diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
deleted file mode 100644
index 96f0c7a7d6e..00000000000
--- a/.github/CODEOWNERS
+++ /dev/null
@@ -1,3 +0,0 @@
-/scripts/check-pr-captures.mjs @miguel-heygen
-/scripts/check-pr-captures.test.mjs @miguel-heygen
-/.github/workflows/pr-captures.yml @miguel-heygen
diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml
deleted file mode 100644
index a1fccea5458..00000000000
--- a/.github/codeql/codeql-config.yml
+++ /dev/null
@@ -1,64 +0,0 @@
-name: "Hyperframes CodeQL config"
-
-# Use GitHub's default security-extended suite — it's a strict superset of the
-# default suite (more queries, slightly higher false-positive rate). Pair it with
-# the query-filters below so the extra queries don't drown the dashboard.
-queries:
-  - uses: security-extended
-
-# Per-rule path filters. The intent is to silence rules that have known false
-# positives on specific file shapes (generated test artifacts, CDN-script test
-# fixtures, functional-cleanup regex) WITHOUT excluding those paths from all
-# analysis — a malicious contributor adding e.g. a command-injection sink into
-# a "test fixture" would still get caught.
-#
-# To audit what changed: look at PR diffs touching this file. Reviewers should
-# treat it like CODEOWNERS — adding a new path exclusion is a policy change.
-query-filters:
-  # Generated test artifacts (golden baselines written by the producer test
-  # harness). Every compiled.html re-rasterizes the regex-stripped composition;
-  # the same alerts fire on every fixture and on every re-render.
-  - exclude:
-      id: js/incomplete-sanitization
-      paths:
-        - "packages/producer/tests/**/output/compiled.html"
-        - "packages/producer/tests/**/failures/*.html"
-
-  # Test fixtures and skill test corpora intentionally load CDN scripts without
-  # SRI — pinning hashes there would fight the test's purpose (we want the test
-  # to use whatever the registry hands back, the same way a composition would).
-  - exclude:
-      id: js/functionality-from-untrusted-source
-      paths:
-        - "packages/producer/tests/**"
-        - "skills/**/test-corpus/**"
-        - "skills/**/assets/test-corpus/**"
-
-  # The hand-rolled HTML cleanup regex in our build-time tooling looks like a
-  # sanitizer to CodeQL but isn't one — it strips framework bootstraps from
-  # captured pages before they're fed back into our own renderer (Puppeteer,
-  # not a user-facing DOM). Same for the text normalizer in the whisper path
-  # (caption text → SRT/VTT, no DOM emission). Scope these exclusions to the
-  # exact files that contain functional regex, not to whole directories, so
-  # any new code in cli/, core/, or producer/ that LOOKS like a sanitizer
-  # still trips the rules.
-  - exclude:
-      id: js/bad-tag-filter
-      paths:
-        - "packages/cli/src/capture/index.ts"
-        - "packages/cli/src/whisper/normalize.ts"
-        - "packages/core/src/lint/utils.ts"
-        - "packages/producer/src/services/htmlCompiler.ts"
-  - exclude:
-      id: js/incomplete-multi-character-sanitization
-      paths:
-        - "packages/cli/src/capture/index.ts"
-        - "packages/cli/src/whisper/normalize.ts"
-
-  # Golden baselines inline vendor libraries (Three.js, GSAP) whose bundled
-  # Math.random() calls trip insecure-randomness. These are test artifacts
-  # from compiled compositions, not production code paths.
-  - exclude:
-      id: js/insecure-randomness
-      paths:
-        - "packages/producer/tests/**/output/compiled.html"
diff --git a/.github/renovate.json b/.github/renovate.json
deleted file mode 100644
index 820d0e57fc9..00000000000
--- a/.github/renovate.json
+++ /dev/null
@@ -1,46 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["config:recommended", ":semanticCommits", ":dependencyDashboard"],
-  "schedule": ["before 6am on monday"],
-  "timezone": "America/Los_Angeles",
-  "prConcurrentLimit": 5,
-  "prHourlyLimit": 2,
-  "rangeStrategy": "bump",
-  "lockFileMaintenance": {
-    "enabled": true,
-    "schedule": ["before 6am on monday"]
-  },
-  "vulnerabilityAlerts": {
-    "enabled": true,
-    "labels": ["security"]
-  },
-  "packageRules": [
-    {
-      "matchDepTypes": ["engines", "peerDependencies"],
-      "rangeStrategy": "widen"
-    },
-    {
-      "matchUpdateTypes": ["minor", "patch"],
-      "matchDepTypes": ["devDependencies"],
-      "groupName": "dev dependencies (non-major)"
-    },
-    {
-      "matchUpdateTypes": ["patch"],
-      "matchDepTypes": ["dependencies"],
-      "groupName": "prod patch updates"
-    },
-    {
-      "matchUpdateTypes": ["major"],
-      "dependencyDashboardApproval": true
-    },
-    {
-      "matchManagers": ["github-actions"],
-      "groupName": "github-actions",
-      "pinDigests": true
-    },
-    {
-      "enabled": false,
-      "matchPackageNames": ["/^@hyperframes//"]
-    }
-  ]
-}
diff --git a/.github/workflows/canary-sunset.yml b/.github/workflows/canary-sunset.yml
deleted file mode 100644
index 9fbca635668..00000000000
--- a/.github/workflows/canary-sunset.yml
+++ /dev/null
@@ -1,32 +0,0 @@
-# Canary sunset governance.
-#
-# Deliberately NOT a PR gate. The check reads the current date, so as a PR gate
-# it would fail builds for authors who touched nothing related, on a calendar
-# date, with no fix available to them. On a schedule the failure stands on its
-# own instead of blocking an unrelated author.
-#
-# The job names the overdue canary and its owner in the run log; it does not
-# notify anyone. Routing that to the owner automatically (an issue, a ping)
-# is worth doing and is not done here.
-name: Canary sunset
-
-permissions:
-  contents: read
-
-on:
-  schedule:
-    # Mondays at 15:10 UTC, shortly after the CodeQL run.
-    - cron: "10 15 * * 1"
-  workflow_dispatch:
-
-jobs:
-  sunset:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-        with:
-          bun-version: latest
-      # No install/build: the script imports the registry source directly and
-      # bun runs TypeScript natively.
-      - run: bun scripts/check-canary-sunset.ts
diff --git a/.github/workflows/catalog-previews.yml b/.github/workflows/catalog-previews.yml
deleted file mode 100644
index 5eec5076482..00000000000
--- a/.github/workflows/catalog-previews.yml
+++ /dev/null
@@ -1,129 +0,0 @@
-name: Catalog Previews
-
-permissions:
-  contents: read
-
-# Suppress hyperframes CLI telemetry from HeyGen's own CI runs.
-# External users' CI continues to emit telemetry unless they set this themselves.
-env:
-  HYPERFRAMES_NO_TELEMETRY: "1"
-
-on:
-  pull_request:
-    branches: [main]
-    paths:
-      - "registry/blocks/**"
-      - "registry/components/**"
-      - "scripts/generate-catalog-previews.ts"
-      # Modules the renderer imports. Without them a change to path-traversal
-      # defence or temp-directory allocation alone never re-runs the job that
-      # exercises it.
-      - "scripts/registry-target-paths.mjs"
-      - "scripts/catalog-preview-temp.ts"
-      - ".github/workflows/catalog-previews.yml"
-
-concurrency:
-  group: catalog-previews-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  preflight:
-    name: Preflight (lint + format)
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: ./.github/actions/preflight
-
-  render-previews:
-    name: Render catalog previews
-    needs: preflight
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          fetch-depth: 0
-
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-
-      - run: bun install --frozen-lockfile
-
-      - run: bun run build
-
-      # Chrome headless shell for rendering
-      - uses: browser-actions/setup-chrome@c785b87e244131f27c9f19c1a33e2ead956ab7ce # v1
-        with:
-          chrome-version: stable
-
-      # The renderer shells out to ffmpeg for both halves of a preview: the
-      # poster transcode and the web encode of the mp4. Neither ran here before
-      # (`--skip-video` skipped the encode, and the poster copy was a plain
-      # file copy), so the job never needed it and ubuntu-latest does not ship
-      # it.
-      - name: Install ffmpeg
-        uses: ./.github/actions/install-ffmpeg-linux
-
-      - name: Render changed block/component previews
-        run: |
-          # HEAD is the PR merge ref; its first parent is the current base tip,
-          # unlike the event payload's base.sha, which can go stale.
-          BASE_SHA="$(git rev-parse HEAD^1)"
-
-          # Find which blocks/components changed in this PR. The trailing slash
-          # in the grep matters: an item is a directory, and a file sitting
-          # directly under registry/components (CATALOG.md) does not match the
-          # sed, so without it the whole path survives and is passed to the
-          # renderer as if it were an item name.
-          CHANGED_ITEMS=$(git diff --name-only --diff-filter=ACMR "$BASE_SHA"...HEAD -- registry/blocks/ registry/components/ \
-            | grep -E '^registry/(blocks|components)/[^/]+/' \
-            | sed 's|^registry/[^/]*/\([^/]*\)/.*|\1|' \
-            | sort -u)
-
-          # A renderer change reaches every item, so it cannot be trusted to a
-          # PR that happens to also touch a block. Two canaries cover the two
-          # shapes the renderer has to tell apart: a block whose scene lives in
-          # a <template> (mounted through a wrapper) and one that registers its
-          # timeline at body level (rendered directly). Getting that wrong is
-          # silent — the wrong-shaped block renders blank, not red.
-          RENDERER_CHANGED=$(git diff --name-only --diff-filter=ACMR "$BASE_SHA"...HEAD \
-            -- scripts/generate-catalog-previews.ts scripts/registry-target-paths.mjs \
-               scripts/catalog-preview-temp.ts)
-          if [ -n "$RENDERER_CHANGED" ]; then
-            CHANGED_ITEMS=$(printf '%s\n' $CHANGED_ITEMS \
-              code-snippet-dark-modern code-snippet-apple-terminal-pro | sort -u)
-          fi
-
-          if [ -z "$CHANGED_ITEMS" ]; then
-            echo "No block/component changes detected."
-            exit 0
-          fi
-
-          echo "Changed items: $CHANGED_ITEMS"
-          FAILED=0
-
-          for item in $CHANGED_ITEMS; do
-            echo "Rendering preview for: $item"
-            if ! timeout 120 npx tsx scripts/generate-catalog-previews.ts --only "$item" --skip-video; then
-              echo "::warning::Failed to render preview for $item"
-              FAILED=$((FAILED + 1))
-            fi
-          done
-
-          if [ "$FAILED" -gt 0 ]; then
-            echo "::warning::$FAILED item(s) failed to render"
-            exit 1
-          fi
-
-      - name: Upload preview artifacts
-        if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: catalog-previews
-          path: docs/images/catalog/
-          if-no-files-found: ignore
-          retention-days: 7
diff --git a/.github/workflows/catalog-publish.yml b/.github/workflows/catalog-publish.yml
deleted file mode 100644
index 25730ac324c..00000000000
--- a/.github/workflows/catalog-publish.yml
+++ /dev/null
@@ -1,42 +0,0 @@
-name: Publish catalog
-
-on:
-  push:
-    branches: [main]
-  workflow_dispatch:
-
-permissions:
-  actions: write
-  contents: write
-  pull-requests: write
-
-concurrency:
-  group: catalog-publish
-  cancel-in-progress: false
-
-env:
-  HYPERFRAMES_NO_TELEMETRY: "1"
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          ref: main
-          fetch-depth: 0
-          persist-credentials: false
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-      - run: bash scripts/ci/install-workspace-dependencies.sh
-      - run: bun run --filter '@hyperframes/{parsers,lint,studio-server}' build
-      - run: bun run --cwd packages/core build
-      - run: bun run --cwd packages/core build:hyperframes-runtime
-      - run: bun run check:catalog-drift
-      - name: Refresh the standing publish PR
-        run: node scripts/publish-catalog.mjs
-        env:
-          GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7a6bcdf820f..8e2bd62eb27 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,1650 +1,80 @@
+# promptwise CI: the checks for what this fork changes, Studio and the CLI that serves it.
+# Upstream's other workflows (renders, Windows, Lambda, catalog, npm publish, perf benches) are removed.
 name: CI
-run-name: ${{ github.event_name == 'workflow_dispatch' && format('Checks (catalog_publish={0})', inputs.catalog_publish) || '' }}
-
-permissions:
-  contents: read
-  pull-requests: read
-
-# Suppress hyperframes CLI telemetry from HeyGen's own CI runs.
-# External users' CI continues to emit telemetry unless they set this themselves.
-env:
-  HYPERFRAMES_NO_TELEMETRY: "1"
 
 on:
-  merge_group:
-    types: [checks_requested]
-  workflow_dispatch:
-    inputs:
-      catalog_publish:
-        description: "Run required checks for a generated catalog publication."
-        type: boolean
-        default: false
   pull_request:
-    # `edited` is required so the workflow re-fires when a PR's base ref is
-    # set back to `main` after a Graphite stack restack momentarily flips
-    # the base off of `main`. Without it, `pull_request` triggers are not
-    # re-evaluated on `base_ref_changed`, leaving required checks skipped
-    # for that head SHA forever.
-    types: [opened, synchronize, reopened, edited]
-    branches: [main]
   push:
     branches: [main]
+  workflow_dispatch:
 
 concurrency:
   group: ci-${{ github.ref }}
-  # A body or title edit queues behind running checks instead of cancelling them.
-  cancel-in-progress: ${{ github.event.action != 'edited' || github.event.changes.base != null }}
-
-jobs:
-  test-reachability:
-    name: Test reachability
-    runs-on: ubuntu-latest
-    timeout-minutes: 6
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        timeout-minutes: 3
-        with:
-          fetch-depth: 2
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-      - name: Report base reachability
-        if: github.event_name == 'pull_request'
-        # HEAD is the PR merge ref; its first parent is the current base tip,
-        # which stays correct even when pull_request.base.sha is stale.
-        run: |
-          BASE_SHA="$(git rev-parse HEAD^1)"
-          git worktree add --detach "$RUNNER_TEMP/reachability-base" "$BASE_SHA"
-          (cd "$RUNNER_TEMP/reachability-base" && node scripts/check-test-reachability.mjs --report)
-          git worktree remove "$RUNNER_TEMP/reachability-base"
-      - name: Report head reachability
-        run: node scripts/check-test-reachability.mjs --report
-      - run: node --test scripts/check-test-reachability.test.mjs
-      - run: node scripts/check-test-reachability.mjs
-
-  changes:
-    name: Detect changes
-    runs-on: ubuntu-latest
-    timeout-minutes: 8
-    permissions:
-      actions: read
-      contents: read
-      pull-requests: read
-    outputs:
-      release_only: ${{ steps.release.outputs.release_only }}
-      code: ${{ (github.event_name == 'workflow_dispatch' && inputs.catalog_publish) && 'true' || steps.release.outputs.release_only == 'true' && 'false' || steps.filter.outputs.code }}
-      docs_catalog: ${{ steps.filter.outputs.docs_catalog }}
-      cli: ${{ steps.release.outputs.release_only == 'true' && 'false' || steps.filter.outputs.cli }}
-      cli_bundle: ${{ steps.release.outputs.release_only == 'true' && 'false' || steps.filter.outputs.cli_bundle }}
-      skills: ${{ steps.release.outputs.release_only == 'true' && 'false' || steps.filter.outputs.skills }}
-      catalog_index: ${{ steps.release.outputs.release_only == 'true' && 'false' || steps.filter.outputs.catalog_index }}
-      codex_plugin: ${{ steps.filter.outputs.codex_plugin }}
-      gcp_beginframe: ${{ steps.release.outputs.release_only == 'true' && 'false' || steps.filter.outputs.gcp_beginframe }}
-      studio: ${{ steps.release.outputs.release_only == 'true' && 'false' || steps.filter.outputs.studio }}
-      edit_accuracy: ${{ steps.release.outputs.release_only == 'true' && 'false' || steps.edit_accuracy_filter.outputs.edit_accuracy }}
-    steps:
-      # Force git-based change detection instead of the pull_request REST API.
-      # The API path can fail the whole workflow on transient listFiles
-      # timeouts before any real CI work starts.
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        timeout-minutes: 3
-      - name: Fetch the history the diffs read
-        timeout-minutes: 2
-        uses: ./.github/actions/fetch-history
-      - name: Check whether this commit already passed before a title or body edit
-        id: edit
-        uses: ./.github/actions/edit-already-passed
-      - name: Reject accidental file deletions
-        if: github.event_name == 'pull_request'
-        run: node scripts/check-no-main-deletions.mjs --base origin/main
-      # HEAD is the PR merge ref; its first parent is the current base tip, unlike the payload's
-      # base.sha, which goes stale and would count the base's newer commits as the PR's changes.
-      - name: Find the pull request's current base
-        id: base
-        if: github.event_name == 'pull_request'
-        run: |
-          git rev-parse --verify -q HEAD^2 > /dev/null || { echo "::error::HEAD is not the pull request merge commit"; exit 1; }
-          sha="$(git rev-parse --verify HEAD^1)"
-          echo "sha=$sha" >> "$GITHUB_OUTPUT"
-      - name: Reject large binaries outside LFS
-        if: github.event_name == 'pull_request'
-        env:
-          BASE_SHA: ${{ steps.base.outputs.sha }}
-        run: sh scripts/check-large-files.sh --range "$BASE_SHA" HEAD
-      - name: Find a release-only diff
-        id: release
-        uses: ./.github/actions/release-only-diff
-      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4
-        id: filter
-        if: steps.edit.outputs.passed != 'true'
-        with:
-          token: ""
-          base: ${{ steps.base.outputs.sha }}
-          filters: |
-            catalog_index:
-              - "registry/**"
-              - "registry/catalog-artifact/**"
-              - "skills/media-use/audio/assets/sfx/**"
-              - "scripts/catalog/check-artifact-coverage.ts"
-            docs_catalog:
-              - "skills/media-use/audio/assets/sfx/**"
-              - "docs/**"
-              - "registry/**"
-              - "scripts/*catalog*"
-              - "scripts/catalog-fetch-mirror/**"
-              - "scripts/docs-catalog-shared.mjs"
-              - "packages/core/**"
-              - "packages/producer/**"
-              - "package.json"
-              - ".github/workflows/ci.yml"
-            code:
-              - "registry/**"
-              - "packages/**"
-              - "scripts/**"
-              - "package.json"
-              - "bun.lock"
-              - "tsconfig*.json"
-              - "Dockerfile*"
-              - ".github/workflows/**"
-              - ".github/actions/**"
-            cli:
-              - "packages/cli/**"
-              - "package.json"
-              - "bun.lock"
-              - ".github/workflows/ci.yml"
-            # Skills packages/cli/scripts/build-copy.mjs bundles into the CLI tarball (size budget).
-            cli_bundle:
-              - "skills/hyperframes/**"
-              - "skills/hyperframes-cli/**"
-              - "skills/gsap/**"
-              - "skills/media-use/**"
-            skills:
-              - "packages/cli/src/media-use/**"
-              - "scripts/check-media-use-copy-parity.test.mjs"
-              - "scripts/check-skill-import-boundaries.test.mjs"
-              - "scripts/generate-skill-module-copies.mjs"
-              - "skills/**"
-              - ".claude/skills/**"
-              - ".agents/skills/**"
-              - "skills-manifest.json"
-              - "scripts/lint-skills.ts"
-              - "scripts/check-skill-mirror.mjs"
-              - "package.json"
-              - ".github/workflows/ci.yml"
-              - ".github/actions/install-ffmpeg-linux/**"
-            codex_plugin:
-              - "skills-manifest.json"
-              - "packages/cli/package.json"
-              - "plugin.json"
-              - "gemini-extension.json"
-              - ".claude-plugin/**"
-              - ".cursor-plugin/**"
-              - "scripts/package-agent-plugin*"
-              - "scripts/set-version*"
-              - "LICENSE"
-              - ".codex-plugin/**"
-              - "assets/**"
-              - "skills/**"
-              - "scripts/package-codex-plugin.mjs"
-              - "package.json"
-              - ".github/workflows/ci.yml"
-            studio:
-              - "packages/studio/**"
-              - "packages/core/**"
-              - "packages/studio-server/**"
-              - "bun.lock"
-              - ".github/workflows/ci.yml"
-            gcp_beginframe:
-              - "packages/gcp-cloud-run/Dockerfile"
-              - "packages/aws-lambda/scripts/probe-beginframe.ts"
-              - "packages/engine/src/services/browserManager.ts"
-              - "package.json"
-              - "bun.lock"
-              - ".github/workflows/ci.yml"
-      # Only what the edit accuracy bench runs: the Studio it drives, the preview server the CLI hosts it from,
-      # and the engine and producer modules it captures frames with (the import closure of browserManager,
-      # frameCapture and both fileServers). Encoders, renders and other CLI commands are not on its path.
-      # Its own base: the merge queue's is the event's base_sha, since that run's HEAD is not a PR merge commit.
-      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4
-        id: edit_accuracy_filter
-        if: steps.edit.outputs.passed != 'true' && (github.event_name == 'pull_request' || github.event_name == 'merge_group')
-        with:
-          token: ""
-          base: ${{ github.event_name == 'merge_group' && github.event.merge_group.base_sha || steps.base.outputs.sha }}
-          predicate-quantifier: some-with-excludes
-          filters: |
-            edit_accuracy:
-              - "packages/studio/src/**"
-              - "packages/studio/index.html"
-              - "packages/studio/vite.*.ts"
-              - "packages/studio/public/**"
-              - "packages/studio/tests/e2e/edit-accuracy/**"
-              - "packages/studio/tests/e2e/webmcp-host.mjs"
-              - "packages/studio-server/src/**"
-              - "packages/core/src/**"
-              - "packages/core/scripts/**"
-              - "packages/core/schemas/**"
-              - "packages/parsers/src/**"
-              - "packages/player/src/**"
-              - "packages/sdk/src/**"
-              - "packages/lint/src/**"
-              - "packages/cli/src/{cli,help,version}.ts"
-              - "packages/cli/src/renderSetupWorker*.ts"
-              - "packages/cli/src/commands/{preview*,add,browser}.ts"
-              - "packages/cli/src/server/**"
-              - "packages/cli/src/browser/**"
-              - "packages/cli/src/utils/**"
-              - "packages/cli/src/ui/**"
-              - "packages/cli/src/{background-removal,registry,telemetry}/**"
-              - "packages/cli/src/capture/{captureCompositionFrame,captureTimeout,navigateForCapture,readBoundedResponse}.ts"
-              - "packages/cli/src/media-use/lib/config-lock.mjs"
-              - "packages/cli/src/auth/{paths,telemetryIdentity}.ts"
-              - "packages/cli/scripts/**"
-              - "packages/core/stubs/**"
-              - "packages/engine/src/**"
-              - "packages/producer/src/**"
-              - "packages/producer/stubs/**"
-              - "packages/producer/scripts/build-hf-early-stub.ts"
-              - "packages/producer/build*.mjs"
-              - "packages/player/scripts/verify-runtime-pin.mjs"
-              - "packages/{studio,studio-server,core,parsers,player,sdk,lint,cli,engine,producer}/{package.json,tsconfig.json,tsup.config.ts}"
-              - "packages/*/package-subpaths.json"
-              - "scripts/package-subpaths.mjs"
-              - "scripts/rewrite-relative-import-extensions.mjs"
-              - "scripts/ci/base-file.sh"
-              - "scripts/ci/edit-accuracy-shard.sh"
-              - "scripts/ci/install-workspace-dependencies.sh"
-              - ".github/actions/prepare-ffmpeg-bin/**"
-              - "package.json"
-              - "bun.lock"
-              - ".github/workflows/ci.yml"
-              - "!**/*.{test,spec}.{ts,tsx,mjs,js}"
-              - "!**/{__tests__,__fixtures__}/**"
-              - "!**/*.md"
-
-  # A release PR changes versions and notes only (scripts/ci/release-only-diff.mjs), so heavy suites skip it.
-  # Build still packs the manifests and keeps the tarballs; this job checks the release is consistent.
-  release-checks:
-    name: Release checks
-    needs: changes
-    if: ${{ needs.changes.outputs.release_only == 'true' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 4
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          fetch-depth: 0
-      - run: node scripts/ci/release-only-diff.mjs --verify
-
-  gcp-beginframe-contract:
-    name: GCP BeginFrame image contract
-    needs: changes
-    if: needs.changes.outputs.gcp_beginframe == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          lfs: true
-      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
-        with:
-          # Docker Hub rate-limits anonymous pulls from shared runners; pull through Google's mirror.
-          driver-opts: image=mirror.gcr.io/moby/buildkit:buildx-stable-1
-          buildkitd-config-inline: |
-            [registry."docker.io"]
-              mirrors = ["mirror.gcr.io"]
-      - name: Build BeginFrame contract image
-        # A hung bun install (Dockerfile.test, run 35468046055) would
-        # otherwise eat the whole job timeout instead of failing at this step.
-        timeout-minutes: 10
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
-        with:
-          context: .
-          file: packages/gcp-cloud-run/Dockerfile
-          target: beginframe-contract
-          push: false
-          cache-from: type=gha,scope=gcp-beginframe-contract
-          # One writer (main): ~1 GB exports per PR run evict the bun cache, and a cold bun install can stall.
-          cache-to: ${{ github.event_name == 'push' && 'type=gha,mode=max,scope=gcp-beginframe-contract' || '' }}
-
-  build:
-    name: Build
-    needs: changes
-    # A skipped required check passes, so a broken change detection must fail it instead.
-    if: ${{ !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.code == 'true' || needs.changes.outputs.cli_bundle == 'true' || needs.changes.outputs.edit_accuracy == 'true' || needs.changes.outputs.release_only == 'true') }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - name: Require change detection
-        if: needs.changes.result != 'success'
-        run: |
-          echo "::error::Detect changes did not succeed (it also rejects large binaries outside LFS); see its log. This required check cannot pass."
-          exit 1
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          lfs: true
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-      - run: corepack enable
-      - run: corepack prepare pnpm@10.17.1 --activate
-      - uses: ./.github/actions/prepare-ffmpeg-bin
-      - run: bash scripts/ci/install-workspace-dependencies.sh
-      - run: bun run build
-      - run: bun run verify:packed-manifests
-        env:
-          PACK_KEEP_DIR: ${{ startsWith(github.head_ref, 'release/v') && format('{0}/release-tarballs', runner.temp) || '' }}
-      - name: Keep the release tarballs
-        if: startsWith(github.head_ref, 'release/v')
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: release-tarballs
-          path: ${{ runner.temp }}/release-tarballs/*.tgz
-          if-no-files-found: error
-          retention-days: 7
-      - run: bun run check:cli-lazy-deps
-      - name: Share the built CLI with the edit accuracy shards
-        if: needs.changes.outputs.edit_accuracy == 'true'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: edit-accuracy-cli
-          path: packages/cli/dist
-          if-no-files-found: error
-          retention-days: 1
+  cancel-in-progress: true
 
-  lint:
-    name: Lint
-    needs: changes
-    if: needs.changes.outputs.code == 'true' || needs.changes.outputs.docs_catalog == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          lfs: true
-          fetch-depth: 0
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-      - uses: ./.github/actions/prepare-ffmpeg-bin
-      - run: bash scripts/ci/install-workspace-dependencies.sh
-      - run: bun scripts/generate-registry-items.ts
-      - run: bun run lint
+permissions:
+  contents: read
 
-  # Loads every catalog payload a PR changes in headless Chrome. A static scan of the
-  # markup cannot see an asset a script fetches, and the docs host serves only fonts,
-  # images and JSON, so a payload that runs locally can 404 there.
-  catalog-payloads:
-    name: Catalog payloads
-    needs: changes
-    if: needs.changes.outputs.docs_catalog == 'true'
+jobs:
+  check:
+    name: Lint, format and typecheck
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          fetch-depth: 0
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-      - run: bash scripts/ci/install-workspace-dependencies.sh
-      - run: bun run --filter '@hyperframes/{parsers,lint,studio-server}' build
-      - run: bun run --cwd packages/core build
-      - run: bun run --cwd packages/core build:hyperframes-runtime
-      - name: Keep catalog source PRs source-only
-        if: github.event_name == 'pull_request'
-        run: node scripts/check-catalog-source-pr.mjs origin/main
-      - name: Generate and validate catalog
-        env:
-          PUBLISH_PR: ${{ (github.head_ref || github.ref_name) == 'bot/catalog-publish' }}
-        run: |
-          if [ "$PUBLISH_PR" = "true" ]; then
-            bun run check:catalog-drift --committed
-          else
-            bun run check:catalog-drift
-          fi
-      - run: bun run verify:catalog-payloads --changed origin/main
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: catalog-index
-          path: |
-            registry/registry.json
-            registry/catalog-artifact/local-vectors.json
-            registry/catalog-artifact/local-vectors.bin
-
-  # `fallow audit` runs dead-code + complexity + duplication analysis scoped to
-  # the changed files. The default `--gate new-only` means existing legacy
-  # findings don't fail the build — only NEW issues introduced by the PR do.
-  # This stops bleeding while letting incremental cleanup land separately.
-  #
-  # On findings, the job posts (or updates) a sticky comment on the PR so
-  # reviewers see the full list inline instead of digging through CI logs.
-  fallow:
-    name: Fallow audit
-    needs: changes
-    if: needs.changes.outputs.code == 'true' && github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    # Scope write access to this single job — the rest of `ci.yml` keeps the
-    # workflow-level `pull-requests: read` default so build / lint / test
-    # tokens can't post or modify PR comments. Job-level permissions override
-    # the workflow block.
-    permissions:
-      contents: read
-      pull-requests: write
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          # Full history so `--base origin/main` can diff against the merge
-          # base on stacked PRs, not just the shallow tip.
-          fetch-depth: 0
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-      - uses: ./.github/actions/prepare-ffmpeg-bin
-      - run: bash scripts/ci/install-workspace-dependencies.sh
-      - name: Build generated inspector inputs
-        run: |
-          bun run --filter '@hyperframes/{parsers,lint}' build
-          bun run build:hyperframes-runtime
-          bun run --filter @hyperframes/inspector build
-      - name: Run fallow audit
-        id: audit
-        # `bun install` above made `bunx fallow` resolve from node_modules, so
-        # we don't re-download fallow each run. The script disables `errexit`
-        # so the audit's non-zero exit (on findings) doesn't abort before we
-        # write the exit code to the step output. The size check guards
-        # against fallow crashing before producing markdown (e.g. transient
-        # parse failure) — without it we'd post a blank sticky comment.
-        run: |
-          set +e
-          bunx fallow audit --base origin/main --fail-on-issues \
-            --format pr-comment-github \
-            > /tmp/fallow-comment.md
-          echo "exit_code=$?" >> "$GITHUB_OUTPUT"
-          if [ ! -s /tmp/fallow-comment.md ]; then
-            echo "fallow produced no output — see the job logs above." > /tmp/fallow-comment.md
-          fi
-      - name: Post sticky comment (findings)
-        if: steps.audit.outputs.exit_code != '0'
-        # Fork PRs run with a read-only GITHUB_TOKEN regardless of the
-        # workflow's `permissions:` block, so the comment post will fail on
-        # forks. Don't fail the whole job — the audit gate below still fires.
-        continue-on-error: true
-        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
-        with:
-          # `header` matches fallow's built-in `<!-- fallow-id: fallow-results -->`
-          # sentinel so subsequent runs update the same comment.
-          header: fallow-results
-          path: /tmp/fallow-comment.md
-      - name: Remove stale sticky comment (clean run)
-        if: steps.audit.outputs.exit_code == '0'
-        continue-on-error: true
-        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
-        with:
-          header: fallow-results
-          delete: true
-      - name: Fail if audit found issues
-        if: steps.audit.outputs.exit_code != '0'
-        run: |
-          echo "::error::Fallow audit found new issues — see the PR comment above for details."
-          exit 1
-
-  format:
-    name: Format
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          lfs: true
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 22
       - uses: ./.github/actions/prepare-ffmpeg-bin
       - run: bash scripts/ci/install-workspace-dependencies.sh
+      - run: node_modules/.bin/oxlint packages/studio packages/cli
+      - run: node scripts/check-studio-copy-dashes.mjs
       - run: bun run format:check
-
-  typecheck:
-    name: Typecheck
-    needs: changes
-    # A skipped required check passes, so a broken change detection must fail it instead.
-    if: ${{ !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.code == 'true') }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - name: Require change detection
-        if: needs.changes.result != 'success'
-        run: |
-          echo "::error::Detect changes did not succeed (it also rejects large binaries outside LFS); see its log. This required check cannot pass."
-          exit 1
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          lfs: true
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-      - uses: ./.github/actions/prepare-ffmpeg-bin
-      - run: bash scripts/ci/install-workspace-dependencies.sh
       - run: bun run build
-      - run: bun run --filter '*' typecheck
-      - run: bun run typecheck:scripts
+      - run: bun run --filter '@hyperframes/{studio,cli}' typecheck
 
   test-studio:
     name: Test (studio)
-    needs: changes
-    if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          lfs: true
-          fetch-depth: 0
       - uses: ./.github/actions/setup-test-workspace
       - run: bun run --cwd packages/studio test
 
-  test-runtime:
-    name: Test (runtime)
-    needs: changes
-    if: needs.changes.outputs.code == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          lfs: true
-      - uses: ./.github/actions/setup-test-workspace
-      - run: bun run --filter '@hyperframes/{core,engine}' test
-
   test-cli:
     name: Test (cli)
-    needs: changes
-    if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          lfs: true
       - uses: ./.github/actions/setup-test-workspace
       - run: bun run --filter '@hyperframes/cli' test
 
-  test-support:
-    name: Test (support)
-    needs: changes
-    if: needs.changes.outputs.code == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          lfs: true
-          fetch-depth: 0
-      - id: workspace
-        uses: ./.github/actions/setup-test-workspace
-        with:
-          chrome: "true"
-      - run: bun run generate:catalog
-        if: needs.changes.outputs.docs_catalog == 'true'
-      - run: bun run test:scripts
-        env:
-          HYPERFRAMES_BROWSER_PATH: ${{ steps.workspace.outputs.chrome-path }}
-      - run: bun run --filter '@hyperframes/{lint,parsers,studio-server,sdk,player,aws-lambda,gcp-cloud-run,sdk-playground,shader-transitions,inspector}' test
-
-  flake-gate:
-    name: Flake gate
-    if: github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          lfs: true
-          fetch-depth: 0
-      # HEAD is the PR merge ref; its first parent is the current base tip (see `changes`).
-      - name: Find changed test files
-        id: plan
-        run: |
-          echo "base=$(git rev-parse HEAD^1)" >> "$GITHUB_OUTPUT"
-          node scripts/ci/flake-gate.mjs --list --base "$(git rev-parse HEAD^1)"
-      - id: workspace
-        if: steps.plan.outputs.any == 'true'
-        uses: ./.github/actions/setup-test-workspace
-        with:
-          chrome: "true"
-          engine: "true"
-      - if: steps.plan.outputs.any == 'true'
-        env:
-          HYPERFRAMES_BROWSER_PATH: ${{ steps.workspace.outputs.chrome-path }}
-        run: node scripts/ci/flake-gate.mjs --base "${{ steps.plan.outputs.base }}"
-
-  test:
-    name: Test
-    needs:
-      [
-        changes,
-        producer-source-tests,
-        test-studio,
-        test-runtime,
-        test-cli,
-        test-support,
-        test-skills,
-      ]
-    # Keep the existing required `Test` context authoritative for producer
-    # failures too. It also fails closed if any package shard fails or is cancelled.
-    if: always() && (needs.changes.result != 'success' || needs.changes.outputs.code == 'true' || needs.changes.outputs.skills == 'true')
-    runs-on: ubuntu-latest
-    timeout-minutes: 3
-    steps:
-      - name: Require change detection
-        if: needs.changes.result != 'success'
-        run: |
-          echo "::error::Detect changes did not succeed (it also rejects large binaries outside LFS); see its log. This required check cannot pass."
-          exit 1
-      - name: Require producer source tests
-        if: needs.changes.outputs.code == 'true' && needs.producer-source-tests.result != 'success'
-        run: |
-          echo "::error::Producer unit/integration tests did not succeed."
-          exit 1
-      - name: Require package test shards
-        if: needs.changes.outputs.code == 'true' && (needs.test-studio.result != 'success' || needs.test-runtime.result != 'success' || needs.test-cli.result != 'success' || needs.test-support.result != 'success')
-        run: |
-          echo "::error::A package test shard did not succeed."
-          echo "studio=${{ needs.test-studio.result }} runtime=${{ needs.test-runtime.result }} cli=${{ needs.test-cli.result }} support=${{ needs.test-support.result }}"
-          exit 1
-      - name: Require skills tests
-        if: needs.changes.outputs.skills == 'true' && needs.test-skills.result != 'success'
-        run: |
-          echo "::error::Skills tests did not succeed."
-          exit 1
-
-  producer-source-tests:
-    name: "Producer: ${{ matrix.lane }} tests"
-    needs: changes
-    if: needs.changes.outputs.code == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    strategy:
-      fail-fast: false
-      matrix:
-        lane: [unit, integration]
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          lfs: true
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-      - name: Install FFmpeg for integration tests
-        if: matrix.lane == 'integration'
-        uses: ./.github/actions/install-ffmpeg-linux
-      - uses: ./.github/actions/prepare-ffmpeg-bin
-      - run: bash scripts/ci/install-workspace-dependencies.sh
-      - run: bun run --filter '@hyperframes/{parsers,lint,studio-server}' build
-      - run: bun run --cwd packages/core build
-      - run: bun run --filter @hyperframes/engine build
-      - run: bun run producer:test:${{ matrix.lane }}
-
-  # Tests under skills/**/*.test.mjs are bare `node --test` files with only
-  # `node:` built-in imports. They aren't part of any workspace package, and
-  # the main `Test` job's `code` path filter excludes `skills/**`, so without
-  # this dedicated job they'd never run in CI. Examples:
-  #   * packages/cli/src/media-use/resolve.test.mjs
-  #   * packages/cli/src/media-use/lib/manifest.test.mjs
-  # Several of these are regression guards (e.g. shell-injection cases), so
-  # the whole point is that they fire on PRs that touch skills/.
-  test-skills:
-    name: "Test: skills"
-    needs: changes
-    if: needs.changes.outputs.skills == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-      - uses: ./.github/actions/install-ffmpeg-linux
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-      - name: Verify standalone skill imports
-        run: bun test scripts/check-skill-import-boundaries.test.mjs
-      - name: Discover and run skills tests
-        env:
-          HYPERFRAMES_MEDIA_HOME_REQUIRED: "1"
-        # We expand the test list via bash so the job fails loudly when the
-        # matcher comes back empty, rather than silently no-op'ing (which
-        # would defeat the whole point of this job).
-        run: |
-          set -euo pipefail
-          mapfile -t SKILLS_TESTS < <(find skills packages/cli/src/media-use -type f -name "*.test.mjs" | sort)
-          if [ "${#SKILLS_TESTS[@]}" -eq 0 ]; then
-            echo "::error::No skills/**/*.test.mjs files found. Did the layout change?"
-            exit 1
-          fi
-          SKILLS_TESTS+=(scripts/check-media-use-copy-parity.test.mjs scripts/creator-editing-capabilities.test.mjs)
-          printf 'Running %d skills test file(s):\n' "${#SKILLS_TESTS[@]}"
-          printf '  * %s\n' "${SKILLS_TESTS[@]}"
-          node --import ./packages/cli/scripts/test-home.mjs --test "${SKILLS_TESTS[@]}"
-
-  test-skill-bootstrap-windows:
-    name: "Test: skill bootstrap (Windows, Node 24)"
-    needs: changes
-    if: needs.changes.outputs.skills == 'true'
-    runs-on: windows-latest
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 24
-      - name: Exercise npm-cli bootstrap command
-        run: >-
-          node --test
-          skills/hyperframes/scripts/plugin-cli.test.mjs
-
-  # Guards that skills-manifest.json (the published freshness fingerprint read
-  # by `hyperframes skills check`) was regenerated when a skill changed. Runs
-  # `gen:skills-manifest --check`, which compares per-skill content hashes; the
-  # manifest carries no version/timestamp, so it only fails on real content
-  # drift. bun runs the TS script directly, no install needed.
-  catalog-index-coverage:
-    name: "Catalog: search index covers the registry"
-    needs: [changes, catalog-payloads]
-    if: needs.changes.outputs.catalog_index == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 3
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
-        with:
-          name: catalog-index
-          path: registry
-      - name: Verify every searchable registry item has a vector
-        run: bun scripts/catalog/check-artifact-coverage.ts
-
-  skills-manifest:
-    name: "Skills: manifest in sync"
-    needs: changes
-    if: needs.changes.outputs.skills == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 3
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-      - name: Verify skills-manifest.json matches skills/
-        run: bun packages/cli/scripts/gen-skills-manifest.ts --check
-
-  # Repo-native project skills live under .claude/skills/ (Claude Code) and
-  # .agents/skills/ (Codex CLI). Runs the skill validator against all three
-  # locations (skills/, .claude/skills/, .agents/skills/) and verifies the two
-  # project-skill trees stay byte-identical mirrors of each other. Fires on
-  # any change to the skill dirs or the two validating scripts.
-  project-skills-check:
-    name: "Skills: project-native lint + mirror"
-    needs: changes
-    if: needs.changes.outputs.skills == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 3
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-      - name: Lint SKILL.md files across skills/, .claude/skills/, .agents/skills/
-        run: bun scripts/lint-skills.ts
-      - name: Verify .claude/skills/ and .agents/skills/ are byte-identical
-        run: node scripts/check-skill-mirror.mjs
-
-  codex-plugin-package:
-    name: "Codex plugin package"
-    needs: changes
-    if: needs.changes.outputs.codex_plugin == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 3
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-      - name: Test portable plugin packaging
-        run: node --test scripts/package-agent-plugin.test.mjs
-      - name: Build portable agent plugin
-        run: node scripts/package-agent-plugin.mjs
-      - name: Build upload-ready Codex plugin
-        run: node scripts/package-codex-plugin.mjs
-
-  cli-npx-shim:
-    name: "CLI: npx shim (${{ matrix.os }})"
-    needs: changes
-    if: needs.changes.outputs.cli == 'true'
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 10
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-      - name: Install dependencies
-        if: runner.os != 'Windows'
-        run: bash scripts/ci/install-workspace-dependencies.sh --ignore-scripts
-      - name: Install dependencies
-        if: runner.os == 'Windows'
-        run: bun install --frozen-lockfile --ignore-scripts --linker=hoisted
-      - run: bun run --filter '@hyperframes/{parsers,lint,studio-server}' build
-      - run: bun run --cwd packages/core build
-      - run: bun run --cwd packages/cli test src/utils/npxCommand.test.ts src/commands/skills.test.ts
-
-  sdk-tests:
-    name: "SDK: unit + contract + smoke"
-    needs: changes
-    if: needs.changes.outputs.code == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-      - run: bash scripts/ci/install-workspace-dependencies.sh
-      # Build workspace deps so the sdk's @hyperframes/parsers + core subpath
-      # imports resolve via the "node" export condition (dist) under vitest.
-      - run: bun run --filter '@hyperframes/parsers' build
-      - run: bun run --cwd packages/core build
-      - run: bun run --filter @hyperframes/sdk test
-
-  test-runtime-contract:
-    name: "Test: runtime contract"
-    needs: changes
-    # A skipped required check passes, so a broken change detection must fail it instead.
-    if: ${{ !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.code == 'true') }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - name: Require change detection
-        if: needs.changes.result != 'success'
-        run: |
-          echo "::error::Detect changes did not succeed (it also rejects large binaries outside LFS); see its log. This required check cannot pass."
-          exit 1
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          lfs: true
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-      - uses: ./.github/actions/prepare-ffmpeg-bin
-      - run: bash scripts/ci/install-workspace-dependencies.sh
-      # Runtime coverage now imports core modules that consume workspace
-      # subpaths. Build their dist exports before Vitest resolves them.
-      - run: bun run --filter '@hyperframes/{parsers,lint,studio-server}' build
-      - run: bun run --filter @hyperframes/core test:hyperframe-runtime-ci
-
-  studio-load-smoke:
+  studio-smoke:
     name: "Studio: load smoke"
-    needs: [changes]
-    if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          lfs: true
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 22
       - uses: ./.github/actions/prepare-ffmpeg-bin
       - run: bash scripts/ci/install-workspace-dependencies.sh
-      # Build workspace deps so the studio vite.config.ts (loaded by Node) can
-      # resolve @hyperframes/core and @hyperframes/studio-server via the "node"
-      # export condition (dist).
+      # vite.config.ts is loaded by Node and resolves these workspace packages through their built "node" export.
       - run: bun run --filter '@hyperframes/{parsers,lint,studio-server}' build
       - run: bun run --cwd packages/core build
       - run: bun run --cwd packages/core build:hyperframes-runtime
-      - name: Start studio and check for runtime errors
+      - name: Start Studio and check for runtime errors
         run: |
-          # Start the studio Vite dev server (fast — no bundle step)
           bun run --filter '@hyperframes/studio' dev -- --port 5199 &
           SERVER_PID=$!
-
-          # Wait for the server to be ready (up to 20s)
           for i in $(seq 1 40); do
             if curl -sf http://localhost:5199/ >/dev/null 2>&1; then break; fi
             sleep 0.5
           done
-
-          if ! curl -sf http://localhost:5199/ >/dev/null 2>&1; then
-            echo "FAIL: studio dev server did not start"
-            kill $SERVER_PID 2>/dev/null || true
-            exit 1
-          fi
-
-          # Load the studio in headless Chrome with API mocking to trigger
-          # the full splash→main transition (catches hooks-after-early-return bugs)
           node scripts/studio-runtime-smoke.mjs http://localhost:5199/#project=smoke-test
-
           kill $SERVER_PID 2>/dev/null || true
-
-  studio-timeline-viewport:
-    name: "Studio: timeline viewport gate"
-    needs: [changes]
-    if: needs.changes.outputs.studio == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 18
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-      - run: bash scripts/ci/install-workspace-dependencies.sh
-      # Same reason as studio-load-smoke: vite.config.ts is loaded by Node and
-      # resolves the workspace packages through their "node" export condition.
-      - run: bun run --filter '@hyperframes/{parsers,lint,studio-server}' build
-      - run: bun run --cwd packages/core build
-      - run: bun run --cwd packages/core build:hyperframes-runtime
-      - name: Install the fixture as a Studio project
-        # Studio resolves projects from packages/studio/data/projects, which is
-        # gitignored. The fixture composition is tracked under tests/e2e, so
-        # copy it into place rather than committing a project directory.
-        run: |
-          mkdir -p packages/studio/data/projects
-          cp -R packages/studio/tests/e2e/fixtures/timeline-virtualization \
-            packages/studio/data/projects/timeline-virtualization
-          cp -R packages/studio/tests/e2e/fixtures/studio-open \
-            packages/studio/data/projects/studio-open
-          cp -R packages/studio/tests/e2e/fixtures/fade-handles \
-            packages/studio/data/projects/fade-handles
-          cp -R packages/studio/tests/e2e/fixtures/timeline-trim-snap \
-            packages/studio/data/projects/timeline-trim-snap
-          cp -R packages/studio/tests/e2e/fixtures/inline-text-caret \
-            packages/studio/data/projects/inline-text-caret
-          cp -R packages/studio/tests/e2e/fixtures/undo-socket-pool \
-            packages/studio/data/projects/undo-socket-pool
-          cp -R packages/studio/tests/e2e/fixtures/aroll-backdrop \
-            packages/studio/data/projects/aroll-backdrop
-      - name: Build the base the viewport gate compares against
-        # The first parent of the checked-out commit, as in base-file.sh. Measured only when the head misses a budget.
-        run: |
-          set -euo pipefail
-          base="$(git cat-file -p HEAD | awk '/^parent /{print $2; exit}')"
-          git fetch --no-tags --depth=1 origin "$base"
-          GIT_LFS_SKIP_SMUDGE=1 git worktree add --detach /tmp/studio-base "$base"
-          cd /tmp/studio-base
-          bash scripts/ci/install-workspace-dependencies.sh
-          bun run --filter '@hyperframes/{parsers,lint,studio-server}' build
-          bun run --cwd packages/core build
-          bun run --cwd packages/core build:hyperframes-runtime
-          # The same projects as the head's server, so neither side serves more than the other.
-          cp -R "$GITHUB_WORKSPACE/packages/studio/data" packages/studio/data
-      - name: Read the base branch's work-count ceilings
-        # A ceiling may not disappear, or rise without a new reason, against the branch this PR merges into.
-        if: github.event_name == 'pull_request'
-        run: bash scripts/ci/base-file.sh packages/studio/tests/e2e/perf-ceilings.json /tmp/base-perf-ceilings.json
-      - name: Run both arms of the timeline viewport gate
-        run: |
-          set -euo pipefail
-
-          SERVER_PIDS=()
-          stop_servers() {
-            for pid in "${SERVER_PIDS[@]}"; do
-              kill "$pid" 2>/dev/null || true
-              wait "$pid" 2>/dev/null || true
-            done
-            SERVER_PIDS=()
-          }
-          wait_for_server() {
-            local port="$1"
-            for i in $(seq 1 60); do
-              if curl -sf "http://localhost:${port}/" >/dev/null 2>&1; then return 0; fi
-              sleep 1
-            done
-            echo "FAIL: studio dev server did not start on port ${port}"
-            return 1
-          }
-          trap stop_servers EXIT
-
-          # One arm at a time, so no other arm's Vite module graph competes with the measured browser.
-          # The base page loads only if the head misses a budget; production React matches shipped
-          # rendering, and the gate asserts that runtime before timing.
-          run_arm() {
-            local arm="$1" port="$2" virtualization="$3" count="$4" enabled="$5"
-            NODE_ENV=production VITE_STUDIO_TIMELINE_ROW_VIRTUALIZATION_ENABLED="$enabled" \
-              bun run --cwd /tmp/studio-base/packages/studio dev -- --port "$((port + 10))" --strictPort &
-            SERVER_PIDS+=($!)
-            NODE_ENV=production VITE_STUDIO_TIMELINE_ROW_VIRTUALIZATION_ENABLED="$enabled" \
-              bun run --cwd packages/studio dev -- --port "$port" --strictPort &
-            SERVER_PIDS+=($!)
-            local status=0
-            if wait_for_server "$((port + 10))" && wait_for_server "$port"; then
-              STUDIO_URL="http://localhost:${port}/#project/timeline-virtualization" \
-                BASE_STUDIO_URL="http://localhost:$((port + 10))/#project/timeline-virtualization" \
-                TIMELINE_ROW_VIRTUALIZATION="$virtualization" \
-                TIMELINE_ELEMENT_COUNT="$count" \
-                TIMELINE_TIER=ci \
-                node packages/studio/tests/e2e/timeline-virtualization.mjs \
-                | tee "/tmp/timeline-gate-${arm}.json" \
-                || status=$?
-            else
-              status=1
-            fi
-            stop_servers
-            return "$status"
-          }
-          DEFAULT_STATUS=0
-          run_arm default 5313 on 50000 1 || DEFAULT_STATUS=$?
-          DISABLED_STATUS=0
-          run_arm disabled 5314 off 1000 0 || DISABLED_STATUS=$?
-
-          {
-            echo "### Timeline viewport gate"
-            echo "- Default arm exit: ${DEFAULT_STATUS}"
-            echo "- Explicitly disabled arm exit: ${DISABLED_STATUS}"
-            for arm in default disabled; do
-              node -e '
-                const e = JSON.parse(require("fs").readFileSync(process.argv[1], "utf8"));
-                const b = e.environment.appliedBudgets;
-                for (const a of e.attempts)
-                  console.log(`- ${process.argv[2]} attempt ${a.attempt}: interaction p95 ${a.interactionP95Ms.toFixed(1)}/${b.interactionP95Ms} ms, frame p95 ${a.frameIntervalP95Ms.toFixed(1)}/${b.frameIntervalP95Ms} ms, ${a.passingRuns}/${a.runs.length} runs, ${a.passed ? "pass" : "fail"}`);
-                const c = e.againstBase;
-                if (c)
-                  console.log(`- ${process.argv[2]} against base on this runner: ${c.summary}`);
-              ' "/tmp/timeline-gate-${arm}.json" "$arm" || echo "- ${arm}: no evidence"
-            done
-          } >> "$GITHUB_STEP_SUMMARY"
-
-          if (( DEFAULT_STATUS != 0 || DISABLED_STATUS != 0 )); then
-            echo "FAIL: default=${DEFAULT_STATUS}, disabled=${DISABLED_STATUS}"
-            exit 1
-          fi
-      - name: Count the work of opening a film in Studio
-        # Counts, not ms: thumbnail renders, page loads and requests do not move
-        # with runner load, so perf-ceilings.json can hold them exactly.
-        if: success() || failure()
-        run: |
-          set -euo pipefail
-          NODE_ENV=production bun run --cwd packages/studio dev -- --port 5315 --strictPort &
-          SERVER_PID=$!
-          trap 'kill "$SERVER_PID" 2>/dev/null || true' EXIT
-          for i in $(seq 1 60); do
-            if curl -sf "http://localhost:5315/" >/dev/null 2>&1; then break; fi
-            sleep 1
-          done
-          if ! curl -sf "http://localhost:5315/" >/dev/null 2>&1; then
-            echo "FAIL: studio dev server did not start on port 5315"
-            exit 1
-          fi
-          STUDIO_URL="http://localhost:5315/#project/studio-open" \
-            STUDIO_PROJECT_DIR="$PWD/packages/studio/data/projects/studio-open" \
-            node packages/studio/tests/e2e/studio-open-counts.mjs \
-            | tee /tmp/studio-open-counts.json
-          node packages/studio/tests/e2e/perf-ratchet.mjs check \
-            packages/studio/tests/e2e/perf-ceilings.json studio-open /tmp/studio-open-counts.json \
-            /tmp/base-perf-ceilings.json
-      - name: Check fade handles, render selects, thumbnail connection release, trim snapping and a script-hidden backdrop
-        if: success() || failure()
-        run: |
-          set -euo pipefail
-          NODE_ENV=production bun run --cwd packages/studio dev -- --port 5316 --strictPort &
-          SERVER_PID=$!
-          trap 'kill "$SERVER_PID" 2>/dev/null || true' EXIT
-          for i in $(seq 1 60); do
-            if curl -sf "http://localhost:5316/" >/dev/null 2>&1; then break; fi
-            sleep 1
-          done
-          if ! curl -sf "http://localhost:5316/" >/dev/null 2>&1; then
-            echo "FAIL: studio dev server did not start on port 5316"
-            exit 1
-          fi
-          # All checks run even when an earlier one fails.
-          rc=0
-          STUDIO_URL="http://localhost:5316/#project/fade-handles" \
-            node packages/studio/tests/e2e/fade-handles.mjs || rc=1
-          STUDIO_URL="http://localhost:5316/#project/fade-handles?tab=renders" \
-            node packages/studio/tests/e2e/render-selects.mjs || rc=1
-          STUDIO_URL="http://localhost:5316/" \
-            node packages/studio/tests/e2e/thumbnail-save.mjs || rc=1
-          STUDIO_URL="http://localhost:5316/#project/timeline-trim-snap" \
-            node packages/studio/tests/e2e/timeline-trim-snap.mjs || rc=1
-          rm -rf packages/studio/data/projects/timeline-trim-snap
-          cp -R packages/studio/tests/e2e/fixtures/timeline-trim-snap \
-            packages/studio/data/projects/timeline-trim-snap
-          STUDIO_URL="http://localhost:5316/#project/timeline-trim-snap" \
-            node packages/studio/tests/e2e/timeline-snap-release.mjs || rc=1
-          STUDIO_URL="http://localhost:5316/#project/aroll-backdrop" \
-            node packages/studio/tests/e2e/aroll-backdrop.mjs || rc=1
-          exit "$rc"
-      - name: Measure the caret of a text edited in place
-        if: success() || failure()
-        run: |
-          set -euo pipefail
-          NODE_ENV=production bun run --cwd packages/studio dev -- --port 5317 --strictPort &
-          SERVER_PID=$!
-          trap 'kill "$SERVER_PID" 2>/dev/null || true' EXIT
-          for i in $(seq 1 60); do
-            if curl -sf "http://localhost:5317/" >/dev/null 2>&1; then break; fi
-            sleep 1
-          done
-          if ! curl -sf "http://localhost:5317/" >/dev/null 2>&1; then
-            echo "FAIL: studio dev server did not start on port 5317"
-            exit 1
-          fi
-          STUDIO_URL="http://localhost:5317/#project/inline-text-caret" \
-            EVIDENCE_DIR=/tmp/inline-text-caret \
-            node packages/studio/tests/e2e/inline-text-caret.mjs
-      - name: Install ffmpeg for the paused-video fixture
-        if: success() || failure()
-        uses: ./.github/actions/install-ffmpeg-linux
-      - name: Undo while paused videos hold the preview's sockets
-        # Counts the undo's wait for a socket, not its total time: unpinned it is 0 ms.
-        if: success() || failure()
-        run: |
-          set -euo pipefail
-          NODE_ENV=production bun run --cwd packages/studio dev -- --port 5318 --strictPort &
-          SERVER_PID=$!
-          trap 'kill "$SERVER_PID" 2>/dev/null || true' EXIT
-          for i in $(seq 1 60); do
-            if curl -sf "http://localhost:5318/" >/dev/null 2>&1; then break; fi
-            sleep 1
-          done
-          if ! curl -sf "http://localhost:5318/" >/dev/null 2>&1; then
-            echo "FAIL: studio dev server did not start on port 5318"
-            exit 1
-          fi
-          STUDIO_URL="http://localhost:5318/#project/undo-socket-pool" \
-            STUDIO_PROJECT_DIR="$PWD/packages/studio/data/projects/undo-socket-pool" \
-            node packages/studio/tests/e2e/undo-socket-pool.mjs | tee /tmp/undo-socket-pool.json
-      - name: Upload gate evidence
-        # The gate's whole output is machine-readable evidence, and a red run is
-        # exactly when someone needs to read it. Keep it on failure too.
-        if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: timeline-viewport-gate-evidence
-          path: |
-            /tmp/timeline-gate-*.json
-            /tmp/studio-open-counts.json
-            /tmp/inline-text-caret/*.png
-            /tmp/undo-socket-pool.json
-          if-no-files-found: error
-
-  # Manual editing accuracy in the built Studio, gated against the base branch's baseline.json. A pull request
-  # runs the `pr` slice in 5 shards; the merge queue runs the full grid in 20, so nothing reaches main unmeasured.
-  # The gate job below repeats both shard counts.
-  studio-edit-accuracy:
-    name: "Studio: edit accuracy (${{ matrix.shard }}/${{ strategy.job-total }})"
-    needs: [changes, build]
-    if: needs.changes.outputs.edit_accuracy == 'true'
-    runs-on: ubuntu-latest
-    # Healthy shards take 6-9 min; 25 leaves a cancelled shard's fresh re-run inside the queue's 60 min check wait.
-    timeout-minutes: 25
-    strategy:
-      fail-fast: false
-      matrix:
-        shard: ${{ fromJSON(github.event_name == 'merge_group' && '[1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20]' || '[1, 2, 3, 4, 5]') }}
-    env:
-      EDIT_ACCURACY_GRID: ${{ github.event_name == 'merge_group' && 'full' || 'pr' }}
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-      - uses: ./.github/actions/prepare-ffmpeg-bin
-      - run: bash scripts/ci/install-workspace-dependencies.sh
-      # The bench imports producer and engine source, which need core's generated runtime files.
-      - run: bun run --cwd packages/core build
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
-        with:
-          name: edit-accuracy-cli
-          path: packages/cli/dist
-      # Studio and the producer both run in the engine's pinned headless shell.
-      - run: node packages/cli/dist/cli.js browser ensure
-      - name: Read the base branch's edit accuracy baseline
-        run: |
-          bash scripts/ci/base-file.sh packages/studio/tests/e2e/edit-accuracy/baseline.json /tmp/base-edit-accuracy.json
-          [ -f /tmp/base-edit-accuracy.json ] || echo '{"cases":{}}' > /tmp/base-edit-accuracy.json
-      - name: Run this shard, then re-run twice each case whose verdict differs from the base branch
-        run: bash scripts/ci/edit-accuracy-shard.sh "${{ matrix.shard }}/${{ strategy.job-total }}"
-      # A slow runner stops the bench (slow-runner.json) or runs into the timeout; either gets one fresh re-run.
-      - name: Mark a slow or cancelled shard for a re-run
-        if: always()
-        run: |
-          mkdir -p /tmp/edit-accuracy
-          if [ "${{ job.status }}" = cancelled ] || [ -n "$(find /tmp/edit-accuracy -name slow-runner.json)" ]; then
-            touch /tmp/edit-accuracy/retry
-          fi
-      - name: Upload shard evidence
-        if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: edit-accuracy-shard-${{ matrix.shard }}
-          path: /tmp/edit-accuracy
-          if-no-files-found: error
-
-  studio-edit-accuracy-retry-plan:
-    name: "Studio: edit accuracy retry plan"
-    needs: [changes, studio-edit-accuracy]
-    if: ${{ !cancelled() && needs.changes.outputs.edit_accuracy == 'true' && needs.studio-edit-accuracy.result != 'success' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    outputs:
-      shards: ${{ steps.plan.outputs.shards }}
-    steps:
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
-        with:
-          pattern: edit-accuracy-shard-*
-          path: /tmp/edit-accuracy-shards
-      - name: List the shards marked for a re-run
-        id: plan
-        run: |
-          shards=$(find /tmp/edit-accuracy-shards -path '*/edit-accuracy-shard-*/retry' |
-            sed -E 's#.*/edit-accuracy-shard-([0-9]+)/retry$#\1#' | sort -n | paste -sd, -)
-          echo "shards=[${shards}]" >> "$GITHUB_OUTPUT"
-
-  # Each marked shard runs once more on a fresh runner and replaces its evidence before the gate reads it.
-  studio-edit-accuracy-retry:
-    name: "Studio: edit accuracy retry (${{ matrix.shard }})"
-    needs: [changes, build, studio-edit-accuracy-retry-plan]
-    if: ${{ !cancelled() && needs.studio-edit-accuracy-retry-plan.outputs.shards != '[]' && needs.studio-edit-accuracy-retry-plan.outputs.shards != '' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 25
-    strategy:
-      fail-fast: false
-      matrix:
-        shard: ${{ fromJSON(needs.studio-edit-accuracy-retry-plan.outputs.shards) }}
-    env:
-      EDIT_ACCURACY_GRID: ${{ github.event_name == 'merge_group' && 'full' || 'pr' }}
-      SHARDS: ${{ github.event_name == 'merge_group' && 20 || 5 }}
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-      - uses: ./.github/actions/prepare-ffmpeg-bin
-      - run: bash scripts/ci/install-workspace-dependencies.sh
-      - run: bun run --cwd packages/core build
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
-        with:
-          name: edit-accuracy-cli
-          path: packages/cli/dist
-      - run: node packages/cli/dist/cli.js browser ensure
-      - name: Read the base branch's edit accuracy baseline
-        run: |
-          bash scripts/ci/base-file.sh packages/studio/tests/e2e/edit-accuracy/baseline.json /tmp/base-edit-accuracy.json
-          [ -f /tmp/base-edit-accuracy.json ] || echo '{"cases":{}}' > /tmp/base-edit-accuracy.json
-      - name: Run the shard again
-        run: bash scripts/ci/edit-accuracy-shard.sh "${{ matrix.shard }}/${SHARDS}"
-      - name: Replace the shard's evidence
-        if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: edit-accuracy-shard-${{ matrix.shard }}
-          path: /tmp/edit-accuracy
-          if-no-files-found: error
-          overwrite: true
-
-  studio-edit-accuracy-gate:
-    name: "Studio: edit accuracy gate"
-    needs: [changes, studio-edit-accuracy, studio-edit-accuracy-retry]
-    if: ${{ !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.edit_accuracy == 'true') }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: read
-      pull-requests: write
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-      - name: Read the base branch's edit accuracy baseline
-        run: |
-          bash scripts/ci/base-file.sh packages/studio/tests/e2e/edit-accuracy/baseline.json /tmp/base-edit-accuracy.json
-          [ -f /tmp/base-edit-accuracy.json ] || echo '{"cases":{}}' > /tmp/base-edit-accuracy.json
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
-        with:
-          pattern: edit-accuracy-shard-*
-          path: /tmp/edit-accuracy-shards
-      - name: Compare every run with the base branch
-        id: gate
-        # Smoothness and newly passing cases are reported, not gated; a case fails only if it fails 2 of its 3 runs.
-        env:
-          SHARDS: ${{ github.event_name == 'merge_group' && 20 || 5 }}
-        run: |
-          set +e
-          mapfile -t RESULTS < <(find /tmp/edit-accuracy-shards -name results.json | sort)
-          node packages/studio/tests/e2e/edit-accuracy/ratchet.mjs gate --shards "$SHARDS" /tmp/base-edit-accuracy.json \
-            packages/studio/tests/e2e/edit-accuracy/baseline.json /tmp/edit-accuracy-gate "${RESULTS[@]}"
-          echo "exit_code=$?" >> "$GITHUB_OUTPUT"
-          cat /tmp/edit-accuracy-gate/comment.md >> "$GITHUB_STEP_SUMMARY" || true
-      - name: Post sticky comment
-        # Fork PRs get a read-only token; the gate below still fires. The merge queue has no PR to comment on.
-        if: github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
-        with:
-          header: edit-accuracy
-          path: /tmp/edit-accuracy-gate/comment.md
-      - name: Upload the gate report and a baseline.json to bank
-        if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: edit-accuracy-gate
-          path: /tmp/edit-accuracy-gate
-      - name: Fail if the gate failed
-        if: steps.gate.outputs.exit_code != '0'
-        run: |
-          verdict=$(jq -r '.verdict // empty' /tmp/edit-accuracy-gate/gate.json 2>/dev/null)
-          echo "::error::${verdict:-The edit accuracy gate could not finish; see its log.}"
-          exit 1
-
-  smoke-global-install:
-    name: "Smoke: global install"
-    needs: [changes, build]
-    if: needs.changes.outputs.code == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          lfs: true
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-      - uses: ./.github/actions/prepare-ffmpeg-bin
-      - run: bash scripts/ci/install-workspace-dependencies.sh
-      - run: bun run build
-
-      # Pack the CLI as a tarball (simulates what `npm publish` produces)
-      - name: Pack CLI tarball
-        run: cd packages/cli && npm pack
-
-      # Install globally using --prefix to avoid sudo
-      - name: Install globally via npm
-        run: npm install -g --prefix /tmp/hf-smoke ./packages/cli/hyperframes-cli-*.tgz
-
-      # Scaffold a blank project
-      - name: Init blank project
-        run: |
-          export PATH="/tmp/hf-smoke/bin:$PATH"
-          mkdir /tmp/hf-project && cd /tmp/hf-project
-          hyperframes init test-project --example blank
-
-      # Start preview, probe the runtime endpoint, assert no esbuild errors
-      - name: Smoke-test preview server
-        run: |
-          export PATH="/tmp/hf-smoke/bin:$PATH"
-          cd /tmp/hf-project/test-project
-
-          # Start the preview server in the background; capture stderr
-          CI=true hyperframes preview --port 3099 2>/tmp/hf-stderr.log &
-          SERVER_PID=$!
-
-          # Wait for the server to be ready (up to 15 s)
-          for i in $(seq 1 30); do
-            if curl -sf http://localhost:3099/ >/dev/null 2>&1; then
-              break
-            fi
-            sleep 0.5
-          done
-
-          # Probe the runtime JS endpoint
-          BODY=$(curl -sf http://localhost:3099/api/runtime.js | head -c 200 || true)
-          if [ -z "$BODY" ]; then
-            echo "FAIL: /api/runtime.js returned empty response"
-            kill $SERVER_PID 2>/dev/null || true
-            cat /tmp/hf-stderr.log
-            exit 1
-          fi
-
-          kill $SERVER_PID 2>/dev/null || true
-          wait $SERVER_PID 2>/dev/null || true
-
-          # Assert stderr does not contain esbuild / runtime load errors
-          if grep -qE '✘ \[ERROR\]|Failed to load runtime' /tmp/hf-stderr.log; then
-            echo "FAIL: preview emitted runtime errors:"
-            cat /tmp/hf-stderr.log
-            exit 1
-          fi
-
-          echo "PASS: global install smoke test succeeded"
-
-  cli-smoke-required:
-    name: "CLI smoke (required)"
-    needs: changes
-    if: needs.changes.outputs.code == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 25
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          lfs: true
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-      - name: Install FFmpeg
-        uses: ./.github/actions/install-ffmpeg-linux
-      - uses: ./.github/actions/prepare-ffmpeg-bin
-      - name: Install dependencies
-        run: bash scripts/ci/install-workspace-dependencies.sh
-      - name: Build monorepo
-        run: bun run build
-
-      - name: Create smoke input video
-        run: |
-          set -euo pipefail
-          ffmpeg -hide_banner -loglevel error \
-            -f lavfi -i testsrc2=size=640x360:rate=30 \
-            -f lavfi -i sine=frequency=880:sample_rate=48000 \
-            -t 3 \
-            -c:v libx264 \
-            -pix_fmt yuv420p \
-            -c:a aac \
-            -shortest \
-            -y /tmp/hf-cli-input.mp4
-          test -s /tmp/hf-cli-input.mp4
-
-      - name: Smoke-test CLI from monorepo source
-        # Skip skill installation and GitHub checks to keep the smoke test offline.
-        env:
-          HYPERFRAMES_SKIP_SKILLS: "1"
-        run: |
-          set -euo pipefail
-          rm -rf /tmp/hf-cli-inside
-
-          bun run --filter @hyperframes/cli dev -- init /tmp/hf-cli-inside \
-            --example warm-grain \
-            --video /tmp/hf-cli-input.mp4 \
-            --skip-transcribe \
-            --non-interactive \
-            --skip-skills
-
-          # No smoke page waits on a CDN for GSAP.
-          node scripts/ci/inline-gsap.mjs /tmp/hf-cli-inside
-
-          bun run --filter @hyperframes/cli dev -- lint /tmp/hf-cli-inside
-          bun run --filter @hyperframes/cli dev -- validate /tmp/hf-cli-inside --timeout 3000
-          bun run --filter @hyperframes/cli dev -- render /tmp/hf-cli-inside \
-            --quality standard \
-            --workers auto \
-            --strict \
-            --output /tmp/hf-cli-inside/renders/inside.mp4 2>&1 | tee /tmp/hf-cli-render.log
-
-          test -s /tmp/hf-cli-inside/renders/inside.mp4
-
-      # Belongs in this job because it needs the BUILT CLI: `shouldTrack()`
-      # short-circuits whenever `isDevMode()` is true, which it is for any `.ts`
-      # entry, so under vitest a real event and no event look identical. Sends
-      # nothing to PostHog — the script wraps fetch and captures the batch.
-      - name: Smoke-test `add` telemetry end to end
-        run: node scripts/ci/cli-telemetry-e2e.mjs
-
-      - name: Assert page.goto completes under 5s budget
-        run: |
-          set -euo pipefail
-          # Extract the longest page.goto time from render logs.
-          # Format: [initSession:MODE] page.goto complete (NNNms)
-          MAX_MS=$(grep -oP 'page\.goto complete \(\K[0-9]+' /tmp/hf-cli-render.log | sort -n | tail -1)
-          if [ -z "$MAX_MS" ]; then
-            echo "::error::No page.goto timing found in render logs — log format may have changed. Update the grep pattern."
-            exit 1
-          fi
-          echo "Slowest page.goto: ${MAX_MS}ms (budget: 5000ms)"
-          if [ "$MAX_MS" -gt 5000 ]; then
-            echo "::error::page.goto took ${MAX_MS}ms — exceeds 5s budget. Possible Proxy/stub regression."
-            exit 1
-          fi
-
-      - name: Pack CLI tarball
-        run: |
-          set -euo pipefail
-          mkdir -p /tmp/hf-cli-pack
-          cd packages/cli
-          PACKED_TARBALL="$(npm pack --pack-destination /tmp/hf-cli-pack | tail -n 1)"
-          test -n "$PACKED_TARBALL"
-          test -f "/tmp/hf-cli-pack/$PACKED_TARBALL"
-          echo "HF_CLI_TARBALL=/tmp/hf-cli-pack/$PACKED_TARBALL" >> "$GITHUB_ENV"
-
-      - name: Install packed CLI outside monorepo
-        run: |
-          set -euo pipefail
-          npm install -g --prefix /tmp/hf-cli-global "$HF_CLI_TARBALL"
-
-      - name: Smoke-test packed CLI outside monorepo
-        # Skip skill installation and GitHub checks to keep the smoke test offline.
-        env:
-          HYPERFRAMES_SKIP_SKILLS: "1"
-        run: |
-          set -euo pipefail
-          export PATH="/tmp/hf-cli-global/bin:$PATH"
-          rm -rf /tmp/hf-cli-outside
-
-          hyperframes init /tmp/hf-cli-outside \
-            --example warm-grain \
-            --video /tmp/hf-cli-input.mp4 \
-            --skip-transcribe \
-            --non-interactive \
-            --skip-skills
-
-          # No smoke page waits on a CDN for GSAP.
-          node scripts/ci/inline-gsap.mjs /tmp/hf-cli-outside
-
-          hyperframes lint /tmp/hf-cli-outside
-          hyperframes validate /tmp/hf-cli-outside --timeout 3000
-          hyperframes render /tmp/hf-cli-outside \
-            --quality standard \
-            --workers auto \
-            --strict \
-            --output /tmp/hf-cli-outside/renders/outside.mp4
-
-          test -s /tmp/hf-cli-outside/renders/outside.mp4
-
-  filesize:
-    name: File size check
-    runs-on: ubuntu-latest
-    timeout-minutes: 1
-    steps:
-      # A pull request checks out its merge commit, whose first parent is the base: two commits are the whole diff.
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          fetch-depth: 2
-      - name: Check file sizes (max 600 lines)
-        # Scoped to files THIS PR changed under packages/studio. Walking the
-        # whole tree blamed every unrelated PR for pre-existing offenders.
-        # Falls back to a full scan on push events (no base ref available)
-        # so the rule still guards main.
-        run: |
-          set -e
-          if [ -n "${{ github.base_ref }}" ]; then
-            mapfile -t files < <(
-              git diff --name-only --diff-filter=ACMR \
-                HEAD^1 HEAD -- \
-                'packages/studio/**/*.ts' 'packages/studio/**/*.tsx' \
-                | grep -vE '\.(test|spec)\.(ts|tsx)$|\.generated\.' || true
-            )
-          else
-            mapfile -t files < <(
-              find packages/studio -path '*/node_modules' -prune -o \
-                \( -name '*.ts' -o -name '*.tsx' \) -print \
-                | grep -vE '\.(test|spec)\.(ts|tsx)$|\.generated\.'
-            )
-          fi
-          EXIT=0
-          for f in "${files[@]}"; do
-            [ -z "$f" ] && continue
-            [ -f "$f" ] || continue  # skip files deleted in this PR
-            lines=$(wc -l < "$f")
-            if [ "$lines" -gt 600 ]; then
-              echo "::error file=$f::$f has $lines lines (max 600)"
-              EXIT=1
-            fi
-          done
-          exit $EXIT
-
-  semantic-pr-title:
-    name: Semantic PR title
-    if: github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    env:
-      PR_TITLE_TYPES: |
-        feat
-        fix
-        docs
-        style
-        refactor
-        perf
-        test
-        build
-        ci
-        chore
-        revert
-    steps:
-      - if: github.event_name == 'pull_request'
-        uses: amannn/action-semantic-pull-request@e32d7e603df1aa1ba07e981f2a23455dee596825 # v5
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          types: ${{ env.PR_TITLE_TYPES }}
-      - if: github.event_name == 'workflow_dispatch'
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          persist-credentials: false
-      - if: github.event_name == 'workflow_dispatch'
-        id: pr
-        run: node scripts/ci/resolve-workflow-pr.mjs
-        env:
-          GH_TOKEN: ${{ github.token }}
-      - if: github.event_name == 'workflow_dispatch'
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          repository: amannn/action-semantic-pull-request
-          ref: e32d7e603df1aa1ba07e981f2a23455dee596825 # v5
-          path: .semantic-pr-action
-          persist-credentials: false
-      - if: github.event_name == 'workflow_dispatch'
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-      - if: github.event_name == 'workflow_dispatch'
-        name: Validate PR title
-        run: GITHUB_EVENT_PATH="$PR_EVENT_PATH" node .semantic-pr-action/dist/index.js
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_EVENT_PATH: ${{ steps.pr.outputs.event_path }}
-          INPUT_GITHUBBASEURL: ${{ github.api_url }}
-          INPUT_TYPES: ${{ env.PR_TITLE_TYPES }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
deleted file mode 100644
index 94a0529ebef..00000000000
--- a/.github/workflows/codeql.yml
+++ /dev/null
@@ -1,58 +0,0 @@
-# CodeQL advanced setup. Replaces GitHub's default code-scanning setup; the
-# repo must have default setup disabled in Security → Code scanning → "Set up"
-# before this workflow can run.
-#
-# Languages were taken from the existing default-setup config (JS/TS, Python,
-# Actions). Triggers mirror what default setup ran: push to main, every PR
-# against main, and a weekly schedule.
-#
-# The rules and path filters live in .github/codeql/codeql-config.yml so policy
-# changes show up as a normal PR diff.
-name: CodeQL
-
-# No merge_group: the code scanning rule does not apply to merge queue groups,
-# and the queue often merges a group and deletes its ref before the upload lands.
-on:
-  workflow_dispatch:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-  schedule:
-    # Mondays at 14:39 UTC — matches the cadence default setup was running on.
-    - cron: "39 14 * * 1"
-
-jobs:
-  analyze:
-    name: Analyze (${{ matrix.language }})
-    runs-on: ubuntu-latest
-    permissions:
-      security-events: write
-      packages: read
-      actions: read
-      contents: read
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - language: actions
-            build-mode: none
-          - language: javascript-typescript
-            build-mode: none
-          - language: python
-            build-mode: none
-    steps:
-      - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
-        with:
-          languages: ${{ matrix.language }}
-          build-mode: ${{ matrix.build-mode }}
-          config-file: ./.github/codeql/codeql-config.yml
-
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
-        with:
-          category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/comments.yml b/.github/workflows/comments.yml
deleted file mode 100644
index 188a62501b2..00000000000
--- a/.github/workflows/comments.yml
+++ /dev/null
@@ -1,67 +0,0 @@
-name: Comments
-
-permissions:
-  contents: read
-
-# No secrets and a read-only token, so fork PRs run it too. Rules: CONTRIBUTING.md, "Comments".
-on:
-  pull_request:
-    types: [opened, synchronize, reopened]
-
-concurrency:
-  group: comments-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-jobs:
-  comments:
-    name: Comments
-    # A release PR carries commits that each passed this gate on their own PR.
-    if: ${{ !startsWith(github.head_ref, 'release/') }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    env:
-      # Every repo script this job runs. They import each other, so all run from one tree.
-      COMMENT_SCRIPTS: >-
-        scripts/check-comment-citations.mjs scripts/check-comment-citations.test.mjs
-        scripts/comment-ratchet.mjs scripts/comment-ratchet.test.mjs
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          # The PR's own head, graded against its merge-base: not the merge preview, which would
-          # charge the branch for every comment main changed since it forked.
-          ref: ${{ github.event.pull_request.head.sha }}
-          path: pr
-          fetch-depth: 0
-      # A branch cut before any of these scripts existed runs the base's copies. A branch that has
-      # them all runs its own, so a PR that fixes a check is graded by the fix.
-      - name: Pick the checks
-        run: |
-          dir=pr
-          for script in $COMMENT_SCRIPTS; do [ -f "pr/$script" ] || dir=base; done
-          echo "CHECKS_DIR=$dir" >> "$GITHUB_ENV"
-      - if: env.CHECKS_DIR == 'base'
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          ref: ${{ github.event.pull_request.base.sha }}
-          path: base
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-      # The commented-out-code rule asks the TypeScript parser, a root dependency.
-      - working-directory: ${{ env.CHECKS_DIR }}
-        run: bash scripts/ci/install-workspace-dependencies.sh --ignore-scripts
-      - name: Test the checker
-        working-directory: ${{ env.CHECKS_DIR }}
-        run: node --test scripts/check-comment-citations.test.mjs scripts/comment-ratchet.test.mjs
-      - name: Check the comments this diff touched
-        working-directory: pr
-        env:
-          COMMENT_CHECK_BASE: ${{ github.event.pull_request.base.sha }}
-        run: node "../$CHECKS_DIR/scripts/check-comment-citations.mjs"
-      - name: A package file's comment share may not rise
-        if: ${{ !cancelled() }}
-        working-directory: pr
-        env:
-          COMMENT_CHECK_BASE: ${{ github.event.pull_request.base.sha }}
-        run: node "../$CHECKS_DIR/scripts/comment-ratchet.mjs"
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
deleted file mode 100644
index 32cb4a7a355..00000000000
--- a/.github/workflows/docs.yml
+++ /dev/null
@@ -1,70 +0,0 @@
-name: Docs
-
-permissions:
-  contents: read
-
-# Suppress hyperframes CLI telemetry from HeyGen's own CI runs.
-# External users' CI continues to emit telemetry unless they set this themselves.
-env:
-  HYPERFRAMES_NO_TELEMETRY: "1"
-
-on:
-  pull_request:
-    branches: [main]
-    paths:
-      - ".github/workflows/docs.yml"
-      - "docs/**"
-      - "DOCS_GUIDELINES.md"
-      - "packages/core/schemas/**"
-      - "scripts/sync-schemas.ts"
-      # A new CLI command must be listed in the docs (check-docs-cli-commands.mjs).
-      - "packages/cli/src/cli.ts"
-      - "scripts/check-docs-cli-commands.mjs"
-  push:
-    branches: [main]
-    paths:
-      - ".github/workflows/docs.yml"
-      - "docs/**"
-      - "DOCS_GUIDELINES.md"
-      - "packages/core/schemas/**"
-      - "scripts/sync-schemas.ts"
-      # A new CLI command must be listed in the docs (check-docs-cli-commands.mjs).
-      - "packages/cli/src/cli.ts"
-      - "scripts/check-docs-cli-commands.mjs"
-
-concurrency:
-  group: docs-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  validate:
-    name: Validate docs
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-
-      - name: Check schema mirror (core → docs)
-        run: npx tsx scripts/sync-schemas.ts --check
-
-      - name: Check every CLI command is listed in the docs
-        run: node scripts/check-docs-cli-commands.mjs
-
-      - name: Install Mint CLI
-        run: |
-          npm install --prefix "$RUNNER_TEMP/mint-cli" --no-save --no-package-lock mint@4.2.1096
-          echo "$RUNNER_TEMP/mint-cli/node_modules/.bin" >> "$GITHUB_PATH"
-
-      - name: Validate build
-        working-directory: docs
-        run: mint validate
-
-      - name: Check broken links
-        working-directory: docs
-        # --check-redirects also resolves every redirect destination, so a
-        # restructure cannot leave a redirect pointing at a page it removed.
-        run: mint broken-links --check-redirects
diff --git a/.github/workflows/fast-video-validation.yml b/.github/workflows/fast-video-validation.yml
deleted file mode 100644
index 6c80db3fd98..00000000000
--- a/.github/workflows/fast-video-validation.yml
+++ /dev/null
@@ -1,62 +0,0 @@
-# Validates the experimental fast-capture (drawElementImage) VIDEO path on a
-# native amd64 Linux runner — where chrome-headless-shell's per-frame BeginFrame
-# drives a real paint each frame, so drawElementImage's snapshot is fresh and
-# video captures correctly. This is the one part of the feature that could not be
-# validated locally (macOS has no BeginFrame; Docker-on-rosetta hung).
-# See docs/fast-capture-limitations.md (Limitation 2).
-#
-# Manual trigger: Actions → "Fast-capture video validation" → Run workflow.
-name: Fast-capture video validation
-
-permissions:
-  contents: read
-
-on:
-  # Manual only. NOTE: currently fails by design — fast capture cannot capture
-  # video on any platform yet (see docs/fast-capture-limitations.md, Limitation 2).
-  # This is the regression gate for if/when fast video is implemented.
-  workflow_dispatch:
-    inputs:
-      composition:
-        description: Test composition to render (must contain <video>)
-        default: sub-composition-video
-      min_psnr:
-        description: Min fast-vs-baseline PSNR (dB) to pass
-        default: "25"
-
-jobs:
-  validate:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
-        with:
-          # Docker Hub rate-limits anonymous pulls from shared runners; pull through Google's mirror.
-          driver-opts: image=mirror.gcr.io/moby/buildkit:buildx-stable-1
-          buildkitd-config-inline: |
-            [registry."docker.io"]
-              mirrors = ["mirror.gcr.io"]
-
-      - name: Build test Docker image (cached)
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
-        with:
-          context: .
-          file: Dockerfile.test
-          load: true
-          tags: hyperframes-producer:test
-          # regression.yml owns this cache's writes.
-          cache-from: type=gha,scope=regression-test-image
-
-      - name: Validate fast-capture video (drawElement + BeginFrame)
-        run: |
-          docker run --rm \
-            -e HYPERFRAMES_NO_TELEMETRY=1 \
-            --security-opt seccomp=unconfined \
-            --shm-size=4g \
-            -e PRODUCER_VALIDATE_COMP='${{ inputs.composition }}' \
-            -e PRODUCER_VALIDATE_MIN_PSNR='${{ inputs.min_psnr }}' \
-            --workdir /app/packages/producer \
-            --entrypoint bunx \
-            hyperframes-producer:test tsx scripts/validate-fast-video.ts
diff --git a/.github/workflows/fixtures/windows-canary.html b/.github/workflows/fixtures/windows-canary.html
deleted file mode 100644
index b8b356343b8..00000000000
--- a/.github/workflows/fixtures/windows-canary.html
+++ /dev/null
@@ -1,81 +0,0 @@
-<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="UTF-8" />
-    <script src="https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js"></script>
-    <style>
-      * {
-        margin: 0;
-        padding: 0;
-        box-sizing: border-box;
-      }
-      html,
-      body {
-        width: 1920px;
-        height: 1080px;
-        overflow: hidden;
-        background: #0a0a0a;
-        color: #f4eee4;
-        font-family:
-          system-ui,
-          -apple-system,
-          "Segoe UI",
-          sans-serif;
-      }
-      #root {
-        display: flex;
-        flex-direction: column;
-        align-items: center;
-        justify-content: center;
-        width: 100%;
-        height: 100%;
-        gap: 40px;
-      }
-      #headline {
-        font-size: 180px;
-        font-weight: 900;
-        letter-spacing: -0.03em;
-        line-height: 0.9;
-        color: #c7c4f7;
-        text-align: center;
-      }
-      #sub {
-        font-size: 36px;
-        letter-spacing: 0.3em;
-        text-transform: uppercase;
-        color: #f4eee4;
-        opacity: 0.7;
-      }
-      #bar {
-        width: 560px;
-        height: 4px;
-        background: #9b95f0;
-        transform-origin: left center;
-      }
-    </style>
-  </head>
-  <body>
-    <div
-      id="root"
-      data-composition-id="main"
-      data-start="0"
-      data-duration="8"
-      data-width="1920"
-      data-height="1080"
-    >
-      <div id="headline">HYPERFRAMES</div>
-      <div id="sub">RENDERED ON WINDOWS</div>
-      <div id="bar"></div>
-    </div>
-    <script>
-      window.__timelines = window.__timelines || {};
-      const tl = gsap.timeline({ paused: true });
-      tl.from("#headline", { y: 80, opacity: 0, duration: 0.9, ease: "power3.out" }, 0.2);
-      tl.from("#sub", { y: 40, opacity: 0, duration: 0.7, ease: "power2.out" }, 0.6);
-      tl.fromTo("#bar", { scaleX: 0 }, { scaleX: 1, duration: 1.2, ease: "power4.inOut" }, 1.0);
-      tl.to("#headline", { letterSpacing: "-0.01em", duration: 4.0, ease: "sine.inOut" }, 2.5);
-      tl.to(["#headline", "#sub", "#bar"], { opacity: 0, duration: 0.8, ease: "power2.in" }, 7.0);
-      window.__timelines["main"] = tl;
-    </script>
-  </body>
-</html>
diff --git a/.github/workflows/lambda-arm64-image.yml b/.github/workflows/lambda-arm64-image.yml
deleted file mode 100644
index 3fe7405a0df..00000000000
--- a/.github/workflows/lambda-arm64-image.yml
+++ /dev/null
@@ -1,134 +0,0 @@
-name: Lambda arm64 image
-
-permissions:
-  contents: read
-
-# Builds the arm64 Lambda video function image: the native ffmpeg on two separate ARM runners (each runs
-# the codec check, the tarballs must match), then the image from the x86 handler ZIP, smoke-run on ARM.
-on:
-  pull_request:
-    paths:
-      - "packages/aws-lambda/image/**"
-      - "packages/aws-lambda/scripts/stage-arm64-image.ts"
-      # A @sparticuz/chromium bump or a ZIP layout change must re-stage the image.
-      - "packages/aws-lambda/package.json"
-      - "packages/aws-lambda/scripts/build-zip.ts"
-      - ".github/workflows/lambda-arm64-image.yml"
-  # On main it also seeds publish.yml's ffmpeg cache.
-  push:
-    branches: [main]
-    paths:
-      - "packages/aws-lambda/image/**"
-  workflow_dispatch:
-
-concurrency:
-  group: lambda-arm64-image-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  changes:
-    name: Detect changes
-    runs-on: ubuntu-latest
-    timeout-minutes: 4
-    outputs:
-      release_only: ${{ steps.release.outputs.release_only }}
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          fetch-depth: 0
-      - name: Find a release-only diff
-        id: release
-        uses: ./.github/actions/release-only-diff
-
-  ffmpeg:
-    name: ffmpeg ${{ matrix.copy }}
-    needs: changes
-    # A release PR changes versions and notes only; a failed change detection must not skip the build.
-    if: ${{ !cancelled() && needs.changes.outputs.release_only != 'true' }}
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 90
-    strategy:
-      matrix:
-        copy: [a, b]
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - name: Build and check
-        run: >-
-          docker buildx build --progress=plain --platform linux/arm64 --target artifact
-          --output type=local,dest=out packages/aws-lambda/image
-      - run: cat out/hf-media-check.txt && sha256sum out/*.tar.gz
-      # Same path and key as publish.yml's lambda-arm64-ffmpeg job reads.
-      - if: matrix.copy == 'a' && github.ref == 'refs/heads/main'
-        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
-        with:
-          path: out/
-          key: hf-media-linux-aarch64-${{ hashFiles('packages/aws-lambda/image/**') }}
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: hf-media-${{ matrix.copy }}
-          path: out/
-          retention-days: 7
-
-  reproducible:
-    name: ffmpeg builds match
-    needs: ffmpeg
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
-      - run: cmp hf-media-a/hf-media-linux-aarch64.tar.gz hf-media-b/hf-media-linux-aarch64.tar.gz
-
-  handler-zip:
-    name: Handler ZIP
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-      - run: bun install --frozen-lockfile
-      - run: bun run build
-      - run: bun run --cwd packages/aws-lambda build:zip
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: handler-zip
-          path: packages/aws-lambda/dist/handler.zip
-          retention-days: 7
-
-  image:
-    name: Image smoke
-    needs: [ffmpeg, handler-zip]
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 20
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
-        with:
-          path: artifacts
-      - name: Stage /var/task
-        run: >-
-          bun packages/aws-lambda/scripts/stage-arm64-image.ts
-          --zip=artifacts/handler-zip/handler.zip
-          --ffmpeg=artifacts/hf-media-a/hf-media-linux-aarch64.tar.gz --out=staged
-      - name: Build image
-        run: >-
-          docker buildx build --progress=plain --platform linux/arm64 --target video
-          --build-context task=staged/task --load -t hf-video:ci packages/aws-lambda/image
-      - name: ffmpeg and Chrome run under the image's own Lambda runtime
-        run: |
-          docker run -d --name hf-smoke -p 9001:8080 \
-            -v "$PWD/packages/aws-lambda/image/smoke-video.mjs:/var/task/smoke-video.mjs:ro" \
-            hf-video:ci smoke-video.handler
-          reply=$(curl -sS --retry 30 --retry-all-errors --retry-delay 1 \
-            -d '{}' http://localhost:9001/2015-03-31/functions/function/invocations)
-          docker logs hf-smoke
-          echo "$reply"
-          jq -e '.arch == "arm64" and .screenshotBytes > 0 and (.ffmpeg | startswith("ffmpeg version 7.0.2"))' <<<"$reply"
-      - name: The Lambda runtime loads the handler
-        run: |
-          docker run -d --name hf-video -p 9000:8080 hf-video:ci
-          reply=$(curl -sS --retry 30 --retry-all-errors --retry-delay 1 \
-            -d '{"Action":"not-an-action"}' http://localhost:9000/2015-03-31/functions/function/invocations)
-          docker logs hf-video
-          echo "$reply"
-          grep -q 'no recognised Action' <<<"$reply"
diff --git a/.github/workflows/lambda-sam-template.yml b/.github/workflows/lambda-sam-template.yml
deleted file mode 100644
index 6e217f6b8c6..00000000000
--- a/.github/workflows/lambda-sam-template.yml
+++ /dev/null
@@ -1,25 +0,0 @@
-name: Lambda SAM template
-
-on:
-  pull_request:
-    paths:
-      - "examples/aws-lambda/**"
-      - ".github/workflows/lambda-sam-template.yml"
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  sam-deploy:
-    name: sam deploy validation
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - run: pipx install aws-sam-cli==1.169.0
-      - run: bash examples/aws-lambda/scripts/check-sam-deploy.sh
diff --git a/.github/workflows/player-perf.yml b/.github/workflows/player-perf.yml
deleted file mode 100644
index 4f0e22428e9..00000000000
--- a/.github/workflows/player-perf.yml
+++ /dev/null
@@ -1,200 +0,0 @@
-name: Player perf
-
-permissions:
-  contents: read
-
-# Suppress hyperframes CLI telemetry from HeyGen's own CI runs.
-# External users' CI continues to emit telemetry unless they set this themselves.
-env:
-  HYPERFRAMES_NO_TELEMETRY: "1"
-
-on:
-  pull_request:
-  push:
-    branches: [main]
-
-concurrency:
-  group: player-perf-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  changes:
-    name: Detect changes
-    runs-on: ubuntu-latest
-    timeout-minutes: 8
-    outputs:
-      perf: ${{ steps.release.outputs.release_only == 'true' && 'false' || steps.filter.outputs.perf }}
-    steps:
-      # Force git-based change detection instead of the pull_request REST API.
-      # The API path can fail the perf workflow on transient listFiles timeouts.
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        timeout-minutes: 3
-      - name: Fetch the history the diffs read
-        timeout-minutes: 2
-        uses: ./.github/actions/fetch-history
-      # HEAD is the PR merge ref; its first parent is the current base tip, unlike the payload's
-      # base.sha, which goes stale and would count the base's newer commits as the PR's changes.
-      - name: Find the pull request's current base
-        id: base
-        if: github.event_name == 'pull_request'
-        run: |
-          git rev-parse --verify -q HEAD^2 > /dev/null || { echo "::error::HEAD is not the pull request merge commit"; exit 1; }
-          sha="$(git rev-parse --verify HEAD^1)"
-          echo "sha=$sha" >> "$GITHUB_OUTPUT"
-      - name: Find a release-only diff
-        id: release
-        uses: ./.github/actions/release-only-diff
-      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4
-        id: filter
-        with:
-          token: ""
-          base: ${{ steps.base.outputs.sha }}
-          filters: |
-            perf:
-              - "packages/player/**"
-              - "packages/core/**"
-              - "package.json"
-              - "bun.lock"
-              - ".github/workflows/player-perf.yml"
-
-  preflight:
-    name: Preflight (lint + format)
-    needs: changes
-    if: needs.changes.outputs.perf == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: ./.github/actions/preflight
-
-  perf-shards:
-    name: "Perf: ${{ matrix.shard }}"
-    needs: [changes, preflight]
-    if: needs.changes.outputs.perf == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    strategy:
-      fail-fast: true
-      matrix:
-        include:
-          - shard: load
-            scenarios: load
-            runs: "5"
-          - shard: fps
-            scenarios: fps
-            runs: "3"
-          - shard: scrub
-            scenarios: scrub
-            runs: "3"
-          - shard: drift
-            scenarios: drift
-            runs: "3"
-          - shard: parity
-            scenarios: parity
-            runs: "3"
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-
-      - run: bun install --frozen-lockfile
-
-      # Player perf loads packages/player/dist/hyperframes-player.global.js
-      # and packages/core/dist/hyperframe.runtime.iife.js, so a full build is required.
-      - run: bun run build
-
-      - name: Set up Chrome (headless shell)
-        id: setup-chrome
-        uses: browser-actions/setup-chrome@c785b87e244131f27c9f19c1a33e2ead956ab7ce # v1
-        with:
-          chrome-version: stable
-
-      # The parity scenario shells out to `ffmpeg -lavfi ssim` to score the
-      # live-playback frame against the sync-seek reference frame. ffmpeg is
-      # not on the default ubuntu-latest runner image, and a missing binary
-      # surfaces as ENOENT inside computeSsim() — informative, but cheaper
-      # to just install it here so the shard never trips on infra.
-      - name: Install ffmpeg (parity shard only)
-        if: matrix.shard == 'parity'
-        uses: ./.github/actions/install-ffmpeg-linux
-
-      - name: Verify sandbox origin boundary (load shard only)
-        if: matrix.shard == 'load'
-        working-directory: packages/player
-        env:
-          PUPPETEER_EXECUTABLE_PATH: ${{ steps.setup-chrome.outputs.chrome-path }}
-        run: bun run test:browser-security
-
-      - name: Verify the preview rasters at its shown size (load shard only)
-        if: matrix.shard == 'load'
-        working-directory: packages/player
-        env:
-          PUPPETEER_EXECUTABLE_PATH: ${{ steps.setup-chrome.outputs.chrome-path }}
-        run: bun run test:browser-raster
-
-      - name: Verify the player takes the box its embed asks for (load shard only)
-        if: matrix.shard == 'load'
-        working-directory: packages/player
-        env:
-          PUPPETEER_EXECUTABLE_PATH: ${{ steps.setup-chrome.outputs.chrome-path }}
-        run: bun run test:browser-box
-
-      - name: Run player perf — ${{ matrix.shard }} (measure mode)
-        working-directory: packages/player
-        env:
-          PUPPETEER_EXECUTABLE_PATH: ${{ steps.setup-chrome.outputs.chrome-path }}
-        run: |
-          bun run perf \
-            --mode=measure \
-            --scenarios=${{ matrix.scenarios }} \
-            --runs=${{ matrix.runs }}
-
-      - name: Upload perf results
-        if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: player-perf-${{ matrix.shard }}
-          path: packages/player/tests/perf/results/
-          if-no-files-found: warn
-          retention-days: 30
-
-  # Summary job — matches the required check name in branch protection.
-  # Logs an explicit "skipped" / "passed" / "failed" line both to stdout and to
-  # $GITHUB_STEP_SUMMARY so a false skip is obvious in the Checks UI without
-  # having to dig into the changes-job logs.
-  player-perf:
-    runs-on: ubuntu-latest
-    needs: [changes, perf-shards]
-    if: always()
-    steps:
-      - name: Check results
-        env:
-          PERF_FILTER_RESULT: ${{ needs.changes.outputs.perf }}
-          PERF_SHARDS_RESULT: ${{ needs.perf-shards.result }}
-        run: |
-          {
-            echo "## Player perf gate"
-            echo ""
-            echo "- paths-filter \`perf\` matched: \`${PERF_FILTER_RESULT}\`"
-            echo "- perf-shards result: \`${PERF_SHARDS_RESULT}\`"
-            echo ""
-          } >> "$GITHUB_STEP_SUMMARY"
-
-          if [ "${PERF_FILTER_RESULT}" != "true" ]; then
-            echo "::notice title=Player perf::SKIPPED — no changes under packages/player/**, packages/core/**, package.json, bun.lock, or .github/workflows/player-perf.yml. Auto-pass."
-            echo "**Status:** SKIPPED (no player/core changes — auto-pass)" >> "$GITHUB_STEP_SUMMARY"
-            exit 0
-          fi
-
-          if [ "${PERF_SHARDS_RESULT}" != "success" ]; then
-            echo "::error title=Player perf::FAILED — perf-shards result was '${PERF_SHARDS_RESULT}'. See the per-shard logs above."
-            echo "**Status:** FAILED (perf-shards result: \`${PERF_SHARDS_RESULT}\`)" >> "$GITHUB_STEP_SUMMARY"
-            exit 1
-          fi
-
-          echo "::notice title=Player perf::PASSED — all perf shards completed successfully."
-          echo "**Status:** PASSED" >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/player-safari.yml b/.github/workflows/player-safari.yml
deleted file mode 100644
index 057ea172c6e..00000000000
--- a/.github/workflows/player-safari.yml
+++ /dev/null
@@ -1,80 +0,0 @@
-name: Player Safari perf
-
-permissions:
-  contents: read
-
-env:
-  HYPERFRAMES_NO_TELEMETRY: "1"
-
-on:
-  pull_request:
-    paths:
-      - "packages/player/**"
-      - "packages/core/src/runtime/**"
-      - ".github/workflows/player-safari.yml"
-  schedule:
-    - cron: "23 7 * * *"
-  workflow_dispatch:
-
-concurrency:
-  group: player-safari-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  changes:
-    name: Detect changes
-    runs-on: ubuntu-latest
-    timeout-minutes: 4
-    outputs:
-      release_only: ${{ steps.release.outputs.release_only }}
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          fetch-depth: 0
-      - name: Find a release-only diff
-        id: release
-        uses: ./.github/actions/release-only-diff
-
-  heavy-films:
-    name: "Heavy films: Safari vs Chrome"
-    needs: changes
-    # A release PR changes versions and notes only; a failed change detection must not skip the films.
-    if: ${{ !cancelled() && needs.changes.outputs.release_only != 'true' }}
-    runs-on: macos-latest
-    timeout-minutes: 45
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-
-      - run: bun install --frozen-lockfile
-
-      # The bench serves packages/player/dist and packages/core/dist, as the Linux perf shards do.
-      - run: bun run build
-
-      - name: Generate heavy media
-        run: |
-          brew install ffmpeg
-          bash packages/player/tests/perf/browsers/make-media.sh
-
-      - name: Enable safaridriver
-        run: sudo safaridriver --enable
-
-      - name: Run heavy films in Safari and Chrome
-        working-directory: packages/player
-        run: |
-          sw_vers
-          CHROMEDRIVER="$CHROMEWEBDRIVER/chromedriver" bun run tests/perf/browsers/run.ts --browsers safari,chrome --runs 2
-
-      - name: Upload results
-        if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: player-safari-heavy-films
-          path: packages/player/tests/perf/results/
-          if-no-files-found: warn
-          retention-days: 30
diff --git a/.github/workflows/pr-captures.yml b/.github/workflows/pr-captures.yml
deleted file mode 100644
index 67e78969006..00000000000
--- a/.github/workflows/pr-captures.yml
+++ /dev/null
@@ -1,43 +0,0 @@
-name: PR captures
-
-permissions:
-  contents: read
-  pull-requests: read
-
-# Runs on every PR (no path filter) so it can be a required check; the script passes when neither package changed.
-on:
-  merge_group:
-    types: [checks_requested]
-  workflow_dispatch:
-  pull_request:
-    types: [opened, synchronize, reopened, edited]
-    branches: [main]
-
-concurrency:
-  group: pr-captures-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  captures:
-    name: Studio and player captures
-    # A merge group has no PR body to read; the queued PR passed this check already.
-    if: github.event_name != 'merge_group'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          fetch-depth: 0
-      - id: pr
-        run: node scripts/ci/resolve-workflow-pr.mjs
-        env:
-          GH_TOKEN: ${{ github.token }}
-      - name: Require Before and After captures
-        env:
-          PR_BODY: ${{ fromJSON(steps.pr.outputs.pr).body }}
-          PR_NUMBER: ${{ fromJSON(steps.pr.outputs.pr).number }}
-          BASE_REF: ${{ fromJSON(steps.pr.outputs.pr).base.ref }}
-          HEAD_REPO: ${{ fromJSON(steps.pr.outputs.pr).head.repo.full_name }}
-          BASE_REPO: ${{ github.repository }}
-          HEAD_SHA: ${{ fromJSON(steps.pr.outputs.pr).head.sha }}
-        run: node scripts/check-pr-captures.mjs --base "origin/$BASE_REF" --head "$HEAD_SHA"
diff --git a/.github/workflows/preview-regression.yml b/.github/workflows/preview-regression.yml
deleted file mode 100644
index c8a77280f19..00000000000
--- a/.github/workflows/preview-regression.yml
+++ /dev/null
@@ -1,176 +0,0 @@
-name: preview-regression
-
-permissions:
-  contents: read
-
-# Suppress hyperframes CLI telemetry from HeyGen's own CI runs.
-# External users' CI continues to emit telemetry unless they set this themselves.
-env:
-  HYPERFRAMES_NO_TELEMETRY: "1"
-
-on:
-  pull_request:
-  push:
-    branches:
-      - main
-
-concurrency:
-  group: preview-regression-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  changes:
-    name: Detect changes
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    outputs:
-      preview: ${{ steps.release.outputs.release_only == 'true' && 'false' || steps.filter.outputs.preview }}
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          fetch-depth: 0
-      # HEAD is the PR merge ref; its first parent is the current base tip, unlike the payload's
-      # base.sha, which goes stale and would count the base's newer commits as the PR's changes.
-      - name: Find the pull request's current base
-        id: base
-        if: github.event_name == 'pull_request'
-        run: |
-          git rev-parse --verify -q HEAD^2 > /dev/null || { echo "::error::HEAD is not the pull request merge commit"; exit 1; }
-          sha="$(git rev-parse --verify HEAD^1)"
-          echo "sha=$sha" >> "$GITHUB_OUTPUT"
-      - name: Find a release-only diff
-        id: release
-        uses: ./.github/actions/release-only-diff
-      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4
-        id: filter
-        with:
-          token: ""
-          base: ${{ steps.base.outputs.sha }}
-          filters: |
-            preview:
-              - "packages/core/**"
-              - "packages/parsers/**"
-              - "packages/studio-server/**"
-              - "packages/lint/**"
-              - "packages/player/**"
-              - "packages/studio/**"
-              - "packages/cli/**"
-              - "packages/producer/src/parity-harness.ts"
-              - "packages/producer/src/parity-fixtures.ts"
-              - "packages/producer/tests/parity/**"
-              - "package.json"
-              - "bun.lock"
-              - ".github/workflows/preview-regression.yml"
-
-  preflight:
-    name: Preflight (lint + format)
-    needs: changes
-    if: needs.changes.outputs.preview == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: ./.github/actions/preflight
-
-  preview-parity:
-    name: Preview parity
-    needs: [changes, preflight]
-    if: needs.changes.outputs.preview == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-
-      - run: bun install --frozen-lockfile
-
-      - name: Build workspace packages (required for vite config loading)
-        run: |
-          bun run --filter '@hyperframes/{parsers,lint,studio-server}' build
-          bun run --cwd packages/core build
-
-      - name: Run Studio preview routing regression
-        run: |
-          bun run --cwd packages/studio test -- vite.thumbnail.test.ts src/utils/projectRouting.test.ts src/utils/frameCapture.test.ts
-          bun run --cwd packages/studio-server test -- src/routes/thumbnail.test.ts
-
-      - name: Build preview runtime
-        run: bun run --cwd packages/core build:hyperframes-runtime
-
-      - name: Prepare parity fixtures
-        run: bun run --cwd packages/producer parity:fixtures:ci
-
-      - name: Install ffmpeg
-        uses: ./.github/actions/install-ffmpeg-linux
-
-      - name: Set up Chrome
-        id: setup-chrome
-        uses: browser-actions/setup-chrome@c785b87e244131f27c9f19c1a33e2ead956ab7ce # v1
-        with:
-          chrome-version: stable
-
-      - name: Start parity fixture server
-        run: |
-          cd packages/producer/tests/parity/fixtures
-          python3 -m http.server 4173 --bind 127.0.0.1 > /tmp/preview-parity-http.log 2>&1 &
-          echo "$!" > /tmp/preview-parity-http.pid
-          for _ in $(seq 1 30); do
-            if curl -fsS http://127.0.0.1:4173/minimal-wysiwyg.html >/dev/null; then
-              exit 0
-            fi
-            sleep 1
-          done
-          cat /tmp/preview-parity-http.log
-          exit 1
-
-      - name: Run preview parity check
-        working-directory: packages/producer
-        env:
-          PUPPETEER_EXECUTABLE_PATH: ${{ steps.setup-chrome.outputs.chrome-path }}
-        run: bun run parity:check:ci
-
-      - name: Upload parity artifacts
-        if: failure()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: preview-parity-artifacts
-          path: packages/producer/.debug/parity-harness-ci/
-          if-no-files-found: ignore
-          retention-days: 30
-
-  preview-regression:
-    runs-on: ubuntu-latest
-    needs: [changes, preview-parity]
-    if: always()
-    steps:
-      - name: Check results
-        env:
-          PREVIEW_FILTER_RESULT: ${{ needs.changes.outputs.preview }}
-          PREVIEW_PARITY_RESULT: ${{ needs.preview-parity.result }}
-        run: |
-          {
-            echo "## Preview regression gate"
-            echo ""
-            echo "- paths-filter \`preview\` matched: \`${PREVIEW_FILTER_RESULT}\`"
-            echo "- preview-parity result: \`${PREVIEW_PARITY_RESULT}\`"
-            echo ""
-          } >> "$GITHUB_STEP_SUMMARY"
-
-          if [ "${PREVIEW_FILTER_RESULT}" != "true" ]; then
-            echo "::notice title=Preview regression::SKIPPED — no preview/runtime changes. Auto-pass."
-            echo "**Status:** SKIPPED (no preview/runtime changes — auto-pass)" >> "$GITHUB_STEP_SUMMARY"
-            exit 0
-          fi
-
-          if [ "${PREVIEW_PARITY_RESULT}" != "success" ]; then
-            echo "**Status:** FAILED" >> "$GITHUB_STEP_SUMMARY"
-            echo "Preview parity check failed"
-            exit 1
-          fi
-
-          echo "**Status:** PASSED" >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/promptwise-release.yml b/.github/workflows/promptwise-release.yml
new file mode 100644
index 00000000000..23bd4f4c561
--- /dev/null
+++ b/.github/workflows/promptwise-release.yml
@@ -0,0 +1,31 @@
+# Builds the CLI (with our Studio) as an npm tarball and attaches it to a GitHub release.
+# promptwise's sandbox image installs it with `npm i -g <release asset url>`.
+name: promptwise release
+
+on:
+  push:
+    tags: ["promptwise-v*"]
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - run: bun install --frozen-lockfile
+      # Studio checks this at build time; the sandbox sets HYPERFRAMES_NO_TELEMETRY for the CLI.
+      - run: bun run build
+        env:
+          VITE_HYPERFRAMES_NO_TELEMETRY: "1"
+      # Published as "hyperframes" upstream (see publish.yml), so the sandbox's paths stay the same.
+      - run: npm pkg set name=hyperframes && npm pack --pack-destination "$RUNNER_TEMP"
+        working-directory: packages/cli
+      - run: gh release create "$GITHUB_REF_NAME" "$RUNNER_TEMP"/hyperframes-*.tgz --title "$GITHUB_REF_NAME" --notes "HyperFrames CLI with the promptwise Studio."
+        env:
+          GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
deleted file mode 100644
index 7376b598862..00000000000
--- a/.github/workflows/publish.yml
+++ /dev/null
@@ -1,324 +0,0 @@
-name: Publish to npm
-
-permissions: {}
-
-on:
-  push:
-    tags:
-      # Stable tags are created only by a merged, reviewed release PR. Direct
-      # tag pushes are reserved for prerelease channels.
-      - "v*-*"
-  pull_request:
-    types: [closed]
-    branches: [main]
-
-jobs:
-  lambda-arm64-ffmpeg:
-    name: Lambda arm64 ffmpeg
-    runs-on: ubuntu-24.04-arm
-    # A cache miss compiles ffmpeg natively, 15-20 minutes.
-    timeout-minutes: 60
-    permissions:
-      contents: read
-    env:
-      EXPECTED_RELEASE_SHA: >-
-        ${{ github.event_name == 'pull_request'
-            && github.event.pull_request.merge_commit_sha
-            || github.sha }}
-    if: >-
-      github.event_name == 'push' ||
-      (github.event.pull_request.merged == true &&
-       startsWith(github.event.pull_request.head.ref, 'release/v'))
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          ref: ${{ env.EXPECTED_RELEASE_SHA }}
-      # lambda-arm64-image.yml saves this key on main; a release run's own saves reach only its re-runs.
-      - id: cache
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
-        with:
-          path: out/
-          key: hf-media-linux-aarch64-${{ hashFiles('packages/aws-lambda/image/**') }}
-      - if: steps.cache.outputs.cache-hit != 'true'
-        run: >-
-          docker buildx build --progress=plain --platform linux/arm64 --target artifact
-          --output type=local,dest=out packages/aws-lambda/image
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: hf-media-linux-aarch64
-          path: out/hf-media-linux-aarch64.tar.gz
-          if-no-files-found: error
-
-  publish:
-    name: Publish
-    needs: lambda-arm64-ffmpeg
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    environment: npm-publish
-    permissions:
-      contents: write
-      id-token: write
-    env:
-      EXPECTED_RELEASE_SHA: >-
-        ${{ github.event_name == 'pull_request'
-            && github.event.pull_request.merge_commit_sha
-            || github.sha }}
-    # Stable releases come only from reviewed release PRs. Tag pushes are
-    # prerelease-only because the trigger pattern requires a hyphenated version.
-    if: >-
-      github.event_name == 'push' ||
-      (github.event.pull_request.merged == true &&
-       startsWith(github.event.pull_request.head.ref, 'release/v'))
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          fetch-depth: 0
-          # Pin every release to an immutable ref. In particular, a merged
-          # release PR event exposes main as github.ref, which may advance
-          # before this job starts; use the event's exact merge commit instead.
-          ref: ${{ env.EXPECTED_RELEASE_SHA }}
-
-      - name: Verify immutable release checkout
-        run: |
-          ACTUAL_SHA="$(git rev-parse HEAD)"
-          EXPECTED_COMMIT_SHA="$(git rev-parse "${EXPECTED_RELEASE_SHA}^{commit}")"
-          if [ "$ACTUAL_SHA" != "$EXPECTED_COMMIT_SHA" ]; then
-            echo "::error::Expected release commit $EXPECTED_COMMIT_SHA, checked out $ACTUAL_SHA"
-            exit 1
-          fi
-
-      - name: Resolve version
-        id: version
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-          PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
-        run: |
-          if [ "$EVENT_NAME" = "push" ]; then
-            VERSION="${GITHUB_REF_NAME#v}"
-          else
-            BRANCH="${PR_HEAD_REF}"
-            VERSION="${BRANCH#release/v}"
-          fi
-          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
-
-          # Detect pre-release tag (e.g. 0.1.16-alpha.1 → alpha, 0.1.16-beta.2 → beta)
-          if [[ "$VERSION" =~ -([a-zA-Z]+) ]]; then
-            DIST_TAG="${BASH_REMATCH[1]}"
-            echo "prerelease=true" >> "$GITHUB_OUTPUT"
-          else
-            DIST_TAG="latest"
-            echo "prerelease=false" >> "$GITHUB_OUTPUT"
-          fi
-          echo "dist_tag=${DIST_TAG}" >> "$GITHUB_OUTPUT"
-          echo "Resolved version=${VERSION} dist_tag=${DIST_TAG}"
-
-      - name: Validate release channel
-        env:
-          VERSION: ${{ steps.version.outputs.version }}
-          DIST_TAG: ${{ steps.version.outputs.dist_tag }}
-          EVENT_NAME: ${{ github.event_name }}
-          PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
-        run: node scripts/validate-release-channel.mjs
-
-      - name: Create release tag
-        if: github.event_name == 'pull_request'
-        env:
-          VERSION: ${{ steps.version.outputs.version }}
-        run: |
-          TAG="v$VERSION"
-          EXPECTED_TAG_SHA="$(git rev-parse HEAD)"
-
-          verify_remote_tag() {
-            git fetch --force --no-tags origin "+refs/tags/$TAG:refs/tags/$TAG"
-            ACTUAL_TAG_SHA="$(git rev-parse "refs/tags/$TAG^{commit}")"
-            if [ "$ACTUAL_TAG_SHA" != "$EXPECTED_TAG_SHA" ]; then
-              echo "::error::Release tag $TAG points to $ACTUAL_TAG_SHA, expected $EXPECTED_TAG_SHA"
-              exit 1
-            fi
-            echo "Release tag $TAG already exists at the expected commit — skipping"
-          }
-
-          if [ -n "$(git ls-remote --refs origin "refs/tags/$TAG")" ]; then
-            verify_remote_tag
-          else
-            git tag --no-sign "$TAG" "$EXPECTED_TAG_SHA"
-            if ! git push origin "refs/tags/$TAG"; then
-              # A concurrent retry may have created the tag after ls-remote.
-              git tag -d "$TAG"
-              verify_remote_tag
-            fi
-          fi
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 24
-          registry-url: "https://registry.npmjs.org"
-      - run: corepack enable
-      - run: corepack prepare pnpm@10.17.1 --activate
-      - run: bun install --frozen-lockfile
-      - run: bun run build
-
-      # Before `npm publish`, so @hyperframes/aws-lambda pins this exact zip.
-      - name: Build Lambda handler zip
-        id: lambda_zip
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          VERSION: ${{ steps.version.outputs.version }}
-          REPO: ${{ github.repository }}
-        run: |
-          # A retried run reuses the zip already on the release, so the pin still matches it.
-          if gh release download "v${VERSION}" --repo "$REPO" --pattern hyperframes-lambda-handler.zip --dir dist; then
-            echo "attached=true" >> "$GITHUB_OUTPUT"
-          else
-            bun run --cwd packages/aws-lambda build:zip
-          fi
-          bun packages/aws-lambda/scripts/pin-handler-zip.ts
-
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
-        with:
-          name: hf-media-linux-aarch64
-          path: dist/hf-media
-
-      # Built from the zip pinned above. The video stage only copies files, so no emulation is needed.
-      - name: Build Lambda video image
-        id: lambda_video_image
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          VERSION: ${{ steps.version.outputs.version }}
-          REPO: ${{ github.repository }}
-        run: |
-          # A retried run reuses the image already on the release, so the pin still matches it.
-          if gh release download "v${VERSION}" --repo "$REPO" --pattern hyperframes-lambda-video-arm64.oci.tar --dir dist; then
-            echo "attached=true" >> "$GITHUB_OUTPUT"
-          else
-            bun packages/aws-lambda/scripts/stage-arm64-image.ts --zip=dist/hyperframes-lambda-handler.zip \
-              --ffmpeg=dist/hf-media/hf-media-linux-aarch64.tar.gz --out=dist/arm64-image
-            # OCI export needs a docker-container builder; no attestations, so index.json lists one image.
-            docker buildx create --use
-            docker buildx build --progress=plain --platform linux/arm64 --target video \
-              --provenance=false --sbom=false --build-context task=dist/arm64-image/task \
-              --output type=oci,dest=dist/hyperframes-lambda-video-arm64.oci.tar packages/aws-lambda/image
-          fi
-          bun packages/aws-lambda/scripts/pin-handler-zip.ts --video-image
-
-      - run: bun run verify:packed-manifests
-
-      - name: Create GitHub Release
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          VERSION: ${{ steps.version.outputs.version }}
-          PRERELEASE: ${{ steps.version.outputs.prerelease }}
-          REPO: ${{ github.repository }}
-        run: |
-          NOTES_FILE="releases/v${VERSION}.md"
-
-          # Skip if release already exists (idempotent re-runs)
-          if gh release view "v${VERSION}" --repo "$REPO" >/dev/null 2>&1; then
-            echo "Release v${VERSION} already exists — skipping"
-          else
-            FLAGS=(--repo "$REPO" --title "v${VERSION}")
-            if [ -f "$NOTES_FILE" ]; then
-              FLAGS+=(--notes-file "$NOTES_FILE")
-            else
-              echo "No reviewed release notes found at $NOTES_FILE — using GitHub generated notes"
-              FLAGS+=(--generate-notes)
-            fi
-            if [ "$PRERELEASE" = "true" ]; then
-              FLAGS+=(--prerelease)
-            fi
-            gh release create "v${VERSION}" "${FLAGS[@]}"
-          fi
-
-      - name: Attach Lambda handler zip to release
-        if: steps.lambda_zip.outputs.attached != 'true'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          VERSION: ${{ steps.version.outputs.version }}
-          REPO: ${{ github.repository }}
-        run: gh release upload "v${VERSION}" dist/hyperframes-lambda-handler.zip dist/hyperframes-lambda-handler.sha256 --repo "$REPO"
-
-      - name: Attach Lambda video image to release
-        if: steps.lambda_video_image.outputs.attached != 'true'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          VERSION: ${{ steps.version.outputs.version }}
-          REPO: ${{ github.repository }}
-        run: gh release upload "v${VERSION}" dist/hyperframes-lambda-video-arm64.oci.tar dist/hyperframes-lambda-video-arm64.sha256 --repo "$REPO"
-
-      - name: Publish packages
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          VERSION: ${{ steps.version.outputs.version }}
-          DIST_TAG: ${{ steps.version.outputs.dist_tag }}
-        run: |
-          FAILED=0
-
-          publish_pkg() {
-            local filter="$1"
-            local name="$2"
-
-            # Check if this version is already published
-            if npm view "${name}@${VERSION}" version >/dev/null 2>&1; then
-              echo "⏭️  ${name}@${VERSION} already published — skipping"
-              return 0
-            fi
-
-            echo "📦 Publishing ${name}@${VERSION}..."
-            if pnpm --filter "$filter" publish --access public --no-git-checks --tag "$DIST_TAG"; then
-              echo "✅ ${name}@${VERSION} published"
-            else
-              echo "❌ ${name}@${VERSION} failed to publish"
-              FAILED=1
-            fi
-          }
-
-          publish_pkg "@hyperframes/parsers" "@hyperframes/parsers"
-          publish_pkg "@hyperframes/lint" "@hyperframes/lint"
-          publish_pkg "@hyperframes/studio-server" "@hyperframes/studio-server"
-          publish_pkg "@hyperframes/core" "@hyperframes/core"
-          publish_pkg "@hyperframes/inspector" "@hyperframes/inspector"
-          publish_pkg "@hyperframes/sdk" "@hyperframes/sdk"
-          publish_pkg "@hyperframes/engine" "@hyperframes/engine"
-          publish_pkg "@hyperframes/player" "@hyperframes/player"
-          publish_pkg "@hyperframes/producer" "@hyperframes/producer"
-          publish_pkg "@hyperframes/shader-transitions" "@hyperframes/shader-transitions"
-          publish_pkg "@hyperframes/studio" "@hyperframes/studio"
-          publish_pkg "@hyperframes/aws-lambda" "@hyperframes/aws-lambda"
-          publish_pkg "@hyperframes/gcp-cloud-run" "@hyperframes/gcp-cloud-run"
-
-          # CLI is @hyperframes/cli in the monorepo but published as unscoped "hyperframes" on npm.
-          # Rewrite the name in package.json before publishing, then use npm publish directly
-          # since pnpm --filter won't match the rewritten name.
-          if npm view "hyperframes@${VERSION}" version >/dev/null 2>&1; then
-            echo "⏭️  hyperframes@${VERSION} already published — skipping"
-          else
-            node -e "
-              const fs = require('fs');
-              const p = 'packages/cli/package.json';
-              const pkg = JSON.parse(fs.readFileSync(p, 'utf8'));
-              pkg.name = 'hyperframes';
-              fs.writeFileSync(p, JSON.stringify(pkg, null, 2) + '\n');
-            "
-            echo "📦 Publishing hyperframes@${VERSION}..."
-            if (cd packages/cli && npm publish --access public --tag "$DIST_TAG"); then
-              echo "✅ hyperframes@${VERSION} published"
-            else
-              echo "❌ hyperframes@${VERSION} failed to publish"
-              FAILED=1
-            fi
-          fi
-
-          if [ "$FAILED" -ne 0 ]; then
-            echo "::error::One or more packages failed to publish"
-            exit 1
-          fi
-
-      - name: Build portable agent plugin
-        run: node scripts/package-agent-plugin.mjs
-
-      - name: Attach portable plugin to release
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          VERSION: ${{ steps.version.outputs.version }}
-          REPO: ${{ github.repository }}
-        run: gh release upload "v${VERSION}" dist/hyperframes-agent-plugin.zip dist/hyperframes-agent-plugin.sha256 dist/hyperframes-agent-plugin.json --repo "$REPO" --clobber
diff --git a/.github/workflows/regression.yml b/.github/workflows/regression.yml
deleted file mode 100644
index 80ae8382802..00000000000
--- a/.github/workflows/regression.yml
+++ /dev/null
@@ -1,211 +0,0 @@
-name: regression
-run-name: ${{ github.event_name == 'workflow_dispatch' && format('Checks (catalog_publish={0})', inputs.catalog_publish) || '' }}
-
-permissions:
-  contents: read
-
-# Suppress hyperframes CLI telemetry from HeyGen's own CI runs.
-# External users' CI continues to emit telemetry unless they set this themselves.
-env:
-  HYPERFRAMES_NO_TELEMETRY: "1"
-
-# Graphite can update a branch and its PR base separately for the same head
-# SHA. Keep only the newest expensive regression run for each PR/ref.
-concurrency:
-  group: regression-${{ github.event.pull_request.number || github.ref }}${{ github.event_name == 'schedule' && '-nightly' || '' }}
-  # A body or title edit queues behind running checks instead of cancelling them.
-  cancel-in-progress: ${{ github.event.action != 'edited' || github.event.changes.base != null }}
-
-on:
-  merge_group:
-    types: [checks_requested]
-  workflow_dispatch:
-    inputs:
-      catalog_publish:
-        description: "Run required checks for a generated catalog publication."
-        type: boolean
-        default: false
-  pull_request:
-    # Re-run when Graphite changes only the PR base for the same head SHA.
-    types: [opened, synchronize, reopened, edited]
-  push:
-    branches:
-      - main
-  schedule:
-    # Daily at 06:17 UTC: the full suite, including fixtures too slow for every PR.
-    - cron: "17 6 * * *"
-
-jobs:
-  changes:
-    name: Detect changes
-    runs-on: ubuntu-latest
-    timeout-minutes: 8
-    permissions:
-      actions: read
-      contents: read
-    outputs:
-      code: ${{ (github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.catalog_publish)) && 'true' || steps.edit.outputs.passed == 'true' && 'false' || steps.release.outputs.release_only == 'true' && 'false' || steps.filter.outputs.code }}
-      matrix: ${{ steps.shards.outputs.matrix }}
-    steps:
-      # Force git-based change detection instead of the pull_request REST API.
-      # The API path can fail the whole workflow on transient listFiles
-      # timeouts before any regression shard even starts.
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        timeout-minutes: 3
-      - name: Fetch the history the diffs read
-        timeout-minutes: 2
-        uses: ./.github/actions/fetch-history
-      - name: Check whether this commit already passed before a title or body edit
-        id: edit
-        uses: ./.github/actions/edit-already-passed
-      # HEAD is the PR merge ref; its first parent is the current base tip, unlike the payload's
-      # base.sha, which goes stale and would count the base's newer commits as the PR's changes.
-      - name: Find the pull request's current base
-        id: base
-        if: github.event_name == 'pull_request'
-        run: |
-          git rev-parse --verify -q HEAD^2 > /dev/null || { echo "::error::HEAD is not the pull request merge commit"; exit 1; }
-          sha="$(git rev-parse --verify HEAD^1)"
-          echo "sha=$sha" >> "$GITHUB_OUTPUT"
-      - name: Find a release-only diff
-        id: release
-        uses: ./.github/actions/release-only-diff
-      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4
-        id: filter
-        if: github.event_name != 'schedule' && steps.edit.outputs.passed != 'true'
-        with:
-          token: ""
-          base: ${{ steps.base.outputs.sha }}
-          filters: |
-            code:
-              - "packages/core/**"
-              - "packages/producer/**"
-              - "packages/engine/**"
-              - "Dockerfile*"
-              - ".github/workflows/regression.yml"
-      # Bin-pack the shard matrix from recorded per-fixture timings rather than
-      # a hand-written list. Fails if any fixture on disk is neither scheduled
-      # nor explicitly excluded, so a new fixture cannot silently never run.
-      - name: Plan regression shards
-        id: shards
-        env:
-          NIGHTLY: ${{ github.event_name == 'schedule' && '--nightly' || '' }}
-        run: |
-          echo "matrix=$(node packages/producer/scripts/plan-regression-shards.mjs $NIGHTLY)" >> "$GITHUB_OUTPUT"
-          node packages/producer/scripts/plan-regression-shards.mjs $NIGHTLY --pretty
-
-  preflight:
-    name: Preflight (lint + format)
-    needs: changes
-    if: needs.changes.outputs.code == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: ./.github/actions/preflight
-
-  regression-shards:
-    needs: [changes, preflight]
-    if: needs.changes.outputs.code == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    strategy:
-      fail-fast: true
-      # Bin-packed at run time from packages/producer/tests/shard-schedule.json.
-      # To rebalance, refresh the timings in that file — no YAML edit needed.
-      # To change shard count, set "shardCount" there.
-      matrix: ${{ fromJSON(needs.changes.outputs.matrix) }}
-    steps:
-      - name: Checkout (with LFS)
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          lfs: true
-
-      - name: Validate LFS files
-        run: |
-          echo "Checking golden baseline MP4s are real files (not LFS pointers)..."
-          for mp4 in packages/producer/tests/*/output/output.mp4; do
-            if [ -f "$mp4" ]; then
-              size=$(stat --format=%s "$mp4")
-              if [ "$size" -lt 1000 ]; then
-                echo "ERROR: $mp4 appears to be an LFS pointer ($size bytes)"
-                exit 1
-              fi
-              echo "OK: $mp4 ($size bytes)"
-            fi
-          done
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
-        with:
-          # Docker Hub rate-limits anonymous pulls from shared runners; pull through Google's mirror.
-          driver-opts: image=mirror.gcr.io/moby/buildkit:buildx-stable-1
-          buildkitd-config-inline: |
-            [registry."docker.io"]
-              mirrors = ["mirror.gcr.io"]
-
-      - name: Build test Docker image (cached)
-        # Normal duration is ~3 min; a bun install that errors and hangs
-        # instead of exiting (run 35468046055) otherwise runs unbounded until
-        # someone notices and cancels it. Fail fast so a shard fails, not stalls.
-        timeout-minutes: 20
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
-        with:
-          context: .
-          file: Dockerfile.test
-          load: true
-          tags: hyperframes-producer:test
-          cache-from: type=gha,scope=regression-test-image
-          # One writer: the first shard of a main push. Every shard rebuilds the same layers with
-          # different digests, so each export added ~1.3 GB and evicted the rest of the 10 GB cache.
-          cache-to: ${{ github.event_name == 'push' && strategy.job-index == 0 && 'type=gha,mode=max,scope=regression-test-image' || '' }}
-
-      - name: "Run regression shard: ${{ matrix.shard }} (${{ matrix.mode }})"
-        run: |
-          echo "Shard: ${{ matrix.shard }}"
-          echo "Mode:  ${{ matrix.mode }}"
-          echo "Args:  ${{ matrix.args }}"
-          docker run --rm \
-            -e HYPERFRAMES_NO_TELEMETRY=1 \
-            --security-opt seccomp=unconfined \
-            --shm-size=4g \
-            -v ${{ github.workspace }}/packages/producer/tests:/app/packages/producer/tests \
-            hyperframes-producer:test \
-            --mode=${{ matrix.mode }} \
-            ${{ matrix.args }}
-
-      - name: Upload failure artifacts
-        if: failure()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: regression-failures-${{ matrix.shard }}
-          path: packages/producer/tests/*/failures/
-          if-no-files-found: ignore
-
-  # Summary job — matches the required check name in branch protection
-  regression:
-    runs-on: ubuntu-latest
-    needs: [changes, regression-shards]
-    if: always()
-    steps:
-      - name: Check results
-        env:
-          CHANGES_RESULT: ${{ needs.changes.result }}
-          CODE_CHANGED: ${{ needs.changes.outputs.code }}
-          SHARDS_RESULT: ${{ needs.regression-shards.result }}
-        run: |
-          if [ "$CHANGES_RESULT" != "success" ]; then
-            echo "::error::Change detection did not succeed."
-            exit 1
-          fi
-          case "$CODE_CHANGED" in
-            false) echo "No regression code changes." ;;
-            true)
-              if [ "$SHARDS_RESULT" != "success" ]; then
-                echo "::error::Regression shards did not succeed."
-                exit 1
-              fi
-              echo "All regression shards succeeded."
-              ;;
-            *) echo "::error::Change detection returned no valid decision."; exit 1 ;;
-          esac
diff --git a/.github/workflows/studio-drag-frames.yml b/.github/workflows/studio-drag-frames.yml
deleted file mode 100644
index 54553941f2a..00000000000
--- a/.github/workflows/studio-drag-frames.yml
+++ /dev/null
@@ -1,85 +0,0 @@
-name: Studio drag frames
-
-permissions:
-  contents: read
-
-env:
-  HYPERFRAMES_NO_TELEMETRY: "1"
-
-# Measures drag smoothness on a runner with nothing else on it. The bench measures a blank page per case
-# in the same run, and the box only counts as quiet if that control dropped no frame anywhere.
-on:
-  workflow_dispatch:
-    inputs:
-      ref:
-        description: Commit, branch or tag to measure
-        default: main
-      filter:
-        description: Case ids to run (a regular expression)
-        default: "^(move|resize|rotate|crop)-(none|tween)-px-r0-root-z100$"
-      grid:
-        description: The grid the ids come from (pr or full)
-        default: pr
-  pull_request:
-    paths:
-      - ".github/workflows/studio-drag-frames.yml"
-
-jobs:
-  drag-frames:
-    name: "Studio: drag frames (run ${{ matrix.run }})"
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    strategy:
-      fail-fast: false
-      matrix:
-        run: [1, 2, 3, 4, 5]
-    env:
-      BENCH_REF: ${{ inputs.ref || 'main' }}
-      BENCH_FILTER: ${{ inputs.filter || '^(move|resize|rotate|crop)-(none|tween)-px-r0-root-z100$' }}
-      BENCH_GRID: ${{ inputs.grid || 'pr' }}
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          ref: ${{ env.BENCH_REF }}
-          lfs: true
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-      - run: corepack enable
-      - run: corepack prepare pnpm@10.17.1 --activate
-      - uses: ./.github/actions/prepare-ffmpeg-bin
-      - run: bash scripts/ci/install-workspace-dependencies.sh
-      - run: bun run build
-      - run: node packages/cli/dist/cli.js browser ensure
-      - name: Run the drag cases
-        working-directory: packages/studio
-        run: |
-          set -euo pipefail
-          echo "Measuring $(git rev-parse HEAD)"
-          bun tests/e2e/edit-accuracy/run.mjs --grid "$BENCH_GRID" --filter "$BENCH_FILTER" \
-            --jobs 1 --port 5961 --cli "$GITHUB_WORKSPACE/packages/cli/dist/cli.js" \
-            --out "$RUNNER_TEMP/drag-frames/run-${{ matrix.run }}"
-      - name: Require a quiet box (the blank page dropped no frame)
-        run: |
-          # shellcheck disable=SC2016 # the backticks are JavaScript template strings
-          node -e '
-            const fs = require("fs"), dir = process.env.RUNNER_TEMP + "/drag-frames";
-            let noisy = 0;
-            for (const run of fs.readdirSync(dir)) {
-              const { cases } = JSON.parse(fs.readFileSync(`${dir}/${run}/results.json`, "utf8"));
-              for (const c of cases) {
-                const dropped = c.smooth?.control?.dropped;
-                if (dropped !== 0) { noisy++; console.log(`${run} ${c.id} control dropped=${dropped}`); }
-              }
-            }
-            if (noisy) { console.log(`::error::the blank page dropped frames, or went unmeasured, in ${noisy} case(s); this box is not quiet`); process.exit(1); }
-            console.log("the blank page dropped 0 frames in every case of every run");
-          '
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        if: always()
-        with:
-          name: studio-drag-frames-${{ matrix.run }}
-          path: ${{ runner.temp }}/drag-frames
-          if-no-files-found: error
-          retention-days: 30
diff --git a/.github/workflows/sync-skills-to-clawhub.yml b/.github/workflows/sync-skills-to-clawhub.yml
deleted file mode 100644
index 7c6b76292a8..00000000000
--- a/.github/workflows/sync-skills-to-clawhub.yml
+++ /dev/null
@@ -1,62 +0,0 @@
-name: Sync skills to ClawHub
-
-# Publishes changed skills under skills/ to ClawHub (https://clawhub.ai/heygen-com)
-# whenever they land on main. `clawhub sync` only publishes skills whose content
-# changed vs. the registry, auto-bumping the patch version — unchanged skills are
-# a no-op, so this is safe to run on every push. Skills listed in RETIRED_SKILLS
-# (packages/cli/src/utils/skillsManifest.ts) are hidden once, then left alone.
-
-on:
-  push:
-    branches: [main]
-    paths:
-      - "skills/**"
-      - "scripts/clawhub-sync.mjs"
-      - "scripts/clawhub-unlist-retired.mjs"
-      - "packages/cli/src/utils/skillsManifest.ts"
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: "Preview what would publish or be hidden, without changing ClawHub"
-        type: boolean
-        default: false
-
-# Serialize runs so two pushes don't race on the same skill version.
-concurrency:
-  group: clawhub-sync
-  cancel-in-progress: false
-
-permissions:
-  contents: read
-
-jobs:
-  sync:
-    name: Publish changed skills
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    env:
-      CLAWHUB_DISABLE_TELEMETRY: "1"
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-
-      - name: Install ClawHub CLI
-        run: npm i -g clawhub@0.23.1
-
-      - name: Authenticate
-        env:
-          CLAWHUB_TOKEN: ${{ secrets.CLAWHUB_TOKEN }}
-        run: clawhub login --token "$CLAWHUB_TOKEN" --no-input --label "hyperframes CI"
-
-      - name: Sync skills
-        env:
-          DRY_RUN: ${{ github.event.inputs.dry_run }}
-        run: node scripts/clawhub-sync.mjs
-
-      - name: Hide retired skills
-        env:
-          DRY_RUN: ${{ github.event.inputs.dry_run }}
-        run: node scripts/clawhub-unlist-retired.mjs
diff --git a/.github/workflows/windows-render.yml b/.github/workflows/windows-render.yml
deleted file mode 100644
index bde7e5e584e..00000000000
--- a/.github/workflows/windows-render.yml
+++ /dev/null
@@ -1,591 +0,0 @@
-name: Windows render verification
-
-permissions:
-  contents: read
-
-# Suppress hyperframes CLI telemetry from HeyGen's own CI runs.
-# External users' CI continues to emit telemetry unless they set this themselves.
-env:
-  HYPERFRAMES_NO_TELEMETRY: "1"
-
-# Manually triggered smoke test that renders a HyperFrames composition on a
-# real Windows runner. Proves the PR #336 `where ffmpeg` fix actually works
-# end-to-end: FFmpeg is discovered natively on Windows, Chrome is installed
-# and launched, frames are captured, and an MP4 is produced — without Docker
-# or WSL.
-
-on:
-  merge_group:
-    types: [checks_requested]
-  pull_request:
-    # `edited` is required so the workflow re-fires when a PR's base ref is
-    # set back to `main` after a Graphite stack restack momentarily flips
-    # the base off of `main`. Without it, `pull_request` triggers are not
-    # re-evaluated on `base_ref_changed`, leaving required checks skipped
-    # for that head SHA forever.
-    types: [opened, synchronize, reopened, edited]
-    branches: [main]
-  push:
-    branches: [main]
-  workflow_dispatch:
-    inputs:
-      ref:
-        description: "Git ref to render (branch / tag / SHA)."
-        required: false
-        default: ""
-
-concurrency:
-  group: windows-render-${{ github.ref }}
-  # A body or title edit queues behind running checks instead of cancelling them.
-  cancel-in-progress: ${{ github.event.action != 'edited' || github.event.changes.base != null }}
-
-jobs:
-  changes:
-    name: Detect changes
-    runs-on: ubuntu-latest
-    timeout-minutes: 8
-    permissions:
-      actions: read
-      contents: read
-    outputs:
-      code: ${{ steps.release.outputs.release_only == 'true' && 'false' || steps.filter.outputs.code }}
-    steps:
-      # Force git-based change detection instead of the pull_request REST API.
-      # The API path can fail the workflow on transient listFiles timeouts
-      # before the Windows render jobs even start.
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        timeout-minutes: 3
-      - name: Fetch the history the diffs read
-        timeout-minutes: 2
-        uses: ./.github/actions/fetch-history
-      - name: Check whether this commit already passed before a title or body edit
-        id: edit
-        uses: ./.github/actions/edit-already-passed
-      # HEAD is the PR merge ref; its first parent is the current base tip, unlike the payload's
-      # base.sha, which goes stale and would count the base's newer commits as the PR's changes.
-      - name: Find the pull request's current base
-        id: base
-        if: github.event_name == 'pull_request'
-        run: |
-          git rev-parse --verify -q HEAD^2 > /dev/null || { echo "::error::HEAD is not the pull request merge commit"; exit 1; }
-          sha="$(git rev-parse --verify HEAD^1)"
-          echo "sha=$sha" >> "$GITHUB_OUTPUT"
-      - name: Find a release-only diff
-        id: release
-        uses: ./.github/actions/release-only-diff
-      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4
-        id: filter
-        if: steps.edit.outputs.passed != 'true'
-        with:
-          token: ""
-          base: ${{ steps.base.outputs.sha }}
-          # A file counts only if it matches every pattern. Player and Studio `src/` run in a browser
-          # and no code reads a package README, so a diff confined to them skips Windows.
-          predicate-quantifier: every
-          filters: |
-            code:
-              - "{packages/**,scripts/**,package.json,bun.lock,.github/workflows/windows-render.yml}"
-              - "!packages/player/src/**"
-              - "!packages/studio/src/**"
-              - "!packages/*/README.md"
-
-  preflight:
-    name: Preflight (lint + format)
-    needs: changes
-    if: needs.changes.outputs.code == 'true' || github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          ref: ${{ inputs.ref || github.sha }}
-      - uses: ./.github/actions/preflight
-
-  render-windows:
-    name: Render on windows-latest
-    needs: [changes, preflight]
-    # A skipped required check passes, so a failed change detection or preflight must fail it.
-    if: ${{ !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.code == 'true' || github.event_name == 'workflow_dispatch') }}
-    runs-on: windows-latest
-    timeout-minutes: 30
-
-    steps:
-      - name: Require change detection and the preflight
-        if: needs.changes.result != 'success' || needs.preflight.result != 'success'
-        shell: bash
-        run: |
-          echo "::error::changes=${{ needs.changes.result }} preflight=${{ needs.preflight.result }}; this required check cannot pass."
-          exit 1
-
-      - name: Disable Windows Defender real-time monitoring
-        shell: pwsh
-        continue-on-error: true
-        run: Set-MpPreference -DisableRealtimeMonitoring $true
-
-      - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          ref: ${{ inputs.ref || github.sha }}
-          lfs: true
-
-      - name: Show platform info
-        shell: pwsh
-        run: |
-          Write-Host "OS: $([System.Environment]::OSVersion.VersionString)"
-          Write-Host "PowerShell: $($PSVersionTable.PSVersion)"
-          Write-Host "Runner: windows-latest"
-
-      # -----------------------------------------------------------------
-      # Install FFmpeg via the shared composite action so the install logic
-      # stays identical between this job and `test-windows` below. See
-      # .github/actions/install-ffmpeg-windows for why we bypass Chocolatey.
-      # -----------------------------------------------------------------
-      - name: Install FFmpeg
-        uses: ./.github/actions/install-ffmpeg-windows
-
-      - name: Set FFMPEG_BIN for bun install
-        shell: pwsh
-        run: |
-          $path = (Get-Command ffmpeg.exe).Source
-          "FFMPEG_BIN=$path" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
-
-      # -----------------------------------------------------------------
-      # Verify FFmpeg feature inventory.
-      #
-      # The engine shells out to a fixed set of encoders (libx264 for MP4,
-      # libx265 for HEVC, libvpx-vp9 for WebM, prores_ks for transparent
-      # MOV, aac for audio), muxers (mp4 / mov / webm), and demuxers
-      # (image2pipe for streaming RGBA frames, rawvideo for HDR PQ frames,
-      # mov,mp4 for video frame extraction). Some of these are GPL-only,
-      # so a future build swap could silently drop one and break a code
-      # path the canary render doesn't exercise. Fail fast here instead.
-      # -----------------------------------------------------------------
-      - name: Verify FFmpeg feature inventory
-        shell: pwsh
-        run: |
-          $ErrorActionPreference = 'Stop'
-
-          function Assert-FfmpegFeature {
-            param(
-              [Parameter(Mandatory)] [string] $Listing,
-              [Parameter(Mandatory)] [string] $Name,
-              [Parameter(Mandatory)] [string] $Kind
-            )
-            # `ffmpeg -encoders` etc. emit one feature per line as
-            # `<flags> <name> <description>`, so a whitespace boundary on
-            # each side is enough to disambiguate (e.g. `mov` vs `movflags`).
-            $pattern = "(^|\s)$([regex]::Escape($Name))(\s|$)"
-            if ($Listing -notmatch $pattern) {
-              throw "Required FFmpeg $Kind '$Name' not present in this build"
-            }
-            Write-Host "  ok: $Kind $Name"
-          }
-
-          Write-Host "--- encoders ---"
-          $encoders = (& ffmpeg -hide_banner -encoders 2>&1) -join "`n"
-          foreach ($enc in @('libx264', 'libx265', 'libvpx-vp9', 'prores_ks', 'aac')) {
-            Assert-FfmpegFeature -Listing $encoders -Name $enc -Kind 'encoder'
-          }
-
-          Write-Host "--- muxers ---"
-          $muxers = (& ffmpeg -hide_banner -muxers 2>&1) -join "`n"
-          foreach ($mux in @('mp4', 'mov', 'webm')) {
-            Assert-FfmpegFeature -Listing $muxers -Name $mux -Kind 'muxer'
-          }
-
-          Write-Host "--- demuxers ---"
-          $demuxers = (& ffmpeg -hide_banner -demuxers 2>&1) -join "`n"
-          foreach ($dem in @('image2pipe', 'rawvideo', 'mov,mp4,m4a,3gp,3g2,mj2')) {
-            Assert-FfmpegFeature -Listing $demuxers -Name $dem -Kind 'demuxer'
-          }
-
-      - name: Install Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-
-      - name: Install Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-
-      - name: Install dependencies
-        shell: pwsh
-        # Force the pre-1.3 "hoisted" linker on Windows. Bun 1.3.x's default
-        # "isolated" linker creates nested workspace junctions that don't
-        # materialize reliably on Windows GHA runners — manifests as
-        # `Cannot find package 'esbuild'` walking up from
-        # `packages/producer/build.mjs` and `EPERM stat` on
-        # `packages/producer/node_modules/@fontsource/*` from generators.
-        # See oven-sh/bun#23615, #18354, #10146. Linux CI keeps isolated;
-        # the lockfile is linker-agnostic so this flag is safe with
-        # --frozen-lockfile.
-        run: bun install --frozen-lockfile --linker=hoisted
-
-      # The CLI bundle consumes Engine and Producer from source, but copies the
-      # built Studio, Player and Inspector artifacts. Build only that dependency chain;
-      # cloud adapters, SDK playground, and other publish-only packages are not
-      # exercised by this Windows render smoke test.
-      - name: Build render prerequisites
-        shell: pwsh
-        run: |
-          bun run --filter '@hyperframes/{parsers,lint,studio-server}' build
-          bun run --cwd packages/core build
-          bun run --filter @hyperframes/player build
-          bun run --filter @hyperframes/studio build
-          bun run --filter @hyperframes/inspector build
-          bun run --filter @hyperframes/cli build
-
-      # -----------------------------------------------------------------
-      # Prove the PR #336 fix: hyperframes doctor exercises findFFmpeg()
-      # and whichBinary() — both must pass on Windows without workarounds.
-      # -----------------------------------------------------------------
-      - name: hyperframes doctor (verifies `where ffmpeg` fix)
-        shell: pwsh
-        run: node packages/cli/dist/cli.js doctor
-
-      - name: Scaffold canary composition
-        shell: pwsh
-        # Skip skill installation and GitHub checks to keep the canary scaffold offline.
-        env:
-          HYPERFRAMES_SKIP_SKILLS: "1"
-        run: |
-          New-Item -ItemType Directory -Force -Path "$env:RUNNER_TEMP\windows-canary" | Out-Null
-          cd "$env:RUNNER_TEMP\windows-canary"
-          node "$env:GITHUB_WORKSPACE\packages\cli\dist\cli.js" init canary --example blank --non-interactive --skip-skills
-
-          $fixtures = "$env:GITHUB_WORKSPACE\.github\workflows\fixtures"
-          Copy-Item "$fixtures\windows-canary.html" "canary\index.html" -Force
-
-      - name: Render canary composition
-        shell: pwsh
-        run: |
-          cd "$env:RUNNER_TEMP\windows-canary\canary"
-          node "$env:GITHUB_WORKSPACE\packages\cli\dist\cli.js" render `
-            --fps 30 `
-            --quality draft `
-            --workers 2 `
-            --output renders\canary.mp4
-
-      - name: Verify rendered MP4
-        shell: pwsh
-        run: |
-          $mp4 = "$env:RUNNER_TEMP\windows-canary\canary\renders\canary.mp4"
-          if (-not (Test-Path $mp4)) { throw "canary.mp4 not produced" }
-
-          $probe = ffprobe -v error -select_streams v:0 `
-            -show_entries stream=width,height,r_frame_rate -show_entries format=duration `
-            -of default=noprint_wrappers=1 $mp4
-          Write-Host $probe
-
-          # Parse probe output
-          $width    = ($probe | Select-String '^width=(.+)$').Matches.Groups[1].Value
-          $height   = ($probe | Select-String '^height=(.+)$').Matches.Groups[1].Value
-          $fps      = ($probe | Select-String '^r_frame_rate=(.+)$').Matches.Groups[1].Value
-          $duration = [double]($probe | Select-String '^duration=(.+)$').Matches.Groups[1].Value
-
-          if ([int]$width  -ne 1920) { throw "expected 1920 width, got $width" }
-          if ([int]$height -ne 1080) { throw "expected 1080 height, got $height" }
-          if ($fps -ne "30/1")       { throw "expected 30fps, got $fps" }
-          if ($duration -lt 7.5 -or $duration -gt 8.5) { throw "expected ~8s duration, got $duration" }
-
-          Write-Host "canary.mp4 ok: ${width}x${height} @ $fps, ${duration}s"
-
-      - name: Scaffold issue #574 reused-video regression
-        shell: pwsh
-        run: |
-          $ErrorActionPreference = 'Stop'
-
-          $project = "$env:RUNNER_TEMP\issue-574-reused-video"
-          New-Item -ItemType Directory -Force -Path $project | Out-Null
-          cd $project
-
-          ffmpeg -y `
-            -f lavfi -i "testsrc2=size=1920x1080:rate=30:duration=12" `
-            -f lavfi -i "sine=frequency=880:sample_rate=48000:duration=12" `
-            -c:v libx264 `
-            -pix_fmt yuv420p `
-            -r 30 `
-            -g 250 `
-            -keyint_min 250 `
-            -c:a aac `
-            -shortest `
-            1.mp4
-
-          @'
-          <!doctype html>
-          <html lang="en">
-            <head>
-              <meta charset="UTF-8" />
-              <title>Issue 574 reused video regression</title>
-              <style>
-                html,
-                body {
-                  margin: 0;
-                  padding: 0;
-                  background: #000;
-                }
-
-                #root {
-                  position: relative;
-                  width: 1920px;
-                  height: 1080px;
-                  overflow: hidden;
-                  background: #000;
-                }
-
-                video {
-                  position: absolute;
-                  inset: 0;
-                  width: 100%;
-                  height: 100%;
-                  object-fit: cover;
-                }
-              </style>
-            </head>
-            <body>
-              <div
-                id="root"
-                data-composition-id="root"
-                data-start="0"
-                data-duration="12"
-                data-width="1920"
-                data-height="1080"
-              >
-                <video id="video1" src="1.mp4" data-start="0" muted data-duration="4" data-track-index="0" data-media-start="0"></video>
-                <video id="video2" src="1.mp4" data-start="4" muted data-duration="4" data-track-index="0" data-media-start="4"></video>
-                <video id="video3" src="1.mp4" data-start="8" muted data-duration="4" data-track-index="0" data-media-start="8"></video>
-              </div>
-              <script>
-                window.__timelines = window.__timelines || {};
-              </script>
-            </body>
-          </html>
-          '@ | Set-Content -Path index.html -Encoding utf8
-
-      - name: Render issue #574 reused-video regression
-        shell: pwsh
-        env:
-          PRODUCER_PLAYER_READY_TIMEOUT_MS: "15000"
-        run: |
-          cd "$env:RUNNER_TEMP\issue-574-reused-video"
-          node "$env:GITHUB_WORKSPACE\packages\cli\dist\cli.js" render `
-            --fps 30 `
-            --quality standard `
-            --workers 1 `
-            --output renders\issue-574.mp4
-
-      - name: Verify issue #574 rendered MP4
-        shell: pwsh
-        run: |
-          $mp4 = "$env:RUNNER_TEMP\issue-574-reused-video\renders\issue-574.mp4"
-          if (-not (Test-Path $mp4)) { throw "issue-574.mp4 not produced" }
-
-          $probe = ffprobe -v error -select_streams v:0 `
-            -show_entries stream=width,height,r_frame_rate -show_entries format=duration `
-            -of default=noprint_wrappers=1 $mp4
-          Write-Host $probe
-
-          $width    = ($probe | Select-String '^width=(.+)$').Matches.Groups[1].Value
-          $height   = ($probe | Select-String '^height=(.+)$').Matches.Groups[1].Value
-          $fps      = ($probe | Select-String '^r_frame_rate=(.+)$').Matches.Groups[1].Value
-          $duration = [double]($probe | Select-String '^duration=(.+)$').Matches.Groups[1].Value
-
-          if ([int]$width  -ne 1920) { throw "expected 1920 width, got $width" }
-          if ([int]$height -ne 1080) { throw "expected 1080 height, got $height" }
-          if ($fps -ne "30/1")       { throw "expected 30fps, got $fps" }
-          if ($duration -lt 11.5 -or $duration -gt 12.5) { throw "expected ~12s duration, got $duration" }
-
-          Write-Host "issue-574.mp4 ok: ${width}x${height} @ $fps, ${duration}s"
-
-      - name: Upload rendered MP4 artifact
-        if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: windows-render-${{ github.run_id }}
-          path: |
-            ${{ runner.temp }}/windows-canary/canary/renders/canary.mp4
-            ${{ runner.temp }}/issue-574-reused-video/renders/issue-574.mp4
-          if-no-files-found: error
-          retention-days: 7
-
-  # -------------------------------------------------------------------
-  # Unit-test suites on Windows. Mirrors the Linux `test` job in ci.yml
-  # so we catch Windows-specific regressions (path separators, shell
-  # invocations, CRLF, file URLs, etc.) in existing vitest suites.
-  # The producer package is skipped because its tests require Docker /
-  # Linux-only tooling (Dockerfile.test, LFS golden MP4 baselines).
-  # The aws-lambda package is skipped because it targets the AWS Lambda
-  # Linux runtime exclusively (`@sparticuz/chromium` is Linux-only; the
-  # ZIP layout is for `/var/task` on AL2023). Its handler.test.ts also
-  # trips a bun-on-Windows workspace-symlink quirk reading the
-  # producer's transitive `hono` dep.
-  # -------------------------------------------------------------------
-  test-windows-lane:
-    name: "Tests on windows-latest: ${{ matrix.lane }}"
-    needs: [changes, preflight]
-    if: needs.changes.outputs.code == 'true' || github.event_name == 'workflow_dispatch'
-    runs-on: windows-latest
-    timeout-minutes: 30
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          # One suite group per runner: Studio's halves and the process-heavy Engine and CLI
-          # suites never share a runner, and no lane waits for another group's tests.
-          - lane: studio-1
-            studio_shard: 1/2
-          - lane: studio-2
-            studio_shard: 2/2
-          - lane: core
-            packages: --filter @hyperframes/core --filter @hyperframes/player --filter @hyperframes/shader-transitions
-          - lane: engine-cli
-            packages: --filter @hyperframes/engine --filter @hyperframes/cli
-            runtime_contract: true
-
-    steps:
-      - name: Disable Windows Defender real-time monitoring
-        shell: pwsh
-        continue-on-error: true
-        run: Set-MpPreference -DisableRealtimeMonitoring $true
-
-      - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          ref: ${{ inputs.ref || github.sha }}
-          # Only the engine-cli lane reads an LFS file (engine's ffprobe test parses a producer HDR PNG).
-          lfs: ${{ matrix.lane == 'engine-cli' }}
-
-      # -----------------------------------------------------------------
-      # Install FFmpeg so vitest suites that gate on `HAS_FFMPEG`
-      # (e.g. packages/engine videoFrameExtractor.test.ts) actually run on
-      # Windows. Without it those suites `describe.skipIf(!HAS_FFMPEG)`
-      # themselves silently and any Windows-specific regression in the
-      # FFmpeg-driven code paths would not be caught here.
-      # -----------------------------------------------------------------
-      - name: Install FFmpeg
-        uses: ./.github/actions/install-ffmpeg-windows
-
-      - name: Set FFMPEG_BIN for bun install
-        shell: pwsh
-        run: |
-          $path = (Get-Command ffmpeg.exe).Source
-          "FFMPEG_BIN=$path" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
-
-      - name: Install Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-
-      - name: Install Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-
-      - name: Install dependencies
-        shell: pwsh
-        # Force the pre-1.3 "hoisted" linker on Windows. Bun 1.3.x's default
-        # "isolated" linker creates nested workspace junctions that don't
-        # materialize reliably on Windows GHA runners — manifests as
-        # `Cannot find package 'esbuild'` walking up from
-        # `packages/producer/build.mjs` and `EPERM stat` on
-        # `packages/producer/node_modules/@fontsource/*` from generators.
-        # See oven-sh/bun#23615, #18354, #10146. Linux CI keeps isolated;
-        # the lockfile is linker-agnostic so this flag is safe with
-        # --frozen-lockfile.
-        run: bun install --frozen-lockfile --linker=hoisted
-
-      # Vitest loads these workspace packages through their Node dist exports.
-      # No tested package needs the full publish build used by `bun run build`.
-      - name: Build test prerequisites
-        shell: pwsh
-        run: |
-          bun run --filter '@hyperframes/{parsers,lint,studio-server}' build
-          bun run --cwd packages/core build
-
-      - name: Prepare browser for process tests
-        if: matrix.lane == 'engine-cli'
-        shell: pwsh
-        run: node --import tsx packages/cli/scripts/prepare-process-test-browser.mjs
-
-      # Step limits stay under the job limit minus setup (~5 min), so a hung run fails its step and keeps the log.
-      - name: Run Studio shard ${{ matrix.studio_shard }}
-        if: matrix.studio_shard
-        shell: pwsh
-        timeout-minutes: 16
-        run: bun run --cwd packages/studio test -- --shard=${{ matrix.studio_shard }} --maxWorkers=2 --reporter=verbose
-
-      - name: Run ${{ matrix.lane }} package tests
-        if: matrix.packages
-        shell: pwsh
-        timeout-minutes: 20
-        # Each package starts its own Vitest pool. Bound every pool so concurrent
-        # package scripts cannot oversubscribe the hosted Windows runner.
-        # timeout-minutes did not fire on a hung run, so the script enforces the 16 minutes itself.
-        run: ./scripts/ci/run-with-deadline.ps1 -Minutes 16 -Command 'bun run ${{ matrix.packages }} test -- --maxWorkers=2 --reporter=verbose'
-
-      - name: Verify waveform cache writes on Windows
-        if: matrix.lane == 'engine-cli'
-        shell: pwsh
-        run: bun run --cwd packages/studio-server test -- src/helpers/waveform.test.ts src/helpers/waveform.file-race.test.ts --maxWorkers=2
-
-      - name: Verify producer lint entry reads on Windows
-        if: matrix.lane == 'engine-cli'
-        shell: pwsh
-        run: bunx vitest run packages/producer/src/services/hyperframeLint.file-race.test.ts --maxWorkers=2
-
-      - name: Verify Windows frame staging
-        if: matrix.lane == 'engine-cli'
-        shell: pwsh
-        run: bunx vitest run packages/producer/src/services/windowsFrameStaging.test.ts --maxWorkers=2
-
-      - name: Verify catalog file operations on Windows
-        if: matrix.lane == 'engine-cli'
-        shell: pwsh
-        run: bunx vitest run scripts/catalog/catalog-payload-assets.file-race.test.ts scripts/catalog/catalog-payload-assets.cache-race.test.ts --maxWorkers=2
-
-      - name: Upload test step log
-        if: always() && matrix.packages
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: test-step-log-${{ matrix.lane }}
-          path: ${{ runner.temp }}/deadline-step.log
-          if-no-files-found: ignore
-          retention-days: 7
-
-      - name: Run runtime contract test
-        if: matrix.runtime_contract
-        shell: pwsh
-        run: bun run --filter "@hyperframes/core" test:hyperframe-runtime-ci
-
-  # Preserve the existing required check name while the lanes stay
-  # independently visible and rerunnable.
-  test-windows:
-    name: Tests on windows-latest
-    needs: [changes, test-windows-lane]
-    if: always() && (needs.changes.result != 'success' || needs.changes.outputs.code == 'true' || github.event_name == 'workflow_dispatch')
-    runs-on: ubuntu-latest
-    timeout-minutes: 2
-    permissions:
-      actions: read
-    steps:
-      # On a PR, a cancelled lane passes only when a newer run of this workflow
-      # exists for the branch (concurrency cancelled this one). Push runs, a manual
-      # cancel of the latest run and any API error still fail.
-      - name: Require all Windows test lanes
-        if: needs.test-windows-lane.result != 'success'
-        env:
-          GH_TOKEN: ${{ github.token }}
-          LANE_RESULT: ${{ needs.test-windows-lane.result }}
-          BRANCH: ${{ github.head_ref || github.ref_name }}
-        run: |
-          if [ "$LANE_RESULT" = "cancelled" ] && [ "$GITHUB_EVENT_NAME" = "pull_request" ]; then
-            api="repos/$GITHUB_REPOSITORY/actions"
-            HEAD_REPO=$(gh api "$api/runs/$GITHUB_RUN_ID" --jq .head_repository.full_name)
-            export HEAD_REPO
-            newer=$(gh api "$api/workflows/windows-render.yml/runs" -X GET \
-              -f event="$GITHUB_EVENT_NAME" -f branch="$BRANCH" -f per_page=100 \
-              --jq '[.workflow_runs[] | select(.id > (env.GITHUB_RUN_ID | tonumber) and .head_repository.full_name == env.HEAD_REPO)] | length')
-            if [ "$newer" -gt 0 ]; then
-              echo "::notice::Superseded by a newer run; it reports the Windows result."
-              exit 0
-            fi
-          fi
-          echo "::error::One or more Windows test lanes did not succeed."
-          exit 1
diff --git a/.github/workflows/windows-window-probe.yml b/.github/workflows/windows-window-probe.yml
deleted file mode 100644
index 4bc868eb068..00000000000
--- a/.github/workflows/windows-window-probe.yml
+++ /dev/null
@@ -1,56 +0,0 @@
-name: Windows window probe
-
-permissions:
-  contents: read
-
-env:
-  HYPERFRAMES_NO_TELEMETRY: "1"
-
-on:
-  pull_request:
-    paths:
-      - .github/workflows/windows-window-probe.yml
-      - .github/scripts/windows-window-probe.ps1
-  workflow_dispatch:
-
-jobs:
-  probe:
-    name: Agent commands open no window on windows-latest
-    runs-on: windows-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: ./.github/actions/install-ffmpeg-windows
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-      - run: bun install --frozen-lockfile --linker=hoisted
-        shell: pwsh
-      - name: Build the CLI
-        shell: pwsh
-        run: |
-          bun run --filter '@hyperframes/{parsers,lint,studio-server}' build
-          bun run --cwd packages/core build
-          bun run --filter @hyperframes/player build
-          bun run --filter @hyperframes/studio build
-          bun run --filter @hyperframes/inspector build
-          bun run --filter @hyperframes/cli build
-      - name: Scaffold the canary
-        shell: pwsh
-        env:
-          HYPERFRAMES_SKIP_SKILLS: "1"
-        run: |
-          $dir = "$env:RUNNER_TEMP\probe"
-          New-Item -ItemType Directory -Force -Path $dir | Out-Null
-          Set-Location $dir
-          node "$env:GITHUB_WORKSPACE\packages\cli\dist\cli.js" init canary --example blank --non-interactive --skip-skills
-          Copy-Item "$env:GITHUB_WORKSPACE\.github\workflows\fixtures\windows-canary.html" "canary\index.html" -Force
-      - name: Install Chrome before watching
-        shell: pwsh
-        run: |
-          Set-Location "$env:RUNNER_TEMP\probe\canary"
-          node "$env:GITHUB_WORKSPACE\packages\cli\dist\cli.js" browser ensure
-      - name: Run the commands while watching for windows
-        shell: pwsh
-        run: .github/scripts/windows-window-probe.ps1 -Cli "$env:GITHUB_WORKSPACE\packages\cli\dist\cli.js" -Project "$env:RUNNER_TEMP\probe\canary"
diff --git a/bun.lock b/bun.lock
index 46a60d321e0..0bb2896b160 100644
--- a/bun.lock
+++ b/bun.lock
@@ -27,7 +27,7 @@
     },
     "packages/aws-lambda": {
       "name": "@hyperframes/aws-lambda",
-      "version": "0.8.210",
+      "version": "0.8.217",
       "dependencies": {
         "@aws-sdk/client-ecr": "^3.1146.0",
         "@aws-sdk/client-lambda": "^3.1146.0",
@@ -63,13 +63,12 @@
     },
     "packages/cli": {
       "name": "@hyperframes/cli",
-      "version": "0.8.210",
+      "version": "0.8.217",
       "bin": {
         "hyperframes": "./bin/hyperframes.mjs",
         "hyperframes-localize-fonts": "./bin/hyperframes-localize-fonts.mjs",
       },
       "dependencies": {
-        "undici": "7.25.0",
         "@hono/node-server": "^2.0.5",
         "@puppeteer/browsers": "^3.2.2",
         "acorn": "^8.17.0",
@@ -86,6 +85,7 @@
         "open": "^10.0.0",
         "postcss": "^8.5.8",
         "puppeteer-core": "^25.10.0",
+        "undici": "7.25.0",
         "yauzl": "^3.4.0",
       },
       "devDependencies": {
@@ -119,7 +119,7 @@
     },
     "packages/core": {
       "name": "@hyperframes/core",
-      "version": "0.8.210",
+      "version": "0.8.217",
       "dependencies": {
         "@chenglou/pretext": "^0.0.5",
         "@hyperframes/lint": "workspace:*",
@@ -164,9 +164,8 @@
     },
     "packages/engine": {
       "name": "@hyperframes/engine",
-      "version": "0.8.210",
+      "version": "0.8.217",
       "dependencies": {
-        "undici": "7.25.0",
         "@hono/node-server": "^2.0.5",
         "@hyperframes/core": "workspace:^",
         "@hyperframes/parsers": "workspace:^",
@@ -174,6 +173,7 @@
         "linkedom": "^0.18.12",
         "puppeteer": "~25.11.0",
         "puppeteer-core": "^25.11.0",
+        "undici": "7.25.0",
       },
       "devDependencies": {
         "@types/node": "^25.0.10",
@@ -184,7 +184,7 @@
     },
     "packages/gcp-cloud-run": {
       "name": "@hyperframes/gcp-cloud-run",
-      "version": "0.8.210",
+      "version": "0.8.217",
       "dependencies": {
         "@google-cloud/storage": "^7.14.0",
         "@google-cloud/workflows": "^4.2.0",
@@ -205,7 +205,7 @@
     },
     "packages/inspector": {
       "name": "@hyperframes/inspector",
-      "version": "0.8.210",
+      "version": "0.8.217",
       "bin": {
         "hyperframes-inspector": "./dist/server.js",
       },
@@ -228,7 +228,7 @@
     },
     "packages/lint": {
       "name": "@hyperframes/lint",
-      "version": "0.8.210",
+      "version": "0.8.217",
       "dependencies": {
         "@hyperframes/parsers": "workspace:*",
         "acorn": "^8.17.0",
@@ -248,7 +248,7 @@
     },
     "packages/parsers": {
       "name": "@hyperframes/parsers",
-      "version": "0.8.210",
+      "version": "0.8.217",
       "dependencies": {
         "@babel/parser": "^7.27.0",
         "acorn": "^8.17.0",
@@ -269,7 +269,7 @@
     },
     "packages/player": {
       "name": "@hyperframes/player",
-      "version": "0.8.210",
+      "version": "0.8.217",
       "dependencies": {
         "@hyperframes/core": "workspace:*",
       },
@@ -284,7 +284,7 @@
     },
     "packages/producer": {
       "name": "@hyperframes/producer",
-      "version": "0.8.210",
+      "version": "0.8.217",
       "dependencies": {
         "@hono/node-server": "^2.0.5",
         "@hyperframes/core": "workspace:*",
@@ -310,7 +310,7 @@
     },
     "packages/sdk": {
       "name": "@hyperframes/sdk",
-      "version": "0.8.210",
+      "version": "0.8.217",
       "dependencies": {
         "@hyperframes/core": "workspace:*",
         "@hyperframes/parsers": "workspace:*",
@@ -340,7 +340,7 @@
     },
     "packages/shader-transitions": {
       "name": "@hyperframes/shader-transitions",
-      "version": "0.8.210",
+      "version": "0.8.217",
       "dependencies": {
         "html2canvas": "^1.4.1",
       },
@@ -353,7 +353,7 @@
     },
     "packages/studio": {
       "name": "@hyperframes/studio",
-      "version": "0.8.210",
+      "version": "0.8.217",
       "dependencies": {
         "@base-ui/react": "1.7.0",
         "@codemirror/autocomplete": "^6.20.1",
@@ -375,6 +375,7 @@
         "@lezer/highlight": "^1.2.3",
         "@mcp-b/global": "^5.0.1",
         "@phosphor-icons/react": "^2.1.10",
+        "@remixicon/react": "4.9.0",
         "@tanstack/react-virtual": "^3.14.13",
         "acorn": "^8.17.0",
         "cn": "0.2.4",
@@ -407,7 +408,7 @@
     },
     "packages/studio-server": {
       "name": "@hyperframes/studio-server",
-      "version": "0.8.210",
+      "version": "0.8.217",
       "dependencies": {
         "@hyperframes/core": "workspace:*",
         "@hyperframes/parsers": "workspace:*",
@@ -1079,6 +1080,8 @@
 
     "@puppeteer/browsers": ["@puppeteer/browsers@3.2.2", "", { "dependencies": { "modern-tar": "^0.8.4", "yargs": "^18.0.0" }, "peerDependencies": { "proxy-agent": ">=8.0.1", "yauzl": "^2.10.0 || ^3.4.0" }, "optionalPeers": ["proxy-agent", "yauzl"], "bin": { "browsers": "lib/main-cli.js" } }, "sha512-q2BU4YfO9h/Wt7IcWPcggpOOqLk2Tbs1hDwolvKZrweRjy751OJBKMN9zO5bfD0pzU7X/tvKw/exQds4pM/LOg=="],
 
+    "@remixicon/react": ["@remixicon/react@4.9.0", "", { "peerDependencies": { "react": ">=18.2.0" } }, "sha512-5/jLDD4DtKxH2B4QVXTobvV1C2uL8ab9D5yAYNtFt+w80O0Ys1xFOrspqROL3fjrZi+7ElFUWE37hBfaAl6U+Q=="],
+
     "@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.0-beta.27", "", {}, "sha512-+d0F4MKMCbeVUJwG96uQ4SgAznZNSq93I3V+9NHA4OpvqG8mRCpGdKmK8l/dl02h2CCDHwW2FqilnTyDcAnqjA=="],
 
     "@rollup/rollup-android-arm-eabi": ["@rollup/rollup-android-arm-eabi@4.60.3", "", { "os": "android", "cpu": "arm" }, "sha512-x35CNW/ANXG3hE/EZpRU8MXX1JDN86hBb2wMGAtltkz7pc6cxgjpy1OMMfDosOQ+2hWqIkag/fGok1Yady9nGw=="],
diff --git a/packages/studio/index.html b/packages/studio/index.html
index 321a34e105c..843e67db6b9 100644
--- a/packages/studio/index.html
+++ b/packages/studio/index.html
@@ -4,11 +4,21 @@
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover" />
     <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
-    <title>HyperFrames Studio</title>
+    <title>promptwise Timeline</title>
+    <link rel="preconnect" href="https://fonts.googleapis.com" />
+    <link
+      rel="stylesheet"
+      href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500&display=swap"
+    />
     <script>
-      // Before the first paint: the theme the toggle saved, else light (owner: src/utils/studioTheme.ts).
+      // Before the first paint: promptwise passes its theme as ?theme=light|dark; else the theme the toggle saved, else light (owner: src/utils/studioTheme.ts).
       try {
-        if (JSON.parse(localStorage.getItem("hf-studio-ui-preferences") || "{}").theme !== "dark")
+        var asked = new URLSearchParams(location.search).get("theme");
+        if (
+          asked
+            ? asked !== "dark"
+            : JSON.parse(localStorage.getItem("hf-studio-ui-preferences") || "{}").theme !== "dark"
+        )
           document.documentElement.dataset.theme = "paper";
       } catch (e) {
         document.documentElement.dataset.theme = "paper";
diff --git a/packages/studio/package.json b/packages/studio/package.json
index 4d90b41229a..ff8aeb95599 100644
--- a/packages/studio/package.json
+++ b/packages/studio/package.json
@@ -108,6 +108,7 @@
     "@lezer/highlight": "^1.2.3",
     "@mcp-b/global": "^5.0.1",
     "@phosphor-icons/react": "^2.1.10",
+    "@remixicon/react": "4.9.0",
     "@tanstack/react-virtual": "^3.14.13",
     "acorn": "^8.17.0",
     "cn": "0.2.4",
diff --git a/packages/studio/src/components/StudioHeader.tsx b/packages/studio/src/components/StudioHeader.tsx
index b452e61780d..1e2bcb59ad4 100644
--- a/packages/studio/src/components/StudioHeader.tsx
+++ b/packages/studio/src/components/StudioHeader.tsx
@@ -6,8 +6,7 @@ import { trackStudioEvent } from "../utils/studioTelemetry";
 import { Button, buttonBase, buttonSizes, buttonVariants, cn, Tooltip } from "./ui";
 import { Dock } from "./dock/Dock";
 import { InspectorIcon } from "./icons/InspectorIcon";
-import { OpenInDesktopButton } from "./OpenInDesktopButton";
-import { HyperframesLogo } from "./ui/HyperframesLogo";
+import { PromptwiseMark } from "../promptwise/PromptwiseMark";
 import { ShowThemeToggle, ThemeToggle } from "./ThemeToggle";
 
 interface StudioHeaderProps {
@@ -56,7 +55,7 @@ export const StudioHeader = memo(function StudioHeader({
     <div className="flex items-center justify-between h-10 px-3 bg-surface border-b border-border-strong shrink-0">
       {/* Left: logo + project name */}
       <div className="flex items-center gap-3">
-        <HyperframesLogo />
+        <PromptwiseMark />
         <span className="text-text-5 select-none" aria-hidden="true">
           |
         </span>
@@ -152,7 +151,6 @@ export const StudioHeader = memo(function StudioHeader({
         </div>
         {showThemeToggle && <ThemeToggle />}
         <Dock.WindowMenu />
-        <OpenInDesktopButton />
         <Tooltip
           label={
             ffmpegMissing
diff --git a/packages/studio/src/components/editor/PropertyPanelEmptyState.test.tsx b/packages/studio/src/components/editor/PropertyPanelEmptyState.test.tsx
index 2ce69a2404d..2848c1ee0e3 100644
--- a/packages/studio/src/components/editor/PropertyPanelEmptyState.test.tsx
+++ b/packages/studio/src/components/editor/PropertyPanelEmptyState.test.tsx
@@ -23,11 +23,12 @@ function renderInto(node: React.ReactElement) {
 }
 
 describe("PropertyPanelEmptyState — flat empty", () => {
-  it("shows the cursor glyph, headline, and the two shortcut rows", () => {
+  it("shows the cursor glyph, headline, and the gesture row", () => {
     const { host, root } = renderInto(<PropertyPanelEmptyState flat multiSelectCount={0} />);
     expect(host.textContent).toContain("Nothing selected");
     expect(host.textContent).toContain("Record a gesture");
-    expect(host.textContent).toContain("Describe a change to the agent");
+    // The agent chip only shows inside promptwise, whose chat it opens.
+    expect(host.textContent).not.toContain("Describe a change to the agent");
     act(() => root.unmount());
   });
 });
diff --git a/packages/studio/src/components/editor/PropertyPanelEmptyState.tsx b/packages/studio/src/components/editor/PropertyPanelEmptyState.tsx
index c3d873460fd..a706196f484 100644
--- a/packages/studio/src/components/editor/PropertyPanelEmptyState.tsx
+++ b/packages/studio/src/components/editor/PropertyPanelEmptyState.tsx
@@ -2,6 +2,7 @@ import { Eye, Layers } from "../../icons/SystemIcons";
 import type { DomEditSelection } from "./domEditingTypes";
 import { canHideSelections } from "../../utils/timelineInspector";
 import { useTrackDesignInput } from "../../contexts/DesignPanelInputContext";
+import { askPromptwiseAgent, embeddedInPromptwise } from "../../promptwise/embed";
 
 function FlatEmptyState() {
   return (
@@ -32,15 +33,16 @@ function FlatEmptyState() {
             R
           </span>
         </span>
-        <span className="flex items-center justify-between rounded-lg border border-panel-border bg-panel-bg px-3 py-2">
-          <span className="flex items-center gap-2 text-[11px] text-panel-text-2">
+        {embeddedInPromptwise && (
+          <button
+            type="button"
+            onClick={askPromptwiseAgent}
+            className="flex items-center gap-2 rounded-lg border border-panel-border bg-panel-bg px-3 py-2 text-[11px] text-panel-text-2 hover:bg-hover"
+          >
             <span className="text-accent-ink">✦</span>
             Describe a change to the agent
-          </span>
-          <span className="rounded-sm border border-panel-border-input px-[5px] py-px font-mono text-[9px] text-panel-text-5">
-            ⌘K
-          </span>
-        </span>
+          </button>
+        )}
       </div>
     </div>
   );
diff --git a/packages/studio/src/main.tsx b/packages/studio/src/main.tsx
index ff8735e274a..7994ed12f84 100644
--- a/packages/studio/src/main.tsx
+++ b/packages/studio/src/main.tsx
@@ -3,6 +3,7 @@ import { createRoot } from "react-dom/client";
 import { IconContext } from "@phosphor-icons/react";
 import { StudioApp } from "./App";
 import { ShowThemeToggle } from "./components/ThemeToggle";
+import { embeddedInPromptwise } from "./promptwise/embed";
 import { StudioErrorBoundary } from "./components/StudioErrorBoundary";
 import { readIconTokens } from "./styles/iconTokens";
 import { trackStudioEvent } from "./utils/studioTelemetry";
@@ -116,7 +117,7 @@ createRoot(document.getElementById("root")!).render(
         Icons that pass their own size or weight still win. */}
     <IconContext.Provider value={readIconTokens()}>
       <StudioErrorBoundary>
-        <ShowThemeToggle.Provider value>
+        <ShowThemeToggle.Provider value={!embeddedInPromptwise}>
           <StudioApp />
         </ShowThemeToggle.Provider>
       </StudioErrorBoundary>
diff --git a/packages/studio/src/promptwise/PromptwiseMark.tsx b/packages/studio/src/promptwise/PromptwiseMark.tsx
new file mode 100644
index 00000000000..129ea24baad
--- /dev/null
+++ b/packages/studio/src/promptwise/PromptwiseMark.tsx
@@ -0,0 +1,11 @@
+// promptwise: our mark in Studio's header, in place of the HyperFrames logo.
+const MARK =
+  "M13.297 7.174h-.049C8.82 7.184 4.423 7.806.18 9.026l-.085.024.831 2.841.086-.024a44.8 44.8 0 0 1 12.24-1.735h.097c1.93 0 3.89.203 6.167.643q.319.06.642.061a3.37 3.37 0 0 0 3.13-2.143l.038-.096-.1-.024c-3.913-.97-6.974-1.402-9.928-1.402zM1.096 5.322a44.5 44.5 0 0 1 12.155-1.718h.079c3.278 0 6.088.357 9.4 1.192l.089.024.02-.09a3.4 3.4 0 0 0-.48-2.686A3.48 3.48 0 0 0 20.043.543C17.841.172 15.707 0 13.33 0h-.086A47.9 47.9 0 0 0 .086 1.862L0 1.886l1.01 3.46zM13.25 13.883c-4.49.01-8.892 1.093-12.977 2.264l-.086.024.65 2.227.086-.024c3.913-1.124 8.114-2.165 12.334-2.172h.336a3.18 3.18 0 0 0 2.951-2.034l.041-.106-.113-.014c-.93-.113-1.893-.161-3.219-.165zM6.093 20.905l-.096.017c-1.708.299-3.501.722-5.642 1.337l-.085.024.494 1.693.086-.024a59 59 0 0 1 3.814-.972 1.847 1.847 0 0 0 1.44-1.979z";
+
+export function PromptwiseMark() {
+  return (
+    <svg role="img" aria-label="promptwise" viewBox="0 0 24 24" className="size-4 shrink-0">
+      <path d={MARK} fill="var(--color-accent)" />
+    </svg>
+  );
+}
diff --git a/packages/studio/src/promptwise/embed.ts b/packages/studio/src/promptwise/embed.ts
new file mode 100644
index 00000000000..2fa085534e5
--- /dev/null
+++ b/packages/studio/src/promptwise/embed.ts
@@ -0,0 +1,5 @@
+export const embeddedInPromptwise = typeof window !== "undefined" && window.parent !== window;
+
+export function askPromptwiseAgent() {
+  window.parent.postMessage({ type: "promptwise:ask-agent" }, "*");
+}
diff --git a/packages/studio/src/promptwise/phosphor-remix.tsx b/packages/studio/src/promptwise/phosphor-remix.tsx
new file mode 100644
index 00000000000..161baad5286
--- /dev/null
+++ b/packages/studio/src/promptwise/phosphor-remix.tsx
@@ -0,0 +1,151 @@
+// promptwise: Studio imports @phosphor-icons/react everywhere; the build aliases that package to this
+// file, so every icon is a Remix icon without touching upstream files. Names follow Phosphor's.
+import {
+  createContext,
+  forwardRef,
+  useContext,
+  type ForwardRefExoticComponent,
+  type RefAttributes,
+  type SVGProps,
+} from "react";
+import * as Ri from "@remixicon/react";
+
+export type IconWeight = "thin" | "light" | "regular" | "bold" | "fill" | "duotone";
+export type IconProps = Omit<SVGProps<SVGSVGElement>, "ref"> & {
+  size?: number | string;
+  color?: string;
+  weight?: IconWeight;
+  mirrored?: boolean;
+  alt?: string;
+};
+export type Icon = ForwardRefExoticComponent<IconProps & RefAttributes<SVGSVGElement>>;
+
+type Remix = typeof Ri.RiAddLine;
+
+/** Phosphor's context for default props (size, weight) of the icons under it. */
+export const IconContext = createContext<IconProps>({});
+
+/** Phosphor's weight and mirroring props have no Remix twin; `fill` picks the filled icon when there is one. */
+function icon(line: Remix, fill = line): Icon {
+  return forwardRef<SVGSVGElement, IconProps>(function RemixIcon(
+    {
+      weight: ownWeight,
+      mirrored,
+      alt,
+      size: ownSize,
+      style,
+      width: _width,
+      height: _height,
+      fill: _fill,
+      viewBox: _viewBox,
+      children: _children,
+      ...rest
+    },
+    _ref,
+  ) {
+    // Like Phosphor, a prop the icon doesn't set comes from IconContext.
+    const defaults = useContext(IconContext);
+    const size = ownSize ?? defaults.size ?? "1em";
+    const Shape = (ownWeight ?? defaults.weight) === "fill" ? fill : line;
+    const flip = mirrored ? { transform: "scaleX(-1)", ...style } : style;
+    return (
+      <Shape
+        size={size}
+        aria-label={alt}
+        aria-hidden={alt ? undefined : true}
+        style={flip}
+        {...rest}
+      />
+    );
+  });
+}
+
+export const Aperture = icon(Ri.RiCameraLensLine, Ri.RiCameraLensFill);
+export const ArrowClockwise = icon(Ri.RiArrowGoForwardLine);
+export const ArrowCounterClockwise = icon(Ri.RiArrowGoBackLine);
+export const ArrowLeft = icon(Ri.RiArrowLeftLine);
+export const ArrowLineLeft = icon(Ri.RiContractLeftLine);
+export const ArrowLineRight = icon(Ri.RiContractRightLine);
+export const ArrowSquareOut = icon(Ri.RiExternalLinkLine);
+export const ArrowsOutCardinal = icon(Ri.RiDragMove2Line);
+export const ArrowsOutLineHorizontal = icon(Ri.RiExpandLeftRightLine);
+export const BezierCurve = icon(Ri.RiPenNibLine, Ri.RiPenNibFill);
+export const BracketsCurly = icon(Ri.RiBracesLine);
+export const Camera = icon(Ri.RiCameraLine, Ri.RiCameraFill);
+export const CaretDown = icon(Ri.RiArrowDownSLine);
+export const CaretRight = icon(Ri.RiArrowRightSLine);
+export const ChartBarHorizontal = icon(Ri.RiBarChartHorizontalLine, Ri.RiBarChartHorizontalFill);
+export const Check = icon(Ri.RiCheckLine);
+export const CheckCircle = icon(Ri.RiCheckboxCircleLine, Ri.RiCheckboxCircleFill);
+export const ClipboardText = icon(Ri.RiClipboardLine, Ri.RiClipboardFill);
+export const Clock = icon(Ri.RiTimeLine, Ri.RiTimeFill);
+export const Code = icon(Ri.RiCodeLine);
+export const Copy = icon(Ri.RiFileCopyLine, Ri.RiFileCopyFill);
+export const CornersIn = icon(Ri.RiFullscreenExitLine);
+export const CornersOut = icon(Ri.RiFullscreenLine);
+export const DotsThree = icon(Ri.RiMoreFill);
+export const Eye = icon(Ri.RiEyeLine, Ri.RiEyeFill);
+export const EyeSlash = icon(Ri.RiEyeOffLine, Ri.RiEyeOffFill);
+export const Eyedropper = icon(Ri.RiSipLine, Ri.RiSipFill);
+export const File = icon(Ri.RiFileLine, Ri.RiFileFill);
+export const FileCode = icon(Ri.RiFileCodeLine, Ri.RiFileCodeFill);
+export const FileCss = icon(Ri.RiCss3Line, Ri.RiCss3Fill);
+export const FileHtml = icon(Ri.RiHtml5Line, Ri.RiHtml5Fill);
+export const FileJpg = icon(Ri.RiFileImageLine, Ri.RiFileImageFill);
+export const FileJs = icon(Ri.RiJavascriptLine, Ri.RiJavascriptFill);
+export const FileJsx = icon(Ri.RiReactjsLine, Ri.RiReactjsFill);
+export const FileMd = icon(Ri.RiMarkdownLine, Ri.RiMarkdownFill);
+export const FilePlus = icon(Ri.RiFileAddLine, Ri.RiFileAddFill);
+export const FilePng = FileJpg;
+export const FileSvg = FileJpg;
+export const FileTs = FileCode;
+export const FileTsx = FileJsx;
+export const FileTxt = icon(Ri.RiFileTextLine, Ri.RiFileTextFill);
+export const FileVideo = icon(Ri.RiFileVideoLine, Ri.RiFileVideoFill);
+export const FilmSlate = icon(Ri.RiMovieLine, Ri.RiMovieFill);
+export const FilmStrip = icon(Ri.RiFilmLine, Ri.RiFilmFill);
+export const FolderSimple = icon(Ri.RiFolderLine, Ri.RiFolderFill);
+export const FolderSimplePlus = icon(Ri.RiFolderAddLine, Ri.RiFolderAddFill);
+export const FrameCorners = icon(Ri.RiFullscreenLine);
+export const Gear = icon(Ri.RiSettings3Line, Ri.RiSettings3Fill);
+export const GridFour = icon(Ri.RiGridLine, Ri.RiGridFill);
+export const Image = icon(Ri.RiImageLine, Ri.RiImageFill);
+export const Layout = icon(Ri.RiLayoutLine, Ri.RiLayoutFill);
+export const Lightning = icon(Ri.RiFlashlightLine, Ri.RiFlashlightFill);
+export const Link = icon(Ri.RiLinksLine);
+export const LinkSimple = Link;
+export const Magnet = icon(Ri.RiCrosshair2Line, Ri.RiCrosshair2Fill);
+export const MagnetStraight = Magnet;
+export const MagnifyingGlassMinus = icon(Ri.RiZoomOutLine);
+export const MagnifyingGlassPlus = icon(Ri.RiZoomInLine);
+export const Minus = icon(Ri.RiSubtractLine);
+export const Monitor = icon(Ri.RiComputerLine, Ri.RiComputerFill);
+export const MusicNote = icon(Ri.RiMusic2Line, Ri.RiMusic2Fill);
+export const Palette = icon(Ri.RiPaletteLine, Ri.RiPaletteFill);
+export const Path = icon(Ri.RiRouteLine, Ri.RiRouteFill);
+export const PencilSimple = icon(Ri.RiPencilLine, Ri.RiPencilFill);
+export const Plus = icon(Ri.RiAddLine);
+export const Presentation = icon(Ri.RiSlideshowLine, Ri.RiSlideshowFill);
+export const Ruler = icon(Ri.RiRulerLine, Ri.RiRulerFill);
+export const Scissors = icon(Ri.RiScissorsLine, Ri.RiScissorsFill);
+export const SlidersHorizontal = icon(Ri.RiEqualizerLine, Ri.RiEqualizerFill);
+export const SpeakerHigh = icon(Ri.RiVolumeUpLine, Ri.RiVolumeUpFill);
+export const SpeakerSlash = icon(Ri.RiVolumeMuteLine, Ri.RiVolumeMuteFill);
+export const Square = icon(Ri.RiSquareLine, Ri.RiSquareFill);
+export const SquareSplitVertical = icon(Ri.RiSplitCellsVertical);
+export const SquaresFour = icon(Ri.RiLayoutGridLine, Ri.RiLayoutGridFill);
+export const Stack = icon(Ri.RiStackLine, Ri.RiStackFill);
+export const TextAa = icon(Ri.RiFontSize);
+export const TextT = icon(Ri.RiText);
+export const Trash = icon(Ri.RiDeleteBinLine, Ri.RiDeleteBinFill);
+export const Warning = icon(Ri.RiAlertLine, Ri.RiAlertFill);
+export const Waveform = icon(Ri.RiVoiceprintLine, Ri.RiVoiceprintFill);
+export const X = icon(Ri.RiCloseLine);
+
+// Phosphor's `*Icon` spellings.
+export {
+  CaretRight as CaretRightIcon,
+  CheckCircle as CheckCircleIcon,
+  Warning as WarningIcon,
+  X as XIcon,
+};
diff --git a/packages/studio/src/promptwise/theme.css b/packages/studio/src/promptwise/theme.css
new file mode 100644
index 00000000000..9cd05aea304
--- /dev/null
+++ b/packages/studio/src/promptwise/theme.css
@@ -0,0 +1,41 @@
+/* promptwise: BoardUI's look over Studio's tokens (src/styles/theme.css), unlayered so it wins over
+ * Tailwind's theme layer. Values are BoardUI's neutral and accent scales, light first, then dark. */
+:root {
+  --font-sans: "Inter", ui-sans-serif, system-ui, sans-serif;
+  --font-mono: "JetBrains Mono", ui-monospace, "SFMono-Regular", Menlo, monospace;
+
+  --radius-sm: 0.375rem;
+  --radius-md: 0.625rem;
+  --radius-lg: 0.75rem;
+
+  /* Surfaces: page, panels, inputs, menus. */
+  --color-bg-0: light-dark(#f7f7f7, #121212);
+  --color-surface: light-dark(#ffffff, #262626);
+  --color-input: light-dark(#ffffff, #171717);
+  --color-raised: light-dark(#ffffff, #2e2e2e);
+
+  /* Text: primary, secondary, muted, disabled. */
+  --color-text-0: light-dark(#0a0a0a, #fafafa);
+  --color-text-2: light-dark(#525252, #d4d4d4);
+  --color-text-muted: light-dark(#737373, #a3a3a3);
+  --color-text-off: light-dark(#a3a3a3, #737373);
+
+  /* The promptwise orange. */
+  --color-accent: light-dark(#ec5f2c, #ff7948);
+  --color-accent-hover: light-dark(#c4471a, #ff946c);
+  --color-on-accent: #ffffff;
+  --color-accent-ink: light-dark(#c4471a, #ff946c);
+  --color-danger: #ef4444;
+  --color-danger-ink: light-dark(#b91c1c, #f87171);
+
+  --timeline-row-bg: light-dark(#ffffff, #1c1c1c);
+  --timeline-gutter-bg: light-dark(#f7f7f7, #171717);
+  --timeline-clip-label-active: light-dark(#441608, #fff5f1);
+  --timeline-clip-selection: light-dark(#c4471a, rgba(255, 255, 255, 0.85));
+}
+
+/* Inter sets the dock's tab labels wider than the system font, so the tabs keep a little less padding to fit
+ * the left group's four at its default width (scripts/studio-runtime-smoke.mjs checks it). */
+.hf-dock .dv-tab.dv-tab {
+  padding: 0 4px;
+}
diff --git a/packages/studio/src/styles/hex-baseline.json b/packages/studio/src/styles/hex-baseline.json
index 5e0c513e0d2..a038d67d183 100644
--- a/packages/studio/src/styles/hex-baseline.json
+++ b/packages/studio/src/styles/hex-baseline.json
@@ -1,5 +1,5 @@
 {
-  "total": 226,
+  "total": 258,
   "files": {
     "packages/studio/src/captions/components/CaptionOverlay.tsx": 5,
     "packages/studio/src/captions/components/CaptionTimeline.tsx": 11,
@@ -44,6 +44,7 @@
     "packages/studio/src/player/components/CompositionThumbnail.tsx": 2,
     "packages/studio/src/player/components/PlayerControls.tsx": 1,
     "packages/studio/src/player/components/SpeedMenu.tsx": 2,
+    "packages/studio/src/promptwise/theme.css": 34,
     "packages/studio/src/styles/components.css": 48,
     "packages/studio/src/telemetry/client.ts": 1,
     "packages/studio/src/webmcp/webmcpTestUtils.ts": 1
diff --git a/packages/studio/src/styles/studio.css b/packages/studio/src/styles/studio.css
index 5c559d9b5cf..17d4c125ee2 100644
--- a/packages/studio/src/styles/studio.css
+++ b/packages/studio/src/styles/studio.css
@@ -1,6 +1,7 @@
 @import "tailwindcss" source(none);
 @import "./palette-reset.css";
 @import "./theme.css";
+@import "../promptwise/theme.css";
 @import "./components.css";
 
 /* Explicit sources: Studio's own TypeScript and its shell HTML. Automatic
diff --git a/packages/studio/tsconfig.json b/packages/studio/tsconfig.json
index ee7066da642..5158df41439 100644
--- a/packages/studio/tsconfig.json
+++ b/packages/studio/tsconfig.json
@@ -4,7 +4,8 @@
     "module": "ESNext",
     "moduleResolution": "bundler",
     "paths": {
-      "@hyperframes/player": ["../player/src/hyperframes-player.ts"]
+      "@hyperframes/player": ["../player/src/hyperframes-player.ts"],
+      "@phosphor-icons/react": ["./src/promptwise/phosphor-remix.tsx"]
     },
     "jsx": "react-jsx",
     "strict": true,
diff --git a/packages/studio/vite.config.ts b/packages/studio/vite.config.ts
index 00af9240d5f..6c5f7978673 100644
--- a/packages/studio/vite.config.ts
+++ b/packages/studio/vite.config.ts
@@ -320,6 +320,8 @@ export default defineConfig({
       // openComposition and silently loses its SDK session. See the stub.
       canvas: resolve(__dirname, "src/shims/canvasBrowserStub.js"),
       "@hyperframes/player": resolve(__dirname, "../player/src/hyperframes-player.ts"),
+      // promptwise: Remix icons under Phosphor's names (src/promptwise/phosphor-remix.tsx).
+      "@phosphor-icons/react": resolve(__dirname, "src/promptwise/phosphor-remix.tsx"),
       "@hyperframes/studio-server/source-mutation": resolve(
         __dirname,
         "../studio-server/src/helpers/sourceMutation.ts",