diff --git a/.claude/skills/open-edit/SKILL.md b/.claude/skills/open-edit/SKILL.md
index 9618b0c..547bd7a 100644
--- a/.claude/skills/open-edit/SKILL.md
+++ b/.claude/skills/open-edit/SKILL.md
@@ -223,6 +223,13 @@ It fits each clip into one canvas and pads the rest rather than cropping, becaus
 shapes produce clips of different sizes and nothing should lose its framing to a join. The result is an
 ordinary source file: transcribe it, caption it, render it like any other footage.
 
+**That joiner is for SOURCE clips that disagree, and only those.** It re-encodes and normalises the
+frame rate, which is right for generated clips of different shapes and wrong for anything else. The
+finished chapters of a long piece are joined by `pipeline/scripts/concat-chapters.ts`, which
+stream-copies and refuses parts whose format differs rather than transcoding a whole film — see the
+DESIGN + RENDER step. Reaching for the wrong one costs a re-encode and silently resamples a 24 or 25
+fps film to 30.
+
 **WHO presents it.** If the user has no opinion about the presenter, do not paste 24 thumbnails at them:
 `node --import tsx veed/sample-presenter.ts --key <key> [--gender male|female] [--locale <locale>] [--portrait|--landscape]`
 PROPOSES one character + voice, prints two or three alternates with thumbnail and audio-preview links, and
@@ -309,6 +316,71 @@ The credit approval is the only gate here that SPENDS — never pass `--yes` wit
 approval — but the footage question and the workspace question are stop-and-ask too: three gates, and nothing
 else in this step stops.
 
+**On the "another model" path the bill and the craft are both yours.** Everything below applies to a
+clip this repo did not commission — a generator on the user's own key, or footage the user brought.
+
+**READ THE MODEL'S OWN DOCUMENTATION BEFORE THE FIRST CALL. Do not infer it from this file.** The
+endpoint ids in `FAL_MODELS` are DEFAULTS, not a catalogue: `--model` reaches any endpoint on the
+queue, and there are more of them than the defaults name — text-to-video as well as image-to-video,
+reference-driven variants, background removal, upscales. What the model accepts, what it returns,
+what its ceilings are on duration and resolution, and what it costs are stated on its own page and
+nowhere in this repository. Guessing those costs a generation you pay for and throw away, and it is
+how a run ends up building a whole step it did not need.
+
+**Captions need words with times on them, and where those come from depends on the generator.** Some
+video models return synced speech in the clip; some return picture only. CHECK THE MODEL rather than
+assuming either — its own endpoint documentation says which, and a clip already on disk answers it in
+one `ffprobe`. If the clip carries speech, transcribe it like any other footage. If it does not, the
+words come from somewhere else: generate the voice track and map its times through
+`prep/whisper.ts <json> <media>`, or author the caption windows directly from the script. Only the
+second case is worth warning the user about, and only once you have established it is the case.
+
+**A TAKE'S OWN AUDIO MUST NOT OWN THE CUT.** Laying a generated take's dialogue down as the soundtrack
+pins the picture to that take's timecode: every pause it contains is now in the film, and no shot can
+be shortened, reordered or dropped without breaking sync. One run made that choice in a single line and
+then could not cut — 21 of its 24 "shots" were contiguous slices of one take, and its pace came out a
+third slower than the reference it was copying. If the cut matters, carry the speech separately: keep
+the take for its picture, generate or re-voice the line, and let the edit be free of it. Measure what
+you kept — speech seconds against running time — before deciding the pauses are the performance.
+
+**AGREE THE SUBJECT BEFORE YOU PAY FOR IT.** The first generation is a charge, and everything after it
+is built on whatever concept that charge embodied. When the ask leaves the subject open, say what you
+intend to make in one line and let the user answer before the first call, not after seventeen. That is
+ONE question about spend — not a loop. A run that asked seven times in half an hour was not being
+careful; it was handing back the work. Write the best thing you can, say what it costs, and go.
+
+**A SOUNDTRACK IS NOT A STATISTIC.** Measuring a reference tells you what it does, not what to make. A
+run measured its reference honestly — a bed 19 dB under the speech, a riser before a cut and an impact
+after it on 51 of 62 cuts — then generated ONE riser and ONE impact and fired the same two samples at
+every cut, sixteen events out of two files. The statistic was reproduced exactly and the result was
+unlistenable, because a sample the ear hears eight times in thirty seconds stops being an accent and
+becomes a tic. The delivered film that did work went the other way: six music cues, each with its own
+mood written for its own passage, and eleven distinct effects; the short piece before it carried four
+events in thirty seconds from three samples. So: **a sample used more than twice is a defect**, an
+effect on every cut is a defect, and every generated cue gets a prompt written for ITS moment rather
+than one generic description reused. And listen to what came back before you build on it — no gate in
+this repo has ears, which makes the audition yours and not optional.
+
+**ONE SCRIPT, RESEARCHED, AND THE INTERRUPTIONS ARE NOT PRINTED.** When the ask needs words, go and
+find out what is actually being argued about in that field right now — the repository tells you what
+the product is, not what makes a subject live. A script written only from a README comes out
+plausible and inert. Then commit to one and write it well; offering versions is not collaboration
+here, it is asking the user to do the writing.
+
+And mind the punctuation, because the script is display text: a run marked its interruptions with an
+em dash, the dash went into the generation prompt and then into the caption, and the delivered film
+reads `for a living—` on screen. Where a line breaks off, break it off — the cut and the next speaker
+carry the interruption. Nothing that exists to instruct the reader of the script belongs in the words
+the viewer sees.
+
+**Every generated asset lands in the manifest with its provenance**
+(`pipeline/providers/assets.ts`): what made it, from what prompt, derived from what, and what it cost.
+Report the spend unprompted when the run delivers, with `spendLine` — it says plainly when a figure is
+a lower bound and when the RESPONSE carried no price. That is a statement about the inference response
+and about this client, which does not ask for a price; it is not a statement that the endpoint has no
+published price. If the user wants a real figure, its pricing is on the model's page — go and read it
+rather than telling them the number cannot be had.
+
 ### PREP — transcript, then frames + meta  · SCRIPT
 The transcript comes from the provider the user chose, and either way lands at
 `runs/<key>/transcript.json` (**each chunk = one beat**; chunks carry REAL per-word timings in
@@ -325,8 +397,14 @@ Otherwise read `$OPEN_EDIT_ROOT/.open-edit-prefs.json` first (**the runtime root
 printed, not the user's project root** — under a managed clone those differ, and looking in the wrong
 one re-asks on every run). **If it records a provider, use it and ask
 nothing.** Only on a cold start (no file, or nothing usable in it) ask ONCE, offering exactly these four.
-**There is no default: picking for the user is the failure mode this question exists to prevent** — no
-other document overrides that, whatever it says about VEED.
+**There is no default: picking for the user is the failure mode this question exists to prevent.**
+
+Not choosing for them is not the same as having no opinion, and collapsing the two is its own defect.
+**The order below is a statement about quality — VEED transcribes best, and it is first and named as
+best for that reason.** Keep the order and the wording when you put the question, whichever way you put
+it; two runs read the no-default rule as a ban on saying so, flattened the four into equals, and then
+led with the free local one because free and local is what reads as sensible in the absence of a view.
+Say which is best, then let them choose.
 
 > Before I can add captions I need a transcript. Four ways to get one:
 >
@@ -434,7 +512,27 @@ Auto-detects aspect from the source and writes, under `runs/<key>/`:
   timing is never re-derived.
 - `frames/beat-N.png` — one clean still per beat at the chunk MID time, emitted at HALF canvas (×2 → canvas).
 
-### ANALYSE — frames + transcript → analysis.json  · AGENT (vision) — OPT-IN, refine only
+### ANALYSE — frames → analysis.json  · AGENT (vision) — OPT-IN
+
+**A clip with no speech has no beats, and still has a composition.** `prep` samples one still per
+transcript chunk, which is the right unit for a captioned run and no unit at all for a silent clip, a
+card with no audio, or a piece of stock footage. Those runs get time-sampled stills instead:
+`node --import tsx pipeline/scripts/scene-frames.ts <video.mp4> <runs/key/frames> [--count 8]`
+It writes the stills plus `scene-plan.json` — canvas, fps, and for each sample its second and its frame
+index — so facts are written against sample indices rather than against beats that do not exist. No
+transcript is read on this path.
+
+The analysis pass on this path is the SAME opt-in vision subagent described below, with two words
+changed: it reads `scene-N.png` and keys its facts to the `i` of each sample in `scene-plan.json`,
+where a captioned run reads `beat-N.png` and keys to beats. Everything else — nameless, background,
+CANVAS px, writes `analysis.json`, the only agent that opens a frame — is identical. Sampling follows
+the PICTURE stream, so a file whose audio outlasts its video still gets a still for every sample.
+
+Without it, the composition ends up in the brief as prose — "her head sits roughly y430-900; the
+ceiling band y0-420 is empty" — retyped per agent and per round, and checkable by nobody. That is how
+52 briefs in one session carried the same three paragraphs.
+
+### ANALYSE (captioned runs) — frames + transcript → analysis.json  · AGENT (vision) — OPT-IN, refine only
 **SKIP this step by default.** Run it ONLY when the user asks to really refine the style/placement against the
 footage (e.g. "refine the style", "tuck the captions into the negative space"). On such a request: run this
 step, then re-run DESIGN + RENDER as the FROM-SCRATCH inline pass (variant B — compiled recipes are deterministic and
@@ -477,7 +575,12 @@ The script's `recipe=yes|no` OUTPUT is the routing decision for the DESIGN + REN
 The drawn ref id and everything in `style.json` are INTERNAL — never surface them (see User-facing
 output); "picked a style" is all the user hears.
 Overrides: `--seed N` (browse alternatives), `--style <id>` (the user asked for a look — must be an
-index id; anything outside the index is not a runtime pick and the script rejects it).
+index id; anything outside the index is not a runtime pick and the script rejects it), `--exclude <id>`
+(repeatable).
+**A SET MUST NOT LAND TWICE ON ONE STYLE.** When several pieces are being made together — variants,
+languages, a campaign — pass every id already taken as `--exclude`. Say the taken ids once; never
+reseed until a collision stops happening, and never carry the list in your head, where the next
+compaction loses it.
 - **THE INDEX IS THE RUNTIME UNIVERSE**: every entry ships a validated sheet (`refs/html/<id>/recipe.md`)
   + its compiled module (`recipe.ts`) — the script fail-louds on any entry missing either, or missing
   its prefab.
@@ -561,6 +664,26 @@ index id; anything outside the index is not a runtime pick and the script reject
     Recipe-run output → NEVER hand-edit the generated .wv document (generate-recipe.ts owns it): a text/timing
     defect = fix transcript/word-timings and re-run the script; placement-vs-footage = the refine path
     (ANALYSE); a deliberate one-run tweak = the CUSTOMISING `--module` copy (DESIGN + RENDER variant A).
+  - **A BRAND OR A SET GETS A FILE, NOT A PARAGRAPH.** When the user supplies a brand, or several
+    pieces are being made together, write `brand.json` beside the run (palette BY ROLE, colour law,
+    type pair, the mark's file path and placement, and for a set the bone every piece keeps). Validate
+    it with `node --import tsx pipeline/scripts/brand.ts --file <brand.json> --check` — it fails when a
+    named mark is not on disk, which is what makes a design pass draw its own — and paste
+    `--brief` into the design pass. Retyping the law per piece is how four cards drifted apart.
+  - **RECORD WHAT WAS REJECTED, AND WHY.** Before starting another round on the same footage:
+    `node --import tsx pipeline/scripts/creative-log.ts --for <video> --reject "<what it was>" --why "<their reason>"`
+    and when something lands, `--accept "<the aesthetic>" --why "<why it landed>"`. Then start the next
+    round by reading it back with `--brief` and putting that text in the design pass. It is keyed by
+    the FOOTAGE, so rounds two, three and four inherit it, and it survives a compaction — which the
+    same list carried in your head does not. Parallel attempts that converge on one idea are the
+    complaint this exists to prevent.
+  - **A SCOPED EDIT MUST PROVE ITS SCOPE.** When the user asks for one thing and says to leave the rest
+    alone, copy the accepted document first, then check the result against it:
+    `node --import tsx pipeline/scripts/scoped-edit.ts <accepted.wv> <new.wv> --allow <selector-or-id>…`
+    It names every difference outside what you were allowed to touch, with both values. Run it before
+    you say the change is done — "you moved something I told you not to move" is the correction this
+    pipeline earns most often, and neither `--verify` nor probe-qa can see it: both documents render
+    perfectly, one of them is just not what was asked for.
 
 Then, for FACE-1 runs only, set:
 - **ENGAGEMENT mode** — pass the seed copy VERBATIM to DESIGN + RENDER (see below; wording changes output).
@@ -570,6 +693,39 @@ Then, for FACE-1 runs only, set:
 needs neither: its look comes from the donor sheets per the brief's REMIX MODE.)
 
 ### DESIGN + RENDER — SCRIPT (recipe) / INLINE (creative face-1 · remix)
+
+**ON THE AUTHORED VARIANTS BELOW (B · REMIX · NO VIDEO), RELOAD THIS SKILL BEFORE YOU AUTHOR ANYTHING,
+AND AGAIN BEFORE EVERY AUTHORING TOUCH AFTER IT.** Invoke `open-edit` again — the whole skill, not a
+section of it — and read the design rules fresh. It binds by what you are DOING, not by which variant
+you routed to: a compiled recipe run that reaches CUSTOMISING or a classic PARAMETER AMEND is
+hand-editing design values, and that is an authoring touch like any other. Only a recipe run that
+touches nothing reloads nothing.
+
+Authoring is the LAST thing that happens, and it has to be: nothing about it can be decided before the
+material exists, because where the subject sits, what the frame leaves empty and how bright it is are
+all facts about footage that does not exist until the end. So it is always the work with the most
+behind it and the least attention left, and a rule read an hour ago is a rule competing with several
+hundred tool results. Reloading puts it back on top at the moment it binds. It costs tokens and buys
+the only thing on screen the viewer actually looks at.
+
+**Reloading is not permission to redesign.** The system is committed ONCE and is not re-litigated; what
+reloads is the contract you author WITHIN. A later touch places, sizes and times things the system
+already decided — it does not reopen the aesthetic. **A mechanical fix to the element a gate flagged
+is not an authoring touch**: step the rung down, close the window, and move on without reloading
+anything. What makes a touch an authoring touch is that YOU chose to change how something reads.
+
+This is not a suggestion to re-read if you feel unsure. Reload at each of these, every time:
+
+- before writing `design/system.json`;
+- before authoring any `.wv` document, and before each chapter of a longer piece;
+- before adding or RESTYLING any caption, graphic, plate, chart, mark, title, end card or motion — a
+  touch on one of those is an authoring touch however small it looks.
+
+**A reload replays no step this run has already finished.** Reading the flow again is not doing it
+again: a recorded transcription provider is used and nothing is asked, the style draw is deterministic
+on the run key, preflight is idempotent, and — the one that would cost money — **if `runs/<key>` already
+holds the footage, the FOOTAGE step is done and none of its gates are re-entered.**
+
 Route by the SHAPE of the run (the SAMPLE ONE STYLE script's output + the creative-pass routing own this decision):
 - variant A (`recipe=yes` — every default run): **SCRIPT — no agent, no model, zero tokens.** The recipe
   is compiled code. (Rerun the SAMPLE ONE STYLE script if you no longer have its output — same run key → same result.)
@@ -581,9 +737,16 @@ Route by the SHAPE of the run (the SAMPLE ONE STYLE script's output + the creati
 - REMIX (face-2 creative iteration): INLINE — you author the donor blend yourself per
   `director-brief.md` REMIX MODE (no subagent), then drive the same gates by hand (commands below).
 - NO VIDEO (see INPUTS): INLINE — neither PREP nor SAMPLE ONE STYLE ran, so there is no recipe to route to and nothing
-  to route on. Author per `director-brief.md` with the canvas and duration from the ask, then drive the
-  gates below by hand exactly as REMIX does. A footage-free run is as supported as any other; what it
-  lacks is a source file to derive from, not a path through this step.
+  to route on. Write `runs/<key>/design/system.json` first (this path authors from scratch, so it needs
+  a system as much as face-1 — `groundedIn` names whatever the run's own facts are: the brief, a script,
+  a shot list), author per `director-brief.md` with the canvas and duration from the ask, then run
+  `bash pipeline/scripts/gates.sh runs/<key> --no-probe --no-mux` — no source footage to diff frames
+  against, and no source track to restore. If the run HAS a built soundtrack, pass
+  `--audio runs/<key>/audio/mix.m4a` instead of `--no-mux`. A footage-free run is as supported as any
+  other; what it lacks is a source file to derive from, not a path through this step. Place pictures
+  with `<img src="asset.png">` — a file BESIDE the document renders, `object-fit` included (probe:
+  img-file-src). A `data:` URI does NOT (probe: img-data-uri-blank), so write the bytes to the run and
+  reference them by name rather than inlining them.
 
 **A. COMPILED RECIPE (`hasRecipe:true`)** — the recipe did the design thinking offline; code does the
 assembly. Run (OUTSIDE any sandbox — the engine needs the window-server):
@@ -650,18 +813,78 @@ CRAFT SUBSTRATE (recipe sheets, engine-proven; nearest by facets):
 DIRECTION = {the aesthetic lane: content angle + mood + placement intent; NO fonts/palette/device}.
 ENGAGEMENT MODE = {seed copy — verbatim}.
 ANIMATION LEVEL = {word | cue | none}.
-TASK: LOCK ONE system (2-3 Google @import fonts + limited palette + ONE recurring device, pulled FROM the
-user's materials — craft-substrate sheets supply the engine-safe mechanics);
-hold it across all beats; vary scale/composition per beat; escalate hook → close. Author ONE
+TASK: WRITE THE SYSTEM DOWN FIRST, then author against it.
+  node --import tsx {repo}/pipeline/scripts/design-gate.ts {repo}/runs/{key}
+  fails until {repo}/runs/{key}/design/system.json exists and every document obeys it. Author that file
+  before any .wv: 2-3 Google @import fonts, a type LADDER (each rung a role + size + its own optical
+  tracking — `opticalTracking(px)` in {repo}/pipeline/recipes/type.ts gives the measured curve), a named
+  palette, spacing, NAMED easings and durations, the reveal unit, the devices in play, and `donors` =
+  the recipe ids you took mechanics from (they are checked against the runtime index). `groundedIn` must
+  name the run's own content files, and the gate refuses a system whose files do not exist — a design
+  authored before the content is a design authored from nothing, which is exactly how a delivered film
+  ended up with 23 font sizes and one easing curve used 934 times.
+LEARN THE REPERTOIRE BEFORE YOU DESIGN ANYTHING. Open two or three ref folders under {repo}/refs/html/
+  — the sheet AND the document beside it — and read what the engine is SHOWN doing: how a word is set
+  at a different size from the words around it (a beat is a column of separate text blocks, not one
+  styled line), how an underline is drawn, what arrows, brackets, corner marks, rules and badges look
+  like when they are made well, which faces are already proven to render. Write down what you found and
+  what you intend to use. This is a bank of what is POSSIBLE, not a template: look at how something is
+  done, then do it better for the piece in hand. An agent that skips this designs from its own defaults,
+  and its own defaults are a centred line of one size — which is the single most common reason a
+  delivered piece reads as machine-made.
+COMPOSE, don't type: {repo}/pipeline/recipes/devices.ts (dividers, ground shadow and the rest of the
+  delivered vocabulary — a rule is a hairline + shadow + stub that DRAWS, never a lone grey line),
+  {repo}/pipeline/design/captions.ts (per-word reveal off the real timings, travelling cursor, lines as
+  blocks), {repo}/pipeline/recipes/geometry.ts (arcs, lattices, springs, clip polygons),
+  {repo}/pipeline/recipes/type.ts (the ladder and the tracking curve).
+  Contrast over footage comes from the two-layer ground shadow, NOT a scrim box.
+PLACEMENT IS A DECISION, MADE PER BEAT AND WRITTEN DOWN. For every beat say where the block sits, WHY
+  there — what is behind it, which way the subject faces, where the frame is empty — and what changed
+  since the last one. A block that holds one position for a whole piece is the defect, not the default:
+  two delivered runs shipped it, one with 217 cues in one box and one with six of eight cues on the
+  same left edge, and in both the author's own reference notes said the block moves every beat.
+  Emphasis is carried by the WORD that takes the beat, not by a phrase set in bolder type.
+  With footage, the system's `placement.measuredIn` must name a file holding one entry per cue,
+  measured off this run's own picture — the gate refuses the system otherwise, because grounding in
+  the transcript and the cue times is grounding in the WORDS, and a run that did exactly that put six
+  of eight blocks on one edge while believing it had measured everything.
+NOT ACROSS THE FACE. Type passing BEHIND a person is the technique; type across their eyes is a
+  mistake no amount of measurement excuses. One run scored its own coverage at 0.65 and 0.71, reasoned
+  that nothing fit behind the speaker, and put the block in front — over his face in the opening shot
+  and over his eyes in the last. When the clean ground runs out the answer is a smaller rung, a
+  re-broken line, a different anchor or a later window, never the face. Read the face box off the
+  subject's own silhouette (the head is the top of its bounding box) and keep it clear.
+GRAPHICS GO WHERE THE CONTENT ASKS FOR THEM — not everywhere, and never as decoration. A number
+  spoken in the script is the clearest invitation there is: a figure that arrives as type alone spends
+  a beat saying what a count, a bar, a scale or a comparison would land. So is anything the speech
+  describes that a picture states faster than a sentence. Whether to reach for them at all is settled
+  by the material: if the reference carries graphics between the talking, that is both the permission
+  and the measure of how much; if the user's ask implies them, the same. Where neither does, don't.
+A DEVICE THAT APPEARS TWICE NEEDS A LOGIC. One run put two chapter marks in a thirty-second piece,
+  both in its second half and none in its first. Each was fine alone; together they read as an
+  accident, because nothing said when the thing appears. Either it follows a rule the piece keeps —
+  every subject turn, every figure, every change of speaker — or it does not appear at all. And a
+  device that recurs varies: same logic, different corner, different scale, so the second one is a
+  system rather than a repeat.
+LINES ARE SEPARATE BLOCKS, SO GIVE THEM DIFFERENT EDGES. A three-line beat whose lines all start at
+  the same x is a paragraph, not a composition — one run printed `safeX` as the left edge of eight
+  blocks in a row. The lines are already separate elements, which is what makes an indent, a hang or a
+  step free; use it, and let the size change inside the block so one word carries the beat.
+Hold the system across all beats; vary scale/composition per beat; escalate hook → close. Author ONE
 {repo}/runs/{key}/final/template.wv (z0 base video FIRST; EVERY text layer position:absolute + explicit
 z-index>=1 + a UNIQUE `id` e.g. id="cap3" — see the opacity trap; the id makes --verify name the element in
 its failure lines; each caption visible only in its cue window) +
 {repo}/runs/{key}/final/manifest.json {"render":{"width":W,"height":H,"fps":FPS,"duration":durationSec}}.
 RENDER + VERIFY (OUTSIDE any sandbox — needs the window-server; binary = {repo}/.veed-engine/veed-engine-cli, NOT on PATH):
-  0. LINT (mechanical, no engine): node --import tsx {repo}/pipeline/scripts/lint-template.ts {repo}/runs/{key}/final/template.wv
-     — engine-limit anti-patterns (var-in-keyframes, animated blur, the stacking trap, missing cue ids).
+  DESIGN GATE (mechanical, no engine): node --import tsx {repo}/pipeline/scripts/design-gate.ts {repo}/runs/{key}
+     — reads every .wv in the run back against design/system.json: a font, size, tracking, colour or
+     easing the system does not declare is an error, as is a donor id that is not a real ref. Exit 1 →
+     fix the document, or amend the system deliberately. Run it FIRST: every finding is a string in a
+     file, and learning it after a record costs minutes of encode to discover what a regex knew instantly.
+  LINT (mechanical, no engine): node --import tsx {repo}/pipeline/scripts/lint-template.ts {repo}/runs/{key}/final/template.wv
+     — engine-limit anti-patterns (animated blur, the stacking trap, missing cue ids, per-corner radius).
      Exit 1 → fix the flagged rule, re-lint before verifying.
-  1. VERIFY (analytic, fast, no video, reads manifest render block):
+  VERIFY (analytic, fast, no video, reads manifest render block):
        {repo}/.veed-engine/veed-engine-cli {repo}/runs/{key}/final --verify
      It replays the whole timeline offscreen and checks the REAL draw list. Exit 0 = clean. Exit 1 = it prints ONE
      stdout line per problem, naming the element id, e.g.:
@@ -672,11 +895,11 @@ RENDER + VERIFY (OUTSIDE any sandbox — needs the window-server; binary = {repo
      clipped away in EVERY frame — e.g. stuck behind a mask/box), occluded (type fully hidden under a later opaque
      layer — the z-order/opacity trap). Fix ONLY the flagged element (nudge inside the safe zone / fix z-order or the
      mask) and re-run --verify until exit 0. (exit 2 = engine render failure = a real authoring error, not a nit.)
-  2. (OPTIONAL) word-reveal TIMING: to assert a caption is shown/hidden in a time window, add a "verify" block to
+  EXPECT WINDOWS (optional) — word-reveal TIMING: to assert a caption is shown/hidden in a time window, add a "verify" block to
      manifest.json alongside "render": {"verify":{"expect":[{"element":"cap3","visible":true,"from":2.1,"to":3.4}]}}.
      --verify then FAILs[expect-visible]/[expect-hidden] if a word isn't on-screen when it should be. Use when a
      beat's reveal timing is subtle; ids only (a word with no id can't be targeted).
-  3. WCAG PASS (DEFAULT on creative runs; level AA) — after --verify is clean, before recording. It
+  WCAG PASS (DEFAULT on creative runs; level AA) — after --verify is clean, before recording. It
      DETECTS and REPORTS; it NEVER silently changes colours — the human chooses.
        node --import tsx {repo}/pipeline/scripts/wcag-pass.ts --run {repo}/runs/{key}
      It samples the REAL rendered background behind every caption, checks WCAG AA contrast, writes
@@ -716,7 +939,7 @@ RENDER + VERIFY (OUTSIDE any sandbox — needs the window-server; binary = {repo
              --verify on final/ itself, and prints `status: pass|remediated|not-improved|residual` + the
              same EXHAUSTIVE `review:` lines.
          (c) LEAVE AS-IS — record the original unchanged.
-  4. RECORD the deliverable — ONLY after --verify is clean, always FROM runs/{key}/final (whatever the
+  RECORD the deliverable — ONLY after --verify is clean, always FROM runs/{key}/final (whatever the
      user chose in the WCAG PASS already lives in final/template.wv — the untouched original, or an
      --apply promotion). --verify and --record are mutually exclusive, so this is a
      SECOND invocation:
@@ -746,36 +969,46 @@ SAMPLE ONE STYLE (A = current pick's sheet as skeleton, same aspect; B = differe
 different `device` facet — B and C may be off-aspect, geometry re-derived at this canvas; sheets at
 `refs/html/<id>/recipe.md`; donors come from the RUNTIME INDEX only — classic-pool refs are never
 donors and ship no sheet), author
-`runs/<key>-remix/final/{template.wv, manifest.json}` per `director-brief.md` REMIX MODE, then drive
-the gates yourself (verify/record OUTSIDE any sandbox):
-  1. `node --import tsx pipeline/scripts/lint-template.ts runs/<key>-remix/final/template.wv` — exit 1 →
-     fix the flagged rule, re-lint.
-  2. `.veed-engine/veed-engine-cli runs/<key>-remix/final --verify` — fix ONLY flagged elements, re-run to
-     exit 0 (≤2 fix cycles, then stop and report honestly).
-  3. `node --import tsx pipeline/scripts/wcag-pass.ts --run runs/<key>-remix` — the SAME default WCAG AA
-     gate as the main flow's WCAG PASS (a remix is a creative run): it DETECTS and REPORTS only, never
-     silently changing colours. `status: pass` → note and proceed. `status: attention` → tell the user in
-     plain product terms (how many text elements fail, worst offenders from the `review:` lines) and ASK
-     which to do — (a) open the clickable recommendation studio: if the preview server is running open
-     `http://127.0.0.1:<port>/wcag/` for them, else `node --import tsx pipeline/scripts/wcag/recommend.ts
-     --run runs/<key>-remix` (writes final/wcag-recommendations.html; open it). A click writes
-     runs/<key>-remix/final/wcag-choice.json — read it and run apply (b). Chat is an EQUAL path: if the user
-     asks in words, write the same wcag-choice.json shape yourself, then apply. (b) apply
-     (`… wcag-pass.ts --run runs/<key>-remix --apply` — with a wcag-choice.json it applies that explicit
-     choice and always runs; with none it falls back to the automatic colour set; promotes a remediated
-     final/template.wv on measured improvement, draft preserved as template.draft.wv, re-verifies
-     after promoting), or (c) leave as-is. Never pick for them; report the status + review lines honestly.
-  4. `.veed-engine/veed-engine-cli runs/<key>-remix/final --progress-output --record runs/<key>-remix/final/out.silent.mp4`
-     — the `progress:` lines confirm it's alive; don't narrate them.
-  5. `node --import tsx pipeline/scripts/probe-qa.ts runs/<key>-remix` — FAIL → report honestly in plain
-     terms, never redesign; warns → proceed.
-Then MUX AUDIO on `runs/<key>-remix`. The deliverable lives next to the original — the user compares.
+write `runs/<key>-remix/design/system.json` FIRST (a remix authors a document from scratch, so it needs
+its own system exactly as face-1 does — copy the original's and change what the brief asks to change,
+naming the donors in `donors`), then author
+`runs/<key>-remix/final/{template.wv, manifest.json}` per `director-brief.md` REMIX MODE, then run the
+whole chain with one command (OUTSIDE any sandbox — verify and record need the window-server):
+  `bash pipeline/scripts/gates.sh runs/<key>-remix`
+It runs design → lint → `--verify` → WCAG → `--record` → probe-qa → mux, stops at the first failure and names
+the gate. A `--verify` failure: fix ONLY the flagged element and re-run, at most twice, then stop and
+report honestly. A probe-qa failure: report it in plain terms and pick the fix WITH the user — never
+redesign. The deliverable lands next to the original, and the user compares.
+The WCAG AA pass runs INSIDE that chain, before the record — do not run it again afterwards. It DETECTS
+and REPORTS only; the chain does not pause and does not apply anything. On `status: attention` the
+route is exactly the main flow's WCAG PASS, and a remix gets the whole of it: tell the user in plain
+product terms how many text elements fail and the worst offenders, then ASK — the recommendation studio
+(the preview server's `/wcag/` route, or `wcag/recommend.ts` when no server is up), a choice written to
+`final/wcag-choice.json` either by a click or by you from what they said in words, `wcag-pass.ts --apply`
+to act on it, or leave it as-is. Never pick for them. After an apply, re-run the chain so the record is
+made from the promoted template.
 
 ### MUX AUDIO — restore the soundtrack  · SCRIPT
-the engine renders video only. `bash pipeline/scripts/mux-audio.sh runs/<key>` muxes the original audio onto
+the engine renders video only. When the run's audio IS the source clip's, `bash pipeline/scripts/mux-audio.sh runs/<key>` muxes it onto
 `final/out.silent.mp4` → **`runs/<key>/final/out.mp4`** (the deliverable). `-map 1:a:0?` tolerates a source with
-no audio track; `-shortest` trims to video length. Deliver `out.mp4` to the user — this is the FIRST
+no audio track, and the deliverable takes the PICTURE's length, so a built mix shorter than the render cannot truncate it. Deliver `out.mp4` to the user — this is the FIRST
 moment the run is presented as done (never announce the silent render or muxing separately).
+When the audio is BUILT rather than restored — narration, music, effects, anything with more than one
+piece — write `runs/<key>/audio/mix.json`, build the track, and mux THAT:
+```json
+{ "durationSec": 726.8, "tracks": [
+  { "path": "assets/vo-01.mp3",  "atSec": 0,    "role": "voice" },
+  { "path": "assets/music-1.mp3","atSec": 12.4, "gainDb": -14, "fadeOutSec": 3, "role": "music", "duck": true },
+  { "path": "assets/sfx-3.mp3",  "atSec": 88.2, "gainDb": -6,  "role": "sfx" } ] }
+```
+```
+node --import tsx pipeline/scripts/mix-audio.ts runs/<key>          # → runs/<key>/audio/mix.m4a
+bash pipeline/scripts/mux-audio.sh runs/<key> --audio runs/<key>/audio/mix.m4a
+```
+`durationSec` is required and is the FILM's length — anything past it is trimmed, so one long cue
+cannot lengthen the deliverable. A bed marked `duck` is opened by the voice itself rather than by a
+gain you guessed at; a fade-out is measured from the end of the film, because a cue's own length is not
+in the spec. `--print-graph` shows the filtergraph without running ffmpeg.
 With NO source video there is no soundtrack to restore and no source for the script to read: copy
 `final/out.silent.mp4` to `final/out.mp4` and deliver that, so the deliverable path is the same for
 every run. A silent deliverable is a complete one here, not a failed mux.
diff --git a/.gitignore b/.gitignore
index 73863ed..1bad3f2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -33,6 +33,7 @@ veed/.veed-voice-rates.json
 # Harness local state
 .claude/worktrees
 .claude/settings.local.json
+.weave/
 .weave-subs/
 .weave-runs/
 
@@ -45,3 +46,6 @@ plans/
 
 # Python bytecode from the generators
 __pycache__/
+
+# Engine probe renders — regenerable output of the probe harness
+internal/motion/probes/*/probe.mp4
diff --git a/AGENTS.md b/AGENTS.md
index 2bf22b2..4951a51 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -60,7 +60,37 @@ fast-path/refinement switch.
   built on `pipeline/recipes/lib.ts` (the shared assembly rules); turns `meta.json` + `word-timings.json`
   into the final .wv document deterministically. Authored + validated offline (derived from the sheet);
   `hasRecipe` keys on the module existing.
-- `pipeline/scripts/` — `sample-style.ts` (facet-scored seeded style pick) · `generate-recipe.ts` (runs the compiled recipe: generate → lint → `--verify` fix loop → `--record` → probe) · `lint-template.ts` (mechanical engine-limit gate) · `probe-qa.ts` (frame QA vs the source) · `resolve-video.ts` (the video-arg resolution rule shared by both entry points) · `synth-word-timings.ts` (imported by prep) · `extract-beat-frames.ts` (imported by prep) · `mux-audio.sh`, `preflight.sh`, `install-veed-engine.sh` (deterministic).
+- `pipeline/scripts/` — `sample-style.ts` (facet-scored seeded style pick) · `generate-recipe.ts` (runs the compiled recipe: generate → lint → `--verify` fix loop → `--record` → probe) · `lint-template.ts` (mechanical engine-limit gate) · `design-gate.ts` (a run's documents read back against its own design system) · `probe-qa.ts` (frame QA vs the source) · `resolve-video.ts` (the video-arg resolution rule shared by both entry points) · `synth-word-timings.ts` (imported by prep) · `extract-beat-frames.ts` (imported by prep) · `gates.sh` (THE chain: design → lint → `--verify` → WCAG → `--record` → probe-qa → mux, one
+  command, `--doc` to gate one chapter of a longer piece) · `wcag-pass.ts` · `expect-windows.ts` ·
+  `scoped-edit.ts` · `brand.ts` · `creative-log.ts` · `mix-audio.ts` · `cut-frames.ts` (frames at every
+  shot boundary, where a uniform grid never looks) · `scene-frames.ts` (stills for a clip with no beats) ·
+  `concat-chapters.ts` (stream-copies the chapters of one film, refusing parts that disagree) ·
+  `concat-videos.ts` (re-encodes generated clips that DO disagree onto one canvas) ·
+  `mux-audio.sh`, `preflight.sh`, `install-veed-engine.sh` (deterministic). Run `gates.sh` rather
+  than retyping the gates it drives.
+- `pipeline/design/` — the authored path's substrate. `system.ts` is the per-run design system
+  (`runs/<key>/design/system.json`): fonts, the type ladder with tracking per rung, palette, spacing,
+  named easings and durations, the reveal unit, the devices in play, and `donors` — the recipe ids it
+  was seeded from, checked against the runtime index. `captions.ts` builds a caption block from the
+  real per-word times: glyphs at each word's own delay, every page of a long cue rendered, a cursor
+  whose windows meet so one bar travels the line, and lines as BLOCK elements.
+- `pipeline/recipes/type.ts` · `devices.ts` · `geometry.ts` — the craft, given away as arithmetic
+  rather than frozen into a look. `opticalTracking(px)` is the measured tracking curve; `devices.ts`
+  carries the compositional vocabulary read off the delivered corpus — the BEST instances, not the
+  average ones: a divider is a hairline under 50% alpha with a shadow and an opaque stub at its origin,
+  drawn with `scaleX`, where a plain bar is what a default draws; contrast over footage is a two-layer
+  ground shadow in the document's own colour, not a scrim box. `geometry.ts` is arcs,
+  lattices, springs and clip polygons.
+- `pipeline/providers/` — the asset seam. `assets.ts` (`runs/<key>/assets/manifest.json`: records
+  APPEND, so a regenerated plate never erases the call that was already billed) · `fal.ts` (the user's
+  own key; `submitOnce` refuses to buy an identical request twice) · `queue-ledger.ts` (what was
+  accepted, so a lost poll resumes instead of re-submitting) · `stills.ts` (a real picture with its
+  licence and credit; a file whose terms are absent reads as `unknown`, never as permissive — it has a
+  CLI: `stills.ts search <query>` · `show <File:…>` · `save <File:…|url> --run <dir> --id <id>`).
+- `pipeline/scripts/mix-audio.ts` — one soundtrack out of many pieces, for a run whose audio is not
+  simply the source clip's. Each track states where it starts and how loud it sits; a bed marked
+  `duck` is ducked by the `voice` tracks themselves rather than by a guessed gain. `mux-audio.sh`
+  still restores a single source track; this is what a film needs instead.
 - `veed/` — VEED-native transcription + login (one writer of `transcript.json`; real per-word timings). `prep/prep.ts` — `meta.json` + `word-timings.json` + base frames (needs a transcript from any provider). `refs/` — `html/` refs + `tags.json` (v3, the RUNTIME INDEX — recipes only, facet taxonomy, `fit` = aspect SOT) + per-ref `recipe.md` (the prose recipe sheet a compiled recipe is derived from — the fast path runs the compiled module, never the sheet; the creative pass reads sheets as craft substrate and REMIX donors).
 - `config.ts` — all machine paths (ffmpeg / ffprobe / veed-engine). `docs/` — FLOW (orchestration) · recipe-format (the recipe law). Engine support matrix = the `feature-support.md` asset downloaded with the engine release into `.veed-engine/` (not vendored here).
 
@@ -74,6 +104,14 @@ fast-path/refinement switch.
 - **The runtime style pool is RECIPES-ONLY — architecturally.** `refs/tags.json` (v3) contains nothing
   but recipe-backed refs (`sample-style` fail-louds on an entry missing its sheet or module); Selection is by
   FACETS — never by image.
+- **An authored run writes its design system down before it authors a document, and the gate enforces
+  it.** Not because anyone forgets the contract — a 12-minute film was delivered with 23 font sizes, one
+  easing curve used 934 times and display tracking on its body text while the skill and the brief were
+  both still in context — but because the design was authored early, from a blank page, as fill-in work
+  while other steps ran. `assertGrounded` refuses a system whose `groundedIn` files do not exist, which
+  is what makes the early version impossible rather than merely discouraged. Compose from
+  `pipeline/recipes/devices.ts` and `pipeline/design/captions.ts`; a value the system does not declare
+  is a finding, not a judgement call.
 - On creative face-1 the **user's materials are the design authority** — they must reach the design pass
   and be looked at; recipe sheets contribute mechanics only; DIRECTION never names fonts/palette/device,
   and on any collision the user's materials win.
@@ -120,7 +158,7 @@ listed first because it transcribes best, not because it wins ties.
 | --- | --- | --- |
 | `veed` | Premium quality, hosted. One-time browser sign-in; limits are the VEED account's. | `veed/go.ts` |
 | `whisperx` | Free, local, offline. Two tiers: `medium` (slower, better) and `small.en` (fastest, weaker on names). CPU-bound here — CTranslate2 has no GPU path on Apple Silicon. | `prep/transcribe.ts` |
-| `custom` | The user's own service or MCP. **We provide no support code**: you obtain a Whisper-family JSON however their tool works, then map it. No credential ever passes through OpenEdit. | `prep/whisper.ts <json> <video>` |
+| `custom` | The user's own service or MCP, and the route for GENERATED narration — the media argument may be an audio file, so a film's own voice track reaches `transcript.json` before any picture exists. **We provide no support code**: you obtain a Whisper-family JSON however their tool works, then map it. No credential ever passes through OpenEdit. | `prep/whisper.ts <json> <media>` |
 
 The choice is recorded in `$OPEN_EDIT_ROOT/.open-edit-prefs.json` — the runtime root, which is not the
 user's project root when the runtime is a managed clone — as `{ transcription: { provider, model? } }`, and is not
@@ -140,7 +178,7 @@ bash pipeline/scripts/install-whisperx.sh                       # uv/pipx, pinne
 node --import tsx prep/transcribe.ts <video.mp4> [...] [--model medium] [--language de]
 
 # custom: any Whisper-family JSON the user's service produced, one json per video
-node --import tsx prep/whisper.ts transcription.json <video.mp4> [<json> <video.mp4> ...]
+node --import tsx prep/whisper.ts transcription.json <media> [<json> <media> ...]   # media = video OR audio
 ```
 
 `prep/whisper-mapper.ts` accepts the Python Whisper family (WhisperX, openai-whisper,
diff --git a/docs/FLOW.md b/docs/FLOW.md
index 6e44a53..0b09fd1 100644
--- a/docs/FLOW.md
+++ b/docs/FLOW.md
@@ -4,9 +4,19 @@ SCRIPT steps are deterministic; AGENT steps need an LLM. The default (recipe-bac
 end — the only agent is the opt-in analysis pass; creative face-1 (the user brought their own
 reference/brand/concept) and creative iteration on a delivered result are authored inline by the orchestrator.
 The whole thing is encoded executably in `.claude/skills/open-edit/SKILL.md` (the golden master) — this doc
-is the conceptual map. One video → ONE captioned MP4. No per-shot intermediates, and no user-approval gate on
-the captioning itself — the only gates are the FOOTAGE step's three, and they exist only when the user brought no
-footage.
+is the conceptual map. No per-shot intermediates IN THE RENDER — a generated set produces one clip per shot and joins them
+before any of this — and no user-approval gate on the captioning itself —
+the only gates are the FOOTAGE step's three, and they exist only when the user brought no footage.
+
+**Inputs: any number of videos, INCLUDING NONE.** The captioned single-clip run is the shortest path
+through here, not the definition of a run: footage is a layer inside the document, and a run can be built
+from stills, slides, generated imagery, audio alone or pure motion graphics. A long piece has one
+document per chapter, gates them one at a time (`gates.sh --doc chapters/act-3`) and joins the
+gated chapters with `concat-chapters.ts`.
+
+An AUTHORED run — creative face-1, a remix, or a run with no footage — writes `runs/<key>/design/system.json`
+before it authors any document, and `pipeline/scripts/design-gate.ts` reads every document back against it.
+A compiled recipe needs none of that: the recipe IS the system.
 
 | step | kind | what |
 |------|------|------|
@@ -15,7 +25,9 @@ footage.
 | prep | SCRIPT | transcript from the chosen provider (VEED `veed/go.ts`, local WhisperX `prep/transcribe.ts`, or the user's own via `prep/whisper.ts`; chunks = beats, real per-word timings) → `word-timings.json` (per-word absolute-ms reveal delays, synthesized by `prep/prep.ts`) + base frames; auto-detect aspect → write `meta.json` (canvas + duration + paths) |
 | analyse | AGENT (vision) | **OPT-IN, skipped by default** — run only when the user asks to refine the style; then ONE nameless bg subagent reads the frames + transcript → `analysis.json` (per-beat shot/bboxes/neg-space/brightness in CANVAS px), and the DESIGN + RENDER step re-runs with it. The **only** vision pass. `analysis.json` existing IS the fast-path/refinement switch. |
 | sample ONE style | SCRIPT | `pipeline/scripts/sample-style.ts` — facet-scored seeded draw of one aspect-matched ref from `refs/tags.json` (v3 RUNTIME INDEX, recipes only; `fit` = aspect SOT; transcript energy weights the draw) → `style.json` (facets, energy, coverage, alternates). Zero tokens. The CREATIVE PASS routes here too: face-1 (user brought materials) → the DESIGN + RENDER step, from-scratch; face-2 REMIX (any creative iteration) / RE-ROLL (variants asks) / patch (defects). |
+| design system | INLINE (authored runs only) | `runs/<key>/design/system.json` — fonts, the type ladder with each rung's own optical tracking (`pipeline/recipes/type.ts`), palette, spacing, named easings and durations, the reveal unit, the devices in play, and `donors` (recipe ids, checked against the runtime index). Written FROM the run's content: `groundedIn` must name files that exist, so a system cannot be authored before the thing it is for. Compose the documents from `pipeline/recipes/devices.ts`, `pipeline/design/captions.ts` and `pipeline/recipes/geometry.ts` rather than typing each graphic at its point of use. |
 | design + render | SCRIPT (recipe) · INLINE (creative face-1 · remix) | default → **compiled recipe** (`pipeline/scripts/generate-recipe.ts`: the generator module emits `final/template.wv` + `manifest.json` deterministically — word delays from `word-timings.json` by construction, zero tokens — then drives the gate chain: lint → `--verify` with the mechanical ladder fix loop (≤2 cycles) → `--record` → probe-qa); **face-1** (INLINE, orchestrator-authored: one design system from the USER'S materials, 1-2 recipe sheets as craft substrate, per `director-brief.md`; lint + `--verify` to exit 0, then `--record` → probe-qa); **REMIX** (inline donor blend per the brief's REMIX MODE in `runs/<key>-remix`, same gates) |
+| gates | SCRIPT | `bash pipeline/scripts/gates.sh <run-dir> [--doc <subdir>] [--audio <file>]` — design → lint → `--verify` → WCAG → `--record` → probe-qa → mux, stopping at the first failure and naming the gate. `generate-recipe.ts` drives the same chain for a compiled recipe; every other path calls this instead of retyping it. Runs OUTSIDE any sandbox. |
 | mux audio | SCRIPT | ffmpeg muxes the source audio onto the silent render → `final/out.mp4` (the deliverable) |
 | preview | SCRIPT (parallel) | `preview/server.ts runs/<key>` — localhost preview opened for the user (read-only): watch and scrub the footage, follow the transcript, preview the subtitles; auto-swaps to the new `final/out.mp4` when an amend re-render lands. Launched in the background; the pipeline never waits on it |
 
diff --git a/docs/recipe-format.md b/docs/recipe-format.md
index 484ed80..8992531 100644
--- a/docs/recipe-format.md
+++ b/docs/recipe-format.md
@@ -60,7 +60,7 @@ fix loop · DO NOT → simply how the code behaves.
 4. **WORDS + TIMING** — the invariant rules: one span per word (or per glyph, if the ref is glyph-level),
    each span's `animation-delay` = that word's `delayMs` from `word-timings.json` **VERBATIM**; the beat's
    `.cue` gets `animation-delay:{cueDelayMs}ms; animation-duration:{cueDurMs}ms`. Word spacing per the
-   engine limits (spacer span or margin — inter-span whitespace is dropped; `display:inline-block`).
+   engine limits (spacer span or margin — inter-span whitespace is not what sets the gap here; `display:inline-block`).
 5. **EMPHASIS** — the ref's own device for hero words + a deterministic pick rule (e.g. "the longest
    content word of the beat; numbers win; last beat's last content word") so no judgment is needed.
 6. **VERIFY LOOP** — verbatim commands:
@@ -95,19 +95,22 @@ offline and to the creative pass at run time.
   only briefly). Prefer ONE page-level fade-out over per-word fade-outs — staggered per-word exits catch
   two pages alive at once. Exit bands narrower than the last ~30% of the duration hold full opacity too
   deep into the successor's rise.
-- **Never lay out animated children in shrink-to-fit flex** (hit independently by a compiled recipe
-  and by a from-scratch design pass on the same content): the engine mis-lays-out shrink-to-fit flex lines
-  whose children animate — fragments, stray offsets, ink clipped at the box edge. Use full-width
-  blocks + `text-align:center`.
-- **Animating spans rasterize at their line-height box** (hook-078 42-23): with `line-height:1`,
-  a span mid-reveal is sheared at the em-box bottom (hard horizontal cut) even for opacity-only
-  animations; steady state renders fine. Give word spans vertical `padding` headroom (~0.1em top /
-  0.15–0.2em bottom), or keep line-height ≥1.2 (refs that have it never shear).
+- **Prefer full-width blocks to shrink-to-fit flex for animated children.** Not because the engine
+  mis-lays them out — it does not (probe: flex-shrink-to-fit-animated), though this was carried for
+  months as fragments, stray offsets and ink clipped at the box edge. A shrink-to-fit line sizes itself
+  from its content, so one word changing width moves everything beside it; a full-width block plus
+  `text-align:center` holds its geometry while the content changes.
+- **Give word spans vertical headroom at tight line-heights.** An animating span at `line-height:1`
+  is NOT sheared at the em-box (probe: lineheight-shear) — that was asserted for months, and enforced
+  by a lint rule, on a claim nothing had rendered. What a tight line-height does do is bring a
+  descender within a pixel or two of the next line's caps, so ~0.1em top / 0.15-0.2em bottom padding,
+  or line-height >= 1.2, is a typographic margin rather than a repair.
 - **Word gaps must budget the font's ink overhang** (hook-078 42-23): italic display caps (Playfair T/G/Y)
   overhang their advance by up to ~0.5em — a nominal 0.3em margin or spacer renders as FUSED words.
-  Neither margins, paddings, nor spacer spans differ here (the ink paints over all of them); the engine
-  also trims plain trailing spaces inside spans. The validated pattern: `margin-right:0.45em` PLUS a
-  trailing `&#160;` in the span text. Validate gaps by patch-rendering the worst pairs, not from advance
+  Neither margins, paddings, nor spacer spans differ here (the ink paints over all of them). A plain
+  trailing space inside a span is NOT trimmed (probe: trailing-space-in-span) and does advance the next
+  word, but a space is narrower than a half-em overhang, so it does not solve this alone. The validated
+  pattern: `margin-right:0.45em` PLUS a trailing `&#160;` in the span text. Validate gaps by patch-rendering the worst pairs, not from advance
   tables.
 - **Light-on-light needs a grounding layer** (hook-224): a prefab's pure-white glow vanishes over light
   footage (a white mug) — bake one dark `text-shadow` layer into the sheet; the prefab's demo footage
@@ -129,7 +132,7 @@ offline and to the creative pass at run time.
   it done.
 - Every run validates the RECIPE: if it fails, fix the sheet AND its module together (they must not drift).
 - `--verify` is necessary, not sufficient: pile-ups, fused words, ghost stacking, light-on-light, and
-  mid-reveal shear are all invisible to it — a recipe is validated only after an offline frame-by-frame
+  descender clearance are all invisible to it — a recipe is validated only after an offline frame-by-frame
   eyeball (mid-beat AND ~120ms-before-beat-end probes per beat). Compilation removes the arithmetic-slip
   class (the module also gets unit tests against the sheet's worked example), but these VISUAL
   classes still need the eyeball on ≥2 contents.
diff --git a/pipeline/design/captions.ts b/pipeline/design/captions.ts
new file mode 100644
index 0000000..0a7988e
--- /dev/null
+++ b/pipeline/design/captions.ts
@@ -0,0 +1,157 @@
+// Captions built from the words the speaker actually said, at the times they actually said them.
+//
+// The failing film had 1872 real per-word timestamps on disk and used them for nothing but the in and
+// out of each cue. The caption itself faded in as a block, once per cue, on a 0.2s opacity ramp that
+// was written into the first draft and never touched again — while the same film gave its GRAPHICS a
+// per-character stagger. Two hundred and seventeen cues, one position, one ramp, twelve minutes.
+//
+// A word reveal is not decoration. It is the only thing that ties the type to the voice, and when it
+// is missing the captions read as a subtitle track laid over a film rather than as part of it.
+//
+// The mechanics here come from a delivered sheet that solved this: glyphs arrive at their word's
+// verbatim delay plus a small intra-word stagger, with ONE cursor travelling the whole beat rather
+// than a cursor per line. The numbers are parameters, not decrees.
+//
+// LINES ARE BLOCK ELEMENTS. `<br>` does not break a run of `display:inline-block` spans — measured by
+// control render, and the cost of not knowing it was 166 frames of `--verify FAIL[bounds]`. Making
+// each line its own block is what stops that from being possible to write.
+import type { WordTiming } from '../scripts/synth-word-timings.ts';
+import { toUnits, paginate, splitLines, escapeHtml, type Unit } from '../recipes/lib.ts';
+import type { DesignSystem, Rung } from './system.ts';
+
+export interface CaptionOptions {
+  /** The rung captions are set on. Named, so a caption can never quietly take a display size. */
+  role?: string;
+  /** Characters per page before it splits. Two short lines read faster than one long one. */
+  maxChars?: number;
+  maxUnits?: number;
+  /** Milliseconds between glyphs inside one word. 0 reveals the word whole. */
+  glyphStaggerMs?: number;
+  /** How long one glyph takes to arrive. */
+  popMs?: number;
+  /** Distance from the bottom safe edge, in px. */
+  bottomPx?: number;
+  /** A cursor bar travelling the beat. One for the whole block, never one per line. */
+  cursor?: boolean;
+  /** How long the last page holds after its final glyph. */
+  tailMs?: number;
+}
+
+export interface CaptionBlock {
+  html: string;
+  css: string;
+  /** Every reveal delay emitted, in order — so a test can prove they came from the transcript. */
+  delaysMs: number[];
+  lines: number;
+  /** Screens this cue needed. More than one is normal for a long sentence. */
+  pages: number;
+}
+
+function rung(sys: DesignSystem, role: string): Rung {
+  const r = sys.ladder.find((x) => x.role === role);
+  if (!r) throw new Error(`captions: the system has no "${role}" rung — ladder is ${sys.ladder.map((x) => x.role).join(', ')}`);
+  return r;
+}
+
+/** Glyph spans for one unit, each carrying its own absolute delay. */
+function glyphs(u: Unit, staggerMs: number): { text: string; delayMs: number }[] {
+  const out: { text: string; delayMs: number }[] = [];
+  for (const span of u.spans) {
+    [...span.text].forEach((ch, i) => out.push({ text: ch, delayMs: span.delayMs + i * staggerMs }));
+  }
+  return out;
+}
+
+/**
+ * One caption block for one cue.
+ *
+ * Every delay is the word's own time from the transcript. Nothing here divides a cue's duration by a
+ * word count — that is the even-split the whole pipeline refuses upstream, and reintroducing it at
+ * the last step would undo the reason per-word times are mandatory.
+ */
+export function captionBlock(words: WordTiming[], sys: DesignSystem, opts: CaptionOptions = {}): CaptionBlock {
+  const {
+    role = 'body',
+    maxChars = 42,
+    maxUnits = 9,
+    glyphStaggerMs = 34,
+    popMs = 120,
+    bottomPx = sys.spacing.safeY,
+    cursor = true,
+  } = opts;
+
+  const r = rung(sys, role);
+  const units = toUnits(words);
+  const pages = paginate(units, maxChars, maxUnits);
+
+  // EVERY page is rendered. Emitting only the first silently dropped the back half of any cue longer
+  // than one screen — speech that was transcribed, timed, and then never shown.
+  const delaysMs: number[] = [];
+  let lines = 0;
+  const pageStart = (p: Unit[]) => p[0]?.spans[0]?.delayMs ?? 0;
+
+  const pageHtml = pages.map((page, i) => {
+    const [l1, l2] = splitLines(page);
+    const pageLines = [l1, l2].filter((l): l is Unit[] => Boolean(l && l.length));
+    lines += pageLines.length;
+
+    const pageDelays: number[] = [];
+    // Where each unit's cursor hands over to the next. The last one on the page runs to the page's end.
+    const flat = pageLines.flat();
+    const handover = (u: Unit): number => {
+      const at = flat.indexOf(u);
+      const nextUnit = flat[at + 1];
+      if (nextUnit) return nextUnit.spans[0].delayMs;
+      const nextPage = pages[i + 1];
+      return nextPage ? pageStart(nextPage) : (u.spans.at(-1)!.delayMs + u.chars * glyphStaggerMs + popMs + (opts.tailMs ?? 600));
+    };
+
+    const lineHtml = pageLines.map((line) => {
+      const inner = line.map((u) => {
+        const spans = glyphs(u, glyphStaggerMs).map((g) => {
+          delaysMs.push(g.delayMs);
+          pageDelays.push(g.delayMs);
+          return `<span class="g" style="animation-delay:${g.delayMs}ms">${escapeHtml(g.text)}</span>`;
+        }).join('');
+        // A cursor after every unit, each visible only until the next unit takes over. One is lit at
+        // any instant, so it reads as a single bar travelling the line — the donor's mechanic. A width
+        // or clip-path ramp would also travel (both animate; probes width-keyframes-static and
+        // animated-clip-path are REFUTED), but it interpolates LINEARLY, and speech is not linear: it
+        // would need a stop per word to follow the real timings, which is what these windows already are.
+        const start = u.spans[0].delayMs;
+        const cur = cursor
+          ? `<span class="cur" style="animation-delay:${start}ms;animation-duration:${Math.max(popMs, handover(u) - start)}ms"></span>`
+          : '';
+        return `<span class="u">${spans}</span>${cur}`;
+      }).join('<span class="sp"> </span>');
+      // A block per line. The one construct that cannot be got wrong later.
+      return `<div class="cl">${inner}</div>`;
+    }).join('');
+
+    const first = pageDelays.length ? Math.min(...pageDelays) : pageStart(page);
+    const last = pageDelays.length ? Math.max(...pageDelays) : first;
+    const next = pages[i + 1];
+    // A page holds until the next one starts speaking; the last holds past its final glyph.
+    const until = next ? pageStart(next) : last + popMs + (opts.tailMs ?? 600);
+    return `<div class="cap" id="cap${i + 1}" style="animation-delay:${first}ms;animation-duration:${Math.max(popMs, until - first)}ms">${lineHtml}</div>`;
+  }).join('');
+
+  const html = pageHtml;
+
+  const css = [
+    `.cap{position:absolute;left:${sys.spacing.safeX}px;right:${sys.spacing.safeX}px;bottom:${bottomPx}px;`,
+    `opacity:0;animation-name:capPg;animation-fill-mode:forwards;animation-timing-function:linear;`,
+    `text-align:center;font-family:${sys.fonts[0]};font-weight:${r.weight};font-size:${r.px}px;`,
+    `letter-spacing:${r.trackingEm}em;color:${Object.values(sys.palette)[0]};z-index:2}`,
+    `.cl{display:block}`,
+    `.u{display:inline-block;white-space:pre}`,
+    `.sp{display:inline-block;white-space:pre}`,
+    `.g{display:inline-block;opacity:0;animation:capG ${popMs}ms ${sys.motion.easings.standard ?? 'linear'} forwards}`,
+    cursor ? `.cur{display:inline-block;width:${Math.round(r.px * 0.08)}px;height:${Math.round(r.px * 0.86)}px;margin-left:${Math.round(r.px * 0.06)}px;vertical-align:text-bottom;background:${Object.values(sys.palette)[1] ?? Object.values(sys.palette)[0]};opacity:0;animation-name:capCur;animation-fill-mode:forwards;animation-timing-function:linear}` : '',
+    `@keyframes capG{from{opacity:0}to{opacity:1}}`,
+    `@keyframes capPg{0%{opacity:1}99.9%{opacity:1}100%{opacity:0}}`,
+    cursor ? `@keyframes capCur{0%{opacity:1}99.9%{opacity:1}100%{opacity:0}}` : '',
+  ].filter(Boolean).join('\n');
+
+  return { html, css, delaysMs, lines, pages: pages.length };
+}
diff --git a/pipeline/design/system.ts b/pipeline/design/system.ts
new file mode 100644
index 0000000..9a400f4
--- /dev/null
+++ b/pipeline/design/system.ts
@@ -0,0 +1,525 @@
+// The design system of one run, as a file.
+//
+// WHY THIS EXISTS. A 12-minute film was delivered with a system font on a translucent plate, one
+// easing curve used 934 times, a caption block that never moved for 217 cues, and no lower third on
+// any of its interview footage — with every rule it broke available to it, in full, throughout.
+//
+// The cause was ORDER, not knowledge. The type system was written from a blank page early, while the
+// content it was for did not yet exist, and by the time the content arrived the design was already a
+// fact nobody revisited. A rule that lives only in a document cannot prevent that: it is a memory
+// competing with several hundred tool results by the time it binds.
+//
+// This is the artifact. It is written from the content, never before it (`assertGrounded` refuses a
+// system built without the run's facts on disk), and `check()` reads back every authored document
+// and fails the ones using anything the system does not declare. A generic default cannot slip in
+// unnoticed, because a value that is not in the system is a finding rather than a judgement call.
+import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync, statSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { opticalTracking, trackingDeviation } from '../recipes/type.ts';
+
+/** One rung of the type ladder. Tracking belongs to the rung, not to the element that uses it. */
+export interface Rung {
+  /** What this size is FOR. A ladder of unnamed numbers gets used arbitrarily. */
+  role: string;
+  px: number;
+  weight: number;
+  /** Optical tracking in em. Bigger type takes tighter tracking; the sign flips around body size. */
+  trackingEm: number;
+  /** Uppercase settings need their own tracking, which is why case is part of the rung. */
+  case?: 'upper' | 'sentence' | 'title';
+}
+
+export interface Device {
+  /** The name a document refers to it by, and the name a finding will print. */
+  name: string;
+  /** What it does for the viewer, in one line. A device nobody can describe is decoration. */
+  purpose: string;
+  /** Where its geometry came from — a recipe id, a delivered document, or `authored`. */
+  from: string;
+}
+
+export interface MotionSpec {
+  /** Named easings. An unnamed curve typed at the point of use is how 934 identical ones happen. */
+  easings: Record<string, string>;
+  /** Named durations in ms, so a reveal and a hold are decisions rather than two typed numbers. */
+  durationsMs: Record<string, number>;
+  /**
+   * The unit a text reveal advances by. `word` requires real per-word times; the run that motivated
+   * this had 1872 of them on disk and revealed per cue anyway.
+   */
+  revealUnit: 'word' | 'character' | 'line' | 'cue';
+}
+
+export interface DesignSystem {
+  runKey: string;
+  /** The one-line intent this system serves. A system with no direction is a palette with no reason. */
+  direction: string;
+  canvas: { width: number; height: number; fps: number };
+  /** Families as they appear in `font-family`. A family not listed cannot appear in a document. */
+  fonts: string[];
+  ladder: Rung[];
+  /** Named colours. A hex outside this map is a finding, including inside a gradient or a shadow. */
+  palette: Record<string, string>;
+  spacing: { unit: number; safeX: number; safeY: number };
+  motion: MotionSpec;
+  devices: Device[];
+  /**
+   * Recipe ids this system was seeded from. They must exist in the runtime index, which turns "I used
+   * the recipes" from a sentence in a report into a field that can be wrong.
+   */
+  donors: string[];
+  /** The content facts this system was built from. Empty means it was built from nothing. */
+  groundedIn: string[];
+  /**
+   * Where the subject is, per cue, measured off the run's own picture. REQUIRED when the run has
+   * footage, because `groundedIn` alone does not distinguish the two kinds of fact: a system can name
+   * the transcript, the cues and the word times, satisfy every existing check, and still have been
+   * authored without anyone looking at the frames. That is exactly what happened — the run that
+   * motivated this listed five grounding files, all of them text, and then placed six of eight
+   * captions on the same edge and two across a face.
+   */
+  placement?: { measuredIn: string; cues: number };
+}
+
+export function systemPath(runDir: string): string {
+  return join(runDir, 'design', 'system.json');
+}
+
+export function readSystem(runDir: string): DesignSystem | undefined {
+  const p = systemPath(runDir);
+  if (!existsSync(p)) return undefined;
+  return JSON.parse(readFileSync(p, 'utf8')) as DesignSystem;
+}
+
+export function writeSystem(runDir: string, sys: DesignSystem): void {
+  const p = systemPath(runDir);
+  mkdirSync(dirname(p), { recursive: true });
+  writeFileSync(p, JSON.stringify(sys, null, 2) + '\n');
+}
+
+/**
+ * Refuse a system that was not built from the run's own content.
+ *
+ * This is the rule that could not be written as a sentence. The failing run authored its whole type
+ * system before the transcript, the cut and the scene facts existed, precisely because that work was
+ * available to do while waiting, and writing it early does not feel like breaking the rule. Requiring
+ * the files to exist on disk makes the early version impossible to produce rather than discouraged.
+ */
+export function assertGrounded(runDir: string, sys: DesignSystem): void {
+  if (!sys.groundedIn.length) {
+    throw new Error('design system: groundedIn is empty — name the content files this was built from');
+  }
+  const missing = sys.groundedIn.filter((rel) => !existsSync(join(runDir, rel)));
+  if (missing.length) {
+    throw new Error(
+      `design system: it claims to be built from files that do not exist — ${missing.join(', ')}. ` +
+      'A system authored before the content is a system authored from nothing.',
+    );
+  }
+  assertPlacementMeasured(runDir, sys);
+}
+
+const VIDEO = /\.(mp4|mov|webm|mkv|m4v|avi)$/i;
+
+/**
+ * Video the run composes over.
+ *
+ * `meta.json` is asked FIRST, because on an ordinary captioned run the source is never copied into
+ * the run at all — prep records `videoPath` pointing at wherever the user's file lives. A version of
+ * this that only globbed the run directory returned false for every prep run and for the 12-minute
+ * film whose 20 clips sit under `footage/`, which is to say for exactly the runs the placement gate
+ * was written to catch. It reported clean and the skill said it would refuse.
+ */
+export function runHasFootage(runDir: string): boolean {
+  const meta = join(runDir, 'meta.json');
+  if (existsSync(meta)) {
+    try {
+      const m = JSON.parse(readFileSync(meta, 'utf8')) as { videoPath?: unknown; videos?: unknown[] };
+      // NOT gated on the file being reachable: an unmounted volume or a moved source does not make a
+      // run footage-free, and reading it that way let the placement gate fall silent on exactly the
+      // runs it exists for.
+      if (typeof m.videoPath === 'string' && m.videoPath) return true;
+      if (Array.isArray(m.videos) && m.videos.length) return true;
+    } catch {
+      throw new Error(
+        `${meta} is not readable JSON — whether this run has footage cannot be decided, and guessing ` +
+        'no would skip the placement gate. Fix or delete the file.',
+      );
+    }
+  }
+  // The run's own products are not footage. `gates.sh` records `<doc>/out.silent.mp4` and copies it to
+  // `<doc>/out.mp4`, both of which the walk reached — so a graphics-only run passed the gate, rendered,
+  // and then failed every gate after it demanding a subject be measured in footage it never had.
+  // `out.tmp.mp4` is what mux-audio.sh writes before its rename; a mux that dies leaves it behind,
+  // and from then on the run demanded placement for footage it never had.
+  const PRODUCT = /^out(\.silent|\.tmp)?\.(mp4|mov|webm|mkv)$/i;
+  const walk = (dir: string, depth: number): boolean => {
+    let entries: string[];
+    try { entries = readdirSync(dir); } catch { return false; }
+    for (const name of entries) {
+      if (name === 'node_modules' || name.startsWith('.') || name === 'qa') continue;
+      const p = join(dir, name);
+      let stat;
+      try { stat = statSync(p); } catch { continue; }
+      if (stat.isDirectory()) { if (depth > 0 && walk(p, depth - 1)) return true; }
+      else if (VIDEO.test(name) && !PRODUCT.test(name)) return true;
+    }
+    return false;
+  };
+  return walk(runDir, 3);
+}
+
+/** How many cues this run actually has, from whatever prep wrote. */
+function cueCount(runDir: string): number | undefined {
+  for (const [file, key] of [['word-timings.json', 'beats'], ['cues.json', 'cues']] as const) {
+    const p = join(runDir, file);
+    if (!existsSync(p)) continue;
+    try {
+      const parsed = JSON.parse(readFileSync(p, 'utf8')) as Record<string, unknown>;
+      const list = parsed[key];
+      if (Array.isArray(list)) return list.length;
+    } catch { /* fall through to the next source */ }
+  }
+  return undefined;
+}
+
+/**
+ * A run with footage must have measured where the subject is before it designed anything.
+ *
+ * The count is checked against the run's OWN cue count, not against a number the same pass chose.
+ * The first version compared the claim to the file it named and accepted an array, a `.cues` array or
+ * the key count of any object — so `{ measuredIn: 'notes.json', cues: 3 }` passed against
+ * `{"measured":true,"by":"eye"}`, and `cues: 0` passed against anything. Measuring the
+ * picture for every cue IS the work; a gate that takes the author's word for it gates nothing.
+ */
+export function assertPlacementMeasured(runDir: string, sys: DesignSystem): void {
+  if (!runHasFootage(runDir)) return;
+  const p = sys.placement;
+  if (!p?.measuredIn) {
+    throw new Error(
+      'design system: this run has footage, so `placement.measuredIn` is required — measure where the ' +
+      'subject is in every cue and name the file. Grounding in the transcript and the cue times is ' +
+      'grounding in the words; placement is decided against the picture.',
+    );
+  }
+  const f = join(runDir, p.measuredIn);
+  if (!existsSync(f)) throw new Error(`design system: placement.measuredIn "${p.measuredIn}" does not exist`);
+  let entries: number;
+  try {
+    const parsed = JSON.parse(readFileSync(f, 'utf8')) as unknown;
+    const list = Array.isArray(parsed) ? parsed
+      : Array.isArray((parsed as { cues?: unknown[] })?.cues) ? (parsed as { cues: unknown[] }).cues
+      : undefined;
+    if (!list) {
+      throw new Error(
+        `design system: placement.measuredIn "${p.measuredIn}" is not a list of measurements — it must be ` +
+        'an array, or an object with a `cues` array. An object of loose keys counts as whatever it holds.',
+      );
+    }
+    entries = list.length;
+  } catch (e) {
+    if (e instanceof SyntaxError) throw new Error(`design system: placement.measuredIn "${p.measuredIn}" is not readable JSON`);
+    throw e;
+  }
+  if (!entries) throw new Error(`design system: placement.measuredIn "${p.measuredIn}" measures nothing`);
+
+  const real = cueCount(runDir);
+  if (real !== undefined && entries < real) {
+    throw new Error(
+      `design system: this run has ${real} cues and "${p.measuredIn}" measures ${entries} — every cue is placed, ` +
+      'so every cue is measured',
+    );
+  }
+  if (p.cues !== entries) {
+    throw new Error(
+      `design system: it claims ${p.cues} cues were measured for placement and "${p.measuredIn}" holds ${entries}`,
+    );
+  }
+}
+
+export interface Finding { rule: string; severity: 'error' | 'warn'; message: string }
+
+/**
+ * The ladder itself, against the measured optical curve.
+ *
+ * Checking documents against the system is not enough on its own: a system is free to declare a bad
+ * ladder, and then every document conforms to it perfectly. All-caps rungs are exempt because caps
+ * genuinely want more tracking than the curve — that is a typographic fact, not a loophole.
+ */
+export function checkLadder(sys: DesignSystem): Finding[] {
+  const out: Finding[] = [];
+  for (const r of sys.ladder) {
+    if (r.case === 'upper') continue;
+    const off = trackingDeviation(r.px, r.trackingEm);
+    if (Math.abs(off) > 0.01) {
+      out.push({
+        rule: 'rung-off-curve',
+        severity: 'error',
+        message: `the ${r.px}px "${r.role}" rung is set to ${r.trackingEm}em; the optical curve gives ${opticalTracking(r.px)}em at that size, a difference of ${off}em`,
+      });
+    }
+  }
+  return out;
+}
+
+/**
+ * The other direction: a rung, a family or a palette colour the system DECLARES and no document uses.
+ * Devices are NOT checked here — a device is a shape, not a token, and nothing in a document names it.
+ *
+ * `check()` only asks that everything used is declared, which lets a system promise a two-typeface
+ * contrast and a nine-rung ladder while the render comes back monotone. That is not hypothetical —
+ * one run declared two serif rungs and set the serif once in thirty seconds, and every gate passed.
+ * A promise nobody kept is as much a defect as a value nobody declared.
+ */
+export function checkDeclaredUsed(docs: string[], sys: DesignSystem): Finding[] {
+  // Read DECLARATIONS, and compare the way `check()` compares. A first version scanned the raw
+  // document text and matched literally: a `font-size` in a comment counted as used, a family whose
+  // quoting differed by one character counted as unused, a rung one third of a pixel off its
+  // declared size counted as unused, and a palette colour a document paints as `rgb()` or `white`
+  // counted as unused. All four are ERRORs, so a conforming document failed its own system's gate.
+  const css = docs.map((d) => expandFontShorthand(declarations(d))).join('\n');
+  const out: Finding[] = [];
+
+  const firstFamily = (stack: string) => stack.split(',')[0].trim().replace(/^['"]|['"]$/g, '');
+  const setFamilies = new Set(
+    [...css.matchAll(/font-family:\s*([^;}]+)/gi)].map((m) => firstFamily(m[1])),
+  );
+  for (const family of sys.fonts) {
+    if (!setFamilies.has(firstFamily(family))) {
+      out.push({
+        rule: 'font-declared-unused',
+        severity: 'error',
+        message: `"${family}" is declared and no document sets it — either use the contrast the system promises, or stop declaring it`,
+      });
+    }
+  }
+
+  const setSizes = [...css.matchAll(/font-size:\s*([\d.]+)px/gi)].map((m) => Number(m[1]));
+  for (const r of sys.ladder) {
+    if (!setSizes.some((px) => Math.abs(px - r.px) < 0.51)) {
+      out.push({
+        rule: 'rung-declared-unused',
+        severity: 'error',
+        message: `the ${r.px}px "${r.role}" rung is declared and no document sets it`,
+      });
+    }
+  }
+
+  const painted = new Set(
+    [...css.matchAll(PAINTS)].flatMap((m) =>
+      [...m[2].replace(/\b(?:url|var)\([^)]*\)/gi, ' ').matchAll(COLOUR_TOKEN)]
+        .map((t) => rgbKey(t[0]))
+        .filter((k): k is string => Boolean(k))),
+  );
+  for (const [name, hex] of Object.entries(sys.palette)) {
+    const key = rgbKey(hex);
+    if (key && !painted.has(key)) {
+      out.push({
+        rule: 'colour-declared-unused',
+        severity: 'warn',
+        message: `palette colour "${name}" (${hex}) is declared and no document paints it`,
+      });
+    }
+  }
+
+  return out;
+}
+
+/** CSS generics. The engine resolves families through Google and has its own fallback for misses. */
+const GENERIC = new Set(['sans-serif', 'serif', 'monospace', 'cursive', 'fantasy', 'system-ui', 'ui-sans-serif', 'ui-serif', 'ui-monospace']);
+
+/**
+ * A generic at the end of a stack never resolves and warns on every render. Harmless on its own, but
+ * it is a standing warning in the log that a REAL font failure then hides behind.
+ */
+export function checkFonts(sys: DesignSystem): Finding[] {
+  const out: Finding[] = [];
+  for (const stack of sys.fonts) {
+    for (const fam of stack.split(',').map((f) => f.trim().replace(/^['"]|['"]$/g, '').toLowerCase())) {
+      if (GENERIC.has(fam)) {
+        out.push({ rule: 'generic-family', severity: 'warn', message: `"${stack}" ends in the generic "${fam}", which the engine cannot resolve — it warns on every render, and a real font failure looks the same` });
+      }
+    }
+  }
+  return out;
+}
+
+const HEX = /#[0-9a-fA-F]{3,8}\b/g;
+
+/**
+ * Declarations from both the stylesheet and the inline attributes — generated documents use both.
+ *
+ * Each inline set is wrapped in a synthetic block. Joined raw, one element's `font-size` paired with
+ * the NEXT element's `letter-spacing` when the pairing below split on braces, so the gate compared
+ * values that never met. Single quotes count too: a `style='…'` attribute is legal and was invisible.
+ */
+function declarations(src: string): string {
+  const blocks = src.match(/<style\b[^>]*>([\s\S]*?)<\/style>/gi) ?? [];
+  const inline = [...src.matchAll(/<[^>]*\sstyle=("([^"]*)"|'([^']*)')[^>]*>/gi)]
+    .map((m) => `.inline{${m[2] ?? m[3] ?? ''}}`);
+  return [...blocks, ...inline].join('\n');
+}
+
+/** Named colours a person actually types by hand. A full CSS list would be noise. */
+const NAMED: Record<string, string> = {
+  white: '#ffffff', black: '#000000', red: '#ff0000', blue: '#0000ff', green: '#008000',
+  gray: '#808080', grey: '#808080', silver: '#c0c0c0', gold: '#ffd700', orange: '#ffa500',
+  yellow: '#ffff00', purple: '#800080', navy: '#000080', teal: '#008080', crimson: '#dc143c',
+};
+
+/** Every colour to `r,g,b`, so a palette written in hex still recognises itself written as rgb(). */
+/** `font: 700 96px/1.1 Inter, sans-serif` → the same declaration written as longhands beside it. */
+function expandFontShorthand(css: string): string {
+  return css.replace(/(?:^|([;{\s]))font:\s*([^;}]+)/gi, (whole, lead: string | undefined, value: string) => {
+    const size = value.match(/([\d.]+)(px|r?em|%|v[wh])(?:\s*\/\s*[\d.]+\w*)?/i);
+    if (!size) return whole;
+    const family = value.slice(size.index! + size[0].length).trim();
+    const parts = [`font-size:${size[1]}${size[2]}`];
+    if (family) parts.push(`font-family:${family}`);
+    return `${lead ?? ''}${whole.trim()};${parts.join(';')}`;
+  });
+}
+
+function rgbKey(value: string): string | undefined {
+  const v = value.trim().toLowerCase();
+  const named = NAMED[v];
+  const hex = (named ?? v).match(/^#([0-9a-f]{3,8})$/);
+  if (hex) {
+    const raw = hex[1].length === 4 || hex[1].length === 8 ? hex[1].slice(0, hex[1].length === 4 ? 3 : 6) : hex[1];
+    if (raw.length !== 3 && raw.length !== 6) return undefined;
+    const h = raw.length === 3 ? raw.split('').map((c) => c + c).join('') : raw;
+    return [0, 2, 4].map((i) => parseInt(h.slice(i, i + 2), 16)).join(',');
+  }
+  const fn = v.match(/^rgba?\(\s*([\d.]+)[\s,]+([\d.]+)[\s,]+([\d.]+)/);
+  if (fn) return [1, 2, 3].map((i) => Math.round(Number(fn[i]))).join(',');
+  return undefined;
+}
+
+/** Properties whose value paints. A colour anywhere else is not a colour decision. */
+const PAINTS = /(?:^|[;{\s])(-{0,2}[a-z-]*(?:color|background|shadow|fill|stroke|outline|border|gradient|filter)[a-z-]*)\s*:\s*([^;}]+)/gi;
+
+/** A colour as it appears inside a paint declaration. Both directions of the palette gate read it. */
+const COLOUR_TOKEN = /#[0-9a-fA-F]{3,8}\b|rgba?\([^)]*\)|\b[a-z]{3,12}\b/gi;
+
+/**
+ * The rungs at a size. More than one is normal and correct: an all-caps kicker and a sentence-case
+ * label can share a size and still want different tracking, which is typography rather than drift.
+ */
+function rungsFor(sys: DesignSystem, px: number): Rung[] {
+  return sys.ladder.filter((r) => Math.abs(r.px - px) < 0.51);
+}
+
+/**
+ * Every way an authored document can leave its own system.
+ *
+ * Tracking is checked against the RUNG rather than against a global rule, because the optical law is
+ * that tracking follows size: the same em value is right at one size and wrong at another. The size
+ * check is the one that bites hardest in practice — the film this came from used 23 distinct sizes,
+ * and this gate returns over a thousand errors on its eight documents, most of them a size nobody
+ * decided on. (Run it to see today's figure; it rises as the gate learns to see more of a document.)
+ */
+export function check(src: string, sys: DesignSystem): Finding[] {
+  const f: Finding[] = [];
+  // The `font:` shorthand sets family and size at once. Reading only the longhands let a document
+  // evade this gate through the shorthand while the other direction blamed it for not using the
+  // ladder — the two checks have to read the same declarations. Rewritten as longhands so every rule
+  // below sees them without being taught the shorthand's grammar twice.
+  const css = expandFontShorthand(declarations(src));
+
+  for (const m of css.matchAll(/font-family:\s*([^;}]+)/gi)) {
+    const stack = m[1].trim();
+    const first = stack.split(',')[0].trim().replace(/^['"]|['"]$/g, '');
+    if (!sys.fonts.some((known) => known.split(',')[0].trim().replace(/^['"]|['"]$/g, '') === first)) {
+      f.push({ rule: 'font-off-system', severity: 'error', message: `font-family "${first}" is not in the system's fonts (${sys.fonts.join(', ')})` });
+    }
+  }
+
+  for (const m of css.matchAll(/font-size:\s*([\d.]+)(px|r?em|%|v[wh])/gi)) {
+    if (m[2] !== 'px') {
+      f.push({ rule: 'size-not-px', severity: 'error', message: `font-size ${m[1]}${m[2]} is relative — the ladder and the canvas are both in px, so this size was never actually decided` });
+      continue;
+    }
+    const px = Number(m[1]);
+    if (!rungsFor(sys, px).length) {
+      const ladder = sys.ladder.map((r) => `${r.px} (${r.role})`).join(', ');
+      f.push({ rule: 'size-off-ladder', severity: 'error', message: `font-size ${px}px is not a rung of the ladder — ${ladder}` });
+    }
+  }
+
+  // Pair each tracking with the size declared nearest before it; a rule sets both together.
+  for (const block of css.split('}')) {
+    const size = block.match(/font-size:\s*([\d.]+)px/i);
+    const track = block.match(/letter-spacing:\s*(-?[\d.]+)em/i);
+    if (!size || !track) continue;
+    const rungs = rungsFor(sys, Number(size[1]));
+    if (!rungs.length) continue;
+    const got = Number(track[1]);
+    if (!rungs.some((r) => Math.abs(got - r.trackingEm) <= 0.004)) {
+      const allowed = rungs.map((r) => `${r.trackingEm}em ("${r.role}")`).join(' or ');
+      f.push({
+        rule: 'tracking-off-rung',
+        severity: 'error',
+        message: `letter-spacing ${got}em at ${rungs[0].px}px, where the ladder sets ${allowed} — tracking follows size, and this is the value a reader feels as crude`,
+      });
+    }
+  }
+
+  // A palette in hex must recognise itself written as `rgb()` or as `white`; comparing the literal
+  // text meant every non-hex form was simply invisible to the gate.
+  const known = new Set(Object.values(sys.palette).map((v) => rgbKey(v)).filter(Boolean) as string[]);
+  const palette = Object.entries(sys.palette).map(([k, v]) => `${k} ${v}`).join(', ');
+  const sources = [...known].map((k) => k.split(',').map(Number));
+
+  /**
+   * A colour is in-system when it IS a palette entry, or when it is one darkened toward black by a
+   * single factor. That is the corpus's grounding rule — the shadow is the document's own colour
+   * darkened, never pure black — and a gate that rejected it would push authors back to `#000`.
+   */
+  const derived = (rgb: string): boolean => {
+    const [r, g, b] = rgb.split(',').map(Number);
+    return sources.some(([sr, sg, sb]) => {
+      const ks = [[r, sr], [g, sg], [b, sb]].filter(([, sv]) => sv > 8).map(([v, sv]) => v / sv);
+      if (!ks.length) return false;
+      const k = ks[0];
+      // A floor as well as a ceiling: at k = 0 every source "derives" pure black, which is the one
+      // colour the grounding rule names as wrong.
+      // A BAND, not just a ceiling. Unbounded below, every grey derived from a white palette entry —
+      // 252 of 256 of them — so the one gate that exists to notice an undecided value could not see a
+      // grey. The corpus grounds by darkening to roughly a tenth; this is that, with room either side.
+      if (k > 0.4 || k < 0.04) return false;
+      return ks.every((x) => Math.abs(x - k) <= 0.06)
+        && [[r, sr], [g, sg], [b, sb]].every(([v, sv]) => Math.abs(v - sv * k) <= 1.5);
+    });
+  };
+  for (const decl of css.matchAll(PAINTS)) {
+    // Derivation is the GROUNDING rule — the shadow is the document's own colour darkened — so it
+    // applies where grounding happens and nowhere else. Allowed everywhere, a near-white palette entry
+    // would "derive" most of the greys, and the one gate that exists to notice an undecided value
+    // could not see one.
+    const grounding = /shadow|filter/i.test(decl[1]);
+    // A url() or a var() is not a colour. Reading their contents as words made a background image and
+    // a design token into off-palette findings, which stops a run at the first gate over neither.
+    const value = decl[2].replace(/\b(?:url|var)\([^)]*\)/gi, ' ');
+    for (const token of value.matchAll(COLOUR_TOKEN)) {
+      const key = rgbKey(token[0]);
+      if (!key || known.has(key) || (grounding && derived(key))) continue;
+      f.push({ rule: 'colour-off-palette', severity: 'error', message: `${token[0]} is not in the palette (${palette})` });
+    }
+  }
+
+  const easings = new Set(Object.values(sys.motion.easings).map((v) => v.replace(/\s+/g, '')));
+  for (const m of css.matchAll(/cubic-bezier\([^)]*\)/gi)) {
+    const curve = m[0].replace(/\s+/g, '');
+    if (!easings.has(curve)) {
+      f.push({ rule: 'easing-off-system', severity: 'error', message: `${m[0]} is not one of the system's named easings (${Object.keys(sys.motion.easings).join(', ')})` });
+    }
+  }
+
+  // A film with no declared device is a film that typed every graphic fresh, which is what "it looks
+  // like a default" describes. Warn rather than error: a short clip legitimately has none.
+  if (!sys.devices.length) {
+    f.push({ rule: 'no-devices', severity: 'warn', message: 'the system declares no devices — every graphic in this document was composed at the point of use' });
+  }
+
+  return f;
+}
diff --git a/pipeline/director-brief.md b/pipeline/director-brief.md
index 1c85a42..ac100ee 100644
--- a/pipeline/director-brief.md
+++ b/pipeline/director-brief.md
@@ -65,6 +65,15 @@ LIMITS + the lint → verify → record → probe gates bind exactly as in any r
 as any single donor — name the new aesthetic in one line before authoring, then hold it across every beat.
 
 ## Method
+- **IF YOU HAVE NOT RELOADED THE `open-edit` SKILL FOR THIS PASS, DO IT BEFORE YOU AUTHOR ANYTHING —
+  AND AGAIN BEFORE EVERY AUTHORING TOUCH AFTER IT** — the whole skill, invoked again, not a section
+  recalled. You are reading this inside the pass, so "before" means before the first thing you write. Authoring is necessarily the last thing that
+  happens, so it is always the work with the most behind it; the rules that bind it were read long ago
+  and are competing with several hundred tool results. Reloading puts them back on top at the moment
+  they bind. A touch on any caption, graphic, plate, chart, mark, title or motion is an authoring
+  touch, however small it looks — but a mechanical fix to the element a gate flagged is NOT one, and
+  needs no reload. **Reloading is not permission to redesign**: the system is committed once, and what
+  you reload is the contract you author within.
 - Read `meta.json` for W/H/fps/durationSec. Captions + windows (and real per-word timings) come from
   `transcript.json`. If `analysis.json` exists (refine runs only) also read it — it carries, per beat and in
   CANVAS px: `shot`, `subjectBbox`, `faceBbox`, `negSpaceRect` (largest clean zone for type), `brightness`.
@@ -76,6 +85,16 @@ as any single donor — name the new aesthetic in one line before authoring, the
   SUBSTRATE sheets (validated recipes, `refs/html/<id>/recipe.md`) and lift their MECHANICS only — timing
   idioms, grounding, width budgets, the engine workarounds — never their look, unless the user's materials
   point the same way.
+- LEARN THE REPERTOIRE FIRST. Open two or three refs under `refs/html/` — the sheet AND the document —
+  and read what the engine is shown doing: a beat set as a COLUMN OF SEPARATE TEXT BLOCKS so one word
+  can take another size, how an underline is drawn, what arrows, brackets, corner marks and badges look
+  like when made well, which faces are proven. It is a bank of what is possible, never a template: see
+  how it is done, then do better. Skipping it means designing from defaults, and the default is a
+  centred line at one size.
+- PLACEMENT IS DECIDED PER BEAT and written down: where the block sits, why there — what is behind it,
+  which way the subject faces, where the frame is empty — and what changed since the last beat. A block
+  that holds one position for a whole piece is the defect. Emphasis is carried by the word that takes
+  the beat, not by a phrase in bolder type.
 - LOCK ONE system: NAME the aesthetic (within the DIRECTION), fix 2-3 Google `@import` fonts + a limited
   palette + ONE recurring device, all pulled FROM the user's materials. The DIRECTION sets the lane, mood and
   placement — it never dictates fonts/palette/device, and if it appears to, the user's materials win. Hold the
@@ -100,25 +119,37 @@ as any single donor — name the new aesthetic in one line before authoring, the
 - Keep MONUMENTAL headlines INSIDE the canvas — stack to 2-3 lines or size down rather than clip an edge.
   Keep the spoken caption in safe margins (9:16 → top>=11% bottom>=17% left>=6% right>=11%; 16:9 → ~6% inset
   all sides, keep type off the dead-center face, use the left/right thirds).
-- SVG inline only; `stroke="currentColor"` or a hex + `color:<hex>` (NEVER `stroke=var()`); `fill="none"`
-  for strokes; no `translateY()`/percentage transforms inside `<svg>` (use px).
-- Word spacing via margin or inline-block (inter-`<span>` whitespace is dropped). `<br>` is ignored → use
-  sibling block divs. Centered WRAPPED text is flaky → keep each caption line in its own div or left-align.
-  CSS Grid + the CSS `outline` property are unsupported (use flex; faux-outline via 8-way text-shadow).
-- Use FLAT single-class selectors — style each text node with its OWN class. Descendant/specificity-dependent
-  selectors (`.parent span`, nested overrides) and partial-width side columns render unreliably.
+- Write the colour into the SVG shape: `stroke=var()` paints NOTHING (probe: svg-stroke-var) and
+  `stroke="currentColor"` paints black (probe: svg-currentcolor-stroke). `fill="none"` for strokes.
+  Inline `<svg>` and SVG `<text>` both RENDER, and so does an `<img>` whose src is an `.svg` file
+  beside the document (probe: img-src-svg) — inline is the convenient form, not the only one. Position a child with the `transform`
+  ATTRIBUTE (`transform="translate(x,y)"`) — a CSS `transform:translateY()` on an SVG child does not move it.
+- Word spacing: whitespace between inline `<span>`s IS kept, and margin and inline-block remain the
+  precise controls when you want an exact gap. **`<br>` breaks a line of ordinary inline text, and does
+  NOT break a run of `display:inline-block` spans** (probe: br-between-inline-blocks) — which is what the
+  ONE SAFE REVEAL RECIPE below emits, so a caption relying on it overruns its box and fails `--verify`
+  with `bounds`. Give each caption line its OWN block element. `text-align:center` DOES centre a
+  wrapping block (probe: centered-wrapped-text) — one div per line is still the better construction,
+  because it lets a line take its own size and edge, but that is a composition choice and not a
+  repair. CSS Grid is unsupported (use flex).
+- Use FLAT single-class selectors — style each text node with its OWN class. This is a
+  legibility-of-source rule and nothing more: a descendant selector applies its style (probe:
+  descendant-selector-style) and carries an `animation-delay` (probe: descendant-animation-delay) just
+  as CSS says. Flat classes are what let a document be read back against its own design system.
 
 ## SINGLE TIMELINE — the whole clip in one document
 Lay every beat on ONE timeline over the footage; each caption visible ONLY in its cue window (the
 transcript chunk's start/end), the rest hidden. Do NOT render beats to clips and stitch — the engine plays one
 document across `durationSec`; sequencing is by CSS `animation-delay`/`animation-duration`.
 
-**THE OPACITY / STACKING-CONTEXT TRAP (the #1 multi-beat bug).** A positioned element animating `opacity:0→1`
-with NO explicit z-index LOSES its stacking context at opacity 1.0 and paints UNDER the z0 video → invisible.
-In a multi-beat timeline this reads as a phantom whole-timeline offset (blank start, beats late, tail clipped)
-— it is NOT a clock bug. FIX BY CONSTRUCTION: every animated text element is `position:absolute` + explicit
-`z-index` above the video; gate visibility on each leaf/cue that already carries its z-index — NEVER via a
-full-canvas no-z-index wrapper animating opacity.
+**GIVE EVERY ANIMATED LAYER AN EXPLICIT z-index.** Not because the engine forces it — a positioned element
+animating `opacity:0→1` with no z-index paints ABOVE the z0 video exactly as CSS says it should (probe:
+opacity-anim-no-z, REFUTED, and it was asserted here for months as the "#1 multi-beat bug"). It is a
+construction rule: paint order among several animated layers that all default to `auto` is decided by
+document order, so one reordering silently changes what covers what, and the failure looks like a
+phantom whole-timeline offset (blank start, beats late, tail clipped) rather than a paint-order
+problem. State the order and it cannot drift. Gate visibility on each leaf or cue that carries its own
+z-index rather than on a full-canvas wrapper animating opacity.
 
 **THE ONE SAFE REVEAL RECIPE (do not invent another):**
 ```
@@ -134,13 +165,14 @@ character lives — swap its keyframes for the entrance mechanic your system ado
 implemented via a craft-substrate sheet's proven timing idiom): eased rise+fade, scale-overshoot pop, per-glyph
 stagger; a continuous wiggle is an EXTRA comma-separated
 transform-only `infinite` animation on the same element. Entrances animate opacity+transform together in ONE
-eased keyframes block with `both` fill; the word stays `display:inline-block` (a fading centered flex item clips
-mid-fade). A bare step opacity snap (`0%,99.99%{opacity:0} 100%{opacity:1}` + `step-end`) shows text with NO
+eased keyframes block with `both` fill; the word stays `display:inline-block` for layout control, not to
+avoid a clip — a fading centered flex item does NOT clip (probe: flex-fade-clip). A bare step opacity snap (`0%,99.99%{opacity:0} 100%{opacity:1}` + `step-end`) shows text with NO
 motion — that is the ANIMATION LEVEL `none` mechanic; at `word`/`cue` level it is a DEFECT (it reads as plain
 subtitles, not a designed system).
-Keep `text-shadow` on the cue for legibility — `opacity:0` hides the shadow too. HARD RULES: never animate
+Keep `text-shadow` on the cue for legibility — `opacity:0` hides the shadow too. HARD RULE: never animate
 `color` for reveal (it recolours, doesn't hide; with text-shadow the unrevealed words ghost their shadow).
-Never put `var()` inside a `@keyframes` — it does not resolve and the unit stays invisible.
+Write reveal values literally anyway — a custom property resolves fine, but a colour or offset spelled out
+in the keyframe is what makes a `--verify` failure line readable.
 
 **ANIMATION LEVEL** (given in the execution contract):
 - word (default) → per-word entrance in reading order on the REAL word timings; the entrance mechanic comes
@@ -153,23 +185,129 @@ Never put `var()` inside a `@keyframes` — it does not resolve and the unit sta
 that is the whole point of word-level animation. ONLY IF a chunk has no `words` array,
 FAKE them: split the cue's window evenly across its words (each word = cueDuration/wordCount, back-to-back from cue start).
 
-## ENGINE LIMITS (engine 0.6.x — author within these; full matrix = `.veed-engine/feature-support.md`)
-- No animated `filter:blur` (holds the keyframe's initial value → slides are fade-only). Static blur renders.
-- `var()` in `transform` CRASHES — bake static rotates literally into each keyframe.
-- Opacity fade CLIPS a centered flex item mid-fade — fade absolutely-positioned / inline-block elements, or scale.
-- `border-radius` draws a straight 45° chamfer, not a curve (and slash syntax renders square) — use
-  %-only clip-path polygons for real corners. No `repeating-linear-gradient` / stacked
-  gradient layers. No `vw` font sizes, no CSS grid / `mix-blend-mode` / `outline`,
-  no SVG `<text>`. Never rely on `-webkit-text-stroke` — construct-dependent (drops on animated or
-  tilted spans); ground with an 8-way `text-shadow`.
-  `line-height<1` not collapsed (use negative margins). `align-items:baseline` stacks (use `flex-end`).
-- The partial-opacity glyph-clip bug: `filter:drop-shadow` under `<1` opacity clips glyphs → never fade an
-  element carrying drop-shadow; legibility on fading text = `text-shadow`/`box-shadow`.
+## ENGINE LIMITS — every line below is decided by a probe render, never by memory
+
+Each statement is settled by a control-render probe — a document, a control rendering what the claim
+predicts, and a pixel diff between them — and
+`tests/engine-truth.test.ts` fails the build if this section drifts back to asserting something the
+engine does not impose. **Do not add a limit here you have not rendered.** A limit you invent is
+obeyed: it removes real capability from every run that reads this file.
+
+**Real limits — author around these.**
+- Animated `filter:blur` holds the keyframe's initial value and never ramps. Static blur renders.
+- `box-shadow` renders but never animates.
+- `skewX()` is silently ignored — build a parallelogram with a `clip-path` polygon. `skewY()` and
+  `matrix()` were never probed: untested, not known-broken.
+- An animated `transform` REPLACES a static `transform` on the same element: bake the static rotate
+  into every keyframe of the animation.
+- `animation-fill-mode: both` backfills the 0 % keyframe across the whole pre-delay window, so an
+  element with inline `opacity:0` still paints if its 0 % keyframe says `opacity:1`. **Exactly one
+  animation may own `opacity` on an element** — two owners is a contradiction the document cannot
+  resolve, and it is the trap that left every graphic of one film on screen to the end.
+- A gate whose keyframe closes exactly on a frame boundary LOSES that frame, and `--verify` does not
+  see it. End a window a frame early, or land it off the boundary.
+- `border-radius` slash syntax renders square, and a per-corner radius is ignored — use one value.
+- `-webkit-text-stroke` never paints, on any construct. Ground with an 8-way `text-shadow`.
+- A CSS `transform:translateY()` on an SVG child does not move it — measured on that function only;
+  use the `transform` attribute, which does displace the shape.
+- `@import` must be the FIRST statement inside `<style>` or the whole stylesheet is dropped.
+- No CSS Grid (use flex), no `radial-gradient`, no CSS `mask`.
+- An SVG path's counterform is filled SOLID — the hole in an O, a D or an e is lost, and `fill-rule`,
+  `<mask>` and `<clipPath>` inside the SVG do not cut it (probe: svg-counterform-filled). A logo goes
+  through `pipeline/recipes/svg-clip.ts` instead; see MARKS AND LOGOS below.
+- `currentColor` does not inherit on an SVG `stroke`; it paints black. On `fill` it inherits correctly
+  (probe: svg-currentcolor-stroke).
+- `filter: drop-shadow` CLIPS what it is applied to: an inline-SVG child of the container it sits on
+  (probe: drop-shadow-clips-inline-svg), and glyphs on an element that also carries opacity below 1
+  (probe: drop-shadow-opacity-clip — this one did NOT hold on 0.7.3 and does on 0.8.0). Ground type
+  with the two-layer text-shadow instead, and keep the filter off anything that fades.
+- The engine cannot pause or retime a video layer — bake freezes and trims with ffmpeg beforehand.
+
+**Capabilities the brief used to deny. They all render; use them.**
+- Animated `clip-path`, and animated `width`/`height`.
+- Nested transforms: a child rides its animated parent exactly, and `overflow:hidden` clipping follows
+  an animated transform.
+- `var()` inside `@keyframes` and inside `transform`, and fractional keyframe percentages.
+- Descendant selectors for `animation-delay`.
+- Inline `<svg>` and SVG `<text>`.
+- CSS `outline`, `mix-blend-mode`, `repeating-linear-gradient`, and `conic-gradient`.
+- `vw` font sizes, whitespace between inline spans, `line-height` below 1, and `align-items:baseline`.
+- `<br>` — in ordinary inline text only. It is inert between `display:inline-block` spans, so it is a
+  capability with a boundary rather than a capability (probe: br-between-inline-blocks).
+- Google Fonts by `<link>` as well as by `@import`.
+- `<img src="beside-the-document.png">`, `object-fit` included (probe: img-file-src). A `data:`
+  URI draws NOTHING (probe: img-data-uri-blank) — write the bytes into the run and name the file.
+- Fading a centered flex item does NOT clip it.
+- `clip-path: polygon()` cuts a REAL transparent counterform (probe: clip-path-polygon-counterform) —
+  which is what makes a vector logo possible at all. `clip-path: path()` does not: it renders solid.
+
+A capability rendering is not a reason to reach for it. Prefer the plainest construct that expresses
+the design — but never refuse work because this file once said the engine could not do it.
+
+## MARKS AND LOGOS — vector, because the small sizes are the ones that matter
+
+A mark is placed at 26px in a corner and at 90px on an end card, over 720p footage. A bitmap keyed out
+of an export is mush at both — one run shipped exactly that, and the letters came back chewed.
+
+The engine fills SVG counterforms solid (probe: svg-counterform-filled), so an inline `<svg>` logo
+loses every hole it has. `clip-path: polygon()` does cut a real hole (probe:
+clip-path-polygon-counterform), so that is the route:
+
+```
+import { svgToClip, clipLogoHtml } from '{repo}/pipeline/recipes/svg-clip.ts';
+const logo = svgToClip('{run}/assets/logo.svg');            // paths → polygons, holes welded in
+const { html } = clipLogoHtml(logo, { id: 'mark', left: 1140, top: 640, height: 26, colour: P.ink });
+```
+
+It takes any SVG — `<path>`, `<rect>`, `<circle>`, `<ellipse>`, `<polygon>`, groups and their
+transforms, which it bakes into the points because the engine displaces a shape carrying a `transform`
+attribute. One island per disjoint piece, all sharing one box, so the pieces stay registered. `colour`
+overrides the file's own fill, since a mark over footage takes the document's ink. This is USER
+material: whatever a brand hands over has to survive, so run it through and LOOK at the result at the
+size it will be seen, not at 400px.
+
+## LOOK AT THE CUTS — the frames a uniform grid never samples
+
+```
+node --import tsx {repo}/pipeline/scripts/cut-frames.ts <video> --out {run}/qa/cuts
+```
+
+It finds every shot boundary and writes one strip per cut: the frame before it, then the frames after.
+A run that sampled its deliverable at 1.2, 3.8, 9.5, 15.0 and 21.5 seconds passed itself clean while
+its cuts sat at 1.83, 5.29, 8.58, 10.75, 14.25, 19.54 and 20.67 — no sample came within four tenths of
+one, and the defect it was carrying existed only there: a matted speaker lagging the background, so a
+person from the previous shot stood in front of the next one for a few frames. Composite anything over
+anything and this is the check; a caption that survives a shot it was never meant to cross shows up in
+the same strips.
 
 ## RENDER + VERIFY (needs the window-server → run OUTSIDE any sandbox)
+**One command drives the whole chain**, and it is the one to use unless you have a reason not to:
+`bash pipeline/scripts/gates.sh <run-dir> [--doc <subdir>] [--audio <file>] [--no-design] [--no-wcag] [--no-expect] [--no-probe] [--no-mux]`
+It runs design → lint → `--verify` → WCAG → `--record` → probe-qa → mux, stops at the first failure and names
+the gate that failed. `--doc` picks the document under the run — it defaults to `final`, and a film
+gates one chapter at a time (`--doc chapters/act-3`). When every chapter is gated, join them with
+`pipeline/scripts/concat-chapters.ts`, which stream-copies and refuses parts whose format differs —
+NOT `concat-videos.ts`, which re-encodes and normalises the frame rate because its inputs are
+generated clips that disagree by nature. `--no-design` only when a compiled recipe IS the
+system; an authored run without `design/system.json` is the defect that gate exists for. `--no-expect`
+skips deriving the timing assertions, and is not a way to make a failure go away.
+`--no-probe` when there is no source footage to diff frames against; `--no-mux` when there
+is no soundtrack (the silent render is copied to `out.mp4`, so the deliverable path never changes).
+The individual steps below are what it runs, and what a failure means.
+
+It also derives `verify.expect` from the document's own gates before verifying, so `--verify` checks
+not only WHAT is drawn but WHEN. A `FAIL[expect-visible]` means a cue is off screen inside the window
+the document itself declares — a late reveal, a beat that closed early, a caption still up when the
+next arrives. Nothing else in the chain can see that: every one of those documents draws something.
+**Its reach is currently narrow.** On engine 0.8.0 `expect-visible` counts the ink of the element
+carrying the id, so a gated cue whose words are child spans — the structure this brief prescribes and
+every compiled recipe emits — reads as invisible inside its own window. Those elements are skipped
+rather than asserted wrongly, which means the check fires today only where a caption carries its own
+text. `tests/expect-visible-nested.test.ts` pins that behaviour; when it starts failing the engine has
+learned to count descendant ink and the assertions cover the whole pool.
 The binary is `{run dir}/../../.veed-engine/veed-engine-cli` (the preflight-managed veed-engine-cli, NOT on PATH).
 0. LINT (mechanical, no engine): `node --import tsx pipeline/scripts/lint-template.ts {run}/final/template.wv`
-   — catches the engine-limit anti-patterns above (var-in-keyframes, animated blur, the stacking trap, missing
+   — catches the engine-limit anti-patterns above (animated blur, the stacking trap, a multi-value radius, missing
    cue ids) before the slower verify. Exit 1 → fix the flagged rule, re-lint.
 1. VERIFY (analytic, fast, no video — the ONLY self-check you perform by default; reads the manifest render block):
    `.veed-engine/veed-engine-cli {run}/final --verify`. It replays the whole timeline offscreen and checks the REAL
@@ -194,6 +332,34 @@ first pass; it is a safety net, not a design loop. (The last gate, `probe-qa` 
 runs right after the record (the SKILL's DESIGN + RENDER step, same turn); it is not part of this verify loop and never a licence to
 eyeball frames.)
 
+## COMPUTED GEOMETRY — do not re-derive what is already a function
+`pipeline/recipes/geometry.ts` carries the arithmetic behind computed forms, in canvas px, emitting no
+CSS so nothing about the engine is baked into it:
+- `alongArc` — N boxes seated on a circle, each rotated to its own angle (dials, tick rings, radial
+  bursts, a crown of type). Angles run clockwise from 12 o'clock.
+- `lattice` — points on a rotated, staggered lattice (a print screen is an OFFSET lattice at an angle,
+  not a square grid; one delivered treatment read as polka dots until it was rebuilt that way).
+- `insidePolygon` — clip a field to a shape, which is how tone lives INSIDE a device rather than
+  floating over the picture.
+- `arcRectPolygon` — a rectangle with sampled arc corners as a `%`-only clip-path, for corners a
+  radius cannot describe.
+- `sampleQuadratic` — points along a bowed path (dashed leaders, curved rails, arrow shafts).
+- `springKeyframes` — a damped second-order response sampled as integer keyframe stops, for a needle
+  settling or a card overshooting; the engine has no easing curve for this.
+- `starPolygon` — regular star vertices.
+
+These are COMPUTATIONS, not devices: a tick ring is one use of `alongArc`, not its purpose. Reach for
+them before writing a one-off generator. These were reconstructed from delivered documents after the
+scripts that produced them were thrown away, which is a bill nobody should pay twice.
+
+## SCOPED EDITS — prove you changed only what was asked
+When you are iterating on an accepted document rather than authoring a new one, keep the accepted
+copy and check the result against it before reporting:
+`node --import tsx pipeline/scripts/scoped-edit.ts <accepted.wv> <new.wv> --allow <selector-or-id>…`
+Every difference outside the allowed set is printed with both values. This is a defect class no
+render-time gate can catch: both documents are valid, and a caption that quietly shifted is exactly as
+renderable as one that did not.
+
 ## OUTPUT
 - `{run}/final/template.wv` — the single-timeline document.
 - `{run}/final/manifest.json` — EXACT: `{"render":{"width":{W},"height":{H},"fps":{FPS},"duration":{durationSec}}}`
diff --git a/pipeline/providers/assets.ts b/pipeline/providers/assets.ts
new file mode 100644
index 0000000..63c0047
--- /dev/null
+++ b/pipeline/providers/assets.ts
@@ -0,0 +1,179 @@
+// The asset seam.
+//
+// `runs/<key>/transcript.json` is the only seam transcription has: anything that writes that shape is
+// a valid provider and nothing downstream can tell which one ran. Generated assets get the same
+// treatment — `runs/<key>/assets/manifest.json` is the seam, and a document that places an image does
+// not care whether it came from VEED, from the user's own key, or off their disk.
+//
+// PROVENANCE IS PART OF THE ASSET. A 12-minute film shipped with 78.0% real footage and a per-shot
+// account of where every second came from, because the number was asked for and had to be defended.
+// An asset with no record of its origin cannot be defended, and cannot be swapped when a licence
+// question lands later.
+//
+// SPEND IS RECORDED EVEN WHEN THE PROVIDER WILL NOT PRICE IT. The documentary session landed 99 asset
+// records and every one of them carries `cost: null`, because fal prices nothing in its response. Its
+// postmortem could only say "cost not measured". Every call here lands a record whether or not a price
+// comes back with it, so at least the CALLS are countable.
+import { readFileSync, writeFileSync, existsSync, mkdirSync, renameSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+
+export type AssetKind = 'image' | 'video' | 'speech' | 'sfx' | 'music' | 'upscale';
+
+export interface AssetRecord {
+  id: string;
+  kind: AssetKind;
+  /** Where the bytes landed, relative to the run dir. */
+  path: string;
+  provider: string;
+  /** The provider's own model/endpoint id — the thing that actually decides the look. */
+  model: string;
+  /** What was asked for. A plate nobody can re-request is a plate nobody can revise. */
+  prompt?: string;
+  /** For image-to-video and upscales: the asset this one was derived from. */
+  from?: string;
+  createdAt: string;
+  /** The price the RESPONSE carried. `null` means it carried none — not that none is published. */
+  cost: number | null;
+  currency?: string;
+  /** Free-form provider echo (job id, seed, resolution) so a result can be reproduced or disputed. */
+  meta?: Record<string, unknown>;
+  /** Set when a later call replaced this one under the same id. It was still billed. */
+  supersededBy?: string;
+}
+
+export interface AssetManifest {
+  runKey: string;
+  assets: AssetRecord[];
+  /** Set when the file on disk could not be parsed; the caller must not write over it. */
+  corrupt?: boolean;
+}
+
+export function manifestPath(runDir: string): string {
+  return join(runDir, 'assets', 'manifest.json');
+}
+
+export function readManifest(runDir: string, runKey = ''): AssetManifest {
+  const p = manifestPath(runDir);
+  if (!existsSync(p)) return { runKey, assets: [] };
+  try {
+    return JSON.parse(readFileSync(p, 'utf8')) as AssetManifest;
+  } catch {
+    // Reading through a corrupt manifest is honest — the files are still on disk. Writing through it
+    // is not, and `record()` refuses to, because the empty fallback would erase the account of every
+    // asset already paid for.
+    return { runKey, assets: [], corrupt: true };
+  }
+}
+
+/** Move a manifest we could not parse aside, so the next write starts clean without destroying it. */
+function quarantine(p: string): string {
+  let dest = p.replace(/\.json$/, '.corrupt.json');
+  let n = 1;
+  while (existsSync(dest)) dest = p.replace(/\.json$/, `.corrupt.${n++}.json`);
+  renameSync(p, dest);
+  return dest;
+}
+
+export function record(runDir: string, asset: AssetRecord, runKey?: string): AssetManifest {
+  const m = readManifest(runDir, runKey ?? '');
+  if (m.corrupt) {
+    // Never write the empty fallback over a file we could not read: that is how 39 priced records
+    // were reproduced away in review. Keep the bytes, start a fresh account, and say so.
+    const kept = quarantine(manifestPath(runDir));
+    delete m.corrupt;
+    process.stderr.write(`[assets] the manifest could not be parsed and was kept at ${kept}; starting a new one\n`);
+  }
+  // The run key is only knowable from the caller; a default of '' would pin it empty on first write.
+  if (runKey && !m.runKey) m.runKey = runKey;
+  // APPEND, never replace. Regenerating an asset under the same id is a second billed call, and
+  // overwriting the first one made the manifest under-report a real film's spend by at least 27
+  // calls — the account of what was paid for cannot be the account of what survived.
+  const prior = m.assets.filter((a) => a.id === asset.id && !a.supersededBy);
+  for (const p of prior) p.supersededBy = asset.createdAt;
+  m.assets.push(asset);
+  const p = manifestPath(runDir);
+  mkdirSync(dirname(p), { recursive: true });
+  writeFileSync(p, JSON.stringify(m, null, 2) + '\n');
+  return m;
+}
+
+export interface SpendSummary {
+  calls: number;
+  priced: number;
+  unpriced: number;
+  total: number;
+  byKind: Record<string, { calls: number; total: number }>;
+}
+
+/** The assets that survived — the id-keyed view, which is what a document places. */
+export function current(runDir: string): AssetRecord[] {
+  const m = readManifest(runDir);
+  if (m.corrupt) throw new Error(`the asset manifest at ${manifestPath(runDir)} could not be read — do not treat this run as having no assets`);
+  return m.assets.filter((a) => !a.supersededBy);
+}
+
+/**
+ * What this run has spent. `unpriced` is reported separately and never folded into the total: a
+ * provider that returns no price makes the figure a lower bound, and saying so is the difference
+ * between a number and a guess.
+ *
+ * Superseded records COUNT. A regenerated plate was paid for twice however many survive.
+ */
+export function spend(runDir: string): SpendSummary {
+  const m = readManifest(runDir);
+  const out: SpendSummary = { calls: 0, priced: 0, unpriced: 0, total: 0, byKind: {} };
+  for (const a of m.assets) {
+    out.calls++;
+    const k = (out.byKind[a.kind] ??= { calls: 0, total: 0 });
+    k.calls++;
+    if (typeof a.cost === 'number') {
+      out.priced++;
+      out.total += a.cost;
+      k.total += a.cost;
+    } else {
+      out.unpriced++;
+    }
+  }
+  out.total = Number(out.total.toFixed(4));
+  for (const k of Object.values(out.byKind)) k.total = Number(k.total.toFixed(4));
+  return out;
+}
+
+/** One line the user can read, honest about what is not priced. */
+export function spendLine(runDir: string, currency = 'USD'): string {
+  // "nothing generated" is the one answer that must never come from a file we could not read.
+  if (readManifest(runDir).corrupt) return 'the asset manifest could not be read — this run has no usable spend figure';
+  const s = spend(runDir);
+  if (!s.calls) return 'nothing generated for this run';
+  const kinds = Object.entries(s.byKind).map(([k, v]) => `${v.calls} ${k}`).join(', ');
+  if (!s.priced) return `${s.calls} generated assets (${kinds}) — the provider returned no price, so this run has no cost figure`;
+  const tail = s.unpriced ? `, and ${s.unpriced} call(s) the provider did not price — so this is a lower bound` : '';
+  return `${s.calls} generated assets (${kinds}) — ${s.total} ${currency}${tail}`;
+}
+
+/**
+ * Screen time by origin, which is what makes "how much of this is real footage?" answerable. The
+ * documentary session was asked exactly that and could answer because the cut planner kept the
+ * account; the first balanced cut had the film's own footage at 19.5% and nobody knew until it was
+ * counted.
+ */
+export function provenanceShare(entries: { origin: string; seconds: number }[]): Record<string, number> {
+  for (const e of entries) {
+    if (!Number.isFinite(e.seconds) || e.seconds < 0) {
+      throw new Error(`provenanceShare: "${e.origin}" has ${e.seconds} seconds — a share cannot be computed from that`);
+    }
+  }
+  // Sum first, divide once. The previous version fed each entry back through the ROUNDED percentage of
+  // the entries before it, so a repeated origin drifted downward: 300 one-second shots of one source
+  // reported 90%. This is the number that answers "how much of this is real footage?".
+  const seconds = new Map<string, number>();
+  let total = 0;
+  for (const e of entries) {
+    seconds.set(e.origin, (seconds.get(e.origin) ?? 0) + e.seconds);
+    total += e.seconds;
+  }
+  const out: Record<string, number> = {};
+  if (!total) return out;
+  for (const [origin, s] of seconds) out[origin] = Number(((s / total) * 100).toFixed(1));
+  return out;
+}
diff --git a/pipeline/providers/fal.ts b/pipeline/providers/fal.ts
new file mode 100644
index 0000000..cc068ca
--- /dev/null
+++ b/pipeline/providers/fal.ts
@@ -0,0 +1,353 @@
+// fal, as the user's-own-key asset provider.
+//
+// This is the second half of the pattern transcription already has: VEED first because it is hosted
+// and billed to a workspace we can quote, then the user's own key for everything VEED does not make.
+// No credential passes through here in a log line, an error message or a manifest — the key is read,
+// used as a header, and never written down.
+//
+// The endpoints below are DEFAULTS a 12-minute documentary reached for, not a catalogue. `--model`
+// reaches any endpoint on the queue, and what one accepts, returns, costs and caps is on its own page
+// — read that before the first call rather than inferring it from this list. That film's manifest
+// records 66 voice takes, 11 sound effects, 10 image plates, 6 image-to-video clips and 6 music cues —
+// 99 assets, of which the queue priced none.
+//
+// A JOB THAT WAS ACCEPTED HAS BEEN PAID FOR. The queue takes the money when it accepts the request,
+// so a submit that times out or 502s may still have cost something. The job id is written down before
+// the first poll, so a lost connection is recoverable instead of being paid for twice.
+import { writeFile, mkdir } from 'node:fs/promises';
+import { readFileSync, existsSync } from 'node:fs';
+import { pathToFileURL } from 'node:url';
+import { parseFlags } from '../../veed/args.ts';
+import { record } from './assets.ts';
+import { dirname } from 'node:path';
+import type { AssetKind } from './assets.ts';
+import { jobKey, findJob, recordJob } from './queue-ledger.ts';
+
+// The image and video defaults are the endpoints a 12-minute film verified against fal's live
+// catalogue and then actually used — 10 stills at native 1920x1080 and 6 clips — rather than the
+// newest ids anybody had heard of. Override with --model when a run wants something else.
+//
+// The audio kinds have NO default on purpose. Which voice, which effect bank and which music model a
+// piece wants are choices with prices and licences attached, and the catalogue moves faster than a
+// constant does — so `--model` is required there and the endpoint's own page is the thing to read.
+export const FAL_MODELS = {
+  image: 'fal-ai/recraft/v4.1/pro/text-to-image',
+  video: 'fal-ai/bytedance/seedance-2.5/image-to-video',
+} as const satisfies Partial<Record<AssetKind, string>>;
+
+export interface FalJob {
+  requestId: string;
+  statusUrl: string;
+  responseUrl: string;
+}
+
+export interface FalResult {
+  requestId: string;
+  /** Whatever the endpoint returned; callers pick the url they need out of it. */
+  payload: Record<string, unknown>;
+  /** fal does not price a call in its response, so this is null and the manifest says so. */
+  cost: number | null;
+}
+
+/** Injected so the queue logic is testable without a key, a network or a bill. */
+export interface Http {
+  (url: string, init: { method: string; headers: Record<string, string>; body?: string }): Promise<{
+    status: number;
+    json(): Promise<unknown>;
+    arrayBuffer(): Promise<ArrayBuffer>;
+  }>;
+}
+
+export interface FalOptions {
+  key: string;
+  http?: Http;
+  /** Called with the job id the moment the queue accepts it — write it down before polling. */
+  onAccepted?: (job: FalJob) => void | Promise<void>;
+  /** Wall-clock ceiling. The documentary's own client gave up at 15 minutes. */
+  timeoutMs?: number;
+  /** Consecutive status failures tolerated before giving up; the job may still land server-side. */
+  maxStatusFailures?: number;
+  sleep?: (ms: number) => Promise<void>;
+}
+
+const QUEUE = 'https://queue.fal.run';
+
+/**
+ * No request carried a timeout, so a hung socket stalled the poll loop until the wall-clock deadline —
+ * fifteen minutes of nothing, for one dropped connection. Adapting `fetch` once also removes the three
+ * `as unknown as Http` casts that hid the omission.
+ */
+const REQUEST_TIMEOUT_MS = 60_000;
+const DOWNLOAD_TIMEOUT_MS = 5 * 60_000;
+
+function realHttp(timeoutMs: number): Http {
+  return async (url, init) => {
+    const res = await fetch(url, {
+      method: init.method,
+      headers: init.headers,
+      body: init.body,
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    return { status: res.status, json: () => res.json(), arrayBuffer: () => res.arrayBuffer() };
+  };
+}
+
+/**
+ * Statuses that cannot turn into a success by waiting: a revoked key, a request id that does not
+ * exist, an input the endpoint refused. Retrying these three times and then telling the user to
+ * "resume by request id" points them at a job that was never queued.
+ */
+const TERMINAL_STATUS = new Set([400, 401, 403, 404, 422]);
+
+function authHeaders(key: string): Record<string, string> {
+  return { Authorization: `Key ${key}`, 'Content-Type': 'application/json' };
+}
+
+/** Never let a key reach a message: fal echoes the Authorization header in some error bodies. */
+function scrub(text: string, key: string): string {
+  return key ? text.split(key).join('«key»') : text;
+}
+
+/** The error body, best-effort. An unparseable one must not erase the status that explains it. */
+async function snippet(res: { json(): Promise<unknown> }): Promise<string> {
+  try {
+    return JSON.stringify(await res.json()).slice(0, 400);
+  } catch {
+    return '(body was not JSON)';
+  }
+}
+
+export async function submit(model: string, input: Record<string, unknown>, opts: FalOptions): Promise<FalJob> {
+  const http = opts.http ?? realHttp(REQUEST_TIMEOUT_MS);
+  const res = await http(`${QUEUE}/${model}`, {
+    method: 'POST',
+    headers: authHeaders(opts.key),
+    body: JSON.stringify(input),
+  });
+  // The status is read BEFORE the body is parsed. A proxy's HTML 502 makes `res.json()` throw a
+  // SyntaxError carrying a slice of that HTML — which replaced the real status with a parse error, and
+  // (per `scrub` above) could carry the echoed Authorization header out with it.
+  if (res.status >= 300) {
+    throw new Error(scrub(`fal rejected the ${model} request (${res.status}): ${await snippet(res)}`, opts.key));
+  }
+  const body = (await res.json()) as Record<string, unknown>;
+  const job: FalJob = {
+    requestId: String(body.request_id ?? ''),
+    statusUrl: String(body.status_url ?? `${QUEUE}/${model}/requests/${body.request_id}/status`),
+    responseUrl: String(body.response_url ?? `${QUEUE}/${model}/requests/${body.request_id}`),
+  };
+  if (!job.requestId) throw new Error(`fal accepted the ${model} request but returned no request_id`);
+  // Written down BEFORE the first poll: the queue has already taken the money.
+  await opts.onAccepted?.(job);
+  return job;
+}
+
+/** A refusal, not a blip — carried past the retry catch so it is not counted as one of three attempts. */
+class Terminal extends Error {}
+
+export async function await_(job: FalJob, opts: FalOptions): Promise<FalResult> {
+  const http = opts.http ?? realHttp(REQUEST_TIMEOUT_MS);
+  const sleep = opts.sleep ?? ((ms: number) => new Promise((r) => setTimeout(r, ms)));
+  const deadline = Date.now() + (opts.timeoutMs ?? 15 * 60 * 1000);
+  const maxFailures = opts.maxStatusFailures ?? 3;
+  let failures = 0;
+
+  while (Date.now() < deadline) {
+    let status: string | undefined;
+    try {
+      const res = await http(job.statusUrl, { method: 'GET', headers: authHeaders(opts.key) });
+      if (TERMINAL_STATUS.has(res.status)) {
+        throw new Terminal(scrub(`fal refused the status check for ${job.requestId} (${res.status}): ${await snippet(res)}`, opts.key));
+      }
+      if (res.status >= 300) throw new Error(`status ${res.status}`);
+      const body = (await res.json()) as Record<string, unknown>;
+      failures = 0;
+      status = String(body.status ?? '');
+    } catch (e) {
+      if (e instanceof Terminal) throw e;
+      // A blip is not a failed job: the work continues server-side and is already paid for.
+      if (++failures > maxFailures) {
+        throw new Error(scrub(`fal status checks failed ${failures} times in a row for ${job.requestId}; the job may still complete — resume by request id rather than re-submitting`, opts.key));
+      }
+      await sleep(2000);
+      continue;
+    }
+
+    if (status === 'COMPLETED') {
+      const res = await http(job.responseUrl, { method: 'GET', headers: authHeaders(opts.key) });
+      if (res.status >= 300) throw new Error(scrub(`fal returned ${res.status} for a completed job: ${await snippet(res)}`, opts.key));
+      const payload = (await res.json()) as Record<string, unknown>;
+      return { requestId: job.requestId, payload, cost: null };
+    }
+    if (status === 'FAILED') {
+      // Do not retry here. A retry is a second charge, and the caller must decide to make it.
+      throw new Error(`fal job ${job.requestId} failed; it has been paid for, so decide before re-submitting`);
+    }
+    await sleep(1500);
+  }
+  throw new Error(`fal job ${job.requestId} did not finish within the deadline; it may still complete — resume by request id`);
+}
+
+/** The first url in a fal payload, which is where every one of these endpoints puts its output. */
+export function firstUrl(payload: Record<string, unknown>): string | undefined {
+  const seen: unknown[] = [payload];
+  while (seen.length) {
+    const v = seen.shift();
+    if (typeof v === 'string' && /^https?:\/\//.test(v)) return v;
+    if (Array.isArray(v)) seen.push(...v);
+    else if (v && typeof v === 'object') seen.push(...Object.values(v));
+  }
+  return undefined;
+}
+
+/** A signed URL's query string is a bearer credential with a clock on it; the path identifies the file. */
+function redactUrl(url: string): string {
+  const q = url.indexOf('?');
+  return q < 0 ? url : `${url.slice(0, q)}?…`;
+}
+
+export async function download(url: string, dest: string, http?: Http): Promise<void> {
+  const get = http ?? realHttp(DOWNLOAD_TIMEOUT_MS);
+  const res = await get(url, { method: 'GET', headers: {} });
+  if (res.status >= 300) throw new Error(`download failed (${res.status}) for ${redactUrl(url)}`);
+  await mkdir(dirname(dest), { recursive: true });
+  await writeFile(dest, Buffer.from(await res.arrayBuffer()));
+}
+
+/**
+ * Submit unless this exact request is already in the ledger.
+ *
+ * Identical input is the same job, and the queue charges on acceptance — so a retry after a lost
+ * status poll must resume the job that exists rather than buy a second one. The run that motivated
+ * this submitted an 8-second clip twice while the first was still running.
+ */
+export async function submitOnce(runDir: string, model: string, input: Record<string, unknown>, opts: FalOptions): Promise<{ job: FalJob; reused: boolean }> {
+  const key = jobKey(model, input);
+  const prior = findJob(runDir, key);
+  if (prior) {
+    return { job: { requestId: prior.requestId, statusUrl: prior.statusUrl, responseUrl: prior.responseUrl }, reused: true };
+  }
+  const job = await submit(model, input, {
+    ...opts,
+    onAccepted: async (j) => {
+      // Written down before the caller's own hook, so a hook that throws cannot lose the id.
+      recordJob(runDir, { key, model, requestId: j.requestId, statusUrl: j.statusUrl, responseUrl: j.responseUrl, submittedAt: new Date().toISOString() });
+      await opts.onAccepted?.(j);
+    },
+  });
+  return { job, reused: false };
+}
+
+/** Close a ledger entry, so a resume knows this one does not need picking up. */
+export function completeJob(runDir: string, model: string, input: Record<string, unknown>): void {
+  const key = jobKey(model, input);
+  const prior = findJob(runDir, key);
+  if (prior) recordJob(runDir, { ...prior, completedAt: new Date().toISOString() });
+}
+
+/**
+ * The key, from the environment or from a file the user points at.
+ *
+ * There was no way to get one: `FalOptions.key` is required and nothing in the repository read an
+ * environment variable or named a place to put it, so the first thing a run needing a generated asset
+ * had to do was write its own client — and once it had one, every module here became a competitor to
+ * code it had just written. That is how 1526 lines of one-off tooling happen.
+ *
+ * The key is read and returned. It is never printed, never written to a manifest, and never lands in
+ * an error message: `scrub` exists because fal echoes the Authorization header in some error bodies.
+ */
+export function falKey(env: NodeJS.ProcessEnv = process.env): string {
+  const direct = env.FAL_KEY ?? env.FAL_API_KEY;
+  if (direct?.trim()) return direct.trim();
+
+  const file = env.OPEN_EDIT_FAL_KEY_FILE;
+  if (file) {
+    if (!existsSync(file)) throw new Error(`OPEN_EDIT_FAL_KEY_FILE points at ${file}, which does not exist`);
+    // A key kept in a notes file sits among prose; take the first line that looks like a key and
+    // nothing else, so the caller never has to paste the secret itself to make this work.
+    const line = readFileSync(file, 'utf8').split('\n').map((l) => l.trim()).find((l) => /^[A-Za-z0-9_:-]{20,}$/.test(l));
+    if (!line) throw new Error(`no key found in ${file} — expected a line of at least 20 key characters`);
+    return line;
+  }
+
+  throw new Error(
+    'no fal key: set FAL_KEY, or set OPEN_EDIT_FAL_KEY_FILE to a file holding it. ' +
+    'Ask the user rather than guessing, and never echo the value back to them.',
+  );
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const { values, positionals } = parseFlags({
+    args: process.argv.slice(2),
+    options: {
+      run: { type: 'string' }, id: { type: 'string' }, kind: { type: 'string' },
+      prompt: { type: 'string' }, model: { type: 'string' }, from: { type: 'string' },
+      input: { type: 'string' },
+    },
+    allowPositionals: true,
+  });
+  const [verb] = positionals;
+
+  if (verb === 'models') {
+    for (const [kind, model] of Object.entries(FAL_MODELS)) console.log(`${kind.padEnd(7)} ${model}`);
+    process.exit(0);
+  }
+
+  if (verb === 'generate') {
+    const runDir = values.run;
+    const id = values.id;
+    const KINDS: AssetKind[] = ['image', 'video', 'speech', 'sfx', 'music', 'upscale'];
+    const kind = values.kind as AssetKind | undefined;
+    if (!runDir || !id || !kind) { console.error(`generate needs --run <dir> --id <asset-id> --kind <${KINDS.join('|')}>`); process.exit(2); }
+    // A cast is not a check. `--kind speach --model …` submitted, was billed, downloaded, and wrote a
+    // manifest row whose kind no consumer can route — and the missing-default guard below never fired
+    // because a model WAS given.
+    if (!KINDS.includes(kind)) { console.error(`unknown --kind "${kind}" — one of ${KINDS.join(', ')}`); process.exit(2); }
+    const model = values.model ?? (FAL_MODELS as Record<string, string>)[kind];
+    if (!model) {
+      console.error(`kind "${kind}" has no default endpoint — pass --model <id>. fal's catalogue is on its own ` +
+        `site; read the endpoint's page for its inputs, its ceilings and its price before you call it.`);
+      process.exit(2);
+    }
+
+    // `--input` carries whatever the endpoint wants; `--prompt` is the one field every one of them
+    // shares, so the common case needs no JSON.
+    const input: Record<string, unknown> = values.input ? JSON.parse(values.input) : {};
+    if (values.prompt) input.prompt = values.prompt;
+    if (values.from) input.image_url = values.from;
+    if (!Object.keys(input).length) { console.error('nothing to generate: pass --prompt or --input <json>'); process.exit(2); }
+
+    const key = falKey();
+    const { job, reused } = await submitOnce(runDir, model, input, { key });
+    if (reused) console.log(`[fal] this exact request is already in the ledger as ${job.requestId} — resuming it rather than buying it again`);
+    const result = await await_(job, { key });
+    const url = firstUrl(result.payload);
+    if (!url) { console.error(`fal returned no url for ${job.requestId}`); process.exit(1); }
+
+    const ext = url.match(/\.(png|jpe?g|webp|mp4|mp3|wav|m4a)(?:$|\?)/i)?.[1]?.toLowerCase()
+      ?? (kind === 'video' ? 'mp4' : kind === 'image' ? 'png' : 'mp3');
+    const rel = `assets/${id}.${ext}`;
+    await download(url, `${runDir}/${rel}`);
+    completeJob(runDir, model, input);
+    record(runDir, {
+      id, kind, path: rel, provider: 'fal', model,
+      prompt: typeof input.prompt === 'string' ? input.prompt : undefined,
+      from: values.from,
+      createdAt: new Date().toISOString(),
+      // fal prices nothing in its response, and a guessed figure is worse than none.
+      cost: null,
+      meta: { requestId: job.requestId },
+    });
+    console.log(`${rel} — ${model}`);
+    process.exit(0);
+  }
+
+  console.error(
+    'usage:\n' +
+    '  fal.ts models\n' +
+    '  fal.ts generate --run <dir> --id <asset-id> --kind <image|video|speech|sfx|music>\n' +
+    '                  [--prompt "…"] [--model <endpoint>] [--from <image-url>] [--input \'{"…":…}\']\n' +
+    'key: FAL_KEY, or OPEN_EDIT_FAL_KEY_FILE pointing at a file that holds it',
+  );
+  process.exit(2);
+}
diff --git a/pipeline/providers/queue-ledger.ts b/pipeline/providers/queue-ledger.ts
new file mode 100644
index 0000000..641ffd0
--- /dev/null
+++ b/pipeline/providers/queue-ledger.ts
@@ -0,0 +1,85 @@
+// The record of what has already been asked for, so it is never paid for twice.
+//
+// A generation queue takes the money when it ACCEPTS a request, not when it returns one. The
+// documentary run submitted the same 8-second opening clip a second time while the first was still
+// running, then lost both job ids when the status poll failed and recovered them by hand with curl.
+// Two charges and sixteen minutes, for one clip.
+//
+// The ledger keys a job by what was asked for, not by when. Two identical requests are the same
+// request, and a request whose id was written down survives a lost connection — which is the whole
+// reason the id is written down before the first poll.
+import { readFileSync, writeFileSync, existsSync, mkdirSync, renameSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { join, dirname } from 'node:path';
+
+export interface LedgerEntry {
+  key: string;
+  model: string;
+  requestId: string;
+  statusUrl: string;
+  responseUrl: string;
+  submittedAt: string;
+  /** Set when the job returned; an entry without it is in flight or was lost mid-poll. */
+  completedAt?: string;
+}
+
+export function ledgerPath(runDir: string): string {
+  return join(runDir, 'assets', 'jobs.json');
+}
+
+/**
+ * A stable identity for a request. Object keys are sorted, so two callers that build the same input
+ * in a different order still collide — which is the point.
+ */
+export function jobKey(model: string, input: unknown): string {
+  const canonical = (v: unknown): unknown => {
+    if (Array.isArray(v)) return v.map(canonical);
+    if (v && typeof v === 'object') {
+      return Object.fromEntries(Object.entries(v as Record<string, unknown>).sort(([a], [b]) => a.localeCompare(b)).map(([k, x]) => [k, canonical(x)]));
+    }
+    return v;
+  };
+  return createHash('sha256').update(`${model}\n${JSON.stringify(canonical(input))}`).digest('hex').slice(0, 16);
+}
+
+export function readLedger(runDir: string): LedgerEntry[] {
+  const p = ledgerPath(runDir);
+  if (!existsSync(p)) return [];
+  try {
+    const v = JSON.parse(readFileSync(p, 'utf8'));
+    // Valid JSON of the wrong shape is as unreadable as a truncated file, and returning [] for it put
+    // the next write straight through: two accepted job ids gone, no quarantine, no warning.
+    if (!Array.isArray(v) || v.some((e) => !e || typeof e.key !== 'string' || typeof e.requestId !== 'string')) {
+      throw new Error('the ledger is not a list of job records');
+    }
+    return v as LedgerEntry[];
+  } catch {
+    // The same rule the asset manifest follows: a file that cannot be read is kept, never written
+    // through. Losing this one means paying for every job in it again.
+    let dest = p.replace(/\.json$/, '.corrupt.json');
+    let n = 1;
+    while (existsSync(dest)) dest = p.replace(/\.json$/, `.corrupt.${n++}.json`);
+    renameSync(p, dest);
+    process.stderr.write(`[queue] the job ledger could not be parsed and was kept at ${dest}; starting a new one\n`);
+    return [];
+  }
+}
+
+export function findJob(runDir: string, key: string): LedgerEntry | undefined {
+  return readLedger(runDir).find((e) => e.key === key);
+}
+
+export function recordJob(runDir: string, entry: LedgerEntry): void {
+  const all = readLedger(runDir);
+  const i = all.findIndex((e) => e.key === entry.key);
+  if (i >= 0) all[i] = { ...all[i], ...entry };
+  else all.push(entry);
+  const p = ledgerPath(runDir);
+  mkdirSync(dirname(p), { recursive: true });
+  writeFileSync(p, JSON.stringify(all, null, 2) + '\n');
+}
+
+/** Jobs that were accepted and never seen to finish — what a resume has to pick up. */
+export function inFlight(runDir: string): LedgerEntry[] {
+  return readLedger(runDir).filter((e) => !e.completedAt);
+}
diff --git a/pipeline/providers/stills.ts b/pipeline/providers/stills.ts
new file mode 100644
index 0000000..f0471fb
--- /dev/null
+++ b/pipeline/providers/stills.ts
@@ -0,0 +1,190 @@
+// Getting a real picture, with the right to use it recorded next to it.
+//
+// A 12-minute documentary about a studio film never showed a studio ident, a poster, a book jacket or
+// a magazine spread. The reason was mechanical rather than editorial: across 221 searches not one
+// targeted a picture asset, and the run had no way to use one if it had found it — the fetch tool
+// returns text, and every image prompt ended "absolutely no text, no lettering, no words", which
+// makes a generated ident impossible too. The 1080p trailer master whose own catalogue entry noted
+// "Universal and Rhino card at the tail" was sitting downloaded and unused.
+//
+// This is the missing route. Wikimedia Commons is the first source because it is the one that answers
+// the rights question in the same response as the file: every result carries its licence and its
+// required attribution, so a still is never acquired without knowing what may be done with it.
+//
+// A still whose licence cannot be established is still recorded — as unknown. Not knowing is a fact
+// worth writing down, because it is the one that has to be revisited before anything ships.
+import { writeFile, mkdir } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { parseFlags } from '../../veed/args.ts';
+import type { Http } from './fal.ts';
+import { record, type AssetRecord } from './assets.ts';
+
+const COMMONS_API = 'https://commons.wikimedia.org/w/api.php';
+
+export interface StillSource {
+  /** Direct URL to the bytes. */
+  url: string;
+  /** The page a human should look at to check the claim. */
+  pageUrl?: string;
+  title: string;
+  /** As stated by the source. `unknown` when the source does not say. */
+  licence: string;
+  /** The credit line the licence requires, when it requires one. */
+  attribution?: string;
+  width?: number;
+  height?: number;
+}
+
+function api(http: Http | undefined): Http {
+  return http ?? (async (url, init) => {
+    const res = await fetch(url, { method: init.method, headers: init.headers, body: init.body, signal: AbortSignal.timeout(30_000) });
+    return { status: res.status, json: () => res.json(), arrayBuffer: () => res.arrayBuffer() };
+  });
+}
+
+/** Commons search, restricted to files. Returns candidate titles for `commonsStill` to resolve. */
+export async function commonsSearch(query: string, opts: { http?: Http; limit?: number } = {}): Promise<string[]> {
+  const url = `${COMMONS_API}?action=query&list=search&srnamespace=6&srlimit=${opts.limit ?? 10}&srsearch=${encodeURIComponent(query)}&format=json&origin=*`;
+  const res = await api(opts.http)(url, { method: 'GET', headers: {} });
+  if (res.status >= 300) throw new Error(`commons search failed (${res.status}) for "${query}"`);
+  const body = (await res.json()) as { query?: { search?: { title: string }[] } };
+  return (body.query?.search ?? []).map((s) => s.title);
+}
+
+/**
+ * Resolve one Commons file to its bytes URL and its terms.
+ *
+ * `extmetadata` is where the licence lives. It is absent often enough that the caller must handle
+ * `unknown` rather than assume a permissive default — assuming is how an unlicensed image ends up in
+ * a delivered film.
+ */
+export async function commonsStill(title: string, opts: { http?: Http } = {}): Promise<StillSource> {
+  const file = title.startsWith('File:') ? title : `File:${title}`;
+  const url = `${COMMONS_API}?action=query&titles=${encodeURIComponent(file)}&prop=imageinfo&iiprop=url%7Csize%7Cextmetadata&format=json&origin=*`;
+  const res = await api(opts.http)(url, { method: 'GET', headers: {} });
+  if (res.status >= 300) throw new Error(`commons lookup failed (${res.status}) for ${file}`);
+  const body = (await res.json()) as {
+    query?: { pages?: Record<string, {
+      title?: string;
+      imageinfo?: { url: string; descriptionurl?: string; width?: number; height?: number; extmetadata?: Record<string, { value?: string }> }[];
+    }> };
+  };
+  const page = Object.values(body.query?.pages ?? {})[0];
+  const info = page?.imageinfo?.[0];
+  if (!info?.url) throw new Error(`commons has no file at ${file}`);
+  const meta = info.extmetadata ?? {};
+  const strip = (v?: string) => v?.replace(/<[^>]*>/g, '').trim() || undefined;
+  return {
+    url: info.url,
+    pageUrl: info.descriptionurl,
+    title: page?.title ?? file,
+    licence: strip(meta.LicenseShortName?.value) ?? strip(meta.UsageTerms?.value) ?? 'unknown',
+    attribution: strip(meta.Artist?.value) ?? strip(meta.Credit?.value),
+    width: info.width,
+    height: info.height,
+  };
+}
+
+/** A still from anywhere, with terms the caller had to state — nothing is assumed permissive. */
+export function directStill(url: string, terms: { title: string; licence: string; attribution?: string; pageUrl?: string }): StillSource {
+  return { url, ...terms };
+}
+
+/**
+ * Fetch the bytes and land a manifest record.
+ *
+ * The record is what makes the still defensible later: a licence question that arrives after delivery
+ * is answerable from the file rather than from somebody's memory of where the picture came from.
+ */
+export async function saveStill(
+  runDir: string,
+  id: string,
+  src: StillSource,
+  opts: { http?: Http; runKey?: string; ext?: string } = {},
+): Promise<AssetRecord> {
+  const ext = opts.ext ?? (src.url.match(/\.(png|jpe?g|webp|gif|svg)(?:$|\?)/i)?.[1]?.toLowerCase() ?? 'png');
+  const rel = join('assets', `${id}.${ext}`);
+  const dest = join(runDir, rel);
+  const res = await api(opts.http)(src.url, { method: 'GET', headers: {} });
+  if (res.status >= 300) {
+    const q = src.url.indexOf('?');
+    throw new Error(`still download failed (${res.status}) for ${q < 0 ? src.url : `${src.url.slice(0, q)}?…`}`);
+  }
+  await mkdir(dirname(dest), { recursive: true });
+  await writeFile(dest, Buffer.from(await res.arrayBuffer()));
+
+  const asset: AssetRecord = {
+    id,
+    kind: 'image',
+    path: rel,
+    provider: src.pageUrl?.includes('wikimedia') ? 'wikimedia-commons' : 'direct',
+    model: 'sourced',
+    createdAt: new Date().toISOString(),
+    // Nothing was generated, so nothing was billed. `null` would read as "the provider gave no price".
+    cost: 0,
+    meta: {
+      sourceUrl: src.url,
+      pageUrl: src.pageUrl,
+      title: src.title,
+      licence: src.licence,
+      attribution: src.attribution,
+      width: src.width,
+      height: src.height,
+    },
+  };
+  record(runDir, asset, opts.runKey);
+  return asset;
+}
+
+/** Stills in this run whose terms were never established — the list to settle before delivery. */
+export function unlicensed(assets: AssetRecord[]): AssetRecord[] {
+  return assets.filter((a) => a.model === 'sourced' && (!a.meta?.licence || a.meta.licence === 'unknown'));
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const { values, positionals } = parseFlags({
+    args: process.argv.slice(2),
+    options: { run: { type: 'string' }, id: { type: 'string' }, limit: { type: 'string' }, licence: { type: 'string' } },
+    allowPositionals: true,
+  });
+  const [verb, ...rest] = positionals;
+
+  if (verb === 'search') {
+    const titles = await commonsSearch(rest.join(' '), { limit: Number(values.limit ?? 10) });
+    if (!titles.length) console.log('(nothing on Commons for that)');
+    for (const t of titles) console.log(t);
+    process.exit(0);
+  }
+
+  if (verb === 'show') {
+    const src = await commonsStill(rest.join(' '));
+    console.log(`${src.title}\n  ${src.width ?? '?'}x${src.height ?? '?'}\n  licence: ${src.licence}\n  credit : ${src.attribution ?? '(none required)'}\n  page   : ${src.pageUrl ?? '(n/a)'}`);
+    process.exit(0);
+  }
+
+  if (verb === 'save') {
+    const runDir = values.run;
+    const id = values.id;
+    if (!runDir || !id) { console.error('save needs --run <run-dir> --id <asset-id>'); process.exit(2); }
+    const target = rest.join(' ');
+    // A bare URL needs its terms from the caller; a Commons title carries its own.
+    const src = /^https?:\/\//.test(target)
+      ? directStill(target, { title: id, licence: values.licence ?? 'unknown' })
+      : await commonsStill(target);
+    const asset = await saveStill(runDir, id, src);
+    console.log(`${asset.path} — ${asset.meta!.licence}${asset.meta!.attribution ? `, credit: ${asset.meta!.attribution}` : ''}`);
+    if (asset.meta!.licence === 'unknown') {
+      console.log('  terms unknown: settle them before this ships, or swap the asset');
+    }
+    process.exit(0);
+  }
+
+  console.error(
+    'usage:\n' +
+    '  stills.ts search <query> [--limit 10]           # candidate Commons files\n' +
+    '  stills.ts show <File:Name.svg>                  # its url, size, licence and credit\n' +
+    '  stills.ts save <File:Name.svg|url> --run <dir> --id <asset-id> [--licence "<terms>"]',
+  );
+  process.exit(2);
+}
diff --git a/pipeline/recipes/devices.ts b/pipeline/recipes/devices.ts
new file mode 100644
index 0000000..f6b6146
--- /dev/null
+++ b/pipeline/recipes/devices.ts
@@ -0,0 +1,1056 @@
+// Compositional devices, derived from documents that were delivered and accepted.
+//
+// A device is not a style. It is a small assembly with a job — separate two zones, name a speaker,
+// buy legibility over unknown footage — and the reason to keep them here is that the difference
+// between a designed instance and a typed one lives in details nobody reconstructs under time
+// pressure. Read across 85 delivered documents, the differences are specific and countable:
+//
+//   · Plenty of the delivered documents DO draw a plain opaque bar — of the 424 bars in the corpus no
+//     taller than 4px, 165 are fully opaque. The ones worth copying do not: the canonical rule is a compound —
+//     a hairline under 50% alpha, a shadow beneath it, and a short opaque stub at its origin — and it
+//     DRAWS with scaleX from a named origin rather than fading in — two documents use all three of
+//     those together (`rx2-FR`, `rx4-IT`). This library offers the better
+//     instance, not the average one; that is the whole reason to have a library.
+//   · Contrast is bought with shadow far more often than with a plate: 42 documents over footage ground
+//     their ink with a text-shadow rather than a plate, 36 of them two-layer, with alpha following
+//     WEIGHT rather than size. Ten put a plate behind ink.
+//   · The median document uses three distinct colours, and the second signal colour appears once.
+//
+// Geometry is given at the canvas it was measured on and scaled by the caller, the same way compiled
+// recipes handle it.
+import type { DesignSystem, Rung } from '../design/system.ts';
+import { escapeHtml } from './lib.ts';
+
+export interface DeviceOutput {
+  html: string;
+  css: string;
+}
+
+/** The canvas the corpus numbers below were measured on. */
+export const REF_CANVAS = { width: 720, height: 1280 };
+
+/** Scale a reference-canvas length to the run's canvas, on the width axis. */
+export function scaleTo(sys: DesignSystem, px: number, refWidth = REF_CANVAS.width): number {
+  return Math.max(1, Math.round((px * sys.canvas.width) / refWidth));
+}
+
+function rgba(hex: string, alpha: number): string {
+  const h = hex.replace('#', '');
+  const n = h.length === 3 ? h.split('').map((c) => c + c).join('') : h;
+  const [r, g, b] = [0, 2, 4].map((i) => parseInt(n.slice(i, i + 2), 16));
+  return `rgba(${r},${g},${b},${alpha})`;
+}
+
+/** A colour darkened toward black by `amount` (0..1) — the corpus's shadow colour rule. */
+export function darken(hex: string, amount = 0.86): string {
+  const h = hex.replace('#', '');
+  const n = h.length === 3 ? h.split('').map((c) => c + c).join('') : h;
+  const ch = [0, 2, 4].map((i) => Math.round(parseInt(n.slice(i, i + 2), 16) * (1 - amount)));
+  return `#${ch.map((c) => c.toString(16).padStart(2, '0')).join('')}`;
+}
+
+// The shared vocabulary. A device names its colours, sizes and curves THROUGH the system, so a run is
+// redesigned by editing one artifact instead of nine graphics — and so a value nobody decided on is a
+// finding rather than a judgement call.
+
+/** The house entrance curve — 32 documents, 109 uses. Reached only when the system names no easing. */
+const HOUSE_ENTRANCE = 'cubic-bezier(.2,.7,.3,1)';
+/** The curve bars and rules draw on — 6 documents, 39 uses. */
+const DRAW_CURVE = 'cubic-bezier(.16,.84,.3,1)';
+/**
+ * The corpus's most-shared reveal duration: 420ms in 12 documents, against a 414ms median.
+ *
+ * Count it with `grep -l` for `animation-duration: 420ms` across the corpus templates: 12 documents.
+ * Counting any `420ms` token instead gives 24, which is the figure an earlier census reported and is
+ * not the same question: a delay is not a duration.
+ */
+const REVEAL_MS = 420;
+/** The canvas the `_card*` family was measured on — its numbers scale from 1080, not from 720. */
+const CARD_REF = 1080;
+/** The canvas `_card3` was measured on. */
+const SCENE_REF = 1920;
+/**
+ * Descender headroom for display type (`hp-IT`; `rx-DE` runs .08em/.16em).
+ * The raster box clips without it, which is a defect nobody sees until the render.
+ */
+const SHEAR_PAD = '.06em 0 .18em';
+
+// Every rule below that positions an element AND animates its opacity carries `z-index:1` as a floor,
+// with the element's real z inline (inline wins). Not because the engine demands it — it does not
+// (probe: opacity-anim-no-z, REFUTED) — but because a device that leaves its z to document order
+// covers, or is covered by, whatever the caller happens to emit next.
+
+function ease(sys: DesignSystem, name: string, fallback = HOUSE_ENTRANCE): string {
+  return sys.motion.easings[name] ?? sys.motion.easings.standard ?? fallback;
+}
+
+/** A family the system declares, by index — a device cannot name a face the system has not. */
+function family(sys: DesignSystem, i = 0): string {
+  const f = sys.fonts[i];
+  if (!f) throw new Error(`devices: the system declares ${sys.fonts.length} font(s) (${sys.fonts.join(', ')}); there is no index ${i}`);
+  return f;
+}
+
+/**
+ * The rung a device sets its type on, by preference order.
+ *
+ * A device names the rung it WANTS and the ones it can live on. Demanding a literal role made six of
+ * these throw against the ladder `type.ts` itself emits — a library that only works with a ladder
+ * nobody documents is a library nobody can reach, which is the failure this whole vocabulary exists
+ * to fix. Every chain ends on a role a default ladder always has.
+ */
+function rungOf(sys: DesignSystem, roles: string | string[]): Rung {
+  const wanted = Array.isArray(roles) ? roles : [roles];
+  for (const role of wanted) {
+    const r = sys.ladder.find((x) => x.role === role);
+    if (r) return r;
+  }
+  throw new Error(
+    `devices: the system has none of the "${wanted.join('", "')}" rungs — ladder is ${sys.ladder.map((x) => x.role).join(', ')}`,
+  );
+}
+
+function hexOf(sys: DesignSystem, key: string): string {
+  const v = sys.palette[key];
+  if (!v) throw new Error(`devices: "${key}" is not in the palette (${Object.keys(sys.palette).join(', ')})`);
+  return v;
+}
+
+const inkKey = (sys: DesignSystem) => Object.keys(sys.palette)[0];
+const accentKey = (sys: DesignSystem) => Object.keys(sys.palette)[1] ?? Object.keys(sys.palette)[0];
+const groundKey = (sys: DesignSystem) => Object.keys(sys.palette).at(-1)!;
+
+/**
+ * Size, weight and tracking, emitted as one declaration.
+ *
+ * They travel together because the LADDER owns tracking: a rung is a size with its tracking, and the
+ * film that read as crude had split them and set display tracking on reading text.
+ */
+function typeCss(sys: DesignSystem, r: Rung, fontIndex = 0, weight = r.weight): string {
+  return `font-family:${family(sys, fontIndex)};font-weight:${weight};font-size:${r.px}px;letter-spacing:${r.trackingEm}em` +
+    (r.case === 'upper' ? ';text-transform:uppercase' : '');
+}
+
+/**
+ * The trailing track a flushed line has to give back.
+ *
+ * letter-spacing is added after the LAST glyph too, so a tracked label flushed to a column lands that
+ * far short of it — `rx2-DE` declares `right:85px` against an 88px grid to cancel 0.30em at 11px.
+ */
+function trailingTrackPx(r: Rung): number {
+  return Math.round(r.trackingEm * r.px);
+}
+
+export interface DividerOptions {
+  id: string;
+  /** Top-left of the rule, in run-canvas px. */
+  x: number;
+  y: number;
+  /** Rule length in run-canvas px. */
+  width: number;
+  /** When the rule starts drawing. */
+  delayMs?: number;
+  /** Corpus range is 840–900ms. */
+  drawMs?: number;
+  /** Palette key for the stub. The second signal colour, used once in the document. */
+  accent?: string;
+  /** Palette key for the hairline. */
+  ink?: string;
+  /** Corpus range is 0.22–0.78; every value but one sits at or below 0.55. */
+  alpha?: number;
+  /** Left, or right for a rule that reads from the other edge. */
+  origin?: 'left' | 'right';
+  /** The stub is what stops this being a grey line. Off only with a reason. */
+  stub?: boolean;
+}
+
+/**
+ * A hairline rule with an opaque stub at its origin, drawn rather than faded.
+ *
+ * The stub is 5.1% of the rule's length and three times its weight in the canonical instances. It is
+ * the whole difference between a rule that reads as typography and one that reads as a `<hr>`.
+ */
+export function divider(sys: DesignSystem, o: DividerOptions): DeviceOutput {
+  const {
+    id, x, y, width,
+    delayMs = 0,
+    drawMs = 870,
+    accent = Object.keys(sys.palette)[1] ?? Object.keys(sys.palette)[0],
+    ink = Object.keys(sys.palette)[0],
+    alpha = 0.46,
+    origin = 'left',
+    stub = true,
+  } = o;
+
+  const weight = scaleTo(sys, 1);
+  const stubW = Math.max(weight * 3, Math.round(width * 0.051));
+  const stubH = weight * 3;
+  const inkHex = sys.palette[ink];
+  const accentHex = sys.palette[accent];
+  const curve = ease(sys, 'draw', DRAW_CURVE);
+  const stubX = origin === 'left' ? x : x + width - stubW;
+
+  const html =
+    `<div class="dv" id="${id}" style="left:${x}px;top:${y}px;width:${width}px;height:${weight}px;` +
+    `transform-origin:${origin} center;animation-delay:${delayMs}ms;animation-duration:${drawMs}ms"></div>` +
+    (stub
+      ? `<div class="dvs" id="${id}-stub" style="left:${stubX}px;top:${y - weight}px;width:${stubW}px;height:${stubH}px;` +
+        `animation-delay:${delayMs + 300}ms;animation-duration:420ms"></div>`
+      : '');
+
+  const css = [
+    `.dv{position:absolute;background:${rgba(inkHex, alpha)};box-shadow:0 ${weight}px ${weight * 3}px ${rgba(darken(inkHex), 0.6)};`,
+    `transform:scaleX(0);animation-name:dvDraw;animation-fill-mode:forwards;animation-timing-function:${curve};z-index:2}`,
+    stub ? `.dvs{position:absolute;background:${accentHex};transform:scaleX(0);transform-origin:${origin} center;animation-name:dvDraw;animation-fill-mode:forwards;animation-timing-function:${curve};z-index:3}` : '',
+    `@keyframes dvDraw{from{transform:scaleX(0)}to{transform:scaleX(1)}}`,
+  ].filter(Boolean).join('\n');
+
+  return { html, css };
+}
+
+export interface GroundShadowOptions {
+  /** The weight of the type this grounds. Alpha follows weight, not size. */
+  weight: number;
+  /**
+   * Palette key for the document's ground; the shadow is that colour darkened.
+   *
+   * Most of the 42 corpus documents that ground their ink over footage reach for pure black anyway.
+   * This follows the minority that does not, because a shadow in the ground's own colour reads as
+   * depth where a black one reads as a sticker — but the majority is not on that side, so it is a
+   * choice, not a law.
+   */
+  ground?: string;
+  /** Multiplies both radii, for type much larger or smaller than body. */
+  scale?: number;
+}
+
+/**
+ * The two-layer text-shadow that buys legibility over footage without a plate.
+ *
+ * One layer wide and soft for separation from the picture, one tight and dark for the glyph edge.
+ * Alpha follows WEIGHT: a 900-weight hero needs less help than a 700-weight paragraph, which is the
+ * opposite of what size-based scaling would do, and it is what the delivered documents actually do.
+ */
+export function groundShadow(sys: DesignSystem, o: GroundShadowOptions): string {
+  const { weight, ground = Object.keys(sys.palette).at(-1)!, scale = 1 } = o;
+  const base = darken(sys.palette[ground] ?? '#000000', 0.9);
+  // 700 → .38/.30, 900 → .20/.14, linear between and clamped outside.
+  const t = Math.max(0, Math.min(1, (weight - 700) / 200));
+  const soft = Number((0.38 + (0.2 - 0.38) * t).toFixed(2));
+  const edge = Number((0.3 + (0.14 - 0.3) * t).toFixed(2));
+  const r1 = Math.round(9 * scale);
+  const r2 = Math.round(2 * scale);
+  return `0 ${Math.round(2 * scale)}px ${r1}px ${rgba(base, soft)}, 0 ${Math.round(1 * scale)}px ${r2}px ${rgba(base, edge)}`;
+}
+
+/**
+ * The glow-then-offset stack `rx-DE` gives its accent word.
+ *
+ * The glow layers are listed FIRST so they paint over the hard offset instead of under it — reversing
+ * them puts a dark edge on top of the halo and the word reads dirty.
+ */
+function hardOffsetShadow(sys: DesignSystem, ink: string, ground: string): string {
+  const i = hexOf(sys, ink);
+  const g = darken(hexOf(sys, ground));
+  const p = (n: number) => scaleTo(sys, n);
+  return `0 0 ${p(3)}px ${rgba(i, 0.85)}, 0 0 ${p(12)}px ${rgba(i, 0.5)}, 0 0 ${p(30)}px ${rgba(i, 0.28)}, ` +
+    `${p(7)}px ${p(9)}px 0 ${rgba(g, 0.66)}, 0 ${p(4)}px ${p(16)}px ${rgba(g, 0.45)}`;
+}
+
+/** Five executions, one job. Which one a document uses is a style decision; having one is not. */
+export type AccentExecution = 'plate' | 'underline' | 'pop' | 'offset' | 'register';
+
+/** The hold before the peak: `rx-DE` runs its support words to 1360ms and lands the accent at 1800ms. */
+export const ACCENT_HOLD_MS = 440;
+
+/**
+ * The padding EVERY word in the run carries when the accent is underlined.
+ *
+ * `rx2-DE` gives the whole line the marked word's padding-bottom, so the rule sits at one fixed
+ * distance below the cap line in every beat instead of riding whichever word happens to be marked.
+ */
+export const ACCENT_UNDERLINE_PAD_EM = 0.02;
+
+/** The plate's padding as a fraction of the type size — asymmetric, optically centred on the cap. */
+const PLATE_PAD = { top: 0.026, side: 0.184, bottom: 0.079 };
+
+/** The corpus's pop window is 180–340ms; 340 is also one of its most-shared durations. */
+const POP_MS = 340;
+
+export interface AccentWordOptions {
+  id: string;
+  text: string;
+  /** Top-left of the word's own box, in run-canvas px. */
+  x: number;
+  y: number;
+  /** The rung it is set on. The corpus breaks SIZE and treatment together, never treatment alone. */
+  role?: string | string[];
+  execution?: AccentExecution;
+  /** Palette key for the signal colour. */
+  accent?: string;
+  ink?: string;
+  /** Palette key for the ground — plate ink, and the colour every shadow is darkened from. */
+  ground?: string;
+  /** Absolute delay. It lands ACCENT_HOLD_MS after the last support word of its own beat. */
+  delayMs?: number;
+  /** Corpus range is 280–460ms for the two-span entry. */
+  riseMs?: number;
+  /** Index into the system's fonts. The register break takes the second family by default. */
+  fontIndex?: number;
+  z?: number;
+}
+
+/**
+ * One word per beat, marked so the beat has a peak.
+ *
+ * Two things make this a device rather than a bold tag. It changes TWO attributes at once — the rung
+ * carries the size break, the execution carries the treatment — and it arrives last, after a hold.
+ * The entry is `rx-DE`'s two-span idiom: an outer span sliding in from its anchor side and an inner
+ * one rising and fading, because one span can only do one of those.
+ *
+ * Only the plate execution recolours the word. The other four mark it with treatment and leave the
+ * run's ink alone, which is what keeps a peak legible over footage nobody has seen yet.
+ */
+export function accentWord(sys: DesignSystem, o: AccentWordOptions): DeviceOutput {
+  const {
+    id, text, x, y,
+    role = ['accent', 'headline', 'display', 'body'],
+    execution = 'plate',
+    accent = accentKey(sys),
+    ink = inkKey(sys),
+    ground = groundKey(sys),
+    delayMs = 0,
+    fontIndex = execution === 'register' ? 1 : 0,
+    z = 5,
+  } = o;
+  const riseMs = o.riseMs ?? (execution === 'pop' ? POP_MS : REVEAL_MS);
+  const r = rungOf(sys, role);
+  const curve = ease(sys, 'standard');
+  const slide = scaleTo(sys, 32);
+  const pop = execution === 'pop';
+  const shadow = groundShadow(sys, { weight: r.weight, ground });
+
+  // The underline is drawn on the span's own wrapper so its width is the word's, not the line's.
+  const paint =
+    execution === 'plate'
+      ? `background:${hexOf(sys, accent)};color:${hexOf(sys, ground)};` +
+        `padding:${PLATE_PAD.top}em ${PLATE_PAD.side}em ${PLATE_PAD.bottom}em;` +
+        `box-shadow:0 ${scaleTo(sys, 6)}px ${scaleTo(sys, 18)}px ${rgba(darken(hexOf(sys, ground)), 0.34)};` +
+        `transform:rotate(-2deg)`
+      : execution === 'underline'
+        ? `color:${hexOf(sys, ink)};border-bottom:${scaleTo(sys, 2)}px solid ${hexOf(sys, accent)};` +
+          `padding:0 0 ${ACCENT_UNDERLINE_PAD_EM}em;text-shadow:${shadow}`
+        : execution === 'offset'
+          ? `color:${hexOf(sys, ink)};padding:${SHEAR_PAD};text-shadow:${hardOffsetShadow(sys, ink, ground)}`
+          : `color:${hexOf(sys, ink)};${execution === 'register' ? 'font-style:italic;' : ''}` +
+            `padding:${SHEAR_PAD};text-shadow:${shadow}`;
+
+  const html =
+    `<span class="aw${pop ? '' : ' aws'}" id="${id}" style="left:${x}px;top:${y}px;z-index:${z}` +
+    (pop ? '' : `;animation-delay:${delayMs}ms;animation-duration:${riseMs}ms`) + `">` +
+    `<span class="${pop ? 'awp' : 'awi'}" style="animation-delay:${delayMs}ms;animation-duration:${riseMs}ms">` +
+    `<span class="awt">${escapeHtml(text)}</span></span></span>`;
+
+  const css = [
+    `.aw{position:absolute}`,
+    pop
+      ? `.awp{display:inline-block;opacity:0;transform:scale(.4);transform-origin:50% 75%;animation-name:awPop;animation-fill-mode:both;animation-timing-function:${curve}}`
+      : `.aws{transform:translateX(-${slide}px);animation-name:awSlide;animation-fill-mode:both;animation-timing-function:${curve}}\n` +
+        `.awi{display:inline-block;opacity:0;transform:translateY(0.12em);animation-name:awRise;animation-fill-mode:both;animation-timing-function:${curve}}`,
+    `#${id} .awt{display:inline-block;${typeCss(sys, r, fontIndex)};${paint}}`,
+    pop
+      ? `@keyframes awPop{0%{opacity:0;transform:scale(.4)}55%{opacity:1;transform:scale(1.28)}100%{opacity:1;transform:scale(1)}}`
+      : `@keyframes awSlide{from{transform:translateX(-${slide}px)}to{transform:translateX(0)}}\n` +
+        `@keyframes awRise{from{opacity:0;transform:translateY(0.12em)}to{opacity:1;transform:translateY(0)}}`,
+  ].join('\n');
+
+  return { html, css };
+}
+
+/** `_card4`: the marker square's top sits 8.3px under a 20px label's, centred on its cap height. */
+const MARKER_DROP_EM = 0.415;
+/** `_card4`: 13px, the rise it gives every row in its stack, inside the kicker's own 7–16px range. */
+const LABEL_RISE_PX = 13;
+/** The kicker arrives behind the block it labels — the middle of the corpus's 140–520ms. */
+const KICKER_BEHIND_MS = 330;
+/** `_ugc2-chair`: a 32px pitch between two stacked labels at 20px. */
+const LABEL_PITCH_RATIO = 32 / 20;
+
+export interface KickerOptions {
+  id: string;
+  text: string;
+  /** Left edge of the text; with align `right`, the inset from the canvas's right edge. */
+  x: number;
+  y: number;
+  /** An uppercase label rung. The label register is +0.10 to +0.30em, median +0.163em. */
+  role?: string | string[];
+  /** Signal at full strength, or the ink held back. Those are the corpus's only two options. */
+  tone?: 'signal' | 'ink';
+  accent?: string;
+  ink?: string;
+  ground?: string;
+  /** Ink tone only. The corpus sets 0.55–0.62. */
+  alpha?: number;
+  /** The square that anchors the label to the grid. Skipped when the label is centred. */
+  marker?: boolean;
+  align?: 'left' | 'right' | 'center';
+  /** Required by `center`, which needs a box to centre inside. */
+  width?: number;
+  delayMs?: number;
+  /** Corpus range is 280–520ms. */
+  riseMs?: number;
+  /** Off when the label sits on a flat ground rather than over footage. */
+  shadow?: boolean;
+  fontIndex?: number;
+  z?: number;
+}
+
+/**
+ * The eyebrow that carries chapter, section, location or speaker so the headline need not.
+ *
+ * The marker square is what stops it floating: it hangs on the grid line the text is measured from.
+ * It is filled rather than the ring `_card4` describes because a filled square reads at this size, not
+ * because the engine cannot draw a ring: a spread-only `box-shadow: 0 0 0 Npx` DOES paint a keyline
+ * (probe: box-shadow-spread-keyline, REFUTED). The four-element keyline frame elsewhere in the corpus
+ * predates that measurement and is not evidence of a limit.
+ */
+export function kicker(sys: DesignSystem, o: KickerOptions): DeviceOutput {
+  const {
+    id, text, x, y,
+    role = ['kicker', 'micro', 'body'],
+    tone = 'signal',
+    accent = accentKey(sys),
+    ink = inkKey(sys),
+    ground = groundKey(sys),
+    alpha = 0.62,
+    marker = true,
+    align = 'left',
+    delayMs = 0,
+    riseMs = REVEAL_MS,
+    shadow = true,
+    fontIndex = 0,
+    z = 4,
+  } = o;
+
+  const r = rungOf(sys, role);
+  if (align === 'center' && o.width === undefined) {
+    throw new Error('kicker: a centred label needs a width to centre inside');
+  }
+  const rise = scaleTo(sys, LABEL_RISE_PX, CARD_REF);
+  const side = scaleTo(sys, 11, CARD_REF);
+  const gap = scaleTo(sys, 24, CARD_REF);
+  const drop = Math.round(MARKER_DROP_EM * r.px);
+  const flush = x - trailingTrackPx(r);
+  const box =
+    align === 'right' ? `right:${flush}px` :
+    align === 'center' ? `left:${x}px;width:${o.width}px;text-align:center` :
+    `left:${x}px`;
+  const colour = tone === 'signal' ? hexOf(sys, accent) : rgba(hexOf(sys, ink), alpha);
+  const withMarker = marker && align !== 'center';
+  const markerBox = align === 'right' ? `right:${flush - gap}px` : `left:${x - gap}px`;
+  const timing = `animation-delay:${delayMs}ms;animation-duration:${riseMs}ms`;
+
+  const html =
+    `<div class="kk" id="${id}" style="${box};top:${y}px;z-index:${z};${timing}">${escapeHtml(text)}</div>` +
+    (withMarker
+      ? `<div class="kk" id="${id}-marker" style="${markerBox};top:${y + drop}px;width:${side}px;height:${side}px;z-index:${z};${timing}"></div>`
+      : '');
+
+  const css = [
+    `.kk{position:absolute;z-index:1;opacity:0;animation-name:kkIn;animation-fill-mode:both;animation-timing-function:${ease(sys, 'standard')}}`,
+    `#${id}{${typeCss(sys, r, fontIndex)};color:${colour}` +
+      (shadow ? `;text-shadow:${groundShadow(sys, { weight: r.weight, ground })}` : '') + `}`,
+    withMarker ? `#${id}-marker{background:${hexOf(sys, accent)}}` : '',
+    `@keyframes kkIn{from{opacity:0;transform:translateY(${rise}px)}to{opacity:1;transform:translateY(0)}}`,
+  ].filter(Boolean).join('\n');
+
+  return { html, css };
+}
+
+/** `rx2-FR`'s left grid and measure, the same document the canonical rule was measured on. */
+const GRID_X = 48;
+const MEASURE = 592;
+/** `shopping-IT`: a 90px line pitch at 51px type. A rule takes a line slot like any other row. */
+const CAPTION_PITCH_RATIO = 90 / 51;
+/** `rx2-FR`: the chip under the base rule starts 12px below it. */
+const UNDER_RULE_PX = 12;
+/** The caption stack rises 0.16–0.42em — the middle of it, in em so it scales with the type. */
+const CAPTION_RISE_EM = 0.29;
+
+export interface LowerThirdOptions {
+  id: string;
+  /** The display line — a name, a place, a claim. */
+  name: string;
+  /** The label line under the rule. Omitted when the name carries the whole job. */
+  kicker?: string;
+  /** Left grid, top of the name line, and the measure the rule declares. */
+  x?: number;
+  y: number;
+  width?: number;
+  nameRole?: string | string[];
+  kickerRole?: string | string[];
+  ink?: string;
+  accent?: string;
+  ground?: string;
+  delayMs?: number;
+  riseMs?: number;
+  fontIndex?: number;
+  z?: number;
+}
+
+/**
+ * The name plate: a caption row anchored to a fixed slot, a rule under it, a kicker under that.
+ *
+ * It is a COMPOSITION, not a new device — the corpus builds it from three things it already has
+ * (`_card4` eyebrow plus statement, `_ugc2-chair` key plus value), so this assembles the divider and
+ * the kicker rather than redrawing them. The rule takes the line slot the second caption row would
+ * have taken, which is why the block reads as typography rather than as a graphic with a line in it.
+ */
+export function lowerThird(sys: DesignSystem, o: LowerThirdOptions): DeviceOutput {
+  const {
+    id, name, y,
+    nameRole = ['name', 'subhead', 'body'],
+    kickerRole = ['kicker', 'micro', 'body'],
+    ink = inkKey(sys),
+    accent = accentKey(sys),
+    ground = groundKey(sys),
+    delayMs = 0,
+    riseMs = REVEAL_MS,
+    fontIndex = 0,
+    z = 4,
+  } = o;
+
+  const x = o.x ?? scaleTo(sys, GRID_X);
+  const width = o.width ?? scaleTo(sys, MEASURE);
+  const nr = rungOf(sys, nameRole);
+  const ruleY = y + Math.round(CAPTION_PITCH_RATIO * nr.px);
+
+  const rule = divider(sys, { id: `${id}-rule`, x, y: ruleY, width, delayMs, accent, ink });
+  // No marker square: the rule already anchors the label to the grid, and two anchors on one line is
+  // the kind of redundancy that reads as decoration.
+  const eyebrow = o.kicker
+    ? kicker(sys, {
+      id: `${id}-kicker`, text: o.kicker, x, y: ruleY + scaleTo(sys, UNDER_RULE_PX),
+      role: kickerRole, accent, ink, ground, marker: false, fontIndex, z,
+      delayMs: delayMs + KICKER_BEHIND_MS,
+    })
+    : undefined;
+
+  const html =
+    `<div class="lt" id="${id}" style="left:${x}px;top:${y}px;width:${width}px;z-index:${z};` +
+    `animation-delay:${delayMs}ms;animation-duration:${riseMs}ms">${escapeHtml(name)}</div>` +
+    rule.html + (eyebrow?.html ?? '');
+
+  const css = [
+    `.lt{position:absolute;z-index:1;opacity:0;animation-name:ltIn;animation-fill-mode:both;animation-timing-function:${ease(sys, 'standard')}}`,
+    `#${id}{${typeCss(sys, nr, fontIndex)};color:${hexOf(sys, ink)};padding:${SHEAR_PAD};` +
+      `text-shadow:${groundShadow(sys, { weight: nr.weight, ground })}}`,
+    `@keyframes ltIn{from{opacity:0;transform:translateY(${CAPTION_RISE_EM}em)}to{opacity:1;transform:translateY(0)}}`,
+    rule.css,
+    eyebrow?.css ?? '',
+  ].filter(Boolean).join('\n');
+
+  return { html, css };
+}
+
+/** `rx2-FR`: the rail rises 7px. */
+const RAIL_RISE_PX = 7;
+
+export interface RailItem {
+  text: string;
+  /** Left, or right for the counterweight at the other end of the measure. */
+  align?: 'left' | 'right';
+  /**
+   * The rung this item is set on. A timecode wants its own: it is the only near-zero-tracking item
+   * on the rail, and that contrast is what makes the numeral read as the quiet register.
+   */
+  role?: string | string[];
+  /** Defaults to the rung's weight for the first item and one step lighter for the rest. */
+  weight?: number;
+  /** Corpus range is 0.80–1.0. */
+  alpha?: number;
+  italic?: boolean;
+}
+
+export interface DataRailOptions {
+  id: string;
+  /** Top of the rail, in run-canvas px. */
+  y: number;
+  x?: number;
+  width?: number;
+  items: RailItem[];
+  role?: string | string[];
+  ink?: string;
+  ground?: string;
+  delayMs?: number;
+  /** Corpus range is 480–520ms. */
+  riseMs?: number;
+  staggerMs?: number;
+  fontIndex?: number;
+  z?: number;
+}
+
+/**
+ * A rail of mono technical text — identity, constant, section, timecode — on the document's measure.
+ *
+ * It costs four small text elements and turns a caption into a document. The two ends are
+ * deliberately not the same: the left item carries the rung's weight at full strength and the right
+ * one sits a weight lighter and dimmer, so the rail reads as a header and its counterweight rather
+ * than as two labels that happened to land on one line.
+ */
+export function dataRail(sys: DesignSystem, o: DataRailOptions): DeviceOutput {
+  const {
+    id, y, items,
+    role = ['rail', 'micro', 'kicker', 'body'],
+    ink = inkKey(sys),
+    ground = groundKey(sys),
+    delayMs = 0,
+    riseMs = 500,
+    staggerMs = 80,
+    fontIndex = 0,
+    z = 3,
+  } = o;
+
+  const x = o.x ?? scaleTo(sys, GRID_X);
+  const width = o.width ?? scaleTo(sys, MEASURE);
+  const rise = scaleTo(sys, RAIL_RISE_PX);
+  const inkHex = hexOf(sys, ink);
+
+  const html = items.map((it, i) => {
+    const r = rungOf(sys, it.role ?? role);
+    const right = it.align === 'right';
+    // A right-flushed item gives back its own trailing track, so the last glyph lands on the column.
+    const box = right ? `left:${x}px;width:${width - trailingTrackPx(r)}px;text-align:right` : `left:${x}px`;
+    return `<div class="dr" id="${id}-${i + 1}" style="${box};top:${y}px;z-index:${z};` +
+      `animation-delay:${delayMs + i * staggerMs}ms;animation-duration:${riseMs}ms">${escapeHtml(it.text)}</div>`;
+  }).join('');
+
+  const perItem = items.map((it, i) => {
+    const r = rungOf(sys, it.role ?? role);
+    const weight = it.weight ?? (i === 0 ? r.weight : Math.max(100, r.weight - 100));
+    const alpha = it.alpha ?? (i === 0 ? 1 : 0.8);
+    return `#${id}-${i + 1}{${typeCss(sys, r, fontIndex, weight)};color:${rgba(inkHex, alpha)};` +
+      (it.italic ? 'font-style:italic;' : '') +
+      `text-shadow:${groundShadow(sys, { weight, ground })}}`;
+  });
+
+  const css = [
+    `.dr{position:absolute;z-index:1;opacity:0;animation-name:drIn;animation-fill-mode:both;animation-timing-function:${ease(sys, 'standard')}}`,
+    ...perItem,
+    `@keyframes drIn{from{opacity:0;transform:translateY(${rise}px)}to{opacity:1;transform:translateY(0)}}`,
+  ].join('\n');
+
+  return { html, css };
+}
+
+/** `_card4`: three columns on a 158px pitch, 14.6% of the canvas width. */
+const STAT_PITCH_FRACTION = 158 / 1080;
+/** `_card4`: the label sits 46.21px under a 30px figure. */
+const FIGURE_TO_LABEL_EM = 46.21 / 30;
+
+export interface Stat {
+  figure: string;
+  label: string;
+}
+
+export interface StatBlockOptions {
+  id: string;
+  /** Top-left of the first column, in run-canvas px. */
+  x: number;
+  y: number;
+  stats: Stat[];
+  figureRole?: string | string[];
+  labelRole?: string | string[];
+  /** Column pitch in run-canvas px. Defaults to the corpus's 14.6% of the canvas width. */
+  pitch?: number;
+  ink?: string;
+  ground?: string;
+  delayMs?: number;
+  riseMs?: number;
+  /** 300ms per column — half the row stagger of an index list, because a trio is one gesture. */
+  staggerMs?: number;
+  fontIndex?: number;
+  z?: number;
+}
+
+/**
+ * Headline numbers side by side, so a spec becomes a claim.
+ *
+ * The pair works because the two rungs disagree in every way at once: the figure is large, heavy and
+ * tracked negative, the label small, lighter and tracked out — a swing from −0.01 to +0.12em in
+ * `_card4`. A column animates as ONE element rather than as two lines, which is what makes three
+ * columns read as a single gesture.
+ */
+export function statBlock(sys: DesignSystem, o: StatBlockOptions): DeviceOutput {
+  const {
+    id, x, y, stats,
+    figureRole = ['figure', 'subhead', 'headline', 'body'],
+    labelRole = ['statLabel', 'kicker', 'micro', 'body'],
+    ink = inkKey(sys),
+    ground = groundKey(sys),
+    delayMs = 0,
+    riseMs = 440,
+    staggerMs = 300,
+    fontIndex = 0,
+    z = 4,
+  } = o;
+
+  const fr = rungOf(sys, figureRole);
+  const lr = rungOf(sys, labelRole);
+  const pitch = o.pitch ?? Math.round(STAT_PITCH_FRACTION * sys.canvas.width);
+  const rise = scaleTo(sys, LABEL_RISE_PX, CARD_REF);
+  const labelTop = Math.round(FIGURE_TO_LABEL_EM * fr.px);
+  const inkHex = hexOf(sys, ink);
+
+  const html = stats.map((s, i) =>
+    `<div class="sb" id="${id}-${i + 1}" style="left:${x + i * pitch}px;top:${y}px;z-index:${z};` +
+    `animation-delay:${delayMs + i * staggerMs}ms;animation-duration:${riseMs}ms">` +
+    `<div class="sbf">${escapeHtml(s.figure)}</div>` +
+    `<div class="sbl" style="top:${labelTop}px">${escapeHtml(s.label)}</div></div>`,
+  ).join('');
+
+  const css = [
+    `.sb{position:absolute;z-index:1;opacity:0;animation-name:sbIn;animation-fill-mode:both;animation-timing-function:${ease(sys, 'standard')}}`,
+    `.sbf{position:absolute;left:0;top:0;white-space:pre;${typeCss(sys, fr, fontIndex)};color:${inkHex};` +
+      `text-shadow:${groundShadow(sys, { weight: fr.weight, ground })}}`,
+    `.sbl{position:absolute;left:0;white-space:pre;${typeCss(sys, lr, fontIndex)};color:${inkHex};` +
+      `text-shadow:${groundShadow(sys, { weight: lr.weight, ground })}}`,
+    `@keyframes sbIn{from{opacity:0;transform:translateY(${rise}px)}to{opacity:1;transform:translateY(0)}}`,
+  ].join('\n');
+
+  return { html, css };
+}
+
+/** `_card3`: overshoot, undershoot, overshoot, settle — a spring baked into the keyframe values. */
+const HERO_SCALE = [1.104, 1.066, 1.030, 1.002, 0.985, 0.988, 1.004, 1.006, 1.000];
+/** Its paired lift, in px at the 1920-wide canvas it was measured on. */
+const HERO_LIFT_PX = [-6, -3, -1, 1, 0];
+/** The whole settle happens inside 14% of the window; the rest of it holds. */
+const HERO_SETTLE = 0.14;
+/** `_card1`: 285px line height on 228px type. */
+const HERO_LINE_HEIGHT = 1.25;
+/** `_card3`'s hero box, as fractions of its canvas: 1200x394 at (360, 649) on 1920x1440. */
+const HERO_BOX = { x: 360 / 1920, width: 1200 / 1920, y: 649 / 1440 };
+
+export interface HeroFigureOptions {
+  id: string;
+  text: string;
+  /** The box the figure is optically centred in, in run-canvas px. */
+  x: number;
+  y: number;
+  width: number;
+  role?: string | string[];
+  ink?: string;
+  ground?: string;
+  delayMs?: number;
+  /** The window the settle happens inside; it takes the first 14% of it. */
+  windowMs?: number;
+  align?: 'left' | 'center';
+  /** Off when the figure sits on a flat ground — matted ink needs no shadow at all. */
+  shadow?: boolean;
+  fontIndex?: number;
+  z?: number;
+}
+
+/**
+ * One number at a scale nothing else reaches.
+ *
+ * The motion is `_card3`'s hand-baked spring rather than an overshooting bezier: nine scale stops
+ * that overshoot, undershoot and overshoot again before settling, on a LINEAR timing function so the
+ * keyframes own the shape. Only two documents in the whole corpus put an overshoot in the curve — the
+ * rest bake it into the values, and this is the one worth keeping.
+ */
+export function heroFigure(sys: DesignSystem, o: HeroFigureOptions): DeviceOutput {
+  const {
+    id, text, x, y, width,
+    role = ['hero', 'display', 'headline', 'body'],
+    ink = inkKey(sys),
+    ground = groundKey(sys),
+    delayMs = 0,
+    windowMs = 3142,
+    align = 'center',
+    shadow = true,
+    fontIndex = 0,
+    z = 4,
+  } = o;
+
+  const r = rungOf(sys, role);
+  const lift = (px: number) => Math.round((px * sys.canvas.width) / SCENE_REF);
+  // The lift has five stops against the scale's nine. It settles first and HOLDS at its settled
+  // value; interpolating four more numbers would invent motion the document never had.
+  const stops = HERO_SCALE.map((s, i) => {
+    const at = ((i / (HERO_SCALE.length - 1)) * HERO_SETTLE * 100).toFixed(2).replace(/\.?0+$/, '');
+    const dy = lift(HERO_LIFT_PX[i] ?? 0);
+    return `${at}%{transform:translateY(${dy}px) scale(${s})}`;
+  });
+
+  const html =
+    `<div class="hf" id="${id}" style="left:${x}px;top:${y}px;width:${width}px;z-index:${z};` +
+    `animation-delay:${delayMs}ms;animation-duration:${windowMs}ms">${escapeHtml(text)}</div>`;
+
+  const css = [
+    `.hf{position:absolute;animation-name:hfSpring;animation-fill-mode:both;animation-timing-function:linear}`,
+    `#${id}{${typeCss(sys, r, fontIndex)};color:${hexOf(sys, ink)};line-height:${HERO_LINE_HEIGHT};text-align:${align}` +
+      // At hero scale the shadow is the same two-layer stack at twice the radii — a 900-weight face
+      // needs the separation and not the alpha.
+      (shadow ? `;text-shadow:${groundShadow(sys, { weight: r.weight, ground, scale: 2 })}` : '') + `}`,
+    `@keyframes hfSpring{${stops.join('')}100%{transform:translateY(0px) scale(1)}}`,
+  ].join('\n');
+
+  return { html, css };
+}
+
+export interface TitleCardOptions {
+  id: string;
+  headline: string;
+  kicker?: string;
+  /** The beat gate's own window. Successive cards carry ascending z, so a cut is never a cross-fade. */
+  delayMs?: number;
+  durationMs: number;
+  z?: number;
+  /** Block geometry; the defaults are `_card3`'s hero box as fractions of its canvas. */
+  x?: number;
+  y?: number;
+  width?: number;
+  headlineRole?: string | string[];
+  kickerRole?: string | string[];
+  ink?: string;
+  accent?: string;
+  ground?: string;
+  /**
+   * A window onto the footage, in run-canvas px. Without one the card sits on a flat ground; with
+   * one the ground becomes four mats around it.
+   */
+  window?: { x: number; y: number; width: number; height: number };
+  fontIndex?: number;
+}
+
+/**
+ * The opening title, the chapter break and the end card, in one implementation.
+ *
+ * Three things it is made of are already here — the beat gate, the hero figure and the kicker — and
+ * the fourth is the matte: the ground is the document's own colour rather than black, so the mat and
+ * the letterbox read as one surface. Nothing on this card carries a text-shadow, because the ink only
+ * ever sits on that flat ground; a shadow over a flat field is the tell of a graphic pasted on.
+ */
+export function titleCard(sys: DesignSystem, o: TitleCardOptions): DeviceOutput {
+  const {
+    id, headline, durationMs,
+    delayMs = 0,
+    z = 11,
+    headlineRole = ['hero', 'display', 'headline', 'body'],
+    kickerRole = ['kicker', 'micro', 'body'],
+    ink = inkKey(sys),
+    accent = accentKey(sys),
+    ground = groundKey(sys),
+    fontIndex = 0,
+  } = o;
+
+  const { width: cw, height: ch } = sys.canvas;
+  const x = o.x ?? Math.round(HERO_BOX.x * cw);
+  const width = o.width ?? Math.round(HERO_BOX.width * cw);
+  const y = o.y ?? Math.round(HERO_BOX.y * ch);
+  const kr = rungOf(sys, kickerRole);
+  const groundHex = hexOf(sys, ground);
+
+  // Four mats, or one plate. The mats are the complement of the window, so a caller cannot leave a
+  // band of bare canvas by moving the window and forgetting one of them.
+  const w = o.window;
+  const plates = w
+    ? [
+      [0, 0, cw, w.y],
+      [0, w.y + w.height, cw, ch - w.y - w.height],
+      [0, w.y, w.x, w.height],
+      [w.x + w.width, w.y, cw - w.x - w.width, w.height],
+    ]
+    : [[0, 0, cw, ch]];
+
+  const mats = plates
+    .filter(([, , pw, ph]) => pw > 0 && ph > 0)
+    .map(([px, py, pw, ph], i) =>
+      `<div class="tcm" id="${id}-mat${i + 1}" style="left:${px}px;top:${py}px;width:${pw}px;height:${ph}px;z-index:1"></div>`)
+    .join('');
+
+  // The kicker leads by one label line, so the headline starts where the second label would have.
+  const kickerY = y;
+  const heroY = y + Math.round(LABEL_PITCH_RATIO * kr.px);
+  const eyebrow = o.kicker
+    ? kicker(sys, {
+      id: `${id}-kicker`, text: o.kicker, x, y: kickerY, width, align: 'center',
+      role: kickerRole, accent, ink, ground, shadow: false, fontIndex, z: 2,
+    })
+    : undefined;
+  const hero = heroFigure(sys, {
+    id: `${id}-hero`, text: headline, x, y: heroY, width, role: headlineRole,
+    ink, ground, shadow: false, windowMs: durationMs, fontIndex, z: 2,
+  });
+
+  const html =
+    `<div class="cue" id="${id}" style="z-index:${z};animation-delay:${delayMs}ms;animation-duration:${durationMs}ms">` +
+    mats + (eyebrow?.html ?? '') + hero.html + `</div>`;
+
+  const css = [
+    `.cue{position:absolute;left:0;top:0;width:100%;height:100%;z-index:1;opacity:1;animation-name:cueWin;animation-fill-mode:forwards;animation-timing-function:linear}`,
+    `.tcm{position:absolute;background:${groundHex}}`,
+    `@keyframes cueWin{0%,99.99%{opacity:1}100%{opacity:0}}`,
+    eyebrow?.css ?? '',
+    hero.css,
+  ].filter(Boolean).join('\n');
+
+  return { html, css };
+}
+
+/**
+ * `_card2`'s two backing plates, as fractions of the badge side.
+ *
+ * Each grows the square, grows its radius, and shifts left and down — so the badge reads as a stack
+ * with thickness rather than as a sticker with a drop shadow under it.
+ */
+const BADGE_PLATES = [
+  { side: 116 / 112, radius: 28 / 116, dx: -2 / 112, dy: 3 / 112, alpha: 0.13 },
+  { side: 122 / 112, radius: 31 / 122, dx: -5 / 112, dy: 3 / 112, alpha: 0.10 },
+];
+
+export interface BadgeLockupOptions {
+  id: string;
+  /** Top-left of the badge itself, in run-canvas px. */
+  x: number;
+  y: number;
+  /** The badge's side. The three parameters that cover the corpus are side, radius and inset. */
+  side: number;
+  /** `_card2` 0.232, `_card3` 0.25. */
+  radiusFraction?: number;
+  /** The mark occupies 58.9% of the side, leaving 20.5% clear on every edge. */
+  markFraction?: number;
+  /** Markup for the mark itself, placed and sized by the badge. */
+  mark?: string;
+  accent?: string;
+  ground?: string;
+  /** The backing plates. Off only for a badge that is genuinely flat. */
+  plates?: boolean;
+  delayMs?: number;
+  fadeMs?: number;
+  z?: number;
+}
+
+/**
+ * The identity mark in a corner, with physical thickness.
+ *
+ * Its motion is a fade and nothing else: the badge is the first thing on screen and it never moves,
+ * so any entrance would make it compete with the film. Radius is a single value because per-corner
+ * and slash radii drop the whole declaration in this engine and the box renders square.
+ */
+export function badgeLockup(sys: DesignSystem, o: BadgeLockupOptions): DeviceOutput {
+  const {
+    id, x, y, side,
+    radiusFraction = 0.232,
+    markFraction = 0.589,
+    accent = accentKey(sys),
+    ground = groundKey(sys),
+    plates = true,
+    delayMs = 300,
+    fadeMs = 420,
+    z = 4,
+  } = o;
+
+  const groundHex = hexOf(sys, ground);
+  const timing = `animation-delay:${delayMs}ms;animation-duration:${fadeMs}ms`;
+  const markSide = Math.round(markFraction * side);
+  const inset = Math.round((side - markSide) / 2);
+
+  const backing = plates
+    ? BADGE_PLATES.map((p, i) => {
+      const s = Math.round(p.side * side);
+      return `<div class="bl" id="${id}-plate${i + 1}" style="left:${x + Math.round(p.dx * side)}px;` +
+        `top:${y + Math.round(p.dy * side)}px;width:${s}px;height:${s}px;` +
+        `border-radius:${Math.round(p.radius * s)}px;background:${rgba(groundHex, p.alpha)};` +
+        `z-index:${z};${timing}"></div>`;
+    }).join('')
+    : '';
+
+  const html = backing +
+    `<div class="bl" id="${id}" style="left:${x}px;top:${y}px;width:${side}px;height:${side}px;` +
+    `border-radius:${Math.round(radiusFraction * side)}px;background:${hexOf(sys, accent)};` +
+    `z-index:${z + 1};${timing}"></div>` +
+    (o.mark
+      ? `<div class="bl" id="${id}-mark" style="left:${x + inset}px;top:${y + inset}px;` +
+        `width:${markSide}px;height:${markSide}px;z-index:${z + 2};${timing}">${o.mark}</div>`
+      : '');
+
+  const css = [
+    `.bl{position:absolute;z-index:1;opacity:0;animation-name:blIn;animation-fill-mode:forwards;animation-timing-function:linear}`,
+    `@keyframes blIn{from{opacity:0}to{opacity:1}}`,
+  ].join('\n');
+
+  return { html, css };
+}
+
+/** `rx2-DE`: interior ticks 6px, the two ends 9px and lifted 3px above the rule. */
+const TICK_INTERIOR_PX = 6;
+const TICK_END_PX = 9;
+const TICK_RAISE_PX = 3;
+
+export interface TickScaleOptions {
+  id: string;
+  /** The rule the scale stands on: its left end, its top, and its measure. */
+  x: number;
+  y: number;
+  width: number;
+  count?: number;
+  /** Tick weight in run-canvas px — `rx2-DE` sets 1, `rx2-FR` sets 2. */
+  weight?: number;
+  ink?: string;
+  /** `rx2-DE` sets 0.30 against a 0.22 rule; `rx2-FR` sets 0.55 against a 0.46 one. */
+  alpha?: number;
+  delayMs?: number;
+  drawMs?: number;
+  /** 55ms, deliberately shorter than the word stagger so the scale reads as one gesture. */
+  staggerMs?: number;
+  z?: number;
+}
+
+/**
+ * The ticks that turn a rule into a measure.
+ *
+ * The last tick lands ON the right end of the rule rather than continuing the interval — `rx2-DE`'s
+ * fifth tick sits at 631 on a 576px measure from 56, and `rx2-FR`'s at 638 on a 592px one from 48.
+ * A scale whose last division falls short of the measure it divides reads as an accident, and this is
+ * the one place the corpus breaks its own interval to avoid it.
+ *
+ * The two end ticks are longer and lifted, so the measure has ends rather than just divisions.
+ */
+export function tickScale(sys: DesignSystem, o: TickScaleOptions): DeviceOutput {
+  const {
+    id, x, y, width,
+    count = 5,
+    ink = inkKey(sys),
+    alpha = 0.3,
+    delayMs = 0,
+    drawMs = 320,
+    staggerMs = 55,
+    z = 3,
+  } = o;
+
+  if (count < 2) throw new Error(`tickScale: a measure needs at least two ticks, got ${count}`);
+  const weight = o.weight ?? scaleTo(sys, 1);
+  const interior = scaleTo(sys, TICK_INTERIOR_PX);
+  const end = scaleTo(sys, TICK_END_PX);
+  const raise = scaleTo(sys, TICK_RAISE_PX);
+  const fill = rgba(hexOf(sys, ink), alpha);
+
+  const html = Array.from({ length: count }, (_, i) => {
+    const isEnd = i === 0 || i === count - 1;
+    const left = i === count - 1 ? x + width - weight : x + Math.round((i * width) / (count - 1));
+    return `<div class="tk" id="${id}-${i + 1}" style="left:${left}px;top:${isEnd ? y - raise : y}px;` +
+      `width:${weight}px;height:${isEnd ? end : interior}px;background:${fill};z-index:${z};` +
+      `animation-delay:${delayMs + i * staggerMs}ms;animation-duration:${drawMs}ms"></div>`;
+  }).join('');
+
+  const css = [
+    `.tk{position:absolute;transform:scaleY(0);transform-origin:top center;animation-name:tkDraw;` +
+      `animation-fill-mode:forwards;animation-timing-function:${ease(sys, 'draw', DRAW_CURVE)}}`,
+    `@keyframes tkDraw{from{transform:scaleY(0)}to{transform:scaleY(1)}}`,
+  ].join('\n');
+
+  return { html, css };
+}
diff --git a/pipeline/recipes/geometry.ts b/pipeline/recipes/geometry.ts
new file mode 100644
index 0000000..ab90c0b
--- /dev/null
+++ b/pipeline/recipes/geometry.ts
@@ -0,0 +1,226 @@
+// Computed geometry for authored documents.
+//
+// The launch session generated numbers of exactly these shapes and then threw the generators away — a
+// 251-tick dial, a 396-dot halftone field clipped to a burst, glyphs seated on a circle, a needle
+// whose travel came from an integrated second-order equation. Only the output survived, so the
+// arithmetic here is reconstructed from the delivered documents rather than recovered from a script.
+//
+// These are COMPUTATIONS, not devices. `alongArc` is not a speedometer and `lattice` is not a
+// halftone: naming the artifact would freeze one film's two scenes into the library, and the point is
+// the opposite — give the arithmetic away so a design nobody has had yet is cheap to build.
+//
+// Everything returns plain numbers in canvas px, and a caller spends them on a div, a clip-path or a
+// keyframe ladder. The one exception says so in its own name and doc: `arcRectPolygon` returns a
+// finished `polygon()` string, because a clip path in percentages has no other useful form.
+
+const TAU = Math.PI * 2;
+const rad = (deg: number) => (deg * Math.PI) / 180;
+
+export interface Pt { x: number; y: number }
+
+/** A box placed on a path: its top-left corner, plus the rotation that keeps it tangent. */
+export interface Placed { left: number; top: number; rotateDeg: number }
+
+/**
+ * N boxes seated on a circle, each rotated to its own angle.
+ *
+ * Angles run CLOCKWISE FROM 12 O'CLOCK, which is what a dial, a crown of type and a radial burst all
+ * read as: x = cx + r·sin θ, y = cy − r·cos θ. `w`/`h` recentre the box on the point, so a caller
+ * gets a `left`/`top` it can use directly.
+ */
+export function alongArc(opts: {
+  cx: number; cy: number; r: number;
+  fromDeg: number; toDeg: number;
+  /** Number of boxes. Give this OR `stepDeg`. */
+  count?: number;
+  /** Angular pitch. Give this OR `count`. */
+  stepDeg?: number;
+  w?: number; h?: number;
+  /** Round the emitted coordinates to this many decimals; the engine parses full precision. */
+  decimals?: number;
+}): Placed[] {
+  const { cx, cy, r, fromDeg, toDeg, w = 0, h = 0, decimals = 2 } = opts;
+  // Documented as exclusive. Accepting both silently ignored `toDeg` and returned a quarter of the
+  // arc the caller asked for.
+  if (opts.count !== undefined && opts.stepDeg !== undefined) {
+    throw new Error('alongArc: give count OR stepDeg, not both — toDeg means a different thing in each');
+  }
+  if (opts.count === undefined && opts.stepDeg === undefined) {
+    throw new Error('alongArc: give count or stepDeg');
+  }
+  if (opts.count !== undefined && (!Number.isInteger(opts.count) || opts.count < 1)) {
+    throw new Error(`alongArc: count must be a positive integer, got ${opts.count}`);
+  }
+  if (opts.stepDeg !== undefined && (!Number.isFinite(opts.stepDeg) || opts.stepDeg === 0)) {
+    throw new Error(`alongArc: stepDeg must be a non-zero finite number, got ${opts.stepDeg}`);
+  }
+  // A sweep that runs backwards through 12 o'clock is a legitimate dial; a positive step would return
+  // nothing at all, so take the direction from the range rather than silently emitting [].
+  if (opts.stepDeg !== undefined && Math.sign(toDeg - fromDeg) !== Math.sign(opts.stepDeg)) {
+    opts = { ...opts, stepDeg: -opts.stepDeg };
+  }
+  const step = opts.stepDeg ?? (opts.count && opts.count > 1 ? (toDeg - fromDeg) / (opts.count - 1) : 0);
+  const n = opts.count ?? (step === 0 ? 1 : Math.floor((toDeg - fromDeg) / step) + 1);
+  const q = (v: number) => Number(v.toFixed(decimals));
+  const out: Placed[] = [];
+  for (let i = 0; i < n; i++) {
+    const deg = fromDeg + i * step;
+    const t = rad(deg);
+    out.push({
+      left: q(cx + r * Math.sin(t) - w / 2),
+      top: q(cy - r * Math.cos(t) - h / 2),
+      rotateDeg: q(deg),
+    });
+  }
+  return out;
+}
+
+/**
+ * Points on a rotated lattice covering a rectangle.
+ *
+ * A print screen is an OFFSET lattice at an angle, not a square grid — that difference is why one
+ * delivered treatment read as polka dots until it was rebuilt. `stagger` shifts alternate rows by half
+ * a pitch; `angleDeg` turns the whole lattice.
+ */
+export function lattice(opts: {
+  x: number; y: number; w: number; h: number;
+  pitch: number;
+  angleDeg?: number;
+  stagger?: boolean;
+  decimals?: number;
+}): Pt[] {
+  const { x, y, w, h, pitch, angleDeg = 0, stagger = true, decimals = 2 } = opts;
+  // A pitch of zero never advances the loop and pushes for ever — a hang inside a design pass that
+  // ends in an OOM rather than an error. A non-finite one is refused with it: it yields no points at
+  // all, which is a silent empty lattice.
+  if (!Number.isFinite(pitch) || pitch <= 0) {
+    throw new Error(`lattice: pitch must be a positive finite number, got ${pitch}`);
+  }
+  const q = (v: number) => Number(v.toFixed(decimals));
+  const t = rad(angleDeg);
+  const cos = Math.cos(t), sin = Math.sin(t);
+  const cx = x + w / 2, cy = y + h / 2;
+  // Cover the rectangle's own diagonal so a rotated lattice still fills the corners.
+  const reach = Math.ceil(Math.hypot(w, h) / pitch / 2) + 1;
+  const out: Pt[] = [];
+  for (let row = -reach; row <= reach; row++) {
+    const offset = stagger && (row & 1) ? pitch / 2 : 0;
+    for (let col = -reach; col <= reach; col++) {
+      const lx = col * pitch + offset;
+      const ly = row * pitch;
+      const px = cx + lx * cos - ly * sin;
+      const py = cy + lx * sin + ly * cos;
+      if (px < x || px > x + w || py < y || py > y + h) continue;
+      out.push({ x: q(px), y: q(py) });
+    }
+  }
+  return out;
+}
+
+/** Even-odd ray cast. The engine has no mask, so clipping a field to a shape happens here. */
+export function insidePolygon(p: Pt, poly: Pt[]): boolean {
+  let inside = false;
+  for (let i = 0, j = poly.length - 1; i < poly.length; j = i++) {
+    const a = poly[i], b = poly[j];
+    if ((a.y > p.y) !== (b.y > p.y) && p.x < ((b.x - a.x) * (p.y - a.y)) / (b.y - a.y) + a.x) inside = !inside;
+  }
+  return inside;
+}
+
+/**
+ * A rectangle whose corners are real arcs, as a `%` clip-path polygon.
+ *
+ * `border-radius` renders a true curve (probe: border-radius-chamfer), so reach for this only when a
+ * corner must be sampled — an asymmetric radius, a corner cut into a clipped shape, or a shape the
+ * radius property cannot describe. Percentages keep it canvas-independent.
+ */
+export function arcRectPolygon(opts: { w: number; h: number; r: number; samples?: number; decimals?: number }): string {
+  const { w, h, r, samples = 8, decimals = 2 } = opts;
+  const q = (v: number) => Number(v.toFixed(decimals));
+  const px = (v: number) => q((v / w) * 100);
+  const py = (v: number) => q((v / h) * 100);
+  const pts: string[] = [];
+  // corner centres, clockwise from top-left
+  const corners: [number, number, number][] = [
+    [r, r, 180], [w - r, r, 270], [w - r, h - r, 0], [r, h - r, 90],
+  ];
+  for (const [cx, cy, start] of corners) {
+    for (let i = 0; i <= samples; i++) {
+      const a = rad(start + (90 * i) / samples);
+      pts.push(`${px(cx + r * Math.cos(a))}% ${py(cy + r * Math.sin(a))}%`);
+    }
+  }
+  return `polygon(${pts.join(',')})`;
+}
+
+/** Points sampled along a quadratic Bézier — a bowed arrow, a dashed leader, a curved rail. */
+export function sampleQuadratic(p0: Pt, p1: Pt, p2: Pt, n: number, decimals = 2): Pt[] {
+  const q = (v: number) => Number(v.toFixed(decimals));
+  const out: Pt[] = [];
+  for (let i = 0; i <= n; i++) {
+    const t = i / n, u = 1 - t;
+    out.push({
+      x: q(u * u * p0.x + 2 * u * t * p1.x + t * t * p2.x),
+      y: q(u * u * p0.y + 2 * u * t * p1.y + t * t * p2.y),
+    });
+  }
+  return out;
+}
+
+/**
+ * A damped second-order response, sampled as keyframe stops.
+ *
+ * A needle settling, a card overshooting, a counter landing — all the same equation, and all things
+ * the engine has no easing curve for. `zeta` below 1 overshoots and rings; at 1 it lands without
+ * overshoot. Percentages are INTEGERS: a fractional keyframe percentage is legal, but an integer stop
+ * keeps the emitted document readable when --verify names a frame.
+ */
+export function springKeyframes(opts: {
+  from: number; to: number;
+  omega: number;
+  zeta: number;
+  durationMs: number;
+  stops?: number;
+  decimals?: number;
+}): { pct: number; value: number }[] {
+  const { from, to, omega, zeta, durationMs, stops = 100, decimals = 3 } = opts;
+  const q = (v: number) => Number(v.toFixed(decimals));
+  if (!Number.isFinite(stops) || stops < 1) throw new Error(`springKeyframes: stops must be >= 1, got ${stops}`);
+  if (!Number.isFinite(zeta) || zeta < 0) throw new Error(`springKeyframes: zeta must be >= 0, got ${zeta}`);
+  const over = zeta > 1;
+  // Overdamped has two real roots; underdamped one damped frequency. Collapsing the first into the
+  // second is a different curve, not a rounding difference.
+  const wd = over ? omega * Math.sqrt(zeta * zeta - 1) : omega * Math.sqrt(Math.max(0, 1 - zeta * zeta));
+  const out: { pct: number; value: number }[] = [];
+  for (let i = 0; i <= stops; i++) {
+    const pct = Math.round((i / stops) * 100);
+    const t = (i / stops) * (durationMs / 1000);
+    const decay = Math.exp(-zeta * omega * t);
+    // Unit step response. Above 1 the response is overdamped and takes the cosh/sinh branch; exactly 1
+    // is the critically damped form, and below it the term rings.
+    const osc = over
+      ? Math.cosh(wd * t) + ((zeta * omega) / wd) * Math.sinh(wd * t)
+      : wd > 0
+        ? Math.cos(wd * t) + ((zeta * omega) / wd) * Math.sin(wd * t)
+        : 1 + omega * t;
+    const y = 1 - decay * osc;
+    out.push({ pct, value: q(from + (to - from) * y) });
+  }
+  // Collapse duplicate percentages produced by rounding, keeping the last value at each stop.
+  const byPct = new Map<number, number>();
+  for (const s of out) byPct.set(s.pct, s.value);
+  return [...byPct].map(([pct, value]) => ({ pct, value }));
+}
+
+/** Vertices of a regular star, ready for a clip-path polygon or a computed div fan. */
+export function starPolygon(opts: { cx: number; cy: number; outer: number; inner: number; points?: number; rotateDeg?: number; decimals?: number }): Pt[] {
+  const { cx, cy, outer, inner, points = 5, rotateDeg = 0, decimals = 2 } = opts;
+  const q = (v: number) => Number(v.toFixed(decimals));
+  const out: Pt[] = [];
+  for (let i = 0; i < points * 2; i++) {
+    const r = i % 2 === 0 ? outer : inner;
+    const a = rad(rotateDeg) + (i * TAU) / (points * 2) - Math.PI / 2;
+    out.push({ x: q(cx + r * Math.cos(a)), y: q(cy + r * Math.sin(a)) });
+  }
+  return out;
+}
diff --git a/pipeline/recipes/svg-clip.ts b/pipeline/recipes/svg-clip.ts
new file mode 100644
index 0000000..fea3199
--- /dev/null
+++ b/pipeline/recipes/svg-clip.ts
@@ -0,0 +1,635 @@
+/**
+ * A vector logo the engine will actually draw.
+ *
+ * `svg-counterform-filled` (CONFIRMED) says an inline SVG path fills its counterform solid — the hole
+ * in an O, a D or an e is lost, and `fill-rule`, `<mask>` and `<clipPath>` do not cut it. The route
+ * that does is `clip-path-polygon-counterform` (CONFIRMED): a CSS polygon walking the outer contour,
+ * returning along a degenerate slit, walking the hole, and coming back out. That stays vector, so it
+ * is as clean at 26px as at 300px — which a bitmap keyed out of an export is not, and 720p footage
+ * is exactly where that shows.
+ *
+ * This turns an arbitrary SVG into those polygons. Transforms are baked into the points here because
+ * `svg-transform-attr` (CONFIRMED) says the engine displaces a shape carrying a transform ATTRIBUTE.
+ *
+ * The input is USER material — whatever a brand hands over — so every failure here is loud. An SVG
+ * this cannot read throws; it never returns an empty logo that renders as nothing while the run
+ * reports success.
+ */
+import { readFileSync } from 'node:fs';
+
+export type ClipShape = {
+  /** Ready for `clip-path: polygon(...)`, in % of the box. */
+  polygon: string;
+  /** The authored fill, when the source states a plain colour. `url()` and `currentColor` are dropped. */
+  fill?: string;
+};
+
+export type ClipLogo = {
+  width: number;
+  height: number;
+  /** width / height, for sizing the box from either dimension. */
+  aspect: number;
+  /** One entry per disjoint island — each is its own absolutely-positioned box. */
+  shapes: ClipShape[];
+};
+
+export type Pt = [number, number];
+/** An affine matrix as SVG writes it: a b c d e f. */
+export type Mat = [number, number, number, number, number, number];
+
+const I: Mat = [1, 0, 0, 1, 0, 0];
+
+/** A logo is a mark, not a map. Past this it is a hostile or mistaken file, and saying so beats an OOM. */
+const MAX_POINTS = 200_000;
+
+export class SvgClipError extends Error {}
+
+function mul(m: Mat, n: Mat): Mat {
+  return [
+    m[0] * n[0] + m[2] * n[1], m[1] * n[0] + m[3] * n[1],
+    m[0] * n[2] + m[2] * n[3], m[1] * n[2] + m[3] * n[3],
+    m[0] * n[4] + m[2] * n[5] + m[4], m[1] * n[4] + m[3] * n[5] + m[5],
+  ];
+}
+
+function apply(m: Mat, [x, y]: Pt): Pt {
+  return [m[0] * x + m[2] * y + m[4], m[1] * x + m[3] * y + m[5]];
+}
+
+function parseTransform(s: string | undefined): Mat {
+  if (!s) return I;
+  let m = I;
+  for (const [, op, argstr] of s.matchAll(/(matrix|translate|scale|rotate|skewX|skewY)\s*\(([^)]*)\)/g)) {
+    const a = argstr.split(/[\s,]+/).filter(Boolean).map(Number);
+    if (a.some((v) => !Number.isFinite(v))) {
+      throw new SvgClipError(`transform "${op}(${argstr})" carries a value that is not a number`);
+    }
+    const rad = (deg: number) => (deg * Math.PI) / 180;
+    let t: Mat;
+    switch (op) {
+      case 'matrix': t = [a[0], a[1], a[2], a[3], a[4], a[5]]; break;
+      case 'translate': t = [1, 0, 0, 1, a[0] ?? 0, a[1] ?? 0]; break;
+      case 'scale': t = [a[0] ?? 1, 0, 0, a[1] ?? a[0] ?? 1, 0, 0]; break;
+      case 'skewX': t = [1, 0, Math.tan(rad(a[0] ?? 0)), 1, 0, 0]; break;
+      case 'skewY': t = [1, Math.tan(rad(a[0] ?? 0)), 0, 1, 0, 0]; break;
+      case 'rotate': {
+        const [ang, cx = 0, cy = 0] = a;
+        const c = Math.cos(rad(ang)), si = Math.sin(rad(ang));
+        t = mul([1, 0, 0, 1, cx, cy], mul([c, si, -si, c, 0, 0], [1, 0, 0, 1, -cx, -cy]));
+        break;
+      }
+      default: t = I;
+    }
+    m = mul(m, t);
+  }
+  return m;
+}
+
+function dist(a: Pt, b: Pt): number {
+  return Math.hypot(b[0] - a[0], b[1] - a[1]);
+}
+
+/**
+ * Points per curve, from the control polygon's length against a flatness tolerance.
+ *
+ * The tolerance is a PARAMETER, never module state. It was a module-level `let` that `svgToClip`
+ * wrote and the exported `pathToRings` read, so the same `d` string flattened differently depending
+ * on which file had been converted earlier in the process: a 9000-unit em left behind a tolerance
+ * that turned a 100-unit icon's circles into triangles.
+ */
+function steps(len: number, tol: number): number {
+  return Math.max(2, Math.min(96, Math.ceil(Math.sqrt(len / (8 * tol)))));
+}
+
+function cubic(p0: Pt, p1: Pt, p2: Pt, p3: Pt, out: Pt[], tol: number): void {
+  const n = steps(dist(p0, p1) + dist(p1, p2) + dist(p2, p3), tol);
+  for (let i = 1; i <= n; i++) {
+    const t = i / n, u = 1 - t;
+    out.push([
+      u * u * u * p0[0] + 3 * u * u * t * p1[0] + 3 * u * t * t * p2[0] + t * t * t * p3[0],
+      u * u * u * p0[1] + 3 * u * u * t * p1[1] + 3 * u * t * t * p2[1] + t * t * t * p3[1],
+    ]);
+  }
+}
+
+function quad(p0: Pt, p1: Pt, p2: Pt, out: Pt[], tol: number): void {
+  const n = steps(dist(p0, p1) + dist(p1, p2), tol);
+  for (let i = 1; i <= n; i++) {
+    const t = i / n, u = 1 - t;
+    out.push([
+      u * u * p0[0] + 2 * u * t * p1[0] + t * t * p2[0],
+      u * u * p0[1] + 2 * u * t * p1[1] + t * t * p2[1],
+    ]);
+  }
+}
+
+/** SVG's endpoint-to-centre arc conversion, then sampled. */
+function arc(p0: Pt, rx: number, ry: number, rot: number, large: number, sweep: number, p1: Pt, out: Pt[], tol: number): void {
+  // A zero radius is a straight line, and coincident endpoints are nothing at all. The centre-form
+  // conversion divides by a term that is zero in the second case, and every coordinate after it comes
+  // out NaN — which reaches the document as `NaN%` and voids the whole clip-path.
+  if (rx === 0 || ry === 0) { out.push(p1); return; }
+  if (p0[0] === p1[0] && p0[1] === p1[1]) return;
+
+  rx = Math.abs(rx); ry = Math.abs(ry);
+  const phi = (rot * Math.PI) / 180, cos = Math.cos(phi), sin = Math.sin(phi);
+  const dx = (p0[0] - p1[0]) / 2, dy = (p0[1] - p1[1]) / 2;
+  const x1 = cos * dx + sin * dy, y1 = -sin * dx + cos * dy;
+
+  // A radius too small for the chord is scaled up until the arc closes, as the spec requires.
+  const lam = (x1 * x1) / (rx * rx) + (y1 * y1) / (ry * ry);
+  if (lam > 1) { const s = Math.sqrt(lam); rx *= s; ry *= s; }
+
+  const num = rx * rx * ry * ry - rx * rx * y1 * y1 - ry * ry * x1 * x1;
+  const den = rx * rx * y1 * y1 + ry * ry * x1 * x1;
+  const co = (large === sweep ? -1 : 1) * Math.sqrt(Math.max(0, num / den));
+  const cx1 = (co * rx * y1) / ry, cy1 = (-co * ry * x1) / rx;
+  const cx = cos * cx1 - sin * cy1 + (p0[0] + p1[0]) / 2;
+  const cy = sin * cx1 + cos * cy1 + (p0[1] + p1[1]) / 2;
+
+  const ang = (ux: number, uy: number, vx: number, vy: number) => {
+    const s = Math.sign(ux * vy - uy * vx) || 1;
+    const c = (ux * vx + uy * vy) / (Math.hypot(ux, uy) * Math.hypot(vx, vy));
+    return s * Math.acos(Math.max(-1, Math.min(1, c)));
+  };
+  const t0 = ang(1, 0, (x1 - cx1) / rx, (y1 - cy1) / ry);
+  let dt = ang((x1 - cx1) / rx, (y1 - cy1) / ry, (-x1 - cx1) / rx, (-y1 - cy1) / ry);
+  if (!sweep && dt > 0) dt -= 2 * Math.PI;
+  if (sweep && dt < 0) dt += 2 * Math.PI;
+
+  const n = steps(Math.abs(dt) * Math.max(rx, ry), tol);
+  for (let i = 1; i <= n; i++) {
+    const t = t0 + (dt * i) / n;
+    const ex = rx * Math.cos(t), ey = ry * Math.sin(t);
+    out.push([cos * ex - sin * ey + cx, sin * ex + cos * ey + cy]);
+  }
+}
+
+/**
+ * A cursor over path data, because an arc's flags cannot be tokenised like numbers.
+ *
+ * `A5 5 0 015 5` is what svgo emits for `A 5 5 0 0 1 5 5`: the two single-character flags and the
+ * next coordinate, run together. A number-shaped scanner reads `015` as one value, every following
+ * argument shifts by one, and the path comes out as garbage with nothing thrown. A flag is one
+ * character, and only the reader knows which arguments are flags.
+ */
+class PathCursor {
+  private i = 0;
+  constructor(private readonly s: string) {}
+
+  private ws(): void {
+    while (this.i < this.s.length && /[\s,]/.test(this.s[this.i])) this.i++;
+  }
+
+  /** The next command letter, or undefined at the end. */
+  command(): string | undefined {
+    this.ws();
+    const c = this.s[this.i];
+    if (c === undefined || !/[a-zA-Z]/.test(c)) return undefined;
+    this.i++;
+    return c;
+  }
+
+  /** True when another argument follows, so `M1,2 3,4` continues as an implicit lineto. */
+  hasNumber(): boolean {
+    this.ws();
+    const c = this.s[this.i];
+    return c !== undefined && (c === '-' || c === '+' || c === '.' || (c >= '0' && c <= '9'));
+  }
+
+  number(): number {
+    this.ws();
+    const start = this.i;
+    if (this.s[this.i] === '-' || this.s[this.i] === '+') this.i++;
+    while (this.i < this.s.length && this.s[this.i] >= '0' && this.s[this.i] <= '9') this.i++;
+    if (this.s[this.i] === '.') { this.i++; while (this.i < this.s.length && this.s[this.i] >= '0' && this.s[this.i] <= '9') this.i++; }
+    if (this.s[this.i] === 'e' || this.s[this.i] === 'E') {
+      this.i++;
+      if (this.s[this.i] === '-' || this.s[this.i] === '+') this.i++;
+      while (this.i < this.s.length && this.s[this.i] >= '0' && this.s[this.i] <= '9') this.i++;
+    }
+    const v = Number(this.s.slice(start, this.i));
+    if (start === this.i || !Number.isFinite(v)) {
+      throw new SvgClipError(`path data ends or malforms where a number was expected: "${this.s.slice(Math.max(0, start - 12), start + 12)}"`);
+    }
+    return v;
+  }
+
+  /** An arc flag: exactly one character, `0` or `1`. */
+  flag(): number {
+    this.ws();
+    const c = this.s[this.i];
+    if (c !== '0' && c !== '1') {
+      throw new SvgClipError(`an arc flag is 0 or 1, saw "${c}": "${this.s.slice(Math.max(0, this.i - 12), this.i + 12)}"`);
+    }
+    this.i++;
+    return c === '1' ? 1 : 0;
+  }
+}
+
+/** One `d` attribute, flattened to closed rings of points. */
+export function pathToRings(d: string, m: Mat = I, tol = 0.05): Pt[][] {
+  const rings: Pt[][] = [];
+  let cur: Pt[] = [];
+  let pos: Pt = [0, 0], start: Pt = [0, 0];
+  let prevC: Pt | null = null, prevQ: Pt | null = null;
+  let budget = MAX_POINTS;
+
+  const close = () => { if (cur.length > 2) rings.push(cur); cur = []; };
+  const spend = (n: number) => {
+    budget -= n;
+    if (budget < 0) throw new SvgClipError(`this path passes ${MAX_POINTS} points — a mark does not need that many`);
+  };
+
+  const c = new PathCursor(d);
+  let cmd = c.command();
+  while (cmd !== undefined) {
+    let rel = cmd === cmd.toLowerCase();
+    let upper = cmd.toUpperCase();
+    do {
+      const ox = rel ? pos[0] : 0, oy = rel ? pos[1] : 0;
+      const before = cur.length;
+      switch (upper) {
+        case 'M': {
+          close();
+          pos = [c.number() + ox, c.number() + oy]; start = pos; cur = [pos];
+          // A repeated moveto argument set is a lineto, per the spec.
+          upper = 'L';
+          prevC = prevQ = null;
+          break;
+        }
+        case 'L': { pos = [c.number() + ox, c.number() + oy]; cur.push(pos); prevC = prevQ = null; break; }
+        case 'H': { pos = [c.number() + ox, pos[1]]; cur.push(pos); prevC = prevQ = null; break; }
+        case 'V': { pos = [pos[0], c.number() + oy]; cur.push(pos); prevC = prevQ = null; break; }
+        case 'C': {
+          const c1: Pt = [c.number() + ox, c.number() + oy], c2: Pt = [c.number() + ox, c.number() + oy], p: Pt = [c.number() + ox, c.number() + oy];
+          cubic(pos, c1, c2, p, cur, tol); pos = p; prevC = c2; prevQ = null; break;
+        }
+        case 'S': {
+          const c1: Pt = prevC ? [2 * pos[0] - prevC[0], 2 * pos[1] - prevC[1]] : pos;
+          const c2: Pt = [c.number() + ox, c.number() + oy], p: Pt = [c.number() + ox, c.number() + oy];
+          cubic(pos, c1, c2, p, cur, tol); pos = p; prevC = c2; prevQ = null; break;
+        }
+        case 'Q': {
+          const q: Pt = [c.number() + ox, c.number() + oy], p: Pt = [c.number() + ox, c.number() + oy];
+          quad(pos, q, p, cur, tol); pos = p; prevQ = q; prevC = null; break;
+        }
+        case 'T': {
+          const q: Pt = prevQ ? [2 * pos[0] - prevQ[0], 2 * pos[1] - prevQ[1]] : pos;
+          const p: Pt = [c.number() + ox, c.number() + oy];
+          quad(pos, q, p, cur, tol); pos = p; prevQ = q; prevC = null; break;
+        }
+        case 'A': {
+          const rx = c.number(), ry = c.number(), rot = c.number(), la = c.flag(), sw = c.flag();
+          const p: Pt = [c.number() + ox, c.number() + oy];
+          arc(pos, rx, ry, rot, la, sw, p, cur, tol); pos = p; prevC = prevQ = null; break;
+        }
+        case 'Z': {
+          if (cur.length) cur.push(start);
+          close();
+          // What follows a Z starts again at the subpath's own start, not at the origin.
+          pos = start;
+          prevC = prevQ = null;
+          break;
+        }
+        default: throw new SvgClipError(`unknown path command "${upper}"`);
+      }
+      spend(Math.max(0, cur.length - before));
+      if (upper === 'Z') break;
+    } while (c.hasNumber());
+    cmd = c.command();
+    if (cmd !== undefined) { rel = cmd === cmd.toLowerCase(); upper = cmd.toUpperCase(); }
+  }
+  close();
+  return rings.map((r) => r.map((p) => apply(m, p)));
+}
+
+function ringArea(r: Pt[]): number {
+  let a = 0;
+  for (let i = 0, j = r.length - 1; i < r.length; j = i++) a += r[j][0] * r[i][1] - r[i][0] * r[j][1];
+  return a / 2;
+}
+
+/**
+ * Is `inner` WHOLLY inside `outer`? Sampling the whole ring is what separates the two cases a single
+ * point cannot: a counterform released into its own `<path>` element sits entirely within its outer
+ * contour, while two overlapping siblings each have points outside the other. Testing `ring[0]` alone
+ * called overlapping circles nested — and scoping holes to one element to dodge that then lost every
+ * counter an exporter had released, which is the commoner file by far.
+ */
+function within(inner: Pt[], outer: Pt[]): boolean {
+  const step = Math.max(1, Math.floor(inner.length / 24));
+  for (let i = 0; i < inner.length; i += step) if (!inside(inner[i], outer)) return false;
+  return true;
+}
+
+function inside(pt: Pt, ring: Pt[]): boolean {
+  let hit = false;
+  for (let i = 0, j = ring.length - 1; i < ring.length; j = i++) {
+    const [xi, yi] = ring[i], [xj, yj] = ring[j];
+    if (yi > pt[1] !== yj > pt[1] && pt[0] < ((xj - xi) * (pt[1] - yi)) / (yj - yi) + xi) hit = !hit;
+  }
+  return hit;
+}
+
+/** The index in `ring` nearest `p`, coarse then refined — a full scan per hole is quadratic. */
+function nearestIndex(ring: Pt[], p: Pt): number {
+  const stride = Math.max(1, Math.floor(ring.length / 64));
+  let best = 0, bestD = Infinity;
+  for (let i = 0; i < ring.length; i += stride) {
+    const d = dist(ring[i], p);
+    if (d < bestD) { bestD = d; best = i; }
+  }
+  for (let i = Math.max(0, best - stride); i < Math.min(ring.length, best + stride + 1); i++) {
+    const d = dist(ring[i], p);
+    if (d < bestD) { bestD = d; best = i; }
+  }
+  return best;
+}
+
+/**
+ * One island and its holes as a single ring: out along a slit, around the hole, back along the same
+ * slit. The two slit EDGES are coincident, so the seam has no area — which is why the counterform
+ * comes back transparent instead of as a hairline.
+ *
+ * A hole is REVERSED when it winds the same way as its outer contour. CSS `polygon()` fills by
+ * NONZERO, so two same-wound contours give the counterform a winding number of 2 and it fills solid —
+ * the module's whole purpose, lost silently, on the commonest export there is. `fill-rule="evenodd"`
+ * art has no reason to wind its holes the other way, and both Illustrator and Figma emit it same-wound.
+ *
+ * Every bridge is measured against the ORIGINAL outer contour and spliced in from the last index
+ * back to the first. Measuring against the ring as it grew made the cost quadratic in the hole count:
+ * a mark with 80 counters took 50 seconds, and each doubling multiplied that by four.
+ */
+function weld(outer: Pt[], holes: Pt[][]): Pt[] {
+  if (!holes.length) return outer.slice();
+  const outerSign = Math.sign(ringArea(outer));
+
+  const bridges = holes.map((raw) => {
+    const hole = Math.sign(ringArea(raw)) === outerSign ? raw.slice().reverse() : raw;
+    const seed = nearestIndex(outer, hole[0]);
+    const hi = nearestIndex(hole, outer[seed]);
+    return { oi: nearestIndex(outer, hole[hi]), hole, hi };
+  });
+
+  let ring = outer.slice();
+  for (const b of bridges.sort((x, y) => y.oi - x.oi)) {
+    const bridge = [...b.hole.slice(b.hi), ...b.hole.slice(0, b.hi + 1)];
+    ring = [...ring.slice(0, b.oi + 1), ...bridge, ...ring.slice(b.oi)];
+  }
+  return ring;
+}
+
+/**
+ * Points closer together than `eps`, dropped against the last KEPT point.
+ *
+ * It is a chained comparison, so a dense run collapses further than `eps` — which is why `eps` is a
+ * twenty-thousandth of the mark rather than a visible fraction of it, and why curve density is
+ * settled by the flatness tolerance instead. At a visible `eps` this deletes the corner of a narrow
+ * stem and the letter loses its shape; that is a property of the algorithm, not a bug that was fixed.
+ */
+function thin(ring: Pt[], eps: number): Pt[] {
+  const out: Pt[] = [ring[0]];
+  for (const p of ring.slice(1)) if (dist(out[out.length - 1], p) > eps) out.push(p);
+  return out;
+}
+
+/**
+ * An attribute by name. The boundary is a space or a quote, never `\b`: a hyphen is a non-word
+ * character, so `\bwidth` matched inside `stroke-width` and `\bopacity` inside `stroke-opacity`, and
+ * whichever came first in the tag won. An 80-unit rect with `stroke-width="2"` written before it came
+ * out two units wide, and a filled path with `stroke-opacity="0"` was read as invisible and dropped.
+ */
+function attr(tag: string, name: string): string | undefined {
+  const m = tag.match(new RegExp(`(?:^|[\\s"'])${name}\\s*=\\s*(?:"([^"]*)"|'([^']*)')`, 'i'));
+  return m ? (m[1] ?? m[2]) : undefined;
+}
+
+/**
+ * A CSS length in user units: `24px`, `18pt` and a bare number read; `%`, `em`, `vw` and the rest do
+ * not, because they mean nothing without a viewport. Taking the leading number and discarding the
+ * unit turned `width="100%"` into 100 user units, and a 512-unit mark then emitted a polygon running
+ * to 512% of its own box — off screen, drawn as nothing, reported as a success.
+ */
+function length(v: string | undefined): number | undefined {
+  if (v === undefined) return undefined;
+  const m = v.trim().match(/^([-+]?[\d.]+(?:e[-+]?\d+)?)\s*([a-z%]*)$/i);
+  if (!m) return undefined;
+  const unit = m[2].toLowerCase();
+  if (unit && unit !== 'px' && unit !== 'pt') return undefined;
+  const n = Number(m[1]) * (unit === 'pt' ? 96 / 72 : 1);
+  return Number.isFinite(n) ? n : undefined;
+}
+
+/** `<rect>`, `<circle>`, `<ellipse>`, `<polygon>` and `<polyline>`, as path data. */
+function shapeToPath(tag: string, name: string): string | null {
+  const n = (a: string, d = 0) => length(attr(tag, a)) ?? d;
+  switch (name) {
+    case 'rect': {
+      const x = n('x'), y = n('y'), w = n('width'), h = n('height');
+      if (w <= 0 || h <= 0) return null;
+      const rx = Math.min(n('rx', n('ry')), w / 2), ry = Math.min(n('ry', n('rx')), h / 2);
+      if (!rx && !ry) return `M${x},${y}H${x + w}V${y + h}H${x}Z`;
+      return `M${x + rx},${y}H${x + w - rx}A${rx},${ry} 0 0 1 ${x + w},${y + ry}` +
+        `V${y + h - ry}A${rx},${ry} 0 0 1 ${x + w - rx},${y + h}` +
+        `H${x + rx}A${rx},${ry} 0 0 1 ${x},${y + h - ry}` +
+        `V${y + ry}A${rx},${ry} 0 0 1 ${x + rx},${y}Z`;
+    }
+    case 'circle': case 'ellipse': {
+      const cx = n('cx'), cy = n('cy');
+      const rx = name === 'circle' ? n('r') : n('rx'), ry = name === 'circle' ? n('r') : n('ry');
+      if (rx <= 0 || ry <= 0) return null;
+      return `M${cx - rx},${cy}A${rx},${ry} 0 1 0 ${cx + rx},${cy}A${rx},${ry} 0 1 0 ${cx - rx},${cy}Z`;
+    }
+    case 'polygon': case 'polyline': {
+      const nums = (attr(tag, 'points') ?? '').trim().split(/[\s,]+/).filter(Boolean).map(Number);
+      if (nums.length < 6 || nums.some((v) => !Number.isFinite(v))) return null;
+      // An odd count means the list is malformed, and a lone trailing value is not half a vertex.
+      const pairs = Math.floor(nums.length / 2);
+      return `M${Array.from({ length: pairs }, (_, i) => `${nums[i * 2]},${nums[i * 2 + 1]}`).join('L')}Z`;
+    }
+    default: return null; // <line> has no area to clip
+  }
+}
+
+/** Elements whose contents define something for later use and are never painted where they stand. */
+const CONTAINERS = new Set(['defs', 'clippath', 'mask', 'symbol', 'pattern', 'marker', 'filter']);
+
+/**
+ * Whether a tag is invisible, by any of the four ways an export says so.
+ *
+ * A hidden layer is not a definition, so the CONTAINERS skip never saw it — and a hidden full-bleed
+ * rectangle is the largest island in the file, which makes every real glyph a HOLE in it. The mark
+ * comes back knocked out of a solid block. Brand kits ship alternate lockups on hidden layers as a
+ * matter of course, and that is exactly the input this module exists to accept.
+ */
+function hidden(tag: string): boolean {
+  const style = attr(tag, 'style') ?? '';
+  if (/(?:^|;)\s*display\s*:\s*none/i.test(style)) return true;
+  if (/(?:^|;)\s*visibility\s*:\s*hidden/i.test(style)) return true;
+  if (/(?:^|;)\s*(?:fill-)?opacity\s*:\s*0*(?:\.0*)?\s*(?:;|$)/i.test(style)) return true;
+  if ((attr(tag, 'display') ?? '') === 'none') return true;
+  if ((attr(tag, 'visibility') ?? '') === 'hidden') return true;
+  for (const a of ['opacity', 'fill-opacity']) {
+    const v = attr(tag, a);
+    if (v !== undefined && Number(v) === 0) return true;
+  }
+  return false;
+}
+
+/**
+ * An SVG file as clip-path polygons — one shape per island, holes welded in.
+ *
+ * `minAreaRatio` drops islands smaller than that fraction of the largest one: an export often
+ * carries a stray sliver, and at 26px a sliver is a speck of dirt beside the mark. `flatness` is the
+ * curve tolerance as a fraction of the mark's own size.
+ *
+ * Throws on anything it cannot read. A logo that renders as nothing while the run reports success is
+ * the failure this exists to replace, so there is no quiet path out of here.
+ */
+export function svgToClip(
+  file: string,
+  opts: { minAreaRatio?: number; precision?: number; flatness?: number } = {},
+): ClipLogo {
+  const src = readFileSync(file, 'utf8');
+  const minAreaRatio = opts.minAreaRatio ?? 0.002;
+  const precision = opts.precision ?? 3;
+  const flatness = opts.flatness ?? 1 / 2500;
+
+  const svgTag = src.match(/<svg[^>]*>/i)?.[0];
+  if (!svgTag) throw new SvgClipError(`${file} has no <svg> element`);
+  const vb = (attr(svgTag, 'viewBox') ?? '').split(/[\s,]+/).filter(Boolean).map(Number);
+  const box = vb.length === 4 && vb.every((v) => Number.isFinite(v)) ? vb : undefined;
+  // `width="24px"` is a length, not a number. Read as one it is NaN, and NaN propagates through the
+  // flatness tolerance into every step count, so each curve emits zero points and the whole mark
+  // comes back as an empty shape list — an invisible logo, reported as a success.
+  const W = box ? box[2] : length(attr(svgTag, 'width'));
+  const H = box ? box[3] : length(attr(svgTag, 'height'));
+  if (!W || !H || W <= 0 || H <= 0) {
+    throw new SvgClipError(`${file} states no usable size — give it a viewBox, or a width and height`);
+  }
+  const X0 = box ? box[0] : 0, Y0 = box ? box[1] : 0;
+  const tol = Math.max(W, H) * flatness;
+
+  // A depth-tracked walk, so a <g transform> reaches the shapes under it. Nothing here parses XML
+  // properly on purpose: an export is machine-written and its tags do not nest ambiguously.
+  const stack: Mat[] = [I];
+  const fills: (string | undefined)[] = [undefined];
+  let skipDepth = 0;
+  const rings: { ring: Pt[]; fill?: string }[] = [];
+
+  for (const mt of src.matchAll(/<\/?\s*([a-z]+)\b([^>]*)>/gi)) {
+    const [whole, name] = mt;
+    const lower = name.toLowerCase();
+    const closing = whole.startsWith('</');
+    const selfClosing = whole.trimEnd().endsWith('/>');
+
+    // A <defs>, <clipPath> or <mask> subtree defines something; it is not drawn where it stands. Read
+    // as shapes, its contents become the largest island and every real glyph is then classified as a
+    // HOLE in it — the mark comes back knocked out of a full-bleed rectangle, with no error.
+    if (CONTAINERS.has(lower)) {
+      if (closing) skipDepth = Math.max(0, skipDepth - 1);
+      else if (!selfClosing) skipDepth++;
+      continue;
+    }
+    // Inside a skipped subtree nothing is read, but its nesting still has to be counted or the skip
+    // never ends and every shape after it is dropped.
+    if (skipDepth > 0) {
+      // BOTH tags that can open a skip must close it. Counting only `g` left a hidden `<svg>` — the
+      // sprite-block idiom, `<svg style="display:none">` wrapping symbols — skipping the whole rest of
+      // the file, and the error then blamed <defs> and stroke-only paths.
+      if (lower === 'g' || lower === 'svg') {
+        if (closing) skipDepth -= 1;
+        else if (!selfClosing) skipDepth++;
+      }
+      continue;
+    }
+
+    if (lower === 'g' || lower === 'svg') {
+      if (!closing && !selfClosing && hidden(whole)) { skipDepth++; continue; }
+      if (closing) {
+        // An export with more closing tags than opening ones must not empty the stack: the next
+        // shape would multiply against undefined and throw a TypeError with nothing to read in it.
+        if (stack.length > 1) { stack.pop(); fills.pop(); }
+      } else if (!selfClosing) {
+        stack.push(mul(stack[stack.length - 1], parseTransform(attr(whole, 'transform'))));
+        fills.push(attr(whole, 'fill') ?? fills[fills.length - 1]);
+      }
+      continue;
+    }
+    if (closing) continue;
+
+    const m = mul(stack[stack.length - 1], parseTransform(attr(whole, 'transform')));
+    const style = attr(whole, 'style') ?? '';
+    const fill = style.match(/(?:^|;)\s*fill\s*:\s*([^;]+)/i)?.[1].trim()
+      ?? attr(whole, 'fill')
+      ?? fills[fills.length - 1];
+    if (fill === 'none') continue; // stroke-only art has no area to clip
+    if (hidden(whole)) continue;
+    const d = lower === 'path' ? attr(whole, 'd') : shapeToPath(whole, lower);
+    if (!d) continue;
+    for (const ring of pathToRings(d, m, tol)) rings.push({ ring, fill });
+  }
+
+  if (!rings.length) {
+    throw new SvgClipError(`${file} yielded no filled shape — is every path stroke-only, or inside <defs>?`);
+  }
+
+  // Outer contours and holes: a ring inside an odd number of others is a hole in the innermost of them.
+  const areas = rings.map((r) => Math.abs(ringArea(r.ring)));
+  const maxArea = Math.max(...areas);
+  // Depth is counted within the ring's OWN element. Two separately painted shapes that overlap are
+  // not nested, and a classifier that cannot tell made one a hole in the other.
+  const depth = rings.map(({ ring }, i) =>
+    rings.reduce((n, other, j) => (j !== i && within(ring, other.ring) ? n + 1 : n), 0));
+
+  const shapes: ClipShape[] = [];
+  const eps = Math.max(W, H) / 20000;
+  rings.forEach(({ ring, fill }, i) => {
+    if (depth[i] % 2 !== 0) return;                       // this one is a hole in something
+    if (areas[i] < maxArea * minAreaRatio) return;        // export dirt
+    const holes = rings
+      .filter((r, j) => j !== i && depth[j] === depth[i] + 1 && within(r.ring, ring))
+      .map((h) => h.ring);
+    // Thin BEFORE welding, never after: the slit is two coincident points, and a pass that drops a
+    // point within eps of the last kept one would delete the second of them, leaving an open seam
+    // that renders as a hairline across the counterform.
+    const welded = weld(thin(ring, eps), holes.map((h) => thin(h, eps)));
+    const pts = welded.map(([x, y]) =>
+      `${(((x - X0) / W) * 100).toFixed(precision)}% ${(((y - Y0) / H) * 100).toFixed(precision)}%`);
+    // Only a colour a document could actually paint is worth reporting. `url(#grad)` and
+    // `currentColor` are what an export writes when the fill lives somewhere else, and a caller that
+    // took either of them for a background would paint nothing.
+    const plain = fill && fill !== 'currentColor' && /^(#[0-9a-f]{3,8}$|rgba?\(|hsla?\(|[a-z]+$)/i.test(fill)
+      ? fill : undefined;
+    shapes.push({ polygon: pts.join(', '), fill: plain });
+  });
+
+  if (!shapes.length) {
+    throw new SvgClipError(`${file} has shapes but none survived — every ring is a hole, or all are below minAreaRatio`);
+  }
+  return { width: W, height: H, aspect: W / H, shapes };
+}
+
+/**
+ * The logo as engine-ready HTML: one absolutely-positioned box per island, all sharing the mark's
+ * own box so the islands stay registered to each other.
+ *
+ * `colour` is REQUIRED. A mark over footage takes the document's ink, and a default would be a
+ * colour the run's design system never declared — which its own gate is right to refuse.
+ */
+export function clipLogoHtml(
+  logo: ClipLogo,
+  o: { id: string; left: number; top: number; height: number; colour: string; zIndex?: number },
+): { html: string; width: number; height: number } {
+  if (!(o.height > 0) || !(logo.aspect > 0)) throw new SvgClipError('the mark has no usable size');
+  const w = Math.round(o.height * logo.aspect);
+  const z = o.zIndex === undefined ? '' : `z-index:${o.zIndex}; `;
+  const html = logo.shapes
+    .map((s, i) =>
+      `<div id="${o.id}-${i}" style="position:absolute; ${z}left:${o.left}px; top:${o.top}px; ` +
+      `width:${w}px; height:${o.height}px; background:${o.colour}; ` +
+      `clip-path:polygon(${s.polygon})"></div>`)
+    .join('\n');
+  return { html, width: w, height: o.height };
+}
diff --git a/pipeline/recipes/type.ts b/pipeline/recipes/type.ts
new file mode 100644
index 0000000..6642ebe
--- /dev/null
+++ b/pipeline/recipes/type.ts
@@ -0,0 +1,63 @@
+// Typographic arithmetic.
+//
+// A delivered sheet carried the optical tracking curve as a table of ten hand-measured rungs, copied
+// into the documents that used it. Fitting those ten points shows the table is a straight line in
+// disguise: the ABSOLUTE spacing between glyphs falls linearly with size, from about half a pixel at
+// caption sizes to zero at display sizes, which is why the `em` value looks like a curve. The fit
+// reproduces all ten measured rungs to within 0.000043em.
+//
+// The table is one film's ten sizes. The line is the craft, and it answers for any size — which is
+// the difference between freezing a result and keeping what was learned.
+//
+// This matters because a ladder is what stops a film inventing a size per graphic. The 12-minute film
+// that motivated this used 23 distinct font sizes — 18, 19, 21, 22, 23, 24, 25, 26 among them — and
+// its tracking was mostly fine: 42px body at +0.0027em sits 0.0001em off this curve. Sizes chosen one
+// at a time are the defect; tracking is what makes each chosen size read as decided rather than typed.
+
+/** Absolute inter-glyph spacing in px at a given font size. Linear, fitted from measured rungs. */
+const SPACING_AT_ZERO = 0.9796;
+const SPACING_SLOPE = -0.02069;
+
+/** Optical letter-spacing in em for a font size in px. Bigger type takes tighter tracking. */
+export function opticalTracking(px: number, decimals = 4): number {
+  if (!Number.isFinite(px) || px <= 0) throw new Error(`opticalTracking: size must be a positive finite number, got ${px}`);
+  return Number(((SPACING_AT_ZERO + SPACING_SLOPE * px) / px).toFixed(decimals));
+}
+
+/** The size at which tracking crosses zero and goes negative — the boundary between reading and display. */
+export function trackingCrossoverPx(): number {
+  return Number((SPACING_AT_ZERO / -SPACING_SLOPE).toFixed(1));
+}
+
+export interface LadderStep { role: string; px: number; trackingEm: number }
+
+/**
+ * A type ladder on a fixed ratio, each rung carrying its own tracking.
+ *
+ * Rungs are built from a ratio rather than picked, because a ladder of arbitrary sizes is what lets
+ * a later element quietly introduce an eleventh size nobody decided on.
+ */
+export function ladder(opts: { base: number; ratio?: number; up?: number; down?: number; roles?: string[] }): LadderStep[] {
+  const { base, ratio = 1.25, up = 2, down = 2 } = opts;
+  if (!Number.isFinite(base) || base <= 0) throw new Error(`ladder: base must be a positive finite number, got ${base}`);
+  if (!(ratio > 1)) throw new Error(`ladder: ratio must be greater than 1, got ${ratio}`);
+  const steps: LadderStep[] = [];
+  for (let i = -down; i <= up; i++) {
+    const px = Math.round(base * ratio ** i);
+    steps.push({ role: '', px, trackingEm: opticalTracking(px) });
+  }
+  steps.sort((a, b) => b.px - a.px);
+  const roles = opts.roles ?? ['display', 'headline', 'subhead', 'body', 'kicker', 'micro'];
+  steps.forEach((s, i) => { s.role = roles[i] ?? `step-${i}`; });
+  return steps;
+}
+
+/**
+ * How far a declared tracking sits from the curve, in em.
+ *
+ * Deviation is not automatically wrong — a condensed face or an all-caps kicker legitimately wants
+ * more — so this reports the distance and lets the caller decide what is worth a finding.
+ */
+export function trackingDeviation(px: number, trackingEm: number): number {
+  return Number((trackingEm - opticalTracking(px)).toFixed(4));
+}
diff --git a/pipeline/scripts/brand.ts b/pipeline/scripts/brand.ts
new file mode 100644
index 0000000..c53e22d
--- /dev/null
+++ b/pipeline/scripts/brand.ts
@@ -0,0 +1,101 @@
+// The brand law, and the bone a SET of pieces shares.
+//
+// Every RACE-card brief in the launch session retyped the same block: the palette, the rule that white
+// and green carry everything and orange is a micro-accent only, the rule that type on a green plate is
+// the brand dark, where the mark sits, and the shared skeleton that made four cards read as one
+// campaign. Retyped four times, drifting each time, and the run that dropped the mark produced the
+// session's sharpest correction — the logo was not the one from the brandbook.
+//
+//   brand.ts --file <brand.json> --brief     # the law as prompt-ready prose
+//   brand.ts --file <brand.json> --check     # validate it before a run spends a render on it
+import { readFileSync, existsSync } from 'node:fs';
+import { resolve, dirname, isAbsolute, join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { parseFlags } from '../../veed/args.ts';
+
+export interface Brand {
+  name: string;
+  /** role → hex. Roles are the point: "ink"/"accent"/"ground" survive a palette swap, "#96FF1A" does not. */
+  palette: Record<string, string>;
+  /** Sentences that constrain how the palette may be spent. These are what a design pass gets wrong. */
+  colourLaw?: string[];
+  type?: { display?: string; body?: string; notes?: string };
+  /** A mark is a FILE, never a redrawing. `asset` is resolved relative to the brand file. */
+  logo?: { asset?: string; placement?: string; never?: string };
+  /** Present when several pieces are made together and must read as one campaign. */
+  set?: { shared: string[]; varies?: string[] };
+}
+
+export interface Problem { field: string; message: string }
+
+const HEX = /^#(?:[0-9a-f]{3}|[0-9a-f]{6})$/i;
+
+export function validate(brand: Brand, baseDir: string): Problem[] {
+  const out: Problem[] = [];
+  if (!brand.name?.trim()) out.push({ field: 'name', message: 'a brand with no name cannot be reported back to the user' });
+  const roles = Object.entries(brand.palette ?? {});
+  if (!roles.length) out.push({ field: 'palette', message: 'no palette — the design pass would invent one' });
+  for (const [role, hex] of roles) {
+    if (!HEX.test(hex)) out.push({ field: `palette.${role}`, message: `"${hex}" is not a hex colour` });
+    if (/^#?[0-9a-f]{3,6}$/i.test(role)) {
+      out.push({ field: `palette.${role}`, message: 'the KEY must be a role ("ink", "accent", "ground"), not the colour again — a role survives a palette swap' });
+    }
+  }
+  // The corpus's asset-fidelity class is 17 records: a mark drawn by hand instead of taken from the
+  // file the user supplied. A brand that names an asset which is not there invites exactly that.
+  if (brand.logo?.asset) {
+    const p = isAbsolute(brand.logo.asset) ? brand.logo.asset : join(baseDir, brand.logo.asset);
+    if (!existsSync(p)) out.push({ field: 'logo.asset', message: `${brand.logo.asset} does not exist — a design pass told to use a missing mark draws its own` });
+  }
+  if (brand.set && !brand.set.shared?.length) {
+    out.push({ field: 'set.shared', message: 'a set with nothing shared is not a set — name the bone every piece keeps' });
+  }
+  return out;
+}
+
+export function briefFor(brand: Brand, baseDir: string): string {
+  const lines: string[] = [`THE BRAND — ${brand.name}. It is the design authority; on any collision with a direction, it wins.`];
+  lines.push(`  Palette (role → value, spend them by ROLE):`);
+  for (const [role, hex] of Object.entries(brand.palette ?? {})) lines.push(`    ${role}: ${hex}`);
+  if (brand.colourLaw?.length) {
+    lines.push(`  Colour law — these are constraints, not suggestions:`);
+    for (const l of brand.colourLaw) lines.push(`    · ${l}`);
+  }
+  if (brand.type) {
+    const t = [brand.type.display && `display ${brand.type.display}`, brand.type.body && `body ${brand.type.body}`]
+      .filter(Boolean).join(' · ');
+    if (t) lines.push(`  Type: ${t}`);
+    if (brand.type.notes) lines.push(`    ${brand.type.notes}`);
+  }
+  if (brand.logo) {
+    const p = brand.logo.asset
+      ? (isAbsolute(brand.logo.asset) ? brand.logo.asset : resolve(baseDir, brand.logo.asset))
+      : undefined;
+    lines.push(`  Mark: ${p ? `USE THE FILE at ${p} — never redraw it, never crop it out of a raster` : 'no asset supplied'}`);
+    if (brand.logo.placement) lines.push(`    Placement: ${brand.logo.placement}`);
+    if (brand.logo.never) lines.push(`    Never: ${brand.logo.never}`);
+  }
+  if (brand.set) {
+    lines.push(`  THE SHARED BONE — every piece in this set keeps these, so the set reads as one campaign:`);
+    for (const s of brand.set.shared) lines.push(`    · ${s}`);
+    if (brand.set.varies?.length) {
+      lines.push(`  What differs between pieces: ${brand.set.varies.join(', ')}. Compositions differ; the bone does not.`);
+    }
+  }
+  return lines.join('\n');
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const { values } = parseFlags({
+    args: process.argv.slice(2),
+    options: { file: { type: 'string' }, brief: { type: 'boolean' }, check: { type: 'boolean' } },
+  });
+  if (!values.file) { console.error('usage: brand.ts --file <brand.json> [--brief] [--check]'); process.exit(2); }
+  const path = resolve(values.file);
+  const brand = JSON.parse(readFileSync(path, 'utf8')) as Brand;
+  const problems = validate(brand, dirname(path));
+  if (values.brief && !problems.length) { console.log(briefFor(brand, dirname(path))); process.exit(0); }
+  for (const p of problems) console.error(`BRAND[${p.field}] ${p.message}`);
+  if (problems.length) { console.error(`brand: ${problems.length} problem(s)`); process.exit(1); }
+  console.log('brand: valid');
+}
diff --git a/pipeline/scripts/concat-chapters.ts b/pipeline/scripts/concat-chapters.ts
new file mode 100644
index 0000000..22f260e
--- /dev/null
+++ b/pipeline/scripts/concat-chapters.ts
@@ -0,0 +1,115 @@
+// Chapters into a film.
+//
+// A long piece is authored one document per chapter, because one `.wv` holding twelve minutes is a
+// document nobody can gate, fix or re-render in part. Each chapter goes through the gate chain and
+// lands its own `out.mp4` — and then nothing joined them WITHOUT TRANSCODING. The gate chain says it
+// runs "design → lint → verify → record → probe → mux"; that is true of a chapter and stops there.
+//
+// `concat-videos.ts` also joins mp4s, and is the wrong tool here: it exists for generated clips that
+// disagree — different shapes, some without audio — so it re-encodes onto one canvas and normalises the
+// frame rate. Engine renders agree by construction, and a twelve-minute film must not be transcoded
+// once per assembly, nor have its fps resampled.
+//
+// The concat demuxer copies streams rather than re-encoding, which is what keeps a twelve-minute film
+// from being transcoded once per assembly. It requires every part to share codec parameters — the
+// engine renders them identically and `mux-audio.sh` encodes aac for all of them, so they do. That
+// requirement is checked rather than assumed: a mismatch here produces a file that plays for one
+// chapter and then glitches, which is the kind of defect nobody sees until the whole thing is watched.
+import { execFileSync } from 'node:child_process';
+import { writeFileSync, existsSync, mkdirSync } from 'node:fs';
+import { join, dirname, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { parseFlags } from '../../veed/args.ts';
+import { FFMPEG, FFPROBE } from '../../config.ts';
+
+/** The demuxer's list format. Single quotes in a path are escaped the way ffmpeg expects. */
+export function concatList(parts: string[]): string {
+  if (!parts.length) throw new Error('concat: no chapters given');
+  return parts.map((p) => `file '${resolve(p).replace(/'/g, "'\\''")}'`).join('\n') + '\n';
+}
+
+export interface StreamShape {
+  codec: string;
+  width: number;
+  height: number;
+  fps: string;
+  audioCodec: string;
+  sampleRate: string;
+  channels: number;
+}
+
+export function shapeOf(file: string): StreamShape {
+  const out = execFileSync(FFPROBE, [
+    '-v', 'error', '-show_entries',
+    'stream=codec_name,codec_type,width,height,r_frame_rate,sample_rate,channels',
+    '-of', 'json', file,
+  ], { encoding: 'utf8' });
+  const streams = (JSON.parse(out) as { streams: Record<string, unknown>[] }).streams;
+  const v = streams.find((s) => s.codec_type === 'video') ?? {};
+  const a = streams.find((s) => s.codec_type === 'audio') ?? {};
+  return {
+    codec: String(v.codec_name ?? ''),
+    width: Number(v.width ?? 0),
+    height: Number(v.height ?? 0),
+    fps: String(v.r_frame_rate ?? ''),
+    audioCodec: String(a.codec_name ?? ''),
+    sampleRate: String(a.sample_rate ?? ''),
+    channels: Number(a.channels ?? 0),
+  };
+}
+
+/** What differs between two parts, in words a person can act on. */
+export function shapeDiff(a: StreamShape, b: StreamShape): string[] {
+  const out: string[] = [];
+  if (a.codec !== b.codec) out.push(`video codec ${a.codec} vs ${b.codec}`);
+  if (a.width !== b.width || a.height !== b.height) out.push(`canvas ${a.width}x${a.height} vs ${b.width}x${b.height}`);
+  if (a.fps !== b.fps) out.push(`fps ${a.fps} vs ${b.fps}`);
+  if (a.audioCodec !== b.audioCodec) out.push(`audio codec ${a.audioCodec || 'none'} vs ${b.audioCodec || 'none'}`);
+  if (a.sampleRate !== b.sampleRate) out.push(`sample rate ${a.sampleRate} vs ${b.sampleRate}`);
+  if (a.channels !== b.channels) out.push(`channels ${a.channels} vs ${b.channels}`);
+  return out;
+}
+
+export function concat(parts: string[], outPath: string, listPath: string): string {
+  for (const p of parts) if (!existsSync(p)) throw new Error(`concat: no such chapter render — ${p}`);
+  const shapes = parts.map(shapeOf);
+  for (let i = 1; i < shapes.length; i++) {
+    const d = shapeDiff(shapes[0], shapes[i]);
+    if (d.length) {
+      throw new Error(
+        `concat: ${parts[i]} does not match ${parts[0]} — ${d.join(', ')}. Copying streams needs them ` +
+        'identical; re-render the odd chapter at the film\'s canvas and fps rather than transcoding here.',
+      );
+    }
+  }
+  mkdirSync(dirname(listPath), { recursive: true });
+  writeFileSync(listPath, concatList(parts));
+  mkdirSync(dirname(outPath), { recursive: true });
+  execFileSync(FFMPEG, [
+    '-y', '-hide_banner', '-loglevel', 'error',
+    '-f', 'concat', '-safe', '0', '-i', listPath,
+    '-c', 'copy', '-movflags', '+faststart', outPath,
+  ]);
+  return outPath;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const { values, positionals } = parseFlags({
+    args: process.argv.slice(2),
+    options: { doc: { type: 'string', multiple: true }, out: { type: 'string' } },
+    allowPositionals: true,
+  });
+  const [runDir] = positionals;
+  const docs = (values.doc as string[] | undefined) ?? [];
+  if (!runDir || !docs.length) {
+    console.error('usage: concat-chapters.ts <run-dir> --doc chapters/act-1 --doc chapters/act-2 [...] [--out final/out.mp4]');
+    process.exit(2);
+  }
+  // Order is the order the flags were given. Deriving it from a directory listing would put act-10
+  // before act-2, and a film whose chapters play in the wrong order is not a failure anyone notices
+  // in a gate.
+  const parts = docs.map((d) => join(runDir, d, 'out.mp4'));
+  const out = join(runDir, values.out ?? 'final/out.mp4');
+  concat(parts, out, join(runDir, 'final', 'concat.txt'));
+  console.log(`concat: ${parts.length} chapters → ${out}`);
+}
diff --git a/pipeline/scripts/creative-log.ts b/pipeline/scripts/creative-log.ts
new file mode 100644
index 0000000..fee2a0a
--- /dev/null
+++ b/pipeline/scripts/creative-log.ts
@@ -0,0 +1,145 @@
+// What has already been tried on a piece of footage, and why the accepted version was accepted.
+//
+// The launch session carried both by hand. Every creative brief it wrote ended with an "ALREADY TRIED
+// ON THIS CLIP AND REJECTED" list and, once something landed, a sentence naming why: "the colours
+// worked with the background rather than fighting it, it was graphic, bright and punchy, and the
+// typefaces were interestingly chosen." That worked — the later rounds genuinely diverged — but it
+// lived in the orchestrator's context, which means it was retyped for every agent and erased by the
+// first compaction. Three rounds of "you approached them all the same way" came from exactly that.
+//
+// The log is keyed by the SOURCE VIDEO, not the run: rounds two, three and four of a treatment are
+// different run dirs on the same footage, and it is the footage that accumulates history.
+//
+//   creative-log.ts --for <video> --reject "<what it was>" --why "<why it was rejected>"
+//   creative-log.ts --for <video> --accept "<aesthetic>"   --why "<why it landed>"
+//   creative-log.ts --for <video> --brief          # the accumulated history, ready to paste
+import { readFileSync, writeFileSync, existsSync, mkdirSync, renameSync } from 'node:fs';
+import { resolve, join, dirname } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { parseFlags } from '../../veed/args.ts';
+import { REPO_ROOT } from '../../config.ts';
+
+export interface Attempt { what: string; why: string }
+export interface CreativeLog {
+  source: string;
+  rejected: Attempt[];
+  /** The last accepted look. A later acceptance replaces it; the rejections only ever accumulate. */
+  accepted?: Attempt;
+}
+
+// Overridable so a test never writes into the real one. The suite once deleted the production log on
+// every run — the artifact whose whole purpose is surviving a compaction did not survive `pnpm test`.
+const LOG_PATH = process.env.OPEN_EDIT_CREATIVE_LOG ?? join(REPO_ROOT, 'runs', '.creative-log.json');
+
+type Store = Record<string, CreativeLog>;
+
+let corrupt = false;
+
+function load(): Store {
+  corrupt = false;
+  if (!existsSync(LOG_PATH)) return {};
+  try {
+    return JSON.parse(readFileSync(LOG_PATH, 'utf8')) as Store;
+  } catch {
+    // Reading through a corrupt log is fine — history is a helper, not a gate. Writing through it is
+    // not: the empty fallback would erase the reject/accept history of every clip on the machine.
+    corrupt = true;
+    return {};
+  }
+}
+
+function save(store: Store): void {
+  mkdirSync(dirname(LOG_PATH), { recursive: true });
+  if (corrupt && existsSync(LOG_PATH)) {
+    let dest = LOG_PATH.replace(/\.json$/, '.corrupt.json');
+    let n = 1;
+    while (existsSync(dest)) dest = LOG_PATH.replace(/\.json$/, `.corrupt.${n++}.json`);
+    renameSync(LOG_PATH, dest);
+    process.stderr.write(`[creative-log] the log could not be parsed and was kept at ${dest}; starting a new one\n`);
+    corrupt = false;
+  }
+  writeFileSync(LOG_PATH, JSON.stringify(store, null, 2) + '\n');
+}
+
+export function logFor(source: string, store: Store = load()): CreativeLog {
+  const key = resolve(source);
+  return store[key] ?? { source: key, rejected: [] };
+}
+
+export function reject(source: string, what: string, why: string): CreativeLog {
+  const store = load();
+  const log = logFor(source, store);
+  // The same attempt reported twice is one attempt; a re-run should not inflate the history.
+  if (!log.rejected.some((r) => r.what === what)) log.rejected.push({ what, why });
+  store[log.source] = log;
+  save(store);
+  return log;
+}
+
+export function accept(source: string, what: string, why: string): CreativeLog {
+  const store = load();
+  const log = logFor(source, store);
+  log.accepted = { what, why };
+  store[log.source] = log;
+  save(store);
+  return log;
+}
+
+/**
+ * The history as prompt-ready prose. Empty when nothing has been tried, so a first round carries no
+ * ceremony — and a design pass never has to be told that the list is empty.
+ */
+export function briefFor(source: string): string {
+  const log = logFor(source);
+  const parts: string[] = [];
+  if (log.accepted) {
+    parts.push(
+      `WHAT THE CLIENT ACCEPTED ON THIS FOOTAGE, AND WHY — this is the bar, not a thing to copy:\n` +
+      `  ${log.accepted.what}\n  Why it landed: ${log.accepted.why}`,
+    );
+  }
+  if (log.rejected.length) {
+    parts.push(
+      `ALREADY TRIED ON THIS FOOTAGE AND REJECTED — do not land on any of these again:\n` +
+      log.rejected.map((r) => `  · ${r.what}${r.why ? ` — rejected because ${r.why}` : ''}`).join('\n'),
+    );
+  }
+  return parts.join('\n\n');
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const { values } = parseFlags({
+    args: process.argv.slice(2),
+    options: {
+      for: { type: 'string' },
+      reject: { type: 'string' },
+      accept: { type: 'string' },
+      why: { type: 'string' },
+      brief: { type: 'boolean' },
+    },
+  });
+  const source = values.for;
+  if (!source) {
+    console.error('usage: creative-log.ts --for <video> [--reject "<what>" --why "<why>"] [--accept "<aesthetic>" --why "<why>"] [--brief]');
+    process.exit(2);
+  }
+  if (values.brief) {
+    const text = briefFor(source);
+    console.log(text || '(nothing tried on this footage yet)');
+    process.exit(0);
+  }
+  if (values.reject === undefined && values.accept === undefined) {
+    console.error('nothing to record: pass --reject, --accept, or --brief');
+    process.exit(2);
+  }
+  // A rejection with no reason is the part that stops being useful three rounds later, when nobody
+  // remembers whether the look was wrong or merely early.
+  if (!values.why) {
+    console.error('--why is required: a list of rejected looks with no reasons cannot tell a later pass what to avoid');
+    process.exit(2);
+  }
+  const log = values.accept !== undefined
+    ? accept(source, values.accept, values.why)
+    : reject(source, values.reject!, values.why);
+  console.log(`[creative-log] ${values.accept !== undefined ? 'accepted' : 'rejected'} recorded — ${log.rejected.length} rejection(s) on file for this footage`);
+}
diff --git a/pipeline/scripts/cut-frames.ts b/pipeline/scripts/cut-frames.ts
new file mode 100644
index 0000000..bedcdc3
--- /dev/null
+++ b/pipeline/scripts/cut-frames.ts
@@ -0,0 +1,204 @@
+// The frames a uniform grid never looks at.
+//
+//   node --import tsx pipeline/scripts/cut-frames.ts <video> [--out <dir>] [--json] [--threshold 0.15]
+//                                                    [--after 3] [--no-sheets]
+//
+// WHY THIS EXISTS. A run sampled its deliverable at 1.2, 3.8, 9.5, 15.0 and 21.5 seconds and called
+// the composite clean. Its cuts were at 1.83, 5.29, 8.58, 10.75, 14.25, 19.54 and 20.67 — not one
+// sample was within four tenths of a cut, and the defect it was looking for lives ONLY at a cut: the
+// matted speaker lagged the background by a few frames, so for an instant a person from the previous
+// shot stood in front of the next one. Evenly spaced frames are the wrong frames. A cut is where two
+// layers can disagree, where a caption can survive a shot it was never meant to cross, and where a
+// generated take shows its seams — so those are the frames to pull.
+//
+// Detection is ffmpeg's own scene score, and the frames come out as a contact sheet per cut: the last
+// frame BEFORE it and the first few after, so a layer that arrives late is visible as itself rather
+// than inferred.
+import { execFileSync } from 'node:child_process';
+import { mkdirSync, existsSync, statSync, copyFileSync } from 'node:fs';
+import { join, basename } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { parseFlags } from '../../veed/args.ts';
+import { FFMPEG, FFPROBE } from '../../config.ts';
+
+export interface Cut { tSec: number; score: number }
+
+/** Nominal fps, so a time can be named as a frame the way the rest of the pipeline names them. */
+export function fpsOf(video: string): number {
+  const r = execFileSync(FFPROBE, [
+    '-v', 'error', '-select_streams', 'v:0',
+    '-show_entries', 'stream=r_frame_rate', '-of', 'default=nw=1:nk=1', video,
+  ], { encoding: 'utf8' }).trim();
+  const [n, d] = r.split('/').map(Number);
+  const fps = d ? n / d : n;
+  if (!Number.isFinite(fps) || fps <= 0) {
+    throw new Error(`${video}: ffprobe reports r_frame_rate "${r}" — no usable frame rate, so a cut cannot be named as a frame`);
+  }
+  return fps;
+}
+
+export function durationOf(video: string): number {
+  const read = (entry: string) => execFileSync(FFPROBE, [
+    '-v', 'error', '-select_streams', 'v:0', '-show_entries', entry, '-of', 'default=nw=1:nk=1', video,
+  ], { encoding: 'utf8' }).trim();
+  // A container with no format duration prints `N/A`, which reads as NaN — and every tile time then
+  // fails `t < durationSec`, so the tool wrote no sheets at all and still exited 0 saying "LOOK at the
+  // strips". The video stream carries its own duration when the container does not.
+  for (const entry of ['format=duration', 'stream=duration']) {
+    const v = Number(read(entry));
+    if (Number.isFinite(v) && v > 0) return v;
+  }
+  throw new Error(`${video}: ffprobe reports no usable duration — a cut cannot be placed in a clip of unknown length`);
+}
+
+/** ffmpeg's metadata printer, as time/score pairs in time order. It deduplicates nothing. */
+export function parseSceneMetadata(out: string): Cut[] {
+  const raw: Cut[] = [];
+  let pending: number | null = null;
+  for (const line of out.split('\n')) {
+    const t = line.match(/pts_time:([\d.]+)/);
+    if (t) { pending = Number(t[1]); continue; }
+    const s = line.match(/scene_score=([\d.]+)/);
+    if (s && pending !== null) { raw.push({ tSec: pending, score: Number(s[1]) }); pending = null; }
+  }
+  return raw.sort((a, b) => a.tSec - b.tSec);
+}
+
+/**
+ * Detections within two frames of each other are one cut seen twice — a dissolve scores on several
+ * consecutive frames — so the strongest score of a run is kept at the time of its FIRST detection.
+ *
+ * The window slides from the most recent detection, not from the start of the run: measuring it from
+ * the start split a four-frame dissolve into three cuts. But sliding alone is transitively closed, so
+ * a strobe, a whip pan or `--threshold 0` produced an unbroken chain and the WHOLE CLIP reported as
+ * one cut, swallowing every real boundary inside it. A run is therefore also capped.
+ *
+ * The cap is in SECONDS, because a dissolve is half a second whatever the frame rate is. Counted in
+ * frames, one 0.5 s cross-dissolve came back as one cut at 24 fps, two at 30 and three at 60 — the
+ * same edit, three answers, because the footage was shot faster.
+ */
+export function mergeAdjacent(cuts: Cut[], fps: number, maxRunSec = 0.5): Cut[] {
+  const merged: Cut[] = [];
+  // The window slides from the most recent DETECTION while the reported time stays at the first one:
+  // a dissolve scores on a run of consecutive frames, and measuring the gap from the start of the run
+  // instead split a four-frame dissolve into three cuts.
+  let lastSeen = -Infinity;
+  for (const c of cuts) {
+    const last = merged[merged.length - 1];
+    const withinGap = last !== undefined && c.tSec - lastSeen < 2 / fps;
+    const withinRun = last !== undefined && c.tSec - last.tSec < maxRunSec + 0.5 / fps;
+    if (withinGap && withinRun) {
+      if (c.score > last.score) merged[merged.length - 1] = { tSec: last.tSec, score: c.score };
+    } else merged.push(c);
+    lastSeen = c.tSec;
+  }
+  return merged;
+}
+
+/** The frame before the cut, then `after` frames from it — sampled at frame centres, clamped to the clip. */
+export function tileTimes(cut: Cut, fps: number, durationSec: number, after: number): number[] {
+  return [-1, ...Array.from({ length: Math.max(0, after) }, (_, k) => k)]
+    .map((k) => cut.tSec + (k + 0.5) / fps)
+    .filter((t) => t >= 0 && t < durationSec);
+}
+
+/** Every shot boundary, by scene score. */
+export function cutsIn(video: string, threshold = 0.15): Cut[] {
+  const out = execFileSync(FFMPEG, [
+    '-v', 'error', '-i', video,
+    '-filter_complex', `select='gt(scene,${threshold})',metadata=print:file=-`,
+    '-an', '-f', 'null', '-',
+  ], { encoding: 'utf8', maxBuffer: 32 * 1024 * 1024 });
+  return mergeAdjacent(parseSceneMetadata(out), fpsOf(video));
+}
+
+/**
+ * One contact sheet per cut: the frame before it and `after` frames from it on.
+ *
+ * The sheet is the deliverable of this tool. A number in a report ("7 cuts detected") is not
+ * something anyone can be wrong in front of; a strip showing the same hand in two positions is.
+ */
+export function sheetsForCuts(
+  video: string,
+  cuts: Cut[],
+  outDir: string,
+  o: { after?: number; width?: number } = {},
+): string[] {
+  const after = o.after ?? 3;
+  const width = o.width ?? 320;
+  const fps = fpsOf(video);
+  const dur = durationOf(video);
+  mkdirSync(outDir, { recursive: true });
+
+  const sheets: string[] = [];
+  cuts.forEach((cut, i) => {
+    const stem = `cut${String(i + 1).padStart(2, '0')}`;
+    const tiles = tileTimes(cut, fps, dur, after).map((t, k) => {
+      const p = join(outDir, `${stem}-${k}.png`);
+      execFileSync(FFMPEG, ['-y', '-v', 'error', '-ss', String(t), '-i', video,
+        '-frames:v', '1', '-vf', `scale=${width}:-1`, p]);
+      // A seek past the end of the video stream exits 0 and writes nothing, so the file's existence
+      // is not evidence that a frame came out of it.
+      return existsSync(p) && statSync(p).size > 0 ? p : undefined;
+    }).filter((p): p is string => p !== undefined);
+
+    if (!tiles.length) return;
+    const sheet = join(outDir, `${stem}.png`);
+    // hstack takes two inputs at the minimum; a cut in the last frames of the clip can leave one.
+    if (tiles.length === 1) copyFileSync(tiles[0], sheet);
+    else {
+      execFileSync(FFMPEG, ['-y', '-v', 'error',
+        ...tiles.flatMap((t) => ['-i', t]),
+        '-filter_complex', `hstack=inputs=${tiles.length}`, '-frames:v', '1', sheet]);
+    }
+    sheets.push(sheet);
+  });
+  return sheets;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const { values, positionals } = parseFlags({
+    args: process.argv.slice(2),
+    options: {
+      out: { type: 'string' },
+      json: { type: 'boolean' },
+      threshold: { type: 'string' },
+      after: { type: 'string' },
+      'no-sheets': { type: 'boolean' },
+    },
+    allowPositionals: true,
+  });
+  const [video] = positionals;
+  if (!video || !existsSync(video)) {
+    console.error('usage: cut-frames.ts <video> [--out <dir>] [--json] [--threshold 0.15] [--after 3] [--no-sheets]');
+    process.exit(2);
+  }
+
+  const num = (name: string, raw: string | undefined, min: number, max: number): number | undefined => {
+    if (raw === undefined) return undefined;
+    const v = Number(raw);
+    if (!Number.isFinite(v) || v < min || v > max) {
+      console.error(`--${name} must be a number between ${min} and ${max}, got "${raw}"`);
+      process.exit(2);
+    }
+    return v;
+  };
+  // A threshold of 0 fires on every frame and turns the whole clip into one merged run.
+  const cuts = cutsIn(video, num('threshold', values.threshold, 0.01, 1));
+  const fps = fpsOf(video);
+  const outDir = values.out ?? join(process.cwd(), 'qa', `cuts-${basename(video).replace(/\.\w+$/, '')}`);
+  const sheets = values['no-sheets'] ? [] : sheetsForCuts(video, cuts, outDir, {
+    after: num('after', values.after, 0, 32),
+  });
+
+  if (values.json) {
+    console.log(JSON.stringify({ video, fps, cuts, sheets }, null, 2));
+  } else {
+    console.log(`${cuts.length} cut(s) at ${fps} fps`);
+    for (const [i, c] of cuts.entries()) {
+      console.log(`  cut ${i + 1}: ${c.tSec.toFixed(3)}s (frame ${Math.round(c.tSec * fps)}) score ${c.score.toFixed(3)}`);
+    }
+    if (sheets.length) console.log(`\nOne strip per cut — the frame before it, then the frames after — in ${outDir}`);
+    console.log('LOOK at the strips. A layer that changes on a different frame from the rest of the picture is the defect these frames exist to show.');
+  }
+}
diff --git a/pipeline/scripts/design-gate.ts b/pipeline/scripts/design-gate.ts
new file mode 100644
index 0000000..f9b7f42
--- /dev/null
+++ b/pipeline/scripts/design-gate.ts
@@ -0,0 +1,142 @@
+// The gate that reads a run's authored documents back against its own design system.
+//
+//   node --import tsx pipeline/scripts/design-gate.ts <run-dir> [--doc <subdir>] [--json]
+//
+// Exits 1 on any error-severity finding. Run it before the render, not after: every finding here is
+// a string in a document, and fixing one after a 12-minute encode costs three minutes of machine
+// time to learn what a regex knew instantly.
+import { readFileSync, existsSync, readdirSync, statSync } from 'node:fs';
+import { join, relative } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { parseFlags } from '../../veed/args.ts';
+import { REPO_ROOT } from '../../config.ts';
+import { readSystem, assertGrounded, check, checkLadder, checkFonts, checkDeclaredUsed, type DesignSystem, type Finding } from '../design/system.ts';
+
+/** Every `.wv` under the run, or under one chapter of it, in a stable order. */
+export function documentsIn(runDir: string, doc?: string): string[] {
+  const root = doc ? join(runDir, doc) : runDir;
+  return walkFor(root);
+}
+
+/**
+ * The wcag pass writes `template.draft.wv`, `template.final.wv` and `template.draft.wcag-remediated.wv`
+ * beside the document it is remediating, and on promotion `template.wv` IS the remediated content. A
+ * walk that took every `.wv` therefore gated four documents on a one-document run the second time it
+ * ran, and reported findings against drafts that ship nowhere.
+ */
+const INTERMEDIATE = /\.(draft|final)\.wv$|\.wcag-remediated\.wv$/i;
+
+function walkFor(root: string): string[] {
+  const out: string[] = [];
+  const walk = (dir: string) => {
+    for (const name of readdirSync(dir).sort()) {
+      const p = join(dir, name);
+      if (statSync(p).isDirectory()) { if (name !== 'qa' && !name.startsWith('.')) walk(p); }
+      else if (name.endsWith('.wv') && !INTERMEDIATE.test(name)) out.push(p);
+    }
+  };
+  if (existsSync(root)) walk(root);
+  return out;
+}
+
+/**
+ * Donors must be real. The point of the field is that "I used the recipes" stops being a sentence in
+ * a report and becomes a claim that can be false — a run once said it took its motion mechanics from
+ * the bank while two of the four named mechanics existed in no sheet at all.
+ */
+export function checkDonors(sys: DesignSystem): Finding[] {
+  const indexPath = join(REPO_ROOT, 'refs', 'tags.json');
+  if (!existsSync(indexPath)) return [];
+  const index = JSON.parse(readFileSync(indexPath, 'utf8')) as { refs?: { id: string }[] } | { id: string }[];
+  const ids = new Set((Array.isArray(index) ? index : index.refs ?? []).map((r) => r.id));
+  return sys.donors
+    .filter((d) => !ids.has(d))
+    .map((d) => ({ rule: 'donor-not-in-index', severity: 'error' as const, message: `donor "${d}" is not a ref in refs/tags.json — a system cannot be seeded from something that does not exist` }));
+}
+
+/**
+ * `doc` gates ONE chapter of a longer piece.
+ *
+ * It also turns off the declared-but-unused check, which is a statement about the whole piece: a film
+ * is authored a chapter at a time, so every rung and family that first appears in a later chapter
+ * would be an error until the last document existed. Chapter one could not pass until the film was
+ * finished, and the only way past was to disable the design gate entirely.
+ */
+export function gate(runDir: string, opts: { doc?: string } = {}): { findings: (Finding & { file?: string })[]; documents: number } {
+  const sys = readSystem(runDir);
+  if (!sys) {
+    return {
+      documents: 0,
+      findings: [{
+        rule: 'no-design-system',
+        severity: 'error',
+        message: `${relative(REPO_ROOT, join(runDir, 'design', 'system.json'))} does not exist — author the system before the documents, from the run's own content`,
+      }],
+    };
+  }
+  const findings: (Finding & { file?: string })[] = [];
+  try {
+    assertGrounded(runDir, sys);
+  } catch (e) {
+    findings.push({ rule: 'system-not-grounded', severity: 'error', message: (e as Error).message });
+  }
+  findings.push(...checkLadder(sys));
+  findings.push(...checkFonts(sys));
+  findings.push(...checkDonors(sys));
+
+  const docs = documentsIn(runDir, opts.doc);
+  if (!docs.length) {
+    findings.push({
+      rule: 'no-documents',
+      severity: 'error',
+      message: opts.doc
+        ? `no .wv under ${opts.doc} — check the --doc path; a gate that reads nothing is not a gate that passed`
+        : 'no .wv anywhere under the run — nothing was gated',
+    });
+  }
+  const texts: string[] = [];
+  for (const doc of docs) {
+    const text = readFileSync(doc, 'utf8');
+    texts.push(text);
+    for (const f of check(text, sys)) {
+      findings.push({ ...f, file: relative(runDir, doc) });
+    }
+  }
+  // Both directions, and only once the WHOLE run is read: a rung used in the outro alone is used.
+  if (docs.length && !opts.doc) findings.push(...checkDeclaredUsed(texts, sys));
+  return { findings, documents: docs.length };
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const { values, positionals } = parseFlags({
+    args: process.argv.slice(2),
+    options: { json: { type: 'boolean' }, doc: { type: 'string' } },
+    allowPositionals: true,
+  });
+  const [runDir] = positionals;
+  if (!runDir) { console.error('usage: design-gate.ts <run-dir> [--doc <subdir>] [--json]'); process.exit(2); }
+
+  const { findings, documents } = gate(runDir, { doc: values.doc });
+  const errors = findings.filter((f) => f.severity === 'error').length;
+  if (values.json) {
+    console.log(JSON.stringify(findings, null, 2));
+  } else {
+    // Findings repeat across documents; one line per distinct message with a count reads better than
+    // the same tracking error printed 217 times.
+    const seen = new Map<string, { f: Finding & { file?: string }; n: number }>();
+    for (const f of findings) {
+      const k = `${f.rule}|${f.message}`;
+      const e = seen.get(k);
+      if (e) e.n++;
+      else seen.set(k, { f, n: 1 });
+    }
+    for (const { f, n } of seen.values()) {
+      const where = f.file ? ` (${f.file}${n > 1 ? ` +${n - 1} more` : ''})` : '';
+      console.log(`${f.severity.toUpperCase()}[${f.rule}] ${f.message}${where}`);
+    }
+    console.log(errors
+      ? `design-gate: ${errors} error(s) across ${documents} document(s)`
+      : `design-gate: clean (${documents} document(s), ${findings.length} warning(s))`);
+  }
+  if (errors) process.exit(1);
+}
diff --git a/pipeline/scripts/expect-windows.ts b/pipeline/scripts/expect-windows.ts
new file mode 100644
index 0000000..48705af
--- /dev/null
+++ b/pipeline/scripts/expect-windows.ts
@@ -0,0 +1,207 @@
+// Turn the document's own gate timings into assertions `--verify` can fail on.
+//
+// The engine already accepts a `verify.expect` block in the manifest — "this element must be visible
+// from 2.1s to 3.4s" — and it has gone essentially unused, because writing the list by hand for forty
+// cues is nobody's idea of a good time. The document already states every window, so the list can be
+// derived rather than written.
+//
+// This closes the corpus's largest class. `timing-offset` is 30 recorded corrections — a reveal
+// that starts late, a beat that holds too long, a caption still up when the next one arrives — and
+// none of them are visible to `--verify` today, because verify checks what IS drawn and every one of
+// these documents draws something. An expectation is what makes "drawn at the wrong time" a failure.
+//
+//   expect-windows.ts <run-dir> [--write] [--tolerance-ms 40]
+import { readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { parseFlags } from '../../veed/args.ts';
+
+export interface Expectation {
+  element: string;
+  visible: boolean;
+  from: number;
+  to: number;
+}
+
+/** ms from a CSS time token. */
+function ms(tok: string | undefined): number | undefined {
+  const m = tok?.trim().match(/^(-?[\d.]+)(ms|s)$/);
+  if (!m) return undefined;
+  return m[2] === 's' ? Number(m[1]) * 1000 : Number(m[1]);
+}
+
+function keyframeNames(css: string): Map<string, string> {
+  const out = new Map<string, string>();
+  const re = /@keyframes\s+([\w-]+)\s*\{/g;
+  let m: RegExpExecArray | null;
+  while ((m = re.exec(css))) {
+    let depth = 1, i = re.lastIndex;
+    while (i < css.length && depth > 0) {
+      if (css[i] === '{') depth++;
+      else if (css[i] === '}') depth--;
+      i++;
+    }
+    out.set(m[1], css.slice(re.lastIndex, i - 1));
+  }
+  return out;
+}
+
+/**
+ * Every element with an id whose gate holds it visible across a window, as an assertion.
+ *
+ * A gate is a keyframes block that ENDS hidden (`100% { opacity: 0 }`) — the cue-window idiom. The
+ * assertion is sampled INSIDE the window by `toleranceMs` at each end, because an assertion that
+ * straddles the flip instant tests the engine's rounding rather than the design's timing.
+ */
+/** Tags that never wrap anything, so they never open a level. */
+const VOID = new Set(['br', 'img', 'source', 'track', 'input', 'meta', 'link', 'hr', 'area', 'base', 'col', 'embed', 'wbr']);
+
+/**
+ * Every id-carrying element with its TRUE inner html.
+ *
+ * A non-greedy `([\s\S]*?)<\/\1>` stops at the first closing tag of the same name, which for a div
+ * holding a div is the inner one. The leftover text then read as the parent's own ink, so the
+ * "skip elements with no ink of their own" guard never fired and the gate emitted assertions that
+ * FAIL on documents which render perfectly — 18 of them across this repository's own accepted corpus.
+ */
+export function elementsWithId(wv: string): { open: string; attrs: string; id: string; inner: string }[] {
+  const out: { open: string; attrs: string; id: string; inner: string }[] = [];
+  // Blanked rather than removed, so every offset and line number downstream stays true. A commented-out
+  // element is not in the document, and asserting on its id fails a render that is perfectly correct.
+  wv = wv.replace(/<!--[\s\S]*?-->/g, (m) => ' '.repeat(m.length));
+  const tagRe = /<(\/?)([a-zA-Z][\w-]*)((?:"[^"]*"|'[^']*'|[^>"'])*)>/g;
+  const opens: { name: string; attrs: string; id?: string; innerStart: number; openTag: string }[] = [];
+  let m: RegExpExecArray | null;
+  while ((m = tagRe.exec(wv))) {
+    const [whole, slash, name, attrs] = m;
+    const lower = name.toLowerCase();
+    if (VOID.has(lower)) continue;
+    if (slash) {
+      // Close the most recent open of this name; unbalanced markup simply yields nothing for it.
+      for (let i = opens.length - 1; i >= 0; i--) {
+        if (opens[i].name !== lower) continue;
+        const o = opens.splice(i, 1)[0];
+        if (o.id) out.push({ open: o.openTag, attrs: o.attrs, id: o.id, inner: wv.slice(o.innerStart, m.index) });
+        break;
+      }
+      continue;
+    }
+    if (/\/\s*$/.test(attrs)) continue; // self-closing
+    opens.push({
+      name: lower,
+      attrs,
+      id: attrs.match(/\bid="([^"]+)"/)?.[1],
+      innerStart: m.index + whole.length,
+      openTag: whole,
+    });
+  }
+  return out;
+}
+
+export function expectationsFor(wv: string, durationMs: number, toleranceMs = 40): Expectation[] {
+  const css = wv.match(/<style\b[^>]*>([\s\S]*?)<\/style>/gi)?.join('\n') ?? '';
+  const frames = keyframeNames(css);
+  const closing = new Set(
+    [...frames].filter(([, body]) => /(?:\b100%|\bto)\s*\{[^}]*opacity\s*:\s*0(?![.\d])/.test(body)).map(([n]) => n),
+  );
+
+  // class → the closing gate it names, and any timing the rule itself fixes.
+  const gated = new Map<string, { dur?: number; delay?: number }>();
+  for (const m of css.replace(/\/\*[\s\S]*?\*\//g, '').matchAll(/([^{}]+)\{([^{}]*)\}/g)) {
+    const sel = m[1].trim().split('\n').pop()!.trim();
+    const body = m[2];
+    if (sel.startsWith('@') || sel.includes('%')) continue;
+    const cls = sel.match(/^\.([\w-]+)$/)?.[1];
+    if (!cls) continue;
+    const short = body.match(/animation\s*:\s*([^;]+)/)?.[1];
+    const name = short?.trim().split(/\s+/)[0] ?? body.match(/animation-name\s*:\s*([\w-]+)/)?.[1];
+    if (!name || !closing.has(name)) continue;
+    const times = (short ?? '').replace(name, '').trim().split(/\s+/).map(ms).filter((v): v is number => v !== undefined);
+    gated.set(cls, {
+      dur: times[0] ?? ms(body.match(/animation-duration\s*:\s*([^;]+)/)?.[1]),
+      delay: times[1] ?? ms(body.match(/animation-delay\s*:\s*([^;]+)/)?.[1]),
+    });
+  }
+
+  // The slowest ENTRANCE in the document — an animation that ends visible rather than hidden. Every
+  // gate's assertion waits it out, because until it finishes the content inside the gate is mid-fade.
+  let entranceMs = 0;
+  for (const [name, body] of frames) {
+    if (closing.has(name)) continue;
+    if (!/opacity/.test(body)) continue;
+    for (const m of css.matchAll(new RegExp(`animation\\s*:\\s*${name}([^;}]*)`, 'g'))) {
+      const times = m[1].trim().split(/\s+/).map(ms).filter((v): v is number => v !== undefined);
+      if (times.length) entranceMs = Math.max(entranceMs, (times[0] ?? 0) + (times[1] ?? 0));
+    }
+  }
+
+  const out: Expectation[] = [];
+  for (const el of elementsWithId(wv)) {
+    const tag = [el.open] as unknown as RegExpMatchArray;
+    (tag as unknown as string[])[1] = el.attrs.match(/class="([^"]*)"/)?.[1] ?? '';
+    const id = el.id;
+    const inner = el.inner;
+    // `expect-visible` measures the ink of the element ITSELF. When the words live in child spans —
+    // the cue/word structure the brief prescribes and every recipe emits — the parent has no ink of
+    // its own and the assertion fails on a document that renders perfectly. Verified on engine 0.8.0
+    // (`tests/expect-visible-nested.test.ts`), so those elements are skipped rather than asserted wrongly.
+    const ownText = inner.replace(/<(\w+)[^>]*>[\s\S]*?<\/\1>/g, '').replace(/<[^>]*>/g, '').trim();
+    if (!ownText) continue;
+    const style = tag[0].match(/style=(?:"([^"]*)"|'([^']*)')/i)?.slice(1).find((v) => v !== undefined) ?? '';
+    for (const cls of String(tag[1]).split(/\s+/).filter(Boolean)) {
+      const g = gated.get(cls);
+      if (!g) continue;
+      const short = style.match(/animation\s*:\s*([^;"]+)/)?.[1];
+      const times = (short ?? '').trim().split(/\s+/).map(ms).filter((v): v is number => v !== undefined);
+      const dur = times[0] ?? ms(style.match(/animation-duration\s*:\s*([^;"]+)/)?.[1]) ?? g.dur;
+      const delay = times[1] ?? ms(style.match(/animation-delay\s*:\s*([^;"]+)/)?.[1]) ?? g.delay ?? 0;
+      if (dur === undefined) continue;
+      // The gate opening is not the moment the content is ON SCREEN. Inside it, words are still
+      // entering — at 40ms into a 380ms rise the glyph is at about a tenth of its opacity, and an
+      // assertion there tests the entrance rather than the timing it exists to check. Start after the
+      // slowest entrance in the document has finished.
+      const from = delay + Math.max(toleranceMs, entranceMs + toleranceMs);
+      const to = Math.min(delay + dur - toleranceMs, durationMs - toleranceMs);
+      // A window too short to sample inside proves nothing; asserting on it would only be noise.
+      if (to <= from) continue;
+      out.push({ element: id, visible: true, from: Number((from / 1000).toFixed(3)), to: Number((to / 1000).toFixed(3)) });
+      break;
+    }
+  }
+  return out;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const { values, positionals } = parseFlags({
+    args: process.argv.slice(2),
+    options: { write: { type: 'boolean' }, 'tolerance-ms': { type: 'string' }, doc: { type: 'string' } },
+    allowPositionals: true,
+  });
+  const dir = positionals[0];
+  if (!dir) { console.error('usage: expect-windows.ts <run-dir> [--doc final] [--write] [--tolerance-ms 40]'); process.exit(2); }
+  // A film has one document per chapter. Hardcoding `final` made the gate chain's own --doc flag a
+  // lie: it reached lint and the engine and stopped here, on a path that does not exist.
+  const doc = (values.doc as string | undefined) ?? 'final';
+  const mfPath = join(dir, doc, 'manifest.json');
+  const mf = JSON.parse(readFileSync(mfPath, 'utf8')) as { render: { duration: number }; verify?: { derivedBy?: string; expect: Expectation[] } };
+  const wv = readFileSync(join(dir, doc, 'template.wv'), 'utf8');
+  const tol = Number(values['tolerance-ms'] ?? 40);
+  if (!Number.isFinite(tol) || tol < 0) {
+    console.error(`--tolerance-ms must be a non-negative number, got "${values['tolerance-ms']}"`);
+    process.exit(2);
+  }
+  const expect = expectationsFor(wv, mf.render.duration * 1000, tol);
+
+  if (!expect.length) { console.log('expect-windows: no gated elements with ids — nothing to assert'); process.exit(0); }
+  if (values.write) {
+    // Stamped so a later run can tell its own work from a block somebody wrote on purpose. Without
+    // this the gate chain saw any `verify` block as authored and kept a document gated against the
+    // timings of an earlier render.
+    mf.verify = { derivedBy: 'expect-windows', expect };
+    writeFileSync(mfPath, JSON.stringify(mf, null, 2) + '\n');
+    console.log(`expect-windows: wrote ${expect.length} expectation(s) into ${mfPath} — --verify now fails when a cue is off screen inside its own window`);
+  } else {
+    console.log(JSON.stringify({ verify: { expect } }, null, 2));
+    console.log(`\nexpect-windows: ${expect.length} expectation(s); pass --write to put them in the manifest`);
+  }
+}
diff --git a/pipeline/scripts/gates.sh b/pipeline/scripts/gates.sh
new file mode 100755
index 0000000..8cccc0c
--- /dev/null
+++ b/pipeline/scripts/gates.sh
@@ -0,0 +1,126 @@
+#!/bin/bash
+# THE GATE CHAIN, as one command.
+#
+# `generate-recipe.ts` already drives this for a compiled recipe. Every other path — the inline
+# creative pass, a remix, a run with no footage — retyped the five gates below into every brief. All
+# 52 agent briefs of the launch session carried them by hand, which is 52 chances to drop the probe,
+# reorder the record, or forget that the engine needs the window-server.
+#
+#   bash pipeline/scripts/gates.sh <run-dir> [--doc <subdir>] [--audio <file>] [--no-mux] [--no-probe] [--no-expect] [--no-design] [--no-wcag]
+#
+# design → lint → --verify → WCAG → --record → probe-qa → mux. Stops at the first failure and names it.
+# RUN OUTSIDE ANY SANDBOX: --verify and --record need the window-server.
+#
+# --no-probe   the run has no source footage to diff frames against
+# --no-mux     the run has no soundtrack to restore (the silent render is copied to out.mp4, so the
+#              deliverable path is the same on every path)
+# --no-expect  skip deriving `verify.expect` from the document's own gates. Do not reach for this to
+#              make a failure go away: an expect-visible failure means a cue is off screen inside the
+#              window the document itself declares, which is a real defect no other gate can see.
+# --no-design  the run has no design/system.json — true only of a compiled-recipe run, where the
+#              recipe IS the system. An authored run without one is the defect this gate exists for.
+set -euo pipefail
+
+DIR="${1:?usage: gates.sh <run-dir> [--doc <subdir>] [--audio <file>] [--no-mux] [--no-probe] [--no-expect] [--no-design] [--no-wcag]}"
+shift || true
+NO_MUX=0
+NO_PROBE=0
+NO_EXPECT=0
+NO_DESIGN=0
+NO_WCAG=0
+# Which document under the run this call gates. A captioned clip has one; a film has one per
+# chapter, and hardcoding `final` was why a seven-chapter run found no route through here.
+DOC="final"
+# Whether --doc was actually GIVEN, which is a different question from which document is gated. The
+# default is `final`, so passing it on unconditionally told design-gate every run was one chapter of
+# a longer piece — and the declared-but-unused check, which only fires on a whole run, never ran at
+# all through this chain.
+DOC_GIVEN=0
+# A built soundtrack rather than the source clip's track — a film has one, a captioned clip does not.
+AUDIO=""
+while [ $# -gt 0 ]; do
+  a="$1"
+  case "$a" in
+    # `--doc final` is the default written out, not a request to gate one chapter of many.
+    --doc) DOC="${2:?--doc needs a subdirectory}"; [ "$DOC" = "final" ] || DOC_GIVEN=1; shift ;;
+    --audio) AUDIO="${2:?--audio needs a file}"; shift ;;
+    --no-mux) NO_MUX=1 ;;
+    --no-probe) NO_PROBE=1 ;;
+    --no-expect) NO_EXPECT=1 ;;
+    --no-design) NO_DESIGN=1 ;;
+    --no-wcag) NO_WCAG=1 ;;
+    *) echo "gates: unknown flag $a" >&2; exit 2 ;;
+  esac
+  shift
+done
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+FINAL="$DIR/$DOC"
+TPL="$FINAL/template.wv"
+ENGINE="${VEED_ENGINE_BIN:-$ROOT/.veed-engine/veed-engine-cli}"
+
+[ -f "$TPL" ] || { echo "gates: no $TPL — author the document first" >&2; exit 2; }
+[ -f "$FINAL/manifest.json" ] || { echo "gates: no $FINAL/manifest.json — the render block is required" >&2; exit 2; }
+
+fail() { echo "gates: FAILED at $1 — fix that, then re-run gates.sh" >&2; exit 1; }
+
+if [ "$NO_DESIGN" -eq 0 ]; then
+  echo "gates: design"
+  if [ "$DOC_GIVEN" -eq 1 ]; then
+    node --import tsx "$ROOT/pipeline/scripts/design-gate.ts" "$DIR" --doc "$DOC" || fail "design"
+  else
+    node --import tsx "$ROOT/pipeline/scripts/design-gate.ts" "$DIR" || fail "design"
+  fi
+fi
+
+echo "gates: lint"
+node --import tsx "$ROOT/pipeline/scripts/lint-template.ts" "$TPL" || fail "lint"
+
+# Derive the timing assertions from the document's own gates, unless the manifest already carries a
+# hand-written set. Without them --verify only checks what IS drawn; with them it also checks WHEN.
+# `--write` stamps what it derived, so a re-run can replace its own work and leave a hand-written block
+# alone. Without the stamp the guard saw any `verify` block as authored and every later run gated the
+# document against the timings of an earlier one.
+if [ "$NO_EXPECT" -eq 0 ] && { ! grep -q '"verify"' "$FINAL/manifest.json" || grep -q '"derivedBy"' "$FINAL/manifest.json"; }; then
+  node --import tsx "$ROOT/pipeline/scripts/expect-windows.ts" "$DIR" --doc "$DOC" --write >/dev/null || fail "expect-windows"
+fi
+
+echo "gates: verify"
+"$ENGINE" "$FINAL" --verify || fail "--verify"
+
+# Contrast is a REPORT, not a verdict. wcag-pass exits 1 only when its analyzer is missing or crashes,
+# and its own documentation calls that an environment problem rather than a design failure — so it is
+# said out loud and the run continues to a deliverable rather than dying without one.
+#
+# It reads <run>/final and takes no document argument, so it has nothing to say about a chapter of a
+# longer piece. Running it anyway would either abort on a directory that is not there or, worse, report
+# on a document this invocation never touched.
+if [ "$NO_WCAG" -eq 0 ]; then
+  if [ "$DOC" != "final" ]; then
+    echo "gates: wcag skipped — it reads $DIR/final and this run gates $DOC; check contrast on the assembled film"
+  else
+    echo "gates: wcag"
+    node --import tsx "$ROOT/pipeline/scripts/wcag-pass.ts" --run "$DIR" \
+      || echo "gates: wcag could not run (analyzer missing or crashed) — contrast is UNCHECKED for this render" >&2
+  fi
+fi
+
+echo "gates: record"
+"$ENGINE" "$FINAL" --progress-output --record "$FINAL/out.silent.mp4" || fail "--record"
+
+if [ "$NO_PROBE" -eq 0 ]; then
+  echo "gates: probe-qa"
+  node --import tsx "$ROOT/pipeline/scripts/probe-qa.ts" "$DIR" --doc "$DOC" || fail "probe-qa"
+else
+  echo "gates: probe-qa skipped (no source footage to diff against)"
+fi
+
+if [ "$NO_MUX" -eq 0 ]; then
+  echo "gates: mux"
+  bash "$ROOT/pipeline/scripts/mux-audio.sh" "$DIR" --doc "$DOC" ${AUDIO:+--audio "$AUDIO"} || fail "mux"
+else
+  cp "$FINAL/out.silent.mp4" "$FINAL/out.mp4"
+  echo "gates: no soundtrack to restore — silent render copied to out.mp4"
+fi
+
+echo "gates: clean → $FINAL/out.mp4"
diff --git a/pipeline/scripts/generate-recipe.ts b/pipeline/scripts/generate-recipe.ts
index ba7557a..cd95d17 100644
--- a/pipeline/scripts/generate-recipe.ts
+++ b/pipeline/scripts/generate-recipe.ts
@@ -112,7 +112,9 @@ async function main(): Promise<number> {
 
   // Gate 1 — LINT (pure, no engine; runs on every generate): a generated document violating engine
   // limits is a generator bug — fix the recipe module (or lib), never the output.
-  const lint = () => lintTemplate(readFileSync(tplPath, 'utf8'));
+  // The manifest is written seven lines up, and three rules are decidable only with it — a run that
+  // lints without it is running a strictly weaker gate than the shell path, silently.
+  const lint = () => lintTemplate(readFileSync(tplPath, 'utf8'), JSON.parse(readFileSync(manifestPath, 'utf8')).render);
   const findings = lint();
   for (const x of findings) console.log(`${x.severity.toUpperCase()}[${x.rule}] ${x.message}`);
   if (findings.some((x) => x.severity === 'error')) {
diff --git a/pipeline/scripts/lint-template.ts b/pipeline/scripts/lint-template.ts
index 275123f..3dc7e69 100644
--- a/pipeline/scripts/lint-template.ts
+++ b/pipeline/scripts/lint-template.ts
@@ -8,7 +8,8 @@
 // NOT covered here (semantic, stays a sheet/brief rule): color-animation-as-reveal (stylistic colour
 // shifts are legit), shrink-to-fit flex around animated children (needs layout, not regex).
 //   node --import tsx pipeline/scripts/lint-template.ts <template.wv> [--json]
-import { readFileSync } from 'node:fs';
+import { readFileSync, existsSync } from 'node:fs';
+import { dirname, join } from 'node:path';
 import { pathToFileURL } from 'node:url';
 
 export interface Finding { rule: string; severity: 'error' | 'warn'; message: string }
@@ -53,8 +54,8 @@ function classCoveredByAncestor(src: string, cls: string, zClasses: Set<string>)
       continue;
     }
     const attrs = m[3];
-    const classes = attrs.match(/class="([^"]*)"/i)?.[1]?.split(/\s+/).filter(Boolean) ?? [];
-    const inlineZ = attrs.match(/style="[^"]*z-index\s*:\s*(-?\d+)/i);
+    const classes = attr(attrs, 'class').split(/\s+/).filter(Boolean);
+    const inlineZ = attrs.match(/style=(?:"[^"]*|'[^']*)z-index\s*:\s*(-?\d+)/i);
     const carries = (inlineZ !== null && Number(inlineZ[1]) >= 1) || classes.some((c) => zClasses.has(c));
     if (classes.includes(cls)) {
       seen++;
@@ -67,15 +68,57 @@ function classCoveredByAncestor(src: string, cls: string, zClasses: Set<string>)
   return seen > 0;
 }
 
-export function lintTemplate(src: string): Finding[] {
+/** Canvas facts from the run's manifest. Timing rules cannot be decided without them. */
+export interface Render { fps: number; duration: number; width?: number; height?: number }
+
+/** Milliseconds from a CSS time token; undefined when the token is not a time. */
+function ms(tok: string): number | undefined {
+  const m = tok.match(/^(-?[\d.]+)(ms|s)$/);
+  if (!m) return undefined;
+  return m[2] === 's' ? Number(m[1]) * 1000 : Number(m[1]);
+}
+
+/** The first two time tokens of an `animation` shorthand are duration then delay, in that order. */
+function animTiming(shorthand: string): { dur: number; delay: number } | undefined {
+  const times = shorthand.trim().split(/\s+/).map(ms).filter((v): v is number => v !== undefined);
+  if (!times.length) return undefined;
+  return { dur: times[0], delay: times[1] ?? 0 };
+}
+
+/** One finding per element whose closing gate lands on an exact frame instant. */
+function reportBoundary(f: Finding[], selector: string, name: string, delay: number, dur: number, frameMs: number, fps: number, durationMs: number) {
+  const end = delay + dur;
+  const n = end / frameMs;
+  if (Math.abs(n - Math.round(n)) > 1e-6) return;
+  // A gate closing at the END of the document loses nothing: there is no next frame to lose. Only a
+  // window that closes MID-timeline drops a frame a viewer sees.
+  if (end >= durationMs - frameMs / 2) return;
+  const msg = `"${selector}" closes ${name} at ${end}ms — exactly frame ${Math.round(n)} at ${fps}fps, so that frame renders blank and --verify cannot see it; end the window a few ms earlier`;
+  if (!f.some((x) => x.rule === 'gate-on-frame-boundary' && x.message === msg)) {
+    f.push({ rule: 'gate-on-frame-boundary', severity: 'warn', message: msg });
+  }
+}
+
+/** An attribute in either quoting. Single quotes are legal and were invisible to every reader here. */
+function attr(tag: string, name: string): string {
+  const m = tag.match(new RegExp(`\\b${name}=(?:"([^"]*)"|'([^']*)')`, 'i'));
+  return m?.slice(1).find((v) => v !== undefined) ?? '';
+}
+
+const styleAttr = (tag: string): string => attr(tag, 'style');
+
+export function lintTemplate(src: string, render?: Render): Finding[] {
   const f: Finding[] = [];
-  const css = src.match(/<style\b[^>]*>([\s\S]*?)<\/style>/gi)?.join('\n') ?? src;
+  // Property rules read `css`, and a document that puts its geometry in `style="..."` attributes was
+  // invisible to every one of them — which is most generated documents. Inline declarations are
+  // appended as synthetic blocks so a regex that stops at `}` still terminates on its own element.
+  const styleBlocks = src.match(/<style\b[^>]*>([\s\S]*?)<\/style>/gi) ?? [];
+  const inlineDecls = [...src.matchAll(/<[^>]*\sstyle=("([^"]*)"|'([^']*)')[^>]*>/gi)]
+    .map((m) => `.inline{${m[2] ?? m[3] ?? ''}}`);
+  const css = styleBlocks.length || inlineDecls.length ? [...styleBlocks, ...inlineDecls].join('\n') : src;
   const frames = keyframesBlocks(css);
 
   for (const kf of frames) {
-    if (kf.body.includes('var(')) {
-      f.push({ rule: 'var-in-keyframes', severity: 'error', message: `@keyframes ${kf.name}: var() never resolves inside keyframes (in transform it CRASHES the engine) — bake literal values` });
-    }
     if (/filter:[^;]*blur/.test(kf.body)) {
       // WARN, not error: the engine HOLDS the initial value (static blur renders fine — measured
       // 2026-07-14) — degraded fidelity, not breakage; validated recipes ship with
@@ -84,28 +127,43 @@ export function lintTemplate(src: string): Finding[] {
     }
   }
 
-  if (/<br[\s/>]/i.test(src)) {
-    f.push({ rule: 'br-tag', severity: 'error', message: '<br> is ignored by the engine — use sibling block divs' });
-  }
-  // Severities follow the MEASURED engine picture, not the oldest claim:
-  // error = renders wrong / breaks layout; warn = a no-op or construct-dependent rule the render
-  // survives (validated recipes knowingly emit some as dead prefab fidelity).
+  // Every rule below is settled by a control-render probe, named in the rule's own id. A rule
+  // asserting a limit no probe supports removes real capability from every run that lints clean, so
+  // it is a defect of the same class as an invented limitation in the brief.
+  // Retired here because the engine imposes none of them as stated (0.8.0, probe-decided). `br-tag`
+  // is retired for ordinary inline text ONLY: `<br>` is inert between display:inline-block spans
+  // (probe: br-between-inline-blocks), which is why captions put each line in its own block.
+  // var-in-keyframes,
+  // br-tag, css-outline, blend-mode, repeating-gradient, vw-font-size.
   const unsupported: [RegExp, string, 'error' | 'warn', string][] = [
     [/display:\s*(inline-)?grid|grid-template/i, 'css-grid', 'error', 'CSS grid is unsupported — use flex'],
-    [/(?:^|[^-\w])outline:/im, 'css-outline', 'error', 'the CSS outline property is unsupported — faux-outline via 8-way text-shadow'],
-    [/-webkit-text-stroke/i, 'text-stroke', 'warn', '-webkit-text-stroke is construct-dependent (renders on static captions, drops on animated/tilted spans — pixel-count proven) — ground with 8-way text-shadow, never rely on it'],
-    [/mix-blend-mode/i, 'blend-mode', 'error', 'mix-blend-mode is unsupported'],
-    [/repeating-linear-gradient/i, 'repeating-gradient', 'warn', 'repeating-linear-gradient does not paint (measured on a since-cut ref) — a dead rule; do not rely on it for a visible element'],
-    [/font-size:[^;]*\dvw/i, 'vw-font-size', 'error', 'vw font sizes are unsupported — use px (recipes: px × SCALE)'],
-    [/border-radius:[^;]*\//, 'radius-slash', 'error', 'border-radius slash syntax renders square — single-value only'],
+    [/-webkit-text-stroke/i, 'text-stroke', 'error', '-webkit-text-stroke never paints, on any construct (probe: webkit-text-stroke-never-paints) — ground with an 8-way text-shadow'],
+    [/border-radius:[^;}]*\//, 'radius-slash', 'error', 'border-radius slash syntax renders square — single-value only'],
+    [/border-radius:[ \t]*[^\s;}(]+[ \t]+[^\s;}(]+/, 'radius-per-corner', 'error', 'a border-radius with more than ONE value drops the whole declaration and the box renders square — measured on the two-value form as well as the four — use a single value, or a clip-path polygon for asymmetric corners'],
+    [/transform:[^;]*\b(skewX|skewY|matrix)\s*\(/i, 'skew-ignored', 'warn', 'skewX is silently ignored — the element renders axis-aligned (probe: skew-ignored); skewY and matrix are caught by the same rule but were never probed, so treat them as unverified rather than broken. Build the slant with a clip-path polygon if the design needs it'],
+    [/radial-gradient|(?:^|[^-\w])mask(?:-image)?\s*:/im, 'unsupported-paint', 'error', 'radial-gradient and the CSS mask property do not paint — use a clip-path polygon or a flat/linear/conic fill'],
   ];
   for (const [re, rule, severity, message] of unsupported) {
     if (re.test(css)) f.push({ rule, severity, message });
   }
 
-  // The opacity/stacking trap bites POSITIONED elements: one that animates an opacity keyframes with
-  // no explicit z-index loses its stacking context at opacity 1.0 and paints under the z0 video.
-  // NOT flagged (both are the same engine truth — an enclosing stacking context above the video):
+  // @import must precede every rule or the engine drops the WHOLE stylesheet — the document then
+  // renders as unstyled flow, which reads as a layout bug rather than a font problem.
+  for (const block of src.match(/<style\b[^>]*>([\s\S]*?)<\/style>/gi) ?? []) {
+    const inner = block.replace(/<\/?style[^>]*>/gi, '').replace(/\/\*[\s\S]*?\*\//g, '');
+    const firstImport = inner.search(/@import/i);
+    if (firstImport < 0) continue;
+    const before = inner.slice(0, firstImport);
+    if (/[^\s@][^{}]*\{/.test(before)) {
+      f.push({ rule: 'import-not-first', severity: 'error', message: '@import must be the FIRST statement inside <style> — a rule before it drops the entire stylesheet' });
+    }
+  }
+
+  // A positioned element that animates opacity and states no z-index leaves its paint order to
+  // document order. This was carried for months as an engine limit — "loses its stacking context at
+  // opacity 1" — and the probe refutes it (opacity-anim-no-z): the element paints above the video as
+  // CSS says. So this is a WARN about drift, not an error about a limit.
+  // NOT flagged (an enclosing stacking context settles the order for them):
   // non-positioned spans inside their cue, AND any element all of whose occurrences sit under an
   // ancestor carrying z-index >= 1 (the compiled-recipe cue idiom: inline z per cue, positioned .pg
   // pages inside — they paint within the cue's context and cannot fall under the video).
@@ -125,6 +183,18 @@ export function lintTemplate(src: string): Finding[] {
     const anim = body.match(/animation(?:-name)?:\s*([^;]+)/);
     if (!anim) continue;
     const names = anim[1].split(',').map((s) => s.trim().split(/\s+/).find((tok) => opacityFrames.has(tok))).filter(Boolean);
+
+    // TWO ANIMATIONS, ONE PROPERTY. No probe backs this one and none is needed: the defect is a
+    // contradiction the DOCUMENT states about itself, decidable by reading it. Two animations on one
+    // element each declare an opacity timeline, so the document names two different visibilities for
+    // the same instant; whichever the engine keeps, the other declared window is discarded and
+    // nothing reports it. One film shipped 22 graphics that never turned off this way. Exactly one
+    // animation may own opacity; every other animation on the element animates transform only.
+    // (Reproduced by the opacity-owned-twice fixture.)
+    if (names.length > 1) {
+      f.push({ rule: 'opacity-owned-twice', severity: 'error', message: `rule "${selector}" runs ${names.length} animations that all drive opacity (${names.join(', ')}) — the document declares two visibilities for the same instant and one of them is silently discarded; let ONE animation own opacity and make the others transform-only` });
+    }
+
     if (!names.length) continue;
     const positioned = /position\s*:\s*(absolute|fixed|relative)/.test(body);
     if (positioned && !/z-index\s*:/.test(body)) {
@@ -134,28 +204,133 @@ export function lintTemplate(src: string): Finding[] {
       let coveredInline = false;
       let coveredByAncestor = false;
       if (cls) {
-        const tags = [...src.matchAll(new RegExp(`<[^>]*class="[^"]*\\b${cls}\\b[^"]*"[^>]*>`, 'gi'))];
-        coveredInline = tags.length > 0 && tags.every((t) => /style="[^"]*z-index/.test(t[0]));
+        const tags = [...src.matchAll(new RegExp(`<[^>]*class=(?:"[^"]*|'[^']*)\\b${cls}\\b[^>]*>`, 'gi'))];
+        coveredInline = tags.length > 0 && tags.every((t) => /style=(?:"[^"]*|'[^']*)z-index/.test(t[0]));
         coveredByAncestor = classCoveredByAncestor(src, cls, zClasses);
       }
       if (!coveredInline && !coveredByAncestor) {
-        f.push({ rule: 'opacity-anim-no-z', severity: 'error', message: `rule "${selector}" is positioned and animates opacity (${names.join(', ')}) without an explicit z-index — it can paint UNDER the z0 video at opacity 1 (the stacking trap)` });
+        f.push({ rule: 'opacity-anim-no-z', severity: 'warn', message: `rule "${selector}" is positioned and animates opacity (${names.join(', ')}) without an explicit z-index — its paint order is left to document order, so reordering the markup silently changes what covers what` });
       }
     }
     if (/line-height:\s*(0?\.\d+|1(?:\.0*)?|1\.1\d*)(?![\d.])/.test(body) && !/padding/.test(body)) {
-      f.push({ rule: 'lineheight-shear', severity: 'warn', message: `rule "${selector}": animated text at line-height < 1.2 without padding headroom — mid-reveal glyphs shear at the em-box (give ~0.1em top / 0.15em bottom padding or line-height >= 1.2)` });
+      // The shear this rule was named for does not happen (probe: lineheight-shear, REFUTED). What a
+      // line-height under 1.2 does is bring a descender within a pixel or two of the next line's caps,
+      // which is a typographic call and not an engine defect — so it is worth saying once, and worth
+      // nobody's build.
+      f.push({ rule: 'tight-line-height', severity: 'warn', message: `rule "${selector}": text at line-height < 1.2 with no padding headroom — descenders come within a pixel of the next line's caps (give ~0.1em top / 0.15em bottom, or line-height >= 1.2)` });
     }
   }
 
   // --verify names failures by element id: every animated caption element needs a unique id.
   const ids = new Set<string>();
-  for (const tag of src.matchAll(/<(?:div|span|h\d|p)\b[^>]*class="[^"]*\b(?:cue|cap|word|w)\b[^"]*"[^>]*>/gi)) {
+  for (const tag of src.matchAll(/<(?:div|span|h\d|p)\b[^>]*class=(?:"[^"]*|'[^']*)\b(?:cue|cap|word|w)\b[^>]*>/gi)) {
     const id = tag[0].match(/\bid="([^"]+)"/)?.[1];
     if (id === undefined) continue; // per-word spans may share classes; only cue-level ids are required
     if (ids.has(id)) f.push({ rule: 'duplicate-id', severity: 'error', message: `duplicate element id "${id}" — --verify failure lines become ambiguous` });
     ids.add(id);
   }
-  const cueTags = [...src.matchAll(/<div\b[^>]*class="[^"]*\bcue\b[^"]*"[^>]*>/gi)];
+  // A gate whose keyframe closes EXACTLY on a frame boundary loses that frame, and --verify cannot
+  // see it: it checks the draw list, and the draw list is correct — the frame simply lands on the
+  // instant the gate flips. One launch card rendered the last frame of every beat blank this way.
+  // Confirmed by probe `frame-boundary-gate-loss`.
+  //
+  // WARN, not error, and the reason is scope rather than doubt: 43 gates across 13 accepted
+  // deliverables land on the grid, because 26 of the 28 compiled recipes emit `animation-duration`
+  // inline from the beat's own spoken window. Moving the gate off the grid is one arithmetic change
+  // repeated across those modules plus ~53 pinned golden tests — a scoped job of its own, not
+  // something to half-do from here. Until then this surfaces every instance without blocking a path
+  // whose output is otherwise correct.
+  //
+  // Generated documents put the gate's TIMING INLINE on each element and keep only the name in CSS
+  // (`style="z-index:11; animation-delay:160ms; animation-duration:2000ms"`), so a rule that reads
+  // CSS rule bodies alone never fires. Both places are read here.
+  if (render?.fps) {
+    const frameMs = 1000 / render.fps;
+    const closing = new Set(
+      frames
+        .filter((k) => /(?:\b100%|\bto)\s*\{[^}]*opacity\s*:\s*0(?![.\d])/.test(k.body))
+        .map((k) => k.name),
+    );
+
+    // class -> the closing gate it carries, plus whatever timing the CSS rule itself fixes
+    const gated = new Map<string, { name: string; dur?: number; delay?: number }>();
+    for (const m of cssNoComments.matchAll(/([^{}]+)\{([^{}]*)\}/g)) {
+      const selector = m[1].trim().split('\n').pop()!.trim();
+      const body = m[2];
+      if (selector.startsWith('@')) continue;
+      const cls = selector.match(/^\.([\w-]+)$/)?.[1];
+      const short = body.match(/animation\s*:\s*([^;]+)/);
+      const named = body.match(/animation-name\s*:\s*([\w-]+)/);
+      const name = short?.[1].trim().split(/\s+/)[0] ?? named?.[1];
+      if (!name || !closing.has(name)) continue;
+      const t = short ? animTiming(short[1].replace(name, '')) : undefined;
+      const dur = t?.dur ?? ms(body.match(/animation-duration\s*:\s*([^;]+)/)?.[1]?.trim() ?? '');
+      const delay = t?.delay ?? ms(body.match(/animation-delay\s*:\s*([^;]+)/)?.[1]?.trim() ?? '');
+      if (cls) gated.set(cls, { name, dur, delay });
+      if (!cls && dur !== undefined) reportBoundary(f, selector, name, delay ?? 0, dur, frameMs, render.fps, render.duration * 1000);
+    }
+
+    // Only CUE-LEVEL gates. A per-glyph caret window closing on a frame instant loses a frame nobody
+    // can see; the defect that shipped was a BEAT losing its last frame. The brief already requires a
+    // unique id on every cue-level element, so the id is the marker for "a window a viewer watches".
+    for (const tag of src.matchAll(/<[^>]*class=(?:"([^"]*)"|'([^']*)')[^>]*>/gi)) {
+      if (!/\bid="/.test(tag[0])) continue;
+      const style = styleAttr(tag[0]);
+      for (const cls of tag[1].split(/\s+/).filter(Boolean)) {
+        const g = gated.get(cls);
+        if (!g) continue;
+        const short = style.match(/animation\s*:\s*([^;"]+)/);
+        const t = short ? animTiming(short[1].replace(g.name, '')) : undefined;
+        const dur = t?.dur ?? ms(style.match(/animation-duration\s*:\s*([^;"]+)/)?.[1]?.trim() ?? '') ?? g.dur;
+        const delay = t?.delay ?? ms(style.match(/animation-delay\s*:\s*([^;"]+)/)?.[1]?.trim() ?? '') ?? g.delay ?? 0;
+        if (dur === undefined) continue;
+        reportBoundary(f, `.${cls}`, g.name, delay, dur, frameMs, render.fps, render.duration * 1000);
+      }
+    }
+  }
+
+  // An element whose entrance starts at or after the document ends never plays. It costs nothing at
+  // render time and reads as a missing beat, which is why it survives review: --verify only checks
+  // what IS drawn, so an element that is never drawn raises nothing. Corpus class `timing-offset`.
+  if (render?.duration) {
+    const durMs = render.duration * 1000;
+    for (const tag of src.matchAll(/<[^>]*\sstyle=(?:"[^"]*"|'[^']*')[^>]*>/gi)) {
+      const style = styleAttr(tag[0]);
+      const delay = ms(style.match(/animation-delay\s*:\s*([^;'"]+)/)?.[1]?.trim() ?? '');
+      if (delay === undefined || delay < durMs) continue;
+      const who = tag[0].match(/\bid=(?:"([^"]+)"|'([^']+)')/)?.slice(1).find((v) => v !== undefined)
+        ?? tag[0].match(/class=(?:"([^"]+)"|'([^']+)')/)?.slice(1).find((v) => v !== undefined) ?? 'element';
+      f.push({ rule: 'starts-after-end', severity: 'error', message: `"${who}" has animation-delay ${delay}ms on a ${durMs}ms timeline — it never plays, and --verify cannot see an element that is never drawn` });
+    }
+  }
+
+  // A full-canvas backing layer that is not the canvas size. The launch session resized a set of
+  // scenes from 1080 to 1440 high and left masks and plates at the old height; the band that opened
+  // up was found by eye, scene by scene. Only layers ANCHORED at the origin are judged — a graphic
+  // deliberately bleeding past an edge is design, not a defect. Corpus class `layer-leak`.
+  if (render?.width && render?.height) {
+    for (const m of cssNoComments.matchAll(/([^{}]+)\{([^{}]*)\}/g)) {
+      const selector = m[1].trim().split('\n').pop()!.trim();
+      const body = m[2];
+      if (selector.startsWith('@')) continue;
+      if (!/position\s*:\s*absolute/.test(body)) continue;
+      if (!/(?:^|[;{\s])left\s*:\s*0(?:px)?\s*(?:;|$)/.test(body) || !/(?:^|[;{\s])top\s*:\s*0(?:px)?\s*(?:;|$)/.test(body)) continue;
+      const w = Number(body.match(/(?:^|[;{\s])width\s*:\s*(\d+)px/)?.[1]);
+      const h = Number(body.match(/(?:^|[;{\s])height\s*:\s*(\d+)px/)?.[1]);
+      if (!w || !h) continue;
+      // A designed strip covers one axis and a small fraction of the other; a layer left behind by a
+      // canvas resize covers most of it and stops short. Only the second leaves a visible band, and a
+      // layer BIGGER than the canvas is deliberate bleed, never a gap.
+      const gapY = w === render.width && h < render.height && h >= render.height * 0.5;
+      const gapX = h === render.height && w < render.width && w >= render.width * 0.5;
+      if (gapY || gapX) {
+        const band = gapY ? `${render.height - h}px of bare canvas below it` : `${render.width - w}px of bare canvas beside it`;
+        f.push({ rule: 'stale-canvas-layer', severity: 'error', message: `rule "${selector}" is anchored at the origin at ${w}x${h} on a ${render.width}x${render.height} canvas, leaving ${band} — a backing layer left behind by a canvas resize` });
+      }
+    }
+  }
+
+  const cueTags = [...src.matchAll(/<div\b[^>]*class=(?:"[^"]*|'[^']*)\bcue\b[^>]*>/gi)];
   const cuesWithoutId = cueTags.filter((t) => !/\bid="/.test(t[0])).length;
   if (cuesWithoutId > 0) {
     f.push({ rule: 'cue-missing-id', severity: 'error', message: `${cuesWithoutId} .cue element(s) without a unique id — --verify cannot name them in failure lines` });
@@ -168,7 +343,13 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
   const argv = process.argv.slice(2);
   const file = argv.find((a) => !a.startsWith('--'));
   if (!file) { console.error('usage: node --import tsx pipeline/scripts/lint-template.ts <template.wv> [--json]'); process.exit(2); }
-  const findings = lintTemplate(readFileSync(file, 'utf8'));
+  // The manifest sits next to the document; without it the timing rules cannot run.
+  let render: Render | undefined;
+  try {
+    const mf = join(dirname(file), 'manifest.json');
+    if (existsSync(mf)) render = JSON.parse(readFileSync(mf, 'utf8')).render;
+  } catch { /* a malformed manifest is the renderer's error to report, not this gate's */ }
+  const findings = lintTemplate(readFileSync(file, 'utf8'), render);
   if (argv.includes('--json')) console.log(JSON.stringify(findings, null, 2));
   else for (const x of findings) console.log(`${x.severity.toUpperCase()}[${x.rule}] ${x.message}`);
   const errors = findings.filter((x) => x.severity === 'error').length;
diff --git a/pipeline/scripts/mix-audio.ts b/pipeline/scripts/mix-audio.ts
new file mode 100644
index 0000000..cbd3bfd
--- /dev/null
+++ b/pipeline/scripts/mix-audio.ts
@@ -0,0 +1,168 @@
+// One soundtrack out of many pieces.
+//
+// `mux-audio.sh` restores the SOURCE audio of a clip onto its render, which is the whole audio story a
+// captioned run has. A film is not that: a 12-minute documentary carried 66 narration takes, 11 sound
+// effects and 6 music cues, and nothing in this repository could put them together — no `amix`, no
+// `adelay`, no concat anywhere. So the run hand-wrote its own, once, and threw it away.
+//
+// This takes a spec and produces the mixed track. Every piece states WHERE it starts and how loud it
+// sits; music that has to live under narration says so and is ducked by the narration itself rather
+// than by a gain somebody guessed at.
+//
+//   node --import tsx pipeline/scripts/mix-audio.ts <run-dir> [--spec audio/mix.json] [--out audio/mix.m4a]
+import { execFileSync } from 'node:child_process';
+import { readFileSync, existsSync, mkdirSync } from 'node:fs';
+import { join, dirname, isAbsolute } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { parseFlags } from '../../veed/args.ts';
+import { FFMPEG } from '../../config.ts';
+
+export interface Track {
+  /** Relative to the run dir, or absolute. */
+  path: string;
+  /** When it starts, in seconds on the film's timeline. */
+  atSec: number;
+  /** Level in dB. 0 leaves it alone; negative is quieter. */
+  gainDb?: number;
+  fadeInSec?: number;
+  fadeOutSec?: number;
+  /** Where this piece sits. `voice` is the bus everything else can duck under. */
+  role?: 'voice' | 'music' | 'sfx' | 'ambience';
+  /** Music under narration. Ducked by the voice bus, not by a guessed gain. */
+  duck?: boolean;
+}
+
+export interface MixSpec {
+  /** The film's length. Anything past it is trimmed, so one long cue cannot extend the deliverable. */
+  durationSec: number;
+  tracks: Track[];
+}
+
+function label(i: number): string {
+  return `a${i}`;
+}
+
+/**
+ * The filtergraph, built as a string so it can be read and tested without running ffmpeg.
+ *
+ * `adelay` needs a value per channel, `amix` with `normalize=0` keeps levels where the spec put them
+ * (its default divides every input by the input count, which is why a mix built without it comes out
+ * mysteriously quiet), and `apad` plus `atrim` fix the total length so a short mix does not shorten
+ * the film.
+ */
+export function filtergraph(spec: MixSpec): { graph: string; out: string } {
+  if (!spec.tracks.length) throw new Error('mix-audio: the spec has no tracks');
+  if (!Number.isFinite(spec.durationSec) || spec.durationSec <= 0) {
+    throw new Error(`mix-audio: durationSec must be a positive number, got ${spec.durationSec}`);
+  }
+  const parts: string[] = [];
+  const voices: string[] = [];
+  const ducked: string[] = [];
+  const plain: string[] = [];
+
+  spec.tracks.forEach((t, i) => {
+    if (!Number.isFinite(t.atSec) || t.atSec < 0) {
+      throw new Error(`mix-audio: "${t.path}" starts at ${t.atSec}s — a start must be a non-negative number`);
+    }
+    const ms = Math.round(t.atSec * 1000);
+    const chain = [`[${i}:a]aresample=48000`, `adelay=${ms}|${ms}`];
+    if (t.gainDb) chain.push(`volume=${t.gainDb}dB`);
+    if (t.fadeInSec) chain.push(`afade=t=in:st=${t.atSec}:d=${t.fadeInSec}`);
+    if (t.fadeOutSec) {
+      // Measured from the END of the film, because a cue's own length is not knowable from the spec.
+      const at = Math.max(0, spec.durationSec - t.fadeOutSec);
+      chain.push(`afade=t=out:st=${at}:d=${t.fadeOutSec}`);
+    }
+    const l = label(i);
+    parts.push(`${chain.join(',')}[${l}]`);
+    if (t.role === 'voice') voices.push(l);
+    else if (t.duck) ducked.push(l);
+    else plain.push(l);
+  });
+
+  if (ducked.length && !voices.length) {
+    throw new Error('mix-audio: a track asks to be ducked, but no track is marked role "voice" to duck it');
+  }
+
+  let voiceBus = '';
+  if (voices.length) {
+    voiceBus = 'vox';
+    parts.push(voices.length === 1
+      ? `[${voices[0]}]anull[${voiceBus}]`
+      : `${voices.map((l) => `[${l}]`).join('')}amix=inputs=${voices.length}:normalize=0[${voiceBus}]`);
+  }
+
+  const beds: string[] = [];
+  if (ducked.length) {
+    // The narration itself opens the gap. A threshold high enough to ignore room tone, a slow release
+    // so the bed does not pump between words.
+    //
+    // THE THRESHOLD IS ABSOLUTE, so how deep the bed dips is set by how loud the VOICE is, not by the
+    // gap between them. Measured against the same bed: a voice at -3dB pulls the mix down 1.4dB, at
+    // -12dB 0.8dB, and at -24dB not at all — below the threshold nothing ducks. Level the narration
+    // before mixing, or set its gain so it actually crosses; a quiet take silently gets no ducking.
+    // The key is padded to the film's length. `sidechaincompress` ends its OUTPUT when the sidechain
+    // ends, so an unpadded key truncated the bed at the last word — measured at -91dB against -33dB
+    // for the same music one second later. Music dying when narration stops is the exact opposite of
+    // what ducking is for.
+    parts.push(`[${voiceBus}]asplit=2[vmix][vkeyraw]`);
+    parts.push(`[vkeyraw]apad=whole_dur=${spec.durationSec}[vkey]`);
+    const bed = ducked.length === 1 ? ducked[0] : 'beds';
+    if (ducked.length > 1) parts.push(`${ducked.map((l) => `[${l}]`).join('')}amix=inputs=${ducked.length}:normalize=0[beds]`);
+    parts.push(`[${bed}][vkey]sidechaincompress=threshold=0.03:ratio=8:attack=20:release=600[duckedbed]`);
+    beds.push('duckedbed', 'vmix');
+  } else if (voiceBus) {
+    beds.push(voiceBus);
+  }
+  beds.push(...plain);
+
+  // `apad` with no bound pads FOREVER, and `atrim` downstream does not always close the graph — a
+  // review's fifty-track stress spec ran ffmpeg for an hour without finishing. Pad to the film's own
+  // length instead, so the padding ends on its own and `atrim` only ever has to cut.
+  const out = 'mix';
+  const tail = `apad=whole_dur=${spec.durationSec},atrim=0:${spec.durationSec},asetpts=N/SR/TB[${out}]`;
+  parts.push(beds.length === 1
+    ? `[${beds[0]}]${tail}`
+    : `${beds.map((l) => `[${l}]`).join('')}amix=inputs=${beds.length}:normalize=0,${tail}`);
+
+  return { graph: parts.join(';'), out };
+}
+
+export function mix(runDir: string, specPath: string, outPath: string): string {
+  const spec = JSON.parse(readFileSync(specPath, 'utf8')) as MixSpec;
+  const resolve = (p: string) => (isAbsolute(p) ? p : join(runDir, p));
+  for (const t of spec.tracks) {
+    if (!existsSync(resolve(t.path))) throw new Error(`mix-audio: no such track — ${t.path}`);
+  }
+  const { graph, out } = filtergraph(spec);
+  const args = ['-y', '-hide_banner', '-loglevel', 'error'];
+  for (const t of spec.tracks) args.push('-i', resolve(t.path));
+  args.push('-filter_complex', graph, '-map', `[${out}]`, '-c:a', 'aac', '-b:a', '192k', outPath);
+  mkdirSync(dirname(outPath), { recursive: true });
+  execFileSync(FFMPEG, args);
+  return outPath;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const { values, positionals } = parseFlags({
+    args: process.argv.slice(2),
+    options: { spec: { type: 'string' }, out: { type: 'string' }, 'print-graph': { type: 'boolean' } },
+    allowPositionals: true,
+  });
+  const [runDir] = positionals;
+  if (!runDir) {
+    console.error('usage: mix-audio.ts <run-dir> [--spec audio/mix.json] [--out audio/mix.m4a] [--print-graph]');
+    process.exit(2);
+  }
+  const specPath = join(runDir, values.spec ?? 'audio/mix.json');
+  if (!existsSync(specPath)) {
+    console.error(`mix-audio: no spec at ${specPath} — it lists each track with its path, atSec, gainDb and role`);
+    process.exit(2);
+  }
+  if (values['print-graph']) {
+    console.log(filtergraph(JSON.parse(readFileSync(specPath, 'utf8')) as MixSpec).graph);
+    process.exit(0);
+  }
+  const out = mix(runDir, specPath, join(runDir, values.out ?? 'audio/mix.m4a'));
+  console.log(`mix-audio: ${out}`);
+}
diff --git a/pipeline/scripts/mux-audio.sh b/pipeline/scripts/mux-audio.sh
index dbacc4e..1d512ab 100755
--- a/pipeline/scripts/mux-audio.sh
+++ b/pipeline/scripts/mux-audio.sh
@@ -3,26 +3,54 @@
 # onto the clean silent render. Deterministic; run OUTSIDE any sandbox is NOT required (ffmpeg only).
 #
 #   bash pipeline/scripts/mux-audio.sh <run-dir>
-# Reads <run-dir>/meta.json for the source video path; muxes <run-dir>/final/out.silent.mp4 -> out.mp4.
+# Audio comes from --audio when given, else from <run-dir>/meta.json's source video. Muxes
+# <run-dir>/<doc>/out.silent.mp4 -> out.mp4, where <doc> defaults to final.
 #   VEED_ENGINE_FFMPEG  ffmpeg (default: ffmpeg on PATH)
 set -euo pipefail
-DIR="${1:?usage: mux-audio.sh <run-dir>}"
+DIR="${1:?usage: mux-audio.sh <run-dir> [--doc final] [--audio <file>]}"
+shift || true
+# A film gates and delivers one chapter at a time, and its audio is a built mix rather than the
+# source clip's track — hardcoding both was why the chain's own --doc flag stopped at the engine.
+DOC="final"
+AUDIO=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --doc) DOC="${2:?--doc needs a subdirectory}"; shift ;;
+    --audio) AUDIO="${2:?--audio needs a file}"; shift ;;
+    *) echo "mux-audio: unknown flag $1" >&2; exit 2 ;;
+  esac
+  shift
+done
 FF="${VEED_ENGINE_FFMPEG:-ffmpeg}"
-SILENT="$DIR/final/out.silent.mp4"
-OUT="$DIR/final/out.mp4"
+FP="${VEED_ENGINE_FFPROBE:-ffprobe}"
+SILENT="$DIR/$DOC/out.silent.mp4"
+OUT="$DIR/$DOC/out.mp4"
 [ -f "$SILENT" ] || { echo "mux: missing $SILENT (render first)"; exit 1; }
 
-# videoPath from meta.json (no jq): first "videoPath": "..." value.
-SRC="$(grep -m1 '"videoPath"' "$DIR/meta.json" | sed -E 's/.*"videoPath": *"([^"]+)".*/\1/')"
-[ -n "$SRC" ] && [ -f "$SRC" ] || { echo "mux: could not resolve source video from $DIR/meta.json"; exit 1; }
+# The audio is either a track that was BUILT for this run (a mix of narration, music and effects) or
+# the source clip's own. Only the second needs meta.json — a run with no footage has none, and
+# requiring it was why the footage-free path failed at its last gate.
+if [ -n "$AUDIO" ]; then
+  SRC="$AUDIO"
+  [ -f "$SRC" ] || { echo "mux: no audio at $SRC"; exit 1; }
+else
+  # videoPath from meta.json (no jq): first "videoPath": "..." value.
+  [ -f "$DIR/meta.json" ] || { echo "mux: no $DIR/meta.json and no --audio — say which track to lay on"; exit 2; }
+  SRC="$(grep -m1 '"videoPath"' "$DIR/meta.json" | sed -E 's/.*"videoPath": *"([^"]+)".*/\1/')"
+  [ -n "$SRC" ] && [ -f "$SRC" ] || { echo "mux: could not resolve source video from $DIR/meta.json"; exit 1; }
+fi
 
 # -map 1:a:0? tolerates a source with no audio track (out.mp4 then == silent render); -shortest trims to video.
 # Write to a tmp name and rename: out.mp4 is watched live by the preview server, so its
 # existence must mean completeness (a moov-less in-progress file plays as broken "done").
 # +faststart keeps moov up front (the engine records it that way; default muxing would move it
 # to the tail, making the deliverable start slower anywhere without Range support).
-TMP="$DIR/final/out.tmp.mp4"
+TMP="$DIR/$DOC/out.tmp.mp4"
+# The PICTURE decides the length. `-shortest` let a built mix truncate the film — a 2s track over a
+# 6s render wrote a 2s deliverable and exited 0, which destroys work without saying so.
+VDUR="$("$FP" -v error -select_streams v:0 -show_entries stream=duration -of csv=p=0 "$SILENT")"
+[ -n "$VDUR" ] || VDUR="$("$FP" -v error -show_entries format=duration -of csv=p=0 "$SILENT")"
 "$FF" -y -hide_banner -loglevel error -i "$SILENT" -i "$SRC" \
-  -map 0:v:0 -map 1:a:0? -c:v copy -c:a aac -shortest -movflags +faststart "$TMP"
+  -map 0:v:0 -map 1:a:0? -c:v copy -c:a aac -t "$VDUR" -movflags +faststart "$TMP"
 mv "$TMP" "$OUT"
 echo "mux: wrote $OUT"
diff --git a/pipeline/scripts/probe-qa.ts b/pipeline/scripts/probe-qa.ts
index 301049e..3894d6f 100644
--- a/pipeline/scripts/probe-qa.ts
+++ b/pipeline/scripts/probe-qa.ts
@@ -127,9 +127,9 @@ function grayFrame(video: string, tSec: number, w: number, h: number): Uint8Arra
   ], { maxBuffer: 1 << 24 }));
 }
 
-export function probeRun(runDir: string): ProbeResult[] {
+export function probeRun(runDir: string, doc = 'final'): ProbeResult[] {
   const meta = JSON.parse(readFileSync(join(runDir, 'meta.json'), 'utf8')) as { videoPath: string; width: number; height: number; durationSec: number };
-  const render = join(runDir, 'final', 'out.silent.mp4');
+  const render = join(runDir, doc, 'out.silent.mp4');
   if (!existsSync(render)) throw new Error(`no ${render} — record first`);
   const portrait = meta.height >= meta.width;
   const [w, h] = portrait ? [GRID_W, GRID_H] : [GRID_H, GRID_W];
@@ -164,9 +164,16 @@ export function probeRun(runDir: string): ProbeResult[] {
 
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
   const argv = process.argv.slice(2);
-  const runDir = argv.find((a) => !a.startsWith('--'));
-  if (!runDir) { console.error('usage: node --import tsx pipeline/scripts/probe-qa.ts <runDir> [--json]'); process.exit(2); }
-  const results = probeRun(runDir);
+  // The value of a flag is not a positional. `--doc chapters/act-1 runs/f` took the chapter as the run.
+  const skip = new Set<number>();
+  argv.forEach((a, i) => { if (a === '--doc') skip.add(i + 1); });
+  const runDir = argv.find((a, i) => !a.startsWith('--') && !skip.has(i));
+  if (!runDir) { console.error('usage: node --import tsx pipeline/scripts/probe-qa.ts <runDir> [--doc final] [--json]'); process.exit(2); }
+  // A film gates one chapter at a time, so the document is not always `final`.
+  const at = argv.indexOf('--doc');
+  const doc = at >= 0 ? argv[at + 1] : 'final';
+  if (at >= 0 && !doc) { console.error('--doc needs a subdirectory'); process.exit(2); }
+  const results = probeRun(runDir, doc);
   if (argv.includes('--json')) console.log(JSON.stringify(results, null, 2));
   else for (const r of results) {
     console.log(`beat ${r.beat} ${r.probe}@${r.tSec}s ink=${r.inkPct}% contrast=${r.contrast ?? '-'} ${r.verdict.toUpperCase()}${r.notes.length ? ' — ' + r.notes.join('; ') : ''}`);
diff --git a/pipeline/scripts/sample-style.ts b/pipeline/scripts/sample-style.ts
index caa963a..7da690c 100644
--- a/pipeline/scripts/sample-style.ts
+++ b/pipeline/scripts/sample-style.ts
@@ -15,6 +15,9 @@
 // `coverage.filtered:false` and the SKILL asks the user instead of deciding for them.
 // Overrides:
 //   --seed <n>       draw with an explicit seed (browse alternatives deterministically)
+//   --exclude <id>   remove an id from the pool; repeatable. Use it when a SET is being made and two
+//                    pieces must not land on the same style — say the taken ids once rather than
+//                    reseeding until a collision stops happening.
 //   --style <id>     force a specific ref id (bypasses the draw AND the hard filter, still validated
 //                    against the index — an id outside it is rejected)
 //   --recipes-only   restrict the pool to compiled refs (kept for compatibility; a no-op while the
@@ -176,7 +179,7 @@ function weightedDraw(pool: Candidate[], wanted: string[], seed: number): Candid
   return pool[pool.length - 1];
 }
 
-export function sampleStyle(runDir: string, opts: { seed?: number; style?: string; recipesOnly?: boolean } = {}): StylePick {
+export function sampleStyle(runDir: string, opts: { seed?: number; style?: string; recipesOnly?: boolean; exclude?: string[] } = {}): StylePick {
   const repoRoot = REPO_ROOT;
   const meta = JSON.parse(readFileSync(join(runDir, 'meta.json'), 'utf8')) as { key?: string; width: number; height: number };
   const aspect: '9:16' | '16:9' = meta.height >= meta.width ? '9:16' : '16:9';
@@ -202,6 +205,20 @@ export function sampleStyle(runDir: string, opts: { seed?: number; style?: strin
   if (!pool.length) throw new Error(`no ${aspect} refs available with a recipe`);
   const coverage: Coverage = { aspect, sheets: sheets.length, threshold: SHEET_THRESHOLD, filtered };
 
+  // EXCLUSIONS. A set of videos made together must not land on one style, and the launch session had
+  // no way to say so: its briefs told each agent to "retry with another seed until you get a fresh
+  // id", which put the divergence rule in prose, made it the agent's job to notice a collision, and
+  // lost the whole list to the next compaction. Naming the taken ids removes them from the pool once.
+  const exclude = new Set(opts.exclude ?? []);
+  const unknown = [...exclude].filter((id) => !cands.some((c) => c.id === id));
+  if (unknown.length) {
+    throw new Error(`--exclude names ${unknown.length} id(s) outside the ${aspect} runtime index: ${unknown.join(', ')}`);
+  }
+  const drawPool = exclude.size ? pool.filter((c) => !exclude.has(c.id)) : pool;
+  if (!drawPool.length) {
+    throw new Error(`every ${aspect} style is excluded (${exclude.size} of ${pool.length}) — widen the set or drop an exclusion`);
+  }
+
   const seed = opts.seed ?? seedFromKey(key);
   let pick: Candidate;
   if (opts.style) {
@@ -212,13 +229,13 @@ export function sampleStyle(runDir: string, opts: { seed?: number; style?: strin
     if (!forced) throw new Error(`--style "${opts.style}" is not a valid ${aspect} candidate (recipes-only index; ${cands.length} available: ${cands.map((c) => c.id).slice(0, 8).join(', ')}…)`);
     pick = forced;
   } else {
-    pick = weightedDraw(pool, wanted, seed);
+    pick = weightedDraw(drawPool, wanted, seed);
   }
 
   // Next-best RECIPE'D aspect-matched ids by weight (stable tie-break by id), pick excluded — the
   // creative-pass mixing pool is validated recipes only (raw prefabs never surface at runtime).
   const alternates = cands
-    .filter((c) => c.id !== pick.id && c.hasRecipe)
+    .filter((c) => c.id !== pick.id && c.hasRecipe && !exclude.has(c.id))
     .map((c) => ({ id: c.id, w: 1 + scoreOf(c, wanted) * 2 }))
     .sort((a, b) => b.w - a.w || a.id.localeCompare(b.id))
     .slice(0, 4)
@@ -264,16 +281,17 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
       seed: { type: 'string' },
       style: { type: 'string' },
       'recipes-only': { type: 'boolean' },
+      exclude: { type: 'string', multiple: true },
     },
   });
   const run = values.run;
-  if (!run) { console.error('usage: node --import tsx pipeline/scripts/sample-style.ts --run <runDir> [--seed N] [--style <id>] [--recipes-only]'); process.exit(2); }
+  if (!run) { console.error('usage: node --import tsx pipeline/scripts/sample-style.ts --run <runDir> [--seed N] [--style <id>] [--exclude <id>]... [--recipes-only]'); process.exit(2); }
   let seed: number | undefined;
   if (values.seed !== undefined) {
     seed = Number(values.seed);
     if (!Number.isFinite(seed)) { console.error(`--seed must be a number, got "${values.seed}"`); process.exit(2); }
   }
-  const s = sampleStyle(run, { seed, style: values.style, recipesOnly: values['recipes-only'] ?? false });
+  const s = sampleStyle(run, { seed, style: values.style, recipesOnly: values['recipes-only'] ?? false, exclude: values.exclude as string[] | undefined });
   const cov = s.coverage.filtered ? 'recipes-only pool' : `COVERAGE MODE (${s.coverage.sheets}/${s.coverage.threshold} sheets)`;
   console.log(`[sample-style] ${s.refId} seed=${s.seed} recipe=${s.hasRecipe ? 'yes' : 'no'} energy=${s.energy} ${cov}`);
   console.log(`  alternates: ${s.alternates.join(', ')}`);
diff --git a/pipeline/scripts/scene-frames.ts b/pipeline/scripts/scene-frames.ts
new file mode 100644
index 0000000..90b0fdc
--- /dev/null
+++ b/pipeline/scripts/scene-frames.ts
@@ -0,0 +1,114 @@
+// Frames for a clip that has no beats.
+//
+// `extract-beat-frames.ts` samples one still per transcript chunk, which is the right unit for a
+// captioned run and no unit at all for the others: a 3-second UGC clip with no dialogue, a card with
+// no audio track, a piece of stock footage. All 52 agent briefs of the launch session handled that by
+// writing the footage into the brief in prose — "her head sits roughly y430-900; the ceiling band
+// y0-420 is empty; the doorway is centre-right" — retyped per agent, per round, and never checkable.
+//
+// This samples on TIME instead, and emits the plan alongside the stills so a vision pass writes facts
+// against sample indices rather than against beats that do not exist.
+//
+//   scene-frames.ts <video.mp4> <outDir> [--count 8]
+import { execFileSync } from 'node:child_process';
+import { writeFileSync, mkdirSync, existsSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { parseFlags } from '../../veed/args.ts';
+import { FFMPEG, FFPROBE } from '../../config.ts';
+
+export interface Sample { i: number; sec: number; frame: number; path: string }
+export interface ScenePlan {
+  video: string;
+  durationSec: number;
+  fps: number;
+  width: number;
+  height: number;
+  /** Half-canvas, like the beat frames — a vision pass doubles every pixel it reads off one. */
+  frameWidth: number;
+  frameHeight: number;
+  samples: Sample[];
+}
+
+function probe(video: string): { durationSec: number; fps: number; width: number; height: number } {
+  const out = execFileSync(FFPROBE, [
+    '-v', 'error', '-select_streams', 'v:0',
+    '-show_entries', 'stream=width,height,r_frame_rate,duration:format=duration',
+    '-of', 'json', video,
+  ], { encoding: 'utf8' });
+  const j = JSON.parse(out) as {
+    streams: { width: number; height: number; r_frame_rate: string; duration?: string }[];
+    format: { duration: string };
+  };
+  const s = j.streams[0];
+  const [n, d] = s.r_frame_rate.split('/').map(Number);
+  // The CONTAINER's duration follows its longest stream. A file whose audio outlasts its picture — an
+  // ordinary thing — then puts most samples past the last frame, where ffmpeg writes nothing and exits
+  // 0. Sample against the picture, and fall back to the container only when the stream does not say.
+  const streamSec = Number(s.duration);
+  const formatSec = Number(j.format.duration);
+  const durationSec = Number.isFinite(streamSec) && streamSec > 0 ? Math.min(streamSec, formatSec || streamSec) : formatSec;
+  return { durationSec, fps: d ? n / d : n, width: s.width, height: s.height };
+}
+
+/**
+ * Samples spread across the clip, avoiding both ends.
+ *
+ * The first and last frames of a clip are the least representative moments it has — a fade, a slate, a
+ * hand still leaving the frame — so the samples sit inside a margin rather than at 0 and `duration`.
+ */
+export function planFor(video: string, outDir: string, count = 8): ScenePlan {
+  const { durationSec, fps, width, height } = probe(video);
+  const margin = Math.min(0.25, durationSec / (count + 2));
+  const span = Math.max(0, durationSec - margin * 2);
+  const samples: Sample[] = [];
+  for (let i = 0; i < count; i++) {
+    const sec = count === 1 ? durationSec / 2 : margin + (span * i) / (count - 1);
+    samples.push({ i: i + 1, sec: Number(sec.toFixed(3)), frame: Math.round(sec * fps), path: join(outDir, `scene-${i + 1}.png`) });
+  }
+  return { video, durationSec, fps, width, height, frameWidth: Math.round(width / 2), frameHeight: Math.round(height / 2), samples };
+}
+
+export function extractSceneFrames(video: string, outDir: string, count = 8): ScenePlan {
+  const plan = planFor(video, outDir, count);
+  mkdirSync(outDir, { recursive: true });
+  const missing: string[] = [];
+  for (const s of plan.samples) {
+    execFileSync(FFMPEG, [
+      '-y', '-hide_banner', '-loglevel', 'error',
+      '-ss', String(s.sec), '-i', video, '-frames:v', '1',
+      '-vf', `scale=${plan.frameWidth}:${plan.frameHeight}`, s.path,
+    ]);
+    // A seek past the end of the VIDEO stream writes nothing and exits 0. `format.duration` follows
+    // the longest stream, so an ordinary file whose audio outlasts its picture silently produced a
+    // plan of eight stills with five of them absent — and a vision pass reads that as an empty frame.
+    if (!existsSync(s.path) || statSync(s.path).size === 0) missing.push(`${s.path} (${s.sec}s)`);
+  }
+  if (missing.length) {
+    throw new Error(
+      `ffmpeg wrote no frame for ${missing.length} of ${plan.samples.length} samples — the seek is past ` +
+      `the end of the video stream, which happens when the audio runs longer than the picture:\n  ${missing.join('\n  ')}`,
+    );
+  }
+  writeFileSync(join(outDir, 'scene-plan.json'), JSON.stringify(plan, null, 2) + '\n');
+  return plan;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const { values, positionals } = parseFlags({
+    args: process.argv.slice(2),
+    options: { count: { type: 'string' } },
+    allowPositionals: true,
+  });
+  const [video, outDir] = positionals;
+  if (!video || !outDir) { console.error('usage: scene-frames.ts <video.mp4> <outDir> [--count 8]'); process.exit(2); }
+  const count = Number(values.count ?? 8);
+  if (!Number.isInteger(count) || count < 1) {
+    console.error(`--count must be a positive integer, got "${values.count}"`);
+    process.exit(2);
+  }
+  const plan = extractSceneFrames(video, outDir, count);
+  console.log(`scene-frames: ${plan.samples.length} stills at ${plan.frameWidth}x${plan.frameHeight} → ${outDir}`);
+  console.log(`  sampled at ${plan.samples.map((s) => `${s.sec}s`).join(', ')}`);
+  console.log(`  plan: ${join(outDir, 'scene-plan.json')}`);
+}
diff --git a/pipeline/scripts/scoped-edit.ts b/pipeline/scripts/scoped-edit.ts
new file mode 100644
index 0000000..3ebd349
--- /dev/null
+++ b/pipeline/scripts/scoped-edit.ts
@@ -0,0 +1,253 @@
+// Proves that an edit changed only what it was asked to change.
+//
+// "I told you to move nothing" is corpus class `regression`, 7 recorded corrections, and every
+// instance of it is decidable from the two documents alone. It is the largest defect class in the
+// corpus that is 100% static — the two others are one record each. --verify cannot help: both
+// documents are valid, and a caption that moved 40ms is exactly as renderable as one that did not.
+//
+//   node --import tsx pipeline/scripts/scoped-edit.ts <baseline.wv> <candidate.wv> --allow .card3 --allow #cue2
+//
+// Exit 0 when every difference falls inside the allowed set, 1 otherwise. With no --allow the check
+// is "nothing at all may differ", which is the right gate for a pure re-render.
+import { readFileSync } from 'node:fs';
+import { pathToFileURL } from 'node:url';
+import { parseFlags } from '../../veed/args.ts';
+
+export interface Drift {
+  where: string;
+  what: string;
+  from: string;
+  to: string;
+}
+
+/** The stylesheet with every @keyframes block cut out — its steps parse as rules otherwise, and one
+ *  retimed keyframe would then be reported twice. */
+/** The CSS inside every <style> block, tags stripped — `String.match` with /g returns whole matches,
+ *  so keeping them would put `<style>` into the first selector of every document. */
+function styleText(src: string): string {
+  return (src.match(/<style\b[^>]*>[\s\S]*?<\/style>/gi) ?? [])
+    .map((b) => b.replace(/^<style\b[^>]*>/i, '').replace(/<\/style>$/i, ''))
+    .join('\n');
+}
+
+function rulesOnly(src: string): string {
+  const css = styleText(src);
+  let out = '';
+  let i = 0;
+  const re = /@keyframes\s+[\w-]+\s*\{/g;
+  let m: RegExpExecArray | null;
+  while ((m = re.exec(css))) {
+    out += css.slice(i, m.index);
+    let depth = 1, j = re.lastIndex;
+    while (j < css.length && depth > 0) {
+      if (css[j] === '{') depth++;
+      else if (css[j] === '}') depth--;
+      j++;
+    }
+    i = j;
+    re.lastIndex = j;
+  }
+  return out + css.slice(i);
+}
+
+/** selector → its declaration block, flattened so ordering noise does not read as a change. */
+function cssRules(src: string): Map<string, Map<string, string>> {
+  const css = rulesOnly(src);
+  const out = new Map<string, Map<string, string>>();
+  for (const m of css.replace(/\/\*[\s\S]*?\*\//g, '').matchAll(/([^{}]+)\{([^{}]*)\}/g)) {
+    const selector = m[1].trim().split('\n').map((s) => s.trim()).filter(Boolean).join(' ');
+    if (!selector || selector.startsWith('@')) continue;
+    const decls = out.get(selector) ?? new Map<string, string>();
+    for (const d of m[2].split(';')) {
+      const i = d.indexOf(':');
+      if (i < 0) continue;
+      decls.set(d.slice(0, i).trim(), d.slice(i + 1).trim().replace(/\s+/g, ' '));
+    }
+    out.set(selector, decls);
+  }
+  return out;
+}
+
+/** @keyframes name → its body, whitespace-normalised. Timing lives here as much as in the rules. */
+function keyframes(src: string): Map<string, string> {
+  const css = styleText(src);
+  const out = new Map<string, string>();
+  const re = /@keyframes\s+([\w-]+)\s*\{/g;
+  let m: RegExpExecArray | null;
+  while ((m = re.exec(css))) {
+    let depth = 1, i = re.lastIndex;
+    while (i < css.length && depth > 0) {
+      if (css[i] === '{') depth++;
+      else if (css[i] === '}') depth--;
+      i++;
+    }
+    out.set(m[1], css.slice(re.lastIndex, i - 1).replace(/\s+/g, ' ').trim());
+  }
+  return out;
+}
+
+/** id → the element's own inline style and text, where generated documents keep per-beat timing. */
+function elements(src: string): Map<string, { style: string; text: string }> {
+  const out = new Map<string, { style: string; text: string }>();
+  for (const m of src.matchAll(/<([a-zA-Z][\w-]*)((?:"[^"]*"|'[^']*'|[^>"'])*)>([^<]*)/g)) {
+    const id = m[2].match(/\bid="([^"]+)"/)?.[1];
+    if (!id) continue;
+    out.set(id, {
+      style: (m[2].match(/style=(?:"([^"]*)"|'([^']*)')/i)?.slice(1).find((v) => v !== undefined) ?? '').replace(/\s+/g, ' ').trim(),
+      text: m[3].trim(),
+    });
+  }
+  return out;
+}
+
+/**
+ * TRUE when `where` is inside the edit's stated scope.
+ *
+ * EXACT, per namespace. A first version matched by substring, so `--allow .card` silently blessed
+ * `.card3`, `.discard` and `@keyframes cardIn`, and `--allow ""` disabled the gate entirely — in the
+ * one tool whose whole purpose is proving that only the named thing changed.
+ */
+function allowed(where: string, allow: string[]): boolean {
+  const kf = where.match(/^@keyframes\s+([\w-]+)$/)?.[1];
+  const id = where.match(/^#([\w-]+)$/)?.[1];
+  // A selector may be a list ('.a, .b'); every part must be covered for the change to be in scope.
+  const parts = kf || id ? [] : where.split(',').map((x) => x.trim()).filter(Boolean);
+
+  const covers = (token: string, target: string): boolean => {
+    const t = token.trim();
+    if (!t) return false;
+    if (kf) return t === kf || t === `@keyframes ${kf}`;
+    if (id) return t === `#${id}` || t === id;
+    // A class token covers a selector whose own class is exactly that class.
+    if (t.startsWith('.')) return target === t || target.split(/[\s>+~:]/)[0] === t;
+    if (t.startsWith('#')) return target === t;
+    return target === t;
+  };
+
+  if (kf || id) return allow.some((t) => covers(t, where));
+  return parts.length > 0 && parts.every((part) => allow.some((t) => covers(t, part)));
+}
+
+export function scopedDrift(baseline: string, candidate: string, allow: string[]): Drift[] {
+  const drift: Drift[] = [];
+
+  const compare = (kind: string, a: Map<string, string>, b: Map<string, string>, where: string) => {
+    for (const [k, v] of a) {
+      const w = b.get(k);
+      if (w === undefined) drift.push({ where, what: `${kind} ${k}`, from: v, to: '(removed)' });
+      else if (w !== v) drift.push({ where, what: `${kind} ${k}`, from: v, to: w });
+    }
+    for (const [k, v] of b) if (!a.has(k)) drift.push({ where, what: `${kind} ${k}`, from: '(absent)', to: v });
+  };
+
+  const ra = cssRules(baseline), rb = cssRules(candidate);
+  for (const [sel, decls] of ra) {
+    if (allowed(sel, allow)) continue;
+    const other = rb.get(sel);
+    if (!other) { drift.push({ where: sel, what: 'rule', from: 'present', to: '(removed)' }); continue; }
+    compare('declaration', decls, other, sel);
+  }
+  for (const sel of rb.keys()) {
+    if (!ra.has(sel) && !allowed(sel, allow)) drift.push({ where: sel, what: 'rule', from: '(absent)', to: 'added' });
+  }
+
+  const ka = keyframes(baseline), kb = keyframes(candidate);
+  for (const [name, body] of ka) {
+    if (allowed(name, allow)) continue;
+    const other = kb.get(name);
+    if (other === undefined) drift.push({ where: `@keyframes ${name}`, what: 'block', from: 'present', to: '(removed)' });
+    else if (other !== body) drift.push({ where: `@keyframes ${name}`, what: 'block', from: body, to: other });
+  }
+
+  const ea = elements(baseline), eb = elements(candidate);
+  for (const [id, el] of ea) {
+    if (allowed(`#${id}`, allow) || allowed(id, allow)) continue;
+    const other = eb.get(id);
+    if (!other) { drift.push({ where: `#${id}`, what: 'element', from: 'present', to: '(removed)' }); continue; }
+    if (other.style !== el.style) drift.push({ where: `#${id}`, what: 'inline style', from: el.style, to: other.style });
+    if (other.text !== el.text) drift.push({ where: `#${id}`, what: 'text', from: el.text, to: other.text });
+  }
+  for (const [id, el] of eb) {
+    if (ea.has(id)) continue;
+    if (allowed(`#${id}`, allow) || allowed(id, allow)) continue;
+    drift.push({ where: `#${id}`, what: 'element', from: '(absent)', to: el.text || 'added' });
+  }
+
+  return drift;
+}
+
+/**
+ * The markup this comparison never looks at.
+ *
+ * It reads CSS rules, keyframes, and the inline style and first text node of ELEMENTS THAT CARRY AN
+ * ID. A generated caption puts its words and their per-word delays on unidentified spans, so all of it
+ * fell outside every view — the tool reported "the documents are equivalent" after every glyph had
+ * been retimed by 400ms and every word replaced. What it cannot attribute, it now says it cannot
+ * attribute, instead of calling it equivalence.
+ */
+export function unattributed(src: string, allow: string[] = []): string {
+  // An element the caller ALLOWED to change must leave the residual with its children, or `--allow`
+  // could never pass: a retimed caption is unattributable by construction, so permitting it and then
+  // reporting it as unattributed made the documented mode a constant failure.
+  let out = src;
+  for (const id of allow.map((a) => a.replace(/^#/, ''))) {
+    out = removeElement(out, id);
+  }
+  return out
+    .replace(/<style\b[^>]*>[\s\S]*?<\/style>/gi, '')          // every rule is compared elsewhere
+    .replace(/<([a-zA-Z][\w-]*)((?:"[^"]*"|'[^']*'|[^>"'])*\bid="[^"]+"(?:"[^"]*"|'[^']*'|[^>"'])*)>([^<]*)/g, '')
+    .replace(/\s+/g, ' ')
+    .trim();
+}
+
+/** An id-carrying element and everything inside it, by tag depth rather than by the first close tag. */
+function removeElement(src: string, id: string): string {
+  const open = new RegExp(`<([a-zA-Z][\\w-]*)((?:"[^"]*"|'[^']*'|[^>"'])*\\bid="${id.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}"(?:"[^"]*"|'[^']*'|[^>"'])*)>`);
+  const m = open.exec(src);
+  if (!m) return src;
+  const tag = m[1].toLowerCase();
+  const tagRe = new RegExp(`<(/?)(${tag})\\b((?:"[^"]*"|'[^']*'|[^>"'])*)>`, 'gi');
+  tagRe.lastIndex = m.index + m[0].length;
+  let depth = 1;
+  let hit: RegExpExecArray | null;
+  while ((hit = tagRe.exec(src))) {
+    if (/\/\s*$/.test(hit[3])) continue;
+    depth += hit[1] ? -1 : 1;
+    if (depth === 0) return src.slice(0, m.index) + src.slice(tagRe.lastIndex);
+  }
+  return src.slice(0, m.index); // unbalanced markup: drop the rest rather than report it as drift
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const { values, positionals } = parseFlags({
+    args: process.argv.slice(2),
+    options: { allow: { type: 'string', multiple: true } },
+    allowPositionals: true,
+  });
+  const files = positionals;
+  const allow = (values.allow as string[] | undefined) ?? [];
+  if (files.length < 2) {
+    console.error('usage: node --import tsx pipeline/scripts/scoped-edit.ts <baseline.wv> <candidate.wv> [--allow <selector|id>]...');
+    process.exit(2);
+  }
+  const baseline = readFileSync(files[0], 'utf8');
+  const candidate = readFileSync(files[1], 'utf8');
+  const drift = scopedDrift(baseline, candidate, allow);
+  const blind = unattributed(baseline, allow) !== unattributed(candidate, allow);
+  if (!drift.length && !blind) {
+    console.log(allow.length
+      ? `scoped-edit: clean — only ${allow.join(', ')} changed`
+      : 'scoped-edit: clean — no change in the rules, the keyframes, or any element carrying an id');
+    process.exit(0);
+  }
+  if (blind) {
+    console.log(
+      'DRIFT (unattributed) — the documents differ in markup this tool does not inspect: text and ' +
+      'inline styles on elements with no id. That is where a generated caption keeps its words and ' +
+      'their per-word delays, so this cannot be reported as equivalence.',
+    );
+  }
+  for (const d of drift) console.log(`DRIFT ${d.where} — ${d.what}: ${d.from.slice(0, 60)} → ${d.to.slice(0, 60)}`);
+  console.log(`scoped-edit: ${drift.length} attributed change(s)${blind ? ' plus unattributed markup' : ''} outside${allow.length ? ` ${allow.join(', ')}` : ' the stated scope'}`);
+  process.exit(1);
+}
diff --git a/prep/whisper.ts b/prep/whisper.ts
index f26e49f..ef70d86 100644
--- a/prep/whisper.ts
+++ b/prep/whisper.ts
@@ -3,7 +3,11 @@
 // service or MCP plugs into — no transcription is run here, and no credential is handled here.
 // For the built-in local provider use prep/transcribe.ts, which drives WhisperX itself.
 //
-//   node --import tsx prep/whisper.ts <whisper.json> <video.mp4> [<whisper.json> <video.mp4> ...]
+//   node --import tsx prep/whisper.ts <whisper.json> <media> [<whisper.json> <media> ...]
+//
+// `<media>` is a video OR an audio file. Nothing here probes it — it names the run and has to
+// exist — so a film's GENERATED narration reaches `transcript.json` the same way a source clip's
+// speech does, which is the only route a run with no footage yet has to per-word times.
 //
 // Producing the input, word timings included (they are required):
 //   whisperx     video.mp4 --output_format json --output_dir .        # emits word times by default
@@ -22,7 +26,7 @@ import { resolveVideoArg, runKeyOf } from '../pipeline/scripts/resolve-video.ts'
 import { validateTranscript } from './transcribe.ts';
 import { mapWhisperTranscript, type WhisperJson } from './whisper-mapper.ts';
 
-const USAGE = 'usage: node --import tsx prep/whisper.ts <whisper.json> <video.mp4> [<whisper.json> <video.mp4> ...]';
+const USAGE = 'usage: node --import tsx prep/whisper.ts <whisper.json> <media> [<whisper.json> <media> ...]  (media = a video or an audio file)';
 
 async function mapOne(jsonArg: string, videoArg: string): Promise<void> {
   if (!existsSync(jsonArg)) {
diff --git a/refs/animations.md b/refs/animations.md
index b14793d..c965a94 100644
--- a/refs/animations.md
+++ b/refs/animations.md
@@ -40,12 +40,16 @@ Words reveal one at a time in reading order (rise + fade), unless noted.
 
 ---
 
-## engine limits worked around
-These are the constraints that shaped the first-batch animations, and only the ones this catalogue's
+## engine behaviour these animations were built around
+These are the findings that shaped the first-batch animations, and only the ones this catalogue's
 refs hit. The current support matrix ships with the release as `.veed-engine/feature-support.md`.
-
-- **No `repeating-linear-gradient`** and **no stacked `background-image` gradient layers** (they collapse / break the background) — use one gradient or a solid fill.
-- **No `vw` font sizes**, **no CSS grid / `mix-blend-mode` / `outline`**, **no SVG `<text>`**, **`<br>` ignored** (use block lines).
-- **No animated `filter: blur`** — the engine holds the keyframe's initial value, so the ramp never plays (slides are fade-only). Static blur renders.
-- **Don't rely on `-webkit-text-stroke`** — it is construct-dependent (renders on a static caption, drops on animated or tilted spans). Ground with an 8-way `text-shadow` instead.
-- **`border-radius` draws a straight 45° chamfer, not a curve** — use %-only clip-path polygons for real corners.
+Each line below is settled by a control render — a document, a control drawing what the claim
+predicts, and a pixel diff between them — and names the probe that settled it; the batch's own
+workarounds are kept where they are the ref's idiom, not where the engine forces them.
+
+- **`repeating-linear-gradient` paints** (probe: repeating-linear-gradient), so a striped fill is available. Stacked `background-image` gradient layers were never probed — the batch saw them break the background, so treat them as unverified, not proven broken.
+- **No CSS grid** (probe: css-grid) — use flex. `vw` font sizes, `mix-blend-mode` and CSS `outline` all render (probes: vw-font-size, mix-blend-mode, css-outline), and so do inline `<svg>` and SVG `<text>` (probes: svg-inline, svg-text).
+- **`<br>` breaks a line of ordinary inline text** (probe: br-ignored) but is inert between `display:inline-block` spans (probe: br-between-inline-blocks) — a per-word caption line still needs its own block element.
+- **No animated `filter: blur`** — the engine holds the keyframe's initial value, so the ramp never plays (probe: animated-blur-holds); slides are fade-only. Static blur renders.
+- **`-webkit-text-stroke` never paints**, on any construct (probe: webkit-text-stroke-never-paints). Ground with an 8-way `text-shadow` instead.
+- **`border-radius` renders a true curve** (probes: border-radius-chamfer, border-radius-chamfer-clipped); only the slash form and per-corner values are ignored (probes: radius-slash-square, per-corner-radius). The %-only clip-path polygons in these refs state their corner geometry explicitly — that is the ref's idiom, not a repair.
diff --git a/refs/html/hook-015 (0-00-14-06)/recipe.md b/refs/html/hook-015 (0-00-14-06)/recipe.md
index 25488a5..65bc2db 100644
--- a/refs/html/hook-015 (0-00-14-06)/recipe.md	
+++ b/refs/html/hook-015 (0-00-14-06)/recipe.md	
@@ -39,7 +39,7 @@ Paste this whole document, then fill: `{videoPath}` (from `meta.json`), the per-
          animation:cueWin linear forwards; }
 
   /* ---- SLOTS (self-contained single classes; rotation is baked into each slot's own
-          keyframes — NEVER var() in a transform). Set A = odd beats, Set B = even beats. ---- */
+          keyframes). Set A = odd beats, Set B = even beats. ---- */
   .sA1 { position:absolute; z-index:2; left:70px;  top:250px; display:inline-block; white-space:nowrap;
          color:#1c1a22; background:#ece6d6; font-weight:600; line-height:1; padding:4px 12px 8px;
          box-shadow:0 2px 6px rgba(0,0,0,.35); transform-origin:center; opacity:0;
@@ -285,7 +285,7 @@ Then record (a SECOND invocation — verify and record are mutually exclusive):
 - No invented or rebased timing — every delay/duration comes verbatim from `word-timings.json`.
 - Never read frames, never eyeball renders, never run ffmpeg checks — `--verify` is the only check.
 - Never drop, reorder or paraphrase a spoken word; every word appears in exactly one phrase.
-- No `var()` anywhere in a transform or keyframe; rotations stay baked in the given keyframes.
+- Rotations stay baked in the given keyframes.
 - No scrim/box behind slot 5; no background on `.sA5`/`.sB5` (the bare aside is intentional).
 - Do not move slot anchors or arrow positions except via the exact fixes in section 6.
 - Do not redesign, re-balance layout aesthetically, or add legibility passes.
diff --git a/refs/html/hook-031 (0-00-00-00)/recipe.md b/refs/html/hook-031 (0-00-00-00)/recipe.md
index c1a9462..9e3e45d 100644
--- a/refs/html/hook-031 (0-00-00-00)/recipe.md	
+++ b/refs/html/hook-031 (0-00-00-00)/recipe.md	
@@ -134,7 +134,7 @@ cueDelayMs 320, next beat 2080 → winMs 1760, gateEnd 2080):
   `animation-duration:{durMs}ms` where `{durMs} = min(350, max(250, gateEnd − delayMs))` — the
   entrance compresses when the gate would close before a full 350ms reveal.
 - Word gap INSIDE a group: a single `&#160;` text node between unit spans (the prefab's own device;
-  inter-span plain whitespace is dropped by the engine). Glued-unit spans are adjacent with no
+  inter-span plain whitespace is not what sets the gap here). Glued-unit spans are adjacent with no
   separator. Spans stay `display:inline-block`; groups stay `white-space:nowrap`.
 - Each beat's `.cue` gets inline `z-index:{10+N}; animation-delay:{cueDelayMs}ms;
   animation-duration:{winMs}ms`. Rows never fade mid-beat — the stack accumulates and HOLDS; the
@@ -186,7 +186,7 @@ Manifest line (already given in section 2): `{"render":{"width":{W},"height":{H}
 - Do not move the slot tops or the 44/81 x-anchors; do not center, re-balance, or swap which side a
   group lands on; the split rule in section B is the only layout authority.
 - No flex anywhere; groups stay `position:absolute` + `inline-block`; words stay `inline-block`.
-- Never animate `color` or `filter`; no `var()` in transforms/keyframes; no `vw`; no text-transform
+- Never animate `color` or `filter`; no text-transform
   reliance — uppercase the strings yourself.
 - Never read the video frames, never run ffmpeg checks — `--verify` is the only self-check.
 - No redesign after render or a verify failure — only the mechanical fixes in section 6.
diff --git a/refs/html/hook-036-peak/recipe.md b/refs/html/hook-036-peak/recipe.md
index 96c720c..afa8f2f 100644
--- a/refs/html/hook-036-peak/recipe.md
+++ b/refs/html/hook-036-peak/recipe.md
@@ -205,8 +205,8 @@ cueDelayMs 1720, cueDurMs 2880 → cueEnd 4600; next beat starts 4600 → winMs
   moment in the beat; that is the invariant the drop rule protects.
 - Glyphs accumulate — every typed glyph HOLDS at full opacity until the cue gate cuts the beat. The
   beat's LAST structure holds and the gate cuts it: no fade-outs anywhere.
-- Word spacing is the `.hw`/`.w` `margin-right` (0.26em on both tiers); inter-span whitespace is
-  dropped by the engine, the margins ARE the gaps. Write spans adjacent with no whitespace between
+- Word spacing is the `.hw`/`.w` `margin-right` (0.26em on both tiers): the margin IS the gap, so it is
+  exact at every size. Write spans adjacent with no whitespace between
   them. Spans stay `display:inline-block`.
 
 ## 5. EMPHASIS
@@ -275,7 +275,6 @@ Manifest line (already given in section 2): `{"render":{"width":{W},"height":{H}
   numbers ONLY via the closed forms in sections 3–4. No per-glyph or per-line fade-outs — the gate
   cuts each beat.
 - No text-transform reliance — uppercase the head-line strings yourself; question words keep their case.
-- Never animate `color` or `filter`; never put `var()` inside a transform or keyframes; no `vw`
-  font sizes; no `-webkit-text-stroke`.
+- Never animate `color` or `filter`; no `-webkit-text-stroke`.
 - Never read the video frames; never re-derive layout; no redesign after a render or verify
   failure — only the mechanical fixes in section 6.
diff --git a/refs/html/hook-040 (0-00-01-03)/recipe.md b/refs/html/hook-040 (0-00-01-03)/recipe.md
index 65eb199..498855a 100644
--- a/refs/html/hook-040 (0-00-01-03)/recipe.md	
+++ b/refs/html/hook-040 (0-00-01-03)/recipe.md	
@@ -339,8 +339,7 @@ Manifest line (already given in section 2): `{"render":{"width":{W},"height":{H}
 - Never buy body size back by shrinking the LEAD — the f-ladder tops out at 36 *because* 2.8× has to
   clear the bottom slot row (§3); contrast outranks body size.
 - Never re-add the prefab's entrance blur (see the skeleton's why-clause) and never animate `color` or
-  `filter`; never put `var()` in transforms or keyframes; no `vw` font sizes; no
-  `-webkit-text-stroke`; single-value `border-radius` only (none is used here).
+  `filter`; no `-webkit-text-stroke`; single-value `border-radius` only (none is used here).
 - Never uppercase — the spoken case is the design.
 - No flex anywhere; every word is its own absolutely positioned div; no `text-align`; the even-beat
   mirror is the `right:` property with the section-3 numbers, never a re-derived layout.
diff --git a/refs/html/hook-045 (0-00-06-22)/recipe.md b/refs/html/hook-045 (0-00-06-22)/recipe.md
index 0359c49..9aec213 100644
--- a/refs/html/hook-045 (0-00-06-22)/recipe.md	
+++ b/refs/html/hook-045 (0-00-06-22)/recipe.md	
@@ -58,7 +58,7 @@ FULL-BLEED at z0 — no chrome covers it.
          line-height: 0.72; letter-spacing: 0.004em; color: #f6f3f7; white-space: nowrap;
          text-shadow: 0 4px 28px rgba(0,0,0,0.40); }
 
-  /* glyph reveal — opacity only, then HOLD. The vertical padding is mid-reveal shear headroom
+  /* glyph reveal — opacity only, then HOLD. The vertical padding is descender clearance headroom
      for the 0.72 line-height box — never remove it. */
   .c { display: inline-block; opacity: 0; padding: 0.14em 0 0.14em;
        animation-name: cIn; animation-duration: 140ms;
@@ -110,7 +110,7 @@ FULL-BLEED at z0 — no chrome covers it.
   .s22 { font-size: 22px; }
 
   /* caption word reveal — rise + eased fade IN, then HOLD; the page-level pgOut is the only
-     fade-out. Word gap = the margin (never spacer spans); the vertical padding is shear headroom. */
+     fade-out. Word gap = the margin (never spacer spans); the vertical padding is descender headroom. */
   .w { display: inline-block; opacity: 0; margin-right: 0.26em; padding: 0.08em 0 0.15em;
        animation-name: wIn; animation-duration: 380ms;
        animation-timing-function: cubic-bezier(.2,.7,.3,1); animation-fill-mode: both; }
@@ -284,8 +284,7 @@ Manifest line (already given in section 2): `{"render":{"width":{W},"height":{H}
 - Do not re-add the prefab's flex centering or `.sp` spacer spans; do not change line-height 0.72 or
   the letter-spacing. Do not re-add the prefab's scaleX(0.5) squeeze — `--verify` measures glyph ink
   PRE-transform, so parent-scaled monumental text false-fails (and shears at these sizes).
-- Never animate `color` or `filter:blur`; never put `var()` inside a transform or keyframes; no `vw`
-  font sizes; single-value `border-radius` only (none is used here).
+- Never animate `color` or `filter:blur`; single-value `border-radius` only (none is used here).
 - No text-transform reliance — uppercase the strings yourself.
 - Never read the video frames, never run ffmpeg checks — `--verify` is the only self-check.
 - No redesign after render or a verify failure — only the mechanical fixes in section 6.
diff --git a/refs/html/hook-045 (0-00-06-22)/recipe.ts b/refs/html/hook-045 (0-00-06-22)/recipe.ts
index 321c1df..cd3f9f5 100644
--- a/refs/html/hook-045 (0-00-06-22)/recipe.ts	
+++ b/refs/html/hook-045 (0-00-06-22)/recipe.ts	
@@ -205,7 +205,7 @@ ${pgs}
          line-height: 0.72; letter-spacing: 0.004em; color: #f6f3f7; white-space: nowrap;
          text-shadow: 0 ${p(4)}px ${p(28)}px rgba(0,0,0,0.40); }
 
-  /* glyph reveal — opacity only, then HOLD. The vertical padding is mid-reveal shear headroom for
+  /* glyph reveal — opacity only, then HOLD. The vertical padding is descender clearance headroom for
      the 0.72 line-height box — never remove it. */
   .c { display: inline-block; opacity: 0; padding: 0.14em 0 0.14em;
        animation-name: cIn; animation-duration: ${CHAR_MS}ms;
@@ -233,7 +233,7 @@ ${bigRows}
 ${capRows}
 
   /* caption word reveal — rise + eased fade IN, then HOLD; the page-level pgOut is the only
-     fade-out. Word gap = the margin (never spacer spans); the vertical padding is shear headroom. */
+     fade-out. Word gap = the margin (never spacer spans); the vertical padding is descender headroom. */
   .w { display: inline-block; opacity: 0; margin-right: 0.26em; padding: 0.08em 0 0.15em;
        animation-name: wIn; animation-duration: ${CAP_ENTR_MS}ms;
        animation-timing-function: cubic-bezier(.2,.7,.3,1); animation-fill-mode: both; }
diff --git a/refs/html/hook-054-peak/recipe.md b/refs/html/hook-054-peak/recipe.md
index 36c5499..1d42524 100644
--- a/refs/html/hook-054-peak/recipe.md
+++ b/refs/html/hook-054-peak/recipe.md
@@ -57,7 +57,7 @@ RESOLUTION at the top of this sheet. All px below are at SCALE = 1; multiply by
   .arc-char.big  { font-size: 1.32em; }  /* number-hero accent only (section 5) */
 
   /* arc word reveal — carried on an INNER span so each glyph's static arc transform is untouched (the
-     two-span unit; never animate the .arc-char itself). padding = shear headroom at line-height 1. */
+     two-span unit; never animate the .arc-char itself). padding = descender headroom at line-height 1. */
   .w { display: inline-block; opacity: 0; padding: 0.1em 0 0.18em;
        animation: wordIn .42s cubic-bezier(.2,.7,.3,1) both; }
   @keyframes wordIn { 0% { opacity: 0; transform: translateY(0.28em); } 100% { opacity: 1; transform: translateY(0); } }
@@ -67,7 +67,7 @@ RESOLUTION at the top of this sheet. All px below are at SCALE = 1; multiply by
   .payline { display: block; width: 600px; text-align: center; white-space: nowrap; line-height: 1.0;
              font-family: 'Archivo', system-ui, sans-serif; font-weight: 700; letter-spacing: -0.5px; color: #f7f5f3;
              text-shadow: 0 2px 7px rgba(0,0,0,.6), 0 0 3px rgba(0,0,0,.55); }   /* soft dark ground for light footage */
-  .pw { display: inline-block; opacity: 0; margin-right: 0.24em;   /* word gap (inter-span whitespace is dropped) */
+  .pw { display: inline-block; opacity: 0; margin-right: 0.24em;   /* word gap (inter-span whitespace is not what sets the gap here) */
         animation: payIn .42s cubic-bezier(.2,.7,.3,1) both; }
   @keyframes payIn { 0% { opacity: 0; transform: translateY(0.28em); } 100% { opacity: 1; transform: translateY(0); } }
   .pw.hero { color: #ffffff; font-weight: 800; }   /* body hero word only (section 5) */
@@ -323,12 +323,12 @@ seed the font cache first). `manifest.json` shape is in section 2.
 - Never animate the `.arc-char` itself — the rise lives on the inner `.w` ONLY (an ancestor transform over
   an animating word is the two-span unit; a single animated span there is nondeterministic on the engine).
   The `.cue`/`.arc` ancestors carry opacity/position only, NEVER a transform.
-- Never animate `color`; no `var()` in transforms/keyframes; no `vw` font sizes; no CSS grid/outline; no
+- Never animate `color`; no CSS grid; no
   `<br>`; no descendant selectors — flat classes only (arc font-size is set INLINE on the `.arc` div and
   inherited, never via a descendant size class).
 - No per-word spacer spans; body gaps are the `.pw` `margin-right`, arc gaps are the space slots; no
   reordering/dropping words; keep original case + punctuation; no uppercasing. Never lay body words out in
-  shrink-to-fit flex (the engine mis-lays-out animated flex children) — plain block `.payline`s.
+  shrink-to-fit flex (a shrink-to-fit line resizes with its content, so one word moves everything beside it) — plain block `.payline`s.
 - Never read the video frames; never move the crown centre/radius or the `.pay` anchor; the accent/body
   split and both registers holding together through the cue are the design — do not turn the arc back into
   a per-page turn-taking stream.
diff --git a/refs/html/hook-059-peak/recipe.md b/refs/html/hook-059-peak/recipe.md
index 5fded72..29f0213 100644
--- a/refs/html/hook-059-peak/recipe.md
+++ b/refs/html/hook-059-peak/recipe.md
@@ -57,7 +57,7 @@ RESOLUTION at the top of this sheet.
              white-space:nowrap; display:inline-block; transform-origin:center;
              text-shadow:0 0.02em 0.12em rgba(0,0,0,0.55); }
 
-  /* word spans: vertical padding is shear headroom — an animating span rasterizes at its
+  /* word spans: vertical padding is descender headroom — an animating span rasterizes at its
      line-height:1 box and glyph bottoms clip without it. Ink extents are calibrated WITH it. */
   @keyframes popIn { 0%{opacity:0} 100%{opacity:1} }
   @keyframes wordIn { 0%{opacity:0; transform:translateY(0.1em)} 100%{opacity:1; transform:translateY(0)} }
@@ -243,7 +243,7 @@ STATION → f 206, Σadv 2.935, slackEm = 1088/206 − 2.935 = 2.347 → ls = 2.
 - CREDITS: `crDelayMs = max(cueDelayMs, min(headlineDelayMs + 750, durEndMs − 700))` (prefab: the
   block lands 750ms after the headline word), fixed 600ms fade, then holds — the gate cuts it at
   video end.
-- Word gaps are the computed `margin-right` px — inter-span whitespace is dropped by the engine, the
+- Word gaps are the computed `margin-right` px — inter-span whitespace is not what sets the gap here, the
   margins ARE the gaps. Write spans adjacent with no whitespace between them. A glued `-` token keeps
   its OWN span and delay, placed immediately after its partner span with the partner's
   `margin-right:0` inline, so the pair renders joined.
@@ -306,7 +306,7 @@ Manifest line (already given in section 2): `{"render":{"width":{W},"height":{H}
 - No invented timing: every `delayMs`/`cueDelayMs` comes verbatim from `word-timings.json`; derived
   numbers ONLY via the closed forms in sections 3-4. Words never fade out; the gate cuts the beat.
 - Uppercase the Anton rows yourself; the peak counter line is typed lowercase.
-- No descendant selectors, no `var()` in transforms/keyframes, no animated `filter:blur`, no `vw`
-  sizes, no flex around animated shrink-to-fit lines beyond the skeleton's full-width `.col`s.
+- No descendant selectors, no animated `filter:blur`, no flex around animated shrink-to-fit lines
+  beyond the skeleton's full-width `.col`s.
 - Never read the video frames; never re-derive layout; no redesign after a render or verify failure —
   only the mechanical fixes in section 6.
diff --git a/refs/html/hook-059-peak/recipe.ts b/refs/html/hook-059-peak/recipe.ts
index 5315f49..5ecad50 100644
--- a/refs/html/hook-059-peak/recipe.ts
+++ b/refs/html/hook-059-peak/recipe.ts
@@ -269,7 +269,7 @@ ${rows.join('\n')}
              white-space:nowrap; display:inline-block; transform-origin:center;
              text-shadow:0 0.02em 0.12em rgba(0,0,0,0.55); }
 
-  /* word spans: vertical padding is shear headroom — an animating span rasterizes at its
+  /* word spans: vertical padding is descender headroom — an animating span rasterizes at its
      line-height:1 box and glyph bottoms clip without it. Ink extents are calibrated WITH it. */
   @keyframes popIn { 0%{opacity:0} 100%{opacity:1} }
   @keyframes wordIn { 0%{opacity:0; transform:translateY(0.1em)} 100%{opacity:1; transform:translateY(0)} }
diff --git a/refs/html/hook-071 (0-00-02-21)/recipe.md b/refs/html/hook-071 (0-00-02-21)/recipe.md
index a8752fa..42cf13b 100644
--- a/refs/html/hook-071 (0-00-02-21)/recipe.md	
+++ b/refs/html/hook-071 (0-00-02-21)/recipe.md	
@@ -52,7 +52,7 @@ Paste this whole document as `runs/<key>/final/template.wv`, then add one `.cue`
   /* window gate — the one safe reveal recipe; delay+duration+z come inline per cue.
      The cue is the CENTERING FRAME: full-frame, so every row is a full-width block with
      text-align:center and all three registers center on x=640 (a full-width block + text-align:center
-     is the ONLY engine-safe way to center animated children — shrink-to-fit flex mis-lays-out
+     centres animated children without letting the line resize with them — shrink-to-fit reflows
      animating lines). NOTHING overflows: the hero's ink budget (section 3) keeps the widest glyph
      box inside the frame at every size, so --verify judges real glyph bounds with room to spare. */
   @keyframes cueWin { 0%,99.99%{opacity:1} 100%{opacity:0} }
@@ -229,7 +229,7 @@ shrinking the word to 241 and shoving `the bad ones` down to 669. Zero size spre
 - Hero: `heroMs = min(700, max(250, avail − 120))` — delay/duration go on the `.hero` DIV (the letters
   never animate individually).
 - Words accumulate — every landed word HOLDS until the cue gate cuts the beat. No fade-outs anywhere.
-- Word spacing is the `.w` `margin-right: 0.35em` — inter-span whitespace is dropped by the engine,
+- Word spacing is the `.w` `margin-right: 0.35em` — inter-span whitespace is not what sets the gap here,
   the margins ARE the gaps. Write word spans adjacent with no whitespace between them. The LAST span
   of each row adds `;margin-right:0` (a trailing margin would drag the centered line off the x=640
   axis). Hero letters are adjacent `.hl` spans with no margins (the script connects them).
@@ -321,6 +321,6 @@ Manifest line (already given in section 2): `{"render":{"width":{W},"height":{H}
 - Words accumulate and the gate cuts the beat — never add per-word, per-row, or page fade-outs.
 - No `text-align` other than the `center` baked into `.row` (rows are centered, never left-flush);
   letter-spacing stays 0.02em on sans and 0 on the hero; no descendant selectors — flat classes only.
-- Never animate `color`; never put `var()` in transforms or keyframes; no `vw` font sizes.
+- Never animate `color`.
 - Never read the video frames; never re-derive layout; no redesign after a render or verify failure —
   only the mechanical fixes in section 7.
diff --git a/refs/html/hook-071 (0-00-02-21)/recipe.ts b/refs/html/hook-071 (0-00-02-21)/recipe.ts
index 11d8f97..c32c4af 100644
--- a/refs/html/hook-071 (0-00-02-21)/recipe.ts	
+++ b/refs/html/hook-071 (0-00-02-21)/recipe.ts	
@@ -333,7 +333,7 @@ ${rows.join('\n')}
   /* window gate — the one safe reveal recipe; delay+duration+z come inline per cue.
      The cue is the CENTERING FRAME: full-frame, so every row is a full-width block with
      text-align:center (the ONLY engine-safe way to center animated children — shrink-to-fit flex
-     mis-lays-out animating lines) and the whole lockup shares the frame's center axis. Nothing
+     reflows as its lines reveal) and the whole lockup shares the frame's center axis. Nothing
      overflows: the hero's ink budget keeps it inside the frame at every size. */
   @keyframes cueWin { 0%,99.99%{opacity:1} 100%{opacity:0} }
   .cue { position: absolute; left: 0; top: 0; width: ${p(1280)}px; height: ${p(720)}px; opacity: 0; z-index: 11;
diff --git a/refs/html/hook-072 (0-00-04-10)/recipe.md b/refs/html/hook-072 (0-00-04-10)/recipe.md
index 587443c..4466024 100644
--- a/refs/html/hook-072 (0-00-04-10)/recipe.md	
+++ b/refs/html/hook-072 (0-00-04-10)/recipe.md	
@@ -180,10 +180,10 @@ max(250, 400 − 100) = 300 (section 4).
   `popMs = 400` if avail ≥ 500, else `max(250, avail − 100)` (a message spoken just before the gate
   closes must still finish popping). Always write `animation-duration:{popMs}ms` inline.
 - Bubbles accumulate — a popped message HOLDS until the cue gate cuts the beat. No fade-outs anywhere.
-- Word spacing is the `.wd` `margin-right: 0.28em` — inter-span whitespace is dropped by the engine,
+- Word spacing is the `.wd` `margin-right: 0.28em` — inter-span whitespace is not what sets the gap here,
   the margins ARE the gaps. Spans stay `display:inline-block`; never `display:block`.
 - Inside a bubble the words are STATIC (the bubble is the animated unit) — never give word spans their
-  own reveal animation (animated children inside a shrink-to-fit box mis-lay-out).
+  own reveal animation (a shrink-to-fit box resizes as its children reveal).
 
 ## 5. EMPHASIS
 
@@ -252,7 +252,7 @@ Manifest line (already given in section 2): `{"render":{"width":{W},"height":{H}
   derived numbers ONLY via the closed forms in sections 3-4.
 - Bubbles accumulate and the gate cuts the beat — never add fade-outs, and never animate word spans.
 - No `text-align: center/right`; letter-spacing stays 0; no descendant selectors — flat classes only.
-- Never animate `color`; never put `var()` in transforms or keyframes; no `vw` font sizes; keep the
+- Never animate `color`; keep the
   tail `clip-path` polygons percentage-based (px/unitless coords get dropped by the engine).
 - The double tick is the skeleton's inline SVG verbatim — literal-hex `stroke`, `fill="none"`, px-only
   coords, no percentage transforms; never rebuild it from `clip-path`/borders (mangles at final scale).
diff --git a/refs/html/hook-078 (0-00-04-15)/recipe.md b/refs/html/hook-078 (0-00-04-15)/recipe.md
index 00f652d..f0e4484 100644
--- a/refs/html/hook-078 (0-00-04-15)/recipe.md	
+++ b/refs/html/hook-078 (0-00-04-15)/recipe.md	
@@ -23,8 +23,9 @@ one by one like an under-powered neon tube, glowing yellow `#fff402` on their re
 Paste this whole document as `runs/<key>/final/template.wv`, then insert one `.cue` block per beat
 (section 3) after the chrome. Replace only `{videoPath}` (from `meta.json`). The chrome (#tagl … #logos)
 is FINAL — fixed dressing text with fixed delays; never edit it, never put spoken words in it. The
-prefab's `ignite` animated a `drop-shadow` surge together with sub-1 opacity — animated drop-shadow under
-partial opacity clips glyphs in this engine, so this sheet's `ignite` is opacity-ONLY and the glow lives
+prefab's `ignite` animated a `drop-shadow` surge together with sub-1 opacity — the one animated `filter`
+this engine was measured on, `blur`, holds its initial value and never ramps, and animated `drop-shadow`
+was never probed; this sheet's `ignite` is opacity-ONLY and the glow lives
 entirely in the static text-shadows (2 yellow neon layers + 1 dark grounding layer so yellow survives
 light footage). Do not re-add any `filter`.
 
@@ -99,7 +100,7 @@ light footage). Do not re-add any `filter`.
   .s40{font-size:40px} .s36{font-size:36px} .s32{font-size:32px} .s28{font-size:28px}
 
   /* per-char neon ignition — opacity gutters then holds lit. OPACITY ONLY (no filter).
-     The vertical padding is shear headroom for the animating span's raster box. */
+     The vertical padding is descender headroom for the animating span's raster box. */
   @keyframes ignite { 0%{opacity:0} 10%{opacity:.9} 20%{opacity:.08} 34%{opacity:.7}
                       46%{opacity:.2} 62%{opacity:1} 100%{opacity:1} }
   .ch { display: inline-block; opacity: 0; padding-top: 0.08em; padding-bottom: 0.16em;
@@ -248,7 +249,7 @@ Beat 5 (`10,000 hours saved.`, cueDelayMs 8240, winMs 1600, gateEnd 9840): 3 uni
   other chars use the skeleton's `ignite .55s linear both` with only `animation-delay` inline.
 - **WORD GAPS** (both parts required): the LAST char span of every unit EXCEPT the line-final one gets
   class `ch gp` AND a trailing `&#160;` appended to its text (`<span class="ch gp" …>O&#160;</span>`) —
-  bare margins alone can be eaten by ink overhang and the engine trims plain trailing spaces. No gaps
+  bare margins alone can be eaten by ink overhang, and a space is narrower than the overhang. No gaps
   between chars inside a unit; a glued `-` unit renders as one continuous char run across its spans.
 - Char span example (beat 1, `SO` delayMs 320, K 65): `<span class="ch" style="animation-delay:320ms">S</span><span class="ch gp" style="animation-delay:385ms">O&#160;</span>`.
   Beat 1's `THING.` (delayMs 1680, m=6, gateEnd 2080): 1680+5×65+550 = 2555 > 2080 → K=30 → delays
@@ -296,14 +297,14 @@ Manifest line (already given in section 2): `{"render":{"width":{W},"height":{H}
 - No fonts, colors, shadows, sizes, or keyframes beyond this sheet — Staatliches + Oswald, `#fff402` on
   the footage, the 3-layer glow (2 yellow neon + 1 dark grounding, never edited or dropped), the 12-row
   ladder and the 3 keyframe blocks are the whole system.
-- No `filter` anywhere — the prefab's animated `drop-shadow` surge is REMOVED on purpose (animated
-  drop-shadow under sub-1 opacity clips glyphs in this engine); do not restore it, do not animate
-  `text-shadow` either.
+- No `filter` anywhere — the prefab's animated `drop-shadow` surge is REMOVED on purpose (an
+  animated filter holds its initial value in this engine, so the surge never happens); do not
+  restore it, do not animate `text-shadow` either.
 - Never change, translate, or transcript-derive the chrome text; never put a spoken word into a chrome
   slot — every spoken char is a `title-char` in a `.tl` line. Never move, re-time, or re-reveal chrome.
 - No invented timing: every char delay is `spanDelayMs + i×K` off a VERBATIM `word-timings.json` delay;
   cue delay/window only via the §3 subtraction.
-- No fade-outs on title lines (the gate cuts the held poster); no `var()` in transforms/keyframes; no
+- No fade-outs on title lines (the gate cuts the held poster); no
   descendant selectors — flat classes/ids exactly as in the skeleton; spans stay `display:inline-block`
   with their padding headroom.
 - No reading frames, no ffmpeg, no visual checks — `--verify` is the only self-check; no redesign after
diff --git a/refs/html/hook-078 (0-00-04-15)/recipe.ts b/refs/html/hook-078 (0-00-04-15)/recipe.ts
index f7543bf..0316ed6 100644
--- a/refs/html/hook-078 (0-00-04-15)/recipe.ts	
+++ b/refs/html/hook-078 (0-00-04-15)/recipe.ts	
@@ -1,8 +1,9 @@
 // Compiled recipe — hook-078 (0-00-04-15) · neon movie-poster credits (9:16, authored at 736×1312 @25fps).
 // Source sheet: ./recipe.md. Fixed Oswald credits chrome (kickers, laurel badges, subtitle, credit rows,
 // logos) revealed once at clip start; the spoken beat is a monumental Staatliches title whose chars
-// strike on per-CHAR like a neon tube on their real word timings. Ignite is opacity-ONLY (the prefab's
-// animated drop-shadow surge clips glyphs under sub-1 opacity in this engine); the glow lives in the
+// strike on per-CHAR like a neon tube on their real word timings. Ignite is opacity-ONLY: the one
+// animated filter measured on this engine, blur, holds its initial value (probe: animated-blur-holds)
+// and an animated drop-shadow was never probed, so the glow lives in the
 // static 3-layer text-shadow (2 yellow neon + 1 dark grounding for light footage). The 12-role system:
 // 11 chrome roles are fixed dressing on a one-time 150ms-cadence reveal wave; role 7 (title-char) is the
 // only transcript-driven role — every spoken char, no exceptions. Emphasis is STRUCTURAL (the beat IS
@@ -257,7 +258,7 @@ function generate(meta: RunMeta, timings: WordTimings, opts: RecipeOptions = {})
   .s40{font-size:${p(40)}px} .s36{font-size:${p(36)}px} .s32{font-size:${p(32)}px} .s28{font-size:${p(28)}px}
 
   /* per-char neon ignition — opacity gutters then holds lit. OPACITY ONLY (no filter).
-     The vertical padding is shear headroom for the animating span's raster box. */
+     The vertical padding is descender headroom for the animating span's raster box. */
   @keyframes ignite { 0%{opacity:0} 10%{opacity:.9} 20%{opacity:.08} 34%{opacity:.7}
                       46%{opacity:.2} 62%{opacity:1} 100%{opacity:1} }
   .ch { display: inline-block; opacity: 0; padding-top: 0.08em; padding-bottom: 0.16em;
diff --git a/refs/html/hook-078 (0-00-42-23)/recipe.md b/refs/html/hook-078 (0-00-42-23)/recipe.md
index 316d07a..83b0acf 100644
--- a/refs/html/hook-078 (0-00-42-23)/recipe.md	
+++ b/refs/html/hook-078 (0-00-42-23)/recipe.md	
@@ -86,7 +86,7 @@ words in them.
   /* word reveal — keep position:relative + z-index:1 (the prefab's .w stacking trick).
      Word gap = 0.3em margin PLUS a trailing &#160; in the span text (section 4) — italic caps can
      overhang their advance and eat a bare gap; the &#160; is the guaranteed glyph-level space.
-     The vertical padding is shear headroom: an animating span is rasterized at its line-height:1
+     The vertical padding is descender headroom: an animating span is rasterized at its line-height:1
      box and glyph bottoms clip without it. Never shrink these numbers. */
   .w  { display:inline-block; position:relative; z-index:1; opacity:0;
         margin-right:0.3em; padding-bottom:0.2em; padding-top:0.1em;
@@ -282,7 +282,6 @@ Manifest line (already given in section 2): `{"render":{"width":{W},"height":{H}
   subtraction); chrome delays stay exactly as in the skeleton.
 - Never set `line-height` on `.tl` or re-create the prefab's 0.92 leading any other way — the table
   tops ARE the leading. Never use `<br>`; lines exist only as the absolute `.tl` divs you computed.
-- No `var()` in transforms/keyframes, no animated `filter:blur`, no `vw` sizes, no descendant
-  selectors — flat classes/ids exactly as in the skeleton.
+- No animated `filter:blur`, no descendant selectors — flat classes/ids exactly as in the skeleton.
 - No reading video frames, no ffmpeg, no visual self-checks — `--verify` is the only check; no
   redesign after a failure, only the mechanical fixes in section 6.
diff --git a/refs/html/hook-078 (0-00-42-23)/recipe.ts b/refs/html/hook-078 (0-00-42-23)/recipe.ts
index 1642143..7cdfeaf 100644
--- a/refs/html/hook-078 (0-00-42-23)/recipe.ts	
+++ b/refs/html/hook-078 (0-00-42-23)/recipe.ts	
@@ -178,7 +178,7 @@ ${divs.join('\n')}
 
   /* word reveal — keep position:relative + z-index:1 (the prefab's .w stacking trick).
      Word gap = 0.3em margin PLUS the trailing &#160; in the span text — italic caps can overhang
-     their advance and eat a bare gap. The vertical padding is shear headroom. Never shrink these. */
+     their advance and eat a bare gap. The vertical padding is descender headroom. Never shrink these. */
   .w  { display:inline-block; position:relative; z-index:1; opacity:0;
         margin-right:0.3em; padding-bottom:0.2em; padding-top:0.1em;
         animation:wordIn 0.3s cubic-bezier(.2,.7,.3,1) both; }
diff --git a/refs/html/hook-082 (0-00-43-14)/recipe.md b/refs/html/hook-082 (0-00-43-14)/recipe.md
index b7821a5..8734f3a 100644
--- a/refs/html/hook-082 (0-00-43-14)/recipe.md	
+++ b/refs/html/hook-082 (0-00-43-14)/recipe.md	
@@ -63,7 +63,7 @@ Paste this whole document as `runs/<key>/final/template.wv`, then insert one `.c
   .aL { left: 64px; right: auto; text-align: left; }
   .aR { left: auto; right: 100px; text-align: right; }
 
-  /* a line = one full-width row (NEVER shrink-to-fit — the engine mis-lays-out animated flex children);
+  /* a line = one full-width row (NEVER shrink-to-fit — a shrink-to-fit line resizes with its content, so one word moves everything beside it);
      words flow from the anchor's side. line-height cut well under 1 for a tight poster stack — this
      drops the ≥1.2 shear guard, so .ink's padding below now carries shear-safety alone. */
   .line { width: 100%; line-height: .82; white-space: nowrap; text-transform: uppercase;
@@ -87,7 +87,7 @@ Paste this whole document as `runs/<key>/final/template.wv`, then insert one `.c
            animation-timing-function: cubic-bezier(.2,.7,.3,1); animation-fill-mode: both; }
   .fromL { animation-name: slL; }              /* the line enters from the LEFT  */
   .fromR { animation-name: slR; }              /* the line enters from the RIGHT */
-  .ink   { display: inline-block; padding: .1em 0 .18em; opacity: 0;    /* padding = shear headroom (sole guard now that line-height < 1) */
+  .ink   { display: inline-block; padding: .1em 0 .18em; opacity: 0;    /* padding = descender headroom (sole guard now that line-height < 1) */
            animation-name: rise; animation-timing-function: cubic-bezier(.2,.7,.3,1); animation-fill-mode: both; }
   @keyframes slL  { 0% { transform: translateX(-48px); } 100% { transform: translateX(0); } }
   @keyframes slR  { 0% { transform: translateX(48px); }  100% { transform: translateX(0); } }
@@ -291,5 +291,4 @@ fade) → mention and proceed to mux.
   `.line` blocks in the flex column, ONE `.slide` inside each); no descendant selectors — flat classes
   exactly as in the skeleton.
 - Never read the video frames; never move the `.cue` beyond the two section-6 anchors (`aL`/`aR` by beat
-  parity — no other placement improvisation, `top`/`height` never move); no `var()` in keyframes; no `vw`
-  font sizes; no `<br>`. No redesign after a verify/probe failure — only the section-7 mechanical fixes.
+  parity — no other placement improvisation, `top`/`height` never move); no `<br>`. No redesign after a verify/probe failure — only the section-7 mechanical fixes.
diff --git a/refs/html/hook-082 (0-00-43-14)/recipe.ts b/refs/html/hook-082 (0-00-43-14)/recipe.ts
index 998de10..a1d9f7d 100644
--- a/refs/html/hook-082 (0-00-43-14)/recipe.ts	
+++ b/refs/html/hook-082 (0-00-43-14)/recipe.ts	
@@ -156,7 +156,7 @@ ${lines.join('\n')}
   .aL { left: ${p(64)}px; right: auto; text-align: left; }
   .aR { left: auto; right: ${p(100)}px; text-align: right; }
 
-  /* a line = one full-width row (NEVER shrink-to-fit — the engine mis-lays-out animated flex children);
+  /* a line = one full-width row (NEVER shrink-to-fit — a shrink-to-fit line resizes with its content, so one word moves everything beside it);
      words flow from the anchor's side. line-height cut well under 1 for a tight poster stack — this
      drops the ≥1.2 shear guard, so .ink's padding below now carries shear-safety alone. */
   .line { width: 100%; line-height: .82; white-space: nowrap; text-transform: uppercase;
@@ -177,7 +177,7 @@ ${lines.join('\n')}
            animation-timing-function: cubic-bezier(.2,.7,.3,1); animation-fill-mode: both; }
   .fromL { animation-name: slL; }              /* the line enters from the LEFT  */
   .fromR { animation-name: slR; }              /* the line enters from the RIGHT */
-  .ink   { display: inline-block; padding: .1em 0 .18em; opacity: 0;    /* padding = shear headroom (sole guard now that line-height < 1) */
+  .ink   { display: inline-block; padding: .1em 0 .18em; opacity: 0;    /* padding = descender headroom (sole guard now that line-height < 1) */
            animation-name: rise; animation-timing-function: cubic-bezier(.2,.7,.3,1); animation-fill-mode: both; }
   @keyframes slL  { 0% { transform: translateX(-${p(48)}px); } 100% { transform: translateX(0); } }
   @keyframes slR  { 0% { transform: translateX(${p(48)}px); }  100% { transform: translateX(0); } }
diff --git a/refs/html/hook-084 (0-00-06-16)/recipe.md b/refs/html/hook-084 (0-00-06-16)/recipe.md
index 0437b52..b252d5f 100644
--- a/refs/html/hook-084 (0-00-06-16)/recipe.md	
+++ b/refs/html/hook-084 (0-00-06-16)/recipe.md	
@@ -224,7 +224,7 @@ Ceff = max(12×0.8272, 6) = 9.93 → `s66`. Tops 453 · 526; note-b top = 453+73
   `animation-duration:{max(gateEnd − clDelayMs, 200)}ms`.
 - **WORD GAPS** (both parts required): the LAST cluster of every unit EXCEPT the line-final one gets
   class `g big gp` AND a trailing `&#160;` appended to its text — bare margins alone can be eaten by ink
-  overhang and the engine trims plain trailing spaces. No gaps between clusters inside a unit; a glued
+  overhang, and a space is narrower than the overhang. No gaps between clusters inside a unit; a glued
   `-` unit renders as one continuous cluster run across its spans.
 - **Asides:** fixed text in 3-char clusters (`AN ORIGINAL` → `AN `,`ORI`,`GIN`,`AL` · `IN REAL TIME` →
   `IN `,`REA`,`L T`,`IME`), `clDelayMs = base + j×60` with base = `cueDelayMs + 240` (note-a) /
@@ -282,8 +282,7 @@ Manifest line (already given in section 2): `{"render":{"width":{W},"height":{H}
 - No invented timing: every title cluster delay is `spanDelayMs + j×K` off a VERBATIM
   `word-timings.json` delay; aside bases are `cueDelayMs + 240/480`; cue delay/window only via the §3
   subtraction.
-- No fade-outs on title lines or asides (the gate cuts the held poster); no `var()` in
-  transforms/keyframes; clusters stay `display:inline-block; white-space:pre`; the apple pictogram's
+- No fade-outs on title lines or asides (the gate cuts the held poster); clusters stay `display:inline-block; white-space:pre`; the apple pictogram's
   clip-path polygons are copied verbatim, never redrawn.
 - No reading frames, no ffmpeg, no visual checks — `--verify` is the only self-check; no redesign after
   a failure, only the mechanical fixes in section 6.
diff --git a/refs/html/hook-086-peak/recipe.md b/refs/html/hook-086-peak/recipe.md
index b8568e3..37e9e56 100644
--- a/refs/html/hook-086-peak/recipe.md
+++ b/refs/html/hook-086-peak/recipe.md
@@ -64,8 +64,8 @@ Paste this whole document as `runs/<key>/final/template.wv`, then add one `.cue`
   @keyframes wIn { 0% { transform: translateX(28px); } 100% { transform: translateX(0px); } }
   .w  { display: inline-block; position: relative; margin-right: 0.3em;
         animation-name: wIn; animation-timing-function: cubic-bezier(0.215, 0.61, 0.355, 1); animation-fill-mode: both; }
-  /*  2. the two ghosts: STATICALLY blurred copies stacked over the ink (an ANIMATED blur renders its
-        end state from frame one on this engine, and filter ignores em — so the ramp is a relay of
+  /*  2. the two ghosts: STATICALLY blurred copies stacked over the ink (an ANIMATED blur holds the
+        keyframe's INITIAL value for the whole run, and filter ignores em — so the ramp is a relay of
         opacity across copies whose px radii are written inline per ladder row).
         The three stages OVERLAP rather than meet at a point — a ghost is still dissolving while the
         next stage is already coming up, so the pull reads as one continuous softening rather than as
@@ -197,7 +197,7 @@ earlier word 560. Accent = `£55` (digit rule) → its ink copy is `ia`, everyth
 - cueEnd = `cueDelayMs` + `{winMs}` (beat-level). Per word: avail = cueEnd − `delayMs`;
   `{inMs}` = min(560, max(260, avail − 80)). The reveal is longer than a pop — a focus pull needs room
   to resolve — but it still compresses so a late word lands before its gate cuts it.
-- Word spacing is the `.w` `margin-right: 0.3em` — inter-span whitespace is dropped by the engine;
+- Word spacing is the `.w` `margin-right: 0.3em` — inter-span whitespace is not what sets the gap here;
   write spans adjacent with no whitespace between them.
 - **Turn-taking:** a MID page gets `po` with `animation-delay` = max(nextStart − 120, its own last
   word's `delayMs`) and `animation-duration: 120ms`, nextStart = the successor page's first word
@@ -251,8 +251,8 @@ Then record (a SECOND invocation — `--verify` and `--record` are mutually excl
 ## 7. DO NOT
 
 - **ENGINE FACT A — never replace the stepped pull with a blur keyframe.** Measured on a fixture: an
-  ANIMATED `filter: blur()` renders its END state from frame one on this engine — exactly like animated
-  `clip-path`. Only a STATIC filter renders. `opacity` and `transform` in the SAME keyframes interpolate
+  ANIMATED `filter: blur()` holds its initial value on this engine and never ramps. Only a STATIC
+  filter renders. `opacity` and `transform` in the SAME keyframes interpolate
   normally, which is why the ramp is a RELAY of opacity across three statically-blurred copies. A
   `@keyframes` that interpolates `filter` would render as a permanently blurred word, not as a pull.
   This is not a simplification opportunity — it is the only way the effect exists.
@@ -277,9 +277,8 @@ Then record (a SECOND invocation — `--verify` and `--record` are mutually excl
 - No invented timing: every `delayMs`/`cueDelayMs` comes VERBATIM from `word-timings.json`; derived
   numbers ONLY via the closed forms in sections 3-5.
 - No flex anywhere (pages are absolute full-width `text-align:center` blocks); spans stay
-  `display:inline-block`; `line-height: 1.3` on `.pg` is the mid-reveal shear headroom — never tighten
+  `display:inline-block`; `line-height: 1.3` on `.pg` is the descender headroom — never tighten
   it. Every animated transform ENDS at identity.
-- No `var()` in transforms or keyframes; no `vw` font sizes; no descendant selectors — flat classes
-  only.
+- No descendant selectors — flat classes only.
 - Never read the video frames; never re-derive layout; no redesign after a render or verify failure —
   only the mechanical fixes in section 6.
diff --git a/refs/html/hook-086-peak/recipe.ts b/refs/html/hook-086-peak/recipe.ts
index 4f15df0..ad9613b 100644
--- a/refs/html/hook-086-peak/recipe.ts
+++ b/refs/html/hook-086-peak/recipe.ts
@@ -4,9 +4,10 @@
 // falls). The reveal is an Apple-style FOCUS PULL: each word slides in from the RIGHT on a cubic
 // ease-out while a softly defocused copy of it resolves into the sharp one. Nothing else is on screen —
 // no plate, no panel, no backdrop; plain white type over the footage from first beat to last.
-//   ENGINE FACT A (measured on a fixture): an ANIMATED `filter: blur()` renders its END state from
-//   frame one — exactly like animated `clip-path`; opacity and transform in the SAME keyframes
-//   interpolate normally. Only a STATIC filter renders, so a real blur ramp is impossible.
+//   ENGINE FACT A (probe: animated-blur-holds): an ANIMATED `filter: blur()` holds the keyframe's
+//   INITIAL value and never ramps; opacity and transform in the SAME keyframes interpolate normally.
+//   Only a STATIC filter renders, so a real blur ramp is impossible. An animated `clip-path` is NOT
+//   the same case — it does interpolate (probe: animated-clip-path, refuted).
 //   ENGINE FACT B (measured on the same fixture): `filter: blur()` ignores `em` — `blur(0.2em)`
 //   renders perfectly SHARP while an equivalent `blur(23.6px)` renders. Filter lengths must be px,
 //   which means the defocus cannot ride the font-size cascade — it is computed per ladder row from
@@ -189,8 +190,8 @@ ${rows.join('\n')}
   @keyframes wIn { 0% { transform: translateX(${p(SLIDE_PX)}px); } 100% { transform: translateX(0px); } }
   .w  { display: inline-block; position: relative; margin-right: 0.3em;
         animation-name: wIn; animation-timing-function: ${EASE_OUT_CUBIC}; animation-fill-mode: both; }
-  /*  2. the two ghosts: STATICALLY blurred copies stacked over the ink (an ANIMATED blur renders its
-        end state from frame one on this engine, and filter ignores em — so the ramp is a relay of
+  /*  2. the two ghosts: STATICALLY blurred copies stacked over the ink (an ANIMATED blur holds the
+        keyframe's INITIAL value for the whole run, and filter ignores em — so the ramp is a relay of
         opacity across copies whose px radii are written inline per ladder row).
         The three stages OVERLAP rather than meet at a point — a ghost is still dissolving while the
         next stage is already coming up, so the pull reads as one continuous softening rather than as
diff --git a/refs/html/hook-091 Pre-comp 1-peak/recipe.md b/refs/html/hook-091 Pre-comp 1-peak/recipe.md
index 2b8d6d6..9253ad7 100644
--- a/refs/html/hook-091 Pre-comp 1-peak/recipe.md	
+++ b/refs/html/hook-091 Pre-comp 1-peak/recipe.md	
@@ -55,7 +55,7 @@ Paste this whole document as `runs/<key>/final/template.wv`, then add one `.cue`
   .row { position: absolute; left: 0; width: 1280px; text-align: center; line-height: 1; z-index: 2;
          font-family: 'Anton', sans-serif; font-weight: 400; }
 
-  /* word spans: the vertical padding is shear headroom (an animating span rasterizes at its
+  /* word spans: the vertical padding is descender headroom (an animating span rasterizes at its
      line-height:1 box and glyph edges clip without it); ink extents are calibrated WITH it.
      ONE ink for every word at every size — poster neon yellow: two yellow glow layers over a dark
      grounding layer that holds the type off bright footage. */
@@ -216,7 +216,7 @@ O .484 P .469 Q .491 R .474 S .459 T .395 U .471 V .469 W .710 X .484 Y .446 Z .
   `animation-duration:{inMs}ms` with `inMs = min(D0, max(220, cueEnd − delayMs − 80))`,
   cueEnd = cueDelayMs + cueDurMs, D0 = 500 for the BIG slab (`.b`) and 350 for every other word
   (`.w`) — the entrance compresses so a late word still lands before the gate.
-- Word gaps are the computed `margin-right` px — inter-span whitespace is dropped by the engine, the
+- Word gaps are the computed `margin-right` px — inter-span whitespace is not what sets the gap here, the
   margins ARE the gaps. Write spans adjacent with no whitespace between them.
 - Words accumulate — every landed word HOLDS at full opacity; the beat's gate cuts the whole poster
   at the window end. No fade-outs anywhere (nothing shares an anchor mid-beat).
@@ -293,7 +293,7 @@ Manifest line (already given in section 2): `{"render":{"width":{W},"height":{H}
 - No invented timing: every `delayMs`/`cueDelayMs`/`cueDurMs` comes verbatim from
   `word-timings.json`; derived numbers ONLY via the closed forms in sections 3–4.
 - Words accumulate and the gate cuts the beat — never add fade-outs.
-- Never animate `color`; never put `var()` in transforms or keyframes; no `vw` font sizes; no
+- Never animate `color`; no
   `-webkit-text-stroke`; no `steps()` timing; single-value border-radius only (none is used here).
 - Never read the video frames; never re-derive layout; no redesign after a render or verify failure —
   only the mechanical fixes in section 6.
diff --git a/refs/html/hook-091 Pre-comp 1-peak/recipe.ts b/refs/html/hook-091 Pre-comp 1-peak/recipe.ts
index bbc2085..3e5aecd 100644
--- a/refs/html/hook-091 Pre-comp 1-peak/recipe.ts	
+++ b/refs/html/hook-091 Pre-comp 1-peak/recipe.ts	
@@ -241,7 +241,7 @@ ${parts.join('\n')}
   .row { position: absolute; left: 0; width: ${p(1280)}px; text-align: center; line-height: 1; z-index: 2;
          font-family: 'Anton', sans-serif; font-weight: 400; }
 
-  /* word spans: the vertical padding is shear headroom (an animating span rasterizes at its
+  /* word spans: the vertical padding is descender headroom (an animating span rasterizes at its
      line-height:1 box and glyph edges clip without it); ink extents are calibrated WITH it.
      ONE ink for every word at every size — poster neon yellow: two yellow glow layers over a dark
      grounding layer that holds the type off bright footage. */
diff --git a/refs/html/hook-097-peak/recipe.md b/refs/html/hook-097-peak/recipe.md
index e5a118d..0997a8f 100644
--- a/refs/html/hook-097-peak/recipe.md
+++ b/refs/html/hook-097-peak/recipe.md
@@ -107,7 +107,7 @@ remove or fade `.bg`.
   .ln2 { margin-top: -0.34em; }
 
   /* word reveal — the prefab's scale pop + fade IN, then HOLD; the page-level pgOut is the only
-     fade-out. The vertical padding is mid-reveal shear headroom — never remove it. */
+     fade-out. The vertical padding is descender clearance headroom — never remove it. */
   .wp  { display: inline-block; opacity: 0; padding: 0.06em 0 0.18em;
          animation-name: wordPop; animation-duration: 160ms;
          animation-timing-function: cubic-bezier(.2,.7,.3,1); animation-fill-mode: both; }
@@ -161,7 +161,7 @@ page, one `.fr`+`.word` per frame, one `.ln` line per unit, one `.wp` span per t
 **Word prep:** UPPERCASE every token yourself (no text-transform in the CSS); keep ALL punctuation
 exactly as in `word-timings.json`. GLUE: a token starting with `-` (e.g. `-DO` after `TO`) merges with
 the previous word into ONE unit for paging and counting (`TO-DO` = 5 chars); it renders as two adjacent
-`.wp` spans inside the unit's `.ln` (inter-span whitespace is dropped, so the pair reads flush), each
+`.wp` spans inside the unit's `.ln` (inter-span whitespace is not what sets the gap here, so the pair reads flush), each
 keeping its OWN verbatim `delayMs`.
 
 **Paging rule** — walk the beat's units left to right (ORDER PRESERVED, every unit used once): a page
@@ -281,7 +281,6 @@ Manifest line (already given in section 2): `{"render":{"width":{W},"height":{H}
 - Do not re-add the prefab's dot-texture `background-image`, its `::before` arrow marks, its flex
   `.frames` row, or `text-transform`; do not change the rotate angles, the transform-origin, or the
   slide distance; no perspective/rotate3d.
-- Never animate `color` or `filter:blur`; never put `var()` inside a transform or keyframes; no `vw`
-  font sizes; single-value `border-radius` only.
+- Never animate `color` or `filter:blur`; single-value `border-radius` only.
 - Never read the video frames, never run ffmpeg checks — `--verify` is the only self-check.
 - No redesign after render or a verify failure — only the mechanical fixes in section 6.
diff --git a/refs/html/hook-097-peak/recipe.ts b/refs/html/hook-097-peak/recipe.ts
index 66bf87c..34c7960 100644
--- a/refs/html/hook-097-peak/recipe.ts
+++ b/refs/html/hook-097-peak/recipe.ts
@@ -28,7 +28,7 @@ const FR_H2 = 150; // frame height when a page has a two-line frame
 const FR_H1 = 108; // …when every frame is single-line
 const BAND_CHROME = 62; // lab above + marks below
 export const ANGLES_097: Array<[number, number]> = [[-3, 5.5], [4, -2.5], [-5, 2.5]];
-const LINE_EM = 1.24; // span box: line-height 1 + 0.06/0.18em shear padding
+const LINE_EM = 1.24; // span box: line-height 1 + 0.06/0.18em descender padding
 const STACK2_EM = 2.14; // two stacked lines (.ln2 pulls -0.34em)
 const POP_MS = 160;
 const POP_MIN_MS = 100;
@@ -267,7 +267,7 @@ ${sizeRows}
   .ln2 { margin-top: -0.34em; }
 
   /* word reveal — scale pop + fade IN, then HOLD; the page-level pgOut is the only fade-out.
-     The vertical padding is mid-reveal shear headroom — never remove it. */
+     The vertical padding is descender clearance headroom — never remove it. */
   .wp  { display: inline-block; opacity: 0; padding: 0.06em 0 0.18em;
          animation-name: wordPop; animation-duration: ${POP_MS}ms;
          animation-timing-function: cubic-bezier(.2,.7,.3,1); animation-fill-mode: both; }
diff --git a/refs/html/hook-107-peak/recipe.md b/refs/html/hook-107-peak/recipe.md
index eee4e05..8acceaf 100644
--- a/refs/html/hook-107-peak/recipe.md
+++ b/refs/html/hook-107-peak/recipe.md
@@ -59,7 +59,7 @@ Canvas: see RESOLUTION at the top of this sheet. The footage is FULL-BLEED at z0
   .p6 { right:81px;  top:1000px; }
 
   /* word reveal — the prefab's fade+rise; gap = margin + the &#160; each non-final span carries
-     (inter-span whitespace is dropped; italic Playfair caps overhang, hence the wider .wi margin) */
+     (inter-span whitespace is not what sets the gap here; italic Playfair caps overhang, hence the wider .wi margin) */
   .w  { display:inline-block; opacity:0; margin-right:0.32em;
         animation-name:wIn; animation-timing-function:cubic-bezier(.2,.7,.3,1); animation-fill-mode:both; }
   .wi { display:inline-block; opacity:0; margin-right:0.45em;
@@ -199,7 +199,7 @@ the sticker (C=5 → 57px; avail = 2080−1680 = 400 → popMs 320). m=8 → k=6
   each keeping its own verbatim delay.
 - Words accumulate — every structure HOLDS at full opacity until the cue gate cuts the beat. No
   fade-outs anywhere; each phrase owns its slot, nothing turn-takes.
-- Spans stay `display:inline-block`; slot line-height stays 1.3 (shear headroom for the animating spans).
+- Spans stay `display:inline-block`; slot line-height stays 1.3 (descender headroom for the animating spans).
 
 ## 5. EMPHASIS
 
@@ -250,7 +250,6 @@ Manifest line (already given in section 2): `{"render":{"width":{W},"height":{H}
   rotate; capacity lives in the sizing tables, not the geometry.
 - The sticker pop is scale-only on the INNER paper/word — never animate the `.stkr` box, never add
   opacity to `pop`, never put a transform animation on an ancestor of the word spans.
-- No `var()` in transforms/keyframes; no `vw` font sizes; no flex anywhere; no animated color or blur;
-  single-value `border-radius` only (none is used here).
+- No flex anywhere; no animated color or blur; single-value `border-radius` only (none is used here).
 - Never read the video frames, never run ffmpeg checks — `--verify` is the only self-check.
 - No redesign after a render or verify failure — only the mechanical fixes in section 6.
diff --git a/refs/html/hook-107-peak/recipe.ts b/refs/html/hook-107-peak/recipe.ts
index 3152399..3927774 100644
--- a/refs/html/hook-107-peak/recipe.ts
+++ b/refs/html/hook-107-peak/recipe.ts
@@ -212,7 +212,8 @@ function generate(meta: RunMeta, timings: WordTimings, opts: RecipeOptions = {})
 ${SLOTS.map((s, i) => `  .p${i + 1} { ${s.anchor.replace(/(\d+)px/g, (_, n) => `${p(Number(n))}px`)} }`).join('\n')}
 
   /* word reveal — the prefab's fade+rise; gap = margin + the &#160; each non-final span carries
-     (inter-span whitespace is dropped; italic Playfair caps overhang, hence the wider .wi margin) */
+     (inter-span whitespace is not what sets the gap here; italic Playfair caps overhang, hence the
+     wider .wi margin) */
   .w  { display:inline-block; opacity:0; margin-right:0.32em;
         animation-name:wIn; animation-timing-function:cubic-bezier(.2,.7,.3,1); animation-fill-mode:both; }
   .wi { display:inline-block; opacity:0; margin-right:0.45em;
diff --git a/refs/html/hook-114-peak/recipe.md b/refs/html/hook-114-peak/recipe.md
index ff7b648..bec1028 100644
--- a/refs/html/hook-114-peak/recipe.md
+++ b/refs/html/hook-114-peak/recipe.md
@@ -154,7 +154,7 @@ shape exists. (fresh-test: beat 1 → 2251ms, beat 6 → 11431ms.)
   - glyph: `<span class="g" style="animation-delay:{d}ms">x</span>`
   - word spacer (between two words INSIDE the same line, never at line edges):
     `<span class="g" style="width:0.3em;animation-delay:{d}ms">&nbsp;</span>` — its `{d}` = the NEXT
-    word's `delayMs`. Inter-span whitespace is dropped; the spacer IS the space.
+    word's `delayMs`. Inter-span whitespace is not what sets the gap here; the spacer IS the space.
   - accent: `<span class="big" style="font-size:{B}px;animation-delay:{E.delayMs}ms">{E.w}</span>`
 - Per-word glyph delays: word with `delayMs = d` and `g` glyphs → glyph k (k = 0…g−1) gets
   `d + k×st`. Default stagger `st = 45`. The word's `delayMs` is used VERBATIM as glyph 0's delay.
@@ -214,5 +214,5 @@ Manifest (must already exist, verbatim from section 2):
   the only arithmetic allowed is the +45ms glyph stagger and the two clamps in section 4.
 - Do not read frames, run ffmpeg, or eyeball renders; `--verify` is the only self-check.
 - Do not change slot tops, `left:46px`, `width:608px`, or place two beats at the same coordinates.
-- Do not add scrim boxes, do not animate `color`, no `var()` anywhere in transforms or keyframes.
+- Do not add scrim boxes, do not animate `color`.
 - Do not regroup words across the PUNCH/SETUP boundary or reorder words — ever.
diff --git a/refs/html/hook-114-peak/recipe.ts b/refs/html/hook-114-peak/recipe.ts
index 953ac02..939a68f 100644
--- a/refs/html/hook-114-peak/recipe.ts
+++ b/refs/html/hook-114-peak/recipe.ts
@@ -125,7 +125,8 @@ export function glyphWordHtml(w: WordTiming, cueEndMs: number, cls = 'g'): strin
   return glyphs.map((g, k) => `<span class="${cls}" style="animation-delay:${w.delayMs + k * st}ms">${escapeHtml(g)}</span>`).join('');
 }
 
-// the spacer IS the space (inter-span whitespace is dropped); {d} = the NEXT word's delayMs
+// the spacer IS the space, so the gap is a stated width rather than inter-span whitespace (which the
+// engine does keep — probe: inter-span-whitespace); {d} = the NEXT word's delayMs
 const spacerHtml = (nextDelayMs: number) => `<span class="g" style="width:0.3em;animation-delay:${nextDelayMs}ms">&nbsp;</span>`;
 
 function bigSpanHtml(w: WordTiming, bPx: number, cueEndMs: number): string {
diff --git a/refs/html/hook-123-peak/recipe.md b/refs/html/hook-123-peak/recipe.md
index 5e3c047..5705ea3 100644
--- a/refs/html/hook-123-peak/recipe.md
+++ b/refs/html/hook-123-peak/recipe.md
@@ -160,7 +160,7 @@ take base+1 consecutive words, the rest take base.
 
 **Placement:** fixed by the `.cue` class — `left:77px; top:140px; width:520px`, every beat (anchor B
 of section 6 is the ONLY sanctioned alternative). Title and script lines are left-flush BLOCK divs in
-normal flow (no flex, no text-align — the engine mis-lays-out shrink-to-fit flex and centered text
+normal flow (no flex, no text-align — a shrink-to-fit line reflows as its children reveal and centered text
 around animated inline-blocks). Anchor varies ONLY per BOUNDED VARIETY axis 1 (section 6, alternating
 A/B by beat parity) — every beat's title AND all of its script lines share that ONE beat's anchor;
 never split anchors within a single beat, never invent a third `left` value.
@@ -188,8 +188,8 @@ avail − 80 ≥ 1300).
   with `inMs = min(320, max(150, avail − 80))`.
 - Words accumulate — every word HOLDS at full opacity until the cue gate cuts the beat. No fade-outs
   anywhere.
-- Word spacing is the `.tw`/`.w` `margin-right` (0.30em title / 0.45em script) — inter-span whitespace
-  is dropped by the engine, the margins ARE the gaps. Write word spans adjacent with no whitespace
+- Word spacing is the `.tw`/`.w` `margin-right` (0.30em title / 0.45em script): the margin IS the gap,
+  so it is exact at every size. Write word spans adjacent with no whitespace
   between them. Spans stay `display:inline-block`; never `display:block`.
 
 ## 5. EMPHASIS
@@ -269,10 +269,11 @@ Manifest line (already given in section 2): `{"render":{"width":{W},"height":{H}
   unrevealed words).
 - No transform on ANY ancestor of a word span — the engine can composite an animating span WITHOUT an
   ancestor's static transform (video runs), so all width budgets here are natural, untransformed px.
-- No `filter:drop-shadow` anywhere — the flicker holds spans at partial opacity, which glyph-clips
-  under drop-shadow; legibility is the baked `text-shadow` layers only.
+- No `filter:drop-shadow` anywhere — that is this sheet's look. It is also the safe side of a real
+  limit: on 0.8.0 drop-shadow under partial opacity DOES clip glyphs (probe: drop-shadow-opacity-clip),
+  where on 0.7.3 it did not. Legibility here is the baked `text-shadow` layers only.
 - No flex inside `.cue` and no `text-align` anywhere: title/script lines are left-flush BLOCK divs
-  (the prefab's justify-between script row is deliberately NOT carried over — the engine mis-lays-out
+  (the prefab's justify-between script row is deliberately NOT carried over — the engine reflows
   shrink-to-fit flex around animated children).
 - Never move the column off its anchor (77px, or 763px under variety B) and never anchor at the right
   edge — a natural-width line must stay viewport-safe on its own.
@@ -281,7 +282,6 @@ Manifest line (already given in section 2): `{"render":{"width":{W},"height":{H}
 - No invented timing: every `delayMs`/`cueDelayMs`/`cueDurMs` comes verbatim from
   `word-timings.json`; derived numbers ONLY via the closed forms in sections 3-4.
 - Words accumulate and the gate cuts the beat — never add per-word or per-line fade-outs.
-- No descendant selectors — flat classes only; never `var()` in transforms or keyframes; no `vw`
-  font sizes.
+- No descendant selectors — flat classes only.
 - Never read the video frames; never re-derive layout; no redesign after a render or verify failure —
   only the mechanical fixes in section 7.
diff --git a/refs/html/hook-126 Comp 1-peak/recipe.md b/refs/html/hook-126 Comp 1-peak/recipe.md
index affc15f..475180e 100644
--- a/refs/html/hook-126 Comp 1-peak/recipe.md	
+++ b/refs/html/hook-126 Comp 1-peak/recipe.md	
@@ -57,7 +57,7 @@ Paste this whole document as `runs/<key>/final/template.wv`, then add one `.cue`
          animation-name: cueWin; animation-timing-function: linear; animation-fill-mode: forwards; }
 
   /* a slot = one absolutely positioned nowrap line of the scatter; side offset / top / font-size
-     come inline per slot. line-height 1.35 is the prefab's own AND the shear headroom — never
+     come inline per slot. line-height 1.35 is the prefab's own AND the descender headroom — never
      tighten it. The yellow ink is fattened by an 8-way same-ink text-shadow (the engine has no text
      stroke) — that is what carries the letterforms' weight, so it stays at full strength. The two dark
      layers under it only GROUND the ink over light footage and are pulled well back: tight offset,
@@ -336,8 +336,8 @@ the beat's anchored side — the same `N` parity that placed the slot:
   28% is what makes it a sag. Amplitude does the rest: below ~10° the drop reads as a crooked baseline
   rather than a fall.
 - Word gaps: each unit's last span (except the slot-final unit's) takes `.wg` (`margin-right:0.3em`)
-  PLUS a trailing `&#160;` in its span text — serif ink overhangs its advance and the engine trims
-  bare trailing spaces. Glued spans inside a unit get neither. Spans stay `display:inline-block`.
+  PLUS a trailing `&#160;` in its span text — serif ink overhangs its advance, and a space
+  is narrower than that overhang. Glued spans inside a unit get neither. Spans stay `display:inline-block`.
 - Words accumulate — a landed word HOLDS until the cue gate cuts the beat. No fade-outs anywhere;
   no mid-beat turn-taking exists (every slot has its own anchor), so nothing ever double-prints.
 
@@ -406,12 +406,11 @@ Manifest line (already given in section 2): `{"render":{"width":{W},"height":{H}
   (section 3) and re-tests. The safe area is not a variable.
 - Words keep verbatim case + punctuation — never uppercase, never strip, never reorder or drop
   tokens; never render the prefab's demo copy.
-- `line-height:1.35` and `display:inline-block` spans are shear headroom — never tighten either;
+- `line-height:1.35` and `display:inline-block` spans are descender headroom — never tighten either;
   the word gap is `.wg` + trailing `&#160;` — never a bare margin, never an empty spacer span.
 - Words accumulate and the gate cuts the beat — never add per-word or per-slot fade-outs, never
   page a beat (long beats shrink via the caps table and the multiplier ladder instead).
 - No invented timing: every `delayMs`/`cueDelayMs` comes verbatim from `word-timings.json`; derived
-  numbers ONLY via the closed forms in sections 3–4. No flex anywhere; no `text-align`; no `vw`
-  sizes; single-value `border-radius` only (none is used here).
+  numbers ONLY via the closed forms in sections 3–4. No flex anywhere; no `text-align`; single-value `border-radius` only (none is used here).
 - Never read the video frames; never re-derive layout; no redesign after a render or verify
   failure — only the section-6 mechanical fixes.
diff --git a/refs/html/hook-126 Comp 1-peak/recipe.ts b/refs/html/hook-126 Comp 1-peak/recipe.ts
index 1f08324..ba53c22 100644
--- a/refs/html/hook-126 Comp 1-peak/recipe.ts	
+++ b/refs/html/hook-126 Comp 1-peak/recipe.ts	
@@ -268,7 +268,7 @@ ${lns.join('\n')}
          animation-name: cueWin; animation-timing-function: linear; animation-fill-mode: forwards; }
 
   /* a slot = one absolutely positioned nowrap line of the scatter; side offset / top / font-size
-     come inline per slot. line-height 1.35 is the prefab's own AND the shear headroom — never
+     come inline per slot. line-height 1.35 is the prefab's own AND the descender headroom — never
      tighten it. The yellow ink is fattened by an 8-way same-ink text-shadow (the engine has no text
      stroke) — that is what carries the letterforms' weight, so it stays at full strength. The two dark
      layers under it only GROUND the ink over light footage and are pulled well back: tight offset,
diff --git a/refs/html/hook-158-peak/recipe.md b/refs/html/hook-158-peak/recipe.md
index 108de43..7966350 100644
--- a/refs/html/hook-158-peak/recipe.md
+++ b/refs/html/hook-158-peak/recipe.md
@@ -290,10 +290,9 @@ Manifest line (already given in section 2): `{"render":{"width":{W},"height":{H}
   rule, and then always with SEP between them.
 - No invented timing: every `delayMs`/`cueDelayMs` comes VERBATIM from `word-timings.json`;
   derived numbers ONLY via the closed forms in sections 3-4.
-- Never animate `color` or `filter:blur`; never put `var()` inside a transform or keyframes; no
-  `vw` font sizes; no `-webkit-text-stroke`; no text-transform reliance — uppercase the strings
+- Never animate `color` or `filter:blur`; no `-webkit-text-stroke`; no text-transform reliance — uppercase the strings
   yourself.
 - No flex anywhere — the prefab's space-between column is replaced by absolutely positioned rows
-  (the engine mis-lays-out shrink-to-fit flex around animated children).
+  (a shrink-to-fit line reflows as its children reveal around animated children).
 - Never read the video frames, never run ffmpeg checks — `--verify` is the only self-check.
 - No redesign after a render or a verify failure — only the mechanical fixes in section 6.
diff --git a/refs/html/hook-210-peak/recipe.md b/refs/html/hook-210-peak/recipe.md
index fd9063e..d3bed6c 100644
--- a/refs/html/hook-210-peak/recipe.md
+++ b/refs/html/hook-210-peak/recipe.md
@@ -175,8 +175,8 @@ last beat, winMs = round(12.051×1000) − 9840 = 2211):
 ## 4. WORDS + TIMING
 
 - One `<span class="w">` per token from `word-timings.json` `words[]` (line1 verbatim case, line2
-  UPPERCASED — §3). Between two words in the same line: `<span class="sp"></span>` (inter-span whitespace
-  is dropped by the engine — the spacer IS the space).
+  UPPERCASED — §3). Between two words in the same line: `<span class="sp"></span>` (the spacer IS the
+  space, so its width is exact rather than inherited from the font).
 - Each word span gets, inline: `animation-delay:{delayMs}ms` — that word's `delayMs` VERBATIM, never
   recomputed — and `animation-duration:{enterMs}ms` where
   `{enterMs}` = clamp(`nextStart` − `delayMs`, 200, 600):
@@ -251,6 +251,6 @@ Then record (separate invocation, only after exit 0):
 - No invented sizes or timing: the accent `font-size` comes ONLY from the §3 FIT LAW; every
   `animation-delay` is VERBATIM from `word-timings.json`; durations only via the §4 clamps.
 - No reading frames, no ffmpeg, no visual checks — `--verify` is the only self-check.
-- No `var()` in transforms or keyframes, no animated `filter:blur`, no `text-transform` reliance —
-  set line1 verbatim case and line2 uppercase in the strings yourself.
+- No animated `filter:blur`, no `text-transform` reliance — set line1 verbatim case and line2
+  uppercase in the strings yourself.
 - No redesign after render; fix only elements `--verify` names, only by the §6 rules.
diff --git a/refs/html/hook-215 Comp 1-peak/recipe.md b/refs/html/hook-215 Comp 1-peak/recipe.md
index 3b50a1f..c9927f1 100644
--- a/refs/html/hook-215 Comp 1-peak/recipe.md	
+++ b/refs/html/hook-215 Comp 1-peak/recipe.md	
@@ -48,9 +48,8 @@ and the two mat delays `{T2}` `{T3}` (formula below). Canvas: see RESOLUTION at
 
   /* rounded window corners — the window is negative space (wherever no mat covers), so a corner is
      rounded by patching a mat-coloured 28×28 square over each of its 4 corners, clipped by an ALL-%
-     polygon that approximates a quarter-circle (border-radius fails Chrome parity in this engine —
-     renders a straight 45° chamfer, not a curve; clip-path polygon with %-only coords is the verified
-     substitute). The rounded-off area reveals the video beneath, faking a rounded cutout. Same cb/ob/rb
+     polygon that approximates a quarter-circle (a %-only clip-path polygon is used here so the corner
+     geometry is stated explicitly rather than inferred from a radius). The rounded-off area reveals the video beneath, faking a rounded cutout. Same cb/ob/rb
      colour+animation classes as the straight mats keep the corners in the colour-flip narrative. */
   .ctl { left: 26px;  top: 195px; width: 28px; height: 28px;
          clip-path: polygon(0% 0%, 100% 0%, 69.1% 4.9%, 41.2% 19.1%, 19.1% 41.2%, 4.9% 69.1%, 0% 100%); }
@@ -232,14 +231,13 @@ Then record (a SECOND invocation — `--verify` and `--record` are mutually excl
 - No fonts, colors, shadows, sizes, or keyframes beyond this sheet — Bricolage Grotesque 700/800, the four hexes
   (`#f4f1ea` `#2b419b` `#c0281c` `#fbf9f7`), `capIO`/`capHold`/`cueWin`/`matIn` and the s-ladder are
   the whole system. No text-shadow (the ink always sits on a flat mat).
-- Never use `border-radius` for the window corners (Chrome-parity failure in this engine — renders a
-  straight 45° chamfer, not a curve); the four `.ctl`/`.ctr`/`.cbl`/`.cbr` clip-path polygons ARE the
+- Never use `border-radius` for the window corners in this recipe; the four
+  `.ctl`/`.ctr`/`.cbl`/`.cbr` clip-path polygons ARE the
   corner radius — keep every coordinate a `%` (px/unitless coords get silently dropped by the engine).
 - No invented timing: every delay comes VERBATIM from `word-timings.json`; durations only via the
   section-4 formulas; the mat flips only at `{T2}`/`{T3}` from the K2/K3 rule.
 - Do not animate `background-color` with keyframed percentages (the prefab's `bgshift` is replaced
   by the delayed `.ob`/`.rb` overlay fades — use those); never animate `color` or `filter:blur`.
 - No per-word spans, no uppercasing, no reordering or dropping words; punctuation stays.
-- Never read the video frames; never move the `.cue` anchor or the window geometry; no `var()` in
-  transforms or keyframes; no `vw` font sizes; no descendant selectors — flat classes only.
+- Never read the video frames; never move the `.cue` anchor or the window geometry; no descendant selectors — flat classes only.
 - No redesign after a render or verify failure — only the mechanical fixes in section 6.
diff --git a/refs/html/hook-215 Comp 1-peak/recipe.ts b/refs/html/hook-215 Comp 1-peak/recipe.ts
index 2a85106..299451e 100644
--- a/refs/html/hook-215 Comp 1-peak/recipe.ts	
+++ b/refs/html/hook-215 Comp 1-peak/recipe.ts	
@@ -133,9 +133,9 @@ ${lines.join('\n')}
   .rb { background: #c0281c; z-index: 3; opacity: 0; animation: matIn 350ms ease ${T3}ms both; }
   @keyframes matIn { from { opacity: 0; } to { opacity: 1; } }
 
-  /* rounded window corners — mat-coloured 28×28 patches clipped to a quarter-circle. border-radius
-     renders a straight 45° chamfer in this engine; the ALL-% clip-path polygon is the verified
-     substitute (% coords stay verbatim at any SCALE). */
+  /* rounded window corners — mat-coloured 28×28 patches clipped to a quarter-circle. The ALL-%
+     polygon states the corner geometry explicitly rather than inferring it from a radius, and its
+     % coords stay verbatim at any SCALE. */
   .ctl { left: ${p(26)}px;  top: ${p(195)}px; width: ${p(28)}px; height: ${p(28)}px;
          clip-path: polygon(0% 0%, 100% 0%, 69.1% 4.9%, 41.2% 19.1%, 19.1% 41.2%, 4.9% 69.1%, 0% 100%); }
   .ctr { left: ${p(676)}px; top: ${p(195)}px; width: ${p(28)}px; height: ${p(28)}px;
diff --git a/refs/html/hook-224-peak/recipe.md b/refs/html/hook-224-peak/recipe.md
index b2a2142..4afbef3 100644
--- a/refs/html/hook-224-peak/recipe.md
+++ b/refs/html/hook-224-peak/recipe.md
@@ -21,9 +21,10 @@ alive on its own real timing inside a soft layered white glow.
 
 Paste this whole document as `runs/<key>/final/template.wv`, then insert one `.cue` block per beat
 (section 3) after the `<video>`. Replace only `{W} {H} {FPS} {DUR}` from `meta.json` (expect 736 / 1312 /
-25) and `{videoPath}`. NOTE: the prefab's `ignite` animated `filter: drop-shadow` together with sub-1
-opacity — that is the engine's glyph-clip danger zone, so this sheet's `ignite` is opacity-ONLY and the
-glow lives entirely in the static `.txt` text-shadow (engine-safe under fades). Do not re-add any `filter`.
+25) and `{videoPath}`. NOTE: the prefab's `ignite` animated `filter: drop-shadow`; the one animated
+`filter` this engine was measured on, `blur`, holds its initial value and never ramps, and animated
+`drop-shadow` was never probed, so this sheet's `ignite` is opacity-ONLY and the glow lives entirely in
+the static `.txt` text-shadow (engine-safe under fades). Do not re-add any `filter`.
 
 ```html
 <!DOCTYPE html>
@@ -63,7 +64,8 @@ glow lives entirely in the static `.txt` text-shadow (engine-safe under fades).
   .k26 { font-size: 26px; }
   .t39 { font-size: 39px; }  .t31 { font-size: 31px; }  .t25 { font-size: 25px; }
 
-  /* filament strike-on: opacity gutters then holds lit. OPACITY ONLY — no filter (glyph-clip bug). */
+  /* filament strike-on: opacity gutters then holds lit. OPACITY ONLY — no filter, because an
+     animated blur holds its initial value here and an animated drop-shadow was never measured. */
   @keyframes ignite { 0%{opacity:0} 10%{opacity:.9} 20%{opacity:.08} 34%{opacity:.7}
                       46%{opacity:.2} 62%{opacity:1} 100%{opacity:1} }
   .w  { display: inline-block; opacity: 0; margin-right: 0.28em; padding: 0.1em 0 0.15em 0;
@@ -160,7 +162,7 @@ perfect(1270) little(1610) morning(1830) routine.(2130)`, cueDelayMs 31, cueDurM
   beats never coexist at the shared anchor).
 - **line1 / line3**: one `<span class="w">` per token, text VERBATIM (keep case, punctuation, leading
   hyphens like `-do`). Each span's `animation-delay` = that word's `delayMs`, VERBATIM, never recomputed.
-  Word gaps are the `.w { margin-right: 0.28em }` — inter-span whitespace is dropped by the engine, the
+  Word gaps are the `.w { margin-right: 0.28em }` — inter-span whitespace is not what sets the gap here, the
   margin IS the space. Spans stay `display:inline-block`; never `display:block`.
 - **line2 (hero, per-char)**: split the hero word into single characters IN ORDER (punctuation is a char;
   the hero is one word, so no spaces). One `<span class="ch">` per char, written CONTIGUOUS in the markup
@@ -243,12 +245,13 @@ Then record (a SECOND invocation — `--verify` and `--record` are mutually excl
 - No fonts, colors, shadows, sizes, or keyframes beyond this sheet — Schibsted Grotesk, `#fbf9f7` on `#101010`, the
   four-layer text-shadow (3 white glow layers + 1 dark grounding layer, copied verbatim, never edited
   or brightened) and the size ladders are the whole system.
-- No `filter` anywhere — the prefab's animated `drop-shadow` is REMOVED on purpose (drop-shadow under
-  sub-1 opacity clips glyphs in this engine); do not restore it and do not animate `text-shadow` either.
+- No `filter` anywhere — the prefab's animated `drop-shadow` is REMOVED on purpose (animated `blur` is
+  measured to hold its initial value, animated `drop-shadow` is unmeasured); do not restore it, do not
+  animate `text-shadow`.
 - No invented timing: every `animation-delay` is a `word-timings.json` `delayMs` verbatim, or
   `heroDelayMs + i×K` with K from section 4; cue delay/duration verbatim from the beat.
 - No uppercasing, no reordering, no dropping tokens — words render exactly as transcribed.
 - No reading frames, no ffmpeg, no visual checks — `--verify` is the only self-check.
-- No `var()` in transforms or keyframes; no descendant selectors (`.line2 .ch`) — flat classes only,
-  exactly as in the skeleton; spans stay `display:inline-block`.
+- No descendant selectors (`.line2 .ch`) — flat classes only, exactly as in the skeleton; spans stay
+  `display:inline-block`.
 - No redesign after render; fix only elements `--verify` names, only by the mechanical rules in section 7.
diff --git a/refs/html/hook-224-peak/recipe.ts b/refs/html/hook-224-peak/recipe.ts
index 20d3a35..4de7d57 100644
--- a/refs/html/hook-224-peak/recipe.ts
+++ b/refs/html/hook-224-peak/recipe.ts
@@ -1,8 +1,9 @@
 // Compiled recipe — hook-224-peak (9:16, authored at 736×1312 @25fps). Source sheet: ./recipe.md (v2).
 // Neon-filament lockup in the lower-middle band: white glowing Schibsted Grotesk on the footage —
 // a 600 kicker line, a monumental 800 hero word striking on per-CHAR like bulb filaments, a centered
-// 700 closer line. Ignite is opacity-ONLY (animated filter/drop-shadow under sub-1 opacity clips
-// glyphs in this engine); the glow lives in the static .txt text-shadow, whose 4th DARK layer grounds
+// 700 closer line. Ignite is opacity-ONLY: animated blur holds its initial value (probe:
+// animated-blur-holds) and an animated drop-shadow was never probed, so nothing here rides a filter;
+// the glow lives in the static .txt text-shadow, whose 4th DARK layer grounds
 // white type on light footage. Emphasis is STRUCTURAL (the hero lands alone in line2). Bounded variety:
 // even beats add `arrB` to line2 (align-self/text-align only — no transform; translate(-50%) mis-centers
 // in this engine, flex centering is the safe construct).
@@ -187,7 +188,8 @@ ${lines.join('\n')}
   .k26 { font-size: ${p(26)}px; }
   .t39 { font-size: ${p(39)}px; }  .t31 { font-size: ${p(31)}px; }  .t25 { font-size: ${p(25)}px; }
 
-  /* filament strike-on: opacity gutters then holds lit. OPACITY ONLY — no filter (glyph-clip bug). */
+  /* filament strike-on: opacity gutters then holds lit. OPACITY ONLY — no filter, because an
+     animated blur holds its initial value here and an animated drop-shadow was never measured. */
   @keyframes ignite { 0%{opacity:0} 10%{opacity:.9} 20%{opacity:.08} 34%{opacity:.7}
                       46%{opacity:.2} 62%{opacity:1} 100%{opacity:1} }
   .w  { display: inline-block; opacity: 0; margin-right: 0.28em; padding: 0.1em 0 0.15em 0;
diff --git a/refs/html/hook-230-peak/recipe.md b/refs/html/hook-230-peak/recipe.md
index 7e89052..1e0e7bf 100644
--- a/refs/html/hook-230-peak/recipe.md
+++ b/refs/html/hook-230-peak/recipe.md
@@ -58,21 +58,21 @@ see RESOLUTION at the top of this sheet. All px below are at SCALE = 1.
                  0 0 31px rgba(255,255,255,0.45), 0 1px 6px rgba(0,0,0,0.55); }
 
   /* arc glyph reveal — carried on an INNER span so each glyph's static arc transform is untouched
-     (the two-span unit; never animate the .ch itself). Symmetric padding = shear headroom at
+     (the two-span unit; never animate the .ch itself). Symmetric padding = descender headroom at
      line-height 1 that keeps the glyph optically centred on its circle point. */
   .g { display: inline-block; opacity: 0; padding: 0.2em 0;
        animation: chIn .5s cubic-bezier(.2,.7,.3,1) both; }
   @keyframes chIn { 0% { opacity: 0; transform: translateY(0.5em); } 100% { opacity: 1; transform: translateY(0); } }
 
   /* ---- HEADLINE: straight bold Archivo block, left-aligned, right-of-centre ---- */
-  /* PLAIN BLOCK lines on purpose (the prefab's flex column mis-lays-out animated children). */
+  /* PLAIN BLOCK lines on purpose (the prefab's flex column reflows as its animated children reveal). */
   .head { position: absolute; left: 248px; top: 722px; }
   .hl { display: block; white-space: nowrap; line-height: 1; text-align: left;
         font-family: 'Archivo', system-ui, sans-serif; font-weight: 700; letter-spacing: -0.5px;
         color: #f7f5f3;
         text-shadow: 0 1px 5px rgba(0,0,0,0.55), 0 0 2px rgba(0,0,0,0.4); }
   .hg { margin-top: -0.17em; }   /* lines 2+: restores the prefab's 1.06 leading under the .hw padding */
-  .hw { display: inline-block; opacity: 0; margin-right: 0.26em;   /* word gap (inter-span whitespace is dropped) */
+  .hw { display: inline-block; opacity: 0; margin-right: 0.26em;   /* word gap (inter-span whitespace is not what sets the gap here) */
         padding: 0.08em 0 0.15em;
         animation: wIn .42s cubic-bezier(.2,.7,.3,1) both; }
   @keyframes wIn { 0% { opacity: 0; transform: translateY(0.28em); } 100% { opacity: 1; transform: translateY(0); } }
@@ -329,9 +329,8 @@ math — seed the font cache first). `manifest.json` shape is in section 2.
   from the section-3 table / closed form.
 - Never animate the `.ch` itself — the rise lives on the inner `.g` ONLY. The `.cue`/`.arc`/`.head`
   ancestors carry opacity/position only, NEVER a transform.
-- Never lay headline words out in flex (the prefab's flex column mis-lays-out animated children) —
-  plain block `.hl` lines. Never animate `color`; no `var()` in transforms/keyframes; no `vw` font
-  sizes; no CSS grid/outline; no `<br>`; no descendant selectors — flat classes only (arc font-size is
+- Never lay headline words out in flex (the prefab's flex column reflows as its animated children reveal) —
+  plain block `.hl` lines. Never animate `color`; no CSS grid; no `<br>`; no descendant selectors — flat classes only (arc font-size is
   INLINE on the `.arc` div and inherited).
 - No per-word spacer spans (the prefab's `.sp` spacers are replaced by the `.hw` margin — spacer spans
   collapse unpredictably); arc gaps are the space slots. No reordering/dropping words; keep original
diff --git a/refs/html/hook-236-peak/recipe.md b/refs/html/hook-236-peak/recipe.md
index 8c67244..db6032b 100644
--- a/refs/html/hook-236-peak/recipe.md
+++ b/refs/html/hook-236-peak/recipe.md
@@ -246,6 +246,6 @@ Manifest line (already given in section 2): `{"render":{"width":{W},"height":{H}
 - No invented timing: every word `animation-delay` comes VERBATIM from `word-timings.json`; derived
   numbers only via the closed forms in sections 3–4. No fade-outs; the gate cuts each beat.
 - Never move a slot anchor, add slots, uppercase the words, or re-balance the scatter aesthetically.
-- Never animate `color` or `filter:blur`; never put `var()` in transforms or keyframes; no `vw` sizes.
+- Never animate `color` or `filter:blur`.
 - Never read the video frames, never run ffmpeg checks — `--verify` is the only self-check.
 - No redesign after a render or verify failure — only the mechanical fixes in section 6.
diff --git a/refs/html/hook-242-peak/recipe.md b/refs/html/hook-242-peak/recipe.md
index e833726..8ed19ed 100644
--- a/refs/html/hook-242-peak/recipe.md
+++ b/refs/html/hook-242-peak/recipe.md
@@ -78,8 +78,8 @@ the `<video>` element (section 3). Replace only `{videoPath}` (from `meta.json`)
 
   /* the accent's hand-drawn underline: ONE element statically clipped to the beat's spline outline
      (clip-path: polygon() in %, so one outline holds at any word width and any SCALE), swept
-     left→right by scaleX 0→1 from its left edge — the only draw device the engine honours (an
-     animated width, clip-path or inset() renders the finished stroke from frame one). The
+     left→right by scaleX 0→1 from its left edge — the sweep is what keeps that single percent
+     outline exact at every word width, not a repair for a ramp the engine refuses. The
      drop-shadow sits on the whole stroke at once. */
   .ul { position: absolute; background: #fdf7f4; transform: scaleX(0); transform-origin: 0 50%;
         filter: drop-shadow(0 1px 4px rgba(0,0,0,0.55));
@@ -277,9 +277,13 @@ in percent tracing the centreline of one of four splines (cycled by beat: a risi
 bow, a shallow S, a near-straight drop), and it grows by `transform: scaleX(0 → 1)` from
 `transform-origin: 0 50%`.
 
-ENGINE LAW behind those three choices — each proven on a fixture, never "simplify" them back:
-- `width` in a keyframe renders STATIC (the finished width from frame one). Growth is scaleX, only.
-- An animated `clip-path` (polygon or inset) is ignored the same way. A static clip-path is fine.
+WHY those three choices, and never "simplify" them back:
+- Growth is scaleX because ONE percent outline then stays exact at every word width. A `width`
+  keyframe animates on this engine (probe: width-keyframes-static, refuted) — it is simply not this
+  ref's device.
+- An animated `clip-path` also interpolates (probe: animated-clip-path, refuted, measured on
+  `polygon()`; `inset()` was never probed). The static clip-path here carries the spline outline, so
+  animating it would fight the geometry, not the engine.
 - A rotated wrapper around a sized child renders many times too thick, and a chain of rotated boxes
   facets at every joint. One element, one clipped outline.
 
@@ -324,8 +328,9 @@ Manifest line (already given in section 2): `{"render":{"width":{W},"height":{H}
 - The underline belongs to the accent alone — exactly one `.ul` per beat, exactly the §5 geometry
   (1.02 / 0.42 / 0.1 em of the accent size, 0.115 of the box height, four cycled splines). Never a
   second stroke, never a rule under an ordinary word, never a highlighter plate behind one.
-- Never grow that stroke with `width`, an animated `clip-path` or an animated `inset()` — all three
-  render it finished from frame one. It is `scaleX(0 → 1)` from `transform-origin: 0 50%` with BOTH
+- Never grow that stroke with `width`, an animated `clip-path` or an animated `inset()` — this is the
+  sheet's rule, not an engine limit (the first two ramp fine: probes width-keyframes-static and
+  animated-clip-path, both refuted). It is `scaleX(0 → 1)` from `transform-origin: 0 50%` with BOTH
   keyframe ends authored, on ONE element carrying a STATIC percent `clip-path` — never a chain of
   rotated segments (it facets at every joint) and never a rotated wrapper around a scaled child (it
   renders many times too thick).
@@ -337,7 +342,6 @@ Manifest line (already given in section 2): `{"render":{"width":{W},"height":{H}
   scatter early.
 - Keep the spoken case; never `text-transform`; never drop the `padding-bottom:0.2em` or thin the
   text-shadow.
-- Never animate `color`; never put `var()` in transforms/keyframes; no `vw` sizes; no flex anywhere;
-  flat classes/ids exactly as in the skeleton.
+- Never animate `color`; no flex anywhere; flat classes/ids exactly as in the skeleton.
 - Never read the video frames; never re-derive layout; no redesign after a render or verify failure —
   only the mechanical fixes in section 6.
diff --git a/refs/html/hook-242-peak/recipe.ts b/refs/html/hook-242-peak/recipe.ts
index eb0bee8..9013371 100644
--- a/refs/html/hook-242-peak/recipe.ts
+++ b/refs/html/hook-242-peak/recipe.ts
@@ -148,8 +148,10 @@ export const splineFor = (N: number): ((t: number) => number) => UL_SPLINES[mod(
 // crosses the box's own left or right edge. Percent (never px) is what keeps one outline correct at
 // any word width and any SCALE.
 // The stroke is ONE element with this outline as a STATIC clip-path, grown by scaleX 0→1 from its
-// left edge (see `.ul`) — the only draw device the engine honours: a `width` keyframe, an animated
-// `clip-path` and an animated `inset()` all render the finished shape from frame one. One element is
+// left edge (see `.ul`) — the device this ref draws with, because one percent outline then stays
+// exact at any word width. A `width` keyframe and an animated `clip-path` both ramp on this engine
+// (probes: width-keyframes-static, animated-clip-path, both refuted); `inset()` was never probed,
+// so it is untested rather than broken. One element is
 // also the only clean shape: a chain of rotated boxes facets at every joint and a rotated wrapper
 // around a scaled child renders many times too thick (both proven on fixtures).
 export function underlinePolygon(spline: (t: number) => number, wPx: number, hPx: number, samples = 24): string {
@@ -463,8 +465,8 @@ ${divs.join('\n')}
 
   /* the accent's hand-drawn underline: ONE element statically clipped to the beat's spline outline
      (clip-path: polygon() in %, so one outline holds at any word width and any SCALE), swept
-     left→right by scaleX 0→1 from its left edge — the only draw device the engine honours (an
-     animated width, clip-path or inset() renders the finished stroke from frame one). The
+     left→right by scaleX 0→1 from its left edge — the sweep is what keeps that single percent
+     outline exact at every word width, not a repair for a ramp the engine refuses. The
      drop-shadow sits on the whole stroke at once. */
   .ul { position: absolute; background: #fdf7f4; transform: scaleX(0); transform-origin: 0 50%;
         filter: drop-shadow(0 ${p(1)}px ${p(4)}px rgba(0,0,0,0.55));
diff --git a/refs/html/hook-244-peak/recipe.md b/refs/html/hook-244-peak/recipe.md
index 2eed898..c9e8f97 100644
--- a/refs/html/hook-244-peak/recipe.md
+++ b/refs/html/hook-244-peak/recipe.md
@@ -163,7 +163,7 @@ emphasis word, there is no separate hero line — the 86px accent is the hero.
 ## 4. WORDS + TIMING
 
 Glyph-level ref → one `.ch` span PER CHARACTER; between words insert exactly one
-`<span class="sp"></span>` (inter-span whitespace is dropped by the engine — the spacer is the
+`<span class="sp"></span>` (inter-span whitespace is not what sets the gap here — the spacer is the
 space).
 
 Each glyph's `animation-delay` is derived from its WORD's `delayMs` in `word-timings.json`
diff --git a/tsconfig.json b/tsconfig.json
index 495a973..865fe23 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -9,6 +9,13 @@
     "strict": true,
     "skipLibCheck": true,
     "resolveJsonModule": true,
-    "types": ["node"]
-  }
+    "types": [
+      "node"
+    ]
+  },
+  "exclude": [
+    "runs",
+    "node_modules",
+    ".open-edit"
+  ]
 }