diff --git a/Cargo.lock b/Cargo.lock
index e16c9c170..b4358be26 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -165,9 +165,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.102"
+version = "1.0.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
 
 [[package]]
 name = "arbitrary"
@@ -1206,9 +1206,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-bforest"
-version = "0.133.0"
+version = "0.133.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e2e9b7adf77fa02204d4d523ae4f171b6591c2632b030865336335c7d7b420e"
+checksum = "03b4982ef9fa54ec9eee841e891e7ddc5434be1250e88de31572e000c888f30b"
 dependencies = [
  "cranelift-entity",
  "wasmtime-internal-core",
@@ -1216,9 +1216,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-bitset"
-version = "0.133.0"
+version = "0.133.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90f09d9f397eae612ac15becf0e0b2165d2232003f4f2a1549572a724d1c48c5"
+checksum = "529143118c4eeb58c39ecb02319557d512be6c61348486422974ab8e3906b8a8"
 dependencies = [
  "serde",
  "serde_derive",
@@ -1227,9 +1227,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-codegen"
-version = "0.133.0"
+version = "0.133.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e004cf1270abc82f7b9fb32d1a9d73a1cc0d5a0215b97db8c32658748e78b01"
+checksum = "b7780677247ad3577e3a6a3ebf43f39b325a11d6393db72b2c9968a910d4d13d"
 dependencies = [
  "bumpalo",
  "cranelift-assembler-x64",
@@ -1258,9 +1258,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-codegen-meta"
-version = "0.133.0"
+version = "0.133.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04f32034641f96b123e4fdb5666e726d9f252e222638fc8fdd905b4ff18c3c4e"
+checksum = "ac9645250416cbf92454fe61160e17e026e0ce405906a54500b114f923ddffc9"
 dependencies = [
  "cranelift-assembler-x64-meta",
  "cranelift-codegen-shared",
@@ -1286,9 +1286,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-entity"
-version = "0.133.0"
+version = "0.133.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "341d5e1e071320505ebbc8194a8eb61fa94394b1ed93ba3cbec3be5fa1c3c1ce"
+checksum = "a5300c49cf940526fe771517b3b3eabd5d0ff164ee61698579cf403fe8d3af3c"
 dependencies = [
  "cranelift-bitset",
  "serde",
@@ -1298,9 +1298,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-frontend"
-version = "0.133.0"
+version = "0.133.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97c6f3e2419ecb54a5503994d35421554c5e487d0493bc86ea96907bab51fd29"
+checksum = "da4adbf760207fdbbe130f1191cce01cdef66831a9f648b1f39ff2800d126d45"
 dependencies = [
  "cranelift-codegen",
  "hashbrown 0.17.1",
@@ -1311,15 +1311,15 @@ dependencies = [
 
 [[package]]
 name = "cranelift-isle"
-version = "0.133.0"
+version = "0.133.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21aa47a5e0b1e9fb2c9348459088d5dbb872ebe17781ada1270d8364c7e73257"
+checksum = "8315b21ff018226a42a60a4702c2dd75f6447cac26e9bca622e14c22088c2ff5"
 
 [[package]]
 name = "cranelift-native"
-version = "0.133.0"
+version = "0.133.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3054a03ac285b170662ec9530602b01cd394a7428cd753b48d9cae51f05249a"
+checksum = "d506ef23a60715bde451b06620b14402166ded3b648454fccbf04f3e46a4aa70"
 dependencies = [
  "cranelift-codegen",
  "libc",
@@ -1863,7 +1863,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -2990,7 +2990,7 @@ checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46"
 dependencies = [
  "hermit-abi",
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -4791,7 +4791,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b570b25f7617e43d59005d0990ccb79e950a423952cea19671b7a876da390adf"
 dependencies = [
  "anyhow",
- "itertools 0.14.0",
+ "itertools 0.12.1",
  "proc-macro2",
  "quote",
  "syn 2.0.118",
@@ -4817,9 +4817,9 @@ dependencies = [
 
 [[package]]
 name = "pulley-interpreter"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "047bda68096e5f290619ce037b7c3fa352d11f08edf0fce3030c351adc0f8ec0"
+checksum = "38b92604caae1a1899b6a5b54967289dd538177c626004c91accf9d0ec7e4a12"
 dependencies = [
  "cranelift-bitset",
  "log",
@@ -4829,9 +4829,9 @@ dependencies = [
 
 [[package]]
 name = "pulley-macros"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83258a9bcc97d3fb15bf4e1c43bc2cc85c718e3563a697f145f245e651f2828f"
+checksum = "5a7ac85c0bb3fb351f10d531230aaa5e366b46d7c4e5328e5f02801d6dac1165"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -5662,7 +5662,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -5731,7 +5731,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -5752,7 +5752,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -6896,7 +6896,7 @@ dependencies = [
  "getrandom 0.4.3",
  "once_cell",
  "rustix 1.1.4",
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -8002,9 +8002,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08dd5caf09eda1d523261a0dd421a54e3bb165cf6f5b02c82327e712d49e3cf4"
+checksum = "c4213d2f019a5e44aa8a61d8826dd33a505bff79f749b14a8bafd67321cb9351"
 dependencies = [
  "addr2line 0.26.1",
  "async-trait",
@@ -8055,9 +8055,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-environ"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1f3aa689689cf295568aa4d24ab636579fb3b36dfa7cea35020d87064fc88ec"
+checksum = "d45863de41977ec6453e859cf843d456fa3fcb45a659b66d16e794f90ec4f5b7"
 dependencies = [
  "anyhow",
  "cpp_demangle",
@@ -8086,9 +8086,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-cache"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd6c27fbabb7df6c88a592a28773a92aa8cfba5ee656963d7ad9b32a8f57a3d8"
+checksum = "438bc7dc45fb75297d75f79a9a0ce852345d13ebc6a6863f6f688f013836a9dd"
 dependencies = [
  "base64 0.22.1",
  "directories-next",
@@ -8106,9 +8106,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-component-macro"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de4451ab437d7b2d41e637a4379e87ff76aeeb051236064dcc75c1855714ee58"
+checksum = "f1e48f8d4966d62a10b6d70722bc432c1e163890be2801d3b5784589ad36ffc3"
 dependencies = [
  "anyhow",
  "proc-macro2",
@@ -8121,15 +8121,15 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-component-util"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53b5e357002645964342b99a6fe8405cda7dd031f498927992c9d99d5012daa7"
+checksum = "819ad5abd5822a22dbf4014475cdfd1fe790707761cd732d74aaa3ba4d5ba489"
 
 [[package]]
 name = "wasmtime-internal-core"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f6ce74d60a8ed870548e7efa9710c54f982bbfcf80e5ee5eee8498318616483"
+checksum = "3fc28372e36eaf8cf70faa83b5779137f7e99c8d18569a125d1580e735cc9e4d"
 dependencies = [
  "anyhow",
  "hashbrown 0.17.1",
@@ -8139,9 +8139,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-cranelift"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e24204583d847b7ce3d770f7a3456739d5d43f65c884cb47111dbe27b26ebbe6"
+checksum = "a433efc6e35112a5457e1dc8bc4d8d39820ac7722267e89bc04e5df641f32124"
 dependencies = [
  "cfg-if",
  "cranelift-codegen",
@@ -8166,9 +8166,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-fiber"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ecaeb13bf3eb94a02e32ea3842c8fda3ea6897c299745100c1230b65769d2d91"
+checksum = "18a1d3a39d0d210f6b8574ee96a4315e0a14c67f3a1fc3cd5372cb10d2fb4422"
 dependencies = [
  "cc",
  "cfg-if",
@@ -8181,9 +8181,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-jit-debug"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5090e9a302bb5729a84766e4af07b6b10efe733e437bc266dd954a957114df63"
+checksum = "9f667288cb4dfa68a4639ffac4d5628535dda64ebdc2b990526efb12b30ba803"
 dependencies = [
  "cc",
  "object 0.39.1",
@@ -8193,9 +8193,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-jit-icache-coherence"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bba33d9d951a9a974a866e80c864a9a46b28086e369582e0caa78e14a9f29e4"
+checksum = "eba651d44ab0faad4c58106b3adb45068189fb65ef50f0c404b6d9e3bf81a357"
 dependencies = [
  "cfg-if",
  "libc",
@@ -8205,9 +8205,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-unwinder"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "695063a19bac17895f95c0c0f2f9544e85a277763cd77b5778f0cce6a971073e"
+checksum = "2ecc52563b0558af2a7487eb710de07cc4532564b55528876129238e83118cb1"
 dependencies = [
  "cfg-if",
  "cranelift-codegen",
@@ -8218,9 +8218,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-versioned-export-macros"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc77f7513209b76e8f4772af640819f47fca3a5425b4417ef9c20b888334063c"
+checksum = "e747f4a074699ba1b4e4d841fb263f9b7df5bd1555181c4752bf5990d21ba676"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -8229,9 +8229,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-wit-bindgen"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e859103d8336304b8beebbf89a620c2f53a118fd5fbce41bc572cf4bacc8111d"
+checksum = "80009f46991622814196d96fac6fc0a938f46b5cba737a8f4e21e24e5a03856f"
 dependencies = [
  "anyhow",
  "bitflags 2.13.0",
@@ -8242,9 +8242,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-wasi"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "093c67243785465fdab0cb8bfada4a1171a543dfc22b392201c77d8086367b58"
+checksum = "e9f65ef30a2c5478873cdb619085a7a649d3ce41cc3eaf298a7ce3dee96a8e11"
 dependencies = [
  "async-trait",
  "bitflags 2.13.0",
@@ -8271,9 +8271,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-wasi-io"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95db6ca70bd5b7aab6b0297419ccbdb88682e12cc37764c757f58e917da650b9"
+checksum = "cee57d5fef4976b1ab542615f4cef2c43278eb549d8078939668ea0f13d5c696"
 dependencies = [
  "async-trait",
  "bytes",
@@ -8627,9 +8627,9 @@ dependencies = [
 
 [[package]]
 name = "wiggle"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "860468238360805e56e88335d892df427ad7a6908f4a83d96d7a391460346025"
+checksum = "e03df88bf1a6068b02851aa3ef9427d285118f5c1c153b068a8995c69dd9562a"
 dependencies = [
  "bitflags 2.13.0",
  "thiserror 2.0.18",
@@ -8641,9 +8641,9 @@ dependencies = [
 
 [[package]]
 name = "wiggle-generate"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8a128aae0b85cf03726242fad62c5b00c7d1ad809f18883a2338a0c3d5ae1fb"
+checksum = "e014aec8661b613154377e4b49dbbb0dfc4f424efcee749782054576c00537d9"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -8655,9 +8655,9 @@ dependencies = [
 
 [[package]]
 name = "wiggle-macro"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bdf3c6a6e1a110be73fcfe10ab9456f0b1bf5a1020010e66d536502baf70a36b"
+checksum = "f67310a8ae5190b7f3dcacf8697f2890701a3a8427b3e77ed91d3632dcedaceb"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -8693,7 +8693,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
diff --git a/apps/skit/src/config.rs b/apps/skit/src/config.rs
index 7aed38349..03438539f 100644
--- a/apps/skit/src/config.rs
+++ b/apps/skit/src/config.rs
@@ -1677,6 +1677,27 @@ allowed_plugins = []
         });
     }
 
+    #[test]
+    fn config_partial_role_override_deep_merges_builtin() {
+        figment::Jail::expect_with(|jail| {
+            jail.create_file(
+                "skit.toml",
+                r#"[permissions.roles.user]
+allowed_nodes = ["video::*", "containers::*", "transport::http::mse", "plugin::*"]
+"#,
+            )?;
+            let result = load("skit.toml").expect("load with user override");
+            let user = result.config.permissions.roles.get("user").expect("user role");
+            // Fields absent from the TOML must survive from the built-in default
+            // (deep-merge), not reset to the struct's bool default of false.
+            assert!(user.create_sessions, "create_sessions preserved by deep-merge");
+            assert!(user.destroy_sessions, "destroy_sessions preserved by deep-merge");
+            // The overridden array adds the MSE transport node.
+            assert!(user.is_node_allowed("transport::http::mse"));
+            Ok(())
+        });
+    }
+
     fn attr_policy(allowed: &[&str], fallback: &str) -> MetricsAttributePolicy {
         MetricsAttributePolicy {
             allowed: allowed.iter().map(|s| (*s).to_string()).collect(),
diff --git a/deny.toml b/deny.toml
index 6ea3b8f97..8716fd741 100644
--- a/deny.toml
+++ b/deny.toml
@@ -81,6 +81,22 @@ ignore = [
   # an unmaintained notice; CMake 4.0 build-error risk is mitigated since
   # CI pins an earlier CMake.
   { id = "RUSTSEC-2026-0150", reason = "transitive dep via opus crate; no safe upgrade available" },
+
+  # ttf-parser is unmaintained (author archived the crate). Transitive dep of
+  # fontdue, which streamkit-nodes uses for text rasterization. No safe upgrade
+  # is available per the advisory; migrating fontdue->skrifa is tracked in
+  # https://github.com/streamer45/streamkit/issues/642. No security
+  # vulnerability, just an unmaintained notice.
+  { id = "RUSTSEC-2026-0192", reason = "transitive dep via fontdue; no safe upgrade available" },
+
+  # quick-xml 0.39 DoS advisories (quadratic duplicate-attribute check and
+  # unbounded NsReader namespace allocation). Transitive dep via opendal, whose
+  # latest release (0.57) pins quick-xml 0.39, so no upgrade path exists yet
+  # (fixed in quick-xml >= 0.41). Exposure is limited to XML responses from the
+  # operator-configured S3 endpoint, not attacker-supplied input. Removal is
+  # tracked in https://github.com/streamer45/streamkit/issues/647.
+  { id = "RUSTSEC-2026-0194", reason = "transitive dep via opendal; no upgrade path; only parses configured S3 endpoint responses" },
+  { id = "RUSTSEC-2026-0195", reason = "transitive dep via opendal; no upgrade path; only parses configured S3 endpoint responses" },
 ]
 # If this is true, then cargo deny will use the git executable to fetch advisory database.
 # If this is false, then it uses a built-in git library.
diff --git a/examples/web-capture/.gitignore b/examples/web-capture/.gitignore
new file mode 100644
index 000000000..9064eb2e2
--- /dev/null
+++ b/examples/web-capture/.gitignore
@@ -0,0 +1 @@
+/gateway
diff --git a/examples/web-capture/.golangci.yml b/examples/web-capture/.golangci.yml
new file mode 100644
index 000000000..e4ee18ab0
--- /dev/null
+++ b/examples/web-capture/.golangci.yml
@@ -0,0 +1,26 @@
+version: "2"
+linters:
+  default: none
+  enable:
+    - bidichk
+    - errcheck
+    - govet
+    - ineffassign
+    - makezero
+    - misspell
+    - revive
+    - staticcheck
+    - unconvert
+    - unqueryvet
+    - unused
+    - whitespace
+  settings:
+    govet:
+      disable:
+        - fieldalignment
+      enable-all: true
+    unqueryvet:
+      check-sql-builders: true
+issues:
+  max-issues-per-linter: 0 # no maximum
+  max-same-issues: 0 # no maximum
diff --git a/examples/web-capture/Dockerfile b/examples/web-capture/Dockerfile
new file mode 100644
index 000000000..8c86de183
--- /dev/null
+++ b/examples/web-capture/Dockerfile
@@ -0,0 +1,13 @@
+# SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+#
+# SPDX-License-Identifier: MPL-2.0
+
+FROM golang:1.24-bookworm AS build
+WORKDIR /src
+COPY . .
+RUN CGO_ENABLED=0 go build -o /gateway ./cmd/gateway
+
+FROM gcr.io/distroless/static-debian12
+COPY --from=build /gateway /gateway
+EXPOSE 8080
+ENTRYPOINT ["/gateway"]
diff --git a/examples/web-capture/Makefile b/examples/web-capture/Makefile
new file mode 100644
index 000000000..e0e112efb
--- /dev/null
+++ b/examples/web-capture/Makefile
@@ -0,0 +1,20 @@
+# SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+#
+# SPDX-License-Identifier: MPL-2.0
+
+.PHONY: build lint test run clean
+
+build:
+	go build -o gateway ./cmd/gateway
+
+lint:
+	golangci-lint run
+
+test:
+	go test ./...
+
+run:
+	go run ./cmd/gateway
+
+clean:
+	rm -f gateway
diff --git a/examples/web-capture/README.md b/examples/web-capture/README.md
new file mode 100644
index 000000000..9ebc4bcfb
--- /dev/null
+++ b/examples/web-capture/README.md
@@ -0,0 +1,117 @@
+<!--
+SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+
+SPDX-License-Identifier: MPL-2.0
+-->
+
+# Web Capture Gateway
+
+Render any web page to video through a StreamKit backend. The first path segment picks the output; paste the target URL after it — no flags, no JSON:
+
+- **clip** — a finite MP4 file (oneshot pipeline): `web.streamkit.dev/clip/example.com`
+- **cast** — a live stream, WebM or fMP4 (dynamic session): `web.streamkit.dev/cast/example.com`
+
+The page is rendered by the [Servo](../../plugins/native/servo) browser engine on the backend. The gateway turns a pasteable URL into the multipart oneshot / dynamic-session calls the backend expects and, for `cast`, owns the session lifetime so abandoned streams are torn down instead of leaking a renderer.
+
+## URL shape
+
+```
+{host}/{clip|cast}/[options/]{target-url}
+```
+
+The first segment is the output (`clip` or `cast`); the target URL follows **verbatim** (scheme optional, `https` assumed), so its own query string just rides along — no percent-encoding:
+
+```
+web.streamkit.dev/clip/grafana.example/d/abc?panel=3&from=now-6h
+```
+
+Options are an optional comma-separated `key=value` segment between the output and the URL:
+
+```
+web.streamkit.dev/clip/dur=30s/example.com                # clip length (default 10s, capped at 60s)
+web.streamkit.dev/cast/res=2560x1440/example.com          # capture resolution (default 1920x1080)
+web.streamkit.dev/clip/res=1280x720,dur=15s/example.com   # combine, comma-separated
+```
+
+`dur` is `clip`-only; `res` (the capture resolution) applies to both modes. The scheme is identical locally, e.g. `http://127.0.0.1:8080/clip/dur=5s/example.com`.
+
+The same URL serves a browser and a player/script: an address-bar visit (`Accept: text/html`) to a `cast` URL returns a tiny autoplay page; anything else (a `<video src>`, `curl`, `ffplay`) gets the raw stream/file.
+
+## Formats & browser support
+
+| Mode | Format | Plays in |
+|------|--------|----------|
+| `clip` | MP4 / H.264, fragmented (plays inline as it renders) | Everywhere, including Safari/iOS |
+| `cast` | VP9 / WebM by default; H.264 / fMP4 via `cast-encoder=h264-sw` | VP9: Chromium & Firefox. H.264/fMP4: everywhere, including Safari/iOS |
+
+The cast default (VP9/WebM) is crisper for screen text but plays only in Chromium/Firefox. For universal live playback (incl. Safari/iOS), set `cast-encoder=h264-sw` (or `h264-hw`): `transport::http::mse` serves fragmented MP4, which a plain `<video>` plays everywhere.
+
+## Prereqs
+
+- A StreamKit server with the **Servo plugin** built and loaded:
+  `just build-plugin-native-servo && just copy-plugins-native`.
+- A non-admin **`user`** token suffices (it may create/destroy sessions and use `transport::http::mse`, `plugin::native::servo`, and the video/container nodes) — no admin needed. Pass it via `--token` / `SKIT_TOKEN`.
+- Go 1.24+.
+
+## Run
+
+```sh
+cd examples/web-capture
+go run ./cmd/gateway --listen :8080 --skit-url http://127.0.0.1:4545
+
+# clip → MP4 (plays inline in a browser; -o saves it)
+curl -L 'http://127.0.0.1:8080/clip/dur=5s/example.com' -o clip.mp4
+
+# cast → open in a browser to watch live
+xdg-open 'http://127.0.0.1:8080/cast/example.com'
+```
+
+### Configuration
+
+| Env | Flag | Default | Purpose |
+|-----|------|---------|---------|
+| `GATEWAY_LISTEN` | `--listen` | `:8080` | Listen address |
+| `SKIT_URL` | `--skit-url` | `http://127.0.0.1:4545` | Backend URL |
+| `SKIT_TOKEN` | `--token` | — | Bearer token sent to the backend |
+| `GATEWAY_MAX_CONCURRENCY` | `--max-concurrency` | 4 | Max concurrent clip renders |
+| `GATEWAY_CLIP_DEFAULT_SECS` | `--clip-default-secs` | 10 | Default clip duration |
+| `GATEWAY_CLIP_MAX_SECS` | `--clip-max-secs` | 60 | Maximum clip duration |
+| `GATEWAY_MAX_SESSIONS` | `--max-sessions` | 8 | Max concurrent live cast sessions |
+| `GATEWAY_MAX_VIEWERS` | `--max-viewers` | 10 | Max viewers per cast stream |
+| `GATEWAY_SESSION_IDLE_SECS` | `--session-idle-secs` | 30 | Idle grace before a viewerless session is reaped |
+| `GATEWAY_SESSION_MAX_SECS` | `--session-max-secs` | 1800 | Hard cap on a session's lifetime |
+| `GATEWAY_RESOLUTION` | `--resolution` | `1920x1080` | Capture resolution WxH (render = encode, 1:1) |
+| `GATEWAY_CLIP_BITRATE_KBPS` | `--clip-bitrate-kbps` | `10000` | Clip video bitrate (kbps) |
+| `GATEWAY_CAST_BITRATE_KBPS` | `--cast-bitrate-kbps` | `6000` | Cast video bitrate (kbps) |
+| `GATEWAY_CLIP_ENCODER` | `--clip-encoder` | `h264-sw` | `h264-sw`, or `h264-hw` (Vulkan Video) |
+| `GATEWAY_CAST_ENCODER` | `--cast-encoder` | `vp9-sw` | `vp9-sw`, `av1-sw`, `av1-hw`, `h264-sw`, `h264-hw` |
+
+Capture runs at **1080p30** by default: the page renders **and** encodes at the same resolution (1:1, no downscale), so text stays crisp and the page gets a real desktop layout. Drop to `res=1280x720` for less bandwidth or raise to `res=2560x1440` for more detail (capped at 4K); frame rate is fixed at 30.
+
+### Encoders
+
+Software encoders are the default, so the gateway runs anywhere with no GPU — ideal for local dev. Hardware is opt-in per mode:
+
+| Profile | Codec / container | Modes | Notes |
+|---|---|---|---|
+| `h264-sw` | H.264 — MP4 (clip) / fMP4 (cast) | clip, cast | universal incl. Safari/iOS; OpenH264 (software) |
+| `h264-hw` | H.264 — MP4 / fMP4 | clip, cast | Vulkan Video (NVIDIA/AMD/Intel; NVENC has no H.264) |
+| `vp9-sw` | VP9 — WebM | cast | cast default; crisp screen text; Chromium/Firefox |
+| `av1-sw` | AV1 — WebM | cast | SVT-AV1 (software) — exercise AV1 without a GPU |
+| `av1-hw` | AV1 — WebM | cast | NVENC AV1 (NVIDIA); efficient + crisp; Chromium/Firefox |
+
+Clips are always H.264/MP4 (universal download). Cast defaults to VP9/WebM (crisp, Chromium/Firefox); switch to `h264-sw`/`h264-hw` for H.264/fMP4 that also plays in Safari/iOS, or `av1-*` for AV1/WebM. Hardware profiles require the matching runtime in the **backend** (Vulkan for `h264-hw`, CUDA + NVENC for `av1-hw`) — the gateway only selects the node, so a missing runtime surfaces as a backend pipeline error, not a gateway one.
+
+## Lifetime & teardown (cast)
+
+The engine does **not** stop a pipeline when its MSE viewers disconnect, and has no idle reaper — so lifetime is the gateway's job. It keeps **one session per normalized URL** (viewers of the same page share one renderer), refcounts viewers across the streaming proxy, and a background reaper tears down sessions that have been **idle** past the grace window or have exceeded their **max lifetime** (via `DELETE /api/v1/sessions/{id}`, which fully drops the pipeline). On `SIGTERM` it drains and destroys every owned session, so a redeploy never leaks renderers.
+
+## Metrics
+
+Prometheus metrics at `GET /metrics` (not gated by the concurrency limit). Beyond the per-endpoint request/latency/rejection series (`endpoint` is `clip` or `cast`), `cast` adds `webcapture_active_sessions`, `webcapture_active_viewers`, `webcapture_session_lifetime_seconds`, and `webcapture_sessions_reaped_total{reason}`. A public instance may keep `/metrics` inside its trust boundary rather than exposing it.
+
+## Limitations
+
+- **Public / URL-only.** Targets that resolve to loopback/private/link-local/CGNAT/cloud-metadata addresses are rejected (SSRF guard). Auth-gated pages (cookies/headers) are intentionally out of scope — a future self-hosted feature, never the public path. DNS rebinding between the gateway's check and Servo's own fetch is a known gap.
+- **Servo is view-only and software-rendered**: static/CSS pages render at full frame rate; heavy WebGL is ~15–20 fps. No clicking, scrolling, or login.
+- **`cast` in Safari/iOS**: the default VP9/WebM is Chromium/Firefox-only; use `cast-encoder=h264-sw` for fMP4/H.264 that plays in Safari/iOS.
diff --git a/examples/web-capture/cmd/gateway/capture.go b/examples/web-capture/cmd/gateway/capture.go
new file mode 100644
index 000000000..4d50e2bfe
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/capture.go
@@ -0,0 +1,309 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+package main
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"net/url"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+)
+
+type captureMode int
+
+const (
+	modeClip captureMode = iota
+	modeCast
+)
+
+func (m captureMode) String() string {
+	if m == modeCast {
+		return "cast"
+	}
+	return "clip"
+}
+
+// Capture resolution is capped at 4K; bigger just wastes work.
+const (
+	maxResW = 3840
+	maxResH = 2160
+)
+
+var (
+	errNoTarget      = errors.New("no target URL in path")
+	errBadDuration   = errors.New("invalid dur option")
+	errBadResolution = errors.New("invalid res option (expected WxH)")
+	errUnknownOption = errors.New("unknown option")
+	errBlockedTarget = errors.New("target host is not allowed")
+)
+
+// captureOpts holds the per-request knobs parsed from the options segment,
+// seeded from the gateway defaults. res{W,H} is the capture resolution: the
+// page renders at that size AND is encoded at it (1:1, no downscale) so text
+// stays crisp; a wider resolution also yields a roomier desktop layout.
+type captureOpts struct {
+	dur  time.Duration // clip only
+	resW int
+	resH int
+}
+
+// optionsSegmentRe matches a leading comma-separated key=value options segment
+// (e.g. "dur=30s" or "res=1920x1080,dur=30s"). A real host never contains '=',
+// so a first segment that matches this is unambiguously options, not the target.
+var optionsSegmentRe = regexp.MustCompile(`^[a-z]+=[^,/]+(,[a-z]+=[^,/]+)*$`)
+
+// detectMode resolves the output mode from the first path segment — `clip` or
+// `cast` — so a single host (web.streamkit.dev) serves both: the path is
+// /{mode}/[options]/{target-url}. It returns the rest of the raw request target
+// with the mode segment stripped, and ok=false when neither matches.
+func detectMode(rawTarget string) (mode captureMode, rest string, ok bool) {
+	rest = strings.TrimPrefix(rawTarget, "/")
+	switch {
+	case rest == "clip" || strings.HasPrefix(rest, "clip/"):
+		return modeClip, strings.TrimPrefix(strings.TrimPrefix(rest, "clip"), "/"), true
+	case rest == "cast" || strings.HasPrefix(rest, "cast/"):
+		return modeCast, strings.TrimPrefix(strings.TrimPrefix(rest, "cast"), "/"), true
+	}
+	return modeClip, rest, false
+}
+
+// parseTargetAndOptions splits an optional leading options segment from the
+// verbatim target URL. rest MUST come from r.RequestURI (not the cleaned
+// r.URL.Path), so the target's own "//" and query string survive intact. opts
+// is seeded from def and overridden by any options present.
+func parseTargetAndOptions(rest string, def captureOpts, maxDur time.Duration) (target string, opts captureOpts, err error) {
+	opts = def
+	rest = strings.TrimPrefix(rest, "/")
+	if rest == "" {
+		return "", def, errNoTarget
+	}
+
+	head, tail, _ := strings.Cut(rest, "/")
+	headDec, decErr := url.PathUnescape(head)
+	if decErr != nil {
+		headDec = head
+	}
+
+	switch {
+	case optionsSegmentRe.MatchString(headDec) && tail == "":
+		return "", def, errNoTarget // options given but no target followed
+	case optionsSegmentRe.MatchString(headDec):
+		opts, err = parseOptions(headDec, def, maxDur)
+		if err != nil {
+			return "", def, err
+		}
+		target = tail
+	default:
+		target = rest
+	}
+
+	if target == "" {
+		return "", def, errNoTarget
+	}
+	low := strings.ToLower(target)
+	if !strings.HasPrefix(low, "http://") && !strings.HasPrefix(low, "https://") {
+		target = "https://" + target
+	}
+	return target, opts, nil
+}
+
+func parseOptions(seg string, def captureOpts, maxDur time.Duration) (captureOpts, error) {
+	opts := def
+	for kv := range strings.SplitSeq(seg, ",") {
+		k, v, found := strings.Cut(kv, "=")
+		if !found {
+			return def, errUnknownOption
+		}
+		switch k {
+		case "dur":
+			d, err := parseDuration(v)
+			if err != nil {
+				return def, err
+			}
+			if d > maxDur {
+				d = maxDur // clamp rather than reject — friendlier for a demo
+			}
+			opts.dur = d
+		case "res":
+			w, h, err := parseResolution(v)
+			if err != nil {
+				return def, err
+			}
+			opts.resW, opts.resH = w, h
+		default:
+			return def, fmt.Errorf("%w: %q", errUnknownOption, k)
+		}
+	}
+	return opts, nil
+}
+
+func parseDuration(v string) (time.Duration, error) {
+	if d, err := time.ParseDuration(v); err == nil {
+		if d <= 0 {
+			return 0, errBadDuration
+		}
+		return d, nil
+	}
+	if n, err := strconv.Atoi(v); err == nil && n > 0 {
+		return time.Duration(n) * time.Second, nil
+	}
+	return 0, errBadDuration
+}
+
+// parseResolution parses a "WxH" string, clamping each dimension to a sane
+// maximum. Used for both the gateway default and the res= option.
+func parseResolution(s string) (w, h int, err error) {
+	a, b, ok := strings.Cut(strings.ToLower(s), "x")
+	if !ok {
+		return 0, 0, errBadResolution
+	}
+	w, errW := strconv.Atoi(a)
+	h, errH := strconv.Atoi(b)
+	if errW != nil || errH != nil || w < 1 || h < 1 {
+		return 0, 0, errBadResolution
+	}
+	if w > maxResW {
+		w = maxResW
+	}
+	if h > maxResH {
+		h = maxResH
+	}
+	return w, h, nil
+}
+
+// parseTargetURL runs the DNS-free half of target validation: http(s)-only
+// scheme plus a literal-IP block check. It is cheap enough to run before the
+// autoplay player page (which never fetches the target), so a browser visit
+// pays no DNS lookup. The page's <video> re-request then hits the render path,
+// where validateTarget completes the check with a single DNS resolution.
+func parseTargetURL(raw string) (*url.URL, error) {
+	u, err := url.Parse(raw)
+	if err != nil {
+		return nil, fmt.Errorf("parse url: %w", err)
+	}
+	switch strings.ToLower(u.Scheme) {
+	case "http", "https":
+	default:
+		return nil, errBlockedTarget
+	}
+	host := u.Hostname()
+	if host == "" {
+		return nil, errBlockedTarget
+	}
+	if ip := net.ParseIP(host); ip != nil && isBlockedIP(ip) {
+		return nil, errBlockedTarget
+	}
+	return u, nil
+}
+
+// validateTarget enforces the public/URL-only policy: http(s) only, and the
+// host must not resolve to a loopback/private/link-local/metadata address. DNS
+// is re-resolved here so a hostname pointing at an internal IP is caught;
+// rebinding between this check and Servo's own fetch is a documented limitation.
+func validateTarget(ctx context.Context, raw string) (*url.URL, error) {
+	u, err := parseTargetURL(raw)
+	if err != nil {
+		return nil, err
+	}
+	if err := resolveTargetAllowed(ctx, u); err != nil {
+		return nil, err
+	}
+	return u, nil
+}
+
+// resolveTargetAllowed completes validateTarget by resolving a hostname and
+// rejecting it if any address is internal. Literal-IP hosts are already screened
+// by parseTargetURL, so they skip the lookup.
+func resolveTargetAllowed(ctx context.Context, u *url.URL) error {
+	host := u.Hostname()
+	if net.ParseIP(host) != nil {
+		return nil
+	}
+	rctx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+	addrs, err := net.DefaultResolver.LookupIPAddr(rctx, host)
+	if err != nil {
+		return fmt.Errorf("resolve host: %w", err)
+	}
+	if len(addrs) == 0 {
+		return errBlockedTarget
+	}
+	for _, a := range addrs {
+		if isBlockedIP(a.IP) {
+			return errBlockedTarget
+		}
+	}
+	return nil
+}
+
+func isBlockedIP(ip net.IP) bool {
+	if ip.IsLoopback() ||
+		ip.IsPrivate() ||
+		ip.IsUnspecified() ||
+		ip.IsLinkLocalUnicast() ||
+		ip.IsLinkLocalMulticast() ||
+		ip.IsInterfaceLocalMulticast() ||
+		ip.IsMulticast() {
+		return true
+	}
+	if v4 := ip.To4(); v4 != nil {
+		return blockedV4(v4)
+	}
+	// IPv6 forms that embed an internal IPv4 (NAT64, 6to4) dodge the v4 checks
+	// above — extract the embedded address and re-check it.
+	if v4 := embeddedV4(ip); v4 != nil {
+		return isBlockedIP(v4)
+	}
+	return false
+}
+
+// blockedV4 covers reserved IPv4 ranges that the net.IP predicates miss.
+func blockedV4(v4 net.IP) bool {
+	switch {
+	case v4[0] == 0: // 0.0.0.0/8 "this host" — 0.0.0.1 reaches localhost on Linux
+		return true
+	case v4[0] == 100 && v4[1]&0xc0 == 64: // 100.64.0.0/10 CGNAT
+		return true
+	case v4[0] == 198 && v4[1]&0xfe == 18: // 198.18.0.0/15 benchmarking
+		return true
+	default:
+		return false
+	}
+}
+
+// embeddedV4 returns the IPv4 address an IPv6 form can reach an IPv4 host
+// through — so the caller can re-screen it against the internal-range block
+// list. Covers NAT64 (well-known 64:ff9b::/96 and RFC 8215 local-use
+// 64:ff9b:1::/48), 6to4 (2002::/16), and the deprecated IPv4-compatible
+// ::a.b.c.d (::/96); returns nil for anything else.
+func embeddedV4(ip net.IP) net.IP {
+	v6 := ip.To16()
+	if v6 == nil || ip.To4() != nil {
+		return nil
+	}
+	suffixV4 := net.IPv4(v6[12], v6[13], v6[14], v6[15])
+	switch {
+	case bytes.HasPrefix(v6, []byte{0x00, 0x64, 0xff, 0x9b, 0, 0, 0, 0, 0, 0, 0, 0}): // NAT64 64:ff9b::/96
+		return suffixV4
+	case bytes.HasPrefix(v6, []byte{0x00, 0x64, 0xff, 0x9b, 0x00, 0x01}): // NAT64 64:ff9b:1::/48 (RFC 8215)
+		return suffixV4
+	case v6[0] == 0x20 && v6[1] == 0x02: // 6to4 2002::/16
+		return net.IPv4(v6[2], v6[3], v6[4], v6[5])
+	case bytes.Equal(v6[:12], ipv4CompatPrefix): // ::a.b.c.d (loopback/unspecified already screened)
+		return suffixV4
+	default:
+		return nil
+	}
+}
+
+// ipv4CompatPrefix is the 12 zero bytes that lead an IPv4-compatible IPv6
+// address (::a.b.c.d).
+var ipv4CompatPrefix = make([]byte, 12)
diff --git a/examples/web-capture/cmd/gateway/capture_test.go b/examples/web-capture/cmd/gateway/capture_test.go
new file mode 100644
index 000000000..a1d634161
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/capture_test.go
@@ -0,0 +1,157 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+package main
+
+import (
+	"context"
+	"testing"
+	"time"
+)
+
+func TestDetectMode(t *testing.T) {
+	cases := []struct {
+		rawTarget string
+		wantMode  captureMode
+		wantRest  string
+		wantOK    bool
+	}{
+		{"/clip/example.com", modeClip, "example.com", true},
+		{"/cast/dur=5s/example.com", modeCast, "dur=5s/example.com", true},
+		{"/clip/dur=30s/example.com", modeClip, "dur=30s/example.com", true},
+		{"/cast/example.com", modeCast, "example.com", true},
+		{"/example.com", modeClip, "", false}, // no mode segment
+		{"/", modeClip, "", false},
+	}
+	for _, c := range cases {
+		mode, rest, ok := detectMode(c.rawTarget)
+		if ok != c.wantOK {
+			t.Errorf("detectMode(%q) ok=%v want %v", c.rawTarget, ok, c.wantOK)
+			continue
+		}
+		if !ok {
+			continue
+		}
+		if mode != c.wantMode || rest != c.wantRest {
+			t.Errorf("detectMode(%q) = (%v,%q) want (%v,%q)", c.rawTarget, mode, rest, c.wantMode, c.wantRest)
+		}
+	}
+}
+
+func TestParseTargetAndOptions(t *testing.T) {
+	def := captureOpts{dur: 10 * time.Second, resW: 1920, resH: 1080}
+	const maxDur = 60 * time.Second
+	cases := []struct {
+		name, rest         string
+		wantTarget         string
+		wantDur            time.Duration
+		wantResW, wantResH int
+		wantErr            bool
+	}{
+		{"bare host", "example.com/page", "https://example.com/page", 10 * time.Second, 1920, 1080, false},
+		{"scheme + query preserved", "https://e.com/p?a=1&b=2", "https://e.com/p?a=1&b=2", 10 * time.Second, 1920, 1080, false},
+		{"explicit http kept", "http://e.com", "http://e.com", 10 * time.Second, 1920, 1080, false},
+		{"dur option", "dur=30s/example.com", "https://example.com", 30 * time.Second, 1920, 1080, false},
+		{"dur seconds int", "dur=15/example.com", "https://example.com", 15 * time.Second, 1920, 1080, false},
+		{"dur clamped to max", "dur=90s/example.com", "https://example.com", maxDur, 1920, 1080, false},
+		{"resolution option", "res=2560x1440/example.com", "https://example.com", 10 * time.Second, 2560, 1440, false},
+		{"dur and resolution", "dur=20s,res=1280x720/example.com", "https://example.com", 20 * time.Second, 1280, 720, false},
+		{"host that looks like a token", "30s.com/x", "https://30s.com/x", 10 * time.Second, 1920, 1080, false},
+		{"empty", "", "", 0, 0, 0, true},
+		{"options with no target", "dur=30s", "", 0, 0, 0, true},
+		{"bad dur", "dur=abc/example.com", "", 0, 0, 0, true},
+		{"bad resolution", "res=wide/example.com", "", 0, 0, 0, true},
+		{"unknown option", "zoom=2/example.com", "", 0, 0, 0, true},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			target, opts, err := parseTargetAndOptions(c.rest, def, maxDur)
+			if (err != nil) != c.wantErr {
+				t.Fatalf("err=%v wantErr=%v", err, c.wantErr)
+			}
+			if c.wantErr {
+				return
+			}
+			if target != c.wantTarget {
+				t.Errorf("target=%q want %q", target, c.wantTarget)
+			}
+			if opts.dur != c.wantDur {
+				t.Errorf("dur=%v want %v", opts.dur, c.wantDur)
+			}
+			if opts.resW != c.wantResW || opts.resH != c.wantResH {
+				t.Errorf("res=%dx%d want %dx%d", opts.resW, opts.resH, c.wantResW, c.wantResH)
+			}
+		})
+	}
+}
+
+// The exact shape a local path-prefix request produces, end to end through
+// detectMode + parseTargetAndOptions.
+func TestDetectModeThenParseWithOptions(t *testing.T) {
+	mode, rest, ok := detectMode("/clip/dur=5s,res=1920x1080/streamkit.dev")
+	if !ok || mode != modeClip {
+		t.Fatalf("detectMode = (%v, %q, %v)", mode, rest, ok)
+	}
+	def := captureOpts{dur: 10 * time.Second, resW: 1280, resH: 720}
+	target, opts, err := parseTargetAndOptions(rest, def, 60*time.Second)
+	if err != nil {
+		t.Fatalf("parse error: %v", err)
+	}
+	if target != "https://streamkit.dev" {
+		t.Errorf("target=%q want https://streamkit.dev", target)
+	}
+	if opts.dur != 5*time.Second || opts.resW != 1920 || opts.resH != 1080 {
+		t.Errorf("opts=%+v want dur=5s res=1920x1080", opts)
+	}
+}
+
+func TestClipFrames(t *testing.T) {
+	cases := map[time.Duration]int{
+		10 * time.Second:        300,
+		1500 * time.Millisecond: 45, // would truncate to 30 (1s) without rounding
+		500 * time.Millisecond:  15,
+		5 * time.Millisecond:    1, // rounds to 0 -> clamped to 1
+	}
+	for dur, want := range cases {
+		if got := clipFrames(dur); got != want {
+			t.Errorf("clipFrames(%v)=%d want %d", dur, got, want)
+		}
+	}
+}
+
+func TestValidateTarget(t *testing.T) {
+	// IP literals resolve without DNS, so these run offline.
+	cases := []struct {
+		raw         string
+		wantBlocked bool
+	}{
+		{"http://127.0.0.1", true},
+		{"http://169.254.169.254", true}, // cloud metadata
+		{"http://10.1.2.3", true},
+		{"http://192.168.0.1", true},
+		{"http://172.16.0.1", true},
+		{"http://100.64.0.1", true}, // CGNAT
+		{"http://0.0.0.0", true},
+		{"http://0.0.0.1", true},                  // 0.0.0.0/8 "this host"
+		{"http://198.18.0.1", true},               // 198.18.0.0/15 benchmarking
+		{"http://[64:ff9b::7f00:1]", true},        // NAT64 of 127.0.0.1
+		{"http://[64:ff9b:1::a9fe:a9fe]", true},   // NAT64 local-use (RFC 8215) of 169.254.169.254
+		{"http://[2002:7f00:1::]", true},          // 6to4 embedding 127.0.0.1
+		{"http://[::169.254.169.254]", true},      // IPv4-compatible IPv6 of metadata
+		{"http://[::ffff:169.254.169.254]", true}, // IPv4-mapped IPv6 of metadata
+		{"https://[64:ff9b::808:808]", false},     // NAT64 of public 8.8.8.8 — allowed
+		{"https://[64:ff9b:1::808:808]", false},   // NAT64 local-use of public 8.8.8.8 — allowed
+		{"https://[::1.1.1.1]", false},            // IPv4-compatible IPv6 of public 1.1.1.1 — allowed
+		{"http://[::1]", true},
+		{"ftp://8.8.8.8", true}, // scheme
+		{"https://8.8.8.8", false},
+		{"https://1.1.1.1", false},
+	}
+	for _, c := range cases {
+		_, err := validateTarget(context.Background(), c.raw)
+		if (err != nil) != c.wantBlocked {
+			t.Errorf("validateTarget(%q) err=%v wantBlocked=%v", c.raw, err, c.wantBlocked)
+		}
+	}
+}
diff --git a/examples/web-capture/cmd/gateway/encoders.go b/examples/web-capture/cmd/gateway/encoders.go
new file mode 100644
index 000000000..33cded7a5
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/encoders.go
@@ -0,0 +1,125 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+package main
+
+import (
+	"fmt"
+	"slices"
+	"strings"
+)
+
+// encoderProfile is a swappable encoder choice. block is the `encoder` node.
+// Clip pipelines use their fixed mp4 muxer (muxCodec = its video_codec); cast
+// pipelines inject muxer (WebM for VP9/AV1, fMP4 for H.264). Software encoders
+// take a kbps bitrate; the HW ones take bits/sec + framerate.
+type encoderProfile struct {
+	block       string
+	muxer       string // cast only
+	muxCodec    string // clip only
+	contentType string
+}
+
+// Shared encoder node blocks; placeholders are filled at render time.
+const (
+	// gop_size = {{GOP}} (one keyframe per second) keeps the first fMP4
+	// fragment short so playback starts within ~1s of first paint instead
+	// of waiting a full default GOP (2s) for the muxer to flush.
+	openh264Block = `  encoder:
+    kind: video::openh264::encoder
+    params:
+      bitrate_kbps: {{BR_KBPS}}
+      max_frame_rate: {{FPS}}.0
+      gop_size: {{GOP}}
+    needs: pixel_convert`
+
+	vulkanH264Block = `  encoder:
+    kind: video::vulkan_video::h264_encoder
+    params:
+      bitrate: {{BR_BPS}}
+      framerate: {{FPS}}
+    needs: pixel_convert`
+
+	vp9Block = `  encoder:
+    kind: video::vp9::encoder
+    params:
+      bitrate_kbps: {{BR_KBPS}}
+    needs: pixel_convert`
+
+	// CRF, not a target bitrate: SVT-AV1 rejects VBR in its low-delay mode
+	// (required for live), so a bitrate_kbps>0 fails.
+	svtAv1Block = `  encoder:
+    kind: video::svt_av1::encoder
+    params:
+      bitrate_kbps: 0
+      crf: 32
+      fps: {{FPS}}
+    needs: pixel_convert`
+
+	nvAv1Block = `  encoder:
+    kind: video::nv::av1_encoder
+    params:
+      bitrate: {{BR_BPS}}
+      framerate: {{FPS}}
+    needs: pixel_convert`
+)
+
+// Cast muxer blocks. WebM auto-detects VP9 vs AV1 from the packets; fMP4 (mp4
+// mode:stream) carries H.264 and — since the http::mse fMP4 support landed —
+// plays in Safari/iOS over a plain <video>.
+const (
+	webmMuxerBlock = `  muxer:
+    kind: containers::webm::muxer
+    params:
+      video_width: {{WIDTH}}
+      video_height: {{HEIGHT}}
+      streaming_mode: live
+    needs: encoder`
+
+	fmp4MuxerBlock = `  muxer:
+    kind: containers::mp4::muxer
+    params:
+      mode: stream
+      video_width: {{WIDTH}}
+      video_height: {{HEIGHT}}
+      video_codec: h264
+    needs: encoder`
+)
+
+// Plain MIME values; the pipeline renderers YAML-quote them at substitution
+// time, and proxyMSE reuses them verbatim as a response-header fallback.
+const (
+	h264ContentType = `video/mp4; codecs="avc1.42c01f"`
+	vp9ContentType  = `video/webm; codecs="vp9"`
+	av1ContentType  = `video/webm; codecs="av01.0.08M.08"`
+)
+
+// clipEncoders stay H.264 so downloaded clips play everywhere; software is the
+// default, hardware (Vulkan; NVIDIA/AMD/Intel) is opt-in.
+var clipEncoders = map[string]encoderProfile{
+	"h264-sw": {block: openh264Block, muxCodec: "h264", contentType: h264ContentType},
+	"h264-hw": {block: vulkanH264Block, muxCodec: "h264", contentType: h264ContentType},
+}
+
+// castEncoders: VP9/AV1-in-WebM (crisper/efficient, Chromium + Firefox) or
+// H.264-in-fMP4 (universal, including Safari/iOS).
+var castEncoders = map[string]encoderProfile{
+	"vp9-sw":  {block: vp9Block, muxer: webmMuxerBlock, contentType: vp9ContentType},
+	"av1-sw":  {block: svtAv1Block, muxer: webmMuxerBlock, contentType: av1ContentType},
+	"av1-hw":  {block: nvAv1Block, muxer: webmMuxerBlock, contentType: av1ContentType},
+	"h264-sw": {block: openh264Block, muxer: fmp4MuxerBlock, contentType: h264ContentType},
+	"h264-hw": {block: vulkanH264Block, muxer: fmp4MuxerBlock, contentType: h264ContentType},
+}
+
+func lookupEncoder(profiles map[string]encoderProfile, name string) (encoderProfile, error) {
+	if p, ok := profiles[name]; ok {
+		return p, nil
+	}
+	keys := make([]string, 0, len(profiles))
+	for k := range profiles {
+		keys = append(keys, k)
+	}
+	slices.Sort(keys)
+	return encoderProfile{}, fmt.Errorf("unknown encoder %q (choices: %s)", name, strings.Join(keys, ", "))
+}
diff --git a/examples/web-capture/cmd/gateway/encoders_test.go b/examples/web-capture/cmd/gateway/encoders_test.go
new file mode 100644
index 000000000..47b6010d4
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/encoders_test.go
@@ -0,0 +1,66 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+package main
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestLookupEncoder(t *testing.T) {
+	if _, err := lookupEncoder(clipEncoders, "h264-sw"); err != nil {
+		t.Fatalf("h264-sw should resolve: %v", err)
+	}
+	if _, err := lookupEncoder(castEncoders, "av1-hw"); err != nil {
+		t.Fatalf("av1-hw should resolve: %v", err)
+	}
+	if _, err := lookupEncoder(clipEncoders, "nope"); err == nil {
+		t.Fatal("unknown encoder should error")
+	}
+}
+
+// Each profile must select the right encoder node and bitrate unit (software =
+// kbps, hardware = bits/sec) and leave no unreplaced placeholders.
+func TestClipEncoderProfiles(t *testing.T) {
+	cases := map[string][]string{
+		"h264-sw": {"video::openh264::encoder", "bitrate_kbps: 10000", "max_frame_rate: 30.0", "gop_size: 30", "video_codec: h264"},
+		"h264-hw": {"video::vulkan_video::h264_encoder", "bitrate: 10000000", "framerate: 30", "video_codec: h264"},
+	}
+	for name, wants := range cases {
+		out := renderClipPipeline("https://example.com", 1920, 1080, 30, 300, 10000, clipEncoders[name])
+		if strings.Contains(out, "{{") {
+			t.Fatalf("%s: unreplaced placeholder in:\n%s", name, out)
+		}
+		for _, w := range wants {
+			if !strings.Contains(out, w) {
+				t.Errorf("%s: missing %q", name, w)
+			}
+		}
+	}
+}
+
+func TestCastEncoderProfiles(t *testing.T) {
+	cases := map[string][]string{
+		"vp9-sw":  {"video::vp9::encoder", "bitrate_kbps: 6000", "containers::webm::muxer", `codecs=\"vp9\"`},
+		"av1-sw":  {"video::svt_av1::encoder", "crf: 32", "containers::webm::muxer", `codecs=\"av01.0.08M.08\"`},
+		"av1-hw":  {"video::nv::av1_encoder", "bitrate: 6000000", "containers::webm::muxer", `codecs=\"av01.0.08M.08\"`},
+		"h264-sw": {"video::openh264::encoder", "containers::mp4::muxer", "mode: stream", `codecs=\"avc1.42c01f\"`},
+		"h264-hw": {"video::vulkan_video::h264_encoder", "containers::mp4::muxer", "mode: stream", `codecs=\"avc1.42c01f\"`},
+	}
+	for name, wants := range cases {
+		out := renderCastPipeline("https://example.com", 1920, 1080, 30, 10, 6000, castEncoders[name])
+		if strings.Contains(out, "{{") {
+			t.Fatalf("%s: unreplaced placeholder in:\n%s", name, out)
+		}
+		for _, w := range wants {
+			if !strings.Contains(out, w) {
+				t.Errorf("%s: missing %q", name, w)
+			}
+		}
+		if strings.Contains(out, "frame_count:") {
+			t.Errorf("%s: cast must not bound frame_count", name)
+		}
+	}
+}
diff --git a/examples/web-capture/cmd/gateway/main.go b/examples/web-capture/cmd/gateway/main.go
new file mode 100644
index 000000000..6ad14141e
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/main.go
@@ -0,0 +1,381 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+// Gateway renders web pages to video via a StreamKit backend: clip.* returns a
+// finite MP4 (oneshot), cast.* returns a live WebM stream (dynamic session).
+package main
+
+import (
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"log"
+	"math"
+	"net/http"
+	"net/url"
+	"os"
+	"os/signal"
+	"strconv"
+	"syscall"
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+)
+
+const (
+	defaultSkitURL    = "http://127.0.0.1:4545"
+	defaultListenAddr = ":8080"
+
+	captureFPS = 30
+
+	// Capture resolution: pages render AND encode at this size (1:1, no
+	// downscale, so text stays crisp). Override per request with res=WxH or
+	// globally with --resolution / GATEWAY_RESOLUTION.
+	defaultResolution = "1920x1080"
+
+	// Video bitrate defaults (kbps), tuned for crisp 1080p screen content.
+	defaultClipBitrateKbps = 10000
+	defaultCastBitrateKbps = 6000
+
+	// Software encoders by default so it runs anywhere (no GPU); hardware is
+	// opt-in via --clip-encoder / --cast-encoder.
+	defaultClipEncoder = "h264-sw"
+	defaultCastEncoder = "vp9-sw"
+)
+
+type config struct {
+	listenAddr     string
+	skitURL        string
+	authToken      string
+	maxConcurrency int
+	clipDefaultDur time.Duration
+	clipMaxDur     time.Duration
+	resW           int
+	resH           int
+	clipBitrate    int
+	castBitrate    int
+	clipEncoder    string
+	castEncoder    string
+	maxSessions    int
+	maxViewers     int
+	idleTTL        time.Duration
+	maxLifetime    time.Duration
+}
+
+type gateway struct {
+	client          *http.Client // oneshot + skit control calls
+	streamClient    *http.Client // long-lived MSE proxy
+	skitURL         string
+	clipSem         chan struct{}
+	clipDefaultDur  time.Duration
+	clipMaxDur      time.Duration
+	resW            int
+	resH            int
+	clipBitrate     int
+	castBitrate     int
+	clipEnc         encoderProfile
+	castEnc         encoderProfile
+	mseReadyTimeout time.Duration
+	skit            *skitClient
+	sessions        *sessionManager
+}
+
+func main() {
+	cfg := loadConfig()
+
+	clipEnc, err := lookupEncoder(clipEncoders, cfg.clipEncoder)
+	if err != nil {
+		log.Fatalf("invalid --clip-encoder: %v", err)
+	}
+	castEnc, err := lookupEncoder(castEncoders, cfg.castEncoder)
+	if err != nil {
+		log.Fatalf("invalid --cast-encoder: %v", err)
+	}
+
+	ctrlClient := newHTTPClient(false, 0)
+	skit := &skitClient{client: ctrlClient, baseURL: cfg.skitURL, token: cfg.authToken}
+	gw := &gateway{
+		client:          ctrlClient,
+		streamClient:    newHTTPClient(true, 10*time.Second),
+		skitURL:         cfg.skitURL,
+		clipSem:         make(chan struct{}, cfg.maxConcurrency),
+		clipDefaultDur:  cfg.clipDefaultDur,
+		clipMaxDur:      cfg.clipMaxDur,
+		resW:            cfg.resW,
+		resH:            cfg.resH,
+		clipBitrate:     cfg.clipBitrate,
+		castBitrate:     cfg.castBitrate,
+		clipEnc:         clipEnc,
+		castEnc:         castEnc,
+		mseReadyTimeout: 8 * time.Second,
+		skit:            skit,
+		sessions:        newSessionManager(skit, cfg.maxSessions, cfg.maxViewers, cfg.idleTTL, cfg.maxLifetime),
+	}
+	log.Printf("encoders: clip=%s cast=%s", cfg.clipEncoder, cfg.castEncoder)
+
+	srv := &http.Server{
+		Addr:              cfg.listenAddr,
+		Handler:           logging(gw.router()),
+		ReadHeaderTimeout: 5 * time.Second,
+	}
+
+	reaperCtx, cancelReaper := context.WithCancel(context.Background())
+	go gw.sessions.runReaper(reaperCtx, 10*time.Second)
+
+	done := make(chan struct{})
+	go func() {
+		sigCh := make(chan os.Signal, 1)
+		signal.Notify(sigCh, os.Interrupt, syscall.SIGTERM)
+		<-sigCh
+		log.Printf("shutdown signal received; draining and tearing down sessions")
+		cancelReaper()
+
+		shutCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		defer cancel()
+		if err := srv.Shutdown(shutCtx); err != nil {
+			log.Printf("graceful shutdown timed out (%v); forcing", err)
+			_ = srv.Close()
+		}
+		// Tear down owned sessions so a restart never leaks Servo pipelines.
+		destroyCtx, cancel2 := context.WithTimeout(context.Background(), 15*time.Second)
+		defer cancel2()
+		gw.sessions.shutdownAll(destroyCtx)
+		close(done)
+	}()
+
+	log.Printf("StreamKit web-capture gateway listening on %s -> %s", cfg.listenAddr, cfg.skitURL)
+	if err := srv.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
+		log.Fatalf("server error: %v", err)
+	}
+	<-done
+}
+
+// clampMin floors a capacity knob at 1: --max-concurrency < 1 would size
+// clipSem as an unbuffered channel and deadlock every clip render, and
+// --max-sessions/--max-viewers < 1 would silently reject every cast.
+func clampMin(name string, n int) int {
+	if n < 1 {
+		log.Printf("invalid %s %d, using 1", name, n)
+		return 1
+	}
+	return n
+}
+
+func loadConfig() config {
+	listen := flag.String("listen", getEnvDefault("GATEWAY_LISTEN", defaultListenAddr), "Listen address")
+	skit := flag.String("skit-url", getEnvDefault("SKIT_URL", defaultSkitURL), "Skit backend URL")
+	token := flag.String("token", os.Getenv("SKIT_TOKEN"), "Bearer token for Skit (overrides SKIT_TOKEN env)")
+	maxConc := flag.Int("max-concurrency", envInt("GATEWAY_MAX_CONCURRENCY", 4), "Max concurrent clip renders")
+	clipDefault := flag.Int("clip-default-secs", envInt("GATEWAY_CLIP_DEFAULT_SECS", 10), "Default clip duration (seconds)")
+	clipMax := flag.Int("clip-max-secs", envInt("GATEWAY_CLIP_MAX_SECS", 60), "Maximum clip duration (seconds)")
+	maxSessions := flag.Int("max-sessions", envInt("GATEWAY_MAX_SESSIONS", 8), "Max concurrent live cast sessions")
+	maxViewers := flag.Int("max-viewers", envInt("GATEWAY_MAX_VIEWERS", 10), "Max viewers per cast stream")
+	idleSecs := flag.Int("session-idle-secs", envInt("GATEWAY_SESSION_IDLE_SECS", 30), "Idle grace before a viewerless session is reaped (seconds)")
+	maxLifeSecs := flag.Int("session-max-secs", envInt("GATEWAY_SESSION_MAX_SECS", 1800), "Max lifetime of a cast session (seconds)")
+	resolution := flag.String("resolution", getEnvDefault("GATEWAY_RESOLUTION", defaultResolution), "Capture resolution WxH (pages render and encode at this size, 1:1)")
+	clipBitrate := flag.Int("clip-bitrate-kbps", envInt("GATEWAY_CLIP_BITRATE_KBPS", defaultClipBitrateKbps), "Clip video bitrate (kbps)")
+	castBitrate := flag.Int("cast-bitrate-kbps", envInt("GATEWAY_CAST_BITRATE_KBPS", defaultCastBitrateKbps), "Cast video bitrate (kbps)")
+	clipEncoder := flag.String("clip-encoder", getEnvDefault("GATEWAY_CLIP_ENCODER", defaultClipEncoder), "Clip encoder: h264-sw, h264-hw")
+	castEncoder := flag.String("cast-encoder", getEnvDefault("GATEWAY_CAST_ENCODER", defaultCastEncoder), "Cast encoder: vp9-sw, av1-sw, av1-hw, h264-sw, h264-hw (h264 = fMP4, plays in Safari/iOS)")
+
+	flag.Parse()
+
+	clipDefaultDur := time.Duration(*clipDefault) * time.Second
+	clipMaxDur := time.Duration(*clipMax) * time.Second
+	if clipDefaultDur > clipMaxDur {
+		clipDefaultDur = clipMaxDur
+	}
+
+	*maxConc = clampMin("--max-concurrency", *maxConc)
+	*maxSessions = clampMin("--max-sessions", *maxSessions)
+	*maxViewers = clampMin("--max-viewers", *maxViewers)
+
+	resW, resH, err := parseResolution(*resolution)
+	if err != nil {
+		log.Printf("invalid --resolution %q, using %s", *resolution, defaultResolution)
+		resW, resH, _ = parseResolution(defaultResolution)
+	}
+
+	return config{
+		listenAddr:     *listen,
+		skitURL:        *skit,
+		authToken:      *token,
+		maxConcurrency: *maxConc,
+		clipDefaultDur: clipDefaultDur,
+		clipMaxDur:     clipMaxDur,
+		resW:           resW,
+		resH:           resH,
+		clipBitrate:    *clipBitrate,
+		castBitrate:    *castBitrate,
+		clipEncoder:    *clipEncoder,
+		castEncoder:    *castEncoder,
+		maxSessions:    *maxSessions,
+		maxViewers:     *maxViewers,
+		idleTTL:        time.Duration(*idleSecs) * time.Second,
+		maxLifetime:    time.Duration(*maxLifeSecs) * time.Second,
+	}
+}
+
+func envInt(key string, def int) int {
+	if v := os.Getenv(key); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 {
+			return n
+		}
+	}
+	return def
+}
+
+func getEnvDefault(key, def string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return def
+}
+
+func (gw *gateway) router() http.Handler {
+	metricsHandler := promhttp.Handler()
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/metrics":
+			metricsHandler.ServeHTTP(w, r)
+		case "/healthz", "/health":
+			w.Header().Set("Content-Type", "text/plain")
+			_, _ = io.WriteString(w, "ok\n")
+		case "", "/", "/favicon.ico", "/robots.txt":
+			gw.handleUsage(w, r)
+		default:
+			gw.handleCapture(w, r)
+		}
+	})
+}
+
+func (gw *gateway) handleCapture(w http.ResponseWriter, r *http.Request) {
+	mode, rest, ok := detectMode(r.RequestURI)
+	if !ok {
+		gw.handleUsage(w, r)
+		return
+	}
+	endpoint := mode.String()
+
+	withMetrics(endpoint, w, r, func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodGet {
+			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+			return
+		}
+		def := captureOpts{dur: gw.clipDefaultDur, resW: gw.resW, resH: gw.resH}
+		target, opts, err := parseTargetAndOptions(rest, def, gw.clipMaxDur)
+		if err != nil {
+			recordRejection(endpoint, reasonBadRequest)
+			http.Error(w, "bad request: "+err.Error(), http.StatusBadRequest)
+			return
+		}
+		// Only the DNS-free screen (scheme + literal-IP block) runs here; the
+		// hostname DNS resolution is deferred into the render path so a browser
+		// visit served the autoplay page pays no lookup (see serveClip/serveCast).
+		u, err := parseTargetURL(target)
+		if err != nil {
+			recordRejection(endpoint, reasonSSRFBlocked)
+			http.Error(w, "target host is not allowed", http.StatusForbidden)
+			return
+		}
+		switch mode {
+		case modeClip:
+			gw.serveClip(w, r, u, opts)
+		case modeCast:
+			gw.serveCast(w, r, u, opts)
+		}
+	})
+}
+
+func (gw *gateway) serveClip(w http.ResponseWriter, r *http.Request, u *url.URL, opts captureOpts) {
+	// A browser address-bar paste (Accept: text/html) gets an autoplay page; the
+	// page's <video> then re-requests this same URL (Accept: */*) and is served
+	// the raw MP4. Serving the page first avoids consuming a render slot for it.
+	if acceptsHTML(r) {
+		gw.writePlayerPage(w, r, "clip", u)
+		return
+	}
+	if !gw.screenResolvable(w, r, u, "clip") {
+		return
+	}
+
+	release, ok := gw.acquireClip(r.Context())
+	if !ok {
+		return // client disconnected while queued for a slot
+	}
+	defer release()
+
+	yaml := renderClipPipeline(u.String(), opts.resW, opts.resH, captureFPS, clipFrames(opts.dur), gw.clipBitrate, gw.clipEnc)
+	gw.proxyOneshot(w, r, yaml)
+}
+
+func (gw *gateway) serveCast(w http.ResponseWriter, r *http.Request, u *url.URL, opts captureOpts) {
+	// A browser address-bar paste (Accept: text/html) gets an autoplay page; the
+	// page's <video> then re-requests this same URL (Accept: */*) and is streamed.
+	if acceptsHTML(r) {
+		gw.writePlayerPage(w, r, "cast", u)
+		return
+	}
+	if !gw.screenResolvable(w, r, u, "cast") {
+		return
+	}
+
+	// Resolution is part of the render, so it keys the shared session: viewers of
+	// the same URL+resolution share one pipeline; a different resolution is its
+	// own. The YAML renders lazily — only a session-creating acquire uses it.
+	key := fmt.Sprintf("%s|%dx%d", u.String(), opts.resW, opts.resH)
+	s, err := gw.sessions.acquire(r.Context(), key, func() string {
+		return renderCastPipeline(u.String(), opts.resW, opts.resH, captureFPS, gw.sessions.maxViewers, gw.castBitrate, gw.castEnc)
+	})
+	if err != nil {
+		switch {
+		case errors.Is(err, errOverCapacity):
+			recordRejection("cast", reasonOverCapacity)
+			http.Error(w, "server at capacity, try again shortly", http.StatusServiceUnavailable)
+		case errors.Is(err, errShuttingDown):
+			http.Error(w, "server shutting down", http.StatusServiceUnavailable)
+		case errors.Is(err, context.Canceled):
+			// client gave up before the stream was ready
+		default:
+			recordRejection("cast", reasonUpstreamError)
+			http.Error(w, "failed to start stream", http.StatusBadGateway)
+		}
+		return
+	}
+	defer gw.sessions.release(s)
+	gw.proxyMSE(w, r, s)
+}
+
+// screenResolvable completes SSRF validation for the render path by resolving
+// the target hostname; it is called after the player-page short-circuit so a
+// browser visit never pays the DNS lookup. Returns false (and writes a 403)
+// when the host resolves to a blocked address.
+func (gw *gateway) screenResolvable(w http.ResponseWriter, r *http.Request, u *url.URL, endpoint string) bool {
+	if err := resolveTargetAllowed(r.Context(), u); err != nil {
+		recordRejection(endpoint, reasonSSRFBlocked)
+		http.Error(w, "target host is not allowed", http.StatusForbidden)
+		return false
+	}
+	return true
+}
+
+// clipFrames rounds a duration to a whole number of frames (parseDuration
+// accepts sub-second values, so truncation would skew the clip length).
+func clipFrames(dur time.Duration) int {
+	frames := int(math.Round(dur.Seconds() * float64(captureFPS)))
+	return max(frames, 1)
+}
+
+// acquireClip takes a concurrency slot but bails if the client disconnects
+// while queued — otherwise abandoned requests pile up on a full channel.
+func (gw *gateway) acquireClip(ctx context.Context) (release func(), ok bool) {
+	select {
+	case gw.clipSem <- struct{}{}:
+		return func() { <-gw.clipSem }, true
+	case <-ctx.Done():
+		return func() {}, false
+	}
+}
diff --git a/examples/web-capture/cmd/gateway/main_test.go b/examples/web-capture/cmd/gateway/main_test.go
new file mode 100644
index 000000000..2b9411c56
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/main_test.go
@@ -0,0 +1,24 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+package main
+
+import "testing"
+
+func TestClampMin(t *testing.T) {
+	cases := []struct {
+		in   int
+		want int
+	}{
+		{-1, 1},
+		{0, 1},
+		{1, 1},
+		{4, 4},
+	}
+	for _, tc := range cases {
+		if got := clampMin("--max-concurrency", tc.in); got != tc.want {
+			t.Errorf("clampMin(%d) = %d, want %d", tc.in, got, tc.want)
+		}
+	}
+}
diff --git a/examples/web-capture/cmd/gateway/metrics.go b/examples/web-capture/cmd/gateway/metrics.go
new file mode 100644
index 000000000..923b05d41
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/metrics.go
@@ -0,0 +1,173 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+package main
+
+import (
+	"fmt"
+	"net/http"
+	"strconv"
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/promauto"
+)
+
+// Buckets span sub-100ms rejections up to a 60s clip render / slow session start.
+var latencyBuckets = []float64{0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10, 30, 60}
+
+// sessionLifetimeBuckets span a quick reload up to the max-lifetime cap.
+var sessionLifetimeBuckets = []float64{1, 5, 15, 30, 60, 120, 300, 600, 1800}
+
+// codeClientClosed mirrors nginx's 499: the handler returned without writing a
+// response, typically because the client disconnected mid-request.
+const codeClientClosed = 499
+
+// knownMethods bounds the requests_total method label so a client cannot mint
+// unbounded time series via arbitrary RFC method tokens.
+var knownMethods = map[string]struct{}{
+	http.MethodGet:  {},
+	http.MethodHead: {},
+	http.MethodPost: {},
+	http.MethodPut:  {},
+}
+
+func methodLabel(method string) string {
+	if _, ok := knownMethods[method]; ok {
+		return method
+	}
+	return "other"
+}
+
+// codeLabel keeps canonical HTTP statuses (and 499) but folds anything else to
+// its class (e.g. "5xx") so an odd backend code cannot explode label cardinality.
+func codeLabel(code int) string {
+	if code == codeClientClosed || http.StatusText(code) != "" {
+		return strconv.Itoa(code)
+	}
+	if code >= 100 && code < 600 {
+		return fmt.Sprintf("%dxx", code/100)
+	}
+	return "other"
+}
+
+var (
+	requestsTotal = promauto.NewCounterVec(prometheus.CounterOpts{
+		Name: "webcapture_requests_total",
+		Help: "Total web-capture requests by endpoint (clip/cast), method, and HTTP status code.",
+	}, []string{"endpoint", "method", "code"})
+
+	requestDuration = promauto.NewHistogramVec(prometheus.HistogramOpts{
+		Name:    "webcapture_request_duration_seconds",
+		Help:    "Total handler latency in seconds by endpoint. For cast this spans the whole viewer connection.",
+		Buckets: latencyBuckets,
+	}, []string{"endpoint"})
+
+	inflightRequests = promauto.NewGaugeVec(prometheus.GaugeOpts{
+		Name: "webcapture_inflight_requests",
+		Help: "In-flight requests by endpoint (received, not yet completed).",
+	}, []string{"endpoint"})
+
+	upstreamDuration = promauto.NewHistogramVec(prometheus.HistogramOpts{
+		Name:    "webcapture_upstream_duration_seconds",
+		Help:    "Time to receive response headers from the skit backend by endpoint.",
+		Buckets: latencyBuckets,
+	}, []string{"endpoint"})
+
+	rejectedTotal = promauto.NewCounterVec(prometheus.CounterOpts{
+		Name: "webcapture_rejected_total",
+		Help: "Rejected requests by endpoint and reason.",
+	}, []string{"endpoint", "reason"})
+
+	activeSessions = promauto.NewGauge(prometheus.GaugeOpts{
+		Name: "webcapture_active_sessions",
+		Help: "Live cast sessions the gateway currently owns (one Servo pipeline each).",
+	})
+
+	activeViewers = promauto.NewGauge(prometheus.GaugeOpts{
+		Name: "webcapture_active_viewers",
+		Help: "Active cast viewers across all sessions.",
+	})
+
+	sessionsReaped = promauto.NewCounterVec(prometheus.CounterOpts{
+		Name: "webcapture_sessions_reaped_total",
+		Help: "Cast sessions torn down, by reason (idle, max_lifetime, shutdown).",
+	}, []string{"reason"})
+
+	sessionLifetime = promauto.NewHistogram(prometheus.HistogramOpts{
+		Name:    "webcapture_session_lifetime_seconds",
+		Help:    "Lifetime of a cast session from creation to teardown.",
+		Buckets: sessionLifetimeBuckets,
+	})
+)
+
+type rejectReason string
+
+const (
+	reasonBadRequest    rejectReason = "bad_request"
+	reasonSSRFBlocked   rejectReason = "ssrf_blocked"
+	reasonOverCapacity  rejectReason = "over_capacity"
+	reasonUpstreamError rejectReason = "upstream_error"
+	reasonSessionGone   rejectReason = "session_gone"
+)
+
+func recordRejection(endpoint string, reason rejectReason) {
+	rejectedTotal.WithLabelValues(endpoint, string(reason)).Inc()
+}
+
+// statusRecorder captures the response status code while preserving
+// http.Flusher so proxied streaming responses keep flushing incrementally. A
+// zero code means nothing was written (client closed before any response).
+type statusRecorder struct {
+	http.ResponseWriter
+	code int
+}
+
+func (s *statusRecorder) WriteHeader(code int) {
+	if s.code == 0 {
+		s.code = code
+	}
+	s.ResponseWriter.WriteHeader(code)
+}
+
+func (s *statusRecorder) Write(b []byte) (int, error) {
+	if s.code == 0 {
+		s.code = http.StatusOK
+	}
+	return s.ResponseWriter.Write(b)
+}
+
+func (s *statusRecorder) Flush() {
+	if f, ok := s.ResponseWriter.(http.Flusher); ok {
+		f.Flush()
+	}
+}
+
+// withMetrics records count, latency, and the in-flight gauge for one endpoint.
+// Recording runs in a defer so a panicking handler is still counted (as 500)
+// before the panic propagates.
+func withMetrics(endpoint string, w http.ResponseWriter, r *http.Request, fn func(http.ResponseWriter, *http.Request)) {
+	inflightRequests.WithLabelValues(endpoint).Inc()
+	rec := &statusRecorder{ResponseWriter: w}
+	start := time.Now()
+
+	defer func() {
+		p := recover()
+		code := rec.code
+		switch {
+		case p != nil:
+			code = http.StatusInternalServerError
+		case code == 0:
+			code = codeClientClosed
+		}
+		requestDuration.WithLabelValues(endpoint).Observe(time.Since(start).Seconds())
+		requestsTotal.WithLabelValues(endpoint, methodLabel(r.Method), codeLabel(code)).Inc()
+		inflightRequests.WithLabelValues(endpoint).Dec()
+		if p != nil {
+			panic(p)
+		}
+	}()
+
+	fn(rec, r)
+}
diff --git a/examples/web-capture/cmd/gateway/metrics_test.go b/examples/web-capture/cmd/gateway/metrics_test.go
new file mode 100644
index 000000000..9365c69f1
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/metrics_test.go
@@ -0,0 +1,44 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+package main
+
+import (
+	"net/http"
+	"testing"
+)
+
+func TestMethodLabel(t *testing.T) {
+	cases := map[string]string{
+		http.MethodGet:  "GET",
+		http.MethodPost: "POST",
+		http.MethodPut:  "PUT",
+		http.MethodHead: "HEAD",
+		"PATCH":         "other",
+		"FROBNICATE":    "other",
+		"":              "other",
+	}
+	for in, want := range cases {
+		if got := methodLabel(in); got != want {
+			t.Errorf("methodLabel(%q)=%q want %q", in, got, want)
+		}
+	}
+}
+
+func TestCodeLabel(t *testing.T) {
+	cases := map[int]string{
+		200: "200",
+		404: "404",
+		499: "499", // client closed
+		502: "502",
+		550: "5xx", // non-canonical, folds to class
+		99:  "other",
+		700: "other",
+	}
+	for in, want := range cases {
+		if got := codeLabel(in); got != want {
+			t.Errorf("codeLabel(%d)=%q want %q", in, got, want)
+		}
+	}
+}
diff --git a/examples/web-capture/cmd/gateway/pipelines.go b/examples/web-capture/cmd/gateway/pipelines.go
new file mode 100644
index 000000000..f7a4cd90b
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/pipelines.go
@@ -0,0 +1,67 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+package main
+
+import (
+	_ "embed"
+	"strconv"
+	"strings"
+)
+
+// The clip (oneshot MP4) and cast (live WebM) pipelines are embedded as YAML
+// templates from pipelines/. Each renders and encodes at one resolution (no
+// downscale, so text stays crisp) and carries placeholders the render functions
+// substitute: {{URL}} (strconv.Quote'd so a hostile URL can't break out of the
+// scalar), dimensions/fps/bitrate, the {{ENCODER_BLOCK}} for the chosen profile,
+// and the {{CONTENT_TYPE}}/{{MUX_CODEC}} it implies. See encoders.go.
+
+//go:embed pipelines/clip.yml.tmpl
+var clipPipelineTemplate string
+
+//go:embed pipelines/cast.yml.tmpl
+var castPipelineTemplate string
+
+func renderClipPipeline(targetURL string, resW, resH, fps, frameCount, brKbps int, enc encoderProfile) string {
+	tmpl := strings.Replace(clipPipelineTemplate, "{{ENCODER_BLOCK}}", enc.block, 1)
+	return strings.NewReplacer(
+		"{{URL}}", strconv.Quote(targetURL),
+		"{{WIDTH}}", strconv.Itoa(resW),
+		"{{HEIGHT}}", strconv.Itoa(resH),
+		"{{FPS}}", strconv.Itoa(fps),
+		"{{GOP}}", strconv.Itoa(gopForFPS(fps)),
+		"{{FRAME_COUNT}}", strconv.Itoa(frameCount),
+		"{{BR_KBPS}}", strconv.Itoa(brKbps),
+		"{{BR_BPS}}", strconv.Itoa(brKbps*1000),
+		"{{MUX_CODEC}}", enc.muxCodec,
+		"{{CONTENT_TYPE}}", strconv.Quote(enc.contentType),
+	).Replace(tmpl)
+}
+
+func renderCastPipeline(targetURL string, resW, resH, fps, maxClients, brKbps int, enc encoderProfile) string {
+	tmpl := strings.Replace(castPipelineTemplate, "{{ENCODER_BLOCK}}", enc.block, 1)
+	tmpl = strings.Replace(tmpl, "{{MUXER_BLOCK}}", enc.muxer, 1)
+	return strings.NewReplacer(
+		"{{URL}}", strconv.Quote(targetURL),
+		"{{WIDTH}}", strconv.Itoa(resW),
+		"{{HEIGHT}}", strconv.Itoa(resH),
+		"{{FPS}}", strconv.Itoa(fps),
+		"{{GOP}}", strconv.Itoa(gopForFPS(fps)),
+		"{{MAX_CLIENTS}}", strconv.Itoa(maxClients),
+		"{{BR_KBPS}}", strconv.Itoa(brKbps),
+		"{{BR_BPS}}", strconv.Itoa(brKbps*1000),
+		"{{CONTENT_TYPE}}", strconv.Quote(enc.contentType),
+	).Replace(tmpl)
+}
+
+// gopForFPS picks a keyframe interval of ~1 second (one IDR per fps frames) so
+// the fragmented-MP4 muxer flushes its first playable fragment quickly. Only
+// the OpenH264 (software) block reads {{GOP}}; the Vulkan block forces its own
+// keyframe at frame 0, so the substitution is a harmless no-op there.
+func gopForFPS(fps int) int {
+	if fps < 1 {
+		return 1
+	}
+	return fps
+}
diff --git a/examples/web-capture/cmd/gateway/pipelines/cast.yml.tmpl b/examples/web-capture/cmd/gateway/pipelines/cast.yml.tmpl
new file mode 100644
index 000000000..6ecc18b1f
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/pipelines/cast.yml.tmpl
@@ -0,0 +1,40 @@
+# SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+#
+# SPDX-License-Identifier: MPL-2.0
+
+# Dynamic pipeline: render a web page to a live WebM stream over HTTP MSE.
+# Placeholders are substituted by renderCastPipeline (see pipelines.go); the
+# encoder and muxer nodes are injected per selected profile (WebM for VP9/AV1,
+# fMP4 for H.264 — see encoders.go). The stream is unbounded (no frame limit).
+name: web-cast
+description: Render a web page to a live WebM stream
+mode: dynamic
+attributes:
+  service: web-capture
+  mode: cast
+client:
+  watch:
+    mse_path: /video
+    video: true
+nodes:
+  web:
+    kind: plugin::native::servo
+    params:
+      url: {{URL}}
+      width: {{WIDTH}}
+      height: {{HEIGHT}}
+      fps: {{FPS}}
+  pixel_convert:
+    kind: video::pixel_convert
+    params:
+      output_format: nv12
+    needs: web
+{{ENCODER_BLOCK}}
+{{MUXER_BLOCK}}
+  http_mse:
+    kind: transport::http::mse
+    params:
+      path: /video
+      max_clients: {{MAX_CLIENTS}}
+      content_type: {{CONTENT_TYPE}}
+    needs: muxer
diff --git a/examples/web-capture/cmd/gateway/pipelines/clip.yml.tmpl b/examples/web-capture/cmd/gateway/pipelines/clip.yml.tmpl
new file mode 100644
index 000000000..04359cb07
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/pipelines/clip.yml.tmpl
@@ -0,0 +1,47 @@
+# SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+#
+# SPDX-License-Identifier: MPL-2.0
+
+# Oneshot pipeline: render a web page to a short MP4 clip.
+# Placeholders are substituted by renderClipPipeline (see pipelines.go); the
+# encoder node is injected per selected profile (see encoders.go).
+# mp4 mode:stream = fragmented/progressive, so it plays inline as it renders.
+name: web-clip
+description: Render a web page to a short MP4 clip
+mode: oneshot
+attributes:
+  service: web-capture
+  mode: clip
+client:
+  input:
+    type: none
+  output:
+    type: video
+nodes:
+  web:
+    kind: plugin::native::servo
+    params:
+      url: {{URL}}
+      width: {{WIDTH}}
+      height: {{HEIGHT}}
+      fps: {{FPS}}
+      frame_count: {{FRAME_COUNT}}
+  pixel_convert:
+    kind: video::pixel_convert
+    params:
+      output_format: nv12
+    needs: web
+{{ENCODER_BLOCK}}
+  muxer:
+    kind: containers::mp4::muxer
+    params:
+      mode: stream
+      video_width: {{WIDTH}}
+      video_height: {{HEIGHT}}
+      video_codec: {{MUX_CODEC}}
+    needs: encoder
+  http_output:
+    kind: streamkit::http_output
+    params:
+      content_type: {{CONTENT_TYPE}}
+    needs: muxer
diff --git a/examples/web-capture/cmd/gateway/pipelines_test.go b/examples/web-capture/cmd/gateway/pipelines_test.go
new file mode 100644
index 000000000..cdba379cb
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/pipelines_test.go
@@ -0,0 +1,72 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+package main
+
+import (
+	"strconv"
+	"strings"
+	"testing"
+)
+
+func TestRenderClipPipeline(t *testing.T) {
+	out := renderClipPipeline("https://example.com/p?a=1", 1920, 1080, 30, 300, 10000, clipEncoders["h264-sw"])
+	if strings.Contains(out, "{{") {
+		t.Fatalf("unreplaced placeholder in:\n%s", out)
+	}
+	for _, want := range []string{
+		`url: "https://example.com/p?a=1"`,
+		"width: 1920",
+		"height: 1080",
+		"frame_count: 300",
+		"mode: stream",
+		"video_codec: h264",
+		"bitrate_kbps: 10000",
+		"max_frame_rate: 30.0",
+		"gop_size: 30",
+		"plugin::native::servo",
+		"output_format: nv12",
+		"streamkit::http_output",
+	} {
+		if !strings.Contains(out, want) {
+			t.Errorf("clip pipeline missing %q", want)
+		}
+	}
+}
+
+// A hostile URL must not break out of the YAML scalar — strconv.Quote escapes
+// any embedded newline/quote so injected keys never appear at line start.
+func TestRenderClipPipelineQuotesURL(t *testing.T) {
+	malicious := "https://x/\"\n  evil: true"
+	out := renderClipPipeline(malicious, 1920, 1080, 30, 30, 10000, clipEncoders["h264-sw"])
+	if strings.Contains(out, "\n  evil: true") {
+		t.Errorf("newline injection not escaped:\n%s", out)
+	}
+	if !strings.Contains(out, "url: "+strconv.Quote(malicious)) {
+		t.Errorf("url not quoted as expected:\n%s", out)
+	}
+}
+
+func TestRenderCastPipeline(t *testing.T) {
+	out := renderCastPipeline("https://example.com", 1920, 1080, 30, 10, 6000, castEncoders["vp9-sw"])
+	if strings.Contains(out, "{{") {
+		t.Fatalf("unreplaced placeholder in:\n%s", out)
+	}
+	for _, want := range []string{
+		"mse_path: /video",
+		"transport::http::mse",
+		"video::vp9::encoder",
+		"max_clients: 10",
+		"streaming_mode: live",
+		"width: 1920",
+		"height: 1080",
+	} {
+		if !strings.Contains(out, want) {
+			t.Errorf("cast pipeline missing %q", want)
+		}
+	}
+	if strings.Contains(out, "frame_count:") {
+		t.Error("cast pipeline must not bound frame_count (live is infinite)")
+	}
+}
diff --git a/examples/web-capture/cmd/gateway/player_page_test.go b/examples/web-capture/cmd/gateway/player_page_test.go
new file mode 100644
index 000000000..d21a302bc
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/player_page_test.go
@@ -0,0 +1,75 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+package main
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+)
+
+// A browser request (Accept: text/html) must get the autoplay player page for
+// both clip and cast, without touching the backend/render path. CLI clients
+// (no text/html in Accept) fall through to the raw-video path.
+func TestServePlayerPageForBrowser(t *testing.T) {
+	u, _ := url.Parse("https://example.com/")
+	gw := &gateway{}
+
+	cases := []struct {
+		name    string
+		serve   func(http.ResponseWriter, *http.Request, *url.URL, captureOpts)
+		titleID string
+	}{
+		{"clip", gw.serveClip, "web-clip"},
+		{"cast", gw.serveCast, "web-cast"},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			r := httptest.NewRequest(http.MethodGet, "/"+tc.name+"/example.com", nil)
+			r.Header.Set("Accept", "text/html,application/xhtml+xml")
+			w := httptest.NewRecorder()
+
+			tc.serve(w, r, u, captureOpts{})
+
+			resp := w.Result()
+			if resp.StatusCode != http.StatusOK {
+				t.Fatalf("status = %d, want 200", resp.StatusCode)
+			}
+			if ct := resp.Header.Get("Content-Type"); !strings.HasPrefix(ct, "text/html") {
+				t.Fatalf("Content-Type = %q, want text/html", ct)
+			}
+			body := w.Body.String()
+			for _, want := range []string{"<video", "autoplay", tc.titleID, "example.com"} {
+				if !strings.Contains(body, want) {
+					t.Errorf("body missing %q\nbody: %s", want, body)
+				}
+			}
+		})
+	}
+}
+
+func TestAcceptsHTML(t *testing.T) {
+	cases := []struct {
+		accept string
+		want   bool
+	}{
+		{"text/html,application/xhtml+xml", true},
+		{"*/*", false},
+		{"", false},
+		{"application/json", false},
+	}
+	for _, tc := range cases {
+		r := httptest.NewRequest(http.MethodGet, "/clip/example.com", nil)
+		if tc.accept != "" {
+			r.Header.Set("Accept", tc.accept)
+		}
+		if got := acceptsHTML(r); got != tc.want {
+			t.Errorf("acceptsHTML(%q) = %v, want %v", tc.accept, got, tc.want)
+		}
+	}
+}
diff --git a/examples/web-capture/cmd/gateway/proxy.go b/examples/web-capture/cmd/gateway/proxy.go
new file mode 100644
index 000000000..7264a4b20
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/proxy.go
@@ -0,0 +1,299 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"html"
+	"io"
+	"log"
+	"mime/multipart"
+	"net"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+)
+
+// newHTTPClient builds a client with no overall timeout (oneshot renders take
+// seconds; MSE streams run until the viewer leaves). keepAlives is off for the
+// one-shot control/render calls so each gets a fresh connection, and on for the
+// long-lived MSE proxy.
+// responseHeaderTimeout bounds the wait for upstream response headers only
+// (not the streaming body), so a backend that accepts a connection but never
+// answers can't pin a request past the ready-timeout retry loop.
+func newHTTPClient(keepAlives bool, responseHeaderTimeout time.Duration) *http.Client {
+	return &http.Client{
+		Transport: &http.Transport{
+			DialContext: (&net.Dialer{
+				Timeout:   5 * time.Second,
+				KeepAlive: 30 * time.Second,
+			}).DialContext,
+			DisableKeepAlives:     !keepAlives,
+			ForceAttemptHTTP2:     false,
+			ResponseHeaderTimeout: responseHeaderTimeout,
+		},
+	}
+}
+
+func (gw *gateway) failUpstream(w http.ResponseWriter, endpoint string, err error) {
+	log.Printf("%s upstream error: %v", endpoint, err)
+	recordRejection(endpoint, reasonUpstreamError)
+	http.Error(w, "upstream error", http.StatusBadGateway)
+}
+
+// proxyOneshot runs a clip pipeline via POST /api/v1/process and streams the
+// resulting MP4 back. The request body is a config-only multipart (the pipeline
+// has no http_input, so no media part is needed).
+func (gw *gateway) proxyOneshot(w http.ResponseWriter, r *http.Request, pipelineYAML string) {
+	ctx := r.Context()
+
+	bodyReader, bodyWriter := io.Pipe()
+	mw := multipart.NewWriter(bodyWriter)
+	go func() {
+		defer func() { _ = bodyWriter.Close() }()
+		field, err := mw.CreateFormField("config")
+		if err != nil {
+			bodyWriter.CloseWithError(err)
+			return
+		}
+		if _, err := io.WriteString(field, strings.TrimSpace(pipelineYAML)); err != nil {
+			bodyWriter.CloseWithError(err)
+			return
+		}
+		if err := mw.Close(); err != nil {
+			bodyWriter.CloseWithError(err)
+		}
+	}()
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, gw.skitURL+"/api/v1/process", bodyReader)
+	if err != nil {
+		_ = bodyReader.Close()
+		gw.failUpstream(w, "clip", fmt.Errorf("create skit request: %w", err))
+		return
+	}
+	req.Header.Set("Content-Type", mw.FormDataContentType())
+	req.Close = true
+	gw.skit.auth(req)
+
+	start := time.Now()
+	resp, err := gw.client.Do(req)
+	if err != nil {
+		if errors.Is(err, context.Canceled) {
+			return
+		}
+		gw.failUpstream(w, "clip", fmt.Errorf("call skit: %w", err))
+		return
+	}
+	upstreamDuration.WithLabelValues("clip").Observe(time.Since(start).Seconds())
+	defer func() { _ = resp.Body.Close() }()
+
+	// A status outside [100,999] would panic w.WriteHeader below (Go rejects
+	// such codes), so treat a malformed upstream status as a backend fault
+	// before forwarding it.
+	if resp.StatusCode < 100 || resp.StatusCode > 999 {
+		gw.failUpstream(w, "clip", fmt.Errorf("invalid upstream status %d", resp.StatusCode))
+		return
+	}
+	if resp.StatusCode >= 400 {
+		slurp, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
+		log.Printf("clip upstream status %d: %s", resp.StatusCode, strings.TrimSpace(string(slurp)))
+		recordRejection("clip", reasonUpstreamError)
+		http.Error(w, "failed to render page", http.StatusBadGateway)
+		return
+	}
+
+	copyHeaders(w.Header(), resp.Header)
+	if w.Header().Get("Content-Type") == "" {
+		w.Header().Set("Content-Type", "video/mp4")
+	}
+	w.WriteHeader(resp.StatusCode)
+	streamCopy(ctx, w, resp.Body, "clip")
+}
+
+// proxyMSE streams a live session to the viewer. The http_mse path only
+// registers once the session's pipeline starts, so a freshly created session
+// may 404 briefly — retry until ready or the viewer goes away. A 404 after the
+// session has been reaped (idle/max-lifetime) is indistinguishable from the
+// startup 404 by status alone, so the loop also checks session liveness and
+// fails fast rather than spinning until the ready timeout.
+func (gw *gateway) proxyMSE(w http.ResponseWriter, r *http.Request, s *liveSession) {
+	ctx := r.Context()
+	streamURL := gw.skit.streamURL(s.id)
+	deadline := time.Now().Add(gw.mseReadyTimeout)
+	retry := time.NewTicker(200 * time.Millisecond)
+	defer retry.Stop()
+
+	var resp *http.Response
+	for {
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, streamURL, nil)
+		if err != nil {
+			gw.failUpstream(w, "cast", err)
+			return
+		}
+		gw.skit.auth(req)
+		r2, err := gw.streamClient.Do(req)
+		if err == nil && r2.StatusCode == http.StatusOK {
+			resp = r2
+			break
+		}
+		if r2 != nil {
+			_, _ = io.Copy(io.Discard, io.LimitReader(r2.Body, 2048))
+			_ = r2.Body.Close()
+		}
+		if ctx.Err() != nil {
+			return
+		}
+		if !gw.sessions.isLive(s.id) {
+			log.Printf("cast: session %s reaped before mse stream became ready", s.id)
+			recordRejection("cast", reasonSessionGone)
+			http.Error(w, "stream unavailable, please retry", http.StatusServiceUnavailable)
+			return
+		}
+		if time.Now().After(deadline) {
+			if err != nil {
+				gw.failUpstream(w, "cast", err)
+			} else {
+				gw.failUpstream(w, "cast", fmt.Errorf("mse stream not ready (status %d)", r2.StatusCode))
+			}
+			return
+		}
+		select {
+		case <-ctx.Done():
+			return
+		case <-retry.C:
+		}
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	// Close the upstream body the instant the viewer's connection ends, so
+	// streamCopy's read unblocks immediately. Without this, a read parked
+	// between frames keeps the session's viewer count > 0 and dodges idle
+	// reaping until skit happens to write again. ctx is also canceled when the
+	// handler returns, so this goroutine never outlives the request.
+	go func() {
+		<-ctx.Done()
+		_ = resp.Body.Close()
+	}()
+
+	copyHeaders(w.Header(), resp.Header)
+	if w.Header().Get("Content-Type") == "" {
+		w.Header().Set("Content-Type", gw.castEnc.contentType)
+	}
+	w.WriteHeader(http.StatusOK)
+	streamCopy(ctx, w, resp.Body, "cast")
+}
+
+// streamCopy forwards an upstream body to the client, flushing each chunk so
+// live/progressive playback starts without waiting for the whole response.
+func streamCopy(ctx context.Context, w http.ResponseWriter, src io.Reader, endpoint string) {
+	var dst io.Writer = w
+	if flusher, ok := w.(http.Flusher); ok {
+		dst = flushWriter{w: w, f: flusher}
+	}
+	// A client disconnect (ctx canceled, which also closes the upstream body) is
+	// the normal way a live stream ends; only log a copy error that happened
+	// while the client was still connected.
+	if _, err := io.Copy(dst, src); err != nil && ctx.Err() == nil {
+		log.Printf("%s copy response error: %v", endpoint, err)
+	}
+}
+
+// playerPageTemplate wraps the capture in a full-window autoplay <video>. The
+// <video> re-requests this same URL with `Accept: */*`, which the clip/cast
+// handlers serve as raw video, so CLI clients (curl/ffmpeg) bypass this page.
+const playerPageTemplate = `<!doctype html><html><head><meta charset="utf-8">` +
+	`<title>web-%s · %s</title>` +
+	`<style>html,body{margin:0;height:100%%;background:#000}video{width:100%%;height:100%%;object-fit:contain}</style>` +
+	`</head><body><video src="%s" autoplay muted playsinline controls></video></body></html>`
+
+func (gw *gateway) writePlayerPage(w http.ResponseWriter, r *http.Request, kind string, target *url.URL) {
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	w.WriteHeader(http.StatusOK)
+	_, _ = fmt.Fprintf(w, playerPageTemplate, kind, html.EscapeString(target.String()), html.EscapeString(r.RequestURI))
+}
+
+const usagePage = `<!doctype html><html><head><meta charset="utf-8"><title>StreamKit web-capture</title>` +
+	`<style>body{font:16px/1.5 system-ui,sans-serif;max-width:42rem;margin:3rem auto;padding:0 1rem;color:#222}` +
+	`code{background:#f2f2f2;padding:.1em .3em;border-radius:.2em}</style></head><body>` +
+	`<h1>StreamKit web-capture</h1>` +
+	`<p>Render any web page to video. The path is <code>/{output}/[config]/{url}</code> — ` +
+	`the first segment picks the output, then optional config, then the target URL:</p>` +
+	`<ul>` +
+	`<li><strong>Clip</strong> (MP4 file): <code>web.streamkit.dev/clip/example.com</code></li>` +
+	`<li><strong>Clip</strong> with duration: <code>web.streamkit.dev/clip/dur=30s/example.com</code></li>` +
+	`<li><strong>Cast</strong> (live stream): <code>web.streamkit.dev/cast/example.com</code></li>` +
+	`<li><strong>Cast</strong> at a resolution: <code>web.streamkit.dev/cast/res=2560x1440/example.com</code></li>` +
+	`</ul>` +
+	`</body></html>`
+
+func (gw *gateway) handleUsage(w http.ResponseWriter, _ *http.Request) {
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	_, _ = io.WriteString(w, usagePage)
+}
+
+func acceptsHTML(r *http.Request) bool {
+	return strings.Contains(r.Header.Get("Accept"), "text/html")
+}
+
+// hopByHop headers are connection-scoped and must not be forwarded by a proxy
+// (RFC 7230 §6.1); Content-Length is also dropped since Go sets it from the
+// streamed body.
+var hopByHop = map[string]bool{
+	"connection":          true,
+	"keep-alive":          true,
+	"proxy-authenticate":  true,
+	"proxy-authorization": true,
+	"te":                  true,
+	"trailer":             true,
+	"transfer-encoding":   true,
+	"upgrade":             true,
+	"content-length":      true,
+}
+
+func copyHeaders(dst, src http.Header) {
+	// Headers named in the Connection header are connection-scoped too
+	// (RFC 7230 §6.1) and must not be forwarded.
+	connScoped := make(map[string]bool)
+	for _, v := range src["Connection"] {
+		for _, name := range strings.Split(v, ",") {
+			if name = strings.TrimSpace(name); name != "" {
+				connScoped[strings.ToLower(name)] = true
+			}
+		}
+	}
+	for k, vv := range src {
+		lk := strings.ToLower(k)
+		if hopByHop[lk] || connScoped[lk] {
+			continue
+		}
+		for _, v := range vv {
+			dst.Add(k, v)
+		}
+	}
+}
+
+type flushWriter struct {
+	w io.Writer
+	f http.Flusher
+}
+
+func (fw flushWriter) Write(p []byte) (int, error) {
+	n, err := fw.w.Write(p)
+	if fw.f != nil {
+		fw.f.Flush()
+	}
+	return n, err
+}
+
+func logging(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		start := time.Now()
+		next.ServeHTTP(w, r)
+		log.Printf("%s %s remote=%s %s", r.Method, r.RequestURI, r.RemoteAddr, time.Since(start).Truncate(time.Millisecond))
+	})
+}
diff --git a/examples/web-capture/cmd/gateway/proxy_test.go b/examples/web-capture/cmd/gateway/proxy_test.go
new file mode 100644
index 000000000..8975b4d75
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/proxy_test.go
@@ -0,0 +1,35 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+package main
+
+import (
+	"net/http"
+	"testing"
+)
+
+func TestCopyHeadersStripsHopByHopAndConnectionListed(t *testing.T) {
+	src := http.Header{
+		"Content-Type":      {"video/mp4"},
+		"Connection":        {"keep-alive, X-Internal-Token"},
+		"Keep-Alive":        {"timeout=5"},
+		"Transfer-Encoding": {"chunked"},
+		"X-Internal-Token":  {"secret"},
+		"Cache-Control":     {"no-store"},
+	}
+	dst := http.Header{}
+	copyHeaders(dst, src)
+
+	if got := dst.Get("Content-Type"); got != "video/mp4" {
+		t.Errorf("Content-Type = %q, want forwarded", got)
+	}
+	if got := dst.Get("Cache-Control"); got != "no-store" {
+		t.Errorf("Cache-Control = %q, want forwarded", got)
+	}
+	for _, h := range []string{"Connection", "Keep-Alive", "Transfer-Encoding", "X-Internal-Token"} {
+		if v := dst.Get(h); v != "" {
+			t.Errorf("%s = %q, want stripped", h, v)
+		}
+	}
+}
diff --git a/examples/web-capture/cmd/gateway/sessions.go b/examples/web-capture/cmd/gateway/sessions.go
new file mode 100644
index 000000000..6627c74a6
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/sessions.go
@@ -0,0 +1,328 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"net/url"
+	"strings"
+	"sync"
+	"time"
+)
+
+var (
+	errOverCapacity = errors.New("session capacity reached")
+	errShuttingDown = errors.New("gateway shutting down")
+)
+
+// skitClient talks to the skit dynamic-session REST API.
+type skitClient struct {
+	client  *http.Client
+	baseURL string
+	token   string
+}
+
+func (c *skitClient) auth(req *http.Request) {
+	if c.token != "" {
+		req.Header.Set("Authorization", "Bearer "+c.token)
+	}
+}
+
+func (c *skitClient) createSession(ctx context.Context, yaml string) (string, error) {
+	payload, err := json.Marshal(struct {
+		YAML string `json:"yaml"`
+	}{yaml})
+	if err != nil {
+		return "", err
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, c.baseURL+"/api/v1/sessions", bytes.NewReader(payload))
+	if err != nil {
+		return "", err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	c.auth(req)
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusCreated {
+		b, _ := io.ReadAll(io.LimitReader(resp.Body, 2048))
+		return "", fmt.Errorf("create session: status %d: %s", resp.StatusCode, strings.TrimSpace(string(b)))
+	}
+	var out struct {
+		SessionID string `json:"session_id"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
+		return "", fmt.Errorf("decode session response: %w", err)
+	}
+	if out.SessionID == "" {
+		return "", errors.New("empty session_id in response")
+	}
+	return out.SessionID, nil
+}
+
+func (c *skitClient) destroySession(ctx context.Context, id string) error {
+	req, err := http.NewRequestWithContext(ctx, http.MethodDelete, c.baseURL+"/api/v1/sessions/"+url.PathEscape(id), nil)
+	if err != nil {
+		return err
+	}
+	c.auth(req)
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = resp.Body.Close() }()
+	_, _ = io.Copy(io.Discard, io.LimitReader(resp.Body, 4096))
+	// A 404 means the session is already gone — the desired end state.
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusNotFound {
+		return fmt.Errorf("destroy session: status %d", resp.StatusCode)
+	}
+	return nil
+}
+
+func (c *skitClient) streamURL(id string) string {
+	return c.baseURL + "/mse/" + url.PathEscape(id) + "/video"
+}
+
+// liveSession is one running cast pipeline, shared by all viewers of the same
+// normalized URL. ready is closed once creation resolves (id set or createErr).
+type liveSession struct {
+	id         string
+	key        string
+	viewers    int
+	createdAt  time.Time
+	idleSince  time.Time // set when viewers drops to 0; zero while viewers > 0
+	reapReason string
+	ready      chan struct{}
+	createErr  error
+}
+
+// sessionManager owns cast pipeline lifetime. The engine does NOT auto-stop a
+// pipeline when its MSE viewers disconnect, so the gateway must: dedupe by URL,
+// refcount viewers, and reap idle / over-aged sessions via DELETE. The zero
+// value is not usable — construct via newSessionManager.
+type sessionManager struct {
+	mu          sync.Mutex
+	sessions    map[string]*liveSession // key (normalized URL) -> session
+	byID        map[string]*liveSession
+	closed      bool
+	skit        *skitClient
+	maxSessions int
+	maxViewers  int
+	idleTTL     time.Duration
+	maxLifetime time.Duration
+	createTO    time.Duration
+	now         func() time.Time
+}
+
+func newSessionManager(skit *skitClient, maxSessions, maxViewers int, idleTTL, maxLifetime time.Duration) *sessionManager {
+	return &sessionManager{
+		sessions:    make(map[string]*liveSession),
+		byID:        make(map[string]*liveSession),
+		skit:        skit,
+		maxSessions: maxSessions,
+		maxViewers:  maxViewers,
+		idleTTL:     idleTTL,
+		maxLifetime: maxLifetime,
+		createTO:    15 * time.Second,
+		now:         time.Now,
+	}
+}
+
+func (m *sessionManager) updateGaugesLocked() {
+	activeSessions.Set(float64(len(m.sessions)))
+	viewers := 0
+	for _, s := range m.sessions {
+		viewers += s.viewers
+	}
+	activeViewers.Set(float64(viewers))
+}
+
+// acquire returns a ready session for key, creating one (and the skit pipeline)
+// if none exists. The caller must call release exactly once when its viewer
+// connection ends.
+func (m *sessionManager) acquire(ctx context.Context, key string, renderYAML func() string) (*liveSession, error) {
+	m.mu.Lock()
+	if m.closed {
+		m.mu.Unlock()
+		return nil, errShuttingDown
+	}
+	if s := m.sessions[key]; s != nil {
+		if s.viewers >= m.maxViewers {
+			m.mu.Unlock()
+			return nil, errOverCapacity // reject now rather than fail downstream at max_clients
+		}
+		s.viewers++
+		s.idleSince = time.Time{}
+		m.updateGaugesLocked()
+		m.mu.Unlock()
+		select {
+		case <-s.ready:
+			if s.createErr != nil {
+				m.release(s)
+				return nil, s.createErr
+			}
+			return s, nil
+		case <-ctx.Done():
+			m.release(s)
+			return nil, ctx.Err()
+		}
+	}
+	if len(m.sessions) >= m.maxSessions {
+		m.mu.Unlock()
+		return nil, errOverCapacity
+	}
+	s := &liveSession{key: key, viewers: 1, createdAt: m.now(), ready: make(chan struct{})}
+	m.sessions[key] = s
+	m.updateGaugesLocked()
+	m.mu.Unlock()
+
+	// Create on a background context, NOT the first viewer's: if that viewer
+	// disconnects mid-create, the pipeline must still come up for the other
+	// deduped waiters (and createErr must not masquerade as context.Canceled).
+	cctx, cancel := context.WithTimeout(context.Background(), m.createTO)
+	defer cancel()
+	id, err := m.skit.createSession(cctx, renderYAML())
+
+	m.mu.Lock()
+	if err != nil {
+		delete(m.sessions, key)
+		s.createErr = err
+		m.updateGaugesLocked()
+		m.mu.Unlock()
+		close(s.ready)
+		return nil, err
+	}
+	s.id = id
+	// shutdownAll may have run while the create was in flight: it captured s
+	// (it was in m.sessions) and waits on ready to destroy it, so don't register
+	// the id in the fresh byID map or hand a doomed session to the caller.
+	if m.closed {
+		m.mu.Unlock()
+		close(s.ready)
+		return nil, errShuttingDown
+	}
+	m.byID[id] = s
+	m.mu.Unlock()
+	close(s.ready)
+	log.Printf("cast: session %s created (key=%q)", id, key)
+	return s, nil
+}
+
+// isLive reports whether the session is still tracked (not yet reaped or torn
+// down). proxyMSE uses it to tell a transient pre-ready 404 (pipeline still
+// starting) apart from a 404 after the session was reaped mid-stream — e.g. a
+// max-lifetime reap landing just as a deduped late viewer connects.
+func (m *sessionManager) isLive(id string) bool {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	_, ok := m.byID[id]
+	return ok
+}
+
+func (m *sessionManager) release(s *liveSession) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if s.viewers > 0 {
+		s.viewers--
+	}
+	if s.viewers == 0 {
+		s.idleSince = m.now()
+	}
+	m.updateGaugesLocked()
+	log.Printf("cast: viewer left %s (viewers=%d)", s.id, s.viewers)
+}
+
+// reap tears down idle and over-aged sessions.
+func (m *sessionManager) reap(ctx context.Context) {
+	now := m.now()
+	var toDestroy []*liveSession
+
+	m.mu.Lock()
+	for key, s := range m.sessions {
+		if s.id == "" {
+			continue // still being created
+		}
+		switch {
+		case s.viewers == 0 && !s.idleSince.IsZero() && now.Sub(s.idleSince) >= m.idleTTL:
+			s.reapReason = "idle"
+		case now.Sub(s.createdAt) >= m.maxLifetime:
+			s.reapReason = "max_lifetime"
+		default:
+			continue
+		}
+		delete(m.sessions, key)
+		delete(m.byID, s.id)
+		toDestroy = append(toDestroy, s)
+	}
+	m.updateGaugesLocked()
+	m.mu.Unlock()
+
+	for _, s := range toDestroy {
+		m.destroy(ctx, s)
+	}
+}
+
+func (m *sessionManager) destroy(ctx context.Context, s *liveSession) {
+	dctx, cancel := context.WithTimeout(ctx, m.createTO)
+	defer cancel()
+	if err := m.skit.destroySession(dctx, s.id); err != nil {
+		log.Printf("destroy session %s: %v", s.id, err)
+	}
+	sessionsReaped.WithLabelValues(s.reapReason).Inc()
+	sessionLifetime.Observe(m.now().Sub(s.createdAt).Seconds())
+	log.Printf("cast: reaped session %s (reason=%s)", s.id, s.reapReason)
+}
+
+func (m *sessionManager) runReaper(ctx context.Context, interval time.Duration) {
+	t := time.NewTicker(interval)
+	defer t.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+			m.reap(ctx)
+		}
+	}
+}
+
+// shutdownAll destroys every owned session so a deploy/restart never leaks
+// Servo pipelines.
+func (m *sessionManager) shutdownAll(ctx context.Context) {
+	m.mu.Lock()
+	m.closed = true // reject new acquires; in-flight creates self-report via ready
+	all := make([]*liveSession, 0, len(m.sessions))
+	for _, s := range m.sessions {
+		all = append(all, s)
+	}
+	m.sessions = make(map[string]*liveSession)
+	m.byID = make(map[string]*liveSession)
+	m.updateGaugesLocked()
+	m.mu.Unlock()
+
+	for _, s := range all {
+		// Wait for an in-flight creation to resolve so we have an id to DELETE;
+		// tearing down only id-bearing sessions would leak the rest's pipelines.
+		select {
+		case <-s.ready:
+		case <-ctx.Done():
+			return
+		}
+		if s.id != "" && s.createErr == nil {
+			s.reapReason = "shutdown"
+			m.destroy(ctx, s)
+		}
+	}
+}
diff --git a/examples/web-capture/cmd/gateway/sessions_test.go b/examples/web-capture/cmd/gateway/sessions_test.go
new file mode 100644
index 000000000..eb9f636a4
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/sessions_test.go
@@ -0,0 +1,320 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+// mockSkit stands in for the skit dynamic-session API and counts create/destroy.
+type mockSkit struct {
+	mu       sync.Mutex
+	creates  int
+	destroys int
+	live     map[string]bool
+	nextID   int
+}
+
+func newMockSkit() (*mockSkit, *httptest.Server) {
+	ms := &mockSkit{live: map[string]bool{}}
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		ms.mu.Lock()
+		defer ms.mu.Unlock()
+		switch {
+		case r.Method == http.MethodPost && r.URL.Path == "/api/v1/sessions":
+			ms.creates++
+			ms.nextID++
+			id := fmt.Sprintf("sess-%d", ms.nextID)
+			ms.live[id] = true
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = fmt.Fprintf(w, `{"session_id":%q}`, id)
+		case r.Method == http.MethodDelete && strings.HasPrefix(r.URL.Path, "/api/v1/sessions/"):
+			ms.destroys++
+			delete(ms.live, strings.TrimPrefix(r.URL.Path, "/api/v1/sessions/"))
+			w.WriteHeader(http.StatusOK)
+		case r.Method == http.MethodGet && r.URL.Path == "/api/v1/sessions":
+			w.Header().Set("Content-Type", "application/json")
+			parts := make([]string, 0, len(ms.live))
+			for id := range ms.live {
+				parts = append(parts, fmt.Sprintf(`{"id":%q}`, id))
+			}
+			_, _ = fmt.Fprintf(w, "[%s]", strings.Join(parts, ","))
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	return ms, srv
+}
+
+func (ms *mockSkit) counts() (int, int) {
+	ms.mu.Lock()
+	defer ms.mu.Unlock()
+	return ms.creates, ms.destroys
+}
+
+func (ms *mockSkit) liveCount() int {
+	ms.mu.Lock()
+	defer ms.mu.Unlock()
+	return len(ms.live)
+}
+
+type fakeClock struct{ t time.Time }
+
+func (c *fakeClock) now() time.Time          { return c.t }
+func (c *fakeClock) advance(d time.Duration) { c.t = c.t.Add(d) }
+
+func newTestManager(srv *httptest.Server, maxSessions int, idle, maxLife time.Duration) (*sessionManager, *fakeClock) {
+	m := newSessionManager(&skitClient{client: srv.Client(), baseURL: srv.URL}, maxSessions, 100, idle, maxLife)
+	clock := &fakeClock{t: time.Unix(1_000_000, 0)}
+	m.now = clock.now
+	return m, clock
+}
+
+func TestSessionManagerDedupeAndIdleReap(t *testing.T) {
+	ms, srv := newMockSkit()
+	defer srv.Close()
+	m, clock := newTestManager(srv, 4, 30*time.Second, time.Hour)
+	ctx := context.Background()
+
+	s1, err := m.acquire(ctx, "https://a.example", testYAML)
+	if err != nil {
+		t.Fatal(err)
+	}
+	s2, err := m.acquire(ctx, "https://a.example", testYAML)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if s1 != s2 {
+		t.Fatal("expected the same session to be reused for the same URL")
+	}
+	if c, _ := ms.counts(); c != 1 {
+		t.Fatalf("expected 1 create, got %d", c)
+	}
+	if s1.viewers != 2 {
+		t.Fatalf("viewers=%d want 2", s1.viewers)
+	}
+
+	m.release(s1)
+	m.release(s2)
+	if s1.viewers != 0 {
+		t.Fatalf("viewers=%d want 0", s1.viewers)
+	}
+
+	clock.advance(10 * time.Second)
+	m.reap(ctx)
+	if _, d := ms.counts(); d != 0 {
+		t.Fatalf("premature destroy: %d", d)
+	}
+
+	clock.advance(30 * time.Second)
+	m.reap(ctx)
+	if _, d := ms.counts(); d != 1 {
+		t.Fatalf("expected 1 destroy after idle TTL, got %d", d)
+	}
+	if ms.liveCount() != 0 {
+		t.Fatalf("server still has %d sessions", ms.liveCount())
+	}
+}
+
+func TestSessionManagerOverCapacity(t *testing.T) {
+	ms, srv := newMockSkit()
+	defer srv.Close()
+	m, _ := newTestManager(srv, 1, time.Hour, time.Hour)
+	ctx := context.Background()
+
+	if _, err := m.acquire(ctx, "https://a.example", testYAML); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := m.acquire(ctx, "https://b.example", testYAML); !errors.Is(err, errOverCapacity) {
+		t.Fatalf("expected errOverCapacity, got %v", err)
+	}
+	if c, _ := ms.counts(); c != 1 {
+		t.Fatalf("expected exactly 1 create, got %d", c)
+	}
+}
+
+func TestSessionManagerMaxLifetimeReapsActiveViewer(t *testing.T) {
+	ms, srv := newMockSkit()
+	defer srv.Close()
+	m, clock := newTestManager(srv, 4, time.Hour, 10*time.Second)
+	ctx := context.Background()
+
+	// Acquire and keep the viewer (never release): the max-lifetime cap must
+	// still tear the session down.
+	if _, err := m.acquire(ctx, "https://a.example", testYAML); err != nil {
+		t.Fatal(err)
+	}
+	clock.advance(11 * time.Second)
+	m.reap(ctx)
+	if _, d := ms.counts(); d != 1 {
+		t.Fatalf("expected max-lifetime reap, got %d destroys", d)
+	}
+}
+
+func TestSessionManagerMaxViewers(t *testing.T) {
+	_, srv := newMockSkit()
+	defer srv.Close()
+	m := newSessionManager(&skitClient{client: srv.Client(), baseURL: srv.URL}, 4, 2, time.Hour, time.Hour)
+	ctx := context.Background()
+
+	if _, err := m.acquire(ctx, "https://a.example", testYAML); err != nil { // creator (viewers=1)
+		t.Fatal(err)
+	}
+	if _, err := m.acquire(ctx, "https://a.example", testYAML); err != nil { // 2nd viewer (=2)
+		t.Fatalf("2nd viewer: %v", err)
+	}
+	if _, err := m.acquire(ctx, "https://a.example", testYAML); !errors.Is(err, errOverCapacity) {
+		t.Fatalf("3rd viewer: expected errOverCapacity, got %v", err)
+	}
+}
+
+func testYAML() string { return "pipeline: yaml" }
+
+func TestSessionManagerRejectsAfterShutdown(t *testing.T) {
+	_, srv := newMockSkit()
+	defer srv.Close()
+	m := newSessionManager(&skitClient{client: srv.Client(), baseURL: srv.URL}, 4, 10, time.Hour, time.Hour)
+	m.closed = true
+	if _, err := m.acquire(context.Background(), "https://a.example", testYAML); !errors.Is(err, errShuttingDown) {
+		t.Fatalf("expected errShuttingDown, got %v", err)
+	}
+}
+
+// A session whose creation is in flight when shutdownAll runs must still be torn
+// down once creation resolves — otherwise its backend pipeline leaks.
+func TestSessionManagerShutdownDuringCreate(t *testing.T) {
+	release := make(chan struct{})
+	var created, destroyed atomic.Int32
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.Method == http.MethodPost && r.URL.Path == "/api/v1/sessions":
+			<-release // block so the create is in flight when shutdownAll runs
+			created.Add(1)
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = fmt.Fprint(w, `{"session_id":"sess-inflight"}`)
+		case r.Method == http.MethodDelete:
+			destroyed.Add(1)
+			w.WriteHeader(http.StatusOK)
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	defer srv.Close()
+	m := newSessionManager(&skitClient{client: srv.Client(), baseURL: srv.URL}, 4, 10, time.Hour, time.Hour)
+
+	acquireDone := make(chan error, 1)
+	go func() {
+		_, err := m.acquire(context.Background(), "https://a.example", testYAML)
+		acquireDone <- err
+	}()
+
+	// Wait until acquire has reserved the session and is blocked in createSession.
+	deadline := time.Now().Add(2 * time.Second)
+	for {
+		m.mu.Lock()
+		n := len(m.sessions)
+		m.mu.Unlock()
+		if n == 1 {
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatal("acquire never reserved the session")
+		}
+		time.Sleep(time.Millisecond)
+	}
+
+	shutdownDone := make(chan struct{})
+	go func() {
+		m.shutdownAll(context.Background())
+		close(shutdownDone)
+	}()
+
+	close(release) // let creation finish
+	acquireErr := <-acquireDone
+	<-shutdownDone
+
+	if created.Load() != 1 {
+		t.Fatalf("created=%d want 1", created.Load())
+	}
+	if destroyed.Load() != 1 {
+		t.Fatalf("in-flight session not torn down on shutdown: destroyed=%d", destroyed.Load())
+	}
+	// The creator must not be handed the doomed session, and its id must not be
+	// re-registered in the byID map that shutdownAll just reset.
+	if !errors.Is(acquireErr, errShuttingDown) {
+		t.Fatalf("acquire during shutdown: got %v, want errShuttingDown", acquireErr)
+	}
+	if m.isLive("sess-inflight") {
+		t.Fatal("destroyed in-flight session still registered in byID")
+	}
+}
+
+// A session reaped while a deduped late viewer is still waiting in proxyMSE's
+// readiness loop must fail fast (the post-teardown 404 is otherwise
+// indistinguishable from a pre-ready 404, so the loop would spin the full
+// mseReadyTimeout and return a misleading 502).
+func TestProxyMSEFailsFastWhenSessionReaped(t *testing.T) {
+	// Upstream always 404s (as it would for both a not-yet-ready and a
+	// torn-down session).
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusNotFound)
+	}))
+	defer srv.Close()
+
+	m := newSessionManager(&skitClient{client: srv.Client(), baseURL: srv.URL}, 4, 10, time.Hour, time.Hour)
+	gw := &gateway{
+		streamClient:    srv.Client(),
+		skit:            &skitClient{client: srv.Client(), baseURL: srv.URL},
+		sessions:        m,
+		mseReadyTimeout: 30 * time.Second, // long: the test must return well before this
+	}
+	// A session the manager no longer tracks (reaped) — isLive(id) is false.
+	s := &liveSession{id: "sess-reaped", ready: make(chan struct{})}
+	close(s.ready)
+
+	r := httptest.NewRequest(http.MethodGet, "/cast/example.com", nil)
+	w := httptest.NewRecorder()
+
+	start := time.Now()
+	gw.proxyMSE(w, r, s)
+	elapsed := time.Since(start)
+
+	if w.Code != http.StatusServiceUnavailable {
+		t.Fatalf("status = %d, want 503", w.Code)
+	}
+	if elapsed > 5*time.Second {
+		t.Fatalf("proxyMSE spun for %v; expected fast fail well under mseReadyTimeout", elapsed)
+	}
+}
+
+func TestSessionManagerShutdownAll(t *testing.T) {
+	ms, srv := newMockSkit()
+	defer srv.Close()
+	m, _ := newTestManager(srv, 4, time.Hour, time.Hour)
+	ctx := context.Background()
+
+	if _, err := m.acquire(ctx, "https://a.example", testYAML); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := m.acquire(ctx, "https://b.example", testYAML); err != nil {
+		t.Fatal(err)
+	}
+	m.shutdownAll(ctx)
+	if _, d := ms.counts(); d != 2 {
+		t.Fatalf("expected 2 destroys, got %d", d)
+	}
+	if ms.liveCount() != 0 {
+		t.Fatalf("server still has %d sessions", ms.liveCount())
+	}
+}
diff --git a/examples/web-capture/go.mod b/examples/web-capture/go.mod
new file mode 100644
index 000000000..b04cd4828
--- /dev/null
+++ b/examples/web-capture/go.mod
@@ -0,0 +1,18 @@
+module github.com/streamer45/streamkit/examples/web-capture
+
+go 1.24
+
+require github.com/prometheus/client_golang v1.23.2
+
+require (
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/kr/text v0.2.0 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.66.1 // indirect
+	github.com/prometheus/procfs v0.16.1 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	golang.org/x/sys v0.35.0 // indirect
+	google.golang.org/protobuf v1.36.8 // indirect
+)
diff --git a/examples/web-capture/go.sum b/examples/web-capture/go.sum
new file mode 100644
index 000000000..d6b8ca98b
--- /dev/null
+++ b/examples/web-capture/go.sum
@@ -0,0 +1,46 @@
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
+github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
+github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
+github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
+github.com/prometheus/common v0.66.1 h1:h5E0h5/Y8niHc5DlaLlWLArTQI7tMrsfQjHV+d9ZoGs=
+github.com/prometheus/common v0.66.1/go.mod h1:gcaUsgf3KfRSwHY4dIMXLPV0K/Wg1oZ8+SbZk/HH/dA=
+github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg=
+github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is=
+github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
+github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
+golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
+google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/marketplace/official-plugins.json b/marketplace/official-plugins.json
index 9cb41007f..b0474e94f 100644
--- a/marketplace/official-plugins.json
+++ b/marketplace/official-plugins.json
@@ -304,7 +304,7 @@
     {
       "id": "servo",
       "name": "Servo Web Renderer",
-      "version": "0.1.0",
+      "version": "0.1.1",
       "node_kind": "servo",
       "kind": "native",
       "entrypoint": "libservo_web.so",
diff --git a/plugins/native/servo/Cargo.lock b/plugins/native/servo/Cargo.lock
index 74257d8d1..2aa9b715e 100644
--- a/plugins/native/servo/Cargo.lock
+++ b/plugins/native/servo/Cargo.lock
@@ -6458,11 +6458,12 @@ dependencies = [
 
 [[package]]
 name = "servo-plugin-native"
-version = "0.1.0"
+version = "0.1.1"
 dependencies = [
  "dpi",
  "euclid",
  "image",
+ "libc",
  "serde",
  "serde_json",
  "servo",
diff --git a/plugins/native/servo/Cargo.toml b/plugins/native/servo/Cargo.toml
index 3dbb90b47..adaf9c84f 100644
--- a/plugins/native/servo/Cargo.toml
+++ b/plugins/native/servo/Cargo.toml
@@ -4,13 +4,16 @@
 
 [package]
 name = "servo-plugin-native"
-version = "0.1.0"
+version = "0.1.1"
 edition = "2021"
 license = "MPL-2.0"
 
 [lib]
 name = "servo_web"
-crate-type = ["cdylib"]
+# `rlib` (in addition to the `cdylib` the host loads) lets the
+# integration test in `tests/` link the crate and exercise the real
+# Servo engine through the public `send_work` API.
+crate-type = ["cdylib", "rlib"]
 
 [dependencies]
 streamkit-plugin-sdk-native = { path = "../../../sdks/plugin-sdk/native" }
@@ -33,6 +36,13 @@ tracing = "0.1"
 # dlopen-safe global-dynamic TLS model.
 tikv-jemalloc-sys = { version = "0.6", features = ["disable_initial_exec_tls"] }
 
+[dev-dependencies]
+# The cross-session leak integration test drives the real Servo engine,
+# which has no clean global-shutdown path: at process exit mozjs' C++
+# destructors race the still-live renderer thread and SIGSEGV.  The test
+# calls `libc::_exit` after asserting to bypass that teardown.
+libc = "0.2"
+
 [lints.clippy]
 # Categories
 pedantic = { level = "warn", priority = -1 }
diff --git a/plugins/native/servo/plugin.yml b/plugins/native/servo/plugin.yml
index fa8be2898..89057d2d9 100644
--- a/plugins/native/servo/plugin.yml
+++ b/plugins/native/servo/plugin.yml
@@ -4,7 +4,7 @@
 
 id: servo
 name: Servo Web Renderer
-version: 0.1.0
+version: 0.1.1
 node_kind: servo
 kind: native
 entrypoint: libservo_web.so
diff --git a/plugins/native/servo/src/lib.rs b/plugins/native/servo/src/lib.rs
index fbe18fccc..b4cdb0daa 100644
--- a/plugins/native/servo/src/lib.rs
+++ b/plugins/native/servo/src/lib.rs
@@ -10,3 +10,13 @@ use servo_node::ServoSourcePlugin;
 use streamkit_plugin_sdk_native::{native_source_plugin_entry, NativeSourceNode};
 
 native_source_plugin_entry!(ServoSourcePlugin);
+
+/// Internal surface re-exported solely for this crate's integration tests.
+///
+/// This crate ships as a `cdylib` host plugin and has no stable Rust API;
+/// nothing here is part of a public contract and it may change at any time.
+#[doc(hidden)]
+pub mod test_api {
+    pub use crate::config::ServoConfig;
+    pub use crate::servo_thread::{send_work, NodeId, ServoThreadResult, ServoWorkItem};
+}
diff --git a/plugins/native/servo/src/servo_thread.rs b/plugins/native/servo/src/servo_thread.rs
index 699517e1a..8b488d23b 100644
--- a/plugins/native/servo/src/servo_thread.rs
+++ b/plugins/native/servo/src/servo_thread.rs
@@ -132,9 +132,17 @@ pub fn send_work(item: ServoWorkItem) -> Result<(), String> {
 /// `loaded` is read by `handle_render`'s post-load gate to fire one-shot
 /// post-load actions (custom CSS injection) on the first tick after the
 /// page reaches `LoadStatus::Complete`.
+///
+/// `painted` gates surface reads: surfman reuses the underlying
+/// `SoftwareRenderingContext` surface across instances, so before Servo
+/// has painted the current page at least once the surface may still hold
+/// a previous (unrelated) capture's pixels.  Until the first paint,
+/// `handle_render` emits a fully transparent frame rather than leaking
+/// stale pixels.  Reset on URL change in `handle_update_config`.
 #[derive(Default)]
 struct FrameDelegate {
     loaded: Cell<bool>,
+    painted: Cell<bool>,
 }
 
 impl WebViewDelegate for FrameDelegate {
@@ -151,6 +159,7 @@ impl WebViewDelegate for FrameDelegate {
 
     fn notify_new_frame_ready(&self, webview: WebView) {
         webview.paint();
+        self.painted.set(true);
     }
 }
 
@@ -364,18 +373,22 @@ fn panic_message(payload: &Box<dyn std::any::Any + Send>) -> String {
         .unwrap_or_else(|| "unknown panic".to_string())
 }
 
+/// A fully transparent RGBA8 frame at the given output dimensions, used until
+/// the page first paints, on a `read_to_image` miss with no cached frame, and
+/// as the post-panic fallback.
+fn transparent_frame(width: u32, height: u32) -> Vec<u8> {
+    vec![0u8; (width as usize) * (height as usize) * 4]
+}
+
 /// Send a fallback frame (last good frame or transparent) after a panic.
 fn send_fallback_frame(instances: &HashMap<NodeId, InstanceState>, node_id: &NodeId) {
     let Some(state) = instances.get(node_id) else {
         return;
     };
-    let fallback = state.last_good_frame.as_ref().map_or_else(
-        || {
-            let len = (state.config.width as usize) * (state.config.height as usize) * 4;
-            vec![0u8; len]
-        },
-        Clone::clone,
-    );
+    let fallback = state
+        .last_good_frame
+        .clone()
+        .unwrap_or_else(|| transparent_frame(state.config.width, state.config.height));
     let _ = state.result_tx.send(ServoThreadResult::Frame { rgba_data: fallback });
 }
 
@@ -470,6 +483,11 @@ fn handle_render(
 
     let render_start = Instant::now();
 
+    // Bind this instance's context before pumping so its own paint targets
+    // its own surface.  `SoftwareRenderingContext`/surfman share GL state
+    // process-wide, so the read below additionally re-binds (see there).
+    let _ = state.rendering_context.make_current();
+
     // Pump the event loop to let Servo process pending work — this is
     // also what advances the deferred page load registered in
     // `handle_register`.
@@ -490,10 +508,46 @@ fn handle_render(
         );
     }
 
-    // Always read the full rendering context (rc_width × rc_height) —
-    // this is the native size Servo is currently rendering at.  These
-    // stay constant under `Resize` hints (output-only) but are updated
-    // under `UpdateConfig` when the viewport resolution changes.
+    let rgba_data = if state.delegate.painted.get() {
+        read_painted_frame(state, node_id)
+    } else {
+        // Until Servo has painted the current page at least once, the surfman
+        // surface backing this rendering context may still contain a previous,
+        // unrelated capture's pixels (surfman reuses surfaces across contexts).
+        // Emit a fully transparent frame instead of reading stale content, so a
+        // freshly-opened clip/cast never leaks another session's page.
+        transparent_frame(state.config.width, state.config.height)
+    };
+
+    let render_duration = render_start.elapsed();
+    state.render_count += 1;
+    state.render_duration_sum += render_duration;
+
+    // Log render time periodically (every 300 frames ~ 10s at 30fps).
+    if state.render_count % 300 == 0 {
+        let avg_us = state.render_duration_sum.as_micros() / u128::from(state.render_count);
+        tracing::debug!(
+            node_id = %node_id,
+            frame = state.render_count,
+            render_us = render_duration.as_micros(),
+            avg_render_us = avg_us,
+            "Servo render metrics",
+        );
+    }
+
+    if state.result_tx.send(ServoThreadResult::Frame { rgba_data }).is_err() {
+        instances.remove(node_id);
+    }
+}
+
+/// Read this instance's painted surface into an RGBA8 frame, scaling to the
+/// output size and falling back to the cached frame (or transparent) on a miss.
+/// Caller must have already confirmed the page has painted at least once.
+fn read_painted_frame(state: &mut InstanceState, node_id: &NodeId) -> Vec<u8> {
+    // Always read the full rendering context (rc_width × rc_height) — the
+    // native size Servo is currently rendering at. These stay constant under
+    // `Resize` hints (output-only) but are updated under `UpdateConfig` when
+    // the viewport resolution changes.
     let rect = Box2D::new(
         Point2D::new(0, 0),
         Point2D::new(
@@ -502,11 +556,23 @@ fn handle_render(
         ),
     );
 
-    // Scale when the rendering context size differs from the output.
     let needs_scaling =
         state.rc_width != state.config.width || state.rc_height != state.config.height;
 
-    let rgba_data = if let Some(img) = state.rendering_context.read_to_image(rect) {
+    // `read_to_image` reads whichever surfman context is currently bound
+    // process-wide. `spin_event_loop` paints every webview and leaves the
+    // last-painted instance's context current, so re-bind ours immediately
+    // before the read to capture this instance's surface and never a concurrent
+    // node's (the cross-session pixel leak). A bind failure means the read may
+    // return another instance's pixels, so surface it rather than silently leak.
+    if let Err(e) = state.rendering_context.make_current() {
+        tracing::warn!(
+            node_id = %node_id,
+            error = ?e,
+            "make_current before read_to_image failed; frame may not be this instance's surface",
+        );
+    }
+    if let Some(img) = state.rendering_context.read_to_image(rect) {
         let raw = if needs_scaling {
             let scaled = image::imageops::resize(
                 &img,
@@ -531,29 +597,7 @@ fn handle_render(
         tracing::debug!(node_id = %node_id, "read_to_image returned None, using cached frame");
         cached.clone()
     } else {
-        // No cached frame — send transparent at output resolution.
-        let len = (state.config.width as usize) * (state.config.height as usize) * 4;
-        vec![0u8; len]
-    };
-
-    let render_duration = render_start.elapsed();
-    state.render_count += 1;
-    state.render_duration_sum += render_duration;
-
-    // Log render time periodically (every 300 frames ~ 10s at 30fps).
-    if state.render_count % 300 == 0 {
-        let avg_us = state.render_duration_sum.as_micros() / u128::from(state.render_count);
-        tracing::debug!(
-            node_id = %node_id,
-            frame = state.render_count,
-            render_us = render_duration.as_micros(),
-            avg_render_us = avg_us,
-            "Servo render metrics",
-        );
-    }
-
-    if state.result_tx.send(ServoThreadResult::Frame { rgba_data }).is_err() {
-        instances.remove(node_id);
+        transparent_frame(state.config.width, state.config.height)
     }
 }
 
@@ -575,6 +619,13 @@ fn handle_update_config(
         if let Ok(parsed) = url::Url::parse(&new_config.url) {
             state.webview.load(parsed);
             state.delegate.loaded.set(false);
+            // Re-arm the first-paint gate so `handle_render` emits
+            // transparent frames until the new page paints, preventing the
+            // outgoing page's pixels from bleeding into the new capture.
+            state.delegate.painted.set(false);
+            // Drop the cached frame so a `read_to_image` miss after the new
+            // page paints can't fall back to the previous URL's last frame.
+            state.last_good_frame = None;
             // Reset the one-shot post-load gate so the new page gets
             // its custom-CSS injection (if any) once it finishes
             // loading.  Render ticks will run `handle_render`'s
@@ -615,6 +666,10 @@ fn handle_update_config(
             state.rc_width = vw;
             state.rc_height = vh;
             state.last_good_frame = None;
+            // Re-arm the first-paint gate: resizing reallocates the
+            // surfman surface, which is pooled across instances and may
+            // hold a neighbour's pixels until the resized page repaints.
+            state.delegate.painted.set(false);
             servo.spin_event_loop();
         }
     }
diff --git a/plugins/native/servo/tests/cross_session_leak.rs b/plugins/native/servo/tests/cross_session_leak.rs
new file mode 100644
index 000000000..ae0bde897
--- /dev/null
+++ b/plugins/native/servo/tests/cross_session_leak.rs
@@ -0,0 +1,124 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+//! Regression test for the cross-session pixel leak.
+//!
+//! Two concurrent Servo instances render solid-colour `data:` pages; no
+//! frame from one instance may ever contain the other's pixels.  Before
+//! the first-paint gate in `handle_render`, the surfman surface reused
+//! across instances meant a freshly-opened capture could emit a previous,
+//! unrelated page's pixels.
+//!
+//! This lives in its own integration binary because it boots the real
+//! Servo engine (software-rendered via llvmpipe — no GPU/display needed)
+//! and is far too heavy for the workspace `cargo test`.
+
+use std::io::Write;
+use std::sync::mpsc::Receiver;
+use std::time::Duration;
+
+use servo_web::test_api::{send_work, NodeId, ServoConfig, ServoThreadResult, ServoWorkItem};
+
+const DIM: u32 = 64;
+/// Per-instance tick budget — generous so the `data:` pages reach first
+/// paint even on a slow/loaded CI box.  Each tick advances the shared
+/// event loop once.
+const MAX_TICKS: usize = 400;
+
+fn send(item: ServoWorkItem) {
+    if let Err(e) = send_work(item) {
+        panic!("send_work failed: {e}");
+    }
+}
+
+fn register(url: &str) -> (NodeId, Receiver<ServoThreadResult>) {
+    let node_id = uuid::Uuid::new_v4();
+    let (tx, rx) = std::sync::mpsc::sync_channel(2);
+    let config =
+        ServoConfig { url: url.to_string(), width: DIM, height: DIM, ..ServoConfig::default() };
+    send(ServoWorkItem::Register { node_id, config, result_tx: tx });
+    match rx.recv() {
+        Ok(ServoThreadResult::InitOk) => {},
+        Ok(ServoThreadResult::InitErr(e)) => panic!("init failed: {e}"),
+        Ok(ServoThreadResult::Frame { .. }) => panic!("unexpected frame during init"),
+        Err(e) => panic!("init recv failed: {e}"),
+    }
+    (node_id, rx)
+}
+
+fn render(node_id: NodeId, rx: &Receiver<ServoThreadResult>) -> Vec<u8> {
+    send(ServoWorkItem::Render { node_id });
+    match rx.recv() {
+        Ok(ServoThreadResult::Frame { rgba_data }) => rgba_data,
+        Ok(_) => panic!("expected frame result"),
+        Err(e) => panic!("frame recv failed: {e}"),
+    }
+}
+
+/// Count opaque pixels that are predominantly red and predominantly blue.
+fn count_red_blue(frame: &[u8]) -> (usize, usize) {
+    let (mut red, mut blue) = (0usize, 0usize);
+    for px in frame.chunks_exact(4) {
+        let (r, g, b, a) = (px[0], px[1], px[2], px[3]);
+        if a < 128 {
+            continue;
+        }
+        if r > 200 && g < 80 && b < 80 {
+            red += 1;
+        } else if b > 200 && r < 80 && g < 80 {
+            blue += 1;
+        }
+    }
+    (red, blue)
+}
+
+#[test]
+fn no_cross_session_pixel_leak() {
+    let red_url = "data:text/html,<style>html,body{margin:0;height:100%;background:red}</style>";
+    let blue_url = "data:text/html,<style>html,body{margin:0;height:100%;background:blue}</style>";
+
+    let (red_id, red_rx) = register(red_url);
+    let (blue_id, blue_rx) = register(blue_url);
+
+    let mut red_saw_own = false;
+    let mut blue_saw_own = false;
+
+    for _ in 0..MAX_TICKS {
+        let rf = render(red_id, &red_rx);
+        let bf = render(blue_id, &blue_rx);
+
+        let (rr, rb) = count_red_blue(&rf);
+        let (br, bb) = count_red_blue(&bf);
+
+        assert_eq!(rb, 0, "red instance leaked blue pixels");
+        assert_eq!(br, 0, "blue instance leaked red pixels");
+
+        red_saw_own |= rr > 0;
+        blue_saw_own |= bb > 0;
+        if red_saw_own && blue_saw_own {
+            break;
+        }
+        std::thread::sleep(Duration::from_millis(5));
+    }
+
+    send(ServoWorkItem::Unregister { node_id: red_id });
+    send(ServoWorkItem::Unregister { node_id: blue_id });
+
+    // Otherwise the no-leak assertions above would be vacuous.
+    assert!(red_saw_own, "red instance never painted its own page");
+    assert!(blue_saw_own, "blue instance never painted its own page");
+
+    // Servo's embedded engine has no clean global-shutdown path: at normal
+    // process exit, mozjs' C++ static destructors race the still-live
+    // renderer thread and abort with a SIGSEGV, which would fail this
+    // otherwise-passing test.  This is the only test in this binary, so
+    // exiting here — after all assertions have held — is safe and bypasses
+    // that teardown entirely.
+    println!("no_cross_session_pixel_leak: PASSED");
+    let _ = std::io::stdout().flush();
+    // SAFETY: `_exit` is async-signal-safe and simply terminates the
+    // process with status 0 without running atexit handlers or C++ static
+    // destructors (the source of the teardown SIGSEGV above).
+    unsafe { libc::_exit(0) };
+}