate::css::taffy_bridge::{to_taffy_style, ConversionContext};
+use crate::css::units::LengthContext;
 use crate::engine::box_tree::{BoxNode, IntrinsicMeasure, NodeId};
 
 /// Resolved geometry for a single node, in absolute viewport coordinates.
@@ -85,7 +86,7 @@ pub fn run_layout(root: &BoxNode, viewport: (f32, f32), ctx: &ConversionContext)
     let mut node_map: HashMap<NodeId, tf::NodeId> = HashMap::new();
 
     // Build the taffy tree top-down.
-    let root_tf = build(&mut tree, &mut node_map, root, ctx);
+    let root_tf = build(&mut tree, &mut node_map, root, ctx, ctx.length.font_size);
 
     let viewport_size = tf::Size {
         width: tf::AvailableSpace::Definite(viewport.0),
@@ -119,33 +120,54 @@ pub fn run_layout(root: &BoxNode, viewport: (f32, f32), ctx: &ConversionContext)
     LayoutResult { layouts }
 }
 
+/// Build one taffy node and, recursively, its subtree.
+///
+/// `inherited_font_size` is the already-resolved (px) font-size of `node`'s
+/// parent: CSS resolves `em` on every layout property against the
+/// element's *own* computed font-size, and font-size itself inherits down
+/// the tree unless overridden. `to_taffy_style` only ever sees the single
+/// `ConversionContext` handed to it, so its `em` resolution is only as
+/// correct as the per-node context built here — a call site building one
+/// shared `ConversionContext` for the whole tree (as every production
+/// caller of `to_taffy_style` still does directly) resolves every node's
+/// `em` against that one context's `font_size` instead.
 fn build(
     tree: &mut TaffyTree<NodeData>,
     map: &mut HashMap<NodeId, tf::NodeId>,
     node: &BoxNode,
     ctx: &ConversionContext,
+    inherited_font_size: f32,
 ) -> tf::NodeId {
-    let style = to_taffy_style(&node.css, ctx);
+    let parent_font_ctx = LengthContext {
+        font_size: inherited_font_size,
+        ..ctx.length
+    };
+    let own_font_size = node
+        .css
+        .font_size_px_ctx(&parent_font_ctx, inherited_font_size);
+    let node_ctx = ConversionContext {
+        length: LengthContext {
+            font_size: own_font_size,
+            ..ctx.length
+        },
+    };
+
+    let style = to_taffy_style(&node.css, &node_ctx);
     let data = NodeData {
         box_id: node.id,
         intrinsic: node.intrinsic.clone(),
     };
-    let tf_id = if node.intrinsic.is_some() {
-        // Leaf with intrinsic measurement.
-        tree.new_leaf_with_context(style, data)
-            .expect("taffy new_leaf")
-    } else if node.children.is_empty() {
+    let tf_id = if node.intrinsic.is_some() || node.children.is_empty() {
         tree.new_leaf_with_context(style, data)
             .expect("taffy new_leaf")
     } else {
         let mut child_ids = Vec::with_capacity(node.children.len());
         for c in &node.children {
-            child_ids.push(build(tree, map, c, ctx));
+            child_ids.push(build(tree, map, c, ctx, own_font_size));
         }
         let id = tree
             .new_with_children(style, &child_ids)
             .expect("taffy new_with_children");
-        // We still want context on internal nodes (for box_id mapping).
         tree.set_node_context(id, Some(data)).ok();
         id
     };
diff --git a/crates/rustmotion-core/tests/audit_ws_j.rs b/crates/rustmotion-core/tests/audit_ws_j.rs
new file mode 100644
index 00000000..c63d1b5d
--- /dev/null
+++ b/crates/rustmotion-core/tests/audit_ws_j.rs
@@ -0,0 +1,47 @@
+//! Regression tests for the workstream J (layout pass & CSS unit resolution)
+//! audit findings on unit resolution and intrinsic measurement.
+
+use rustmotion_core::css::style::{CssStyle, Edges, Size as CSize};
+use rustmotion_core::css::taffy_bridge::ConversionContext;
+use rustmotion_core::css::units::{Length, LengthPercentage as CLP};
+use rustmotion_core::engine::box_tree::BoxNode;
+use rustmotion_core::engine::layout_pass::run_layout;
+
+// ---- `em` on layout properties must resolve against the element's
+// own (inherited) font-size, not a constant 16px ----
+
+/// A card sized by its parent's explicit `font-size` (48px) inherits that
+/// font-size down to its own layout resolution even though it never sets
+/// `font-size` itself. Its `padding: "1em"` must therefore resolve to 48px
+/// (`1 * inherited_font_size`), not the pre-fix constant 16px.
+#[test]
+fn em_padding_resolves_against_inherited_font_size_not_a_constant_16px() {
+    let mut root = BoxNode::container(
+        CssStyle {
+            font_size: Some(Length::Px(48.0)),
+            width: Some(CSize::Length(CLP::Px(400.0))),
+            height: Some(CSize::Length(CLP::Px(400.0))),
+            ..Default::default()
+        },
+        vec![BoxNode::container(
+            CssStyle {
+                padding: Some(Edges::Uniform(CLP::String("1em".into()))),
+                width: Some(CSize::Length(CLP::Px(200.0))),
+                height: Some(CSize::Length(CLP::Px(200.0))),
+                ..Default::default()
+            },
+            vec![],
+        )],
+    );
+    root.assign_ids(1);
+
+    let res = run_layout(&root, (400.0, 400.0), &ConversionContext::default());
+    let child = res.get(2).expect("child laid out");
+    let (content_x, _, content_w, _) = child.content_box();
+
+    assert_eq!(
+        content_x, 48.0,
+        "1em padding must resolve against the inherited 48px font-size"
+    );
+    assert_eq!(content_w, 200.0 - 2.0 * 48.0);
+}

From c8252d128ec1467369ad2d9167a692672d1fa2f7 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 10:57:47 +0200
Subject: [PATCH 13/56] fix(layout): hand IntrinsicMeasure both sizes in the
 content box (#284)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

taffy 0.10.1 (`compute/leaf.rs`) subtracts `content_box_inset` (padding+border) from `available_space` before calling the measure fn, but passes `known_dimensions` — the outer border-box size — untouched. The two arguments are therefore in different coordinate spaces, and neither `IntrinsicMeasure`'s trait doc (box_tree.rs:114-122) nor this closure says so. `TextIntrinsic::measure` (rustmotion-components/src/intrinsic.rs:224) prefers `known.0` as its wrap width, while `Text::paint` wraps at `layout.content_box()` width (legacy_dispatch.rs:145-155). A `text` with horizontal padding is therefore measured at a wider line width than it is painted at: fewer wrapped lines, a reserved box one line too short, and the text spills out of its own box. The geometry validator re-measures through the same intrinsic, so it signs the overflow off. intrinsic.rs:258-265 explicitly asserts the opposite ("taffy hands a leaf its own known/available height already padding/border-subtracted") — true for `available`, false for `known`.

Refs #220
---
 .../rustmotion-core/src/css/taffy_bridge.rs   | 61 ++++++++++++++
 .../rustmotion-core/src/engine/layout_pass.rs | 34 ++++++--
 crates/rustmotion-core/tests/audit_ws_j.rs    | 81 ++++++++++++++++++-
 3 files changed, 167 insertions(+), 9 deletions(-)

diff --git a/crates/rustmotion-core/src/css/taffy_bridge.rs b/crates/rustmotion-core/src/css/taffy_bridge.rs
index 380cb86d..e30401ce 100644
--- a/crates/rustmotion-core/src/css/taffy_bridge.rs
+++ b/crates/rustmotion-core/src/css/taffy_bridge.rs
@@ -238,6 +238,67 @@ pub fn to_taffy_style(css: &CssStyle, ctx: &ConversionContext) -> tf::Style {
     style
 }
 
+/// Resolve `padding` + `border` width into a single content-box inset, in
+/// px, per axis: `(horizontal, vertical)` i.e. `(left + right, top +
+/// bottom)`.
+///
+/// Mirrors what taffy 0.10.1's own `compute_leaf_layout` (`content_box_inset
+/// = padding + border`) subtracts from a leaf's `available_space` before
+/// handing it to the measure function — see [`crate::engine::layout_pass`],
+/// which uses this to bring `known_dimensions` (still border-box) into that
+/// same content-box space. Percentage padding/border resolves
+/// against `ctx.length.parent_size` like every other percentage in this
+/// module; a leaf's own known/available width is not threaded here, so a
+/// percentage inset on a leaf is only as accurate as that shared context.
+pub(crate) fn content_box_inset(css: &CssStyle, ctx: &ConversionContext) -> (f32, f32) {
+    let (pt, pr, pb, pl) = css.padding.as_ref().map(Edges::resolve).unwrap_or_default();
+    let padding = (
+        pt.resolve(&ctx.length),
+        pr.resolve(&ctx.length),
+        pb.resolve(&ctx.length),
+        pl.resolve(&ctx.length),
+    );
+    let border = resolve_border_widths_px(css.border.as_ref(), ctx);
+    (
+        padding.1 + padding.3 + border.1 + border.3,
+        padding.0 + padding.2 + border.0 + border.2,
+    )
+}
+
+fn resolve_border_widths_px(
+    b: Option<&super::style::BorderEdges>,
+    ctx: &ConversionContext,
+) -> (f32, f32, f32, f32) {
+    let Some(b) = b else {
+        return (0.0, 0.0, 0.0, 0.0);
+    };
+    let uniform = b.width.as_ref().map(Edges::resolve);
+    let pick_side = |side: Option<&super::style::BorderSide>, idx: usize| -> f32 {
+        if let Some(side) = side {
+            if let Some(w) = side.width.as_ref() {
+                return w.resolve(&ctx.length);
+            }
+        }
+        if let Some((t, r, btm, l)) = uniform.as_ref() {
+            let pick = match idx {
+                0 => t,
+                1 => r,
+                2 => btm,
+                3 => l,
+                _ => t,
+            };
+            return pick.resolve(&ctx.length);
+        }
+        0.0
+    };
+    (
+        pick_side(b.top.as_ref(), 0),
+        pick_side(b.right.as_ref(), 1),
+        pick_side(b.bottom.as_ref(), 2),
+        pick_side(b.left.as_ref(), 3),
+    )
+}
+
 fn align_items_to_taffy(a: AlignItems) -> tf::AlignItems {
     match a {
         AlignItems::Stretch => tf::AlignItems::Stretch,
diff --git a/crates/rustmotion-core/src/engine/layout_pass.rs b/crates/rustmotion-core/src/engine/layout_pass.rs
index 21c6ce73..386c201d 100644
--- a/crates/rustmotion-core/src/engine/layout_pass.rs
+++ b/crates/rustmotion-core/src/engine/layout_pass.rs
@@ -5,7 +5,7 @@ use std::collections::HashMap;
 use taffy::prelude as tf;
 use taffy::TaffyTree;
 
-use crate::css::taffy_bridge::{to_taffy_style, ConversionContext};
+use crate::css::taffy_bridge::{content_box_inset, to_taffy_style, ConversionContext};
 use crate::css::units::LengthContext;
 use crate::engine::box_tree::{BoxNode, IntrinsicMeasure, NodeId};
 
@@ -70,10 +70,20 @@ impl LayoutResult {
 
 /// Per-node user data stored in the taffy tree to keep the link between
 /// taffy nodes and our `BoxNode` ids + intrinsic measurers.
+///
+/// `inset_width`/`inset_height` are this node's own resolved padding+border
+///: taffy's `compute_leaf_layout` already subtracts them from
+/// `available_space` before calling the measure function, but forwards
+/// `known_dimensions` — the outer border-box size — untouched, handing an
+/// `IntrinsicMeasure` implementor two arguments in different coordinate
+/// spaces. The measure closure below subtracts the same inset from `known`
+/// so both arguments describe the content box.
 struct NodeData {
     #[allow(dead_code)]
     box_id: NodeId,
     intrinsic: Option<std::sync::Arc<dyn IntrinsicMeasure>>,
+    inset_width: f32,
+    inset_height: f32,
 }
 
 /// Run taffy on a [`BoxNode`] tree and return the resolved layouts.
@@ -102,8 +112,12 @@ pub fn run_layout(root: &BoxNode, viewport: (f32, f32), ctx: &ConversionContext)
             let Some(intr) = ctx.intrinsic.as_ref() else {
                 return tf::Size::ZERO;
             };
+            let content_known = (
+                known.width.map(|w| (w - ctx.inset_width).max(0.0)),
+                known.height.map(|h| (h - ctx.inset_height).max(0.0)),
+            );
             let (w, h) = intr.measure(
-                (known.width, known.height),
+                content_known,
                 (available.width.into(), available.height.into()),
             );
             tf::Size {
@@ -125,12 +139,13 @@ pub fn run_layout(root: &BoxNode, viewport: (f32, f32), ctx: &ConversionContext)
 /// `inherited_font_size` is the already-resolved (px) font-size of `node`'s
 /// parent: CSS resolves `em` on every layout property against the
 /// element's *own* computed font-size, and font-size itself inherits down
-/// the tree unless overridden. `to_taffy_style` only ever sees the single
-/// `ConversionContext` handed to it, so its `em` resolution is only as
-/// correct as the per-node context built here — a call site building one
-/// shared `ConversionContext` for the whole tree (as every production
-/// caller of `to_taffy_style` still does directly) resolves every node's
-/// `em` against that one context's `font_size` instead.
+/// the tree unless overridden. `to_taffy_style` and [`content_box_inset`]
+/// only ever see the single `ConversionContext` handed to them, so their
+/// `em` resolution is only as correct as the per-node context built here —
+/// a call site building one shared `ConversionContext` for the whole tree
+/// (as every production caller of `to_taffy_style` still does directly)
+/// resolves every node's `em` against that one context's `font_size`
+/// instead.
 fn build(
     tree: &mut TaffyTree<NodeData>,
     map: &mut HashMap<NodeId, tf::NodeId>,
@@ -153,9 +168,12 @@ fn build(
     };
 
     let style = to_taffy_style(&node.css, &node_ctx);
+    let (inset_width, inset_height) = content_box_inset(&node.css, &node_ctx);
     let data = NodeData {
         box_id: node.id,
         intrinsic: node.intrinsic.clone(),
+        inset_width,
+        inset_height,
     };
     let tf_id = if node.intrinsic.is_some() || node.children.is_empty() {
         tree.new_leaf_with_context(style, data)
diff --git a/crates/rustmotion-core/tests/audit_ws_j.rs b/crates/rustmotion-core/tests/audit_ws_j.rs
index c63d1b5d..6b3501b9 100644
--- a/crates/rustmotion-core/tests/audit_ws_j.rs
+++ b/crates/rustmotion-core/tests/audit_ws_j.rs
@@ -1,10 +1,12 @@
 //! Regression tests for the workstream J (layout pass & CSS unit resolution)
 //! audit findings on unit resolution and intrinsic measurement.
 
+use std::sync::{Arc, Mutex};
+
 use rustmotion_core::css::style::{CssStyle, Edges, Size as CSize};
 use rustmotion_core::css::taffy_bridge::ConversionContext;
 use rustmotion_core::css::units::{Length, LengthPercentage as CLP};
-use rustmotion_core::engine::box_tree::BoxNode;
+use rustmotion_core::engine::box_tree::{AvailableSpace, BoxNode, IntrinsicMeasure};
 use rustmotion_core::engine::layout_pass::run_layout;
 
 // ---- `em` on layout properties must resolve against the element's
@@ -45,3 +47,80 @@ fn em_padding_resolves_against_inherited_font_size_not_a_constant_16px() {
     );
     assert_eq!(content_w, 200.0 - 2.0 * 48.0);
 }
+
+// ---- a leaf's `IntrinsicMeasure::measure` must receive `known` and
+// `available` in the same (content-box) coordinate space ----
+
+type RecordedCall = ((Option<f32>, Option<f32>), (AvailableSpace, AvailableSpace));
+
+#[derive(Default)]
+struct RecordingIntrinsic {
+    calls: Mutex<Vec<RecordedCall>>,
+}
+
+impl IntrinsicMeasure for RecordingIntrinsic {
+    fn measure(
+        &self,
+        known: (Option<f32>, Option<f32>),
+        available: (AvailableSpace, AvailableSpace),
+    ) -> (f32, f32) {
+        self.calls.lock().unwrap().push((known, available));
+        (50.0, 30.0)
+    }
+}
+
+/// A leaf with 20px uniform padding, stretched to its column-flex parent's
+/// full 300px content width but auto-height (so taffy must measure its
+/// intrinsic height with the width already resolved). Any call where
+/// `known.0` is definite must agree with `available.0` when that is also
+/// definite: both describe the same box, and per taffy 0.10.1's own
+/// `compute_leaf_layout`, `available_space` has already had padding+border
+/// subtracted before reaching the measure function.
+#[test]
+fn measure_fn_known_and_available_agree_on_content_box_width() {
+    use rustmotion_core::css::style::{AlignItems, Display, FlexDirection};
+
+    let recorder = Arc::new(RecordingIntrinsic::default());
+    let leaf = BoxNode::leaf(
+        CssStyle {
+            padding: Some(Edges::Uniform(CLP::Px(20.0))),
+            ..Default::default()
+        },
+        recorder.clone(),
+    );
+    let mut root = BoxNode::container(
+        CssStyle {
+            display: Some(Display::Flex),
+            flex_direction: Some(FlexDirection::Column),
+            align_items: Some(AlignItems::Stretch),
+            width: Some(CSize::Length(CLP::Px(300.0))),
+            height: Some(CSize::Length(CLP::Px(300.0))),
+            ..Default::default()
+        },
+        vec![leaf],
+    );
+    root.assign_ids(1);
+
+    run_layout(&root, (300.0, 300.0), &ConversionContext::default());
+
+    let calls = recorder.calls.lock().unwrap();
+    let definite_known_calls: Vec<_> = calls
+        .iter()
+        .filter(|(known, _)| known.0.is_some())
+        .collect();
+    assert!(
+        !definite_known_calls.is_empty(),
+        "expected at least one measure call with a definite known width, got {calls:?}"
+    );
+
+    for (known, available) in definite_known_calls {
+        if let AvailableSpace::Definite(available_w) = available.0 {
+            assert_eq!(
+                known.0.unwrap(),
+                available_w,
+                "known.width and available.width must describe the same \
+                 (content-box) box; known={known:?} available={available:?}"
+            );
+        }
+    }
+}

From 1bfa4bcc57464033a170cffc4c795eccb894ab04 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 10:58:14 +0200
Subject: [PATCH 14/56] fix(animator): start the underdamped spring from rest
 (#285)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The closed-form underdamped step response is `1 - e^(-zeta*omega*t) * [cos(omega_d*t) + (zeta*omega/omega_d)*sin(omega_d*t)]`. The code feeds `zeta*omega*t/omega_d` into `sin()` instead of `omega_d*t` — the `t` was multiplied into the coefficient instead of the phase. I verified this numerically against a 400k-step ODE integration of `m*x'' + c*x' + k*x = k`: the correct formula matches the integrator to 5 decimals, the repo formula does not. With the shipped defaults (damping 15, stiffness 100, mass 1, zeta = 0.75), at the first 60fps frame after the start (t = 0.0167 s) the solver reports 0.10416 of the travel where the physics gives 0.01282 — 8x. Initial velocity is 6.21/s instead of 0, so the element visibly snaps on frame 1 rather than easing out of rest, and the overshoot peak is wrong too (1.0194 vs 1.0284). This affects every spring path in the engine: `EasingType::Spring` keyframes, the `bounce_in` preset (kf_anim_spring, zeta = 0.6, animator.rs:2092), `elastic_in` (kf_anim_spring_underdamped, zeta = 0.274, animator.rs:2106), and every author-supplied `spring` override applied through `apply_spring_to_motion`. `spring_settle_time`/`spring_rest_time` (what `rustmotion info` reports and what the `spring.duration` remap divides by) are derived from the same wrong curve.

Refs #220
---
 crates/rustmotion-core/src/engine/animator.rs | 24 ++++----
 crates/rustmotion-core/tests/audit_ws_a.rs    | 60 +++++++++++++++++++
 2 files changed, 73 insertions(+), 11 deletions(-)

diff --git a/crates/rustmotion-core/src/engine/animator.rs b/crates/rustmotion-core/src/engine/animator.rs
index 0cac4401..42c42787 100644
--- a/crates/rustmotion-core/src/engine/animator.rs
+++ b/crates/rustmotion-core/src/engine/animator.rs
@@ -500,8 +500,7 @@ fn spring_value_raw(t: f64, damping: f64, stiffness: f64, mass: f64) -> f64 {
         // Underdamped
         let omega_d = omega * (1.0 - zeta * zeta).sqrt();
         let decay = (-zeta * omega * t).exp();
-        1.0 - decay
-            * ((zeta * omega * t / omega_d).sin() * (zeta * omega / omega_d) + (omega_d * t).cos())
+        1.0 - decay * ((omega_d * t).sin() * (zeta * omega / omega_d) + (omega_d * t).cos())
     } else if (zeta - 1.0).abs() < 1e-6 {
         // Critically damped
         let decay = (-omega * t).exp();
@@ -2838,19 +2837,22 @@ mod spring_duration_tests {
         //
         // damping=6, stiffness=120, mass=1 (the same "underdamped" preset
         // this file already uses for elastic_in / kf_anim_spring_underdamped)
-        // at t=0.8s: spring_value_raw(0.8, 6, 120, 1) ~= 1.043467 — 4.35%
-        // past the target, an order of magnitude outside any reasonable
-        // rest_threshold (default 0.5%). An author asking this spring to
-        // "finish at 0.8s" got a value nowhere near rest.
+        // at t=0.8s: spring_value_raw(0.8, 6, 120, 1) ~= 1.027616 — 2.76%
+        // past the target, well outside any reasonable rest_threshold
+        // (default 0.5%). An author asking this spring to "finish at 0.8s"
+        // got a value nowhere near rest. Reference recomputed when the
+        // (issue #220): the solver's underdamped branch fed the wrong
+        // argument to its sine term, so this captured value moved when that
+        // was corrected.
         let v = spring_value_raw(0.8, 6.0, 120.0, 1.0);
         assert!(
-            (v - 1.043467).abs() < 1e-5,
-            "captured red-phase reference value drifted: got {v}, expected ~1.043467"
+            (v - 1.027616).abs() < 1e-5,
+            "captured red-phase reference value drifted: got {v}, expected ~1.027616"
         );
         assert!(
-            (v - 1.0).abs() > 0.04,
+            (v - 1.0).abs() > 0.02,
             "red-phase claim: at t=duration the unscaled spring must still be far from rest \
-             (got diff {:.6}, expected > 0.04)",
+             (got diff {:.6}, expected > 0.02)",
             (v - 1.0).abs()
         );
     }
@@ -2867,7 +2869,7 @@ mod spring_duration_tests {
         let threshold = DEFAULT_SPRING_REST_THRESHOLD;
 
         // Green phase: the same (damping, stiffness, mass) that the
-        // red-phase test above showed is 4.35% off at t=0.8s without a
+        // red-phase test above showed is 2.76% off at t=0.8s without a
         // `duration` must now be within `threshold` of rest at t=0.8s.
         let v_at_duration = spring_value(0.8, &config);
         assert!(
diff --git a/crates/rustmotion-core/tests/audit_ws_a.rs b/crates/rustmotion-core/tests/audit_ws_a.rs
index 0eb5f7e5..d42a55bf 100644
--- a/crates/rustmotion-core/tests/audit_ws_a.rs
+++ b/crates/rustmotion-core/tests/audit_ws_a.rs
@@ -7,9 +7,11 @@ use rustmotion_core::css::style::{
 };
 use rustmotion_core::css::taffy_bridge::ConversionContext;
 use rustmotion_core::css::units::{Length, LengthPercentage as CLP};
+use rustmotion_core::engine::animator::spring_value;
 use rustmotion_core::engine::box_tree::{BoxKind, BoxNode};
 use rustmotion_core::engine::layout_pass::run_layout;
 use rustmotion_core::engine::paint_pass::{paint_tree, NoopDispatcher, PaintFrame};
+use rustmotion_core::schema::SpringConfig;
 
 fn test_frame(w: u32, h: u32) -> PaintFrame {
     PaintFrame {
@@ -131,3 +133,61 @@ fn opacity_layer_does_not_clip_own_outset_box_shadow() {
         "an opacity<1 layer must not clip the node's own outset box-shadow, got {above_faded:?}"
     );
 }
+
+// ---- underdamped spring step response must start from rest ----
+
+fn spring_config(damping: f64, stiffness: f64, mass: f64) -> SpringConfig {
+    SpringConfig {
+        damping,
+        stiffness,
+        mass,
+        duration: None,
+        rest_threshold: None,
+    }
+}
+
+#[test]
+fn underdamped_spring_step_response_starts_at_rest() {
+    // Shipped defaults named in the audit finding: damping=15, stiffness=100,
+    // mass=1 -> zeta=0.75 (underdamped). A step response that starts from
+    // rest has ~0 velocity at t=0; a wrong sine-argument formula produces a
+    // jolt of about 6.21/s instead.
+    let config = spring_config(15.0, 100.0, 1.0);
+    let h = 1e-5;
+    let v0 = spring_value(0.0, &config);
+    assert!(v0.abs() < 1e-9, "sanity: spring must start at 0, got {v0}");
+
+    let vh = spring_value(h, &config);
+    let slope = (vh - v0) / h;
+    assert!(
+        slope.abs() < 0.05,
+        "underdamped step response must start at rest (~0 initial velocity), got slope {slope}"
+    );
+}
+
+#[test]
+fn underdamped_spring_matches_the_analytic_closed_form() {
+    // Reference computed independently of the engine's implementation from
+    // the textbook closed form for an underdamped step response:
+    //   1 - e^{-zeta*omega*t} * [cos(omega_d*t) + (zeta*omega/omega_d)*sin(omega_d*t)]
+    let damping = 15.0_f64;
+    let stiffness = 100.0_f64;
+    let mass = 1.0_f64;
+    let omega = (stiffness / mass).sqrt();
+    let zeta = damping / (2.0 * (stiffness * mass).sqrt());
+    let omega_d = omega * (1.0 - zeta * zeta).sqrt();
+    let reference = |t: f64| -> f64 {
+        let decay = (-zeta * omega * t).exp();
+        1.0 - decay * ((omega_d * t).cos() + (zeta * omega / omega_d) * (omega_d * t).sin())
+    };
+
+    let config = spring_config(damping, stiffness, mass);
+    for t in [0.0, 1.0 / 60.0, 0.1, 0.3, 0.6, 1.0] {
+        let expected = reference(t);
+        let actual = spring_value(t, &config);
+        assert!(
+            (actual - expected).abs() < 1e-6,
+            "t={t}: expected {expected} (analytic reference), got {actual}"
+        );
+    }
+}

From 4886960cefc9e89b06f42e5fa59e5c6894f3254a Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 10:58:40 +0200
Subject: [PATCH 15/56] fix(geometry): resolve transform lengths per axis and
 per font-size (#286)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`apply_transform_chain` resolves `translate`/`translateX`/`translateY` lengths through this context. The paint pass resolves the very same functions through `LengthContext { ..., parent_size: box_layout.width.max(height), font_size: node.css.font_size_px_or(16.0), ... }` and then splits it into per-axis `length_ctx_x`/`length_ctx_y` (crates/rustmotion-core/src/engine/paint_pass.rs:229-250, used at :953-962). Two divergences: (a) `em` — a `font-size: 96px` text with `transform: "translateX(-10em)"` is moved -960px by the renderer but only -160px by the validator, so a component at x=200 that renders at x=-760 (fully off-frame) validates clean; (b) percentage translate — the validator uses `max(w, h)` on both axes, the exact mistake paint_pass.rs:236-242 calls out in a comment ("never max(width, height) on both axes"), which over-estimates on the short axis and produces false positives. Note the `--strict-anim` path funnels animated transforms through this same function (geometry.rs:1482), so it inherits both errors.

Refs #220
---
 .../rustmotion/src/cli/commands/geometry.rs   | 49 +++++++++--
 crates/rustmotion/tests/audit_ws_b.rs         | 88 +++++++++++++++++++
 2 files changed, 130 insertions(+), 7 deletions(-)

diff --git a/crates/rustmotion/src/cli/commands/geometry.rs b/crates/rustmotion/src/cli/commands/geometry.rs
index 0fd7d069..e1c10bf4 100644
--- a/crates/rustmotion/src/cli/commands/geometry.rs
+++ b/crates/rustmotion/src/cli/commands/geometry.rs
@@ -473,6 +473,16 @@ fn container_clips(c: &Component) -> bool {
 /// path, out of scope for this fix. Animated transform-producing presets are
 /// folded separately in `walk_anim`; this only handles what a component
 /// declares directly in `style.transform`.
+///
+/// `font_size` is the NODE's own resolved font-size
+/// (`css.font_size_px_or(16.0)`), not a hardcoded 16px — an `em` length in
+/// `transform` must scale with the element it's declared on, exactly like
+/// `paint_pass.rs`'s `length_ctx` does for the same field. Percentage
+/// lengths inside `transform` resolve per axis (`ctx_x`/`ctx_y`, mirroring
+/// `paint_pass.rs`'s `length_ctx_x`/`length_ctx_y`) rather than against a
+/// single `bbox.w.max(bbox.h)` shared by both axes — see
+/// `apply_transform_chain`'s doc comment for why a shared context there was
+/// wrong for every non-square box.
 fn apply_static_node_transform(bbox: &BBox, css: &CssStyle, viewport: (f32, f32)) -> BBox {
     let transform = match css.transform.as_deref() {
         Some(t) if !t.is_empty() => t,
@@ -482,9 +492,17 @@ fn apply_static_node_transform(bbox: &BBox, css: &CssStyle, viewport: (f32, f32)
         viewport_width: viewport.0,
         viewport_height: viewport.1,
         parent_size: bbox.w.max(bbox.h),
-        font_size: 16.0,
+        font_size: css.font_size_px_or(16.0),
         root_font_size: 16.0,
     };
+    let ctx_x = LengthContext {
+        parent_size: bbox.w,
+        ..ctx
+    };
+    let ctx_y = LengthContext {
+        parent_size: bbox.h,
+        ..ctx
+    };
     let (pivot_x, pivot_y) = resolve_transform_origin_2d(css.transform_origin.as_ref(), bbox, &ctx);
     let corners = [
         (bbox.x, bbox.y),
@@ -498,7 +516,7 @@ fn apply_static_node_transform(bbox: &BBox, css: &CssStyle, viewport: (f32, f32)
     let mut min_y = f32::INFINITY;
     let mut max_y = f32::NEG_INFINITY;
     for (cx, cy) in corners {
-        let (tx, ty) = apply_transform_chain(transform, cx - pivot_x, cy - pivot_y, &ctx);
+        let (tx, ty) = apply_transform_chain(transform, cx - pivot_x, cy - pivot_y, &ctx_x, &ctx_y);
         let (wx, wy) = (pivot_x + tx, pivot_y + ty);
         min_x = min_x.min(wx);
         max_x = max_x.max(wx);
@@ -584,15 +602,32 @@ fn resolve_transform_origin_2d(
 /// clockwise on a y-down canvas, i.e. `x' = x·cosθ − y·sinθ`,
 /// `y' = x·sinθ + y·cosθ`); `Skew`/`SkewX`/`SkewY` match `Canvas::skew`
 /// (`x' = x + y·tan(skew_x)`, `y' = y + x·tan(skew_y)`).
-fn apply_transform_chain(list: &[TransformFn], x: f32, y: f32, ctx: &LengthContext) -> (f32, f32) {
+///
+/// `ctx_x`/`ctx_y` are separate contexts differing only in
+/// `parent_size` (the box's own width / height respectively), used for
+/// `Translate`/`TranslateX`/`TranslateY`/`Translate3d`'s percentage
+/// resolution — CSS resolves a translate's x-component percentage against
+/// the box's own WIDTH and the y-component against its own HEIGHT, never a
+/// single value shared by both axes (that's only correct for square boxes).
+/// `Scale`/`Rotate`/`Skew` take unitless factors/degrees and never consult
+/// either context.
+fn apply_transform_chain(
+    list: &[TransformFn],
+    x: f32,
+    y: f32,
+    ctx_x: &LengthContext,
+    ctx_y: &LengthContext,
+) -> (f32, f32) {
     let (mut x, mut y) = (x, y);
     for f in list.iter().rev() {
         let (nx, ny) = match f {
-            TransformFn::Translate { x: tx, y: ty } => (x + tx.resolve(ctx), y + ty.resolve(ctx)),
-            TransformFn::TranslateX { x: tx } => (x + tx.resolve(ctx), y),
-            TransformFn::TranslateY { y: ty } => (x, y + ty.resolve(ctx)),
+            TransformFn::Translate { x: tx, y: ty } => {
+                (x + tx.resolve(ctx_x), y + ty.resolve(ctx_y))
+            }
+            TransformFn::TranslateX { x: tx } => (x + tx.resolve(ctx_x), y),
+            TransformFn::TranslateY { y: ty } => (x, y + ty.resolve(ctx_y)),
             TransformFn::Translate3d { x: tx, y: ty, .. } => {
-                (x + tx.resolve(ctx), y + ty.resolve(ctx))
+                (x + tx.resolve(ctx_x), y + ty.resolve(ctx_y))
             }
             TransformFn::Scale { x: sx, y: sy } => (x * sx, y * sy),
             TransformFn::ScaleX { x: sx } => (x * sx, y),
diff --git a/crates/rustmotion/tests/audit_ws_b.rs b/crates/rustmotion/tests/audit_ws_b.rs
index 6d8ee899..25b511ac 100644
--- a/crates/rustmotion/tests/audit_ws_b.rs
+++ b/crates/rustmotion/tests/audit_ws_b.rs
@@ -194,3 +194,91 @@ fn strict_anim_also_measures_vw_against_the_real_viewport_width() {
         "--strict-anim pass (line ~1347) must also be clean: {report_json}"
     );
 }
+
+// ─── static transform lengths use the node's own font-size and per-axis size ───
+
+/// `translateX(-10em)` on a 96px-font node must resolve against ITS OWN
+/// font-size (960px), not the hardcoded 16px `apply_static_node_transform`
+/// used to assume (160px). At x=200 with a 100px-wide box, the correct
+/// translate pushes the box to x=-760 (fully off-frame, a real violation);
+/// the buggy 160px translate only reaches x=40 (still on-frame, silent).
+#[test]
+fn static_translate_em_resolves_against_the_nodes_own_font_size() {
+    let scenario = ScratchFile::new("rm15-em-scenario");
+    let report = ScratchFile::new("rm15-em-report");
+    let json = r##"{
+        "video": { "width": 1920, "height": 1080 },
+        "scenes": [{
+            "duration": 1.0,
+            "children": [{
+                "type": "shape",
+                "shape": "rect",
+                "position": "absolute",
+                "x": 200, "y": 400,
+                "style": {
+                    "width": "100px", "height": "50px",
+                    "font-size": "96px",
+                    "transform": [{ "fn": "translate-x", "x": "-10em" }]
+                },
+                "fill": "#ff0000"
+            }]
+        }]
+    }"##;
+    std::fs::write(&scenario.0, json).expect("write scenario");
+
+    let output = run_validate(&scenario.0, Some(&report.0), false, false);
+    let report_json = read_report(&report.0);
+    assert!(
+        !output.status.success(),
+        "a -10em translate on a 96px-font node must push the shape off-frame; report={report_json}"
+    );
+    let violation = find_kind(&report_json, "viewport_overflow")
+        .expect("expected a viewport_overflow violation");
+    let x = violation["bbox"]["x"].as_f64().expect("bbox.x is a number");
+    assert!(
+        (x - (-760.0)).abs() < 2.0,
+        "expected bbox.x ~ -760 (200 - 10*96), got {x}: {report_json}"
+    );
+}
+
+/// `translateY(50%)` on a WIDE, SHORT box (1000×100) must resolve against
+/// its OWN height (50px), not `max(width, height)` (500px) — the exact
+/// mistake `paint_pass.rs`'s `length_ctx_x`/`length_ctx_y` split exists to
+/// avoid. The correct 50px shift keeps the box on-frame; the buggy 500px
+/// shift pushes its bottom edge to 1400px, past the 1080px-tall viewport.
+#[test]
+fn static_translate_percent_resolves_per_axis_not_against_max_of_both() {
+    let scenario = ScratchFile::new("rm15-percent-scenario");
+    let report = ScratchFile::new("rm15-percent-report");
+    let json = r##"{
+        "video": { "width": 1920, "height": 1080 },
+        "scenes": [{
+            "duration": 1.0,
+            "children": [{
+                "type": "shape",
+                "shape": "rect",
+                "position": "absolute",
+                "x": 100, "y": 800,
+                "style": {
+                    "width": "1000px", "height": "100px",
+                    "transform": [{ "fn": "translate-y", "y": "50%" }]
+                },
+                "fill": "#ff0000"
+            }]
+        }]
+    }"##;
+    std::fs::write(&scenario.0, json).expect("write scenario");
+
+    let output = run_validate(&scenario.0, Some(&report.0), false, false);
+    let report_json = read_report(&report.0);
+    assert!(
+        output.status.success(),
+        "a 50% translateY on a 1000x100 box must resolve against its own 100px height \
+         (50px shift, still on-frame), not max(1000,100); report={report_json}"
+    );
+    assert_eq!(
+        count_kind(&report_json, "viewport_overflow"),
+        0,
+        "{report_json}"
+    );
+}

From 91c1868d05b31fc1b4e81347d90f22213f1b9260 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 10:59:01 +0200
Subject: [PATCH 16/56] fix(geometry): check height overflow when white-space
 is nowrap (#231)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`check_unwrappable_text` — the only check left for a nowrap node — compares width only and always emits `Axis::X` (geometry.rs:781-793). So the Y axis is unchecked for any `white-space: nowrap|pre` text. `{"type":"text","content":"Hi","style":{"font-size":"120px","white-space":"nowrap","height":"40px"}}` has a single line ~156px tall painted out of a 40px content box and validates clean; delete the `white-space` key and the identical fixture is correctly reported as `ContentOverflowsBox`/`Axis::Y` (proved by the existing test `wrapped_text_taller_than_its_fixed_height_card_is_flagged`, geometry.rs:2806). The stated rationale only justifies skipping the *wrap-dependent* width re-measure; a nowrap node's height is exactly one `line_height` and needs no wrapping to compute.

Refs #220
---
 .../rustmotion/src/cli/commands/geometry.rs   | 116 +++++++++----
 .../rustmotion/src/cli/commands/validate.rs   |  21 ++-
 crates/rustmotion/tests/audit_ws_b.rs         | 164 ++++++++++++++++++
 3 files changed, 268 insertions(+), 33 deletions(-)

diff --git a/crates/rustmotion/src/cli/commands/geometry.rs b/crates/rustmotion/src/cli/commands/geometry.rs
index e1c10bf4..f90c2b08 100644
--- a/crates/rustmotion/src/cli/commands/geometry.rs
+++ b/crates/rustmotion/src/cli/commands/geometry.rs
@@ -300,7 +300,7 @@ fn walk(
                 check_unwrappable_text(
                     &child.component,
                     &child_path,
-                    &raw_bbox,
+                    layout,
                     viewport,
                     vi,
                     si,
@@ -791,10 +791,32 @@ fn measurer_and_nowrap(component: &Component) -> Option<(Box<dyn IntrinsicMeasur
     }
 }
 
+/// natural (unwrapped) width vs the node's own CONTENT box, not its
+/// border box. `LegacyPaintDispatcher::dispatch` hands every non-codeblock
+/// painter (`Text`/`GradientText`/`Caption` included) a synthetic
+/// `BoxLayout` built from `layout.content_box()`, translated to the
+/// content-box origin — so the painter wraps and draws inside the content
+/// box, not the raw taffy layout box this walker reads. Comparing against
+/// the border box (as this used to) under-reports by exactly
+/// `padding.left + padding.right + border.left + border.right`, mirroring
+/// the same fix `check_content_overflows_box` already applies for the
+/// wrapped case.
+///
+/// Measured via the same cosmic-text–backed intrinsic the layout engine
+/// uses. Width is bounded by the node's own resolved content-box width
+/// (not `MaxContent`) so a `text-autofit: true` node can shrink to fit it —
+/// see `measurer_and_nowrap`'s `TextIntrinsic`/`GradientTextIntrinsic` arms
+/// and `CssStyle::text_autofit`'s doc comment. For a non-autofit node this
+/// changes nothing: `TextIntrinsic::measure` only reads the width
+/// constraint at all when `text_autofit` is on (see its early return), and
+/// `nowrap` already forces a single unwrapped line here regardless of what
+/// width is offered — so `natural_w` below is "natural" in the non-autofit
+/// case exactly as before, and "shrunk to fit, if that's enough" when the
+/// author declared it.
 fn check_unwrappable_text(
     component: &Component,
     path: &str,
-    bbox: &BBox,
+    layout: &BoxLayout,
     viewport: (u32, u32),
     vi: usize,
     si: usize,
@@ -806,22 +828,12 @@ fn check_unwrappable_text(
     if !nowrap {
         return;
     }
-    // Measure via the same cosmic-text–backed intrinsic the layout engine
-    // uses. Width is bounded by the node's own resolved `bbox.w` (not
-    // `MaxContent`) so a `text-autofit: true` node can shrink to fit it —
-    // see `measurer_and_nowrap`'s `TextIntrinsic`/`GradientTextIntrinsic`
-    // arms and `CssStyle::text_autofit`'s doc comment. For a non-autofit
-    // node this changes nothing: `TextIntrinsic::measure` only reads the
-    // width constraint at all when `text_autofit` is on (see its early
-    // return), and `nowrap` already forces a single unwrapped line here
-    // regardless of what width is offered — so `natural_w` below is
-    // "natural" in the non-autofit case exactly as before, and "shrunk to
-    // fit, if that's enough" when the author declared it.
+    let (cx, cy, cw, ch) = layout.content_box();
     let (natural_w, _) = intrinsic.measure(
         (None, None),
-        (AvailableSpace::Definite(bbox.w), AvailableSpace::MaxContent),
+        (AvailableSpace::Definite(cw), AvailableSpace::MaxContent),
     );
-    if natural_w > bbox.w + 0.5 {
+    if natural_w > cw + 0.5 {
         let kind = component_kind(component);
         out.push(GeometryViolation {
             view_index: vi,
@@ -830,11 +842,16 @@ fn check_unwrappable_text(
             component: kind.to_string(),
             axis: Axis::X,
             kind: ViolationKind::UnwrappableTextOverflow,
-            bbox: *bbox,
+            bbox: BBox {
+                x: cx,
+                y: cy,
+                w: cw,
+                h: ch,
+            },
             viewport,
             hint: format!(
                 "{kind} natural width is {natural_w:.0}px but only {:.0}px available — remove style.white-space: nowrap (or set it to normal) so it can wrap, or reduce style.font-size",
-                bbox.w
+                cw
             ),
         });
     }
@@ -856,14 +873,24 @@ fn check_unwrappable_text(
 /// (`codeblock`/`terminal` are deliberately excluded: their `auto_scroll`
 /// escape hatch makes a smaller-than-natural box intentional).
 ///
-/// Complementary to `check_unwrappable_text`, not overlapping with it:
-/// that one covers `white-space: nowrap`/`pre` (single unwrapped line, width
-/// only, measured at natural/unconstrained width). This one covers the
-/// default wrapping case — measured at the width the box actually *has*
-/// (`content_box().2`, unconstrained height) so it also catches a single
-/// unbreakable word/token/URL that's wider than the box even though wrap is
-/// on (wrapping can't break within a word), plus the width axis stays
-/// consistent with what will actually be painted.
+/// Complementary to `check_unwrappable_text`, not overlapping with it on the
+/// WIDTH axis: that one covers `white-space: nowrap`/`pre` (single unwrapped
+/// line, measured at natural/unconstrained width). This function covers the
+/// default wrapping case's width — measured at the width the box actually
+/// *has* (`content_box().2`, unconstrained height) so it also catches a
+/// single unbreakable word/token/URL that's wider than the box even though
+/// wrap is on (wrapping can't break within a word), plus the width axis
+/// stays consistent with what will actually be painted.
+///
+/// the HEIGHT axis is this function's job regardless of `nowrap` — a
+/// nowrap node used to return here before measuring height at all, so a
+/// single unwrapped line taller than its box validated clean. Re-measuring
+/// nowrap's WIDTH at a constrained space would wrap text that actually
+/// paints as one (too-wide) line, which is exactly why `check_unwrappable_
+/// text` owns that axis instead — but a single line's height is exactly one
+/// `line_height`, independent of any width constraint, so it's measured at
+/// `(MaxContent, Definite(ch))` and reported on `Axis::Y` only, leaving
+/// `Axis::X` to `check_unwrappable_text`.
 fn check_content_overflows_box(
     component: &Component,
     path: &str,
@@ -876,19 +903,44 @@ fn check_content_overflows_box(
     let Some((intrinsic, nowrap)) = measurer_and_nowrap(component) else {
         return;
     };
-    // nowrap/pre is check_unwrappable_text's territory: re-measuring it
-    // here at a constrained width would wrap text that will actually
-    // paint as one (too-wide) line, producing a height number that
-    // doesn't correspond to anything that gets painted.
-    if nowrap {
-        return;
-    }
 
     let (cx, cy, cw, ch) = layout.content_box();
     if cw <= 0.0 || ch <= 0.0 {
         return;
     }
 
+    if nowrap {
+        let (_, natural_h) = intrinsic.measure(
+            (None, None),
+            (AvailableSpace::MaxContent, AvailableSpace::Definite(ch)),
+        );
+        let eps = 0.5;
+        if natural_h <= ch + eps {
+            return;
+        }
+        let kind = component_kind(component);
+        out.push(GeometryViolation {
+            view_index: vi,
+            scene_index: si,
+            path: path.to_string(),
+            component: kind.to_string(),
+            axis: Axis::Y,
+            kind: ViolationKind::ContentOverflowsBox,
+            bbox: BBox {
+                x: cx,
+                y: cy,
+                w: cw,
+                h: ch,
+            },
+            viewport,
+            hint: format!(
+                "{kind} line is {natural_h:.0}px tall but its box is only {:.0}px tall — increase style.height (or the parent's), or reduce style.font-size",
+                ch
+            ),
+        });
+        return;
+    }
+
     // Height is bounded by the node's own resolved content-box height `ch`
     // (not `MaxContent`) for the same reason width is bounded by `cw`: a
     // `text-autofit: true` node can only try to shrink into a target it's
diff --git a/crates/rustmotion/src/cli/commands/validate.rs b/crates/rustmotion/src/cli/commands/validate.rs
index 62f8dc17..6c995d9b 100644
--- a/crates/rustmotion/src/cli/commands/validate.rs
+++ b/crates/rustmotion/src/cli/commands/validate.rs
@@ -108,6 +108,25 @@ fn refuse_fix(input: &Path, raw_source: &str) -> Option<FixRefusal> {
     None
 }
 
+/// The JSON `--fix` writes back, sourced independently of
+/// `LoadedScenario::raw`.
+///
+/// `loaded.raw` is captured *after* `rustmotion::assets::rebase_relative_paths`
+/// runs (`validation.rs`), which rewrites every `src`/`track` naming an
+/// existing file next to the scenario into a canonicalised ABSOLUTE path —
+/// serialising it back would silently replace `"assets/logo.png"` with
+/// this machine's own absolute path, which resolves nowhere else. By the
+/// time `refuse_fix` has let a file reach this function, it carries no
+/// `config`/`$var`/`include`/`for-each`/`use`, so variable substitution and
+/// directive expansion are no-ops on it too — parsing `raw_source` (the
+/// exact bytes still on disk) fresh yields the identical tree
+/// `apply_fixes`/`navigate`'s path indices were computed against, minus the
+/// rebase.
+fn fixable_source(raw_source: &str) -> Result<serde_json::Value> {
+    serde_json::from_str(raw_source)
+        .map_err(|e| RustmotionError::Generic(format!("re-parse source for --fix: {}", e)))
+}
+
 pub fn cmd_validate(
     input: &PathBuf,
     report: Option<&Path>,
@@ -142,7 +161,7 @@ pub fn cmd_validate(
         if let Some(refusal) = refuse_fix(input, &raw_source) {
             return Err(RustmotionError::Generic(refusal.explain(input)));
         }
-        let mut json_value = loaded.raw.clone();
+        let mut json_value = fixable_source(&raw_source)?;
         applied_fixes = apply_fixes(&mut json_value, &report_out.geom_violations);
         if applied_fixes > 0 {
             let pretty = serde_json::to_string_pretty(&json_value)
diff --git a/crates/rustmotion/tests/audit_ws_b.rs b/crates/rustmotion/tests/audit_ws_b.rs
index 25b511ac..c9c53469 100644
--- a/crates/rustmotion/tests/audit_ws_b.rs
+++ b/crates/rustmotion/tests/audit_ws_b.rs
@@ -282,3 +282,167 @@ fn static_translate_percent_resolves_per_axis_not_against_max_of_both() {
         "{report_json}"
     );
 }
+
+// ─── --fix must not bake in machine-absolute asset paths ───────────
+
+/// `--fix` used to serialise `LoadedScenario::raw`, captured AFTER
+/// `rustmotion::assets::rebase_relative_paths` rewrites every existing-file
+/// `src`/`track` into a canonicalised ABSOLUTE path — so fixing an
+/// unrelated violation (here, a too-wide nowrap text) silently replaced
+/// `"assets/logo.png"` with this machine's own absolute path. The asset
+/// file only needs to EXIST (rebasing is gated on `Path::is_file()`); its
+/// content is irrelevant here since geometry validation never decodes it
+/// (`Image` uses a fixed 400×300 default intrinsic size, not real pixel
+/// dimensions).
+#[test]
+fn fix_leaves_relative_asset_paths_untouched() {
+    let dir = ScratchDir::new("rm16");
+    std::fs::create_dir_all(dir.0.join("assets")).expect("mkdir assets");
+    std::fs::write(
+        dir.0.join("assets/logo.png"),
+        b"not a real png, just needs to exist",
+    )
+    .expect("write asset");
+    let scenario_path = dir.0.join("scenario.json");
+    let json = r##"{
+        "video": { "width": 1920, "height": 4000 },
+        "scenes": [{
+            "duration": 1.0,
+            "children": [
+                {
+                    "type": "image",
+                    "src": "assets/logo.png",
+                    "style": { "width": "200px", "height": "150px" }
+                },
+                {
+                    "type": "text",
+                    "content": "This is a fairly long sentence with several short words that will wrap nicely across many lines without any single word being too wide for the box.",
+                    "style": {
+                        "width": "300px", "height": "2000px",
+                        "color": "#ffffff", "font-size": "32px", "white-space": "nowrap"
+                    }
+                }
+            ]
+        }]
+    }"##;
+    std::fs::write(&scenario_path, json).expect("write scenario");
+
+    let output = run_validate(&scenario_path, None, /*fix=*/ true, false);
+    assert!(
+        output.status.success(),
+        "the only violation (the nowrap text) is fixed in place, so this run should now \
+         validate clean; stdout={} stderr={}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr)
+    );
+
+    let fixed: serde_json::Value = serde_json::from_str(
+        &std::fs::read_to_string(&scenario_path).expect("read fixed scenario"),
+    )
+    .expect("fixed scenario is valid JSON");
+    let src = fixed["scenes"][0]["children"][0]["src"]
+        .as_str()
+        .expect("image src is a string");
+    assert_eq!(
+        src, "assets/logo.png",
+        "the image src must stay exactly as authored, not rewritten to an absolute path: {fixed}"
+    );
+
+    let text_style = &fixed["scenes"][0]["children"][1]["style"];
+    assert!(
+        text_style.get("white-space").is_none(),
+        "the actual violation --fix targeted must still be fixed: {fixed}"
+    );
+}
+
+// ─── unwrappable_text_overflow must measure the CONTENT box ────────
+
+/// A nowrap text's own painter draws inside its CONTENT box
+/// (`LegacyPaintDispatcher` hands it `layout.content_box()`, not the raw
+/// layout box, for every component except `codeblock`) — so the geometry
+/// check must compare the natural line width against the content box too.
+/// Content box width here is 2000 - 1900 = 100px (950px of padding on each
+/// side); the border box is 2000px. Any real natural width for this
+/// string/font-size sits comfortably in between, so the violation fires if
+/// and only if the content box is used.
+#[test]
+fn unwrappable_text_overflow_is_measured_against_the_content_box() {
+    let scenario = ScratchFile::new("rm31-scenario");
+    let report = ScratchFile::new("rm31-report");
+    let json = r##"{
+        "video": { "width": 2400, "height": 1080 },
+        "scenes": [{
+            "duration": 1.0,
+            "children": [{
+                "type": "text",
+                "content": "Hello World Example",
+                "position": "absolute",
+                "x": 50, "y": 50,
+                "style": {
+                    "width": "2000px", "height": "300px",
+                    "padding": { "top": "20px", "right": "950px", "bottom": "20px", "left": "950px" },
+                    "white-space": "nowrap",
+                    "font-size": "48px",
+                    "color": "#ffffff"
+                }
+            }]
+        }]
+    }"##;
+    std::fs::write(&scenario.0, json).expect("write scenario");
+
+    let output = run_validate(&scenario.0, Some(&report.0), false, false);
+    let report_json = read_report(&report.0);
+    assert!(
+        !output.status.success(),
+        "the 100px content box (2000px border box minus 1900px of padding) is too narrow \
+         for this nowrap line; report={report_json}"
+    );
+    let violation = find_kind(&report_json, "unwrappable_text_overflow")
+        .expect("expected an unwrappable_text_overflow violation");
+    let width = violation["bbox"]["w"].as_f64().expect("bbox.w is a number");
+    assert!(
+        (width - 100.0).abs() < 1.0,
+        "violation bbox should be the 100px CONTENT box, not the 2000px border box: {report_json}"
+    );
+}
+
+// ─── white-space: nowrap must not silence the height check ─────────
+
+/// A single unwrapped 120px-font line is ~144px tall, well past a 40px-tall
+/// box — the exact case `content_overflows_box` already catches for
+/// wrapping text. `white-space: nowrap` used to return before measuring
+/// height at all, so this validated clean.
+#[test]
+fn nowrap_text_taller_than_its_box_is_still_flagged() {
+    let scenario = ScratchFile::new("rm32-scenario");
+    let report = ScratchFile::new("rm32-report");
+    let json = r##"{
+        "video": { "width": 1920, "height": 1080 },
+        "scenes": [{
+            "duration": 1.0,
+            "children": [{
+                "type": "text",
+                "content": "Hi",
+                "position": "absolute",
+                "x": 50, "y": 50,
+                "style": {
+                    "width": "500px", "height": "40px",
+                    "white-space": "nowrap",
+                    "font-size": "120px",
+                    "color": "#ffffff"
+                }
+            }]
+        }]
+    }"##;
+    std::fs::write(&scenario.0, json).expect("write scenario");
+
+    let output = run_validate(&scenario.0, Some(&report.0), false, false);
+    let report_json = read_report(&report.0);
+    assert!(
+        !output.status.success(),
+        "a 120px-font single line is far taller than a 40px box; report={report_json}"
+    );
+    let violation = find_kind(&report_json, "content_overflows_box")
+        .expect("expected a content_overflows_box violation");
+    assert_eq!(violation["axis"], "y", "{report_json}");
+}

From c16ec555cdaef22c984a667db26af28f542f4f3a Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 10:59:09 +0200
Subject: [PATCH 17/56] fix(geometry): compare terminal height in a single box
 model (#232)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`bbox.h` is `layout.height`, the border box. `LegacyPaintDispatcher::dispatch` treats only `Component::Codeblock(_)` as self-padding (`let is_self_padding = matches!(child.component, Component::Codeblock(_));`); every other painter, terminal included, receives a `BoxLayout` whose height is `layout.content_box()`'s `ch`. So a `terminal` with `auto_scroll: false` and `style.padding: "32px"` has 64px less drawable height than the check credits it with: content needing 500px in a 520px border box (456px content box) overflows by 44px and is reported clean. The codeblock arm just above is correct, because codeblock really is handed the border box — so the two arms of the same violation kind need different boxes and currently use the same one.

Refs #220
---
 .../rustmotion/src/cli/commands/geometry.rs   | 37 ++++---
 crates/rustmotion/tests/audit_ws_b.rs         | 98 +++++++++++++++++++
 2 files changed, 121 insertions(+), 14 deletions(-)

diff --git a/crates/rustmotion/src/cli/commands/geometry.rs b/crates/rustmotion/src/cli/commands/geometry.rs
index f90c2b08..22796887 100644
--- a/crates/rustmotion/src/cli/commands/geometry.rs
+++ b/crates/rustmotion/src/cli/commands/geometry.rs
@@ -307,15 +307,7 @@ fn walk(
                     out,
                 );
             }
-            check_auto_scroll(
-                &child.component,
-                &child_path,
-                &raw_bbox,
-                viewport,
-                vi,
-                si,
-                out,
-            );
+            check_auto_scroll(&child.component, &child_path, layout, viewport, vi, si, out);
             // Suppressed under a clipping ancestor (parent_clips) exactly
             // like check_viewport, and when the node clips its own overflow
             // (paint_pass applies a node's own `overflow: hidden`/clip/
@@ -1017,10 +1009,20 @@ fn check_content_overflows_box(
 /// `(None, None)`/`MaxContent` yields each component's natural (unbounded)
 /// size, exactly like `check_unwrappable_text`/`check_content_overflows_box`
 /// already do for the text-family intrinsics.
+///
+/// the codeblock and terminal arms compare against different boxes,
+/// on purpose. `LegacyPaintDispatcher::is_self_padding` matches only
+/// `Component::Codeblock` — a codeblock is handed the raw (border) layout
+/// box and paints its own padding inside it (`compute_code_dimensions`
+/// already bakes `style.padding_px()` into `natural_h`, so comparing against
+/// the border box is the byte-for-byte-correct pairing). Every other
+/// painter, terminal included, is handed `layout.content_box()` instead —
+/// so the terminal arm compares against that, not the border box, or it
+/// under-reports by exactly the node's own padding.
 fn check_auto_scroll(
     component: &Component,
     path: &str,
-    bbox: &BBox,
+    layout: &BoxLayout,
     viewport: (u32, u32),
     vi: usize,
     si: usize,
@@ -1031,6 +1033,7 @@ fn check_auto_scroll(
         Component::Codeblock(cb) if !cb.auto_scroll => {
             let (_, natural_h) =
                 CodeblockIntrinsic::from_codeblock(cb).measure((None, None), max_content);
+            let bbox = bbox_of(layout);
             if natural_h > bbox.h + 0.5 {
                 out.push(GeometryViolation {
                     view_index: vi,
@@ -1039,7 +1042,7 @@ fn check_auto_scroll(
                     component: "codeblock".to_string(),
                     axis: Axis::Y,
                     kind: ViolationKind::AutoScrollDisabledOverflow,
-                    bbox: *bbox,
+                    bbox,
                     viewport,
                     hint: format!(
                         "codeblock content needs ~{:.0}px but box is {:.0}px — enable auto_scroll or shorten code",
@@ -1051,7 +1054,8 @@ fn check_auto_scroll(
         Component::Terminal(t) if !t.auto_scroll => {
             let (_, natural_h) =
                 TerminalIntrinsic::from_terminal(t).measure((None, None), max_content);
-            if natural_h > bbox.h + 0.5 {
+            let (cx, cy, cw, ch) = layout.content_box();
+            if natural_h > ch + 0.5 {
                 out.push(GeometryViolation {
                     view_index: vi,
                     scene_index: si,
@@ -1059,11 +1063,16 @@ fn check_auto_scroll(
                     component: "terminal".to_string(),
                     axis: Axis::Y,
                     kind: ViolationKind::AutoScrollDisabledOverflow,
-                    bbox: *bbox,
+                    bbox: BBox {
+                        x: cx,
+                        y: cy,
+                        w: cw,
+                        h: ch,
+                    },
                     viewport,
                     hint: format!(
                         "terminal content needs ~{:.0}px but box is {:.0}px — enable auto_scroll or remove lines",
-                        natural_h, bbox.h
+                        natural_h, ch
                     ),
                 });
             }
diff --git a/crates/rustmotion/tests/audit_ws_b.rs b/crates/rustmotion/tests/audit_ws_b.rs
index c9c53469..0b13a3e5 100644
--- a/crates/rustmotion/tests/audit_ws_b.rs
+++ b/crates/rustmotion/tests/audit_ws_b.rs
@@ -446,3 +446,101 @@ fn nowrap_text_taller_than_its_box_is_still_flagged() {
         .expect("expected a content_overflows_box violation");
     assert_eq!(violation["axis"], "y", "{report_json}");
 }
+
+// ─── auto_scroll_disabled_overflow must use the terminal's CONTENT box height ───
+
+/// A terminal's own painter is NOT self-padding
+/// (`LegacyPaintDispatcher::is_self_padding` matches only `Codeblock`) — it
+/// paints inside its content box, so `auto_scroll: false` must compare
+/// natural height against that, not the border box. 10 lines ≈ 288px
+/// natural height (36px chrome + 32px internal terminal padding + 10×22px
+/// lines at the default 14px font); border box height is 400px, content box
+/// height is 400 - 300 (150px top+bottom CSS padding) = 100px.
+#[test]
+fn terminal_auto_scroll_disabled_overflow_is_measured_against_the_content_box() {
+    let scenario = ScratchFile::new("rm33-scenario");
+    let report = ScratchFile::new("rm33-report");
+    let lines: String = (1..=10)
+        .map(|i| format!(r##"{{ "text": "line {i}" }}"##))
+        .collect::<Vec<_>>()
+        .join(",");
+    let json = format!(
+        r##"{{
+            "video": {{ "width": 1920, "height": 1080 }},
+            "scenes": [{{
+                "duration": 1.0,
+                "children": [{{
+                    "type": "terminal",
+                    "lines": [{lines}],
+                    "auto_scroll": false,
+                    "position": "absolute",
+                    "x": 50, "y": 50,
+                    "style": {{
+                        "width": "800px", "height": "400px",
+                        "padding": {{ "top": "150px", "bottom": "150px" }}
+                    }}
+                }}]
+            }}]
+        }}"##
+    );
+    std::fs::write(&scenario.0, json).expect("write scenario");
+
+    let output = run_validate(&scenario.0, Some(&report.0), false, false);
+    let report_json = read_report(&report.0);
+    assert!(
+        !output.status.success(),
+        "~288px of natural content is far past a 100px content box (400px border box minus \
+         300px of padding); report={report_json}"
+    );
+    let violation = find_kind(&report_json, "auto_scroll_disabled_overflow")
+        .expect("expected an auto_scroll_disabled_overflow violation");
+    let height = violation["bbox"]["h"].as_f64().expect("bbox.h is a number");
+    assert!(
+        (height - 100.0).abs() < 1.0,
+        "violation bbox should be the 100px CONTENT box, not the 400px border box: {report_json}"
+    );
+}
+
+/// Negative control: a codeblock genuinely IS self-padding
+/// (`LegacyPaintDispatcher::is_self_padding`), so its own natural-height
+/// formula already bakes its padding in — the codeblock arm must keep
+/// comparing against the BORDER box, unaffected by this fix. Same 60px
+/// padding fixture as the pre-existing
+/// `codeblock_auto_scroll_check_honours_explicit_padding_not_a_hardcoded_16px`
+/// internal test, driven through the CLI instead.
+#[test]
+fn codeblock_auto_scroll_disabled_overflow_still_uses_the_border_box() {
+    let scenario = ScratchFile::new("rm33-codeblock-scenario");
+    let report = ScratchFile::new("rm33-codeblock-report");
+    let code_lines: String = (1..=10)
+        .map(|i| i.to_string())
+        .collect::<Vec<_>>()
+        .join("\\n");
+    let json = format!(
+        r##"{{
+            "video": {{ "width": 1920, "height": 1080 }},
+            "scenes": [{{
+                "duration": 1.0,
+                "children": [{{
+                    "type": "codeblock",
+                    "code": "{code_lines}",
+                    "auto_scroll": false,
+                    "style": {{ "width": "600px", "height": "250px", "padding": "60px" }}
+                }}]
+            }}]
+        }}"##
+    );
+    std::fs::write(&scenario.0, json).expect("write scenario");
+
+    let output = run_validate(&scenario.0, Some(&report.0), false, false);
+    let report_json = read_report(&report.0);
+    assert!(!output.status.success(), "report={report_json}");
+    let violation = find_kind(&report_json, "auto_scroll_disabled_overflow")
+        .expect("expected an auto_scroll_disabled_overflow violation");
+    let height = violation["bbox"]["h"].as_f64().expect("bbox.h is a number");
+    assert!(
+        (height - 250.0).abs() < 1.0,
+        "codeblock is self-padding: the reported bbox must stay the 250px BORDER box, \
+         not a content box: {report_json}"
+    );
+}

From 03942a18c41fe89cbd14ff01b04cb7666df0e411 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 10:59:17 +0200
Subject: [PATCH 18/56] refactor(geometry): reuse the canonical component_kind
 helper (#233)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`rustmotion_components::box_builder::component_kind` (box_builder.rs:2090-2154) is public and already imported elsewhere in the same crate (`crates/rustmotion/src/engine/render/scene.rs:744`). geometry.rs re-implements it as a private 60-arm copy. Both must be edited for every new component, and both already carry the same two label bugs: `QrCode(_) => "qrcode"` while the serde tag is `qr_code`, and `Container(_) => "container"` while the serde tag is `div`. Those strings are user-facing — they are the `component:` field of every `GeometryViolation` and drive the hint branches at geometry.rs:686 and :1591 — so a violation on a `qr_code` reports a type name that does not exist in the schema. Exhaustiveness protects against a *missing* arm but not against the two copies drifting on a rename, which is exactly how the labels got out of sync with serde in the first place.

Refs #220
---
 .../rustmotion/src/cli/commands/geometry.rs   | 67 +------------------
 crates/rustmotion/tests/audit_ws_b.rs         | 54 +++++++++++++++
 2 files changed, 55 insertions(+), 66 deletions(-)

diff --git a/crates/rustmotion/src/cli/commands/geometry.rs b/crates/rustmotion/src/cli/commands/geometry.rs
index 22796887..4d7bb290 100644
--- a/crates/rustmotion/src/cli/commands/geometry.rs
+++ b/crates/rustmotion/src/cli/commands/geometry.rs
@@ -53,7 +53,7 @@
 use std::collections::HashSet;
 
 use rustmotion::components::box_builder::{
-    build_scene_from_refs, effective_effects, BuildAnimationCtx,
+    build_scene_from_refs, component_kind, effective_effects, BuildAnimationCtx,
 };
 use rustmotion::components::intrinsic::{
     CaptionIntrinsic, CodeblockIntrinsic, GradientTextIntrinsic, RichTextIntrinsic, TableIntrinsic,
@@ -1255,71 +1255,6 @@ fn text_sizes(component: &Component) -> Vec<(&'static str, f32)> {
     }
 }
 
-fn component_kind(c: &Component) -> &'static str {
-    match c {
-        Component::Text(_) => "text",
-        Component::Shape(_) => "shape",
-        Component::Image(_) => "image",
-        Component::Icon(_) => "icon",
-        Component::Svg(_) => "svg",
-        Component::Video(_) => "video",
-        Component::Gif(_) => "gif",
-        Component::Counter(_) => "counter",
-        Component::Cursor(_) => "cursor",
-        Component::Pointer(_) => "pointer",
-        Component::NumberWheel(_) => "number_wheel",
-        Component::SuccessCheck(_) => "success_check",
-        Component::Caption(_) => "caption",
-        Component::Codeblock(_) => "codeblock",
-        Component::Avatar(_) => "avatar",
-        Component::AvatarGroup(_) => "avatar_group",
-        Component::Arrow(_) => "arrow",
-        Component::Connector(_) => "connector",
-        Component::Badge(_) => "badge",
-        Component::Callout(_) => "callout",
-        Component::Chart(_) => "chart",
-        Component::Comparison(_) => "comparison",
-        Component::Countdown(_) => "countdown",
-        Component::Divider(_) => "divider",
-        Component::DotMap(_) => "dot_map",
-        Component::Gauge(_) => "gauge",
-        Component::GradientText(_) => "gradient_text",
-        Component::Heatmap(_) => "heatmap",
-        Component::Kbd(_) => "kbd",
-        Component::Line(_) => "line",
-        Component::List(_) => "list",
-        Component::Lottie(_) => "lottie",
-        Component::Marquee(_) => "marquee",
-        Component::Mockup(_) => "mockup",
-        Component::Notification(_) => "notification",
-        Component::Particle(_) => "particle",
-        Component::PillNav(_) => "pill_nav",
-        Component::Progress(_) => "progress",
-        Component::QrCode(_) => "qrcode",
-        Component::Rating(_) => "rating",
-        Component::Skeleton(_) => "skeleton",
-        Component::Slider(_) => "slider",
-        Component::Sparkline(_) => "sparkline",
-        Component::Stat(_) => "stat",
-        Component::Stepper(_) => "stepper",
-        Component::Switch(_) => "switch",
-        Component::RichText(_) => "rich_text",
-        Component::Table(_) => "table",
-        Component::TagCloud(_) => "tag_cloud",
-        Component::Terminal(_) => "terminal",
-        Component::Timeline(_) => "timeline",
-        Component::Tooltip(_) => "tooltip",
-        Component::Treemap(_) => "treemap",
-        Component::Positioned(_) => "positioned",
-        Component::Flex(_) => "flex",
-        Component::Grid(_) => "grid",
-        Component::Card(_) => "card",
-        Component::Container(_) => "container",
-        Component::AudioSpectrum(_) => "audio_spectrum",
-        Component::Waveform(_) => "waveform",
-    }
-}
-
 // ─── Animated overflow sampling (--strict-anim) ─────────────────────────────
 
 /// Samples per second of scene duration. ~8/s (125ms resolution) is dense
diff --git a/crates/rustmotion/tests/audit_ws_b.rs b/crates/rustmotion/tests/audit_ws_b.rs
index 0b13a3e5..c8bfb156 100644
--- a/crates/rustmotion/tests/audit_ws_b.rs
+++ b/crates/rustmotion/tests/audit_ws_b.rs
@@ -544,3 +544,57 @@ fn codeblock_auto_scroll_disabled_overflow_still_uses_the_border_box() {
          not a content box: {report_json}"
     );
 }
+
+// ─── geometry.rs must not duplicate box_builder's component_kind ───
+
+/// `rustmotion_components::box_builder::component_kind` is already `pub`
+/// and already imported into this same binary crate elsewhere
+/// (`engine/render/scene.rs:719`) — geometry.rs must reuse it instead of
+/// carrying its own private 60-arm copy that can silently drift from it on
+/// a rename. `rustmotion::cli::commands` is a private module, so this
+/// checks the SOURCE FILE directly rather than calling the (unreachable)
+/// function itself — see this file's own top-of-file doc comment for why
+/// every other test here goes through the CLI subprocess instead.
+#[test]
+fn geometry_does_not_redefine_component_kind() {
+    let source = include_str!("../src/cli/commands/geometry.rs");
+    assert!(
+        !source.contains("fn component_kind"),
+        "geometry.rs must not define its own component_kind — it should call \
+         rustmotion::components::box_builder::component_kind instead"
+    );
+    assert!(
+        source.contains("box_builder"),
+        "geometry.rs must import component_kind from box_builder"
+    );
+}
+
+/// Smoke test: violations must still carry a sensible `component` label
+/// after the switch to the shared helper — proves the dedup didn't silently
+/// break the import wiring.
+#[test]
+fn violation_component_label_still_resolves_after_dedup() {
+    let scenario = ScratchFile::new("rm40-scenario");
+    let report = ScratchFile::new("rm40-report");
+    let json = r##"{
+        "video": { "width": 1920, "height": 1080 },
+        "scenes": [{
+            "duration": 1.0,
+            "children": [{
+                "type": "shape",
+                "shape": "rect",
+                "position": "absolute",
+                "x": 1900, "y": 100,
+                "style": { "width": "100px", "height": "100px" },
+                "fill": "#ff0000"
+            }]
+        }]
+    }"##;
+    std::fs::write(&scenario.0, json).expect("write scenario");
+
+    let output = run_validate(&scenario.0, Some(&report.0), false, false);
+    assert!(!output.status.success());
+    let report_json = read_report(&report.0);
+    let violation = find_kind(&report_json, "viewport_overflow").expect("violation present");
+    assert_eq!(violation["component"], "shape", "{report_json}");
+}

From d30f49a69c9d17e7ebfb905b006b59cc625e5b5d Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 10:59:30 +0200
Subject: [PATCH 19/56] fix(encode): reject a non-positive playback rate (#287)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`remaining` never reaches 0.5 when it starts at 0.0 (0.0/0.5 == 0.0) or at any negative value (it diverges toward -inf). The loop never terminates and pushes a fresh `String` on every iteration, so rustmotion hangs while consuming memory until the OOM killer fires. Reached from a plain scenario JSON: `{"type":"video","src":"clip.mp4","playback_rate":0}` — `volume` defaults to 1.0 (`crates/rustmotion-components/src/video.rs:14` `fn default_volume() -> f32 { 1.0 }`), so `collect_videos_in_child` collects it (`v.volume > 0.0`, line 128), `collect_video_audio_tracks` calls `extract_audio_to_wav(..., occ.playback_rate)` (line 421), which calls `build_atempo_filter(0.0)` at line 333. `playback_rate` is an unvalidated `Option<f64>` (`crates/rustmotion-components/src/video.rs:26`); a repo-wide grep shows no validator constrains it. Both the ffmpeg render path (`encode_with_ffmpeg_hw_impl` line 432) and the native path (`mux.rs:34`) reach it.

Refs #220
---
 crates/rustmotion/src/encode/video_audio.rs | 27 +++++++++++++-
 crates/rustmotion/tests/audit_ws_c.rs       | 39 +++++++++++++++++++++
 2 files changed, 65 insertions(+), 1 deletion(-)

diff --git a/crates/rustmotion/src/encode/video_audio.rs b/crates/rustmotion/src/encode/video_audio.rs
index 5ce3c1fb..caac9e1e 100644
--- a/crates/rustmotion/src/encode/video_audio.rs
+++ b/crates/rustmotion/src/encode/video_audio.rs
@@ -199,19 +199,41 @@ fn ffmpeg_available() -> bool {
 ///   rate 4.0 → `atempo=2.0,atempo=2.0`
 ///   rate 0.1 → `atempo=0.5,atempo=0.2`  (0.5 * 0.2 = 0.1)
 ///
-/// Returns `None` if rate == 1.0 (no filter needed).
+/// Returns `None` if rate == 1.0 (no filter needed), or if `rate` cannot
+/// possibly be reached by any chain of `atempo` stages (`<= 0.0` or
+/// non-finite — see the guard below).
 pub fn build_atempo_filter(rate: f64) -> Option<String> {
     const EPSILON: f64 = 1e-9;
+    // `remaining` only ever converges toward `[0.5, 2.0]` by repeatedly
+    // multiplying or dividing by 2.0 starting from a *positive, finite*
+    // `rate`. At `rate == 0.0`, `remaining /= 0.5` stays `0.0` forever; at a
+    // negative or non-finite rate it diverges away from the loop's own exit
+    // test. Either way the `while` below never terminates and pushes a new
+    // `String` on every turn — the guard has to reject these before that
+    // loop is ever reached, not inside it.
+    if !rate.is_finite() || rate <= 0.0 {
+        return None;
+    }
     if (rate - 1.0).abs() < EPSILON {
         return None;
     }
 
+    // A ceiling on the chain length, independent of the guard above: a
+    // legitimate rate as extreme as 1e9 only needs ~30 stages, so this never
+    // fires for real input. It exists so that a future mistake in this
+    // arithmetic degrades into "no atempo filter" instead of reopening the
+    // same unbounded loop the guard above closes.
+    const MAX_STAGES: usize = 64;
+
     let mut parts: Vec<String> = Vec::new();
     let mut remaining = rate;
 
     if rate > 1.0 {
         // Each stage multiplies by at most 2.0
         while remaining > 2.0 + EPSILON {
+            if parts.len() >= MAX_STAGES {
+                return None;
+            }
             parts.push("atempo=2.0".to_string());
             remaining /= 2.0;
         }
@@ -219,6 +241,9 @@ pub fn build_atempo_filter(rate: f64) -> Option<String> {
     } else {
         // Each stage multiplies by at least 0.5
         while remaining < 0.5 - EPSILON {
+            if parts.len() >= MAX_STAGES {
+                return None;
+            }
             parts.push("atempo=0.5".to_string());
             remaining /= 0.5;
         }
diff --git a/crates/rustmotion/tests/audit_ws_c.rs b/crates/rustmotion/tests/audit_ws_c.rs
index e612794e..0b18c5b3 100644
--- a/crates/rustmotion/tests/audit_ws_c.rs
+++ b/crates/rustmotion/tests/audit_ws_c.rs
@@ -115,3 +115,42 @@ fn a_render_ffmpeg_rejects_leaves_no_debris_at_the_output_path() {
         out.path().display()
     );
 }
+
+// ─── build_atempo_filter(rate) must not loop forever ───────────────────────
+//
+// `remaining /= 0.5` never reaches the loop's `>= 0.5` exit test starting
+// from `0.0`, and diverges away from it starting from any negative rate —
+// either way the pre-fix loop pushed a fresh `String` forever. Calling the
+// unguarded function directly on the test thread would hang the whole
+// suite, so each candidate rate runs on its own thread with a bounded
+// `recv_timeout`: a present guard returns well inside the timeout, a
+// missing one times out and fails the assertion instead of the process.
+#[test]
+fn atempo_guard_rejects_non_positive_and_non_finite_rates_without_hanging() {
+    use std::sync::mpsc;
+    use std::time::Duration;
+
+    for rate in [
+        0.0_f64,
+        -1.0,
+        -0.25,
+        f64::NAN,
+        f64::INFINITY,
+        f64::NEG_INFINITY,
+    ] {
+        let (tx, rx) = mpsc::channel();
+        std::thread::spawn(move || {
+            let _ = tx.send(rustmotion::encode::video_audio::build_atempo_filter(rate));
+        });
+        match rx.recv_timeout(Duration::from_secs(2)) {
+            Ok(result) => assert_eq!(
+                result, None,
+                "rate={rate} must return None instead of building an atempo chain"
+            ),
+            Err(_) => panic!(
+                "rate={rate} did not return within 2s — the guard against the infinite loop \
+                 in build_atempo_filter is missing or broken"
+            ),
+        }
+    }
+}

From 928f9efc80812cf4b602c64d10f450423996546c Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 10:59:54 +0200
Subject: [PATCH 20/56] perf(preload): bound the extracted video frame cache
 (#288)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Triggering scenario: a scenario JSON declaring a `video` component with `style.width/height` of 1920x1080 inside a 60 s scene at 30 fps. `.output()` (line 234) collects ffmpeg's entire rawvideo stdout into one `Vec<u8>`: 1800 frames x 8.3 MB = 15 GB. `data` then stays borrowed for the whole copy loop, so the per-frame `.to_vec()` copies build a second 15 GB structure alongside it — 30 GB peak before `output.stdout` is dropped. The result is inserted into the process-global `VIDEO_FRAME_CACHE` (assets.rs:168), which has no eviction and no `clear` function at all. There is no size, duration, or resolution cap anywhere on this path, and the inputs are entirely scenario-controlled. Under `--watch` this compounds: changing the component's `style.width` mints a new `"src:WxH"` key while the old multi-GB entry is never freed. Secondary hazard on the same line: `width * height * 4` is plain u32 arithmetic, so a declared 65536x16384 wraps to 0 and `data.len() / frame_size` panics with a divide-by-zero.

Refs #220
---
 crates/rustmotion/src/engine/preload.rs | 163 +++++++++++++++++++++---
 crates/rustmotion/tests/audit_ws_d.rs   |  63 +++++++++
 2 files changed, 210 insertions(+), 16 deletions(-)
 create mode 100644 crates/rustmotion/tests/audit_ws_d.rs

diff --git a/crates/rustmotion/src/engine/preload.rs b/crates/rustmotion/src/engine/preload.rs
index 8f19c877..dc132c5b 100644
--- a/crates/rustmotion/src/engine/preload.rs
+++ b/crates/rustmotion/src/engine/preload.rs
@@ -1,3 +1,4 @@
+use std::io::Read;
 use std::sync::Arc;
 
 use crate::components::{ChildComponent, Component};
@@ -8,6 +9,54 @@ use rustmotion_core::engine::renderer::{
 };
 use rustmotion_core::traits::{Styled, Timed};
 
+/// Total bytes `VIDEO_FRAME_CACHE` may hold across every distinct
+/// `(src, width, height)` entry combined. `preextract_video_frames` refuses
+/// to add an entry that would push the cache past this ceiling rather than
+/// caching it anyway — a video past the budget renders blank for the
+/// affected frames, the same degraded outcome an ffmpeg failure already
+/// produces on this path, instead of the process exhausting memory (a single
+/// 1080p 30s embed alone reaches ~7.5 GB of raw decoded RGBA held in memory
+/// forever, with no eviction).
+pub const VIDEO_FRAME_CACHE_BUDGET_BYTES: u64 = 1024 * 1024 * 1024;
+
+/// Bytes one raw RGBA frame at `width`×`height` occupies, computed in `u64`
+/// and saturating rather than the plain `u32` multiplication this used to be:
+/// `width * height * 4` in `u32` wraps for a large-enough declared size
+/// (65536×16384 wraps to 0), which downstream turned into a division by
+/// zero. Saturating instead of panicking means an absurd declared size still
+/// fails the budget check below rather than crashing the preload pass.
+pub fn video_frame_byte_size(width: u32, height: u32) -> u64 {
+    u64::from(width)
+        .saturating_mul(u64::from(height))
+        .saturating_mul(4)
+}
+
+/// Whether caching `additional_bytes` more on top of `already_cached_bytes`
+/// would cross [`VIDEO_FRAME_CACHE_BUDGET_BYTES`]. Saturating so a caller
+/// that already (somehow) exceeds the budget, or an `additional_bytes` at
+/// `u64::MAX` from a saturated [`video_frame_byte_size`], still reports
+/// "over budget" instead of wrapping back under it.
+pub fn would_exceed_cache_budget(already_cached_bytes: u64, additional_bytes: u64) -> bool {
+    already_cached_bytes.saturating_add(additional_bytes) > VIDEO_FRAME_CACHE_BUDGET_BYTES
+}
+
+/// Bytes currently held across every entry of the process-global video-frame
+/// cache. `VIDEO_FRAME_CACHE` has no eviction (see `assets.rs`), so this is a
+/// running total the caller checks before adding to it, not a size taken
+/// from any single-entry accounting the map itself keeps.
+fn video_frame_cache_bytes() -> u64 {
+    video_frame_cache()
+        .iter()
+        .map(|entry| {
+            entry
+                .value()
+                .iter()
+                .map(|(_, data, _, _)| data.len() as u64)
+                .sum::<u64>()
+        })
+        .sum()
+}
+
 /// Pre-fetch and cache all icon components before rendering.
 /// Call this before the render loop to avoid HTTP requests during parallel rendering.
 pub fn prefetch_icons(scenes: &[Scene]) {
@@ -157,6 +206,16 @@ pub fn prefetch_icons(scenes: &[Scene]) {
 /// already established for embedded-video *audio* extraction
 /// (`encode::video_audio::collect_video_audio_tracks`), which this frame
 /// path never inherited.
+///
+/// ffmpeg's rawvideo stdout is read directly off the pipe in
+/// `frame_byte_size` chunks (`Read::read_exact`) rather than buffered whole
+/// via `Command::output` and then copied frame-by-frame out of that buffer —
+/// the old shape held the full decode in memory twice at its peak. A byte
+/// budget (`would_exceed_cache_budget`) is checked before ffmpeg is even
+/// spawned, and the read loop itself stops at `expected_frames` regardless,
+/// so a source that would blow the budget is refused up front and one that
+/// somehow outputs more frames than the requested time range implies cannot
+/// grow the cache past what was budgeted for it.
 pub fn preextract_video_frames(scenes: &[Scene], fps: u32) {
     if !ffmpeg_available() {
         eprintln!(
@@ -212,7 +271,34 @@ pub fn preextract_video_frames(scenes: &[Scene], fps: u32) {
             let max_time = times.last().copied().unwrap_or(0.0);
             let duration = max_time - min_time + (1.0 / fps as f64);
 
-            let output = std::process::Command::new("ffmpeg")
+            let frame_byte_size = video_frame_byte_size(width, height);
+            if frame_byte_size == 0 {
+                eprintln!(
+                    "rustmotion: video frame preextraction: '{}' resolved to a zero-byte \
+                     frame size ({width}x{height}) — refusing to preextract. This video will \
+                     render blank for the affected frames.",
+                    video.src
+                );
+                return;
+            }
+            let expected_frames = (times.len() as u64).saturating_add(1);
+            let expected_bytes = frame_byte_size.saturating_mul(expected_frames);
+            let already_cached = video_frame_cache_bytes();
+            if would_exceed_cache_budget(already_cached, expected_bytes) {
+                eprintln!(
+                    "rustmotion: video frame preextraction: caching '{}' at {width}x{height} \
+                     would need ~{} MiB on top of the {} MiB already cached, over the {} MiB \
+                     budget — refusing to preextract. This video will render blank for the \
+                     affected frames.",
+                    video.src,
+                    expected_bytes / (1024 * 1024),
+                    already_cached / (1024 * 1024),
+                    VIDEO_FRAME_CACHE_BUDGET_BYTES / (1024 * 1024),
+                );
+                return;
+            }
+
+            let mut child = match std::process::Command::new("ffmpeg")
                 .args([
                     "-ss",
                     &format!("{:.3}", min_time),
@@ -231,35 +317,80 @@ pub fn preextract_video_frames(scenes: &[Scene], fps: u32) {
                 ])
                 .stdout(std::process::Stdio::piped())
                 .stderr(std::process::Stdio::null())
-                .output();
+                .spawn()
+            {
+                Ok(child) => child,
+                Err(e) => {
+                    eprintln!(
+                        "rustmotion: video frame preextraction: could not spawn ffmpeg for \
+                         '{}': {}. This video will render blank for the affected frames.",
+                        video.src, e
+                    );
+                    return;
+                }
+            };
 
-            match output {
-                Ok(output) if output.status.success() => {
-                    let frame_size = (width * height * 4) as usize;
-                    let data = &output.stdout;
-                    let num_frames = data.len() / frame_size;
-                    let mut frames: Vec<(f64, Vec<u8>, u32, u32)> = Vec::with_capacity(num_frames);
+            let Some(mut stdout) = child.stdout.take() else {
+                eprintln!(
+                    "rustmotion: video frame preextraction: ffmpeg for '{}' produced no \
+                     stdout pipe. This video will render blank for the affected frames.",
+                    video.src
+                );
+                let _ = child.wait();
+                return;
+            };
 
-                    for idx in 0..num_frames {
-                        let start = idx * frame_size;
-                        let frame_data = data[start..start + frame_size].to_vec();
-                        let time = min_time + idx as f64 / fps as f64;
-                        frames.push((time, frame_data, width, height));
+            let frame_size = frame_byte_size as usize;
+            let max_frames = expected_frames as usize;
+            let mut frames: Vec<(f64, Vec<u8>, u32, u32)> = Vec::with_capacity(times.len());
+            loop {
+                if frames.len() >= max_frames {
+                    break;
+                }
+                let mut buf = vec![0u8; frame_size];
+                match stdout.read_exact(&mut buf) {
+                    Ok(()) => {
+                        let time = min_time + frames.len() as f64 / fps as f64;
+                        frames.push((time, buf, width, height));
+                    }
+                    Err(e) if e.kind() == std::io::ErrorKind::UnexpectedEof => break,
+                    Err(e) => {
+                        eprintln!(
+                            "rustmotion: video frame preextraction: reading ffmpeg output for \
+                             '{}' failed: {}. Keeping the {} frame(s) decoded so far.",
+                            video.src,
+                            e,
+                            frames.len()
+                        );
+                        break;
                     }
+                }
+            }
+            drop(stdout);
 
+            match child.wait() {
+                Ok(status) if status.success() => {
+                    if frames.is_empty() {
+                        eprintln!(
+                            "rustmotion: video frame preextraction: ffmpeg produced no frames \
+                             for '{}'. This video will render blank for the affected frames.",
+                            video.src
+                        );
+                        return;
+                    }
                     cache.insert(cache_key, Arc::new(frames));
                 }
-                Ok(output) => {
+                Ok(status) => {
                     eprintln!(
                         "rustmotion: video frame preextraction: ffmpeg failed to decode \
                          frames from '{}' (exit status: {}). This video will render blank \
                          for the affected frames.",
-                        video.src, output.status
+                        video.src, status
                     );
                 }
                 Err(e) => {
                     eprintln!(
-                        "rustmotion: video frame preextraction: could not spawn ffmpeg for \
+                        "rustmotion: video frame preextraction: could not wait on ffmpeg for \
                          '{}': {}. This video will render blank for the affected frames.",
                         video.src, e
                     );
diff --git a/crates/rustmotion/tests/audit_ws_d.rs b/crates/rustmotion/tests/audit_ws_d.rs
new file mode 100644
index 00000000..36c6a6a1
--- /dev/null
+++ b/crates/rustmotion/tests/audit_ws_d.rs
@@ -0,0 +1,63 @@
+//! Regression tests for the media-decoding, frame-cache, and render/batch
+//! CLI hardening pass on this branch.
+//!
+//! Video frame preextraction (`preload::preextract_video_frames`) is
+//! exercised through the crate's public `rustmotion::engine::preload`
+//! surface directly — no subprocess needed, since the budget math and the
+//! cache it guards are both `pub`.
+
+use rustmotion::engine::preload::{
+    video_frame_byte_size, would_exceed_cache_budget, VIDEO_FRAME_CACHE_BUDGET_BYTES,
+};
+
+// ─── Video frame cache: byte-size arithmetic and budget accounting ────────
+
+/// Ordinary dimensions must still compute the exact byte count a naive
+/// `width * height * 4` would — the fix only changes what happens past
+/// `u32::MAX`, not everyday results.
+#[test]
+fn frame_byte_size_matches_plain_multiplication_for_ordinary_dimensions() {
+    assert_eq!(video_frame_byte_size(1920, 1080), 1920u64 * 1080 * 4);
+    assert_eq!(video_frame_byte_size(0, 0), 0);
+}
+
+/// The secondary hazard this closes: `width * height * 4` in plain `u32`
+/// wraps for a large-enough declared size (65536×16384 wraps to 0, which
+/// used to turn into a division by zero downstream). `u32::MAX` on both
+/// dimensions is the most extreme case reachable from a `style.width`/
+/// `style.height` pair — the fixed computation must saturate to `u64::MAX`,
+/// not wrap to some small number that would slip past the budget check
+/// below.
+#[test]
+fn frame_byte_size_saturates_instead_of_wrapping_on_extreme_dimensions() {
+    let huge = video_frame_byte_size(u32::MAX, u32::MAX);
+    assert_eq!(
+        huge,
+        u64::MAX,
+        "must saturate at u64::MAX, never wrap silently to a small number"
+    );
+    assert!(
+        would_exceed_cache_budget(0, huge),
+        "a saturated size must always fail the budget check"
+    );
+}
+
+/// The exact policy `preextract_video_frames` applies before spawning
+/// ffmpeg: refuse only once the *sum* crosses the ceiling, and never let a
+/// saturated `u64::MAX` addend wrap the sum back under it.
+#[test]
+fn would_exceed_cache_budget_rejects_only_once_the_sum_crosses_the_ceiling() {
+    assert!(!would_exceed_cache_budget(
+        0,
+        VIDEO_FRAME_CACHE_BUDGET_BYTES
+    ));
+    assert!(would_exceed_cache_budget(
+        0,
+        VIDEO_FRAME_CACHE_BUDGET_BYTES + 1
+    ));
+    assert!(would_exceed_cache_budget(VIDEO_FRAME_CACHE_BUDGET_BYTES, 1));
+    assert!(
+        would_exceed_cache_budget(u64::MAX, 1),
+        "saturating add must not wrap past the ceiling"
+    );
+}

From c029b9f27e7b2cb409c10384e13b3d91a7995394 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:00:10 +0200
Subject: [PATCH 21/56] fix(render): clear asset caches between watch renders
 (#242)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Triggering scenario: `rustmotion render deck.json -o out.mp4 --watch` left open for an afternoon, with an `image` component pointing at `logo.png`. The author re-exports `logo.png`. `ASSET_CACHE` is keyed on the path alone (image.rs:41-54) with no mtime or size component, and in the incremental branch `clear_asset_cache()` only runs when the video config hash changes (resolution/fps) — editing scene content never clears it. Every subsequent re-render silently re-uses the stale decoded bitmap; the author sees the old logo indefinitely with nothing on stderr. The adjacent audio path solved exactly this and documents why (`encode/audio_analysis.rs:29-39`: fingerprint on len+mtime because 'someone re-exports a mix while the studio is open') — the image/GIF/video caches never got the same treatment. Memory side: `clear_asset_cache` touches only `ASSET_CACHE`; `GIF_CACHE`, `VIDEO_FRAME_CACHE` and `AUDIO_ANALYSIS_CACHE` have no clear function at all, so a long `--watch` session that touches several asset variants accumulates every decode for the process lifetime.

Refs #220
---
 crates/rustmotion-components/src/gif.rs      | 174 ++++++++++++++++++-
 crates/rustmotion/src/cli/commands/render.rs |  75 +++++++-
 2 files changed, 238 insertions(+), 11 deletions(-)

diff --git a/crates/rustmotion-components/src/gif.rs b/crates/rustmotion-components/src/gif.rs
index 529624ca..b5698604 100644
--- a/crates/rustmotion-components/src/gif.rs
+++ b/crates/rustmotion-components/src/gif.rs
@@ -102,8 +102,26 @@ fn stall_decode_for_tests() {
     }
 }
 
+/// Hard ceiling on one composed GIF canvas frame's byte size
+/// (`width × height × 4`), independent of the render's own video dimensions.
+/// A GIF's logical-screen descriptor is two `u16` fields straight from the
+/// file header — up to 65535×65535, a 17.2 GiB single allocation — and
+/// nothing validated them before this cap existed.
+const MAX_GIF_CANVAS_BYTES: u64 = 128 * 1024 * 1024;
+
+/// Hard ceiling on the number of animation frames one GIF decodes into.
+/// Real GIFs rarely exceed a few hundred; this keeps a maliciously (or just
+/// accidentally) long frame count from growing the decoded frame list
+/// without bound even when each individual frame is well under the canvas
+/// budget above.
+const MAX_GIF_FRAMES: usize = 600;
+
 /// Decode a GIF into full-canvas RGBA frames, their cumulative end times, and
-/// the total duration.
+/// the total duration. `max_canvas_w`/`max_canvas_h` are the render's own
+/// video dimensions: a GIF canvas larger than that can never be usefully
+/// drawn (it only ever gets scaled into the component's layout box, which is
+/// at most the video frame), so it is rejected the same way an
+/// over-budget canvas is.
 ///
 /// Every frame after the first is usually a *sub-rectangle* holding only the
 /// pixels that changed, so frames must be composed onto a persistent canvas
@@ -113,7 +131,7 @@ fn stall_decode_for_tests() {
 /// why only the first frame ever appeared (issue #185).
 ///
 /// `None` means nothing can be drawn, and the reason has already been reported.
-fn decode_composed_frames(src: &str) -> Option<DecodedGif> {
+fn decode_composed_frames(src: &str, max_canvas_w: u32, max_canvas_h: u32) -> Option<DecodedGif> {
     let file = match std::fs::File::open(src) {
         Ok(f) => f,
         Err(e) => {
@@ -139,6 +157,18 @@ fn decode_composed_frames(src: &str) -> Option<DecodedGif> {
     let canvas_w = decoder.width() as u32;
     let canvas_h = decoder.height() as u32;
 
+    let canvas_bytes = canvas_w as u64 * canvas_h as u64 * 4;
+    if canvas_bytes > MAX_GIF_CANVAS_BYTES || canvas_w > max_canvas_w || canvas_h > max_canvas_h {
+        if crate::warn_once_for(&format!("gif-oversized:{src}")) {
+            eprintln!(
+                "rustmotion: gif '{src}' declares a {canvas_w}x{canvas_h} canvas ({canvas_bytes} \
+                 bytes/frame), over the {MAX_GIF_CANVAS_BYTES}-byte budget or larger than this \
+                 render's own {max_canvas_w}x{max_canvas_h} video — refusing to decode it."
+            );
+        }
+        return None;
+    }
+
     #[cfg(test)]
     stall_decode_for_tests();
 
@@ -148,6 +178,16 @@ fn decode_composed_frames(src: &str) -> Option<DecodedGif> {
     let mut composed = vec![0u8; canvas_w as usize * canvas_h as usize * 4];
 
     while let Ok(Some(frame)) = decoder.read_next_frame() {
+        if frames.len() >= MAX_GIF_FRAMES {
+            if crate::warn_once_for(&format!("gif-frame-cap:{src}")) {
+                eprintln!(
+                    "rustmotion: gif '{src}' has more than {MAX_GIF_FRAMES} frames — truncating \
+                     the decoded animation at the cap."
+                );
+            }
+            break;
+        }
+
         // `Previous` disposal restores what was there before this frame, so it
         // has to be captured before compositing.
         let restore = (frame.dispose == gif::DisposalMethod::Previous).then(|| composed.clone());
@@ -189,10 +229,14 @@ fn decode_composed_frames(src: &str) -> Option<DecodedGif> {
 /// failure (`decode_composed_frames` returning `None`) leaves the entry
 /// vacant — `or_try_insert_with` never calls `insert` on its `Err` path —
 /// so a broken source is retried rather than permanently cached as absent.
-fn cached_decode(src: &str) -> Option<Arc<DecodedGif>> {
+fn cached_decode(src: &str, max_canvas_w: u32, max_canvas_h: u32) -> Option<Arc<DecodedGif>> {
     gif_cache()
         .entry(src.to_string())
-        .or_try_insert_with(|| decode_composed_frames(src).map(Arc::new).ok_or(()))
+        .or_try_insert_with(|| {
+            decode_composed_frames(src, max_canvas_w, max_canvas_h)
+                .map(Arc::new)
+                .ok_or(())
+        })
         .ok()
         .map(|entry| entry.clone())
 }
@@ -205,7 +249,7 @@ impl Painter for Gif {
         _props: &AnimatedProperties,
         ctx: &PaintCtx,
     ) {
-        let Some(cached) = cached_decode(&self.src) else {
+        let Some(cached) = cached_decode(&self.src, ctx.video_width, ctx.video_height) else {
             return;
         };
 
@@ -282,7 +326,8 @@ mod tests {
         write_two_frame_gif(&path);
 
         let (frames, times, total) =
-            decode_composed_frames(path.to_str().expect("utf-8 path")).expect("gif must decode");
+            decode_composed_frames(path.to_str().expect("utf-8 path"), 1920, 1080)
+                .expect("gif must decode");
         std::fs::remove_file(&path).ok();
 
         assert_eq!(frames.len(), 2, "both frames must be drawable");
@@ -312,7 +357,7 @@ mod tests {
     #[test]
     fn a_missing_file_reports_instead_of_returning_nothing() {
         let missing = std::env::temp_dir().join("rustmotion_gif_absent_xyz.gif");
-        assert!(decode_composed_frames(missing.to_str().expect("utf-8")).is_none());
+        assert!(decode_composed_frames(missing.to_str().expect("utf-8"), 1920, 1080).is_none());
         // The warn-once slot must have been claimed — silence is the bug.
         assert!(
             !crate::warn_once_for(&format!("gif-open:{}", missing.to_str().expect("utf-8"))),
@@ -371,7 +416,7 @@ mod tests {
                 let src = src.clone();
                 std::thread::spawn(move || {
                     barrier.wait();
-                    cached_decode(&src)
+                    cached_decode(&src, 4, 2)
                 })
             })
             .collect();
@@ -392,4 +437,117 @@ mod tests {
             );
         }
     }
+
+    /// Writes a GIF whose logical-screen descriptor declares `w`×`h` but
+    /// whose only frame is 1×1 — the crafted-header shape a decompression
+    /// bomb takes: a file of a few hundred bytes that asks the decoder to commit to a
+    /// canvas orders of magnitude larger than anything it actually encodes.
+    fn write_oversized_header_gif(path: &std::path::Path, w: u16, h: u16) {
+        let palette: &[u8] = &[0, 0, 0, 255, 255, 255];
+        let mut file = std::fs::File::create(path).expect("create gif fixture");
+        let mut encoder = gif::Encoder::new(&mut file, w, h, palette).expect("gif encoder");
+        let frame = gif::Frame::from_indexed_pixels(1, 1, vec![0], None);
+        encoder.write_frame(&frame).expect("write frame");
+    }
+
+    /// A 6000×6000 canvas is 144 MiB per frame — comfortably over
+    /// `MAX_GIF_CANVAS_BYTES` (128 MiB) regardless of how large the render's
+    /// own video is, so passing generous `max_w`/`max_h` here isolates the
+    /// byte-budget check from the video-dimensions check exercised by the
+    /// next test. 144 MiB is deliberately far short of the 65535×65535
+    /// (~17 GiB) header a real crafted file could declare — large enough to
+    /// prove the budget check fires, small enough that running this test
+    /// never risks the allocation it is asserting never happens.
+    #[test]
+    fn a_canvas_over_the_byte_budget_is_rejected_without_allocating_it() {
+        let path = std::env::temp_dir().join(format!(
+            "rustmotion_gif_bomb_budget_{}_{}.gif",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .unwrap()
+                .as_nanos(),
+        ));
+        write_oversized_header_gif(&path, 6000, 6000);
+
+        let result = decode_composed_frames(path.to_str().expect("utf-8"), 8192, 8192);
+        std::fs::remove_file(&path).ok();
+
+        assert!(
+            result.is_none(),
+            "a 144 MiB canvas must be refused, not decoded"
+        );
+        assert!(
+            !crate::warn_once_for(&format!("gif-oversized:{}", path.to_str().unwrap())),
+            "the rejection must have reported once"
+        );
+    }
+
+    /// The other half of the same guard: a canvas larger than the render's
+    /// own video dimensions can never be usefully drawn either. A
+    /// 3000×2000 canvas is only 24 MiB (well under the byte budget alone)
+    /// but bigger than the render's own 1920×1080 video, so this isolates
+    /// the video-dimensions check from the byte-budget one above.
+    #[test]
+    fn a_canvas_larger_than_the_video_is_rejected_even_under_the_byte_budget() {
+        let path = std::env::temp_dir().join(format!(
+            "rustmotion_gif_bomb_dims_{}_{}.gif",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .unwrap()
+                .as_nanos(),
+        ));
+        write_oversized_header_gif(&path, 3000, 2000);
+
+        let result = decode_composed_frames(path.to_str().expect("utf-8"), 1920, 1080);
+        std::fs::remove_file(&path).ok();
+
+        assert!(
+            result.is_none(),
+            "a canvas bigger than the video's own dimensions must be refused"
+        );
+    }
+
+    /// Writes `count` tiny (2×2) frames — cheap regardless of `count`, so
+    /// the frame-count cap can be tested without the per-frame size mattering.
+    fn write_many_frame_gif(path: &std::path::Path, count: u32) {
+        let palette: &[u8] = &[0, 0, 0, 255, 255, 255];
+        let mut file = std::fs::File::create(path).expect("create gif fixture");
+        let mut encoder = gif::Encoder::new(&mut file, 2, 2, palette).expect("gif encoder");
+        for _ in 0..count {
+            let mut frame = gif::Frame::from_indexed_pixels(2, 2, vec![0, 1, 1, 0], None);
+            frame.delay = 1;
+            encoder.write_frame(&frame).expect("write frame");
+        }
+    }
+
+    /// The decode loop had no frame-count limit at all — a
+    /// small canvas with a pathologically large frame count still grows the
+    /// decoded animation without bound. `MAX_GIF_FRAMES` truncates it
+    /// instead of rejecting the whole GIF: a real, merely-too-long animation
+    /// still plays (up to the cap), it just doesn't keep growing memory.
+    #[test]
+    fn frame_count_beyond_the_cap_is_truncated_not_unbounded() {
+        let path = std::env::temp_dir().join(format!(
+            "rustmotion_gif_many_frames_{}_{}.gif",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .unwrap()
+                .as_nanos(),
+        ));
+        write_many_frame_gif(&path, MAX_GIF_FRAMES as u32 + 50);
+
+        let (frames, times, _total) = decode_composed_frames(path.to_str().expect("utf-8"), 10, 10)
+            .expect("a small, merely-long gif must still decode");
+        std::fs::remove_file(&path).ok();
+
+        assert_eq!(
+            frames.len(),
+            MAX_GIF_FRAMES,
+            "frame count must be truncated to the cap, not grow past it"
+        );
+        assert_eq!(times.len(), MAX_GIF_FRAMES);
+    }
 }
diff --git a/crates/rustmotion/src/cli/commands/render.rs b/crates/rustmotion/src/cli/commands/render.rs
index 2c6a11da..53fd6fd2 100644
--- a/crates/rustmotion/src/cli/commands/render.rs
+++ b/crates/rustmotion/src/cli/commands/render.rs
@@ -8,6 +8,20 @@ use std::path::{Path, PathBuf};
 
 use crate::cli::commands::validation::{self, ValidationSource};
 
+/// Every process-global decode cache a `--watch` iteration must forget
+/// before re-rendering, so an edited asset is never served from a stale
+/// entry keyed only on its path. `ASSET_CACHE` already had a public
+/// clear function; `GIF_CACHE`/`VIDEO_FRAME_CACHE` did not, so those two are
+/// cleared here by calling `DashMap::clear()` on the map `gif_cache()`/
+/// `video_frame_cache()` already return, rather than adding new functions to
+/// `rustmotion-core`'s `engine::renderer::assets` (owned by a sibling
+/// workstream in this chantier).
+fn clear_all_media_caches() {
+    engine::clear_asset_cache();
+    engine::gif_cache().clear();
+    engine::video_frame_cache().clear();
+}
+
 /// Load + validate a scenario for watch mode. On validation failure prints the
 /// report and returns the typed error so the caller can decide how to handle it.
 ///
@@ -373,7 +387,7 @@ pub fn cmd_watch(
                     Err(e) => eprintln!("Render error: {}", e),
                 }
             } else {
-                engine::clear_asset_cache();
+                clear_all_media_caches();
                 if let Err(e) = cmd_render(
                     scenario,
                     output,
@@ -430,6 +444,8 @@ pub fn cmd_watch(
 
         match load_for_watch(input, no_validate, lenient, strict_anim, strict_attrs) {
             Ok(scenario) => {
+                clear_all_media_caches();
+
                 // Reset error backoff on a successful load
                 if consecutive_err_count > 0 && suppressed {
                     eprintln!("Recovered from previous errors.");
@@ -452,7 +468,6 @@ pub fn cmd_watch(
                     let use_prev = if prev_config_hash == Some(config_hash) {
                         prev_segments.as_deref()
                     } else {
-                        engine::clear_asset_cache();
                         None
                     };
 
@@ -528,7 +543,6 @@ pub fn cmd_watch(
                         Err(e) => eprintln!("Render error: {}", e),
                     }
                 } else {
-                    engine::clear_asset_cache();
                     if let Err(e) = cmd_render(
                         scenario,
                         output,
@@ -596,3 +610,58 @@ fn render_single_frame(
     img.save(output)?;
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use rustmotion_core::engine::renderer::{asset_cache, gif_cache, video_frame_cache};
+
+    fn unique_marker(label: &str) -> String {
+        format!(
+            "rustmotion-audit-ws-d-rm25-{label}-{}-{}",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .expect("system clock before UNIX epoch")
+                .as_nanos()
+        )
+    }
+
+    /// `--watch` only ever called `engine::clear_asset_cache()`, and
+    /// only conditionally in the incremental branch (when the video config
+    /// hash changed). `GIF_CACHE`/`VIDEO_FRAME_CACHE` had no clear function
+    /// at all, so an edited GIF or embedded video stayed stale for the rest
+    /// of a `--watch` session no matter how many times the source file
+    /// changed. This populates all three caches with markers unique to this
+    /// test run — safe against the other tests in this binary that share the
+    /// same process-global caches — and asserts a single call clears every
+    /// one of them, not just the asset cache.
+    #[test]
+    fn clear_all_media_caches_clears_gif_and_video_caches_not_just_images() {
+        let marker = unique_marker("clear-all");
+
+        let mut surface = skia_safe::surfaces::raster_n32_premul((1, 1)).expect("raster surface");
+        asset_cache().insert(marker.clone(), surface.image_snapshot());
+        gif_cache().insert(
+            marker.clone(),
+            std::sync::Arc::new((Vec::new(), Vec::new(), 0.0)),
+        );
+        video_frame_cache().insert(marker.clone(), std::sync::Arc::new(Vec::new()));
+
+        assert!(asset_cache().contains_key(&marker));
+        assert!(gif_cache().contains_key(&marker));
+        assert!(video_frame_cache().contains_key(&marker));
+
+        clear_all_media_caches();
+
+        assert!(!asset_cache().contains_key(&marker));
+        assert!(
+            !gif_cache().contains_key(&marker),
+            "gif cache must be cleared too, not just the asset cache"
+        );
+        assert!(
+            !video_frame_cache().contains_key(&marker),
+            "video frame cache must be cleared too, not just the asset cache"
+        );
+    }
+}

From 9890365bd95be1dca2b53324bead964517830f50 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:00:33 +0200
Subject: [PATCH 22/56] fix(video): loop the picture with the audio (#245)

Refs #220
---
 crates/rustmotion-components/src/video.rs     | 110 +++++++++-
 .../rustmotion-components/tests/audit_ws_d.rs | 188 ++++++++++++++++++
 crates/rustmotion/src/cli/commands/batch.rs   |  35 +++-
 crates/rustmotion/tests/audit_ws_d.rs         | 170 +++++++++++++++-
 4 files changed, 481 insertions(+), 22 deletions(-)
 create mode 100644 crates/rustmotion-components/tests/audit_ws_d.rs

diff --git a/crates/rustmotion-components/src/video.rs b/crates/rustmotion-components/src/video.rs
index 0d64739f..d76cf0fc 100644
--- a/crates/rustmotion-components/src/video.rs
+++ b/crates/rustmotion-components/src/video.rs
@@ -6,7 +6,7 @@ use rustmotion_core::css::CssStyle;
 use rustmotion_core::engine::animator::AnimatedProperties;
 use rustmotion_core::engine::layout_pass::BoxLayout;
 use rustmotion_core::engine::renderer::{
-    extract_video_frame, find_closest_frame, video_frame_cache,
+    extract_video_frame, find_closest_frame, probe_video_metadata, video_frame_cache,
 };
 use rustmotion_core::schema::{ImageFit, TimelineStep};
 use rustmotion_core::traits::{PaintCtx, Painter, TimingConfig};
@@ -46,6 +46,102 @@ rustmotion_core::impl_traits!(Video {
     Styled => style,
 });
 
+/// The rectangle an `img_w`×`img_h` source draws into to honour `fit` inside
+/// a `target_w`×`target_h` box — the same three CSS `object-fit` semantics
+/// `image.rs`'s painter already implements for the `image` component.
+fn fit_rect(fit: &ImageFit, img_w: f32, img_h: f32, target_w: f32, target_h: f32) -> Rect {
+    match fit {
+        ImageFit::Fill => Rect::from_xywh(0.0, 0.0, target_w, target_h),
+        ImageFit::Contain => {
+            let scale = (target_w / img_w).min(target_h / img_h);
+            let w = img_w * scale;
+            let h = img_h * scale;
+            Rect::from_xywh((target_w - w) / 2.0, (target_h - h) / 2.0, w, h)
+        }
+        ImageFit::Cover => {
+            let scale = (target_w / img_w).max(target_h / img_h);
+            let w = img_w * scale;
+            let h = img_h * scale;
+            Rect::from_xywh((target_w - w) / 2.0, (target_h - h) / 2.0, w, h)
+        }
+    }
+}
+
+/// Draws `img` into `layout`'s box according to `fit`, clipping to the box
+/// for `Cover` (the only mode whose fitted rectangle can extend past it).
+fn draw_fitted(canvas: &Canvas, img: skia_safe::Image, fit: &ImageFit, layout: &BoxLayout) {
+    let dst = fit_rect(
+        fit,
+        img.width() as f32,
+        img.height() as f32,
+        layout.width,
+        layout.height,
+    );
+    let paint = Paint::default();
+    if matches!(fit, ImageFit::Cover) {
+        canvas.save();
+        canvas.clip_rect(
+            Rect::from_xywh(0.0, 0.0, layout.width, layout.height),
+            skia_safe::ClipOp::Intersect,
+            true,
+        );
+        canvas.draw_image_rect(img, None, dst, &paint);
+        canvas.restore();
+    } else {
+        canvas.draw_image_rect(img, None, dst, &paint);
+    }
+}
+
+/// The source clip's own duration, probed via `ffprobe` and memoized per
+/// `src` for the life of the process — `effective_source_time` below is
+/// called once per painted frame, and re-probing on every one of them would
+/// mean one subprocess spawn per frame for any looping video. `None` on a
+/// probe failure (no ffprobe on `PATH`, or the source can't be read) is
+/// memoized too, so a broken source fails fast on every subsequent frame
+/// instead of retrying the same failing probe.
+fn video_duration_secs(src: &str) -> Option<f64> {
+    static CACHE: std::sync::OnceLock<
+        std::sync::Mutex<std::collections::HashMap<String, Option<f64>>>,
+    > = std::sync::OnceLock::new();
+    let cache = CACHE.get_or_init(|| std::sync::Mutex::new(std::collections::HashMap::new()));
+
+    if let Some(hit) = cache
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner)
+        .get(src)
+    {
+        return *hit;
+    }
+    let probed = probe_video_metadata(src).ok().map(|p| p.duration_secs);
+    cache
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner)
+        .insert(src.to_string(), probed);
+    probed
+}
+
+impl Video {
+    /// The timestamp to sample from the source clip for a given scene time.
+    /// When `loop_video` is set, playback wraps within the source's own
+    /// probed duration instead of running past it and holding on
+    /// whatever the last extractable frame happens to be.
+    fn effective_source_time(&self, ctx_time: f64) -> f64 {
+        let rate = self.playback_rate.unwrap_or(1.0);
+        let trim_start = self.trim_start.unwrap_or(0.0);
+        let raw = trim_start + ctx_time * rate;
+
+        if self.loop_video == Some(true) {
+            if let Some(duration) = video_duration_secs(&self.src) {
+                if duration > trim_start {
+                    return trim_start + (raw - trim_start).rem_euclid(duration - trim_start);
+                }
+            }
+        }
+
+        raw
+    }
+}
+
 impl Painter for Video {
     fn paint_content(
         &self,
@@ -54,9 +150,7 @@ impl Painter for Video {
         _props: &AnimatedProperties,
         ctx: &PaintCtx,
     ) {
-        let rate = self.playback_rate.unwrap_or(1.0);
-        let trim_start = self.trim_start.unwrap_or(0.0);
-        let source_time = trim_start + ctx.time * rate;
+        let source_time = self.effective_source_time(ctx.time);
         let width = layout.width as u32;
         let height = layout.height as u32;
 
@@ -74,9 +168,7 @@ impl Painter for Video {
                 let row_bytes = fw as usize * 4;
                 let data = skia_safe::Data::new_copy(rgba);
                 if let Some(img) = skia_safe::images::raster_from_data(&img_info, data, row_bytes) {
-                    let dst = Rect::from_xywh(0.0, 0.0, layout.width, layout.height);
-                    let paint = Paint::default();
-                    canvas.draw_image_rect(img, None, dst, &paint);
+                    draw_fitted(canvas, img, &self.fit, layout);
                 }
                 return;
             }
@@ -105,9 +197,7 @@ impl Painter for Video {
         };
         let skia_data = skia_safe::Data::new_copy(&frame_data);
         if let Some(img) = skia_safe::Image::from_encoded(skia_data) {
-            let dst = Rect::from_xywh(0.0, 0.0, layout.width, layout.height);
-            let paint = Paint::default();
-            canvas.draw_image_rect(img, None, dst, &paint);
+            draw_fitted(canvas, img, &self.fit, layout);
         }
     }
 }
diff --git a/crates/rustmotion-components/tests/audit_ws_d.rs b/crates/rustmotion-components/tests/audit_ws_d.rs
new file mode 100644
index 00000000..3cb43373
--- /dev/null
+++ b/crates/rustmotion-components/tests/audit_ws_d.rs
@@ -0,0 +1,188 @@
+//! Regression tests for the `video` component's dead-field fixes: `fit`,
+//! `trim_end`, `loop_video`, and the straight-vs-premultiplied alpha bug on
+//! its cached-frame draw path.
+//!
+//! Every case populates `video_frame_cache()` directly with hand-built RGBA
+//! frames rather than shelling out to a real ffmpeg decode: the field this
+//! module exercises (`Video::paint_content`) is one call away from the
+//! cache, and driving it that way keeps these tests hermetic and fast while
+//! still going through the real, public `Painter` implementation — no
+//! private items from `rustmotion-components` are touched.
+
+use std::sync::Arc;
+
+use rustmotion_components::Video;
+use rustmotion_core::css::CssStyle;
+use rustmotion_core::engine::animator::AnimatedProperties;
+use rustmotion_core::engine::layout_pass::BoxLayout;
+use rustmotion_core::engine::renderer::video_frame_cache;
+use rustmotion_core::schema::ImageFit;
+use rustmotion_core::traits::{PaintCtx, Painter, TimingConfig};
+
+fn unique_src(label: &str) -> String {
+    format!(
+        "audit-ws-d-video-{label}-{}-{}",
+        std::process::id(),
+        std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .expect("system clock before UNIX epoch")
+            .as_nanos()
+    )
+}
+
+#[allow(clippy::too_many_arguments)]
+fn video(
+    src: &str,
+    fit: ImageFit,
+    trim_start: Option<f64>,
+    trim_end: Option<f64>,
+    loop_video: Option<bool>,
+) -> Video {
+    Video {
+        src: src.to_string(),
+        trim_start,
+        trim_end,
+        playback_rate: None,
+        fit,
+        volume: 1.0,
+        loop_video,
+        timing: TimingConfig::default(),
+        style: CssStyle::default(),
+        timeline: Vec::new(),
+        stagger: None,
+    }
+}
+
+fn ctx_at(time: f64) -> PaintCtx {
+    PaintCtx {
+        time,
+        scenario_time: time,
+        scene_duration: 10.0,
+        frame_index: 0,
+        fps: 30,
+        video_width: 1920,
+        video_height: 1080,
+        stagger_offset: 0.0,
+    }
+}
+
+fn solid_rgba(color: [u8; 4], w: u32, h: u32) -> Vec<u8> {
+    let mut buf = Vec::with_capacity((w * h * 4) as usize);
+    for _ in 0..(w * h) {
+        buf.extend_from_slice(&color);
+    }
+    buf
+}
+
+/// Paints `video` into a fresh `w`×`h` surface (background transparent if
+/// `transparent_bg`, opaque black otherwise) and reads the composited pixels
+/// back as straight (unpremultiplied) RGBA.
+fn paint_and_read(video: &Video, ctx: &PaintCtx, w: i32, h: i32, transparent_bg: bool) -> Vec<u8> {
+    let mut surface = skia_safe::surfaces::raster_n32_premul((w, h)).expect("raster surface");
+    let bg = if transparent_bg {
+        skia_safe::Color4f::new(0.0, 0.0, 0.0, 0.0)
+    } else {
+        skia_safe::Color4f::new(0.0, 0.0, 0.0, 1.0)
+    };
+    surface.canvas().clear(bg);
+
+    let layout = BoxLayout {
+        width: w as f32,
+        height: h as f32,
+        ..Default::default()
+    };
+    let props = AnimatedProperties::default();
+    video.paint_content(surface.canvas(), &layout, &props, ctx);
+
+    let mut pixels = vec![0u8; (w * h * 4) as usize];
+    let info = skia_safe::ImageInfo::new(
+        (w, h),
+        skia_safe::ColorType::RGBA8888,
+        skia_safe::AlphaType::Unpremul,
+        None,
+    );
+    surface.read_pixels(&info, &mut pixels, (w * 4) as usize, (0, 0));
+    pixels
+}
+
+fn px(buf: &[u8], w: i32, x: i32, y: i32) -> [u8; 4] {
+    let i = ((y * w + x) * 4) as usize;
+    buf[i..i + 4].try_into().expect("pixel in bounds")
+}
+
+// ─── `fit` was declared, documented, and never read ────────────────────────
+
+/// A 10×20 source into a 40×40 box under `contain` must letterbox — scale
+/// is `min(40/10, 40/40) = 1`, so the drawn region is 10 wide, centred with
+/// a 15px empty margin on each side. Before the fix, the painter always
+/// stretched to the full box regardless of `fit`, so every pixel — margins
+/// included — came out opaque.
+#[test]
+fn contain_fit_letterboxes_instead_of_stretching() {
+    let src = unique_src("fit-contain");
+    let (fw, fh) = (10u32, 20u32);
+    let cache_key = format!("{src}:40x40");
+    video_frame_cache().insert(
+        cache_key,
+        Arc::new(vec![(
+            0.0,
+            solid_rgba([255, 255, 255, 255], fw, fh),
+            fw,
+            fh,
+        )]),
+    );
+
+    let v = video(&src, ImageFit::Contain, None, None, None);
+    let ctx = ctx_at(0.0);
+    let pixels = paint_and_read(&v, &ctx, 40, 40, true);
+
+    assert_eq!(
+        px(&pixels, 40, 0, 20)[3],
+        0,
+        "letterboxed left margin must stay empty, not be stretched into"
+    );
+    assert_eq!(
+        px(&pixels, 40, 39, 20)[3],
+        0,
+        "letterboxed right margin must stay empty, not be stretched into"
+    );
+    assert_eq!(
+        px(&pixels, 40, 20, 20),
+        [255, 255, 255, 255],
+        "the drawn column itself must still be opaque"
+    );
+}
+
+/// `fill` (the CSS default `object-fit: fill` behaviour) must still stretch
+/// to cover the whole box exactly as before — the fix must not regress the
+/// one mode that already matched the pre-fix behaviour.
+#[test]
+fn fill_fit_still_stretches_to_the_whole_box() {
+    let src = unique_src("fit-fill");
+    let (fw, fh) = (10u32, 20u32);
+    let cache_key = format!("{src}:40x40");
+    video_frame_cache().insert(
+        cache_key,
+        Arc::new(vec![(
+            0.0,
+            solid_rgba([255, 255, 255, 255], fw, fh),
+            fw,
+            fh,
+        )]),
+    );
+
+    let v = video(&src, ImageFit::Fill, None, None, None);
+    let ctx = ctx_at(0.0);
+    let pixels = paint_and_read(&v, &ctx, 40, 40, true);
+
+    assert_eq!(
+        px(&pixels, 40, 0, 0)[3],
+        255,
+        "fill must cover every corner"
+    );
+    assert_eq!(
+        px(&pixels, 40, 39, 39)[3],
+        255,
+        "fill must cover every corner"
+    );
+}
diff --git a/crates/rustmotion/src/cli/commands/batch.rs b/crates/rustmotion/src/cli/commands/batch.rs
index b8ec3643..e68d2f20 100644
--- a/crates/rustmotion/src/cli/commands/batch.rs
+++ b/crates/rustmotion/src/cli/commands/batch.rs
@@ -71,11 +71,14 @@ pub(crate) fn resolve_name_template(
             out.push_str(&replacement);
             cursor = start + end + 1; // skip past '}'
         } else {
-            out.push(bytes[cursor] as char);
-            cursor += 1;
+            let ch = template[cursor..].chars().next().expect(
+                "cursor sits on a UTF-8 char boundary: every branch above advances it either \
+                 past an ASCII '{'/'}' byte or by a full char's own byte length",
+            );
+            out.push(ch);
+            cursor += ch.len_utf8();
         }
     }
-    let _ = bytes;
     Ok(out)
 }
 
@@ -492,6 +495,32 @@ mod name_template_tests {
             "static.mp4"
         );
     }
+
+    /// The literal (non-`{field}`) text of the template used to be walked
+    /// byte-by-byte and each byte cast straight to `char` — a Latin-1
+    /// reinterpretation of whatever UTF-8 continuation bytes an accented
+    /// character produced. `é` is `0xC3 0xA9` in UTF-8; cast individually
+    /// that becomes `é`, exactly the corruption this asserts is gone.
+    #[test]
+    fn accented_literal_text_round_trips() {
+        let data = row(&[("id", json!("abc"))]);
+        assert_eq!(
+            resolve_name_template("résumé-{id}.mp4", &data, 0).unwrap(),
+            "résumé-abc.mp4"
+        );
+    }
+
+    /// A non-Latin script exercises characters that are more than two UTF-8
+    /// bytes wide, where a byte-at-a-time cast produces even more mangled
+    /// output than the two-byte Latin-1 case above.
+    #[test]
+    fn cjk_literal_text_round_trips() {
+        let data = row(&[("id", json!("1"))]);
+        assert_eq!(
+            resolve_name_template("动画-{id}.mp4", &data, 0).unwrap(),
+            "动画-1.mp4"
+        );
+    }
 }
 
 #[cfg(test)]
diff --git a/crates/rustmotion/tests/audit_ws_d.rs b/crates/rustmotion/tests/audit_ws_d.rs
index 36c6a6a1..23c484e7 100644
--- a/crates/rustmotion/tests/audit_ws_d.rs
+++ b/crates/rustmotion/tests/audit_ws_d.rs
@@ -1,10 +1,29 @@
 //! Regression tests for the media-decoding, frame-cache, and render/batch
 //! CLI hardening pass on this branch.
 //!
-//! Video frame preextraction (`preload::preextract_video_frames`) is
-//! exercised through the crate's public `rustmotion::engine::preload`
-//! surface directly — no subprocess needed, since the budget math and the
-//! cache it guards are both `pub`.
+//! Two kinds of coverage land here:
+//!
+//! - Video frame preextraction (`preload::preextract_video_frames`) is
+//!   exercised through the crate's public `rustmotion::engine::preload`
+//!   surface directly — no subprocess needed, since the budget math and the
+//!   cache it guards are both `pub`.
+//! - The batch `--name-template` byte-vs-char bug
+//!   (`cli::commands::batch::resolve_name_template`) cannot be reached this
+//!   way: `cli::commands` is a private module (`mod commands;` in
+//!   `src/cli/mod.rs`), so — mirroring `audit_ws_b.rs`'s reasoning for the
+//!   same constraint — the only externally-observable contract is the
+//!   compiled binary itself, driven as a subprocess.
+//!
+//! The GIF cache-stampede/decompression-bomb caps and the video component's
+//! dead-field fixes (`fit`, `loop_video`, `trim_end`, straight-vs-premultiplied
+//! alpha) live in `rustmotion-components`'s own test suite instead — see
+//! that crate's `audit_ws_d.rs` and `gif.rs`'s in-file `mod tests`. The
+//! `--watch` cache-clearing fix needs a private helper in
+//! `cli::commands::render` and lives in that file's own `mod tests` for the
+//! same private-module reason as the name-template test above.
+
+use std::path::{Path, PathBuf};
+use std::process::{Command, Output};
 
 use rustmotion::engine::preload::{
     video_frame_byte_size, would_exceed_cache_budget, VIDEO_FRAME_CACHE_BUDGET_BYTES,
@@ -23,11 +42,10 @@ fn frame_byte_size_matches_plain_multiplication_for_ordinary_dimensions() {
 
 /// The secondary hazard this closes: `width * height * 4` in plain `u32`
 /// wraps for a large-enough declared size (65536×16384 wraps to 0, which
-/// used to turn into a division by zero downstream). `u32::MAX` on both
-/// dimensions is the most extreme case reachable from a `style.width`/
-/// `style.height` pair — the fixed computation must saturate to `u64::MAX`,
-/// not wrap to some small number that would slip past the budget check
-/// below.
+/// used to turn into a division by zero downstream). `u32::MAX` on both dimensions
+/// is the most extreme case reachable from a `style.width`/`style.height`
+/// pair — the fixed computation must saturate to `u64::MAX`, not wrap to
+/// some small number that would slip past the budget check below.
 #[test]
 fn frame_byte_size_saturates_instead_of_wrapping_on_extreme_dimensions() {
     let huge = video_frame_byte_size(u32::MAX, u32::MAX);
@@ -61,3 +79,137 @@ fn would_exceed_cache_budget_rejects_only_once_the_sum_crosses_the_ceiling() {
         "saturating add must not wrap past the ceiling"
     );
 }
+
+// ─── `batch --name-template` must not mangle non-ASCII bytes ──────────────
+
+/// Minimal RAII scratch directory, mirroring `audit_ws_b.rs`'s `ScratchDir`.
+struct ScratchDir(PathBuf);
+
+impl ScratchDir {
+    fn new(label: &str) -> Self {
+        let unique = format!(
+            "rustmotion-audit-ws-d-{label}-{}-{}",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .expect("system clock before UNIX epoch")
+                .as_nanos()
+        );
+        let path = std::env::temp_dir().join(unique);
+        std::fs::create_dir_all(&path).expect("create scratch dir");
+        Self(path)
+    }
+}
+
+impl Drop for ScratchDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn write_file(dir: &Path, name: &str, contents: &str) -> PathBuf {
+    let path = dir.join(name);
+    std::fs::write(&path, contents).expect("write scratch file");
+    path
+}
+
+fn run_batch(file: &Path, data: &Path, output_dir: &Path, name_template: &str) -> Output {
+    Command::new(env!("CARGO_BIN_EXE_rustmotion"))
+        .arg("--quiet")
+        .arg("batch")
+        .arg("--file")
+        .arg(file)
+        .arg("--data")
+        .arg(data)
+        .arg("--output-dir")
+        .arg(output_dir)
+        .arg("--name-template")
+        .arg(name_template)
+        .arg("--format")
+        .arg("png-seq")
+        .output()
+        .expect("failed to spawn `rustmotion batch`")
+}
+
+/// `resolve_name_template` used to walk the template as raw bytes and
+/// cast each one to `char` — a Latin-1 reinterpretation that mangles every
+/// non-ASCII byte: `résumé-{id}.mp4` became `résumé-VAL.mp4` on disk.
+/// `batch`'s own module doc gives `{lang}/{id}
+/// .mp4` as the flagship use case for `--name-template`, which is exactly
+/// the localisation scenario most likely to carry accents.
+///
+/// Driven as a subprocess rather than calling `resolve_name_template`
+/// directly: it is `pub(crate)` inside the private `cli::commands::batch`
+/// module, unreachable from an external integration test.
+#[test]
+fn batch_name_template_round_trips_accented_characters_on_disk() {
+    let scratch = ScratchDir::new("rm30");
+    let template = write_file(
+        &scratch.0,
+        "template.json",
+        &serde_json::json!({
+            "config": { "id": { "type": "string", "default": "x" } },
+            "video": { "width": 32, "height": 32, "fps": 1 },
+            "scenes": [{ "duration": 1.0, "children": [] }]
+        })
+        .to_string(),
+    );
+    let data = write_file(
+        &scratch.0,
+        "data.jsonl",
+        &serde_json::json!({"id": "abc"}).to_string(),
+    );
+    let output_dir = scratch.0.join("out");
+    std::fs::create_dir_all(&output_dir).expect("create output dir");
+
+    let result = run_batch(&template, &data, &output_dir, "résumé-{id}.png");
+
+    assert!(
+        result.status.success(),
+        "batch must succeed: stdout={}\nstderr={}",
+        String::from_utf8_lossy(&result.stdout),
+        String::from_utf8_lossy(&result.stderr)
+    );
+
+    let expected = output_dir.join("résumé-abc.png");
+    assert!(
+        expected.is_dir(),
+        "expected an accent-preserving output directory at {}, found instead: {:?}",
+        expected.display(),
+        std::fs::read_dir(&output_dir)
+            .map(|entries| entries
+                .filter_map(|e| e.ok().map(|e| e.file_name()))
+                .collect::<Vec<_>>())
+            .unwrap_or_default()
+    );
+    assert!(expected.join("frame_00000.png").exists());
+}
+
+/// A template with no non-ASCII content must still resolve exactly as
+/// before — the fix changes how a byte becomes a `char`, not the loop's
+/// control flow (the `{`/`}` brace scan is untouched).
+#[test]
+fn batch_name_template_plain_ascii_is_unaffected() {
+    let scratch = ScratchDir::new("rm30-ascii");
+    let template = write_file(
+        &scratch.0,
+        "template.json",
+        &serde_json::json!({
+            "config": { "id": { "type": "string", "default": "x" } },
+            "video": { "width": 32, "height": 32, "fps": 1 },
+            "scenes": [{ "duration": 1.0, "children": [] }]
+        })
+        .to_string(),
+    );
+    let data = write_file(
+        &scratch.0,
+        "data.jsonl",
+        &serde_json::json!({"id": "abc"}).to_string(),
+    );
+    let output_dir = scratch.0.join("out");
+    std::fs::create_dir_all(&output_dir).expect("create output dir");
+
+    let result = run_batch(&template, &data, &output_dir, "clip-{id}.png");
+    assert!(result.status.success());
+    assert!(output_dir.join("clip-abc.png").is_dir());
+}

From 7298fd82e2cdcf311d44e19db21d7a555b2f0ee0 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:00:53 +0200
Subject: [PATCH 23/56] fix(video): treat decoded frames as unpremultiplied
 (#247)

Refs #220
---
 crates/rustmotion-components/src/gif.rs       |   6 +-
 crates/rustmotion-components/src/video.rs     |  32 +++--
 .../rustmotion-components/tests/audit_ws_d.rs | 135 ++++++++++++++++++
 3 files changed, 161 insertions(+), 12 deletions(-)

diff --git a/crates/rustmotion-components/src/gif.rs b/crates/rustmotion-components/src/gif.rs
index b5698604..5a0d918d 100644
--- a/crates/rustmotion-components/src/gif.rs
+++ b/crates/rustmotion-components/src/gif.rs
@@ -455,9 +455,9 @@ mod tests {
     /// own video is, so passing generous `max_w`/`max_h` here isolates the
     /// byte-budget check from the video-dimensions check exercised by the
     /// next test. 144 MiB is deliberately far short of the 65535×65535
-    /// (~17 GiB) header a real crafted file could declare — large enough to
-    /// prove the budget check fires, small enough that running this test
-    /// never risks the allocation it is asserting never happens.
+    /// (~17 GiB) header the audit's own crafted file could declare — large
+    /// enough to prove the budget check fires, small enough that running
+    /// this test never risks the allocation it is asserting never happens.
     #[test]
     fn a_canvas_over_the_byte_budget_is_rejected_without_allocating_it() {
         let path = std::env::temp_dir().join(format!(
diff --git a/crates/rustmotion-components/src/video.rs b/crates/rustmotion-components/src/video.rs
index d76cf0fc..cae7b018 100644
--- a/crates/rustmotion-components/src/video.rs
+++ b/crates/rustmotion-components/src/video.rs
@@ -95,10 +95,10 @@ fn draw_fitted(canvas: &Canvas, img: skia_safe::Image, fit: &ImageFit, layout: &
 /// The source clip's own duration, probed via `ffprobe` and memoized per
 /// `src` for the life of the process — `effective_source_time` below is
 /// called once per painted frame, and re-probing on every one of them would
-/// mean one subprocess spawn per frame for any looping video. `None` on a
-/// probe failure (no ffprobe on `PATH`, or the source can't be read) is
-/// memoized too, so a broken source fails fast on every subsequent frame
-/// instead of retrying the same failing probe.
+/// mean one subprocess spawn per frame for any looping video with no
+/// explicit `trim_end`. `None` on a probe failure (no ffprobe on `PATH`, or
+/// the source can't be read) is memoized too, so a broken source fails fast
+/// on every subsequent frame instead of retrying the same failing probe.
 fn video_duration_secs(src: &str) -> Option<f64> {
     static CACHE: std::sync::OnceLock<
         std::sync::Mutex<std::collections::HashMap<String, Option<f64>>>,
@@ -122,15 +122,29 @@ fn video_duration_secs(src: &str) -> Option<f64> {
 
 impl Video {
     /// The timestamp to sample from the source clip for a given scene time.
-    /// When `loop_video` is set, playback wraps within the source's own
-    /// probed duration instead of running past it and holding on
-    /// whatever the last extractable frame happens to be.
+    ///
+    /// Honours `trim_end` on the picture the same way the audio track
+    /// already does: past `trim_end`, playback holds on the last in-window
+    /// frame instead of continuing to draw whatever the source contains
+    /// beyond the intended trim point. When `loop_video` is set, playback
+    /// wraps within `[trim_start, trim_end)` instead of clamping — falling
+    /// back to the source's own probed duration as the loop window only
+    /// when `trim_end` is absent, since that is the only case where the
+    /// window cannot otherwise be known at all.
     fn effective_source_time(&self, ctx_time: f64) -> f64 {
         let rate = self.playback_rate.unwrap_or(1.0);
         let trim_start = self.trim_start.unwrap_or(0.0);
         let raw = trim_start + ctx_time * rate;
 
-        if self.loop_video == Some(true) {
+        if let Some(end) = self.trim_end {
+            if end > trim_start {
+                return if self.loop_video == Some(true) {
+                    trim_start + (raw - trim_start).rem_euclid(end - trim_start)
+                } else {
+                    raw.min(end)
+                };
+            }
+        } else if self.loop_video == Some(true) {
             if let Some(duration) = video_duration_secs(&self.src) {
                 if duration > trim_start {
                     return trim_start + (raw - trim_start).rem_euclid(duration - trim_start);
@@ -162,7 +176,7 @@ impl Painter for Video {
                 let img_info = ImageInfo::new(
                     (fw as i32, fh as i32),
                     ColorType::RGBA8888,
-                    skia_safe::AlphaType::Premul,
+                    skia_safe::AlphaType::Unpremul,
                     None,
                 );
                 let row_bytes = fw as usize * 4;
diff --git a/crates/rustmotion-components/tests/audit_ws_d.rs b/crates/rustmotion-components/tests/audit_ws_d.rs
index 3cb43373..7ac9dbd8 100644
--- a/crates/rustmotion-components/tests/audit_ws_d.rs
+++ b/crates/rustmotion-components/tests/audit_ws_d.rs
@@ -186,3 +186,138 @@ fn fill_fit_still_stretches_to_the_whole_box() {
         "fill must cover every corner"
     );
 }
+
+// ─── `trim_end` was honoured only on the extracted audio ───────────────────
+
+/// Frames beyond `trim_end` sit in the cache (simulating a preextraction
+/// window, or a direct extraction, wider than the intended trim), so the
+/// picture path must never pick one of them once `trim_end` is set: past
+/// `trim_end`, playback holds on the last in-window frame. Before the fix,
+/// `source_time` had no upper bound at all — querying past `trim_end` on a
+/// cache/source that extends further would draw whatever sits further
+/// along the source, not the frame at the trim boundary.
+#[test]
+fn trim_end_clamps_playback_instead_of_running_past_it() {
+    let src = unique_src("trimend");
+    let cache_key = format!("{src}:20x20");
+    let frames = vec![
+        (0.0, solid_rgba([255, 0, 0, 255], 2, 2), 2, 2),
+        (0.5, solid_rgba([0, 0, 255, 255], 2, 2), 2, 2),
+        (1.0, solid_rgba([0, 255, 0, 255], 2, 2), 2, 2),
+        (1.5, solid_rgba([128, 0, 128, 255], 2, 2), 2, 2),
+        (2.0, solid_rgba([255, 165, 0, 255], 2, 2), 2, 2),
+    ];
+    video_frame_cache().insert(cache_key, Arc::new(frames));
+
+    let v = video(&src, ImageFit::Fill, Some(0.0), Some(1.0), None);
+    let ctx = ctx_at(1.8);
+    let pixels = paint_and_read(&v, &ctx, 20, 20, false);
+
+    assert_eq!(
+        px(&pixels, 20, 10, 10),
+        [0, 255, 0, 255],
+        "past trim_end, playback must clamp to the frame at trim_end (green), not the frame \
+         nearest the unclamped query time (orange)"
+    );
+}
+
+// ─── `loop_video` made neither the picture nor the audio loop ─────────────
+
+/// Cache frames only cover `[0.0, 1.0)`; `trim_end: Some(1.0)` gives
+/// `loop_video` a window to wrap within without needing a real source file
+/// to probe. Querying at `ctx.time = 2.1` (raw source time 2.1s, i.e. "2
+/// full loops plus 0.1s") must land near 0.1s once wrapped — nearest to
+/// that among `{0.0, 0.25, 0.5, 0.75}` is red. Before this fix, the same
+/// query — with the trim-end clamp from the previous test already in place
+/// but no loop branch yet — clamped to `min(2.1, 1.0) = 1.0`, whose nearest
+/// cached frame is yellow: a clearly different pixel, which is what proves
+/// this test is exercising the loop path and not being masked by the clamp.
+#[test]
+fn loop_video_wraps_playback_within_the_trim_window() {
+    let src = unique_src("loop");
+    let cache_key = format!("{src}:20x20");
+    let frames = vec![
+        (0.0, solid_rgba([255, 0, 0, 255], 2, 2), 2, 2),
+        (0.25, solid_rgba([0, 255, 0, 255], 2, 2), 2, 2),
+        (0.5, solid_rgba([0, 0, 255, 255], 2, 2), 2, 2),
+        (0.75, solid_rgba([255, 255, 0, 255], 2, 2), 2, 2),
+    ];
+    video_frame_cache().insert(cache_key, Arc::new(frames));
+
+    let v = video(&src, ImageFit::Fill, Some(0.0), Some(1.0), Some(true));
+    let ctx = ctx_at(2.1);
+    let pixels = paint_and_read(&v, &ctx, 20, 20, false);
+
+    assert_eq!(
+        px(&pixels, 20, 10, 10),
+        [255, 0, 0, 255],
+        "looping must wrap the query time back into the window (nearest: red), not clamp to \
+         the window's own end (nearest: yellow)"
+    );
+}
+
+/// Without `loop_video`, a `trim_end`-bounded video must still clamp
+/// (unaffected by the loop branch existing) rather than wrap — the same
+/// scenario as the wrap test above, minus the flag.
+#[test]
+fn without_loop_video_playback_still_clamps_not_wraps() {
+    let src = unique_src("no-loop");
+    let cache_key = format!("{src}:20x20");
+    let frames = vec![
+        (0.0, solid_rgba([255, 0, 0, 255], 2, 2), 2, 2),
+        (0.25, solid_rgba([0, 255, 0, 255], 2, 2), 2, 2),
+        (0.5, solid_rgba([0, 0, 255, 255], 2, 2), 2, 2),
+        (0.75, solid_rgba([255, 255, 0, 255], 2, 2), 2, 2),
+    ];
+    video_frame_cache().insert(cache_key, Arc::new(frames));
+
+    let v = video(&src, ImageFit::Fill, Some(0.0), Some(1.0), None);
+    let ctx = ctx_at(2.1);
+    let pixels = paint_and_read(&v, &ctx, 20, 20, false);
+
+    assert_eq!(
+        px(&pixels, 20, 10, 10),
+        [255, 255, 0, 255],
+        "no loop_video: must clamp to the window's end (nearest: yellow), not wrap"
+    );
+}
+
+// ─── cached-frame draw path mistagged straight alpha as premultiplied ──────
+
+/// ffmpeg's `-pix_fmt rgba` output — what fills the video-frame cache — is
+/// straight (unpremultiplied) alpha. Tagging that buffer `AlphaType::Premul`
+/// makes Skia treat the RGB channels as already scaled by alpha instead of
+/// scaling them itself, which brightens (here: doubles) every
+/// semi-transparent pixel's channels once composited.
+///
+/// A straight-alpha (200, 100, 50, 128) pixel, composited over black:
+/// correctly tagged `Unpremul`, Skia premultiplies it to
+/// (200×128/255, 100×128/255, 50×128/255) ≈ (100, 50, 25) before compositing
+/// over black, landing there almost exactly (the `(1 - alpha) * 0` background
+/// term vanishes either way). Mistagged `Premul`, Skia uses the raw channel
+/// values directly as if already scaled — (200, 100, 50) — composited over
+/// black with no further scaling, landing at roughly double the correct
+/// result.
+#[test]
+fn cached_frame_straight_alpha_composites_correctly_not_doubled() {
+    let src = unique_src("alpha");
+    let cache_key = format!("{src}:10x10");
+    let straight = [200u8, 100, 50, 128];
+    video_frame_cache().insert(
+        cache_key,
+        Arc::new(vec![(0.0, solid_rgba(straight, 2, 2), 2, 2)]),
+    );
+
+    let v = video(&src, ImageFit::Fill, None, None, None);
+    let ctx = ctx_at(0.0);
+    let pixels = paint_and_read(&v, &ctx, 10, 10, false);
+    let composited = px(&pixels, 10, 5, 5);
+
+    let close = |actual: u8, expected: u8| (actual as i16 - expected as i16).abs() <= 4;
+    assert!(
+        close(composited[0], 100) && close(composited[1], 50) && close(composited[2], 25),
+        "straight-alpha (200,100,50,128) over black must composite to roughly (100,50,25), \
+         got {composited:?} — a value near (200,100,50) means the buffer is still mistagged \
+         as premultiplied and its channels are being used unscaled"
+    );
+}

From 05e0074501b01f855f644bd435ae09d7a472bb07 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:01:33 +0200
Subject: [PATCH 24/56] fix(html): emit lengths the core parser can read (#289)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two parsers for the same syntax have drifted. Executed: `style="padding: 24px 48px; margin: 0 auto; grid-template-columns: repeat(3, 1fr)"` transpiles to `"padding":"24px 48px"`, `"margin":"0 auto"`, `"grid-template-columns":["repeat(3,","1fr)"]`. All three deserialize successfully — `Edges::Uniform(LengthPercentage::String)` and `GridTrack::Length(LengthPercentage::String)` are untagged string variants — and then core's `parse_length` (rustmotion-core/src/css/units.rs:125) only understands a single number+unit token, so `parse_length_or_warn` (units.rs:262) falls back to `Px(0.0)`: zero padding, zero margin, two zero-width grid tracks. The only signal is an `eprintln!` warning; `validate` exits 0 and the render is wrong. Per-side padding is entirely unexpressible from HTML (`padding-top:32` is rejected by `CssStyle`'s `deny_unknown_fields`, `padding:32px 48px` silently becomes 0), and the skill rule html-css-mental-model.md:97 only documents the JSON object form, which inline `style=""` cannot produce.

Refs #220
---
 crates/rustmotion-html/src/element.rs      |   9 +-
 crates/rustmotion-html/src/style.rs        | 217 +++++++++++++++++++--
 crates/rustmotion-html/tests/audit_ws_f.rs |  92 +++++++++
 3 files changed, 298 insertions(+), 20 deletions(-)

diff --git a/crates/rustmotion-html/src/element.rs b/crates/rustmotion-html/src/element.rs
index b370f658..337c8b2e 100644
--- a/crates/rustmotion-html/src/element.rs
+++ b/crates/rustmotion-html/src/element.rs
@@ -58,11 +58,10 @@ fn collect_text(handle: &Handle, out: &mut String) {
 /// [`crate::style::parse_anim_attr`]) lands in `style.animation` — inline CSS
 /// cannot express animation arrays, so `anim` is the only writer of that key.
 fn style_object(attrs: &[(String, String)]) -> Result<Option<Value>, HtmlError> {
-    let mut map = attrs
-        .iter()
-        .find(|(k, _)| k == "style")
-        .map(|(_, raw)| parse_inline_style(raw))
-        .unwrap_or_default();
+    let mut map = match attrs.iter().find(|(k, _)| k == "style") {
+        Some((_, raw)) => parse_inline_style(raw)?,
+        None => Map::new(),
+    };
     if let Some((_, anim)) = attrs.iter().find(|(k, _)| k == "anim") {
         map.insert("animation".into(), parse_anim_attr(anim)?);
     }
diff --git a/crates/rustmotion-html/src/style.rs b/crates/rustmotion-html/src/style.rs
index d27a71e4..e80a239c 100644
--- a/crates/rustmotion-html/src/style.rs
+++ b/crates/rustmotion-html/src/style.rs
@@ -28,10 +28,16 @@ pub fn coerce_value(raw: &str) -> Value {
     Value::from(t.to_string())
 }
 
-/// Parse an inline `style="a:b; c:d"` declaration list into a JSON style object.
-/// `grid-template-columns`/`-rows` are split into string arrays; all other
-/// properties pass through their kebab-case name with a coerced value.
-pub fn parse_inline_style(decls: &str) -> Map<String, Value> {
+/// Parse an inline `style="a:b; c:d"` declaration list into a JSON style
+/// object. `padding`/`margin`/`border-radius` accept the CSS 1/2/3/4-value
+/// box shorthand, expanded into the `{top,right,bottom,left}` /
+/// `{top-left,top-right,bottom-right,bottom-left}` object the core CSS
+/// engine's `Edges`/`BorderRadius` types deserialize. `grid-template-columns`/
+/// `-rows` accept a track list, `repeat()`/`minmax()` included. Any other
+/// property whose value is more than one top-level (paren-aware) token is
+/// refused rather than passed through as an opaque string the core length
+/// parser cannot read (see [`HtmlError::UnsupportedStyleShorthand`]).
+pub fn parse_inline_style(decls: &str) -> Result<Map<String, Value>, HtmlError> {
     let mut map = Map::new();
     for decl in decls.split(';') {
         let decl = decl.trim();
@@ -43,17 +49,198 @@ pub fn parse_inline_style(decls: &str) -> Map<String, Value> {
         };
         let prop = prop.trim().to_string();
         let value = value.trim();
-        if prop == "grid-template-columns" || prop == "grid-template-rows" {
-            let arr: Vec<Value> = value
-                .split_whitespace()
-                .map(|t| Value::from(t.to_string()))
-                .collect();
-            map.insert(prop, Value::Array(arr));
-        } else {
-            map.insert(prop, coerce_value(value));
+        match prop.as_str() {
+            "grid-template-columns" | "grid-template-rows" => {
+                map.insert(
+                    prop.clone(),
+                    Value::Array(parse_grid_template(&prop, value)?),
+                );
+            }
+            "padding" | "margin" => {
+                let tokens = split_top_level_tokens(value);
+                match tokens.len() {
+                    1 => {
+                        map.insert(prop, coerce_value(value));
+                    }
+                    2..=4 => {
+                        map.insert(prop, expand_box_edges(&tokens));
+                    }
+                    _ => {
+                        return Err(HtmlError::UnsupportedStyleShorthand {
+                            prop,
+                            value: value.to_string(),
+                        })
+                    }
+                }
+            }
+            "border-radius" => {
+                let tokens = split_top_level_tokens(value);
+                match tokens.len() {
+                    1 => {
+                        map.insert(prop, coerce_value(value));
+                    }
+                    2..=4 => {
+                        map.insert(prop, expand_border_radius_corners(&tokens));
+                    }
+                    _ => {
+                        return Err(HtmlError::UnsupportedStyleShorthand {
+                            prop,
+                            value: value.to_string(),
+                        })
+                    }
+                }
+            }
+            _ => {
+                if split_top_level_tokens(value).len() > 1 {
+                    return Err(HtmlError::UnsupportedStyleShorthand {
+                        prop,
+                        value: value.to_string(),
+                    });
+                }
+                map.insert(prop, coerce_value(value));
+            }
+        }
+    }
+    Ok(map)
+}
+
+/// Split a CSS value on top-level whitespace: whitespace inside a `(...)`
+/// span (e.g. the argument list of `rgba(0, 0, 0, 0.5)` or `repeat(3, 1fr)`)
+/// does not count as a separator, so a single functional-notation value
+/// stays one token while a genuine multi-value shorthand (`24px 48px`)
+/// splits into its parts.
+fn split_top_level_tokens(s: &str) -> Vec<&str> {
+    let mut tokens = Vec::new();
+    let mut depth = 0i32;
+    let mut token_start: Option<usize> = None;
+    for (i, c) in s.char_indices() {
+        match c {
+            '(' => depth += 1,
+            ')' => depth = depth.saturating_sub(1),
+            _ => {}
+        }
+        if c.is_whitespace() && depth == 0 {
+            if let Some(start) = token_start.take() {
+                tokens.push(&s[start..i]);
+            }
+        } else if token_start.is_none() {
+            token_start = Some(i);
+        }
+    }
+    if let Some(start) = token_start {
+        tokens.push(&s[start..]);
+    }
+    tokens
+}
+
+/// Expand a 2/3/4-value `padding`/`margin` shorthand into the
+/// `{top,right,bottom,left}` object `Edges::Sides` deserializes, following
+/// the standard CSS clockwise-from-top expansion rule.
+fn expand_box_edges(tokens: &[&str]) -> Value {
+    let (top, right, bottom, left) = match tokens {
+        [a, b] => (*a, *b, *a, *b),
+        [a, b, c] => (*a, *b, *c, *b),
+        [a, b, c, d] => (*a, *b, *c, *d),
+        _ => unreachable!("caller only passes 2..=4 tokens"),
+    };
+    let mut edges = Map::new();
+    edges.insert("top".into(), coerce_value(top));
+    edges.insert("right".into(), coerce_value(right));
+    edges.insert("bottom".into(), coerce_value(bottom));
+    edges.insert("left".into(), coerce_value(left));
+    Value::Object(edges)
+}
+
+/// Expand a 2/3/4-value `border-radius` shorthand into the
+/// `{top-left,top-right,bottom-right,bottom-left}` object
+/// `BorderRadius::Corners` deserializes, following the standard CSS
+/// clockwise-from-top-left expansion rule (a different starting corner than
+/// [`expand_box_edges`], per the CSS box-shorthand spec).
+fn expand_border_radius_corners(tokens: &[&str]) -> Value {
+    let (top_left, top_right, bottom_right, bottom_left) = match tokens {
+        [a, b] => (*a, *b, *a, *b),
+        [a, b, c] => (*a, *b, *c, *b),
+        [a, b, c, d] => (*a, *b, *c, *d),
+        _ => unreachable!("caller only passes 2..=4 tokens"),
+    };
+    let mut corners = Map::new();
+    corners.insert("top-left".into(), coerce_value(top_left));
+    corners.insert("top-right".into(), coerce_value(top_right));
+    corners.insert("bottom-right".into(), coerce_value(bottom_right));
+    corners.insert("bottom-left".into(), coerce_value(bottom_left));
+    Value::Object(corners)
+}
+
+/// Parse a `grid-template-columns`/`-rows` track list into the flat
+/// `Vec<GridTrack>` JSON the core CSS engine expects: `repeat(n, track)`
+/// expands into `n` copies of `track`, `minmax(min, max)` becomes
+/// `{"min":..,"max":..}`, and every other token passes through
+/// [`coerce_value`] unchanged (a bare number for `fr`, a keyword string, or
+/// an explicit length).
+fn parse_grid_template(prop: &str, value: &str) -> Result<Vec<Value>, HtmlError> {
+    let mut out = Vec::new();
+    for token in split_top_level_tokens(value) {
+        push_grid_track(prop, token, &mut out)?;
+    }
+    Ok(out)
+}
+
+fn push_grid_track(prop: &str, token: &str, out: &mut Vec<Value>) -> Result<(), HtmlError> {
+    if let Some(inner) = token
+        .strip_prefix("repeat(")
+        .and_then(|s| s.strip_suffix(')'))
+    {
+        let (count_str, pattern) =
+            inner
+                .split_once(',')
+                .ok_or_else(|| HtmlError::UnsupportedStyleShorthand {
+                    prop: prop.to_string(),
+                    value: token.to_string(),
+                })?;
+        let count: usize =
+            count_str
+                .trim()
+                .parse()
+                .map_err(|_| HtmlError::UnsupportedStyleShorthand {
+                    prop: prop.to_string(),
+                    value: token.to_string(),
+                })?;
+        let pattern_tokens = split_top_level_tokens(pattern.trim());
+        if pattern_tokens.is_empty() {
+            return Err(HtmlError::UnsupportedStyleShorthand {
+                prop: prop.to_string(),
+                value: token.to_string(),
+            });
         }
+        for _ in 0..count {
+            for t in &pattern_tokens {
+                out.push(parse_single_grid_track(prop, t)?);
+            }
+        }
+        return Ok(());
+    }
+    out.push(parse_single_grid_track(prop, token)?);
+    Ok(())
+}
+
+fn parse_single_grid_track(prop: &str, token: &str) -> Result<Value, HtmlError> {
+    if let Some(inner) = token
+        .strip_prefix("minmax(")
+        .and_then(|s| s.strip_suffix(')'))
+    {
+        let (min_s, max_s) =
+            inner
+                .split_once(',')
+                .ok_or_else(|| HtmlError::UnsupportedStyleShorthand {
+                    prop: prop.to_string(),
+                    value: token.to_string(),
+                })?;
+        let mut minmax = Map::new();
+        minmax.insert("min".into(), coerce_value(min_s.trim()));
+        minmax.insert("max".into(), coerce_value(max_s.trim()));
+        return Ok(Value::Object(minmax));
     }
-    map
+    Ok(coerce_value(token))
 }
 
 /// Parse an `anim` attribute into the `style.animation` JSON array.
@@ -187,7 +374,7 @@ mod tests {
 
     #[test]
     fn parses_declarations_into_style_object() {
-        let m = parse_inline_style("font-size:96px; color:#fff; text-align:center");
+        let m = parse_inline_style("font-size:96px; color:#fff; text-align:center").unwrap();
         assert_eq!(m.get("font-size"), Some(&json!(96)));
         assert_eq!(m.get("color"), Some(&json!("#fff")));
         assert_eq!(m.get("text-align"), Some(&json!("center")));
@@ -195,7 +382,7 @@ mod tests {
 
     #[test]
     fn grid_template_becomes_string_array() {
-        let m = parse_inline_style("grid-template-columns: 1fr 1fr");
+        let m = parse_inline_style("grid-template-columns: 1fr 1fr").unwrap();
         assert_eq!(m.get("grid-template-columns"), Some(&json!(["1fr", "1fr"])));
     }
 
diff --git a/crates/rustmotion-html/tests/audit_ws_f.rs b/crates/rustmotion-html/tests/audit_ws_f.rs
index 2230e257..60e4a8a1 100644
--- a/crates/rustmotion-html/tests/audit_ws_f.rs
+++ b/crates/rustmotion-html/tests/audit_ws_f.rs
@@ -95,3 +95,95 @@ fn inert_attributes_stay_inert_on_container_and_text() {
     let html = r##"<rustmotion width="1920" height="1080"><scene duration="2"><div class="wrapper" id="hero" data-testid="x"><p class="lead" data-x="1">Hi</p></div></scene></rustmotion>"##;
     html_to_scenario_value(html).expect("class/id/data-* must remain inert, not flagged");
 }
+
+// ---------------------------------------------------------------------------
+// CSS shorthand values transpile to strings the core length parser
+// cannot read, silently resolving to 0px.
+// ---------------------------------------------------------------------------
+
+#[test]
+fn padding_two_value_shorthand_expands_to_edges_object() {
+    let html = r##"<rustmotion width="1920" height="1080"><scene duration="2"><div style="padding: 24px 48px"></div></scene></rustmotion>"##;
+    let v = html_to_scenario_value(html).expect("2-value padding must transpile");
+    let padding = &v["scenes"][0]["children"][0]["style"]["padding"];
+    assert_eq!(padding["top"], json!(24));
+    assert_eq!(padding["bottom"], json!(24));
+    assert_eq!(padding["right"], json!(48));
+    assert_eq!(padding["left"], json!(48));
+}
+
+#[test]
+fn margin_four_value_shorthand_expands_to_edges_object() {
+    let html = r##"<rustmotion width="1920" height="1080"><scene duration="2"><div style="margin: 4px 8px 12px 16px"></div></scene></rustmotion>"##;
+    let v = html_to_scenario_value(html).expect("4-value margin must transpile");
+    let margin = &v["scenes"][0]["children"][0]["style"]["margin"];
+    assert_eq!(margin["top"], json!(4));
+    assert_eq!(margin["right"], json!(8));
+    assert_eq!(margin["bottom"], json!(12));
+    assert_eq!(margin["left"], json!(16));
+}
+
+#[test]
+fn border_radius_four_value_shorthand_expands_to_corners_object() {
+    let html = r##"<rustmotion width="1920" height="1080"><scene duration="2"><div style="border-radius: 2px 4px 6px 8px"></div></scene></rustmotion>"##;
+    let v = html_to_scenario_value(html).expect("4-value border-radius must transpile");
+    let radius = &v["scenes"][0]["children"][0]["style"]["border-radius"];
+    assert_eq!(radius["top-left"], json!(2));
+    assert_eq!(radius["top-right"], json!(4));
+    assert_eq!(radius["bottom-right"], json!(6));
+    assert_eq!(radius["bottom-left"], json!(8));
+}
+
+#[test]
+fn grid_template_columns_repeat_expands_to_flat_track_list() {
+    let html = r##"<rustmotion width="1920" height="1080"><scene duration="2"><div style="grid-template-columns: repeat(3, 1fr)"></div></scene></rustmotion>"##;
+    let v = html_to_scenario_value(html).expect("repeat() must transpile");
+    let tracks = v["scenes"][0]["children"][0]["style"]["grid-template-columns"]
+        .as_array()
+        .expect("array of tracks");
+    assert_eq!(tracks, &vec![json!("1fr"), json!("1fr"), json!("1fr")]);
+}
+
+#[test]
+fn grid_template_columns_minmax_expands_to_min_max_object() {
+    let html = r##"<rustmotion width="1920" height="1080"><scene duration="2"><div style="grid-template-columns: minmax(100px, 1fr) auto"></div></scene></rustmotion>"##;
+    let v = html_to_scenario_value(html).expect("minmax() must transpile");
+    let tracks = v["scenes"][0]["children"][0]["style"]["grid-template-columns"]
+        .as_array()
+        .expect("array of tracks");
+    assert_eq!(tracks.len(), 2);
+    assert_eq!(tracks[0]["min"], json!(100));
+    assert_eq!(tracks[0]["max"], json!("1fr"));
+    assert_eq!(tracks[1], json!("auto"));
+}
+
+#[test]
+fn unhandled_multi_token_style_value_is_refused_not_an_opaque_string() {
+    let html = r##"<rustmotion width="1920" height="1080"><scene duration="2"><div style="gap: 8px 16px"></div></scene></rustmotion>"##;
+    let err = html_to_scenario_value(html)
+        .expect_err("an unsupported multi-token style value must be refused, not silently zeroed");
+    match err {
+        HtmlError::UnsupportedStyleShorthand { prop, value } => {
+            assert_eq!(prop, "gap");
+            assert_eq!(value, "8px 16px");
+        }
+        other => panic!("expected UnsupportedStyleShorthand, got: {other:?}"),
+    }
+}
+
+#[test]
+fn single_token_padding_still_transpiles_to_a_plain_value() {
+    let html = r##"<rustmotion width="1920" height="1080"><scene duration="2"><div style="padding: 32px"></div></scene></rustmotion>"##;
+    let v = html_to_scenario_value(html).expect("uniform padding must still transpile");
+    assert_eq!(v["scenes"][0]["children"][0]["style"]["padding"], json!(32));
+}
+
+#[test]
+fn rgba_color_functional_notation_is_not_treated_as_multi_token() {
+    let html = r##"<rustmotion width="1920" height="1080"><scene duration="2"><div style="background: rgba(0, 0, 0, 0.5)"></div></scene></rustmotion>"##;
+    let v = html_to_scenario_value(html).expect("rgba(...) must not be flagged as multi-token");
+    assert_eq!(
+        v["scenes"][0]["children"][0]["style"]["background"],
+        json!("rgba(0, 0, 0, 0.5)")
+    );
+}

From 23c2bede7246c5df6866246a77185be4f8a67ab5 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:01:58 +0200
Subject: [PATCH 25/56] fix(studio): surface a render panic instead of caching
 an empty frame (#290)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`render_frame` panics on failure (`.expect("render frame")`, `.expect("rgba matches dimensions")`, `.expect("encode jpeg")`). Because the panic happens in the scoped child thread and is consumed by `join().unwrap_or_default()`, the `catch_unwind` wrapper in `view.rs::serve_or_render` never fires — so `fail_ledger().record_failure(key)` is unreachable on that path and the whole retry-budget mechanism is dead code for the on-demand asset handler. Instead the empty `Vec` is treated as a successful render: `frame_cache().insert(key, rendered.clone(), ...)` caches zero bytes, and the responder replies `200 image/jpeg` with an empty body. The canvas shows a permanently broken image for that (generation, frame, scale) and the cache guarantees it is never re-attempted. (The prefetch worker path calls `render_frame` directly and is correctly fenced.)

Refs #220
---
 crates/rustmotion-studio/src/editor/audio.rs  |  4 +-
 crates/rustmotion-studio/src/editor/frames.rs | 11 +++-
 crates/rustmotion-studio/src/editor/view.rs   | 24 ++++---
 crates/rustmotion-studio/src/lib.rs           |  2 +-
 crates/rustmotion-studio/src/library/data.rs  |  4 +-
 .../src/scenario/optimistic.rs                |  4 +-
 crates/rustmotion-studio/tests/audit_ws_g.rs  | 65 ++++++++++++++++---
 7 files changed, 84 insertions(+), 30 deletions(-)

diff --git a/crates/rustmotion-studio/src/editor/audio.rs b/crates/rustmotion-studio/src/editor/audio.rs
index 6a232169..5b015479 100644
--- a/crates/rustmotion-studio/src/editor/audio.rs
+++ b/crates/rustmotion-studio/src/editor/audio.rs
@@ -165,9 +165,7 @@ pub fn prepare(scenario: Arc<ResolvedScenario>, total_duration: f64) {
         match mixed {
             Ok(Some(pcm_bytes)) => {
                 let pcm: Vec<f32> = pcm_bytes
-                    .as_chunks::<2>()
-                    .0
-                    .iter()
+                    .chunks_exact(2)
                     .map(|b| i16::from_le_bytes([b[0], b[1]]) as f32 / 32768.0)
                     .collect();
                 let _ = tx.send(Cmd::Load(Arc::new(pcm), SAMPLE_RATE));
diff --git a/crates/rustmotion-studio/src/editor/frames.rs b/crates/rustmotion-studio/src/editor/frames.rs
index a734fd2e..b56ce160 100644
--- a/crates/rustmotion-studio/src/editor/frames.rs
+++ b/crates/rustmotion-studio/src/editor/frames.rs
@@ -26,20 +26,25 @@ pub const RENDER_STACK: usize = 32 * 1024 * 1024;
 
 /// [`render_frame`] on a thread with [`RENDER_STACK`], for callers that are not
 /// on the main thread. Scoped, so the scenario and tasks are borrowed rather
-/// than cloned.
+/// than cloned. `Err` means the render thread panicked (a Skia panic, a
+/// dimension mismatch, a JPEG encode failure): the caller must not treat that
+/// as a successful empty frame.
+// The panic payload carries no information callers act on; they only branch
+// on success vs. failure (retry-budget ledger, cache, HTTP status).
+#[allow(clippy::result_unit_err)]
 pub fn render_frame_deep(
     scenario: &ResolvedScenario,
     tasks: &[rustmotion::encode::video::FrameTask],
     frame: u32,
     scale: f32,
-) -> Vec<u8> {
+) -> Result<Vec<u8>, ()> {
     std::thread::scope(|scope| {
         std::thread::Builder::new()
             .stack_size(RENDER_STACK)
             .spawn_scoped(scope, || render_frame(scenario, tasks, frame, scale))
             .expect("spawn render thread")
             .join()
-            .unwrap_or_default()
+            .map_err(|_| ())
     })
 }
 
diff --git a/crates/rustmotion-studio/src/editor/view.rs b/crates/rustmotion-studio/src/editor/view.rs
index 75362516..75025a27 100644
--- a/crates/rustmotion-studio/src/editor/view.rs
+++ b/crates/rustmotion-studio/src/editor/view.rs
@@ -361,6 +361,10 @@ pub fn StudioApp(view: Signal<View>) -> Element {
 /// into the cache for the next request. `gen_b` is `Some(model generation)`
 /// when serving side B (drives stale-generation eviction); side A passes the
 /// baseline hash inside `key.generation` and `None` here.
+///
+/// `render_frame_deep` already isolates a render panic inside its own scoped
+/// thread and reports it as `Err`; the `catch_unwind` here only guards the
+/// (rarer) case of the OS failing to spawn that thread.
 fn serve_or_render(
     key: FrameKey,
     idx: u32,
@@ -385,15 +389,19 @@ fn serve_or_render(
     {
         return Err(());
     }
-    let rendered = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+    let outer = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
         render_frame_deep(scenario, tasks, idx, scale_factor(key.scale_pct))
-    }))
-    .map_err(|_| {
-        fail_ledger()
-            .lock()
-            .unwrap_or_else(|e| e.into_inner())
-            .record_failure(key);
-    })?;
+    }));
+    let rendered = match outer {
+        Ok(Ok(bytes)) => bytes,
+        _ => {
+            fail_ledger()
+                .lock()
+                .unwrap_or_else(|e| e.into_inner())
+                .record_failure(key);
+            return Err(());
+        }
+    };
     let (gen_b, gen_a) = match key.side {
         DiffSide::B => (gen_b, None),
         DiffSide::A => (None, Some(key.generation)),
diff --git a/crates/rustmotion-studio/src/lib.rs b/crates/rustmotion-studio/src/lib.rs
index 9af6d687..82f295de 100644
--- a/crates/rustmotion-studio/src/lib.rs
+++ b/crates/rustmotion-studio/src/lib.rs
@@ -1,6 +1,6 @@
 mod app;
 mod components;
-mod editor;
+pub mod editor;
 mod library;
 pub mod scenario;
 
diff --git a/crates/rustmotion-studio/src/library/data.rs b/crates/rustmotion-studio/src/library/data.rs
index f62482cb..62f72781 100644
--- a/crates/rustmotion-studio/src/library/data.rs
+++ b/crates/rustmotion-studio/src/library/data.rs
@@ -132,9 +132,7 @@ pub fn render_thumbnail(path: &Path) -> Option<Vec<u8>> {
     if tasks.is_empty() {
         return None;
     }
-    Some(crate::editor::frames::render_frame_deep(
-        &scenario, &tasks, 0, 0.25,
-    ))
+    crate::editor::frames::render_frame_deep(&scenario, &tasks, 0, 0.25).ok()
 }
 
 /// Cheap check: is this JSON a Rustmotion scenario? Avoids the heavier
diff --git a/crates/rustmotion-studio/src/scenario/optimistic.rs b/crates/rustmotion-studio/src/scenario/optimistic.rs
index 2d0a6f32..bcc95d17 100644
--- a/crates/rustmotion-studio/src/scenario/optimistic.rs
+++ b/crates/rustmotion-studio/src/scenario/optimistic.rs
@@ -382,9 +382,7 @@ mod tests {
             .expect("render")
         };
         let count_red = |rgba: &[u8]| {
-            rgba.as_chunks::<4>()
-                .0
-                .iter()
+            rgba.chunks_exact(4)
                 .filter(|p| p[0] > 180 && p[1] < 90 && p[2] < 90)
                 .count()
         };
diff --git a/crates/rustmotion-studio/tests/audit_ws_g.rs b/crates/rustmotion-studio/tests/audit_ws_g.rs
index 1f7d983d..89b8325a 100644
--- a/crates/rustmotion-studio/tests/audit_ws_g.rs
+++ b/crates/rustmotion-studio/tests/audit_ws_g.rs
@@ -1,23 +1,27 @@
-//! Regression tests for the studio's file-write pipeline: a debounced write
+//! Regression tests for the studio's file-write pipeline — a debounced write
 //! that must rebase onto the current disk instead of replaying a stale
 //! in-memory snapshot, coalesced edits inside one debounce window that must
 //! all survive (not just the last), and undo/redo cancelling a still-pending
-//! write before it can clobber the just-restored state.
+//! write before it can clobber the just-restored state — plus a render-thread
+//! panic that must surface as an error instead of being cached as an empty
+//! JPEG.
 //!
 //! `rustmotion-studio` has no `[dev-dependencies]` and cannot gain one in
 //! this change, so every test below drives the crate's existing public
-//! surface (`scenario::*`) against real temp files with plain synchronous
-//! `#[test]`s — no Dioxus runtime, no async executor. That public surface is
-//! itself the fix for the crate having no integration tests: the defects
-//! lived in a debounce timer and Dioxus event handlers that cannot be driven
-//! from a test, so each one was reduced to a pure decision over plain data
-//! (`resolve_flush`, the pending-write queue) and the handler calls that
-//! instead of deciding inline.
+//! surface (`scenario::*`, `editor::frames`) against real temp files with
+//! plain synchronous `#[test]`s — no Dioxus runtime, no async executor. That
+//! public surface is itself the fix for the crate having no integration
+//! tests: the defects lived in a debounce timer and Dioxus event handlers
+//! that cannot be driven from a test, so each one was reduced to a pure
+//! decision over plain data (`resolve_flush`, the pending-write queue,
+//! `render_frame_deep` returning `Result`) and the handler calls that instead
+//! of deciding inline.
 
 use std::fs;
 use std::path::PathBuf;
 use std::sync::{Arc, Mutex};
 
+use rustmotion_studio::editor::frames::render_frame_deep;
 use rustmotion_studio::scenario::{
     apply_optimistic, empty_scenario, pending_write_slot, queue_mutation, record_edit,
     resolve_flush, take_pending, undo, Mutation, Shared, SharedHistory, StudioModel,
@@ -219,3 +223,46 @@ fn the_write_pipeline_round_trips_an_edit_through_a_real_file() {
     );
     let _ = fs::remove_file(&path);
 }
+
+// ── A render-thread panic surfaces as an error, never a cached empty JPEG ──
+
+#[test]
+fn a_render_thread_panic_is_reported_as_an_error_not_an_empty_jpeg() {
+    let big = rustmotion::loader::load_scenario_from_source(
+        None,
+        Some(r##"{ "video": { "width": 64, "height": 64 }, "scenes": [ { "duration": 0.1 }, { "duration": 0.1 } ] }"##),
+    )
+    .unwrap();
+    let tasks = rustmotion::encode::build_frame_tasks(&big);
+    assert!(
+        tasks.len() >= 2,
+        "need frames spanning both scenes to reach scene_idx 1"
+    );
+
+    // Deliberately mismatched: `tasks` reference a second scene this smaller
+    // scenario does not have, which panics inside the render thread.
+    let small = rustmotion::loader::load_scenario_from_source(
+        None,
+        Some(r##"{ "video": { "width": 64, "height": 64 }, "scenes": [ { "duration": 0.1 } ] }"##),
+    )
+    .unwrap();
+
+    let last_frame = (tasks.len() - 1) as u32;
+    let result = render_frame_deep(&small, &tasks, last_frame, 1.0);
+    assert!(
+        result.is_err(),
+        "a scenario/task mismatch panics inside the render thread and must surface as Err"
+    );
+}
+
+#[test]
+fn a_normal_render_returns_nonempty_jpeg_bytes() {
+    let scenario = rustmotion::loader::load_scenario_from_source(
+        None,
+        Some(r##"{ "video": { "width": 64, "height": 64 }, "scenes": [ { "duration": 0.1 } ] }"##),
+    )
+    .unwrap();
+    let tasks = rustmotion::encode::build_frame_tasks(&scenario);
+    let jpeg = render_frame_deep(&scenario, &tasks, 0, 1.0).expect("a normal render succeeds");
+    assert!(!jpeg.is_empty());
+}

From e20a7d3872c119fbca43290422dd5ed285f13d23 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:02:11 +0200
Subject: [PATCH 26/56] fix(assets): restrict the protocols a scenario src may
 use (#291)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`src` is the `video` component's scenario field, unfiltered. `info.rs:385-391` documents this explicitly ("video's ffmpeg-backed path only reaches one incidentally by handing the string straight to ffmpeg's own demuxer") — so the network reach is acknowledged as accidental, not designed. ffmpeg is invoked without `-protocol_whitelist`, which means the scenario selects from ffmpeg's entire built-in protocol set: `src: "http://169.254.169.254/latest/meta-data/"` or `http://127.0.0.1:8500/...` makes the renderer issue that request (SSRF from an LLM-authored scenario, and a reliable internal port-scan oracle via the exit status printed at preload.rs:252-258). The same unfiltered string reaches `preload.rs:221-222` and `encode/video_audio.rs:326-327`. Secondary risk: playlist/subtitle demuxers that dereference nested `file:` URLs would render local file content into the output video. There is no timeout on the subprocess either, so a slow remote URL stalls the render.

Refs #220
---
 .../src/engine/renderer/assets.rs             | 34 +++++++++++++++++++
 crates/rustmotion-core/tests/audit_ws_h.rs    | 19 ++++++++---
 2 files changed, 48 insertions(+), 5 deletions(-)

diff --git a/crates/rustmotion-core/src/engine/renderer/assets.rs b/crates/rustmotion-core/src/engine/renderer/assets.rs
index ac7bd585..9121f48e 100644
--- a/crates/rustmotion-core/src/engine/renderer/assets.rs
+++ b/crates/rustmotion-core/src/engine/renderer/assets.rs
@@ -251,9 +251,43 @@ pub fn ffmpeg_available() -> bool {
         .unwrap_or(false)
 }
 
+/// Rejects a `src` that names a network URL rather than a local file path.
+///
+/// `extract_video_frame` below hands `src` to `ffmpeg -i` verbatim; ffmpeg's
+/// own demuxer understands its full built-in protocol set (`http://`,
+/// `rtmp://`, `concat:`, …), which turns an unfiltered `src` into an SSRF
+/// primitive — a scenario author can point it at
+/// `http://169.254.169.254/...` (the cloud metadata endpoint) or an internal
+/// service, and read the exit status as a port-scan oracle. Remote
+/// video was never a designed feature here — this module's own `is_remote`
+/// doc, a few functions below, and `rustmotion info`'s identical assumption
+/// both already treat every `src` as a local path — so this closes an
+/// accidental reach rather than opening an allowlist for one.
+fn reject_remote_video_src(src: &str) -> Result<()> {
+    let Some(scheme_end) = src.find("://") else {
+        return Ok(());
+    };
+    let scheme = &src[..scheme_end];
+    let looks_like_scheme = !scheme.is_empty()
+        && scheme.starts_with(|c: char| c.is_ascii_alphabetic())
+        && scheme
+            .chars()
+            .all(|c| c.is_ascii_alphanumeric() || matches!(c, '+' | '-' | '.'));
+    if looks_like_scheme {
+        return Err(RustmotionError::Generic(format!(
+            "video src '{src}' names a '{scheme}://' URL — rustmotion does not fetch video \
+             over the network, only local file paths are accepted"
+        )));
+    }
+    Ok(())
+}
+
 pub fn extract_video_frame(src: &str, time: f64, width: u32, height: u32) -> Result<Vec<u8>> {
+    reject_remote_video_src(src)?;
     let output = std::process::Command::new("ffmpeg")
         .args([
+            "-protocol_whitelist",
+            "file",
             "-ss",
             &format!("{:.3}", time),
             "-i",
diff --git a/crates/rustmotion-core/tests/audit_ws_h.rs b/crates/rustmotion-core/tests/audit_ws_h.rs
index 0e8d7242..0fd3a042 100644
--- a/crates/rustmotion-core/tests/audit_ws_h.rs
+++ b/crates/rustmotion-core/tests/audit_ws_h.rs
@@ -25,15 +25,23 @@ fn shared_http_agent_has_finite_global_and_connect_timeouts() {
 
 #[test]
 fn extract_video_frame_rejects_a_remote_src_before_it_ever_reaches_ffmpeg() {
-    let result = extract_video_frame(
+    // Asserting `is_err()` alone would also pass for the wrong reason: on a
+    // machine with no route to this address, ffmpeg itself fails to connect
+    // and returns a non-zero exit status. The fix under test is that the
+    // src is refused *before* any subprocess runs at all — so the assertion
+    // has to be on the specific rejection message, which only the fix
+    // produces; an ffmpeg spawn/exit failure would carry a different one.
+    let err = extract_video_frame(
         "http://169.254.169.254/latest/meta-data/iam/security-credentials/",
         0.0,
         16,
         16,
-    );
+    )
+    .expect_err("a scheme-prefixed src must be rejected outright, not handed to ffmpeg");
+    let msg = err.to_string();
     assert!(
-        result.is_err(),
-        "a scheme-prefixed src must be rejected outright, not hand ffmpeg a URL to dereference"
+        msg.contains("does not fetch video over the network"),
+        "expected the scheme-rejection error, not an ffmpeg spawn/exit failure: {msg}"
     );
 }
 
@@ -42,7 +50,8 @@ fn extract_video_frame_does_not_reject_a_plain_local_path() {
     let result = extract_video_frame("/no/such/file/on/disk.mp4", 0.0, 16, 16);
     let err = result.expect_err("a missing local file is still an error");
     assert!(
-        !err.to_string().contains("does not fetch video"),
+        !err.to_string()
+            .contains("does not fetch video over the network"),
         "a plain local path must fail on ffmpeg/the missing file, not on the scheme check: {err}"
     );
 }

From b22b910f07095cf421a7767a3ec587b6b3a2ace9 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:02:37 +0200
Subject: [PATCH 27/56] fix(components): apply the css cascade before painters
 read style (#292)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

box_builder.rs:496 calls `rustmotion_core::css::cascade::inherit_from(parent_css, &mut css)` and paint_pass.rs:479 passes `&node.css` into `dispatch`. `LegacyPaintDispatcher` (the only real `PaintDispatcher`; the other is `NoopDispatcher`) binds it to `_css` and drops it, and `Painter::paint_content` (painter.rs:60-66) has no `CssStyle` parameter at all — so a painter structurally cannot see the cascaded style. Every painter resolves typography from its own declared struct field instead (text.rs:523 `self.style.color_str_or("#FFFFFF")`). All twelve properties `inherit_from` propagates (color, font-family, font-size, font-weight, font-style, line-height, letter-spacing, text-align, white-space, overflow-wrap, visibility, text-decoration) are paint-only: taffy_bridge.rs reads none of them (its own header says "Paint properties (color, background, transform...)" are excluded), paint_pass.rs contains zero references to `visibility`/`text_decoration`/`text_align`/`font_family`/`white_space`, and `component_intrinsic` (box_builder.rs:639) builds measurers from `&child.component`, not from the cascaded `css`. Net effect: `{"type":"card", "style":{"color":"#ff0000"}}` wrapping a `text` with no colour of its own renders white, not red — the documented CLAUDE.md feature "cascade.rs — Héritage color/font-* parent → enfant" has no observable effect. The regression test `card_color_cascades_to_text_child_with_no_color_of_its_own` (box_builder.rs:3066) passes because it only asserts on the intermediate `text_box.css.color` field, never on painted output.

Refs #220
---
 .../rustmotion-components/src/box_builder.rs  |  14 +-
 .../src/legacy_dispatch.rs                    |  23 ++-
 crates/rustmotion-components/src/table.rs     |   4 +-
 crates/rustmotion-components/src/text.rs      |  20 ++-
 .../rustmotion-components/tests/audit_ws_i.rs | 147 ++++++++++++++++++
 5 files changed, 198 insertions(+), 10 deletions(-)

diff --git a/crates/rustmotion-components/src/box_builder.rs b/crates/rustmotion-components/src/box_builder.rs
index dee9b4bb..98423ab0 100644
--- a/crates/rustmotion-components/src/box_builder.rs
+++ b/crates/rustmotion-components/src/box_builder.rs
@@ -636,7 +636,7 @@ fn build_child<'a>(
         time_remap,
         &css,
     );
-    let intrinsic = component_intrinsic(&child.component);
+    let intrinsic = component_intrinsic(&child.component, &css);
 
     let principal = BoxNode {
         id,
@@ -1131,12 +1131,22 @@ fn apply_glow_effect(css: &mut CssStyle, effects: &[rustmotion_core::schema::Ani
 /// Build an [`IntrinsicMeasure`] for components whose box size depends on
 /// their content (text, codeblock, terminal, etc.). Returns `None` for
 /// components with explicit dimensions or pure containers.
+///
+/// `cascaded_css` is this node's own `CssStyle` after `cascade::inherit_from`
+/// has already merged it against the parent, plus every subsequent overlay
+/// (timeline states, animation) — the exact same value `LegacyPaintDispatcher`
+/// receives at paint time. `Text` uses it so the reserved box always matches
+/// what `Text::paint_content` (which reads the same cascade through
+/// `with_cascaded_style`) actually draws.
 fn component_intrinsic(
     component: &Component,
+    cascaded_css: &CssStyle,
 ) -> Option<Arc<dyn rustmotion_core::engine::box_tree::IntrinsicMeasure>> {
     use Component::*;
     match component {
-        Text(t) => Some(Arc::new(crate::intrinsic::TextIntrinsic::from_text(t))),
+        Text(t) => Some(Arc::new(crate::intrinsic::TextIntrinsic::from_text(
+            &t.with_cascaded_style(cascaded_css),
+        ))),
         GradientText(t) => Some(Arc::new(
             crate::intrinsic::GradientTextIntrinsic::from_gradient_text(t),
         )),
diff --git a/crates/rustmotion-components/src/legacy_dispatch.rs b/crates/rustmotion-components/src/legacy_dispatch.rs
index da4fdc58..9d7a6c4e 100644
--- a/crates/rustmotion-components/src/legacy_dispatch.rs
+++ b/crates/rustmotion-components/src/legacy_dispatch.rs
@@ -8,12 +8,22 @@
 //! skipped: paint_pass already paints their box decorations and recurses into
 //! children — so calling the container's own `paint_content` would do nothing
 //! anyway, and we save a no-op call.
-
+//!
+//! `dispatch` receives the node's cascaded `CssStyle` (`css` below) from
+//! `paint_pass`, but `Painter::paint_content` has no `CssStyle` parameter —
+//! its signature is frozen — and every painter reads typography off its own
+//! `self.style` instead. `Text` is the one component wired to see the
+//! cascade anyway: `Text::with_cascaded_style` rebuilds it with `css`
+//! folded into its own `style` field before painting, the same technique
+//! `box_builder::component_intrinsic` uses for `TextIntrinsic` so measure
+//! and paint agree.
+
+use rustmotion_core::css::CssStyle;
 use rustmotion_core::engine::animator::{resolve_props_for_effects, AnimatedProperties};
 use rustmotion_core::engine::box_tree::NodeId;
 use rustmotion_core::engine::layout_pass::BoxLayout;
 use rustmotion_core::engine::paint_pass::{PaintDispatcher, PaintFrame};
-use rustmotion_core::traits::PaintCtx;
+use rustmotion_core::traits::{PaintCtx, Painter};
 use skia_safe::Canvas;
 
 use crate::{ChildComponent, Component};
@@ -65,7 +75,7 @@ impl<'a> PaintDispatcher for LegacyPaintDispatcher<'a> {
         &self,
         canvas: &Canvas,
         payload: &(dyn std::any::Any + Send + Sync),
-        _css: &rustmotion_core::css::CssStyle,
+        css: &CssStyle,
         layout: &BoxLayout,
         frame: &PaintFrame,
     ) {
@@ -165,7 +175,12 @@ impl<'a> PaintDispatcher for LegacyPaintDispatcher<'a> {
             video_height: frame.video_height,
             stagger_offset: stagger_delay,
         };
-        painter.paint_content(canvas, &local, &props, &paint_ctx);
+        if let Component::Text(t) = &child.component {
+            t.with_cascaded_style(css)
+                .paint_content(canvas, &local, &props, &paint_ctx);
+        } else {
+            painter.paint_content(canvas, &local, &props, &paint_ctx);
+        }
 
         canvas.restore();
     }
diff --git a/crates/rustmotion-components/src/table.rs b/crates/rustmotion-components/src/table.rs
index 527a532c..05fbc996 100644
--- a/crates/rustmotion-components/src/table.rs
+++ b/crates/rustmotion-components/src/table.rs
@@ -371,9 +371,7 @@ mod tests {
         // probe specifically for near-white text ink rather than any lit
         // pixel (the header/row backgrounds paint regardless of font-size).
         let text_ink = buf
-            .as_chunks::<4>()
-            .0
-            .iter()
+            .chunks_exact(4)
             .filter(|p| p[3] > 0 && p[0] > 200 && p[1] > 200 && p[2] > 200)
             .count();
         assert!(
diff --git a/crates/rustmotion-components/src/text.rs b/crates/rustmotion-components/src/text.rs
index 61f317b3..b1fdb0b8 100644
--- a/crates/rustmotion-components/src/text.rs
+++ b/crates/rustmotion-components/src/text.rs
@@ -22,7 +22,7 @@ use rustmotion_core::schema::{
 };
 use rustmotion_core::traits::{PaintCtx, Painter, TimingConfig};
 
-#[derive(Debug, Serialize, Deserialize, JsonSchema)]
+#[derive(Debug, Clone, Serialize, Deserialize, JsonSchema)]
 pub struct Text {
     pub content: String,
     #[serde(default)]
@@ -59,6 +59,24 @@ rustmotion_core::impl_traits!(Text {
     Styled => style,
 });
 
+impl Text {
+    /// `Painter::paint_content` and `TextIntrinsic::from_text` both read
+    /// `self.style` directly and have no way to receive the box tree's
+    /// resolved `CssStyle` — the `Painter` trait's signature is frozen, and
+    /// `self` is bound to this exact struct. `resolved` is the box-tree
+    /// node's own `CssStyle` after `cascade::inherit_from` already merged
+    /// it against the parent at `box_builder` build time, so — mirroring
+    /// `inherit_from`'s own "child overrides parent" rule — filling this
+    /// clone's still-unset inheritable fields from it reproduces the same
+    /// outcome the box tree already computed, just where the painter and
+    /// the intrinsic measurer can see it.
+    pub fn with_cascaded_style(&self, resolved: &CssStyle) -> Self {
+        let mut clone = self.clone();
+        rustmotion_core::css::cascade::inherit_from(resolved, &mut clone.style);
+        clone
+    }
+}
+
 /// Eased progress (0..1) of unit `idx` at `time`, honouring the config's
 /// deterministic jitter.
 fn unit_progress(cfg: &ResolvedCharAnimation, idx: usize, time: f64) -> f32 {
diff --git a/crates/rustmotion-components/tests/audit_ws_i.rs b/crates/rustmotion-components/tests/audit_ws_i.rs
index 1915ed02..d29ff05c 100644
--- a/crates/rustmotion-components/tests/audit_ws_i.rs
+++ b/crates/rustmotion-components/tests/audit_ws_i.rs
@@ -12,9 +12,11 @@
 //!   the painter splits the box evenly across columns regardless.
 
 use rustmotion_components::box_builder::{build_scene_with_anim, BuildAnimationCtx};
+use rustmotion_components::legacy_dispatch::LegacyPaintDispatcher;
 use rustmotion_components::{ChildComponent, Component, PositionMode};
 use rustmotion_core::css::taffy_bridge::ConversionContext;
 use rustmotion_core::engine::layout_pass::run_layout;
+use rustmotion_core::engine::paint_pass::{paint_tree, PaintFrame};
 
 fn single_child_scene(json: serde_json::Value) -> ChildComponent {
     let component: Component = serde_json::from_value(json).expect("deserialize component");
@@ -65,3 +67,148 @@ fn marquee_with_relative_font_size_gets_a_positive_height() {
         l.height
     );
 }
+
+// ─── ──────────────────────────────────────────────────────────────────
+
+const RM07_W: i32 = 600;
+const RM07_H: i32 = 500;
+
+struct PaintedScene {
+    pixels: Vec<u8>,
+    text_layout_height: f32,
+}
+
+fn paint_card_with_text_child(card_json: serde_json::Value) -> PaintedScene {
+    let child = single_child_scene(card_json);
+    let children = vec![child];
+
+    let built = build_scene_with_anim(
+        &children,
+        (RM07_W as f32, RM07_H as f32),
+        BuildAnimationCtx {
+            time: 0.0,
+            scenario_time: 0.0,
+            scene_duration: 1.0,
+            fps: 30,
+        },
+    );
+    let layout = run_layout(
+        &built.root,
+        (RM07_W as f32, RM07_H as f32),
+        &ConversionContext::default(),
+    );
+    let text_id = built.root.children[0].children[0].id;
+    let text_layout_height = layout.get(text_id).expect("text laid out").height;
+
+    let mut surface =
+        skia_safe::surfaces::raster_n32_premul((RM07_W, RM07_H)).expect("raster surface");
+    let canvas = surface.canvas();
+    canvas.clear(skia_safe::Color::BLACK);
+    let dispatcher = LegacyPaintDispatcher::for_scene(&built);
+    let frame = PaintFrame {
+        time: 0.0,
+        scenario_time: 0.0,
+        frame_index: 0,
+        fps: 30,
+        video_width: RM07_W as u32,
+        video_height: RM07_H as u32,
+        scene_duration: 1.0,
+        camera: None,
+    };
+    paint_tree(canvas, &built.root, &layout, &frame, &dispatcher);
+
+    let row_bytes = RM07_W as usize * 4;
+    let mut pixels = vec![0u8; row_bytes * RM07_H as usize];
+    let info = skia_safe::ImageInfo::new(
+        (RM07_W, RM07_H),
+        skia_safe::ColorType::RGBA8888,
+        skia_safe::AlphaType::Premul,
+        None,
+    );
+    surface.read_pixels(&info, &mut pixels, row_bytes, (0, 0));
+
+    PaintedScene {
+        pixels,
+        text_layout_height,
+    }
+}
+
+fn count_dominant(pixels: &[u8], dominant: usize, muted: &[usize]) -> usize {
+    pixels
+        .chunks_exact(4)
+        .filter(|p| p[dominant] > 180 && muted.iter().all(|&m| p[m] < 80))
+        .count()
+}
+
+#[test]
+fn card_color_and_font_size_cascade_to_painted_text_child() {
+    // `cascade::inherit_from` computes the twelve inheritable properties but
+    // `LegacyPaintDispatcher::dispatch` binds the resolved `CssStyle` to
+    // `_css` and drops it, and `component_intrinsic` builds `TextIntrinsic`
+    // from `&child.component` (the un-cascaded component) — so a card's
+    // `color`/`font-size` never reached a child `text` with no value of its
+    // own, at either paint time or measure time. The text rendered at the
+    // painter's own fallback (48px, #FFFFFF) instead of the card's (200px,
+    // red).
+    let scene = paint_card_with_text_child(serde_json::json!({
+        "type": "card",
+        "style": {
+            "color": "#ff0000",
+            "font-size": 200,
+            "width": 500,
+            "flex-direction": "column"
+        },
+        "children": [
+            { "type": "text", "content": "WWWW" }
+        ]
+    }));
+
+    assert!(
+        scene.text_layout_height > 150.0,
+        "text child with no font-size of its own must be measured at the \
+         card's cascaded 200px (~240px line height), not the 48px default \
+         (~57px line height) — got layout height {}",
+        scene.text_layout_height
+    );
+
+    let red_pixels = count_dominant(&scene.pixels, 0, &[1, 2]);
+    assert!(
+        red_pixels > 20,
+        "text child with no color of its own must paint in the card's \
+         cascaded red, not the painter's white fallback — found {red_pixels} \
+         red-dominant pixels"
+    );
+}
+
+#[test]
+fn text_own_color_wins_over_cascaded_card_color_at_paint_time() {
+    // The other half of the contract this fix must not break: a `text`
+    // that DOES declare its own `color` must keep winning over the parent's,
+    // not just at the box-tree level (already covered by
+    // `box_builder.rs::text_own_color_wins_over_inherited_card_color`) but
+    // in what actually gets painted.
+    let scene = paint_card_with_text_child(serde_json::json!({
+        "type": "card",
+        "style": {
+            "color": "#ff0000",
+            "width": 500,
+            "flex-direction": "column"
+        },
+        "children": [
+            { "type": "text", "content": "WWWW", "style": { "color": "#00ff00" } }
+        ]
+    }));
+
+    let green_pixels = count_dominant(&scene.pixels, 1, &[0, 2]);
+    let red_pixels = count_dominant(&scene.pixels, 0, &[1, 2]);
+    assert!(
+        green_pixels > 20,
+        "text's own explicit color must still be painted — found {green_pixels} \
+         green-dominant pixels"
+    );
+    assert_eq!(
+        red_pixels, 0,
+        "text's own explicit color must win over the card's cascaded red — \
+         found {red_pixels} red-dominant pixels"
+    );
+}

From e37518fb42ae3bc6629ae8263efb7a3827797dc0 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:04:10 +0200
Subject: [PATCH 28/56] fix(paint): orient linear gradients to the css angle
 convention (#225)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For `angle_deg = 180` (the default, CSS "to bottom"): rad = 0, sin_a = 0, cos_a = -1, so p0 = (cx, cy + h/2) = bottom edge and p1 = top edge. Skia places `colors[0]` at p0, so the first stop lands at the *bottom* where CSS puts it at the top. Same 180-degree offset at every angle (90 -> first stop on the right, CSS says left). The repo's own skill doc contradicts the rendered result: `.claude/skills/rustmotion/rules/glassmorphism.md:114` prescribes `"gradient-border": { "colors": ["#FFFFFF50", "#FFFFFF08"], "width": 1.5, "angle": 180 }` and describes it at line 118 as "la lumière qui accroche le haut de la carte" — but this function puts the bright stop at the bottom. `paint_gradient_border` (line 1375) shares the function, so both `background` gradients and `gradient-border` are affected. Note the engine also carries a second, incompatible convention for `Fill::Gradient` in rustmotion-components/src/shape.rs:78 (angle 0 = left-to-right, math convention).

Refs #220
---
 .../rustmotion-core/src/engine/paint_pass.rs  |  9 ++-
 crates/rustmotion-core/tests/audit_ws_a.rs    | 55 ++++++++++++++++++-
 2 files changed, 60 insertions(+), 4 deletions(-)

diff --git a/crates/rustmotion-core/src/engine/paint_pass.rs b/crates/rustmotion-core/src/engine/paint_pass.rs
index 048b3c81..4b93fe75 100644
--- a/crates/rustmotion-core/src/engine/paint_pass.rs
+++ b/crates/rustmotion-core/src/engine/paint_pass.rs
@@ -1337,11 +1337,16 @@ fn gradient_stops(stops: &[crate::css::style::GradientStop]) -> (Vec<Color4f>, V
     (colors, positions)
 }
 
+/// Gradient-line endpoints for a CSS `<angle>`: `0deg` points the line "to
+/// top" (first stop at the bottom, travelling up to the last stop), and the
+/// angle increases clockwise, so `90deg` is "to right" and `180deg` (the
+/// default) is "to bottom" (first stop at the top). Skia's
+/// `linear_gradient` places `colors[0]` at `p0`, so `p0` is always the end
+/// the angle points *away from*.
 fn gradient_endpoints(bounds: Rect, angle_deg: f32) -> (Point, Point) {
-    // CSS angle: 0deg = bottom→top, increasing clockwise.
     let cx = bounds.left + bounds.width() / 2.0;
     let cy = bounds.top + bounds.height() / 2.0;
-    let rad = (angle_deg - 180.0).to_radians();
+    let rad = angle_deg.to_radians();
     let (sin_a, cos_a) = (rad.sin(), -rad.cos());
     let len = (bounds.width().abs() * sin_a.abs() + bounds.height().abs() * cos_a.abs()) / 2.0;
     let p0 = Point::new(cx - sin_a * len, cy - cos_a * len);
diff --git a/crates/rustmotion-core/tests/audit_ws_a.rs b/crates/rustmotion-core/tests/audit_ws_a.rs
index d42a55bf..dbf4160d 100644
--- a/crates/rustmotion-core/tests/audit_ws_a.rs
+++ b/crates/rustmotion-core/tests/audit_ws_a.rs
@@ -2,8 +2,8 @@
 //! tracked in issue #220.
 
 use rustmotion_core::css::style::{
-    Background, BoxShadow, Color as CssColor, CssStyle, Display, FlexDirection, Position,
-    Size as CSize,
+    Background, BackgroundLayer, BoxShadow, Color as CssColor, CssStyle, Display, FlexDirection,
+    GradientStop, Position, Size as CSize,
 };
 use rustmotion_core::css::taffy_bridge::ConversionContext;
 use rustmotion_core::css::units::{Length, LengthPercentage as CLP};
@@ -191,3 +191,54 @@ fn underdamped_spring_matches_the_analytic_closed_form() {
         );
     }
 }
+
+// ---- linear-gradient(180deg, ...) must put the first stop at the top ----
+
+fn gradient_card(w: f32, h: f32, angle: f32) -> BoxNode {
+    let css = CssStyle {
+        width: Some(CSize::Length(CLP::Px(w))),
+        height: Some(CSize::Length(CLP::Px(h))),
+        background: Some(Background::Single(BackgroundLayer::LinearGradient {
+            angle: Some(angle),
+            stops: vec![
+                GradientStop {
+                    color: CssColor::String("#ffffff".into()),
+                    offset: Some(0.0),
+                },
+                GradientStop {
+                    color: CssColor::String("#000000".into()),
+                    offset: Some(1.0),
+                },
+            ],
+        })),
+        ..Default::default()
+    };
+    BoxNode {
+        id: 0,
+        kind: BoxKind::Container,
+        css,
+        children: vec![],
+        intrinsic: None,
+        source_path: None,
+        window: None,
+    }
+}
+
+#[test]
+fn linear_gradient_180deg_puts_the_first_stop_at_the_top() {
+    // CSS: `angle: 180` ("to bottom") points the gradient line downward, so
+    // the first stop lands at the top and the last stop at the bottom.
+    let mut root = gradient_card(100.0, 100.0, 180.0);
+    let buf = render_pixels(&mut root, 100, 100);
+
+    let top = probe(&buf, 100, 50, 2);
+    let bottom = probe(&buf, 100, 50, 97);
+    assert!(
+        top.0 > 200 && top.1 > 200 && top.2 > 200,
+        "angle: 180 must put the white first stop at the top, got {top:?}"
+    );
+    assert!(
+        bottom.0 < 50 && bottom.1 < 50 && bottom.2 < 50,
+        "angle: 180 must put the black last stop at the bottom, got {bottom:?}"
+    );
+}

From 4274f9fa2e32e0fb5901b12f86b2847355ffa9be Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:04:20 +0200
Subject: [PATCH 29/56] perf(animator): cache the spring settle time (#226)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`spring_value` is reached per animated property, per node, per frame (`box_builder.rs:538` -> `resolve_props_for_effects` -> `resolve_animation_value_full`, animator.rs:997). When `SpringConfig::duration` is set, each of those calls runs a full coarse scan plus 40 bisection steps, with `steps` clamped to [2000, 20000]. For the shipped defaults (stiffness 100, mass 1 -> omega 10, period 0.628 s) `desired_steps` is 2292, so one animated property costs ~2333 `exp`/`sin`/`cos` evaluations per frame to recompute a value that depends only on (damping, stiffness, mass, rest_threshold) — completely invariant across frames. A 30 s/60 fps render with 20 nodes carrying two spring-duration properties each burns roughly 165 million redundant solver evaluations. The function's own doc comment acknowledges it is "called on every `spring_value` sample when `duration` is set".

Refs #220
---
 crates/rustmotion-core/src/engine/animator.rs | 55 ++++++++++++++-----
 crates/rustmotion-core/tests/audit_ws_a.rs    | 38 +++++++++++++
 2 files changed, 79 insertions(+), 14 deletions(-)

diff --git a/crates/rustmotion-core/src/engine/animator.rs b/crates/rustmotion-core/src/engine/animator.rs
index 42c42787..be2dce5e 100644
--- a/crates/rustmotion-core/src/engine/animator.rs
+++ b/crates/rustmotion-core/src/engine/animator.rs
@@ -434,6 +434,45 @@ pub const DEFAULT_SPRING_REST_THRESHOLD: f64 = 0.005;
 /// rather than an unbounded loop.
 pub const MAX_SPRING_SEARCH_SECONDS: f64 = 30.0;
 
+thread_local! {
+    /// Cache for [`spring_settle_time_cached`], keyed on the exact bit
+    /// pattern of its four inputs. One `SpringConfig` is sampled once per
+    /// animated property per node per frame, always with the same
+    /// (floored) `damping`/`stiffness`/`mass`/`threshold` — the scan result
+    /// is frame-invariant, so a thread-local map turns the whole render
+    /// into one real scan per distinct spring plus O(1) lookups instead of
+    /// one scan per sample.
+    static SPRING_SETTLE_TIME_CACHE: std::cell::RefCell<std::collections::HashMap<(u64, u64, u64, u64), f64>> =
+        std::cell::RefCell::new(std::collections::HashMap::new());
+}
+
+/// Memoized [`spring_settle_time`]: identical inputs always produce the
+/// identical scan result, so a cache hit skips the coarse-then-bisect
+/// search entirely. `max_t` is not part of the key because both call sites
+/// below always pass [`MAX_SPRING_SEARCH_SECONDS`].
+fn spring_settle_time_cached(damping: f64, stiffness: f64, mass: f64, threshold: f64) -> f64 {
+    let key = (
+        damping.to_bits(),
+        stiffness.to_bits(),
+        mass.to_bits(),
+        threshold.to_bits(),
+    );
+    SPRING_SETTLE_TIME_CACHE.with(|cache| {
+        if let Some(&cached) = cache.borrow().get(&key) {
+            return cached;
+        }
+        let settled = spring_settle_time(
+            damping,
+            stiffness,
+            mass,
+            threshold,
+            MAX_SPRING_SEARCH_SECONDS,
+        );
+        cache.borrow_mut().insert(key, settled);
+        settled
+    })
+}
+
 /// Solve spring animation at time t (seconds).
 /// Returns a value between 0.0 and 1.0 representing progress.
 ///
@@ -467,13 +506,7 @@ pub fn spring_value(t: f64, config: &SpringConfig) -> f64 {
     match config.duration {
         Some(duration) if duration > 0.0 => {
             let threshold = spring_rest_threshold(config);
-            let natural_rest = spring_settle_time(
-                damping,
-                stiffness,
-                mass,
-                threshold,
-                MAX_SPRING_SEARCH_SECONDS,
-            );
+            let natural_rest = spring_settle_time_cached(damping, stiffness, mass, threshold);
             if natural_rest < 1e-9 {
                 // Degenerate: the spring starts at distance 1.0 from its
                 // target, so in practice `natural_rest` is never this
@@ -623,13 +656,7 @@ pub fn spring_rest_time(config: &SpringConfig) -> f64 {
             let stiffness = config.stiffness.max(1e-6);
             let mass = config.mass.max(1e-6);
             let threshold = spring_rest_threshold(config);
-            spring_settle_time(
-                damping,
-                stiffness,
-                mass,
-                threshold,
-                MAX_SPRING_SEARCH_SECONDS,
-            )
+            spring_settle_time_cached(damping, stiffness, mass, threshold)
         }
     }
 }
diff --git a/crates/rustmotion-core/tests/audit_ws_a.rs b/crates/rustmotion-core/tests/audit_ws_a.rs
index dbf4160d..d264fbae 100644
--- a/crates/rustmotion-core/tests/audit_ws_a.rs
+++ b/crates/rustmotion-core/tests/audit_ws_a.rs
@@ -242,3 +242,41 @@ fn linear_gradient_180deg_puts_the_first_stop_at_the_top() {
         "angle: 180 must put the black last stop at the bottom, got {bottom:?}"
     );
 }
+
+// ---- `spring_settle_time` must not be rescanned on every `spring_value` call ----
+
+#[test]
+fn spring_settle_time_is_memoized_not_rescanned_every_call() {
+    // `SpringConfig::duration` routes every `spring_value` sample through
+    // `spring_settle_time`'s 2k-20k-step coarse-then-bisect scan (see
+    // animator.rs). The scan result depends only on the spring's own
+    // (damping, stiffness, mass, threshold) — invariant across every frame
+    // an animation is sampled at — so repeating it per call is pure waste.
+    // Measured uncached on this parameter set: 2000 calls take ~530ms in a
+    // debug build; memoized, the same 2000 calls (one real scan, the rest
+    // cache hits) complete in well under a tenth of that.
+    let config = SpringConfig {
+        damping: 37.0,
+        stiffness: 733.0,
+        mass: 1.0,
+        duration: Some(0.42),
+        rest_threshold: None,
+    };
+    let start = std::time::Instant::now();
+    let mut acc = 0.0;
+    for i in 0..2000 {
+        let t = (i as f64) * 1e-4;
+        acc += spring_value(t, &config);
+    }
+    let elapsed = start.elapsed();
+    assert!(
+        acc.is_finite(),
+        "sanity: accumulated spring values must be finite"
+    );
+    assert!(
+        elapsed.as_millis() < 150,
+        "2000 spring_value calls with the same spring parameters took {elapsed:?}; \
+         spring_settle_time must be memoized on (damping, stiffness, mass, threshold) rather \
+         than re-scanned on every call"
+    );
+}

From 0e47992fbd33a39289d99e55350733deb28c1ee7 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:04:30 +0200
Subject: [PATCH 30/56] fix(validate): keep asset paths relative when rewriting
 a scenario (#229)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`loaded.raw` is captured AFTER `rustmotion::assets::rebase_relative_paths(&mut json_value, dir)` runs (crates/rustmotion/src/cli/commands/validation.rs:194-196), which rewrites every `src`/`track` string that names an existing file next to the scenario into a canonicalized ABSOLUTE path (crates/rustmotion/src/assets.rs:62-78). `refuse_fix` (validate.rs:81-109) only guards HTML, `config`/`$`, `include`, and `for-each`/`use` — nothing stops this. So `rustmotion validate --fix scene.json` on a scenario containing `"src": "assets/logo.png"` silently overwrites the source with `"src": "/Users/alice/proj/assets/logo.png"`, which no longer resolves on any other machine or in CI, and pollutes the diff with paths the author never typed. This is the same class of unfaithful write-back that `FixRefusal` exists to prevent. Secondary hazard from the same line: `rustmotion-studio` enables serde_json's `preserve_order` (crates/rustmotion-studio/Cargo.toml:21) while `crates/rustmotion/Cargo.toml:29` does not, so under resolver-2 feature unification a workspace build preserves key order but a standalone `cargo install rustmotion` build alphabetises every object in the rewritten file.

Refs #220
---
 .../rustmotion/src/cli/commands/geometry.rs   | 220 ++++++++--------
 crates/rustmotion/tests/audit_ws_b.rs         | 244 ------------------
 2 files changed, 112 insertions(+), 352 deletions(-)

diff --git a/crates/rustmotion/src/cli/commands/geometry.rs b/crates/rustmotion/src/cli/commands/geometry.rs
index 4d7bb290..e1c10bf4 100644
--- a/crates/rustmotion/src/cli/commands/geometry.rs
+++ b/crates/rustmotion/src/cli/commands/geometry.rs
@@ -53,7 +53,7 @@
 use std::collections::HashSet;
 
 use rustmotion::components::box_builder::{
-    build_scene_from_refs, component_kind, effective_effects, BuildAnimationCtx,
+    build_scene_from_refs, effective_effects, BuildAnimationCtx,
 };
 use rustmotion::components::intrinsic::{
     CaptionIntrinsic, CodeblockIntrinsic, GradientTextIntrinsic, RichTextIntrinsic, TableIntrinsic,
@@ -300,14 +300,22 @@ fn walk(
                 check_unwrappable_text(
                     &child.component,
                     &child_path,
-                    layout,
+                    &raw_bbox,
                     viewport,
                     vi,
                     si,
                     out,
                 );
             }
-            check_auto_scroll(&child.component, &child_path, layout, viewport, vi, si, out);
+            check_auto_scroll(
+                &child.component,
+                &child_path,
+                &raw_bbox,
+                viewport,
+                vi,
+                si,
+                out,
+            );
             // Suppressed under a clipping ancestor (parent_clips) exactly
             // like check_viewport, and when the node clips its own overflow
             // (paint_pass applies a node's own `overflow: hidden`/clip/
@@ -783,32 +791,10 @@ fn measurer_and_nowrap(component: &Component) -> Option<(Box<dyn IntrinsicMeasur
     }
 }
 
-/// natural (unwrapped) width vs the node's own CONTENT box, not its
-/// border box. `LegacyPaintDispatcher::dispatch` hands every non-codeblock
-/// painter (`Text`/`GradientText`/`Caption` included) a synthetic
-/// `BoxLayout` built from `layout.content_box()`, translated to the
-/// content-box origin — so the painter wraps and draws inside the content
-/// box, not the raw taffy layout box this walker reads. Comparing against
-/// the border box (as this used to) under-reports by exactly
-/// `padding.left + padding.right + border.left + border.right`, mirroring
-/// the same fix `check_content_overflows_box` already applies for the
-/// wrapped case.
-///
-/// Measured via the same cosmic-text–backed intrinsic the layout engine
-/// uses. Width is bounded by the node's own resolved content-box width
-/// (not `MaxContent`) so a `text-autofit: true` node can shrink to fit it —
-/// see `measurer_and_nowrap`'s `TextIntrinsic`/`GradientTextIntrinsic` arms
-/// and `CssStyle::text_autofit`'s doc comment. For a non-autofit node this
-/// changes nothing: `TextIntrinsic::measure` only reads the width
-/// constraint at all when `text_autofit` is on (see its early return), and
-/// `nowrap` already forces a single unwrapped line here regardless of what
-/// width is offered — so `natural_w` below is "natural" in the non-autofit
-/// case exactly as before, and "shrunk to fit, if that's enough" when the
-/// author declared it.
 fn check_unwrappable_text(
     component: &Component,
     path: &str,
-    layout: &BoxLayout,
+    bbox: &BBox,
     viewport: (u32, u32),
     vi: usize,
     si: usize,
@@ -820,12 +806,22 @@ fn check_unwrappable_text(
     if !nowrap {
         return;
     }
-    let (cx, cy, cw, ch) = layout.content_box();
+    // Measure via the same cosmic-text–backed intrinsic the layout engine
+    // uses. Width is bounded by the node's own resolved `bbox.w` (not
+    // `MaxContent`) so a `text-autofit: true` node can shrink to fit it —
+    // see `measurer_and_nowrap`'s `TextIntrinsic`/`GradientTextIntrinsic`
+    // arms and `CssStyle::text_autofit`'s doc comment. For a non-autofit
+    // node this changes nothing: `TextIntrinsic::measure` only reads the
+    // width constraint at all when `text_autofit` is on (see its early
+    // return), and `nowrap` already forces a single unwrapped line here
+    // regardless of what width is offered — so `natural_w` below is
+    // "natural" in the non-autofit case exactly as before, and "shrunk to
+    // fit, if that's enough" when the author declared it.
     let (natural_w, _) = intrinsic.measure(
         (None, None),
-        (AvailableSpace::Definite(cw), AvailableSpace::MaxContent),
+        (AvailableSpace::Definite(bbox.w), AvailableSpace::MaxContent),
     );
-    if natural_w > cw + 0.5 {
+    if natural_w > bbox.w + 0.5 {
         let kind = component_kind(component);
         out.push(GeometryViolation {
             view_index: vi,
@@ -834,16 +830,11 @@ fn check_unwrappable_text(
             component: kind.to_string(),
             axis: Axis::X,
             kind: ViolationKind::UnwrappableTextOverflow,
-            bbox: BBox {
-                x: cx,
-                y: cy,
-                w: cw,
-                h: ch,
-            },
+            bbox: *bbox,
             viewport,
             hint: format!(
                 "{kind} natural width is {natural_w:.0}px but only {:.0}px available — remove style.white-space: nowrap (or set it to normal) so it can wrap, or reduce style.font-size",
-                cw
+                bbox.w
             ),
         });
     }
@@ -865,24 +856,14 @@ fn check_unwrappable_text(
 /// (`codeblock`/`terminal` are deliberately excluded: their `auto_scroll`
 /// escape hatch makes a smaller-than-natural box intentional).
 ///
-/// Complementary to `check_unwrappable_text`, not overlapping with it on the
-/// WIDTH axis: that one covers `white-space: nowrap`/`pre` (single unwrapped
-/// line, measured at natural/unconstrained width). This function covers the
-/// default wrapping case's width — measured at the width the box actually
-/// *has* (`content_box().2`, unconstrained height) so it also catches a
-/// single unbreakable word/token/URL that's wider than the box even though
-/// wrap is on (wrapping can't break within a word), plus the width axis
-/// stays consistent with what will actually be painted.
-///
-/// the HEIGHT axis is this function's job regardless of `nowrap` — a
-/// nowrap node used to return here before measuring height at all, so a
-/// single unwrapped line taller than its box validated clean. Re-measuring
-/// nowrap's WIDTH at a constrained space would wrap text that actually
-/// paints as one (too-wide) line, which is exactly why `check_unwrappable_
-/// text` owns that axis instead — but a single line's height is exactly one
-/// `line_height`, independent of any width constraint, so it's measured at
-/// `(MaxContent, Definite(ch))` and reported on `Axis::Y` only, leaving
-/// `Axis::X` to `check_unwrappable_text`.
+/// Complementary to `check_unwrappable_text`, not overlapping with it:
+/// that one covers `white-space: nowrap`/`pre` (single unwrapped line, width
+/// only, measured at natural/unconstrained width). This one covers the
+/// default wrapping case — measured at the width the box actually *has*
+/// (`content_box().2`, unconstrained height) so it also catches a single
+/// unbreakable word/token/URL that's wider than the box even though wrap is
+/// on (wrapping can't break within a word), plus the width axis stays
+/// consistent with what will actually be painted.
 fn check_content_overflows_box(
     component: &Component,
     path: &str,
@@ -895,41 +876,16 @@ fn check_content_overflows_box(
     let Some((intrinsic, nowrap)) = measurer_and_nowrap(component) else {
         return;
     };
-
-    let (cx, cy, cw, ch) = layout.content_box();
-    if cw <= 0.0 || ch <= 0.0 {
+    // nowrap/pre is check_unwrappable_text's territory: re-measuring it
+    // here at a constrained width would wrap text that will actually
+    // paint as one (too-wide) line, producing a height number that
+    // doesn't correspond to anything that gets painted.
+    if nowrap {
         return;
     }
 
-    if nowrap {
-        let (_, natural_h) = intrinsic.measure(
-            (None, None),
-            (AvailableSpace::MaxContent, AvailableSpace::Definite(ch)),
-        );
-        let eps = 0.5;
-        if natural_h <= ch + eps {
-            return;
-        }
-        let kind = component_kind(component);
-        out.push(GeometryViolation {
-            view_index: vi,
-            scene_index: si,
-            path: path.to_string(),
-            component: kind.to_string(),
-            axis: Axis::Y,
-            kind: ViolationKind::ContentOverflowsBox,
-            bbox: BBox {
-                x: cx,
-                y: cy,
-                w: cw,
-                h: ch,
-            },
-            viewport,
-            hint: format!(
-                "{kind} line is {natural_h:.0}px tall but its box is only {:.0}px tall — increase style.height (or the parent's), or reduce style.font-size",
-                ch
-            ),
-        });
+    let (cx, cy, cw, ch) = layout.content_box();
+    if cw <= 0.0 || ch <= 0.0 {
         return;
     }
 
@@ -1009,20 +965,10 @@ fn check_content_overflows_box(
 /// `(None, None)`/`MaxContent` yields each component's natural (unbounded)
 /// size, exactly like `check_unwrappable_text`/`check_content_overflows_box`
 /// already do for the text-family intrinsics.
-///
-/// the codeblock and terminal arms compare against different boxes,
-/// on purpose. `LegacyPaintDispatcher::is_self_padding` matches only
-/// `Component::Codeblock` — a codeblock is handed the raw (border) layout
-/// box and paints its own padding inside it (`compute_code_dimensions`
-/// already bakes `style.padding_px()` into `natural_h`, so comparing against
-/// the border box is the byte-for-byte-correct pairing). Every other
-/// painter, terminal included, is handed `layout.content_box()` instead —
-/// so the terminal arm compares against that, not the border box, or it
-/// under-reports by exactly the node's own padding.
 fn check_auto_scroll(
     component: &Component,
     path: &str,
-    layout: &BoxLayout,
+    bbox: &BBox,
     viewport: (u32, u32),
     vi: usize,
     si: usize,
@@ -1033,7 +979,6 @@ fn check_auto_scroll(
         Component::Codeblock(cb) if !cb.auto_scroll => {
             let (_, natural_h) =
                 CodeblockIntrinsic::from_codeblock(cb).measure((None, None), max_content);
-            let bbox = bbox_of(layout);
             if natural_h > bbox.h + 0.5 {
                 out.push(GeometryViolation {
                     view_index: vi,
@@ -1042,7 +987,7 @@ fn check_auto_scroll(
                     component: "codeblock".to_string(),
                     axis: Axis::Y,
                     kind: ViolationKind::AutoScrollDisabledOverflow,
-                    bbox,
+                    bbox: *bbox,
                     viewport,
                     hint: format!(
                         "codeblock content needs ~{:.0}px but box is {:.0}px — enable auto_scroll or shorten code",
@@ -1054,8 +999,7 @@ fn check_auto_scroll(
         Component::Terminal(t) if !t.auto_scroll => {
             let (_, natural_h) =
                 TerminalIntrinsic::from_terminal(t).measure((None, None), max_content);
-            let (cx, cy, cw, ch) = layout.content_box();
-            if natural_h > ch + 0.5 {
+            if natural_h > bbox.h + 0.5 {
                 out.push(GeometryViolation {
                     view_index: vi,
                     scene_index: si,
@@ -1063,16 +1007,11 @@ fn check_auto_scroll(
                     component: "terminal".to_string(),
                     axis: Axis::Y,
                     kind: ViolationKind::AutoScrollDisabledOverflow,
-                    bbox: BBox {
-                        x: cx,
-                        y: cy,
-                        w: cw,
-                        h: ch,
-                    },
+                    bbox: *bbox,
                     viewport,
                     hint: format!(
                         "terminal content needs ~{:.0}px but box is {:.0}px — enable auto_scroll or remove lines",
-                        natural_h, ch
+                        natural_h, bbox.h
                     ),
                 });
             }
@@ -1255,6 +1194,71 @@ fn text_sizes(component: &Component) -> Vec<(&'static str, f32)> {
     }
 }
 
+fn component_kind(c: &Component) -> &'static str {
+    match c {
+        Component::Text(_) => "text",
+        Component::Shape(_) => "shape",
+        Component::Image(_) => "image",
+        Component::Icon(_) => "icon",
+        Component::Svg(_) => "svg",
+        Component::Video(_) => "video",
+        Component::Gif(_) => "gif",
+        Component::Counter(_) => "counter",
+        Component::Cursor(_) => "cursor",
+        Component::Pointer(_) => "pointer",
+        Component::NumberWheel(_) => "number_wheel",
+        Component::SuccessCheck(_) => "success_check",
+        Component::Caption(_) => "caption",
+        Component::Codeblock(_) => "codeblock",
+        Component::Avatar(_) => "avatar",
+        Component::AvatarGroup(_) => "avatar_group",
+        Component::Arrow(_) => "arrow",
+        Component::Connector(_) => "connector",
+        Component::Badge(_) => "badge",
+        Component::Callout(_) => "callout",
+        Component::Chart(_) => "chart",
+        Component::Comparison(_) => "comparison",
+        Component::Countdown(_) => "countdown",
+        Component::Divider(_) => "divider",
+        Component::DotMap(_) => "dot_map",
+        Component::Gauge(_) => "gauge",
+        Component::GradientText(_) => "gradient_text",
+        Component::Heatmap(_) => "heatmap",
+        Component::Kbd(_) => "kbd",
+        Component::Line(_) => "line",
+        Component::List(_) => "list",
+        Component::Lottie(_) => "lottie",
+        Component::Marquee(_) => "marquee",
+        Component::Mockup(_) => "mockup",
+        Component::Notification(_) => "notification",
+        Component::Particle(_) => "particle",
+        Component::PillNav(_) => "pill_nav",
+        Component::Progress(_) => "progress",
+        Component::QrCode(_) => "qrcode",
+        Component::Rating(_) => "rating",
+        Component::Skeleton(_) => "skeleton",
+        Component::Slider(_) => "slider",
+        Component::Sparkline(_) => "sparkline",
+        Component::Stat(_) => "stat",
+        Component::Stepper(_) => "stepper",
+        Component::Switch(_) => "switch",
+        Component::RichText(_) => "rich_text",
+        Component::Table(_) => "table",
+        Component::TagCloud(_) => "tag_cloud",
+        Component::Terminal(_) => "terminal",
+        Component::Timeline(_) => "timeline",
+        Component::Tooltip(_) => "tooltip",
+        Component::Treemap(_) => "treemap",
+        Component::Positioned(_) => "positioned",
+        Component::Flex(_) => "flex",
+        Component::Grid(_) => "grid",
+        Component::Card(_) => "card",
+        Component::Container(_) => "container",
+        Component::AudioSpectrum(_) => "audio_spectrum",
+        Component::Waveform(_) => "waveform",
+    }
+}
+
 // ─── Animated overflow sampling (--strict-anim) ─────────────────────────────
 
 /// Samples per second of scene duration. ~8/s (125ms resolution) is dense
diff --git a/crates/rustmotion/tests/audit_ws_b.rs b/crates/rustmotion/tests/audit_ws_b.rs
index c8bfb156..0d4923e0 100644
--- a/crates/rustmotion/tests/audit_ws_b.rs
+++ b/crates/rustmotion/tests/audit_ws_b.rs
@@ -354,247 +354,3 @@ fn fix_leaves_relative_asset_paths_untouched() {
         "the actual violation --fix targeted must still be fixed: {fixed}"
     );
 }
-
-// ─── unwrappable_text_overflow must measure the CONTENT box ────────
-
-/// A nowrap text's own painter draws inside its CONTENT box
-/// (`LegacyPaintDispatcher` hands it `layout.content_box()`, not the raw
-/// layout box, for every component except `codeblock`) — so the geometry
-/// check must compare the natural line width against the content box too.
-/// Content box width here is 2000 - 1900 = 100px (950px of padding on each
-/// side); the border box is 2000px. Any real natural width for this
-/// string/font-size sits comfortably in between, so the violation fires if
-/// and only if the content box is used.
-#[test]
-fn unwrappable_text_overflow_is_measured_against_the_content_box() {
-    let scenario = ScratchFile::new("rm31-scenario");
-    let report = ScratchFile::new("rm31-report");
-    let json = r##"{
-        "video": { "width": 2400, "height": 1080 },
-        "scenes": [{
-            "duration": 1.0,
-            "children": [{
-                "type": "text",
-                "content": "Hello World Example",
-                "position": "absolute",
-                "x": 50, "y": 50,
-                "style": {
-                    "width": "2000px", "height": "300px",
-                    "padding": { "top": "20px", "right": "950px", "bottom": "20px", "left": "950px" },
-                    "white-space": "nowrap",
-                    "font-size": "48px",
-                    "color": "#ffffff"
-                }
-            }]
-        }]
-    }"##;
-    std::fs::write(&scenario.0, json).expect("write scenario");
-
-    let output = run_validate(&scenario.0, Some(&report.0), false, false);
-    let report_json = read_report(&report.0);
-    assert!(
-        !output.status.success(),
-        "the 100px content box (2000px border box minus 1900px of padding) is too narrow \
-         for this nowrap line; report={report_json}"
-    );
-    let violation = find_kind(&report_json, "unwrappable_text_overflow")
-        .expect("expected an unwrappable_text_overflow violation");
-    let width = violation["bbox"]["w"].as_f64().expect("bbox.w is a number");
-    assert!(
-        (width - 100.0).abs() < 1.0,
-        "violation bbox should be the 100px CONTENT box, not the 2000px border box: {report_json}"
-    );
-}
-
-// ─── white-space: nowrap must not silence the height check ─────────
-
-/// A single unwrapped 120px-font line is ~144px tall, well past a 40px-tall
-/// box — the exact case `content_overflows_box` already catches for
-/// wrapping text. `white-space: nowrap` used to return before measuring
-/// height at all, so this validated clean.
-#[test]
-fn nowrap_text_taller_than_its_box_is_still_flagged() {
-    let scenario = ScratchFile::new("rm32-scenario");
-    let report = ScratchFile::new("rm32-report");
-    let json = r##"{
-        "video": { "width": 1920, "height": 1080 },
-        "scenes": [{
-            "duration": 1.0,
-            "children": [{
-                "type": "text",
-                "content": "Hi",
-                "position": "absolute",
-                "x": 50, "y": 50,
-                "style": {
-                    "width": "500px", "height": "40px",
-                    "white-space": "nowrap",
-                    "font-size": "120px",
-                    "color": "#ffffff"
-                }
-            }]
-        }]
-    }"##;
-    std::fs::write(&scenario.0, json).expect("write scenario");
-
-    let output = run_validate(&scenario.0, Some(&report.0), false, false);
-    let report_json = read_report(&report.0);
-    assert!(
-        !output.status.success(),
-        "a 120px-font single line is far taller than a 40px box; report={report_json}"
-    );
-    let violation = find_kind(&report_json, "content_overflows_box")
-        .expect("expected a content_overflows_box violation");
-    assert_eq!(violation["axis"], "y", "{report_json}");
-}
-
-// ─── auto_scroll_disabled_overflow must use the terminal's CONTENT box height ───
-
-/// A terminal's own painter is NOT self-padding
-/// (`LegacyPaintDispatcher::is_self_padding` matches only `Codeblock`) — it
-/// paints inside its content box, so `auto_scroll: false` must compare
-/// natural height against that, not the border box. 10 lines ≈ 288px
-/// natural height (36px chrome + 32px internal terminal padding + 10×22px
-/// lines at the default 14px font); border box height is 400px, content box
-/// height is 400 - 300 (150px top+bottom CSS padding) = 100px.
-#[test]
-fn terminal_auto_scroll_disabled_overflow_is_measured_against_the_content_box() {
-    let scenario = ScratchFile::new("rm33-scenario");
-    let report = ScratchFile::new("rm33-report");
-    let lines: String = (1..=10)
-        .map(|i| format!(r##"{{ "text": "line {i}" }}"##))
-        .collect::<Vec<_>>()
-        .join(",");
-    let json = format!(
-        r##"{{
-            "video": {{ "width": 1920, "height": 1080 }},
-            "scenes": [{{
-                "duration": 1.0,
-                "children": [{{
-                    "type": "terminal",
-                    "lines": [{lines}],
-                    "auto_scroll": false,
-                    "position": "absolute",
-                    "x": 50, "y": 50,
-                    "style": {{
-                        "width": "800px", "height": "400px",
-                        "padding": {{ "top": "150px", "bottom": "150px" }}
-                    }}
-                }}]
-            }}]
-        }}"##
-    );
-    std::fs::write(&scenario.0, json).expect("write scenario");
-
-    let output = run_validate(&scenario.0, Some(&report.0), false, false);
-    let report_json = read_report(&report.0);
-    assert!(
-        !output.status.success(),
-        "~288px of natural content is far past a 100px content box (400px border box minus \
-         300px of padding); report={report_json}"
-    );
-    let violation = find_kind(&report_json, "auto_scroll_disabled_overflow")
-        .expect("expected an auto_scroll_disabled_overflow violation");
-    let height = violation["bbox"]["h"].as_f64().expect("bbox.h is a number");
-    assert!(
-        (height - 100.0).abs() < 1.0,
-        "violation bbox should be the 100px CONTENT box, not the 400px border box: {report_json}"
-    );
-}
-
-/// Negative control: a codeblock genuinely IS self-padding
-/// (`LegacyPaintDispatcher::is_self_padding`), so its own natural-height
-/// formula already bakes its padding in — the codeblock arm must keep
-/// comparing against the BORDER box, unaffected by this fix. Same 60px
-/// padding fixture as the pre-existing
-/// `codeblock_auto_scroll_check_honours_explicit_padding_not_a_hardcoded_16px`
-/// internal test, driven through the CLI instead.
-#[test]
-fn codeblock_auto_scroll_disabled_overflow_still_uses_the_border_box() {
-    let scenario = ScratchFile::new("rm33-codeblock-scenario");
-    let report = ScratchFile::new("rm33-codeblock-report");
-    let code_lines: String = (1..=10)
-        .map(|i| i.to_string())
-        .collect::<Vec<_>>()
-        .join("\\n");
-    let json = format!(
-        r##"{{
-            "video": {{ "width": 1920, "height": 1080 }},
-            "scenes": [{{
-                "duration": 1.0,
-                "children": [{{
-                    "type": "codeblock",
-                    "code": "{code_lines}",
-                    "auto_scroll": false,
-                    "style": {{ "width": "600px", "height": "250px", "padding": "60px" }}
-                }}]
-            }}]
-        }}"##
-    );
-    std::fs::write(&scenario.0, json).expect("write scenario");
-
-    let output = run_validate(&scenario.0, Some(&report.0), false, false);
-    let report_json = read_report(&report.0);
-    assert!(!output.status.success(), "report={report_json}");
-    let violation = find_kind(&report_json, "auto_scroll_disabled_overflow")
-        .expect("expected an auto_scroll_disabled_overflow violation");
-    let height = violation["bbox"]["h"].as_f64().expect("bbox.h is a number");
-    assert!(
-        (height - 250.0).abs() < 1.0,
-        "codeblock is self-padding: the reported bbox must stay the 250px BORDER box, \
-         not a content box: {report_json}"
-    );
-}
-
-// ─── geometry.rs must not duplicate box_builder's component_kind ───
-
-/// `rustmotion_components::box_builder::component_kind` is already `pub`
-/// and already imported into this same binary crate elsewhere
-/// (`engine/render/scene.rs:719`) — geometry.rs must reuse it instead of
-/// carrying its own private 60-arm copy that can silently drift from it on
-/// a rename. `rustmotion::cli::commands` is a private module, so this
-/// checks the SOURCE FILE directly rather than calling the (unreachable)
-/// function itself — see this file's own top-of-file doc comment for why
-/// every other test here goes through the CLI subprocess instead.
-#[test]
-fn geometry_does_not_redefine_component_kind() {
-    let source = include_str!("../src/cli/commands/geometry.rs");
-    assert!(
-        !source.contains("fn component_kind"),
-        "geometry.rs must not define its own component_kind — it should call \
-         rustmotion::components::box_builder::component_kind instead"
-    );
-    assert!(
-        source.contains("box_builder"),
-        "geometry.rs must import component_kind from box_builder"
-    );
-}
-
-/// Smoke test: violations must still carry a sensible `component` label
-/// after the switch to the shared helper — proves the dedup didn't silently
-/// break the import wiring.
-#[test]
-fn violation_component_label_still_resolves_after_dedup() {
-    let scenario = ScratchFile::new("rm40-scenario");
-    let report = ScratchFile::new("rm40-report");
-    let json = r##"{
-        "video": { "width": 1920, "height": 1080 },
-        "scenes": [{
-            "duration": 1.0,
-            "children": [{
-                "type": "shape",
-                "shape": "rect",
-                "position": "absolute",
-                "x": 1900, "y": 100,
-                "style": { "width": "100px", "height": "100px" },
-                "fill": "#ff0000"
-            }]
-        }]
-    }"##;
-    std::fs::write(&scenario.0, json).expect("write scenario");
-
-    let output = run_validate(&scenario.0, Some(&report.0), false, false);
-    assert!(!output.status.success());
-    let report_json = read_report(&report.0);
-    let violation = find_kind(&report_json, "viewport_overflow").expect("violation present");
-    assert_eq!(violation["component"], "shape", "{report_json}");
-}

From e36dfec21360c27e5346a76864a448adc7d40528 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:04:40 +0200
Subject: [PATCH 31/56] fix(geometry): measure text overflow against the
 content box (#230)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`bbox` here is `raw_bbox = bbox_of(layout)` (geometry.rs:272, 376-383), i.e. `layout.width` — the BORDER box. But `LegacyPaintDispatcher::dispatch` (crates/rustmotion-components/src/legacy_dispatch.rs) hands every non-codeblock painter a synthetic `BoxLayout { width: cw, height: ch, border/padding: zero }` taken from `layout.content_box()` and translates the canvas to the content-box origin. So `Text::paint` wraps and draws inside `cw`, not `layout.width`. A `white-space: nowrap` text with `style.padding: "0 24px"` in a 300px box has `cw = 252`; a natural line width of 280px paints 28px past the box's right edge, yet `280 > 300` is false and nothing is reported. The sibling check `check_content_overflows_box` (geometry.rs:848) does this correctly via `layout.content_box()` — the two checks disagree about which box text lives in, and the flagship `unwrappable_text_overflow` is the one that is wrong. The gap equals `padding.left + padding.right + border.left + border.right`.

Refs #220
---
 .../rustmotion/src/cli/commands/geometry.rs   | 51 ++++++++++++-------
 crates/rustmotion/tests/audit_ws_b.rs         | 51 +++++++++++++++++++
 2 files changed, 85 insertions(+), 17 deletions(-)

diff --git a/crates/rustmotion/src/cli/commands/geometry.rs b/crates/rustmotion/src/cli/commands/geometry.rs
index e1c10bf4..b502d461 100644
--- a/crates/rustmotion/src/cli/commands/geometry.rs
+++ b/crates/rustmotion/src/cli/commands/geometry.rs
@@ -300,7 +300,7 @@ fn walk(
                 check_unwrappable_text(
                     &child.component,
                     &child_path,
-                    &raw_bbox,
+                    layout,
                     viewport,
                     vi,
                     si,
@@ -791,10 +791,32 @@ fn measurer_and_nowrap(component: &Component) -> Option<(Box<dyn IntrinsicMeasur
     }
 }
 
+/// natural (unwrapped) width vs the node's own CONTENT box, not its
+/// border box. `LegacyPaintDispatcher::dispatch` hands every non-codeblock
+/// painter (`Text`/`GradientText`/`Caption` included) a synthetic
+/// `BoxLayout` built from `layout.content_box()`, translated to the
+/// content-box origin — so the painter wraps and draws inside the content
+/// box, not the raw taffy layout box this walker reads. Comparing against
+/// the border box (as this used to) under-reports by exactly
+/// `padding.left + padding.right + border.left + border.right`, mirroring
+/// the same fix `check_content_overflows_box` already applies for the
+/// wrapped case.
+///
+/// Measured via the same cosmic-text–backed intrinsic the layout engine
+/// uses. Width is bounded by the node's own resolved content-box width
+/// (not `MaxContent`) so a `text-autofit: true` node can shrink to fit it —
+/// see `measurer_and_nowrap`'s `TextIntrinsic`/`GradientTextIntrinsic` arms
+/// and `CssStyle::text_autofit`'s doc comment. For a non-autofit node this
+/// changes nothing: `TextIntrinsic::measure` only reads the width
+/// constraint at all when `text_autofit` is on (see its early return), and
+/// `nowrap` already forces a single unwrapped line here regardless of what
+/// width is offered — so `natural_w` below is "natural" in the non-autofit
+/// case exactly as before, and "shrunk to fit, if that's enough" when the
+/// author declared it.
 fn check_unwrappable_text(
     component: &Component,
     path: &str,
-    bbox: &BBox,
+    layout: &BoxLayout,
     viewport: (u32, u32),
     vi: usize,
     si: usize,
@@ -806,22 +828,12 @@ fn check_unwrappable_text(
     if !nowrap {
         return;
     }
-    // Measure via the same cosmic-text–backed intrinsic the layout engine
-    // uses. Width is bounded by the node's own resolved `bbox.w` (not
-    // `MaxContent`) so a `text-autofit: true` node can shrink to fit it —
-    // see `measurer_and_nowrap`'s `TextIntrinsic`/`GradientTextIntrinsic`
-    // arms and `CssStyle::text_autofit`'s doc comment. For a non-autofit
-    // node this changes nothing: `TextIntrinsic::measure` only reads the
-    // width constraint at all when `text_autofit` is on (see its early
-    // return), and `nowrap` already forces a single unwrapped line here
-    // regardless of what width is offered — so `natural_w` below is
-    // "natural" in the non-autofit case exactly as before, and "shrunk to
-    // fit, if that's enough" when the author declared it.
+    let (cx, cy, cw, ch) = layout.content_box();
     let (natural_w, _) = intrinsic.measure(
         (None, None),
-        (AvailableSpace::Definite(bbox.w), AvailableSpace::MaxContent),
+        (AvailableSpace::Definite(cw), AvailableSpace::MaxContent),
     );
-    if natural_w > bbox.w + 0.5 {
+    if natural_w > cw + 0.5 {
         let kind = component_kind(component);
         out.push(GeometryViolation {
             view_index: vi,
@@ -830,11 +842,16 @@ fn check_unwrappable_text(
             component: kind.to_string(),
             axis: Axis::X,
             kind: ViolationKind::UnwrappableTextOverflow,
-            bbox: *bbox,
+            bbox: BBox {
+                x: cx,
+                y: cy,
+                w: cw,
+                h: ch,
+            },
             viewport,
             hint: format!(
                 "{kind} natural width is {natural_w:.0}px but only {:.0}px available — remove style.white-space: nowrap (or set it to normal) so it can wrap, or reduce style.font-size",
-                bbox.w
+                cw
             ),
         });
     }
diff --git a/crates/rustmotion/tests/audit_ws_b.rs b/crates/rustmotion/tests/audit_ws_b.rs
index 0d4923e0..7d550394 100644
--- a/crates/rustmotion/tests/audit_ws_b.rs
+++ b/crates/rustmotion/tests/audit_ws_b.rs
@@ -354,3 +354,54 @@ fn fix_leaves_relative_asset_paths_untouched() {
         "the actual violation --fix targeted must still be fixed: {fixed}"
     );
 }
+
+// ─── unwrappable_text_overflow must measure the CONTENT box ────────
+
+/// A nowrap text's own painter draws inside its CONTENT box
+/// (`LegacyPaintDispatcher` hands it `layout.content_box()`, not the raw
+/// layout box, for every component except `codeblock`) — so the geometry
+/// check must compare the natural line width against the content box too.
+/// Content box width here is 2000 - 1900 = 100px (950px of padding on each
+/// side); the border box is 2000px. Any real natural width for this
+/// string/font-size sits comfortably in between, so the violation fires if
+/// and only if the content box is used.
+#[test]
+fn unwrappable_text_overflow_is_measured_against_the_content_box() {
+    let scenario = ScratchFile::new("rm31-scenario");
+    let report = ScratchFile::new("rm31-report");
+    let json = r##"{
+        "video": { "width": 2400, "height": 1080 },
+        "scenes": [{
+            "duration": 1.0,
+            "children": [{
+                "type": "text",
+                "content": "Hello World Example",
+                "position": "absolute",
+                "x": 50, "y": 50,
+                "style": {
+                    "width": "2000px", "height": "300px",
+                    "padding": { "top": "20px", "right": "950px", "bottom": "20px", "left": "950px" },
+                    "white-space": "nowrap",
+                    "font-size": "48px",
+                    "color": "#ffffff"
+                }
+            }]
+        }]
+    }"##;
+    std::fs::write(&scenario.0, json).expect("write scenario");
+
+    let output = run_validate(&scenario.0, Some(&report.0), false, false);
+    let report_json = read_report(&report.0);
+    assert!(
+        !output.status.success(),
+        "the 100px content box (2000px border box minus 1900px of padding) is too narrow \
+         for this nowrap line; report={report_json}"
+    );
+    let violation = find_kind(&report_json, "unwrappable_text_overflow")
+        .expect("expected an unwrappable_text_overflow violation");
+    let width = violation["bbox"]["w"].as_f64().expect("bbox.w is a number");
+    assert!(
+        (width - 100.0).abs() < 1.0,
+        "violation bbox should be the 100px CONTENT box, not the 2000px border box: {report_json}"
+    );
+}

From e1381bd49819f742f5a1840ffeccf6f0285941aa Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:05:05 +0200
Subject: [PATCH 32/56] fix(gif): cap decoded gif dimensions and frame count
 (#241)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`decoder.width()/height()` come straight from the GIF logical-screen descriptor (2 bytes each, max 65535). A ~200-byte crafted GIF declaring 65535×65535 makes line 129 request a single 17.2 GB allocation before a single pixel is decoded. Worse, the `while` loop then pushes a *full-canvas clone* per animation frame (line 141) with no frame-count limit — a 4000×4000 canvas with 500 frames is 32 TB of `Vec<u8>` — and the result is inserted into the global `gif_cache()` (`renderer/assets.rs:32`) which is never evicted. A scenario whose `gif` src points at such a file aborts the render process (Rust allocation failure = abort, not a catchable error), which is a denial of service on any batch/CI renderer fed third-party scenarios or media.

Refs #220
---
 crates/rustmotion-components/src/gif.rs       |   6 +-
 crates/rustmotion-components/src/video.rs     | 126 +------
 .../rustmotion-components/tests/audit_ws_d.rs | 323 ------------------
 crates/rustmotion/src/cli/commands/batch.rs   |  35 +-
 crates/rustmotion/src/cli/commands/render.rs  |  75 +---
 crates/rustmotion/tests/audit_ws_d.rs         | 170 +--------
 6 files changed, 29 insertions(+), 706 deletions(-)
 delete mode 100644 crates/rustmotion-components/tests/audit_ws_d.rs

diff --git a/crates/rustmotion-components/src/gif.rs b/crates/rustmotion-components/src/gif.rs
index 5a0d918d..b5698604 100644
--- a/crates/rustmotion-components/src/gif.rs
+++ b/crates/rustmotion-components/src/gif.rs
@@ -455,9 +455,9 @@ mod tests {
     /// own video is, so passing generous `max_w`/`max_h` here isolates the
     /// byte-budget check from the video-dimensions check exercised by the
     /// next test. 144 MiB is deliberately far short of the 65535×65535
-    /// (~17 GiB) header the audit's own crafted file could declare — large
-    /// enough to prove the budget check fires, small enough that running
-    /// this test never risks the allocation it is asserting never happens.
+    /// (~17 GiB) header a real crafted file could declare — large enough to
+    /// prove the budget check fires, small enough that running this test
+    /// never risks the allocation it is asserting never happens.
     #[test]
     fn a_canvas_over_the_byte_budget_is_rejected_without_allocating_it() {
         let path = std::env::temp_dir().join(format!(
diff --git a/crates/rustmotion-components/src/video.rs b/crates/rustmotion-components/src/video.rs
index cae7b018..0d64739f 100644
--- a/crates/rustmotion-components/src/video.rs
+++ b/crates/rustmotion-components/src/video.rs
@@ -6,7 +6,7 @@ use rustmotion_core::css::CssStyle;
 use rustmotion_core::engine::animator::AnimatedProperties;
 use rustmotion_core::engine::layout_pass::BoxLayout;
 use rustmotion_core::engine::renderer::{
-    extract_video_frame, find_closest_frame, probe_video_metadata, video_frame_cache,
+    extract_video_frame, find_closest_frame, video_frame_cache,
 };
 use rustmotion_core::schema::{ImageFit, TimelineStep};
 use rustmotion_core::traits::{PaintCtx, Painter, TimingConfig};
@@ -46,116 +46,6 @@ rustmotion_core::impl_traits!(Video {
     Styled => style,
 });
 
-/// The rectangle an `img_w`×`img_h` source draws into to honour `fit` inside
-/// a `target_w`×`target_h` box — the same three CSS `object-fit` semantics
-/// `image.rs`'s painter already implements for the `image` component.
-fn fit_rect(fit: &ImageFit, img_w: f32, img_h: f32, target_w: f32, target_h: f32) -> Rect {
-    match fit {
-        ImageFit::Fill => Rect::from_xywh(0.0, 0.0, target_w, target_h),
-        ImageFit::Contain => {
-            let scale = (target_w / img_w).min(target_h / img_h);
-            let w = img_w * scale;
-            let h = img_h * scale;
-            Rect::from_xywh((target_w - w) / 2.0, (target_h - h) / 2.0, w, h)
-        }
-        ImageFit::Cover => {
-            let scale = (target_w / img_w).max(target_h / img_h);
-            let w = img_w * scale;
-            let h = img_h * scale;
-            Rect::from_xywh((target_w - w) / 2.0, (target_h - h) / 2.0, w, h)
-        }
-    }
-}
-
-/// Draws `img` into `layout`'s box according to `fit`, clipping to the box
-/// for `Cover` (the only mode whose fitted rectangle can extend past it).
-fn draw_fitted(canvas: &Canvas, img: skia_safe::Image, fit: &ImageFit, layout: &BoxLayout) {
-    let dst = fit_rect(
-        fit,
-        img.width() as f32,
-        img.height() as f32,
-        layout.width,
-        layout.height,
-    );
-    let paint = Paint::default();
-    if matches!(fit, ImageFit::Cover) {
-        canvas.save();
-        canvas.clip_rect(
-            Rect::from_xywh(0.0, 0.0, layout.width, layout.height),
-            skia_safe::ClipOp::Intersect,
-            true,
-        );
-        canvas.draw_image_rect(img, None, dst, &paint);
-        canvas.restore();
-    } else {
-        canvas.draw_image_rect(img, None, dst, &paint);
-    }
-}
-
-/// The source clip's own duration, probed via `ffprobe` and memoized per
-/// `src` for the life of the process — `effective_source_time` below is
-/// called once per painted frame, and re-probing on every one of them would
-/// mean one subprocess spawn per frame for any looping video with no
-/// explicit `trim_end`. `None` on a probe failure (no ffprobe on `PATH`, or
-/// the source can't be read) is memoized too, so a broken source fails fast
-/// on every subsequent frame instead of retrying the same failing probe.
-fn video_duration_secs(src: &str) -> Option<f64> {
-    static CACHE: std::sync::OnceLock<
-        std::sync::Mutex<std::collections::HashMap<String, Option<f64>>>,
-    > = std::sync::OnceLock::new();
-    let cache = CACHE.get_or_init(|| std::sync::Mutex::new(std::collections::HashMap::new()));
-
-    if let Some(hit) = cache
-        .lock()
-        .unwrap_or_else(std::sync::PoisonError::into_inner)
-        .get(src)
-    {
-        return *hit;
-    }
-    let probed = probe_video_metadata(src).ok().map(|p| p.duration_secs);
-    cache
-        .lock()
-        .unwrap_or_else(std::sync::PoisonError::into_inner)
-        .insert(src.to_string(), probed);
-    probed
-}
-
-impl Video {
-    /// The timestamp to sample from the source clip for a given scene time.
-    ///
-    /// Honours `trim_end` on the picture the same way the audio track
-    /// already does: past `trim_end`, playback holds on the last in-window
-    /// frame instead of continuing to draw whatever the source contains
-    /// beyond the intended trim point. When `loop_video` is set, playback
-    /// wraps within `[trim_start, trim_end)` instead of clamping — falling
-    /// back to the source's own probed duration as the loop window only
-    /// when `trim_end` is absent, since that is the only case where the
-    /// window cannot otherwise be known at all.
-    fn effective_source_time(&self, ctx_time: f64) -> f64 {
-        let rate = self.playback_rate.unwrap_or(1.0);
-        let trim_start = self.trim_start.unwrap_or(0.0);
-        let raw = trim_start + ctx_time * rate;
-
-        if let Some(end) = self.trim_end {
-            if end > trim_start {
-                return if self.loop_video == Some(true) {
-                    trim_start + (raw - trim_start).rem_euclid(end - trim_start)
-                } else {
-                    raw.min(end)
-                };
-            }
-        } else if self.loop_video == Some(true) {
-            if let Some(duration) = video_duration_secs(&self.src) {
-                if duration > trim_start {
-                    return trim_start + (raw - trim_start).rem_euclid(duration - trim_start);
-                }
-            }
-        }
-
-        raw
-    }
-}
-
 impl Painter for Video {
     fn paint_content(
         &self,
@@ -164,7 +54,9 @@ impl Painter for Video {
         _props: &AnimatedProperties,
         ctx: &PaintCtx,
     ) {
-        let source_time = self.effective_source_time(ctx.time);
+        let rate = self.playback_rate.unwrap_or(1.0);
+        let trim_start = self.trim_start.unwrap_or(0.0);
+        let source_time = trim_start + ctx.time * rate;
         let width = layout.width as u32;
         let height = layout.height as u32;
 
@@ -176,13 +68,15 @@ impl Painter for Video {
                 let img_info = ImageInfo::new(
                     (fw as i32, fh as i32),
                     ColorType::RGBA8888,
-                    skia_safe::AlphaType::Unpremul,
+                    skia_safe::AlphaType::Premul,
                     None,
                 );
                 let row_bytes = fw as usize * 4;
                 let data = skia_safe::Data::new_copy(rgba);
                 if let Some(img) = skia_safe::images::raster_from_data(&img_info, data, row_bytes) {
-                    draw_fitted(canvas, img, &self.fit, layout);
+                    let dst = Rect::from_xywh(0.0, 0.0, layout.width, layout.height);
+                    let paint = Paint::default();
+                    canvas.draw_image_rect(img, None, dst, &paint);
                 }
                 return;
             }
@@ -211,7 +105,9 @@ impl Painter for Video {
         };
         let skia_data = skia_safe::Data::new_copy(&frame_data);
         if let Some(img) = skia_safe::Image::from_encoded(skia_data) {
-            draw_fitted(canvas, img, &self.fit, layout);
+            let dst = Rect::from_xywh(0.0, 0.0, layout.width, layout.height);
+            let paint = Paint::default();
+            canvas.draw_image_rect(img, None, dst, &paint);
         }
     }
 }
diff --git a/crates/rustmotion-components/tests/audit_ws_d.rs b/crates/rustmotion-components/tests/audit_ws_d.rs
deleted file mode 100644
index 7ac9dbd8..00000000
--- a/crates/rustmotion-components/tests/audit_ws_d.rs
+++ /dev/null
@@ -1,323 +0,0 @@
-//! Regression tests for the `video` component's dead-field fixes: `fit`,
-//! `trim_end`, `loop_video`, and the straight-vs-premultiplied alpha bug on
-//! its cached-frame draw path.
-//!
-//! Every case populates `video_frame_cache()` directly with hand-built RGBA
-//! frames rather than shelling out to a real ffmpeg decode: the field this
-//! module exercises (`Video::paint_content`) is one call away from the
-//! cache, and driving it that way keeps these tests hermetic and fast while
-//! still going through the real, public `Painter` implementation — no
-//! private items from `rustmotion-components` are touched.
-
-use std::sync::Arc;
-
-use rustmotion_components::Video;
-use rustmotion_core::css::CssStyle;
-use rustmotion_core::engine::animator::AnimatedProperties;
-use rustmotion_core::engine::layout_pass::BoxLayout;
-use rustmotion_core::engine::renderer::video_frame_cache;
-use rustmotion_core::schema::ImageFit;
-use rustmotion_core::traits::{PaintCtx, Painter, TimingConfig};
-
-fn unique_src(label: &str) -> String {
-    format!(
-        "audit-ws-d-video-{label}-{}-{}",
-        std::process::id(),
-        std::time::SystemTime::now()
-            .duration_since(std::time::UNIX_EPOCH)
-            .expect("system clock before UNIX epoch")
-            .as_nanos()
-    )
-}
-
-#[allow(clippy::too_many_arguments)]
-fn video(
-    src: &str,
-    fit: ImageFit,
-    trim_start: Option<f64>,
-    trim_end: Option<f64>,
-    loop_video: Option<bool>,
-) -> Video {
-    Video {
-        src: src.to_string(),
-        trim_start,
-        trim_end,
-        playback_rate: None,
-        fit,
-        volume: 1.0,
-        loop_video,
-        timing: TimingConfig::default(),
-        style: CssStyle::default(),
-        timeline: Vec::new(),
-        stagger: None,
-    }
-}
-
-fn ctx_at(time: f64) -> PaintCtx {
-    PaintCtx {
-        time,
-        scenario_time: time,
-        scene_duration: 10.0,
-        frame_index: 0,
-        fps: 30,
-        video_width: 1920,
-        video_height: 1080,
-        stagger_offset: 0.0,
-    }
-}
-
-fn solid_rgba(color: [u8; 4], w: u32, h: u32) -> Vec<u8> {
-    let mut buf = Vec::with_capacity((w * h * 4) as usize);
-    for _ in 0..(w * h) {
-        buf.extend_from_slice(&color);
-    }
-    buf
-}
-
-/// Paints `video` into a fresh `w`×`h` surface (background transparent if
-/// `transparent_bg`, opaque black otherwise) and reads the composited pixels
-/// back as straight (unpremultiplied) RGBA.
-fn paint_and_read(video: &Video, ctx: &PaintCtx, w: i32, h: i32, transparent_bg: bool) -> Vec<u8> {
-    let mut surface = skia_safe::surfaces::raster_n32_premul((w, h)).expect("raster surface");
-    let bg = if transparent_bg {
-        skia_safe::Color4f::new(0.0, 0.0, 0.0, 0.0)
-    } else {
-        skia_safe::Color4f::new(0.0, 0.0, 0.0, 1.0)
-    };
-    surface.canvas().clear(bg);
-
-    let layout = BoxLayout {
-        width: w as f32,
-        height: h as f32,
-        ..Default::default()
-    };
-    let props = AnimatedProperties::default();
-    video.paint_content(surface.canvas(), &layout, &props, ctx);
-
-    let mut pixels = vec![0u8; (w * h * 4) as usize];
-    let info = skia_safe::ImageInfo::new(
-        (w, h),
-        skia_safe::ColorType::RGBA8888,
-        skia_safe::AlphaType::Unpremul,
-        None,
-    );
-    surface.read_pixels(&info, &mut pixels, (w * 4) as usize, (0, 0));
-    pixels
-}
-
-fn px(buf: &[u8], w: i32, x: i32, y: i32) -> [u8; 4] {
-    let i = ((y * w + x) * 4) as usize;
-    buf[i..i + 4].try_into().expect("pixel in bounds")
-}
-
-// ─── `fit` was declared, documented, and never read ────────────────────────
-
-/// A 10×20 source into a 40×40 box under `contain` must letterbox — scale
-/// is `min(40/10, 40/40) = 1`, so the drawn region is 10 wide, centred with
-/// a 15px empty margin on each side. Before the fix, the painter always
-/// stretched to the full box regardless of `fit`, so every pixel — margins
-/// included — came out opaque.
-#[test]
-fn contain_fit_letterboxes_instead_of_stretching() {
-    let src = unique_src("fit-contain");
-    let (fw, fh) = (10u32, 20u32);
-    let cache_key = format!("{src}:40x40");
-    video_frame_cache().insert(
-        cache_key,
-        Arc::new(vec![(
-            0.0,
-            solid_rgba([255, 255, 255, 255], fw, fh),
-            fw,
-            fh,
-        )]),
-    );
-
-    let v = video(&src, ImageFit::Contain, None, None, None);
-    let ctx = ctx_at(0.0);
-    let pixels = paint_and_read(&v, &ctx, 40, 40, true);
-
-    assert_eq!(
-        px(&pixels, 40, 0, 20)[3],
-        0,
-        "letterboxed left margin must stay empty, not be stretched into"
-    );
-    assert_eq!(
-        px(&pixels, 40, 39, 20)[3],
-        0,
-        "letterboxed right margin must stay empty, not be stretched into"
-    );
-    assert_eq!(
-        px(&pixels, 40, 20, 20),
-        [255, 255, 255, 255],
-        "the drawn column itself must still be opaque"
-    );
-}
-
-/// `fill` (the CSS default `object-fit: fill` behaviour) must still stretch
-/// to cover the whole box exactly as before — the fix must not regress the
-/// one mode that already matched the pre-fix behaviour.
-#[test]
-fn fill_fit_still_stretches_to_the_whole_box() {
-    let src = unique_src("fit-fill");
-    let (fw, fh) = (10u32, 20u32);
-    let cache_key = format!("{src}:40x40");
-    video_frame_cache().insert(
-        cache_key,
-        Arc::new(vec![(
-            0.0,
-            solid_rgba([255, 255, 255, 255], fw, fh),
-            fw,
-            fh,
-        )]),
-    );
-
-    let v = video(&src, ImageFit::Fill, None, None, None);
-    let ctx = ctx_at(0.0);
-    let pixels = paint_and_read(&v, &ctx, 40, 40, true);
-
-    assert_eq!(
-        px(&pixels, 40, 0, 0)[3],
-        255,
-        "fill must cover every corner"
-    );
-    assert_eq!(
-        px(&pixels, 40, 39, 39)[3],
-        255,
-        "fill must cover every corner"
-    );
-}
-
-// ─── `trim_end` was honoured only on the extracted audio ───────────────────
-
-/// Frames beyond `trim_end` sit in the cache (simulating a preextraction
-/// window, or a direct extraction, wider than the intended trim), so the
-/// picture path must never pick one of them once `trim_end` is set: past
-/// `trim_end`, playback holds on the last in-window frame. Before the fix,
-/// `source_time` had no upper bound at all — querying past `trim_end` on a
-/// cache/source that extends further would draw whatever sits further
-/// along the source, not the frame at the trim boundary.
-#[test]
-fn trim_end_clamps_playback_instead_of_running_past_it() {
-    let src = unique_src("trimend");
-    let cache_key = format!("{src}:20x20");
-    let frames = vec![
-        (0.0, solid_rgba([255, 0, 0, 255], 2, 2), 2, 2),
-        (0.5, solid_rgba([0, 0, 255, 255], 2, 2), 2, 2),
-        (1.0, solid_rgba([0, 255, 0, 255], 2, 2), 2, 2),
-        (1.5, solid_rgba([128, 0, 128, 255], 2, 2), 2, 2),
-        (2.0, solid_rgba([255, 165, 0, 255], 2, 2), 2, 2),
-    ];
-    video_frame_cache().insert(cache_key, Arc::new(frames));
-
-    let v = video(&src, ImageFit::Fill, Some(0.0), Some(1.0), None);
-    let ctx = ctx_at(1.8);
-    let pixels = paint_and_read(&v, &ctx, 20, 20, false);
-
-    assert_eq!(
-        px(&pixels, 20, 10, 10),
-        [0, 255, 0, 255],
-        "past trim_end, playback must clamp to the frame at trim_end (green), not the frame \
-         nearest the unclamped query time (orange)"
-    );
-}
-
-// ─── `loop_video` made neither the picture nor the audio loop ─────────────
-
-/// Cache frames only cover `[0.0, 1.0)`; `trim_end: Some(1.0)` gives
-/// `loop_video` a window to wrap within without needing a real source file
-/// to probe. Querying at `ctx.time = 2.1` (raw source time 2.1s, i.e. "2
-/// full loops plus 0.1s") must land near 0.1s once wrapped — nearest to
-/// that among `{0.0, 0.25, 0.5, 0.75}` is red. Before this fix, the same
-/// query — with the trim-end clamp from the previous test already in place
-/// but no loop branch yet — clamped to `min(2.1, 1.0) = 1.0`, whose nearest
-/// cached frame is yellow: a clearly different pixel, which is what proves
-/// this test is exercising the loop path and not being masked by the clamp.
-#[test]
-fn loop_video_wraps_playback_within_the_trim_window() {
-    let src = unique_src("loop");
-    let cache_key = format!("{src}:20x20");
-    let frames = vec![
-        (0.0, solid_rgba([255, 0, 0, 255], 2, 2), 2, 2),
-        (0.25, solid_rgba([0, 255, 0, 255], 2, 2), 2, 2),
-        (0.5, solid_rgba([0, 0, 255, 255], 2, 2), 2, 2),
-        (0.75, solid_rgba([255, 255, 0, 255], 2, 2), 2, 2),
-    ];
-    video_frame_cache().insert(cache_key, Arc::new(frames));
-
-    let v = video(&src, ImageFit::Fill, Some(0.0), Some(1.0), Some(true));
-    let ctx = ctx_at(2.1);
-    let pixels = paint_and_read(&v, &ctx, 20, 20, false);
-
-    assert_eq!(
-        px(&pixels, 20, 10, 10),
-        [255, 0, 0, 255],
-        "looping must wrap the query time back into the window (nearest: red), not clamp to \
-         the window's own end (nearest: yellow)"
-    );
-}
-
-/// Without `loop_video`, a `trim_end`-bounded video must still clamp
-/// (unaffected by the loop branch existing) rather than wrap — the same
-/// scenario as the wrap test above, minus the flag.
-#[test]
-fn without_loop_video_playback_still_clamps_not_wraps() {
-    let src = unique_src("no-loop");
-    let cache_key = format!("{src}:20x20");
-    let frames = vec![
-        (0.0, solid_rgba([255, 0, 0, 255], 2, 2), 2, 2),
-        (0.25, solid_rgba([0, 255, 0, 255], 2, 2), 2, 2),
-        (0.5, solid_rgba([0, 0, 255, 255], 2, 2), 2, 2),
-        (0.75, solid_rgba([255, 255, 0, 255], 2, 2), 2, 2),
-    ];
-    video_frame_cache().insert(cache_key, Arc::new(frames));
-
-    let v = video(&src, ImageFit::Fill, Some(0.0), Some(1.0), None);
-    let ctx = ctx_at(2.1);
-    let pixels = paint_and_read(&v, &ctx, 20, 20, false);
-
-    assert_eq!(
-        px(&pixels, 20, 10, 10),
-        [255, 255, 0, 255],
-        "no loop_video: must clamp to the window's end (nearest: yellow), not wrap"
-    );
-}
-
-// ─── cached-frame draw path mistagged straight alpha as premultiplied ──────
-
-/// ffmpeg's `-pix_fmt rgba` output — what fills the video-frame cache — is
-/// straight (unpremultiplied) alpha. Tagging that buffer `AlphaType::Premul`
-/// makes Skia treat the RGB channels as already scaled by alpha instead of
-/// scaling them itself, which brightens (here: doubles) every
-/// semi-transparent pixel's channels once composited.
-///
-/// A straight-alpha (200, 100, 50, 128) pixel, composited over black:
-/// correctly tagged `Unpremul`, Skia premultiplies it to
-/// (200×128/255, 100×128/255, 50×128/255) ≈ (100, 50, 25) before compositing
-/// over black, landing there almost exactly (the `(1 - alpha) * 0` background
-/// term vanishes either way). Mistagged `Premul`, Skia uses the raw channel
-/// values directly as if already scaled — (200, 100, 50) — composited over
-/// black with no further scaling, landing at roughly double the correct
-/// result.
-#[test]
-fn cached_frame_straight_alpha_composites_correctly_not_doubled() {
-    let src = unique_src("alpha");
-    let cache_key = format!("{src}:10x10");
-    let straight = [200u8, 100, 50, 128];
-    video_frame_cache().insert(
-        cache_key,
-        Arc::new(vec![(0.0, solid_rgba(straight, 2, 2), 2, 2)]),
-    );
-
-    let v = video(&src, ImageFit::Fill, None, None, None);
-    let ctx = ctx_at(0.0);
-    let pixels = paint_and_read(&v, &ctx, 10, 10, false);
-    let composited = px(&pixels, 10, 5, 5);
-
-    let close = |actual: u8, expected: u8| (actual as i16 - expected as i16).abs() <= 4;
-    assert!(
-        close(composited[0], 100) && close(composited[1], 50) && close(composited[2], 25),
-        "straight-alpha (200,100,50,128) over black must composite to roughly (100,50,25), \
-         got {composited:?} — a value near (200,100,50) means the buffer is still mistagged \
-         as premultiplied and its channels are being used unscaled"
-    );
-}
diff --git a/crates/rustmotion/src/cli/commands/batch.rs b/crates/rustmotion/src/cli/commands/batch.rs
index e68d2f20..b8ec3643 100644
--- a/crates/rustmotion/src/cli/commands/batch.rs
+++ b/crates/rustmotion/src/cli/commands/batch.rs
@@ -71,14 +71,11 @@ pub(crate) fn resolve_name_template(
             out.push_str(&replacement);
             cursor = start + end + 1; // skip past '}'
         } else {
-            let ch = template[cursor..].chars().next().expect(
-                "cursor sits on a UTF-8 char boundary: every branch above advances it either \
-                 past an ASCII '{'/'}' byte or by a full char's own byte length",
-            );
-            out.push(ch);
-            cursor += ch.len_utf8();
+            out.push(bytes[cursor] as char);
+            cursor += 1;
         }
     }
+    let _ = bytes;
     Ok(out)
 }
 
@@ -495,32 +492,6 @@ mod name_template_tests {
             "static.mp4"
         );
     }
-
-    /// The literal (non-`{field}`) text of the template used to be walked
-    /// byte-by-byte and each byte cast straight to `char` — a Latin-1
-    /// reinterpretation of whatever UTF-8 continuation bytes an accented
-    /// character produced. `é` is `0xC3 0xA9` in UTF-8; cast individually
-    /// that becomes `é`, exactly the corruption this asserts is gone.
-    #[test]
-    fn accented_literal_text_round_trips() {
-        let data = row(&[("id", json!("abc"))]);
-        assert_eq!(
-            resolve_name_template("résumé-{id}.mp4", &data, 0).unwrap(),
-            "résumé-abc.mp4"
-        );
-    }
-
-    /// A non-Latin script exercises characters that are more than two UTF-8
-    /// bytes wide, where a byte-at-a-time cast produces even more mangled
-    /// output than the two-byte Latin-1 case above.
-    #[test]
-    fn cjk_literal_text_round_trips() {
-        let data = row(&[("id", json!("1"))]);
-        assert_eq!(
-            resolve_name_template("动画-{id}.mp4", &data, 0).unwrap(),
-            "动画-1.mp4"
-        );
-    }
 }
 
 #[cfg(test)]
diff --git a/crates/rustmotion/src/cli/commands/render.rs b/crates/rustmotion/src/cli/commands/render.rs
index 53fd6fd2..2c6a11da 100644
--- a/crates/rustmotion/src/cli/commands/render.rs
+++ b/crates/rustmotion/src/cli/commands/render.rs
@@ -8,20 +8,6 @@ use std::path::{Path, PathBuf};
 
 use crate::cli::commands::validation::{self, ValidationSource};
 
-/// Every process-global decode cache a `--watch` iteration must forget
-/// before re-rendering, so an edited asset is never served from a stale
-/// entry keyed only on its path. `ASSET_CACHE` already had a public
-/// clear function; `GIF_CACHE`/`VIDEO_FRAME_CACHE` did not, so those two are
-/// cleared here by calling `DashMap::clear()` on the map `gif_cache()`/
-/// `video_frame_cache()` already return, rather than adding new functions to
-/// `rustmotion-core`'s `engine::renderer::assets` (owned by a sibling
-/// workstream in this chantier).
-fn clear_all_media_caches() {
-    engine::clear_asset_cache();
-    engine::gif_cache().clear();
-    engine::video_frame_cache().clear();
-}
-
 /// Load + validate a scenario for watch mode. On validation failure prints the
 /// report and returns the typed error so the caller can decide how to handle it.
 ///
@@ -387,7 +373,7 @@ pub fn cmd_watch(
                     Err(e) => eprintln!("Render error: {}", e),
                 }
             } else {
-                clear_all_media_caches();
+                engine::clear_asset_cache();
                 if let Err(e) = cmd_render(
                     scenario,
                     output,
@@ -444,8 +430,6 @@ pub fn cmd_watch(
 
         match load_for_watch(input, no_validate, lenient, strict_anim, strict_attrs) {
             Ok(scenario) => {
-                clear_all_media_caches();
-
                 // Reset error backoff on a successful load
                 if consecutive_err_count > 0 && suppressed {
                     eprintln!("Recovered from previous errors.");
@@ -468,6 +452,7 @@ pub fn cmd_watch(
                     let use_prev = if prev_config_hash == Some(config_hash) {
                         prev_segments.as_deref()
                     } else {
+                        engine::clear_asset_cache();
                         None
                     };
 
@@ -543,6 +528,7 @@ pub fn cmd_watch(
                         Err(e) => eprintln!("Render error: {}", e),
                     }
                 } else {
+                    engine::clear_asset_cache();
                     if let Err(e) = cmd_render(
                         scenario,
                         output,
@@ -610,58 +596,3 @@ fn render_single_frame(
     img.save(output)?;
     Ok(())
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use rustmotion_core::engine::renderer::{asset_cache, gif_cache, video_frame_cache};
-
-    fn unique_marker(label: &str) -> String {
-        format!(
-            "rustmotion-audit-ws-d-rm25-{label}-{}-{}",
-            std::process::id(),
-            std::time::SystemTime::now()
-                .duration_since(std::time::UNIX_EPOCH)
-                .expect("system clock before UNIX epoch")
-                .as_nanos()
-        )
-    }
-
-    /// `--watch` only ever called `engine::clear_asset_cache()`, and
-    /// only conditionally in the incremental branch (when the video config
-    /// hash changed). `GIF_CACHE`/`VIDEO_FRAME_CACHE` had no clear function
-    /// at all, so an edited GIF or embedded video stayed stale for the rest
-    /// of a `--watch` session no matter how many times the source file
-    /// changed. This populates all three caches with markers unique to this
-    /// test run — safe against the other tests in this binary that share the
-    /// same process-global caches — and asserts a single call clears every
-    /// one of them, not just the asset cache.
-    #[test]
-    fn clear_all_media_caches_clears_gif_and_video_caches_not_just_images() {
-        let marker = unique_marker("clear-all");
-
-        let mut surface = skia_safe::surfaces::raster_n32_premul((1, 1)).expect("raster surface");
-        asset_cache().insert(marker.clone(), surface.image_snapshot());
-        gif_cache().insert(
-            marker.clone(),
-            std::sync::Arc::new((Vec::new(), Vec::new(), 0.0)),
-        );
-        video_frame_cache().insert(marker.clone(), std::sync::Arc::new(Vec::new()));
-
-        assert!(asset_cache().contains_key(&marker));
-        assert!(gif_cache().contains_key(&marker));
-        assert!(video_frame_cache().contains_key(&marker));
-
-        clear_all_media_caches();
-
-        assert!(!asset_cache().contains_key(&marker));
-        assert!(
-            !gif_cache().contains_key(&marker),
-            "gif cache must be cleared too, not just the asset cache"
-        );
-        assert!(
-            !video_frame_cache().contains_key(&marker),
-            "video frame cache must be cleared too, not just the asset cache"
-        );
-    }
-}
diff --git a/crates/rustmotion/tests/audit_ws_d.rs b/crates/rustmotion/tests/audit_ws_d.rs
index 23c484e7..36c6a6a1 100644
--- a/crates/rustmotion/tests/audit_ws_d.rs
+++ b/crates/rustmotion/tests/audit_ws_d.rs
@@ -1,29 +1,10 @@
 //! Regression tests for the media-decoding, frame-cache, and render/batch
 //! CLI hardening pass on this branch.
 //!
-//! Two kinds of coverage land here:
-//!
-//! - Video frame preextraction (`preload::preextract_video_frames`) is
-//!   exercised through the crate's public `rustmotion::engine::preload`
-//!   surface directly — no subprocess needed, since the budget math and the
-//!   cache it guards are both `pub`.
-//! - The batch `--name-template` byte-vs-char bug
-//!   (`cli::commands::batch::resolve_name_template`) cannot be reached this
-//!   way: `cli::commands` is a private module (`mod commands;` in
-//!   `src/cli/mod.rs`), so — mirroring `audit_ws_b.rs`'s reasoning for the
-//!   same constraint — the only externally-observable contract is the
-//!   compiled binary itself, driven as a subprocess.
-//!
-//! The GIF cache-stampede/decompression-bomb caps and the video component's
-//! dead-field fixes (`fit`, `loop_video`, `trim_end`, straight-vs-premultiplied
-//! alpha) live in `rustmotion-components`'s own test suite instead — see
-//! that crate's `audit_ws_d.rs` and `gif.rs`'s in-file `mod tests`. The
-//! `--watch` cache-clearing fix needs a private helper in
-//! `cli::commands::render` and lives in that file's own `mod tests` for the
-//! same private-module reason as the name-template test above.
-
-use std::path::{Path, PathBuf};
-use std::process::{Command, Output};
+//! Video frame preextraction (`preload::preextract_video_frames`) is
+//! exercised through the crate's public `rustmotion::engine::preload`
+//! surface directly — no subprocess needed, since the budget math and the
+//! cache it guards are both `pub`.
 
 use rustmotion::engine::preload::{
     video_frame_byte_size, would_exceed_cache_budget, VIDEO_FRAME_CACHE_BUDGET_BYTES,
@@ -42,10 +23,11 @@ fn frame_byte_size_matches_plain_multiplication_for_ordinary_dimensions() {
 
 /// The secondary hazard this closes: `width * height * 4` in plain `u32`
 /// wraps for a large-enough declared size (65536×16384 wraps to 0, which
-/// used to turn into a division by zero downstream). `u32::MAX` on both dimensions
-/// is the most extreme case reachable from a `style.width`/`style.height`
-/// pair — the fixed computation must saturate to `u64::MAX`, not wrap to
-/// some small number that would slip past the budget check below.
+/// used to turn into a division by zero downstream). `u32::MAX` on both
+/// dimensions is the most extreme case reachable from a `style.width`/
+/// `style.height` pair — the fixed computation must saturate to `u64::MAX`,
+/// not wrap to some small number that would slip past the budget check
+/// below.
 #[test]
 fn frame_byte_size_saturates_instead_of_wrapping_on_extreme_dimensions() {
     let huge = video_frame_byte_size(u32::MAX, u32::MAX);
@@ -79,137 +61,3 @@ fn would_exceed_cache_budget_rejects_only_once_the_sum_crosses_the_ceiling() {
         "saturating add must not wrap past the ceiling"
     );
 }
-
-// ─── `batch --name-template` must not mangle non-ASCII bytes ──────────────
-
-/// Minimal RAII scratch directory, mirroring `audit_ws_b.rs`'s `ScratchDir`.
-struct ScratchDir(PathBuf);
-
-impl ScratchDir {
-    fn new(label: &str) -> Self {
-        let unique = format!(
-            "rustmotion-audit-ws-d-{label}-{}-{}",
-            std::process::id(),
-            std::time::SystemTime::now()
-                .duration_since(std::time::UNIX_EPOCH)
-                .expect("system clock before UNIX epoch")
-                .as_nanos()
-        );
-        let path = std::env::temp_dir().join(unique);
-        std::fs::create_dir_all(&path).expect("create scratch dir");
-        Self(path)
-    }
-}
-
-impl Drop for ScratchDir {
-    fn drop(&mut self) {
-        let _ = std::fs::remove_dir_all(&self.0);
-    }
-}
-
-fn write_file(dir: &Path, name: &str, contents: &str) -> PathBuf {
-    let path = dir.join(name);
-    std::fs::write(&path, contents).expect("write scratch file");
-    path
-}
-
-fn run_batch(file: &Path, data: &Path, output_dir: &Path, name_template: &str) -> Output {
-    Command::new(env!("CARGO_BIN_EXE_rustmotion"))
-        .arg("--quiet")
-        .arg("batch")
-        .arg("--file")
-        .arg(file)
-        .arg("--data")
-        .arg(data)
-        .arg("--output-dir")
-        .arg(output_dir)
-        .arg("--name-template")
-        .arg(name_template)
-        .arg("--format")
-        .arg("png-seq")
-        .output()
-        .expect("failed to spawn `rustmotion batch`")
-}
-
-/// `resolve_name_template` used to walk the template as raw bytes and
-/// cast each one to `char` — a Latin-1 reinterpretation that mangles every
-/// non-ASCII byte: `résumé-{id}.mp4` became `résumé-VAL.mp4` on disk.
-/// `batch`'s own module doc gives `{lang}/{id}
-/// .mp4` as the flagship use case for `--name-template`, which is exactly
-/// the localisation scenario most likely to carry accents.
-///
-/// Driven as a subprocess rather than calling `resolve_name_template`
-/// directly: it is `pub(crate)` inside the private `cli::commands::batch`
-/// module, unreachable from an external integration test.
-#[test]
-fn batch_name_template_round_trips_accented_characters_on_disk() {
-    let scratch = ScratchDir::new("rm30");
-    let template = write_file(
-        &scratch.0,
-        "template.json",
-        &serde_json::json!({
-            "config": { "id": { "type": "string", "default": "x" } },
-            "video": { "width": 32, "height": 32, "fps": 1 },
-            "scenes": [{ "duration": 1.0, "children": [] }]
-        })
-        .to_string(),
-    );
-    let data = write_file(
-        &scratch.0,
-        "data.jsonl",
-        &serde_json::json!({"id": "abc"}).to_string(),
-    );
-    let output_dir = scratch.0.join("out");
-    std::fs::create_dir_all(&output_dir).expect("create output dir");
-
-    let result = run_batch(&template, &data, &output_dir, "résumé-{id}.png");
-
-    assert!(
-        result.status.success(),
-        "batch must succeed: stdout={}\nstderr={}",
-        String::from_utf8_lossy(&result.stdout),
-        String::from_utf8_lossy(&result.stderr)
-    );
-
-    let expected = output_dir.join("résumé-abc.png");
-    assert!(
-        expected.is_dir(),
-        "expected an accent-preserving output directory at {}, found instead: {:?}",
-        expected.display(),
-        std::fs::read_dir(&output_dir)
-            .map(|entries| entries
-                .filter_map(|e| e.ok().map(|e| e.file_name()))
-                .collect::<Vec<_>>())
-            .unwrap_or_default()
-    );
-    assert!(expected.join("frame_00000.png").exists());
-}
-
-/// A template with no non-ASCII content must still resolve exactly as
-/// before — the fix changes how a byte becomes a `char`, not the loop's
-/// control flow (the `{`/`}` brace scan is untouched).
-#[test]
-fn batch_name_template_plain_ascii_is_unaffected() {
-    let scratch = ScratchDir::new("rm30-ascii");
-    let template = write_file(
-        &scratch.0,
-        "template.json",
-        &serde_json::json!({
-            "config": { "id": { "type": "string", "default": "x" } },
-            "video": { "width": 32, "height": 32, "fps": 1 },
-            "scenes": [{ "duration": 1.0, "children": [] }]
-        })
-        .to_string(),
-    );
-    let data = write_file(
-        &scratch.0,
-        "data.jsonl",
-        &serde_json::json!({"id": "abc"}).to_string(),
-    );
-    let output_dir = scratch.0.join("out");
-    std::fs::create_dir_all(&output_dir).expect("create output dir");
-
-    let result = run_batch(&template, &data, &output_dir, "clip-{id}.png");
-    assert!(result.status.success());
-    assert!(output_dir.join("clip-abc.png").is_dir());
-}

From e068341c404530dc74dc99a8e603ec897f4a3d38 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:05:15 +0200
Subject: [PATCH 33/56] fix(batch): index the name template by character (#243)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`resolve_name_template` walks the template as raw bytes and casts each one to `char`, which in Rust is a Latin-1 reinterpretation of the byte value. Substituted `{field}` values are fine (they go through `push_str` at line 71); the literal text around them is not. I confirmed the behaviour by compiling the same loop standalone: `résumé-{id}.mp4` yields `résumé-VAL.mp4` and `动画-{id}.mp4` yields `å¨ç»-VAL.mp4`. So `rustmotion batch --name-template "résumé-{id}.mp4"` writes files literally named `résumé-abc.mp4` to disk, and the same corruption lands in the `[ok] <path>` progress lines and in every failure message (`item N: ...`). A localisation batch — the exact use case `{lang}/{id}.mp4` in the module doc is built for — is where a non-ASCII template is most likely. None of the five tests in `name_template_tests` (lines 448-495) uses a non-ASCII template.

Refs #220
---
 crates/rustmotion/src/cli/commands/batch.rs  |  35 +++-
 crates/rustmotion/src/cli/commands/render.rs |  75 +++++++-
 crates/rustmotion/tests/audit_ws_d.rs        | 170 ++++++++++++++++++-
 3 files changed, 265 insertions(+), 15 deletions(-)

diff --git a/crates/rustmotion/src/cli/commands/batch.rs b/crates/rustmotion/src/cli/commands/batch.rs
index b8ec3643..e68d2f20 100644
--- a/crates/rustmotion/src/cli/commands/batch.rs
+++ b/crates/rustmotion/src/cli/commands/batch.rs
@@ -71,11 +71,14 @@ pub(crate) fn resolve_name_template(
             out.push_str(&replacement);
             cursor = start + end + 1; // skip past '}'
         } else {
-            out.push(bytes[cursor] as char);
-            cursor += 1;
+            let ch = template[cursor..].chars().next().expect(
+                "cursor sits on a UTF-8 char boundary: every branch above advances it either \
+                 past an ASCII '{'/'}' byte or by a full char's own byte length",
+            );
+            out.push(ch);
+            cursor += ch.len_utf8();
         }
     }
-    let _ = bytes;
     Ok(out)
 }
 
@@ -492,6 +495,32 @@ mod name_template_tests {
             "static.mp4"
         );
     }
+
+    /// The literal (non-`{field}`) text of the template used to be walked
+    /// byte-by-byte and each byte cast straight to `char` — a Latin-1
+    /// reinterpretation of whatever UTF-8 continuation bytes an accented
+    /// character produced. `é` is `0xC3 0xA9` in UTF-8; cast individually
+    /// that becomes `é`, exactly the corruption this asserts is gone.
+    #[test]
+    fn accented_literal_text_round_trips() {
+        let data = row(&[("id", json!("abc"))]);
+        assert_eq!(
+            resolve_name_template("résumé-{id}.mp4", &data, 0).unwrap(),
+            "résumé-abc.mp4"
+        );
+    }
+
+    /// A non-Latin script exercises characters that are more than two UTF-8
+    /// bytes wide, where a byte-at-a-time cast produces even more mangled
+    /// output than the two-byte Latin-1 case above.
+    #[test]
+    fn cjk_literal_text_round_trips() {
+        let data = row(&[("id", json!("1"))]);
+        assert_eq!(
+            resolve_name_template("动画-{id}.mp4", &data, 0).unwrap(),
+            "动画-1.mp4"
+        );
+    }
 }
 
 #[cfg(test)]
diff --git a/crates/rustmotion/src/cli/commands/render.rs b/crates/rustmotion/src/cli/commands/render.rs
index 2c6a11da..53fd6fd2 100644
--- a/crates/rustmotion/src/cli/commands/render.rs
+++ b/crates/rustmotion/src/cli/commands/render.rs
@@ -8,6 +8,20 @@ use std::path::{Path, PathBuf};
 
 use crate::cli::commands::validation::{self, ValidationSource};
 
+/// Every process-global decode cache a `--watch` iteration must forget
+/// before re-rendering, so an edited asset is never served from a stale
+/// entry keyed only on its path. `ASSET_CACHE` already had a public
+/// clear function; `GIF_CACHE`/`VIDEO_FRAME_CACHE` did not, so those two are
+/// cleared here by calling `DashMap::clear()` on the map `gif_cache()`/
+/// `video_frame_cache()` already return, rather than adding new functions to
+/// `rustmotion-core`'s `engine::renderer::assets` (owned by a sibling
+/// workstream in this chantier).
+fn clear_all_media_caches() {
+    engine::clear_asset_cache();
+    engine::gif_cache().clear();
+    engine::video_frame_cache().clear();
+}
+
 /// Load + validate a scenario for watch mode. On validation failure prints the
 /// report and returns the typed error so the caller can decide how to handle it.
 ///
@@ -373,7 +387,7 @@ pub fn cmd_watch(
                     Err(e) => eprintln!("Render error: {}", e),
                 }
             } else {
-                engine::clear_asset_cache();
+                clear_all_media_caches();
                 if let Err(e) = cmd_render(
                     scenario,
                     output,
@@ -430,6 +444,8 @@ pub fn cmd_watch(
 
         match load_for_watch(input, no_validate, lenient, strict_anim, strict_attrs) {
             Ok(scenario) => {
+                clear_all_media_caches();
+
                 // Reset error backoff on a successful load
                 if consecutive_err_count > 0 && suppressed {
                     eprintln!("Recovered from previous errors.");
@@ -452,7 +468,6 @@ pub fn cmd_watch(
                     let use_prev = if prev_config_hash == Some(config_hash) {
                         prev_segments.as_deref()
                     } else {
-                        engine::clear_asset_cache();
                         None
                     };
 
@@ -528,7 +543,6 @@ pub fn cmd_watch(
                         Err(e) => eprintln!("Render error: {}", e),
                     }
                 } else {
-                    engine::clear_asset_cache();
                     if let Err(e) = cmd_render(
                         scenario,
                         output,
@@ -596,3 +610,58 @@ fn render_single_frame(
     img.save(output)?;
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use rustmotion_core::engine::renderer::{asset_cache, gif_cache, video_frame_cache};
+
+    fn unique_marker(label: &str) -> String {
+        format!(
+            "rustmotion-audit-ws-d-rm25-{label}-{}-{}",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .expect("system clock before UNIX epoch")
+                .as_nanos()
+        )
+    }
+
+    /// `--watch` only ever called `engine::clear_asset_cache()`, and
+    /// only conditionally in the incremental branch (when the video config
+    /// hash changed). `GIF_CACHE`/`VIDEO_FRAME_CACHE` had no clear function
+    /// at all, so an edited GIF or embedded video stayed stale for the rest
+    /// of a `--watch` session no matter how many times the source file
+    /// changed. This populates all three caches with markers unique to this
+    /// test run — safe against the other tests in this binary that share the
+    /// same process-global caches — and asserts a single call clears every
+    /// one of them, not just the asset cache.
+    #[test]
+    fn clear_all_media_caches_clears_gif_and_video_caches_not_just_images() {
+        let marker = unique_marker("clear-all");
+
+        let mut surface = skia_safe::surfaces::raster_n32_premul((1, 1)).expect("raster surface");
+        asset_cache().insert(marker.clone(), surface.image_snapshot());
+        gif_cache().insert(
+            marker.clone(),
+            std::sync::Arc::new((Vec::new(), Vec::new(), 0.0)),
+        );
+        video_frame_cache().insert(marker.clone(), std::sync::Arc::new(Vec::new()));
+
+        assert!(asset_cache().contains_key(&marker));
+        assert!(gif_cache().contains_key(&marker));
+        assert!(video_frame_cache().contains_key(&marker));
+
+        clear_all_media_caches();
+
+        assert!(!asset_cache().contains_key(&marker));
+        assert!(
+            !gif_cache().contains_key(&marker),
+            "gif cache must be cleared too, not just the asset cache"
+        );
+        assert!(
+            !video_frame_cache().contains_key(&marker),
+            "video frame cache must be cleared too, not just the asset cache"
+        );
+    }
+}
diff --git a/crates/rustmotion/tests/audit_ws_d.rs b/crates/rustmotion/tests/audit_ws_d.rs
index 36c6a6a1..23c484e7 100644
--- a/crates/rustmotion/tests/audit_ws_d.rs
+++ b/crates/rustmotion/tests/audit_ws_d.rs
@@ -1,10 +1,29 @@
 //! Regression tests for the media-decoding, frame-cache, and render/batch
 //! CLI hardening pass on this branch.
 //!
-//! Video frame preextraction (`preload::preextract_video_frames`) is
-//! exercised through the crate's public `rustmotion::engine::preload`
-//! surface directly — no subprocess needed, since the budget math and the
-//! cache it guards are both `pub`.
+//! Two kinds of coverage land here:
+//!
+//! - Video frame preextraction (`preload::preextract_video_frames`) is
+//!   exercised through the crate's public `rustmotion::engine::preload`
+//!   surface directly — no subprocess needed, since the budget math and the
+//!   cache it guards are both `pub`.
+//! - The batch `--name-template` byte-vs-char bug
+//!   (`cli::commands::batch::resolve_name_template`) cannot be reached this
+//!   way: `cli::commands` is a private module (`mod commands;` in
+//!   `src/cli/mod.rs`), so — mirroring `audit_ws_b.rs`'s reasoning for the
+//!   same constraint — the only externally-observable contract is the
+//!   compiled binary itself, driven as a subprocess.
+//!
+//! The GIF cache-stampede/decompression-bomb caps and the video component's
+//! dead-field fixes (`fit`, `loop_video`, `trim_end`, straight-vs-premultiplied
+//! alpha) live in `rustmotion-components`'s own test suite instead — see
+//! that crate's `audit_ws_d.rs` and `gif.rs`'s in-file `mod tests`. The
+//! `--watch` cache-clearing fix needs a private helper in
+//! `cli::commands::render` and lives in that file's own `mod tests` for the
+//! same private-module reason as the name-template test above.
+
+use std::path::{Path, PathBuf};
+use std::process::{Command, Output};
 
 use rustmotion::engine::preload::{
     video_frame_byte_size, would_exceed_cache_budget, VIDEO_FRAME_CACHE_BUDGET_BYTES,
@@ -23,11 +42,10 @@ fn frame_byte_size_matches_plain_multiplication_for_ordinary_dimensions() {
 
 /// The secondary hazard this closes: `width * height * 4` in plain `u32`
 /// wraps for a large-enough declared size (65536×16384 wraps to 0, which
-/// used to turn into a division by zero downstream). `u32::MAX` on both
-/// dimensions is the most extreme case reachable from a `style.width`/
-/// `style.height` pair — the fixed computation must saturate to `u64::MAX`,
-/// not wrap to some small number that would slip past the budget check
-/// below.
+/// used to turn into a division by zero downstream). `u32::MAX` on both dimensions
+/// is the most extreme case reachable from a `style.width`/`style.height`
+/// pair — the fixed computation must saturate to `u64::MAX`, not wrap to
+/// some small number that would slip past the budget check below.
 #[test]
 fn frame_byte_size_saturates_instead_of_wrapping_on_extreme_dimensions() {
     let huge = video_frame_byte_size(u32::MAX, u32::MAX);
@@ -61,3 +79,137 @@ fn would_exceed_cache_budget_rejects_only_once_the_sum_crosses_the_ceiling() {
         "saturating add must not wrap past the ceiling"
     );
 }
+
+// ─── `batch --name-template` must not mangle non-ASCII bytes ──────────────
+
+/// Minimal RAII scratch directory, mirroring `audit_ws_b.rs`'s `ScratchDir`.
+struct ScratchDir(PathBuf);
+
+impl ScratchDir {
+    fn new(label: &str) -> Self {
+        let unique = format!(
+            "rustmotion-audit-ws-d-{label}-{}-{}",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .expect("system clock before UNIX epoch")
+                .as_nanos()
+        );
+        let path = std::env::temp_dir().join(unique);
+        std::fs::create_dir_all(&path).expect("create scratch dir");
+        Self(path)
+    }
+}
+
+impl Drop for ScratchDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn write_file(dir: &Path, name: &str, contents: &str) -> PathBuf {
+    let path = dir.join(name);
+    std::fs::write(&path, contents).expect("write scratch file");
+    path
+}
+
+fn run_batch(file: &Path, data: &Path, output_dir: &Path, name_template: &str) -> Output {
+    Command::new(env!("CARGO_BIN_EXE_rustmotion"))
+        .arg("--quiet")
+        .arg("batch")
+        .arg("--file")
+        .arg(file)
+        .arg("--data")
+        .arg(data)
+        .arg("--output-dir")
+        .arg(output_dir)
+        .arg("--name-template")
+        .arg(name_template)
+        .arg("--format")
+        .arg("png-seq")
+        .output()
+        .expect("failed to spawn `rustmotion batch`")
+}
+
+/// `resolve_name_template` used to walk the template as raw bytes and
+/// cast each one to `char` — a Latin-1 reinterpretation that mangles every
+/// non-ASCII byte: `résumé-{id}.mp4` became `résumé-VAL.mp4` on disk.
+/// `batch`'s own module doc gives `{lang}/{id}
+/// .mp4` as the flagship use case for `--name-template`, which is exactly
+/// the localisation scenario most likely to carry accents.
+///
+/// Driven as a subprocess rather than calling `resolve_name_template`
+/// directly: it is `pub(crate)` inside the private `cli::commands::batch`
+/// module, unreachable from an external integration test.
+#[test]
+fn batch_name_template_round_trips_accented_characters_on_disk() {
+    let scratch = ScratchDir::new("rm30");
+    let template = write_file(
+        &scratch.0,
+        "template.json",
+        &serde_json::json!({
+            "config": { "id": { "type": "string", "default": "x" } },
+            "video": { "width": 32, "height": 32, "fps": 1 },
+            "scenes": [{ "duration": 1.0, "children": [] }]
+        })
+        .to_string(),
+    );
+    let data = write_file(
+        &scratch.0,
+        "data.jsonl",
+        &serde_json::json!({"id": "abc"}).to_string(),
+    );
+    let output_dir = scratch.0.join("out");
+    std::fs::create_dir_all(&output_dir).expect("create output dir");
+
+    let result = run_batch(&template, &data, &output_dir, "résumé-{id}.png");
+
+    assert!(
+        result.status.success(),
+        "batch must succeed: stdout={}\nstderr={}",
+        String::from_utf8_lossy(&result.stdout),
+        String::from_utf8_lossy(&result.stderr)
+    );
+
+    let expected = output_dir.join("résumé-abc.png");
+    assert!(
+        expected.is_dir(),
+        "expected an accent-preserving output directory at {}, found instead: {:?}",
+        expected.display(),
+        std::fs::read_dir(&output_dir)
+            .map(|entries| entries
+                .filter_map(|e| e.ok().map(|e| e.file_name()))
+                .collect::<Vec<_>>())
+            .unwrap_or_default()
+    );
+    assert!(expected.join("frame_00000.png").exists());
+}
+
+/// A template with no non-ASCII content must still resolve exactly as
+/// before — the fix changes how a byte becomes a `char`, not the loop's
+/// control flow (the `{`/`}` brace scan is untouched).
+#[test]
+fn batch_name_template_plain_ascii_is_unaffected() {
+    let scratch = ScratchDir::new("rm30-ascii");
+    let template = write_file(
+        &scratch.0,
+        "template.json",
+        &serde_json::json!({
+            "config": { "id": { "type": "string", "default": "x" } },
+            "video": { "width": 32, "height": 32, "fps": 1 },
+            "scenes": [{ "duration": 1.0, "children": [] }]
+        })
+        .to_string(),
+    );
+    let data = write_file(
+        &scratch.0,
+        "data.jsonl",
+        &serde_json::json!({"id": "abc"}).to_string(),
+    );
+    let output_dir = scratch.0.join("out");
+    std::fs::create_dir_all(&output_dir).expect("create output dir");
+
+    let result = run_batch(&template, &data, &output_dir, "clip-{id}.png");
+    assert!(result.status.success());
+    assert!(output_dir.join("clip-abc.png").is_dir());
+}

From 4ac841daf76dac95b909a7f51b08cace461eab54 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:05:26 +0200
Subject: [PATCH 34/56] fix(video): honour the fit property (#244)

Refs #220
---
 crates/rustmotion-components/src/video.rs     |  54 ++++-
 .../rustmotion-components/tests/audit_ws_d.rs | 188 ++++++++++++++++++
 2 files changed, 236 insertions(+), 6 deletions(-)
 create mode 100644 crates/rustmotion-components/tests/audit_ws_d.rs

diff --git a/crates/rustmotion-components/src/video.rs b/crates/rustmotion-components/src/video.rs
index 0d64739f..10921bce 100644
--- a/crates/rustmotion-components/src/video.rs
+++ b/crates/rustmotion-components/src/video.rs
@@ -46,6 +46,52 @@ rustmotion_core::impl_traits!(Video {
     Styled => style,
 });
 
+/// The rectangle an `img_w`×`img_h` source draws into to honour `fit` inside
+/// a `target_w`×`target_h` box — the same three CSS `object-fit` semantics
+/// `image.rs`'s painter already implements for the `image` component.
+fn fit_rect(fit: &ImageFit, img_w: f32, img_h: f32, target_w: f32, target_h: f32) -> Rect {
+    match fit {
+        ImageFit::Fill => Rect::from_xywh(0.0, 0.0, target_w, target_h),
+        ImageFit::Contain => {
+            let scale = (target_w / img_w).min(target_h / img_h);
+            let w = img_w * scale;
+            let h = img_h * scale;
+            Rect::from_xywh((target_w - w) / 2.0, (target_h - h) / 2.0, w, h)
+        }
+        ImageFit::Cover => {
+            let scale = (target_w / img_w).max(target_h / img_h);
+            let w = img_w * scale;
+            let h = img_h * scale;
+            Rect::from_xywh((target_w - w) / 2.0, (target_h - h) / 2.0, w, h)
+        }
+    }
+}
+
+/// Draws `img` into `layout`'s box according to `fit`, clipping to the box
+/// for `Cover` (the only mode whose fitted rectangle can extend past it).
+fn draw_fitted(canvas: &Canvas, img: skia_safe::Image, fit: &ImageFit, layout: &BoxLayout) {
+    let dst = fit_rect(
+        fit,
+        img.width() as f32,
+        img.height() as f32,
+        layout.width,
+        layout.height,
+    );
+    let paint = Paint::default();
+    if matches!(fit, ImageFit::Cover) {
+        canvas.save();
+        canvas.clip_rect(
+            Rect::from_xywh(0.0, 0.0, layout.width, layout.height),
+            skia_safe::ClipOp::Intersect,
+            true,
+        );
+        canvas.draw_image_rect(img, None, dst, &paint);
+        canvas.restore();
+    } else {
+        canvas.draw_image_rect(img, None, dst, &paint);
+    }
+}
+
 impl Painter for Video {
     fn paint_content(
         &self,
@@ -74,9 +120,7 @@ impl Painter for Video {
                 let row_bytes = fw as usize * 4;
                 let data = skia_safe::Data::new_copy(rgba);
                 if let Some(img) = skia_safe::images::raster_from_data(&img_info, data, row_bytes) {
-                    let dst = Rect::from_xywh(0.0, 0.0, layout.width, layout.height);
-                    let paint = Paint::default();
-                    canvas.draw_image_rect(img, None, dst, &paint);
+                    draw_fitted(canvas, img, &self.fit, layout);
                 }
                 return;
             }
@@ -105,9 +149,7 @@ impl Painter for Video {
         };
         let skia_data = skia_safe::Data::new_copy(&frame_data);
         if let Some(img) = skia_safe::Image::from_encoded(skia_data) {
-            let dst = Rect::from_xywh(0.0, 0.0, layout.width, layout.height);
-            let paint = Paint::default();
-            canvas.draw_image_rect(img, None, dst, &paint);
+            draw_fitted(canvas, img, &self.fit, layout);
         }
     }
 }
diff --git a/crates/rustmotion-components/tests/audit_ws_d.rs b/crates/rustmotion-components/tests/audit_ws_d.rs
new file mode 100644
index 00000000..3cb43373
--- /dev/null
+++ b/crates/rustmotion-components/tests/audit_ws_d.rs
@@ -0,0 +1,188 @@
+//! Regression tests for the `video` component's dead-field fixes: `fit`,
+//! `trim_end`, `loop_video`, and the straight-vs-premultiplied alpha bug on
+//! its cached-frame draw path.
+//!
+//! Every case populates `video_frame_cache()` directly with hand-built RGBA
+//! frames rather than shelling out to a real ffmpeg decode: the field this
+//! module exercises (`Video::paint_content`) is one call away from the
+//! cache, and driving it that way keeps these tests hermetic and fast while
+//! still going through the real, public `Painter` implementation — no
+//! private items from `rustmotion-components` are touched.
+
+use std::sync::Arc;
+
+use rustmotion_components::Video;
+use rustmotion_core::css::CssStyle;
+use rustmotion_core::engine::animator::AnimatedProperties;
+use rustmotion_core::engine::layout_pass::BoxLayout;
+use rustmotion_core::engine::renderer::video_frame_cache;
+use rustmotion_core::schema::ImageFit;
+use rustmotion_core::traits::{PaintCtx, Painter, TimingConfig};
+
+fn unique_src(label: &str) -> String {
+    format!(
+        "audit-ws-d-video-{label}-{}-{}",
+        std::process::id(),
+        std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .expect("system clock before UNIX epoch")
+            .as_nanos()
+    )
+}
+
+#[allow(clippy::too_many_arguments)]
+fn video(
+    src: &str,
+    fit: ImageFit,
+    trim_start: Option<f64>,
+    trim_end: Option<f64>,
+    loop_video: Option<bool>,
+) -> Video {
+    Video {
+        src: src.to_string(),
+        trim_start,
+        trim_end,
+        playback_rate: None,
+        fit,
+        volume: 1.0,
+        loop_video,
+        timing: TimingConfig::default(),
+        style: CssStyle::default(),
+        timeline: Vec::new(),
+        stagger: None,
+    }
+}
+
+fn ctx_at(time: f64) -> PaintCtx {
+    PaintCtx {
+        time,
+        scenario_time: time,
+        scene_duration: 10.0,
+        frame_index: 0,
+        fps: 30,
+        video_width: 1920,
+        video_height: 1080,
+        stagger_offset: 0.0,
+    }
+}
+
+fn solid_rgba(color: [u8; 4], w: u32, h: u32) -> Vec<u8> {
+    let mut buf = Vec::with_capacity((w * h * 4) as usize);
+    for _ in 0..(w * h) {
+        buf.extend_from_slice(&color);
+    }
+    buf
+}
+
+/// Paints `video` into a fresh `w`×`h` surface (background transparent if
+/// `transparent_bg`, opaque black otherwise) and reads the composited pixels
+/// back as straight (unpremultiplied) RGBA.
+fn paint_and_read(video: &Video, ctx: &PaintCtx, w: i32, h: i32, transparent_bg: bool) -> Vec<u8> {
+    let mut surface = skia_safe::surfaces::raster_n32_premul((w, h)).expect("raster surface");
+    let bg = if transparent_bg {
+        skia_safe::Color4f::new(0.0, 0.0, 0.0, 0.0)
+    } else {
+        skia_safe::Color4f::new(0.0, 0.0, 0.0, 1.0)
+    };
+    surface.canvas().clear(bg);
+
+    let layout = BoxLayout {
+        width: w as f32,
+        height: h as f32,
+        ..Default::default()
+    };
+    let props = AnimatedProperties::default();
+    video.paint_content(surface.canvas(), &layout, &props, ctx);
+
+    let mut pixels = vec![0u8; (w * h * 4) as usize];
+    let info = skia_safe::ImageInfo::new(
+        (w, h),
+        skia_safe::ColorType::RGBA8888,
+        skia_safe::AlphaType::Unpremul,
+        None,
+    );
+    surface.read_pixels(&info, &mut pixels, (w * 4) as usize, (0, 0));
+    pixels
+}
+
+fn px(buf: &[u8], w: i32, x: i32, y: i32) -> [u8; 4] {
+    let i = ((y * w + x) * 4) as usize;
+    buf[i..i + 4].try_into().expect("pixel in bounds")
+}
+
+// ─── `fit` was declared, documented, and never read ────────────────────────
+
+/// A 10×20 source into a 40×40 box under `contain` must letterbox — scale
+/// is `min(40/10, 40/40) = 1`, so the drawn region is 10 wide, centred with
+/// a 15px empty margin on each side. Before the fix, the painter always
+/// stretched to the full box regardless of `fit`, so every pixel — margins
+/// included — came out opaque.
+#[test]
+fn contain_fit_letterboxes_instead_of_stretching() {
+    let src = unique_src("fit-contain");
+    let (fw, fh) = (10u32, 20u32);
+    let cache_key = format!("{src}:40x40");
+    video_frame_cache().insert(
+        cache_key,
+        Arc::new(vec![(
+            0.0,
+            solid_rgba([255, 255, 255, 255], fw, fh),
+            fw,
+            fh,
+        )]),
+    );
+
+    let v = video(&src, ImageFit::Contain, None, None, None);
+    let ctx = ctx_at(0.0);
+    let pixels = paint_and_read(&v, &ctx, 40, 40, true);
+
+    assert_eq!(
+        px(&pixels, 40, 0, 20)[3],
+        0,
+        "letterboxed left margin must stay empty, not be stretched into"
+    );
+    assert_eq!(
+        px(&pixels, 40, 39, 20)[3],
+        0,
+        "letterboxed right margin must stay empty, not be stretched into"
+    );
+    assert_eq!(
+        px(&pixels, 40, 20, 20),
+        [255, 255, 255, 255],
+        "the drawn column itself must still be opaque"
+    );
+}
+
+/// `fill` (the CSS default `object-fit: fill` behaviour) must still stretch
+/// to cover the whole box exactly as before — the fix must not regress the
+/// one mode that already matched the pre-fix behaviour.
+#[test]
+fn fill_fit_still_stretches_to_the_whole_box() {
+    let src = unique_src("fit-fill");
+    let (fw, fh) = (10u32, 20u32);
+    let cache_key = format!("{src}:40x40");
+    video_frame_cache().insert(
+        cache_key,
+        Arc::new(vec![(
+            0.0,
+            solid_rgba([255, 255, 255, 255], fw, fh),
+            fw,
+            fh,
+        )]),
+    );
+
+    let v = video(&src, ImageFit::Fill, None, None, None);
+    let ctx = ctx_at(0.0);
+    let pixels = paint_and_read(&v, &ctx, 40, 40, true);
+
+    assert_eq!(
+        px(&pixels, 40, 0, 0)[3],
+        255,
+        "fill must cover every corner"
+    );
+    assert_eq!(
+        px(&pixels, 40, 39, 39)[3],
+        255,
+        "fill must cover every corner"
+    );
+}

From 41689b8003edc2396bdff4e86f8a61c896d13bb4 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:05:36 +0200
Subject: [PATCH 35/56] fix(video): stop the picture at trim_end (#246)

Refs #220
---
 crates/rustmotion-components/src/video.rs     | 70 +++++++++++++-
 .../rustmotion-components/tests/audit_ws_d.rs | 95 +++++++++++++++++++
 2 files changed, 161 insertions(+), 4 deletions(-)

diff --git a/crates/rustmotion-components/src/video.rs b/crates/rustmotion-components/src/video.rs
index 10921bce..1500dbb5 100644
--- a/crates/rustmotion-components/src/video.rs
+++ b/crates/rustmotion-components/src/video.rs
@@ -6,7 +6,7 @@ use rustmotion_core::css::CssStyle;
 use rustmotion_core::engine::animator::AnimatedProperties;
 use rustmotion_core::engine::layout_pass::BoxLayout;
 use rustmotion_core::engine::renderer::{
-    extract_video_frame, find_closest_frame, video_frame_cache,
+    extract_video_frame, find_closest_frame, probe_video_metadata, video_frame_cache,
 };
 use rustmotion_core::schema::{ImageFit, TimelineStep};
 use rustmotion_core::traits::{PaintCtx, Painter, TimingConfig};
@@ -92,6 +92,70 @@ fn draw_fitted(canvas: &Canvas, img: skia_safe::Image, fit: &ImageFit, layout: &
     }
 }
 
+/// The source clip's own duration, probed via `ffprobe` and memoized per
+/// `src` for the life of the process — `effective_source_time` below is
+/// called once per painted frame, and re-probing on every one of them would
+/// mean one subprocess spawn per frame for any looping video with no
+/// explicit `trim_end`. `None` on a probe failure (no ffprobe on `PATH`, or
+/// the source can't be read) is memoized too, so a broken source fails fast
+/// on every subsequent frame instead of retrying the same failing probe.
+fn video_duration_secs(src: &str) -> Option<f64> {
+    static CACHE: std::sync::OnceLock<
+        std::sync::Mutex<std::collections::HashMap<String, Option<f64>>>,
+    > = std::sync::OnceLock::new();
+    let cache = CACHE.get_or_init(|| std::sync::Mutex::new(std::collections::HashMap::new()));
+
+    if let Some(hit) = cache
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner)
+        .get(src)
+    {
+        return *hit;
+    }
+    let probed = probe_video_metadata(src).ok().map(|p| p.duration_secs);
+    cache
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner)
+        .insert(src.to_string(), probed);
+    probed
+}
+
+impl Video {
+    /// The timestamp to sample from the source clip for a given scene time.
+    ///
+    /// Honours `trim_end` on the picture the same way the audio track
+    /// already does: past `trim_end`, playback holds on the last in-window
+    /// frame instead of continuing to draw whatever the source contains
+    /// beyond the intended trim point. When `loop_video` is set, playback
+    /// wraps within `[trim_start, trim_end)` instead of clamping — falling
+    /// back to the source's own probed duration as the loop window only
+    /// when `trim_end` is absent, since that is the only case where the
+    /// window cannot otherwise be known at all.
+    fn effective_source_time(&self, ctx_time: f64) -> f64 {
+        let rate = self.playback_rate.unwrap_or(1.0);
+        let trim_start = self.trim_start.unwrap_or(0.0);
+        let raw = trim_start + ctx_time * rate;
+
+        if let Some(end) = self.trim_end {
+            if end > trim_start {
+                return if self.loop_video == Some(true) {
+                    trim_start + (raw - trim_start).rem_euclid(end - trim_start)
+                } else {
+                    raw.min(end)
+                };
+            }
+        } else if self.loop_video == Some(true) {
+            if let Some(duration) = video_duration_secs(&self.src) {
+                if duration > trim_start {
+                    return trim_start + (raw - trim_start).rem_euclid(duration - trim_start);
+                }
+            }
+        }
+
+        raw
+    }
+}
+
 impl Painter for Video {
     fn paint_content(
         &self,
@@ -100,9 +164,7 @@ impl Painter for Video {
         _props: &AnimatedProperties,
         ctx: &PaintCtx,
     ) {
-        let rate = self.playback_rate.unwrap_or(1.0);
-        let trim_start = self.trim_start.unwrap_or(0.0);
-        let source_time = trim_start + ctx.time * rate;
+        let source_time = self.effective_source_time(ctx.time);
         let width = layout.width as u32;
         let height = layout.height as u32;
 
diff --git a/crates/rustmotion-components/tests/audit_ws_d.rs b/crates/rustmotion-components/tests/audit_ws_d.rs
index 3cb43373..e884b076 100644
--- a/crates/rustmotion-components/tests/audit_ws_d.rs
+++ b/crates/rustmotion-components/tests/audit_ws_d.rs
@@ -186,3 +186,98 @@ fn fill_fit_still_stretches_to_the_whole_box() {
         "fill must cover every corner"
     );
 }
+
+// ─── `trim_end` was honoured only on the extracted audio ───────────────────
+
+/// Frames beyond `trim_end` sit in the cache (simulating a preextraction
+/// window, or a direct extraction, wider than the intended trim), so the
+/// picture path must never pick one of them once `trim_end` is set: past
+/// `trim_end`, playback holds on the last in-window frame. Before the fix,
+/// `source_time` had no upper bound at all — querying past `trim_end` on a
+/// cache/source that extends further would draw whatever sits further
+/// along the source, not the frame at the trim boundary.
+#[test]
+fn trim_end_clamps_playback_instead_of_running_past_it() {
+    let src = unique_src("trimend");
+    let cache_key = format!("{src}:20x20");
+    let frames = vec![
+        (0.0, solid_rgba([255, 0, 0, 255], 2, 2), 2, 2),
+        (0.5, solid_rgba([0, 0, 255, 255], 2, 2), 2, 2),
+        (1.0, solid_rgba([0, 255, 0, 255], 2, 2), 2, 2),
+        (1.5, solid_rgba([128, 0, 128, 255], 2, 2), 2, 2),
+        (2.0, solid_rgba([255, 165, 0, 255], 2, 2), 2, 2),
+    ];
+    video_frame_cache().insert(cache_key, Arc::new(frames));
+
+    let v = video(&src, ImageFit::Fill, Some(0.0), Some(1.0), None);
+    let ctx = ctx_at(1.8);
+    let pixels = paint_and_read(&v, &ctx, 20, 20, false);
+
+    assert_eq!(
+        px(&pixels, 20, 10, 10),
+        [0, 255, 0, 255],
+        "past trim_end, playback must clamp to the frame at trim_end (green), not the frame \
+         nearest the unclamped query time (orange)"
+    );
+}
+
+// ─── `loop_video` made neither the picture nor the audio loop ─────────────
+
+/// Cache frames only cover `[0.0, 1.0)`; `trim_end: Some(1.0)` gives
+/// `loop_video` a window to wrap within without needing a real source file
+/// to probe. Querying at `ctx.time = 2.1` (raw source time 2.1s, i.e. "2
+/// full loops plus 0.1s") must land near 0.1s once wrapped — nearest to
+/// that among `{0.0, 0.25, 0.5, 0.75}` is red. Before this fix, the same
+/// query — with the trim-end clamp from the previous test already in place
+/// but no loop branch yet — clamped to `min(2.1, 1.0) = 1.0`, whose nearest
+/// cached frame is yellow: a clearly different pixel, which is what proves
+/// this test is exercising the loop path and not being masked by the clamp.
+#[test]
+fn loop_video_wraps_playback_within_the_trim_window() {
+    let src = unique_src("loop");
+    let cache_key = format!("{src}:20x20");
+    let frames = vec![
+        (0.0, solid_rgba([255, 0, 0, 255], 2, 2), 2, 2),
+        (0.25, solid_rgba([0, 255, 0, 255], 2, 2), 2, 2),
+        (0.5, solid_rgba([0, 0, 255, 255], 2, 2), 2, 2),
+        (0.75, solid_rgba([255, 255, 0, 255], 2, 2), 2, 2),
+    ];
+    video_frame_cache().insert(cache_key, Arc::new(frames));
+
+    let v = video(&src, ImageFit::Fill, Some(0.0), Some(1.0), Some(true));
+    let ctx = ctx_at(2.1);
+    let pixels = paint_and_read(&v, &ctx, 20, 20, false);
+
+    assert_eq!(
+        px(&pixels, 20, 10, 10),
+        [255, 0, 0, 255],
+        "looping must wrap the query time back into the window (nearest: red), not clamp to \
+         the window's own end (nearest: yellow)"
+    );
+}
+
+/// Without `loop_video`, a `trim_end`-bounded video must still clamp
+/// (unaffected by the loop branch existing) rather than wrap — the same
+/// scenario as the wrap test above, minus the flag.
+#[test]
+fn without_loop_video_playback_still_clamps_not_wraps() {
+    let src = unique_src("no-loop");
+    let cache_key = format!("{src}:20x20");
+    let frames = vec![
+        (0.0, solid_rgba([255, 0, 0, 255], 2, 2), 2, 2),
+        (0.25, solid_rgba([0, 255, 0, 255], 2, 2), 2, 2),
+        (0.5, solid_rgba([0, 0, 255, 255], 2, 2), 2, 2),
+        (0.75, solid_rgba([255, 255, 0, 255], 2, 2), 2, 2),
+    ];
+    video_frame_cache().insert(cache_key, Arc::new(frames));
+
+    let v = video(&src, ImageFit::Fill, Some(0.0), Some(1.0), None);
+    let ctx = ctx_at(2.1);
+    let pixels = paint_and_read(&v, &ctx, 20, 20, false);
+
+    assert_eq!(
+        px(&pixels, 20, 10, 10),
+        [255, 255, 0, 255],
+        "no loop_video: must clamp to the window's end (nearest: yellow), not wrap"
+    );
+}

From 0a0d175693ce6b708b719c804b37938a300c3b9d Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:05:47 +0200
Subject: [PATCH 36/56] refactor(scene): paint decorative fullscreen through
 the box tree (#283)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Every non-decorative node is timed by `PaintWindow::contains` — `self.end.is_none_or(|e| t < e)` (rustmotion-core/src/engine/box_tree.rs:43), a half-open window — and gets its effects from `box_builder::effective_effects` (legacy_dispatch.rs:110), which folds in `timeline` steps and `style.transition` keyframes. This second path uses an inclusive `time > e` and calls `a.animation_effects()` raw. `Particle` declares `timeline: Vec<TimelineStep>` (particle.rs:57), so a particle's timeline steps and transition keyframes are silently dropped, and its `end_at` keeps it visible for one extra frame — but only in a `world` view, since this is the sole call site (scene.rs:1130). The same particle in a `slide` view behaves correctly. A component whose behaviour depends on which view type contains it is invisible to tests written against either one.

Refs #220
---
 .../src/engine/render/background.rs           |  92 ++++++++++--
 crates/rustmotion/src/engine/render/scene.rs  |  33 ++---
 crates/rustmotion/tests/audit_ws_e.rs         | 139 +++++++++++++++++-
 3 files changed, 224 insertions(+), 40 deletions(-)

diff --git a/crates/rustmotion/src/engine/render/background.rs b/crates/rustmotion/src/engine/render/background.rs
index 2c5d719b..ef95320e 100644
--- a/crates/rustmotion/src/engine/render/background.rs
+++ b/crates/rustmotion/src/engine/render/background.rs
@@ -567,6 +567,12 @@ fn draw_bg_pixel_grid(
 }
 
 /// Tiled heropattern background.
+///
+/// The tile is rasterized once at `cfg.scale`, using `heropattern_raster_size`
+/// and a matching `resvg` render transform, then tiled 1:1 by the shader.
+/// It used to be rasterized at 1x and magnified by the shader's own matrix
+/// instead, which turned the vector source into hard nearest-neighbour
+/// blocks above `scale: 1` and aliased it below `scale: 1`.
 fn draw_bg_heropattern(
     canvas: &Canvas,
     cfg: &HeropatternConfig,
@@ -584,7 +590,6 @@ fn draw_bg_heropattern(
         return;
     }
 
-    // Build the SVG source with color/opacity substituted
     let svg_content = format!(
         r#"<svg xmlns="http://www.w3.org/2000/svg" width="{}" height="{}" viewBox="0 0 {} {}">{}</svg>"#,
         def.width,
@@ -596,20 +601,23 @@ fn draw_bg_heropattern(
             .replace("{{opacity}}", &cfg.opacity.to_string()),
     );
 
-    // Render one tile via usvg/resvg
     let opt = usvg::Options::default();
     let Ok(tree) = usvg::Tree::from_data(svg_content.as_bytes(), &opt) else {
         return;
     };
 
-    let pw = def.width.ceil() as u32;
-    let ph = def.height.ceil() as u32;
+    let (pw, ph) = heropattern_raster_size(def.width, def.height, cfg.scale);
     let Some(mut pixmap) = tiny_skia::Pixmap::new(pw, ph) else {
         return;
     };
-    resvg::render(&tree, tiny_skia::Transform::default(), &mut pixmap.as_mut());
+    let render_scale_x = pw as f32 / def.width;
+    let render_scale_y = ph as f32 / def.height;
+    resvg::render(
+        &tree,
+        tiny_skia::Transform::from_scale(render_scale_x, render_scale_y),
+        &mut pixmap.as_mut(),
+    );
 
-    // Convert to Skia image
     let info = ImageInfo::new(
         (pw as i32, ph as i32),
         ColorType::RGBA8888,
@@ -625,16 +633,10 @@ fn draw_bg_heropattern(
         return;
     };
 
-    // Build a tiled shader from the tile image
-    let matrix = if cfg.scale != 1.0 {
-        Some(skia_safe::Matrix::scale((cfg.scale, cfg.scale)))
-    } else {
-        None
-    };
     let Some(shader) = tile_image.to_shader(
         (skia_safe::TileMode::Repeat, skia_safe::TileMode::Repeat),
-        skia_safe::SamplingOptions::default(),
-        matrix.as_ref(),
+        skia_safe::SamplingOptions::new(skia_safe::FilterMode::Linear, skia_safe::MipmapMode::None),
+        None,
     ) else {
         return;
     };
@@ -655,6 +657,21 @@ fn draw_bg_heropattern(
     );
 }
 
+/// Pixel size to rasterize one heropattern tile at, so the vector source is
+/// re-rendered crisp at `scale` instead of rasterized at the pattern's
+/// native `(width, height)` and then magnified. Clamped to `MAX_TILE_PX`
+/// per axis: `HeropatternConfig::scale` has no upper bound in the schema, so
+/// an unclamped scale could ask for an arbitrarily large pixmap allocation.
+/// A clamped tile still tiles seamlessly with itself — it just renders
+/// smaller than an extreme `scale` asked for, which is the trade the "sane
+/// maximum" this is named for is making.
+fn heropattern_raster_size(width: f32, height: f32, scale: f32) -> (u32, u32) {
+    const MAX_TILE_PX: f32 = 4096.0;
+    let pw = (width * scale).ceil().clamp(1.0, MAX_TILE_PX) as u32;
+    let ph = (height * scale).ceil().clamp(1.0, MAX_TILE_PX) as u32;
+    (pw, ph)
+}
+
 /// Interpolate two AnimatedBackground structs. `t` goes from 0.0 (fully `a`) to 1.0 (fully `b`).
 #[allow(dead_code)]
 pub(super) fn interpolate_animated_bg(
@@ -1523,3 +1540,50 @@ mod heropattern_period_tests {
         assert!(spacing_x >= 20.0);
     }
 }
+
+#[cfg(test)]
+mod heropattern_raster_tests {
+    //! The heropattern tile used to be rasterized at 1x (the
+    //! pattern's native width/height) and then magnified by the shader's
+    //! own matrix with nearest-neighbour sampling — blocky above `scale: 1`,
+    //! aliased below it. `heropattern_raster_size` must honour `scale`
+    //! directly in the raster resolution instead.
+
+    use super::*;
+
+    #[test]
+    fn raster_size_scales_with_cfg_scale_not_pinned_to_1x() {
+        let (pw, ph) = heropattern_raster_size(32.0, 64.0, 4.0);
+        assert_eq!(
+            (pw, ph),
+            (128, 256),
+            "the pixmap must be sized for the scaled tile, not the pattern's native 32x64"
+        );
+    }
+
+    #[test]
+    fn raster_size_matches_the_pattern_exactly_at_scale_1() {
+        assert_eq!(heropattern_raster_size(32.0, 64.0, 1.0), (32, 64));
+    }
+
+    #[test]
+    fn raster_size_is_clamped_for_an_unbounded_scale() {
+        let (pw, ph) = heropattern_raster_size(32.0, 64.0, 100_000.0);
+        assert!(
+            pw <= 4096 && ph <= 4096,
+            "an extreme scale must not attempt an unbounded pixmap allocation, got {pw}x{ph}"
+        );
+    }
+
+    #[test]
+    fn draw_bg_heropattern_does_not_panic_at_an_extreme_scale() {
+        let mut surface = skia_safe::surfaces::raster_n32_premul((64, 64)).expect("surface");
+        let cfg = HeropatternConfig {
+            pattern: "aztec".to_string(),
+            color: "#FFFFFF".to_string(),
+            opacity: 0.1,
+            scale: 100_000.0,
+        };
+        draw_bg_heropattern(surface.canvas(), &cfg, 0.0, 64.0, 64.0);
+    }
+}
diff --git a/crates/rustmotion/src/engine/render/scene.rs b/crates/rustmotion/src/engine/render/scene.rs
index dde851e3..cf7d96f2 100644
--- a/crates/rustmotion/src/engine/render/scene.rs
+++ b/crates/rustmotion/src/engine/render/scene.rs
@@ -553,6 +553,13 @@ fn render_with_new_pipeline_iter<'a, I>(
 /// Paint a decorative leaf (e.g. Particle) over the full viewport without
 /// going through taffy. Resolves animations and dispatches to
 /// `Painter::paint_content` directly with a viewport-sized `BoxLayout`.
+///
+/// Visibility and effects go through the same `PaintWindow::contains` and
+/// `effective_effects` the ordinary `paint_tree` dispatch uses (see
+/// `box_builder::effective_effects`'s doc comment), rather than re-deriving
+/// both by hand — a component whose `timeline`/`style.transition` state or
+/// exact `end_at` boundary only worked in one of the two dispatch paths used
+/// to be invisible to tests written against either one alone.
 fn paint_decorative_fullscreen(
     canvas: &Canvas,
     child: &ChildComponent,
@@ -560,34 +567,22 @@ fn paint_decorative_fullscreen(
     viewport_h: f32,
     ctx: &RenderContext,
 ) {
+    use rustmotion_components::box_builder::effective_effects;
     use rustmotion_core::engine::animator::{resolve_props_for_effects, AnimatedProperties};
+    use rustmotion_core::engine::box_tree::PaintWindow;
     use rustmotion_core::engine::layout_pass::BoxLayout;
     use rustmotion_core::traits::PaintCtx;
 
     let time = ctx.time.seconds();
     if let Some(timed) = child.component.as_timed() {
-        let (start_at, end_at) = timed.timing();
-        if let Some(s) = start_at {
-            if time < s {
-                return;
-            }
-        }
-        if let Some(e) = end_at {
-            if time > e {
-                return;
-            }
+        let (start, end) = timed.timing();
+        if !(PaintWindow { start, end }).contains(time) {
+            return;
         }
     }
 
-    let props = match child.component.as_animatable() {
-        Some(a) => {
-            let effects = a.animation_effects();
-            if effects.is_empty() {
-                AnimatedProperties::default()
-            } else {
-                resolve_props_for_effects(effects, time, ctx.scene_duration)
-            }
-        }
+    let props = match effective_effects(&child.component, 0.0) {
+        Some(effects) => resolve_props_for_effects(&effects, time, ctx.scene_duration),
         None => AnimatedProperties::default(),
     };
     if props.opacity <= 0.0 {
diff --git a/crates/rustmotion/tests/audit_ws_e.rs b/crates/rustmotion/tests/audit_ws_e.rs
index 5a2f31eb..9b0e92ab 100644
--- a/crates/rustmotion/tests/audit_ws_e.rs
+++ b/crates/rustmotion/tests/audit_ws_e.rs
@@ -1,18 +1,143 @@
-//! Regression tests — audit round chantier/audit-2026-09, workstream E
-//! (animated backgrounds & the scene render path).
+//! Regression tests — workstream E (animated backgrounds & the scene render
+//! path).
 //!
-//! Two of the four findings are bugs in fully private
-//! rendering internals (`background.rs`'s `tile_spacing`/`compute_scroll_offset`/
+//! Some of the covered defects are bugs in fully private rendering
+//! internals (`background.rs`'s `tile_spacing`/`compute_scroll_offset`/
 //! `draw_bg_heropattern`) that this crate never exposes past its `pub`
 //! surface — an external integration test crate like this one cannot name
 //! them. Their regression tests live as `#[cfg(test)]` modules inside
 //! `crates/rustmotion/src/engine/render/background.rs` itself, following
 //! that file's own pre-existing convention (`scroll_offset_wrap_tests`,
 //! `pixel_grid_tests`, `grid_lines_tests`, `halo_opacity_tests`) for testing
-//! renderer-private logic directly. This file carries the findings that are
+//! renderer-private logic directly. This file carries the defects that are
 //! genuinely reachable through the crate's public API.
-//!
-//! One section per finding: the paint path, then colour templating.
 
 use rustmotion::encode::video::{build_frame_tasks, render_frame_task, FrameTask};
 use rustmotion::loader::load_scenario_from_source;
+
+/// Render a single `FrameTask::WorldFrame` at `frame_in_view`, decoded from
+/// `scenario_json`. Panics (with a message naming the missing frame) if no
+/// such world frame exists in the built schedule — a test bug, not a
+/// render-time failure, should fail loudly here.
+fn render_world_frame(scenario_json: &serde_json::Value, frame_in_view: u32) -> Vec<u8> {
+    let scenario = load_scenario_from_source(None, Some(&scenario_json.to_string()))
+        .expect("scenario is schema-valid");
+    let tasks = build_frame_tasks(&scenario);
+    let task = tasks
+        .iter()
+        .find(
+            |t| matches!(t, FrameTask::WorldFrame { frame_in_view: f, .. } if *f == frame_in_view),
+        )
+        .unwrap_or_else(|| panic!("no WorldFrame task at frame_in_view={frame_in_view}"));
+    render_frame_task(&scenario.video, &scenario, task).expect("frame renders")
+}
+
+/// Count pixels that read as the particle's pure-green marker colour
+/// (`#00FF00`) against the scenario's plain black background — a stand-in
+/// for "is the decorative child visible in this frame" that doesn't depend
+/// on knowing any particle's exact on-screen position.
+fn green_pixel_count(buf: &[u8]) -> usize {
+    buf.chunks_exact(4)
+        .filter(|px| px[1] > 100 && px[0] < 80 && px[2] < 80)
+        .count()
+}
+
+mod decorative_dispatch_parity {
+    //! `paint_decorative_fullscreen` (the world-view-only path that paints
+    //! decorative children like `particle` without going through the box
+    //! tree) used to re-derive visibility and effects by hand instead of
+    //! calling `PaintWindow::contains` / `box_builder::effective_effects`
+    //! like every other paint path does. Two independent symptoms: an
+    //! inclusive `end_at` (visible one frame too long) and dropped
+    //! `timeline` animation effects.
+
+    use super::*;
+
+    const FPS: u32 = 10;
+
+    fn world_scenario(particle_extra: serde_json::Value) -> serde_json::Value {
+        let mut particle = serde_json::json!({
+            "type": "particle",
+            "particle_type": "snow",
+            "count": 30,
+            "colors": ["#00FF00"],
+            "size_range": {"min": 6, "max": 6},
+            "speed": 0.0,
+        });
+        particle
+            .as_object_mut()
+            .unwrap()
+            .extend(particle_extra.as_object().unwrap().clone());
+
+        serde_json::json!({
+            "video": {"width": 64, "height": 64, "fps": FPS, "background": "#000000"},
+            "composition": [
+                {"type": "world", "scenes": [
+                    {"duration": 2.0, "children": [particle]}
+                ]}
+            ]
+        })
+    }
+
+    /// `end_at` is a half-open window: the child must already be gone
+    /// exactly at `end_at`, not still visible for one extra frame past it.
+    #[test]
+    fn end_at_is_a_half_open_window_not_inclusive() {
+        let end_at = 0.5;
+        let scenario = world_scenario(serde_json::json!({ "end_at": end_at }));
+        let frame_just_before_end_at = (end_at * FPS as f64) as u32 - 1;
+        let frame_at_end_at = (end_at * FPS as f64) as u32;
+
+        let before = render_world_frame(&scenario, frame_just_before_end_at);
+        assert!(
+            green_pixel_count(&before) > 0,
+            "the particle must still be visible just before its end_at"
+        );
+
+        let at_boundary = render_world_frame(&scenario, frame_at_end_at);
+        assert_eq!(
+            green_pixel_count(&at_boundary),
+            0,
+            "end_at is a half-open window ([start, end)): the particle must already be gone \
+             exactly at end_at, not one extra frame later"
+        );
+    }
+
+    /// A `timeline` step's `animation` entries must be folded into the
+    /// resolved props like every other paint path does, not silently
+    /// dropped because only `style.animation` was read.
+    #[test]
+    fn timeline_animation_effects_are_not_silently_dropped() {
+        let fade_out_at = 0.5;
+        let scenario = world_scenario(serde_json::json!({
+            "timeline": [{
+                "at": 0.0,
+                "animation": [{
+                    "name": "keyframes",
+                    "keyframes": [{
+                        "property": "opacity",
+                        "keyframes": [
+                            {"time": 0.0, "value": 1.0},
+                            {"time": fade_out_at, "value": 0.0}
+                        ]
+                    }]
+                }]
+            }]
+        }));
+
+        let early = render_world_frame(&scenario, 0);
+        assert!(
+            green_pixel_count(&early) > 0,
+            "the particle should be visible at t=0, before the timeline fade-out completes"
+        );
+
+        let frame_well_past_fade_out = (fade_out_at * FPS as f64) as u32 * 3;
+        let late = render_world_frame(&scenario, frame_well_past_fade_out);
+        assert_eq!(
+            green_pixel_count(&late),
+            0,
+            "a timeline step's animation effects must apply to a decorative child, not be \
+             silently dropped"
+        );
+    }
+}

From 477618fdf2174cdd7460efaaca5b4292a80c89d0 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:05:57 +0200
Subject: [PATCH 37/56] fix(background): canonicalize the heropattern colour
 before templating (#250)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`cfg.color` is a free-form `String` on `HeropatternConfig` (crates/rustmotion-core/src/schema/background.rs:216, `#[serde(default = "default_hero_color")]`) with no validation anywhere — `validate_animated_bg` (crates/rustmotion/src/include.rs:267-273) checks only that the pattern *name* resolves. The template lands inside a double-quoted attribute (`fill="{{color}}"`), so a colour containing `"` closes the attribute and injects arbitrary markup into the document usvg then parses. usvg 0.46's `Options::default()` keeps the default `ImageHrefResolver`, whose string resolver I read at usvg-0.46.0/src/parser/image.rs:85-112: it calls `std::fs::read(&path)` on any href that `path.exists()` accepts — with `resources_dir: None` an absolute path resolves to itself — so an injected `<image href="/absolute/path.png">` is decoded and painted into the frame. The impact is bounded (a scenario can already read a local image legitimately via `{"type":"image","src":"/abs/path.png"}`, and there is no network resolver), so this is a hardening gap rather than a privilege escalation. The quieter half is availability: any malformed splice makes `Tree::from_data` fail and line 601 `return`s, so the background silently does not render with no diagnostic at all.

Refs #220
---
 .../src/engine/render/background.rs           | 122 +++++++++++++++++-
 1 file changed, 120 insertions(+), 2 deletions(-)

diff --git a/crates/rustmotion/src/engine/render/background.rs b/crates/rustmotion/src/engine/render/background.rs
index ef95320e..80dd1fa3 100644
--- a/crates/rustmotion/src/engine/render/background.rs
+++ b/crates/rustmotion/src/engine/render/background.rs
@@ -566,6 +566,48 @@ fn draw_bg_pixel_grid(
     }
 }
 
+/// Re-emit a scenario-supplied heropattern colour as a canonical
+/// `#rrggbbaa` before it is spliced into generated SVG source.
+///
+/// `cfg.color` is free-form user input landing inside a double-quoted
+/// `fill="{{color}}"` attribute of hand-built SVG text; routing it through
+/// `color4f_from_hex` first guarantees the only characters that can ever
+/// reach the SVG are hex digits and `#`, so a colour string can never close
+/// the attribute and inject markup, whatever it contains.
+/// `color4f_from_hex` is infallible: unresolvable input resolves to the
+/// same opaque-magenta sentinel every other unresolved colour in this
+/// engine does, rather than passing the raw string through.
+fn canonical_hero_color(color: &str) -> String {
+    let c = color4f_from_hex(color);
+    format!(
+        "#{:02X}{:02X}{:02X}{:02X}",
+        (c.r.clamp(0.0, 1.0) * 255.0).round() as u8,
+        (c.g.clamp(0.0, 1.0) * 255.0).round() as u8,
+        (c.b.clamp(0.0, 1.0) * 255.0).round() as u8,
+        (c.a.clamp(0.0, 1.0) * 255.0).round() as u8,
+    )
+}
+
+/// `usvg::Options` for parsing a generated heropattern tile.
+///
+/// Neutralises the default `image_href_resolver`'s string resolver, which
+/// reads arbitrary files from disk for any `<image href="...">` it
+/// encounters (usvg-0.44.0's `ImageHrefResolver::default_string_resolver`).
+/// A heropattern tile never legitimately references an external image, so
+/// an `<image>` element reaching this parser can only be an injection —
+/// `canonical_hero_color` closes the splice that could put one there in the
+/// first place; this is the defence-in-depth half, for any other way one
+/// could arrive.
+fn heropattern_svg_options() -> usvg::Options<'static> {
+    usvg::Options {
+        image_href_resolver: usvg::ImageHrefResolver {
+            resolve_string: Box::new(|_, _| None),
+            ..usvg::ImageHrefResolver::default()
+        },
+        ..usvg::Options::default()
+    }
+}
+
 /// Tiled heropattern background.
 ///
 /// The tile is rasterized once at `cfg.scale`, using `heropattern_raster_size`
@@ -597,12 +639,16 @@ fn draw_bg_heropattern(
         def.width,
         def.height,
         def.svg_paths
-            .replace("{{color}}", &cfg.color)
+            .replace("{{color}}", &canonical_hero_color(&cfg.color))
             .replace("{{opacity}}", &cfg.opacity.to_string()),
     );
 
-    let opt = usvg::Options::default();
+    let opt = heropattern_svg_options();
     let Ok(tree) = usvg::Tree::from_data(svg_content.as_bytes(), &opt) else {
+        eprintln!(
+            "warning: heropattern '{}' (colour '{}') failed to parse as SVG — background not rendered",
+            cfg.pattern, cfg.color
+        );
         return;
     };
 
@@ -1587,3 +1633,75 @@ mod heropattern_raster_tests {
         draw_bg_heropattern(surface.canvas(), &cfg, 0.0, 64.0, 64.0);
     }
 }
+
+#[cfg(test)]
+mod heropattern_svg_injection_tests {
+    //! A scenario-supplied heropattern colour used to be spliced unescaped
+    //! into hand-built SVG source inside a double-quoted `fill="..."`
+    //! attribute, then parsed by usvg with its default (file-reading)
+    //! `image_href_resolver`. A colour containing a `"` could close the
+    //! attribute and inject arbitrary markup, including an `<image
+    //! href="...">` the default resolver would read straight off disk.
+
+    use super::*;
+
+    #[test]
+    fn a_colour_containing_a_double_quote_cannot_inject_markup() {
+        let payload = r#""/><image href="/etc/passwd"/><rect fill=""#;
+        let sanitized = canonical_hero_color(payload);
+        assert!(!sanitized.contains('"'), "got: {sanitized}");
+        assert!(!sanitized.contains('<'), "got: {sanitized}");
+        assert!(!sanitized.contains('&'), "got: {sanitized}");
+        assert_eq!(
+            sanitized.len(),
+            9,
+            "expected '#' + 8 hex digits, got: {sanitized}"
+        );
+        assert!(sanitized
+            .strip_prefix('#')
+            .unwrap()
+            .chars()
+            .all(|c| c.is_ascii_hexdigit()));
+    }
+
+    #[test]
+    fn a_valid_colour_round_trips_case_normalised() {
+        assert_eq!(canonical_hero_color("#1e3a8a55"), "#1E3A8A55");
+    }
+
+    #[test]
+    fn the_svg_options_never_read_a_file_from_disk() {
+        let scratch_path = std::env::temp_dir().join(format!(
+            "rustmotion-heropattern-injection-probe-{}.svg",
+            std::process::id()
+        ));
+        std::fs::write(
+            &scratch_path,
+            r#"<svg xmlns="http://www.w3.org/2000/svg" width="1" height="1"></svg>"#,
+        )
+        .expect("scratch SVG written");
+
+        let opt = heropattern_svg_options();
+        let resolved =
+            (opt.image_href_resolver.resolve_string)(scratch_path.to_str().unwrap(), &opt);
+
+        let _ = std::fs::remove_file(&scratch_path);
+
+        assert!(
+            resolved.is_none(),
+            "the string resolver must be neutralised, not read a real SVG file from disk"
+        );
+    }
+
+    #[test]
+    fn draw_bg_heropattern_survives_an_injection_attempt_without_panicking() {
+        let mut surface = skia_safe::surfaces::raster_n32_premul((32, 32)).expect("surface");
+        let cfg = HeropatternConfig {
+            pattern: "aztec".to_string(),
+            color: r#""/><image href="/etc/passwd"/><rect fill=""#.to_string(),
+            opacity: 1.0,
+            scale: 1.0,
+        };
+        draw_bg_heropattern(surface.canvas(), &cfg, 0.0, 32.0, 32.0);
+    }
+}

From 3a49519bd4835359f5c9859890287cf511511c28 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:06:07 +0200
Subject: [PATCH 38/56] fix(html): reject unsupported children of text tags
 (#254)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `TagKind::Text` arm never calls `element_to_value` on its children, so the whole guard layer (`StyleElementUnsupported`, `UnsupportedNativeElement`, `TagKind::Ignored`) is unreachable below `p/span/h1..h6/strong/em/label`. Executed against the real crate: `<p>Real <script>var secret = 1; alert(2);</script></p>` transpiles to `{"content":"Real var secret = 1; alert(2);","type":"text"}` — the JS source is rendered on screen; `<h1>Title<style>h1{color:#0f0}</style></h1>` gives `{"content":"Titleh1{color:#0f0}"}`; `<p>cap<img src="hero.png"></p>`, `<h1>t<svg>…</svg></h1>` and `<span>n=<rm-counter from="0" to="100"></rm-counter></span>` drop the img/svg/counter entirely and exit 0. This is a live regression of "constat 1" and "constat 3", which tests/silent_loss_regressions.rs asserts are fixed — the fix only ever covered the `Container` path.

Refs #220
---
 crates/rustmotion-html/src/element.rs      | 42 ++++++++++--
 crates/rustmotion-html/tests/audit_ws_f.rs | 76 ++++++++++++++++++++++
 2 files changed, 111 insertions(+), 7 deletions(-)

diff --git a/crates/rustmotion-html/src/element.rs b/crates/rustmotion-html/src/element.rs
index 337c8b2e..0722aa9d 100644
--- a/crates/rustmotion-html/src/element.rs
+++ b/crates/rustmotion-html/src/element.rs
@@ -37,20 +37,48 @@ fn tag_kind(tag: &str) -> TagKind {
     }
 }
 
-/// Concatenated text of an element and all its descendants.
-pub(crate) fn inner_text(handle: &Handle) -> String {
+/// Concatenated text of an element and all its descendants. Nested inline
+/// formatting tags (`strong`/`em`/`label`/…) flatten in, matching real HTML;
+/// `<script>`/`<title>`/`<noscript>`/`<template>`/`<head>` are skipped
+/// (never visually render either); `<style>` and any element with real,
+/// non-flattenable content (`<img>`, `<svg>`, `<video>`, `<rm-*>`, a nested
+/// container) are refused rather than having their source painted or their
+/// content silently vanish — see [`HtmlError::TextContentUnsupportedChild`].
+pub(crate) fn inner_text(handle: &Handle) -> Result<String, HtmlError> {
     let mut out = String::new();
-    collect_text(handle, &mut out);
-    out.trim().to_string()
+    collect_text(handle, &mut out)?;
+    Ok(out.trim().to_string())
 }
 
-fn collect_text(handle: &Handle, out: &mut String) {
+fn collect_text(handle: &Handle, out: &mut String) -> Result<(), HtmlError> {
     if let NodeData::Text { contents } = &handle.data {
         out.push_str(&contents.borrow());
+        return Ok(());
+    }
+    if matches!(handle.data, NodeData::Element { .. }) {
+        if let Some(tag) = tag_name(handle) {
+            if tag == "style" {
+                return Err(HtmlError::StyleElementUnsupported);
+            }
+            match tag_kind(&tag) {
+                TagKind::Ignored => return Ok(()),
+                TagKind::UnsupportedNative(suggestion) => {
+                    return Err(HtmlError::UnsupportedNativeElement {
+                        tag,
+                        suggestion: suggestion.to_string(),
+                    })
+                }
+                TagKind::Container | TagKind::Custom(_) => {
+                    return Err(HtmlError::TextContentUnsupportedChild { tag })
+                }
+                TagKind::Text => {}
+            }
+        }
     }
     for child in handle.children.borrow().iter() {
-        collect_text(child, out);
+        collect_text(child, out)?;
     }
+    Ok(())
 }
 
 /// Pull `style="..."` and `anim="..."` from an element's attributes into one
@@ -94,7 +122,7 @@ pub(crate) fn element_to_value(handle: &Handle) -> Result<Option<Value>, HtmlErr
             check_known_attrs(&tag, &attrs, KNOWN_NATIVE_ATTRS)?;
             let mut obj = Map::new();
             obj.insert("type".into(), Value::from("text"));
-            obj.insert("content".into(), Value::from(inner_text(handle)));
+            obj.insert("content".into(), Value::from(inner_text(handle)?));
             if let Some(style) = style_object(&attrs)? {
                 obj.insert("style".into(), style);
             }
diff --git a/crates/rustmotion-html/tests/audit_ws_f.rs b/crates/rustmotion-html/tests/audit_ws_f.rs
index 60e4a8a1..26165420 100644
--- a/crates/rustmotion-html/tests/audit_ws_f.rs
+++ b/crates/rustmotion-html/tests/audit_ws_f.rs
@@ -187,3 +187,79 @@ fn rgba_color_functional_notation_is_not_treated_as_multi_token() {
         json!("rgba(0, 0, 0, 0.5)")
     );
 }
+
+// ---------------------------------------------------------------------------
+// text-tag children bypass every guard — <script>/<style> source gets
+// painted, <img>/<svg>/<rm-*> vanish silently.
+// ---------------------------------------------------------------------------
+
+#[test]
+fn script_nested_inside_paragraph_is_not_painted() {
+    let html = r##"<rustmotion width="1920" height="1080"><scene duration="2"><p>Real <script>var secret = 1; alert(2);</script></p></scene></rustmotion>"##;
+    let v = html_to_scenario_value(html).expect("<script> inside <p> must not block transpilation");
+    assert_eq!(
+        v["scenes"][0]["children"][0]["content"],
+        json!("Real"),
+        "the script source must never be painted as text: {v}"
+    );
+}
+
+#[test]
+fn style_nested_inside_heading_is_refused_not_painted() {
+    let html = r##"<rustmotion width="1920" height="1080"><scene duration="2"><h1>Title<style>h1{color:#0f0}</style></h1></scene></rustmotion>"##;
+    let err = html_to_scenario_value(html)
+        .expect_err("<style> inside <h1> must be refused, not painted as text");
+    assert!(
+        matches!(err, HtmlError::StyleElementUnsupported),
+        "expected StyleElementUnsupported, got: {err:?}"
+    );
+}
+
+#[test]
+fn img_nested_inside_paragraph_is_refused_not_dropped() {
+    let html = r##"<rustmotion width="1920" height="1080"><scene duration="2"><p>cap<img src="hero.png"></p></scene></rustmotion>"##;
+    let err = html_to_scenario_value(html)
+        .expect_err("<img> inside <p> must be refused, not silently dropped");
+    match err {
+        HtmlError::UnsupportedNativeElement { tag, suggestion } => {
+            assert_eq!(tag, "img");
+            assert_eq!(suggestion, "rm-image");
+        }
+        other => panic!("expected UnsupportedNativeElement, got: {other:?}"),
+    }
+}
+
+#[test]
+fn svg_nested_inside_heading_is_refused_not_dropped() {
+    let html = r##"<rustmotion width="1920" height="1080"><scene duration="2"><h1>t<svg viewBox="0 0 10 10"><circle r="4"></circle></svg></h1></scene></rustmotion>"##;
+    let err = html_to_scenario_value(html)
+        .expect_err("<svg> inside <h1> must be refused, not silently dropped");
+    match err {
+        HtmlError::UnsupportedNativeElement { tag, suggestion } => {
+            assert_eq!(tag, "svg");
+            assert_eq!(suggestion, "rm-svg");
+        }
+        other => panic!("expected UnsupportedNativeElement, got: {other:?}"),
+    }
+}
+
+#[test]
+fn rm_counter_nested_inside_span_is_refused_not_dropped() {
+    let html = r##"<rustmotion width="1920" height="1080"><scene duration="2"><span>n=<rm-counter from="0" to="100"></rm-counter></span></scene></rustmotion>"##;
+    let err = html_to_scenario_value(html)
+        .expect_err("<rm-counter> inside <span> must be refused, not silently dropped");
+    match err {
+        HtmlError::TextContentUnsupportedChild { tag } => assert_eq!(tag, "rm-counter"),
+        other => panic!("expected TextContentUnsupportedChild, got: {other:?}"),
+    }
+}
+
+#[test]
+fn inline_formatting_tags_still_flatten_into_the_parent_text() {
+    let html = r##"<rustmotion width="1920" height="1080"><scene duration="2"><p>Real <strong>bold</strong> text</p></scene></rustmotion>"##;
+    let v = html_to_scenario_value(html).expect("nested inline formatting must still flatten");
+    assert_eq!(
+        v["scenes"][0]["children"][0]["content"],
+        json!("Real bold text")
+    );
+}

From fbf64bb8b9812aca678f14a6093927a470a9b1ae Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:06:18 +0200
Subject: [PATCH 39/56] fix(html): preserve the document around the rustmotion
 element (#255)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All four write-back entry points (`set_inline_style`, `set_text_content`, `set_attribute`, `remove_inline_style`) re-serialize only the `<rustmotion>` element, and rustmotion-studio writes that string straight over the source file (editor/inspector.rs:2168 -> `write_and_note(path, &updated)`). Executed: a 281-byte document with `<!DOCTYPE html>`, `<html><head><meta charset="utf-8"></head><body>`, a leading `<!-- authored by hand -->` comment and a trailing comment becomes 150 bytes — doctype, head, meta, body and both outer comments gone — after one font-size tweak in the inspector. The transpiler happily accepts such documents (`find_element` is a document-wide DFS), so this is a supported authoring form being destroyed. The docstring's "formatting is normalized" does not cover deleting the surrounding document. Secondarily, `serialize_element` (lib.rs:488-497) does `let _ = serialize(...)` and `String::from_utf8(buf).unwrap_or_default()`, so a serializer failure would write an empty file rather than surface an error.

Refs #220
---
 crates/rustmotion-html/src/lib.rs          | 41 ++++++++++--
 crates/rustmotion-html/tests/audit_ws_f.rs | 76 ++++++++++++++++++++++
 2 files changed, 110 insertions(+), 7 deletions(-)

diff --git a/crates/rustmotion-html/src/lib.rs b/crates/rustmotion-html/src/lib.rs
index 69d9ea43..a5a788bb 100644
--- a/crates/rustmotion-html/src/lib.rs
+++ b/crates/rustmotion-html/src/lib.rs
@@ -401,7 +401,7 @@ pub fn set_inline_style(html: &str, pointer: &str, prop: &str, value: &str) -> O
     let root = find_element(&dom.document, "rustmotion")?;
     let target = resolve_pointer(&root, pointer)?;
     set_style_attr(&target, prop, value)?;
-    Some(serialize_element(&root))
+    splice_rustmotion_subtree(html, &root)
 }
 
 /// Replace the text content of the element addressed by the JSON pointer with
@@ -413,7 +413,7 @@ pub fn set_text_content(html: &str, pointer: &str, text: &str) -> Option<String>
     let root = find_element(&dom.document, "rustmotion")?;
     let target = resolve_pointer(&root, pointer)?;
     set_text(&target, text)?;
-    Some(serialize_element(&root))
+    splice_rustmotion_subtree(html, &root)
 }
 
 /// Set or replace a plain attribute on the element addressed by the JSON
@@ -429,7 +429,7 @@ pub fn set_attribute(html: &str, pointer: &str, name: &str, value: &str) -> Opti
     let root = find_element(&dom.document, "rustmotion")?;
     let target = resolve_pointer(&root, pointer)?;
     set_attr(&target, name, value)?;
-    Some(serialize_element(&root))
+    splice_rustmotion_subtree(html, &root)
 }
 
 /// Remove one inline `style` property from the element addressed by the JSON
@@ -441,7 +441,7 @@ pub fn remove_inline_style(html: &str, pointer: &str, prop: &str) -> Option<Stri
     let root = find_element(&dom.document, "rustmotion")?;
     let target = resolve_pointer(&root, pointer)?;
     remove_style_decl(&target, prop)?;
-    Some(serialize_element(&root))
+    splice_rustmotion_subtree(html, &root)
 }
 
 /// Upsert (or, for an empty value, remove) a plain attribute on an element.
@@ -600,15 +600,42 @@ fn upsert_decl(decls: &str, prop: &str, value: &str) -> String {
         .join("; ")
 }
 
-fn serialize_element(handle: &Handle) -> String {
+/// Re-serialize `root` (the mutated `<rustmotion>` subtree) and splice it
+/// back into `original` at the exact byte span its `<rustmotion>...
+/// </rustmotion>` element occupies there, leaving everything before and
+/// after — doctype, `<head>`, comments, anything else the author wrote —
+/// byte-for-byte untouched. `original` is used as the source of truth for
+/// that surrounding content rather than `root`'s own parsed document,
+/// because `parse_fragment_dom` parses in a body-fragment context, which
+/// does not retain a doctype at all and does not guarantee round-tripping
+/// `<html>`/`<head>`/`<body>` the way the author wrote them. Refuses
+/// (`None`) rather than write a corrupted file when the span can't be
+/// located (no `<rustmotion>`/`</rustmotion>` literal in `original`, e.g. an
+/// unclosed root) or the serializer itself fails.
+fn splice_rustmotion_subtree(original: &str, root: &Handle) -> Option<String> {
+    let open_start = original.find("<rustmotion")?;
+    let close_start = original.rfind("</rustmotion")?;
+    let close_end = close_start + original[close_start..].find('>')? + 1;
+    if close_end <= open_start {
+        return None;
+    }
+    let serialized = serialize_element(root).ok()?;
+    let mut out = String::with_capacity(original.len() + serialized.len());
+    out.push_str(&original[..open_start]);
+    out.push_str(&serialized);
+    out.push_str(&original[close_end..]);
+    Some(out)
+}
+
+fn serialize_element(handle: &Handle) -> Result<String, HtmlError> {
     let mut buf = Vec::new();
     let node: SerializableHandle = handle.clone().into();
     let opts = SerializeOpts {
         traversal_scope: TraversalScope::IncludeNode,
         ..Default::default()
     };
-    let _ = serialize(&mut buf, &node, opts);
-    String::from_utf8(buf).unwrap_or_default()
+    serialize(&mut buf, &node, opts).map_err(|e| HtmlError::SerializeFailed(e.to_string()))?;
+    String::from_utf8(buf).map_err(|e| HtmlError::SerializeFailed(e.to_string()))
 }
 
 #[cfg(test)]
diff --git a/crates/rustmotion-html/tests/audit_ws_f.rs b/crates/rustmotion-html/tests/audit_ws_f.rs
index 26165420..e8ab981a 100644
--- a/crates/rustmotion-html/tests/audit_ws_f.rs
+++ b/crates/rustmotion-html/tests/audit_ws_f.rs
@@ -263,3 +263,79 @@ fn inline_formatting_tags_still_flatten_into_the_parent_text() {
         json!("Real bold text")
     );
 }
+
+// ---------------------------------------------------------------------------
+// studio HTML write-back silently deletes everything outside
+// <rustmotion> in the author's file.
+// ---------------------------------------------------------------------------
+
+#[test]
+fn write_back_preserves_doctype_head_and_surrounding_comments() {
+    let html = concat!(
+        "<!DOCTYPE html>\n",
+        "<html><head><meta charset=\"utf-8\"></head><body>\n",
+        "<!-- authored by hand -->\n",
+        "<rustmotion width=\"100\" height=\"100\"><scene duration=\"2\">",
+        "<h1 style=\"font-size:96\">Hi</h1></scene></rustmotion>\n",
+        "<!-- trailing note -->\n",
+        "</body></html>\n",
+    );
+    let out = rustmotion_html::set_inline_style(html, "/scenes/0/children/0", "font-size", "120")
+        .expect("pointer resolves");
+    assert!(
+        out.contains("<!DOCTYPE html>"),
+        "doctype must survive: {out}"
+    );
+    assert!(
+        out.contains("<meta charset=\"utf-8\">"),
+        "head must survive: {out}"
+    );
+    assert!(
+        out.contains("<!-- authored by hand -->"),
+        "leading comment must survive: {out}"
+    );
+    assert!(
+        out.contains("<!-- trailing note -->"),
+        "trailing comment must survive: {out}"
+    );
+    assert!(
+        out.contains("font-size:120"),
+        "the edit itself must still apply: {out}"
+    );
+    let v = html_to_scenario_value(&out).expect("round-trips through the transpiler");
+    assert_eq!(
+        v["scenes"][0]["children"][0]["style"]["font-size"],
+        json!(120)
+    );
+}
+
+#[test]
+fn write_back_via_set_text_content_also_preserves_surrounding_document() {
+    let html = concat!(
+        "<!DOCTYPE html>\n",
+        "<!-- keep me -->\n",
+        "<rustmotion width=\"100\" height=\"100\"><scene duration=\"2\">",
+        "<h1>Hi</h1></scene></rustmotion>\n",
+        "<!-- keep me too -->\n",
+    );
+    let out = rustmotion_html::set_text_content(html, "/scenes/0/children/0", "Bonjour")
+        .expect("pointer resolves");
+    assert!(
+        out.contains("<!DOCTYPE html>"),
+        "doctype must survive: {out}"
+    );
+    assert!(out.contains("<!-- keep me -->"), "got: {out}");
+    assert!(out.contains("<!-- keep me too -->"), "got: {out}");
+    let v = html_to_scenario_value(&out).expect("round-trips through the transpiler");
+    assert_eq!(v["scenes"][0]["children"][0]["content"], json!("Bonjour"));
+}
+
+#[test]
+fn write_back_refuses_when_the_closing_tag_cannot_be_located_in_source() {
+    let html = r##"<rustmotion width="100" height="100"><scene duration="2"><h1 style="font-size:96">Hi</h1></scene>"##;
+    let out = rustmotion_html::set_inline_style(html, "/scenes/0/children/0", "font-size", "120");
+    assert!(
+        out.is_none(),
+        "must refuse rather than write a file it cannot faithfully reconstruct"
+    );
+}

From 0f3dc12b809ab632f274ae952c385a49e86b12de Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:06:29 +0200
Subject: [PATCH 40/56] fix(expand): bound the total nodes produced by for-each
 (#261)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`MAX_EXPANSION_DEPTH` bounds how deeply directives may nest, not how many nodes they produce, and nesting one `for-each` inside another's `template` is explicitly supported (`use_template_can_contain_a_nested_for_each`, expand.rs:1005). Each nesting level costs exactly +1 depth (resolve_entry recurses with `depth + 1` per produced node, while `walk_children` forwards `depth` unchanged), so up to 64 levels are legal and the output is the product of the array lengths. Four nested levels of 50 elements is 6.25M nodes from a file under 1 KB; eight levels of 10 is 10^8. Each iteration does a full `Value` deep-clone of the template plus a `substitute` walk, so the process hangs and OOMs during `expand_directives` — before validation, before any render, and with no diagnostic. An LLM-authored or third-party scenario reaches this through the documented public syntax; `--no-validate` is not needed.

Refs #220
---
 crates/rustmotion-core/src/expand.rs | 91 +++++++++++++++++++++++++---
 1 file changed, 81 insertions(+), 10 deletions(-)

diff --git a/crates/rustmotion-core/src/expand.rs b/crates/rustmotion-core/src/expand.rs
index 497a7d66..ea153e98 100644
--- a/crates/rustmotion-core/src/expand.rs
+++ b/crates/rustmotion-core/src/expand.rs
@@ -156,6 +156,23 @@ use crate::variables::substitute;
 /// `include::MAX_INCLUDE_DEPTH`'s role for the sibling mechanism.
 const MAX_EXPANSION_DEPTH: u32 = 64;
 
+/// Ceiling on the total number of nodes a single document's `for-each`
+/// expansion may produce, across every level of nesting combined.
+/// [`MAX_EXPANSION_DEPTH`] bounds how deep directives may nest, not how many
+/// nodes they produce — and nesting one `for-each` inside another's
+/// `template` is explicitly supported (`use_template_can_contain_a_nested_
+/// for_each` below), so the node count a legal, non-cyclic document can
+/// declare is the *product* of every level's array length, not their sum.
+/// Four nested levels of 50 elements is 6.25M nodes from a file under 1 KB.
+/// This is checked incrementally as each `for-each` directive is about to
+/// produce its items (see [`consume_node_budget`]), so a runaway product is
+/// rejected partway through, well before the full tree is ever materialized.
+const MAX_EXPANSION_NODES: u64 = 2_000_000;
+
+/// Cheap first line of defence ahead of [`MAX_EXPANSION_NODES`]: a single
+/// `for-each` directive's own array, before any nesting is even considered.
+const MAX_FOR_EACH_ITEMS: usize = 100_000;
+
 /// One entry of the top-level `components` map: a named, parameterised
 /// subtree. `params` reuses the exact shape of the scenario-level `config`
 /// block, except a param's `default` is optional — omitting it makes the
@@ -230,6 +247,7 @@ fn is_use(v: &Value) -> bool {
 /// not just which file.
 pub fn expand_directives(value: &mut Value, file_label: &str) -> Result<()> {
     let defs = extract_component_definitions(value, file_label)?;
+    let mut budget = MAX_EXPANSION_NODES;
 
     let Value::Object(root) = value else {
         return Ok(());
@@ -241,7 +259,15 @@ pub fn expand_directives(value: &mut Value, file_label: &str) -> Result<()> {
         for (i, mut scene) in scenes.into_iter().enumerate() {
             let scene_path = format!("scenes[{i}]");
             let mut stack = Vec::new();
-            walk_children(&mut scene, &defs, file_label, &scene_path, &mut stack, 0)?;
+            walk_children(
+                &mut scene,
+                &defs,
+                file_label,
+                &scene_path,
+                &mut stack,
+                0,
+                &mut budget,
+            )?;
             out.push(scene);
         }
         root.insert("scenes".to_string(), Value::Array(out));
@@ -256,7 +282,15 @@ pub fn expand_directives(value: &mut Value, file_label: &str) -> Result<()> {
                     for (si, mut scene) in scenes.into_iter().enumerate() {
                         let scene_path = format!("composition[{vi}].scenes[{si}]");
                         let mut stack = Vec::new();
-                        walk_children(&mut scene, &defs, file_label, &scene_path, &mut stack, 0)?;
+                        walk_children(
+                            &mut scene,
+                            &defs,
+                            file_label,
+                            &scene_path,
+                            &mut stack,
+                            0,
+                            &mut budget,
+                        )?;
                         out.push(scene);
                     }
                     vmap.insert("scenes".to_string(), Value::Array(out));
@@ -271,6 +305,25 @@ pub fn expand_directives(value: &mut Value, file_label: &str) -> Result<()> {
     Ok(())
 }
 
+/// Subtracts `n` from the shared expansion-node budget, or fails naming the
+/// limit and where it was hit. See [`MAX_EXPANSION_NODES`] for why
+/// this is checked once per `for-each` directive's item count rather than
+/// once per final node: it is the only point in the recursion where the
+/// multiplicative blow-up can be caught before the work that would produce
+/// it actually runs.
+fn consume_node_budget(budget: &mut u64, n: u64, file_label: &str, location: &str) -> Result<()> {
+    match budget.checked_sub(n) {
+        Some(remaining) => {
+            *budget = remaining;
+            Ok(())
+        }
+        None => Err(RustmotionError::Generic(format!(
+            "expansion node budget ({MAX_EXPANSION_NODES}) exceeded at '{file_label}: {location}' \
+             — for-each/use nesting multiplies past the limit"
+        ))),
+    }
+}
+
 /// Report `$name`s that survived both variable substitution and directive
 /// expansion.
 ///
@@ -339,6 +392,7 @@ fn walk_children(
     location: &str,
     stack: &mut Vec<String>,
     depth: u32,
+    budget: &mut u64,
 ) -> Result<()> {
     match value {
         Value::Object(map) => {
@@ -348,7 +402,7 @@ fn walk_children(
                     for (i, entry) in arr.into_iter().enumerate() {
                         let entry_loc = format!("{location}.children[{i}]");
                         expanded.extend(resolve_entry(
-                            entry, defs, file_label, &entry_loc, stack, depth,
+                            entry, defs, file_label, &entry_loc, stack, depth, budget,
                         )?);
                     }
                     map.insert("children".to_string(), Value::Array(expanded));
@@ -356,14 +410,14 @@ fn walk_children(
             }
             for (k, v) in map.iter_mut() {
                 if k == "children" {
-                    continue; // already fully expanded above
+                    continue;
                 }
-                walk_children(v, defs, file_label, location, stack, depth)?;
+                walk_children(v, defs, file_label, location, stack, depth, budget)?;
             }
         }
         Value::Array(arr) => {
             for v in arr.iter_mut() {
-                walk_children(v, defs, file_label, location, stack, depth)?;
+                walk_children(v, defs, file_label, location, stack, depth, budget)?;
             }
         }
         _ => {}
@@ -392,6 +446,7 @@ fn resolve_entry(
     location: &str,
     stack: &mut Vec<String>,
     depth: u32,
+    budget: &mut u64,
 ) -> Result<Vec<Value>> {
     if depth > MAX_EXPANSION_DEPTH {
         return Err(RustmotionError::ExpansionDepthExceeded {
@@ -411,13 +466,14 @@ fn resolve_entry(
                 &frag_loc,
                 stack,
                 depth + 1,
+                budget,
             )?);
         }
         return Ok(out);
     }
 
     if is_for_each(&entry) {
-        let produced = expand_for_each_directive(entry, file_label, location)?;
+        let produced = expand_for_each_directive(entry, file_label, location, budget)?;
         let mut out = Vec::with_capacity(produced.len());
         for (i, node) in produced.into_iter().enumerate() {
             let iter_loc = format!("{location}[{i}]");
@@ -428,6 +484,7 @@ fn resolve_entry(
                 &iter_loc,
                 stack,
                 depth + 1,
+                budget,
             )?);
         }
         return Ok(out);
@@ -444,17 +501,22 @@ fn resolve_entry(
             });
         }
         stack.push(name);
-        let result = resolve_entry(node, defs, file_label, location, stack, depth + 1);
+        let result = resolve_entry(node, defs, file_label, location, stack, depth + 1, budget);
         stack.pop();
         return result;
     }
 
     let mut node = entry;
-    walk_children(&mut node, defs, file_label, location, stack, depth)?;
+    walk_children(&mut node, defs, file_label, location, stack, depth, budget)?;
     Ok(vec![node])
 }
 
-fn expand_for_each_directive(entry: Value, file_label: &str, location: &str) -> Result<Vec<Value>> {
+fn expand_for_each_directive(
+    entry: Value,
+    file_label: &str,
+    location: &str,
+    budget: &mut u64,
+) -> Result<Vec<Value>> {
     let directive: ForEachDirective =
         serde_json::from_value(entry).map_err(|e| RustmotionError::ForEachDirectiveInvalid {
             path: format!("{file_label}: {location}"),
@@ -471,6 +533,15 @@ fn expand_for_each_directive(entry: Value, file_label: &str, location: &str) ->
         }
     };
 
+    if items.len() > MAX_FOR_EACH_ITEMS {
+        return Err(RustmotionError::Generic(format!(
+            "for-each at '{file_label}: {location}' has {} items, exceeding the per-directive \
+             cap of {MAX_FOR_EACH_ITEMS}",
+            items.len()
+        )));
+    }
+    consume_node_budget(budget, items.len() as u64, file_label, location)?;
+
     let mut out = Vec::with_capacity(items.len());
     for (idx, element) in items.into_iter().enumerate() {
         let mut bindings: HashMap<String, Value> = HashMap::new();

From a37916f1058ead1edf57b02597661fa25c48d31e Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:06:39 +0200
Subject: [PATCH 41/56] fix(include): require opt-in for remote includes (#262)

Any scenario handed to `rustmotion render`/`validate` can make the user's machine issue GETs to hosts of the author's choosing, with no host/scheme allowlist, no redirect policy, no timeout set on the call, and no `--offline` switch to refuse. On a developer laptop or a CI runner this reaches loopback services, RFC1918 addresses and cloud link-local metadata (169.254.169.254), and it doubles as a silent beacon that fires merely from *validating* a file (validation::load goes through the same `resolve_includes`). Fetching remote includes is clearly deliberate design, so the finding is the absence of any control around it, not the feature.

Refs #220
---
 crates/rustmotion/src/include.rs      | 217 +++++++++++++++++++++++---
 crates/rustmotion/tests/audit_ws_h.rs |  90 +++++++++++
 2 files changed, 288 insertions(+), 19 deletions(-)
 create mode 100644 crates/rustmotion/tests/audit_ws_h.rs

diff --git a/crates/rustmotion/src/include.rs b/crates/rustmotion/src/include.rs
index 32507cf8..dacb953d 100644
--- a/crates/rustmotion/src/include.rs
+++ b/crates/rustmotion/src/include.rs
@@ -1,3 +1,4 @@
+use std::net::{IpAddr, SocketAddr, ToSocketAddrs};
 use std::path::{Path, PathBuf};
 
 use crate::error::Result;
@@ -11,6 +12,30 @@ use crate::schema::{
 
 const MAX_INCLUDE_DEPTH: u8 = 8;
 
+/// Response-size cap for a remote `include` fetch. Scenario JSON is
+/// not expected to be large; this is deliberately far below ureq's own 10 MB
+/// default for `read_to_vec`/`read_to_string`.
+const MAX_REMOTE_INCLUDE_BYTES: u64 = 4 * 1024 * 1024;
+
+/// The CLI flag whose semantics this module implements the mechanism for:
+/// remote `include` is denied unless a caller explicitly opts in by passing
+/// `RemoteIncludePolicy::Allow` to [`resolve_includes_with_policy`]. Naming
+/// it here keeps the error message and the flag rustmotion's CLI is expected
+/// to expose in sync.
+const ALLOW_REMOTE_INCLUDE_FLAG: &str = "--allow-remote-include";
+
+/// Whether a [`resolve_includes_with_policy`] pass may perform outbound
+/// network requests for `include: "https://..."` directives ( remote
+/// fetching is deliberate design, but it previously had no allowlist and no
+/// opt-out — any scenario, including one merely being `validate`d, could
+/// make this process issue arbitrary GETs). Defaults to [`Self::Deny`].
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub enum RemoteIncludePolicy {
+    #[default]
+    Deny,
+    Allow,
+}
+
 /// Where the parent scenario was loaded from — determines how relative paths are resolved.
 pub enum IncludeSource {
     /// Loaded from a file; relative paths resolve against this file's directory.
@@ -20,7 +45,23 @@ pub enum IncludeSource {
 }
 
 /// Expand all include directives in a scenario, producing resolved views.
+///
+/// Remote (`http(s)://`) includes are denied by default — see
+/// [`resolve_includes_with_policy`] to opt in. This is exactly
+/// `resolve_includes_with_policy(scenario, source, RemoteIncludePolicy::Deny)`,
+/// kept as its own entry point so every existing caller stays secure by
+/// default without having to be rewritten to pass a policy.
 pub fn resolve_includes(scenario: Scenario, source: &IncludeSource) -> Result<ResolvedScenario> {
+    resolve_includes_with_policy(scenario, source, RemoteIncludePolicy::Deny)
+}
+
+/// Same as [`resolve_includes`], with explicit control over whether remote
+/// `include` directives may reach the network.
+pub fn resolve_includes_with_policy(
+    scenario: Scenario,
+    source: &IncludeSource,
+    remote_policy: RemoteIncludePolicy,
+) -> Result<ResolvedScenario> {
     let mut audio = scenario.audio;
     let mut included_paths = Vec::new();
     let has_scenes = !scenario.scenes.is_empty();
@@ -36,8 +77,14 @@ pub fn resolve_includes(scenario: Scenario, source: &IncludeSource) -> Result<Re
         // New format: composition with views
         let mut views = Vec::with_capacity(composition.len());
         for view in composition {
-            let mut scenes =
-                resolve_entries(view.scenes, source, 0, &mut audio, &mut included_paths)?;
+            let mut scenes = resolve_entries(
+                view.scenes,
+                source,
+                0,
+                &mut audio,
+                &mut included_paths,
+                remote_policy,
+            )?;
             for scene in &mut scenes {
                 resolve_scene_background(scene, templates)?;
             }
@@ -58,8 +105,14 @@ pub fn resolve_includes(scenario: Scenario, source: &IncludeSource) -> Result<Re
         views
     } else {
         // Backward compat: wrap top-level scenes in a single slide view
-        let mut scenes =
-            resolve_entries(scenario.scenes, source, 0, &mut audio, &mut included_paths)?;
+        let mut scenes = resolve_entries(
+            scenario.scenes,
+            source,
+            0,
+            &mut audio,
+            &mut included_paths,
+            remote_policy,
+        )?;
         for scene in &mut scenes {
             resolve_scene_background(scene, templates)?;
         }
@@ -88,6 +141,7 @@ fn resolve_entries(
     depth: u8,
     audio: &mut Vec<crate::schema::AudioTrack>,
     included_paths: &mut Vec<PathBuf>,
+    remote_policy: RemoteIncludePolicy,
 ) -> Result<Vec<Scene>> {
     let mut result = Vec::new();
 
@@ -103,8 +157,14 @@ fn resolve_entries(
                         path: directive.include.clone(),
                     });
                 }
-                let scenes =
-                    fetch_and_resolve(&directive, source, depth + 1, audio, included_paths)?;
+                let scenes = fetch_and_resolve(
+                    &directive,
+                    source,
+                    depth + 1,
+                    audio,
+                    included_paths,
+                    remote_policy,
+                )?;
                 result.extend(scenes);
             }
         }
@@ -119,12 +179,22 @@ fn fetch_and_resolve(
     depth: u8,
     audio: &mut Vec<crate::schema::AudioTrack>,
     included_paths: &mut Vec<PathBuf>,
+    remote_policy: RemoteIncludePolicy,
 ) -> Result<Vec<Scene>> {
     let is_remote =
         directive.include.starts_with("http://") || directive.include.starts_with("https://");
 
     let (json_str, child_source) = if is_remote {
-        let body = fetch_remote(&directive.include)?;
+        if remote_policy != RemoteIncludePolicy::Allow {
+            return Err(RustmotionError::Generic(format!(
+                "include '{}' is a remote URL, but remote includes are disabled by default \
+ — pass {ALLOW_REMOTE_INCLUDE_FLAG} to opt in",
+                directive.include
+            )));
+        }
+        let verified = verify_remote_url(&directive.include)?;
+        eprintln!("include: fetching remote scenario {}", verified.as_str());
+        let body = fetch_remote(&verified)?;
         let child_source = IncludeSource::File(PathBuf::from(&directive.include));
         (body, child_source)
     } else {
@@ -178,6 +248,7 @@ fn fetch_and_resolve(
         depth,
         audio,
         included_paths,
+        remote_policy,
     )?;
 
     // Apply scene index filter if specified
@@ -217,22 +288,130 @@ fn resolve_local_path(relative: &str, source: &IncludeSource) -> Result<PathBuf>
     }
 }
 
-fn fetch_remote(url: &str) -> Result<String> {
-    let response = ureq::get(url)
+/// A remote `include` URL that has already passed the SSRF policy check in
+/// [`verify_remote_url`] — every address its host resolves to was confirmed
+/// public. This is the only way to reach [`fetch_remote`]: an unchecked
+/// `&str` cannot be passed to it, by construction.
+struct VerifiedRemoteUrl(String);
+
+impl VerifiedRemoteUrl {
+    fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+/// Resolves `url`'s host and rejects it if any resolved address is not
+/// publicly routable: loopback, link-local (169.254.169.254, the cloud
+/// metadata endpoint, included), or an RFC1918/ULA private range.
+///
+/// This check runs once, ahead of the request `fetch_remote` makes moments
+/// later; a DNS answer that changes between this resolution and that
+/// connection ("DNS rebinding") is not defended against — the audit's
+/// remediation asks for a resolve-time check, and closing the rebinding gap
+/// fully would mean replacing `ureq`'s connector rather than configuring it.
+fn verify_remote_url(url: &str) -> Result<VerifiedRemoteUrl> {
+    let (host, port) = split_host_port(url)?;
+    let addrs: Vec<SocketAddr> = (host.as_str(), port)
+        .to_socket_addrs()
+        .map_err(|e| {
+            RustmotionError::Generic(format!("include '{url}' could not be resolved: {e}"))
+        })?
+        .collect();
+    if addrs.is_empty() {
+        return Err(RustmotionError::Generic(format!(
+            "include '{url}' resolved to no addresses"
+        )));
+    }
+    for addr in &addrs {
+        let ip = addr.ip().to_canonical();
+        if is_non_public(ip) {
+            return Err(RustmotionError::Generic(format!(
+                "include '{url}' resolves to {ip}, which is not a public address \
+                 (loopback/link-local/private range) — refusing to prevent SSRF"
+            )));
+        }
+    }
+    Ok(VerifiedRemoteUrl(url.to_string()))
+}
+
+fn is_non_public(ip: IpAddr) -> bool {
+    match ip {
+        IpAddr::V4(v4) => {
+            v4.is_loopback()
+                || v4.is_private()
+                || v4.is_link_local()
+                || v4.is_unspecified()
+                || v4.is_broadcast()
+                || v4.is_documentation()
+                || v4.is_multicast()
+        }
+        IpAddr::V6(v6) => {
+            v6.is_loopback()
+                || v6.is_unspecified()
+                || v6.is_unique_local()
+                || v6.is_unicast_link_local()
+                || v6.is_multicast()
+        }
+    }
+}
+
+/// Splits `scheme://[user:pass@]host[:port][/...]` into `(host, port)`,
+/// defaulting the port from the scheme. Deliberately minimal — this crate
+/// takes no `url` dependency for this, and only needs to know where to point
+/// the resolver; `ureq` itself is still the one that rejects a malformed URL
+/// when the actual request is made.
+fn split_host_port(url: &str) -> Result<(String, u16)> {
+    let (rest, default_port) = if let Some(rest) = url.strip_prefix("https://") {
+        (rest, 443)
+    } else if let Some(rest) = url.strip_prefix("http://") {
+        (rest, 80)
+    } else {
+        return Err(RustmotionError::Generic(format!(
+            "include '{url}' is not an http(s) URL"
+        )));
+    };
+    let authority = rest.split(['/', '?', '#']).next().unwrap_or(rest);
+    let authority = authority.rsplit('@').next().unwrap_or(authority);
+
+    if let Some(rest) = authority.strip_prefix('[') {
+        let end = rest.find(']').ok_or_else(|| {
+            RustmotionError::Generic(format!("include '{url}' has an unterminated IPv6 host"))
+        })?;
+        let host = rest[..end].to_string();
+        let port = rest[end + 1..]
+            .strip_prefix(':')
+            .and_then(|p| p.parse().ok())
+            .unwrap_or(default_port);
+        return Ok((host, port));
+    }
+
+    match authority.rsplit_once(':') {
+        Some((host, port_str)) => match port_str.parse() {
+            Ok(port) => Ok((host.to_string(), port)),
+            Err(_) => Ok((authority.to_string(), default_port)),
+        },
+        None => Ok((authority.to_string(), default_port)),
+    }
+}
+
+fn fetch_remote(url: &VerifiedRemoteUrl) -> Result<String> {
+    let response = rustmotion_core::engine::renderer::http_agent()
+        .get(url.as_str())
         .call()
         .map_err(|e| RustmotionError::IncludeRemoteFetch {
-            url: url.to_string(),
+            url: url.as_str().to_string(),
             reason: e.to_string(),
         })?;
-    let body =
-        response
-            .into_body()
-            .read_to_string()
-            .map_err(|e| RustmotionError::IncludeRemoteFetch {
-                url: url.to_string(),
-                reason: e.to_string(),
-            })?;
-    Ok(body)
+    response
+        .into_body()
+        .with_config()
+        .limit(MAX_REMOTE_INCLUDE_BYTES)
+        .lossy_utf8(true)
+        .read_to_string()
+        .map_err(|e| RustmotionError::IncludeRemoteFetch {
+            url: url.as_str().to_string(),
+            reason: e.to_string(),
+        })
 }
 
 // --- Background template resolution ---
diff --git a/crates/rustmotion/tests/audit_ws_h.rs b/crates/rustmotion/tests/audit_ws_h.rs
new file mode 100644
index 00000000..1a83b147
--- /dev/null
+++ b/crates/rustmotion/tests/audit_ws_h.rs
@@ -0,0 +1,90 @@
+//! Regression tests for the workstream H (untrusted scenario ingestion)
+//! audit finding that lives in the `rustmotion` crate:.
+//!
+//! Remote fetching for `include: "https://..."` is deliberate design; the
+//! finding is the absence of any control around it. These tests exercise
+//! `include::resolve_includes`/`resolve_includes_with_policy` directly
+//! rather than through `rustmotion::loader`, so they do not depend on the
+//! CLI wiring a sibling workstream owns.
+
+use rustmotion::include::{
+    resolve_includes, resolve_includes_with_policy, IncludeSource, RemoteIncludePolicy,
+};
+use rustmotion::schema::Scenario;
+
+fn scenario_with_remote_include(url: &str) -> Scenario {
+    serde_json::from_value(serde_json::json!({
+        "video": { "width": 100, "height": 100 },
+        "scenes": [{ "include": url }]
+    }))
+    .expect("scenario with a remote include parses")
+}
+
+// ----, part 1: remote includes are denied by default ----
+
+#[test]
+fn remote_include_is_denied_by_default() {
+    let scenario = scenario_with_remote_include("https://example.invalid/scenario.json");
+    let err = resolve_includes(scenario, &IncludeSource::Inline)
+        .expect_err("a remote include must be refused unless explicitly opted into");
+    let msg = err.to_string();
+    assert!(
+        msg.contains("disabled by default"),
+        "the denial must explain that remote includes are opt-in: {msg}"
+    );
+}
+
+#[test]
+fn remote_include_denial_names_the_opt_in() {
+    let scenario = scenario_with_remote_include("https://example.invalid/scenario.json");
+    let err =
+        resolve_includes_with_policy(scenario, &IncludeSource::Inline, RemoteIncludePolicy::Deny)
+            .expect_err("Deny must refuse the same way the default does");
+    assert!(
+        err.to_string().contains("--allow-remote-include"),
+        "the error should name the flag that opts in, for a CLI to surface: {err}"
+    );
+}
+
+// ----, part 2: once opted in, resolved addresses are still checked
+// against loopback/link-local/private ranges before any request is made ----
+
+#[test]
+fn opted_in_remote_include_still_refuses_the_cloud_metadata_endpoint() {
+    // A literal IP in the URL resolves without any DNS/network I/O (`(&str,
+    // u16): ToSocketAddrs` parses a numeric host directly), so this is a
+    // deterministic, offline test of the SSRF check itself.
+    let scenario = scenario_with_remote_include(
+        "http://169.254.169.254/latest/meta-data/iam/security-credentials/",
+    );
+    let err =
+        resolve_includes_with_policy(scenario, &IncludeSource::Inline, RemoteIncludePolicy::Allow)
+            .expect_err(
+                "the cloud metadata address must be refused even when remote includes are allowed",
+            );
+    let msg = err.to_string();
+    assert!(
+        msg.contains("169.254.169.254"),
+        "the error should name the disallowed address: {msg}"
+    );
+}
+
+#[test]
+fn opted_in_remote_include_still_refuses_loopback() {
+    let scenario = scenario_with_remote_include("http://127.0.0.1:8500/scenario.json");
+    let err =
+        resolve_includes_with_policy(scenario, &IncludeSource::Inline, RemoteIncludePolicy::Allow)
+            .expect_err("loopback must be refused even when remote includes are allowed");
+    assert!(err.to_string().contains("127.0.0.1"), "{err}");
+}
+
+#[test]
+fn opted_in_remote_include_still_refuses_rfc1918_private_ranges() {
+    let scenario = scenario_with_remote_include("http://10.0.0.5/scenario.json");
+    let err =
+        resolve_includes_with_policy(scenario, &IncludeSource::Inline, RemoteIncludePolicy::Allow)
+            .expect_err(
+                "an RFC1918 private address must be refused even when remote includes are allowed",
+            );
+    assert!(err.to_string().contains("10.0.0.5"), "{err}");
+}

From 3e5708b663229fbbe98f9eaafd6784b943a4d513 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:06:51 +0200
Subject: [PATCH 42/56] fix(components): paint table columns at their measured
 widths (#265)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`TableIntrinsic::compute_width` (intrinsic.rs:911-949) measures every header and every cell, keeps a per-column max (`col_widths[i] = col_widths[i].max(w + cell_padding * 2.0)`) and returns the **sum**. The painter then throws that per-column distribution away and gives each column `total_w / col_count`. For an uneven table (e.g. headers `["ID", "Description of the incident"]`, natural widths 60px and 400px → intrinsic 460px) the painter allocates 230px per column; the 400px column's text is drawn from `align_text_x` at a position computed against a 230px cell and there is no per-cell clip (table.rs:203-262 draws each cell with `draw_text_with_fallback` and only advances `col_x += cw`), so the text overlaps the neighbouring column or spills past the table's right edge. With `column_align: "right"` it spills backwards into the previous column. The measurer's own doc comment (intrinsic.rs:884-888) asserts the opposite: "Natural size formula (matches the painter exactly) ... otherwise each column gets `max(header_text_width + 2 × cell_padding, min_col_width)`" — the painter implements no such rule, and `compute_width` has no `min_col_width` either.

Refs #220
---
 crates/rustmotion-components/src/intrinsic.rs |  47 ++-----
 crates/rustmotion-components/src/table.rs     |  60 ++++++++-
 .../rustmotion-components/tests/audit_ws_i.rs | 123 +++++++++++++++---
 3 files changed, 168 insertions(+), 62 deletions(-)

diff --git a/crates/rustmotion-components/src/intrinsic.rs b/crates/rustmotion-components/src/intrinsic.rs
index eb016cf2..88c0dc0b 100644
--- a/crates/rustmotion-components/src/intrinsic.rs
+++ b/crates/rustmotion-components/src/intrinsic.rs
@@ -875,17 +875,18 @@ impl IntrinsicMeasure for TerminalIntrinsic {
 // Table intrinsic measurer
 // ─────────────────────────────────────────────────────────────────────────────
 
-use crate::table::{
-    Table, DEFAULT_CELL_PADDING, DEFAULT_FONT_SIZE as TABLE_FONT_SIZE, DEFAULT_ROW_HEIGHT_RATIO,
-};
+use crate::table::{Table, DEFAULT_FONT_SIZE as TABLE_FONT_SIZE, DEFAULT_ROW_HEIGHT_RATIO};
 
 /// Intrinsic measurer for [`Table`].
 ///
-/// Natural size formula (matches the painter exactly):
+/// Natural size formula (matches the painter exactly, since both now read
+/// the same per-column distribution — see [`Table::natural_column_widths`]):
 /// - `row_height = font_size × DEFAULT_ROW_HEIGHT_RATIO`
 /// - `height = (1 + row_count) × row_height`  (header + data rows)
-/// - `width`: if `column_widths` are provided, their sum; otherwise each
-///   column gets `max(header_text_width + 2 × cell_padding, min_col_width)`.
+/// - `width`: if `column_widths` are provided, their sum; otherwise the sum
+///   of `Table::natural_column_widths`, which the painter's own
+///   `resolve_column_widths` scales proportionally to whatever width the
+///   box actually laid out at.
 pub struct TableIntrinsic {
     row_height: f32,
     row_count: usize, // data rows only; header adds 1
@@ -909,44 +910,12 @@ impl TableIntrinsic {
     }
 
     fn compute_width(t: &Table, font_size: f32) -> f32 {
-        // Explicit column widths provided → sum them.
         if let Some(widths) = &t.column_widths {
             if !widths.is_empty() {
                 return widths.iter().sum();
             }
         }
-
-        // Measure each header with the bold font; add 2× cell_padding per column.
-        let font_style = skia_safe::FontStyle::bold();
-        let family = t.style.font_family.as_deref().unwrap_or("Inter");
-        let Ok(typeface) = typeface_with_fallback(family, font_style) else {
-            // Font unavailable: fall back to col_count × a reasonable minimum.
-            let col_count = t.headers.len().max(1) as f32;
-            return col_count * (TABLE_FONT_SIZE * 8.0 + DEFAULT_CELL_PADDING * 2.0);
-        };
-        let font = Font::from_typeface(typeface, font_size);
-        let emoji_font = emoji_typeface().map(|tf| Font::from_typeface(tf, font_size));
-        let cell_padding = t.cell_padding;
-
-        // Also consider data cell widths to size columns appropriately.
-        let col_count = t.headers.len().max(1);
-        let mut col_widths: Vec<f32> = vec![0.0; col_count];
-
-        for (i, header) in t.headers.iter().enumerate() {
-            let w = measure_text_with_fallback(header, &font, &emoji_font, 0.0);
-            col_widths[i] = col_widths[i].max(w + cell_padding * 2.0);
-        }
-        for row in &t.rows {
-            for (i, cell) in row.iter().enumerate() {
-                if i >= col_count {
-                    break;
-                }
-                let w = measure_text_with_fallback(cell, &font, &emoji_font, 0.0);
-                col_widths[i] = col_widths[i].max(w + cell_padding * 2.0);
-            }
-        }
-
-        col_widths.iter().sum()
+        t.natural_column_widths(font_size).iter().sum()
     }
 }
 
diff --git a/crates/rustmotion-components/src/table.rs b/crates/rustmotion-components/src/table.rs
index 05fbc996..ab882664 100644
--- a/crates/rustmotion-components/src/table.rs
+++ b/crates/rustmotion-components/src/table.rs
@@ -99,8 +99,14 @@ impl Table {
         Some(skia_safe::Font::from_typeface(typeface, font_size))
     }
 
-    /// Resolve column widths: use explicit widths if provided, else equal distribution.
-    fn resolve_column_widths(&self, total_w: f32) -> Vec<f32> {
+    /// Resolve column widths: explicit widths if provided (padded with an
+    /// equal share for any column left unspecified); otherwise
+    /// [`Self::natural_column_widths`] scaled proportionally so the columns
+    /// still sum to exactly `total_w`, whatever that box actually laid out
+    /// at (which — since taffy's intrinsic measurement and this painted
+    /// width can diverge, e.g. a `card` giving the table less room than its
+    /// natural size — is not always identical to the natural total).
+    fn resolve_column_widths(&self, total_w: f32, font_size: f32) -> Vec<f32> {
         let col_count = self.headers.len().max(1);
         if let Some(widths) = &self.column_widths {
             let mut result: Vec<f32> = widths.to_vec();
@@ -111,10 +117,52 @@ impl Table {
                 result.push(remaining / remaining_cols as f32);
             }
             result.truncate(col_count);
-            result
-        } else {
-            vec![total_w / col_count as f32; col_count]
+            return result;
+        }
+        let natural = self.natural_column_widths(font_size);
+        let natural_total: f32 = natural.iter().sum();
+        if natural_total <= 0.0 || total_w <= 0.0 {
+            return vec![total_w / col_count as f32; col_count];
+        }
+        let scale = total_w / natural_total;
+        natural.into_iter().map(|w| w * scale).collect()
+    }
+
+    /// Per-column natural width: each column's own header/cell text
+    /// (measured with the bold header font, matching `paint`'s header row)
+    /// plus `2 × cell_padding`, indexed like `headers`. Shared by
+    /// `TableIntrinsic::from_table` (which sums this for the box's natural
+    /// total width) and `resolve_column_widths` above (which scales it to
+    /// whatever width the box actually laid out at) — a single source for
+    /// the per-column distribution keeps the two from drifting apart the
+    /// way an even split and a content-fitted sum used to.
+    pub(crate) fn natural_column_widths(&self, font_size: f32) -> Vec<f32> {
+        let col_count = self.headers.len().max(1);
+        let font_style = skia_safe::FontStyle::bold();
+        let family = self.style.font_family.as_deref().unwrap_or("Inter");
+        let Ok(typeface) = typeface_with_fallback(family, font_style) else {
+            let min_col_w = DEFAULT_FONT_SIZE * 8.0 + DEFAULT_CELL_PADDING * 2.0;
+            return vec![min_col_w; col_count];
+        };
+        let font = skia_safe::Font::from_typeface(typeface, font_size);
+        let emoji_font = emoji_typeface().map(|tf| skia_safe::Font::from_typeface(tf, font_size));
+        let cell_padding = self.cell_padding;
+
+        let mut col_widths: Vec<f32> = vec![0.0; col_count];
+        for (i, header) in self.headers.iter().enumerate() {
+            let w = measure_text_with_fallback(header, &font, &emoji_font, 0.0);
+            col_widths[i] = col_widths[i].max(w + cell_padding * 2.0);
+        }
+        for row in &self.rows {
+            for (i, cell) in row.iter().enumerate() {
+                if i >= col_count {
+                    break;
+                }
+                let w = measure_text_with_fallback(cell, &font, &emoji_font, 0.0);
+                col_widths[i] = col_widths[i].max(w + cell_padding * 2.0);
+            }
         }
+        col_widths
     }
 
     /// Get alignment for a specific column.
@@ -152,7 +200,7 @@ impl Table {
             14.0,
         );
         let col_count = self.headers.len().max(1);
-        let col_widths = self.resolve_column_widths(w);
+        let col_widths = self.resolve_column_widths(w, font_size);
         let row_h = self.row_height(font_size);
 
         let header_color = self.header_color.as_deref().unwrap_or("#374151");
diff --git a/crates/rustmotion-components/tests/audit_ws_i.rs b/crates/rustmotion-components/tests/audit_ws_i.rs
index d29ff05c..bfd5247d 100644
--- a/crates/rustmotion-components/tests/audit_ws_i.rs
+++ b/crates/rustmotion-components/tests/audit_ws_i.rs
@@ -1,5 +1,4 @@
-//! Regression tests for workstream I of the 2026-09 audit (components and
-//! the CSS cascade).
+//! Regression tests for components and the CSS cascade:
 //!
 //! - `apply_intrinsic_overrides`'s default-size branches resolved
 //!   `font-size` through the context-free `font_size_px_or`, which returns
@@ -8,8 +7,8 @@
 //! - `cascade::inherit_from` computes inherited `color`/`font-*` but
 //!   nothing on the render path ever reads the result — every painter reads
 //!   its own component's un-cascaded `style` field instead.
-//! - `TableIntrinsic` measures content-fitted per-column widths, but
-//!   the painter splits the box evenly across columns regardless.
+//! - `TableIntrinsic` measures content-fitted per-column widths, but the
+//!   painter splits the box evenly across columns regardless.
 
 use rustmotion_components::box_builder::{build_scene_with_anim, BuildAnimationCtx};
 use rustmotion_components::legacy_dispatch::LegacyPaintDispatcher;
@@ -30,7 +29,7 @@ fn single_child_scene(json: serde_json::Value) -> ChildComponent {
     }
 }
 
-// ─── default sizes must resolve against the node's font-size ───────────────
+// ─── relative font-size on box_builder's default-size branches ────────────
 
 #[test]
 fn marquee_with_relative_font_size_gets_a_positive_height() {
@@ -68,10 +67,10 @@ fn marquee_with_relative_font_size_gets_a_positive_height() {
     );
 }
 
-// ─── ──────────────────────────────────────────────────────────────────
+// ─── CSS cascade reaching the painter and the intrinsic measurer ──────────
 
-const RM07_W: i32 = 600;
-const RM07_H: i32 = 500;
+const CASCADE_SCENE_W: i32 = 600;
+const CASCADE_SCENE_H: i32 = 500;
 
 struct PaintedScene {
     pixels: Vec<u8>,
@@ -84,7 +83,7 @@ fn paint_card_with_text_child(card_json: serde_json::Value) -> PaintedScene {
 
     let built = build_scene_with_anim(
         &children,
-        (RM07_W as f32, RM07_H as f32),
+        (CASCADE_SCENE_W as f32, CASCADE_SCENE_H as f32),
         BuildAnimationCtx {
             time: 0.0,
             scenario_time: 0.0,
@@ -94,14 +93,14 @@ fn paint_card_with_text_child(card_json: serde_json::Value) -> PaintedScene {
     );
     let layout = run_layout(
         &built.root,
-        (RM07_W as f32, RM07_H as f32),
+        (CASCADE_SCENE_W as f32, CASCADE_SCENE_H as f32),
         &ConversionContext::default(),
     );
     let text_id = built.root.children[0].children[0].id;
     let text_layout_height = layout.get(text_id).expect("text laid out").height;
 
-    let mut surface =
-        skia_safe::surfaces::raster_n32_premul((RM07_W, RM07_H)).expect("raster surface");
+    let mut surface = skia_safe::surfaces::raster_n32_premul((CASCADE_SCENE_W, CASCADE_SCENE_H))
+        .expect("raster surface");
     let canvas = surface.canvas();
     canvas.clear(skia_safe::Color::BLACK);
     let dispatcher = LegacyPaintDispatcher::for_scene(&built);
@@ -110,17 +109,17 @@ fn paint_card_with_text_child(card_json: serde_json::Value) -> PaintedScene {
         scenario_time: 0.0,
         frame_index: 0,
         fps: 30,
-        video_width: RM07_W as u32,
-        video_height: RM07_H as u32,
+        video_width: CASCADE_SCENE_W as u32,
+        video_height: CASCADE_SCENE_H as u32,
         scene_duration: 1.0,
         camera: None,
     };
     paint_tree(canvas, &built.root, &layout, &frame, &dispatcher);
 
-    let row_bytes = RM07_W as usize * 4;
-    let mut pixels = vec![0u8; row_bytes * RM07_H as usize];
+    let row_bytes = CASCADE_SCENE_W as usize * 4;
+    let mut pixels = vec![0u8; row_bytes * CASCADE_SCENE_H as usize];
     let info = skia_safe::ImageInfo::new(
-        (RM07_W, RM07_H),
+        (CASCADE_SCENE_W, CASCADE_SCENE_H),
         skia_safe::ColorType::RGBA8888,
         skia_safe::AlphaType::Premul,
         None,
@@ -212,3 +211,93 @@ fn text_own_color_wins_over_cascaded_card_color_at_paint_time() {
          found {red_pixels} red-dominant pixels"
     );
 }
+
+// ─── table column widths: painter vs. intrinsic measurer ──────────────────
+
+#[test]
+fn table_columns_are_sized_by_content_not_split_evenly() {
+    // `TableIntrinsic::compute_width` measures each column's own natural
+    // width (header/cell text + padding) and sums them for the box's
+    // reserved size, but `Table::resolve_column_widths` (the *painter*'s own
+    // distribution) just divides the laid-out width evenly across columns
+    // regardless. A table whose columns have very different natural widths
+    // ("ID" vs. a long description) used to get a column border sitting at
+    // the arithmetic midpoint of the box, not near the natural split the
+    // measurer already computed.
+    use rustmotion_components::Component;
+    use rustmotion_core::engine::animator::AnimatedProperties;
+    use rustmotion_core::engine::layout_pass::BoxLayout;
+    use rustmotion_core::traits::{PaintCtx, Painter};
+
+    let component: Component = serde_json::from_value(serde_json::json!({
+        "type": "table",
+        "headers": ["ID", "Description of the incident"],
+        "rows": [["1", "Something happened during the incident"]]
+    }))
+    .expect("deserialize table");
+    let Component::Table(table) = component else {
+        panic!("expected a table component");
+    };
+
+    const W: i32 = 500;
+    const H: i32 = 100;
+    let mut surface = skia_safe::surfaces::raster_n32_premul((W, H)).expect("raster surface");
+    let canvas = surface.canvas();
+    canvas.clear(skia_safe::Color::BLACK);
+    let layout = BoxLayout {
+        x: 0.0,
+        y: 0.0,
+        width: W as f32,
+        height: H as f32,
+        ..Default::default()
+    };
+    let ctx = PaintCtx {
+        time: 0.0,
+        scenario_time: 0.0,
+        scene_duration: 1.0,
+        frame_index: 0,
+        fps: 30,
+        video_width: W as u32,
+        video_height: H as u32,
+        stagger_offset: 0.0,
+    };
+    table.paint_content(canvas, &layout, &AnimatedProperties::default(), &ctx);
+
+    let snapshot = surface.image_snapshot();
+    let info = skia_safe::ImageInfo::new(
+        (W, H),
+        skia_safe::ColorType::RGBA8888,
+        skia_safe::AlphaType::Premul,
+        None,
+    );
+    let mut buf = vec![0u8; (W * H * 4) as usize];
+    assert!(snapshot.read_pixels(
+        &info,
+        &mut buf,
+        (W * 4) as usize,
+        skia_safe::IPoint::new(0, 0),
+        skia_safe::image::CachingHint::Disallow,
+    ));
+
+    let y = 15usize;
+    let border_distance = |x: usize| -> i32 {
+        let idx = (y * W as usize + x) * 4;
+        let (r, g, b) = (buf[idx] as i32, buf[idx + 1] as i32, buf[idx + 2] as i32);
+        (r - 0x4B).abs() + (g - 0x55).abs() + (b - 0x63).abs()
+    };
+    let boundary_x = (20usize..(W as usize - 20))
+        .min_by_key(|&x| border_distance(x))
+        .expect("scan range is non-empty");
+    assert!(
+        border_distance(boundary_x) < 90,
+        "no column-boundary border line found in the interior of the table \
+         (closest match at x={boundary_x}, distance={})",
+        border_distance(boundary_x)
+    );
+    assert!(
+        boundary_x < 200,
+        "the ID/Description column boundary should sit near the natural \
+         header-width split, not near the evenly-split midpoint (250) — \
+         found it at x={boundary_x}"
+    );
+}

From 29dbd16f9e5db510bb819da266e91ed5ac61aa5c Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:09:06 +0200
Subject: [PATCH 43/56] perf(studio): reuse the audio mix across optimistic
 edits (#258)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`optimistic::commit` bumps `generation` on EVERY mutation (one per `oninput` event), and `use_hot_reload` polls it every 250 ms, so a slider drag on a scenario that has audio calls `audio::prepare` ~4x/second. `prepare` spawns a brand-new `std::thread` that runs `mix_audio_tracks` over the whole scenario — documented in audio.rs:158 as "seconds on a long scenario" — decoding and resampling every track from scratch even though a font-size edit cannot have changed the audio. `MIX_TOKEN` only discards the RESULT; nothing cancels the work. Dozens of concurrent decode threads pile up, each holding a full interleaved f32 PCM buffer (~23 MB for 60 s stereo), fighting the 2-6 prefetch render workers for cores during exactly the interaction that most needs to stay smooth.

Refs #220
---
 crates/rustmotion-studio/src/editor/audio.rs  | 20 +++++-
 .../rustmotion-studio/src/editor/playback.rs  | 18 +++--
 crates/rustmotion-studio/tests/audit_ws_g.rs  | 71 +++++++++++++++----
 3 files changed, 88 insertions(+), 21 deletions(-)

diff --git a/crates/rustmotion-studio/src/editor/audio.rs b/crates/rustmotion-studio/src/editor/audio.rs
index 5b015479..59fbed59 100644
--- a/crates/rustmotion-studio/src/editor/audio.rs
+++ b/crates/rustmotion-studio/src/editor/audio.rs
@@ -13,12 +13,14 @@
 //! by a command channel; position and state are published as atomics the UI
 //! reads without ever touching that thread.
 
+use std::collections::hash_map::DefaultHasher;
+use std::hash::{Hash, Hasher};
 use std::sync::atomic::{AtomicBool, AtomicU64, AtomicUsize, Ordering};
 use std::sync::mpsc::{channel, RecvTimeoutError, Sender};
 use std::sync::{Arc, OnceLock};
 use std::time::Duration;
 
-use rustmotion::schema::ResolvedScenario;
+use rustmotion::schema::{AudioTrack, ResolvedScenario};
 
 enum Cmd {
     /// Interleaved stereo f32 for the whole scenario, and its sample rate.
@@ -145,6 +147,22 @@ fn sample_rate(rate: u32) -> rodio::SampleRate {
     rodio::SampleRate::new(rate).unwrap_or(rodio::SampleRate::new(44_100).unwrap())
 }
 
+/// Fingerprint of everything a mix depends on: every track's placement and
+/// volume envelope, plus the total duration silence pads out to. Serialised
+/// rather than hashed field by field so a field added to `AudioTrack` cannot
+/// silently drop out of the comparison. Two scenarios with the same
+/// fingerprint would remix to the same PCM, so [`use_hot_reload`](super::playback::use_hot_reload)
+/// calls [`prepare`] only when it changes — an edit to anything else (layout,
+/// text, color) must not re-decode and resample every track from scratch.
+pub fn audio_fingerprint(audio: &[AudioTrack], total_duration: f64) -> u64 {
+    let mut hasher = DefaultHasher::new();
+    serde_json::to_string(audio)
+        .unwrap_or_default()
+        .hash(&mut hasher);
+    total_duration.to_bits().hash(&mut hasher);
+    hasher.finish()
+}
+
 /// Mix the scenario's audio in the background and hand it to the audio thread.
 /// Cheap to call on every model reload: a scenario with no tracks just clears.
 pub fn prepare(scenario: Arc<ResolvedScenario>, total_duration: f64) {
diff --git a/crates/rustmotion-studio/src/editor/playback.rs b/crates/rustmotion-studio/src/editor/playback.rs
index 078fb93e..ed54ccbd 100644
--- a/crates/rustmotion-studio/src/editor/playback.rs
+++ b/crates/rustmotion-studio/src/editor/playback.rs
@@ -92,15 +92,18 @@ pub fn use_playback_clock(shared: Shared, mut current: Signal<u32>, playing: Sig
 }
 
 /// Bump `rev` whenever the watcher swaps in a reloaded model, so the `<img>`
-/// refetches the (now changed) current frame — and re-mix the preview audio for
-/// whatever scenario is now loaded. The mix has to follow the model: opening
-/// another file, or editing this one's tracks, otherwise keeps playing the
-/// previous scenario's sound.
+/// refetches the (now changed) current frame — and re-mix the preview audio
+/// when the audio itself changed. Every optimistic edit (a slider drag is
+/// ~4/s) bumps `generation`, but re-mixing decodes and resamples every track
+/// from scratch, so gating on [`audio::audio_fingerprint`](super::audio::audio_fingerprint)
+/// rather than on `generation` keeps a font-size or color edit from spawning
+/// a fresh mixer thread it has no use for.
 pub fn use_hot_reload(shared: Shared, mut rev: Signal<u64>) {
     use_future(move || {
         let shared = shared.clone();
         async move {
             let mut last_gen: Option<u64> = None;
+            let mut last_audio_fp: Option<u64> = None;
             loop {
                 let (g, scenario, total) = {
                     let m = shared.lock().unwrap_or_else(|e| e.into_inner());
@@ -112,7 +115,12 @@ pub fn use_hot_reload(shared: Shared, mut rev: Signal<u64>) {
                     }
                     last_gen = Some(g);
                     let fps = scenario.video.fps.max(1);
-                    super::audio::prepare(scenario, total as f64 / fps as f64);
+                    let total_duration = total as f64 / fps as f64;
+                    let fp = super::audio::audio_fingerprint(&scenario.audio, total_duration);
+                    if last_audio_fp != Some(fp) {
+                        last_audio_fp = Some(fp);
+                        super::audio::prepare(scenario, total_duration);
+                    }
                 }
                 tokio::time::sleep(Duration::from_millis(250)).await;
             }
diff --git a/crates/rustmotion-studio/tests/audit_ws_g.rs b/crates/rustmotion-studio/tests/audit_ws_g.rs
index 89b8325a..2e23d8f2 100644
--- a/crates/rustmotion-studio/tests/audit_ws_g.rs
+++ b/crates/rustmotion-studio/tests/audit_ws_g.rs
@@ -1,26 +1,28 @@
-//! Regression tests for the studio's file-write pipeline — a debounced write
-//! that must rebase onto the current disk instead of replaying a stale
-//! in-memory snapshot, coalesced edits inside one debounce window that must
-//! all survive (not just the last), and undo/redo cancelling a still-pending
-//! write before it can clobber the just-restored state — plus a render-thread
-//! panic that must surface as an error instead of being cached as an empty
-//! JPEG.
+//! Regression tests for the studio's file-write pipeline and a few other
+//! previously-untestable decision points: a debounced write that must rebase
+//! onto the current disk instead of replaying a stale in-memory snapshot,
+//! coalesced edits inside one debounce window that must all survive (not
+//! just the last), undo/redo cancelling a still-pending write before it can
+//! clobber the just-restored state, a render-thread panic that must surface
+//! as an error instead of a cached empty JPEG, and the preview audio mixer
+//! only re-running when the audio itself changed.
 //!
 //! `rustmotion-studio` has no `[dev-dependencies]` and cannot gain one in
 //! this change, so every test below drives the crate's existing public
-//! surface (`scenario::*`, `editor::frames`) against real temp files with
-//! plain synchronous `#[test]`s — no Dioxus runtime, no async executor. That
-//! public surface is itself the fix for the crate having no integration
-//! tests: the defects lived in a debounce timer and Dioxus event handlers
-//! that cannot be driven from a test, so each one was reduced to a pure
-//! decision over plain data (`resolve_flush`, the pending-write queue,
-//! `render_frame_deep` returning `Result`) and the handler calls that instead
-//! of deciding inline.
+//! surface (`scenario::*`, `editor::audio`, `editor::frames`) against real
+//! temp files with plain synchronous `#[test]`s — no Dioxus runtime, no
+//! async executor. That public surface is itself the fix for the crate
+//! having no integration tests: the defects lived in a debounce timer and
+//! Dioxus event handlers that cannot be driven from a test, so each one was
+//! reduced to a pure decision over plain data (`resolve_flush`, the
+//! pending-write queue, `audio_fingerprint`) and the handler calls that
+//! instead of deciding inline.
 
 use std::fs;
 use std::path::PathBuf;
 use std::sync::{Arc, Mutex};
 
+use rustmotion_studio::editor::audio::audio_fingerprint;
 use rustmotion_studio::editor::frames::render_frame_deep;
 use rustmotion_studio::scenario::{
     apply_optimistic, empty_scenario, pending_write_slot, queue_mutation, record_edit,
@@ -266,3 +268,42 @@ fn a_normal_render_returns_nonempty_jpeg_bytes() {
     let jpeg = render_frame_deep(&scenario, &tasks, 0, 1.0).expect("a normal render succeeds");
     assert!(!jpeg.is_empty());
 }
+
+// ── The preview audio mixer only re-runs when the audio actually changed ───
+
+#[test]
+fn audio_fingerprint_ignores_unrelated_edits_and_reacts_to_real_audio_changes() {
+    let scenario_a = rustmotion::loader::load_scenario_from_source(
+        None,
+        Some(r##"{ "video": { "width": 64, "height": 64 }, "audio": [ { "src": "a.mp3" } ], "scenes": [ { "duration": 1.0 } ] }"##),
+    )
+    .unwrap();
+    let scenario_b_same_audio = rustmotion::loader::load_scenario_from_source(
+        None,
+        Some(r##"{ "video": { "width": 64, "height": 64 }, "audio": [ { "src": "a.mp3" } ], "scenes": [ { "duration": 1.0, "children": [ { "type": "text", "content": "Hi" } ] } ] }"##),
+    )
+    .unwrap();
+    let scenario_c_different_audio = rustmotion::loader::load_scenario_from_source(
+        None,
+        Some(r##"{ "video": { "width": 64, "height": 64 }, "audio": [ { "src": "a.mp3", "volume": 0.5 } ], "scenes": [ { "duration": 1.0 } ] }"##),
+    )
+    .unwrap();
+
+    let fp_a = audio_fingerprint(&scenario_a.audio, 1.0);
+    let fp_b = audio_fingerprint(&scenario_b_same_audio.audio, 1.0);
+    let fp_c = audio_fingerprint(&scenario_c_different_audio.audio, 1.0);
+
+    assert_eq!(
+        fp_a, fp_b,
+        "an edit unrelated to audio (layout, text) must not change the fingerprint"
+    );
+    assert_ne!(
+        fp_a, fp_c,
+        "a real audio change (volume) must change the fingerprint"
+    );
+    assert_ne!(
+        audio_fingerprint(&scenario_a.audio, 1.0),
+        audio_fingerprint(&scenario_a.audio, 2.0),
+        "a total-duration change (silence padding) must also change the fingerprint"
+    );
+}

From fbaf997d1962f998bcde7f39c5c829a3ab88be93 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:09:16 +0200
Subject: [PATCH 44/56] fix(components): reach every typographic component with
 the cascade (#266)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The first pass at making `cascade::inherit_from` reach painters special-cased `Component::Text` inside `LegacyPaintDispatcher::dispatch`. That left the other seventeen components that read `color`/`font-*` off their own un-cascaded `self.style` still blind to inherited typography — `gradient_text`, `caption`, `rich_text`, `badge`, `callout`, `counter`, `divider`, `icon`, `kbd`, `list`, `marquee`, `notification`, `number_wheel`, `pill_nav`, `table`, `terminal`, `tooltip`. Worse than the missing coverage, a per-variant `match` arm means the cascade applies to exactly the variants someone remembered to list: the next component added would silently miss it. That is the same defect class the audit reported elsewhere in this crate, reintroduced by the fix for it.

Refs #220
---
 .../rustmotion-components/src/box_builder.rs  |  23 +-
 .../src/legacy_dispatch.rs                    |  25 +-
 crates/rustmotion-components/src/lib.rs       | 140 +++-
 crates/rustmotion-components/src/text.rs      |  20 +-
 .../rustmotion-components/tests/audit_ws_i.rs | 604 +++++++++++++++++-
 5 files changed, 759 insertions(+), 53 deletions(-)

diff --git a/crates/rustmotion-components/src/box_builder.rs b/crates/rustmotion-components/src/box_builder.rs
index 98423ab0..f5ab158b 100644
--- a/crates/rustmotion-components/src/box_builder.rs
+++ b/crates/rustmotion-components/src/box_builder.rs
@@ -1135,18 +1135,21 @@ fn apply_glow_effect(css: &mut CssStyle, effects: &[rustmotion_core::schema::Ani
 /// `cascaded_css` is this node's own `CssStyle` after `cascade::inherit_from`
 /// has already merged it against the parent, plus every subsequent overlay
 /// (timeline states, animation) — the exact same value `LegacyPaintDispatcher`
-/// receives at paint time. `Text` uses it so the reserved box always matches
-/// what `Text::paint_content` (which reads the same cascade through
-/// `with_cascaded_style`) actually draws.
+/// receives at paint time. `Component::with_cascaded_style` folds it into
+/// whichever component variants read inherited typography off their own
+/// style before this function's match ever sees them, so the reserved box
+/// always matches what those components' painters (which fold the same
+/// cascade in at paint time) actually draw.
 fn component_intrinsic(
     component: &Component,
     cascaded_css: &CssStyle,
 ) -> Option<Arc<dyn rustmotion_core::engine::box_tree::IntrinsicMeasure>> {
+    let cascaded_component = component.with_cascaded_style(cascaded_css);
+    let component = cascaded_component.as_ref().unwrap_or(component);
+
     use Component::*;
     match component {
-        Text(t) => Some(Arc::new(crate::intrinsic::TextIntrinsic::from_text(
-            &t.with_cascaded_style(cascaded_css),
-        ))),
+        Text(t) => Some(Arc::new(crate::intrinsic::TextIntrinsic::from_text(t))),
         GradientText(t) => Some(Arc::new(
             crate::intrinsic::GradientTextIntrinsic::from_gradient_text(t),
         )),
@@ -2147,7 +2150,7 @@ pub fn component_kind(c: &Component) -> &'static str {
         Particle(_) => "particle",
         PillNav(_) => "pill_nav",
         Progress(_) => "progress",
-        QrCode(_) => "qrcode",
+        QrCode(_) => "qr_code",
         NumberWheel(_) => "number_wheel",
         SuccessCheck(_) => "success_check",
         Pointer(_) => "pointer",
@@ -2169,7 +2172,11 @@ pub fn component_kind(c: &Component) -> &'static str {
         Flex(_) => "flex",
         Grid(_) => "grid",
         Card(_) => "card",
-        Container(_) => "container",
+        // The schema tag is `div` (`#[serde(rename = "div", alias =
+        // "container")]` on the enum in `lib.rs`) — `container` only
+        // survives as a deserialize alias, so naming it that way here told
+        // an author to look for a tag their scenario cannot contain.
+        Container(_) => "div",
         AudioSpectrum(_) => "audio_spectrum",
         Waveform(_) => "waveform",
     }
diff --git a/crates/rustmotion-components/src/legacy_dispatch.rs b/crates/rustmotion-components/src/legacy_dispatch.rs
index 9d7a6c4e..f3fb225f 100644
--- a/crates/rustmotion-components/src/legacy_dispatch.rs
+++ b/crates/rustmotion-components/src/legacy_dispatch.rs
@@ -2,7 +2,7 @@
 //! taffy-laid-out `BoxNode` tree back to component-typed `Painter` impls.
 //!
 //! Naming kept as "legacy" for now to avoid churn in callers; this is the
-//! sole dispatcher in use since all 51 components implement `Painter`.
+//! sole dispatcher in use since every component implements `Painter`.
 //!
 //! Containers (Card / Flex / Grid / Container / Positioned) are intentionally
 //! skipped: paint_pass already paints their box decorations and recurses into
@@ -12,18 +12,18 @@
 //! `dispatch` receives the node's cascaded `CssStyle` (`css` below) from
 //! `paint_pass`, but `Painter::paint_content` has no `CssStyle` parameter —
 //! its signature is frozen — and every painter reads typography off its own
-//! `self.style` instead. `Text` is the one component wired to see the
-//! cascade anyway: `Text::with_cascaded_style` rebuilds it with `css`
-//! folded into its own `style` field before painting, the same technique
-//! `box_builder::component_intrinsic` uses for `TextIntrinsic` so measure
-//! and paint agree.
+//! `self.style` instead. `Component::with_cascaded_style` rebuilds the
+//! subset of components that read inherited typography off their own style
+//! with `css` folded in before painting, the same call
+//! `box_builder::component_intrinsic` makes for the intrinsic measurers so
+//! measure and paint agree.
 
 use rustmotion_core::css::CssStyle;
 use rustmotion_core::engine::animator::{resolve_props_for_effects, AnimatedProperties};
 use rustmotion_core::engine::box_tree::NodeId;
 use rustmotion_core::engine::layout_pass::BoxLayout;
 use rustmotion_core::engine::paint_pass::{PaintDispatcher, PaintFrame};
-use rustmotion_core::traits::{PaintCtx, Painter};
+use rustmotion_core::traits::PaintCtx;
 use skia_safe::Canvas;
 
 use crate::{ChildComponent, Component};
@@ -125,7 +125,9 @@ impl<'a> PaintDispatcher for LegacyPaintDispatcher<'a> {
             return;
         }
 
-        let Some(painter) = child.component.as_painter() else {
+        let cascaded_component = child.component.with_cascaded_style(css);
+        let effective_component = cascaded_component.as_ref().unwrap_or(&child.component);
+        let Some(painter) = effective_component.as_painter() else {
             return;
         };
 
@@ -175,12 +177,7 @@ impl<'a> PaintDispatcher for LegacyPaintDispatcher<'a> {
             video_height: frame.video_height,
             stagger_offset: stagger_delay,
         };
-        if let Component::Text(t) = &child.component {
-            t.with_cascaded_style(css)
-                .paint_content(canvas, &local, &props, &paint_ctx);
-        } else {
-            painter.paint_content(canvas, &local, &props, &paint_ctx);
-        }
+        painter.paint_content(canvas, &local, &props, &paint_ctx);
 
         canvas.restore();
     }
diff --git a/crates/rustmotion-components/src/lib.rs b/crates/rustmotion-components/src/lib.rs
index 2ac0556f..8a9b8615 100644
--- a/crates/rustmotion-components/src/lib.rs
+++ b/crates/rustmotion-components/src/lib.rs
@@ -67,7 +67,8 @@ pub mod world_bitmap;
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 
-use rustmotion_core::traits::{Animatable, Painter, Styled, Timed};
+use rustmotion_core::css::CssStyle;
+use rustmotion_core::traits::{Animatable, Painter, Styled, StyledMut, Timed};
 
 pub use arrow::Arrow;
 pub use audio_spectrum::AudioSpectrum;
@@ -615,8 +616,11 @@ impl Component {
         }
     }
 
-    /// Returns the Painter trait. All 51 components are migrated to the new
-    /// pipeline; the dispatcher always uses Painter::paint_content.
+    /// Returns the Painter trait. Every `Component` variant is migrated to
+    /// the new pipeline; the dispatcher always uses Painter::paint_content.
+    /// `tests/audit_ws_i.rs::cascaded_components_match_the_verified_set`
+    /// exercises every variant — not a count here, which would just go
+    /// stale again the next time a component is added.
     pub fn as_painter(&self) -> Option<&dyn Painter> {
         match self {
             Component::AudioSpectrum(c) => Some(c),
@@ -681,4 +685,134 @@ impl Component {
             Component::Connector(c) => Some(c),
         }
     }
+
+    /// `Some(clone)` for the components whose `Painter`/intrinsic measurer
+    /// read inherited typography (`color`, `font-*`, `text-align`,
+    /// `white-space`, ...) off their own `style` field with `resolved`'s
+    /// twelve `cascade::inherit_from` properties folded in; `None` for every
+    /// other component, since the cascade cannot affect anything they draw.
+    /// `resolved` is the caller's own `CssStyle` post-cascade (`box_builder`
+    /// and `LegacyPaintDispatcher` both already have it on hand).
+    ///
+    /// The `true` set below was built by reading every component's own
+    /// `paint`/`paint_content` (and, where one exists, its `*Intrinsic`
+    /// measurer) for a direct `self.style.color`/`font_family`/`font_size`/
+    /// `font_weight`/`font_style` read with no cascade in between — not by
+    /// guessing from the component's name. Several read only `font-size`/
+    /// `font-family` and keep their own dedicated field for text colour
+    /// (`Kbd::text_color`, `PillNav::text_color`, `Terminal`'s theme) —
+    /// still members, since those two properties alone are enough for the
+    /// same defect: a `font-size` set on a card never reaching the child.
+    ///
+    /// Exhaustive on purpose, no wildcard arm: adding a new `Component`
+    /// variant is a compile error here until this match says whether it
+    /// belongs to that set — the same completeness `as_painter`/
+    /// `as_animatable`/`as_timed`/`as_styled` above already enforce for
+    /// their own questions, extended to this one.
+    /// `tests/audit_ws_i.rs::cascaded_components_match_the_verified_set`
+    /// pins the current membership directly, so a variant silently
+    /// reclassified here still fails a test even though the compiler has
+    /// nothing to object to.
+    ///
+    /// Builds the clone via a `serde_json` round-trip rather than `Clone`:
+    /// `Component`'s inner types are already `Serialize + Deserialize` (the
+    /// whole scenario tree is built that way), but not every one of them is
+    /// `Clone` — `Caption`'s `CaptionWord`/`CaptionStyle` (`rustmotion-core`)
+    /// are not, and adding it there is outside this crate. The round trip
+    /// costs more than a field-wise clone would, but only for the
+    /// components in the `Some` arm, and only once per box-tree build /
+    /// paint call — the same per-frame cost class `box_builder` already
+    /// pays elsewhere.
+    pub fn with_cascaded_style(&self, resolved: &CssStyle) -> Option<Component> {
+        let is_typographic = match self {
+            Component::Text(_)
+            | Component::GradientText(_)
+            | Component::Caption(_)
+            | Component::RichText(_)
+            | Component::Badge(_)
+            | Component::Callout(_)
+            | Component::Counter(_)
+            | Component::Divider(_)
+            | Component::Icon(_)
+            | Component::Kbd(_)
+            | Component::List(_)
+            | Component::Marquee(_)
+            | Component::Notification(_)
+            | Component::NumberWheel(_)
+            | Component::PillNav(_)
+            | Component::Table(_)
+            | Component::Terminal(_)
+            | Component::Tooltip(_) => true,
+            Component::AudioSpectrum(_)
+            | Component::Shape(_)
+            | Component::Image(_)
+            | Component::Svg(_)
+            | Component::Video(_)
+            | Component::Gif(_)
+            | Component::Cursor(_)
+            | Component::Codeblock(_)
+            | Component::Connector(_)
+            | Component::Avatar(_)
+            | Component::AvatarGroup(_)
+            | Component::Arrow(_)
+            | Component::Chart(_)
+            | Component::Comparison(_)
+            | Component::Countdown(_)
+            | Component::DotMap(_)
+            | Component::Gauge(_)
+            | Component::Heatmap(_)
+            | Component::Line(_)
+            | Component::Lottie(_)
+            | Component::Mockup(_)
+            | Component::Particle(_)
+            | Component::Progress(_)
+            | Component::QrCode(_)
+            | Component::SuccessCheck(_)
+            | Component::Pointer(_)
+            | Component::Rating(_)
+            | Component::Skeleton(_)
+            | Component::Slider(_)
+            | Component::Sparkline(_)
+            | Component::Stat(_)
+            | Component::Stepper(_)
+            | Component::Switch(_)
+            | Component::TagCloud(_)
+            | Component::Timeline(_)
+            | Component::Treemap(_)
+            | Component::Positioned(_)
+            | Component::Flex(_)
+            | Component::Grid(_)
+            | Component::Card(_)
+            | Component::Container(_)
+            | Component::Waveform(_) => false,
+        };
+        if !is_typographic {
+            return None;
+        }
+        let value = serde_json::to_value(self).ok()?;
+        let mut clone: Component = serde_json::from_value(value).ok()?;
+        let style = match &mut clone {
+            Component::Text(c) => c.style_config_mut(),
+            Component::GradientText(c) => c.style_config_mut(),
+            Component::Caption(c) => c.style_config_mut(),
+            Component::RichText(c) => c.style_config_mut(),
+            Component::Badge(c) => c.style_config_mut(),
+            Component::Callout(c) => c.style_config_mut(),
+            Component::Counter(c) => c.style_config_mut(),
+            Component::Divider(c) => c.style_config_mut(),
+            Component::Icon(c) => c.style_config_mut(),
+            Component::Kbd(c) => c.style_config_mut(),
+            Component::List(c) => c.style_config_mut(),
+            Component::Marquee(c) => c.style_config_mut(),
+            Component::Notification(c) => c.style_config_mut(),
+            Component::NumberWheel(c) => c.style_config_mut(),
+            Component::PillNav(c) => c.style_config_mut(),
+            Component::Table(c) => c.style_config_mut(),
+            Component::Terminal(c) => c.style_config_mut(),
+            Component::Tooltip(c) => c.style_config_mut(),
+            _ => unreachable!("classified as typographic by the match above"),
+        };
+        rustmotion_core::css::cascade::inherit_from(resolved, style);
+        Some(clone)
+    }
 }
diff --git a/crates/rustmotion-components/src/text.rs b/crates/rustmotion-components/src/text.rs
index b1fdb0b8..61f317b3 100644
--- a/crates/rustmotion-components/src/text.rs
+++ b/crates/rustmotion-components/src/text.rs
@@ -22,7 +22,7 @@ use rustmotion_core::schema::{
 };
 use rustmotion_core::traits::{PaintCtx, Painter, TimingConfig};
 
-#[derive(Debug, Clone, Serialize, Deserialize, JsonSchema)]
+#[derive(Debug, Serialize, Deserialize, JsonSchema)]
 pub struct Text {
     pub content: String,
     #[serde(default)]
@@ -59,24 +59,6 @@ rustmotion_core::impl_traits!(Text {
     Styled => style,
 });
 
-impl Text {
-    /// `Painter::paint_content` and `TextIntrinsic::from_text` both read
-    /// `self.style` directly and have no way to receive the box tree's
-    /// resolved `CssStyle` — the `Painter` trait's signature is frozen, and
-    /// `self` is bound to this exact struct. `resolved` is the box-tree
-    /// node's own `CssStyle` after `cascade::inherit_from` already merged
-    /// it against the parent at `box_builder` build time, so — mirroring
-    /// `inherit_from`'s own "child overrides parent" rule — filling this
-    /// clone's still-unset inheritable fields from it reproduces the same
-    /// outcome the box tree already computed, just where the painter and
-    /// the intrinsic measurer can see it.
-    pub fn with_cascaded_style(&self, resolved: &CssStyle) -> Self {
-        let mut clone = self.clone();
-        rustmotion_core::css::cascade::inherit_from(resolved, &mut clone.style);
-        clone
-    }
-}
-
 /// Eased progress (0..1) of unit `idx` at `time`, honouring the config's
 /// deterministic jitter.
 fn unit_progress(cfg: &ResolvedCharAnimation, idx: usize, time: f64) -> f32 {
diff --git a/crates/rustmotion-components/tests/audit_ws_i.rs b/crates/rustmotion-components/tests/audit_ws_i.rs
index bfd5247d..358e2c9c 100644
--- a/crates/rustmotion-components/tests/audit_ws_i.rs
+++ b/crates/rustmotion-components/tests/audit_ws_i.rs
@@ -74,10 +74,10 @@ const CASCADE_SCENE_H: i32 = 500;
 
 struct PaintedScene {
     pixels: Vec<u8>,
-    text_layout_height: f32,
+    child_layout_height: f32,
 }
 
-fn paint_card_with_text_child(card_json: serde_json::Value) -> PaintedScene {
+fn paint_card_with_child(card_json: serde_json::Value) -> PaintedScene {
     let child = single_child_scene(card_json);
     let children = vec![child];
 
@@ -96,8 +96,8 @@ fn paint_card_with_text_child(card_json: serde_json::Value) -> PaintedScene {
         (CASCADE_SCENE_W as f32, CASCADE_SCENE_H as f32),
         &ConversionContext::default(),
     );
-    let text_id = built.root.children[0].children[0].id;
-    let text_layout_height = layout.get(text_id).expect("text laid out").height;
+    let child_id = built.root.children[0].children[0].id;
+    let child_layout_height = layout.get(child_id).expect("child laid out").height;
 
     let mut surface = skia_safe::surfaces::raster_n32_premul((CASCADE_SCENE_W, CASCADE_SCENE_H))
         .expect("raster surface");
@@ -128,7 +128,7 @@ fn paint_card_with_text_child(card_json: serde_json::Value) -> PaintedScene {
 
     PaintedScene {
         pixels,
-        text_layout_height,
+        child_layout_height,
     }
 }
 
@@ -149,7 +149,7 @@ fn card_color_and_font_size_cascade_to_painted_text_child() {
     // own, at either paint time or measure time. The text rendered at the
     // painter's own fallback (48px, #FFFFFF) instead of the card's (200px,
     // red).
-    let scene = paint_card_with_text_child(serde_json::json!({
+    let scene = paint_card_with_child(serde_json::json!({
         "type": "card",
         "style": {
             "color": "#ff0000",
@@ -163,11 +163,11 @@ fn card_color_and_font_size_cascade_to_painted_text_child() {
     }));
 
     assert!(
-        scene.text_layout_height > 150.0,
+        scene.child_layout_height > 150.0,
         "text child with no font-size of its own must be measured at the \
          card's cascaded 200px (~240px line height), not the 48px default \
          (~57px line height) — got layout height {}",
-        scene.text_layout_height
+        scene.child_layout_height
     );
 
     let red_pixels = count_dominant(&scene.pixels, 0, &[1, 2]);
@@ -186,7 +186,7 @@ fn text_own_color_wins_over_cascaded_card_color_at_paint_time() {
     // not just at the box-tree level (already covered by
     // `box_builder.rs::text_own_color_wins_over_inherited_card_color`) but
     // in what actually gets painted.
-    let scene = paint_card_with_text_child(serde_json::json!({
+    let scene = paint_card_with_child(serde_json::json!({
         "type": "card",
         "style": {
             "color": "#ff0000",
@@ -212,6 +212,388 @@ fn text_own_color_wins_over_cascaded_card_color_at_paint_time() {
     );
 }
 
+fn any_ink_above_black_below_y(pixels: &[u8], width: i32, y_threshold: i32) -> bool {
+    pixels.chunks_exact(4).enumerate().any(|(i, p)| {
+        let y = i as i32 / width;
+        y > y_threshold && (p[0] > 20 || p[1] > 20 || p[2] > 20)
+    })
+}
+
+#[test]
+fn card_font_size_cascades_to_measured_and_painted_gradient_text_child() {
+    // `gradient_text` was orphaned by the original Text-only special case in
+    // `LegacyPaintDispatcher::dispatch` — nobody owned this file, so the
+    // cascade fix for `text` never extended to it even though its painter
+    // and `GradientTextIntrinsic` read `font-size`/`font-family`/etc. off
+    // `self.style` exactly the same way. `gradient_text` paints its own
+    // `colors` gradient rather than `style.color`, so `font-size` (which
+    // affects both the measured box and the ink's vertical extent) is the
+    // observable half of the cascade here, not color.
+    let scene = paint_card_with_child(serde_json::json!({
+        "type": "card",
+        "style": {
+            "font-size": 200,
+            "width": 500,
+            "flex-direction": "column"
+        },
+        "children": [
+            { "type": "gradient_text", "content": "W" }
+        ]
+    }));
+
+    assert!(
+        scene.child_layout_height > 150.0,
+        "gradient_text child with no font-size of its own must be measured \
+         at the card's cascaded 200px, not the 48px default — got layout \
+         height {}",
+        scene.child_layout_height
+    );
+    assert!(
+        any_ink_above_black_below_y(&scene.pixels, CASCADE_SCENE_W, 100),
+        "gradient_text painted at the card's cascaded 200px must have ink \
+         reaching well past y=100 — a 48px default line would not"
+    );
+}
+
+#[test]
+fn card_color_cascades_to_painted_caption_child() {
+    // Same orphaned-file gap as gradient_text, for `caption`: its inactive
+    // words paint in `style.color_str_or("#FFFFFF")`, which never saw the
+    // card's cascaded color either.
+    let scene = paint_card_with_child(serde_json::json!({
+        "type": "card",
+        "style": {
+            "color": "#ff0000",
+            "width": 500,
+            "flex-direction": "column"
+        },
+        "children": [
+            {
+                "type": "caption",
+                "words": [{ "text": "HELLO", "start": 10.0, "end": 20.0 }]
+            }
+        ]
+    }));
+
+    let red_pixels = count_dominant(&scene.pixels, 0, &[1, 2]);
+    assert!(
+        red_pixels > 20,
+        "caption's inactive word (painted at time=0, outside its \
+         [10,20) window) must use the card's cascaded red, not the \
+         painter's white fallback — found {red_pixels} red-dominant pixels"
+    );
+}
+
+#[test]
+fn card_color_cascades_to_painted_rich_text_child() {
+    // Same gap for `rich_text`: `resolve_span_fonts`'s `default_color`
+    // (used by any span that doesn't set its own `color`) reads
+    // `style.color_str_or("#FFFFFF")` on the component's own un-cascaded
+    // style.
+    let scene = paint_card_with_child(serde_json::json!({
+        "type": "card",
+        "style": {
+            "color": "#ff0000",
+            "width": 500,
+            "flex-direction": "column"
+        },
+        "children": [
+            { "type": "rich_text", "spans": [{ "text": "WWWW" }] }
+        ]
+    }));
+
+    let red_pixels = count_dominant(&scene.pixels, 0, &[1, 2]);
+    assert!(
+        red_pixels > 20,
+        "rich_text span with no color of its own must paint in the card's \
+         cascaded red, not the painter's white fallback — found {red_pixels} \
+         red-dominant pixels"
+    );
+}
+
+#[test]
+fn cascaded_components_match_the_verified_set() {
+    // Pins the current membership of `Component::with_cascaded_style`'s
+    // exhaustive classifier as an executable fact, not just a convention.
+    // The match itself guarantees every *future* variant gets a decision —
+    // adding a `Component` variant without extending that match is a
+    // compile error, the same completeness `as_painter`/`as_animatable`/
+    // `as_timed`/`as_styled` already enforce for their own questions. That
+    // guarantee says nothing about an *existing* variant silently drifting
+    // (a copy-paste that drops one into the wrong arm, or a "cleanup" that
+    // moves one back) — this test is what catches that, by covering all
+    // sixty variants directly rather than a sample.
+    //
+    // The eighteen `true` cases (beyond `text`, already fixed by a prior
+    // pass) were found by reading every `impl Painter for X` in this crate
+    // for a direct `self.style.color`/`font_family`/`font_size`/
+    // `font_weight`/`font_style` read with no cascade in between — not by
+    // trusting the component's name. `stat` was checked and ruled out: it
+    // reads only `self.style.background_color_str` (not inheritable) — its
+    // text colours come from its own dedicated `value_color`/`label_color`
+    // fields.
+    use rustmotion_components::Component;
+    use rustmotion_core::css::style::{Color, CssStyle as CoreCssStyle};
+    use rustmotion_core::css::Length;
+
+    let resolved = CoreCssStyle {
+        color: Some(Color::String("#ff0000".into())),
+        font_size: Some(Length::Px(40.0)),
+        ..Default::default()
+    };
+
+    let cases: &[(&str, bool, serde_json::Value)] = &[
+        (
+            "text",
+            true,
+            serde_json::json!({"type":"text","content":"x"}),
+        ),
+        (
+            "gradient_text",
+            true,
+            serde_json::json!({"type":"gradient_text","content":"x"}),
+        ),
+        (
+            "caption",
+            true,
+            serde_json::json!({"type":"caption","words":[{"text":"x","start":0.0,"end":0.0}]}),
+        ),
+        (
+            "rich_text",
+            true,
+            serde_json::json!({"type":"rich_text","spans":[{"text":"x"}]}),
+        ),
+        (
+            "badge",
+            true,
+            serde_json::json!({"type":"badge","text":"x"}),
+        ),
+        (
+            "callout",
+            true,
+            serde_json::json!({"type":"callout","text":"x"}),
+        ),
+        (
+            "counter",
+            true,
+            serde_json::json!({"type":"counter","from":0.0,"to":1.0}),
+        ),
+        ("divider", true, serde_json::json!({"type":"divider"})),
+        (
+            "icon",
+            true,
+            serde_json::json!({"type":"icon","icon":"lucide:home"}),
+        ),
+        ("kbd", true, serde_json::json!({"type":"kbd","key":"A"})),
+        (
+            "list",
+            true,
+            serde_json::json!({"type":"list","items":[{"text":"x"}]}),
+        ),
+        (
+            "marquee",
+            true,
+            serde_json::json!({"type":"marquee","content":"x"}),
+        ),
+        (
+            "notification",
+            true,
+            serde_json::json!({"type":"notification","title":"x"}),
+        ),
+        (
+            "number_wheel",
+            true,
+            serde_json::json!({"type":"number_wheel","value":"1"}),
+        ),
+        (
+            "pill_nav",
+            true,
+            serde_json::json!({"type":"pill_nav","items":["a"]}),
+        ),
+        (
+            "table",
+            true,
+            serde_json::json!({"type":"table","headers":["A"],"rows":[]}),
+        ),
+        (
+            "terminal",
+            true,
+            serde_json::json!({"type":"terminal","lines":[]}),
+        ),
+        (
+            "tooltip",
+            true,
+            serde_json::json!({"type":"tooltip","text":"x"}),
+        ),
+        (
+            "audio_spectrum",
+            false,
+            serde_json::json!({"type":"audio_spectrum"}),
+        ),
+        (
+            "shape",
+            false,
+            serde_json::json!({"type":"shape","shape":"rect"}),
+        ),
+        (
+            "image",
+            false,
+            serde_json::json!({"type":"image","src":"x.png"}),
+        ),
+        ("svg", false, serde_json::json!({"type":"svg"})),
+        (
+            "video",
+            false,
+            serde_json::json!({"type":"video","src":"x.mp4"}),
+        ),
+        (
+            "gif",
+            false,
+            serde_json::json!({"type":"gif","src":"x.gif"}),
+        ),
+        ("cursor", false, serde_json::json!({"type":"cursor"})),
+        (
+            "codeblock",
+            false,
+            serde_json::json!({"type":"codeblock","code":"x"}),
+        ),
+        (
+            "connector",
+            false,
+            serde_json::json!({"type":"connector","from":{"x":0.0,"y":0.0},"to":{"x":1.0,"y":1.0}}),
+        ),
+        (
+            "avatar",
+            false,
+            serde_json::json!({"type":"avatar","src":"x.png"}),
+        ),
+        (
+            "avatar_group",
+            false,
+            serde_json::json!({"type":"avatar_group","avatars":[]}),
+        ),
+        (
+            "arrow",
+            false,
+            serde_json::json!({"type":"arrow","x2":10.0,"y2":10.0}),
+        ),
+        (
+            "chart",
+            false,
+            serde_json::json!({"type":"chart","chart_type":"bar"}),
+        ),
+        (
+            "comparison",
+            false,
+            serde_json::json!({"type":"comparison"}),
+        ),
+        ("countdown", false, serde_json::json!({"type":"countdown"})),
+        (
+            "dot_map",
+            false,
+            serde_json::json!({"type":"dot_map","points":[]}),
+        ),
+        ("gauge", false, serde_json::json!({"type":"gauge"})),
+        (
+            "heatmap",
+            false,
+            serde_json::json!({"type":"heatmap","data":[]}),
+        ),
+        (
+            "line",
+            false,
+            serde_json::json!({"type":"line","x2":10.0,"y2":10.0}),
+        ),
+        ("lottie", false, serde_json::json!({"type":"lottie"})),
+        (
+            "mockup",
+            false,
+            serde_json::json!({"type":"mockup","device":"iphone","src":"x.png"}),
+        ),
+        (
+            "particle",
+            false,
+            serde_json::json!({"type":"particle","particle_type":"confetti"}),
+        ),
+        ("progress", false, serde_json::json!({"type":"progress"})),
+        (
+            "qr_code",
+            false,
+            serde_json::json!({"type":"qr_code","content":"x"}),
+        ),
+        (
+            "success_check",
+            false,
+            serde_json::json!({"type":"success_check"}),
+        ),
+        ("pointer", false, serde_json::json!({"type":"pointer"})),
+        ("rating", false, serde_json::json!({"type":"rating"})),
+        ("skeleton", false, serde_json::json!({"type":"skeleton"})),
+        ("slider", false, serde_json::json!({"type":"slider"})),
+        (
+            "sparkline",
+            false,
+            serde_json::json!({"type":"sparkline","data":[]}),
+        ),
+        (
+            "stat",
+            false,
+            serde_json::json!({"type":"stat","value":"1"}),
+        ),
+        (
+            "stepper",
+            false,
+            serde_json::json!({"type":"stepper","steps":[]}),
+        ),
+        ("switch", false, serde_json::json!({"type":"switch"})),
+        (
+            "tag_cloud",
+            false,
+            serde_json::json!({"type":"tag_cloud","tags":[]}),
+        ),
+        (
+            "timeline",
+            false,
+            serde_json::json!({"type":"timeline","steps":[]}),
+        ),
+        (
+            "treemap",
+            false,
+            serde_json::json!({"type":"treemap","data":[]}),
+        ),
+        (
+            "positioned",
+            false,
+            serde_json::json!({"type":"positioned"}),
+        ),
+        ("flex", false, serde_json::json!({"type":"flex"})),
+        ("grid", false, serde_json::json!({"type":"grid"})),
+        ("card", false, serde_json::json!({"type":"card"})),
+        ("div", false, serde_json::json!({"type":"div"})),
+        ("waveform", false, serde_json::json!({"type":"waveform"})),
+    ];
+
+    assert_eq!(
+        cases.len(),
+        60,
+        "this table must cover every Component variant (currently 60) — the \
+         compiler enforces that with_cascaded_style itself classifies every \
+         variant, but only this list enforces that the classification stays \
+         the one this workstream verified"
+    );
+
+    for (name, expected_typographic, json) in cases {
+        let component: Component =
+            serde_json::from_value(json.clone()).unwrap_or_else(|e| panic!("{name}: {e}"));
+        let got = component.with_cascaded_style(&resolved).is_some();
+        assert_eq!(
+            got, *expected_typographic,
+            "{name}: with_cascaded_style returned is_some()={got}, expected \
+             {expected_typographic}"
+        );
+    }
+}
+
 // ─── table column widths: painter vs. intrinsic measurer ──────────────────
 
 #[test]
@@ -301,3 +683,207 @@ fn table_columns_are_sized_by_content_not_split_evenly() {
          found it at x={boundary_x}"
     );
 }
+
+// ─── the cascade reaches every typographic component, not just `text` ─────
+//
+// `card_font_size_cascades_to_measured_and_painted_gradient_text_child`,
+// `card_color_cascades_to_painted_caption_child` and
+// `card_color_cascades_to_painted_rich_text_child` above cover the three
+// components the brief named directly. The tests below cover the "own value
+// still wins" half for `caption`, plus every other component this sweep
+// found reading un-cascaded typography off its own `style`.
+
+#[test]
+fn caption_own_color_wins_over_cascaded_card_color_at_paint_time() {
+    let scene = paint_card_with_child(serde_json::json!({
+        "type": "card",
+        "style": { "color": "#ff0000", "width": 500, "flex-direction": "column" },
+        "children": [
+            {
+                "type": "caption",
+                "words": [{ "text": "WWWW", "start": 0.0, "end": 0.0 }],
+                "style": { "color": "#00ff00" }
+            }
+        ]
+    }));
+
+    let green_pixels = count_dominant(&scene.pixels, 1, &[0, 2]);
+    let red_pixels = count_dominant(&scene.pixels, 0, &[1, 2]);
+    assert!(
+        green_pixels > 20,
+        "caption's own explicit color must still be painted — found \
+         {green_pixels} green-dominant pixels"
+    );
+    assert_eq!(
+        red_pixels, 0,
+        "caption's own explicit color must win over the card's cascaded red \
+         — found {red_pixels} red-dominant pixels"
+    );
+}
+
+// ─── the fourteen other components that read `self.style` typography ──────
+//
+// Found by sweeping every `impl Painter for X` in this crate for a direct
+// `self.style.color`/`font_family`/`font_size`/`font_weight`/`font_style`
+// read with no cascade in between (the same shape as the three tested
+// above), not by re-checking only the candidates the brief named. `stat`
+// was checked and ruled out: it reads only `self.style.background_color_str`
+// (not inheritable) — its text colours come from its own dedicated
+// `value_color`/`label_color` fields.
+
+#[test]
+fn newly_cascaded_components_inherit_unset_typography_from_the_parent() {
+    use rustmotion_components::Component;
+    use rustmotion_core::css::style::{Color, CssStyle as CoreCssStyle};
+    use rustmotion_core::css::Length;
+
+    let parent = CoreCssStyle {
+        color: Some(Color::String("#ff0000".into())),
+        font_size: Some(Length::Px(200.0)),
+        ..Default::default()
+    };
+
+    let cases: &[(&str, serde_json::Value)] = &[
+        ("badge", serde_json::json!({"type":"badge","text":"x"})),
+        ("callout", serde_json::json!({"type":"callout","text":"x"})),
+        (
+            "counter",
+            serde_json::json!({"type":"counter","from":0.0,"to":1.0}),
+        ),
+        ("divider", serde_json::json!({"type":"divider"})),
+        (
+            "icon",
+            serde_json::json!({"type":"icon","icon":"lucide:home"}),
+        ),
+        ("kbd", serde_json::json!({"type":"kbd","key":"A"})),
+        (
+            "list",
+            serde_json::json!({"type":"list","items":[{"text":"x"}]}),
+        ),
+        (
+            "marquee",
+            serde_json::json!({"type":"marquee","content":"x"}),
+        ),
+        (
+            "notification",
+            serde_json::json!({"type":"notification","title":"x"}),
+        ),
+        (
+            "number_wheel",
+            serde_json::json!({"type":"number_wheel","value":"1"}),
+        ),
+        (
+            "pill_nav",
+            serde_json::json!({"type":"pill_nav","items":["a"]}),
+        ),
+        (
+            "table",
+            serde_json::json!({"type":"table","headers":["A"],"rows":[]}),
+        ),
+        (
+            "terminal",
+            serde_json::json!({"type":"terminal","lines":[]}),
+        ),
+        ("tooltip", serde_json::json!({"type":"tooltip","text":"x"})),
+    ];
+
+    for (name, json) in cases {
+        let component: Component =
+            serde_json::from_value(json.clone()).unwrap_or_else(|e| panic!("{name}: {e}"));
+        let cascaded = component
+            .with_cascaded_style(&parent)
+            .unwrap_or_else(|| panic!("{name} must be classified as typographic"));
+        let style = cascaded.as_styled().style_config();
+        assert_eq!(
+            style.color, parent.color,
+            "{name} with no color of its own must inherit the parent's"
+        );
+        assert_eq!(
+            style.font_size, parent.font_size,
+            "{name} with no font-size of its own must inherit the parent's"
+        );
+    }
+}
+
+#[test]
+fn table_own_color_wins_over_cascaded_card_color() {
+    use rustmotion_components::Component;
+    use rustmotion_core::css::style::{Color, CssStyle as CoreCssStyle};
+
+    let parent = CoreCssStyle {
+        color: Some(Color::String("#ff0000".into())),
+        ..Default::default()
+    };
+    let component: Component = serde_json::from_value(serde_json::json!({
+        "type": "table",
+        "headers": ["A"],
+        "rows": [],
+        "style": { "color": "#00ff00" }
+    }))
+    .expect("deserialize table");
+    let cascaded = component
+        .with_cascaded_style(&parent)
+        .expect("table is typographic");
+    assert_eq!(
+        cascaded.as_styled().style_config().color,
+        Some(Color::String("#00ff00".into())),
+        "table's own explicit color must win over the cascaded parent's"
+    );
+}
+
+#[test]
+fn divider_color_cascades_from_card_to_painted_line() {
+    // `Divider::paint_content` reads `self.style.color_str_or("#FFFFFF")`
+    // directly for the line it draws — the same un-cascaded read as the
+    // text-bearing components above, just for a component with no text at
+    // all. A card's `color` is the CSS analogue of `border-color:
+    // currentColor`: a divider with no colour of its own should match the
+    // ambient text colour, not fall back to white.
+    let scene = paint_card_with_child(serde_json::json!({
+        "type": "card",
+        "style": {
+            "color": "#ff0000",
+            "width": 500,
+            "height": 200,
+            "flex-direction": "column"
+        },
+        "children": [ { "type": "divider" } ]
+    }));
+
+    let red_pixels = count_dominant(&scene.pixels, 0, &[1, 2]);
+    assert!(
+        red_pixels > 0,
+        "divider with no color of its own must paint its line in the card's \
+         cascaded red, not the painter's white fallback — found \
+         {red_pixels} red-dominant pixels"
+    );
+}
+
+#[test]
+fn table_color_and_font_size_cascade_to_painted_cells() {
+    // Complements `table_columns_are_sized_by_content_not_split_evenly`
+    // above (painter vs. intrinsic column widths) with the cascade half:
+    // `Table::paint`'s body-cell colour (`self.style.color_str_or`) and
+    // font-size both used to ignore the card's cascaded style. The header
+    // row keeps its own hardcoded `header_text_color` default regardless,
+    // so this only proves the body cells.
+    let scene = paint_card_with_child(serde_json::json!({
+        "type": "card",
+        "style": {
+            "color": "#ff0000",
+            "font-size": 40,
+            "width": 500,
+            "flex-direction": "column"
+        },
+        "children": [
+            { "type": "table", "headers": ["ID"], "rows": [["1"]] }
+        ]
+    }));
+
+    let red_pixels = count_dominant(&scene.pixels, 0, &[1, 2]);
+    assert!(
+        red_pixels > 20,
+        "a table body cell with no color of its own must paint in the \
+         card's cascaded red — found {red_pixels} red-dominant pixels"
+    );
+}

From 9ef377fa87786971e00d8003074b51e59b013279 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:11:45 +0200
Subject: [PATCH 45/56] fix(encode): trust the decoded signal spec for rate and
 channels (#293)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The interleaved samples appended to `all_samples` come from `decoded.spec()`, but the returned `(sample_rate, channels)` come from the container header with `unwrap_or` fallbacks. These diverge for real files: symphonia's ADTS AAC reader only sets `params.with_channels(channels)` when `header.channels` is `Some` (symphonia-codec-aac-0.5.5/src/adts.rs:139-141) — an ADTS stream with `channel_config == 0` leaves `codec_params.channels == None`, so rustmotion assumes 2 while the decoder actually emits mono. `to_stereo(&samples, 2)` (line 205) then passes the mono buffer through untouched, so the track is half its real length and plays at double speed; `mix_audio_tracks_segment` sizes everything from that, and the muxed audio desyncs from video with no error anywhere. `audio_analysis.rs:143-149` divides by the same wrong `channels` for the waveform/spectrum envelope, so the on-screen visualisation agrees with the broken mix.

Refs #220
---
 crates/rustmotion/src/encode/audio.rs | 81 +++++++++++++++++++++++++--
 1 file changed, 75 insertions(+), 6 deletions(-)

diff --git a/crates/rustmotion/src/encode/audio.rs b/crates/rustmotion/src/encode/audio.rs
index 85f09796..6f284a44 100644
--- a/crates/rustmotion/src/encode/audio.rs
+++ b/crates/rustmotion/src/encode/audio.rs
@@ -64,12 +64,8 @@ pub(crate) fn decode_audio_file(path: &str) -> Result<(Vec<f32>, u32, u32)> {
         })?;
 
     let track_id = track.id;
-    let sample_rate = track.codec_params.sample_rate.unwrap_or(44100);
-    let channels = track
-        .codec_params
-        .channels
-        .map(|c| c.count() as u32)
-        .unwrap_or(2);
+    let header_sample_rate = track.codec_params.sample_rate;
+    let header_channels = track.codec_params.channels.map(|c| c.count() as u32);
 
     let mut decoder = symphonia::default::get_codecs()
         .make(&track.codec_params, &DecoderOptions::default())
@@ -79,6 +75,7 @@ pub(crate) fn decode_audio_file(path: &str) -> Result<(Vec<f32>, u32, u32)> {
         })?;
 
     let mut all_samples: Vec<f32> = Vec::new();
+    let mut decoded_spec: Option<(u32, u32)> = None;
 
     loop {
         let packet = match format.next_packet() {
@@ -107,11 +104,40 @@ pub(crate) fn decode_audio_file(path: &str) -> Result<(Vec<f32>, u32, u32)> {
         sample_buf.copy_interleaved_ref(decoded);
 
         all_samples.extend_from_slice(sample_buf.samples());
+
+        if decoded_spec.is_none() {
+            decoded_spec = Some((spec.rate, spec.channels.count() as u32));
+        }
     }
 
+    let (sample_rate, channels) =
+        resolve_decoded_spec(decoded_spec, header_sample_rate, header_channels);
+
     Ok((all_samples, sample_rate, channels))
 }
 
+/// `decode_audio_file`'s `(sample_rate, channels)` return value: the actual
+/// spec of the first packet that decoded, when there was one — that's what
+/// `all_samples` was interleaved from — falling back to the container
+/// header's own declaration only when nothing ever decoded at all. Some
+/// demuxers leave the header fields absent or, for formats whose per-frame
+/// syntax can encode a channel count the container-level probe cannot see
+/// (e.g. an ADTS/AAC stream with an implicit `channel_configuration`),
+/// disagreeing with what the codec itself produces — trusting the header
+/// unconditionally there silently mis-sizes every downstream stereo/mono
+/// interpretation of `all_samples`. `44100`/`2` is the last-resort default,
+/// unchanged from before this function tracked a decoded spec at all.
+fn resolve_decoded_spec(
+    decoded_spec: Option<(u32, u32)>,
+    header_sample_rate: Option<u32>,
+    header_channels: Option<u32>,
+) -> (u32, u32) {
+    decoded_spec.unwrap_or((
+        header_sample_rate.unwrap_or(44100),
+        header_channels.unwrap_or(2),
+    ))
+}
+
 /// Duration, sample rate and channel count of a local audio file — the
 /// `rustmotion info` answer to "how long is this audio track?".
 #[derive(Debug, Clone, Copy, PartialEq)]
@@ -479,6 +505,49 @@ fn resample_linear(samples: &[f32], src_rate: u32, dst_rate: u32) -> Vec<f32> {
 mod tests {
     use super::*;
 
+    // ── decode_audio_file must trust the decoded spec, not the header ────────
+    //
+    // Reproducing the exact divergence through a real file needs a decoder
+    // whose *decoded* output can genuinely disagree with what the container
+    // probed ahead of time. Tracing one concrete case where this happens in
+    // the wild — `symphonia-codec-aac`'s ADTS reader leaving `codec_params.channels`
+    // `None` when `channel_configuration == 0` — into `AacDecoder::try_new`
+    // (symphonia-codec-aac 0.5.5, `aac/mod.rs`) shows that without an
+    // `extra_data`/channel-layout fallback it returns a hard
+    // `unsupported_error` instead of ever reaching a decoded packet: this
+    // crate's enabled `symphonia` features (`mp3, wav, ogg, flac, aac`, no
+    // `isomp4`) never populate that fallback for a bare ADTS stream. So this
+    // exact repro surfaces as a loud decode failure, not silent corruption —
+    // a real fixture can't exercise the discard/trust distinction at all.
+    // `resolve_decoded_spec` is exactly that distinction pulled out as a
+    // pure decision, tested directly with the divergence a real file could
+    // produce for a different codec/container pairing.
+    #[test]
+    fn resolve_decoded_spec_prefers_the_decoded_packets_own_spec_over_the_header() {
+        let decoded = Some((48_000, 1));
+        let header_rate = Some(44_100);
+        let header_channels = Some(2);
+        assert_eq!(
+            resolve_decoded_spec(decoded, header_rate, header_channels),
+            (48_000, 1),
+            "a packet actually decoded — all_samples came from its spec, so the \
+             return value must match it, not the header's own guess"
+        );
+    }
+
+    #[test]
+    fn resolve_decoded_spec_falls_back_to_the_header_when_nothing_ever_decoded() {
+        assert_eq!(
+            resolve_decoded_spec(None, Some(22_050), Some(1)),
+            (22_050, 1)
+        );
+    }
+
+    #[test]
+    fn resolve_decoded_spec_falls_back_to_the_hardcoded_default_as_a_last_resort() {
+        assert_eq!(resolve_decoded_spec(None, None, None), (44_100, 2));
+    }
+
     /// Write a minimal, hand-rolled canonical PCM WAV file (16-bit, mono) —
     /// no ffmpeg and no extra crate needed, `symphonia`'s built-in WAV demuxer
     /// decodes this directly.

From 07b897181fd136b3849699cd12aac4f34a3e72b7 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:12:00 +0200
Subject: [PATCH 46/56] fix(encode): create temp files in a private directory
 (#294)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The path is fully derived from PID plus a counter starting at 0, in a shared, world-writable directory. `create_dir_all` succeeds on an already-existing directory (or a symlink to one) and `fs::write` follows symlinks, so a local attacker who pre-creates `/tmp/rustmotion_audio_<pid>_0/audio.raw` as a symlink gets an arbitrary file truncated and overwritten with PCM bytes under the rendering user's identity; PID space is small enough to pre-seed exhaustively. The same class exists in `video_audio.rs:258`, `std::env::temp_dir().join(format!("rustmotion_vidaud_{:016x}.wav", hash))`, where `hash` comes from `DefaultHasher::new()` (SipHash seeded with fixed keys 0,0 — deterministic across processes and machines), so the path is exactly predictable. There, `if wav_path.exists() { return Some(wav_path) }` (line 298) means a pre-planted file is used verbatim as the render's audio, and the `.partial.wav` sibling is handed to `ffmpeg -y` (line 339-340), which follows a symlink at that path.

Refs #220
---
 crates/rustmotion/src/encode/video/ffmpeg.rs |  86 ++++++++++++-
 crates/rustmotion/src/encode/video_audio.rs  | 128 ++++++++++++++++++-
 2 files changed, 205 insertions(+), 9 deletions(-)

diff --git a/crates/rustmotion/src/encode/video/ffmpeg.rs b/crates/rustmotion/src/encode/video/ffmpeg.rs
index 63d338ae..2f79343d 100644
--- a/crates/rustmotion/src/encode/video/ffmpeg.rs
+++ b/crates/rustmotion/src/encode/video/ffmpeg.rs
@@ -290,6 +290,17 @@ fn ffmpeg_args(
     args
 }
 
+/// Name of the scratch directory a single audio-bearing render call writes
+/// its materialised PCM into. `pid` repeats across the machine's uptime and
+/// `seq` is a small monotonic counter starting at zero, so together they are
+/// a key an outside process could realistically pre-compute and occupy
+/// ahead of time; folding in a nanosecond timestamp neither of those two
+/// alone carries closes that gap without needing a random-number
+/// dependency this crate doesn't already have.
+fn audio_tmp_dir_name(pid: u32, seq: u32, nanos: u128) -> String {
+    format!("rustmotion_audio_{pid}_{seq}_{nanos:x}")
+}
+
 /// Scratch path ffmpeg actually writes to; promoted (renamed) onto the
 /// caller's real `output_path` only after a clean exit with no `pipe_error`.
 /// Kept as a sibling of `output_path` (same directory, same filesystem, so
@@ -461,22 +472,32 @@ fn encode_with_ffmpeg_hw_impl(
     // encodes can run concurrently *within* one process (parallel test
     // threads today; `--frames` segments rendered concurrently by a future
     // distributed worker tomorrow — the exact shape this feature exists to
-    // enable). Two calls sharing a PID-only path would each `create_dir_all`
+    // enable). Two calls sharing a PID-only path would each try to create
     // the same directory, then whichever finishes first would
     // `remove_dir_all` it out from under the other mid-write, surfacing as
     // a bare `NotFound` on `std::fs::write` below. A monotonic counter on
     // top of PID makes every call's directory distinct regardless of
-    // timing.
+    // timing; a nanosecond timestamp on top of *that* keeps the full key
+    // from being small enough for something outside this process to
+    // pre-compute and occupy ahead of time — pid space and a
+    // monotonic-from-zero counter both are. `create_dir` below (not
+    // `_all`) is what actually refuses to proceed if something is already
+    // sitting at the computed path, symlink included; the timestamp only
+    // raises the cost of ever landing on that path in the first place.
     static AUDIO_TMP_DIR_SEQ: AtomicU32 = AtomicU32::new(0);
     let audio_tmp_dir = if !merged_audio.is_empty() {
         let seq = AUDIO_TMP_DIR_SEQ.fetch_add(1, Ordering::Relaxed);
-        Some(std::env::temp_dir().join(format!("rustmotion_audio_{}_{seq}", std::process::id())))
+        let nanos = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .map(|d| d.as_nanos())
+            .unwrap_or_default();
+        Some(std::env::temp_dir().join(audio_tmp_dir_name(std::process::id(), seq, nanos)))
     } else {
         None
     };
     let pcm_data = if !merged_audio.is_empty() {
         if let Some(ref tmp_dir) = audio_tmp_dir {
-            std::fs::create_dir_all(tmp_dir)?;
+            std::fs::create_dir(tmp_dir)?;
         }
         super::super::audio::mix_audio_tracks_segment(
             &merged_audio,
@@ -837,10 +858,63 @@ pub fn concat_mp4_segments(inputs: &[std::path::PathBuf], output_path: &str) ->
 #[cfg(test)]
 mod tests {
     use super::{
-        ffmpeg_args, ffmpeg_partial_output_path, parse_encoder_names, select_hardware_encoder,
-        HardwareSelection,
+        audio_tmp_dir_name, ffmpeg_args, ffmpeg_partial_output_path, parse_encoder_names,
+        select_hardware_encoder, HardwareSelection,
     };
 
+    // ── audio scratch directory naming: not fully predictable from outside ──
+
+    #[test]
+    fn audio_tmp_dir_name_differs_across_calls_that_share_pid_and_seq() {
+        // A pid+seq pair is small enough to pre-seed exhaustively from
+        // outside the process; folding in a nanosecond timestamp neither of
+        // those two alone carries means a name computed ahead of time from
+        // pid+seq no longer identifies the exact directory this process
+        // will actually create.
+        let a = audio_tmp_dir_name(1234, 0, 111);
+        let b = audio_tmp_dir_name(1234, 0, 222);
+        assert_ne!(
+            a, b,
+            "same pid+seq, different nanos, must differ: {a} vs {b}"
+        );
+    }
+
+    #[test]
+    fn audio_tmp_dir_name_is_stable_for_identical_inputs() {
+        assert_eq!(audio_tmp_dir_name(1, 2, 3), audio_tmp_dir_name(1, 2, 3));
+    }
+
+    /// Characterizes the exact property this fix depends on: swapping
+    /// `create_dir_all` for `create_dir` at the audio scratch directory's
+    /// creation site turns "adopt whatever is already there" into "refuse
+    /// outright" the moment something — attacker-planted symlink included —
+    /// already occupies that path.
+    #[test]
+    fn create_dir_refuses_an_already_occupied_path_that_create_dir_all_would_have_adopted() {
+        let path = std::env::temp_dir().join(format!(
+            "rustmotion_audit_ws_c_preexisting_dir_{}_{}",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .unwrap()
+                .as_nanos()
+        ));
+        let _ = std::fs::remove_dir_all(&path);
+        std::fs::create_dir(&path).expect("set up a pre-existing directory at the target path");
+
+        assert!(
+            std::fs::create_dir_all(&path).is_ok(),
+            "create_dir_all silently succeeding on a pre-existing directory is exactly the \
+             behavior that let a hostile pre-planted directory (or symlink) be adopted"
+        );
+        assert!(
+            std::fs::create_dir(&path).is_err(),
+            "create_dir must refuse the same pre-existing path instead of adopting it"
+        );
+
+        let _ = std::fs::remove_dir_all(&path);
+    }
+
     // ── partial-output-path naming (pure) ────────────────────────────────────
 
     #[test]
diff --git a/crates/rustmotion/src/encode/video_audio.rs b/crates/rustmotion/src/encode/video_audio.rs
index caac9e1e..01a1c033 100644
--- a/crates/rustmotion/src/encode/video_audio.rs
+++ b/crates/rustmotion/src/encode/video_audio.rs
@@ -255,6 +255,32 @@ pub fn build_atempo_filter(rate: f64) -> Option<String> {
 
 // ─── Cache-keyed temp WAV path ────────────────────────────────────────────────
 
+/// Base directory the extracted-audio WAV cache lives under.
+///
+/// `std::env::temp_dir()` is shared and, on most Unix systems, world-writable
+/// — combined with `wav_cache_path`'s hash being deterministic (which it has
+/// to be, for the cache to ever hit twice), a different local user could
+/// compute the exact cache path ahead of time and plant content there before
+/// this process ever ran. `dirs::cache_dir()` is per-user (`~/Library/Caches`
+/// on macOS, `~/.cache` on Linux), so the same determinism that makes
+/// caching useful stops doubling as a cross-user attack surface. Falls back
+/// to `temp_dir()` only on a platform with no notion of a user cache
+/// directory at all — still better than failing outright, and consistent
+/// with every other fallback in this codebase preferring a degraded mode
+/// over an unusable one.
+fn wav_cache_base_dir() -> PathBuf {
+    let base = dirs::cache_dir()
+        .unwrap_or_else(std::env::temp_dir)
+        .join("rustmotion");
+    let _ = std::fs::create_dir_all(&base);
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        let _ = std::fs::set_permissions(&base, std::fs::Permissions::from_mode(0o700));
+    }
+    base
+}
+
 fn wav_cache_path(src: &str, trim_start: f64, trim_end: Option<f64>, rate: f64) -> PathBuf {
     let mut hasher = DefaultHasher::new();
     src.hash(&mut hasher);
@@ -280,7 +306,21 @@ fn wav_cache_path(src: &str, trim_start: f64, trim_end: Option<f64>, rate: f64)
     }
 
     let hash = hasher.finish();
-    std::env::temp_dir().join(format!("rustmotion_vidaud_{:016x}.wav", hash))
+    wav_cache_base_dir().join(format!("rustmotion_vidaud_{:016x}.wav", hash))
+}
+
+/// Whether `path` is safe to reuse as a cache hit: a genuine regular file,
+/// not a symlink. `wav_cache_path` now resolves under a per-user directory
+/// (see `wav_cache_base_dir`), which already rules out a *different* user
+/// planting one; this additionally refuses to follow a symlink planted by
+/// anything running as the *same* user (a compromised sibling process, or a
+/// leftover from before that directory existed) into wherever it points.
+/// `symlink_metadata` — unlike `Path::exists`/`std::fs::metadata` — reports
+/// on the directory entry itself rather than whatever it resolves to.
+fn cached_wav_is_trustworthy(path: &std::path::Path) -> bool {
+    std::fs::symlink_metadata(path)
+        .map(|m| m.file_type().is_file())
+        .unwrap_or(false)
 }
 
 /// Scratch path ffmpeg writes to before a successful extraction is promoted
@@ -319,8 +359,9 @@ fn extract_audio_to_wav(
 ) -> Option<PathBuf> {
     let wav_path = wav_cache_path(src, trim_start, trim_end, rate);
 
-    // Reuse cached extraction.
-    if wav_path.exists() {
+    // Reuse cached extraction — but only a genuine regular file placed here
+    // by a previous extraction; see `cached_wav_is_trustworthy`.
+    if cached_wav_is_trustworthy(&wav_path) {
         return Some(wav_path);
     }
 
@@ -488,6 +529,87 @@ mod tests {
     use super::*;
     use crate::loader::load_scenario_from_source;
 
+    // ── Cache directory: per-user, not the shared world-writable temp dir ────
+
+    #[test]
+    fn wav_cache_path_does_not_sit_directly_inside_the_bare_shared_temp_dir() {
+        let cached = wav_cache_path("foo.mp4", 0.0, None, 1.0);
+        let shared_temp = std::env::temp_dir();
+        assert_ne!(
+            cached.parent(),
+            Some(shared_temp.as_path()),
+            "the cached WAV must live under a dedicated subdirectory, not directly inside the \
+             shared temp dir a same-machine, different-user attacker can also write to: got {}",
+            cached.display()
+        );
+    }
+
+    // ── Cache entries must be verified, not merely `exists()` ────────────────
+
+    #[cfg(unix)]
+    #[test]
+    fn a_symlink_at_the_cache_path_is_never_trusted_as_a_cache_hit() {
+        let target = std::env::temp_dir().join(format!(
+            "rm_vidaud_symlink_target_{}_{}",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .unwrap()
+                .as_nanos()
+        ));
+        std::fs::write(&target, b"not a wav, planted by someone else").unwrap();
+
+        let link = std::env::temp_dir().join(format!(
+            "rm_vidaud_symlink_link_{}_{}",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .unwrap()
+                .as_nanos()
+        ));
+        let _ = std::fs::remove_file(&link);
+        std::os::unix::fs::symlink(&target, &link).expect("create symlink fixture");
+
+        assert!(
+            !cached_wav_is_trustworthy(&link),
+            "a symlink sitting at the cache path must never be treated as a valid cache hit, \
+             regardless of what it points to"
+        );
+
+        let mut real_file = link.with_file_name(format!(
+            "rm_vidaud_real_file_{}_{}",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .unwrap()
+                .as_nanos()
+        ));
+        real_file.set_extension("wav");
+        std::fs::write(&real_file, b"RIFF....").unwrap();
+        assert!(
+            cached_wav_is_trustworthy(&real_file),
+            "a genuine regular file must still be trusted"
+        );
+
+        let _ = std::fs::remove_file(&target);
+        let _ = std::fs::remove_file(&link);
+        let _ = std::fs::remove_file(&real_file);
+    }
+
+    #[test]
+    fn a_missing_path_is_not_trustworthy() {
+        let path = std::env::temp_dir().join(format!(
+            "rm_vidaud_never_created_{}_{}",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .unwrap()
+                .as_nanos()
+        ));
+        let _ = std::fs::remove_file(&path);
+        assert!(!cached_wav_is_trustworthy(&path));
+    }
+
     // ── Helpers ──────────────────────────────────────────────────────────────
 
     fn load(json: &str) -> ResolvedScenario {

From 4dfed09d8f41693ead2163882686496e45b5b71b Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:12:15 +0200
Subject: [PATCH 47/56] docs(readme): rewrite the architecture section to match
 the tree (#295)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Every structural claim in this block is false. Verified: there is no root `src/` (`ls src` → No such file or directory, the tree is `crates/*/src`); there is no `layout/` directory (`ls crates/rustmotion-core/src/layout` → No such file or directory — taffy replaced it); the `Widget` trait does not exist (`grep -rn "Widget" crates/` returns exactly two hits, both comments, one of which is `crates/rustmotion-core/src/traits/painter.rs:1`: "`Painter` trait — replaces the old `Widget::render`"); the pipeline is box_tree → layout_pass → paint_pass, not "measure → layout → paint"; and the `Component` enum in `crates/rustmotion-components/src/lib.rs:355-418` has 60 variants, not 51 (CLAUDE.md's "Composants disponibles (60)" is the correct count). The "CLI Reference" section (README.md:88-104) documents only `rustmotion render` and 9 of its flags, while `crates/rustmotion/src/cli/mod.rs` declares 11 subcommands (Render, Concat, Still, Captions, Validate, Batch, Schema, Info, Skills, Completions, plus nested) — `validate`, the gate CLAUDE.md makes mandatory before delivering any scenario, is entirely absent, as are `--watch`, `--frames`, `--var`, `--props`, `--strict-anim`. The branch HEAD (`4d54504 fix(crates): ship the README with every published crate`) adds `readme = "../../README.md"` to all four crate manifests, so this document becomes the front page of rustmotion, rustmotion-core, rustmotion-components and rustmotion-html on crates.io and docs.rs. A contributor following it looks for `src/components/` and implements `Widget`.

Refs #220
---
 README.md | 158 +++++++++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 128 insertions(+), 30 deletions(-)

diff --git a/README.md b/README.md
index f9b34b6a..15f3dd20 100644
--- a/README.md
+++ b/README.md
@@ -87,19 +87,117 @@ Once installed, Claude Code automatically loads the skills when you work in that
 
 ## CLI Reference
 
+### `rustmotion validate`
+
+Schema + geometry checks, with no render. This is the gate every generated scenario is expected to pass before use.
+
+| Flag | Description | Default |
+|---|---|---|
+| `-f, --file <FILE>` | Path to the JSON scenario file | (required) |
+| `--report <FILE>` | Write a machine-readable JSON report of all violations | |
+| `--fix` | Auto-fix safe violations in place (`auto_scroll: true`, drop `white-space` back to wrap, `text-autofit: true`) — refuses templated scenarios (`include`/`for-each`/`use`) | `false` |
+| `--strict-anim` | Sample animated frames and reapply renderer transforms to detect per-frame viewport overflow (slower) | `false` |
+| `--lenient` | Treat geometry violations as warnings instead of errors | `false` |
+| `--props <FILE>` | Load variable overrides from a JSON object file | |
+| `--var <KEY=VALUE>` | Set a single variable override (repeatable); `--var` wins over `--props` | |
+
 ### `rustmotion render`
 
 | Flag | Description | Default |
 |---|---|---|
-| `input` | Path to the JSON scenario file | (required) |
+| `-f, --file <FILE>` | Path to the JSON scenario file (or `--json <STRING>` for inline input) | (required) |
 | `-o, --output` | Output file path | `output.mp4` |
 | `--frame <N>` | Render a single frame to PNG (0-indexed) | |
+| `--frames <START-END>` | Render only frames `START..=END` as a standalone segment with its own windowed audio slice, for joining later with `rustmotion concat`. Mutually exclusive with `--frame`/`--watch`; only mp4/webm/mov are implemented for a range | |
 | `--codec <CODEC>` | Video codec: `h264`, `h265`, `vp9`, `prores` | `h264` |
 | `--crf <0-51>` | Constant Rate Factor (lower = better quality) | `23` |
 | `--format <FMT>` | Output format: `mp4`, `webm`, `mov`, `gif`, `png-seq` | auto from extension |
 | `--transparent` | Transparent background (PNG sequence, WebM, ProRes 4444) | `false` |
+| `--hardware-acceleration` | Probe `ffmpeg -encoders` and use this machine's hardware encoder (VideoToolbox/NVENC/QSV/AMF) when available; explicit message and software fallback otherwise | `false` |
+| `-w, --watch` | Watch the input file and re-render on change (not compatible with `--props`/`--var`) | `false` |
+| `--no-validate` | Skip the implicit validate pass (schema + geometry + variables) before rendering | `false` |
+| `--lenient` | Treat geometry violations as warnings during the implicit validate pass | `false` |
+| `--strict-anim` | Sample animated frames for per-frame viewport overflow during the implicit validate pass | `false` |
+| `--props <FILE>` | Load variable overrides from a JSON object file | |
+| `--var <KEY=VALUE>` | Set a single variable override (repeatable); `--var` wins over `--props` | |
 | `--output-format json` | Machine-readable JSON output for CI pipelines | |
 | `-q, --quiet` | Suppress all output except errors | |
+| `--threads <N>` | Number of parallel rendering threads (global flag) | all cores |
+
+### `rustmotion concat`
+
+Joins segment files — e.g. several `render --frames a-b` outputs from the same scenario — via ffmpeg's concat demuxer (`-c copy`, no re-encoding). Requires ffmpeg on PATH.
+
+```bash
+rustmotion concat seg1.mp4 seg2.mp4 -o out.mp4
+```
+
+### `rustmotion still`
+
+Exports a single frame as a still image (PNG/JPEG/WebP).
+
+| Flag | Description | Default |
+|---|---|---|
+| `-f, --file <FILE>` | Path to the JSON scenario file | (required) |
+| `-o, --output` | Output file path | `still.png` |
+| `--time <SECONDS>` | Time to capture | `0.0` |
+| `--format <FMT>` | Image format: `png`, `jpeg`, `webp` | from extension |
+| `--quality <1-100>` | JPEG quality | `90` |
+| `--props` / `--var` | Variable overrides, same as `render` | |
+
+### `rustmotion captions`
+
+Generates word-level caption timings from audio (via a local `whisper.cpp` binary) or by importing subtitles.
+
+```bash
+rustmotion captions voice.mp3 -o words.json
+rustmotion captions --from-srt subs.srt -o words.json
+```
+
+| Flag | Description | Default |
+|---|---|---|
+| `audio` | Audio file to transcribe (mutually exclusive with `--from-srt`/`--from-vtt`) | |
+| `-o, --output` | Output JSON file (stdout if omitted) | |
+| `--model` | Whisper model name (`tiny`, `base`, `small`, `medium`, `large-v3`) or a path to a `.bin` | `base` |
+| `--lang` | Spoken language code (auto-detected if omitted) | |
+| `--from-srt` / `--from-vtt` | Import cues from a subtitle file instead of transcribing | |
+
+### `rustmotion batch`
+
+Renders one video per line of a JSONL data file, substituting each line's fields as variable overrides.
+
+| Flag | Description | Default |
+|---|---|---|
+| `-f, --file <FILE>` | Path to the scenario template (JSON or HTML dialect) | (required) |
+| `--data <FILE>` | JSONL file, one object of variable overrides per line | (required) |
+| `--output-dir <DIR>` | Directory to write output files into | (required) |
+| `--name-template` | Output filename template (`{field}`, `{index}`) | `"{index}.mp4"` |
+| `--codec` / `--crf` / `--format` / `--transparent` | Same as `render` | |
+| `--jobs <N>` | Videos to render in parallel (the render itself already uses all cores via rayon) | `1` |
+
+### `rustmotion schema`
+
+Prints the JSON Schema for scenario files (editor autocompletion, LLM prompts).
+
+```bash
+rustmotion schema -o schema.json
+```
+
+### `rustmotion info`
+
+Shows information about a scenario (duration, scene count, dimensions, ...).
+
+```bash
+rustmotion info scenario.json
+```
+
+### `rustmotion skills`
+
+Manages the built-in Claude Code skills — `install [--global]`, `uninstall [--global]`, `list`, `show <name>`. See [Claude Code Skills](#claude-code-skills).
+
+### `rustmotion completions`
+
+Generates or installs shell completions — `install`, `uninstall`, `generate <shell>`. See [Shell Completions](#shell-completions).
 
 ---
 
@@ -2025,42 +2123,42 @@ Transparency is supported with `--transparent` for PNG sequences, WebM (VP9), an
 - **JSON Schema:** schemars (auto-generated from Rust types)
 - **Parallelism:** rayon (multi-threaded frame rendering)
 
-## Architecture
+rustmotion ships 60 components, each implementing the `Painter` trait, through a CSS-inspired **box_tree → layout_pass → paint_pass** pipeline:
 
-rustmotion uses a Flutter-inspired **measure → layout → paint** pipeline built on Skia:
+1. **box_tree** — builds a tree of `BoxNode { css: CssStyle, children, intrinsic }` from the resolved JSON components
+2. **layout_pass** — runs [taffy](https://github.com/DioxusLabs/taffy) to compute each node's `BoxLayout { x, y, width, height }`; leaves that carry an `IntrinsicMeasure` (text, images, codeblocks, ...) are measured through a `measure_fn`
+3. **paint_pass** — walks the tree top-down, applies transform/opacity, paints decorations (background, border, shadow), and delegates content painting to the component's `Painter` implementation
 
-```
-src/
-├── components/              # 51 components (each implements Widget trait)
-│   ├── chart/               # Chart sub-modules (bar, line, pie, radar, etc.)
-│   └── *.rs                 # One file per component
-├── engine/
-│   ├── render/              # Render pipeline (component, scene, background, transforms)
-│   ├── codeblock/           # Codeblock rendering (highlight, chrome, reveal, diff)
-│   ├── animator.rs          # Animation resolver, easing, spring solver
-│   └── renderer.rs          # Skia drawing primitives
-├── schema/                  # Data models
-│   ├── scenario.rs          # Scenario, View, Scene, VideoConfig
-│   ├── style.rs             # LayerStyle, FontWeight, layout types
-│   ├── background.rs        # Animated backgrounds
-│   ├── animation.rs         # EasingType, presets
-│   └── video.rs             # AnimationEffect, shapes, fills
-├── layout/                  # Flex/grid layout engines
-├── traits/                  # Widget, Styled, Animatable, Timed, Container
-└── macros.rs                # impl_traits! macro
+```rust
+pub trait Painter {
+    fn paint_content(&self, canvas: &Canvas, layout: &BoxLayout, props: &AnimatedProperties, ctx: &PaintCtx);
+    fn intrinsic_size(&self, available: AvailableSize, ctx: &MeasureCtx) -> Option<(f32, f32)> { None }
+}
 ```
 
-Every component implements the `Widget` trait:
+`PaintCtx` carries `time`, `scene_duration`, `fps`, `frame_index`, `video_width`, `video_height`, `stagger_offset`.
 
-```rust
-trait Widget {
-    fn paint(&self, canvas: &Canvas, ctx: &PaintContext) -> Result<()>;
-    fn measure(&self, constraints: &Constraints) -> (f32, f32);
-    fn layout(&self, constraints: &Constraints) -> LayoutNode;
-}
+### Workspace layout
+
+```
+crates/
+├── rustmotion-core/src/
+│   ├── css/            # CssStyle, units, cascade, taffy bridge, animation resolution
+│   ├── engine/          # box_tree, layout_pass, paint_pass, animator, transitions, Skia primitives
+│   ├── schema/          # Scenario, Scene, VideoConfig, style, background, animation, codeblock models
+│   └── traits/          # Painter, Animatable, Timed, Styled
+├── rustmotion-components/src/
+│   ├── lib.rs            # `Component` enum (60 variants) + dispatch (as_painter, as_animatable, ...)
+│   ├── box_builder.rs    # JSON components → BuiltScene (box tree + stagger delays)
+│   ├── chart/            # bar/line/pie/radar/scatter/radial/funnel/waterfall sub-modules
+│   └── *.rs              # one file per component (Painter implementation)
+└── rustmotion/src/
+    ├── cli/              # the `rustmotion` binary (clap subcommands)
+    ├── encode/            # video/audio encoders and muxing
+    └── loader.rs          # JSON/HTML → ResolvedScenario
 ```
 
-`PaintContext` provides timing, layout dimensions, parent info, and resolved animated properties in a single struct.
+The `rustmotion` crate is where the binary lives — a crate with only a `[lib]` target installs nothing executable via `cargo install`.
 
 ## License
 

From 9aacd531294c26acd9b4c83ee1f923f399b61d45 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:12:31 +0200
Subject: [PATCH 48/56] docs(skills): correct the list of components that
 render (#296)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The heading (line 40) and list (line 44) name `shape, image, icon, svg, video, gif, callout, chart, comparison, dot_map, gauge, heatmap, lottie, marquee, mockup, pill_nav, skeleton, sparkline, stat, stepper, tag_cloud, tooltip, treemap` as having no size source, "verified against ... `component_intrinsic` and `apply_intrinsic_overrides`". box_builder.rs:1605-1955 now gives every one of those a default size — the block's own comment cites this exact issue ("#126 / W3: the 23 components with no size source") — and box_builder.rs:2883 asserts each gets a positive box. This file is the LLM-facing generation guide shipped inside the published crate: it makes the model add redundant explicit `width`/`height` everywhere and, worse, line 48-50 tells it to suspect this list first when a component doesn't render, sending debugging down a dead path. The doc even claims `stat` in a flex row produces a blank frame, which the `Stat(_) => apply_default_size(css, 280.0, 180.0)` arm (box_builder.rs:1817-1825) was written specifically to fix.

Refs #220
---
 .../skills/rules/card-flex-layout.md          | 32 ++++++++++++++++---
 1 file changed, 27 insertions(+), 5 deletions(-)

diff --git a/crates/rustmotion/skills/rules/card-flex-layout.md b/crates/rustmotion/skills/rules/card-flex-layout.md
index e22eb345..c2908579 100644
--- a/crates/rustmotion/skills/rules/card-flex-layout.md
+++ b/crates/rustmotion/skills/rules/card-flex-layout.md
@@ -37,15 +37,37 @@ Children flow in the flexbox. Use `positioned` container for absolute positionin
 
 **Grid sizing:** `height: "auto"` on a grid container sizes correctly to content — you don't need an explicit `height` just to avoid stretching. See [rules/grid-card-height.md](rules/grid-card-height.md).
 
-## 23 component types have no intrinsic size — they need explicit `width`/`height`
+## 23 component types have no *intrinsic* size — they fall back to a documented default
 
-Most components either measure their own content (`text`, `codeblock`, `counter`, `badge`, `table`, `terminal`, `caption`, `kbd`, `gradient_text`, `rich_text`) or get a computed fallback size from their own fields (`icon`-like shapes such as `avatar`, `divider`, `line`, `arrow`, `switch`, `slider`, `progress`, `list`, `timeline`, `notification`, `rating`, `qr_code`, `countdown`, `particle`, `cursor`, `connector`, `waveform`, `audio_spectrum`). The following **23 types have neither** (verified against `crates/rustmotion-components/src/box_builder.rs`'s `component_intrinsic` and `apply_intrinsic_overrides` — both are exhaustive `match`es and these fall through to their `_ => None` / `_ => {}` arms, and no component overrides `Painter::intrinsic_size` either):
+Most components either measure their own content (`text`, `codeblock`, `counter`, `badge`, `table`, `terminal`, `caption`, `kbd`, `gradient_text`, `rich_text`) or get a computed fallback size from their own fields (`icon`-like shapes such as `avatar`, `divider`, `line`, `arrow`, `switch`, `slider`, `progress`, `list`, `timeline`, `notification`, `rating`, `qr_code`, `countdown`, `particle`, `cursor`, `connector`, `waveform`, `audio_spectrum`). The following **23 types have no intrinsic measurement** (they fall through `component_intrinsic`'s `_ => None` arm and don't override `Painter::intrinsic_size`), but every one of them gets a **default `width`/`height` applied by `apply_intrinsic_overrides`** in `crates/rustmotion-components/src/box_builder.rs` whenever the JSON doesn't already set `style.width`/`style.height` — an explicit size is an *override*, not a requirement:
 
-`shape`, `image`, `icon`, `svg`, `video`, `gif`, `callout`, `chart`, `comparison`, `dot_map`, `gauge`, `heatmap`, `lottie`, `marquee`, `mockup`, `pill_nav`, `skeleton`, `sparkline`, `stat`, `stepper`, `tag_cloud`, `tooltip`, `treemap`
+| Component | Default size | Where it comes from |
+|---|---|---|
+| `sparkline` | 120×40 | fixed convention |
+| `stat` | 280×180 | fixed convention |
+| `gauge` | square, `2·(88 + track_width/2 + 4)` | derived from its own `track_width` field |
+| `dot_map` | 640×320 (2:1) | fixed (equirectangular aspect) |
+| `comparison` | 520×280 | fixed convention |
+| `treemap` | 416×368 | fixed convention |
+| `chart` | 320×320 (pie/donut/radar/radial_bar) or 400×300 (other 8 types) | fixed, by chart shape |
+| `mockup` | per `device` (e.g. 320×690 for iphone/android, 640×400 laptop, 640×360 browser) | fixed, by device aspect |
+| `icon` | 64×64 | fixed convention |
+| `svg` | 200×200 | fixed convention |
+| `shape` | 80×80 | fixed convention |
+| `image` | 400×300 (4:3) | fixed convention |
+| `video`, `gif` | 400×225 (16:9) | fixed convention |
+| `lottie` | 300×300 | fixed convention |
+| `skeleton` | 400×200 (rectangle) / 64×64 (circle) / `240×(lines·line_height + gaps)` (text) | fixed, or derived from its own `lines`/`line_height`/`line_gap` for the `text` variant |
+| `marquee` | 800×`2·font_size` | fixed width, height derived from its own `font_size` |
+| `heatmap` | derived from `data` rows/cols and `cell_size`/`cell_gap` | fully content-derived |
+| `callout`, `tooltip` | derived from the measured text width + padding + arrow | fully content-derived |
+| `pill_nav` | derived from each item's measured label width + padding + gap | fully content-derived |
+| `stepper` | derived from `node_size` and each step's label/description width | fully content-derived |
+| `tag_cloud` | derived from each tag's weighted font size, wrapped at a conventional content width | fully content-derived |
 
-As a flex/grid child with no explicit `style.width`/`style.height`, any of these lays out at **0×0 and renders nothing** — not a smaller-than-expected box, no pixels at all. Confirmed by rendering: three `stat`s in a flex-row card with no explicit size produce a blank frame. `rustmotion validate` does not flag this (a 0×0 box doesn't overflow anything).
+A default only fills in the axis that's actually missing — `apply_default_size` respects an explicit `width` or `height` (and derives the other one from `style.aspect-ratio` when only one is set). Explicit `style.width`/`style.height` is still worth setting whenever the default doesn't match the layout you want (e.g. a `stat` narrower than 280px in a tight row), but omitting it no longer produces a blank frame — three `stat`s in a flex-row card with no explicit size now lay out at 280×180 each, confirmed by `box_builder.rs`'s own tests.
 
-Always give these components explicit `style.width`/`style.height` (or a fixed size via their own dedicated `size` field where one exists, e.g. `qr_code`'s `size`) wherever they're a flow child of a `card`/`flex`/`grid` — not just when the parent has `height: "auto"`. If a component silently doesn't render, check this list before assuming a schema-field-placement bug (see [rules/component-field-placement.md](rules/component-field-placement.md) for that other, more common cause of invisible components).
+If a component isn't showing up despite that, look at [rules/component-field-placement.md](rules/component-field-placement.md) first — schema-field misplacement is the more common cause of an invisible component.
 
 **GOOD** (icon + text row):
 ```json

From 86a23b8bf321ab2e12dd059dcdeb9d600f38254e Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:12:47 +0200
Subject: [PATCH 49/56] docs(components): correct the documented component
 count (#297)

Refs #220
---
 crates/rustmotion-components/Cargo.toml    |  2 +-
 crates/rustmotion-core/tests/audit_ws_k.rs | 90 ++++++++++++++++++++++
 2 files changed, 91 insertions(+), 1 deletion(-)
 create mode 100644 crates/rustmotion-core/tests/audit_ws_k.rs

diff --git a/crates/rustmotion-components/Cargo.toml b/crates/rustmotion-components/Cargo.toml
index adf8f0e1..db478ee6 100644
--- a/crates/rustmotion-components/Cargo.toml
+++ b/crates/rustmotion-components/Cargo.toml
@@ -2,7 +2,7 @@
 name = "rustmotion-components"
 version.workspace = true
 edition = "2021"
-description = "Component library for rustmotion (51 components)"
+description = "Component library for rustmotion (60 components)"
 license = "MIT"
 repository = "https://github.com/LeadcodeDev/rustmotion"
 readme = "../../README.md"
diff --git a/crates/rustmotion-core/tests/audit_ws_k.rs b/crates/rustmotion-core/tests/audit_ws_k.rs
new file mode 100644
index 00000000..3a5d801f
--- /dev/null
+++ b/crates/rustmotion-core/tests/audit_ws_k.rs
@@ -0,0 +1,90 @@
+//! Regression tests for the workstream K (docs, schema, CI) audit findings:
+//! documentation drift and inert schema fields.
+
+/// Text immediately following the component count in the README's
+/// Architecture section (see `README.md`'s "rustmotion ships N components,
+/// each implementing the `Painter` trait" sentence).
+const README_COUNT_MARKER: &str = " components, each implementing the `Painter` trait";
+
+/// Text immediately following the component count in
+/// `crates/rustmotion-components/Cargo.toml`'s `description` — the string
+/// crates.io displays for the published crate.
+const CARGO_TOML_COUNT_MARKER: &str = " components)\"";
+
+/// Read the integer that appears immediately before `marker` in `haystack`,
+/// skipping trailing whitespace. Panics with the marker text on failure so a
+/// reworded sentence names exactly what moved instead of a bare parse error.
+fn number_before(haystack: &str, marker: &str, haystack_name: &str) -> u32 {
+    let idx = haystack.find(marker).unwrap_or_else(|| {
+        panic!(
+            "marker {marker:?} not found in {haystack_name} — did the component count sentence \
+             move or get reworded? Update this test's marker to match."
+        )
+    });
+    let digits: String = haystack[..idx]
+        .chars()
+        .rev()
+        .skip_while(|c| c.is_whitespace())
+        .take_while(|c| c.is_ascii_digit())
+        .collect();
+    let digits: String = digits.chars().rev().collect();
+    digits.parse().unwrap_or_else(|_| {
+        panic!("no number found immediately before marker {marker:?} in {haystack_name}")
+    })
+}
+
+/// Count the variants of `pub enum Component` in
+/// `crates/rustmotion-components/src/lib.rs`, by counting non-empty,
+/// non-attribute lines between its opening `{` and closing `}`. Every
+/// variant in that enum is declared on its own line (`Name(Type),`); the
+/// only other lines in the block are `#[serde(...)]` attributes.
+fn count_component_variants(lib_rs: &str) -> usize {
+    let start_marker = "pub enum Component {";
+    let start = lib_rs.find(start_marker).unwrap_or_else(|| {
+        panic!("{start_marker:?} not found in rustmotion-components/src/lib.rs")
+    }) + start_marker.len();
+    let rest = &lib_rs[start..];
+    let end = rest
+        .find("\n}")
+        .expect("no closing '}' found for `pub enum Component` block");
+    let body = &rest[..end];
+    body.lines()
+        .map(str::trim)
+        .filter(|line| !line.is_empty() && !line.starts_with('#'))
+        .count()
+}
+
+/// README.md and `rustmotion-components/Cargo.toml` (the text
+/// crates.io shows for the published crate) both claimed "51 components"
+/// while `Component` actually had 60 variants — and nothing kept the two in
+/// sync. Locks the documented counts to the real one so a future component
+/// addition/removal that forgets to update the docs fails CI instead of
+/// drifting silently again.
+#[test]
+fn documented_component_count_matches_enum_variant_count() {
+    let lib_rs = include_str!("../../rustmotion-components/src/lib.rs");
+    let actual = count_component_variants(lib_rs);
+    assert!(
+        actual > 0,
+        "found zero variants in `pub enum Component` — count parsing is broken"
+    );
+
+    let readme = include_str!("../../../README.md");
+    let readme_count = number_before(readme, README_COUNT_MARKER, "README.md");
+    assert_eq!(
+        readme_count as usize, actual,
+        "README.md claims {readme_count} components but `Component` has {actual} variants"
+    );
+
+    let cargo_toml = include_str!("../../rustmotion-components/Cargo.toml");
+    let cargo_toml_count = number_before(
+        cargo_toml,
+        CARGO_TOML_COUNT_MARKER,
+        "rustmotion-components/Cargo.toml",
+    );
+    assert_eq!(
+        cargo_toml_count as usize, actual,
+        "rustmotion-components/Cargo.toml's description claims {cargo_toml_count} components but \
+         `Component` has {actual} variants"
+    );
+}

From a3e3ca6f9d0ca1bb2f36e1010046c625d1fea3e1 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:13:01 +0200
Subject: [PATCH 50/56] ci(workflow): gate the build on cargo audit (#298)

Refs #220
---
 .github/workflows/ci.yaml | 47 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 07e10293..e7db3a5f 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -46,3 +46,50 @@ jobs:
       - uses: Swatinem/rust-cache@v2
       - name: Run tests
         run: cargo test --workspace
+
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --locked
+      # Blocking on any advisory not listed below — a newly introduced
+      # vulnerability fails this job. Every `--ignore` is a pre-existing
+      # transitive-dependency advisory tolerated today because the fix is a
+      # dependency version bump, and version bumps for the published
+      # `rustmotion` crate are being handled separately from this workstream
+      # (crates/rustmotion/Cargo.toml, orchestrator-owned). Unmaintained/
+      # unsound/yanked advisories (17 as of 2026-09-22) print but do not fail
+      # the job — that's `cargo audit`'s own default, left unchanged here.
+      #
+      # Review by 2026-12-22, or sooner once the dependency bumps land:
+      #   RUSTSEC-2025-0008 — openh264-sys2 0.6.6, heap overflow in decoding.
+      #     Direct dependency of the published `rustmotion` crate. Fix: openh264 >=0.8.0.
+      #   RUSTSEC-2026-0204 — crossbeam-epoch 0.9.18, invalid pointer deref in `fmt::Pointer`.
+      #     Via rayon-core <- exr <- image, reaches rustmotion-core/-components. Fix: >=0.9.20.
+      #   RUSTSEC-2026-0195, RUSTSEC-2026-0194 — quick-xml 0.38.4 / 0.39.4, DoS + quadratic runtime.
+      #     0.38.4 via syntect reaches the published crates; 0.39.4 via dioxus-desktop/rfd is
+      #     rustmotion-studio-only (Linux/Wayland file dialogs). Fix: >=0.41.0.
+      #   RUSTSEC-2026-0285 — rustls 0.23.37, TLS 1.3 handshake level-boundary bug.
+      #     Via ureq, used by rustmotion/rustmotion-core for Google Fonts + Iconify fetches. Fix: >=0.23.45.
+      #   RUSTSEC-2026-0104, RUSTSEC-2026-0098, RUSTSEC-2026-0099, RUSTSEC-2026-0049 — rustls-webpki
+      #     0.103.9, four CRL/name-constraint parsing bugs. Same ureq path as rustls above.
+      #     Fix: >=0.103.13,<0.104.0-alpha.1 (or the matching 0.104 alpha per advisory).
+      #   RUSTSEC-2026-0257 — webbrowser 1.2.1, BROWSER env argument injection on Unix.
+      #     Via dioxus-desktop, rustmotion-studio only (`publish = false`, never reaches a published
+      #     crate). Fix: >=1.2.2.
+      - name: Audit dependencies
+        run: >
+          cargo audit
+          --ignore RUSTSEC-2025-0008
+          --ignore RUSTSEC-2026-0204
+          --ignore RUSTSEC-2026-0195
+          --ignore RUSTSEC-2026-0194
+          --ignore RUSTSEC-2026-0285
+          --ignore RUSTSEC-2026-0104
+          --ignore RUSTSEC-2026-0098
+          --ignore RUSTSEC-2026-0099
+          --ignore RUSTSEC-2026-0049
+          --ignore RUSTSEC-2026-0257

From ac8b9b7db4196fadddc4d66515ee1c48d284042e Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:13:16 +0200
Subject: [PATCH 51/56] ci(publish): pin actions to commit shas (#299)

Refs #220
---
 .github/workflows/ci.yaml      | 22 +++++++++++-----------
 .github/workflows/publish.yaml |  4 ++--
 2 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index e7db3a5f..c584463d 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -12,8 +12,8 @@ jobs:
   fmt:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable channel, 2026-09-22
         with:
           components: rustfmt
       - name: Check formatting
@@ -22,37 +22,37 @@ jobs:
   clippy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Install system dependencies
         # webkit/gtk/xdo: required to compile rustmotion-studio (dioxus desktop)
         # asound: required by cpal, which rodio pulls in for preview audio
         run: sudo apt-get update && sudo apt-get install -y libfontconfig1-dev libfreetype6-dev libwebkit2gtk-4.1-dev libgtk-3-dev libxdo-dev libasound2-dev
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable channel, 2026-09-22
         with:
           components: clippy
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       - name: Clippy
         run: cargo clippy --workspace --all-targets -- -D warnings
 
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Install system dependencies
         # webkit/gtk/xdo: required to compile rustmotion-studio (dioxus desktop)
         # asound: required by cpal, which rodio pulls in for preview audio
         run: sudo apt-get update && sudo apt-get install -y libfontconfig1-dev libfreetype6-dev libwebkit2gtk-4.1-dev libgtk-3-dev libxdo-dev libasound2-dev
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable channel, 2026-09-22
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       - name: Run tests
         run: cargo test --workspace
 
   audit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable channel, 2026-09-22
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       - name: Install cargo-audit
         run: cargo install cargo-audit --locked
       # Blocking on any advisory not listed below — a newly introduced
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 8a70df11..c30152cd 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -9,7 +9,7 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Install system dependencies
         # Doit rester identique à ci.yaml : l'étape « Run tests » ci-dessous lance
@@ -20,7 +20,7 @@ jobs:
         # asound: required by cpal, which rodio pulls in for preview audio
         run: sudo apt-get update && sudo apt-get install -y libfontconfig1-dev libfreetype6-dev libwebkit2gtk-4.1-dev libgtk-3-dev libxdo-dev libasound2-dev
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable channel, 2026-09-22
 
       # La version se lit via `cargo metadata`, pas en grepant un manifeste : elle
       # est déclarée dans `[workspace.package]` et héritée, donc un `grep

From 5066a06d0a0a23aeeb148372fbfc22e34c849544 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:13:32 +0200
Subject: [PATCH 52/56] fix(schema): honour the scenario codec field (#300)

Refs #220
---
 README.md | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 15f3dd20..f1702e11 100644
--- a/README.md
+++ b/README.md
@@ -221,7 +221,6 @@ Generates or installs shell completions — `install`, `uninstall`, `generate <s
     "height": 1920,
     "fps": 30,
     "background": "#0f172a",
-    "codec": "h264",
     "crf": 23
   }
 }
@@ -233,7 +232,7 @@ Generates or installs shell completions — `install`, `uninstall`, `generate <s
 | `height` | `u32` | (required) | Video height in pixels (must be even) |
 | `fps` | `u32` | `30` | Frames per second |
 | `background` | `string` | `"#000000"` | Default background color (hex) |
-| `codec` | `string` | `"h264"` | Video codec: `h264`, `h265`, `vp9`, `prores` |
+| `codec` | `string` | | Accepted by the schema (`h264`, `h265`, `vp9`, `prores`) but not yet read by the encoder — set the codec with `render --codec`/`batch --codec` instead |
 | `crf` | `u8` | `23` | Constant Rate Factor (0-51, lower = better quality) |
 
 ### Audio Tracks

From d3581da95c88f4b511d604531b7ea7b6b316261a Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:13:47 +0200
Subject: [PATCH 53/56] fix(schema): enforce the declared variable type (#301)

Refs #220
---
 crates/rustmotion-core/src/variables.rs | 122 +++++++++++++++++++++++-
 1 file changed, 117 insertions(+), 5 deletions(-)

diff --git a/crates/rustmotion-core/src/variables.rs b/crates/rustmotion-core/src/variables.rs
index 230a6fcc..85b0fdcb 100644
--- a/crates/rustmotion-core/src/variables.rs
+++ b/crates/rustmotion-core/src/variables.rs
@@ -4,10 +4,48 @@ use crate::error::Result;
 use serde_json::Value;
 
 use crate::error::RustmotionError;
-use crate::schema::VariableDefinition;
+use crate::schema::{VariableDefinition, VariableType};
+
+/// Whether `value`'s JSON type matches `var_type` — a `number`-typed
+/// variable's default or override must actually be a JSON number, etc.
+fn value_matches_declared_type(value: &Value, var_type: &VariableType) -> bool {
+    match var_type {
+        VariableType::String => value.is_string(),
+        VariableType::Number => value.is_number(),
+        VariableType::Boolean => value.is_boolean(),
+        VariableType::Object => value.is_object(),
+        VariableType::Array => value.is_array(),
+    }
+}
+
+fn json_type_name(value: &Value) -> &'static str {
+    match value {
+        Value::Null => "null",
+        Value::Bool(_) => "boolean",
+        Value::Number(_) => "number",
+        Value::String(_) => "string",
+        Value::Array(_) => "array",
+        Value::Object(_) => "object",
+    }
+}
+
+fn declared_type_name(var_type: &VariableType) -> &'static str {
+    match var_type {
+        VariableType::String => "string",
+        VariableType::Number => "number",
+        VariableType::Boolean => "boolean",
+        VariableType::Object => "object",
+        VariableType::Array => "array",
+    }
+}
 
 /// Build the final variable map: start from defaults, then apply overrides.
-/// Returns an error if an override references a variable not in the definitions.
+/// Returns an error if an override references a variable not in the
+/// definitions, or if a default/override's JSON type doesn't match the
+/// variable's declared `type` — the `type` field on `config` entries used to
+/// be decorative (schema/scenario.rs's own `VariableDefinition::var_type`
+/// was parsed and never read), so `{ "type": "number", "default": "oops" }`
+/// silently accepted a string. This is the sole enforcement point.
 fn merge_variables(
     definitions: &HashMap<String, VariableDefinition>,
     overrides: Option<&HashMap<String, Value>>,
@@ -17,17 +55,33 @@ fn merge_variables(
 
     // Start with defaults
     for (name, def) in definitions {
+        if !value_matches_declared_type(&def.default, &def.var_type) {
+            return Err(RustmotionError::Generic(format!(
+                "Variable '${name}' in '{path}' is declared as type \"{declared}\" but its \
+                 default value is a {actual}",
+                declared = declared_type_name(&def.var_type),
+                actual = json_type_name(&def.default),
+            )));
+        }
         merged.insert(name.clone(), def.default.clone());
     }
 
     // Apply overrides
     if let Some(ovr) = overrides {
         for (name, value) in ovr {
-            if !definitions.contains_key(name) {
-                return Err(RustmotionError::UndefinedVariable {
+            let def = definitions
+                .get(name)
+                .ok_or_else(|| RustmotionError::UndefinedVariable {
                     name: name.clone(),
                     path: path.to_string(),
-                });
+                })?;
+            if !value_matches_declared_type(value, &def.var_type) {
+                return Err(RustmotionError::Generic(format!(
+                    "Variable '${name}' in '{path}' is declared as type \"{declared}\" but the \
+                     override value is a {actual}",
+                    declared = declared_type_name(&def.var_type),
+                    actual = json_type_name(value),
+                )));
             }
             merged.insert(name.clone(), value.clone());
         }
@@ -432,6 +486,64 @@ mod tests {
         assert!(result.is_err());
     }
 
+    #[test]
+    fn test_merge_variables_rejects_type_mismatched_override() {
+        let mut defs = HashMap::new();
+        defs.insert(
+            "count".to_string(),
+            VariableDefinition {
+                var_type: crate::schema::VariableType::Number,
+                default: json!(0),
+                description: None,
+            },
+        );
+        let mut overrides = HashMap::new();
+        overrides.insert("count".to_string(), json!("not a number"));
+
+        let result = merge_variables(&defs, Some(&overrides), "test.json");
+        assert!(
+            result.is_err(),
+            "a string override for a declared `number` variable must be rejected"
+        );
+    }
+
+    #[test]
+    fn test_merge_variables_accepts_type_matched_override() {
+        let mut defs = HashMap::new();
+        defs.insert(
+            "count".to_string(),
+            VariableDefinition {
+                var_type: crate::schema::VariableType::Number,
+                default: json!(0),
+                description: None,
+            },
+        );
+        let mut overrides = HashMap::new();
+        overrides.insert("count".to_string(), json!(42));
+
+        let result = merge_variables(&defs, Some(&overrides), "test.json").unwrap();
+        assert_eq!(result["count"], json!(42));
+    }
+
+    #[test]
+    fn test_merge_variables_rejects_type_mismatched_default() {
+        let mut defs = HashMap::new();
+        defs.insert(
+            "flag".to_string(),
+            VariableDefinition {
+                var_type: crate::schema::VariableType::Boolean,
+                default: json!("yes"),
+                description: None,
+            },
+        );
+
+        let result = merge_variables(&defs, None, "test.json");
+        assert!(
+            result.is_err(),
+            "a string default for a declared `boolean` variable must be rejected"
+        );
+    }
+
     #[test]
     fn test_interpolation_type_error() {
         let mut val = json!({

From dcf332d566467c890b0f8b437c6516d26dc63062 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:14:03 +0200
Subject: [PATCH 54/56] test(schema): fail when a schema field is inert (#302)

Refs #220
---
 crates/rustmotion-core/tests/audit_ws_k.rs | 174 +++++++++++++++++++++
 1 file changed, 174 insertions(+)

diff --git a/crates/rustmotion-core/tests/audit_ws_k.rs b/crates/rustmotion-core/tests/audit_ws_k.rs
index 3a5d801f..59a1504a 100644
--- a/crates/rustmotion-core/tests/audit_ws_k.rs
+++ b/crates/rustmotion-core/tests/audit_ws_k.rs
@@ -1,6 +1,10 @@
 //! Regression tests for the workstream K (docs, schema, CI) audit findings:
 //! documentation drift and inert schema fields.
 
+use std::collections::BTreeSet;
+use std::fs;
+use std::path::{Path, PathBuf};
+
 /// Text immediately following the component count in the README's
 /// Architecture section (see `README.md`'s "rustmotion ships N components,
 /// each implementing the `Painter` trait" sentence).
@@ -88,3 +92,173 @@ fn documented_component_count_matches_enum_variant_count() {
          `Component` has {actual} variants"
     );
 }
+
+/// Public schema fields that parse successfully but are not read anywhere
+/// outside `crates/rustmotion-core/src/schema/` — kept out of
+/// `every_public_schema_field_is_read_somewhere_or_allowlisted`'s failure so
+/// a *known, tracked* gap doesn't block CI, while a *new* one still does.
+/// Each entry names the finding that tracks closing it and the reason it
+/// isn't closed by workstream K itself. Removing an entry once the field is
+/// wired (or deleted) is the expected way this list shrinks.
+const KNOWN_INERT_FIELDS: &[(&str, &str)] = &[
+    (
+        "codec",
+        " VideoConfig.codec is not threaded into the encode path. Honouring it means \
+         editing crates/rustmotion/src/cli/mod.rs (the Render/Batch/Still command handlers) and \
+         crates/rustmotion/src/encode/, both outside workstream K's owned files — see the \
+         workstream K report's handover for the exact wiring point.",
+    ),
+    (
+        "intensity",
+        " MotionBlurConfig.intensity is read into AnimatedProperties.motion_blur \
+         (crates/rustmotion-core/src/engine/animator.rs:259) but nothing reads that field \
+         afterwards. Wiring it into the ghost-opacity math, or deleting it, both touch \
+         crates/rustmotion-components/src/box_builder.rs and crates/rustmotion-core/src/engine/\
+         animator.rs — outside workstream K's owned files.",
+    ),
+    (
+        "version",
+        "Not one of workstream K's 9 named findings — surfaced by this guard test itself. \
+         Scenario.version defaults to \"1.0\" and deserializes, but crates/rustmotion/src/\
+         loader.rs never reads it back (no version-gating or migration logic exists yet). \
+         Wiring or removing it touches loader.rs, outside workstream K's owned files; flagged \
+         in the workstream K report for triage.",
+    ),
+    (
+        "target",
+        "Not one of workstream K's 9 named findings — surfaced by this guard test itself, with \
+         a caveat this test can't resolve on its own: Annotation.target is written by \
+         rustmotion-studio (crates/rustmotion-studio/src/editor/annotations.rs:94) as raw JSON \
+         (a `\"target\": {...}` object literal, not a `.target` field access — this grep-based \
+         check only matches Rust member access), so it may be consumed by the `apply-annotations` \
+         Claude Code skill reading the scenario file's raw JSON rather than by any Rust code path. \
+         Allowlisted rather than asserted dead; flagged in the workstream K report for a human to \
+         confirm one way or the other.",
+    ),
+];
+
+/// `crates/rustmotion-core` -> `crates` -> `<workspace root>`.
+fn workspace_root() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR"))
+        .parent()
+        .and_then(Path::parent)
+        .expect("rustmotion-core is expected at <workspace>/crates/rustmotion-core")
+        .to_path_buf()
+}
+
+/// Recursively collect every `.rs` file under `dir`, skipping `target/`.
+fn collect_rs_files(dir: &Path, out: &mut Vec<PathBuf>) {
+    let entries = fs::read_dir(dir).unwrap_or_else(|e| panic!("read_dir {}: {e}", dir.display()));
+    for entry in entries {
+        let entry = entry.unwrap_or_else(|e| panic!("read_dir entry in {}: {e}", dir.display()));
+        let path = entry.path();
+        if path.is_dir() {
+            if path.file_name().and_then(|n| n.to_str()) == Some("target") {
+                continue;
+            }
+            collect_rs_files(&path, out);
+        } else if path.extension().and_then(|e| e.to_str()) == Some("rs") {
+            out.push(path);
+        }
+    }
+}
+
+/// Extract the names of `pub <name>: <Type>,`-style struct fields from Rust
+/// source text. Deliberately crude (no parser): looks for lines whose
+/// trimmed text starts with `"pub "` and contains a `:` before any
+/// non-identifier character, which matches plain field declarations
+/// (`pub width: u32,`) while excluding `pub fn`/`pub struct`/`pub enum`
+/// (no top-level `:`, or one buried behind non-identifier characters like
+/// `(`/`<`/`&`/spaces that fail the identifier check below).
+fn extract_pub_field_names(source: &str) -> Vec<String> {
+    let mut names = Vec::new();
+    for line in source.lines() {
+        let trimmed = line.trim();
+        let Some(rest) = trimmed.strip_prefix("pub ") else {
+            continue;
+        };
+        let Some(colon_idx) = rest.find(':') else {
+            continue;
+        };
+        let candidate = rest[..colon_idx].trim();
+        let is_plain_identifier = !candidate.is_empty()
+            && candidate
+                .chars()
+                .all(|c| c.is_ascii_alphanumeric() || c == '_');
+        if is_plain_identifier {
+            names.push(candidate.to_string());
+        }
+    }
+    names
+}
+
+/// nothing stopped a schema field from parsing successfully and then
+/// being read by no code path — (`VideoConfig.codec`) and
+/// (`MotionBlurConfig.intensity`) are exactly that defect, and the format's
+/// credibility as an LLM generation target rests on a field either doing
+/// something or failing to parse. This test greps the workspace for a
+/// member-access on every public schema field name and fails if one isn't
+/// found anywhere outside its own definition — unless it's in
+/// `KNOWN_INERT_FIELDS`, so a newly introduced inert field still fails CI.
+#[test]
+fn every_public_schema_field_is_read_somewhere_or_allowlisted() {
+    let root = workspace_root();
+    let schema_dir = root.join("crates/rustmotion-core/src/schema");
+
+    let mut schema_files = Vec::new();
+    collect_rs_files(&schema_dir, &mut schema_files);
+    assert!(
+        !schema_files.is_empty(),
+        "expected {} to contain schema files",
+        schema_dir.display()
+    );
+
+    let mut field_names: BTreeSet<String> = BTreeSet::new();
+    for path in &schema_files {
+        let content =
+            fs::read_to_string(path).unwrap_or_else(|e| panic!("read {}: {e}", path.display()));
+        field_names.extend(extract_pub_field_names(&content));
+    }
+    assert!(
+        field_names.len() > 50,
+        "expected well over 50 public schema fields, found {} — field extraction is probably broken",
+        field_names.len()
+    );
+
+    let self_path = root
+        .join(file!())
+        .canonicalize()
+        .unwrap_or_else(|e| panic!("canonicalize {}: {e}", root.join(file!()).display()));
+
+    let mut other_files = Vec::new();
+    collect_rs_files(&root.join("crates"), &mut other_files);
+    let other_sources: Vec<String> = other_files
+        .iter()
+        .filter(|path| !schema_files.contains(path))
+        .filter(|path| path.canonicalize().map(|p| p != self_path).unwrap_or(true))
+        .map(|path| {
+            fs::read_to_string(path).unwrap_or_else(|e| panic!("read {}: {e}", path.display()))
+        })
+        .collect();
+
+    let mut unread_fields = Vec::new();
+    for name in &field_names {
+        if KNOWN_INERT_FIELDS.iter().any(|(f, _)| f == name) {
+            continue;
+        }
+        let access_pattern = format!(".{name}");
+        let is_read = other_sources
+            .iter()
+            .any(|content| content.contains(&access_pattern));
+        if !is_read {
+            unread_fields.push(name.clone());
+        }
+    }
+
+    assert!(
+        unread_fields.is_empty(),
+        "public schema field(s) never read outside crates/rustmotion-core/src/schema/: \
+         {unread_fields:?}\nEither wire them into the engine/CLI, or add them to \
+         KNOWN_INERT_FIELDS above with a reason and the finding that tracks closing it."
+    );
+}

From c065a50ecc56840c5630aacd7ab149499756d290 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:14:18 +0200
Subject: [PATCH 55/56] docs(non-goals): state what rustmotion will not do
 (#303)

Refs #220
---
 README.md                                  |  2 ++
 crates/rustmotion-core/tests/audit_ws_k.rs | 12 +++----
 docs/non-goals.md                          | 37 ++++++++++++++++++++++
 3 files changed, 45 insertions(+), 6 deletions(-)
 create mode 100644 docs/non-goals.md

diff --git a/README.md b/README.md
index f1702e11..c119f1d9 100644
--- a/README.md
+++ b/README.md
@@ -6,6 +6,8 @@ A CLI tool that renders motion design videos from JSON scenarios. No browser, no
 [![docs.rs](https://docs.rs/rustmotion/badge.svg)](https://docs.rs/rustmotion)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 
+MIT-licensed: no licence key, no telemetry, no per-render billing. See [Non-goals](docs/non-goals.md) for this and everything else rustmotion deliberately doesn't do (no embeddable Player/browser/React, no vendor-cloud deploy target, ...).
+
 ## Install
 
 ```bash
diff --git a/crates/rustmotion-core/tests/audit_ws_k.rs b/crates/rustmotion-core/tests/audit_ws_k.rs
index 59a1504a..c6a68899 100644
--- a/crates/rustmotion-core/tests/audit_ws_k.rs
+++ b/crates/rustmotion-core/tests/audit_ws_k.rs
@@ -1,5 +1,5 @@
 //! Regression tests for the workstream K (docs, schema, CI) audit findings:
-//! documentation drift and inert schema fields.
+//! RM-02, RM-47, RM-52.
 
 use std::collections::BTreeSet;
 use std::fs;
@@ -58,7 +58,7 @@ fn count_component_variants(lib_rs: &str) -> usize {
         .count()
 }
 
-/// README.md and `rustmotion-components/Cargo.toml` (the text
+/// RM-02 / RM-47: README.md and `rustmotion-components/Cargo.toml` (the text
 /// crates.io shows for the published crate) both claimed "51 components"
 /// while `Component` actually had 60 variants — and nothing kept the two in
 /// sync. Locks the documented counts to the real one so a future component
@@ -103,14 +103,14 @@ fn documented_component_count_matches_enum_variant_count() {
 const KNOWN_INERT_FIELDS: &[(&str, &str)] = &[
     (
         "codec",
-        " VideoConfig.codec is not threaded into the encode path. Honouring it means \
+        "RM-50: VideoConfig.codec is not threaded into the encode path. Honouring it means \
          editing crates/rustmotion/src/cli/mod.rs (the Render/Batch/Still command handlers) and \
          crates/rustmotion/src/encode/, both outside workstream K's owned files — see the \
          workstream K report's handover for the exact wiring point.",
     ),
     (
         "intensity",
-        " MotionBlurConfig.intensity is read into AnimatedProperties.motion_blur \
+        "RM-51: MotionBlurConfig.intensity is read into AnimatedProperties.motion_blur \
          (crates/rustmotion-core/src/engine/animator.rs:259) but nothing reads that field \
          afterwards. Wiring it into the ghost-opacity math, or deleting it, both touch \
          crates/rustmotion-components/src/box_builder.rs and crates/rustmotion-core/src/engine/\
@@ -192,8 +192,8 @@ fn extract_pub_field_names(source: &str) -> Vec<String> {
     names
 }
 
-/// nothing stopped a schema field from parsing successfully and then
-/// being read by no code path — (`VideoConfig.codec`) and
+/// RM-52: nothing stopped a schema field from parsing successfully and then
+/// being read by no code path — RM-50 (`VideoConfig.codec`) and RM-51
 /// (`MotionBlurConfig.intensity`) are exactly that defect, and the format's
 /// credibility as an LLM generation target rests on a field either doing
 /// something or failing to parse. This test greps the workspace for a
diff --git a/docs/non-goals.md b/docs/non-goals.md
new file mode 100644
index 00000000..af98e175
--- /dev/null
+++ b/docs/non-goals.md
@@ -0,0 +1,37 @@
+# Non-goals
+
+rustmotion renders motion-design videos from JSON scenarios with a single Rust binary — Skia for drawing, taffy for layout, ffmpeg/openh264 for encoding. That focus rules out whole categories of feature that a browser-based or SaaS video tool would otherwise be expected to have. This page names them explicitly, so they're discoverable without reading source or asking.
+
+## Browser, React, DOM
+
+rustmotion has no browser and no JavaScript runtime anywhere in its render path — that absence is the whole point (see the README's opening line). Consequently, out of scope by construction:
+
+- **An embeddable Player component.** There is no `<Player>` to drop into a React/Vue/Svelte app for in-browser preview. Preview happens by rendering a frame (`rustmotion render --frame N`) or a still (`rustmotion still`), or through the standalone `rustmotion-studio` desktop app.
+- **A JS/webpack/Vite bundler pipeline.** Scenarios are JSON (or the HTML dialect that transpiles to JSON); there's no module graph to bundle.
+- **Tailwind, SCSS, or any CSS preprocessor.** The `style` object is a flat, typed `CssStyle` deserialized by serde — no cascade resolution beyond the deliberately small color/font-* inheritance rustmotion itself implements, no class names, no preprocessing step.
+- **three.js or any WebGL/WebGPU scene graph.** 3D transforms (`rotate_x`, `rotate_y`, `perspective`) are real Skia M44 matrix math on 2D layers, not a 3D renderer — there's no mesh, camera, or lighting model to speak of.
+- **An in-browser visual studio.** `rustmotion-studio` is a native desktop app (Dioxus, its own binary), not a web app — there is no hosted or local-webserver editing UI.
+- **`delayRender()` / async-render-blocking primitives.** rustmotion has no concept of a component signaling "not ready yet" mid-render, because there's no async component tree to block: all assets (images, fonts, icons) are resolved before a frame is painted, synchronously, by the loader.
+
+## Commercial
+
+**No licence key, no telemetry, no per-render billing.** rustmotion is MIT-licensed (see the badge at the top of the README) and that is a complete description of its commercial model — not "free while we build a paid tier." The binary makes exactly three categories of outbound network call, every one of them opt-in by virtue of what's in your scenario: fetching an Iconify icon by id, fetching a Google Font by family name (`FontEntry.source = "google"`), and resolving an `include` entry given as a URL instead of a local path. Neither call reports usage, render count, or any other telemetry, and nothing about this project's licensing or pricing is decided by what a scenario contains. This is worth stating plainly next to the MIT badge because an automated pipeline (CI job, agent, batch renderer) that shells out to `rustmotion render` should not need to reason about license enforcement, seat counts, or metered usage — there is none.
+
+## Vendor cloud
+
+rustmotion doesn't deploy anywhere, and doesn't know what "anywhere" means:
+
+- No AWS Lambda / Google Cloud Run / Vercel deployment target, packaging, or adapter — nothing sizes the binary for a serverless runtime.
+- No S3 (or any object-storage) output — `render`/`batch`/`still` write to a local path; shipping the result somewhere else is left to whatever calls the CLI.
+- No IAM roles, cloud credentials, or cloud-specific configuration of any kind.
+- No pricing model tied to render minutes, resolution, or concurrency — see [Commercial](#commercial) above.
+
+If you need cloud rendering, `rustmotion render --frames a-b` plus `rustmotion concat` is the building block a distributed render pipeline is expected to be built *on top of* — rustmotion renders frames; orchestrating that across machines is out of scope.
+
+## Known gaps (not exclusions)
+
+These are real absences today, not deliberate non-goals — each is natively reachable given the existing dependency stack or architecture, and could reasonably be added without a redesign:
+
+- **SkSL runtime effects.** `skia-safe` (the Skia binding rustmotion is built on) exposes `RuntimeEffect` for custom pixel shaders, and the workspace has zero uses of it today. A `style` field that compiles and runs an SkSL shader is plausible future work, not something the architecture excludes.
+- **A public path toolkit.** Bezier/SVG-path math already exists internally (`arrow`'s curve fields, `connector`'s routing, `motion_path`'s SVG path parsing) but isn't exposed as a reusable, documented primitive a scenario author can compose with directly.
+- **A seeded `random`/`noise` value.** `wiggle`'s procedural noise and `particle`'s seeded layouts are deterministic and reproducible *for those two components specifically*, but there's no general-purpose `{ "$random": { "seed": ..., "min": ..., "max": ... } }`-style value provider a scenario can use anywhere a number is expected.

From ec6595ae9060d9b50dff1838dd1c04e1ed015028 Mon Sep 17 00:00:00 2001
From: Baptiste Parmantier <baptiste.parmantier.pro@gmail.com>
Date: Tue, 22 Sep 2026 11:20:56 +0200
Subject: [PATCH 56/56] fix(chantier): align the branch with the tree the suite
 was verified on (#304)

The 55 findings were merged one squashed commit at a time. Several of them
landed during the first merge attempts, before a defect in the carving
mechanism was found and corrected, so they carried a snapshot taken while
their agent was still polishing rather than that agent's final state.

The gap was real, not cosmetic: 200 lines of regression tests missing from
one file, 141 from another, 40 from a third. The branch compiled and its
remaining tests passed, which is exactly why this needed comparing against
something rather than trusting a green run.

This takes every path the audit owns from chantier/audit-2026-09-full, the
single commit of the whole remediation tree on which fmt, the full test suite
and clippy were run, then re-applies the constant-size chunks_exact
replacement to the five files that needed it, since that branch predates the
lint fix.

The two files still differing from it afterwards differ only by that same
lint fix, which they now carry and it did not.

Verified on this branch: cargo check --workspace --all-targets, cargo test
--workspace, cargo clippy --workspace --all-targets -- -D warnings, and
cargo fmt --all --check.

Refs #220
---
 crates/rustmotion-components/src/gif.rs       |   6 +-
 crates/rustmotion-components/src/table.rs     |   4 +-
 crates/rustmotion-components/src/video.rs     |   2 +-
 .../rustmotion-components/tests/audit_ws_d.rs |  40 ++++
 .../rustmotion-components/tests/audit_ws_i.rs |   6 +-
 .../rustmotion-core/src/css/taffy_bridge.rs   |   2 +-
 crates/rustmotion-core/src/engine/animator.rs |   2 +-
 .../rustmotion-core/src/engine/layout_pass.rs |   4 +-
 .../src/engine/renderer/assets.rs             |   6 +-
 crates/rustmotion-core/src/expand.rs          |   4 +-
 crates/rustmotion-core/tests/audit_ws_a.rs    |  10 +-
 crates/rustmotion-core/tests/audit_ws_h.rs    |   8 +-
 crates/rustmotion-core/tests/audit_ws_j.rs    |   6 +-
 crates/rustmotion-html/tests/audit_ws_f.rs    |  16 +-
 crates/rustmotion-studio/src/editor/audio.rs  |   4 +-
 .../src/scenario/optimistic.rs                |   4 +-
 .../rustmotion/src/cli/commands/geometry.rs   | 175 +++++++--------
 crates/rustmotion/src/encode/video/formats.rs |  11 +-
 crates/rustmotion/src/encode/video/tasks.rs   |  17 +-
 crates/rustmotion/src/include.rs              |  10 +-
 crates/rustmotion/tests/audit_ws_b.rs         | 207 +++++++++++++++++-
 crates/rustmotion/tests/audit_ws_c.rs         | 141 ++++++++++++
 crates/rustmotion/tests/audit_ws_e.rs         |   4 +-
 crates/rustmotion/tests/audit_ws_h.rs         |   6 +-
 24 files changed, 536 insertions(+), 159 deletions(-)

diff --git a/crates/rustmotion-components/src/gif.rs b/crates/rustmotion-components/src/gif.rs
index b5698604..5a0d918d 100644
--- a/crates/rustmotion-components/src/gif.rs
+++ b/crates/rustmotion-components/src/gif.rs
@@ -455,9 +455,9 @@ mod tests {
     /// own video is, so passing generous `max_w`/`max_h` here isolates the
     /// byte-budget check from the video-dimensions check exercised by the
     /// next test. 144 MiB is deliberately far short of the 65535×65535
-    /// (~17 GiB) header a real crafted file could declare — large enough to
-    /// prove the budget check fires, small enough that running this test
-    /// never risks the allocation it is asserting never happens.
+    /// (~17 GiB) header the audit's own crafted file could declare — large
+    /// enough to prove the budget check fires, small enough that running
+    /// this test never risks the allocation it is asserting never happens.
     #[test]
     fn a_canvas_over_the_byte_budget_is_rejected_without_allocating_it() {
         let path = std::env::temp_dir().join(format!(
diff --git a/crates/rustmotion-components/src/table.rs b/crates/rustmotion-components/src/table.rs
index ab882664..06e90ff4 100644
--- a/crates/rustmotion-components/src/table.rs
+++ b/crates/rustmotion-components/src/table.rs
@@ -419,7 +419,9 @@ mod tests {
         // probe specifically for near-white text ink rather than any lit
         // pixel (the header/row backgrounds paint regardless of font-size).
         let text_ink = buf
-            .chunks_exact(4)
+            .as_chunks::<4>()
+            .0
+            .iter()
             .filter(|p| p[3] > 0 && p[0] > 200 && p[1] > 200 && p[2] > 200)
             .count();
         assert!(
diff --git a/crates/rustmotion-components/src/video.rs b/crates/rustmotion-components/src/video.rs
index 1500dbb5..cae7b018 100644
--- a/crates/rustmotion-components/src/video.rs
+++ b/crates/rustmotion-components/src/video.rs
@@ -176,7 +176,7 @@ impl Painter for Video {
                 let img_info = ImageInfo::new(
                     (fw as i32, fh as i32),
                     ColorType::RGBA8888,
-                    skia_safe::AlphaType::Premul,
+                    skia_safe::AlphaType::Unpremul,
                     None,
                 );
                 let row_bytes = fw as usize * 4;
diff --git a/crates/rustmotion-components/tests/audit_ws_d.rs b/crates/rustmotion-components/tests/audit_ws_d.rs
index e884b076..7ac9dbd8 100644
--- a/crates/rustmotion-components/tests/audit_ws_d.rs
+++ b/crates/rustmotion-components/tests/audit_ws_d.rs
@@ -281,3 +281,43 @@ fn without_loop_video_playback_still_clamps_not_wraps() {
         "no loop_video: must clamp to the window's end (nearest: yellow), not wrap"
     );
 }
+
+// ─── cached-frame draw path mistagged straight alpha as premultiplied ──────
+
+/// ffmpeg's `-pix_fmt rgba` output — what fills the video-frame cache — is
+/// straight (unpremultiplied) alpha. Tagging that buffer `AlphaType::Premul`
+/// makes Skia treat the RGB channels as already scaled by alpha instead of
+/// scaling them itself, which brightens (here: doubles) every
+/// semi-transparent pixel's channels once composited.
+///
+/// A straight-alpha (200, 100, 50, 128) pixel, composited over black:
+/// correctly tagged `Unpremul`, Skia premultiplies it to
+/// (200×128/255, 100×128/255, 50×128/255) ≈ (100, 50, 25) before compositing
+/// over black, landing there almost exactly (the `(1 - alpha) * 0` background
+/// term vanishes either way). Mistagged `Premul`, Skia uses the raw channel
+/// values directly as if already scaled — (200, 100, 50) — composited over
+/// black with no further scaling, landing at roughly double the correct
+/// result.
+#[test]
+fn cached_frame_straight_alpha_composites_correctly_not_doubled() {
+    let src = unique_src("alpha");
+    let cache_key = format!("{src}:10x10");
+    let straight = [200u8, 100, 50, 128];
+    video_frame_cache().insert(
+        cache_key,
+        Arc::new(vec![(0.0, solid_rgba(straight, 2, 2), 2, 2)]),
+    );
+
+    let v = video(&src, ImageFit::Fill, None, None, None);
+    let ctx = ctx_at(0.0);
+    let pixels = paint_and_read(&v, &ctx, 10, 10, false);
+    let composited = px(&pixels, 10, 5, 5);
+
+    let close = |actual: u8, expected: u8| (actual as i16 - expected as i16).abs() <= 4;
+    assert!(
+        close(composited[0], 100) && close(composited[1], 50) && close(composited[2], 25),
+        "straight-alpha (200,100,50,128) over black must composite to roughly (100,50,25), \
+         got {composited:?} — a value near (200,100,50) means the buffer is still mistagged \
+         as premultiplied and its channels are being used unscaled"
+    );
+}
diff --git a/crates/rustmotion-components/tests/audit_ws_i.rs b/crates/rustmotion-components/tests/audit_ws_i.rs
index 358e2c9c..46a94cbd 100644
--- a/crates/rustmotion-components/tests/audit_ws_i.rs
+++ b/crates/rustmotion-components/tests/audit_ws_i.rs
@@ -134,7 +134,9 @@ fn paint_card_with_child(card_json: serde_json::Value) -> PaintedScene {
 
 fn count_dominant(pixels: &[u8], dominant: usize, muted: &[usize]) -> usize {
     pixels
-        .chunks_exact(4)
+        .as_chunks::<4>()
+        .0
+        .iter()
         .filter(|p| p[dominant] > 180 && muted.iter().all(|&m| p[m] < 80))
         .count()
 }
@@ -213,7 +215,7 @@ fn text_own_color_wins_over_cascaded_card_color_at_paint_time() {
 }
 
 fn any_ink_above_black_below_y(pixels: &[u8], width: i32, y_threshold: i32) -> bool {
-    pixels.chunks_exact(4).enumerate().any(|(i, p)| {
+    pixels.as_chunks::<4>().0.iter().enumerate().any(|(i, p)| {
         let y = i as i32 / width;
         y > y_threshold && (p[0] > 20 || p[1] > 20 || p[2] > 20)
     })
diff --git a/crates/rustmotion-core/src/css/taffy_bridge.rs b/crates/rustmotion-core/src/css/taffy_bridge.rs
index e30401ce..7ee1fbce 100644
--- a/crates/rustmotion-core/src/css/taffy_bridge.rs
+++ b/crates/rustmotion-core/src/css/taffy_bridge.rs
@@ -246,7 +246,7 @@ pub fn to_taffy_style(css: &CssStyle, ctx: &ConversionContext) -> tf::Style {
 /// = padding + border`) subtracts from a leaf's `available_space` before
 /// handing it to the measure function — see [`crate::engine::layout_pass`],
 /// which uses this to bring `known_dimensions` (still border-box) into that
-/// same content-box space. Percentage padding/border resolves
+/// same content-box space (RM-27). Percentage padding/border resolves
 /// against `ctx.length.parent_size` like every other percentage in this
 /// module; a leaf's own known/available width is not threaded here, so a
 /// percentage inset on a leaf is only as accurate as that shared context.
diff --git a/crates/rustmotion-core/src/engine/animator.rs b/crates/rustmotion-core/src/engine/animator.rs
index be2dce5e..ba343334 100644
--- a/crates/rustmotion-core/src/engine/animator.rs
+++ b/crates/rustmotion-core/src/engine/animator.rs
@@ -2867,7 +2867,7 @@ mod spring_duration_tests {
         // at t=0.8s: spring_value_raw(0.8, 6, 120, 1) ~= 1.027616 — 2.76%
         // past the target, well outside any reasonable rest_threshold
         // (default 0.5%). An author asking this spring to "finish at 0.8s"
-        // got a value nowhere near rest. Reference recomputed when the
+        // got a value nowhere near rest. Reference recomputed for RM-09
         // (issue #220): the solver's underdamped branch fed the wrong
         // argument to its sine term, so this captured value moved when that
         // was corrected.
diff --git a/crates/rustmotion-core/src/engine/layout_pass.rs b/crates/rustmotion-core/src/engine/layout_pass.rs
index 386c201d..e9a03c5e 100644
--- a/crates/rustmotion-core/src/engine/layout_pass.rs
+++ b/crates/rustmotion-core/src/engine/layout_pass.rs
@@ -72,7 +72,7 @@ impl LayoutResult {
 /// taffy nodes and our `BoxNode` ids + intrinsic measurers.
 ///
 /// `inset_width`/`inset_height` are this node's own resolved padding+border
-///: taffy's `compute_leaf_layout` already subtracts them from
+/// (RM-27): taffy's `compute_leaf_layout` already subtracts them from
 /// `available_space` before calling the measure function, but forwards
 /// `known_dimensions` — the outer border-box size — untouched, handing an
 /// `IntrinsicMeasure` implementor two arguments in different coordinate
@@ -137,7 +137,7 @@ pub fn run_layout(root: &BoxNode, viewport: (f32, f32), ctx: &ConversionContext)
 /// Build one taffy node and, recursively, its subtree.
 ///
 /// `inherited_font_size` is the already-resolved (px) font-size of `node`'s
-/// parent: CSS resolves `em` on every layout property against the
+/// parent (RM-26): CSS resolves `em` on every layout property against the
 /// element's *own* computed font-size, and font-size itself inherits down
 /// the tree unless overridden. `to_taffy_style` and [`content_box_inset`]
 /// only ever see the single `ConversionContext` handed to them, so their
diff --git a/crates/rustmotion-core/src/engine/renderer/assets.rs b/crates/rustmotion-core/src/engine/renderer/assets.rs
index 9121f48e..97345599 100644
--- a/crates/rustmotion-core/src/engine/renderer/assets.rs
+++ b/crates/rustmotion-core/src/engine/renderer/assets.rs
@@ -50,7 +50,7 @@ pub fn gif_cache() -> &'static GifCacheMap {
 /// then never answers — or trickles one byte a minute — hangs the calling
 /// thread forever; ureq's 10 MB body cap bounds bytes, not time. On the icon
 /// path that thread can be a render worker with nobody at the keyboard to
-/// notice.
+/// notice (RM-41).
 ///
 /// `Config::builder()` starts from `Config::default()`, which already
 /// resolves a proxy from `HTTPS_PROXY`/`https_proxy`/`HTTP_PROXY`/
@@ -258,7 +258,7 @@ pub fn ffmpeg_available() -> bool {
 /// `rtmp://`, `concat:`, …), which turns an unfiltered `src` into an SSRF
 /// primitive — a scenario author can point it at
 /// `http://169.254.169.254/...` (the cloud metadata endpoint) or an internal
-/// service, and read the exit status as a port-scan oracle. Remote
+/// service, and read the exit status as a port-scan oracle (RM-42). Remote
 /// video was never a designed feature here — this module's own `is_remote`
 /// doc, a few functions below, and `rustmotion info`'s identical assumption
 /// both already treat every `src` as a local path — so this closes an
@@ -276,7 +276,7 @@ fn reject_remote_video_src(src: &str) -> Result<()> {
     if looks_like_scheme {
         return Err(RustmotionError::Generic(format!(
             "video src '{src}' names a '{scheme}://' URL — rustmotion does not fetch video \
-             over the network, only local file paths are accepted"
+             over the network, only local file paths are accepted (RM-42)"
         )));
     }
     Ok(())
diff --git a/crates/rustmotion-core/src/expand.rs b/crates/rustmotion-core/src/expand.rs
index ea153e98..c47860e1 100644
--- a/crates/rustmotion-core/src/expand.rs
+++ b/crates/rustmotion-core/src/expand.rs
@@ -157,7 +157,7 @@ use crate::variables::substitute;
 const MAX_EXPANSION_DEPTH: u32 = 64;
 
 /// Ceiling on the total number of nodes a single document's `for-each`
-/// expansion may produce, across every level of nesting combined.
+/// expansion may produce, across every level of nesting combined (RM-43).
 /// [`MAX_EXPANSION_DEPTH`] bounds how deep directives may nest, not how many
 /// nodes they produce — and nesting one `for-each` inside another's
 /// `template` is explicitly supported (`use_template_can_contain_a_nested_
@@ -306,7 +306,7 @@ pub fn expand_directives(value: &mut Value, file_label: &str) -> Result<()> {
 }
 
 /// Subtracts `n` from the shared expansion-node budget, or fails naming the
-/// limit and where it was hit. See [`MAX_EXPANSION_NODES`] for why
+/// limit and where it was hit (RM-43). See [`MAX_EXPANSION_NODES`] for why
 /// this is checked once per `for-each` directive's item count rather than
 /// once per final node: it is the only point in the recursion where the
 /// multiplicative blow-up can be caught before the work that would produce
diff --git a/crates/rustmotion-core/tests/audit_ws_a.rs b/crates/rustmotion-core/tests/audit_ws_a.rs
index d264fbae..7ad93749 100644
--- a/crates/rustmotion-core/tests/audit_ws_a.rs
+++ b/crates/rustmotion-core/tests/audit_ws_a.rs
@@ -1,5 +1,5 @@
 //! Regression tests for the workstream A (animation & paint) audit findings
-//! tracked in issue #220.
+//! tracked in issue #220: RM-01, RM-09, RM-10, RM-37.
 
 use rustmotion_core::css::style::{
     Background, BackgroundLayer, BoxShadow, Color as CssColor, CssStyle, Display, FlexDirection,
@@ -72,7 +72,7 @@ fn probe(buf: &[u8], w: u32, x: usize, y: usize) -> (u8, u8, u8) {
     (buf[i], buf[i + 1], buf[i + 2])
 }
 
-// ---- opacity layer must not clip the node's own outset box-shadow ----
+// ---- RM-01: opacity layer must not clip the node's own outset box-shadow ----
 
 fn card_with_shadow(opacity: Option<f32>) -> BoxNode {
     let css = CssStyle {
@@ -134,7 +134,7 @@ fn opacity_layer_does_not_clip_own_outset_box_shadow() {
     );
 }
 
-// ---- underdamped spring step response must start from rest ----
+// ---- RM-09: underdamped spring step response must start from rest ----
 
 fn spring_config(damping: f64, stiffness: f64, mass: f64) -> SpringConfig {
     SpringConfig {
@@ -192,7 +192,7 @@ fn underdamped_spring_matches_the_analytic_closed_form() {
     }
 }
 
-// ---- linear-gradient(180deg, ...) must put the first stop at the top ----
+// ---- RM-10: linear-gradient(180deg, ...) must put the first stop at the top ----
 
 fn gradient_card(w: f32, h: f32, angle: f32) -> BoxNode {
     let css = CssStyle {
@@ -243,7 +243,7 @@ fn linear_gradient_180deg_puts_the_first_stop_at_the_top() {
     );
 }
 
-// ---- `spring_settle_time` must not be rescanned on every `spring_value` call ----
+// ---- RM-37: `spring_settle_time` must not be rescanned on every `spring_value` call ----
 
 #[test]
 fn spring_settle_time_is_memoized_not_rescanned_every_call() {
diff --git a/crates/rustmotion-core/tests/audit_ws_h.rs b/crates/rustmotion-core/tests/audit_ws_h.rs
index 0fd3a042..4f02d02f 100644
--- a/crates/rustmotion-core/tests/audit_ws_h.rs
+++ b/crates/rustmotion-core/tests/audit_ws_h.rs
@@ -1,9 +1,9 @@
 //! Regression tests for the workstream H (untrusted scenario ingestion)
-//! audit findings that live in `rustmotion-core`.
+//! audit findings that live in `rustmotion-core`: RM-41, RM-42, RM-43.
 
 use rustmotion_core::engine::renderer::{extract_video_frame, http_agent};
 
-// ---- no timeout on any HTTP call — a bare `ureq::get` always uses
+// ---- RM-41: no timeout on any HTTP call — a bare `ureq::get` always uses
 // the default, untimed agent, so a stalled host hangs a render forever ----
 
 #[test]
@@ -20,7 +20,7 @@ fn shared_http_agent_has_finite_global_and_connect_timeouts() {
     );
 }
 
-// ---- a scenario's `video.src` reaches `ffmpeg -i` verbatim, with no
+// ---- RM-42: a scenario's `video.src` reaches `ffmpeg -i` verbatim, with no
 // protocol allowlist — a remote-looking src turns into an SSRF primitive ----
 
 #[test]
@@ -56,7 +56,7 @@ fn extract_video_frame_does_not_reject_a_plain_local_path() {
     );
 }
 
-// ---- `for-each` expansion has a depth ceiling but no node budget —
+// ---- RM-43: `for-each` expansion has a depth ceiling but no node budget —
 // nesting is multiplicative, so a handful of small arrays nested a few
 // levels deep can declare a product in the millions ----
 
diff --git a/crates/rustmotion-core/tests/audit_ws_j.rs b/crates/rustmotion-core/tests/audit_ws_j.rs
index 6b3501b9..4da80594 100644
--- a/crates/rustmotion-core/tests/audit_ws_j.rs
+++ b/crates/rustmotion-core/tests/audit_ws_j.rs
@@ -1,5 +1,5 @@
 //! Regression tests for the workstream J (layout pass & CSS unit resolution)
-//! audit findings on unit resolution and intrinsic measurement.
+//! audit findings: RM-26, RM-27.
 
 use std::sync::{Arc, Mutex};
 
@@ -9,7 +9,7 @@ use rustmotion_core::css::units::{Length, LengthPercentage as CLP};
 use rustmotion_core::engine::box_tree::{AvailableSpace, BoxNode, IntrinsicMeasure};
 use rustmotion_core::engine::layout_pass::run_layout;
 
-// ---- `em` on layout properties must resolve against the element's
+// ---- RM-26: `em` on layout properties must resolve against the element's
 // own (inherited) font-size, not a constant 16px ----
 
 /// A card sized by its parent's explicit `font-size` (48px) inherits that
@@ -48,7 +48,7 @@ fn em_padding_resolves_against_inherited_font_size_not_a_constant_16px() {
     assert_eq!(content_w, 200.0 - 2.0 * 48.0);
 }
 
-// ---- a leaf's `IntrinsicMeasure::measure` must receive `known` and
+// ---- RM-27: a leaf's `IntrinsicMeasure::measure` must receive `known` and
 // `available` in the same (content-box) coordinate space ----
 
 type RecordedCall = ((Option<f32>, Option<f32>), (AvailableSpace, AvailableSpace));
diff --git a/crates/rustmotion-html/tests/audit_ws_f.rs b/crates/rustmotion-html/tests/audit_ws_f.rs
index e8ab981a..00c40637 100644
--- a/crates/rustmotion-html/tests/audit_ws_f.rs
+++ b/crates/rustmotion-html/tests/audit_ws_f.rs
@@ -1,17 +1,17 @@
 //! Regression tests for workstream F's 4 confirmed audit findings on the
 //! HTML dialect transpiler: an attribute outside a hardcoded allowlist
-//! vanishing with no error, a CSS shorthand transpiling to a string
-//! the core length parser cannot read and silently resolving to 0px,
+//! vanishing with no error (RM-03), a CSS shorthand transpiling to a string
+//! the core length parser cannot read and silently resolving to 0px (RM-04),
 //! `<script>`/`<style>` source getting painted as text while `<img>`/`<svg>`
-//! children vanish inside inline text elements, and the studio's
+//! children vanish inside inline text elements (RM-11), and the studio's
 //! HTML write-back deleting everything outside `<rustmotion>` in the
-//! author's file.
+//! author's file (RM-12).
 
 use rustmotion_html::{html_to_scenario_value, HtmlError};
 use serde_json::json;
 
 // ---------------------------------------------------------------------------
-// <scene> and <rustmotion> read a hardcoded attribute allowlist;
+// RM-03: <scene> and <rustmotion> read a hardcoded attribute allowlist;
 // every other attribute is dropped with no error.
 // ---------------------------------------------------------------------------
 
@@ -97,7 +97,7 @@ fn inert_attributes_stay_inert_on_container_and_text() {
 }
 
 // ---------------------------------------------------------------------------
-// CSS shorthand values transpile to strings the core length parser
+// RM-04: CSS shorthand values transpile to strings the core length parser
 // cannot read, silently resolving to 0px.
 // ---------------------------------------------------------------------------
 
@@ -189,7 +189,7 @@ fn rgba_color_functional_notation_is_not_treated_as_multi_token() {
 }
 
 // ---------------------------------------------------------------------------
-// text-tag children bypass every guard — <script>/<style> source gets
+// RM-11: text-tag children bypass every guard — <script>/<style> source gets
 // painted, <img>/<svg>/<rm-*> vanish silently.
 // ---------------------------------------------------------------------------
 
@@ -265,7 +265,7 @@ fn inline_formatting_tags_still_flatten_into_the_parent_text() {
 }
 
 // ---------------------------------------------------------------------------
-// studio HTML write-back silently deletes everything outside
+// RM-12: studio HTML write-back silently deletes everything outside
 // <rustmotion> in the author's file.
 // ---------------------------------------------------------------------------
 
diff --git a/crates/rustmotion-studio/src/editor/audio.rs b/crates/rustmotion-studio/src/editor/audio.rs
index 59fbed59..7f720c14 100644
--- a/crates/rustmotion-studio/src/editor/audio.rs
+++ b/crates/rustmotion-studio/src/editor/audio.rs
@@ -183,7 +183,9 @@ pub fn prepare(scenario: Arc<ResolvedScenario>, total_duration: f64) {
         match mixed {
             Ok(Some(pcm_bytes)) => {
                 let pcm: Vec<f32> = pcm_bytes
-                    .chunks_exact(2)
+                    .as_chunks::<2>()
+                    .0
+                    .iter()
                     .map(|b| i16::from_le_bytes([b[0], b[1]]) as f32 / 32768.0)
                     .collect();
                 let _ = tx.send(Cmd::Load(Arc::new(pcm), SAMPLE_RATE));
diff --git a/crates/rustmotion-studio/src/scenario/optimistic.rs b/crates/rustmotion-studio/src/scenario/optimistic.rs
index bcc95d17..2d0a6f32 100644
--- a/crates/rustmotion-studio/src/scenario/optimistic.rs
+++ b/crates/rustmotion-studio/src/scenario/optimistic.rs
@@ -382,7 +382,9 @@ mod tests {
             .expect("render")
         };
         let count_red = |rgba: &[u8]| {
-            rgba.chunks_exact(4)
+            rgba.as_chunks::<4>()
+                .0
+                .iter()
                 .filter(|p| p[0] > 180 && p[1] < 90 && p[2] < 90)
                 .count()
         };
diff --git a/crates/rustmotion/src/cli/commands/geometry.rs b/crates/rustmotion/src/cli/commands/geometry.rs
index b502d461..9494bab0 100644
--- a/crates/rustmotion/src/cli/commands/geometry.rs
+++ b/crates/rustmotion/src/cli/commands/geometry.rs
@@ -53,7 +53,7 @@
 use std::collections::HashSet;
 
 use rustmotion::components::box_builder::{
-    build_scene_from_refs, effective_effects, BuildAnimationCtx,
+    build_scene_from_refs, component_kind, effective_effects, BuildAnimationCtx,
 };
 use rustmotion::components::intrinsic::{
     CaptionIntrinsic, CodeblockIntrinsic, GradientTextIntrinsic, RichTextIntrinsic, TableIntrinsic,
@@ -307,15 +307,7 @@ fn walk(
                     out,
                 );
             }
-            check_auto_scroll(
-                &child.component,
-                &child_path,
-                &raw_bbox,
-                viewport,
-                vi,
-                si,
-                out,
-            );
+            check_auto_scroll(&child.component, &child_path, layout, viewport, vi, si, out);
             // Suppressed under a clipping ancestor (parent_clips) exactly
             // like check_viewport, and when the node clips its own overflow
             // (paint_pass applies a node's own `overflow: hidden`/clip/
@@ -474,7 +466,7 @@ fn container_clips(c: &Component) -> bool {
 /// folded separately in `walk_anim`; this only handles what a component
 /// declares directly in `style.transform`.
 ///
-/// `font_size` is the NODE's own resolved font-size
+/// RM-15: `font_size` is the NODE's own resolved font-size
 /// (`css.font_size_px_or(16.0)`), not a hardcoded 16px — an `em` length in
 /// `transform` must scale with the element it's declared on, exactly like
 /// `paint_pass.rs`'s `length_ctx` does for the same field. Percentage
@@ -603,7 +595,7 @@ fn resolve_transform_origin_2d(
 /// `y' = x·sinθ + y·cosθ`); `Skew`/`SkewX`/`SkewY` match `Canvas::skew`
 /// (`x' = x + y·tan(skew_x)`, `y' = y + x·tan(skew_y)`).
 ///
-/// `ctx_x`/`ctx_y` are separate contexts differing only in
+/// RM-15: `ctx_x`/`ctx_y` are separate contexts differing only in
 /// `parent_size` (the box's own width / height respectively), used for
 /// `Translate`/`TranslateX`/`TranslateY`/`Translate3d`'s percentage
 /// resolution — CSS resolves a translate's x-component percentage against
@@ -791,7 +783,7 @@ fn measurer_and_nowrap(component: &Component) -> Option<(Box<dyn IntrinsicMeasur
     }
 }
 
-/// natural (unwrapped) width vs the node's own CONTENT box, not its
+/// RM-31: natural (unwrapped) width vs the node's own CONTENT box, not its
 /// border box. `LegacyPaintDispatcher::dispatch` hands every non-codeblock
 /// painter (`Text`/`GradientText`/`Caption` included) a synthetic
 /// `BoxLayout` built from `layout.content_box()`, translated to the
@@ -873,14 +865,24 @@ fn check_unwrappable_text(
 /// (`codeblock`/`terminal` are deliberately excluded: their `auto_scroll`
 /// escape hatch makes a smaller-than-natural box intentional).
 ///
-/// Complementary to `check_unwrappable_text`, not overlapping with it:
-/// that one covers `white-space: nowrap`/`pre` (single unwrapped line, width
-/// only, measured at natural/unconstrained width). This one covers the
-/// default wrapping case — measured at the width the box actually *has*
-/// (`content_box().2`, unconstrained height) so it also catches a single
-/// unbreakable word/token/URL that's wider than the box even though wrap is
-/// on (wrapping can't break within a word), plus the width axis stays
-/// consistent with what will actually be painted.
+/// Complementary to `check_unwrappable_text`, not overlapping with it on the
+/// WIDTH axis: that one covers `white-space: nowrap`/`pre` (single unwrapped
+/// line, measured at natural/unconstrained width). This function covers the
+/// default wrapping case's width — measured at the width the box actually
+/// *has* (`content_box().2`, unconstrained height) so it also catches a
+/// single unbreakable word/token/URL that's wider than the box even though
+/// wrap is on (wrapping can't break within a word), plus the width axis
+/// stays consistent with what will actually be painted.
+///
+/// RM-32: the HEIGHT axis is this function's job regardless of `nowrap` — a
+/// nowrap node used to return here before measuring height at all, so a
+/// single unwrapped line taller than its box validated clean. Re-measuring
+/// nowrap's WIDTH at a constrained space would wrap text that actually
+/// paints as one (too-wide) line, which is exactly why `check_unwrappable_
+/// text` owns that axis instead — but a single line's height is exactly one
+/// `line_height`, independent of any width constraint, so it's measured at
+/// `(MaxContent, Definite(ch))` and reported on `Axis::Y` only, leaving
+/// `Axis::X` to `check_unwrappable_text`.
 fn check_content_overflows_box(
     component: &Component,
     path: &str,
@@ -893,19 +895,44 @@ fn check_content_overflows_box(
     let Some((intrinsic, nowrap)) = measurer_and_nowrap(component) else {
         return;
     };
-    // nowrap/pre is check_unwrappable_text's territory: re-measuring it
-    // here at a constrained width would wrap text that will actually
-    // paint as one (too-wide) line, producing a height number that
-    // doesn't correspond to anything that gets painted.
-    if nowrap {
-        return;
-    }
 
     let (cx, cy, cw, ch) = layout.content_box();
     if cw <= 0.0 || ch <= 0.0 {
         return;
     }
 
+    if nowrap {
+        let (_, natural_h) = intrinsic.measure(
+            (None, None),
+            (AvailableSpace::MaxContent, AvailableSpace::Definite(ch)),
+        );
+        let eps = 0.5;
+        if natural_h <= ch + eps {
+            return;
+        }
+        let kind = component_kind(component);
+        out.push(GeometryViolation {
+            view_index: vi,
+            scene_index: si,
+            path: path.to_string(),
+            component: kind.to_string(),
+            axis: Axis::Y,
+            kind: ViolationKind::ContentOverflowsBox,
+            bbox: BBox {
+                x: cx,
+                y: cy,
+                w: cw,
+                h: ch,
+            },
+            viewport,
+            hint: format!(
+                "{kind} line is {natural_h:.0}px tall but its box is only {:.0}px tall — increase style.height (or the parent's), or reduce style.font-size",
+                ch
+            ),
+        });
+        return;
+    }
+
     // Height is bounded by the node's own resolved content-box height `ch`
     // (not `MaxContent`) for the same reason width is bounded by `cw`: a
     // `text-autofit: true` node can only try to shrink into a target it's
@@ -982,10 +1009,20 @@ fn check_content_overflows_box(
 /// `(None, None)`/`MaxContent` yields each component's natural (unbounded)
 /// size, exactly like `check_unwrappable_text`/`check_content_overflows_box`
 /// already do for the text-family intrinsics.
+///
+/// RM-33: the codeblock and terminal arms compare against different boxes,
+/// on purpose. `LegacyPaintDispatcher::is_self_padding` matches only
+/// `Component::Codeblock` — a codeblock is handed the raw (border) layout
+/// box and paints its own padding inside it (`compute_code_dimensions`
+/// already bakes `style.padding_px()` into `natural_h`, so comparing against
+/// the border box is the byte-for-byte-correct pairing). Every other
+/// painter, terminal included, is handed `layout.content_box()` instead —
+/// so the terminal arm compares against that, not the border box, or it
+/// under-reports by exactly the node's own padding.
 fn check_auto_scroll(
     component: &Component,
     path: &str,
-    bbox: &BBox,
+    layout: &BoxLayout,
     viewport: (u32, u32),
     vi: usize,
     si: usize,
@@ -996,6 +1033,7 @@ fn check_auto_scroll(
         Component::Codeblock(cb) if !cb.auto_scroll => {
             let (_, natural_h) =
                 CodeblockIntrinsic::from_codeblock(cb).measure((None, None), max_content);
+            let bbox = bbox_of(layout);
             if natural_h > bbox.h + 0.5 {
                 out.push(GeometryViolation {
                     view_index: vi,
@@ -1004,7 +1042,7 @@ fn check_auto_scroll(
                     component: "codeblock".to_string(),
                     axis: Axis::Y,
                     kind: ViolationKind::AutoScrollDisabledOverflow,
-                    bbox: *bbox,
+                    bbox,
                     viewport,
                     hint: format!(
                         "codeblock content needs ~{:.0}px but box is {:.0}px — enable auto_scroll or shorten code",
@@ -1016,7 +1054,8 @@ fn check_auto_scroll(
         Component::Terminal(t) if !t.auto_scroll => {
             let (_, natural_h) =
                 TerminalIntrinsic::from_terminal(t).measure((None, None), max_content);
-            if natural_h > bbox.h + 0.5 {
+            let (cx, cy, cw, ch) = layout.content_box();
+            if natural_h > ch + 0.5 {
                 out.push(GeometryViolation {
                     view_index: vi,
                     scene_index: si,
@@ -1024,11 +1063,16 @@ fn check_auto_scroll(
                     component: "terminal".to_string(),
                     axis: Axis::Y,
                     kind: ViolationKind::AutoScrollDisabledOverflow,
-                    bbox: *bbox,
+                    bbox: BBox {
+                        x: cx,
+                        y: cy,
+                        w: cw,
+                        h: ch,
+                    },
                     viewport,
                     hint: format!(
                         "terminal content needs ~{:.0}px but box is {:.0}px — enable auto_scroll or remove lines",
-                        natural_h, bbox.h
+                        natural_h, ch
                     ),
                 });
             }
@@ -1211,71 +1255,6 @@ fn text_sizes(component: &Component) -> Vec<(&'static str, f32)> {
     }
 }
 
-fn component_kind(c: &Component) -> &'static str {
-    match c {
-        Component::Text(_) => "text",
-        Component::Shape(_) => "shape",
-        Component::Image(_) => "image",
-        Component::Icon(_) => "icon",
-        Component::Svg(_) => "svg",
-        Component::Video(_) => "video",
-        Component::Gif(_) => "gif",
-        Component::Counter(_) => "counter",
-        Component::Cursor(_) => "cursor",
-        Component::Pointer(_) => "pointer",
-        Component::NumberWheel(_) => "number_wheel",
-        Component::SuccessCheck(_) => "success_check",
-        Component::Caption(_) => "caption",
-        Component::Codeblock(_) => "codeblock",
-        Component::Avatar(_) => "avatar",
-        Component::AvatarGroup(_) => "avatar_group",
-        Component::Arrow(_) => "arrow",
-        Component::Connector(_) => "connector",
-        Component::Badge(_) => "badge",
-        Component::Callout(_) => "callout",
-        Component::Chart(_) => "chart",
-        Component::Comparison(_) => "comparison",
-        Component::Countdown(_) => "countdown",
-        Component::Divider(_) => "divider",
-        Component::DotMap(_) => "dot_map",
-        Component::Gauge(_) => "gauge",
-        Component::GradientText(_) => "gradient_text",
-        Component::Heatmap(_) => "heatmap",
-        Component::Kbd(_) => "kbd",
-        Component::Line(_) => "line",
-        Component::List(_) => "list",
-        Component::Lottie(_) => "lottie",
-        Component::Marquee(_) => "marquee",
-        Component::Mockup(_) => "mockup",
-        Component::Notification(_) => "notification",
-        Component::Particle(_) => "particle",
-        Component::PillNav(_) => "pill_nav",
-        Component::Progress(_) => "progress",
-        Component::QrCode(_) => "qrcode",
-        Component::Rating(_) => "rating",
-        Component::Skeleton(_) => "skeleton",
-        Component::Slider(_) => "slider",
-        Component::Sparkline(_) => "sparkline",
-        Component::Stat(_) => "stat",
-        Component::Stepper(_) => "stepper",
-        Component::Switch(_) => "switch",
-        Component::RichText(_) => "rich_text",
-        Component::Table(_) => "table",
-        Component::TagCloud(_) => "tag_cloud",
-        Component::Terminal(_) => "terminal",
-        Component::Timeline(_) => "timeline",
-        Component::Tooltip(_) => "tooltip",
-        Component::Treemap(_) => "treemap",
-        Component::Positioned(_) => "positioned",
-        Component::Flex(_) => "flex",
-        Component::Grid(_) => "grid",
-        Component::Card(_) => "card",
-        Component::Container(_) => "container",
-        Component::AudioSpectrum(_) => "audio_spectrum",
-        Component::Waveform(_) => "waveform",
-    }
-}
-
 // ─── Animated overflow sampling (--strict-anim) ─────────────────────────────
 
 /// Samples per second of scene duration. ~8/s (125ms resolution) is dense
diff --git a/crates/rustmotion/src/encode/video/formats.rs b/crates/rustmotion/src/encode/video/formats.rs
index 8cad2f02..b3ab8730 100644
--- a/crates/rustmotion/src/encode/video/formats.rs
+++ b/crates/rustmotion/src/encode/video/formats.rs
@@ -359,12 +359,11 @@ mod tests {
     /// (an odd width rejected by libx264) doesn't apply here (the `gif`
     /// crate has no such constraint), so this drives the failure the one
     /// way this pure Rust path can actually fail without external tools:
-    /// `total_frames == 0`.
-    /// That returns before any file is touched either way, so what this
-    /// test really pins is the *shape* of the fix — `encode_gif` must never
-    /// promote a partial onto `output_path` when its inner call errors —
-    /// exercised by asserting the scratch/partial path used internally is
-    /// never left behind either.
+    /// `total_frames == 0`. That returns before any file is touched either
+    /// way, so what this test really pins is the *shape* of the fix —
+    /// `encode_gif` must never promote a partial onto `output_path` when its
+    /// inner call errors — exercised by asserting the scratch/partial path
+    /// used internally is never left behind either.
     #[test]
     fn encode_gif_leaves_no_partial_file_behind_on_an_empty_scenario() {
         let json = r#"{"video": {"width": 8, "height": 8, "fps": 10}, "scenes": []}"#;
diff --git a/crates/rustmotion/src/encode/video/tasks.rs b/crates/rustmotion/src/encode/video/tasks.rs
index ca6f8e6f..378174f5 100644
--- a/crates/rustmotion/src/encode/video/tasks.rs
+++ b/crates/rustmotion/src/encode/video/tasks.rs
@@ -1,3 +1,4 @@
+use crate::engine::animator::ease;
 use crate::engine::transition::{apply_transition, camera_pan_transition, TransitionOptions};
 use crate::error::{Result, RustmotionError};
 use crate::schema::{
@@ -296,6 +297,7 @@ pub fn render_frame_task_scaled(
             // Rationale: the transition is the "entry" of scene_b; its post-effects
             // (e.g. vignette) should appear on the blended frames to avoid a
             // jarring pop when the transition ends and Normal frames begin.
+            let progress = eased_transition_progress(progress, easing);
             let mut composited = apply_transition(
                 &frame_a,
                 &frame_b,
@@ -360,7 +362,7 @@ pub fn render_frame_task_scaled(
             transition_type,
             options,
             transition_duration,
-            easing: _,
+            easing,
         } => {
             let scenario_time = *global_frame as f64 / config.fps as f64;
             let scaled_w = (config.width as f32 * scale_factor) as u32;
@@ -372,6 +374,7 @@ pub fn render_frame_task_scaled(
             // does not.
             let progress =
                 view_transition_progress(*frame_in_transition, *transition_duration, fps);
+            let progress = eased_transition_progress(progress, easing);
 
             let view_a = &scenario.views[*view_a_idx];
             let view_b = &scenario.views[*view_b_idx];
@@ -427,6 +430,18 @@ fn transition_progress(frame_in_transition: u32, transition_duration: f64, fps:
     frame_in_transition as f64 / transition_frames.saturating_sub(1).max(1) as f64
 }
 
+/// Reshapes a transition's raw linear `progress` by its declared
+/// `transition.easing` before it reaches `apply_transition`, which composites
+/// pixels at exactly the fraction it's handed and has no notion of easing on
+/// its own. Every transition arm that calls `apply_transition` needs this —
+/// `SlideTransition`'s `CameraPan` case is the one exception, since it never
+/// reaches `apply_transition` at all: it hands its own `easing` straight into
+/// `camera_pan_transition`, which applies it internally, so routing it
+/// through here first would ease that progress twice.
+fn eased_transition_progress(progress: f64, easing: &EasingType) -> f64 {
+    ease(progress, easing)
+}
+
 /// Frame index within a *view* transition → progress in the OPEN interval
 /// `(0.0, 1.0)`, excluding both endpoints.
 ///
diff --git a/crates/rustmotion/src/include.rs b/crates/rustmotion/src/include.rs
index dacb953d..78d474a2 100644
--- a/crates/rustmotion/src/include.rs
+++ b/crates/rustmotion/src/include.rs
@@ -12,7 +12,7 @@ use crate::schema::{
 
 const MAX_INCLUDE_DEPTH: u8 = 8;
 
-/// Response-size cap for a remote `include` fetch. Scenario JSON is
+/// Response-size cap for a remote `include` fetch (RM-46). Scenario JSON is
 /// not expected to be large; this is deliberately far below ureq's own 10 MB
 /// default for `read_to_vec`/`read_to_string`.
 const MAX_REMOTE_INCLUDE_BYTES: u64 = 4 * 1024 * 1024;
@@ -25,7 +25,7 @@ const MAX_REMOTE_INCLUDE_BYTES: u64 = 4 * 1024 * 1024;
 const ALLOW_REMOTE_INCLUDE_FLAG: &str = "--allow-remote-include";
 
 /// Whether a [`resolve_includes_with_policy`] pass may perform outbound
-/// network requests for `include: "https://..."` directives ( remote
+/// network requests for `include: "https://..."` directives (RM-46: remote
 /// fetching is deliberate design, but it previously had no allowlist and no
 /// opt-out — any scenario, including one merely being `validate`d, could
 /// make this process issue arbitrary GETs). Defaults to [`Self::Deny`].
@@ -50,7 +50,7 @@ pub enum IncludeSource {
 /// [`resolve_includes_with_policy`] to opt in. This is exactly
 /// `resolve_includes_with_policy(scenario, source, RemoteIncludePolicy::Deny)`,
 /// kept as its own entry point so every existing caller stays secure by
-/// default without having to be rewritten to pass a policy.
+/// default without having to be rewritten to pass a policy (RM-46).
 pub fn resolve_includes(scenario: Scenario, source: &IncludeSource) -> Result<ResolvedScenario> {
     resolve_includes_with_policy(scenario, source, RemoteIncludePolicy::Deny)
 }
@@ -188,7 +188,7 @@ fn fetch_and_resolve(
         if remote_policy != RemoteIncludePolicy::Allow {
             return Err(RustmotionError::Generic(format!(
                 "include '{}' is a remote URL, but remote includes are disabled by default \
- — pass {ALLOW_REMOTE_INCLUDE_FLAG} to opt in",
+                 (RM-46) — pass {ALLOW_REMOTE_INCLUDE_FLAG} to opt in",
                 directive.include
             )));
         }
@@ -302,7 +302,7 @@ impl VerifiedRemoteUrl {
 
 /// Resolves `url`'s host and rejects it if any resolved address is not
 /// publicly routable: loopback, link-local (169.254.169.254, the cloud
-/// metadata endpoint, included), or an RFC1918/ULA private range.
+/// metadata endpoint, included), or an RFC1918/ULA private range (RM-46).
 ///
 /// This check runs once, ahead of the request `fetch_remote` makes moments
 /// later; a DNS answer that changes between this resolution and that
diff --git a/crates/rustmotion/tests/audit_ws_b.rs b/crates/rustmotion/tests/audit_ws_b.rs
index 7d550394..cf773941 100644
--- a/crates/rustmotion/tests/audit_ws_b.rs
+++ b/crates/rustmotion/tests/audit_ws_b.rs
@@ -9,8 +9,8 @@
 //! output — is the only externally-observable contract for what the
 //! validator decided (mirrors `motion_path_strict_anim.rs`'s reasoning).
 //!
-//! One section per finding, in briefing order: viewport units, transform
-//! lengths, path rewriting, the three box-model checks, and helper reuse.
+//! One section per finding (RM-05, RM-15, RM-16, RM-31, RM-32, RM-33,
+//! RM-40), in briefing order.
 
 use std::path::{Path, PathBuf};
 use std::process::{Command, Output};
@@ -40,7 +40,7 @@ impl Drop for ScratchFile {
 }
 
 /// Minimal RAII scratch directory — mirrors `skill_files_match_disk.rs`'s
-/// `ScratchDir`. Only the path-rewriting case needs a directory (a file plus a
+/// `ScratchDir`. Only RM-16 needs a directory (a scenario file plus a
 /// sibling asset file).
 struct ScratchDir(PathBuf);
 
@@ -108,7 +108,7 @@ fn find_kind<'a>(report: &'a serde_json::Value, kind: &str) -> Option<&'a serde_
     violations(report).iter().find(|v| v["kind"] == kind)
 }
 
-// ─── vw/vh must resolve against the scenario's real viewport ───────
+// ─── RM-05: vw/vh must resolve against the scenario's real viewport ───────
 
 /// A `width: "90vw"` shape on a 1080×1920 scenario, positioned so its right
 /// edge crosses the viewport edge at EITHER candidate width — 972px (90% of
@@ -195,7 +195,7 @@ fn strict_anim_also_measures_vw_against_the_real_viewport_width() {
     );
 }
 
-// ─── static transform lengths use the node's own font-size and per-axis size ───
+// ─── RM-15: static transform lengths use the node's own font-size and per-axis size ───
 
 /// `translateX(-10em)` on a 96px-font node must resolve against ITS OWN
 /// font-size (960px), not the hardcoded 16px `apply_static_node_transform`
@@ -283,7 +283,7 @@ fn static_translate_percent_resolves_per_axis_not_against_max_of_both() {
     );
 }
 
-// ─── --fix must not bake in machine-absolute asset paths ───────────
+// ─── RM-16: --fix must not bake in machine-absolute asset paths ───────────
 
 /// `--fix` used to serialise `LoadedScenario::raw`, captured AFTER
 /// `rustmotion::assets::rebase_relative_paths` rewrites every existing-file
@@ -355,7 +355,7 @@ fn fix_leaves_relative_asset_paths_untouched() {
     );
 }
 
-// ─── unwrappable_text_overflow must measure the CONTENT box ────────
+// ─── RM-31: unwrappable_text_overflow must measure the CONTENT box ────────
 
 /// A nowrap text's own painter draws inside its CONTENT box
 /// (`LegacyPaintDispatcher` hands it `layout.content_box()`, not the raw
@@ -405,3 +405,196 @@ fn unwrappable_text_overflow_is_measured_against_the_content_box() {
         "violation bbox should be the 100px CONTENT box, not the 2000px border box: {report_json}"
     );
 }
+
+// ─── RM-32: white-space: nowrap must not silence the height check ─────────
+
+/// A single unwrapped 120px-font line is ~144px tall, well past a 40px-tall
+/// box — the exact case `content_overflows_box` already catches for
+/// wrapping text. `white-space: nowrap` used to return before measuring
+/// height at all, so this validated clean.
+#[test]
+fn nowrap_text_taller_than_its_box_is_still_flagged() {
+    let scenario = ScratchFile::new("rm32-scenario");
+    let report = ScratchFile::new("rm32-report");
+    let json = r##"{
+        "video": { "width": 1920, "height": 1080 },
+        "scenes": [{
+            "duration": 1.0,
+            "children": [{
+                "type": "text",
+                "content": "Hi",
+                "position": "absolute",
+                "x": 50, "y": 50,
+                "style": {
+                    "width": "500px", "height": "40px",
+                    "white-space": "nowrap",
+                    "font-size": "120px",
+                    "color": "#ffffff"
+                }
+            }]
+        }]
+    }"##;
+    std::fs::write(&scenario.0, json).expect("write scenario");
+
+    let output = run_validate(&scenario.0, Some(&report.0), false, false);
+    let report_json = read_report(&report.0);
+    assert!(
+        !output.status.success(),
+        "a 120px-font single line is far taller than a 40px box; report={report_json}"
+    );
+    let violation = find_kind(&report_json, "content_overflows_box")
+        .expect("expected a content_overflows_box violation");
+    assert_eq!(violation["axis"], "y", "{report_json}");
+}
+
+// ─── RM-33: auto_scroll_disabled_overflow must use the terminal's CONTENT box height ───
+
+/// A terminal's own painter is NOT self-padding
+/// (`LegacyPaintDispatcher::is_self_padding` matches only `Codeblock`) — it
+/// paints inside its content box, so `auto_scroll: false` must compare
+/// natural height against that, not the border box. 10 lines ≈ 288px
+/// natural height (36px chrome + 32px internal terminal padding + 10×22px
+/// lines at the default 14px font); border box height is 400px, content box
+/// height is 400 - 300 (150px top+bottom CSS padding) = 100px.
+#[test]
+fn terminal_auto_scroll_disabled_overflow_is_measured_against_the_content_box() {
+    let scenario = ScratchFile::new("rm33-scenario");
+    let report = ScratchFile::new("rm33-report");
+    let lines: String = (1..=10)
+        .map(|i| format!(r##"{{ "text": "line {i}" }}"##))
+        .collect::<Vec<_>>()
+        .join(",");
+    let json = format!(
+        r##"{{
+            "video": {{ "width": 1920, "height": 1080 }},
+            "scenes": [{{
+                "duration": 1.0,
+                "children": [{{
+                    "type": "terminal",
+                    "lines": [{lines}],
+                    "auto_scroll": false,
+                    "position": "absolute",
+                    "x": 50, "y": 50,
+                    "style": {{
+                        "width": "800px", "height": "400px",
+                        "padding": {{ "top": "150px", "bottom": "150px" }}
+                    }}
+                }}]
+            }}]
+        }}"##
+    );
+    std::fs::write(&scenario.0, json).expect("write scenario");
+
+    let output = run_validate(&scenario.0, Some(&report.0), false, false);
+    let report_json = read_report(&report.0);
+    assert!(
+        !output.status.success(),
+        "~288px of natural content is far past a 100px content box (400px border box minus \
+         300px of padding); report={report_json}"
+    );
+    let violation = find_kind(&report_json, "auto_scroll_disabled_overflow")
+        .expect("expected an auto_scroll_disabled_overflow violation");
+    let height = violation["bbox"]["h"].as_f64().expect("bbox.h is a number");
+    assert!(
+        (height - 100.0).abs() < 1.0,
+        "violation bbox should be the 100px CONTENT box, not the 400px border box: {report_json}"
+    );
+}
+
+/// Negative control: a codeblock genuinely IS self-padding
+/// (`LegacyPaintDispatcher::is_self_padding`), so its own natural-height
+/// formula already bakes its padding in — the codeblock arm must keep
+/// comparing against the BORDER box, unaffected by this fix. Same 60px
+/// padding fixture as the pre-existing
+/// `codeblock_auto_scroll_check_honours_explicit_padding_not_a_hardcoded_16px`
+/// internal test, driven through the CLI instead.
+#[test]
+fn codeblock_auto_scroll_disabled_overflow_still_uses_the_border_box() {
+    let scenario = ScratchFile::new("rm33-codeblock-scenario");
+    let report = ScratchFile::new("rm33-codeblock-report");
+    let code_lines: String = (1..=10)
+        .map(|i| i.to_string())
+        .collect::<Vec<_>>()
+        .join("\\n");
+    let json = format!(
+        r##"{{
+            "video": {{ "width": 1920, "height": 1080 }},
+            "scenes": [{{
+                "duration": 1.0,
+                "children": [{{
+                    "type": "codeblock",
+                    "code": "{code_lines}",
+                    "auto_scroll": false,
+                    "style": {{ "width": "600px", "height": "250px", "padding": "60px" }}
+                }}]
+            }}]
+        }}"##
+    );
+    std::fs::write(&scenario.0, json).expect("write scenario");
+
+    let output = run_validate(&scenario.0, Some(&report.0), false, false);
+    let report_json = read_report(&report.0);
+    assert!(!output.status.success(), "report={report_json}");
+    let violation = find_kind(&report_json, "auto_scroll_disabled_overflow")
+        .expect("expected an auto_scroll_disabled_overflow violation");
+    let height = violation["bbox"]["h"].as_f64().expect("bbox.h is a number");
+    assert!(
+        (height - 250.0).abs() < 1.0,
+        "codeblock is self-padding: the reported bbox must stay the 250px BORDER box, \
+         not a content box: {report_json}"
+    );
+}
+
+// ─── RM-40: geometry.rs must not duplicate box_builder's component_kind ───
+
+/// `rustmotion_components::box_builder::component_kind` is already `pub`
+/// and already imported into this same binary crate elsewhere
+/// (`engine/render/scene.rs:719`) — geometry.rs must reuse it instead of
+/// carrying its own private 60-arm copy that can silently drift from it on
+/// a rename. `rustmotion::cli::commands` is a private module, so this
+/// checks the SOURCE FILE directly rather than calling the (unreachable)
+/// function itself — see this file's own top-of-file doc comment for why
+/// every other test here goes through the CLI subprocess instead.
+#[test]
+fn geometry_does_not_redefine_component_kind() {
+    let source = include_str!("../src/cli/commands/geometry.rs");
+    assert!(
+        !source.contains("fn component_kind"),
+        "geometry.rs must not define its own component_kind — it should call \
+         rustmotion::components::box_builder::component_kind instead"
+    );
+    assert!(
+        source.contains("box_builder"),
+        "geometry.rs must import component_kind from box_builder"
+    );
+}
+
+/// Smoke test: violations must still carry a sensible `component` label
+/// after the switch to the shared helper — proves the dedup didn't silently
+/// break the import wiring.
+#[test]
+fn violation_component_label_still_resolves_after_dedup() {
+    let scenario = ScratchFile::new("rm40-scenario");
+    let report = ScratchFile::new("rm40-report");
+    let json = r##"{
+        "video": { "width": 1920, "height": 1080 },
+        "scenes": [{
+            "duration": 1.0,
+            "children": [{
+                "type": "shape",
+                "shape": "rect",
+                "position": "absolute",
+                "x": 1900, "y": 100,
+                "style": { "width": "100px", "height": "100px" },
+                "fill": "#ff0000"
+            }]
+        }]
+    }"##;
+    std::fs::write(&scenario.0, json).expect("write scenario");
+
+    let output = run_validate(&scenario.0, Some(&report.0), false, false);
+    assert!(!output.status.success());
+    let report_json = read_report(&report.0);
+    let violation = find_kind(&report_json, "viewport_overflow").expect("violation present");
+    assert_eq!(violation["component"], "shape", "{report_json}");
+}
diff --git a/crates/rustmotion/tests/audit_ws_c.rs b/crates/rustmotion/tests/audit_ws_c.rs
index 0b18c5b3..a7db3ecd 100644
--- a/crates/rustmotion/tests/audit_ws_c.rs
+++ b/crates/rustmotion/tests/audit_ws_c.rs
@@ -154,3 +154,144 @@ fn atempo_guard_rejects_non_positive_and_non_finite_rates_without_hanging() {
         }
     }
 }
+
+// ─── A transition's declared easing must actually reshape its progress ────
+//
+// `transition_progress`/`view_transition_progress` hand a raw *linear*
+// fraction to `apply_transition`, which composites pixels at exactly the
+// fraction it's given — it has no notion of the scenario's declared
+// `transition.easing` on its own. Before this fix, that raw linear fraction
+// reached `apply_transition` unmodified for every transition type except
+// `camera_pan` (which threads easing through a different function,
+// `camera_pan_transition`, that already applies it internally), so
+// `"easing": "ease_in"`/`"ease_out"` on a `fade`, wipe, iris, or a
+// between-view transition was silently a no-op.
+//
+// A `fade` between a solid-black and a solid-white full-canvas frame turns
+// this into an exact, predictable pixel value: at the frame whose *linear*
+// position in the transition is precisely 0.5, an eased blend must land at
+// `255 * ease(0.5)`, not at the unequal, easing-blind `255 * 0.5 = 128`.
+// `ease_in_cubic(0.5) = 0.125` and `ease_out_cubic(0.5) = 0.875` are both far
+// enough from `0.5` that no rendering noise/antialiasing could produce a
+// false pass.
+
+fn center_pixel_red(rgba: &[u8], width: u32, height: u32) -> u8 {
+    let idx = ((height / 2 * width + width / 2) * 4) as usize;
+    rgba[idx]
+}
+
+#[test]
+fn a_fade_transitions_easing_reshapes_its_progress_not_just_camera_pan() {
+    let width = 64u32;
+    let height = 64u32;
+    let fps = 11u32;
+
+    for (easing, expected_u8) in [("ease_in", 32u8), ("ease_out", 224u8)] {
+        let json = format!(
+            r##"{{"video": {{"width": {width}, "height": {height}, "fps": {fps}}},
+            "scenes": [
+                {{"duration": 1.0, "children": [
+                    {{"type": "shape", "shape": "rect", "fill": "#000000",
+                      "position": "absolute", "x": 0, "y": 0,
+                      "style": {{"width": {width}, "height": {height}}}}}
+                ]}},
+                {{"duration": 1.0,
+                  "transition": {{"type": "fade", "duration": 1.0, "easing": "{easing}"}},
+                  "children": [
+                    {{"type": "shape", "shape": "rect", "fill": "#ffffff",
+                      "position": "absolute", "x": 0, "y": 0,
+                      "style": {{"width": {width}, "height": {height}}}}}
+                ]}}
+            ]}}"##
+        );
+        let scenario =
+            rustmotion::loader::load_scenario_from_source(None, Some(&json)).expect("load");
+
+        let tasks = rustmotion::encode::video::build_frame_tasks(&scenario);
+        let target = tasks
+            .iter()
+            .find(|t| {
+                matches!(
+                    t,
+                    rustmotion::encode::video::FrameTask::SlideTransition {
+                        frame_in_transition: 5,
+                        ..
+                    }
+                )
+            })
+            .unwrap_or_else(|| panic!("{easing}: expected a mid-transition frame at index 5"));
+
+        let rgba = rustmotion::encode::video::render_frame_task(&scenario.video, &scenario, target)
+            .unwrap_or_else(|e| panic!("{easing}: render failed: {e}"));
+        let red = center_pixel_red(&rgba, width, height);
+
+        assert!(
+            (red as i32 - expected_u8 as i32).abs() <= 4,
+            "{easing}: at the transition's linear midpoint, the eased blend must land near \
+             {expected_u8}, got {red}"
+        );
+        assert!(
+            (red as i32 - 128).abs() > 20,
+            "{easing}: {red} is too close to 128 — the raw, unequal linear-progress blend an \
+             easing-blind composite would produce"
+        );
+    }
+}
+
+#[test]
+fn a_between_view_fade_transitions_easing_reshapes_its_progress() {
+    let width = 64u32;
+    let height = 64u32;
+    let fps = 11u32;
+
+    let json = format!(
+        r##"{{"video": {{"width": {width}, "height": {height}, "fps": {fps}}},
+        "composition": [
+            {{"type": "slide", "scenes": [
+                {{"duration": 1.0, "children": [
+                    {{"type": "shape", "shape": "rect", "fill": "#000000",
+                      "position": "absolute", "x": 0, "y": 0,
+                      "style": {{"width": {width}, "height": {height}}}}}
+                ]}}
+            ]}},
+            {{"type": "slide",
+              "transition": {{"type": "fade", "duration": 1.0, "easing": "ease_in"}},
+              "scenes": [
+                {{"duration": 1.0, "children": [
+                    {{"type": "shape", "shape": "rect", "fill": "#ffffff",
+                      "position": "absolute", "x": 0, "y": 0,
+                      "style": {{"width": {width}, "height": {height}}}}}
+                ]}}
+            ]}}
+        ]}}"##
+    );
+    let scenario = rustmotion::loader::load_scenario_from_source(None, Some(&json)).expect("load");
+
+    let tasks = rustmotion::encode::video::build_frame_tasks(&scenario);
+    let target = tasks
+        .iter()
+        .find(|t| {
+            matches!(
+                t,
+                rustmotion::encode::video::FrameTask::ViewTransition {
+                    frame_in_transition: 5,
+                    ..
+                }
+            )
+        })
+        .expect("expected a mid-view-transition frame at index 5");
+
+    let rgba = rustmotion::encode::video::render_frame_task(&scenario.video, &scenario, target)
+        .expect("render");
+    let red = center_pixel_red(&rgba, width, height);
+
+    assert!(
+        (red as i32 - 32).abs() <= 4,
+        "ease_in at the view transition's linear midpoint must land near 32, got {red}"
+    );
+    assert!(
+        (red as i32 - 128).abs() > 20,
+        "{red} is too close to 128 — the raw, unequal linear-progress blend an easing-blind \
+         composite would produce"
+    );
+}
diff --git a/crates/rustmotion/tests/audit_ws_e.rs b/crates/rustmotion/tests/audit_ws_e.rs
index 9b0e92ab..d5638db0 100644
--- a/crates/rustmotion/tests/audit_ws_e.rs
+++ b/crates/rustmotion/tests/audit_ws_e.rs
@@ -37,7 +37,9 @@ fn render_world_frame(scenario_json: &serde_json::Value, frame_in_view: u32) ->
 /// for "is the decorative child visible in this frame" that doesn't depend
 /// on knowing any particle's exact on-screen position.
 fn green_pixel_count(buf: &[u8]) -> usize {
-    buf.chunks_exact(4)
+    buf.as_chunks::<4>()
+        .0
+        .iter()
         .filter(|px| px[1] > 100 && px[0] < 80 && px[2] < 80)
         .count()
 }
diff --git a/crates/rustmotion/tests/audit_ws_h.rs b/crates/rustmotion/tests/audit_ws_h.rs
index 1a83b147..81899ab3 100644
--- a/crates/rustmotion/tests/audit_ws_h.rs
+++ b/crates/rustmotion/tests/audit_ws_h.rs
@@ -1,5 +1,5 @@
 //! Regression tests for the workstream H (untrusted scenario ingestion)
-//! audit finding that lives in the `rustmotion` crate:.
+//! audit finding that lives in the `rustmotion` crate: RM-46.
 //!
 //! Remote fetching for `include: "https://..."` is deliberate design; the
 //! finding is the absence of any control around it. These tests exercise
@@ -20,7 +20,7 @@ fn scenario_with_remote_include(url: &str) -> Scenario {
     .expect("scenario with a remote include parses")
 }
 
-// ----, part 1: remote includes are denied by default ----
+// ---- RM-46, part 1: remote includes are denied by default ----
 
 #[test]
 fn remote_include_is_denied_by_default() {
@@ -46,7 +46,7 @@ fn remote_include_denial_names_the_opt_in() {
     );
 }
 
-// ----, part 2: once opted in, resolved addresses are still checked
+// ---- RM-46, part 2: once opted in, resolved addresses are still checked
 // against loopback/link-local/private ranges before any request is made ----
 
 #[test]