@1agh/maude 1.0.6 → 1.0.8

package/apps/studio/exporters/format-scopes.ts

@@ -0,0 +1,88 @@
+// format-scopes.ts — which export scopes a format can actually render.
+//
+// DDR-231 Phase 2 T4. This map existed in THREE places and was checked in
+// none of them: `client/app.jsx` (`EXPORT_VALID_SCOPES`, the shell dialog),
+// `export-dialog.tsx` (`VALID_SCOPES_PER_FORMAT`, the in-canvas dialog) — and
+// nowhere on the server, which accepted whatever pair a client sent.
+//
+// That gap is the "PDF nefunguje vubec — invalid render job" the first live
+// cloud export hit, reproduced locally: `POST /_api/export-jobs
+// {format:'pdf', scope:'project-raw'}` is accepted, `resolveScope` returns a
+// `file-tree` target (correct for that scope — it IS the whole project), and
+// the render service's `validBody` rejects it with an opaque `invalid render
+// job` because a file-tree target names repo paths that process must never
+// read. Every layer behaved as specified; the pair was never legal, and
+// nothing said so.
+//
+// The two dialogs keep the scope pickers honest for a user who is looking;
+// this module is what makes the pair unrepresentable for one who is not (a
+// stale scope carried across a format switch, a re-run of a history entry, a
+// context-menu hint, a direct POST).
+//
+// PURE DATA, NO IMPORTS — `http.ts` (Bun), `apps/render/server.ts` (Bun) and
+// both browser bundles all consume it, so it must not reach for `node:*`.
+
+/** Every format the export pipeline knows. Mirrors `index.ts`'s `Format`. */
+export type ExportFormatName =
+  | 'png'
+  | 'pdf'
+  | 'svg'
+  | 'html'
+  | 'pptx'
+  | 'canva'
+  | 'zip'
+  | 'mp4'
+  | 'webm'
+  | 'gif';
+
+/** Mirrors `scope.ts`'s `Scope`. */
+export type ExportScopeName = 'selection' | 'artboard' | 'canvas-as-separate' | 'project-raw';
+
+/**
+ * Scopes each format accepts, in the order a picker should offer them — the
+ * FIRST entry is that format's default.
+ *
+ * The shape rules behind the table:
+ *   - `project-raw` resolves to a `file-tree` target, which only `zip`
+ *     consumes; every rendering format must therefore exclude it.
+ *   - `pptx` is a deck: one slide per artboard, so canvas-wide only.
+ *   - video renders one temporal artboard, so `artboard` only.
+ *   - `html` has no meaningful "selection" unit (it emits a page per artboard).
+ */
+export const VALID_SCOPES_BY_FORMAT: Readonly<
+  Record<ExportFormatName, readonly ExportScopeName[]>
+> = Object.freeze({
+  png: ['selection', 'artboard', 'canvas-as-separate'],
+  pdf: ['selection', 'artboard', 'canvas-as-separate'],
+  svg: ['selection', 'artboard', 'canvas-as-separate'],
+  html: ['artboard', 'canvas-as-separate'],
+  pptx: ['canvas-as-separate'],
+  canva: ['canvas-as-separate'],
+  zip: ['project-raw'],
+  mp4: ['artboard'],
+  webm: ['artboard'],
+  gif: ['artboard'],
+});
+
+/** The scope a picker should select when the format changes. */
+export function defaultScopeForFormat(format: string): ExportScopeName {
+  return VALID_SCOPES_BY_FORMAT[format as ExportFormatName]?.[0] ?? 'artboard';
+}
+
+export function validScopesForFormat(format: string): readonly ExportScopeName[] {
+  return VALID_SCOPES_BY_FORMAT[format as ExportFormatName] ?? ['artboard'];
+}
+
+export function isScopeValidForFormat(format: string, scope: string): boolean {
+  return validScopesForFormat(format).includes(scope as ExportScopeName);
+}
+
+/**
+ * The refusal a caller sees for an incoherent pair. Written for a person and
+ * naming the way out, because it surfaces in the export dialog — the old
+ * `invalid render job` named neither the field nor the remedy.
+ */
+export function scopeRefusalMessage(format: string, scope: string): string {
+  const offered = validScopesForFormat(format).join(', ');
+  return `${format.toUpperCase()} can't export the "${scope}" scope — it supports: ${offered}.`;
+}

package/apps/studio/exporters/html.ts

@@ -1,8 +1,9 @@
 // Phase 6.5 T5 — HTML adapter (standalone bundler).
 //
 // Renders the target through Playwright, emits a self-contained `index.html`
-// with all stylesheets inlined (fonts + remote images still referenced by
-// origin — full asset inlining is a follow-up). Output is always a ZIP per
+// with all stylesheets inlined and every asset (images, fonts, CSS url()s,
+// SVG defs) embedded as data: URIs — see bin/_html-playwright.mjs. Output is
+// always a ZIP per
 // plan T5 ("Always zipped (multi-file)"), even for a single artboard,
 // because the consuming workflow typically wants one bundle per export.
 

package/apps/studio/exporters/jobs.ts

@@ -23,9 +23,10 @@
 // pair had). The ledger is seeded from disk once at construction so history
 // survives a server restart even though job state itself doesn't.
 
-import { readFileSync } from 'node:fs';
+import { readFileSync, realpathSync } from 'node:fs';
 import { mkdir, rm } from 'node:fs/promises';
 import path from 'node:path';
+import { readAllArtboardPrintProps } from '../canvas-edit.ts';
 
 import type { Bus } from '../context.ts';
 import { resolveRenderLane } from '../workspace-mode.ts';
@@ -47,7 +48,8 @@ import {
   renderRemotely,
   resolveRenderService,
 } from './remote.ts';
-import { type ResolveScopeArgs, resolveScope } from './scope.ts';
+import { type ResolveScopeArgs, resolveScope, type Target } from './scope.ts';
+import { scanUnsupportedMedia } from './unsupported-media.ts';
 
 /** Extended shape of the old Phase 6.5 T10 history entry — additive fields only. */
 export interface ExportHistoryEntry {
@@ -63,6 +65,13 @@ export interface ExportHistoryEntry {
   error?: string;
   /** Present when the export produced less than was asked for (e.g. muted mp4). */
   degraded?: ExportDegradation;
+  /**
+   * DDR-231 Phase 2 T6 — the browser lane captured and saved this export in
+   * the member's OWN browser; the cell holds no bytes for it. Present so the
+   * Recent tab and the notification center can list it without offering a
+   * download that would 404.
+   */
+  deliveredInBrowser?: boolean;
 }
 
 export type ExportJobStatus = 'queued' | 'running' | 'done' | 'failed';
@@ -87,6 +96,9 @@ export interface ExportJob {
    * RCA `issue-mp4-audio-export-html5audio-silent-degrade`.
    */
   degraded?: ExportDegradation;
+  /** DDR-231 browser lane — produced and saved in the member's own browser;
+   * this process stores no bytes for it. See {@link ExportHistoryEntry}. */
+  deliveredInBrowser?: boolean;
 }
 
 export interface EnqueueArgs {
@@ -111,6 +123,12 @@ export type DownloadResult =
 
 export interface ExportJobQueue {
   enqueue(args: EnqueueArgs): { id: string; result: Promise<ExportResult> };
+  /**
+   * Record an export the MEMBER'S BROWSER produced and saved (DDR-231 browser
+   * lane) so it appears in the same ledger every other export does. No bytes
+   * are kept — the file never passed through this process.
+   */
+  recordBrowserExport(args: { format: Format; scope: Scope; filename: string }): ExportHistoryEntry;
   get(id: string): ExportJob | undefined;
   list(): ExportJob[];
   loadHistory(): ExportHistoryEntry[];
@@ -211,6 +229,75 @@ function isFinished(job: ExportJob): boolean {
   return job.status === 'done' || job.status === 'failed';
 }
 
+/**
+ * Resolve a client-influenced canvas `file` to an absolute path INSIDE the
+ * design root, following symlinks (security review F2). `file` originates from
+ * `options.canvasFile`/`selection.file` — a viewer picks it — so the floor is
+ * the DESIGN root (not the whole checkout: no `.git`/`.env`/sibling files), the
+ * containment is re-checked AFTER `realpathSync` (a `startsWith` string prefix
+ * alone is escaped by an in-checkout symlink), and only `.tsx`/`.html` canvas
+ * files are eligible. Returns null on any failure — the reader then contributes
+ * nothing, exactly as an unreadable canvas does.
+ */
+function safeCanvasAbs(
+  repoRoot: string | undefined,
+  designRoot: string | undefined,
+  file: string
+): string | null {
+  if (!repoRoot || !designRoot) return null;
+  if (!/\.(tsx|html)$/i.test(file)) return null;
+  let designReal: string;
+  let abs: string;
+  try {
+    designReal = realpathSync(path.resolve(designRoot));
+    // `file` is REPO-relative (it carries the `.design/` prefix) — resolve
+    // against repoRoot, then require the realpath sits under the DESIGN root.
+    abs = realpathSync(path.resolve(repoRoot, file));
+  } catch {
+    return null;
+  }
+  return abs === designReal || abs.startsWith(designReal + path.sep) ? abs : null;
+}
+
+/** The cell-side `scanUnsupportedMedia` for a remote video job — the first
+ * element target's canvas (video renders one artboard). */
+function readUnsupportedMediaFor(
+  targets: Target[],
+  repoRoot: string | undefined,
+  designRoot: string | undefined
+) {
+  const t = targets.find((x) => x.kind === 'element');
+  if (!t || t.kind !== 'element') return [];
+  const abs = safeCanvasAbs(repoRoot, designRoot, t.file);
+  return abs ? scanUnsupportedMedia(abs) : [];
+}
+
+/**
+ * `{ [repoRelativeCanvasFile]: { [artboardId]: print } }` for every canvas an
+ * element target names — what exporters/pdf.ts reads as `options.printProps`
+ * when it renders on the worker. Read from the cell's own checkout; a canvas
+ * that won't parse or has no print artboard contributes nothing.
+ */
+function readPrintPropsFor(
+  targets: Target[],
+  repoRoot: string | undefined,
+  designRoot: string | undefined
+): Record<string, Record<string, Record<string, unknown>>> {
+  const out: Record<string, Record<string, Record<string, unknown>>> = {};
+  for (const t of targets) {
+    if (t.kind !== 'element' || out[t.file]) continue;
+    const abs = safeCanvasAbs(repoRoot, designRoot, t.file);
+    if (!abs) continue;
+    try {
+      const props = readAllArtboardPrintProps(abs, readFileSync(abs, 'utf8'));
+      if (Object.keys(props).length) out[t.file] = props;
+    } catch {
+      /* unreadable canvas — the adapter treats it as non-print, same as local */
+    }
+  }
+  return out;
+}
+
 export function createExportJobQueue(bus: Bus, designRoot: string): ExportJobQueue {
   const jobsDir = path.join(designRoot, '_export-jobs');
   const historyPath = path.join(designRoot, '_export-history.json');
@@ -283,6 +370,7 @@ export function createExportJobQueue(bus: Bus, designRoot: string): ExportJobQue
         // A muted mp4 must not look like a clean one in the ledger either — the
         // history entry is what a later session (or an agent) reads back.
         degraded: j.degraded,
+        deliveredInBrowser: j.deliveredInBrowser,
       }));
   }
 
@@ -290,21 +378,36 @@ export function createExportJobQueue(bus: Bus, designRoot: string): ExportJobQue
     const history = deriveHistory();
     await Bun.write(historyPath, JSON.stringify(history, null, 2));
 
-    // Evict bytes (+ the in-memory record) for anything that rolled past the
-    // cap, or aged out, whichever comes first.
-    const finished = Array.from(jobs.values())
-      .filter(isFinished)
-      .sort((a, b) => (b.finishedAt ?? '').localeCompare(a.finishedAt ?? ''));
     const now = Date.now();
-    const stale = finished.filter((j, i) => {
+
+    // BYTE eviction is ranked among jobs that HAVE bytes on disk — never driven
+    // by browser-lane rows. A `deliveredInBrowser` row (recordBrowserExport)
+    // holds no bytes and is reachable by a viewer, so counting it toward the
+    // FIFO-`HISTORY_DEPTH` window would let a viewer flood fake rows and push a
+    // real member's not-yet-downloaded PDF/video past the cap — deleting its
+    // bytes (security review F2: an append that was secretly a delete
+    // primitive). The two concerns are now separate: the ledger above is a
+    // display list; this is GC of real artifacts only.
+    const withBytes = Array.from(jobs.values())
+      .filter((j) => isFinished(j) && !j.deliveredInBrowser && j.filename)
+      .sort((a, b) => (b.finishedAt ?? '').localeCompare(a.finishedAt ?? ''));
+    const staleBytes = withBytes.filter((j, i) => {
       if (i >= HISTORY_DEPTH) return true;
       const finishedAt = j.finishedAt ? Date.parse(j.finishedAt) : Number.NaN;
       return Number.isFinite(finishedAt) && now - finishedAt > MAX_JOB_AGE_MS;
     });
-    for (const job of stale) {
+    for (const job of staleBytes) {
       jobs.delete(job.id);
       await rm(path.join(jobsDir, job.id), { recursive: true, force: true }).catch(() => {});
     }
+
+    // In-memory record eviction for the byte-free rows (browser-lane +
+    // aged/over-cap finished jobs whose bytes are already gone) — bound the Map
+    // so the ledger's own history depth caps memory. No disk to remove.
+    const byteless = Array.from(jobs.values())
+      .filter((j) => isFinished(j) && (j.deliveredInBrowser || !j.filename))
+      .sort((a, b) => (b.finishedAt ?? '').localeCompare(a.finishedAt ?? ''));
+    for (const job of byteless.slice(HISTORY_DEPTH)) jobs.delete(job.id);
   }
 
   function enqueue(args: EnqueueArgs): { id: string; result: Promise<ExportResult> } {
@@ -336,6 +439,9 @@ export function createExportJobQueue(bus: Bus, designRoot: string): ExportJobQue
     // exercise the lanes without a reboot.
     const lane = resolveRenderLane();
     const dispatchRemote = lane !== 'local' && formatNeedsBrowser(args.format);
+    console.error(
+      `[jobs] ${args.format}: lane=${lane} dispatchRemote=${dispatchRemote} (renderUrl=${process.env.MAUDE_RENDER_URL ? 'set' : 'unset'})`
+    );
 
     const result = (async (): Promise<ExportResult> => {
       // Fail BEFORE taking a render slot: a job that can never render must not
@@ -367,18 +473,42 @@ export function createExportJobQueue(bus: Bus, designRoot: string): ExportJobQue
         job.startedAt = new Date().toISOString();
         emit(job);
 
+        // Scope resolves HERE, against the cell's own checkout — Target is
+        // pure data, and the render service holds no tenant store to resolve
+        // against (DDR-230 §1).
+        const remoteTargets = dispatchRemote
+          ? await resolveScope({ scope: args.scope, ...args.resolve, options: args.options })
+          : [];
         const res = dispatchRemote
           ? await renderRemotely({
               format: args.format,
-              // Scope resolves HERE, against the cell's own checkout — Target
-              // is pure data, and the render service holds no tenant store to
-              // resolve against (DDR-230 §1).
-              targets: await resolveScope({
-                scope: args.scope,
-                ...args.resolve,
-                options: args.options,
-              }),
-              options: args.options,
+              targets: remoteTargets,
+              // Same rule for anything ELSE the adapter would read off disk: a
+              // print artboard's `print` prop (bleed, paper) lives in the canvas
+              // source, which only this process has. Resolve it here and ship
+              // it as data, or the worker's PDF silently loses its boxes/marks.
+              options:
+                args.format === 'pdf'
+                  ? {
+                      ...args.options,
+                      printProps: readPrintPropsFor(
+                        remoteTargets,
+                        args.resolve.repoRoot,
+                        args.resolve.designRoot
+                      ),
+                    }
+                  : VIDEO_FORMATS.has(args.format)
+                    ? {
+                        ...args.options,
+                        // The <Audio>/<OffthreadVideo> pre-flight reads the canvas
+                        // source — same "only the cell has the checkout" rule.
+                        unsupportedMedia: readUnsupportedMediaFor(
+                          remoteTargets,
+                          args.resolve.repoRoot,
+                          args.resolve.designRoot
+                        ),
+                      }
+                    : args.options,
               canvas: args.remoteCanvas ?? { origin: '' },
               // resolveRenderService() is non-null on the `remote` lane by
               // construction (the lane IS the presence of MAUDE_RENDER_URL).
@@ -438,6 +568,38 @@ export function createExportJobQueue(bus: Bus, designRoot: string): ExportJobQue
     enqueue,
     get: (id) => jobs.get(id),
     list: () => Array.from(jobs.values()).sort((a, b) => b.createdAt.localeCompare(a.createdAt)),
+    recordBrowserExport({ format, scope, filename }) {
+      const now = new Date().toISOString();
+      const job: ExportJob = {
+        id: crypto.randomUUID(),
+        format,
+        scope,
+        options: {},
+        status: 'done',
+        createdAt: now,
+        startedAt: now,
+        finishedAt: now,
+        filename,
+        deliveredInBrowser: true,
+      };
+      jobs.set(job.id, job);
+      emit(job);
+      // Fire-and-forget: the member already HAS the file, so a slow ledger
+      // write must not gate their UI, and a failed one must not fail an export
+      // that already succeeded.
+      void persistAndEvict().catch(() => {});
+      return {
+        id: job.id,
+        format,
+        scope,
+        filename,
+        at: now,
+        status: 'done',
+        startedAt: now,
+        finishedAt: now,
+        deliveredInBrowser: true,
+      };
+    },
     loadHistory: deriveHistory,
     async getBytes(id) {
       const job = jobs.get(id);

package/apps/studio/exporters/pdf.ts

@@ -65,6 +65,20 @@ export function artboardIdFromCssPath(cssPath: string): string | null {
   return m ? (m[1] as string) : null;
 }
 
+/**
+ * `options.printProps` — `{ [repoRelativeCanvasFile]: { [artboardId]: print } }`,
+ * attached by the cell when the job dispatches to the render worker
+ * (exporters/jobs.ts). Shape-checked here because it crosses a trust boundary
+ * (the job body reaches the worker over HTTP); anything else is ignored.
+ */
+function shippedPrintProps(
+  options: ExportOptions
+): Record<string, Record<string, Record<string, unknown>>> | null {
+  const raw = (options as { printProps?: unknown }).printProps;
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return null;
+  return raw as Record<string, Record<string, Record<string, unknown>>>;
+}
+
 /** Resolve a client-supplied `sourceFile` (from `options.selection.file`, a
  *  main-origin but caller-controlled string — see scope.ts's `readHints`)
  *  against `repoRoot`, rejecting anything that escapes it — mirrors
@@ -423,7 +437,13 @@ export async function run(
         const pageIndex = out.getPageCount();
         out.addPage(page);
         let printProp: Record<string, unknown> | null = null;
-        if (w.artboardId) {
+        // The cell ships the print props inside a REMOTE job (it has the
+        // checkout; this process may not — DDR-230). Prefer them; fall back to
+        // reading the source on disk for the local lane.
+        const shipped = shippedPrintProps(options);
+        if (w.artboardId && shipped) {
+          printProp = shipped[w.sourceFile]?.[w.artboardId] ?? null;
+        } else if (w.artboardId) {
           const abs = resolveSourceFileUnderRoot(ctx.repoRoot, w.sourceFile);
           if (abs) {
             let text = sourceCache.get(abs);

package/apps/studio/exporters/pptx.ts

@@ -269,30 +269,58 @@ function pngArgsFor(target: ElementTarget, url: string, outDir: string): string[
 
 // ─── PNG fallback deck ────────────────────────────────────────────────────────
 
-async function buildPngDeck(pngPaths: string[]): Promise<Uint8Array> {
+/**
+ * DDR-231 (hybrid export lanes) — the browser-free half of the PNG deck,
+ * working on BYTES so the workspace assemble route (`/_api/export-assemble`)
+ * can feed it captures made in the MEMBER's browser: the client's
+ * export-capture bridge rasterizes the artboards, this composes the .pptx
+ * in-cell with PptxGenJS (pure JS — same containment class as zip). The
+ * desktop path below ({@link buildPngDeck}) is a thin file-reading wrapper,
+ * so both hosts share one composition (the single-spine rule).
+ *
+ * @param captureScale the deviceScale the PNGs were rendered at — slide
+ *   dimensions normalise back to artboard inches through it.
+ */
+export async function assemblePngDeck(
+  images: Uint8Array[],
+  captureScale: number
+): Promise<Uint8Array> {
   const JSZip = (await import('jszip')).default;
-  // Slide size from the first PNG (px → inches); contain-fit the rest.
-  const dims = pngPaths.map((p) => {
+  // The full 8-byte PNG signature (security L3 — 4 bytes let a `\x89PNG…`
+  // prefix on non-PNG bytes through) and a sane dimension ceiling (security
+  // F3 — the images arrive from the untrusted client; an IHDR claiming
+  // 2^31×2^31 would drive PptxGenJS's EMU geometry into overflow/garbage).
+  const PNG_SIG = [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a];
+  const MAX_DIM = 20000; // px — above any real artboard × 8× export scale
+  // Slide size from the largest PNG (px → inches); contain-fit the rest.
+  const dims = images.map((bytes) => {
     // PNG IHDR: width @ byte 16, height @ 20 (big-endian).
-    const b = readFileSync(p);
-    return { w: b.readUInt32BE(16), h: b.readUInt32BE(20), p };
+    const b = Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    if (b.length < 24 || PNG_SIG.some((sig, i) => b[i] !== sig)) {
+      throw new Error('assemblePngDeck: not a PNG');
+    }
+    const w = b.readUInt32BE(16);
+    const h = b.readUInt32BE(20);
+    if (w < 1 || h < 1 || w > MAX_DIM || h > MAX_DIM) {
+      throw new Error(`assemblePngDeck: implausible PNG dimensions ${w}×${h}`);
+    }
+    return { w, h, b };
   });
   const maxW = Math.max(...dims.map((d) => d.w));
   const maxH = Math.max(...dims.map((d) => d.h));
-  // The PNGs are FALLBACK_SCALE× the artboard; normalise to artboard inches.
-  const slideW = maxW / SCREEN_DPI / FALLBACK_SCALE;
-  const slideH = maxH / SCREEN_DPI / FALLBACK_SCALE;
+  const slideW = maxW / SCREEN_DPI / captureScale;
+  const slideH = maxH / SCREEN_DPI / captureScale;
   const pptx = new PptxGenJS();
   pptx.defineLayout({ name: 'MAUDE_ARTBOARD', width: slideW, height: slideH });
   pptx.layout = 'MAUDE_ARTBOARD';
   for (const d of dims) {
     const slide = pptx.addSlide();
-    const nativeW = d.w / SCREEN_DPI / FALLBACK_SCALE;
-    const nativeH = d.h / SCREEN_DPI / FALLBACK_SCALE;
+    const nativeW = d.w / SCREEN_DPI / captureScale;
+    const nativeH = d.h / SCREEN_DPI / captureScale;
     const scale = Math.min(slideW / nativeW, slideH / nativeH);
     const w = nativeW * scale;
     const h = nativeH * scale;
-    const dataUri = `data:image/png;base64,${readFileSync(d.p).toString('base64')}`;
+    const dataUri = `data:image/png;base64,${d.b.toString('base64')}`;
     slide.addImage({ data: dataUri, x: (slideW - w) / 2, y: (slideH - h) / 2, w, h });
   }
   const buf = new Uint8Array((await pptx.write({ outputType: 'nodebuffer' })) as Uint8Array);
@@ -310,6 +338,13 @@ async function buildPngDeck(pngPaths: string[]): Promise<Uint8Array> {
   return zip.generateAsync({ type: 'uint8array' });
 }
 
+async function buildPngDeck(pngPaths: string[]): Promise<Uint8Array> {
+  return assemblePngDeck(
+    pngPaths.map((p) => new Uint8Array(readFileSync(p))),
+    FALLBACK_SCALE
+  );
+}
+
 export async function run(
   targets: Target[],
   options: ExportOptions,

package/apps/studio/exporters/remote.ts

@@ -149,6 +149,41 @@ export class NoRenderServiceError extends Error {
  * artifact as a normal `ExportResult`. Degradation travels back as a JSON
  * header rather than a wrapped body so the artifact bytes stream unmodified.
  */
+/**
+ * Keys a render adapter legitimately consumes (grepped from `exporters/*.ts`
+ * `options.*` reads). Scope hints (`canvasFile`/`artboardId`/`selection`) are
+ * deliberately absent — the cell resolves scope into `targets` before dispatch,
+ * so the worker never needs them. `printProps`/`unsupportedMedia` are re-set by
+ * the cell AFTER this pick (jobs.ts), so they pass through here too.
+ */
+const REMOTE_OPTION_KEYS = new Set([
+  'scale',
+  'dpi',
+  'mode',
+  'raster',
+  'pageFit',
+  'pdfPrint',
+  'audio',
+  'allowUnsupportedMedia',
+  'timeoutSec',
+  'durationMs',
+  'fps',
+  'frameFormat',
+  'frames',
+  'gifColors',
+  'maxFrames',
+  'printProps',
+  'unsupportedMedia',
+]);
+
+function pickRemoteOptions(options: ExportOptions): ExportOptions {
+  const out: ExportOptions = {};
+  for (const [k, v] of Object.entries(options)) {
+    if (REMOTE_OPTION_KEYS.has(k)) out[k] = v;
+  }
+  return out;
+}
+
 export async function renderRemotely(args: {
   format: Format;
   targets: Target[];
@@ -165,21 +200,60 @@ export async function renderRemotely(args: {
   // sandbox on first access, so `_canvas-shell.html` can take far longer than
   // 8s to fire `load`. Give the remote path a generous floor (unless the
   // caller asked for more) so a cold-cell first render doesn't time out.
+  // ALLOWLIST what crosses to the worker (security review F3). `options` is a
+  // free-form bag the requesting member (a viewer, in a workspace) fills, and
+  // the worker is the fleet's least-trusted process (DDR-230) shared across
+  // tenants. Forward ONLY the keys the render adapters actually read — an
+  // unknown attacker key never reaches worker code, and the scope-only hints
+  // (canvasFile / artboardId / selection) that were already consumed cell-side
+  // to build `targets` don't leak the canvas path onward.
   const remoteOptions: ExportOptions = {
-    ...options,
+    ...pickRemoteOptions(options),
     timeoutSec: Math.max(Number((options as { timeoutSec?: number }).timeoutSec) || 0, 60),
   };
-  const res = await fetch(`${service.url}/render`, {
-    method: 'POST',
-    signal,
-    headers: {
-      'content-type': 'application/json',
-      authorization: `Bearer ${service.secret}`,
-    },
-    body: JSON.stringify({ format, targets, options: remoteOptions, canvas }),
-  });
+  let res: Response;
+  try {
+    // Bun's `fetch` has its OWN default ceiling — 300 s — independent of the
+    // signal, and it rejects with a plain TimeoutError that the catch below
+    // read as "the service didn't answer". Every video job longer than five
+    // minutes failed that way (measured: 300 s exactly; `timeout: false`
+    // lifts it). The JOB timeout (exporters/jobs.ts jobTimeoutMs, sized to
+    // the frame count) is the governor here, through `signal`; the fetch
+    // must not carry a second, shorter one.
+    // `timeout` is a Bun extension the bundled RequestInit types don't declare
+    // (bun 1.3.3); the runtime honours it — see the measurement above.
+    const init: RequestInit & { timeout: false } = {
+      method: 'POST',
+      signal,
+      timeout: false,
+      headers: {
+        'content-type': 'application/json',
+        authorization: `Bearer ${service.secret}`,
+      },
+      body: JSON.stringify({ format, targets, options: remoteOptions, canvas }),
+    };
+    const postStart = Date.now();
+    console.error(`[remote] POST ${format} → ${service.url}/render`);
+    res = await fetch(`${service.url}/render`, init);
+    console.error(`[remote] ${format} responded ${res.status} in ${Date.now() - postStart}ms`);
+  } catch (err) {
+    if (signal?.aborted) throw err;
+    // DDR-231 T7 — the member sees this in the export dialog / notification
+    // center: name the LIKELY cause (a sleeping container waking) instead of
+    // leaking a bare fetch error.
+    throw new Error(
+      'The render service didn’t answer — it may still be waking up. Try the export again in a minute.'
+    );
+  }
+  if (res.status === 503) {
+    throw new Error('The render service is busy with other exports right now — try again shortly.');
+  }
   if (!res.ok) {
     const detail = (await res.text().catch(() => '')) || `${res.status}`;
+    // Surface the worker's failure reason on the STUDIO side — the worker's own
+    // stderr buffers under render load and is lost when the test kills it, so
+    // this is the only reliable window into WHY a render 500'd.
+    console.error(`[remote] ${format} FAILED ${res.status}: ${detail.slice(0, 800)}`);
     throw new Error(`render service refused the job: ${detail}`);
   }
   // Sanitize the filename BEFORE it can reach `Bun.write` in jobs.ts — the
@@ -191,7 +265,16 @@ export async function renderRemotely(args: {
   const degradedHeader = res.headers.get('x-maude-degraded');
   if (degradedHeader) {
     try {
-      degraded = JSON.parse(degradedHeader) as ExportDegradation;
+      // base64 on the wire — the degradation reason is free text (it can carry
+      // an em-dash, quotes, any Unicode from a renderer error), and a raw JSON
+      // header value is restricted to Latin-1 with no control chars: a `—` in
+      // the reason made the worker's Response construction throw 500 and lose
+      // the whole (successful, degraded) render. Decode base64 first; fall back
+      // to raw JSON so a mixed-version worker/cell still parses.
+      const raw = /^[A-Za-z0-9+/=]+$/.test(degradedHeader)
+        ? Buffer.from(degradedHeader, 'base64').toString('utf8')
+        : degradedHeader;
+      degraded = JSON.parse(raw) as ExportDegradation;
     } catch {
       /* a malformed degradation note must not fail a real artifact */
     }