feat(producer): enable webm in distributed mode via concat-copy

[jrusso1020]

Description

PR 2 of 4 in the WebM distributed-rendering series. Wires libvpx-vp9
webm through the plan() → renderChunk() × N → assemble() pipeline
now that PR #950's smoke proved Path A (concat-copy) works.

Changes:

• plan.ts:

  • DistributedRenderConfig.format and PlanResult.format now
    include "webm".
  • rejectUnsupportedDistributedFormat() no longer trips on webm.
    HDR mp4 remains the only refused configuration.
  • resolveEncoderTriple() returns libvpx-vp9-software +
    yuva420p + preset="good" for format: "webm".
  • codec= remains rejected for non-mp4 formats. Error message
    lists all four distributed-supported formats.

• freezePlan.ts: LockedRenderConfig.encoder gains
  "libvpx-vp9-software".

• renderChunk.ts: drops the now-incorrect cast that excluded webm
  from buildSyntheticRenderJob's format input; tightens the
  preset-format cast to include webm.

• assemble.ts: docstring + comment updates. The mp4/mov concat-copy
  path is format-agnostic — webm uses the exact same code
  (applyFaststart is a no-op for webm via the existing
  chunkEncoder.ts gate; muxVideoWithAudio already routes webm to
  libopus audio).

• planFormatBanlist.test.ts: webm-rejection tests removed; replaced
  with "accepts webm" tests + an HDR-with-webm combo test that
  verifies HDR is the trip regardless of format.

• plan.test.ts: new describe block pins the webm wiring contract:
  format="webm" produces an encoder=libvpx-vp9-software /
  pixelFormat=yuva420p planDir with closedGop=true and
  gopSize=chunkSize.

• webm-concat-copy.test.ts (smoke): extended with a yuva420p variant
  that proves the alpha pixel format the distributed pipeline actually
  emits also round-trips through concat-copy.

Fixup commit fix(producer): include webm in plan-time needsAlpha + strengthen alpha smoke

Addresses the blocker review feedback from Miguel and Vai:

• The real bug: plan.ts's needsAlpha disjunction excluded
  "webm", so the plan stage froze forceScreenshot: false into the
  LockedRenderConfig even though distributed webm uses yuva420p.
  Every chunk worker would have captured opaque RGB via BeginFrame
  (which doesn't preserve alpha on Linux headless-shell), producing
  un-keyable webm. Fixed to match the in-process renderer's
  needsAlpha logic.
• Why our verification missed it: ffmpeg's PSNR filter compares
  only Y/U/V planes (no psnr_a), so a perfectly-broken alpha plane
  registered as 0 dB difference; the smoke test's testsrc2 + format=rgba source was uniformly opaque so the encoder downgrade
  was harmless; the pix_fmt=yuva?420p regex accepted yuv420p output.
• Smoke test strengthened to catch this class of bug going
  forward: source frames now use geq=a='X*255/W' (a real alpha
  gradient), the test asserts TAG:ALPHA_MODE=1 on the stream, and
  decodes the alpha plane via -c:v libvpx-vp9 -pix_fmt rgba to
  signalstats-check the variance.

Testing

• bun test packages/producer/src/services/distributed/planFormatBanlist.test.ts — passes
• bun test packages/producer/tests/distributed/_smoke/webm-concat-copy.test.ts — passes (now exercises real alpha)
• bunx tsc --noEmit -p packages/producer/tsconfig.json — clean
• Existing distributed-simulated fixtures regression-checked locally — no drift

🤖 Generated with Claude Code

[jrusso1020]

• docs(lambda): document webm support + simplify-review fixes #953
• test(producer): add webm-vp9 distributed regression fixture #952
• feat(producer): enable webm in distributed mode via concat-copy #951 👈 (View in Graphite)
• feat(engine): closed-GOP VP9 encoder args + concat-copy smoke test #950
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[miguel-heygen]

REQUEST CHANGES — one alpha-loss bug, everything else is solid.

Blocker: missing needsAlpha for webm in plan.ts

At plan.ts:603:

const needsAlpha = config.format === "png-sequence" || config.format === "mov";

WebM is not included, but the distributed pipeline configures webm to use yuva420p (alpha pixel format). This flag controls forceScreenshot — on Linux headless-shell, only screenshot capture preserves alpha (BeginFrame does not). Without needsAlpha = true, the compile stage freezes forceScreenshot: false into the plan, and every chunk worker captures without alpha.

Result: webm chunks would encode yuva420p frames with uniformly-opaque or garbage alpha instead of the composition's actual transparency.

Fix:

const needsAlpha = config.format === "png-sequence" || config.format === "mov" || config.format === "webm";

Note: renderChunk.ts:550 already has the correct logic (plan.dimensions.format !== "mp4"), but it only affects the within-chunk capture stage — the plan-time forceScreenshot decision is already frozen incorrectly.

Smoke tests don't catch this because testsrc2 is fully opaque and doesn't exercise the capture pipeline.

Everything else looks good

• resolveEncoderTriple() returns correct VP9 triple
• rejectUnsupportedDistributedFormat() correctly removes webm ban
• LockedRenderConfig.encoder union gains "libvpx-vp9-software"
• Concat-copy (Path A) is the right architectural choice
• Tests correctly pivot from "rejects webm" to "accepts webm" + new HDR+webm combo test
• All CI green

[vanceingalls]

REQUEST CHANGES — agreeing with Miguel on the alpha blocker; flagging the test-coverage gap that hid it.

Blocker (already filed by Miguel; confirming)

packages/producer/src/services/distributed/plan.ts:659:

const needsAlpha = config.format === "png-sequence" || config.format === "mov";

WebM rides the yuva420p pixel-format path (resolveEncoderTriple at L565), but needsAlpha does not include "webm". That gate sets forceScreenshot in compileStage — and the frozen LockedRenderConfig captures whatever decision the plan makes. On Linux headless-shell, only screenshot capture preserves alpha (BeginFrame does not). So for format: "webm" we'd freeze forceScreenshot: false into meta/encoder.json, every chunk worker captures opaque RGB(A), and the libvpx-vp9 alpha sub-stream encodes garbage / uniform alpha — silently producing un-keyable webm output.

renderChunk.ts:572 (needsAlpha: plan.dimensions.format !== "mp4") only covers the within-chunk encode-stage branch; it does not undo the plan-time freeze.

Fix is the one-liner Miguel suggested: include "webm" in the needsAlpha disjunction. Land before merge.

Important — test coverage hid this

The yuva420p smoke block (webm-concat-copy.test.ts) doesn't exercise alpha end-to-end:

• The source is testsrc2 piped through format=rgba. testsrc2 is uniformly opaque — the rgba filter just adds an opaque alpha plane. There is no transparency in the pixel data.
• The decode-test assertion accepts pix_fmt=yuva?420p (i.e., yuv420p OR yuva420p) because "libvpx-vp9 may downgrade uniformly-opaque alpha to yuv420p." That comment is honest, but it concedes the test cannot distinguish "alpha-track survived concat-copy" from "encoder dropped the redundant alpha plane entirely."

So the smoke "proves" the encoder args don't crash on yuva420p input — not that meaningful alpha survives the chunk → concat → mux chain. The capture-stage alpha bug above is exactly the failure mode this test should have caught.

Suggested fix (non-blocking but strong recommendation before declaring this contract proven): replace testsrc2 + format=rgba with a source that actually has spatially-varying alpha — e.g. color=c=red@0.5 overlaid on color=c=blue@0.0, or a geq filter producing a per-pixel alpha gradient. Then assert pix_fmt=yuva420p strictly and probe one pixel near the center of the assembled output to confirm the alpha value is non-trivial. PR 8.3's E2E fixture (#952) can also cover this — but the unit-level smoke should not silently accept the no-alpha codepath when alpha is the whole reason webm exists in this pipeline.

Stack-PR CI gap (process note)

Base is feat/engine-vp9-closed-gop-args, not main. The repo's ci.yml workflow is gated on pull_request: branches: [main], so Build / Test / Typecheck / CLI smoke did NOT run on this head SHA. The rollup shows only regression, preview-regression, Player perf, and Graphite / mergeability_check. The author's PR-body claims (bun test ... — 4/4 pass, bunx tsc --noEmit — clean, oxlint clean) are local-only and not CI-verified for this head.

Not a blocker on its own, but worth flagging: once the alpha fix lands, restack onto main (or wait until #950 merges) so the main CI workflow actually fires on this head before merge.

What's solid (no action)

• rejectUnsupportedDistributedFormat() cleanly removes the webm reject while keeping the HDR gate untouched — the new "HDR + webm" combo test pins that the HDR throw fires regardless of format.
• resolveEncoderTriple() webm branch correctly returns libvpx-vp9-software + yuva420p + preset=good, and getEncoderPreset(_, "webm") in the engine returns matching codec=vp9 + pixelFormat=yuva420p. The non-mp4 codec reject also has the correct updated error message.
• LockedRenderConfig.encoder union gain of "libvpx-vp9-software" matches the existing per-encoder discriminant pattern (libx264 / libx265 / prores / png-sequence).
• renderChunk.ts cast tightening ("mp4" | "mov" | "webm") is correct — the prior cast that excluded webm would have silently fallen back to mp4 preset shape and produced libx264 output, so this fix matters.
• Concat-copy path in assemble.ts is genuinely format-agnostic: concat/mux/applyFaststart all key off the output extension; muxVideoWithAudio already routes .webm to libopus; applyFaststart short-circuits to copyFileSync for .webm and .mov. The audio-pad input path produces .aac content but muxVideoWithAudio transcodes to Opus anyway, so the file extension mismatch (audio-padded.aac feeding a webm mux) is harmless.
• planHash correctly includes format: "webm" via dimensions.format flowing into freezePlan — webm-specific knobs invalidate cache as expected.
• closedGop=true + gopSize=chunkSize + libvpx-vp9 closed-GOP args (-g, -keyint_min, -auto-alt-ref 0, -cpu-used 2 in engine/chunkEncoder.ts:289-298) are correctly mandatory for concat-copy seam independence. Alt-ref disable is the load-bearing piece — verified.
• planFormatBanlist.test.ts pivots are well-scoped; webm-reject tests deleted cleanly, accept-webm + HDR+webm-combo added.

Review by Vai

[jrusso1020]

Thanks for catching the alpha bug — that was a real blocker and ours to miss. Pushed the fix as a follow-up commit on this branch (fix(producer): include webm in plan-time needsAlpha + strengthen alpha smoke):

• Blocker fix — plan.ts needsAlpha now includes "webm", matching the in-process renderer's logic at renderOrchestrator.ts:1469. Added a comment explaining the cross-site invariant so it doesn't drift again.
• Smoke test strengthened to catch this class of bug going forward — source now uses geq=a='X*255/W' (real alpha gradient instead of opaque testsrc2+rgba), asserts TAG:ALPHA_MODE=1 strictly, and decode-checks the alpha plane via -c:v libvpx-vp9 -pix_fmt rgba + signalstats variance.
• Test coverage gap (Vai's important finding) — addressed via the smoke strengthening above. The previous test passed with uniform alpha because ffmpeg's PSNR filter doesn't compare alpha planes (psnr_y/u/v only, no psnr_a); the new signalstats check explicitly verifies the alpha plane round-trips with real spatial variance.
• Stacked-PR CI gap (Vai's process note) — noted; this fix-up commit also restacks onto the latest main.

[miguel-heygen]

Re-reviewed — APPROVE. Blocker resolved.

needsAlpha now includes "webm" — forceScreenshot: true is correctly frozen into the plan for webm distributed renders.

Smoke test also strengthened to catch this exact class of bug:

• Real alpha gradient source (geq=a='X*255/W') instead of uniformly-opaque testsrc2
• TAG:ALPHA_MODE=1 assertion proves encoder was configured for alpha
• Alpha plane variance check (YMAX - YMIN > 100) confirms real alpha survives concat-copy
• Exit-code-only decode gate (no stderr flake risk)

These four checks would have caught the needsAlpha omission pre-review. Good hardening.

No new concerns. Wait for regression shards before merging.

[vanceingalls]

APPROVE — re-review at c44b130f. The blocker is addressed end-to-end and the test-coverage gap is closed.

Blocker resolved

packages/producer/src/services/distributed/plan.ts:665-666:

const needsAlpha =
  config.format === "png-sequence" || config.format === "mov" || config.format === "webm";

"webm" is now in the disjunction. Traced end-to-end:

• needsAlpha=true → runCompileStage({ needsAlpha, … }) (L669-682)
• compileStage returns forceScreenshot (L685)
• forceScreenshot flows into buildLockedRenderConfig({ forceScreenshot, … }) (L823-831)
• buildLockedRenderConfig writes captureMode: "screenshot" and forceScreenshot: true into LockedRenderConfig (L484-488)
• That freezes into meta/encoder.json via freezePlan, so every chunk worker captures via the alpha-aware screenshot path on Linux headless-shell instead of BeginFrame.

Also nice: the inline comment at L656-664 explains why the disjunction matches renderOrchestrator.ts's needsAlpha shape and what specifically breaks (BeginFrame doesn't preserve alpha on Linux headless-shell, libvpx-vp9 silently emits un-keyable output). Good guard against this regressing again.

Important resolved

The yuva420p smoke (webm-concat-copy.test.ts:308-535) is now hardened against the "uniformly-opaque alpha gets silently dropped" failure mode:

• Source frames now use format=rgba,geq=r='r(X,Y)':g='g(X,Y)':b='b(X,Y)':a='X*255/W' — a horizontal alpha gradient on top of testsrc2 RGB. Spatially-varying alpha that libvpx-vp9 cannot downgrade as uniform/redundant (L348).
• New assertion TAG:ALPHA_MODE=1 on the muxed output's stream tags (L478-485) — the right signal that alpha encoding survived concat-copy (libvpx-vp9 stores alpha as a Matroska BlockAdditional sidecar, so pix_fmt alone can't tell you the alpha track exists).
• New signalstats YMIN/YMAX assertion on the extracted alpha plane via -c:v libvpx-vp9 decoder + -pix_fmt rgba (L487-535) — gradient source produces YMIN ≈ 0 / YMAX ≈ 255, spread > 100 confirms real per-pixel alpha content survives the chunk → concat → mux chain. Uniform alpha would give YMIN == YMAX.

The comment at L491-494 explicitly calls out that this is what would have caught the needsAlpha plan-time bug. Test now exercises the failure mode it's meant to cover — good.

Stack-PR CI gap — still open (process note, not blocking)

Base is still feat/engine-vp9-closed-gop-args, not main. Confirmed at head c44b130f:

• Build, Test, Typecheck, CLI smoke — did NOT run (workflow gated on pull_request: branches: [main])
• Preflight (lint + format) — skipped
• Preview parity — skipped
• Perf: ${{ matrix.shard }} — skipped
• Ran: Detect changes, player-perf, preview-regression (all pass), regression-shards 1-8 (in progress)
• Pending: Graphite / mergeability_check

Same gap I flagged last round. Not blocking the approval — Graphite restacks onto main on merge, and Miguel has independently approved. But the author's PR-body typecheck/test/lint claims remain CI-unverified for this head. Worth fixing systemically by changing ci.yml's pull_request: branches: filter to include the long-lived feature branches, or just confirming with the team that the policy is "main-only CI on stacks, trust local for stacked-PR heads."

Verdict

Ship. The load-bearing fix is correct, the test that should have caught it now would, and Miguel has independently approved at the same head SHA.

Review by Vai (re-review)

[vanceingalls]

Re-review at HEAD c44b130f. Flipping CHANGES_REQUESTED → APPROVE — both findings cleanly addressed.

Status of prior findings

• Blocker (needsAlpha excludes webm → silent garbage-alpha output) — ADDRESSED. plan.ts:665-666 now reads needsAlpha = format === "png-sequence" || format === "mov" || format === "webm". Traced end-to-end: needsAlpha → runCompileStage returns forceScreenshot → buildLockedRenderConfig freezes captureMode: "screenshot" + forceScreenshot: true into meta/encoder.json. Inline comment at :656-664 documents the BeginFrame/headless-shell rationale.
• Important (smoke can't catch this) — ADDRESSED. webm-concat-copy.test.ts now uses spatially-varying alpha (geq=a='X*255/W'), asserts TAG:ALPHA_MODE=1 on stream tags, AND runs signalstats on the extracted alpha plane checking YMIN/YMAX spread > 100. Would catch the original failure mode pre-review.
• Stacked-PR CI gap — STILL OPEN. Base is still feat/engine-vp9-closed-gop-args. Build/Test/Typecheck/CLI smoke didn't run on this head; closes incidentally when #950 lands.

CI on c44b130f: 0 failed; player-perf + preview-regression SUCCESS; 8 regression-shards in_progress; Preflight/Preview parity/Perf SKIPPED.

Verdict: APPROVE. The load-bearing fix for the whole webm stack.

Re-review by Vai

The base branch was changed.

[miguel-heygen]

Re-approving at f8ffe9f — same fixup commit (needsAlpha + alpha smoke hardening) I reviewed earlier. No new changes.

[vanceingalls]

Re-review at f8ffe9faf30c2d66fdc3f74598e7bb73b53ca909 (round-2 approve was at c44b130, since dismissed).

Round-2 findings remain addressed. Verified on the new HEAD:

• Blocker (needsAlpha): packages/producer/src/services/distributed/plan.ts:666-667 still has config.format === "webm" in the disjunction.
• Important (alpha smoke): webm-concat-copy.test.ts still drives geq=a='X*255/W', asserts TAG:ALPHA_MODE=1, and validates signalstats YMIN/YMAX variance.

But CI on this HEAD is failing on changes that block merge, and round-2's full CI workflow never actually ran — so this is fresh information, not a regression.

New blocker — @hyperframes/aws-lambda package does not compile against the widened DistributedFormat

Three typecheck errors in packages/aws-lambda/ against the "webm" widening:

src/handler.ts(277,7): error TS2322: Type '"mp4" | "webm" | "mov" | "png-sequence"' is not assignable to type '"mp4" | "mov" | "png-sequence"'.
src/sdk/renderToLambda.ts(87,31): error TS2345: Argument of type '"mp4" | "webm" | "mov" | "png-sequence"' is not assignable to parameter of type 'DistributedFormat'.
src/sdk/validateConfig.ts(69,33): error TS2345: Argument of type '"mp4" | "webm" | "mov" | "png-sequence"' is not assignable to parameter of type '"mp4" | "mov" | "png-sequence"'.

Two root sites in packages/aws-lambda/:

1. src/handler.ts:436 — downloadChunkObjects(..., format: "mp4" | "mov" | "png-sequence") — hard-coded narrow string union, not derived from DistributedFormat. Callers pass result.format/event.Format which now carry "webm".
2. src/sdk/validateConfig.ts:34 — const ALLOWED_FORMATS = ["mp4", "mov", "png-sequence"] as const; — a runtime allowlist that ALSO drops webm. Even if you only widen the TS type, this is a runtime-correctness hole: any Lambda-mode caller that passes format: "webm" will be rejected at validation with must be one of mp4, mov, png-sequence. The distributed-webm feature this PR ships is not reachable through the Lambda SDK.

Why this slipped past round 2: at c44b130 the CI workflow (where Typecheck / Build / CLI smoke (required) live) never ran on this PR — only regression + player-perf jobs report. On f8ffe9fa, full CI is triggering against main and three required jobs are failing:

Build              FAILURE  (aws-lambda tsc -p tsconfig.build.json --emitDeclarationOnly)
Typecheck          FAILURE  (same — TS2322/TS2345 above)
CLI smoke (required)  FAILURE  (Build monorepo step; cascades from the same tsc errors)

Other required-equivalent CI on f8ffe9fa: Test SUCCESS, Test: runtime contract SUCCESS, Lint SUCCESS, Format SUCCESS, Fallow audit SUCCESS, Semantic PR title SUCCESS, regression IN_PROGRESS, Windows render verification IN_PROGRESS.

Required changes

1. Blocker — make aws-lambda accept webm at both type-level and runtime-level. Two minimum edits:
   • packages/aws-lambda/src/handler.ts:436 — replace the hard-coded "mp4" | "mov" | "png-sequence" parameter type with DistributedFormat imported from @hyperframes/producer so the two stay in sync by construction (or with Exclude<DistributedFormat, ...> if a subset is intended — but for downloadChunkObjects, webm uses concat-copy the same way mp4 does, so the full set is right).
   • packages/aws-lambda/src/sdk/validateConfig.ts:34 — add "webm" to ALLOWED_FORMATS. (Or, better, derive ALLOWED_FORMATS from DistributedFormat once, since this is the third site I've now seen with a manual hand-maintained allowlist of distributed formats.)
2. Important — add a bun run --filter '@hyperframes/{...,aws-lambda}' build or equivalent typecheck step to the local pre-push contract, or a packages/aws-lambda/src/sdk/validateConfig.test.ts case that pins the allowlist == DistributedFormat. The hand-maintained mirror of the format union is exactly the class of bug round 2 caught for needsAlpha, and it'll keep recurring across the PR-series fanout (PR 8.3 / 8.4 will both touch this surface) until the source of truth is single.
3. Nit — once 1 lands, please re-trigger CI and confirm Build / Typecheck / CLI smoke (required) go green before re-requesting review. Round-2's approve dismissed on force-push; my re-review depends on a fresh full-CI signal against main.

Process note for next round

I will re-verify the two prior findings + the three new failing CI jobs on the next HEAD. If aws-lambda lands cleanly and CI is green, no further review iteration is needed — drop a comment with the resolved fix and I'll re-stamp.

Review by Vai (re-review round 3)

[miguel-heygen]

Re-reviewed (round 3) — APPROVE. All three TS blockers resolved.

Verified at 7f8a332f35:

• events.ts: RenderChunkEvent, AssembleEvent, PlanLambdaResult format fields widened to include "webm"
• handler.ts:436: downloadChunkObjects parameter type widened
• validateConfig.ts:34: ALLOWED_FORMATS runtime allowlist gains "webm" — was also a runtime gate, not just a type issue
• formatExtension.ts: refactored to Record<DistributedFormat, string> — compile-time exhaustiveness
• validateConfig.test.ts: negative case changed from "webm" to "gif"

CI: Build ✓, Typecheck ✓, CLI smoke ✓, Test ✓, Lint ✓, Format ✓, Fallow ✓, Windows ✓, CodeQL ✓. Regression shards still running.

Prior fixes remain intact: needsAlpha includes webm, alpha smoke hardened with real gradient + ALPHA_MODE + signalstats.

[vanceingalls]

Re-review (round 4) — round-3 blocker addressed; approving.

Calibrated strengths:

• packages/aws-lambda/src/formatExtension.ts:9-25 — picked the right shape: a single DistributedFormat export + Record<DistributedFormat, string> lookup table, plus an honest commit message explaining why the lookup replaces the switch (CRAP/cyclomatic on the new arm vs. exhaustiveness preserved by the Record type). Every other narrow-format site in aws-lambda was widened in lockstep — no stragglers.
• Commit message ("widen narrow format types") explicitly calls out the cross-PR atomicity issue with #952 — exactly the kind of context that pays off in git blame six months from now.

Round-3 blockers — verified ADDRESSED:

• handler.ts:277 Format: result.format (TS2322) → producer's PlanResult.format widened in this same PR; PlanLambdaResult.Format at events.ts:68,83,109 now "mp4" | "mov" | "png-sequence" | "webm". Compiles.
• renderToLambda.ts:87 formatExtension(opts.config.format) (TS2345) → formatExtension.ts:9 DistributedFormat includes "webm"; FORMAT_EXTENSIONS has the webm: ".webm" entry.
• validateConfig.ts:69 (TS2345) → validateConfig.ts:34 ALLOWED_FORMATS = ["mp4", "mov", "png-sequence", "webm"] as const — runtime allowlist now accepts webm at the SDK boundary.
• handler.ts:436 downloadChunkObjects(..., format: ...) narrow union → widened to include "webm". The format === "png-sequence" branch is preserved (untar) and webm falls through to the file-copy branch correctly (concat-copy assemble handles webm identically to mp4/mov per PR 8.1's smoke).

Cross-checked: grep -rn '"mp4" | "mov" | "png-sequence"' packages/aws-lambda/src/ — every match also contains "webm". Zero straggler sites.

Round-2 fixes still present:

• plan.ts:665-666 needsAlpha disjunction includes config.format === "webm".
• webm-concat-copy.test.ts:484, 513 — ALPHA_MODE=1 stream-tag assertion + extractplanes=a,signalstats alpha-variance check are in place.

CI at 7f8a332f — required checks:

• Build: SUCCESS
• Typecheck: SUCCESS
• CLI smoke (required): SUCCESS
• Test: SUCCESS
• Test: runtime contract: SUCCESS
• Render on windows-latest: SUCCESS
• Tests on windows-latest: SUCCESS
• Semantic PR title: SUCCESS
• regression: shards 1-8 IN_PROGRESS (not a regression introduced by this PR; the structural typecheck gates are all green)

No new findings. The fix took the manual-widen route rather than the import-from-producer route, but the choice is defensible: it keeps aws-lambda self-describing at its public-API boundary (events.ts literal union doubles as the wire-protocol contract for Step Functions), and the DistributedFormat export in formatExtension.ts is now the single internal source of truth. A future PR consolidating on import { DistributedFormat } from "@hyperframes/producer/distributed" would be a clean cleanup, but not a blocker today.

Verdict: APPROVE
Reasoning: Round-3 aws-lambda typecheck blocker is cleanly addressed at every site; round-2 fixes (needsAlpha + hardened alpha smoke) remain intact; all structural CI gates that were failing are now green. Regression shards still running but those are not the gate the round-3 blocker raised.

Review by Vai (re-review round 4)

[vanceingalls]

Re-review at HEAD 7f8a332f. Flipping CHANGES_REQUESTED → APPROVE — all 3 round-3 TS blockers addressed cleanly.

Status of prior blockers

• handler.ts:277 TS2322 → ADDRESSED via producer's widened PlanResult.format + events.ts:68,83,109 union now includes "webm".
• renderToLambda.ts:87 TS2345 → ADDRESSED via formatExtension.ts:9 DistributedFormat = "mp4" | "mov" | "png-sequence" | "webm".
• validateConfig.ts:69 TS2345 → ADDRESSED via validateConfig.ts:34 ALLOWED_FORMATS = [..., "webm"].
• handler.ts:436 runtime narrow union → widened to include "webm". Zero straggler narrow-format sites in aws-lambda.

James took the manual-widen route (not the import-from-producer single-source-of-truth route I suggested). To prevent recurrence, he also re-exported DistributedFormat from producer in aws-lambda and refactored formatExtension.ts switch → Record<DistributedFormat, string> for compile-time exhaustiveness. Defensible — manual widen + re-export pattern catches drift via TS errors on missed sites.

CI status (verbatim) at 7f8a332f

Required checks all SUCCESS: Build, Typecheck, CLI smoke (required), Test, Test: runtime contract, Render on windows-latest, Tests on windows-latest, Semantic PR title. regression shards 1-8 IN_PROGRESS (non-gating).

Verdict: APPROVE.

Re-review by Vai (round 4)