#1743: use existing CI and consolidate render source documentation

.github/workflows/render-source-protection.yml

@@ -1,36 +0,0 @@
-name: Render source protection
-
-on:
-  pull_request:
-    paths:
-      - .github/workflows/render-source-protection.yml
-      - Cargo.toml
-      - Cargo.lock
-      - crates/engine/**
-      - crates/project/src/render_queue.rs
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  regression:
-    name: Source guard (${{ matrix.os }})
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 30
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, windows-latest]
-    env:
-      CARGO_PROFILE_DEV_DEBUG: 0
-      CARGO_PROFILE_TEST_DEBUG: 0
-      CARGO_INCREMENTAL: 0
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: dtolnay/rust-toolchain@1.95.0
-      - run: cargo test --locked -p effectcraft-engine --lib output_guard::tests
-      - run: cargo test --locked -p effectcraft-engine --lib tests::render_overwrite
-      - run: cargo test --locked -p effectcraft-project render_queue::tests

docs/agents.md

@@ -5,7 +5,7 @@ panel gestures, the CLI, the control channel and MCP all go through the same com
 user can do, an agent can do too. There are three ways in:
 
 Render-queue outputs cannot replace footage, proxies or the project file. See
-[render source protection](render-source-protection.md) for aliases, default names and sequence
+[render source protection](file-format-parity.md#render-source-protection) for aliases, default names and sequence
 limits. This guard does not change ordinary-file overwrite defaults or add another confirmation API.
 
 | Interface | Best for | Needs a window |

docs/file-format-parity.md

@@ -105,6 +105,37 @@ single-file video (Animation / PNG codecs), DPX / Targa / Photoshop sequences, M
 encoders ([hardware-parity.md](hardware-parity.md)), and rendering safely over an existing file
 (#325).
 
+### Render source protection
+
+The render queue refuses an output that would replace footage, an attached proxy, or the
+project file. It checks every output module and segment before dispatching the item. A refused
+item is marked Failed with its reason; other valid queued items can still render. Render logs
+are checked too. No render parameter overrides this protection.
+
+Checks compare normalized paths and native file identities, so an existing symbolic link,
+hard link, junction or Windows short name cannot disguise a source as another output file.
+Source identities are indexed once per check and matching identities are verified. The index
+does not keep file handles open for the lifetime of a long sequence.
+
+Default output names move aside when they would replace a protected file. This also applies to
+Create Proxy: recreating a proxy chooses a new default name and attaches the new proxy, leaving
+the previous proxy file intact. An explicit output path is kept as entered and refused if it
+would replace a protected file.
+
+After Pre-render imports its result, that file is footage too. Re-queueing the same item
+with the same output is refused; run Pre-render again for a fresh default output, or choose
+another Output To. An item's `last_output` is not permission to replace imported footage.
+
+Image-sequence checks inspect existing frames in the requested range. Skip Existing Files leaves
+existing frames alone. If a frame number appears in a folder name, the checker probes each
+frame separately and refuses ranges over 100,000 frames instead of silently checking a prefix.
+Choose a fixed output folder or a shorter range for those exports.
+
+This guard does not introduce an overwrite flag, confirmation dialog, or changed replacement
+defaults for the CLI, scripts or MCP. Replacement consent and staging ordinary output files
+belong to the exporter. The source check runs before export; filesystem changes between that
+check and a write still require exporter-side revalidation.
+
 ## Estimate
 
 **≈ 130–230 h**: `.aep` / `.aepx` import 80–160 h (after the owner decision), wiring TGA / DPX /
@@ -115,5 +146,6 @@ relinking 6–12 h, `.mogrt`-compatible templates 15–30 h (partly parallel wit
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-30 | minor | Render-queue source-protection behavior and limits consolidated here from the standalone page |
 | 2026-10-12 | minor | #324 and #514 marked closed; open `.aep` PRs #251 and #860 noted |
 | 2026-10-10 | major | First file format parity document, from the After Effects 26.5 bundle and this repository's import/export registries |

docs/render-source-protection.md

@@ -1,30 +0,0 @@
-# Render source protection
-
-The render queue refuses an output that would replace footage, an attached proxy, or the
-project file. It checks every output module and segment before dispatching the item. A refused
-item is marked Failed with its reason; other valid queued items can still render. Render logs
-are checked too. No render parameter overrides this protection.
-
-Checks compare normalized paths and native file identities, so an existing symbolic link,
-hard link, junction or Windows short name cannot disguise a source as another output file.
-Source identities are indexed once per check and matching identities are verified. The index
-does not keep file handles open for the lifetime of a long sequence.
-
-Default output names move aside when they would replace a protected file. This also applies to
-Create Proxy: recreating a proxy chooses a new default name and attaches the new proxy, leaving
-the previous proxy file intact. An explicit output path is kept as entered and refused if it
-would replace a protected file.
-
-After Pre-render imports its result, that file is footage too. Re-queueing the same item
-with the same output is refused; run Pre-render again for a fresh default output, or choose
-another Output To. An item's `last_output` is not permission to replace imported footage.
-
-Image-sequence checks inspect existing frames in the requested range. Skip Existing Files leaves
-existing frames alone. If a frame number appears in a folder name, the checker probes each
-frame separately and refuses ranges over 100,000 frames instead of silently checking a prefix.
-Choose a fixed output folder or a shorter range for those exports.
-
-This guard does not introduce an overwrite flag, confirmation dialog, or changed replacement
-defaults for the CLI, scripts or MCP. Replacement consent and staging ordinary output files
-belong to the exporter. The source check runs before export; filesystem changes between that
-check and a write still require exporter-side revalidation.