* feat(engine,producer): drawElement fast-capture default-on with runtime self-verification safety net Flip useDrawElement + worker-encode defaults on (HF_DE_BATCH default 4), clamped in resolveConfig to hosts where drawElement can engage (macOS + hardware-GPU browser) so page-side shader compositing is untouched everywhere else; explicit env opt-in keeps attempt-and-gate semantics. Safety net makes default-on safe: the compile/init gates catch predictable incompatibility; this catches the intermittent residue no static analysis can see (stale paints, dropped background images, transient blank frames). - engine: captureDeVerificationFrames — K=4 (HF_DE_VERIFY) ground-truth screenshots at init, after gates + armStaticDedup, BEFORE canvas injection (post-injection screenshots show the canvas bitmap, not the DOM). Runs the video-injection hook per sample; double-captures so rAF-driven text counters settle (a single immediate screenshot captures stale text and false-positives). Skips png, <10 frames, implausible __hf.duration (infinite-repeat GSAP sentinel). - producer: guardFrame on both worker-encode drains — rolling-median blank guard with retry-once at drain (byte-identical retry ⇒ deterministic dark frame, accepted; retry save/restores the static-dedup anchor) + ffmpeg PSNR self-verify vs ground truth (HF_DE_VERIFY_MIN_DB, default 32dB; natural agreement ≥45dB, damage ≤25dB). Breach dumps the frame pair to tmpdir and throws DrawElementVerificationError. - orchestrator: one-shot retry — on verification error the whole render re-runs with forceScreenshot (slower, never wrong); telemetry flag deSelfVerifyFallback. - tooling: de-canary-suite.sh (7-comp release gate with expected verdicts), de-gatecheck.sh (init-only corpus routing classifier), we-render.mjs. Validated: canary suite 7/7; 611-comp routing sample 54% drawelement / 37.5% gated / 8.3% comp-defect; 12/12 risk-band renders clean on bare defaults (48/48 verify samples); engine suite 888 passed; caught two real intermittent damage classes in the wild (background-image drop, root-props offset) that previously shipped silently. Kill switches: PRODUCER_EXPERIMENTAL_FAST_CAPTURE=false, HF_DE_WORKER_ENCODE=false, HF_DE_BATCH=0, HF_DE_VERIFY=0. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(engine,producer): harden the drawElement self-verification net (max code-review findings) 15 confirmed findings from the adversarial review of the default-on flip; the load-bearing five: - Ground-truth capture no longer scrubs GSAP state: seek(0) + forced frame FIRST (lazy .from()/overlap tweens record start values on first seek — mid-timeline scrubs corrupted them for the whole render, and since DE frames and truth shared the corruption, PSNR passed on damaged output), then ascending even-spread fractions, page left at frame 0. - Default-on drawElement is confined to the verified path: resolveConfig requires worker-encode (the drain that runs the net), the orchestrator disengages the default when the render takes the disk path or parallel capture (no drain verification there), and closes a drawElement-initialized probe session rather than letting the unverified path reuse it. Explicit PRODUCER_EXPERIMENTAL_FAST_CAPTURE=true keeps old attempt-and-gate behavior. - Blank-frame retry can no longer splice wrong-frame pixels: recapture goes through recaptureDrawElementFrameForVerify — no static-dedup shortcut (lastEncodeResult runs ahead of the drain) and no "No cached paint record" screenshot fallback (post-injection that captures the canvas = the LAST drawn frame); any recapture failure falls back the whole render. - Verify indices derive from the producer-resolved duration (CaptureOptions.compositionDurationSeconds) instead of raw __hf.duration, so samples always land inside the drained range. - The platform clamp accepts "auto" GPU mode — the stock CLI resolves auto, and the literal-"hardware" clamp made default-on a no-op for the primary audience (masked in validation by explicitly-set env). Also: NaN-safe env parses (HF_DE_VERIFY / HF_DE_VERIFY_MIN_DB / HF_DE_BATCH); video comps skip verification when the session has no frame injector (probe sessions — black-video truth false-positived); psnr infrastructure failures skip the sample instead of failing the render; boundary-saturated sample indices are skipped; shader-transition comps prefer page-side compositing over default drawElement and compile-gated comps get page-side compositing restored; observability.clearFailure un-brands the recovered first streaming attempt; canary suite exempts known-marginal "any" comps from the cross-path PSNR gate; dead we-render options removed; clamp tests pin their env. Validated: canary suite 7/7; auto-GPU bare render engages the full stack; disk-path and worker-encode-off renders disengage default drawElement; malformed HF_DE_VERIFY_MIN_DB still verifies at the default threshold; engine suite 890 passed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(engine,producer): review fixes — PSC intent, verify-threshold clamp, fail-closed canaries Addresses miguel-heygen's review on #1998: - Page-side compositing restore preserves explicit caller intent (blocker): resolveConfig now records pageSideCompositingAutoDisabled only when IT turned page-side compositing off because drawElement was on; the compile-time drawElement gates restore page-side compositing only when that flag is set. An explicit enablePageSideCompositing:false from the programmatic API or HF_PAGE_SIDE_COMPOSITING=false stays off. Pinned by two config tests. - HF_DE_VERIFY_MIN_DB clamped to [10, 60] with a warning on out-of-range values: below ~10dB the check passes severe damage; above ~60dB natural encoder differences force a screenshot fallback on every verified render. - de-canary-suite.sh + de-gatecheck.sh run under set -euo pipefail with explicit `|| true` on expected-nonzero commands (render exits handled by the suite's own checks, grep no-match, kill/pkill/wait races) and a hard FAIL when the PSNR compare produces no value — release canaries fail closed. Full suite re-run green (7/7) under the new flags. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Producer regression test fixtures
Each subdirectory under this folder is a regression fixture for the
HTML-to-video pipeline. The harness at
packages/producer/src/regression-harness.ts walks every subdirectory,
runs the composition, and PSNR-compares the rendered output against a
checked-in golden baseline.
Fixture layout
<fixture-name>/
├── meta.json # name, tags, PSNR threshold, renderConfig
├── src/
│ ├── index.html # composition entry point
│ └── assets/... # any locally-referenced media
└── output/
├── compiled.html # golden compiled HTML (validated as a snapshot)
└── output.mp4 # golden rendered video
meta.json is validated by validateMetadata in
src/regression-harness.ts. The required fields are:
name(string),description(string),tags(string[])minPsnr(number, dB)maxFrameFailures(integer)minAudioCorrelation(0..1),maxAudioLagWindows(integer ≥1)renderConfig.fps(integer like30or a rational string like"30000/1001")
Optional renderConfig fields:
format—"mp4"(default) or"webm"workers— integer ≥ 1hdr— boolean (defaultfalse)variables— JSON object of render-time variable overrideschunkSize— integer ≥ 1 (used by--mode=distributed-simulated)maxParallelChunks— integer ≥ 1 (used by--mode=distributed-simulated)
Generating / updating a baseline
Always inside Docker. Host Chrome / FFmpeg versions drift across distros, so a baseline captured on the host won't match the bytes CI renders.
# From the repo root.
docker build -t hyperframes-producer:test -f Dockerfile.test .
# Generate a baseline (single fixture):
bun run --cwd packages/producer docker:test:update <fixture-name>
# Generate all baselines (rarely needed):
bun run --cwd packages/producer docker:test:update
The --update flag writes output/compiled.html and output/output.mp4
from the current render. Without --update, the harness compares against
those baselines.
Running the harness locally
# Run every fixture (parallel, in-process mode — the default).
bun run --cwd packages/producer docker:test
# Run a single fixture:
bun run --cwd packages/producer docker:test font-variant-numeric
# Run sequentially (lower memory):
bun run --cwd packages/producer docker:test -- --sequential
Harness modes
--mode=<value> chooses which render path the harness exercises:
| Mode | What it calls | Use for |
|---|---|---|
in-process (default) |
executeRenderJob |
Day-to-day baselines. This is the same path the hyperframes render CLI takes, and it is what produced every existing output/output.mp4. |
distributed-simulated |
plan() → renderChunk() × N → assemble() from @hyperframes/producer/distributed |
Validates the distributed pipeline against the in-process baseline. No Temporal or Lambda involvement — the controller and chunk worker are both this process. |
--mode=distributed-simulated
bun run --cwd packages/producer docker:test -- --mode=distributed-simulated
bun run --cwd packages/producer docker:test font-variant-numeric -- --mode=distributed-simulated
The distributed pipeline cannot run every fixture. Fixtures that fail any of these gates are skipped with a clear log line (and counted as passing in the summary):
fps.den !== 1— distributed mode is integer-fps only (no NTSC).fps.num ∉ {24, 30, 60}— closed set perDistributedRenderConfig.format === "webm"—plan()refuses webm.hdr === true— distributed mode is SDR-only at v1.
Both modes use the fixture's authored minPsnr as the per-test
threshold — distributed must clear the same quality bar in-process
clears against the same frozen baseline. (Internal contract: distributed
vs in-process renders of the same fixture should clear 50 dB PSNR
against each other within the same Docker image. Against the frozen
committed baseline, neither mode reaches that consistently due to
shared encoder/JPEG-capture jitter — that's why the fixture's authored
threshold gates here, not the 50 dB contract value.) An absolute 10 dB
pathology floor catches fully-black-output regressions when a fixture
authors a permissive threshold. A distributed failure at the fixture's
own threshold means the distributed pipeline has drifted — file an
issue rather than relaxing the fixture.
--update is incompatible with --mode=distributed-simulated: the
in-process renderer is the source of truth for baselines, and the
distributed mode's job is to verify the contract against the same
baseline.
Validating PR 4.1 (the harness mode itself)
The smallest fixtures (font-variant-numeric, many-cuts) are sufficient
to verify the mode plumbing end to end:
docker build -t hyperframes-producer:test -f Dockerfile.test .
# In-process: existing behavior, unchanged.
bun run --cwd packages/producer docker:test font-variant-numeric
bun run --cwd packages/producer docker:test many-cuts
# Distributed-simulated: same baselines, distributed pipeline.
bun run --cwd packages/producer docker:test font-variant-numeric -- --mode=distributed-simulated
bun run --cwd packages/producer docker:test many-cuts -- --mode=distributed-simulated
Both modes must pass at each fixture's authored minPsnr against the
existing baseline. If --mode=distributed-simulated fails where
--mode=in-process passes, the distributed primitive has a regression —
file an issue rather than relaxing the fixture's threshold.
Distributed-only fixtures
Fixtures under tests/distributed/<name>/ are authored specifically for
the distributed pipeline. They follow the same meta.json schema as the
top-level fixtures, but they always set chunkSize / maxParallelChunks
so a plan() over the fixture produces N>1 chunks. Each fixture
exercises one of:
- per-format chunk-boundary correctness (mp4 H.264, mp4 H.265, ProRes, png-sequence)
- per-adapter chunk-seam state preservation (GSAP, Anime.js, Three.js, Lottie, CSS, WAAPI)
Each distributed fixture covers one or more equivalence axes — see the
meta.json description field for what a given fixture is locking in.
Fixture pattern (4.2 onward)
Each tests/distributed/<name>/ fixture has the same structure as a
top-level fixture (meta.json + src/index.html + output/output.mp4).
Differences worth knowing:
renderConfig.chunkSizeis required — pick a value that yields N≥2 chunks for your fixture's frame count (e.g. 60 frames atchunkSize: 15produces N=4). Without this the fixture renders in a single chunk and never exercises the seam.- The fixture's ID on the CLI is just
<name>(nodistributed/prefix).bun run --cwd packages/producer docker:test mp4-h264-sdrworks the same as for a top-level fixture. - The
distributedtag is informational — it doesn't gate any tag-based filter today. Add it so the fixture is easy to find by tag. - The composition should stress state continuity across the chunk seams: an animation crossing a seam, a counter, a rotation. A fully-static composition would pass even if chunk-boundary state was broken.
- Baselines must be generated inside Docker — see the section above.
The baseline is rendered by the in-process renderer (the source of
truth for golden output);
--mode=distributed-simulatedis validated against the same baseline.
Tags
Common tags values control which fixtures the default bun test
invocation runs. --exclude-tags transparency (the default for
bun test) skips webm/png-sequence alpha fixtures that need a working
chrome-headless-shell alpha pipeline.