davinci-resolve-mcp 2.209.1 → 2.210.1

package/CHANGELOG.md

@@ -2,6 +2,98 @@
 
 Release history for the DaVinci Resolve MCP Server. The latest release is summarized in the root README; older entries live here to keep the README focused.
 
+## What's New in v2.210.1 — frame capture and verify_output no longer read JobStatus in English
+
+### Fixed
+
+- **Single-frame capture failed with `RENDER_FAILED` on every non-English Resolve (issue #191).**
+  `GetRenderJobStatus()["JobStatus"]` is a localized display string — `"Concluso"`
+  on an Italian install — and the capture gate compared it to the English word,
+  so a finished render with the file already on disk reported "Render did not
+  complete". Completion is now decided by `_render_job_completed()` on
+  `CompletionPercentage` and `Error`, which are locale-independent, with the
+  file-written check as the real proof. `render.verify_output` carried the same
+  comparison in its "not Complete" warning and its missing-file warning; both
+  use the same rule now, so a localized finished job verifies and a localized
+  failed job still does not. Reported with an exact API readback by
+  @gabrieleleonardi-sya.
+
+### Documentation
+
+- New API truth entry for the localized `JobStatus` field, submitted to the
+  Blackmagic-facing report as a missing locale-independent status code, and a
+  regenerated `docs/reference/api-limitations.md`.
+
+### Validation
+
+- Unit tests cover the reporter's readback (`Concluso` at 100%), a localized
+  failed job carrying `Error`, and a localized incomplete job without one; the
+  English fast path is unchanged. No localized Resolve is available on the
+  release machine, so the live evidence is the reporter's session on Studio
+  21.0.2.4.
+
+## What's New in v2.210.0 — every destructive action now carries a real risk rating
+
+### Changed
+
+- **All 108 registered destructive actions are classified; 80 of them were not.**
+  Safe mode blocks established HIGH and CRITICAL, and the classifier's `else`
+  branch returns MEDIUM with `risk_established: false` — an honest "no rule
+  matched", but not something a gate can act on. So `timeline.move_clips`,
+  `timeline.ripple_insert`, `timeline.create_compound_clip`,
+  `timeline.import_into_timeline`, `graph.apply_grade_from_drx`,
+  `timeline_item_color.copy_grades`, `timeline_item_takes.finalize` and the
+  three `edit_engine` plan executors all passed a gate that was meant to stop
+  them. Safe mode now gates 35 actions where it previously gated 20.
+
+  Every rating was taken from the action's handler rather than its name, since
+  the name heuristic is the thing being replaced. Two results worth calling out:
+
+  - `timeline.move_clips` passes `delete_sources=True` to the duplicate helper,
+    so it removes the originals — it is a deletion wearing a move's name.
+  - `timeline_item.update_sidecar` is the only registered action that writes
+    **outside the project**: it rewrites the `.braw` sidecar or R3D `.RMD` file
+    next to the camera original. No Resolve undo reaches it, and it changes how
+    that media reads in every other application. Rated HIGH.
+
+  New distribution across the 108: 2 critical, 33 high, 35 medium, 38 low.
+
+- **`MEDIUM` now means something.** It was overwhelmingly the fallthrough, so an
+  assessed MEDIUM and an unrated action were indistinguishable by level alone. A
+  `_MEDIUM_RISK_ACTIONS` table makes it a finding, and `risk_established`
+  separates the two everywhere risk is reported.
+
+### Fixed
+
+- **The operator's saved `setup` defaults decided what the test suite did.**
+  `logs/media-analysis-preferences.json` holds real defaults including
+  `destructive.safe_mode`. Tests that call `setup` already overrode the path,
+  but the other three thousand read it — so with safe mode left enabled on a
+  machine, seventeen tests across `test_cut_executor`, `test_keyed_param_guards`,
+  `test_media_pool_changes`, `test_media_pool_delete_governance` and
+  `test_delete_clips_readback_retry` failed with "Safe mode blocked
+  critical-risk action". A red suite produced by a setting rather than by the
+  code, and it would have looked exactly like a regression in this release.
+
+  `tests/offline_guard` now redirects the preferences path for the whole run,
+  alongside the audit-log redirect added in v2.209.1. Pinned by a test asserting
+  the active path is never the operator's file, and by one asserting the guard
+  names the same environment variable the server reads — a mismatch there would
+  fail open and silently.
+
+### Added
+
+- **A guard test asserting no registered destructive action is unrated**, so a
+  newly registered action cannot silently rejoin the ungated set — which is how
+  the 80 accumulated. Registering an action and rating it are now one commit.
+- **A test pinning that `inspect_operation` and the safe-mode gate report the
+  same level** for all 108 actions. They read one classifier; the failure mode
+  if they ever diverge is silent.
+
+Live-validated against DaVinci Resolve Studio 19.1.3.7: the four newly-HIGH
+actions probed are refused with the timeline unchanged, the newly LOW/MEDIUM
+ones still pass, and every audit row carries `risk_established: true`.
+
 ## What's New in v2.209.1 — the test suite no longer writes to the security audit log
 
 ### Fixed

package/README.md

@@ -2,7 +2,7 @@
 
 English | [简体中文](README.zh-CN.md)
 
-[![Version](https://img.shields.io/badge/version-2.209.1-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-2.210.1-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-36%20(353%20full)-blue.svg)](#server-modes)

package/README.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | 简体中文
 
-[![Version](https://img.shields.io/badge/version-2.209.1-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-2.210.1-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-36%20(353%20full)-blue.svg)](#服务器模式)
@@ -12,7 +12,7 @@
 [![Python](https://img.shields.io/badge/python-3.10+-green.svg)](https://www.python.org/downloads/)
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 
-> 本翻译对应 v2.209.1 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
+> 本翻译对应 v2.210.1 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
 
 一个 Model Context Protocol (MCP) 服务器，让 AI 助手通过官方脚本 API 控制 DaVinci Resolve Studio（达芬奇）。它提供完整的 API 覆盖，外加带护栏的工作流助手，涵盖剪辑、媒体池整理、渲染设置、审阅标记、调色、Fusion、Fairlight、项目生命周期任务、扩展开发，以及不碰源媒体的媒体分析。
 

package/docs/reference/api-limitations.md

@@ -12,7 +12,7 @@ that none exists).
 
 **Verified on:** DaVinci Resolve Studio 21.0.2
 
-**Totals:** 41 missing capabilities, 50 bugs / unreliable behaviors.
+**Totals:** 42 missing capabilities, 50 bugs / unreliable behaviors.
 
 The authoritative source is the runtime-queryable `api_truth` ledger
 (`resolve_control api_truth "<query>"`); this document is generated from
@@ -228,6 +228,15 @@ equivalent, blocking full automation.
 - **Workaround / current handling:** capture_media_template harvests mediaStartTime and the native clip elements; drt.assemble clones the source's own captured clip per cut (render-verified: the TC-bearing source plays picture and audio, and the full AAF route renders frame-accurately). Re-capture templates for TC-bearing media. The assemble bridge merges identical audio channel legs (report.audioChannelLegsMerged) instead of refusing them as a same-track overlap.
 - **Tags:** timecode, aaf, audio, drt, silent-failure
 
+### Project.GetRenderJobStatus JobStatus (localized display string)
+
+- **Object:** `Project`
+- **Signature:** `(jobId) -> {JobStatus, CompletionPercentage, TimeTakenToRenderInMs, Error?}`
+- **Behavior:** JobStatus is a display string that follows the application language, not an enum. An English install reports "Complete"; an Italian install reports "Concluso" for the same finished job — read back as {JobStatus: "Concluso", CompletionPercentage: 100, TimeTakenToRenderInMs: 1225} on Studio 21.0.2.4 / macOS 15 with the output file complete on disk (issue #191, reporter's session). Any code that compares the field to the English word fails every non-English Resolve with an error that says the opposite of what happened; this server's single-frame capture did exactly that until v2.210.1. CompletionPercentage is numeric and locale-independent, and Error is populated on a failed job in every language.
+- **Workaround / current handling:** Never gate on the JobStatus string. Treat a job as finished when CompletionPercentage reaches 100 and Error is empty, then confirm the output file exists — the file is the real proof either way (see the recordFrame entry above for a Complete job that wrote a stub). Report JobStatus verbatim for humans only. This server's _render_job_completed() applies the rule to frame capture and render.verify_output.
+- **Reference:** [issue #191](https://github.com/samuelgursky/davinci-resolve-mcp/issues/191)
+- **Tags:** render, localization, silent-failure
+
 ### MediaPool.ImportMedia (current-folder destination only)
 
 - **Object:** `MediaPool`

package/install.py

@@ -37,7 +37,7 @@ from src.utils.update_check import (
 
 # ─── Version ──────────────────────────────────────────────────────────────────
 
-VERSION = "2.209.1"
+VERSION = "2.210.1"
 # Only hard floor: mcp[cli] requires Python 3.10+. There is no upper bound —
 # Resolve's scripting bridge loads into newer interpreters on recent builds
 # (Python 3.14 verified against Resolve Studio 20.3.2). Older Resolve builds

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "davinci-resolve-mcp",
-  "version": "2.209.1",
+  "version": "2.210.1",
   "description": "NPM bootstrapper for the DaVinci Resolve MCP Server.",
   "license": "MIT",
   "author": "Samuel Gursky <samgursky@gmail.com>",

package/src/granular/common.py

@@ -87,7 +87,7 @@ if not logging.getLogger().handlers:
         handlers=[logging.StreamHandler()],
     )
 
-VERSION = "2.209.1"
+VERSION = "2.210.1"
 logger = logging.getLogger("davinci-resolve-mcp")
 logger.info(f"Starting DaVinci Resolve MCP Server v{VERSION}")
 logger.info(f"Detected platform: {get_platform()}")

package/src/server.py

@@ -11,7 +11,7 @@ Usage:
     python src/server.py --full       # Start the 353-tool granular server instead
 """
 
-VERSION = "2.209.1"
+VERSION = "2.210.1"
 
 import base64
 import os
@@ -14823,6 +14823,28 @@ def _playhead_frame_preview(tl, p: Dict[str, Any]):
             _restore_playhead(tl, original_tc, what="the thumbnail capture")
 
 
+def _render_job_completed(status: Optional[Dict[str, Any]]) -> bool:
+    """Whether GetRenderJobStatus says the job finished — without reading English.
+
+    JobStatus is a localized display string that follows the application
+    language: "Complete" on an English install, "Concluso" on an Italian one
+    (issue #191). Comparing it to the English literal fails every non-English
+    Resolve with an error that says the opposite of what happened. The
+    locale-independent signals are CompletionPercentage (numeric) and Error
+    (populated on a failed job), so those decide; the English literal is kept
+    only as a fast path for the common case.
+    """
+    status = status or {}
+    if str(status.get("JobStatus") or "") == "Complete":
+        return True
+    if status.get("Error"):
+        return False
+    try:
+        return float(status.get("CompletionPercentage")) >= 100
+    except (TypeError, ValueError):
+        return False
+
+
 def _playhead_frame_render(proj, tl, p: Dict[str, Any]):
     """Render exactly one frame — the only frame-accurate capture route.
 
@@ -14944,9 +14966,14 @@ def _playhead_frame_render(proj, tl, p: Dict[str, Any]):
             time.sleep(0.25)
             waited += 0.25
         status = _ser(proj.GetRenderJobStatus(job)) or {}
-        if status.get("JobStatus") != "Complete":
+        # Localized JobStatus ("Concluso" on an Italian install, issue #191)
+        # cannot be compared to the English word; the file check below is the
+        # real proof anyway.
+        if not _render_job_completed(status):
             return _err(
-                f"Render did not complete: {status.get('JobStatus')}",
+                f"Render did not complete: JobStatus {status.get('JobStatus')!r} "
+                f"at {status.get('CompletionPercentage')}%"
+                + (f" — {status.get('Error')}" if status.get("Error") else ""),
                 code="RENDER_FAILED", category="api_error",
                 state={"status": status, "frame": frame},
             )
@@ -20350,16 +20377,19 @@ def render(action: str, params: Optional[Dict[str, Any]] = None) -> Dict[str, An
                                 "issue #164)."
                             )
             else:
-                if status.get("JobStatus") == "Complete":
+                if _render_job_completed(status):
                     warnings.append(
-                        "JobStatus is Complete but the output file does not exist."
+                        f"JobStatus is {job_status!r} (complete) but the output "
+                        "file does not exist."
                     )
-        if job_status and job_status != "Complete":
+        if job_status and not _render_job_completed(status):
             # Spotted live: a Failed job that wrote a stub file otherwise
             # produced verified:true — a duration ratio means nothing when
-            # Resolve itself says the job did not complete.
+            # Resolve itself says the job did not complete. Decided on the
+            # locale-independent fields, not the JobStatus word (issue #191).
             warnings.append(
-                f"JobStatus is {job_status!r}, not Complete"
+                f"JobStatus is {job_status!r} at "
+                f"{status.get('CompletionPercentage')}%, not complete"
                 + (f": {status.get('Error')}" if status.get("Error") else "")
             )
         result["warnings"] = warnings

package/src/utils/api_truth.py

@@ -2182,6 +2182,37 @@ API_TRUTH: List[Dict[str, Any]] = [
         "tags": ["timeline", "edit", "render", "silent-failure", "media-pool"],
         "issue": 164,
     },
+    {
+        "symbol": "Project.GetRenderJobStatus JobStatus (localized display string)",
+        "object": "Project",
+        "signature": "(jobId) -> {JobStatus, CompletionPercentage, "
+                     "TimeTakenToRenderInMs, Error?}",
+        "reality": "JobStatus is a display string that follows the application "
+                   "language, not an enum. An English install reports "
+                   "\"Complete\"; an Italian install reports \"Concluso\" for "
+                   "the same finished job — read back as {JobStatus: "
+                   "\"Concluso\", CompletionPercentage: 100, "
+                   "TimeTakenToRenderInMs: 1225} on Studio 21.0.2.4 / macOS 15 "
+                   "with the output file complete on disk (issue #191, "
+                   "reporter's session). Any code that compares the field to "
+                   "the English word fails every non-English Resolve with an "
+                   "error that says the opposite of what happened; this "
+                   "server's single-frame capture did exactly that until "
+                   "v2.210.1. CompletionPercentage is numeric and "
+                   "locale-independent, and Error is populated on a failed "
+                   "job in every language.",
+        "recommended": "Never gate on the JobStatus string. Treat a job as "
+                       "finished when CompletionPercentage reaches 100 and "
+                       "Error is empty, then confirm the output file exists — "
+                       "the file is the real proof either way (see the "
+                       "recordFrame entry above for a Complete job that wrote "
+                       "a stub). Report JobStatus verbatim for humans only. "
+                       "This server's _render_job_completed() applies the rule "
+                       "to frame capture and render.verify_output.",
+        "tags": ["render", "localization", "silent-failure"],
+        "submit": "missing",
+        "issue": 191,
+    },
     {
         "symbol": "Timeline.DeleteClips (requires the Edit page; flaky first attempt)",
         "object": "Timeline",

package/src/utils/execution_lifecycle.py

@@ -145,12 +145,48 @@ class RiskClassificationHook(LifecycleHook):
         ("timeline", "overwrite_range"),
         ("timeline", "apply_cuts"),
         ("graph", "reset_all_grades"),
+        # Plan execution: each rebuilds the timeline from the plan's lifts and
+        # keep_ranges. Same shape as execute_selects and ripple_trim above.
+        ("edit_engine", "execute_tighten"),
+        ("edit_engine", "execute_swap"),
+        ("edit_engine", "execute_silence_ripple"),
+        # Restructuring. move_clips passes delete_sources=True, so the originals
+        # are removed; ripple_insert shifts everything downstream of the insert;
+        # compound/fusion clips replace the selected items with a container and
+        # rewire what the timeline points at.
+        ("timeline", "move_clips"),
+        ("timeline", "ripple_insert"),
+        ("timeline", "create_compound_clip"),
+        ("timeline", "create_fusion_clip"),
+        # ImportIntoTimeline lays an external edit over the timeline;
+        # ConvertTimelineToStereo rewrites the audio track layout and has no
+        # inverse; DetectSceneCuts cuts every clip it decides to cut.
+        ("timeline", "import_into_timeline"),
+        ("timeline", "convert_to_stereo"),
+        ("timeline_ai", "detect_scene_cuts"),
+        # Grades that are replaced wholesale. apply_grade_from_drx documents
+        # itself as replacing the entire node graph with no append mode;
+        # CopyGrades overwrites each target's grade.
+        ("graph", "apply_grade_from_drx"),
+        ("timeline_item_color", "copy_grades"),
+        # Takes. delete removes one; finalize collapses the item to the selected
+        # take and discards the rest.
+        ("timeline_item_takes", "delete"),
+        ("timeline_item_takes", "finalize"),
+        # The only action here that writes OUTSIDE the project: UpdateSidecar
+        # rewrites the .braw sidecar or R3D .RMD file next to the camera
+        # original. No Resolve undo reaches it, and it changes how that media
+        # is interpreted by every other application that reads it.
+        ("timeline_item", "update_sidecar"),
     }
 
-    #: Mutating, but bounded and trivially reversible — a marker or a clip
-    #: colour. Without this table the name heuristic files them under MEDIUM
-    #: and flags them unrecognised, i.e. it warns that the risk is unestablished
-    #: for the actions whose risk is the best established of any we dispatch.
+    #: Mutating, but bounded and trivially reversible — a marker, a clip colour,
+    #: a toggle, or a newly created empty container. Nothing that already exists
+    #: is altered or removed, and the inverse is a single action.
+    #:
+    #: Without this table the name heuristic files them under MEDIUM and flags
+    #: them unrecognised, i.e. it warns that the risk is unestablished for the
+    #: actions whose risk is the best established of any we dispatch.
     _LOW_RISK_ACTIONS: Set[Tuple[str, str]] = {
         ("timeline_markers", "add"),
         ("timeline_markers", "update_custom_data"),
@@ -159,6 +195,103 @@ class RiskClassificationHook(LifecycleHook):
         ("timeline_item_markers", "clear_flags"),
         ("timeline_item_markers", "set_clip_color"),
         ("timeline_item_markers", "clear_clip_color"),
+        ("timeline_item_markers", "update_custom_data"),
+        # Marks and flags: metadata on a clip, no frames touched.
+        ("timeline", "set_mark_in_out"),
+        ("timeline", "clear_mark_in_out"),
+        ("media_pool", "set_clip_marks"),
+        ("media_pool", "clear_clip_marks"),
+        # Track-level toggles and labels. SetTrackEnable/SetTrackLock/SetTrackName
+        # change no content; add_track creates an empty container.
+        ("timeline", "add_track"),
+        ("timeline", "set_track_enable"),
+        ("timeline", "set_track_lock"),
+        ("timeline", "set_track_name"),
+        ("timeline", "set_clips_linked"),
+        ("timeline", "set_title_text"),
+        # DuplicateTimeline writes a new timeline; the original is untouched.
+        ("timeline", "duplicate"),
+        # CreateEmptyTimeline / CreateStereoClip only add. `create_timeline`'s
+        # if_exists policy is version/reuse/fail — it has no overwrite path, so
+        # it cannot replace an existing timeline.
+        ("media_pool", "create_timeline"),
+        ("media_pool", "create_timeline_from_clips"),
+        ("media_pool", "create_stereo_clip"),
+        # Per-item display properties: set them back and the item is as it was.
+        ("timeline_item", "set_clip_enabled"),
+        ("timeline_item", "set_name"),
+        ("timeline_item", "set_crop"),
+        ("timeline_item", "set_transform"),
+        ("timeline_item", "set_composite"),
+        ("timeline_item", "set_audio"),
+        # Cache toggles and node *labels* — not grades.
+        ("timeline_item_color", "set_color_cache"),
+        ("timeline_item_color", "set_fusion_cache"),
+        ("timeline_item_color", "reset_all_node_colors"),
+        ("timeline_item_color", "rename_version"),
+        ("timeline_item_fusion", "add_comp"),
+        ("timeline_item_fusion", "rename_comp"),
+        ("timeline_item_takes", "add"),
+        ("timeline_item_takes", "select"),
+        ("graph", "set_node_enabled"),
+    }
+
+    #: A real assessment landing between LOW and HIGH: existing content or
+    #: settings are altered, recovery is possible but is not one trivial
+    #: inverse. This table exists so that MEDIUM can mean something — before it,
+    #: MEDIUM was overwhelmingly the `else` fallthrough, which made an assessed
+    #: MEDIUM and an unrated action indistinguishable by level alone.
+    _MEDIUM_RISK_ACTIONS: Set[Tuple[str, str]] = {
+        # Additive edits that place content into an existing timeline. Nothing
+        # is deleted (`overwrite_range`, which does delete, is HIGH), but the
+        # timeline is no longer what it was.
+        ("timeline", "copy_clips"),
+        ("timeline", "duplicate_clips"),
+        ("timeline", "copy_range"),
+        ("timeline", "duplicate_range"),
+        ("timeline", "insert_generator"),
+        ("timeline", "insert_title"),
+        ("timeline", "insert_fusion_generator"),
+        ("timeline", "insert_fusion_title"),
+        ("timeline", "insert_fusion_composition"),
+        ("timeline", "insert_ofx_generator"),
+        ("media_pool", "append_to_timeline"),
+        # Timeline-wide settings. No content lost, but a wrong start timecode
+        # silently invalidates every conform and reference built against it.
+        ("timeline", "set_setting"),
+        ("timeline", "set_start_timecode"),
+        ("timeline", "set_voice_isolation_state"),
+        ("timeline_item", "set_voice_isolation_state"),
+        # `set_property` takes an arbitrary key/value, so its blast radius is
+        # whatever the caller passed; `set_retime` changes duration and sync.
+        ("timeline_item", "set_property"),
+        ("timeline_item", "set_retime"),
+        # Pool reorganisation: clips and bins move, nothing is destroyed, but
+        # paths other work depends on change underneath it.
+        ("media_pool", "move_clips"),
+        ("media_pool", "move_folders"),
+        ("media_pool", "auto_sync_audio"),
+        ("media_pool", "setup_multicam_timeline"),
+        # Analysis passes that write their results back onto the timeline.
+        ("timeline_ai", "create_subtitles"),
+        ("timeline_ai", "analyze_dolby_vision"),
+        # Grade state that is replaced rather than removed. AddVersion also
+        # switches the active version, so a later graph write lands on the new
+        # one — the reason a "pre-change" backup version can end up holding the
+        # post-change grade.
+        ("timeline_item_color", "add_version"),
+        ("timeline_item_color", "load_version"),
+        ("timeline_item_color", "set_cdl"),
+        ("timeline_item_color", "assign_color_group"),
+        ("timeline_item_color", "stabilize"),
+        ("timeline_item_color", "smart_reframe"),
+        ("timeline_item_color", "create_magic_mask"),
+        ("timeline_item_color", "regenerate_magic_mask"),
+        ("graph", "set_lut"),
+        ("graph", "apply_arri_cdl_lut"),
+        # Importing or switching the active comp changes what renders.
+        ("timeline_item_fusion", "import_comp"),
+        ("timeline_item_fusion", "load_comp"),
     }
 
     _READ_ONLY_PREFIXES = ("get_", "list_", "query_", "probe_", "inspect_", "export_", "check_")
@@ -195,6 +328,17 @@ class RiskClassificationHook(LifecycleHook):
             destructive = True
             radius = BlastRadius.ITEM
             reasons.append(f"Bounded reversible edit: {action}")
+        elif pair in cls._MEDIUM_RISK_ACTIONS:
+            level = RiskLevel.MEDIUM
+            destructive = True
+            # Scope follows the tool: the timeline and pool tools act on the
+            # timeline or the pool as a whole, the per-item tools on one item.
+            radius = (
+                BlastRadius.TIMELINE
+                if tool_name in {"timeline", "timeline_ai", "edit_engine", "media_pool"}
+                else BlastRadius.ITEM
+            )
+            reasons.append(f"Recoverable edit to existing state: {action}")
         elif any(action.startswith(p) for p in cls._READ_ONLY_PREFIXES) or action in {"read", "status", "info"}:
             level = RiskLevel.LOW
             destructive = False