fix(audit): remediate the September 25 audit across all five crates

[LeadcodeDev]

Remediation of the 25 September audit: 217 findings across five crates, cross-referenced against 795 Remotion features. This branch closes most of them. The full record is on #315.

This is too large to review in one sitting, and that is worth saying plainly. It opened as six commits covering a spike and grew to forty-three across fourteen workstreams. Reviewing it as a unit is not realistic; reviewing it commit by commit is, since each one carries its own why, the alternative it rejected, and what it could not verify. A reader with limited time should read the commit subjects, pick the three that touch code they care about, and read those bodies.

What the audit actually found

The dominant defect class is silence, not crashes. A field that parses and does nothing. A flag accepted and dropped. A barrier that approves what it should refuse. Almost nothing here is a segfault; nearly everything is a picture that came out wrong with no way for the author to find out.

That shape drove the remediation's single rule: either the thing works, or its presence is refused by a message that names it and locates it. Silence is the bug.

What changed

The geometry validator — the entry document calls it mandatory — was bypassable five ways. vw and vh measured against a hardcoded 1920×1080 during intrinsic measurement, so the same declaration was wrong in both directions on any other resolution. --strict-anim sampled eight points per second whatever the frame rate, while the documentation sells it as frame-by-frame. A keyframed camera was never interpolated, so the documented way to animate a pan checked nothing at all. Seven painters ignored the box layout gave them. A centre-aligned stroke always bled half its width outside the box it was measured in.

Encoding did not produce what the flags asked for. --transparent was dropped on the default path after every frame had been rendered. Codec and CRF vanished without ffmpeg. concat drifted the audio by 33 to 45 ms per seam, cumulatively, on the command the entry document sells as the brick of a distributed render — and the cause was not the edit list everyone assumed but the AAC encoder's trailing padding, which nothing in the audio stream records. The video track, never padded, is the only ground truth available for the sample count.

Three file reads reachable from a scenario. Path::join returns its argument unchanged when that argument is absolute, so an icon id carrying a path made the cache directory vanish from the computation. usvg's default href resolver opens a plain <image href> as a local file, so inline SVG data could pull an arbitrary file into a frame. And three of the four sites that hand a scenario's src to ffmpeg had no guard at all — including the one the studio reaches by opening a file, with no flag and no validation upstream.

Seventeen inert fields. mix-blend-mode, clip-path and visibility are implemented. text-decoration is removed, because drawing it correctly needs per-line metrics that only the text painters have, and a bar at a fixed height is right for one line and wrong for every wrapped paragraph.

The scenario expansion had no scope. A config variable named like a for-each field silently won, and a nested iteration lost to its parent. Bindings chain now, and a component sees only what it was handed.

The paint pass clipped transformed descendants out of their own opacity layer, dropped whole subtrees when a container's own box measured zero, and painted eight components' backgrounds twice.

The charts drew plausible wrong answers — a radial bar whose largest item was always a closed ring, an area chart painting its smallest value on the floor as if it were near zero, a treemap whose negative value pushed the others out of the box.

The HTML dialect turned an unrecognized tag into a div in silence, so a typo produced a scenario that transpiled, validated and rendered almost right.

Supply chain: six of the ten advisories the CI suppressed had a semver-compatible fix available the whole time, reachable by a lockfile update and no manifest change. Real vulnerabilities go from eleven to five. The publish workflow now refuses a tag whose commit is not an ancestor of main or whose checks did not pass.

Documentation: every JSON block in the README and the skills was executed rather than read. Eighteen README examples failed. Around twenty-five documented CLI invocations passed the file positionally, which no subcommand accepts.

What the diff does not show

Two findings did not survive contact. world-position is not inert in the HTML dialect: paired with transition: camera_pan it drives the pan between two scenes, proven by two renders whose pixels differ — the finding generalised from a single test. And a spring's closeness to its target at the end of its segment was a sampling coincidence on a zero crossing; instrumenting the settle time showed it had not settled at all.

Three fixes were measured and then not written. Caching layout across frames: taffy is 8.3% of a frame on a deliberately dense scenario, the box tree is 28.8%, and a fingerprint that missed an animated dimension would produce a stale layout — a wrong picture, silently. The text measurement cache gains nothing measurable on this repository's own examples, and the commit says so; it is kept for the complexity fix beside it, which is proven, and for the twelve-thread pathology it removes.

Rendering changes visibly in five examples, and each is a defect being corrected rather than a regression: an area chart's axis now starts at zero, badges lose a square corner behind their rounded pill, a badge that never centred now does, and the promo's particle background declares the bleed it always had.

A missing font family is now reported. Expect it on every example on a machine without Inter — the same scenario used to wrap differently on different machines without a word.

text-decoration is a compatibility break. It parsed and did nothing; it now fails validation. Nothing it produced was ever what was asked for.

Explicitly out of scope

The TEST lens — eleven findings on the suite itself — is untouched, deliberately: writing tests against an engine under repair freezes the intermediate state. Around fifteen findings were handed between workstreams and landed outside every write partition; stagger, declared on fifty-seven component structs and read for four, is the largest. Five encoding performance findings are architecture changes rather than repairs.

Five findings became issues instead: #318, #320, #321, #322, #324. Two of them need a product call, one needs the copyright holder's name.

This audit never had an adversarial panel. The September one did, with 50% refutation. Two findings were refuted here by measurement, both by accident, while doing something else. How many of the rest stand only because nobody tried to break them is unknown.

Verification

Full suite on a detached worktree at rest, cargo fmt --all --check clean, clippy clean across the workspace, and all eleven examples/*.json validate — which they did not before this branch.

Refs #315
Closes #323