From b0489fee3a869aafa10b8a709fb894dd65c0121e Mon Sep 17 00:00:00 2001
From: streamer45 <cstcld91@gmail.com>
Date: Sat, 27 Jun 2026 12:49:20 +0200
Subject: [PATCH 01/26] feat(examples): add web-capture gateway
 (clip/cast.streamkit.dev)

A thin Go gateway, mirroring examples/speech-gateway, that renders any web
page to video via the Servo plugin: clip.* returns a finite MP4 (oneshot),
cast.* serves a live WebM stream (dynamic session). The target URL is the
verbatim path suffix, with an optional comma-separated options segment
(dur=, vp=) and strong 720p30 defaults.

Worth a reviewer's attention:
- cast owns session lifetime (the engine does not auto-stop a pipeline when
  its MSE viewers disconnect): one shared session per URL+viewport, viewer
  refcount, idle + max-lifetime reaper, and graceful-shutdown teardown. The
  MSE proxy closes the upstream body on client disconnect so a read parked
  between frames can't keep the viewer count pinned.
- SSRF guard (public/URL-only): blocks loopback/private/link-local/CGNAT/
  cloud-metadata targets.
- Encoders are swappable profiles, software by default (runs GPU-free),
  hardware opt-in via --clip-encoder/--cast-encoder.
- Prometheus metrics incl. active sessions/viewers and reap counters.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: streamer45 <cstcld91@gmail.com>
---
 examples/web-capture/.gitignore               |   1 +
 examples/web-capture/.golangci.yml            |  26 ++
 examples/web-capture/Dockerfile               |  13 +
 examples/web-capture/Makefile                 |  20 ++
 examples/web-capture/README.md                | 124 +++++++
 examples/web-capture/cmd/gateway/capture.go   | 247 +++++++++++++
 .../web-capture/cmd/gateway/capture_test.go   | 133 +++++++
 examples/web-capture/cmd/gateway/encoders.go  |  95 +++++
 .../web-capture/cmd/gateway/encoders_test.go  |  64 ++++
 examples/web-capture/cmd/gateway/main.go      | 327 +++++++++++++++++
 examples/web-capture/cmd/gateway/metrics.go   | 172 +++++++++
 .../web-capture/cmd/gateway/metrics_test.go   |  44 +++
 examples/web-capture/cmd/gateway/pipelines.go | 140 ++++++++
 .../web-capture/cmd/gateway/pipelines_test.go |  71 ++++
 examples/web-capture/cmd/gateway/proxy.go     | 264 ++++++++++++++
 examples/web-capture/cmd/gateway/sessions.go  | 338 ++++++++++++++++++
 .../web-capture/cmd/gateway/sessions_test.go  | 183 ++++++++++
 examples/web-capture/go.mod                   |  18 +
 examples/web-capture/go.sum                   |  46 +++
 19 files changed, 2326 insertions(+)
 create mode 100644 examples/web-capture/.gitignore
 create mode 100644 examples/web-capture/.golangci.yml
 create mode 100644 examples/web-capture/Dockerfile
 create mode 100644 examples/web-capture/Makefile
 create mode 100644 examples/web-capture/README.md
 create mode 100644 examples/web-capture/cmd/gateway/capture.go
 create mode 100644 examples/web-capture/cmd/gateway/capture_test.go
 create mode 100644 examples/web-capture/cmd/gateway/encoders.go
 create mode 100644 examples/web-capture/cmd/gateway/encoders_test.go
 create mode 100644 examples/web-capture/cmd/gateway/main.go
 create mode 100644 examples/web-capture/cmd/gateway/metrics.go
 create mode 100644 examples/web-capture/cmd/gateway/metrics_test.go
 create mode 100644 examples/web-capture/cmd/gateway/pipelines.go
 create mode 100644 examples/web-capture/cmd/gateway/pipelines_test.go
 create mode 100644 examples/web-capture/cmd/gateway/proxy.go
 create mode 100644 examples/web-capture/cmd/gateway/sessions.go
 create mode 100644 examples/web-capture/cmd/gateway/sessions_test.go
 create mode 100644 examples/web-capture/go.mod
 create mode 100644 examples/web-capture/go.sum

diff --git a/examples/web-capture/.gitignore b/examples/web-capture/.gitignore
new file mode 100644
index 000000000..9064eb2e2
--- /dev/null
+++ b/examples/web-capture/.gitignore
@@ -0,0 +1 @@
+/gateway
diff --git a/examples/web-capture/.golangci.yml b/examples/web-capture/.golangci.yml
new file mode 100644
index 000000000..e4ee18ab0
--- /dev/null
+++ b/examples/web-capture/.golangci.yml
@@ -0,0 +1,26 @@
+version: "2"
+linters:
+  default: none
+  enable:
+    - bidichk
+    - errcheck
+    - govet
+    - ineffassign
+    - makezero
+    - misspell
+    - revive
+    - staticcheck
+    - unconvert
+    - unqueryvet
+    - unused
+    - whitespace
+  settings:
+    govet:
+      disable:
+        - fieldalignment
+      enable-all: true
+    unqueryvet:
+      check-sql-builders: true
+issues:
+  max-issues-per-linter: 0 # no maximum
+  max-same-issues: 0 # no maximum
diff --git a/examples/web-capture/Dockerfile b/examples/web-capture/Dockerfile
new file mode 100644
index 000000000..8c86de183
--- /dev/null
+++ b/examples/web-capture/Dockerfile
@@ -0,0 +1,13 @@
+# SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+#
+# SPDX-License-Identifier: MPL-2.0
+
+FROM golang:1.24-bookworm AS build
+WORKDIR /src
+COPY . .
+RUN CGO_ENABLED=0 go build -o /gateway ./cmd/gateway
+
+FROM gcr.io/distroless/static-debian12
+COPY --from=build /gateway /gateway
+EXPOSE 8080
+ENTRYPOINT ["/gateway"]
diff --git a/examples/web-capture/Makefile b/examples/web-capture/Makefile
new file mode 100644
index 000000000..e0e112efb
--- /dev/null
+++ b/examples/web-capture/Makefile
@@ -0,0 +1,20 @@
+# SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+#
+# SPDX-License-Identifier: MPL-2.0
+
+.PHONY: build lint test run clean
+
+build:
+	go build -o gateway ./cmd/gateway
+
+lint:
+	golangci-lint run
+
+test:
+	go test ./...
+
+run:
+	go run ./cmd/gateway
+
+clean:
+	rm -f gateway
diff --git a/examples/web-capture/README.md b/examples/web-capture/README.md
new file mode 100644
index 000000000..414bddc9e
--- /dev/null
+++ b/examples/web-capture/README.md
@@ -0,0 +1,124 @@
+<!--
+SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+
+SPDX-License-Identifier: MPL-2.0
+-->
+
+# Web Capture Gateway
+
+Render any web page to video through a StreamKit backend. Paste a target URL straight onto the gateway host — no flags, no JSON:
+
+- **clip** — a finite MP4 file (oneshot pipeline): `clip.streamkit.dev/example.com`
+- **cast** — a live WebM stream (dynamic session): `cast.streamkit.dev/example.com`
+
+The page is rendered by the [Servo](../../plugins/native/servo) browser engine on the backend. The gateway turns a pasteable URL into the multipart oneshot / dynamic-session calls the backend expects and, for `cast`, owns the session lifetime so abandoned streams are torn down instead of leaking a renderer.
+
+## URL shape
+
+```
+{host}/[options/]{target-url}
+```
+
+The target URL is taken **verbatim** as the path suffix (scheme optional, `https` assumed), so its own query string just rides along — no percent-encoding:
+
+```
+clip.streamkit.dev/grafana.example/d/abc?panel=3&from=now-6h
+```
+
+Options are an optional comma-separated `key=value` **first segment**:
+
+```
+clip.streamkit.dev/dur=30s/example.com                # clip length (default 10s, capped at 60s)
+cast.streamkit.dev/res=2560x1440/example.com          # capture resolution (default 1920x1080)
+clip.streamkit.dev/res=1280x720,dur=15s/example.com   # combine, comma-separated
+```
+
+`dur` is `clip`-only; `res` (the capture resolution) applies to both modes.
+
+Locally there are no subdomains, so select the mode with a path prefix instead:
+
+```
+http://127.0.0.1:8080/clip/dur=5s/example.com
+http://127.0.0.1:8080/cast/example.com
+```
+
+The same URL serves a browser and a player/script: an address-bar visit (`Accept: text/html`) to a `cast` URL returns a tiny autoplay page; anything else (a `<video src>`, `curl`, `ffplay`) gets the raw stream/file.
+
+## Formats & browser support
+
+| Mode | Format | Plays in |
+|------|--------|----------|
+| `clip` | MP4 / H.264, fragmented (plays inline as it renders) | Everywhere, including Safari/iOS |
+| `cast` | WebM / VP9 (the only container the MSE transport emits) | Chromium & Firefox — **Safari/iOS may not play the live stream** |
+
+Universal live playback would require the backend's `transport::http::mse` node to emit fragmented MP4; that's a possible follow-up, not part of v1.
+
+## Prereqs
+
+- A StreamKit server with the **Servo plugin** built and loaded:
+  `just build-plugin-native-servo && just copy-plugins-native`.
+- The gateway's token/role must be allowed to **create and destroy sessions** and to use the `plugin::native::servo` node.
+- Go 1.24+.
+
+## Run
+
+```sh
+cd examples/web-capture
+go run ./cmd/gateway --listen :8080 --skit-url http://127.0.0.1:4545
+
+# clip → MP4 (plays inline in a browser; -o saves it)
+curl -L 'http://127.0.0.1:8080/clip/dur=5s/example.com' -o clip.mp4
+
+# cast → open in a browser to watch live
+xdg-open 'http://127.0.0.1:8080/cast/example.com'
+```
+
+### Configuration
+
+| Env | Flag | Default | Purpose |
+|-----|------|---------|---------|
+| `GATEWAY_LISTEN` | `--listen` | `:8080` | Listen address |
+| `SKIT_URL` | `--skit-url` | `http://127.0.0.1:4545` | Backend URL |
+| `SKIT_TOKEN` | `--token` | — | Bearer token sent to the backend |
+| `GATEWAY_MAX_CONCURRENCY` | `--max-concurrency` | 4 | Max concurrent clip renders |
+| `GATEWAY_CLIP_DEFAULT_SECS` | `--clip-default-secs` | 10 | Default clip duration |
+| `GATEWAY_CLIP_MAX_SECS` | `--clip-max-secs` | 60 | Maximum clip duration |
+| `GATEWAY_MAX_SESSIONS` | `--max-sessions` | 8 | Max concurrent live cast sessions |
+| `GATEWAY_MAX_VIEWERS` | `--max-viewers` | 10 | Max viewers per cast stream |
+| `GATEWAY_SESSION_IDLE_SECS` | `--session-idle-secs` | 45 | Idle grace before a viewerless session is reaped |
+| `GATEWAY_SESSION_MAX_SECS` | `--session-max-secs` | 1800 | Hard cap on a session's lifetime |
+| `GATEWAY_RESOLUTION` | `--resolution` | `1920x1080` | Capture resolution WxH (render = encode, 1:1) |
+| `GATEWAY_CLIP_BITRATE_KBPS` | `--clip-bitrate-kbps` | `10000` | Clip video bitrate (kbps) |
+| `GATEWAY_CAST_BITRATE_KBPS` | `--cast-bitrate-kbps` | `6000` | Cast video bitrate (kbps) |
+| `GATEWAY_CLIP_ENCODER` | `--clip-encoder` | `h264-sw` | `h264-sw`, or `h264-hw` (Vulkan Video) |
+| `GATEWAY_CAST_ENCODER` | `--cast-encoder` | `vp9-sw` | `vp9-sw`, `av1-sw` (SVT-AV1), or `av1-hw` (NVENC) |
+
+Capture runs at **1080p30** by default: the page renders **and** encodes at the same resolution (1:1, no downscale), so text stays crisp and the page gets a real desktop layout. Drop to `res=1280x720` for less bandwidth or raise to `res=2560x1440` for more detail (capped at 4K); frame rate is fixed at 30.
+
+### Encoders
+
+Software encoders are the default, so the gateway runs anywhere with no GPU — ideal for local dev. Hardware is opt-in per mode:
+
+| Profile | Encoder | Notes |
+|---|---|---|
+| `h264-sw` | OpenH264 | clip default; universal |
+| `h264-hw` | Vulkan Video H.264 | NVIDIA/AMD/Intel (NVENC exposes no H.264) |
+| `vp9-sw` | libvpx VP9 | cast default |
+| `av1-sw` | SVT-AV1 | software AV1 — exercise the AV1 path without a GPU |
+| `av1-hw` | NVENC AV1 | NVIDIA; crisper than VP9 for cast |
+
+Clips stay H.264 so they play everywhere; cast AV1 plays in Chromium/Firefox (the same browsers that already handle the WebM stream). Hardware profiles require the matching runtime in the **backend** (Vulkan for `h264-hw`, CUDA + NVENC for `av1-hw`) — the gateway only selects the node, so a missing runtime surfaces as a backend pipeline error, not a gateway one.
+
+## Lifetime & teardown (cast)
+
+The engine does **not** stop a pipeline when its MSE viewers disconnect, and has no idle reaper — so lifetime is the gateway's job. It keeps **one session per normalized URL** (viewers of the same page share one renderer), refcounts viewers across the streaming proxy, and a background reaper tears down sessions that have been **idle** past the grace window or have exceeded their **max lifetime** (via `DELETE /api/v1/sessions/{id}`, which fully drops the pipeline). On `SIGTERM` it drains and destroys every owned session, so a redeploy never leaks renderers.
+
+## Metrics
+
+Prometheus metrics at `GET /metrics` (not gated by the concurrency limit). Beyond the per-endpoint request/latency/rejection series (`endpoint` is `clip` or `cast`), `cast` adds `webcapture_active_sessions`, `webcapture_active_viewers`, `webcapture_session_lifetime_seconds`, and `webcapture_sessions_reaped_total{reason}`. A public instance may keep `/metrics` inside its trust boundary rather than exposing it.
+
+## Limitations
+
+- **Public / URL-only.** Targets that resolve to loopback/private/link-local/CGNAT/cloud-metadata addresses are rejected (SSRF guard). Auth-gated pages (cookies/headers) are intentionally out of scope — a future self-hosted feature, never the public path. DNS rebinding between the gateway's check and Servo's own fetch is a known gap.
+- **Servo is view-only and software-rendered**: static/CSS pages render at full frame rate; heavy WebGL is ~15–20 fps. No clicking, scrolling, or login.
+- **`cast` in Safari/iOS** may not play (WebM/VP9), see above.
diff --git a/examples/web-capture/cmd/gateway/capture.go b/examples/web-capture/cmd/gateway/capture.go
new file mode 100644
index 000000000..8441b592a
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/capture.go
@@ -0,0 +1,247 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"net/url"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+)
+
+type captureMode int
+
+const (
+	modeClip captureMode = iota
+	modeCast
+)
+
+func (m captureMode) String() string {
+	if m == modeCast {
+		return "cast"
+	}
+	return "clip"
+}
+
+// Capture resolution is capped at 4K; bigger just wastes work.
+const (
+	maxResW = 3840
+	maxResH = 2160
+)
+
+var (
+	errNoTarget      = errors.New("no target URL in path")
+	errBadDuration   = errors.New("invalid dur option")
+	errBadResolution = errors.New("invalid res option (expected WxH)")
+	errUnknownOption = errors.New("unknown option")
+	errBlockedTarget = errors.New("target host is not allowed")
+)
+
+// captureOpts holds the per-request knobs parsed from the options segment,
+// seeded from the gateway defaults. res{W,H} is the capture resolution: the
+// page renders at that size AND is encoded at it (1:1, no downscale) so text
+// stays crisp; a wider resolution also yields a roomier desktop layout.
+type captureOpts struct {
+	dur  time.Duration // clip only
+	resW int
+	resH int
+}
+
+// optionsSegmentRe matches a leading comma-separated key=value options segment
+// (e.g. "dur=30s" or "vp=1920x1080,dur=30s"). A real host never contains '=',
+// so a first segment that matches this is unambiguously options, not the target.
+var optionsSegmentRe = regexp.MustCompile(`^[a-z]+=[^,/]+(,[a-z]+=[^,/]+)*$`)
+
+// detectMode resolves clip/cast from the host subdomain (clip./cast.) or, for
+// local/single-host use, a leading /clip//cast/ path prefix. It returns the rest
+// of the raw request target with the mode prefix (if any) stripped.
+func detectMode(host, rawTarget string) (mode captureMode, rest string, ok bool) {
+	h := host
+	if i := strings.IndexByte(h, ':'); i >= 0 {
+		h = h[:i]
+	}
+	h = strings.ToLower(h)
+	rest = strings.TrimPrefix(rawTarget, "/")
+
+	switch {
+	case strings.HasPrefix(h, "clip."):
+		return modeClip, rest, true
+	case strings.HasPrefix(h, "cast."):
+		return modeCast, rest, true
+	}
+
+	switch {
+	case rest == "clip" || strings.HasPrefix(rest, "clip/"):
+		return modeClip, strings.TrimPrefix(strings.TrimPrefix(rest, "clip"), "/"), true
+	case rest == "cast" || strings.HasPrefix(rest, "cast/"):
+		return modeCast, strings.TrimPrefix(strings.TrimPrefix(rest, "cast"), "/"), true
+	}
+	return modeClip, rest, false
+}
+
+// parseTargetAndOptions splits an optional leading options segment from the
+// verbatim target URL. rest MUST come from r.RequestURI (not the cleaned
+// r.URL.Path), so the target's own "//" and query string survive intact. opts
+// is seeded from def and overridden by any options present.
+func parseTargetAndOptions(rest string, def captureOpts, maxDur time.Duration) (target string, opts captureOpts, err error) {
+	opts = def
+	rest = strings.TrimPrefix(rest, "/")
+	if rest == "" {
+		return "", def, errNoTarget
+	}
+
+	head, tail, _ := strings.Cut(rest, "/")
+	headDec, decErr := url.PathUnescape(head)
+	if decErr != nil {
+		headDec = head
+	}
+
+	switch {
+	case optionsSegmentRe.MatchString(headDec) && tail == "":
+		return "", def, errNoTarget // options given but no target followed
+	case optionsSegmentRe.MatchString(headDec):
+		opts, err = parseOptions(headDec, def, maxDur)
+		if err != nil {
+			return "", def, err
+		}
+		target = tail
+	default:
+		target = rest
+	}
+
+	if target == "" {
+		return "", def, errNoTarget
+	}
+	low := strings.ToLower(target)
+	if !strings.HasPrefix(low, "http://") && !strings.HasPrefix(low, "https://") {
+		target = "https://" + target
+	}
+	return target, opts, nil
+}
+
+func parseOptions(seg string, def captureOpts, maxDur time.Duration) (captureOpts, error) {
+	opts := def
+	for kv := range strings.SplitSeq(seg, ",") {
+		k, v, found := strings.Cut(kv, "=")
+		if !found {
+			return def, errUnknownOption
+		}
+		switch k {
+		case "dur":
+			d, err := parseDuration(v)
+			if err != nil {
+				return def, err
+			}
+			if d > maxDur {
+				d = maxDur // clamp rather than reject — friendlier for a demo
+			}
+			opts.dur = d
+		case "res":
+			w, h, err := parseResolution(v)
+			if err != nil {
+				return def, err
+			}
+			opts.resW, opts.resH = w, h
+		default:
+			return def, fmt.Errorf("%w: %q", errUnknownOption, k)
+		}
+	}
+	return opts, nil
+}
+
+func parseDuration(v string) (time.Duration, error) {
+	if d, err := time.ParseDuration(v); err == nil {
+		if d <= 0 {
+			return 0, errBadDuration
+		}
+		return d, nil
+	}
+	if n, err := strconv.Atoi(v); err == nil && n > 0 {
+		return time.Duration(n) * time.Second, nil
+	}
+	return 0, errBadDuration
+}
+
+// parseResolution parses a "WxH" string, clamping each dimension to a sane
+// maximum. Used for both the gateway default and the res= option.
+func parseResolution(s string) (w, h int, err error) {
+	a, b, ok := strings.Cut(strings.ToLower(s), "x")
+	if !ok {
+		return 0, 0, errBadResolution
+	}
+	w, errW := strconv.Atoi(a)
+	h, errH := strconv.Atoi(b)
+	if errW != nil || errH != nil || w < 1 || h < 1 {
+		return 0, 0, errBadResolution
+	}
+	if w > maxResW {
+		w = maxResW
+	}
+	if h > maxResH {
+		h = maxResH
+	}
+	return w, h, nil
+}
+
+// validateTarget enforces the public/URL-only policy: http(s) only, and the
+// host must not resolve to a loopback/private/link-local/metadata address. DNS
+// is re-resolved here so a hostname pointing at an internal IP is caught;
+// rebinding between this check and Servo's own fetch is a documented limitation.
+func validateTarget(ctx context.Context, raw string) (*url.URL, error) {
+	u, err := url.Parse(raw)
+	if err != nil {
+		return nil, fmt.Errorf("parse url: %w", err)
+	}
+	switch strings.ToLower(u.Scheme) {
+	case "http", "https":
+	default:
+		return nil, errBlockedTarget
+	}
+	host := u.Hostname()
+	if host == "" {
+		return nil, errBlockedTarget
+	}
+
+	rctx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+	addrs, err := net.DefaultResolver.LookupIPAddr(rctx, host)
+	if err != nil {
+		return nil, fmt.Errorf("resolve host: %w", err)
+	}
+	if len(addrs) == 0 {
+		return nil, errBlockedTarget
+	}
+	for _, a := range addrs {
+		if isBlockedIP(a.IP) {
+			return nil, errBlockedTarget
+		}
+	}
+	return u, nil
+}
+
+func isBlockedIP(ip net.IP) bool {
+	return ip.IsLoopback() ||
+		ip.IsPrivate() ||
+		ip.IsUnspecified() ||
+		ip.IsLinkLocalUnicast() ||
+		ip.IsLinkLocalMulticast() ||
+		ip.IsInterfaceLocalMulticast() ||
+		ip.IsMulticast() ||
+		isCGNAT(ip)
+}
+
+// isCGNAT reports whether ip is in the carrier-grade NAT range 100.64.0.0/10,
+// which net.IP.IsPrivate does not cover.
+func isCGNAT(ip net.IP) bool {
+	if v4 := ip.To4(); v4 != nil {
+		return v4[0] == 100 && v4[1]&0xc0 == 64
+	}
+	return false
+}
diff --git a/examples/web-capture/cmd/gateway/capture_test.go b/examples/web-capture/cmd/gateway/capture_test.go
new file mode 100644
index 000000000..b52391674
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/capture_test.go
@@ -0,0 +1,133 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+package main
+
+import (
+	"context"
+	"testing"
+	"time"
+)
+
+func TestDetectMode(t *testing.T) {
+	cases := []struct {
+		host, rawTarget string
+		wantMode        captureMode
+		wantRest        string
+		wantOK          bool
+	}{
+		{"clip.streamkit.dev", "/example.com", modeClip, "example.com", true},
+		{"cast.streamkit.dev", "/dur=5s/example.com", modeCast, "dur=5s/example.com", true},
+		{"clip.streamkit.dev:8080", "/x", modeClip, "x", true},
+		{"localhost:8080", "/clip/example.com", modeClip, "example.com", true},
+		{"localhost:8080", "/cast/example.com", modeCast, "example.com", true},
+		{"localhost", "/example.com", modeClip, "example.com", false},
+	}
+	for _, c := range cases {
+		mode, rest, ok := detectMode(c.host, c.rawTarget)
+		if ok != c.wantOK {
+			t.Errorf("detectMode(%q,%q) ok=%v want %v", c.host, c.rawTarget, ok, c.wantOK)
+			continue
+		}
+		if !ok {
+			continue
+		}
+		if mode != c.wantMode || rest != c.wantRest {
+			t.Errorf("detectMode(%q,%q) = (%v,%q) want (%v,%q)", c.host, c.rawTarget, mode, rest, c.wantMode, c.wantRest)
+		}
+	}
+}
+
+func TestParseTargetAndOptions(t *testing.T) {
+	def := captureOpts{dur: 10 * time.Second, resW: 1920, resH: 1080}
+	const maxDur = 60 * time.Second
+	cases := []struct {
+		name, rest         string
+		wantTarget         string
+		wantDur            time.Duration
+		wantResW, wantResH int
+		wantErr            bool
+	}{
+		{"bare host", "example.com/page", "https://example.com/page", 10 * time.Second, 1920, 1080, false},
+		{"scheme + query preserved", "https://e.com/p?a=1&b=2", "https://e.com/p?a=1&b=2", 10 * time.Second, 1920, 1080, false},
+		{"explicit http kept", "http://e.com", "http://e.com", 10 * time.Second, 1920, 1080, false},
+		{"dur option", "dur=30s/example.com", "https://example.com", 30 * time.Second, 1920, 1080, false},
+		{"dur seconds int", "dur=15/example.com", "https://example.com", 15 * time.Second, 1920, 1080, false},
+		{"dur clamped to max", "dur=90s/example.com", "https://example.com", maxDur, 1920, 1080, false},
+		{"resolution option", "res=2560x1440/example.com", "https://example.com", 10 * time.Second, 2560, 1440, false},
+		{"dur and resolution", "dur=20s,res=1280x720/example.com", "https://example.com", 20 * time.Second, 1280, 720, false},
+		{"host that looks like a token", "30s.com/x", "https://30s.com/x", 10 * time.Second, 1920, 1080, false},
+		{"empty", "", "", 0, 0, 0, true},
+		{"options with no target", "dur=30s", "", 0, 0, 0, true},
+		{"bad dur", "dur=abc/example.com", "", 0, 0, 0, true},
+		{"bad resolution", "res=wide/example.com", "", 0, 0, 0, true},
+		{"unknown option", "zoom=2/example.com", "", 0, 0, 0, true},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			target, opts, err := parseTargetAndOptions(c.rest, def, maxDur)
+			if (err != nil) != c.wantErr {
+				t.Fatalf("err=%v wantErr=%v", err, c.wantErr)
+			}
+			if c.wantErr {
+				return
+			}
+			if target != c.wantTarget {
+				t.Errorf("target=%q want %q", target, c.wantTarget)
+			}
+			if opts.dur != c.wantDur {
+				t.Errorf("dur=%v want %v", opts.dur, c.wantDur)
+			}
+			if opts.resW != c.wantResW || opts.resH != c.wantResH {
+				t.Errorf("res=%dx%d want %dx%d", opts.resW, opts.resH, c.wantResW, c.wantResH)
+			}
+		})
+	}
+}
+
+// The exact shape a local path-prefix request produces, end to end through
+// detectMode + parseTargetAndOptions.
+func TestDetectModeThenParseWithOptions(t *testing.T) {
+	mode, rest, ok := detectMode("127.0.0.1:8080", "/clip/dur=5s,res=1920x1080/streamkit.dev")
+	if !ok || mode != modeClip {
+		t.Fatalf("detectMode = (%v, %q, %v)", mode, rest, ok)
+	}
+	def := captureOpts{dur: 10 * time.Second, resW: 1280, resH: 720}
+	target, opts, err := parseTargetAndOptions(rest, def, 60*time.Second)
+	if err != nil {
+		t.Fatalf("parse error: %v", err)
+	}
+	if target != "https://streamkit.dev" {
+		t.Errorf("target=%q want https://streamkit.dev", target)
+	}
+	if opts.dur != 5*time.Second || opts.resW != 1920 || opts.resH != 1080 {
+		t.Errorf("opts=%+v want dur=5s res=1920x1080", opts)
+	}
+}
+
+func TestValidateTarget(t *testing.T) {
+	// IP literals resolve without DNS, so these run offline.
+	cases := []struct {
+		raw         string
+		wantBlocked bool
+	}{
+		{"http://127.0.0.1", true},
+		{"http://169.254.169.254", true}, // cloud metadata
+		{"http://10.1.2.3", true},
+		{"http://192.168.0.1", true},
+		{"http://172.16.0.1", true},
+		{"http://100.64.0.1", true}, // CGNAT
+		{"http://0.0.0.0", true},
+		{"http://[::1]", true},
+		{"ftp://8.8.8.8", true}, // scheme
+		{"https://8.8.8.8", false},
+		{"https://1.1.1.1", false},
+	}
+	for _, c := range cases {
+		_, err := validateTarget(context.Background(), c.raw)
+		if (err != nil) != c.wantBlocked {
+			t.Errorf("validateTarget(%q) err=%v wantBlocked=%v", c.raw, err, c.wantBlocked)
+		}
+	}
+}
diff --git a/examples/web-capture/cmd/gateway/encoders.go b/examples/web-capture/cmd/gateway/encoders.go
new file mode 100644
index 000000000..ffc9fa85f
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/encoders.go
@@ -0,0 +1,95 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+package main
+
+import (
+	"fmt"
+	"slices"
+	"strings"
+)
+
+// encoderProfile is a swappable encoder choice: the YAML for the `encoder` node
+// (named so the muxer can `needs: encoder`), the mp4 `video_codec` it implies
+// (ignored by the auto-detecting WebM muxer used for cast), and the content_type
+// advertised to the client. Blocks carry {{FPS}}/{{BR_KBPS}}/{{BR_BPS}} — note
+// the software encoders take a kbps bitrate while the HW encoders take bits/sec.
+type encoderProfile struct {
+	block       string
+	muxCodec    string
+	contentType string
+}
+
+// clipEncoders stay H.264 so downloaded clips remain universally playable
+// (incl. Safari/iOS). Software is the default; hardware is Vulkan Video, which
+// works on NVIDIA/AMD/Intel (NVENC exposes AV1 only, not H.264).
+var clipEncoders = map[string]encoderProfile{
+	"h264-sw": {
+		block: `  encoder:
+    kind: video::openh264::encoder
+    params:
+      bitrate_kbps: {{BR_KBPS}}
+      max_frame_rate: {{FPS}}.0
+    needs: pixel_convert`,
+		muxCodec:    "h264",
+		contentType: `'video/mp4; codecs="avc1.42c01f"'`,
+	},
+	"h264-hw": {
+		block: `  encoder:
+    kind: video::vulkan_video::h264_encoder
+    params:
+      bitrate: {{BR_BPS}}
+      framerate: {{FPS}}
+    needs: pixel_convert`,
+		muxCodec:    "h264",
+		contentType: `'video/mp4; codecs="avc1.42c01f"'`,
+	},
+}
+
+// castEncoders: VP9 (software, default) or AV1 — software (svt, for local
+// testing without a GPU) or hardware (NVENC). The WebM muxer auto-detects the
+// codec from the packets, so only the encoder and advertised codec string vary.
+var castEncoders = map[string]encoderProfile{
+	"vp9-sw": {
+		block: `  encoder:
+    kind: video::vp9::encoder
+    params:
+      bitrate_kbps: {{BR_KBPS}}
+    needs: pixel_convert`,
+		contentType: `'video/webm; codecs="vp9"'`,
+	},
+	"av1-sw": {
+		// CRF, not a target bitrate: SVT-AV1 rejects VBR in its low-delay mode
+		// (required for live), so a bitrate_kbps>0 fails. CRF works in low-delay.
+		block: `  encoder:
+    kind: video::svt_av1::encoder
+    params:
+      bitrate_kbps: 0
+      crf: 32
+      fps: {{FPS}}
+    needs: pixel_convert`,
+		contentType: `'video/webm; codecs="av01.0.08M.08"'`,
+	},
+	"av1-hw": {
+		block: `  encoder:
+    kind: video::nv::av1_encoder
+    params:
+      bitrate: {{BR_BPS}}
+      framerate: {{FPS}}
+    needs: pixel_convert`,
+		contentType: `'video/webm; codecs="av01.0.08M.08"'`,
+	},
+}
+
+func lookupEncoder(profiles map[string]encoderProfile, name string) (encoderProfile, error) {
+	if p, ok := profiles[name]; ok {
+		return p, nil
+	}
+	keys := make([]string, 0, len(profiles))
+	for k := range profiles {
+		keys = append(keys, k)
+	}
+	slices.Sort(keys)
+	return encoderProfile{}, fmt.Errorf("unknown encoder %q (choices: %s)", name, strings.Join(keys, ", "))
+}
diff --git a/examples/web-capture/cmd/gateway/encoders_test.go b/examples/web-capture/cmd/gateway/encoders_test.go
new file mode 100644
index 000000000..e38ed868f
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/encoders_test.go
@@ -0,0 +1,64 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+package main
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestLookupEncoder(t *testing.T) {
+	if _, err := lookupEncoder(clipEncoders, "h264-sw"); err != nil {
+		t.Fatalf("h264-sw should resolve: %v", err)
+	}
+	if _, err := lookupEncoder(castEncoders, "av1-hw"); err != nil {
+		t.Fatalf("av1-hw should resolve: %v", err)
+	}
+	if _, err := lookupEncoder(clipEncoders, "nope"); err == nil {
+		t.Fatal("unknown encoder should error")
+	}
+}
+
+// Each profile must select the right encoder node and bitrate unit (software =
+// kbps, hardware = bits/sec) and leave no unreplaced placeholders.
+func TestClipEncoderProfiles(t *testing.T) {
+	cases := map[string][]string{
+		"h264-sw": {"video::openh264::encoder", "bitrate_kbps: 10000", "max_frame_rate: 30.0", "video_codec: h264"},
+		"h264-hw": {"video::vulkan_video::h264_encoder", "bitrate: 10000000", "framerate: 30", "video_codec: h264"},
+	}
+	for name, wants := range cases {
+		out := renderClipPipeline("https://example.com", 1920, 1080, 30, 300, 10000, clipEncoders[name])
+		if strings.Contains(out, "{{") {
+			t.Fatalf("%s: unreplaced placeholder in:\n%s", name, out)
+		}
+		for _, w := range wants {
+			if !strings.Contains(out, w) {
+				t.Errorf("%s: missing %q", name, w)
+			}
+		}
+	}
+}
+
+func TestCastEncoderProfiles(t *testing.T) {
+	cases := map[string][]string{
+		"vp9-sw": {"video::vp9::encoder", "bitrate_kbps: 6000", `codecs="vp9"`},
+		"av1-sw": {"video::svt_av1::encoder", "crf: 32", `codecs="av01.0.08M.08"`},
+		"av1-hw": {"video::nv::av1_encoder", "bitrate: 6000000", `codecs="av01.0.08M.08"`},
+	}
+	for name, wants := range cases {
+		out := renderCastPipeline("https://example.com", 1920, 1080, 30, 10, 6000, castEncoders[name])
+		if strings.Contains(out, "{{") {
+			t.Fatalf("%s: unreplaced placeholder in:\n%s", name, out)
+		}
+		for _, w := range wants {
+			if !strings.Contains(out, w) {
+				t.Errorf("%s: missing %q", name, w)
+			}
+		}
+		if strings.Contains(out, "frame_count") {
+			t.Errorf("%s: cast must not bound frame_count", name)
+		}
+	}
+}
diff --git a/examples/web-capture/cmd/gateway/main.go b/examples/web-capture/cmd/gateway/main.go
new file mode 100644
index 000000000..7cede74d1
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/main.go
@@ -0,0 +1,327 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+// Gateway renders web pages to video via a StreamKit backend: clip.* returns a
+// finite MP4 (oneshot), cast.* returns a live WebM stream (dynamic session).
+package main
+
+import (
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"net/url"
+	"os"
+	"os/signal"
+	"strconv"
+	"syscall"
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+)
+
+const (
+	defaultSkitURL    = "http://127.0.0.1:4545"
+	defaultListenAddr = ":8080"
+
+	captureFPS = 30
+
+	// Capture resolution: pages render AND encode at this size (1:1, no
+	// downscale, so text stays crisp). Override per request with res=WxH or
+	// globally with --resolution / GATEWAY_RESOLUTION.
+	defaultResolution = "1920x1080"
+
+	// Video bitrate defaults (kbps), tuned for crisp 1080p screen content.
+	defaultClipBitrateKbps = 10000
+	defaultCastBitrateKbps = 6000
+
+	// Software encoders by default so it runs anywhere (no GPU); hardware is
+	// opt-in via --clip-encoder / --cast-encoder.
+	defaultClipEncoder = "h264-sw"
+	defaultCastEncoder = "vp9-sw"
+)
+
+type config struct {
+	listenAddr     string
+	skitURL        string
+	authToken      string
+	maxConcurrency int
+	clipDefaultDur time.Duration
+	clipMaxDur     time.Duration
+	resW           int
+	resH           int
+	clipBitrate    int
+	castBitrate    int
+	clipEncoder    string
+	castEncoder    string
+	maxSessions    int
+	maxViewers     int
+	idleTTL        time.Duration
+	maxLifetime    time.Duration
+}
+
+type gateway struct {
+	client          *http.Client // oneshot + skit control calls
+	streamClient    *http.Client // long-lived MSE proxy
+	skitURL         string
+	authToken       string
+	clipSem         chan struct{}
+	clipDefaultDur  time.Duration
+	clipMaxDur      time.Duration
+	resW            int
+	resH            int
+	clipBitrate     int
+	castBitrate     int
+	clipEnc         encoderProfile
+	castEnc         encoderProfile
+	maxViewers      int
+	mseReadyTimeout time.Duration
+	skit            *skitClient
+	sessions        *sessionManager
+}
+
+func main() {
+	cfg := loadConfig()
+
+	clipEnc, err := lookupEncoder(clipEncoders, cfg.clipEncoder)
+	if err != nil {
+		log.Fatalf("invalid --clip-encoder: %v", err)
+	}
+	castEnc, err := lookupEncoder(castEncoders, cfg.castEncoder)
+	if err != nil {
+		log.Fatalf("invalid --cast-encoder: %v", err)
+	}
+
+	ctrlClient := newHTTPClient()
+	skit := &skitClient{client: ctrlClient, baseURL: cfg.skitURL, token: cfg.authToken}
+	gw := &gateway{
+		client:          ctrlClient,
+		streamClient:    newStreamClient(),
+		skitURL:         cfg.skitURL,
+		authToken:       cfg.authToken,
+		clipSem:         make(chan struct{}, cfg.maxConcurrency),
+		clipDefaultDur:  cfg.clipDefaultDur,
+		clipMaxDur:      cfg.clipMaxDur,
+		resW:            cfg.resW,
+		resH:            cfg.resH,
+		clipBitrate:     cfg.clipBitrate,
+		castBitrate:     cfg.castBitrate,
+		clipEnc:         clipEnc,
+		castEnc:         castEnc,
+		maxViewers:      cfg.maxViewers,
+		mseReadyTimeout: 8 * time.Second,
+		skit:            skit,
+		sessions:        newSessionManager(skit, cfg.maxSessions, cfg.idleTTL, cfg.maxLifetime),
+	}
+	log.Printf("encoders: clip=%s cast=%s", cfg.clipEncoder, cfg.castEncoder)
+
+	srv := &http.Server{
+		Addr:              cfg.listenAddr,
+		Handler:           logging(gw.router()),
+		ReadHeaderTimeout: 5 * time.Second,
+	}
+
+	reaperCtx, cancelReaper := context.WithCancel(context.Background())
+	go gw.sessions.runReaper(reaperCtx, 10*time.Second)
+
+	done := make(chan struct{})
+	go func() {
+		sigCh := make(chan os.Signal, 1)
+		signal.Notify(sigCh, os.Interrupt, syscall.SIGTERM)
+		<-sigCh
+		log.Printf("shutdown signal received; draining and tearing down sessions")
+		cancelReaper()
+
+		shutCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		defer cancel()
+		if err := srv.Shutdown(shutCtx); err != nil {
+			log.Printf("graceful shutdown timed out (%v); forcing", err)
+			_ = srv.Close()
+		}
+		// Tear down owned sessions so a restart never leaks Servo pipelines.
+		destroyCtx, cancel2 := context.WithTimeout(context.Background(), 15*time.Second)
+		defer cancel2()
+		gw.sessions.shutdownAll(destroyCtx)
+		close(done)
+	}()
+
+	log.Printf("StreamKit web-capture gateway listening on %s -> %s", cfg.listenAddr, cfg.skitURL)
+	if err := srv.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
+		log.Fatalf("server error: %v", err)
+	}
+	<-done
+}
+
+func loadConfig() config {
+	listen := flag.String("listen", getEnvDefault("GATEWAY_LISTEN", defaultListenAddr), "Listen address")
+	skit := flag.String("skit-url", getEnvDefault("SKIT_URL", defaultSkitURL), "Skit backend URL")
+	token := flag.String("token", os.Getenv("SKIT_TOKEN"), "Bearer token for Skit (overrides SKIT_TOKEN env)")
+	maxConc := flag.Int("max-concurrency", envInt("GATEWAY_MAX_CONCURRENCY", 4), "Max concurrent clip renders")
+	clipDefault := flag.Int("clip-default-secs", envInt("GATEWAY_CLIP_DEFAULT_SECS", 10), "Default clip duration (seconds)")
+	clipMax := flag.Int("clip-max-secs", envInt("GATEWAY_CLIP_MAX_SECS", 60), "Maximum clip duration (seconds)")
+	maxSessions := flag.Int("max-sessions", envInt("GATEWAY_MAX_SESSIONS", 8), "Max concurrent live cast sessions")
+	maxViewers := flag.Int("max-viewers", envInt("GATEWAY_MAX_VIEWERS", 10), "Max viewers per cast stream")
+	idleSecs := flag.Int("session-idle-secs", envInt("GATEWAY_SESSION_IDLE_SECS", 30), "Idle grace before a viewerless session is reaped (seconds)")
+	maxLifeSecs := flag.Int("session-max-secs", envInt("GATEWAY_SESSION_MAX_SECS", 1800), "Max lifetime of a cast session (seconds)")
+	resolution := flag.String("resolution", getEnvDefault("GATEWAY_RESOLUTION", defaultResolution), "Capture resolution WxH (pages render and encode at this size, 1:1)")
+	clipBitrate := flag.Int("clip-bitrate-kbps", envInt("GATEWAY_CLIP_BITRATE_KBPS", defaultClipBitrateKbps), "Clip video bitrate (kbps)")
+	castBitrate := flag.Int("cast-bitrate-kbps", envInt("GATEWAY_CAST_BITRATE_KBPS", defaultCastBitrateKbps), "Cast video bitrate (kbps)")
+	clipEncoder := flag.String("clip-encoder", getEnvDefault("GATEWAY_CLIP_ENCODER", defaultClipEncoder), "Clip encoder: h264-sw, h264-hw")
+	castEncoder := flag.String("cast-encoder", getEnvDefault("GATEWAY_CAST_ENCODER", defaultCastEncoder), "Cast encoder: vp9-sw, av1-sw, av1-hw")
+
+	flag.Parse()
+
+	clipDefaultDur := time.Duration(*clipDefault) * time.Second
+	clipMaxDur := time.Duration(*clipMax) * time.Second
+	if clipDefaultDur > clipMaxDur {
+		clipDefaultDur = clipMaxDur
+	}
+
+	resW, resH, err := parseResolution(*resolution)
+	if err != nil {
+		log.Printf("invalid --resolution %q, using %s", *resolution, defaultResolution)
+		resW, resH, _ = parseResolution(defaultResolution)
+	}
+
+	return config{
+		listenAddr:     *listen,
+		skitURL:        *skit,
+		authToken:      *token,
+		maxConcurrency: *maxConc,
+		clipDefaultDur: clipDefaultDur,
+		clipMaxDur:     clipMaxDur,
+		resW:           resW,
+		resH:           resH,
+		clipBitrate:    *clipBitrate,
+		castBitrate:    *castBitrate,
+		clipEncoder:    *clipEncoder,
+		castEncoder:    *castEncoder,
+		maxSessions:    *maxSessions,
+		maxViewers:     *maxViewers,
+		idleTTL:        time.Duration(*idleSecs) * time.Second,
+		maxLifetime:    time.Duration(*maxLifeSecs) * time.Second,
+	}
+}
+
+func envInt(key string, def int) int {
+	if v := os.Getenv(key); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 {
+			return n
+		}
+	}
+	return def
+}
+
+func getEnvDefault(key, def string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return def
+}
+
+func (gw *gateway) router() http.Handler {
+	metricsHandler := promhttp.Handler()
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/metrics":
+			metricsHandler.ServeHTTP(w, r)
+		case "/healthz", "/health":
+			w.Header().Set("Content-Type", "text/plain")
+			_, _ = io.WriteString(w, "ok\n")
+		case "", "/", "/favicon.ico", "/robots.txt":
+			gw.handleUsage(w, r)
+		default:
+			gw.handleCapture(w, r)
+		}
+	})
+}
+
+func (gw *gateway) handleCapture(w http.ResponseWriter, r *http.Request) {
+	mode, rest, ok := detectMode(r.Host, r.RequestURI)
+	if !ok {
+		gw.handleUsage(w, r)
+		return
+	}
+	endpoint := mode.String()
+
+	withMetrics(endpoint, w, r, func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodGet {
+			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+			return
+		}
+		def := captureOpts{dur: gw.clipDefaultDur, resW: gw.resW, resH: gw.resH}
+		target, opts, err := parseTargetAndOptions(rest, def, gw.clipMaxDur)
+		if err != nil {
+			recordRejection(endpoint, reasonBadRequest)
+			http.Error(w, "bad request: "+err.Error(), http.StatusBadRequest)
+			return
+		}
+		u, err := validateTarget(r.Context(), target)
+		if err != nil {
+			recordRejection(endpoint, reasonSSRFBlocked)
+			http.Error(w, "target host is not allowed", http.StatusForbidden)
+			return
+		}
+		switch mode {
+		case modeClip:
+			gw.serveClip(w, r, u, opts)
+		case modeCast:
+			gw.serveCast(w, r, u, opts)
+		}
+	})
+}
+
+func (gw *gateway) serveClip(w http.ResponseWriter, r *http.Request, u *url.URL, opts captureOpts) {
+	dur := opts.dur
+	if dur <= 0 {
+		dur = gw.clipDefaultDur
+	}
+	release := gw.acquireClip()
+	defer release()
+
+	frames := int(dur.Seconds()) * captureFPS
+	if frames < 1 {
+		frames = captureFPS
+	}
+	yaml := renderClipPipeline(u.String(), opts.resW, opts.resH, captureFPS, frames, gw.clipBitrate, gw.clipEnc)
+	gw.proxyOneshot(w, r, yaml)
+}
+
+func (gw *gateway) serveCast(w http.ResponseWriter, r *http.Request, u *url.URL, opts captureOpts) {
+	// A browser address-bar paste (Accept: text/html) gets an autoplay page; the
+	// page's <video> then re-requests this same URL (Accept: */*) and is streamed.
+	if acceptsHTML(r) {
+		gw.writeCastPage(w, r, u)
+		return
+	}
+
+	// Viewport is part of the render, so it keys the shared session: viewers of
+	// the same URL+viewport share one pipeline; a different viewport is its own.
+	key := fmt.Sprintf("%s|%dx%d", u.String(), opts.resW, opts.resH)
+	yaml := renderCastPipeline(u.String(), opts.resW, opts.resH, captureFPS, gw.maxViewers, gw.castBitrate, gw.castEnc)
+	s, err := gw.sessions.acquire(r.Context(), key, yaml)
+	if err != nil {
+		switch {
+		case errors.Is(err, errOverCapacity):
+			recordRejection("cast", reasonOverCapacity)
+			http.Error(w, "server at capacity, try again shortly", http.StatusServiceUnavailable)
+		case errors.Is(err, context.Canceled):
+			// client gave up before the stream was ready
+		default:
+			recordRejection("cast", reasonUpstreamError)
+			http.Error(w, "failed to start stream", http.StatusBadGateway)
+		}
+		return
+	}
+	defer gw.sessions.release(s)
+	gw.proxyMSE(w, r, s)
+}
+
+func (gw *gateway) acquireClip() func() {
+	gw.clipSem <- struct{}{}
+	return func() { <-gw.clipSem }
+}
diff --git a/examples/web-capture/cmd/gateway/metrics.go b/examples/web-capture/cmd/gateway/metrics.go
new file mode 100644
index 000000000..437904479
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/metrics.go
@@ -0,0 +1,172 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+package main
+
+import (
+	"fmt"
+	"net/http"
+	"strconv"
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/promauto"
+)
+
+// Buckets span sub-100ms rejections up to a 60s clip render / slow session start.
+var latencyBuckets = []float64{0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10, 30, 60}
+
+// sessionLifetimeBuckets span a quick reload up to the max-lifetime cap.
+var sessionLifetimeBuckets = []float64{1, 5, 15, 30, 60, 120, 300, 600, 1800}
+
+// codeClientClosed mirrors nginx's 499: the handler returned without writing a
+// response, typically because the client disconnected mid-request.
+const codeClientClosed = 499
+
+// knownMethods bounds the requests_total method label so a client cannot mint
+// unbounded time series via arbitrary RFC method tokens.
+var knownMethods = map[string]struct{}{
+	http.MethodGet:  {},
+	http.MethodHead: {},
+	http.MethodPost: {},
+	http.MethodPut:  {},
+}
+
+func methodLabel(method string) string {
+	if _, ok := knownMethods[method]; ok {
+		return method
+	}
+	return "other"
+}
+
+// codeLabel keeps canonical HTTP statuses (and 499) but folds anything else to
+// its class (e.g. "5xx") so an odd backend code cannot explode label cardinality.
+func codeLabel(code int) string {
+	if code == codeClientClosed || http.StatusText(code) != "" {
+		return strconv.Itoa(code)
+	}
+	if code >= 100 && code < 600 {
+		return fmt.Sprintf("%dxx", code/100)
+	}
+	return "other"
+}
+
+var (
+	requestsTotal = promauto.NewCounterVec(prometheus.CounterOpts{
+		Name: "webcapture_requests_total",
+		Help: "Total web-capture requests by endpoint (clip/cast), method, and HTTP status code.",
+	}, []string{"endpoint", "method", "code"})
+
+	requestDuration = promauto.NewHistogramVec(prometheus.HistogramOpts{
+		Name:    "webcapture_request_duration_seconds",
+		Help:    "Total handler latency in seconds by endpoint. For cast this spans the whole viewer connection.",
+		Buckets: latencyBuckets,
+	}, []string{"endpoint"})
+
+	inflightRequests = promauto.NewGaugeVec(prometheus.GaugeOpts{
+		Name: "webcapture_inflight_requests",
+		Help: "In-flight requests by endpoint (received, not yet completed).",
+	}, []string{"endpoint"})
+
+	upstreamDuration = promauto.NewHistogramVec(prometheus.HistogramOpts{
+		Name:    "webcapture_upstream_duration_seconds",
+		Help:    "Time to receive response headers from the skit backend by endpoint.",
+		Buckets: latencyBuckets,
+	}, []string{"endpoint"})
+
+	rejectedTotal = promauto.NewCounterVec(prometheus.CounterOpts{
+		Name: "webcapture_rejected_total",
+		Help: "Rejected requests by endpoint and reason.",
+	}, []string{"endpoint", "reason"})
+
+	activeSessions = promauto.NewGauge(prometheus.GaugeOpts{
+		Name: "webcapture_active_sessions",
+		Help: "Live cast sessions the gateway currently owns (one Servo pipeline each).",
+	})
+
+	activeViewers = promauto.NewGauge(prometheus.GaugeOpts{
+		Name: "webcapture_active_viewers",
+		Help: "Active cast viewers across all sessions.",
+	})
+
+	sessionsReaped = promauto.NewCounterVec(prometheus.CounterOpts{
+		Name: "webcapture_sessions_reaped_total",
+		Help: "Cast sessions torn down, by reason (idle, max_lifetime, shutdown).",
+	}, []string{"reason"})
+
+	sessionLifetime = promauto.NewHistogram(prometheus.HistogramOpts{
+		Name:    "webcapture_session_lifetime_seconds",
+		Help:    "Lifetime of a cast session from creation to teardown.",
+		Buckets: sessionLifetimeBuckets,
+	})
+)
+
+type rejectReason string
+
+const (
+	reasonBadRequest    rejectReason = "bad_request"
+	reasonSSRFBlocked   rejectReason = "ssrf_blocked"
+	reasonOverCapacity  rejectReason = "over_capacity"
+	reasonUpstreamError rejectReason = "upstream_error"
+)
+
+func recordRejection(endpoint string, reason rejectReason) {
+	rejectedTotal.WithLabelValues(endpoint, string(reason)).Inc()
+}
+
+// statusRecorder captures the response status code while preserving
+// http.Flusher so proxied streaming responses keep flushing incrementally. A
+// zero code means nothing was written (client closed before any response).
+type statusRecorder struct {
+	http.ResponseWriter
+	code int
+}
+
+func (s *statusRecorder) WriteHeader(code int) {
+	if s.code == 0 {
+		s.code = code
+	}
+	s.ResponseWriter.WriteHeader(code)
+}
+
+func (s *statusRecorder) Write(b []byte) (int, error) {
+	if s.code == 0 {
+		s.code = http.StatusOK
+	}
+	return s.ResponseWriter.Write(b)
+}
+
+func (s *statusRecorder) Flush() {
+	if f, ok := s.ResponseWriter.(http.Flusher); ok {
+		f.Flush()
+	}
+}
+
+// withMetrics records count, latency, and the in-flight gauge for one endpoint.
+// Recording runs in a defer so a panicking handler is still counted (as 500)
+// before the panic propagates.
+func withMetrics(endpoint string, w http.ResponseWriter, r *http.Request, fn func(http.ResponseWriter, *http.Request)) {
+	inflightRequests.WithLabelValues(endpoint).Inc()
+	rec := &statusRecorder{ResponseWriter: w}
+	start := time.Now()
+
+	defer func() {
+		p := recover()
+		code := rec.code
+		switch {
+		case p != nil:
+			code = http.StatusInternalServerError
+		case code == 0:
+			code = codeClientClosed
+		}
+		requestDuration.WithLabelValues(endpoint).Observe(time.Since(start).Seconds())
+		requestsTotal.WithLabelValues(endpoint, methodLabel(r.Method), codeLabel(code)).Inc()
+		inflightRequests.WithLabelValues(endpoint).Dec()
+		if p != nil {
+			panic(p)
+		}
+	}()
+
+	fn(rec, r)
+}
diff --git a/examples/web-capture/cmd/gateway/metrics_test.go b/examples/web-capture/cmd/gateway/metrics_test.go
new file mode 100644
index 000000000..9365c69f1
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/metrics_test.go
@@ -0,0 +1,44 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+package main
+
+import (
+	"net/http"
+	"testing"
+)
+
+func TestMethodLabel(t *testing.T) {
+	cases := map[string]string{
+		http.MethodGet:  "GET",
+		http.MethodPost: "POST",
+		http.MethodPut:  "PUT",
+		http.MethodHead: "HEAD",
+		"PATCH":         "other",
+		"FROBNICATE":    "other",
+		"":              "other",
+	}
+	for in, want := range cases {
+		if got := methodLabel(in); got != want {
+			t.Errorf("methodLabel(%q)=%q want %q", in, got, want)
+		}
+	}
+}
+
+func TestCodeLabel(t *testing.T) {
+	cases := map[int]string{
+		200: "200",
+		404: "404",
+		499: "499", // client closed
+		502: "502",
+		550: "5xx", // non-canonical, folds to class
+		99:  "other",
+		700: "other",
+	}
+	for in, want := range cases {
+		if got := codeLabel(in); got != want {
+			t.Errorf("codeLabel(%d)=%q want %q", in, got, want)
+		}
+	}
+}
diff --git a/examples/web-capture/cmd/gateway/pipelines.go b/examples/web-capture/cmd/gateway/pipelines.go
new file mode 100644
index 000000000..7808b243a
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/pipelines.go
@@ -0,0 +1,140 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+package main
+
+import (
+	"strconv"
+	"strings"
+)
+
+// Both pipelines render a web page with the Servo plugin. Servo emits RGBA8, so
+// pixel_convert -> nv12 is mandatory before any encoder. The target URL is
+// strconv.Quote'd into the YAML so a hostile URL cannot break out of the scalar.
+//
+// The page renders and is encoded at the SAME resolution (no viewport_* override
+// => Servo's viewport defaults to the output size), so there is no downscale to
+// blur text. A wider resolution also gives the page a roomier desktop layout.
+//
+// The encoder is a swappable profile (software default, hardware opt-in): the
+// {{ENCODER_BLOCK}} placeholder is replaced with the chosen encoder node, and
+// {{CONTENT_TYPE}} / {{MUX_CODEC}} follow from it. See encoders.go.
+
+// clip: bounded oneshot -> fragmented MP4 (mode: stream = moov-up-front, so it
+// plays inline as it renders) returned over http_output.
+const clipPipelineTemplate = `
+name: web-clip
+description: Render a web page to a short MP4 clip
+mode: oneshot
+attributes:
+  service: web-capture
+  mode: clip
+client:
+  input:
+    type: none
+  output:
+    type: video
+nodes:
+  web:
+    kind: plugin::native::servo
+    params:
+      url: {{URL}}
+      width: {{WIDTH}}
+      height: {{HEIGHT}}
+      fps: {{FPS}}
+      frame_count: {{FRAME_COUNT}}
+  pixel_convert:
+    kind: video::pixel_convert
+    params:
+      output_format: nv12
+    needs: web
+{{ENCODER_BLOCK}}
+  muxer:
+    kind: containers::mp4::muxer
+    params:
+      mode: stream
+      video_width: {{WIDTH}}
+      video_height: {{HEIGHT}}
+      video_codec: {{MUX_CODEC}}
+    needs: encoder
+  http_output:
+    kind: streamkit::http_output
+    params:
+      content_type: {{CONTENT_TYPE}}
+    needs: muxer
+`
+
+// cast: unbounded dynamic session -> live WebM over HTTP MSE. frame_count is
+// omitted (0 = infinite). The WebM muxer auto-detects the codec (VP9/AV1) from
+// the encoded packets, so only the encoder and the advertised content_type
+// change between profiles.
+const castPipelineTemplate = `
+name: web-cast
+description: Render a web page to a live WebM stream
+mode: dynamic
+attributes:
+  service: web-capture
+  mode: cast
+client:
+  watch:
+    mse_path: /video
+    video: true
+nodes:
+  web:
+    kind: plugin::native::servo
+    params:
+      url: {{URL}}
+      width: {{WIDTH}}
+      height: {{HEIGHT}}
+      fps: {{FPS}}
+  pixel_convert:
+    kind: video::pixel_convert
+    params:
+      output_format: nv12
+    needs: web
+{{ENCODER_BLOCK}}
+  muxer:
+    kind: containers::webm::muxer
+    params:
+      video_width: {{WIDTH}}
+      video_height: {{HEIGHT}}
+      streaming_mode: live
+    needs: encoder
+  http_mse:
+    kind: transport::http::mse
+    params:
+      path: /video
+      max_clients: {{MAX_CLIENTS}}
+      content_type: {{CONTENT_TYPE}}
+    needs: muxer
+`
+
+func renderClipPipeline(targetURL string, resW, resH, fps, frameCount, brKbps int, enc encoderProfile) string {
+	tmpl := strings.Replace(clipPipelineTemplate, "{{ENCODER_BLOCK}}", enc.block, 1)
+	return strings.NewReplacer(
+		"{{URL}}", strconv.Quote(targetURL),
+		"{{WIDTH}}", strconv.Itoa(resW),
+		"{{HEIGHT}}", strconv.Itoa(resH),
+		"{{FPS}}", strconv.Itoa(fps),
+		"{{FRAME_COUNT}}", strconv.Itoa(frameCount),
+		"{{BR_KBPS}}", strconv.Itoa(brKbps),
+		"{{BR_BPS}}", strconv.Itoa(brKbps*1000),
+		"{{MUX_CODEC}}", enc.muxCodec,
+		"{{CONTENT_TYPE}}", enc.contentType,
+	).Replace(tmpl)
+}
+
+func renderCastPipeline(targetURL string, resW, resH, fps, maxClients, brKbps int, enc encoderProfile) string {
+	tmpl := strings.Replace(castPipelineTemplate, "{{ENCODER_BLOCK}}", enc.block, 1)
+	return strings.NewReplacer(
+		"{{URL}}", strconv.Quote(targetURL),
+		"{{WIDTH}}", strconv.Itoa(resW),
+		"{{HEIGHT}}", strconv.Itoa(resH),
+		"{{FPS}}", strconv.Itoa(fps),
+		"{{MAX_CLIENTS}}", strconv.Itoa(maxClients),
+		"{{BR_KBPS}}", strconv.Itoa(brKbps),
+		"{{BR_BPS}}", strconv.Itoa(brKbps*1000),
+		"{{CONTENT_TYPE}}", enc.contentType,
+	).Replace(tmpl)
+}
diff --git a/examples/web-capture/cmd/gateway/pipelines_test.go b/examples/web-capture/cmd/gateway/pipelines_test.go
new file mode 100644
index 000000000..aa6f85201
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/pipelines_test.go
@@ -0,0 +1,71 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+package main
+
+import (
+	"strconv"
+	"strings"
+	"testing"
+)
+
+func TestRenderClipPipeline(t *testing.T) {
+	out := renderClipPipeline("https://example.com/p?a=1", 1920, 1080, 30, 300, 10000, clipEncoders["h264-sw"])
+	if strings.Contains(out, "{{") {
+		t.Fatalf("unreplaced placeholder in:\n%s", out)
+	}
+	for _, want := range []string{
+		`url: "https://example.com/p?a=1"`,
+		"width: 1920",
+		"height: 1080",
+		"frame_count: 300",
+		"mode: stream",
+		"video_codec: h264",
+		"bitrate_kbps: 10000",
+		"max_frame_rate: 30.0",
+		"plugin::native::servo",
+		"output_format: nv12",
+		"streamkit::http_output",
+	} {
+		if !strings.Contains(out, want) {
+			t.Errorf("clip pipeline missing %q", want)
+		}
+	}
+}
+
+// A hostile URL must not break out of the YAML scalar — strconv.Quote escapes
+// any embedded newline/quote so injected keys never appear at line start.
+func TestRenderClipPipelineQuotesURL(t *testing.T) {
+	malicious := "https://x/\"\n  evil: true"
+	out := renderClipPipeline(malicious, 1920, 1080, 30, 30, 10000, clipEncoders["h264-sw"])
+	if strings.Contains(out, "\n  evil: true") {
+		t.Errorf("newline injection not escaped:\n%s", out)
+	}
+	if !strings.Contains(out, "url: "+strconv.Quote(malicious)) {
+		t.Errorf("url not quoted as expected:\n%s", out)
+	}
+}
+
+func TestRenderCastPipeline(t *testing.T) {
+	out := renderCastPipeline("https://example.com", 1920, 1080, 30, 10, 6000, castEncoders["vp9-sw"])
+	if strings.Contains(out, "{{") {
+		t.Fatalf("unreplaced placeholder in:\n%s", out)
+	}
+	for _, want := range []string{
+		"mse_path: /video",
+		"transport::http::mse",
+		"video::vp9::encoder",
+		"max_clients: 10",
+		"streaming_mode: live",
+		"width: 1920",
+		"height: 1080",
+	} {
+		if !strings.Contains(out, want) {
+			t.Errorf("cast pipeline missing %q", want)
+		}
+	}
+	if strings.Contains(out, "frame_count") {
+		t.Error("cast pipeline must not bound frame_count (live is infinite)")
+	}
+}
diff --git a/examples/web-capture/cmd/gateway/proxy.go b/examples/web-capture/cmd/gateway/proxy.go
new file mode 100644
index 000000000..6b72b4ed0
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/proxy.go
@@ -0,0 +1,264 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"html"
+	"io"
+	"log"
+	"mime/multipart"
+	"net"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+)
+
+// newHTTPClient is used for oneshot renders and skit control calls. It has no
+// overall timeout (a clip render legitimately takes seconds) but disables
+// keep-alives so each call gets a fresh connection.
+func newHTTPClient() *http.Client {
+	tr := &http.Transport{
+		DialContext: (&net.Dialer{
+			Timeout:   5 * time.Second,
+			KeepAlive: 30 * time.Second,
+		}).DialContext,
+		DisableKeepAlives: true,
+		ForceAttemptHTTP2: false,
+	}
+	return &http.Client{Transport: tr}
+}
+
+// newStreamClient proxies long-lived MSE streams: keep-alives on, no overall
+// timeout (the stream ends when the viewer disconnects).
+func newStreamClient() *http.Client {
+	tr := &http.Transport{
+		DialContext: (&net.Dialer{
+			Timeout:   5 * time.Second,
+			KeepAlive: 30 * time.Second,
+		}).DialContext,
+		ForceAttemptHTTP2: false,
+	}
+	return &http.Client{Transport: tr}
+}
+
+func (gw *gateway) authReq(req *http.Request) {
+	if gw.authToken != "" {
+		req.Header.Set("Authorization", "Bearer "+gw.authToken)
+	}
+}
+
+func (gw *gateway) failUpstream(w http.ResponseWriter, endpoint string, err error) {
+	log.Printf("%s upstream error: %v", endpoint, err)
+	recordRejection(endpoint, reasonUpstreamError)
+	http.Error(w, "upstream error", http.StatusBadGateway)
+}
+
+// proxyOneshot runs a clip pipeline via POST /api/v1/process and streams the
+// resulting MP4 back. The request body is a config-only multipart (the pipeline
+// has no http_input, so no media part is needed).
+func (gw *gateway) proxyOneshot(w http.ResponseWriter, r *http.Request, pipelineYAML string) {
+	ctx := r.Context()
+
+	bodyReader, bodyWriter := io.Pipe()
+	mw := multipart.NewWriter(bodyWriter)
+	go func() {
+		defer func() { _ = bodyWriter.Close() }()
+		field, err := mw.CreateFormField("config")
+		if err != nil {
+			bodyWriter.CloseWithError(err)
+			return
+		}
+		if _, err := io.WriteString(field, strings.TrimSpace(pipelineYAML)); err != nil {
+			bodyWriter.CloseWithError(err)
+			return
+		}
+		if err := mw.Close(); err != nil {
+			bodyWriter.CloseWithError(err)
+		}
+	}()
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, gw.skitURL+"/api/v1/process", bodyReader)
+	if err != nil {
+		gw.failUpstream(w, "clip", fmt.Errorf("create skit request: %w", err))
+		return
+	}
+	req.Header.Set("Content-Type", mw.FormDataContentType())
+	req.Close = true
+	gw.authReq(req)
+
+	start := time.Now()
+	resp, err := gw.client.Do(req)
+	if err != nil {
+		if errors.Is(err, context.Canceled) {
+			return
+		}
+		gw.failUpstream(w, "clip", fmt.Errorf("call skit: %w", err))
+		return
+	}
+	upstreamDuration.WithLabelValues("clip").Observe(time.Since(start).Seconds())
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode < 100 || resp.StatusCode > 999 {
+		gw.failUpstream(w, "clip", fmt.Errorf("invalid upstream status %d", resp.StatusCode))
+		return
+	}
+	if resp.StatusCode >= 400 {
+		slurp, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
+		log.Printf("clip upstream status %d: %s", resp.StatusCode, strings.TrimSpace(string(slurp)))
+		recordRejection("clip", reasonUpstreamError)
+		http.Error(w, "failed to render page", http.StatusBadGateway)
+		return
+	}
+
+	copyHeaders(w.Header(), resp.Header)
+	if w.Header().Get("Content-Type") == "" {
+		w.Header().Set("Content-Type", "video/mp4")
+	}
+	w.WriteHeader(resp.StatusCode)
+	streamCopy(w, resp.Body, "clip")
+}
+
+// proxyMSE streams a live WebM session to the viewer. The http_mse path only
+// registers once the session's pipeline starts, so a freshly created session
+// may 404 briefly — retry until ready or the viewer goes away.
+func (gw *gateway) proxyMSE(w http.ResponseWriter, r *http.Request, s *liveSession) {
+	ctx := r.Context()
+	streamURL := gw.skit.streamURL(s.id)
+	deadline := time.Now().Add(gw.mseReadyTimeout)
+
+	var resp *http.Response
+	for {
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, streamURL, nil)
+		if err != nil {
+			gw.failUpstream(w, "cast", err)
+			return
+		}
+		gw.authReq(req)
+		r2, err := gw.streamClient.Do(req)
+		if err == nil && r2.StatusCode == http.StatusOK {
+			resp = r2
+			break
+		}
+		if r2 != nil {
+			_, _ = io.Copy(io.Discard, io.LimitReader(r2.Body, 2048))
+			_ = r2.Body.Close()
+		}
+		if ctx.Err() != nil {
+			return
+		}
+		if time.Now().After(deadline) {
+			if err != nil {
+				gw.failUpstream(w, "cast", err)
+			} else {
+				gw.failUpstream(w, "cast", fmt.Errorf("mse stream not ready (status %d)", r2.StatusCode))
+			}
+			return
+		}
+		select {
+		case <-ctx.Done():
+			return
+		case <-time.After(200 * time.Millisecond):
+		}
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	// Close the upstream body the instant the viewer's connection ends, so
+	// streamCopy's read unblocks immediately. Without this, a read parked
+	// between frames keeps the session's viewer count > 0 and dodges idle
+	// reaping until skit happens to write again. ctx is also canceled when the
+	// handler returns, so this goroutine never outlives the request.
+	go func() {
+		<-ctx.Done()
+		_ = resp.Body.Close()
+	}()
+
+	copyHeaders(w.Header(), resp.Header)
+	if w.Header().Get("Content-Type") == "" {
+		w.Header().Set("Content-Type", "video/webm")
+	}
+	w.WriteHeader(http.StatusOK)
+	streamCopy(w, resp.Body, "cast")
+}
+
+// streamCopy forwards an upstream body to the client, flushing each chunk so
+// live/progressive playback starts without waiting for the whole response.
+func streamCopy(w http.ResponseWriter, src io.Reader, endpoint string) {
+	var dst io.Writer = w
+	if flusher, ok := w.(http.Flusher); ok {
+		dst = flushWriter{w: w, f: flusher}
+	}
+	if _, err := io.Copy(dst, src); err != nil && !errors.Is(err, context.Canceled) {
+		log.Printf("%s copy response error: %v", endpoint, err)
+	}
+}
+
+const castPageTemplate = `<!doctype html><html><head><meta charset="utf-8">` +
+	`<title>web-cast · %s</title>` +
+	`<style>html,body{margin:0;height:100%%;background:#000}video{width:100%%;height:100%%;object-fit:contain}</style>` +
+	`</head><body><video src="%s" autoplay muted playsinline controls></video></body></html>`
+
+func (gw *gateway) writeCastPage(w http.ResponseWriter, r *http.Request, target *url.URL) {
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	w.WriteHeader(http.StatusOK)
+	_, _ = fmt.Fprintf(w, castPageTemplate, html.EscapeString(target.String()), html.EscapeString(r.RequestURI))
+}
+
+const usagePage = `<!doctype html><html><head><meta charset="utf-8"><title>StreamKit web-capture</title>` +
+	`<style>body{font:16px/1.5 system-ui,sans-serif;max-width:42rem;margin:3rem auto;padding:0 1rem;color:#222}` +
+	`code{background:#f2f2f2;padding:.1em .3em;border-radius:.2em}</style></head><body>` +
+	`<h1>StreamKit web-capture</h1>` +
+	`<p>Render any web page to video. Paste a target URL straight after the host:</p>` +
+	`<ul>` +
+	`<li><strong>Clip</strong> (MP4 file): <code>clip.streamkit.dev/example.com</code></li>` +
+	`<li><strong>Clip</strong> with duration: <code>clip.streamkit.dev/dur=30s/example.com</code></li>` +
+	`<li><strong>Cast</strong> (live stream): <code>cast.streamkit.dev/example.com</code></li>` +
+	`</ul>` +
+	`<p>Locally, use a path prefix instead of a subdomain: <code>/clip/…</code> or <code>/cast/…</code>.</p>` +
+	`</body></html>`
+
+func (gw *gateway) handleUsage(w http.ResponseWriter, _ *http.Request) {
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	_, _ = io.WriteString(w, usagePage)
+}
+
+func acceptsHTML(r *http.Request) bool {
+	return strings.Contains(r.Header.Get("Accept"), "text/html")
+}
+
+func copyHeaders(dst, src http.Header) {
+	for k, vv := range src {
+		if strings.EqualFold(k, "Content-Length") || strings.EqualFold(k, "Transfer-Encoding") {
+			continue
+		}
+		for _, v := range vv {
+			dst.Add(k, v)
+		}
+	}
+}
+
+type flushWriter struct {
+	w io.Writer
+	f http.Flusher
+}
+
+func (fw flushWriter) Write(p []byte) (int, error) {
+	n, err := fw.w.Write(p)
+	if fw.f != nil {
+		fw.f.Flush()
+	}
+	return n, err
+}
+
+func logging(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		start := time.Now()
+		next.ServeHTTP(w, r)
+		log.Printf("%s %s remote=%s %s", r.Method, r.RequestURI, r.RemoteAddr, time.Since(start).Truncate(time.Millisecond))
+	})
+}
diff --git a/examples/web-capture/cmd/gateway/sessions.go b/examples/web-capture/cmd/gateway/sessions.go
new file mode 100644
index 000000000..bd779134a
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/sessions.go
@@ -0,0 +1,338 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"net/url"
+	"strings"
+	"sync"
+	"time"
+)
+
+var errOverCapacity = errors.New("session capacity reached")
+
+// skitClient talks to the skit dynamic-session REST API.
+type skitClient struct {
+	client  *http.Client
+	baseURL string
+	token   string
+}
+
+func (c *skitClient) auth(req *http.Request) {
+	if c.token != "" {
+		req.Header.Set("Authorization", "Bearer "+c.token)
+	}
+}
+
+func (c *skitClient) createSession(ctx context.Context, yaml string) (string, error) {
+	payload, err := json.Marshal(struct {
+		YAML string `json:"yaml"`
+	}{yaml})
+	if err != nil {
+		return "", err
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, c.baseURL+"/api/v1/sessions", bytes.NewReader(payload))
+	if err != nil {
+		return "", err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	c.auth(req)
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusCreated {
+		b, _ := io.ReadAll(io.LimitReader(resp.Body, 2048))
+		return "", fmt.Errorf("create session: status %d: %s", resp.StatusCode, strings.TrimSpace(string(b)))
+	}
+	var out struct {
+		SessionID string `json:"session_id"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
+		return "", fmt.Errorf("decode session response: %w", err)
+	}
+	if out.SessionID == "" {
+		return "", errors.New("empty session_id in response")
+	}
+	return out.SessionID, nil
+}
+
+func (c *skitClient) destroySession(ctx context.Context, id string) error {
+	req, err := http.NewRequestWithContext(ctx, http.MethodDelete, c.baseURL+"/api/v1/sessions/"+url.PathEscape(id), nil)
+	if err != nil {
+		return err
+	}
+	c.auth(req)
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = resp.Body.Close() }()
+	_, _ = io.Copy(io.Discard, io.LimitReader(resp.Body, 4096))
+	// A 404 means the session is already gone — the desired end state.
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusNotFound {
+		return fmt.Errorf("destroy session: status %d", resp.StatusCode)
+	}
+	return nil
+}
+
+func (c *skitClient) listSessionIDs(ctx context.Context) (map[string]bool, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, c.baseURL+"/api/v1/sessions", nil)
+	if err != nil {
+		return nil, err
+	}
+	c.auth(req)
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("list sessions: status %d", resp.StatusCode)
+	}
+	var arr []struct {
+		ID string `json:"id"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&arr); err != nil {
+		return nil, err
+	}
+	ids := make(map[string]bool, len(arr))
+	for _, s := range arr {
+		ids[s.ID] = true
+	}
+	return ids, nil
+}
+
+func (c *skitClient) streamURL(id string) string {
+	return c.baseURL + "/mse/" + url.PathEscape(id) + "/video"
+}
+
+// liveSession is one running cast pipeline, shared by all viewers of the same
+// normalized URL. ready is closed once creation resolves (id set or createErr).
+type liveSession struct {
+	id         string
+	key        string
+	viewers    int
+	createdAt  time.Time
+	idleSince  time.Time // set when viewers drops to 0; zero while viewers > 0
+	reapReason string
+	ready      chan struct{}
+	createErr  error
+}
+
+// sessionManager owns cast pipeline lifetime. The engine does NOT auto-stop a
+// pipeline when its MSE viewers disconnect, so the gateway must: dedupe by URL,
+// refcount viewers, and reap idle / over-aged sessions via DELETE. The zero
+// value is not usable — construct via newSessionManager.
+type sessionManager struct {
+	mu          sync.Mutex
+	sessions    map[string]*liveSession // key (normalized URL) -> session
+	byID        map[string]*liveSession
+	skit        *skitClient
+	maxSessions int
+	idleTTL     time.Duration
+	maxLifetime time.Duration
+	createTO    time.Duration
+	now         func() time.Time
+}
+
+func newSessionManager(skit *skitClient, maxSessions int, idleTTL, maxLifetime time.Duration) *sessionManager {
+	return &sessionManager{
+		sessions:    make(map[string]*liveSession),
+		byID:        make(map[string]*liveSession),
+		skit:        skit,
+		maxSessions: maxSessions,
+		idleTTL:     idleTTL,
+		maxLifetime: maxLifetime,
+		createTO:    15 * time.Second,
+		now:         time.Now,
+	}
+}
+
+func (m *sessionManager) updateGaugesLocked() {
+	activeSessions.Set(float64(len(m.sessions)))
+	viewers := 0
+	for _, s := range m.sessions {
+		viewers += s.viewers
+	}
+	activeViewers.Set(float64(viewers))
+}
+
+// acquire returns a ready session for key, creating one (and the skit pipeline)
+// if none exists. The caller must call release exactly once when its viewer
+// connection ends.
+func (m *sessionManager) acquire(ctx context.Context, key, yaml string) (*liveSession, error) {
+	m.mu.Lock()
+	if s := m.sessions[key]; s != nil {
+		s.viewers++
+		s.idleSince = time.Time{}
+		m.updateGaugesLocked()
+		m.mu.Unlock()
+		select {
+		case <-s.ready:
+			if s.createErr != nil {
+				m.release(s)
+				return nil, s.createErr
+			}
+			return s, nil
+		case <-ctx.Done():
+			m.release(s)
+			return nil, ctx.Err()
+		}
+	}
+	if len(m.sessions) >= m.maxSessions {
+		m.mu.Unlock()
+		return nil, errOverCapacity
+	}
+	s := &liveSession{key: key, viewers: 1, createdAt: m.now(), ready: make(chan struct{})}
+	m.sessions[key] = s
+	m.updateGaugesLocked()
+	m.mu.Unlock()
+
+	// Bound the create call independently of the (possibly long-lived) viewer ctx.
+	cctx, cancel := context.WithTimeout(ctx, m.createTO)
+	defer cancel()
+	id, err := m.skit.createSession(cctx, yaml)
+
+	m.mu.Lock()
+	if err != nil {
+		delete(m.sessions, key)
+		s.createErr = err
+		m.updateGaugesLocked()
+		m.mu.Unlock()
+		close(s.ready)
+		return nil, err
+	}
+	s.id = id
+	m.byID[id] = s
+	m.mu.Unlock()
+	close(s.ready)
+	log.Printf("cast: session %s created (key=%q)", id, key)
+	return s, nil
+}
+
+func (m *sessionManager) release(s *liveSession) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if s.viewers > 0 {
+		s.viewers--
+	}
+	if s.viewers == 0 {
+		s.idleSince = m.now()
+	}
+	m.updateGaugesLocked()
+	log.Printf("cast: viewer left %s (viewers=%d)", s.id, s.viewers)
+}
+
+// reap tears down idle and over-aged sessions, then reconciles bookkeeping
+// against the server's actual session list.
+func (m *sessionManager) reap(ctx context.Context) {
+	now := m.now()
+	var toDestroy []*liveSession
+
+	m.mu.Lock()
+	for key, s := range m.sessions {
+		if s.id == "" {
+			continue // still being created
+		}
+		switch {
+		case s.viewers == 0 && !s.idleSince.IsZero() && now.Sub(s.idleSince) >= m.idleTTL:
+			s.reapReason = "idle"
+		case now.Sub(s.createdAt) >= m.maxLifetime:
+			s.reapReason = "max_lifetime"
+		default:
+			continue
+		}
+		delete(m.sessions, key)
+		delete(m.byID, s.id)
+		toDestroy = append(toDestroy, s)
+	}
+	m.updateGaugesLocked()
+	m.mu.Unlock()
+
+	for _, s := range toDestroy {
+		m.destroy(ctx, s)
+	}
+	m.reconcile(ctx)
+}
+
+func (m *sessionManager) destroy(ctx context.Context, s *liveSession) {
+	dctx, cancel := context.WithTimeout(ctx, m.createTO)
+	defer cancel()
+	if err := m.skit.destroySession(dctx, s.id); err != nil {
+		log.Printf("destroy session %s: %v", s.id, err)
+	}
+	sessionsReaped.WithLabelValues(s.reapReason).Inc()
+	sessionLifetime.Observe(m.now().Sub(s.createdAt).Seconds())
+	log.Printf("cast: reaped session %s (reason=%s)", s.id, s.reapReason)
+}
+
+// reconcile drops sessions the server no longer has (e.g. it failed or was
+// removed out of band), so the gateway's view self-heals.
+func (m *sessionManager) reconcile(ctx context.Context) {
+	lctx, cancel := context.WithTimeout(ctx, m.createTO)
+	defer cancel()
+	ids, err := m.skit.listSessionIDs(lctx)
+	if err != nil {
+		return // best effort
+	}
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	for key, s := range m.sessions {
+		if s.id == "" {
+			continue
+		}
+		if !ids[s.id] {
+			log.Printf("reconcile: session %s gone server-side, dropping", s.id)
+			delete(m.sessions, key)
+			delete(m.byID, s.id)
+		}
+	}
+	m.updateGaugesLocked()
+}
+
+func (m *sessionManager) runReaper(ctx context.Context, interval time.Duration) {
+	t := time.NewTicker(interval)
+	defer t.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+			m.reap(ctx)
+		}
+	}
+}
+
+// shutdownAll destroys every owned session so a deploy/restart never leaks
+// Servo pipelines.
+func (m *sessionManager) shutdownAll(ctx context.Context) {
+	m.mu.Lock()
+	all := make([]*liveSession, 0, len(m.sessions))
+	for _, s := range m.sessions {
+		if s.id != "" {
+			s.reapReason = "shutdown"
+			all = append(all, s)
+		}
+	}
+	m.sessions = make(map[string]*liveSession)
+	m.byID = make(map[string]*liveSession)
+	m.updateGaugesLocked()
+	m.mu.Unlock()
+
+	for _, s := range all {
+		m.destroy(ctx, s)
+	}
+}
diff --git a/examples/web-capture/cmd/gateway/sessions_test.go b/examples/web-capture/cmd/gateway/sessions_test.go
new file mode 100644
index 000000000..f2b0a5018
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/sessions_test.go
@@ -0,0 +1,183 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+)
+
+// mockSkit stands in for the skit dynamic-session API and counts create/destroy.
+type mockSkit struct {
+	mu       sync.Mutex
+	creates  int
+	destroys int
+	live     map[string]bool
+	nextID   int
+}
+
+func newMockSkit() (*mockSkit, *httptest.Server) {
+	ms := &mockSkit{live: map[string]bool{}}
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		ms.mu.Lock()
+		defer ms.mu.Unlock()
+		switch {
+		case r.Method == http.MethodPost && r.URL.Path == "/api/v1/sessions":
+			ms.creates++
+			ms.nextID++
+			id := fmt.Sprintf("sess-%d", ms.nextID)
+			ms.live[id] = true
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = fmt.Fprintf(w, `{"session_id":%q}`, id)
+		case r.Method == http.MethodDelete && strings.HasPrefix(r.URL.Path, "/api/v1/sessions/"):
+			ms.destroys++
+			delete(ms.live, strings.TrimPrefix(r.URL.Path, "/api/v1/sessions/"))
+			w.WriteHeader(http.StatusOK)
+		case r.Method == http.MethodGet && r.URL.Path == "/api/v1/sessions":
+			w.Header().Set("Content-Type", "application/json")
+			parts := make([]string, 0, len(ms.live))
+			for id := range ms.live {
+				parts = append(parts, fmt.Sprintf(`{"id":%q}`, id))
+			}
+			_, _ = fmt.Fprintf(w, "[%s]", strings.Join(parts, ","))
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	return ms, srv
+}
+
+func (ms *mockSkit) counts() (int, int) {
+	ms.mu.Lock()
+	defer ms.mu.Unlock()
+	return ms.creates, ms.destroys
+}
+
+func (ms *mockSkit) liveCount() int {
+	ms.mu.Lock()
+	defer ms.mu.Unlock()
+	return len(ms.live)
+}
+
+type fakeClock struct{ t time.Time }
+
+func (c *fakeClock) now() time.Time          { return c.t }
+func (c *fakeClock) advance(d time.Duration) { c.t = c.t.Add(d) }
+
+func newTestManager(srv *httptest.Server, maxSessions int, idle, maxLife time.Duration) (*sessionManager, *fakeClock) {
+	m := newSessionManager(&skitClient{client: srv.Client(), baseURL: srv.URL}, maxSessions, idle, maxLife)
+	clock := &fakeClock{t: time.Unix(1_000_000, 0)}
+	m.now = clock.now
+	return m, clock
+}
+
+func TestSessionManagerDedupeAndIdleReap(t *testing.T) {
+	ms, srv := newMockSkit()
+	defer srv.Close()
+	m, clock := newTestManager(srv, 4, 30*time.Second, time.Hour)
+	ctx := context.Background()
+
+	s1, err := m.acquire(ctx, "https://a.example", "yaml")
+	if err != nil {
+		t.Fatal(err)
+	}
+	s2, err := m.acquire(ctx, "https://a.example", "yaml")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if s1 != s2 {
+		t.Fatal("expected the same session to be reused for the same URL")
+	}
+	if c, _ := ms.counts(); c != 1 {
+		t.Fatalf("expected 1 create, got %d", c)
+	}
+	if s1.viewers != 2 {
+		t.Fatalf("viewers=%d want 2", s1.viewers)
+	}
+
+	m.release(s1)
+	m.release(s2)
+	if s1.viewers != 0 {
+		t.Fatalf("viewers=%d want 0", s1.viewers)
+	}
+
+	clock.advance(10 * time.Second)
+	m.reap(ctx)
+	if _, d := ms.counts(); d != 0 {
+		t.Fatalf("premature destroy: %d", d)
+	}
+
+	clock.advance(30 * time.Second)
+	m.reap(ctx)
+	if _, d := ms.counts(); d != 1 {
+		t.Fatalf("expected 1 destroy after idle TTL, got %d", d)
+	}
+	if ms.liveCount() != 0 {
+		t.Fatalf("server still has %d sessions", ms.liveCount())
+	}
+}
+
+func TestSessionManagerOverCapacity(t *testing.T) {
+	ms, srv := newMockSkit()
+	defer srv.Close()
+	m, _ := newTestManager(srv, 1, time.Hour, time.Hour)
+	ctx := context.Background()
+
+	if _, err := m.acquire(ctx, "https://a.example", "y"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := m.acquire(ctx, "https://b.example", "y"); !errors.Is(err, errOverCapacity) {
+		t.Fatalf("expected errOverCapacity, got %v", err)
+	}
+	if c, _ := ms.counts(); c != 1 {
+		t.Fatalf("expected exactly 1 create, got %d", c)
+	}
+}
+
+func TestSessionManagerMaxLifetimeReapsActiveViewer(t *testing.T) {
+	ms, srv := newMockSkit()
+	defer srv.Close()
+	m, clock := newTestManager(srv, 4, time.Hour, 10*time.Second)
+	ctx := context.Background()
+
+	// Acquire and keep the viewer (never release): the max-lifetime cap must
+	// still tear the session down.
+	if _, err := m.acquire(ctx, "https://a.example", "y"); err != nil {
+		t.Fatal(err)
+	}
+	clock.advance(11 * time.Second)
+	m.reap(ctx)
+	if _, d := ms.counts(); d != 1 {
+		t.Fatalf("expected max-lifetime reap, got %d destroys", d)
+	}
+}
+
+func TestSessionManagerShutdownAll(t *testing.T) {
+	ms, srv := newMockSkit()
+	defer srv.Close()
+	m, _ := newTestManager(srv, 4, time.Hour, time.Hour)
+	ctx := context.Background()
+
+	if _, err := m.acquire(ctx, "https://a.example", "y"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := m.acquire(ctx, "https://b.example", "y"); err != nil {
+		t.Fatal(err)
+	}
+	m.shutdownAll(ctx)
+	if _, d := ms.counts(); d != 2 {
+		t.Fatalf("expected 2 destroys, got %d", d)
+	}
+	if ms.liveCount() != 0 {
+		t.Fatalf("server still has %d sessions", ms.liveCount())
+	}
+}
diff --git a/examples/web-capture/go.mod b/examples/web-capture/go.mod
new file mode 100644
index 000000000..b04cd4828
--- /dev/null
+++ b/examples/web-capture/go.mod
@@ -0,0 +1,18 @@
+module github.com/streamer45/streamkit/examples/web-capture
+
+go 1.24
+
+require github.com/prometheus/client_golang v1.23.2
+
+require (
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/kr/text v0.2.0 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.66.1 // indirect
+	github.com/prometheus/procfs v0.16.1 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	golang.org/x/sys v0.35.0 // indirect
+	google.golang.org/protobuf v1.36.8 // indirect
+)
diff --git a/examples/web-capture/go.sum b/examples/web-capture/go.sum
new file mode 100644
index 000000000..d6b8ca98b
--- /dev/null
+++ b/examples/web-capture/go.sum
@@ -0,0 +1,46 @@
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
+github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
+github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
+github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
+github.com/prometheus/common v0.66.1 h1:h5E0h5/Y8niHc5DlaLlWLArTQI7tMrsfQjHV+d9ZoGs=
+github.com/prometheus/common v0.66.1/go.mod h1:gcaUsgf3KfRSwHY4dIMXLPV0K/Wg1oZ8+SbZk/HH/dA=
+github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg=
+github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is=
+github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
+github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
+golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
+google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

From 0dedcd699794acd92a5b14e118c419b07b8c318a Mon Sep 17 00:00:00 2001
From: streamer45 <cstcld91@gmail.com>
Date: Sat, 27 Jun 2026 14:39:17 +0200
Subject: [PATCH 02/26] fix(web-capture): harden SSRF, session lifetime, and
 clip concurrency

Addresses code-review findings on the gateway:

- SSRF guard: also block 0.0.0.0/8, 198.18.0.0/15, and the IPv4 embedded in
  NAT64 (64:ff9b::/96) and 6to4 (2002::/16) IPv6 addresses.
- cast sessions: create on a background context so a creator disconnecting
  mid-create no longer fails the other deduped viewers (and the create error
  can't masquerade as a viewer "client gave up"); cap viewers up front with a
  clean 503 instead of failing downstream at max_clients; drop the reconcile
  step that could abandon a live session on a transient list miss.
- clip: acquireClip now observes client disconnect (no unbounded queueing on a
  full slot channel), and clip length rounds to whole frames instead of
  truncating sub-second durations.
- proxyMSE reuses a single retry timer; collapse the two near-identical HTTP
  clients into one; document the upstream-status guard (it prevents a
  WriteHeader panic). Fix README idle-TTL default (30, not 45).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: streamer45 <cstcld91@gmail.com>
---
 examples/web-capture/README.md                |  2 +-
 examples/web-capture/cmd/gateway/capture.go   | 52 +++++++++++---
 .../web-capture/cmd/gateway/capture_test.go   | 19 +++++
 examples/web-capture/cmd/gateway/main.go      | 37 ++++++----
 examples/web-capture/cmd/gateway/proxy.go     | 46 ++++++-------
 examples/web-capture/cmd/gateway/sessions.go  | 69 ++++---------------
 .../web-capture/cmd/gateway/sessions_test.go  | 19 ++++-
 7 files changed, 138 insertions(+), 106 deletions(-)

diff --git a/examples/web-capture/README.md b/examples/web-capture/README.md
index 414bddc9e..531b935d6 100644
--- a/examples/web-capture/README.md
+++ b/examples/web-capture/README.md
@@ -85,7 +85,7 @@ xdg-open 'http://127.0.0.1:8080/cast/example.com'
 | `GATEWAY_CLIP_MAX_SECS` | `--clip-max-secs` | 60 | Maximum clip duration |
 | `GATEWAY_MAX_SESSIONS` | `--max-sessions` | 8 | Max concurrent live cast sessions |
 | `GATEWAY_MAX_VIEWERS` | `--max-viewers` | 10 | Max viewers per cast stream |
-| `GATEWAY_SESSION_IDLE_SECS` | `--session-idle-secs` | 45 | Idle grace before a viewerless session is reaped |
+| `GATEWAY_SESSION_IDLE_SECS` | `--session-idle-secs` | 30 | Idle grace before a viewerless session is reaped |
 | `GATEWAY_SESSION_MAX_SECS` | `--session-max-secs` | 1800 | Hard cap on a session's lifetime |
 | `GATEWAY_RESOLUTION` | `--resolution` | `1920x1080` | Capture resolution WxH (render = encode, 1:1) |
 | `GATEWAY_CLIP_BITRATE_KBPS` | `--clip-bitrate-kbps` | `10000` | Clip video bitrate (kbps) |
diff --git a/examples/web-capture/cmd/gateway/capture.go b/examples/web-capture/cmd/gateway/capture.go
index 8441b592a..06645bd62 100644
--- a/examples/web-capture/cmd/gateway/capture.go
+++ b/examples/web-capture/cmd/gateway/capture.go
@@ -227,21 +227,55 @@ func validateTarget(ctx context.Context, raw string) (*url.URL, error) {
 }
 
 func isBlockedIP(ip net.IP) bool {
-	return ip.IsLoopback() ||
+	if ip.IsLoopback() ||
 		ip.IsPrivate() ||
 		ip.IsUnspecified() ||
 		ip.IsLinkLocalUnicast() ||
 		ip.IsLinkLocalMulticast() ||
 		ip.IsInterfaceLocalMulticast() ||
-		ip.IsMulticast() ||
-		isCGNAT(ip)
-}
-
-// isCGNAT reports whether ip is in the carrier-grade NAT range 100.64.0.0/10,
-// which net.IP.IsPrivate does not cover.
-func isCGNAT(ip net.IP) bool {
+		ip.IsMulticast() {
+		return true
+	}
 	if v4 := ip.To4(); v4 != nil {
-		return v4[0] == 100 && v4[1]&0xc0 == 64
+		return blockedV4(v4)
+	}
+	// IPv6 forms that embed an internal IPv4 (NAT64, 6to4) dodge the v4 checks
+	// above — extract the embedded address and re-check it.
+	if v4 := embeddedV4(ip); v4 != nil {
+		return isBlockedIP(v4)
 	}
 	return false
 }
+
+// blockedV4 covers reserved IPv4 ranges that the net.IP predicates miss.
+func blockedV4(v4 net.IP) bool {
+	switch {
+	case v4[0] == 0: // 0.0.0.0/8 "this host" — 0.0.0.1 reaches localhost on Linux
+		return true
+	case v4[0] == 100 && v4[1]&0xc0 == 64: // 100.64.0.0/10 CGNAT
+		return true
+	case v4[0] == 198 && v4[1]&0xfe == 18: // 198.18.0.0/15 benchmarking
+		return true
+	default:
+		return false
+	}
+}
+
+// embeddedV4 returns the IPv4 embedded in a NAT64 (64:ff9b::/96) or 6to4
+// (2002::/16) address, or nil for anything else.
+func embeddedV4(ip net.IP) net.IP {
+	v6 := ip.To16()
+	if v6 == nil || ip.To4() != nil {
+		return nil
+	}
+	nat64 := v6[0] == 0x00 && v6[1] == 0x64 && v6[2] == 0xff && v6[3] == 0x9b &&
+		v6[4] == 0 && v6[5] == 0 && v6[6] == 0 && v6[7] == 0 &&
+		v6[8] == 0 && v6[9] == 0 && v6[10] == 0 && v6[11] == 0
+	if nat64 {
+		return net.IPv4(v6[12], v6[13], v6[14], v6[15])
+	}
+	if v6[0] == 0x20 && v6[1] == 0x02 { // 6to4
+		return net.IPv4(v6[2], v6[3], v6[4], v6[5])
+	}
+	return nil
+}
diff --git a/examples/web-capture/cmd/gateway/capture_test.go b/examples/web-capture/cmd/gateway/capture_test.go
index b52391674..7deef88fe 100644
--- a/examples/web-capture/cmd/gateway/capture_test.go
+++ b/examples/web-capture/cmd/gateway/capture_test.go
@@ -106,6 +106,20 @@ func TestDetectModeThenParseWithOptions(t *testing.T) {
 	}
 }
 
+func TestClipFrames(t *testing.T) {
+	cases := map[time.Duration]int{
+		10 * time.Second:        300,
+		1500 * time.Millisecond: 45, // would truncate to 30 (1s) without rounding
+		500 * time.Millisecond:  15,
+		5 * time.Millisecond:    1, // rounds to 0 -> clamped to 1
+	}
+	for dur, want := range cases {
+		if got := clipFrames(dur); got != want {
+			t.Errorf("clipFrames(%v)=%d want %d", dur, got, want)
+		}
+	}
+}
+
 func TestValidateTarget(t *testing.T) {
 	// IP literals resolve without DNS, so these run offline.
 	cases := []struct {
@@ -119,6 +133,11 @@ func TestValidateTarget(t *testing.T) {
 		{"http://172.16.0.1", true},
 		{"http://100.64.0.1", true}, // CGNAT
 		{"http://0.0.0.0", true},
+		{"http://0.0.0.1", true},              // 0.0.0.0/8 "this host"
+		{"http://198.18.0.1", true},           // 198.18.0.0/15 benchmarking
+		{"http://[64:ff9b::7f00:1]", true},    // NAT64 of 127.0.0.1
+		{"http://[2002:7f00:1::]", true},      // 6to4 embedding 127.0.0.1
+		{"https://[64:ff9b::808:808]", false}, // NAT64 of public 8.8.8.8 — allowed
 		{"http://[::1]", true},
 		{"ftp://8.8.8.8", true}, // scheme
 		{"https://8.8.8.8", false},
diff --git a/examples/web-capture/cmd/gateway/main.go b/examples/web-capture/cmd/gateway/main.go
index 7cede74d1..e02629eb0 100644
--- a/examples/web-capture/cmd/gateway/main.go
+++ b/examples/web-capture/cmd/gateway/main.go
@@ -13,6 +13,7 @@ import (
 	"fmt"
 	"io"
 	"log"
+	"math"
 	"net/http"
 	"net/url"
 	"os"
@@ -96,11 +97,11 @@ func main() {
 		log.Fatalf("invalid --cast-encoder: %v", err)
 	}
 
-	ctrlClient := newHTTPClient()
+	ctrlClient := newHTTPClient(false)
 	skit := &skitClient{client: ctrlClient, baseURL: cfg.skitURL, token: cfg.authToken}
 	gw := &gateway{
 		client:          ctrlClient,
-		streamClient:    newStreamClient(),
+		streamClient:    newHTTPClient(true),
 		skitURL:         cfg.skitURL,
 		authToken:       cfg.authToken,
 		clipSem:         make(chan struct{}, cfg.maxConcurrency),
@@ -115,7 +116,7 @@ func main() {
 		maxViewers:      cfg.maxViewers,
 		mseReadyTimeout: 8 * time.Second,
 		skit:            skit,
-		sessions:        newSessionManager(skit, cfg.maxSessions, cfg.idleTTL, cfg.maxLifetime),
+		sessions:        newSessionManager(skit, cfg.maxSessions, cfg.maxViewers, cfg.idleTTL, cfg.maxLifetime),
 	}
 	log.Printf("encoders: clip=%s cast=%s", cfg.clipEncoder, cfg.castEncoder)
 
@@ -280,14 +281,13 @@ func (gw *gateway) serveClip(w http.ResponseWriter, r *http.Request, u *url.URL,
 	if dur <= 0 {
 		dur = gw.clipDefaultDur
 	}
-	release := gw.acquireClip()
+	release, ok := gw.acquireClip(r.Context())
+	if !ok {
+		return // client disconnected while queued for a slot
+	}
 	defer release()
 
-	frames := int(dur.Seconds()) * captureFPS
-	if frames < 1 {
-		frames = captureFPS
-	}
-	yaml := renderClipPipeline(u.String(), opts.resW, opts.resH, captureFPS, frames, gw.clipBitrate, gw.clipEnc)
+	yaml := renderClipPipeline(u.String(), opts.resW, opts.resH, captureFPS, clipFrames(dur), gw.clipBitrate, gw.clipEnc)
 	gw.proxyOneshot(w, r, yaml)
 }
 
@@ -321,7 +321,20 @@ func (gw *gateway) serveCast(w http.ResponseWriter, r *http.Request, u *url.URL,
 	gw.proxyMSE(w, r, s)
 }
 
-func (gw *gateway) acquireClip() func() {
-	gw.clipSem <- struct{}{}
-	return func() { <-gw.clipSem }
+// clipFrames rounds a duration to a whole number of frames (parseDuration
+// accepts sub-second values, so truncation would skew the clip length).
+func clipFrames(dur time.Duration) int {
+	frames := int(math.Round(dur.Seconds() * float64(captureFPS)))
+	return max(frames, 1)
+}
+
+// acquireClip takes a concurrency slot but bails if the client disconnects
+// while queued — otherwise abandoned requests pile up on a full channel.
+func (gw *gateway) acquireClip(ctx context.Context) (release func(), ok bool) {
+	select {
+	case gw.clipSem <- struct{}{}:
+		return func() { <-gw.clipSem }, true
+	case <-ctx.Done():
+		return func() {}, false
+	}
 }
diff --git a/examples/web-capture/cmd/gateway/proxy.go b/examples/web-capture/cmd/gateway/proxy.go
index 6b72b4ed0..d208c0461 100644
--- a/examples/web-capture/cmd/gateway/proxy.go
+++ b/examples/web-capture/cmd/gateway/proxy.go
@@ -19,32 +19,21 @@ import (
 	"time"
 )
 
-// newHTTPClient is used for oneshot renders and skit control calls. It has no
-// overall timeout (a clip render legitimately takes seconds) but disables
-// keep-alives so each call gets a fresh connection.
-func newHTTPClient() *http.Client {
-	tr := &http.Transport{
-		DialContext: (&net.Dialer{
-			Timeout:   5 * time.Second,
-			KeepAlive: 30 * time.Second,
-		}).DialContext,
-		DisableKeepAlives: true,
-		ForceAttemptHTTP2: false,
+// newHTTPClient builds a client with no overall timeout (oneshot renders take
+// seconds; MSE streams run until the viewer leaves). keepAlives is off for the
+// one-shot control/render calls so each gets a fresh connection, and on for the
+// long-lived MSE proxy.
+func newHTTPClient(keepAlives bool) *http.Client {
+	return &http.Client{
+		Transport: &http.Transport{
+			DialContext: (&net.Dialer{
+				Timeout:   5 * time.Second,
+				KeepAlive: 30 * time.Second,
+			}).DialContext,
+			DisableKeepAlives: !keepAlives,
+			ForceAttemptHTTP2: false,
+		},
 	}
-	return &http.Client{Transport: tr}
-}
-
-// newStreamClient proxies long-lived MSE streams: keep-alives on, no overall
-// timeout (the stream ends when the viewer disconnects).
-func newStreamClient() *http.Client {
-	tr := &http.Transport{
-		DialContext: (&net.Dialer{
-			Timeout:   5 * time.Second,
-			KeepAlive: 30 * time.Second,
-		}).DialContext,
-		ForceAttemptHTTP2: false,
-	}
-	return &http.Client{Transport: tr}
 }
 
 func (gw *gateway) authReq(req *http.Request) {
@@ -104,6 +93,9 @@ func (gw *gateway) proxyOneshot(w http.ResponseWriter, r *http.Request, pipeline
 	upstreamDuration.WithLabelValues("clip").Observe(time.Since(start).Seconds())
 	defer func() { _ = resp.Body.Close() }()
 
+	// A status outside [100,999] would panic w.WriteHeader below (Go rejects
+	// such codes), so treat a malformed upstream status as a backend fault
+	// before forwarding it.
 	if resp.StatusCode < 100 || resp.StatusCode > 999 {
 		gw.failUpstream(w, "clip", fmt.Errorf("invalid upstream status %d", resp.StatusCode))
 		return
@@ -131,6 +123,8 @@ func (gw *gateway) proxyMSE(w http.ResponseWriter, r *http.Request, s *liveSessi
 	ctx := r.Context()
 	streamURL := gw.skit.streamURL(s.id)
 	deadline := time.Now().Add(gw.mseReadyTimeout)
+	retry := time.NewTicker(200 * time.Millisecond)
+	defer retry.Stop()
 
 	var resp *http.Response
 	for {
@@ -163,7 +157,7 @@ func (gw *gateway) proxyMSE(w http.ResponseWriter, r *http.Request, s *liveSessi
 		select {
 		case <-ctx.Done():
 			return
-		case <-time.After(200 * time.Millisecond):
+		case <-retry.C:
 		}
 	}
 	defer func() { _ = resp.Body.Close() }()
diff --git a/examples/web-capture/cmd/gateway/sessions.go b/examples/web-capture/cmd/gateway/sessions.go
index bd779134a..ca96f2374 100644
--- a/examples/web-capture/cmd/gateway/sessions.go
+++ b/examples/web-capture/cmd/gateway/sessions.go
@@ -88,33 +88,6 @@ func (c *skitClient) destroySession(ctx context.Context, id string) error {
 	return nil
 }
 
-func (c *skitClient) listSessionIDs(ctx context.Context) (map[string]bool, error) {
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, c.baseURL+"/api/v1/sessions", nil)
-	if err != nil {
-		return nil, err
-	}
-	c.auth(req)
-	resp, err := c.client.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	defer func() { _ = resp.Body.Close() }()
-	if resp.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("list sessions: status %d", resp.StatusCode)
-	}
-	var arr []struct {
-		ID string `json:"id"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&arr); err != nil {
-		return nil, err
-	}
-	ids := make(map[string]bool, len(arr))
-	for _, s := range arr {
-		ids[s.ID] = true
-	}
-	return ids, nil
-}
-
 func (c *skitClient) streamURL(id string) string {
 	return c.baseURL + "/mse/" + url.PathEscape(id) + "/video"
 }
@@ -142,18 +115,20 @@ type sessionManager struct {
 	byID        map[string]*liveSession
 	skit        *skitClient
 	maxSessions int
+	maxViewers  int
 	idleTTL     time.Duration
 	maxLifetime time.Duration
 	createTO    time.Duration
 	now         func() time.Time
 }
 
-func newSessionManager(skit *skitClient, maxSessions int, idleTTL, maxLifetime time.Duration) *sessionManager {
+func newSessionManager(skit *skitClient, maxSessions, maxViewers int, idleTTL, maxLifetime time.Duration) *sessionManager {
 	return &sessionManager{
 		sessions:    make(map[string]*liveSession),
 		byID:        make(map[string]*liveSession),
 		skit:        skit,
 		maxSessions: maxSessions,
+		maxViewers:  maxViewers,
 		idleTTL:     idleTTL,
 		maxLifetime: maxLifetime,
 		createTO:    15 * time.Second,
@@ -176,6 +151,10 @@ func (m *sessionManager) updateGaugesLocked() {
 func (m *sessionManager) acquire(ctx context.Context, key, yaml string) (*liveSession, error) {
 	m.mu.Lock()
 	if s := m.sessions[key]; s != nil {
+		if s.viewers >= m.maxViewers {
+			m.mu.Unlock()
+			return nil, errOverCapacity // reject now rather than fail downstream at max_clients
+		}
 		s.viewers++
 		s.idleSince = time.Time{}
 		m.updateGaugesLocked()
@@ -201,8 +180,10 @@ func (m *sessionManager) acquire(ctx context.Context, key, yaml string) (*liveSe
 	m.updateGaugesLocked()
 	m.mu.Unlock()
 
-	// Bound the create call independently of the (possibly long-lived) viewer ctx.
-	cctx, cancel := context.WithTimeout(ctx, m.createTO)
+	// Create on a background context, NOT the first viewer's: if that viewer
+	// disconnects mid-create, the pipeline must still come up for the other
+	// deduped waiters (and createErr must not masquerade as context.Canceled).
+	cctx, cancel := context.WithTimeout(context.Background(), m.createTO)
 	defer cancel()
 	id, err := m.skit.createSession(cctx, yaml)
 
@@ -236,8 +217,7 @@ func (m *sessionManager) release(s *liveSession) {
 	log.Printf("cast: viewer left %s (viewers=%d)", s.id, s.viewers)
 }
 
-// reap tears down idle and over-aged sessions, then reconciles bookkeeping
-// against the server's actual session list.
+// reap tears down idle and over-aged sessions.
 func (m *sessionManager) reap(ctx context.Context) {
 	now := m.now()
 	var toDestroy []*liveSession
@@ -265,7 +245,6 @@ func (m *sessionManager) reap(ctx context.Context) {
 	for _, s := range toDestroy {
 		m.destroy(ctx, s)
 	}
-	m.reconcile(ctx)
 }
 
 func (m *sessionManager) destroy(ctx context.Context, s *liveSession) {
@@ -279,30 +258,6 @@ func (m *sessionManager) destroy(ctx context.Context, s *liveSession) {
 	log.Printf("cast: reaped session %s (reason=%s)", s.id, s.reapReason)
 }
 
-// reconcile drops sessions the server no longer has (e.g. it failed or was
-// removed out of band), so the gateway's view self-heals.
-func (m *sessionManager) reconcile(ctx context.Context) {
-	lctx, cancel := context.WithTimeout(ctx, m.createTO)
-	defer cancel()
-	ids, err := m.skit.listSessionIDs(lctx)
-	if err != nil {
-		return // best effort
-	}
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	for key, s := range m.sessions {
-		if s.id == "" {
-			continue
-		}
-		if !ids[s.id] {
-			log.Printf("reconcile: session %s gone server-side, dropping", s.id)
-			delete(m.sessions, key)
-			delete(m.byID, s.id)
-		}
-	}
-	m.updateGaugesLocked()
-}
-
 func (m *sessionManager) runReaper(ctx context.Context, interval time.Duration) {
 	t := time.NewTicker(interval)
 	defer t.Stop()
diff --git a/examples/web-capture/cmd/gateway/sessions_test.go b/examples/web-capture/cmd/gateway/sessions_test.go
index f2b0a5018..645670c9d 100644
--- a/examples/web-capture/cmd/gateway/sessions_test.go
+++ b/examples/web-capture/cmd/gateway/sessions_test.go
@@ -74,7 +74,7 @@ func (c *fakeClock) now() time.Time          { return c.t }
 func (c *fakeClock) advance(d time.Duration) { c.t = c.t.Add(d) }
 
 func newTestManager(srv *httptest.Server, maxSessions int, idle, maxLife time.Duration) (*sessionManager, *fakeClock) {
-	m := newSessionManager(&skitClient{client: srv.Client(), baseURL: srv.URL}, maxSessions, idle, maxLife)
+	m := newSessionManager(&skitClient{client: srv.Client(), baseURL: srv.URL}, maxSessions, 100, idle, maxLife)
 	clock := &fakeClock{t: time.Unix(1_000_000, 0)}
 	m.now = clock.now
 	return m, clock
@@ -161,6 +161,23 @@ func TestSessionManagerMaxLifetimeReapsActiveViewer(t *testing.T) {
 	}
 }
 
+func TestSessionManagerMaxViewers(t *testing.T) {
+	_, srv := newMockSkit()
+	defer srv.Close()
+	m := newSessionManager(&skitClient{client: srv.Client(), baseURL: srv.URL}, 4, 2, time.Hour, time.Hour)
+	ctx := context.Background()
+
+	if _, err := m.acquire(ctx, "https://a.example", "y"); err != nil { // creator (viewers=1)
+		t.Fatal(err)
+	}
+	if _, err := m.acquire(ctx, "https://a.example", "y"); err != nil { // 2nd viewer (=2)
+		t.Fatalf("2nd viewer: %v", err)
+	}
+	if _, err := m.acquire(ctx, "https://a.example", "y"); !errors.Is(err, errOverCapacity) {
+		t.Fatalf("3rd viewer: expected errOverCapacity, got %v", err)
+	}
+}
+
 func TestSessionManagerShutdownAll(t *testing.T) {
 	ms, srv := newMockSkit()
 	defer srv.Close()

From 5ca0f1ed8172b3075e4bc6ec9a8cc953e5be6cb6 Mon Sep 17 00:00:00 2001
From: streamer45 <cstcld91@gmail.com>
Date: Sat, 27 Jun 2026 14:54:35 +0200
Subject: [PATCH 03/26] refactor(web-capture): embed pipeline YAML from
 template files
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move the clip/cast pipeline skeletons out of Go string constants into
cmd/gateway/pipelines/*.yml.tmpl, embedded via go:embed — they now read as
standalone (commented) YAML that can be diffed and reviewed on their own.
Rendering is unchanged: the same placeholder substitution (URL still
strconv.Quote'd) and per-profile encoder-block injection. The small per-profile
encoder snippets stay in encoders.go since they're tied to the profile metadata.

Also tighten the cast tests to assert on the `frame_count:` param rather than
the bare word, so a comment mentioning it can't trip them.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: streamer45 <cstcld91@gmail.com>
---
 .../web-capture/cmd/gateway/encoders_test.go  |   2 +-
 examples/web-capture/cmd/gateway/pipelines.go | 109 ++----------------
 .../cmd/gateway/pipelines/cast.yml.tmpl       |  46 ++++++++
 .../cmd/gateway/pipelines/clip.yml.tmpl       |  47 ++++++++
 .../web-capture/cmd/gateway/pipelines_test.go |   2 +-
 5 files changed, 106 insertions(+), 100 deletions(-)
 create mode 100644 examples/web-capture/cmd/gateway/pipelines/cast.yml.tmpl
 create mode 100644 examples/web-capture/cmd/gateway/pipelines/clip.yml.tmpl

diff --git a/examples/web-capture/cmd/gateway/encoders_test.go b/examples/web-capture/cmd/gateway/encoders_test.go
index e38ed868f..a3832924c 100644
--- a/examples/web-capture/cmd/gateway/encoders_test.go
+++ b/examples/web-capture/cmd/gateway/encoders_test.go
@@ -57,7 +57,7 @@ func TestCastEncoderProfiles(t *testing.T) {
 				t.Errorf("%s: missing %q", name, w)
 			}
 		}
-		if strings.Contains(out, "frame_count") {
+		if strings.Contains(out, "frame_count:") {
 			t.Errorf("%s: cast must not bound frame_count", name)
 		}
 	}
diff --git a/examples/web-capture/cmd/gateway/pipelines.go b/examples/web-capture/cmd/gateway/pipelines.go
index 7808b243a..2719b36af 100644
--- a/examples/web-capture/cmd/gateway/pipelines.go
+++ b/examples/web-capture/cmd/gateway/pipelines.go
@@ -5,110 +5,23 @@
 package main
 
 import (
+	_ "embed"
 	"strconv"
 	"strings"
 )
 
-// Both pipelines render a web page with the Servo plugin. Servo emits RGBA8, so
-// pixel_convert -> nv12 is mandatory before any encoder. The target URL is
-// strconv.Quote'd into the YAML so a hostile URL cannot break out of the scalar.
-//
-// The page renders and is encoded at the SAME resolution (no viewport_* override
-// => Servo's viewport defaults to the output size), so there is no downscale to
-// blur text. A wider resolution also gives the page a roomier desktop layout.
-//
-// The encoder is a swappable profile (software default, hardware opt-in): the
-// {{ENCODER_BLOCK}} placeholder is replaced with the chosen encoder node, and
-// {{CONTENT_TYPE}} / {{MUX_CODEC}} follow from it. See encoders.go.
+// The clip (oneshot MP4) and cast (live WebM) pipelines are embedded as YAML
+// templates from pipelines/. Each renders and encodes at one resolution (no
+// downscale, so text stays crisp) and carries placeholders the render functions
+// substitute: {{URL}} (strconv.Quote'd so a hostile URL can't break out of the
+// scalar), dimensions/fps/bitrate, the {{ENCODER_BLOCK}} for the chosen profile,
+// and the {{CONTENT_TYPE}}/{{MUX_CODEC}} it implies. See encoders.go.
 
-// clip: bounded oneshot -> fragmented MP4 (mode: stream = moov-up-front, so it
-// plays inline as it renders) returned over http_output.
-const clipPipelineTemplate = `
-name: web-clip
-description: Render a web page to a short MP4 clip
-mode: oneshot
-attributes:
-  service: web-capture
-  mode: clip
-client:
-  input:
-    type: none
-  output:
-    type: video
-nodes:
-  web:
-    kind: plugin::native::servo
-    params:
-      url: {{URL}}
-      width: {{WIDTH}}
-      height: {{HEIGHT}}
-      fps: {{FPS}}
-      frame_count: {{FRAME_COUNT}}
-  pixel_convert:
-    kind: video::pixel_convert
-    params:
-      output_format: nv12
-    needs: web
-{{ENCODER_BLOCK}}
-  muxer:
-    kind: containers::mp4::muxer
-    params:
-      mode: stream
-      video_width: {{WIDTH}}
-      video_height: {{HEIGHT}}
-      video_codec: {{MUX_CODEC}}
-    needs: encoder
-  http_output:
-    kind: streamkit::http_output
-    params:
-      content_type: {{CONTENT_TYPE}}
-    needs: muxer
-`
+//go:embed pipelines/clip.yml.tmpl
+var clipPipelineTemplate string
 
-// cast: unbounded dynamic session -> live WebM over HTTP MSE. frame_count is
-// omitted (0 = infinite). The WebM muxer auto-detects the codec (VP9/AV1) from
-// the encoded packets, so only the encoder and the advertised content_type
-// change between profiles.
-const castPipelineTemplate = `
-name: web-cast
-description: Render a web page to a live WebM stream
-mode: dynamic
-attributes:
-  service: web-capture
-  mode: cast
-client:
-  watch:
-    mse_path: /video
-    video: true
-nodes:
-  web:
-    kind: plugin::native::servo
-    params:
-      url: {{URL}}
-      width: {{WIDTH}}
-      height: {{HEIGHT}}
-      fps: {{FPS}}
-  pixel_convert:
-    kind: video::pixel_convert
-    params:
-      output_format: nv12
-    needs: web
-{{ENCODER_BLOCK}}
-  muxer:
-    kind: containers::webm::muxer
-    params:
-      video_width: {{WIDTH}}
-      video_height: {{HEIGHT}}
-      streaming_mode: live
-    needs: encoder
-  http_mse:
-    kind: transport::http::mse
-    params:
-      path: /video
-      max_clients: {{MAX_CLIENTS}}
-      content_type: {{CONTENT_TYPE}}
-    needs: muxer
-`
+//go:embed pipelines/cast.yml.tmpl
+var castPipelineTemplate string
 
 func renderClipPipeline(targetURL string, resW, resH, fps, frameCount, brKbps int, enc encoderProfile) string {
 	tmpl := strings.Replace(clipPipelineTemplate, "{{ENCODER_BLOCK}}", enc.block, 1)
diff --git a/examples/web-capture/cmd/gateway/pipelines/cast.yml.tmpl b/examples/web-capture/cmd/gateway/pipelines/cast.yml.tmpl
new file mode 100644
index 000000000..7ab3455bb
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/pipelines/cast.yml.tmpl
@@ -0,0 +1,46 @@
+# SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+#
+# SPDX-License-Identifier: MPL-2.0
+
+# Dynamic pipeline: render a web page to a live WebM stream over HTTP MSE.
+# Placeholders are substituted by renderCastPipeline (see pipelines.go); the
+# encoder node is injected per selected profile (see encoders.go).
+# The stream is unbounded (no frame limit); the WebM muxer auto-detects VP9/AV1.
+name: web-cast
+description: Render a web page to a live WebM stream
+mode: dynamic
+attributes:
+  service: web-capture
+  mode: cast
+client:
+  watch:
+    mse_path: /video
+    video: true
+nodes:
+  web:
+    kind: plugin::native::servo
+    params:
+      url: {{URL}}
+      width: {{WIDTH}}
+      height: {{HEIGHT}}
+      fps: {{FPS}}
+  pixel_convert:
+    kind: video::pixel_convert
+    params:
+      output_format: nv12
+    needs: web
+{{ENCODER_BLOCK}}
+  muxer:
+    kind: containers::webm::muxer
+    params:
+      video_width: {{WIDTH}}
+      video_height: {{HEIGHT}}
+      streaming_mode: live
+    needs: encoder
+  http_mse:
+    kind: transport::http::mse
+    params:
+      path: /video
+      max_clients: {{MAX_CLIENTS}}
+      content_type: {{CONTENT_TYPE}}
+    needs: muxer
diff --git a/examples/web-capture/cmd/gateway/pipelines/clip.yml.tmpl b/examples/web-capture/cmd/gateway/pipelines/clip.yml.tmpl
new file mode 100644
index 000000000..04359cb07
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/pipelines/clip.yml.tmpl
@@ -0,0 +1,47 @@
+# SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+#
+# SPDX-License-Identifier: MPL-2.0
+
+# Oneshot pipeline: render a web page to a short MP4 clip.
+# Placeholders are substituted by renderClipPipeline (see pipelines.go); the
+# encoder node is injected per selected profile (see encoders.go).
+# mp4 mode:stream = fragmented/progressive, so it plays inline as it renders.
+name: web-clip
+description: Render a web page to a short MP4 clip
+mode: oneshot
+attributes:
+  service: web-capture
+  mode: clip
+client:
+  input:
+    type: none
+  output:
+    type: video
+nodes:
+  web:
+    kind: plugin::native::servo
+    params:
+      url: {{URL}}
+      width: {{WIDTH}}
+      height: {{HEIGHT}}
+      fps: {{FPS}}
+      frame_count: {{FRAME_COUNT}}
+  pixel_convert:
+    kind: video::pixel_convert
+    params:
+      output_format: nv12
+    needs: web
+{{ENCODER_BLOCK}}
+  muxer:
+    kind: containers::mp4::muxer
+    params:
+      mode: stream
+      video_width: {{WIDTH}}
+      video_height: {{HEIGHT}}
+      video_codec: {{MUX_CODEC}}
+    needs: encoder
+  http_output:
+    kind: streamkit::http_output
+    params:
+      content_type: {{CONTENT_TYPE}}
+    needs: muxer
diff --git a/examples/web-capture/cmd/gateway/pipelines_test.go b/examples/web-capture/cmd/gateway/pipelines_test.go
index aa6f85201..04252fd5f 100644
--- a/examples/web-capture/cmd/gateway/pipelines_test.go
+++ b/examples/web-capture/cmd/gateway/pipelines_test.go
@@ -65,7 +65,7 @@ func TestRenderCastPipeline(t *testing.T) {
 			t.Errorf("cast pipeline missing %q", want)
 		}
 	}
-	if strings.Contains(out, "frame_count") {
+	if strings.Contains(out, "frame_count:") {
 		t.Error("cast pipeline must not bound frame_count (live is infinite)")
 	}
 }

From 170061fb12420ed5fe376a27176d8362fc61b02c Mon Sep 17 00:00:00 2001
From: streamer45 <cstcld91@gmail.com>
Date: Sat, 27 Jun 2026 15:10:53 +0200
Subject: [PATCH 04/26] fix(web-capture): close shutdown/create race, proxy +
 log correctness
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Second review pass on the gateway:

- shutdownAll no longer leaks a session whose creation is in flight at SIGTERM:
  it marks the manager closed and waits each session's ready channel so it has
  an id to DELETE; acquire rejects new requests once closed. Previously an
  id-less in-flight session was skipped and re-registered after the maps were
  cleared, so its backend pipeline was never torn down.
- streamCopy only logs a copy error when the client is still connected — a
  normal cast disconnect (ctx canceled / closed body) is no longer logged as an
  error, which otherwise floods the log on a busy instance.
- copyHeaders strips the full hop-by-hop set (Connection, Upgrade, TE, Trailer,
  Keep-Alive, Proxy-*), not just Content-Length/Transfer-Encoding.
- serveCast renders the cast YAML lazily, so deduped viewers of an already-
  running stream don't do throwaway render work.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: streamer45 <cstcld91@gmail.com>
---
 examples/web-capture/cmd/gateway/main.go      | 12 ++-
 examples/web-capture/cmd/gateway/proxy.go     | 28 +++++-
 examples/web-capture/cmd/gateway/sessions.go  | 32 +++++--
 .../web-capture/cmd/gateway/sessions_test.go  | 94 +++++++++++++++++--
 4 files changed, 139 insertions(+), 27 deletions(-)

diff --git a/examples/web-capture/cmd/gateway/main.go b/examples/web-capture/cmd/gateway/main.go
index e02629eb0..bc26a2150 100644
--- a/examples/web-capture/cmd/gateway/main.go
+++ b/examples/web-capture/cmd/gateway/main.go
@@ -299,16 +299,20 @@ func (gw *gateway) serveCast(w http.ResponseWriter, r *http.Request, u *url.URL,
 		return
 	}
 
-	// Viewport is part of the render, so it keys the shared session: viewers of
-	// the same URL+viewport share one pipeline; a different viewport is its own.
+	// Resolution is part of the render, so it keys the shared session: viewers of
+	// the same URL+resolution share one pipeline; a different resolution is its
+	// own. The YAML renders lazily — only a session-creating acquire uses it.
 	key := fmt.Sprintf("%s|%dx%d", u.String(), opts.resW, opts.resH)
-	yaml := renderCastPipeline(u.String(), opts.resW, opts.resH, captureFPS, gw.maxViewers, gw.castBitrate, gw.castEnc)
-	s, err := gw.sessions.acquire(r.Context(), key, yaml)
+	s, err := gw.sessions.acquire(r.Context(), key, func() string {
+		return renderCastPipeline(u.String(), opts.resW, opts.resH, captureFPS, gw.maxViewers, gw.castBitrate, gw.castEnc)
+	})
 	if err != nil {
 		switch {
 		case errors.Is(err, errOverCapacity):
 			recordRejection("cast", reasonOverCapacity)
 			http.Error(w, "server at capacity, try again shortly", http.StatusServiceUnavailable)
+		case errors.Is(err, errShuttingDown):
+			http.Error(w, "server shutting down", http.StatusServiceUnavailable)
 		case errors.Is(err, context.Canceled):
 			// client gave up before the stream was ready
 		default:
diff --git a/examples/web-capture/cmd/gateway/proxy.go b/examples/web-capture/cmd/gateway/proxy.go
index d208c0461..70827a44e 100644
--- a/examples/web-capture/cmd/gateway/proxy.go
+++ b/examples/web-capture/cmd/gateway/proxy.go
@@ -113,7 +113,7 @@ func (gw *gateway) proxyOneshot(w http.ResponseWriter, r *http.Request, pipeline
 		w.Header().Set("Content-Type", "video/mp4")
 	}
 	w.WriteHeader(resp.StatusCode)
-	streamCopy(w, resp.Body, "clip")
+	streamCopy(ctx, w, resp.Body, "clip")
 }
 
 // proxyMSE streams a live WebM session to the viewer. The http_mse path only
@@ -177,17 +177,20 @@ func (gw *gateway) proxyMSE(w http.ResponseWriter, r *http.Request, s *liveSessi
 		w.Header().Set("Content-Type", "video/webm")
 	}
 	w.WriteHeader(http.StatusOK)
-	streamCopy(w, resp.Body, "cast")
+	streamCopy(ctx, w, resp.Body, "cast")
 }
 
 // streamCopy forwards an upstream body to the client, flushing each chunk so
 // live/progressive playback starts without waiting for the whole response.
-func streamCopy(w http.ResponseWriter, src io.Reader, endpoint string) {
+func streamCopy(ctx context.Context, w http.ResponseWriter, src io.Reader, endpoint string) {
 	var dst io.Writer = w
 	if flusher, ok := w.(http.Flusher); ok {
 		dst = flushWriter{w: w, f: flusher}
 	}
-	if _, err := io.Copy(dst, src); err != nil && !errors.Is(err, context.Canceled) {
+	// A client disconnect (ctx canceled, which also closes the upstream body) is
+	// the normal way a live stream ends; only log a copy error that happened
+	// while the client was still connected.
+	if _, err := io.Copy(dst, src); err != nil && ctx.Err() == nil {
 		log.Printf("%s copy response error: %v", endpoint, err)
 	}
 }
@@ -225,9 +228,24 @@ func acceptsHTML(r *http.Request) bool {
 	return strings.Contains(r.Header.Get("Accept"), "text/html")
 }
 
+// hopByHop headers are connection-scoped and must not be forwarded by a proxy
+// (RFC 7230 §6.1); Content-Length is also dropped since Go sets it from the
+// streamed body.
+var hopByHop = map[string]bool{
+	"connection":          true,
+	"keep-alive":          true,
+	"proxy-authenticate":  true,
+	"proxy-authorization": true,
+	"te":                  true,
+	"trailer":             true,
+	"transfer-encoding":   true,
+	"upgrade":             true,
+	"content-length":      true,
+}
+
 func copyHeaders(dst, src http.Header) {
 	for k, vv := range src {
-		if strings.EqualFold(k, "Content-Length") || strings.EqualFold(k, "Transfer-Encoding") {
+		if hopByHop[strings.ToLower(k)] {
 			continue
 		}
 		for _, v := range vv {
diff --git a/examples/web-capture/cmd/gateway/sessions.go b/examples/web-capture/cmd/gateway/sessions.go
index ca96f2374..be3dd9174 100644
--- a/examples/web-capture/cmd/gateway/sessions.go
+++ b/examples/web-capture/cmd/gateway/sessions.go
@@ -19,7 +19,10 @@ import (
 	"time"
 )
 
-var errOverCapacity = errors.New("session capacity reached")
+var (
+	errOverCapacity = errors.New("session capacity reached")
+	errShuttingDown = errors.New("gateway shutting down")
+)
 
 // skitClient talks to the skit dynamic-session REST API.
 type skitClient struct {
@@ -113,6 +116,7 @@ type sessionManager struct {
 	mu          sync.Mutex
 	sessions    map[string]*liveSession // key (normalized URL) -> session
 	byID        map[string]*liveSession
+	closed      bool
 	skit        *skitClient
 	maxSessions int
 	maxViewers  int
@@ -148,8 +152,12 @@ func (m *sessionManager) updateGaugesLocked() {
 // acquire returns a ready session for key, creating one (and the skit pipeline)
 // if none exists. The caller must call release exactly once when its viewer
 // connection ends.
-func (m *sessionManager) acquire(ctx context.Context, key, yaml string) (*liveSession, error) {
+func (m *sessionManager) acquire(ctx context.Context, key string, renderYAML func() string) (*liveSession, error) {
 	m.mu.Lock()
+	if m.closed {
+		m.mu.Unlock()
+		return nil, errShuttingDown
+	}
 	if s := m.sessions[key]; s != nil {
 		if s.viewers >= m.maxViewers {
 			m.mu.Unlock()
@@ -185,7 +193,7 @@ func (m *sessionManager) acquire(ctx context.Context, key, yaml string) (*liveSe
 	// deduped waiters (and createErr must not masquerade as context.Canceled).
 	cctx, cancel := context.WithTimeout(context.Background(), m.createTO)
 	defer cancel()
-	id, err := m.skit.createSession(cctx, yaml)
+	id, err := m.skit.createSession(cctx, renderYAML())
 
 	m.mu.Lock()
 	if err != nil {
@@ -275,12 +283,10 @@ func (m *sessionManager) runReaper(ctx context.Context, interval time.Duration)
 // Servo pipelines.
 func (m *sessionManager) shutdownAll(ctx context.Context) {
 	m.mu.Lock()
+	m.closed = true // reject new acquires; in-flight creates self-report via ready
 	all := make([]*liveSession, 0, len(m.sessions))
 	for _, s := range m.sessions {
-		if s.id != "" {
-			s.reapReason = "shutdown"
-			all = append(all, s)
-		}
+		all = append(all, s)
 	}
 	m.sessions = make(map[string]*liveSession)
 	m.byID = make(map[string]*liveSession)
@@ -288,6 +294,16 @@ func (m *sessionManager) shutdownAll(ctx context.Context) {
 	m.mu.Unlock()
 
 	for _, s := range all {
-		m.destroy(ctx, s)
+		// Wait for an in-flight creation to resolve so we have an id to DELETE;
+		// tearing down only id-bearing sessions would leak the rest's pipelines.
+		select {
+		case <-s.ready:
+		case <-ctx.Done():
+			return
+		}
+		if s.id != "" && s.createErr == nil {
+			s.reapReason = "shutdown"
+			m.destroy(ctx, s)
+		}
 	}
 }
diff --git a/examples/web-capture/cmd/gateway/sessions_test.go b/examples/web-capture/cmd/gateway/sessions_test.go
index 645670c9d..a98f2791c 100644
--- a/examples/web-capture/cmd/gateway/sessions_test.go
+++ b/examples/web-capture/cmd/gateway/sessions_test.go
@@ -12,6 +12,7 @@ import (
 	"net/http/httptest"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"testing"
 	"time"
 )
@@ -86,11 +87,11 @@ func TestSessionManagerDedupeAndIdleReap(t *testing.T) {
 	m, clock := newTestManager(srv, 4, 30*time.Second, time.Hour)
 	ctx := context.Background()
 
-	s1, err := m.acquire(ctx, "https://a.example", "yaml")
+	s1, err := m.acquire(ctx, "https://a.example", testYAML)
 	if err != nil {
 		t.Fatal(err)
 	}
-	s2, err := m.acquire(ctx, "https://a.example", "yaml")
+	s2, err := m.acquire(ctx, "https://a.example", testYAML)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -132,10 +133,10 @@ func TestSessionManagerOverCapacity(t *testing.T) {
 	m, _ := newTestManager(srv, 1, time.Hour, time.Hour)
 	ctx := context.Background()
 
-	if _, err := m.acquire(ctx, "https://a.example", "y"); err != nil {
+	if _, err := m.acquire(ctx, "https://a.example", testYAML); err != nil {
 		t.Fatal(err)
 	}
-	if _, err := m.acquire(ctx, "https://b.example", "y"); !errors.Is(err, errOverCapacity) {
+	if _, err := m.acquire(ctx, "https://b.example", testYAML); !errors.Is(err, errOverCapacity) {
 		t.Fatalf("expected errOverCapacity, got %v", err)
 	}
 	if c, _ := ms.counts(); c != 1 {
@@ -151,7 +152,7 @@ func TestSessionManagerMaxLifetimeReapsActiveViewer(t *testing.T) {
 
 	// Acquire and keep the viewer (never release): the max-lifetime cap must
 	// still tear the session down.
-	if _, err := m.acquire(ctx, "https://a.example", "y"); err != nil {
+	if _, err := m.acquire(ctx, "https://a.example", testYAML); err != nil {
 		t.Fatal(err)
 	}
 	clock.advance(11 * time.Second)
@@ -167,27 +168,100 @@ func TestSessionManagerMaxViewers(t *testing.T) {
 	m := newSessionManager(&skitClient{client: srv.Client(), baseURL: srv.URL}, 4, 2, time.Hour, time.Hour)
 	ctx := context.Background()
 
-	if _, err := m.acquire(ctx, "https://a.example", "y"); err != nil { // creator (viewers=1)
+	if _, err := m.acquire(ctx, "https://a.example", testYAML); err != nil { // creator (viewers=1)
 		t.Fatal(err)
 	}
-	if _, err := m.acquire(ctx, "https://a.example", "y"); err != nil { // 2nd viewer (=2)
+	if _, err := m.acquire(ctx, "https://a.example", testYAML); err != nil { // 2nd viewer (=2)
 		t.Fatalf("2nd viewer: %v", err)
 	}
-	if _, err := m.acquire(ctx, "https://a.example", "y"); !errors.Is(err, errOverCapacity) {
+	if _, err := m.acquire(ctx, "https://a.example", testYAML); !errors.Is(err, errOverCapacity) {
 		t.Fatalf("3rd viewer: expected errOverCapacity, got %v", err)
 	}
 }
 
+func testYAML() string { return "pipeline: yaml" }
+
+func TestSessionManagerRejectsAfterShutdown(t *testing.T) {
+	_, srv := newMockSkit()
+	defer srv.Close()
+	m := newSessionManager(&skitClient{client: srv.Client(), baseURL: srv.URL}, 4, 10, time.Hour, time.Hour)
+	m.closed = true
+	if _, err := m.acquire(context.Background(), "https://a.example", testYAML); !errors.Is(err, errShuttingDown) {
+		t.Fatalf("expected errShuttingDown, got %v", err)
+	}
+}
+
+// A session whose creation is in flight when shutdownAll runs must still be torn
+// down once creation resolves — otherwise its backend pipeline leaks.
+func TestSessionManagerShutdownDuringCreate(t *testing.T) {
+	release := make(chan struct{})
+	var created, destroyed atomic.Int32
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.Method == http.MethodPost && r.URL.Path == "/api/v1/sessions":
+			<-release // block so the create is in flight when shutdownAll runs
+			created.Add(1)
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = fmt.Fprint(w, `{"session_id":"sess-inflight"}`)
+		case r.Method == http.MethodDelete:
+			destroyed.Add(1)
+			w.WriteHeader(http.StatusOK)
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	defer srv.Close()
+	m := newSessionManager(&skitClient{client: srv.Client(), baseURL: srv.URL}, 4, 10, time.Hour, time.Hour)
+
+	acquireDone := make(chan struct{})
+	go func() {
+		_, _ = m.acquire(context.Background(), "https://a.example", testYAML)
+		close(acquireDone)
+	}()
+
+	// Wait until acquire has reserved the session and is blocked in createSession.
+	deadline := time.Now().Add(2 * time.Second)
+	for {
+		m.mu.Lock()
+		n := len(m.sessions)
+		m.mu.Unlock()
+		if n == 1 {
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatal("acquire never reserved the session")
+		}
+		time.Sleep(time.Millisecond)
+	}
+
+	shutdownDone := make(chan struct{})
+	go func() {
+		m.shutdownAll(context.Background())
+		close(shutdownDone)
+	}()
+
+	close(release) // let creation finish
+	<-acquireDone
+	<-shutdownDone
+
+	if created.Load() != 1 {
+		t.Fatalf("created=%d want 1", created.Load())
+	}
+	if destroyed.Load() != 1 {
+		t.Fatalf("in-flight session not torn down on shutdown: destroyed=%d", destroyed.Load())
+	}
+}
+
 func TestSessionManagerShutdownAll(t *testing.T) {
 	ms, srv := newMockSkit()
 	defer srv.Close()
 	m, _ := newTestManager(srv, 4, time.Hour, time.Hour)
 	ctx := context.Background()
 
-	if _, err := m.acquire(ctx, "https://a.example", "y"); err != nil {
+	if _, err := m.acquire(ctx, "https://a.example", testYAML); err != nil {
 		t.Fatal(err)
 	}
-	if _, err := m.acquire(ctx, "https://b.example", "y"); err != nil {
+	if _, err := m.acquire(ctx, "https://b.example", testYAML); err != nil {
 		t.Fatal(err)
 	}
 	m.shutdownAll(ctx)

From ce0e5905e8e5a4e3ca7cc5291e3de8602bfd0cc1 Mon Sep 17 00:00:00 2001
From: streamer45 <cstcld91@gmail.com>
Date: Sun, 28 Jun 2026 11:52:41 +0200
Subject: [PATCH 05/26] feat(web-capture): H.264/fMP4 cast for Safari/iOS;
 user-role token
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Leverage two just-merged backend PRs (auth #634, fMP4 MSE #637):

- cast can now serve H.264 in fragmented MP4 via new h264-sw/h264-hw cast
  profiles — http::mse auto-detects fMP4 (#637), so a plain <video> plays the
  live stream in Safari/iOS. The cast muxer is chosen per profile now (WebM for
  VP9/AV1, fMP4 for H.264); VP9/WebM stays the default for crisp screen text on
  Chromium/Firefox.
- Docs: the gateway no longer needs an admin token — the built-in user role now
  allows transport::http::mse (#634), so a user-role token covers the whole
  pipeline. (The demo's token minting is updated separately.)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: streamer45 <cstcld91@gmail.com>
---
 examples/web-capture/README.md                |  28 ++---
 examples/web-capture/cmd/gateway/encoders.go  | 112 +++++++++++-------
 .../web-capture/cmd/gateway/encoders_test.go  |   8 +-
 examples/web-capture/cmd/gateway/main.go      |   2 +-
 examples/web-capture/cmd/gateway/pipelines.go |   1 +
 .../cmd/gateway/pipelines/cast.yml.tmpl       |  12 +-
 6 files changed, 92 insertions(+), 71 deletions(-)

diff --git a/examples/web-capture/README.md b/examples/web-capture/README.md
index 531b935d6..d3e50e71b 100644
--- a/examples/web-capture/README.md
+++ b/examples/web-capture/README.md
@@ -9,7 +9,7 @@ SPDX-License-Identifier: MPL-2.0
 Render any web page to video through a StreamKit backend. Paste a target URL straight onto the gateway host — no flags, no JSON:
 
 - **clip** — a finite MP4 file (oneshot pipeline): `clip.streamkit.dev/example.com`
-- **cast** — a live WebM stream (dynamic session): `cast.streamkit.dev/example.com`
+- **cast** — a live stream, WebM or fMP4 (dynamic session): `cast.streamkit.dev/example.com`
 
 The page is rendered by the [Servo](../../plugins/native/servo) browser engine on the backend. The gateway turns a pasteable URL into the multipart oneshot / dynamic-session calls the backend expects and, for `cast`, owns the session lifetime so abandoned streams are torn down instead of leaking a renderer.
 
@@ -49,15 +49,15 @@ The same URL serves a browser and a player/script: an address-bar visit (`Accept
 | Mode | Format | Plays in |
 |------|--------|----------|
 | `clip` | MP4 / H.264, fragmented (plays inline as it renders) | Everywhere, including Safari/iOS |
-| `cast` | WebM / VP9 (the only container the MSE transport emits) | Chromium & Firefox — **Safari/iOS may not play the live stream** |
+| `cast` | VP9 / WebM by default; H.264 / fMP4 via `cast-encoder=h264-sw` | VP9: Chromium & Firefox. H.264/fMP4: everywhere, including Safari/iOS |
 
-Universal live playback would require the backend's `transport::http::mse` node to emit fragmented MP4; that's a possible follow-up, not part of v1.
+The cast default (VP9/WebM) is crisper for screen text but plays only in Chromium/Firefox. For universal live playback (incl. Safari/iOS), set `cast-encoder=h264-sw` (or `h264-hw`): `transport::http::mse` serves fragmented MP4, which a plain `<video>` plays everywhere.
 
 ## Prereqs
 
 - A StreamKit server with the **Servo plugin** built and loaded:
   `just build-plugin-native-servo && just copy-plugins-native`.
-- The gateway's token/role must be allowed to **create and destroy sessions** and to use the `plugin::native::servo` node.
+- A non-admin **`user`** token suffices (it may create/destroy sessions and use `transport::http::mse`, `plugin::native::servo`, and the video/container nodes) — no admin needed. Pass it via `--token` / `SKIT_TOKEN`.
 - Go 1.24+.
 
 ## Run
@@ -91,7 +91,7 @@ xdg-open 'http://127.0.0.1:8080/cast/example.com'
 | `GATEWAY_CLIP_BITRATE_KBPS` | `--clip-bitrate-kbps` | `10000` | Clip video bitrate (kbps) |
 | `GATEWAY_CAST_BITRATE_KBPS` | `--cast-bitrate-kbps` | `6000` | Cast video bitrate (kbps) |
 | `GATEWAY_CLIP_ENCODER` | `--clip-encoder` | `h264-sw` | `h264-sw`, or `h264-hw` (Vulkan Video) |
-| `GATEWAY_CAST_ENCODER` | `--cast-encoder` | `vp9-sw` | `vp9-sw`, `av1-sw` (SVT-AV1), or `av1-hw` (NVENC) |
+| `GATEWAY_CAST_ENCODER` | `--cast-encoder` | `vp9-sw` | `vp9-sw`, `av1-sw`, `av1-hw`, `h264-sw`, `h264-hw` |
 
 Capture runs at **1080p30** by default: the page renders **and** encodes at the same resolution (1:1, no downscale), so text stays crisp and the page gets a real desktop layout. Drop to `res=1280x720` for less bandwidth or raise to `res=2560x1440` for more detail (capped at 4K); frame rate is fixed at 30.
 
@@ -99,15 +99,15 @@ Capture runs at **1080p30** by default: the page renders **and** encodes at the
 
 Software encoders are the default, so the gateway runs anywhere with no GPU — ideal for local dev. Hardware is opt-in per mode:
 
-| Profile | Encoder | Notes |
-|---|---|---|
-| `h264-sw` | OpenH264 | clip default; universal |
-| `h264-hw` | Vulkan Video H.264 | NVIDIA/AMD/Intel (NVENC exposes no H.264) |
-| `vp9-sw` | libvpx VP9 | cast default |
-| `av1-sw` | SVT-AV1 | software AV1 — exercise the AV1 path without a GPU |
-| `av1-hw` | NVENC AV1 | NVIDIA; crisper than VP9 for cast |
+| Profile | Codec / container | Modes | Notes |
+|---|---|---|---|
+| `h264-sw` | H.264 — MP4 (clip) / fMP4 (cast) | clip, cast | universal incl. Safari/iOS; OpenH264 (software) |
+| `h264-hw` | H.264 — MP4 / fMP4 | clip, cast | Vulkan Video (NVIDIA/AMD/Intel; NVENC has no H.264) |
+| `vp9-sw` | VP9 — WebM | cast | cast default; crisp screen text; Chromium/Firefox |
+| `av1-sw` | AV1 — WebM | cast | SVT-AV1 (software) — exercise AV1 without a GPU |
+| `av1-hw` | AV1 — WebM | cast | NVENC AV1 (NVIDIA); efficient + crisp; Chromium/Firefox |
 
-Clips stay H.264 so they play everywhere; cast AV1 plays in Chromium/Firefox (the same browsers that already handle the WebM stream). Hardware profiles require the matching runtime in the **backend** (Vulkan for `h264-hw`, CUDA + NVENC for `av1-hw`) — the gateway only selects the node, so a missing runtime surfaces as a backend pipeline error, not a gateway one.
+Clips are always H.264/MP4 (universal download). Cast defaults to VP9/WebM (crisp, Chromium/Firefox); switch to `h264-sw`/`h264-hw` for H.264/fMP4 that also plays in Safari/iOS, or `av1-*` for AV1/WebM. Hardware profiles require the matching runtime in the **backend** (Vulkan for `h264-hw`, CUDA + NVENC for `av1-hw`) — the gateway only selects the node, so a missing runtime surfaces as a backend pipeline error, not a gateway one.
 
 ## Lifetime & teardown (cast)
 
@@ -121,4 +121,4 @@ Prometheus metrics at `GET /metrics` (not gated by the concurrency limit). Beyon
 
 - **Public / URL-only.** Targets that resolve to loopback/private/link-local/CGNAT/cloud-metadata addresses are rejected (SSRF guard). Auth-gated pages (cookies/headers) are intentionally out of scope — a future self-hosted feature, never the public path. DNS rebinding between the gateway's check and Servo's own fetch is a known gap.
 - **Servo is view-only and software-rendered**: static/CSS pages render at full frame rate; heavy WebGL is ~15–20 fps. No clicking, scrolling, or login.
-- **`cast` in Safari/iOS** may not play (WebM/VP9), see above.
+- **`cast` in Safari/iOS**: the default VP9/WebM is Chromium/Firefox-only; use `cast-encoder=h264-sw` for fMP4/H.264 that plays in Safari/iOS.
diff --git a/examples/web-capture/cmd/gateway/encoders.go b/examples/web-capture/cmd/gateway/encoders.go
index ffc9fa85f..26bec7d80 100644
--- a/examples/web-capture/cmd/gateway/encoders.go
+++ b/examples/web-capture/cmd/gateway/encoders.go
@@ -10,76 +10,100 @@ import (
 	"strings"
 )
 
-// encoderProfile is a swappable encoder choice: the YAML for the `encoder` node
-// (named so the muxer can `needs: encoder`), the mp4 `video_codec` it implies
-// (ignored by the auto-detecting WebM muxer used for cast), and the content_type
-// advertised to the client. Blocks carry {{FPS}}/{{BR_KBPS}}/{{BR_BPS}} — note
-// the software encoders take a kbps bitrate while the HW encoders take bits/sec.
+// encoderProfile is a swappable encoder choice. block is the `encoder` node.
+// Clip pipelines use their fixed mp4 muxer (muxCodec = its video_codec); cast
+// pipelines inject muxer (WebM for VP9/AV1, fMP4 for H.264). Software encoders
+// take a kbps bitrate; the HW ones take bits/sec + framerate.
 type encoderProfile struct {
 	block       string
-	muxCodec    string
+	muxer       string // cast only
+	muxCodec    string // clip only
 	contentType string
 }
 
-// clipEncoders stay H.264 so downloaded clips remain universally playable
-// (incl. Safari/iOS). Software is the default; hardware is Vulkan Video, which
-// works on NVIDIA/AMD/Intel (NVENC exposes AV1 only, not H.264).
-var clipEncoders = map[string]encoderProfile{
-	"h264-sw": {
-		block: `  encoder:
+// Shared encoder node blocks; placeholders are filled at render time.
+const (
+	openh264Block = `  encoder:
     kind: video::openh264::encoder
     params:
       bitrate_kbps: {{BR_KBPS}}
       max_frame_rate: {{FPS}}.0
-    needs: pixel_convert`,
-		muxCodec:    "h264",
-		contentType: `'video/mp4; codecs="avc1.42c01f"'`,
-	},
-	"h264-hw": {
-		block: `  encoder:
+    needs: pixel_convert`
+
+	vulkanH264Block = `  encoder:
     kind: video::vulkan_video::h264_encoder
     params:
       bitrate: {{BR_BPS}}
       framerate: {{FPS}}
-    needs: pixel_convert`,
-		muxCodec:    "h264",
-		contentType: `'video/mp4; codecs="avc1.42c01f"'`,
-	},
-}
+    needs: pixel_convert`
 
-// castEncoders: VP9 (software, default) or AV1 — software (svt, for local
-// testing without a GPU) or hardware (NVENC). The WebM muxer auto-detects the
-// codec from the packets, so only the encoder and advertised codec string vary.
-var castEncoders = map[string]encoderProfile{
-	"vp9-sw": {
-		block: `  encoder:
+	vp9Block = `  encoder:
     kind: video::vp9::encoder
     params:
       bitrate_kbps: {{BR_KBPS}}
-    needs: pixel_convert`,
-		contentType: `'video/webm; codecs="vp9"'`,
-	},
-	"av1-sw": {
-		// CRF, not a target bitrate: SVT-AV1 rejects VBR in its low-delay mode
-		// (required for live), so a bitrate_kbps>0 fails. CRF works in low-delay.
-		block: `  encoder:
+    needs: pixel_convert`
+
+	// CRF, not a target bitrate: SVT-AV1 rejects VBR in its low-delay mode
+	// (required for live), so a bitrate_kbps>0 fails.
+	svtAv1Block = `  encoder:
     kind: video::svt_av1::encoder
     params:
       bitrate_kbps: 0
       crf: 32
       fps: {{FPS}}
-    needs: pixel_convert`,
-		contentType: `'video/webm; codecs="av01.0.08M.08"'`,
-	},
-	"av1-hw": {
-		block: `  encoder:
+    needs: pixel_convert`
+
+	nvAv1Block = `  encoder:
     kind: video::nv::av1_encoder
     params:
       bitrate: {{BR_BPS}}
       framerate: {{FPS}}
-    needs: pixel_convert`,
-		contentType: `'video/webm; codecs="av01.0.08M.08"'`,
-	},
+    needs: pixel_convert`
+)
+
+// Cast muxer blocks. WebM auto-detects VP9 vs AV1 from the packets; fMP4 (mp4
+// mode:stream) carries H.264 and — since the http::mse fMP4 support landed —
+// plays in Safari/iOS over a plain <video>.
+const (
+	webmMuxerBlock = `  muxer:
+    kind: containers::webm::muxer
+    params:
+      video_width: {{WIDTH}}
+      video_height: {{HEIGHT}}
+      streaming_mode: live
+    needs: encoder`
+
+	fmp4MuxerBlock = `  muxer:
+    kind: containers::mp4::muxer
+    params:
+      mode: stream
+      video_width: {{WIDTH}}
+      video_height: {{HEIGHT}}
+      video_codec: h264
+    needs: encoder`
+)
+
+const (
+	h264ContentType = `'video/mp4; codecs="avc1.42c01f"'`
+	vp9ContentType  = `'video/webm; codecs="vp9"'`
+	av1ContentType  = `'video/webm; codecs="av01.0.08M.08"'`
+)
+
+// clipEncoders stay H.264 so downloaded clips play everywhere; software is the
+// default, hardware (Vulkan; NVIDIA/AMD/Intel) is opt-in.
+var clipEncoders = map[string]encoderProfile{
+	"h264-sw": {block: openh264Block, muxCodec: "h264", contentType: h264ContentType},
+	"h264-hw": {block: vulkanH264Block, muxCodec: "h264", contentType: h264ContentType},
+}
+
+// castEncoders: VP9/AV1-in-WebM (crisper/efficient, Chromium + Firefox) or
+// H.264-in-fMP4 (universal, including Safari/iOS).
+var castEncoders = map[string]encoderProfile{
+	"vp9-sw":  {block: vp9Block, muxer: webmMuxerBlock, contentType: vp9ContentType},
+	"av1-sw":  {block: svtAv1Block, muxer: webmMuxerBlock, contentType: av1ContentType},
+	"av1-hw":  {block: nvAv1Block, muxer: webmMuxerBlock, contentType: av1ContentType},
+	"h264-sw": {block: openh264Block, muxer: fmp4MuxerBlock, contentType: h264ContentType},
+	"h264-hw": {block: vulkanH264Block, muxer: fmp4MuxerBlock, contentType: h264ContentType},
 }
 
 func lookupEncoder(profiles map[string]encoderProfile, name string) (encoderProfile, error) {
diff --git a/examples/web-capture/cmd/gateway/encoders_test.go b/examples/web-capture/cmd/gateway/encoders_test.go
index a3832924c..714e1afc9 100644
--- a/examples/web-capture/cmd/gateway/encoders_test.go
+++ b/examples/web-capture/cmd/gateway/encoders_test.go
@@ -43,9 +43,11 @@ func TestClipEncoderProfiles(t *testing.T) {
 
 func TestCastEncoderProfiles(t *testing.T) {
 	cases := map[string][]string{
-		"vp9-sw": {"video::vp9::encoder", "bitrate_kbps: 6000", `codecs="vp9"`},
-		"av1-sw": {"video::svt_av1::encoder", "crf: 32", `codecs="av01.0.08M.08"`},
-		"av1-hw": {"video::nv::av1_encoder", "bitrate: 6000000", `codecs="av01.0.08M.08"`},
+		"vp9-sw":  {"video::vp9::encoder", "bitrate_kbps: 6000", "containers::webm::muxer", `codecs="vp9"`},
+		"av1-sw":  {"video::svt_av1::encoder", "crf: 32", "containers::webm::muxer", `codecs="av01.0.08M.08"`},
+		"av1-hw":  {"video::nv::av1_encoder", "bitrate: 6000000", "containers::webm::muxer", `codecs="av01.0.08M.08"`},
+		"h264-sw": {"video::openh264::encoder", "containers::mp4::muxer", "mode: stream", `codecs="avc1.42c01f"`},
+		"h264-hw": {"video::vulkan_video::h264_encoder", "containers::mp4::muxer", "mode: stream", `codecs="avc1.42c01f"`},
 	}
 	for name, wants := range cases {
 		out := renderCastPipeline("https://example.com", 1920, 1080, 30, 10, 6000, castEncoders[name])
diff --git a/examples/web-capture/cmd/gateway/main.go b/examples/web-capture/cmd/gateway/main.go
index bc26a2150..ec931141a 100644
--- a/examples/web-capture/cmd/gateway/main.go
+++ b/examples/web-capture/cmd/gateway/main.go
@@ -172,7 +172,7 @@ func loadConfig() config {
 	clipBitrate := flag.Int("clip-bitrate-kbps", envInt("GATEWAY_CLIP_BITRATE_KBPS", defaultClipBitrateKbps), "Clip video bitrate (kbps)")
 	castBitrate := flag.Int("cast-bitrate-kbps", envInt("GATEWAY_CAST_BITRATE_KBPS", defaultCastBitrateKbps), "Cast video bitrate (kbps)")
 	clipEncoder := flag.String("clip-encoder", getEnvDefault("GATEWAY_CLIP_ENCODER", defaultClipEncoder), "Clip encoder: h264-sw, h264-hw")
-	castEncoder := flag.String("cast-encoder", getEnvDefault("GATEWAY_CAST_ENCODER", defaultCastEncoder), "Cast encoder: vp9-sw, av1-sw, av1-hw")
+	castEncoder := flag.String("cast-encoder", getEnvDefault("GATEWAY_CAST_ENCODER", defaultCastEncoder), "Cast encoder: vp9-sw, av1-sw, av1-hw, h264-sw, h264-hw (h264 = fMP4, plays in Safari/iOS)")
 
 	flag.Parse()
 
diff --git a/examples/web-capture/cmd/gateway/pipelines.go b/examples/web-capture/cmd/gateway/pipelines.go
index 2719b36af..72985488c 100644
--- a/examples/web-capture/cmd/gateway/pipelines.go
+++ b/examples/web-capture/cmd/gateway/pipelines.go
@@ -40,6 +40,7 @@ func renderClipPipeline(targetURL string, resW, resH, fps, frameCount, brKbps in
 
 func renderCastPipeline(targetURL string, resW, resH, fps, maxClients, brKbps int, enc encoderProfile) string {
 	tmpl := strings.Replace(castPipelineTemplate, "{{ENCODER_BLOCK}}", enc.block, 1)
+	tmpl = strings.Replace(tmpl, "{{MUXER_BLOCK}}", enc.muxer, 1)
 	return strings.NewReplacer(
 		"{{URL}}", strconv.Quote(targetURL),
 		"{{WIDTH}}", strconv.Itoa(resW),
diff --git a/examples/web-capture/cmd/gateway/pipelines/cast.yml.tmpl b/examples/web-capture/cmd/gateway/pipelines/cast.yml.tmpl
index 7ab3455bb..6ecc18b1f 100644
--- a/examples/web-capture/cmd/gateway/pipelines/cast.yml.tmpl
+++ b/examples/web-capture/cmd/gateway/pipelines/cast.yml.tmpl
@@ -4,8 +4,8 @@
 
 # Dynamic pipeline: render a web page to a live WebM stream over HTTP MSE.
 # Placeholders are substituted by renderCastPipeline (see pipelines.go); the
-# encoder node is injected per selected profile (see encoders.go).
-# The stream is unbounded (no frame limit); the WebM muxer auto-detects VP9/AV1.
+# encoder and muxer nodes are injected per selected profile (WebM for VP9/AV1,
+# fMP4 for H.264 — see encoders.go). The stream is unbounded (no frame limit).
 name: web-cast
 description: Render a web page to a live WebM stream
 mode: dynamic
@@ -30,13 +30,7 @@ nodes:
       output_format: nv12
     needs: web
 {{ENCODER_BLOCK}}
-  muxer:
-    kind: containers::webm::muxer
-    params:
-      video_width: {{WIDTH}}
-      video_height: {{HEIGHT}}
-      streaming_mode: live
-    needs: encoder
+{{MUXER_BLOCK}}
   http_mse:
     kind: transport::http::mse
     params:

From c8e1f75aa64a4f8567a74f8e9661f99fd333fff6 Mon Sep 17 00:00:00 2001
From: streamer45 <cstcld91@gmail.com>
Date: Sun, 28 Jun 2026 12:23:24 +0200
Subject: [PATCH 06/26] refactor(web-capture): single host, output as the first
 path segment
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Serve both outputs from one host (web.streamkit.dev): the path is
/{clip|cast}/[options/]{url} — output first, then optional config, then the
target URL. detectMode now reads the mode from the path only (the subdomain
branch is dropped), so any host works. Usage page, README, and tests updated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: streamer45 <cstcld91@gmail.com>
---
 examples/web-capture/README.md                | 29 +++++++------------
 examples/web-capture/cmd/gateway/capture.go   | 22 ++++----------
 .../web-capture/cmd/gateway/capture_test.go   | 28 +++++++++---------
 examples/web-capture/cmd/gateway/main.go      |  2 +-
 examples/web-capture/cmd/gateway/proxy.go     | 11 +++----
 5 files changed, 37 insertions(+), 55 deletions(-)

diff --git a/examples/web-capture/README.md b/examples/web-capture/README.md
index d3e50e71b..9ebc4bcfb 100644
--- a/examples/web-capture/README.md
+++ b/examples/web-capture/README.md
@@ -6,41 +6,34 @@ SPDX-License-Identifier: MPL-2.0
 
 # Web Capture Gateway
 
-Render any web page to video through a StreamKit backend. Paste a target URL straight onto the gateway host — no flags, no JSON:
+Render any web page to video through a StreamKit backend. The first path segment picks the output; paste the target URL after it — no flags, no JSON:
 
-- **clip** — a finite MP4 file (oneshot pipeline): `clip.streamkit.dev/example.com`
-- **cast** — a live stream, WebM or fMP4 (dynamic session): `cast.streamkit.dev/example.com`
+- **clip** — a finite MP4 file (oneshot pipeline): `web.streamkit.dev/clip/example.com`
+- **cast** — a live stream, WebM or fMP4 (dynamic session): `web.streamkit.dev/cast/example.com`
 
 The page is rendered by the [Servo](../../plugins/native/servo) browser engine on the backend. The gateway turns a pasteable URL into the multipart oneshot / dynamic-session calls the backend expects and, for `cast`, owns the session lifetime so abandoned streams are torn down instead of leaking a renderer.
 
 ## URL shape
 
 ```
-{host}/[options/]{target-url}
+{host}/{clip|cast}/[options/]{target-url}
 ```
 
-The target URL is taken **verbatim** as the path suffix (scheme optional, `https` assumed), so its own query string just rides along — no percent-encoding:
+The first segment is the output (`clip` or `cast`); the target URL follows **verbatim** (scheme optional, `https` assumed), so its own query string just rides along — no percent-encoding:
 
 ```
-clip.streamkit.dev/grafana.example/d/abc?panel=3&from=now-6h
+web.streamkit.dev/clip/grafana.example/d/abc?panel=3&from=now-6h
 ```
 
-Options are an optional comma-separated `key=value` **first segment**:
+Options are an optional comma-separated `key=value` segment between the output and the URL:
 
 ```
-clip.streamkit.dev/dur=30s/example.com                # clip length (default 10s, capped at 60s)
-cast.streamkit.dev/res=2560x1440/example.com          # capture resolution (default 1920x1080)
-clip.streamkit.dev/res=1280x720,dur=15s/example.com   # combine, comma-separated
+web.streamkit.dev/clip/dur=30s/example.com                # clip length (default 10s, capped at 60s)
+web.streamkit.dev/cast/res=2560x1440/example.com          # capture resolution (default 1920x1080)
+web.streamkit.dev/clip/res=1280x720,dur=15s/example.com   # combine, comma-separated
 ```
 
-`dur` is `clip`-only; `res` (the capture resolution) applies to both modes.
-
-Locally there are no subdomains, so select the mode with a path prefix instead:
-
-```
-http://127.0.0.1:8080/clip/dur=5s/example.com
-http://127.0.0.1:8080/cast/example.com
-```
+`dur` is `clip`-only; `res` (the capture resolution) applies to both modes. The scheme is identical locally, e.g. `http://127.0.0.1:8080/clip/dur=5s/example.com`.
 
 The same URL serves a browser and a player/script: an address-bar visit (`Accept: text/html`) to a `cast` URL returns a tiny autoplay page; anything else (a `<video src>`, `curl`, `ffplay`) gets the raw stream/file.
 
diff --git a/examples/web-capture/cmd/gateway/capture.go b/examples/web-capture/cmd/gateway/capture.go
index 06645bd62..95dc2efb2 100644
--- a/examples/web-capture/cmd/gateway/capture.go
+++ b/examples/web-capture/cmd/gateway/capture.go
@@ -59,24 +59,12 @@ type captureOpts struct {
 // so a first segment that matches this is unambiguously options, not the target.
 var optionsSegmentRe = regexp.MustCompile(`^[a-z]+=[^,/]+(,[a-z]+=[^,/]+)*$`)
 
-// detectMode resolves clip/cast from the host subdomain (clip./cast.) or, for
-// local/single-host use, a leading /clip//cast/ path prefix. It returns the rest
-// of the raw request target with the mode prefix (if any) stripped.
-func detectMode(host, rawTarget string) (mode captureMode, rest string, ok bool) {
-	h := host
-	if i := strings.IndexByte(h, ':'); i >= 0 {
-		h = h[:i]
-	}
-	h = strings.ToLower(h)
+// detectMode resolves the output mode from the first path segment — `clip` or
+// `cast` — so a single host (web.streamkit.dev) serves both: the path is
+// /{mode}/[options]/{target-url}. It returns the rest of the raw request target
+// with the mode segment stripped, and ok=false when neither matches.
+func detectMode(rawTarget string) (mode captureMode, rest string, ok bool) {
 	rest = strings.TrimPrefix(rawTarget, "/")
-
-	switch {
-	case strings.HasPrefix(h, "clip."):
-		return modeClip, rest, true
-	case strings.HasPrefix(h, "cast."):
-		return modeCast, rest, true
-	}
-
 	switch {
 	case rest == "clip" || strings.HasPrefix(rest, "clip/"):
 		return modeClip, strings.TrimPrefix(strings.TrimPrefix(rest, "clip"), "/"), true
diff --git a/examples/web-capture/cmd/gateway/capture_test.go b/examples/web-capture/cmd/gateway/capture_test.go
index 7deef88fe..6efb16fea 100644
--- a/examples/web-capture/cmd/gateway/capture_test.go
+++ b/examples/web-capture/cmd/gateway/capture_test.go
@@ -12,29 +12,29 @@ import (
 
 func TestDetectMode(t *testing.T) {
 	cases := []struct {
-		host, rawTarget string
-		wantMode        captureMode
-		wantRest        string
-		wantOK          bool
+		rawTarget string
+		wantMode  captureMode
+		wantRest  string
+		wantOK    bool
 	}{
-		{"clip.streamkit.dev", "/example.com", modeClip, "example.com", true},
-		{"cast.streamkit.dev", "/dur=5s/example.com", modeCast, "dur=5s/example.com", true},
-		{"clip.streamkit.dev:8080", "/x", modeClip, "x", true},
-		{"localhost:8080", "/clip/example.com", modeClip, "example.com", true},
-		{"localhost:8080", "/cast/example.com", modeCast, "example.com", true},
-		{"localhost", "/example.com", modeClip, "example.com", false},
+		{"/clip/example.com", modeClip, "example.com", true},
+		{"/cast/dur=5s/example.com", modeCast, "dur=5s/example.com", true},
+		{"/clip/dur=30s/example.com", modeClip, "dur=30s/example.com", true},
+		{"/cast/example.com", modeCast, "example.com", true},
+		{"/example.com", modeClip, "", false}, // no mode segment
+		{"/", modeClip, "", false},
 	}
 	for _, c := range cases {
-		mode, rest, ok := detectMode(c.host, c.rawTarget)
+		mode, rest, ok := detectMode(c.rawTarget)
 		if ok != c.wantOK {
-			t.Errorf("detectMode(%q,%q) ok=%v want %v", c.host, c.rawTarget, ok, c.wantOK)
+			t.Errorf("detectMode(%q) ok=%v want %v", c.rawTarget, ok, c.wantOK)
 			continue
 		}
 		if !ok {
 			continue
 		}
 		if mode != c.wantMode || rest != c.wantRest {
-			t.Errorf("detectMode(%q,%q) = (%v,%q) want (%v,%q)", c.host, c.rawTarget, mode, rest, c.wantMode, c.wantRest)
+			t.Errorf("detectMode(%q) = (%v,%q) want (%v,%q)", c.rawTarget, mode, rest, c.wantMode, c.wantRest)
 		}
 	}
 }
@@ -89,7 +89,7 @@ func TestParseTargetAndOptions(t *testing.T) {
 // The exact shape a local path-prefix request produces, end to end through
 // detectMode + parseTargetAndOptions.
 func TestDetectModeThenParseWithOptions(t *testing.T) {
-	mode, rest, ok := detectMode("127.0.0.1:8080", "/clip/dur=5s,res=1920x1080/streamkit.dev")
+	mode, rest, ok := detectMode("/clip/dur=5s,res=1920x1080/streamkit.dev")
 	if !ok || mode != modeClip {
 		t.Fatalf("detectMode = (%v, %q, %v)", mode, rest, ok)
 	}
diff --git a/examples/web-capture/cmd/gateway/main.go b/examples/web-capture/cmd/gateway/main.go
index ec931141a..190295ee2 100644
--- a/examples/web-capture/cmd/gateway/main.go
+++ b/examples/web-capture/cmd/gateway/main.go
@@ -242,7 +242,7 @@ func (gw *gateway) router() http.Handler {
 }
 
 func (gw *gateway) handleCapture(w http.ResponseWriter, r *http.Request) {
-	mode, rest, ok := detectMode(r.Host, r.RequestURI)
+	mode, rest, ok := detectMode(r.RequestURI)
 	if !ok {
 		gw.handleUsage(w, r)
 		return
diff --git a/examples/web-capture/cmd/gateway/proxy.go b/examples/web-capture/cmd/gateway/proxy.go
index 70827a44e..8a55bee4c 100644
--- a/examples/web-capture/cmd/gateway/proxy.go
+++ b/examples/web-capture/cmd/gateway/proxy.go
@@ -210,13 +210,14 @@ const usagePage = `<!doctype html><html><head><meta charset="utf-8"><title>Strea
 	`<style>body{font:16px/1.5 system-ui,sans-serif;max-width:42rem;margin:3rem auto;padding:0 1rem;color:#222}` +
 	`code{background:#f2f2f2;padding:.1em .3em;border-radius:.2em}</style></head><body>` +
 	`<h1>StreamKit web-capture</h1>` +
-	`<p>Render any web page to video. Paste a target URL straight after the host:</p>` +
+	`<p>Render any web page to video. The path is <code>/{output}/[config]/{url}</code> — ` +
+	`the first segment picks the output, then optional config, then the target URL:</p>` +
 	`<ul>` +
-	`<li><strong>Clip</strong> (MP4 file): <code>clip.streamkit.dev/example.com</code></li>` +
-	`<li><strong>Clip</strong> with duration: <code>clip.streamkit.dev/dur=30s/example.com</code></li>` +
-	`<li><strong>Cast</strong> (live stream): <code>cast.streamkit.dev/example.com</code></li>` +
+	`<li><strong>Clip</strong> (MP4 file): <code>web.streamkit.dev/clip/example.com</code></li>` +
+	`<li><strong>Clip</strong> with duration: <code>web.streamkit.dev/clip/dur=30s/example.com</code></li>` +
+	`<li><strong>Cast</strong> (live stream): <code>web.streamkit.dev/cast/example.com</code></li>` +
+	`<li><strong>Cast</strong> at a resolution: <code>web.streamkit.dev/cast/res=2560x1440/example.com</code></li>` +
 	`</ul>` +
-	`<p>Locally, use a path prefix instead of a subdomain: <code>/clip/…</code> or <code>/cast/…</code>.</p>` +
 	`</body></html>`
 
 func (gw *gateway) handleUsage(w http.ResponseWriter, _ *http.Request) {

From c8638e03211657b2b62817a6eb0ffa074754dffc Mon Sep 17 00:00:00 2001
From: streamer45 <cstcld91@gmail.com>
Date: Sun, 28 Jun 2026 18:40:15 +0200
Subject: [PATCH 07/26] regression test

---
 apps/skit/src/config.rs | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/apps/skit/src/config.rs b/apps/skit/src/config.rs
index 9d1969154..06a9aac5c 100644
--- a/apps/skit/src/config.rs
+++ b/apps/skit/src/config.rs
@@ -1646,6 +1646,27 @@ allowed_plugins = []
         });
     }
 
+    #[test]
+    fn config_partial_role_override_deep_merges_builtin() {
+        figment::Jail::expect_with(|jail| {
+            jail.create_file(
+                "skit.toml",
+                r#"[permissions.roles.user]
+allowed_nodes = ["video::*", "containers::*", "transport::http::mse", "plugin::*"]
+"#,
+            )?;
+            let result = load("skit.toml").expect("load with user override");
+            let user = result.config.permissions.roles.get("user").expect("user role");
+            // Fields absent from the TOML must survive from the built-in default
+            // (deep-merge), not reset to the struct's bool default of false.
+            assert!(user.create_sessions, "create_sessions preserved by deep-merge");
+            assert!(user.destroy_sessions, "destroy_sessions preserved by deep-merge");
+            // The overridden array adds the MSE transport node.
+            assert!(user.is_node_allowed("transport::http::mse"));
+            Ok(())
+        });
+    }
+
     fn attr_policy(allowed: &[&str], fallback: &str) -> MetricsAttributePolicy {
         MetricsAttributePolicy {
             allowed: allowed.iter().map(|s| (*s).to_string()).collect(),

From 008d3fb41735d59e38159920d3ea9ec236ed82fa Mon Sep 17 00:00:00 2001
From: streamkit-devin <devin@streamkit.dev>
Date: Sun, 28 Jun 2026 18:15:44 +0000
Subject: [PATCH 08/26] fix(servo,web-capture): stop cross-session pixel leak;
 land clip first fragment fast
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Servo's SoftwareRenderingContext shares a surfman surface pool across
instances, and spin_event_loop leaves the last-painted instance's
context bound — so a freshly-opened clip/cast could read another,
unrelated session's pixels (a privacy leak on the public demo).

- Gate surface reads on first paint: until notify_new_frame_ready has
  fired for the current page, emit a transparent frame instead of
  reading a possibly-stale surface; re-arm the gate on URL change.
- Re-bind the instance's rendering context immediately before
  read_to_image (after spin_event_loop) so the read always captures
  this instance's surface, never a concurrent node's.
- Add an isolated integration test that drives two concurrent solid-
  colour data: pages and asserts neither leaks the other's pixels.
- web-capture: tune the OpenH264 GOP to ~1s (one IDR per fps frames)
  so the fragmented-MP4 clip flushes its first playable fragment fast.

Signed-off-by: streamkit-devin <devin@streamkit.dev>
---
 examples/web-capture/cmd/gateway/encoders.go  |   4 +
 .../web-capture/cmd/gateway/encoders_test.go  |   2 +-
 examples/web-capture/cmd/gateway/pipelines.go |  13 ++
 .../web-capture/cmd/gateway/pipelines_test.go |   1 +
 plugins/native/servo/Cargo.lock               |   1 +
 plugins/native/servo/Cargo.toml               |  13 +-
 plugins/native/servo/src/lib.rs               |  10 ++
 plugins/native/servo/src/servo_thread.rs      |  40 ++++++
 .../native/servo/tests/cross_session_leak.rs  | 124 ++++++++++++++++++
 9 files changed, 206 insertions(+), 2 deletions(-)
 create mode 100644 plugins/native/servo/tests/cross_session_leak.rs

diff --git a/examples/web-capture/cmd/gateway/encoders.go b/examples/web-capture/cmd/gateway/encoders.go
index 26bec7d80..fedd1ceae 100644
--- a/examples/web-capture/cmd/gateway/encoders.go
+++ b/examples/web-capture/cmd/gateway/encoders.go
@@ -23,11 +23,15 @@ type encoderProfile struct {
 
 // Shared encoder node blocks; placeholders are filled at render time.
 const (
+	// gop_size = {{GOP}} (one keyframe per second) keeps the first fMP4
+	// fragment short so playback starts within ~1s of first paint instead
+	// of waiting a full default GOP (2s) for the muxer to flush.
 	openh264Block = `  encoder:
     kind: video::openh264::encoder
     params:
       bitrate_kbps: {{BR_KBPS}}
       max_frame_rate: {{FPS}}.0
+      gop_size: {{GOP}}
     needs: pixel_convert`
 
 	vulkanH264Block = `  encoder:
diff --git a/examples/web-capture/cmd/gateway/encoders_test.go b/examples/web-capture/cmd/gateway/encoders_test.go
index 714e1afc9..664a263cc 100644
--- a/examples/web-capture/cmd/gateway/encoders_test.go
+++ b/examples/web-capture/cmd/gateway/encoders_test.go
@@ -25,7 +25,7 @@ func TestLookupEncoder(t *testing.T) {
 // kbps, hardware = bits/sec) and leave no unreplaced placeholders.
 func TestClipEncoderProfiles(t *testing.T) {
 	cases := map[string][]string{
-		"h264-sw": {"video::openh264::encoder", "bitrate_kbps: 10000", "max_frame_rate: 30.0", "video_codec: h264"},
+		"h264-sw": {"video::openh264::encoder", "bitrate_kbps: 10000", "max_frame_rate: 30.0", "gop_size: 30", "video_codec: h264"},
 		"h264-hw": {"video::vulkan_video::h264_encoder", "bitrate: 10000000", "framerate: 30", "video_codec: h264"},
 	}
 	for name, wants := range cases {
diff --git a/examples/web-capture/cmd/gateway/pipelines.go b/examples/web-capture/cmd/gateway/pipelines.go
index 72985488c..5834b75c8 100644
--- a/examples/web-capture/cmd/gateway/pipelines.go
+++ b/examples/web-capture/cmd/gateway/pipelines.go
@@ -30,6 +30,7 @@ func renderClipPipeline(targetURL string, resW, resH, fps, frameCount, brKbps in
 		"{{WIDTH}}", strconv.Itoa(resW),
 		"{{HEIGHT}}", strconv.Itoa(resH),
 		"{{FPS}}", strconv.Itoa(fps),
+		"{{GOP}}", strconv.Itoa(gopForFPS(fps)),
 		"{{FRAME_COUNT}}", strconv.Itoa(frameCount),
 		"{{BR_KBPS}}", strconv.Itoa(brKbps),
 		"{{BR_BPS}}", strconv.Itoa(brKbps*1000),
@@ -46,9 +47,21 @@ func renderCastPipeline(targetURL string, resW, resH, fps, maxClients, brKbps in
 		"{{WIDTH}}", strconv.Itoa(resW),
 		"{{HEIGHT}}", strconv.Itoa(resH),
 		"{{FPS}}", strconv.Itoa(fps),
+		"{{GOP}}", strconv.Itoa(gopForFPS(fps)),
 		"{{MAX_CLIENTS}}", strconv.Itoa(maxClients),
 		"{{BR_KBPS}}", strconv.Itoa(brKbps),
 		"{{BR_BPS}}", strconv.Itoa(brKbps*1000),
 		"{{CONTENT_TYPE}}", enc.contentType,
 	).Replace(tmpl)
 }
+
+// gopForFPS picks a keyframe interval of ~1 second (one IDR per fps frames) so
+// the fragmented-MP4 muxer flushes its first playable fragment quickly. Only
+// the OpenH264 (software) block reads {{GOP}}; the Vulkan block forces its own
+// keyframe at frame 0, so the substitution is a harmless no-op there.
+func gopForFPS(fps int) int {
+	if fps < 1 {
+		return 1
+	}
+	return fps
+}
diff --git a/examples/web-capture/cmd/gateway/pipelines_test.go b/examples/web-capture/cmd/gateway/pipelines_test.go
index 04252fd5f..cdba379cb 100644
--- a/examples/web-capture/cmd/gateway/pipelines_test.go
+++ b/examples/web-capture/cmd/gateway/pipelines_test.go
@@ -24,6 +24,7 @@ func TestRenderClipPipeline(t *testing.T) {
 		"video_codec: h264",
 		"bitrate_kbps: 10000",
 		"max_frame_rate: 30.0",
+		"gop_size: 30",
 		"plugin::native::servo",
 		"output_format: nv12",
 		"streamkit::http_output",
diff --git a/plugins/native/servo/Cargo.lock b/plugins/native/servo/Cargo.lock
index 74257d8d1..71b690a1d 100644
--- a/plugins/native/servo/Cargo.lock
+++ b/plugins/native/servo/Cargo.lock
@@ -6463,6 +6463,7 @@ dependencies = [
  "dpi",
  "euclid",
  "image",
+ "libc",
  "serde",
  "serde_json",
  "servo",
diff --git a/plugins/native/servo/Cargo.toml b/plugins/native/servo/Cargo.toml
index 3dbb90b47..cd883ebbc 100644
--- a/plugins/native/servo/Cargo.toml
+++ b/plugins/native/servo/Cargo.toml
@@ -10,7 +10,10 @@ license = "MPL-2.0"
 
 [lib]
 name = "servo_web"
-crate-type = ["cdylib"]
+# `rlib` (in addition to the `cdylib` the host loads) lets the
+# integration test in `tests/` link the crate and exercise the real
+# Servo engine through the public `send_work` API.
+crate-type = ["cdylib", "rlib"]
 
 [dependencies]
 streamkit-plugin-sdk-native = { path = "../../../sdks/plugin-sdk/native" }
@@ -33,6 +36,14 @@ tracing = "0.1"
 # dlopen-safe global-dynamic TLS model.
 tikv-jemalloc-sys = { version = "0.6", features = ["disable_initial_exec_tls"] }
 
+[dev-dependencies]
+# The cross-session leak integration test drives the real Servo engine,
+# which has no clean global-shutdown path: at process exit mozjs' C++
+# destructors race the still-live renderer thread and SIGSEGV.  The test
+# calls `libc::_exit` after asserting to bypass that teardown.
+libc = "0.2"
+uuid = { version = "1", features = ["v4"] }
+
 [lints.clippy]
 # Categories
 pedantic = { level = "warn", priority = -1 }
diff --git a/plugins/native/servo/src/lib.rs b/plugins/native/servo/src/lib.rs
index fbe18fccc..b4cdb0daa 100644
--- a/plugins/native/servo/src/lib.rs
+++ b/plugins/native/servo/src/lib.rs
@@ -10,3 +10,13 @@ use servo_node::ServoSourcePlugin;
 use streamkit_plugin_sdk_native::{native_source_plugin_entry, NativeSourceNode};
 
 native_source_plugin_entry!(ServoSourcePlugin);
+
+/// Internal surface re-exported solely for this crate's integration tests.
+///
+/// This crate ships as a `cdylib` host plugin and has no stable Rust API;
+/// nothing here is part of a public contract and it may change at any time.
+#[doc(hidden)]
+pub mod test_api {
+    pub use crate::config::ServoConfig;
+    pub use crate::servo_thread::{send_work, NodeId, ServoThreadResult, ServoWorkItem};
+}
diff --git a/plugins/native/servo/src/servo_thread.rs b/plugins/native/servo/src/servo_thread.rs
index 699517e1a..e5addde8b 100644
--- a/plugins/native/servo/src/servo_thread.rs
+++ b/plugins/native/servo/src/servo_thread.rs
@@ -132,9 +132,17 @@ pub fn send_work(item: ServoWorkItem) -> Result<(), String> {
 /// `loaded` is read by `handle_render`'s post-load gate to fire one-shot
 /// post-load actions (custom CSS injection) on the first tick after the
 /// page reaches `LoadStatus::Complete`.
+///
+/// `painted` gates surface reads: surfman reuses the underlying
+/// `SoftwareRenderingContext` surface across instances, so before Servo
+/// has painted the current page at least once the surface may still hold
+/// a previous (unrelated) capture's pixels.  Until the first paint,
+/// `handle_render` emits a fully transparent frame rather than leaking
+/// stale pixels.  Reset on URL change in `handle_update_config`.
 #[derive(Default)]
 struct FrameDelegate {
     loaded: Cell<bool>,
+    painted: Cell<bool>,
 }
 
 impl WebViewDelegate for FrameDelegate {
@@ -151,6 +159,7 @@ impl WebViewDelegate for FrameDelegate {
 
     fn notify_new_frame_ready(&self, webview: WebView) {
         webview.paint();
+        self.painted.set(true);
     }
 }
 
@@ -470,6 +479,11 @@ fn handle_render(
 
     let render_start = Instant::now();
 
+    // Bind this instance's context before pumping so its own paint targets
+    // its own surface.  `SoftwareRenderingContext`/surfman share GL state
+    // process-wide, so the read below additionally re-binds (see there).
+    let _ = state.rendering_context.make_current();
+
     // Pump the event loop to let Servo process pending work — this is
     // also what advances the deferred page load registered in
     // `handle_register`.
@@ -490,6 +504,22 @@ fn handle_render(
         );
     }
 
+    // Until Servo has painted the current page at least once, the surfman
+    // surface backing this rendering context may still contain a previous,
+    // unrelated capture's pixels (surfman reuses surfaces across contexts).
+    // Emit a fully transparent frame instead of reading stale content, so a
+    // freshly-opened clip/cast never leaks another session's page.
+    if !state.delegate.painted.get() {
+        let len = (state.config.width as usize) * (state.config.height as usize) * 4;
+        let rgba_data = vec![0u8; len];
+        state.render_count += 1;
+        state.render_duration_sum += render_start.elapsed();
+        if state.result_tx.send(ServoThreadResult::Frame { rgba_data }).is_err() {
+            instances.remove(node_id);
+        }
+        return;
+    }
+
     // Always read the full rendering context (rc_width × rc_height) —
     // this is the native size Servo is currently rendering at.  These
     // stay constant under `Resize` hints (output-only) but are updated
@@ -506,6 +536,12 @@ fn handle_render(
     let needs_scaling =
         state.rc_width != state.config.width || state.rc_height != state.config.height;
 
+    // `read_to_image` reads whichever surfman context is currently bound
+    // process-wide.  `spin_event_loop` paints every webview and leaves the
+    // last-painted instance's context current, so re-bind ours immediately
+    // before the read to guarantee we capture this instance's surface and
+    // never a concurrent node's (the cross-session pixel leak).
+    let _ = state.rendering_context.make_current();
     let rgba_data = if let Some(img) = state.rendering_context.read_to_image(rect) {
         let raw = if needs_scaling {
             let scaled = image::imageops::resize(
@@ -575,6 +611,10 @@ fn handle_update_config(
         if let Ok(parsed) = url::Url::parse(&new_config.url) {
             state.webview.load(parsed);
             state.delegate.loaded.set(false);
+            // Re-arm the first-paint gate so `handle_render` emits
+            // transparent frames until the new page paints, preventing the
+            // outgoing page's pixels from bleeding into the new capture.
+            state.delegate.painted.set(false);
             // Reset the one-shot post-load gate so the new page gets
             // its custom-CSS injection (if any) once it finishes
             // loading.  Render ticks will run `handle_render`'s
diff --git a/plugins/native/servo/tests/cross_session_leak.rs b/plugins/native/servo/tests/cross_session_leak.rs
new file mode 100644
index 000000000..ae0bde897
--- /dev/null
+++ b/plugins/native/servo/tests/cross_session_leak.rs
@@ -0,0 +1,124 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+//! Regression test for the cross-session pixel leak.
+//!
+//! Two concurrent Servo instances render solid-colour `data:` pages; no
+//! frame from one instance may ever contain the other's pixels.  Before
+//! the first-paint gate in `handle_render`, the surfman surface reused
+//! across instances meant a freshly-opened capture could emit a previous,
+//! unrelated page's pixels.
+//!
+//! This lives in its own integration binary because it boots the real
+//! Servo engine (software-rendered via llvmpipe — no GPU/display needed)
+//! and is far too heavy for the workspace `cargo test`.
+
+use std::io::Write;
+use std::sync::mpsc::Receiver;
+use std::time::Duration;
+
+use servo_web::test_api::{send_work, NodeId, ServoConfig, ServoThreadResult, ServoWorkItem};
+
+const DIM: u32 = 64;
+/// Per-instance tick budget — generous so the `data:` pages reach first
+/// paint even on a slow/loaded CI box.  Each tick advances the shared
+/// event loop once.
+const MAX_TICKS: usize = 400;
+
+fn send(item: ServoWorkItem) {
+    if let Err(e) = send_work(item) {
+        panic!("send_work failed: {e}");
+    }
+}
+
+fn register(url: &str) -> (NodeId, Receiver<ServoThreadResult>) {
+    let node_id = uuid::Uuid::new_v4();
+    let (tx, rx) = std::sync::mpsc::sync_channel(2);
+    let config =
+        ServoConfig { url: url.to_string(), width: DIM, height: DIM, ..ServoConfig::default() };
+    send(ServoWorkItem::Register { node_id, config, result_tx: tx });
+    match rx.recv() {
+        Ok(ServoThreadResult::InitOk) => {},
+        Ok(ServoThreadResult::InitErr(e)) => panic!("init failed: {e}"),
+        Ok(ServoThreadResult::Frame { .. }) => panic!("unexpected frame during init"),
+        Err(e) => panic!("init recv failed: {e}"),
+    }
+    (node_id, rx)
+}
+
+fn render(node_id: NodeId, rx: &Receiver<ServoThreadResult>) -> Vec<u8> {
+    send(ServoWorkItem::Render { node_id });
+    match rx.recv() {
+        Ok(ServoThreadResult::Frame { rgba_data }) => rgba_data,
+        Ok(_) => panic!("expected frame result"),
+        Err(e) => panic!("frame recv failed: {e}"),
+    }
+}
+
+/// Count opaque pixels that are predominantly red and predominantly blue.
+fn count_red_blue(frame: &[u8]) -> (usize, usize) {
+    let (mut red, mut blue) = (0usize, 0usize);
+    for px in frame.chunks_exact(4) {
+        let (r, g, b, a) = (px[0], px[1], px[2], px[3]);
+        if a < 128 {
+            continue;
+        }
+        if r > 200 && g < 80 && b < 80 {
+            red += 1;
+        } else if b > 200 && r < 80 && g < 80 {
+            blue += 1;
+        }
+    }
+    (red, blue)
+}
+
+#[test]
+fn no_cross_session_pixel_leak() {
+    let red_url = "data:text/html,<style>html,body{margin:0;height:100%;background:red}</style>";
+    let blue_url = "data:text/html,<style>html,body{margin:0;height:100%;background:blue}</style>";
+
+    let (red_id, red_rx) = register(red_url);
+    let (blue_id, blue_rx) = register(blue_url);
+
+    let mut red_saw_own = false;
+    let mut blue_saw_own = false;
+
+    for _ in 0..MAX_TICKS {
+        let rf = render(red_id, &red_rx);
+        let bf = render(blue_id, &blue_rx);
+
+        let (rr, rb) = count_red_blue(&rf);
+        let (br, bb) = count_red_blue(&bf);
+
+        assert_eq!(rb, 0, "red instance leaked blue pixels");
+        assert_eq!(br, 0, "blue instance leaked red pixels");
+
+        red_saw_own |= rr > 0;
+        blue_saw_own |= bb > 0;
+        if red_saw_own && blue_saw_own {
+            break;
+        }
+        std::thread::sleep(Duration::from_millis(5));
+    }
+
+    send(ServoWorkItem::Unregister { node_id: red_id });
+    send(ServoWorkItem::Unregister { node_id: blue_id });
+
+    // Otherwise the no-leak assertions above would be vacuous.
+    assert!(red_saw_own, "red instance never painted its own page");
+    assert!(blue_saw_own, "blue instance never painted its own page");
+
+    // Servo's embedded engine has no clean global-shutdown path: at normal
+    // process exit, mozjs' C++ static destructors race the still-live
+    // renderer thread and abort with a SIGSEGV, which would fail this
+    // otherwise-passing test.  This is the only test in this binary, so
+    // exiting here — after all assertions have held — is safe and bypasses
+    // that teardown entirely.
+    println!("no_cross_session_pixel_leak: PASSED");
+    let _ = std::io::stdout().flush();
+    // SAFETY: `_exit` is async-signal-safe and simply terminates the
+    // process with status 0 without running atexit handlers or C++ static
+    // destructors (the source of the teardown SIGSEGV above).
+    unsafe { libc::_exit(0) };
+}

From b2d9233f55e880a2743c9248ea620c325bcbb80e Mon Sep 17 00:00:00 2001
From: streamkit-devin <devin@streamkit.dev>
Date: Sun, 28 Jun 2026 18:57:50 +0000
Subject: [PATCH 09/26] fix(servo): re-arm first-paint gate on viewport resize

A resize via UpdateConfig reallocates the surfman surface, which is
pooled across instances and may hold another instance's pixels until
the resized page repaints. Re-arm the painted gate (as on URL change)
so handle_render emits transparent frames until the post-resize paint,
closing the same cross-session leak on the resize path.

Signed-off-by: streamkit-devin <devin@streamkit.dev>
---
 plugins/native/servo/src/servo_thread.rs | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/plugins/native/servo/src/servo_thread.rs b/plugins/native/servo/src/servo_thread.rs
index e5addde8b..6fef39d61 100644
--- a/plugins/native/servo/src/servo_thread.rs
+++ b/plugins/native/servo/src/servo_thread.rs
@@ -655,6 +655,10 @@ fn handle_update_config(
             state.rc_width = vw;
             state.rc_height = vh;
             state.last_good_frame = None;
+            // Re-arm the first-paint gate: resizing reallocates the
+            // surfman surface, which is pooled across instances and may
+            // hold a neighbour's pixels until the resized page repaints.
+            state.delegate.painted.set(false);
             servo.spin_event_loop();
         }
     }

From 1672946b9a7dcea64373f9a05334e3496e54c218 Mon Sep 17 00:00:00 2001
From: streamkit-devin <devin@streamkit.dev>
Date: Sun, 28 Jun 2026 19:08:51 +0000
Subject: [PATCH 10/26] feat(examples/web-capture): serve autoplay clip player
 page for browser parity

Browser visits to /clip/* (Accept: text/html) now get the same autoplay
HTML player page already served for /cast/*, instead of the browser's bare
native media viewer. The page's <video> re-requests the same URL with
Accept: */* and receives the raw progressive MP4, so CLI clients
(curl/ffmpeg) are unaffected. The HTML branch runs before clip-slot acquire,
so a browser visit does not consume render concurrency.

Generalizes castPageTemplate/writeCastPage into playerPageTemplate/
writePlayerPage(kind) shared by both handlers.

Signed-off-by: streamkit-devin <devin@streamkit.dev>
---
 examples/web-capture/cmd/gateway/main.go      | 10 ++-
 .../cmd/gateway/player_page_test.go           | 75 +++++++++++++++++++
 examples/web-capture/cmd/gateway/proxy.go     | 11 ++-
 3 files changed, 91 insertions(+), 5 deletions(-)
 create mode 100644 examples/web-capture/cmd/gateway/player_page_test.go

diff --git a/examples/web-capture/cmd/gateway/main.go b/examples/web-capture/cmd/gateway/main.go
index 190295ee2..3fc4acbc7 100644
--- a/examples/web-capture/cmd/gateway/main.go
+++ b/examples/web-capture/cmd/gateway/main.go
@@ -277,6 +277,14 @@ func (gw *gateway) handleCapture(w http.ResponseWriter, r *http.Request) {
 }
 
 func (gw *gateway) serveClip(w http.ResponseWriter, r *http.Request, u *url.URL, opts captureOpts) {
+	// A browser address-bar paste (Accept: text/html) gets an autoplay page; the
+	// page's <video> then re-requests this same URL (Accept: */*) and is served
+	// the raw MP4. Serving the page first avoids consuming a render slot for it.
+	if acceptsHTML(r) {
+		gw.writePlayerPage(w, r, "clip", u)
+		return
+	}
+
 	dur := opts.dur
 	if dur <= 0 {
 		dur = gw.clipDefaultDur
@@ -295,7 +303,7 @@ func (gw *gateway) serveCast(w http.ResponseWriter, r *http.Request, u *url.URL,
 	// A browser address-bar paste (Accept: text/html) gets an autoplay page; the
 	// page's <video> then re-requests this same URL (Accept: */*) and is streamed.
 	if acceptsHTML(r) {
-		gw.writeCastPage(w, r, u)
+		gw.writePlayerPage(w, r, "cast", u)
 		return
 	}
 
diff --git a/examples/web-capture/cmd/gateway/player_page_test.go b/examples/web-capture/cmd/gateway/player_page_test.go
new file mode 100644
index 000000000..d21a302bc
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/player_page_test.go
@@ -0,0 +1,75 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+package main
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+)
+
+// A browser request (Accept: text/html) must get the autoplay player page for
+// both clip and cast, without touching the backend/render path. CLI clients
+// (no text/html in Accept) fall through to the raw-video path.
+func TestServePlayerPageForBrowser(t *testing.T) {
+	u, _ := url.Parse("https://example.com/")
+	gw := &gateway{}
+
+	cases := []struct {
+		name    string
+		serve   func(http.ResponseWriter, *http.Request, *url.URL, captureOpts)
+		titleID string
+	}{
+		{"clip", gw.serveClip, "web-clip"},
+		{"cast", gw.serveCast, "web-cast"},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			r := httptest.NewRequest(http.MethodGet, "/"+tc.name+"/example.com", nil)
+			r.Header.Set("Accept", "text/html,application/xhtml+xml")
+			w := httptest.NewRecorder()
+
+			tc.serve(w, r, u, captureOpts{})
+
+			resp := w.Result()
+			if resp.StatusCode != http.StatusOK {
+				t.Fatalf("status = %d, want 200", resp.StatusCode)
+			}
+			if ct := resp.Header.Get("Content-Type"); !strings.HasPrefix(ct, "text/html") {
+				t.Fatalf("Content-Type = %q, want text/html", ct)
+			}
+			body := w.Body.String()
+			for _, want := range []string{"<video", "autoplay", tc.titleID, "example.com"} {
+				if !strings.Contains(body, want) {
+					t.Errorf("body missing %q\nbody: %s", want, body)
+				}
+			}
+		})
+	}
+}
+
+func TestAcceptsHTML(t *testing.T) {
+	cases := []struct {
+		accept string
+		want   bool
+	}{
+		{"text/html,application/xhtml+xml", true},
+		{"*/*", false},
+		{"", false},
+		{"application/json", false},
+	}
+	for _, tc := range cases {
+		r := httptest.NewRequest(http.MethodGet, "/clip/example.com", nil)
+		if tc.accept != "" {
+			r.Header.Set("Accept", tc.accept)
+		}
+		if got := acceptsHTML(r); got != tc.want {
+			t.Errorf("acceptsHTML(%q) = %v, want %v", tc.accept, got, tc.want)
+		}
+	}
+}
diff --git a/examples/web-capture/cmd/gateway/proxy.go b/examples/web-capture/cmd/gateway/proxy.go
index 8a55bee4c..5c54e1bf9 100644
--- a/examples/web-capture/cmd/gateway/proxy.go
+++ b/examples/web-capture/cmd/gateway/proxy.go
@@ -195,15 +195,18 @@ func streamCopy(ctx context.Context, w http.ResponseWriter, src io.Reader, endpo
 	}
 }
 
-const castPageTemplate = `<!doctype html><html><head><meta charset="utf-8">` +
-	`<title>web-cast · %s</title>` +
+// playerPageTemplate wraps the capture in a full-window autoplay <video>. The
+// <video> re-requests this same URL with `Accept: */*`, which the clip/cast
+// handlers serve as raw video, so CLI clients (curl/ffmpeg) bypass this page.
+const playerPageTemplate = `<!doctype html><html><head><meta charset="utf-8">` +
+	`<title>web-%s · %s</title>` +
 	`<style>html,body{margin:0;height:100%%;background:#000}video{width:100%%;height:100%%;object-fit:contain}</style>` +
 	`</head><body><video src="%s" autoplay muted playsinline controls></video></body></html>`
 
-func (gw *gateway) writeCastPage(w http.ResponseWriter, r *http.Request, target *url.URL) {
+func (gw *gateway) writePlayerPage(w http.ResponseWriter, r *http.Request, kind string, target *url.URL) {
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	w.WriteHeader(http.StatusOK)
-	_, _ = fmt.Fprintf(w, castPageTemplate, html.EscapeString(target.String()), html.EscapeString(r.RequestURI))
+	_, _ = fmt.Fprintf(w, playerPageTemplate, kind, html.EscapeString(target.String()), html.EscapeString(r.RequestURI))
 }
 
 const usagePage = `<!doctype html><html><head><meta charset="utf-8"><title>StreamKit web-capture</title>` +

From 6fdae5b3c5299bf3a82a0b2fd38ac384ba5c3d1d Mon Sep 17 00:00:00 2001
From: streamkit-devin <devin@streamkit.dev>
Date: Sun, 28 Jun 2026 19:20:50 +0000
Subject: [PATCH 11/26] fix(plugins/servo): clear cached frame on URL change

The URL-change branch of handle_update_config re-armed the first-paint
gate but left state.last_good_frame holding the previous URL's frame. If
read_to_image returned None on a tick after the new page painted,
handle_render fell back to that stale frame. Null it on URL change,
mirroring the viewport-resize branch.

Signed-off-by: streamkit-devin <devin@streamkit.dev>
---
 plugins/native/servo/src/servo_thread.rs | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/plugins/native/servo/src/servo_thread.rs b/plugins/native/servo/src/servo_thread.rs
index 6fef39d61..0a64d5596 100644
--- a/plugins/native/servo/src/servo_thread.rs
+++ b/plugins/native/servo/src/servo_thread.rs
@@ -615,6 +615,9 @@ fn handle_update_config(
             // transparent frames until the new page paints, preventing the
             // outgoing page's pixels from bleeding into the new capture.
             state.delegate.painted.set(false);
+            // Drop the cached frame so a `read_to_image` miss after the new
+            // page paints can't fall back to the previous URL's last frame.
+            state.last_good_frame = None;
             // Reset the one-shot post-load gate so the new page gets
             // its custom-CSS injection (if any) once it finishes
             // loading.  Render ticks will run `handle_render`'s

From 7a8a51725e4f80c51a2fcf080c8bcbb4176a01af Mon Sep 17 00:00:00 2001
From: streamkit-devin <devin@streamkit.dev>
Date: Sun, 28 Jun 2026 19:21:01 +0000
Subject: [PATCH 12/26] fix(examples/web-capture): clamp max-concurrency to
 >=1, fix option example

--max-concurrency 0 sized clipSem as an unbuffered channel, deadlocking
every clip render; clamp to a floor of 1 via clampConcurrency. Also fix
the optionsSegmentRe comment to use the real 'res=' key instead of the
non-existent 'vp='.

Signed-off-by: streamkit-devin <devin@streamkit.dev>
---
 examples/web-capture/cmd/gateway/capture.go   |  2 +-
 examples/web-capture/cmd/gateway/main.go      | 14 +++++++++++
 examples/web-capture/cmd/gateway/main_test.go | 24 +++++++++++++++++++
 3 files changed, 39 insertions(+), 1 deletion(-)
 create mode 100644 examples/web-capture/cmd/gateway/main_test.go

diff --git a/examples/web-capture/cmd/gateway/capture.go b/examples/web-capture/cmd/gateway/capture.go
index 95dc2efb2..c949615f2 100644
--- a/examples/web-capture/cmd/gateway/capture.go
+++ b/examples/web-capture/cmd/gateway/capture.go
@@ -55,7 +55,7 @@ type captureOpts struct {
 }
 
 // optionsSegmentRe matches a leading comma-separated key=value options segment
-// (e.g. "dur=30s" or "vp=1920x1080,dur=30s"). A real host never contains '=',
+// (e.g. "dur=30s" or "res=1920x1080,dur=30s"). A real host never contains '=',
 // so a first segment that matches this is unambiguously options, not the target.
 var optionsSegmentRe = regexp.MustCompile(`^[a-z]+=[^,/]+(,[a-z]+=[^,/]+)*$`)
 
diff --git a/examples/web-capture/cmd/gateway/main.go b/examples/web-capture/cmd/gateway/main.go
index 3fc4acbc7..9d6f2454f 100644
--- a/examples/web-capture/cmd/gateway/main.go
+++ b/examples/web-capture/cmd/gateway/main.go
@@ -157,6 +157,15 @@ func main() {
 	<-done
 }
 
+// clampConcurrency floors the clip-render concurrency at 1. A value < 1 would
+// size clipSem as an unbuffered channel and deadlock every clip render.
+func clampConcurrency(n int) int {
+	if n < 1 {
+		return 1
+	}
+	return n
+}
+
 func loadConfig() config {
 	listen := flag.String("listen", getEnvDefault("GATEWAY_LISTEN", defaultListenAddr), "Listen address")
 	skit := flag.String("skit-url", getEnvDefault("SKIT_URL", defaultSkitURL), "Skit backend URL")
@@ -182,6 +191,11 @@ func loadConfig() config {
 		clipDefaultDur = clipMaxDur
 	}
 
+	if c := clampConcurrency(*maxConc); c != *maxConc {
+		log.Printf("invalid --max-concurrency %d, using %d", *maxConc, c)
+		*maxConc = c
+	}
+
 	resW, resH, err := parseResolution(*resolution)
 	if err != nil {
 		log.Printf("invalid --resolution %q, using %s", *resolution, defaultResolution)
diff --git a/examples/web-capture/cmd/gateway/main_test.go b/examples/web-capture/cmd/gateway/main_test.go
new file mode 100644
index 000000000..f747cd6c9
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/main_test.go
@@ -0,0 +1,24 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+package main
+
+import "testing"
+
+func TestClampConcurrency(t *testing.T) {
+	cases := []struct {
+		in   int
+		want int
+	}{
+		{-1, 1},
+		{0, 1},
+		{1, 1},
+		{4, 4},
+	}
+	for _, tc := range cases {
+		if got := clampConcurrency(tc.in); got != tc.want {
+			t.Errorf("clampConcurrency(%d) = %d, want %d", tc.in, got, tc.want)
+		}
+	}
+}

From 7d1f949d0224b1795768b95e9220e90a42a2ad9a Mon Sep 17 00:00:00 2001
From: streamkit-devin <devin@streamkit.dev>
Date: Sun, 28 Jun 2026 20:30:45 +0000
Subject: [PATCH 13/26] feat(transport::http::mse): add fMP4 support for H.264
 casting

The node only detected WebM Cluster IDs to delimit the init segment and
GOPs, so an H.264 cast stream (fragmented MP4: ftyp+moov init, repeating
moof+mdat fragments) never flipped init_complete and zero bytes reached
clients. Browsers showed nothing for the h264-sw cast encoder the demo
pins.

Detect the container framing from the first packet (ftyp/styp box at
offset 4 => fMP4, else WebM) and drive a parallel fMP4 state machine that
mirrors the WebM init+GOP replay: buffer ftyp+moov as the init segment,
split off the first moof-led fragment, and replay init + latest fragment
to late-joiners. The WebM path is unchanged.

Adds unit tests for framing detection, MP4 box scanning (incl. 64-bit
largesize), init/fragment splitting, cross-packet init buffering, and
GOP buffer capping.

Signed-off-by: streamkit-devin <devin@streamkit.dev>
---
 crates/nodes/src/transport/http_mse.rs | 384 ++++++++++++++++++++++++-
 1 file changed, 380 insertions(+), 4 deletions(-)

diff --git a/crates/nodes/src/transport/http_mse.rs b/crates/nodes/src/transport/http_mse.rs
index 9ea30cef5..14209f950 100644
--- a/crates/nodes/src/transport/http_mse.rs
+++ b/crates/nodes/src/transport/http_mse.rs
@@ -57,7 +57,165 @@ const WEBM_TRACKS_ID: [u8; 4] = [0x16, 0x54, 0xAE, 0x6B];
 /// keyframes are infrequent (e.g. 10 s interval at high bitrate).
 const MAX_GOP_BUFFER_SIZE: usize = 2 * 1024 * 1024; // 2 MB
 
-/// Buffers the WebM init segment and replays it to late-joining HTTP clients.
+/// Container framing of the upstream byte stream.
+///
+/// The node forwards two structurally different live containers. WebM uses
+/// the Cluster element to delimit the init segment and each GOP; fragmented
+/// MP4 (fMP4, used for the H.264 cast path) uses `ftyp`+`moov` as the init
+/// segment and a repeating `moof`+`mdat` per media fragment.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum Framing {
+    WebM,
+    Fmp4,
+}
+
+/// Detect the container framing from the first bytes of the stream.
+///
+/// fMP4 starts with an `ftyp` (or `styp`) box, whose 4-byte type sits at
+/// offset 4 after the box size. Anything else is treated as WebM, preserving
+/// the original behaviour for the vp9/av1 paths.
+fn detect_framing(data: &[u8]) -> Framing {
+    if data.len() >= 8 && (&data[4..8] == b"ftyp" || &data[4..8] == b"styp") {
+        Framing::Fmp4
+    } else {
+        Framing::WebM
+    }
+}
+
+/// Find the byte offset of the first top-level MP4 box of `box_type`.
+///
+/// Scans length-prefixed boxes (32-bit size, or 64-bit largesize when
+/// size == 1; size == 0 means "to end of stream"). Returns `None` if the
+/// box is not present or a header is truncated mid-stream.
+fn find_mp4_box(data: &[u8], box_type: [u8; 4]) -> Option<usize> {
+    let mut pos = 0usize;
+    while pos + 8 <= data.len() {
+        let size32 = u32::from_be_bytes([data[pos], data[pos + 1], data[pos + 2], data[pos + 3]]);
+        if data[pos + 4..pos + 8] == box_type {
+            return Some(pos);
+        }
+        let box_size = match size32 {
+            1 => {
+                if pos + 16 > data.len() {
+                    return None;
+                }
+                let large = u64::from_be_bytes([
+                    data[pos + 8],
+                    data[pos + 9],
+                    data[pos + 10],
+                    data[pos + 11],
+                    data[pos + 12],
+                    data[pos + 13],
+                    data[pos + 14],
+                    data[pos + 15],
+                ]);
+                usize::try_from(large).ok()?
+            },
+            0 => return None,
+            n => n as usize,
+        };
+        if box_size < 8 {
+            return None;
+        }
+        pos = pos.checked_add(box_size)?;
+    }
+    None
+}
+
+/// Outcome of feeding one fMP4 packet to the framer.
+enum Fmp4Step {
+    /// Still buffering the init segment; nothing to forward yet.
+    NeedMore,
+    /// Init segment (`ftyp`+`moov`) just completed; `forward` is the first
+    /// media fragment that followed it in the same packet.
+    Started { forward: Bytes },
+    /// A subsequent media fragment to forward.
+    Fragment { forward: Bytes },
+}
+
+/// Drive the fMP4 init/fragment state machine for one input packet.
+///
+/// The cast muxer emits the init segment prepended to the first media
+/// fragment, then one `moof`+`mdat` fragment per packet. Init bytes are
+/// split off into `init_segment` (for late-joiner replay); `gop_buffer`
+/// holds the most recent fragment so late joiners start at a keyframe.
+fn fmp4_process_packet(
+    data: &Bytes,
+    init_segment: &mut Vec<u8>,
+    gop_buffer: &mut Vec<u8>,
+    init_complete: &mut bool,
+) -> Fmp4Step {
+    if !*init_complete {
+        let moof = if init_segment.is_empty() {
+            find_mp4_box(data, *b"moof")
+        } else {
+            let mut combined = init_segment.clone();
+            combined.extend_from_slice(data);
+            find_mp4_box(&combined, *b"moof")
+        };
+
+        let Some(moof_offset) = moof else {
+            let remaining = MAX_INIT_SEGMENT_SIZE.saturating_sub(init_segment.len());
+            let to_append = data.len().min(remaining);
+            init_segment.extend_from_slice(&data[..to_append]);
+            return Fmp4Step::NeedMore;
+        };
+
+        let prefix_len = init_segment.len();
+        let take = moof_offset.saturating_sub(prefix_len);
+        init_segment.extend_from_slice(&data[..take.min(data.len())]);
+        let fragment = data.slice(take.min(data.len())..);
+        *init_complete = true;
+        gop_buffer.clear();
+        gop_buffer.extend_from_slice(&fragment);
+        return Fmp4Step::Started { forward: fragment };
+    }
+
+    if find_mp4_box(data, *b"moof") == Some(0) {
+        gop_buffer.clear();
+    }
+    gop_buffer.extend_from_slice(data);
+    if gop_buffer.len() > MAX_GOP_BUFFER_SIZE {
+        gop_buffer.clear();
+    }
+    Fmp4Step::Fragment { forward: data.clone() }
+}
+
+/// Broadcast one chunk to every connected client, dropping any that have
+/// disconnected or fallen too far behind (dropping bytes mid-stream corrupts
+/// the container, so a slow client is disconnected rather than starved).
+/// Each successful delivery is counted in `stats` when `count` is set.
+fn broadcast_chunk(
+    clients: &mut Vec<mpsc::Sender<Bytes>>,
+    chunk: &Bytes,
+    stats: &mut NodeStatsTracker,
+    count: bool,
+) {
+    let mut i = 0;
+    while i < clients.len() {
+        match clients[i].try_send(chunk.clone()) {
+            Ok(()) => {
+                if count {
+                    stats.sent();
+                }
+                i += 1;
+            },
+            Err(mpsc::error::TrySendError::Closed(_)) => {
+                clients.swap_remove(i);
+                tracing::debug!(client_count = clients.len(), "MSE client disconnected");
+            },
+            Err(mpsc::error::TrySendError::Full(_)) => {
+                clients.swap_remove(i);
+                tracing::warn!(
+                    client_count = clients.len(),
+                    "MSE client too slow, disconnecting to avoid corrupt stream"
+                );
+            },
+        }
+    }
+}
+
+/// Buffers the init segment and replays it to late-joining HTTP clients.
 pub struct HttpMseNode {
     config: HttpMseConfig,
 }
@@ -177,6 +335,10 @@ impl ProcessorNode for HttpMseNode {
         let mut gop_buffer: Vec<u8> = Vec::new();
         let mut init_complete = false;
 
+        // Container framing, detected from the first packet. WebM and fMP4
+        // delimit their init segment and GOPs differently.
+        let mut framing: Option<Framing> = None;
+
         // Overlap buffer: last 3 bytes of previous chunk, for detecting
         // a 4-byte Cluster ID that straddles chunk boundaries.
         let mut overlap: Vec<u8> = Vec::new();
@@ -267,6 +429,38 @@ impl ProcessorNode for HttpMseNode {
                         continue;
                     }
 
+                    let framing = *framing.get_or_insert_with(|| detect_framing(&data));
+
+                    if framing == Framing::Fmp4 {
+                        match fmp4_process_packet(
+                            &data,
+                            &mut init_segment,
+                            &mut gop_buffer,
+                            &mut init_complete,
+                        ) {
+                            Fmp4Step::NeedMore => {}
+                            Fmp4Step::Started { forward } => {
+                                let elapsed_ms = u64::try_from(node_start.elapsed().as_millis())
+                                    .unwrap_or(u64::MAX);
+                                tracing::info!(
+                                    init_segment_size = init_segment.len(),
+                                    elapsed_ms,
+                                    "fMP4 init segment captured"
+                                );
+                                if !init_segment.is_empty() {
+                                    let init_bytes = Bytes::copy_from_slice(&init_segment);
+                                    broadcast_chunk(&mut clients, &init_bytes, &mut stats_tracker, false);
+                                }
+                                broadcast_chunk(&mut clients, &forward, &mut stats_tracker, true);
+                            }
+                            Fmp4Step::Fragment { forward } => {
+                                broadcast_chunk(&mut clients, &forward, &mut stats_tracker, true);
+                            }
+                        }
+                        stats_tracker.maybe_send();
+                        continue;
+                    }
+
                     let mut cluster_start_in_data: Option<usize> = None;
                     let mut cluster_prefix: Vec<u8> = Vec::new();
 
@@ -592,9 +786,10 @@ pub fn register_http_mse_nodes(registry: &mut streamkit_core::NodeRegistry) {
         HttpMseNode,
         HttpMseConfig,
         ["transport", "http", "mse"],
-        "Serves WebM streams to HTTP clients for MSE (Media Source Extensions) playback. \
-         Accepts binary data from an upstream WebM muxer and broadcasts to multiple \
-         concurrent HTTP clients with init segment replay for late-joiners.",
+        "Serves WebM or fragmented-MP4 (fMP4) streams to HTTP clients for MSE \
+         (Media Source Extensions) playback. Accepts binary data from an upstream \
+         WebM or fMP4 muxer and broadcasts to multiple concurrent HTTP clients with \
+         init segment replay for late-joiners.",
     );
 }
 
@@ -1104,4 +1299,185 @@ mod tests {
         assert_eq!(truncated.len(), tracks_end);
         assert_eq!(truncated, header);
     }
+
+    fn mp4_box(box_type: &[u8], payload: &[u8]) -> Vec<u8> {
+        let size = u32::try_from(8 + payload.len()).unwrap();
+        let mut b = Vec::with_capacity(size as usize);
+        b.extend_from_slice(&size.to_be_bytes());
+        b.extend_from_slice(box_type);
+        b.extend_from_slice(payload);
+        b
+    }
+
+    fn concat(parts: &[&[u8]]) -> Vec<u8> {
+        parts.iter().flat_map(|p| p.iter().copied()).collect()
+    }
+
+    #[test]
+    fn test_detect_framing() {
+        let ftyp = mp4_box(b"ftyp", b"isom");
+        assert_eq!(detect_framing(&ftyp), Framing::Fmp4);
+
+        let styp = mp4_box(b"styp", b"msdh");
+        assert_eq!(detect_framing(&styp), Framing::Fmp4);
+
+        // WebM EBML header
+        assert_eq!(detect_framing(&[0x1A, 0x45, 0xDF, 0xA3, 0, 0, 0, 0]), Framing::WebM);
+        // Too short to be fMP4 → WebM (the vp9/av1 default path).
+        assert_eq!(detect_framing(&[0x1F, 0x43]), Framing::WebM);
+    }
+
+    #[test]
+    fn test_find_mp4_box() {
+        let ftyp = mp4_box(b"ftyp", b"isom");
+        let moov_box = mp4_box(b"moov", &[0xAB; 40]);
+        let frag = mp4_box(b"moof", &[0xCD; 16]);
+        let stream = concat(&[&ftyp, &moov_box, &frag]);
+
+        assert_eq!(find_mp4_box(&stream, *b"ftyp"), Some(0));
+        assert_eq!(find_mp4_box(&stream, *b"moov"), Some(ftyp.len()));
+        assert_eq!(find_mp4_box(&stream, *b"moof"), Some(ftyp.len() + moov_box.len()));
+        assert_eq!(find_mp4_box(&stream, *b"mdat"), None);
+
+        // Truncated header (< 8 bytes) yields None rather than panicking.
+        assert_eq!(find_mp4_box(&[0, 0, 0, 16, b'm'], *b"moof"), None);
+    }
+
+    #[test]
+    fn test_find_mp4_box_largesize() {
+        // size == 1 signals a 64-bit largesize in the following 8 bytes.
+        let ftyp = mp4_box(b"ftyp", b"isom");
+        let mut big = Vec::new();
+        big.extend_from_slice(&1u32.to_be_bytes());
+        big.extend_from_slice(b"mdat");
+        big.extend_from_slice(&(24u64).to_be_bytes());
+        big.extend_from_slice(&[0x11; 8]);
+        let moof = mp4_box(b"moof", &[0x22; 8]);
+        let stream = concat(&[&ftyp, &big, &moof]);
+
+        assert_eq!(find_mp4_box(&stream, *b"moof"), Some(ftyp.len() + big.len()));
+    }
+
+    fn fmp4_init() -> Vec<u8> {
+        concat(&[&mp4_box(b"ftyp", b"isom"), &mp4_box(b"moov", &[0xAB; 48])])
+    }
+
+    fn fmp4_fragment(payload: u8) -> Vec<u8> {
+        concat(&[&mp4_box(b"moof", &[payload; 12]), &mp4_box(b"mdat", &[payload; 64])])
+    }
+
+    #[test]
+    fn test_fmp4_first_packet_splits_init_and_fragment() {
+        let init = fmp4_init();
+        let frag = fmp4_fragment(0x01);
+        let packet = Bytes::from(concat(&[&init, &frag]));
+
+        let mut init_segment = Vec::new();
+        let mut gop_buffer = Vec::new();
+        let mut init_complete = false;
+
+        let step =
+            fmp4_process_packet(&packet, &mut init_segment, &mut gop_buffer, &mut init_complete);
+
+        match step {
+            Fmp4Step::Started { forward } => assert_eq!(&forward[..], &frag[..]),
+            _ => panic!("expected Started on first packet"),
+        }
+        assert!(init_complete);
+        assert_eq!(init_segment, init, "init segment must be ftyp+moov only");
+        assert_eq!(gop_buffer, frag, "GOP buffer holds the latest fragment");
+    }
+
+    #[test]
+    fn test_fmp4_subsequent_fragment_resets_gop() {
+        let init = fmp4_init();
+        let frag1 = fmp4_fragment(0x01);
+        let frag2 = fmp4_fragment(0x02);
+
+        let mut init_segment = Vec::new();
+        let mut gop_buffer = Vec::new();
+        let mut init_complete = false;
+
+        fmp4_process_packet(
+            &Bytes::from(concat(&[&init, &frag1])),
+            &mut init_segment,
+            &mut gop_buffer,
+            &mut init_complete,
+        );
+
+        let step = fmp4_process_packet(
+            &Bytes::from(frag2.clone()),
+            &mut init_segment,
+            &mut gop_buffer,
+            &mut init_complete,
+        );
+
+        match step {
+            Fmp4Step::Fragment { forward } => assert_eq!(&forward[..], &frag2[..]),
+            _ => panic!("expected Fragment"),
+        }
+        // A new moof-led fragment replaces the previous GOP so late joiners
+        // always start at the most recent keyframe-aligned segment.
+        assert_eq!(gop_buffer, frag2);
+        assert_eq!(init_segment, init, "init segment is immutable after capture");
+    }
+
+    #[test]
+    fn test_fmp4_init_split_across_packets() {
+        let ftyp = mp4_box(b"ftyp", b"isom");
+        let moov = mp4_box(b"moov", &[0xAB; 48]);
+        let frag = fmp4_fragment(0x07);
+
+        let mut init_segment = Vec::new();
+        let mut gop_buffer = Vec::new();
+        let mut init_complete = false;
+
+        // ftyp+moov with no moof yet → still buffering.
+        let step1 = fmp4_process_packet(
+            &Bytes::from(concat(&[&ftyp, &moov])),
+            &mut init_segment,
+            &mut gop_buffer,
+            &mut init_complete,
+        );
+        assert!(matches!(step1, Fmp4Step::NeedMore));
+        assert!(!init_complete);
+
+        // The moof arrives in the next packet → init completes, fragment forwarded.
+        let step2 = fmp4_process_packet(
+            &Bytes::from(frag.clone()),
+            &mut init_segment,
+            &mut gop_buffer,
+            &mut init_complete,
+        );
+        match step2 {
+            Fmp4Step::Started { forward } => assert_eq!(&forward[..], &frag[..]),
+            _ => panic!("expected Started once moof arrives"),
+        }
+        assert!(init_complete);
+        assert_eq!(init_segment, concat(&[&ftyp, &moov]));
+    }
+
+    #[test]
+    fn test_fmp4_gop_buffer_capped() {
+        let init = fmp4_init();
+        let mut init_segment = Vec::new();
+        let mut gop_buffer = Vec::new();
+        let mut init_complete = false;
+        fmp4_process_packet(
+            &Bytes::from(concat(&[&init, &fmp4_fragment(0x01)])),
+            &mut init_segment,
+            &mut gop_buffer,
+            &mut init_complete,
+        );
+
+        // A single oversized fragment must not grow the buffer past the cap.
+        let huge = concat(&[&mp4_box(b"moof", &[0x09; 8]), &vec![0u8; MAX_GOP_BUFFER_SIZE + 16]]);
+        fmp4_process_packet(
+            &Bytes::from(huge),
+            &mut init_segment,
+            &mut gop_buffer,
+            &mut init_complete,
+        );
+        assert!(gop_buffer.len() <= MAX_GOP_BUFFER_SIZE);
+    }
 }

From 1cc9da49b00f9eea9a79b96928a52bed708bbe3b Mon Sep 17 00:00:00 2001
From: streamkit-devin <devin@streamkit.dev>
Date: Sun, 28 Jun 2026 20:44:59 +0000
Subject: [PATCH 14/26] fix(web-capture): close pipe reader if clip request
 build fails

If http.NewRequestWithContext fails in proxyOneshot, the multipart writer
goroutine parks forever on the io.Pipe whose reader is never consumed. Close
the reader on the error path so the worker unwinds. Addresses Devin Review.

Signed-off-by: streamkit-devin <devin@streamkit.dev>
---
 examples/web-capture/cmd/gateway/proxy.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/examples/web-capture/cmd/gateway/proxy.go b/examples/web-capture/cmd/gateway/proxy.go
index 5c54e1bf9..030dc9de7 100644
--- a/examples/web-capture/cmd/gateway/proxy.go
+++ b/examples/web-capture/cmd/gateway/proxy.go
@@ -74,6 +74,7 @@ func (gw *gateway) proxyOneshot(w http.ResponseWriter, r *http.Request, pipeline
 
 	req, err := http.NewRequestWithContext(ctx, http.MethodPost, gw.skitURL+"/api/v1/process", bodyReader)
 	if err != nil {
+		_ = bodyReader.Close()
 		gw.failUpstream(w, "clip", fmt.Errorf("create skit request: %w", err))
 		return
 	}

From af7cef109855052a64ab4aa75613aa6960a68f2e Mon Sep 17 00:00:00 2001
From: streamkit-devin <devin@streamkit.dev>
Date: Sun, 28 Jun 2026 20:48:10 +0000
Subject: [PATCH 15/26] chore(plugins/servo): bump version to 0.1.1

Release-ready bump covering the cross-session pixel-leak privacy fix and the
first-paint transparent-frame gate. Regenerates marketplace/official-plugins.json
via scripts/marketplace/generate_official_plugins.py.

Signed-off-by: streamkit-devin <devin@streamkit.dev>
---
 marketplace/official-plugins.json | 2 +-
 plugins/native/servo/Cargo.lock   | 2 +-
 plugins/native/servo/Cargo.toml   | 2 +-
 plugins/native/servo/plugin.yml   | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/marketplace/official-plugins.json b/marketplace/official-plugins.json
index 9cb41007f..b0474e94f 100644
--- a/marketplace/official-plugins.json
+++ b/marketplace/official-plugins.json
@@ -304,7 +304,7 @@
     {
       "id": "servo",
       "name": "Servo Web Renderer",
-      "version": "0.1.0",
+      "version": "0.1.1",
       "node_kind": "servo",
       "kind": "native",
       "entrypoint": "libservo_web.so",
diff --git a/plugins/native/servo/Cargo.lock b/plugins/native/servo/Cargo.lock
index 71b690a1d..2aa9b715e 100644
--- a/plugins/native/servo/Cargo.lock
+++ b/plugins/native/servo/Cargo.lock
@@ -6458,7 +6458,7 @@ dependencies = [
 
 [[package]]
 name = "servo-plugin-native"
-version = "0.1.0"
+version = "0.1.1"
 dependencies = [
  "dpi",
  "euclid",
diff --git a/plugins/native/servo/Cargo.toml b/plugins/native/servo/Cargo.toml
index cd883ebbc..f44c04c45 100644
--- a/plugins/native/servo/Cargo.toml
+++ b/plugins/native/servo/Cargo.toml
@@ -4,7 +4,7 @@
 
 [package]
 name = "servo-plugin-native"
-version = "0.1.0"
+version = "0.1.1"
 edition = "2021"
 license = "MPL-2.0"
 
diff --git a/plugins/native/servo/plugin.yml b/plugins/native/servo/plugin.yml
index fa8be2898..89057d2d9 100644
--- a/plugins/native/servo/plugin.yml
+++ b/plugins/native/servo/plugin.yml
@@ -4,7 +4,7 @@
 
 id: servo
 name: Servo Web Renderer
-version: 0.1.0
+version: 0.1.1
 node_kind: servo
 kind: native
 entrypoint: libservo_web.so

From 6821c16a1a125262665e17c83a1992fcbfbaad9e Mon Sep 17 00:00:00 2001
From: streamkit-devin <devin@streamkit.dev>
Date: Mon, 29 Jun 2026 18:00:11 +0000
Subject: [PATCH 16/26] fix(web-capture): fail fast in proxyMSE when session
 reaped mid-retry

A post-teardown 404 from the MSE upstream is indistinguishable by status
from a pre-ready 404, so the readiness loop spun the full mseReadyTimeout
and returned a misleading 502 when a session was reaped (idle/max-lifetime)
just as a deduped late viewer connected. Check session liveness in the loop
and return 503 immediately when the session is gone.

Signed-off-by: streamkit-devin <devin@streamkit.dev>
---
 examples/web-capture/cmd/gateway/metrics.go   |  1 +
 examples/web-capture/cmd/gateway/proxy.go     | 13 ++++++-
 examples/web-capture/cmd/gateway/sessions.go  | 11 ++++++
 .../web-capture/cmd/gateway/sessions_test.go  | 38 +++++++++++++++++++
 4 files changed, 61 insertions(+), 2 deletions(-)

diff --git a/examples/web-capture/cmd/gateway/metrics.go b/examples/web-capture/cmd/gateway/metrics.go
index 437904479..923b05d41 100644
--- a/examples/web-capture/cmd/gateway/metrics.go
+++ b/examples/web-capture/cmd/gateway/metrics.go
@@ -109,6 +109,7 @@ const (
 	reasonSSRFBlocked   rejectReason = "ssrf_blocked"
 	reasonOverCapacity  rejectReason = "over_capacity"
 	reasonUpstreamError rejectReason = "upstream_error"
+	reasonSessionGone   rejectReason = "session_gone"
 )
 
 func recordRejection(endpoint string, reason rejectReason) {
diff --git a/examples/web-capture/cmd/gateway/proxy.go b/examples/web-capture/cmd/gateway/proxy.go
index 030dc9de7..f51e5d325 100644
--- a/examples/web-capture/cmd/gateway/proxy.go
+++ b/examples/web-capture/cmd/gateway/proxy.go
@@ -117,9 +117,12 @@ func (gw *gateway) proxyOneshot(w http.ResponseWriter, r *http.Request, pipeline
 	streamCopy(ctx, w, resp.Body, "clip")
 }
 
-// proxyMSE streams a live WebM session to the viewer. The http_mse path only
+// proxyMSE streams a live session to the viewer. The http_mse path only
 // registers once the session's pipeline starts, so a freshly created session
-// may 404 briefly — retry until ready or the viewer goes away.
+// may 404 briefly — retry until ready or the viewer goes away. A 404 after the
+// session has been reaped (idle/max-lifetime) is indistinguishable from the
+// startup 404 by status alone, so the loop also checks session liveness and
+// fails fast rather than spinning until the ready timeout.
 func (gw *gateway) proxyMSE(w http.ResponseWriter, r *http.Request, s *liveSession) {
 	ctx := r.Context()
 	streamURL := gw.skit.streamURL(s.id)
@@ -147,6 +150,12 @@ func (gw *gateway) proxyMSE(w http.ResponseWriter, r *http.Request, s *liveSessi
 		if ctx.Err() != nil {
 			return
 		}
+		if !gw.sessions.isLive(s.id) {
+			log.Printf("cast: session %s reaped before mse stream became ready", s.id)
+			recordRejection("cast", reasonSessionGone)
+			http.Error(w, "stream unavailable, please retry", http.StatusServiceUnavailable)
+			return
+		}
 		if time.Now().After(deadline) {
 			if err != nil {
 				gw.failUpstream(w, "cast", err)
diff --git a/examples/web-capture/cmd/gateway/sessions.go b/examples/web-capture/cmd/gateway/sessions.go
index be3dd9174..d46c8e5de 100644
--- a/examples/web-capture/cmd/gateway/sessions.go
+++ b/examples/web-capture/cmd/gateway/sessions.go
@@ -212,6 +212,17 @@ func (m *sessionManager) acquire(ctx context.Context, key string, renderYAML fun
 	return s, nil
 }
 
+// isLive reports whether the session is still tracked (not yet reaped or torn
+// down). proxyMSE uses it to tell a transient pre-ready 404 (pipeline still
+// starting) apart from a 404 after the session was reaped mid-stream — e.g. a
+// max-lifetime reap landing just as a deduped late viewer connects.
+func (m *sessionManager) isLive(id string) bool {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	_, ok := m.byID[id]
+	return ok
+}
+
 func (m *sessionManager) release(s *liveSession) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
diff --git a/examples/web-capture/cmd/gateway/sessions_test.go b/examples/web-capture/cmd/gateway/sessions_test.go
index a98f2791c..05c138688 100644
--- a/examples/web-capture/cmd/gateway/sessions_test.go
+++ b/examples/web-capture/cmd/gateway/sessions_test.go
@@ -252,6 +252,44 @@ func TestSessionManagerShutdownDuringCreate(t *testing.T) {
 	}
 }
 
+// A session reaped while a deduped late viewer is still waiting in proxyMSE's
+// readiness loop must fail fast (the post-teardown 404 is otherwise
+// indistinguishable from a pre-ready 404, so the loop would spin the full
+// mseReadyTimeout and return a misleading 502).
+func TestProxyMSEFailsFastWhenSessionReaped(t *testing.T) {
+	// Upstream always 404s (as it would for both a not-yet-ready and a
+	// torn-down session).
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusNotFound)
+	}))
+	defer srv.Close()
+
+	m := newSessionManager(&skitClient{client: srv.Client(), baseURL: srv.URL}, 4, 10, time.Hour, time.Hour)
+	gw := &gateway{
+		streamClient:    srv.Client(),
+		skit:            &skitClient{client: srv.Client(), baseURL: srv.URL},
+		sessions:        m,
+		mseReadyTimeout: 30 * time.Second, // long: the test must return well before this
+	}
+	// A session the manager no longer tracks (reaped) — isLive(id) is false.
+	s := &liveSession{id: "sess-reaped", ready: make(chan struct{})}
+	close(s.ready)
+
+	r := httptest.NewRequest(http.MethodGet, "/cast/example.com", nil)
+	w := httptest.NewRecorder()
+
+	start := time.Now()
+	gw.proxyMSE(w, r, s)
+	elapsed := time.Since(start)
+
+	if w.Code != http.StatusServiceUnavailable {
+		t.Fatalf("status = %d, want 503", w.Code)
+	}
+	if elapsed > 5*time.Second {
+		t.Fatalf("proxyMSE spun for %v; expected fast fail well under mseReadyTimeout", elapsed)
+	}
+}
+
 func TestSessionManagerShutdownAll(t *testing.T) {
 	ms, srv := newMockSkit()
 	defer srv.Close()

From d0288fc909ab81bfa94b7c3b3012320737b7100f Mon Sep 17 00:00:00 2001
From: streamkit-devin <devin@streamkit.dev>
Date: Mon, 29 Jun 2026 18:00:27 +0000
Subject: [PATCH 17/26] fix(web-capture): block IPv4-compatible IPv6 and
 local-use NAT64 in SSRF guard

::a.b.c.d (IPv4-compatible) bypassed blockedV4 because To4() returns nil,
and the RFC 8215 local-use NAT64 prefix (64:ff9b:1::/48) was not matched by
embeddedV4, so ::169.254.169.254 and 64:ff9b:1::a9fe:a9fe reached the
metadata IP. Extend embeddedV4 to extract the embedded v4 from both forms
and re-screen it; add regression cases for the two bypasses.

Signed-off-by: streamkit-devin <devin@streamkit.dev>
---
 examples/web-capture/cmd/gateway/capture.go   | 78 ++++++++++++++-----
 .../web-capture/cmd/gateway/capture_test.go   | 15 ++--
 2 files changed, 69 insertions(+), 24 deletions(-)

diff --git a/examples/web-capture/cmd/gateway/capture.go b/examples/web-capture/cmd/gateway/capture.go
index c949615f2..4d50e2bfe 100644
--- a/examples/web-capture/cmd/gateway/capture.go
+++ b/examples/web-capture/cmd/gateway/capture.go
@@ -5,6 +5,7 @@
 package main
 
 import (
+	"bytes"
 	"context"
 	"errors"
 	"fmt"
@@ -178,11 +179,12 @@ func parseResolution(s string) (w, h int, err error) {
 	return w, h, nil
 }
 
-// validateTarget enforces the public/URL-only policy: http(s) only, and the
-// host must not resolve to a loopback/private/link-local/metadata address. DNS
-// is re-resolved here so a hostname pointing at an internal IP is caught;
-// rebinding between this check and Servo's own fetch is a documented limitation.
-func validateTarget(ctx context.Context, raw string) (*url.URL, error) {
+// parseTargetURL runs the DNS-free half of target validation: http(s)-only
+// scheme plus a literal-IP block check. It is cheap enough to run before the
+// autoplay player page (which never fetches the target), so a browser visit
+// pays no DNS lookup. The page's <video> re-request then hits the render path,
+// where validateTarget completes the check with a single DNS resolution.
+func parseTargetURL(raw string) (*url.URL, error) {
 	u, err := url.Parse(raw)
 	if err != nil {
 		return nil, fmt.Errorf("parse url: %w", err)
@@ -196,22 +198,50 @@ func validateTarget(ctx context.Context, raw string) (*url.URL, error) {
 	if host == "" {
 		return nil, errBlockedTarget
 	}
+	if ip := net.ParseIP(host); ip != nil && isBlockedIP(ip) {
+		return nil, errBlockedTarget
+	}
+	return u, nil
+}
+
+// validateTarget enforces the public/URL-only policy: http(s) only, and the
+// host must not resolve to a loopback/private/link-local/metadata address. DNS
+// is re-resolved here so a hostname pointing at an internal IP is caught;
+// rebinding between this check and Servo's own fetch is a documented limitation.
+func validateTarget(ctx context.Context, raw string) (*url.URL, error) {
+	u, err := parseTargetURL(raw)
+	if err != nil {
+		return nil, err
+	}
+	if err := resolveTargetAllowed(ctx, u); err != nil {
+		return nil, err
+	}
+	return u, nil
+}
 
+// resolveTargetAllowed completes validateTarget by resolving a hostname and
+// rejecting it if any address is internal. Literal-IP hosts are already screened
+// by parseTargetURL, so they skip the lookup.
+func resolveTargetAllowed(ctx context.Context, u *url.URL) error {
+	host := u.Hostname()
+	if net.ParseIP(host) != nil {
+		return nil
+	}
 	rctx, cancel := context.WithTimeout(ctx, 5*time.Second)
 	defer cancel()
 	addrs, err := net.DefaultResolver.LookupIPAddr(rctx, host)
 	if err != nil {
-		return nil, fmt.Errorf("resolve host: %w", err)
+		return fmt.Errorf("resolve host: %w", err)
 	}
 	if len(addrs) == 0 {
-		return nil, errBlockedTarget
+		return errBlockedTarget
 	}
 	for _, a := range addrs {
 		if isBlockedIP(a.IP) {
-			return nil, errBlockedTarget
+			return errBlockedTarget
 		}
 	}
-	return u, nil
+	return nil
 }
 
 func isBlockedIP(ip net.IP) bool {
@@ -249,21 +279,31 @@ func blockedV4(v4 net.IP) bool {
 	}
 }
 
-// embeddedV4 returns the IPv4 embedded in a NAT64 (64:ff9b::/96) or 6to4
-// (2002::/16) address, or nil for anything else.
+// embeddedV4 returns the IPv4 address an IPv6 form can reach an IPv4 host
+// through — so the caller can re-screen it against the internal-range block
+// list. Covers NAT64 (well-known 64:ff9b::/96 and RFC 8215 local-use
+// 64:ff9b:1::/48), 6to4 (2002::/16), and the deprecated IPv4-compatible
+// ::a.b.c.d (::/96); returns nil for anything else.
 func embeddedV4(ip net.IP) net.IP {
 	v6 := ip.To16()
 	if v6 == nil || ip.To4() != nil {
 		return nil
 	}
-	nat64 := v6[0] == 0x00 && v6[1] == 0x64 && v6[2] == 0xff && v6[3] == 0x9b &&
-		v6[4] == 0 && v6[5] == 0 && v6[6] == 0 && v6[7] == 0 &&
-		v6[8] == 0 && v6[9] == 0 && v6[10] == 0 && v6[11] == 0
-	if nat64 {
-		return net.IPv4(v6[12], v6[13], v6[14], v6[15])
-	}
-	if v6[0] == 0x20 && v6[1] == 0x02 { // 6to4
+	suffixV4 := net.IPv4(v6[12], v6[13], v6[14], v6[15])
+	switch {
+	case bytes.HasPrefix(v6, []byte{0x00, 0x64, 0xff, 0x9b, 0, 0, 0, 0, 0, 0, 0, 0}): // NAT64 64:ff9b::/96
+		return suffixV4
+	case bytes.HasPrefix(v6, []byte{0x00, 0x64, 0xff, 0x9b, 0x00, 0x01}): // NAT64 64:ff9b:1::/48 (RFC 8215)
+		return suffixV4
+	case v6[0] == 0x20 && v6[1] == 0x02: // 6to4 2002::/16
 		return net.IPv4(v6[2], v6[3], v6[4], v6[5])
+	case bytes.Equal(v6[:12], ipv4CompatPrefix): // ::a.b.c.d (loopback/unspecified already screened)
+		return suffixV4
+	default:
+		return nil
 	}
-	return nil
 }
+
+// ipv4CompatPrefix is the 12 zero bytes that lead an IPv4-compatible IPv6
+// address (::a.b.c.d).
+var ipv4CompatPrefix = make([]byte, 12)
diff --git a/examples/web-capture/cmd/gateway/capture_test.go b/examples/web-capture/cmd/gateway/capture_test.go
index 6efb16fea..a1d634161 100644
--- a/examples/web-capture/cmd/gateway/capture_test.go
+++ b/examples/web-capture/cmd/gateway/capture_test.go
@@ -133,11 +133,16 @@ func TestValidateTarget(t *testing.T) {
 		{"http://172.16.0.1", true},
 		{"http://100.64.0.1", true}, // CGNAT
 		{"http://0.0.0.0", true},
-		{"http://0.0.0.1", true},              // 0.0.0.0/8 "this host"
-		{"http://198.18.0.1", true},           // 198.18.0.0/15 benchmarking
-		{"http://[64:ff9b::7f00:1]", true},    // NAT64 of 127.0.0.1
-		{"http://[2002:7f00:1::]", true},      // 6to4 embedding 127.0.0.1
-		{"https://[64:ff9b::808:808]", false}, // NAT64 of public 8.8.8.8 — allowed
+		{"http://0.0.0.1", true},                  // 0.0.0.0/8 "this host"
+		{"http://198.18.0.1", true},               // 198.18.0.0/15 benchmarking
+		{"http://[64:ff9b::7f00:1]", true},        // NAT64 of 127.0.0.1
+		{"http://[64:ff9b:1::a9fe:a9fe]", true},   // NAT64 local-use (RFC 8215) of 169.254.169.254
+		{"http://[2002:7f00:1::]", true},          // 6to4 embedding 127.0.0.1
+		{"http://[::169.254.169.254]", true},      // IPv4-compatible IPv6 of metadata
+		{"http://[::ffff:169.254.169.254]", true}, // IPv4-mapped IPv6 of metadata
+		{"https://[64:ff9b::808:808]", false},     // NAT64 of public 8.8.8.8 — allowed
+		{"https://[64:ff9b:1::808:808]", false},   // NAT64 local-use of public 8.8.8.8 — allowed
+		{"https://[::1.1.1.1]", false},            // IPv4-compatible IPv6 of public 1.1.1.1 — allowed
 		{"http://[::1]", true},
 		{"ftp://8.8.8.8", true}, // scheme
 		{"https://8.8.8.8", false},

From debfd9a3d4e355ce7db07a0e41f36ef9880cca5b Mon Sep 17 00:00:00 2001
From: streamkit-devin <devin@streamkit.dev>
Date: Mon, 29 Jun 2026 18:00:44 +0000
Subject: [PATCH 18/26] perf(web-capture): defer target DNS lookup off the
 player-page path

handleCapture ran the full validateTarget (up to a 5s DNS lookup) before the
acceptsHTML short-circuit, so a browser address-bar visit paid the lookup just
to render the static autoplay page. Split out parseTargetURL (scheme +
literal-IP screen, no DNS) for the cheap fail-fast path and defer the hostname
resolution into serveClip/serveCast after the player page is served. Also drop
the dead dur<=0 re-defaulting in serveClip (opts.dur is always >0).

Signed-off-by: streamkit-devin <devin@streamkit.dev>
---
 examples/web-capture/cmd/gateway/main.go | 30 +++++++++++++++++++-----
 1 file changed, 24 insertions(+), 6 deletions(-)

diff --git a/examples/web-capture/cmd/gateway/main.go b/examples/web-capture/cmd/gateway/main.go
index 9d6f2454f..f64a87400 100644
--- a/examples/web-capture/cmd/gateway/main.go
+++ b/examples/web-capture/cmd/gateway/main.go
@@ -275,7 +275,10 @@ func (gw *gateway) handleCapture(w http.ResponseWriter, r *http.Request) {
 			http.Error(w, "bad request: "+err.Error(), http.StatusBadRequest)
 			return
 		}
-		u, err := validateTarget(r.Context(), target)
+		// Only the DNS-free screen (scheme + literal-IP block) runs here; the
+		// hostname DNS resolution is deferred into the render path so a browser
+		// visit served the autoplay page pays no lookup (see serveClip/serveCast).
+		u, err := parseTargetURL(target)
 		if err != nil {
 			recordRejection(endpoint, reasonSSRFBlocked)
 			http.Error(w, "target host is not allowed", http.StatusForbidden)
@@ -298,18 +301,17 @@ func (gw *gateway) serveClip(w http.ResponseWriter, r *http.Request, u *url.URL,
 		gw.writePlayerPage(w, r, "clip", u)
 		return
 	}
-
-	dur := opts.dur
-	if dur <= 0 {
-		dur = gw.clipDefaultDur
+	if !gw.screenResolvable(w, r, u, "clip") {
+		return
 	}
+
 	release, ok := gw.acquireClip(r.Context())
 	if !ok {
 		return // client disconnected while queued for a slot
 	}
 	defer release()
 
-	yaml := renderClipPipeline(u.String(), opts.resW, opts.resH, captureFPS, clipFrames(dur), gw.clipBitrate, gw.clipEnc)
+	yaml := renderClipPipeline(u.String(), opts.resW, opts.resH, captureFPS, clipFrames(opts.dur), gw.clipBitrate, gw.clipEnc)
 	gw.proxyOneshot(w, r, yaml)
 }
 
@@ -320,6 +322,9 @@ func (gw *gateway) serveCast(w http.ResponseWriter, r *http.Request, u *url.URL,
 		gw.writePlayerPage(w, r, "cast", u)
 		return
 	}
+	if !gw.screenResolvable(w, r, u, "cast") {
+		return
+	}
 
 	// Resolution is part of the render, so it keys the shared session: viewers of
 	// the same URL+resolution share one pipeline; a different resolution is its
@@ -347,6 +352,19 @@ func (gw *gateway) serveCast(w http.ResponseWriter, r *http.Request, u *url.URL,
 	gw.proxyMSE(w, r, s)
 }
 
+// screenResolvable completes SSRF validation for the render path by resolving
+// the target hostname; it is called after the player-page short-circuit so a
+// browser visit never pays the DNS lookup. Returns false (and writes a 403)
+// when the host resolves to a blocked address.
+func (gw *gateway) screenResolvable(w http.ResponseWriter, r *http.Request, u *url.URL, endpoint string) bool {
+	if err := resolveTargetAllowed(r.Context(), u); err != nil {
+		recordRejection(endpoint, reasonSSRFBlocked)
+		http.Error(w, "target host is not allowed", http.StatusForbidden)
+		return false
+	}
+	return true
+}
+
 // clipFrames rounds a duration to a whole number of frames (parseDuration
 // accepts sub-second values, so truncation would skew the clip length).
 func clipFrames(dur time.Duration) int {

From 8b748fbe3b83d06aea3689e68fbc23c6558af746 Mon Sep 17 00:00:00 2001
From: streamkit-devin <devin@streamkit.dev>
Date: Mon, 29 Jun 2026 18:01:01 +0000
Subject: [PATCH 19/26] refactor(servo): dedupe transparent-frame paths and
 surface make_current errors
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Extract a transparent_frame(w,h) helper and route the unpainted, panic-fallback,
and read_to_image-miss paths through it, collapsing three copies of the buffer
build. Move the painted-surface read into read_painted_frame and stop discarding
the make_current() Result before read_to_image — a bind failure means the frame
may not be this instance's surface, so log it instead of silently risking the
cross-session leak the bind is meant to prevent.

Signed-off-by: streamkit-devin <devin@streamkit.dev>
---
 plugins/native/servo/src/servo_thread.rs | 116 ++++++++++++-----------
 1 file changed, 62 insertions(+), 54 deletions(-)

diff --git a/plugins/native/servo/src/servo_thread.rs b/plugins/native/servo/src/servo_thread.rs
index 0a64d5596..8b488d23b 100644
--- a/plugins/native/servo/src/servo_thread.rs
+++ b/plugins/native/servo/src/servo_thread.rs
@@ -373,18 +373,22 @@ fn panic_message(payload: &Box<dyn std::any::Any + Send>) -> String {
         .unwrap_or_else(|| "unknown panic".to_string())
 }
 
+/// A fully transparent RGBA8 frame at the given output dimensions, used until
+/// the page first paints, on a `read_to_image` miss with no cached frame, and
+/// as the post-panic fallback.
+fn transparent_frame(width: u32, height: u32) -> Vec<u8> {
+    vec![0u8; (width as usize) * (height as usize) * 4]
+}
+
 /// Send a fallback frame (last good frame or transparent) after a panic.
 fn send_fallback_frame(instances: &HashMap<NodeId, InstanceState>, node_id: &NodeId) {
     let Some(state) = instances.get(node_id) else {
         return;
     };
-    let fallback = state.last_good_frame.as_ref().map_or_else(
-        || {
-            let len = (state.config.width as usize) * (state.config.height as usize) * 4;
-            vec![0u8; len]
-        },
-        Clone::clone,
-    );
+    let fallback = state
+        .last_good_frame
+        .clone()
+        .unwrap_or_else(|| transparent_frame(state.config.width, state.config.height));
     let _ = state.result_tx.send(ServoThreadResult::Frame { rgba_data: fallback });
 }
 
@@ -504,26 +508,46 @@ fn handle_render(
         );
     }
 
-    // Until Servo has painted the current page at least once, the surfman
-    // surface backing this rendering context may still contain a previous,
-    // unrelated capture's pixels (surfman reuses surfaces across contexts).
-    // Emit a fully transparent frame instead of reading stale content, so a
-    // freshly-opened clip/cast never leaks another session's page.
-    if !state.delegate.painted.get() {
-        let len = (state.config.width as usize) * (state.config.height as usize) * 4;
-        let rgba_data = vec![0u8; len];
-        state.render_count += 1;
-        state.render_duration_sum += render_start.elapsed();
-        if state.result_tx.send(ServoThreadResult::Frame { rgba_data }).is_err() {
-            instances.remove(node_id);
-        }
-        return;
+    let rgba_data = if state.delegate.painted.get() {
+        read_painted_frame(state, node_id)
+    } else {
+        // Until Servo has painted the current page at least once, the surfman
+        // surface backing this rendering context may still contain a previous,
+        // unrelated capture's pixels (surfman reuses surfaces across contexts).
+        // Emit a fully transparent frame instead of reading stale content, so a
+        // freshly-opened clip/cast never leaks another session's page.
+        transparent_frame(state.config.width, state.config.height)
+    };
+
+    let render_duration = render_start.elapsed();
+    state.render_count += 1;
+    state.render_duration_sum += render_duration;
+
+    // Log render time periodically (every 300 frames ~ 10s at 30fps).
+    if state.render_count % 300 == 0 {
+        let avg_us = state.render_duration_sum.as_micros() / u128::from(state.render_count);
+        tracing::debug!(
+            node_id = %node_id,
+            frame = state.render_count,
+            render_us = render_duration.as_micros(),
+            avg_render_us = avg_us,
+            "Servo render metrics",
+        );
+    }
+
+    if state.result_tx.send(ServoThreadResult::Frame { rgba_data }).is_err() {
+        instances.remove(node_id);
     }
+}
 
-    // Always read the full rendering context (rc_width × rc_height) —
-    // this is the native size Servo is currently rendering at.  These
-    // stay constant under `Resize` hints (output-only) but are updated
-    // under `UpdateConfig` when the viewport resolution changes.
+/// Read this instance's painted surface into an RGBA8 frame, scaling to the
+/// output size and falling back to the cached frame (or transparent) on a miss.
+/// Caller must have already confirmed the page has painted at least once.
+fn read_painted_frame(state: &mut InstanceState, node_id: &NodeId) -> Vec<u8> {
+    // Always read the full rendering context (rc_width × rc_height) — the
+    // native size Servo is currently rendering at. These stay constant under
+    // `Resize` hints (output-only) but are updated under `UpdateConfig` when
+    // the viewport resolution changes.
     let rect = Box2D::new(
         Point2D::new(0, 0),
         Point2D::new(
@@ -532,17 +556,23 @@ fn handle_render(
         ),
     );
 
-    // Scale when the rendering context size differs from the output.
     let needs_scaling =
         state.rc_width != state.config.width || state.rc_height != state.config.height;
 
     // `read_to_image` reads whichever surfman context is currently bound
-    // process-wide.  `spin_event_loop` paints every webview and leaves the
+    // process-wide. `spin_event_loop` paints every webview and leaves the
     // last-painted instance's context current, so re-bind ours immediately
-    // before the read to guarantee we capture this instance's surface and
-    // never a concurrent node's (the cross-session pixel leak).
-    let _ = state.rendering_context.make_current();
-    let rgba_data = if let Some(img) = state.rendering_context.read_to_image(rect) {
+    // before the read to capture this instance's surface and never a concurrent
+    // node's (the cross-session pixel leak). A bind failure means the read may
+    // return another instance's pixels, so surface it rather than silently leak.
+    if let Err(e) = state.rendering_context.make_current() {
+        tracing::warn!(
+            node_id = %node_id,
+            error = ?e,
+            "make_current before read_to_image failed; frame may not be this instance's surface",
+        );
+    }
+    if let Some(img) = state.rendering_context.read_to_image(rect) {
         let raw = if needs_scaling {
             let scaled = image::imageops::resize(
                 &img,
@@ -567,29 +597,7 @@ fn handle_render(
         tracing::debug!(node_id = %node_id, "read_to_image returned None, using cached frame");
         cached.clone()
     } else {
-        // No cached frame — send transparent at output resolution.
-        let len = (state.config.width as usize) * (state.config.height as usize) * 4;
-        vec![0u8; len]
-    };
-
-    let render_duration = render_start.elapsed();
-    state.render_count += 1;
-    state.render_duration_sum += render_duration;
-
-    // Log render time periodically (every 300 frames ~ 10s at 30fps).
-    if state.render_count % 300 == 0 {
-        let avg_us = state.render_duration_sum.as_micros() / u128::from(state.render_count);
-        tracing::debug!(
-            node_id = %node_id,
-            frame = state.render_count,
-            render_us = render_duration.as_micros(),
-            avg_render_us = avg_us,
-            "Servo render metrics",
-        );
-    }
-
-    if state.result_tx.send(ServoThreadResult::Frame { rgba_data }).is_err() {
-        instances.remove(node_id);
+        transparent_frame(state.config.width, state.config.height)
     }
 }
 

From ff957fe339d15e53a8a4d288e999dd081f3307a7 Mon Sep 17 00:00:00 2001
From: streamkit-devin <devin@streamkit.dev>
Date: Mon, 29 Jun 2026 18:25:32 +0000
Subject: [PATCH 20/26] refactor(web-capture): dedupe gateway auth/maxViewers
 state and strip Connection-listed headers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Drop gateway.authToken/authReq; route auth through the single skitClient.auth.
- Drop gateway.maxViewers; read from the session manager so the two can't drift.
- copyHeaders now also strips headers named in the Connection header (RFC 7230 §6.1).

Signed-off-by: streamkit-devin <devin@streamkit.dev>
---
 examples/web-capture/cmd/gateway/main.go      |  5 +--
 examples/web-capture/cmd/gateway/proxy.go     | 23 +++++++-----
 .../web-capture/cmd/gateway/proxy_test.go     | 35 +++++++++++++++++++
 3 files changed, 50 insertions(+), 13 deletions(-)
 create mode 100644 examples/web-capture/cmd/gateway/proxy_test.go

diff --git a/examples/web-capture/cmd/gateway/main.go b/examples/web-capture/cmd/gateway/main.go
index f64a87400..963d1fb68 100644
--- a/examples/web-capture/cmd/gateway/main.go
+++ b/examples/web-capture/cmd/gateway/main.go
@@ -79,7 +79,6 @@ type gateway struct {
 	castBitrate     int
 	clipEnc         encoderProfile
 	castEnc         encoderProfile
-	maxViewers      int
 	mseReadyTimeout time.Duration
 	skit            *skitClient
 	sessions        *sessionManager
@@ -103,7 +102,6 @@ func main() {
 		client:          ctrlClient,
 		streamClient:    newHTTPClient(true),
 		skitURL:         cfg.skitURL,
-		authToken:       cfg.authToken,
 		clipSem:         make(chan struct{}, cfg.maxConcurrency),
 		clipDefaultDur:  cfg.clipDefaultDur,
 		clipMaxDur:      cfg.clipMaxDur,
@@ -113,7 +111,6 @@ func main() {
 		castBitrate:     cfg.castBitrate,
 		clipEnc:         clipEnc,
 		castEnc:         castEnc,
-		maxViewers:      cfg.maxViewers,
 		mseReadyTimeout: 8 * time.Second,
 		skit:            skit,
 		sessions:        newSessionManager(skit, cfg.maxSessions, cfg.maxViewers, cfg.idleTTL, cfg.maxLifetime),
@@ -331,7 +328,7 @@ func (gw *gateway) serveCast(w http.ResponseWriter, r *http.Request, u *url.URL,
 	// own. The YAML renders lazily — only a session-creating acquire uses it.
 	key := fmt.Sprintf("%s|%dx%d", u.String(), opts.resW, opts.resH)
 	s, err := gw.sessions.acquire(r.Context(), key, func() string {
-		return renderCastPipeline(u.String(), opts.resW, opts.resH, captureFPS, gw.maxViewers, gw.castBitrate, gw.castEnc)
+		return renderCastPipeline(u.String(), opts.resW, opts.resH, captureFPS, gw.sessions.maxViewers, gw.castBitrate, gw.castEnc)
 	})
 	if err != nil {
 		switch {
diff --git a/examples/web-capture/cmd/gateway/proxy.go b/examples/web-capture/cmd/gateway/proxy.go
index f51e5d325..61fd6b6be 100644
--- a/examples/web-capture/cmd/gateway/proxy.go
+++ b/examples/web-capture/cmd/gateway/proxy.go
@@ -36,12 +36,6 @@ func newHTTPClient(keepAlives bool) *http.Client {
 	}
 }
 
-func (gw *gateway) authReq(req *http.Request) {
-	if gw.authToken != "" {
-		req.Header.Set("Authorization", "Bearer "+gw.authToken)
-	}
-}
-
 func (gw *gateway) failUpstream(w http.ResponseWriter, endpoint string, err error) {
 	log.Printf("%s upstream error: %v", endpoint, err)
 	recordRejection(endpoint, reasonUpstreamError)
@@ -80,7 +74,7 @@ func (gw *gateway) proxyOneshot(w http.ResponseWriter, r *http.Request, pipeline
 	}
 	req.Header.Set("Content-Type", mw.FormDataContentType())
 	req.Close = true
-	gw.authReq(req)
+	gw.skit.auth(req)
 
 	start := time.Now()
 	resp, err := gw.client.Do(req)
@@ -137,7 +131,7 @@ func (gw *gateway) proxyMSE(w http.ResponseWriter, r *http.Request, s *liveSessi
 			gw.failUpstream(w, "cast", err)
 			return
 		}
-		gw.authReq(req)
+		gw.skit.auth(req)
 		r2, err := gw.streamClient.Do(req)
 		if err == nil && r2.StatusCode == http.StatusOK {
 			resp = r2
@@ -258,8 +252,19 @@ var hopByHop = map[string]bool{
 }
 
 func copyHeaders(dst, src http.Header) {
+	// Headers named in the Connection header are connection-scoped too
+	// (RFC 7230 §6.1) and must not be forwarded.
+	connScoped := make(map[string]bool)
+	for _, v := range src["Connection"] {
+		for _, name := range strings.Split(v, ",") {
+			if name = strings.TrimSpace(name); name != "" {
+				connScoped[strings.ToLower(name)] = true
+			}
+		}
+	}
 	for k, vv := range src {
-		if hopByHop[strings.ToLower(k)] {
+		lk := strings.ToLower(k)
+		if hopByHop[lk] || connScoped[lk] {
 			continue
 		}
 		for _, v := range vv {
diff --git a/examples/web-capture/cmd/gateway/proxy_test.go b/examples/web-capture/cmd/gateway/proxy_test.go
new file mode 100644
index 000000000..8975b4d75
--- /dev/null
+++ b/examples/web-capture/cmd/gateway/proxy_test.go
@@ -0,0 +1,35 @@
+// SPDX-FileCopyrightText: © 2025 StreamKit Contributors
+//
+// SPDX-License-Identifier: MPL-2.0
+
+package main
+
+import (
+	"net/http"
+	"testing"
+)
+
+func TestCopyHeadersStripsHopByHopAndConnectionListed(t *testing.T) {
+	src := http.Header{
+		"Content-Type":      {"video/mp4"},
+		"Connection":        {"keep-alive, X-Internal-Token"},
+		"Keep-Alive":        {"timeout=5"},
+		"Transfer-Encoding": {"chunked"},
+		"X-Internal-Token":  {"secret"},
+		"Cache-Control":     {"no-store"},
+	}
+	dst := http.Header{}
+	copyHeaders(dst, src)
+
+	if got := dst.Get("Content-Type"); got != "video/mp4" {
+		t.Errorf("Content-Type = %q, want forwarded", got)
+	}
+	if got := dst.Get("Cache-Control"); got != "no-store" {
+		t.Errorf("Cache-Control = %q, want forwarded", got)
+	}
+	for _, h := range []string{"Connection", "Keep-Alive", "Transfer-Encoding", "X-Internal-Token"} {
+		if v := dst.Get(h); v != "" {
+			t.Errorf("%s = %q, want stripped", h, v)
+		}
+	}
+}

From d77d0a7c9ef619079e257132faaacc29ec66527c Mon Sep 17 00:00:00 2001
From: streamkit-devin <devin@streamkit.dev>
Date: Tue, 30 Jun 2026 13:07:04 +0000
Subject: [PATCH 21/26] chore(deps): bump anyhow + wasmtime-wasi and ignore
 ttf-parser unmaintained advisory

Resolves the cargo-deny advisory failures from newly published RUSTSEC notices:
- anyhow 1.0.102 -> 1.0.103 (RUSTSEC-2026-0190, downcast_mut unsoundness)
- wasmtime-wasi 46.0.0 -> 46.0.1 (RUSTSEC-2026-0188, WASI FilePerms bypass)
- ignore RUSTSEC-2026-0192 (ttf-parser unmaintained via fontdue; no safe
  upgrade, tracked in #642), matching the existing unmaintained-advisory ignores.

Signed-off-by: streamkit-devin <devin@streamkit.dev>
---
 Cargo.lock | 132 ++++++++++++++++++++++++++---------------------------
 deny.toml  |   7 +++
 2 files changed, 73 insertions(+), 66 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index e16c9c170..b4358be26 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -165,9 +165,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.102"
+version = "1.0.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
 
 [[package]]
 name = "arbitrary"
@@ -1206,9 +1206,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-bforest"
-version = "0.133.0"
+version = "0.133.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e2e9b7adf77fa02204d4d523ae4f171b6591c2632b030865336335c7d7b420e"
+checksum = "03b4982ef9fa54ec9eee841e891e7ddc5434be1250e88de31572e000c888f30b"
 dependencies = [
  "cranelift-entity",
  "wasmtime-internal-core",
@@ -1216,9 +1216,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-bitset"
-version = "0.133.0"
+version = "0.133.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90f09d9f397eae612ac15becf0e0b2165d2232003f4f2a1549572a724d1c48c5"
+checksum = "529143118c4eeb58c39ecb02319557d512be6c61348486422974ab8e3906b8a8"
 dependencies = [
  "serde",
  "serde_derive",
@@ -1227,9 +1227,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-codegen"
-version = "0.133.0"
+version = "0.133.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e004cf1270abc82f7b9fb32d1a9d73a1cc0d5a0215b97db8c32658748e78b01"
+checksum = "b7780677247ad3577e3a6a3ebf43f39b325a11d6393db72b2c9968a910d4d13d"
 dependencies = [
  "bumpalo",
  "cranelift-assembler-x64",
@@ -1258,9 +1258,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-codegen-meta"
-version = "0.133.0"
+version = "0.133.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04f32034641f96b123e4fdb5666e726d9f252e222638fc8fdd905b4ff18c3c4e"
+checksum = "ac9645250416cbf92454fe61160e17e026e0ce405906a54500b114f923ddffc9"
 dependencies = [
  "cranelift-assembler-x64-meta",
  "cranelift-codegen-shared",
@@ -1286,9 +1286,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-entity"
-version = "0.133.0"
+version = "0.133.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "341d5e1e071320505ebbc8194a8eb61fa94394b1ed93ba3cbec3be5fa1c3c1ce"
+checksum = "a5300c49cf940526fe771517b3b3eabd5d0ff164ee61698579cf403fe8d3af3c"
 dependencies = [
  "cranelift-bitset",
  "serde",
@@ -1298,9 +1298,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-frontend"
-version = "0.133.0"
+version = "0.133.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97c6f3e2419ecb54a5503994d35421554c5e487d0493bc86ea96907bab51fd29"
+checksum = "da4adbf760207fdbbe130f1191cce01cdef66831a9f648b1f39ff2800d126d45"
 dependencies = [
  "cranelift-codegen",
  "hashbrown 0.17.1",
@@ -1311,15 +1311,15 @@ dependencies = [
 
 [[package]]
 name = "cranelift-isle"
-version = "0.133.0"
+version = "0.133.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21aa47a5e0b1e9fb2c9348459088d5dbb872ebe17781ada1270d8364c7e73257"
+checksum = "8315b21ff018226a42a60a4702c2dd75f6447cac26e9bca622e14c22088c2ff5"
 
 [[package]]
 name = "cranelift-native"
-version = "0.133.0"
+version = "0.133.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3054a03ac285b170662ec9530602b01cd394a7428cd753b48d9cae51f05249a"
+checksum = "d506ef23a60715bde451b06620b14402166ded3b648454fccbf04f3e46a4aa70"
 dependencies = [
  "cranelift-codegen",
  "libc",
@@ -1863,7 +1863,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -2990,7 +2990,7 @@ checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46"
 dependencies = [
  "hermit-abi",
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -4791,7 +4791,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b570b25f7617e43d59005d0990ccb79e950a423952cea19671b7a876da390adf"
 dependencies = [
  "anyhow",
- "itertools 0.14.0",
+ "itertools 0.12.1",
  "proc-macro2",
  "quote",
  "syn 2.0.118",
@@ -4817,9 +4817,9 @@ dependencies = [
 
 [[package]]
 name = "pulley-interpreter"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "047bda68096e5f290619ce037b7c3fa352d11f08edf0fce3030c351adc0f8ec0"
+checksum = "38b92604caae1a1899b6a5b54967289dd538177c626004c91accf9d0ec7e4a12"
 dependencies = [
  "cranelift-bitset",
  "log",
@@ -4829,9 +4829,9 @@ dependencies = [
 
 [[package]]
 name = "pulley-macros"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83258a9bcc97d3fb15bf4e1c43bc2cc85c718e3563a697f145f245e651f2828f"
+checksum = "5a7ac85c0bb3fb351f10d531230aaa5e366b46d7c4e5328e5f02801d6dac1165"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -5662,7 +5662,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -5731,7 +5731,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -5752,7 +5752,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -6896,7 +6896,7 @@ dependencies = [
  "getrandom 0.4.3",
  "once_cell",
  "rustix 1.1.4",
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -8002,9 +8002,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08dd5caf09eda1d523261a0dd421a54e3bb165cf6f5b02c82327e712d49e3cf4"
+checksum = "c4213d2f019a5e44aa8a61d8826dd33a505bff79f749b14a8bafd67321cb9351"
 dependencies = [
  "addr2line 0.26.1",
  "async-trait",
@@ -8055,9 +8055,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-environ"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1f3aa689689cf295568aa4d24ab636579fb3b36dfa7cea35020d87064fc88ec"
+checksum = "d45863de41977ec6453e859cf843d456fa3fcb45a659b66d16e794f90ec4f5b7"
 dependencies = [
  "anyhow",
  "cpp_demangle",
@@ -8086,9 +8086,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-cache"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd6c27fbabb7df6c88a592a28773a92aa8cfba5ee656963d7ad9b32a8f57a3d8"
+checksum = "438bc7dc45fb75297d75f79a9a0ce852345d13ebc6a6863f6f688f013836a9dd"
 dependencies = [
  "base64 0.22.1",
  "directories-next",
@@ -8106,9 +8106,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-component-macro"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de4451ab437d7b2d41e637a4379e87ff76aeeb051236064dcc75c1855714ee58"
+checksum = "f1e48f8d4966d62a10b6d70722bc432c1e163890be2801d3b5784589ad36ffc3"
 dependencies = [
  "anyhow",
  "proc-macro2",
@@ -8121,15 +8121,15 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-component-util"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53b5e357002645964342b99a6fe8405cda7dd031f498927992c9d99d5012daa7"
+checksum = "819ad5abd5822a22dbf4014475cdfd1fe790707761cd732d74aaa3ba4d5ba489"
 
 [[package]]
 name = "wasmtime-internal-core"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f6ce74d60a8ed870548e7efa9710c54f982bbfcf80e5ee5eee8498318616483"
+checksum = "3fc28372e36eaf8cf70faa83b5779137f7e99c8d18569a125d1580e735cc9e4d"
 dependencies = [
  "anyhow",
  "hashbrown 0.17.1",
@@ -8139,9 +8139,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-cranelift"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e24204583d847b7ce3d770f7a3456739d5d43f65c884cb47111dbe27b26ebbe6"
+checksum = "a433efc6e35112a5457e1dc8bc4d8d39820ac7722267e89bc04e5df641f32124"
 dependencies = [
  "cfg-if",
  "cranelift-codegen",
@@ -8166,9 +8166,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-fiber"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ecaeb13bf3eb94a02e32ea3842c8fda3ea6897c299745100c1230b65769d2d91"
+checksum = "18a1d3a39d0d210f6b8574ee96a4315e0a14c67f3a1fc3cd5372cb10d2fb4422"
 dependencies = [
  "cc",
  "cfg-if",
@@ -8181,9 +8181,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-jit-debug"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5090e9a302bb5729a84766e4af07b6b10efe733e437bc266dd954a957114df63"
+checksum = "9f667288cb4dfa68a4639ffac4d5628535dda64ebdc2b990526efb12b30ba803"
 dependencies = [
  "cc",
  "object 0.39.1",
@@ -8193,9 +8193,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-jit-icache-coherence"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bba33d9d951a9a974a866e80c864a9a46b28086e369582e0caa78e14a9f29e4"
+checksum = "eba651d44ab0faad4c58106b3adb45068189fb65ef50f0c404b6d9e3bf81a357"
 dependencies = [
  "cfg-if",
  "libc",
@@ -8205,9 +8205,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-unwinder"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "695063a19bac17895f95c0c0f2f9544e85a277763cd77b5778f0cce6a971073e"
+checksum = "2ecc52563b0558af2a7487eb710de07cc4532564b55528876129238e83118cb1"
 dependencies = [
  "cfg-if",
  "cranelift-codegen",
@@ -8218,9 +8218,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-versioned-export-macros"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc77f7513209b76e8f4772af640819f47fca3a5425b4417ef9c20b888334063c"
+checksum = "e747f4a074699ba1b4e4d841fb263f9b7df5bd1555181c4752bf5990d21ba676"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -8229,9 +8229,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-wit-bindgen"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e859103d8336304b8beebbf89a620c2f53a118fd5fbce41bc572cf4bacc8111d"
+checksum = "80009f46991622814196d96fac6fc0a938f46b5cba737a8f4e21e24e5a03856f"
 dependencies = [
  "anyhow",
  "bitflags 2.13.0",
@@ -8242,9 +8242,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-wasi"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "093c67243785465fdab0cb8bfada4a1171a543dfc22b392201c77d8086367b58"
+checksum = "e9f65ef30a2c5478873cdb619085a7a649d3ce41cc3eaf298a7ce3dee96a8e11"
 dependencies = [
  "async-trait",
  "bitflags 2.13.0",
@@ -8271,9 +8271,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-wasi-io"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95db6ca70bd5b7aab6b0297419ccbdb88682e12cc37764c757f58e917da650b9"
+checksum = "cee57d5fef4976b1ab542615f4cef2c43278eb549d8078939668ea0f13d5c696"
 dependencies = [
  "async-trait",
  "bytes",
@@ -8627,9 +8627,9 @@ dependencies = [
 
 [[package]]
 name = "wiggle"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "860468238360805e56e88335d892df427ad7a6908f4a83d96d7a391460346025"
+checksum = "e03df88bf1a6068b02851aa3ef9427d285118f5c1c153b068a8995c69dd9562a"
 dependencies = [
  "bitflags 2.13.0",
  "thiserror 2.0.18",
@@ -8641,9 +8641,9 @@ dependencies = [
 
 [[package]]
 name = "wiggle-generate"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8a128aae0b85cf03726242fad62c5b00c7d1ad809f18883a2338a0c3d5ae1fb"
+checksum = "e014aec8661b613154377e4b49dbbb0dfc4f424efcee749782054576c00537d9"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -8655,9 +8655,9 @@ dependencies = [
 
 [[package]]
 name = "wiggle-macro"
-version = "46.0.0"
+version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bdf3c6a6e1a110be73fcfe10ab9456f0b1bf5a1020010e66d536502baf70a36b"
+checksum = "f67310a8ae5190b7f3dcacf8697f2890701a3a8427b3e77ed91d3632dcedaceb"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -8693,7 +8693,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
diff --git a/deny.toml b/deny.toml
index 6ea3b8f97..8f216674a 100644
--- a/deny.toml
+++ b/deny.toml
@@ -81,6 +81,13 @@ ignore = [
   # an unmaintained notice; CMake 4.0 build-error risk is mitigated since
   # CI pins an earlier CMake.
   { id = "RUSTSEC-2026-0150", reason = "transitive dep via opus crate; no safe upgrade available" },
+
+  # ttf-parser is unmaintained (author archived the crate). Transitive dep of
+  # fontdue, which streamkit-nodes uses for text rasterization. No safe upgrade
+  # is available per the advisory; migrating fontdue->skrifa is tracked in
+  # https://github.com/streamer45/streamkit/issues/642. No security
+  # vulnerability, just an unmaintained notice.
+  { id = "RUSTSEC-2026-0192", reason = "transitive dep via fontdue; no safe upgrade available" },
 ]
 # If this is true, then cargo deny will use the git executable to fetch advisory database.
 # If this is false, then it uses a built-in git library.

From d4348e01ae395230a4c0d2a1d177fdc127696367 Mon Sep 17 00:00:00 2001
From: streamkit-devin <devin@streamkit.dev>
Date: Sat, 4 Jul 2026 07:35:06 +0000
Subject: [PATCH 22/26] fix(web-capture): reject sessions whose create finishes
 after shutdown

A create in flight when shutdownAll ran would re-register its id in the
fresh byID map and hand the caller a session that shutdownAll was about
to destroy. Now acquire re-checks closed after the create resolves and
returns errShuttingDown; shutdownAll still tears the pipeline down.

Signed-off-by: streamkit-devin <devin@streamkit.dev>
---
 examples/web-capture/cmd/gateway/sessions.go     |  8 ++++++++
 .../web-capture/cmd/gateway/sessions_test.go     | 16 ++++++++++++----
 2 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/examples/web-capture/cmd/gateway/sessions.go b/examples/web-capture/cmd/gateway/sessions.go
index d46c8e5de..6627c74a6 100644
--- a/examples/web-capture/cmd/gateway/sessions.go
+++ b/examples/web-capture/cmd/gateway/sessions.go
@@ -205,6 +205,14 @@ func (m *sessionManager) acquire(ctx context.Context, key string, renderYAML fun
 		return nil, err
 	}
 	s.id = id
+	// shutdownAll may have run while the create was in flight: it captured s
+	// (it was in m.sessions) and waits on ready to destroy it, so don't register
+	// the id in the fresh byID map or hand a doomed session to the caller.
+	if m.closed {
+		m.mu.Unlock()
+		close(s.ready)
+		return nil, errShuttingDown
+	}
 	m.byID[id] = s
 	m.mu.Unlock()
 	close(s.ready)
diff --git a/examples/web-capture/cmd/gateway/sessions_test.go b/examples/web-capture/cmd/gateway/sessions_test.go
index 05c138688..eb9f636a4 100644
--- a/examples/web-capture/cmd/gateway/sessions_test.go
+++ b/examples/web-capture/cmd/gateway/sessions_test.go
@@ -213,10 +213,10 @@ func TestSessionManagerShutdownDuringCreate(t *testing.T) {
 	defer srv.Close()
 	m := newSessionManager(&skitClient{client: srv.Client(), baseURL: srv.URL}, 4, 10, time.Hour, time.Hour)
 
-	acquireDone := make(chan struct{})
+	acquireDone := make(chan error, 1)
 	go func() {
-		_, _ = m.acquire(context.Background(), "https://a.example", testYAML)
-		close(acquireDone)
+		_, err := m.acquire(context.Background(), "https://a.example", testYAML)
+		acquireDone <- err
 	}()
 
 	// Wait until acquire has reserved the session and is blocked in createSession.
@@ -241,7 +241,7 @@ func TestSessionManagerShutdownDuringCreate(t *testing.T) {
 	}()
 
 	close(release) // let creation finish
-	<-acquireDone
+	acquireErr := <-acquireDone
 	<-shutdownDone
 
 	if created.Load() != 1 {
@@ -250,6 +250,14 @@ func TestSessionManagerShutdownDuringCreate(t *testing.T) {
 	if destroyed.Load() != 1 {
 		t.Fatalf("in-flight session not torn down on shutdown: destroyed=%d", destroyed.Load())
 	}
+	// The creator must not be handed the doomed session, and its id must not be
+	// re-registered in the byID map that shutdownAll just reset.
+	if !errors.Is(acquireErr, errShuttingDown) {
+		t.Fatalf("acquire during shutdown: got %v, want errShuttingDown", acquireErr)
+	}
+	if m.isLive("sess-inflight") {
+		t.Fatal("destroyed in-flight session still registered in byID")
+	}
 }
 
 // A session reaped while a deduped late viewer is still waiting in proxyMSE's

From 4c782ff92393d13d38043e5cf4a930efa76d183e Mon Sep 17 00:00:00 2001
From: streamkit-devin <devin@streamkit.dev>
Date: Sat, 4 Jul 2026 07:35:12 +0000
Subject: [PATCH 23/26] fix(web-capture): derive MSE Content-Type fallback from
 the cast encoder profile

Store encoder content types as plain MIME strings (YAML-quoted at
template render time via strconv.Quote) so proxyMSE can reuse the
active cast profile's type instead of a hardcoded video/webm that would
mislabel H.264/fMP4 streams if the upstream header were ever missing.

Also bound the stream client's wait for upstream response headers so a
hung backend can't pin a viewer request indefinitely.

Signed-off-by: streamkit-devin <devin@streamkit.dev>
---
 examples/web-capture/cmd/gateway/encoders.go      |  8 +++++---
 examples/web-capture/cmd/gateway/encoders_test.go | 10 +++++-----
 examples/web-capture/cmd/gateway/pipelines.go     |  4 ++--
 examples/web-capture/cmd/gateway/proxy.go         | 12 ++++++++----
 4 files changed, 20 insertions(+), 14 deletions(-)

diff --git a/examples/web-capture/cmd/gateway/encoders.go b/examples/web-capture/cmd/gateway/encoders.go
index fedd1ceae..33cded7a5 100644
--- a/examples/web-capture/cmd/gateway/encoders.go
+++ b/examples/web-capture/cmd/gateway/encoders.go
@@ -87,10 +87,12 @@ const (
     needs: encoder`
 )
 
+// Plain MIME values; the pipeline renderers YAML-quote them at substitution
+// time, and proxyMSE reuses them verbatim as a response-header fallback.
 const (
-	h264ContentType = `'video/mp4; codecs="avc1.42c01f"'`
-	vp9ContentType  = `'video/webm; codecs="vp9"'`
-	av1ContentType  = `'video/webm; codecs="av01.0.08M.08"'`
+	h264ContentType = `video/mp4; codecs="avc1.42c01f"`
+	vp9ContentType  = `video/webm; codecs="vp9"`
+	av1ContentType  = `video/webm; codecs="av01.0.08M.08"`
 )
 
 // clipEncoders stay H.264 so downloaded clips play everywhere; software is the
diff --git a/examples/web-capture/cmd/gateway/encoders_test.go b/examples/web-capture/cmd/gateway/encoders_test.go
index 664a263cc..47b6010d4 100644
--- a/examples/web-capture/cmd/gateway/encoders_test.go
+++ b/examples/web-capture/cmd/gateway/encoders_test.go
@@ -43,11 +43,11 @@ func TestClipEncoderProfiles(t *testing.T) {
 
 func TestCastEncoderProfiles(t *testing.T) {
 	cases := map[string][]string{
-		"vp9-sw":  {"video::vp9::encoder", "bitrate_kbps: 6000", "containers::webm::muxer", `codecs="vp9"`},
-		"av1-sw":  {"video::svt_av1::encoder", "crf: 32", "containers::webm::muxer", `codecs="av01.0.08M.08"`},
-		"av1-hw":  {"video::nv::av1_encoder", "bitrate: 6000000", "containers::webm::muxer", `codecs="av01.0.08M.08"`},
-		"h264-sw": {"video::openh264::encoder", "containers::mp4::muxer", "mode: stream", `codecs="avc1.42c01f"`},
-		"h264-hw": {"video::vulkan_video::h264_encoder", "containers::mp4::muxer", "mode: stream", `codecs="avc1.42c01f"`},
+		"vp9-sw":  {"video::vp9::encoder", "bitrate_kbps: 6000", "containers::webm::muxer", `codecs=\"vp9\"`},
+		"av1-sw":  {"video::svt_av1::encoder", "crf: 32", "containers::webm::muxer", `codecs=\"av01.0.08M.08\"`},
+		"av1-hw":  {"video::nv::av1_encoder", "bitrate: 6000000", "containers::webm::muxer", `codecs=\"av01.0.08M.08\"`},
+		"h264-sw": {"video::openh264::encoder", "containers::mp4::muxer", "mode: stream", `codecs=\"avc1.42c01f\"`},
+		"h264-hw": {"video::vulkan_video::h264_encoder", "containers::mp4::muxer", "mode: stream", `codecs=\"avc1.42c01f\"`},
 	}
 	for name, wants := range cases {
 		out := renderCastPipeline("https://example.com", 1920, 1080, 30, 10, 6000, castEncoders[name])
diff --git a/examples/web-capture/cmd/gateway/pipelines.go b/examples/web-capture/cmd/gateway/pipelines.go
index 5834b75c8..f7a4cd90b 100644
--- a/examples/web-capture/cmd/gateway/pipelines.go
+++ b/examples/web-capture/cmd/gateway/pipelines.go
@@ -35,7 +35,7 @@ func renderClipPipeline(targetURL string, resW, resH, fps, frameCount, brKbps in
 		"{{BR_KBPS}}", strconv.Itoa(brKbps),
 		"{{BR_BPS}}", strconv.Itoa(brKbps*1000),
 		"{{MUX_CODEC}}", enc.muxCodec,
-		"{{CONTENT_TYPE}}", enc.contentType,
+		"{{CONTENT_TYPE}}", strconv.Quote(enc.contentType),
 	).Replace(tmpl)
 }
 
@@ -51,7 +51,7 @@ func renderCastPipeline(targetURL string, resW, resH, fps, maxClients, brKbps in
 		"{{MAX_CLIENTS}}", strconv.Itoa(maxClients),
 		"{{BR_KBPS}}", strconv.Itoa(brKbps),
 		"{{BR_BPS}}", strconv.Itoa(brKbps*1000),
-		"{{CONTENT_TYPE}}", enc.contentType,
+		"{{CONTENT_TYPE}}", strconv.Quote(enc.contentType),
 	).Replace(tmpl)
 }
 
diff --git a/examples/web-capture/cmd/gateway/proxy.go b/examples/web-capture/cmd/gateway/proxy.go
index 61fd6b6be..7264a4b20 100644
--- a/examples/web-capture/cmd/gateway/proxy.go
+++ b/examples/web-capture/cmd/gateway/proxy.go
@@ -23,15 +23,19 @@ import (
 // seconds; MSE streams run until the viewer leaves). keepAlives is off for the
 // one-shot control/render calls so each gets a fresh connection, and on for the
 // long-lived MSE proxy.
-func newHTTPClient(keepAlives bool) *http.Client {
+// responseHeaderTimeout bounds the wait for upstream response headers only
+// (not the streaming body), so a backend that accepts a connection but never
+// answers can't pin a request past the ready-timeout retry loop.
+func newHTTPClient(keepAlives bool, responseHeaderTimeout time.Duration) *http.Client {
 	return &http.Client{
 		Transport: &http.Transport{
 			DialContext: (&net.Dialer{
 				Timeout:   5 * time.Second,
 				KeepAlive: 30 * time.Second,
 			}).DialContext,
-			DisableKeepAlives: !keepAlives,
-			ForceAttemptHTTP2: false,
+			DisableKeepAlives:     !keepAlives,
+			ForceAttemptHTTP2:     false,
+			ResponseHeaderTimeout: responseHeaderTimeout,
 		},
 	}
 }
@@ -178,7 +182,7 @@ func (gw *gateway) proxyMSE(w http.ResponseWriter, r *http.Request, s *liveSessi
 
 	copyHeaders(w.Header(), resp.Header)
 	if w.Header().Get("Content-Type") == "" {
-		w.Header().Set("Content-Type", "video/webm")
+		w.Header().Set("Content-Type", gw.castEnc.contentType)
 	}
 	w.WriteHeader(http.StatusOK)
 	streamCopy(ctx, w, resp.Body, "cast")

From 42fdbcc9221a003cca8571e6b13c9231d84048ec Mon Sep 17 00:00:00 2001
From: streamkit-devin <devin@streamkit.dev>
Date: Sat, 4 Jul 2026 07:35:18 +0000
Subject: [PATCH 24/26] fix(web-capture): clamp max-sessions/max-viewers and
 drop unused authToken field

A max-sessions or max-viewers value < 1 would silently reject every
cast; floor them at 1 with a log line, like max-concurrency.

Signed-off-by: streamkit-devin <devin@streamkit.dev>
---
 examples/web-capture/cmd/gateway/main.go      | 20 +++++++++----------
 examples/web-capture/cmd/gateway/main_test.go |  6 +++---
 2 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/examples/web-capture/cmd/gateway/main.go b/examples/web-capture/cmd/gateway/main.go
index 963d1fb68..6ad14141e 100644
--- a/examples/web-capture/cmd/gateway/main.go
+++ b/examples/web-capture/cmd/gateway/main.go
@@ -69,7 +69,6 @@ type gateway struct {
 	client          *http.Client // oneshot + skit control calls
 	streamClient    *http.Client // long-lived MSE proxy
 	skitURL         string
-	authToken       string
 	clipSem         chan struct{}
 	clipDefaultDur  time.Duration
 	clipMaxDur      time.Duration
@@ -96,11 +95,11 @@ func main() {
 		log.Fatalf("invalid --cast-encoder: %v", err)
 	}
 
-	ctrlClient := newHTTPClient(false)
+	ctrlClient := newHTTPClient(false, 0)
 	skit := &skitClient{client: ctrlClient, baseURL: cfg.skitURL, token: cfg.authToken}
 	gw := &gateway{
 		client:          ctrlClient,
-		streamClient:    newHTTPClient(true),
+		streamClient:    newHTTPClient(true, 10*time.Second),
 		skitURL:         cfg.skitURL,
 		clipSem:         make(chan struct{}, cfg.maxConcurrency),
 		clipDefaultDur:  cfg.clipDefaultDur,
@@ -154,10 +153,12 @@ func main() {
 	<-done
 }
 
-// clampConcurrency floors the clip-render concurrency at 1. A value < 1 would
-// size clipSem as an unbuffered channel and deadlock every clip render.
-func clampConcurrency(n int) int {
+// clampMin floors a capacity knob at 1: --max-concurrency < 1 would size
+// clipSem as an unbuffered channel and deadlock every clip render, and
+// --max-sessions/--max-viewers < 1 would silently reject every cast.
+func clampMin(name string, n int) int {
 	if n < 1 {
+		log.Printf("invalid %s %d, using 1", name, n)
 		return 1
 	}
 	return n
@@ -188,10 +189,9 @@ func loadConfig() config {
 		clipDefaultDur = clipMaxDur
 	}
 
-	if c := clampConcurrency(*maxConc); c != *maxConc {
-		log.Printf("invalid --max-concurrency %d, using %d", *maxConc, c)
-		*maxConc = c
-	}
+	*maxConc = clampMin("--max-concurrency", *maxConc)
+	*maxSessions = clampMin("--max-sessions", *maxSessions)
+	*maxViewers = clampMin("--max-viewers", *maxViewers)
 
 	resW, resH, err := parseResolution(*resolution)
 	if err != nil {
diff --git a/examples/web-capture/cmd/gateway/main_test.go b/examples/web-capture/cmd/gateway/main_test.go
index f747cd6c9..2b9411c56 100644
--- a/examples/web-capture/cmd/gateway/main_test.go
+++ b/examples/web-capture/cmd/gateway/main_test.go
@@ -6,7 +6,7 @@ package main
 
 import "testing"
 
-func TestClampConcurrency(t *testing.T) {
+func TestClampMin(t *testing.T) {
 	cases := []struct {
 		in   int
 		want int
@@ -17,8 +17,8 @@ func TestClampConcurrency(t *testing.T) {
 		{4, 4},
 	}
 	for _, tc := range cases {
-		if got := clampConcurrency(tc.in); got != tc.want {
-			t.Errorf("clampConcurrency(%d) = %d, want %d", tc.in, got, tc.want)
+		if got := clampMin("--max-concurrency", tc.in); got != tc.want {
+			t.Errorf("clampMin(%d) = %d, want %d", tc.in, got, tc.want)
 		}
 	}
 }

From 8b5ea1d7cb5879efef1d278983b66897dd0319b4 Mon Sep 17 00:00:00 2001
From: streamkit-devin <devin@streamkit.dev>
Date: Sat, 4 Jul 2026 07:35:24 +0000
Subject: [PATCH 25/26] chore(servo): drop redundant uuid dev-dependency

Integration tests already see the identical uuid entry from
[dependencies].

Signed-off-by: streamkit-devin <devin@streamkit.dev>
---
 plugins/native/servo/Cargo.toml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/plugins/native/servo/Cargo.toml b/plugins/native/servo/Cargo.toml
index f44c04c45..adaf9c84f 100644
--- a/plugins/native/servo/Cargo.toml
+++ b/plugins/native/servo/Cargo.toml
@@ -42,7 +42,6 @@ tikv-jemalloc-sys = { version = "0.6", features = ["disable_initial_exec_tls"] }
 # destructors race the still-live renderer thread and SIGSEGV.  The test
 # calls `libc::_exit` after asserting to bypass that teardown.
 libc = "0.2"
-uuid = { version = "1", features = ["v4"] }
 
 [lints.clippy]
 # Categories

From cf95e4a23d1af65c746767897ff64d6ecd890ebe Mon Sep 17 00:00:00 2001
From: streamkit-devin <devin@streamkit.dev>
Date: Sat, 4 Jul 2026 07:50:31 +0000
Subject: [PATCH 26/26] chore(deps): ignore quick-xml RUSTSEC-2026-0194/0195
 advisories via opendal

No upgrade path exists: opendal 0.57 (latest) pins quick-xml 0.39, while the
fixes land in quick-xml >= 0.41. Exposure is limited to XML responses from
the operator-configured S3 endpoint. Removal tracked in #647.

Signed-off-by: streamkit-devin <devin@streamkit.dev>
---
 deny.toml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/deny.toml b/deny.toml
index 8f216674a..8716fd741 100644
--- a/deny.toml
+++ b/deny.toml
@@ -88,6 +88,15 @@ ignore = [
   # https://github.com/streamer45/streamkit/issues/642. No security
   # vulnerability, just an unmaintained notice.
   { id = "RUSTSEC-2026-0192", reason = "transitive dep via fontdue; no safe upgrade available" },
+
+  # quick-xml 0.39 DoS advisories (quadratic duplicate-attribute check and
+  # unbounded NsReader namespace allocation). Transitive dep via opendal, whose
+  # latest release (0.57) pins quick-xml 0.39, so no upgrade path exists yet
+  # (fixed in quick-xml >= 0.41). Exposure is limited to XML responses from the
+  # operator-configured S3 endpoint, not attacker-supplied input. Removal is
+  # tracked in https://github.com/streamer45/streamkit/issues/647.
+  { id = "RUSTSEC-2026-0194", reason = "transitive dep via opendal; no upgrade path; only parses configured S3 endpoint responses" },
+  { id = "RUSTSEC-2026-0195", reason = "transitive dep via opendal; no upgrade path; only parses configured S3 endpoint responses" },
 ]
 # If this is true, then cargo deny will use the git executable to fetch advisory database.
 # If this is false, then it uses a built-in git library.