Merge remote-tracking branch 'origin/main' into HEAD

docs/agents.md

@@ -4,6 +4,10 @@ Everything in EffectCraft is an engine command with a stable id and JSON params.
 panel gestures, the CLI, the control channel and MCP all go through the same commands, so anything a
 user can do, an agent can do too. There are three ways in:
 
+Render-queue outputs cannot replace footage, proxies or the project file. See
+[render source protection](file-format-parity.md#render-source-protection) for aliases, default names and sequence
+limits. This guard does not change ordinary-file overwrite defaults or add another confirmation API.
+
 | Interface | Best for | Needs a window |
 |---|---|---|
 | **MCP** (`effectcraft-cli mcp`) | Claude Code and other MCP clients | no (headless), or yes with `--bridge` |
@@ -108,7 +112,7 @@ See [MCP conventions](mcp.md) for core tools, resources, strict arguments, and r
 | `run_script {code, name?}` | Run JavaScript with the After Effects-style scripting object model (`app.project`, `comp.layers.addText(…)`, `layer.property("ADBE Transform Group").property("ADBE Position").setValueAtTime(…)`…). Returns `{ok, result, output, error: {message, line, column}}`; edits are undoable. |
 | `get_project` / `get_comp {comp?}` | Project items, comp settings and layers. |
 | `get_layer {layer, comp?, time?, depth?, flat?}` | A layer's property tree (`depth` limits how many group levels expand). Every node has a `path`. |
-| `get_property {layer, path, comp?, time?}` | A leaf property's value at a time, keyframes and expression. Group paths (for example `geometryOptions`) contain children: inspect them with `get_layer`, then query a leaf such as `geometryOptions/extrusionDepth`. |
+| `get_property {layer, path, comp?, time?}` | A leaf property's value at a time, keyframes and expression; a popup (enum) property adds `options` (`[{value, label}]`, zero-based values, also in `get_layer`). Group paths (for example `geometryOptions`) contain children: inspect them with `get_layer`, then query a leaf such as `geometryOptions/extrusionDepth`. |
 | `set_property {layer, path, value?, time?, timeBase?, expression?, comp?}` | Sets a static value. With `time` it sets a keyframe (`timeBase: "comp"` for comp seconds); with `expression` it sets an expression. |
 | `add_keyframe {layer, path, time+value \| keys:[...], timeBase?, interpolation?, comp?}` | Adds keys (layer seconds, or comp seconds with `timeBase: "comp"`), then optionally applies linear/bezier/hold/easyEase. |
 | `list_effects {filter?, compact?}` | Effect ids, names, categories, GPU / 32-bpc support and parameters; `compact` lists only ids, names and categories. |

docs/control-protocol.md

@@ -45,7 +45,7 @@ printf '{"id":1,"method":"engine.execute","params":{"command":"comp.new","params
 
 Useful query commands for `engine.execute` (they aren't journaled or undoable): `project.summary`,
 `comp.info {comp?}`, `layer.tree {layer, comp?, depth?, time?}` (every node has a `path`),
-`prop.get {layer, path, comp?, time?}`, `editor.state`, `command.list {filter?, enabledOnly?, schemas?}`,
+`prop.get {layer, path, comp?, time?}` (a popup (enum) property also lists its `options`, `[{value, label}]`, as `layer.tree` does), `editor.state`, `command.list {filter?, enabledOnly?, schemas?}`,
 `command.describe {command}` (params doc and JSON Schema), `app.capabilities` (version, counts,
 export formats, parity summary), `jobs.list` (Progress panel jobs, e.g. the background
 `footage.check` after File ▸ Open).

docs/effects.md

@@ -3,7 +3,7 @@
 <!-- Generated from the effect registry (crates/effects/src/catalog.rs); do not edit by hand.
      Regenerate: UPDATE_DOCS=1 cargo test -p effectcraft-effects --lib effects_doc_is_current -->
 
-EffectCraft ships 308 effects with 3033 parameters in total, grouped into the same categories as the Effects & Presets panel. Every effect is our own implementation, written from public behaviour descriptions and standard image-processing literature. Parameter names, order, popup options, units, defaults and ranges follow the reference application so that projects, expressions and muscle memory carry over.
+EffectCraft ships 308 effects with 3034 parameters in total, grouped into the same categories as the Effects & Presets panel. Every effect is our own implementation, written from public behaviour descriptions and standard image-processing literature. Parameter names, order, popup options, units, defaults and ranges follow the reference application so that projects, expressions and muscle memory carry over.
 
 - **GPU**: 280 effects also run on the GPU compositor with identical results.
 - **32**: 308 effects process 32-bit float (HDR, overbright) pixels without clamping.
@@ -325,7 +325,7 @@ Effects are addressed by id (`ec.<category>.<name>`) or display name in commands
 | CC Hair | `ec.sim.cchair` | 20 | GPU | 32 | Implemented |
 | CC Mr. Mercury | `ec.sim.ccmrmercury` | 23 | GPU | 32 | Implemented |
 | CC Particle Systems II | `ec.sim.ccparticlesystems2` | 21 | GPU | 32 | Implemented |
-| CC Particle World | `ec.sim.ccparticleworld` | 35 | GPU | 32 | Implemented |
+| CC Particle World | `ec.sim.ccparticleworld` | 36 | GPU | 32 | Implemented |
 | CC Pixel Polly | `ec.sim.ccpixelpolly` | 10 | GPU | 32 | Implemented |
 | CC Rainfall | `ec.sim.ccrainfall` | 14 | GPU | 32 | Implemented |
 | CC Scatterize | `ec.sim.ccscatterize` | 4 | GPU | 32 | Implemented |

docs/file-format-parity.md

@@ -105,6 +105,37 @@ single-file video (Animation / PNG codecs), DPX / Photoshop sequences, MXF, DNxH
 encoders ([hardware-parity.md](hardware-parity.md)), and rendering safely over an existing file
 (#325).
 
+### Render source protection
+
+The render queue refuses an output that would replace footage, an attached proxy, or the
+project file. It checks every output module and segment before dispatching the item. A refused
+item is marked Failed with its reason; other valid queued items can still render. Render logs
+are checked too. No render parameter overrides this protection.
+
+Checks compare normalized paths and native file identities, so an existing symbolic link,
+hard link, junction or Windows short name cannot disguise a source as another output file.
+Source identities are indexed once per check and matching identities are verified. The index
+does not keep file handles open for the lifetime of a long sequence.
+
+Default output names move aside when they would replace a protected file. This also applies to
+Create Proxy: recreating a proxy chooses a new default name and attaches the new proxy, leaving
+the previous proxy file intact. An explicit output path is kept as entered and refused if it
+would replace a protected file.
+
+After Pre-render imports its result, that file is footage too. Re-queueing the same item
+with the same output is refused; run Pre-render again for a fresh default output, or choose
+another Output To. An item's `last_output` is not permission to replace imported footage.
+
+Image-sequence checks inspect existing frames in the requested range. Skip Existing Files leaves
+existing frames alone. If a frame number appears in a folder name, the checker probes each
+frame separately and refuses ranges over 100,000 frames instead of silently checking a prefix.
+Choose a fixed output folder or a shorter range for those exports.
+
+This guard does not introduce an overwrite flag, confirmation dialog, or changed replacement
+defaults for the CLI, scripts or MCP. Replacement consent and staging ordinary output files
+belong to the exporter. The source check runs before export; filesystem changes between that
+check and a write still require exporter-side revalidation.
+
 ## Estimate
 
 **≈ 130–230 h**: `.aep` / `.aepx` import 80–160 h (after the owner decision), wiring TGA / DPX /
@@ -115,5 +146,6 @@ relinking 6–12 h, `.mogrt`-compatible templates 15–30 h (partly parallel wit
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-30 | minor | Render-queue source-protection behavior and limits consolidated here from the standalone page |
 | 2026-10-12 | minor | #324 and #514 marked closed; open `.aep` PRs #251 and #860 noted |
 | 2026-10-10 | major | First file format parity document, from the After Effects 26.5 bundle and this repository's import/export registries |