diff --git a/CHANGELOG.md b/CHANGELOG.md
index d1d7315..4b29fb4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,19 +2,29 @@
 
 All notable changes to capcut-cli are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); the project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [0.33.0] — 2026-11-06
 
 ### Added
 
+- `diff <project> --since-write` shows what changed in a draft since capcut-cli last wrote it, such as what CapCut rewrote when it opened or saved a tool-written draft. It prints the usual `diff` result with `a` as written and `b` as the draft is now, plus `since_write` with `written_at`, `written_by` (the command that made the write), `written_sha256`, `current_sha256` and `changed` (false when the file is exactly what the CLI wrote, which stderr also says), `top_level_changed` (the document fields that differ, such as `update_time`) and `track_order_changed`. Every write now keeps a copy of what it wrote as `<file>.last-write` in the draft's `.capcut-cli-history/` directory, one file per draft file, replaced atomically on each write and on `restore`; snapshots, `.bak`, `restore` and `restore --list` are unchanged. A draft this version has not written yet has no record, and `--since-write` exits 1 saying so. `diff <a> <b>` is unchanged.
+- `fixture --anonymize` builds a bundle you can share without showing what the draft is about. Media file names become `media-001.mp4`, `media-002.mp3`, … (each keeps its extension, and the same file gets the same name in every mirror the bundle carries: `draft_content.json`, `draft_info.json`, `template-2.tmp`, `draft_meta_info.json` and the nested `Timelines/` documents). Folder names on media and project paths become `folder-001`, … (standard folders such as `Desktop` and the app's own stay), and the project name becomes `project`. Every text is replaced character by character with a placeholder of the same length and script (CJK, kana and Hangul with 字, Latin letters with x/X by case, digits with 0; spaces, punctuation and style ranges kept), so line wrapping and style range offsets behave as in the original. Only the replaced strings change; every other byte of each file stays as it was. `fixture` never copies media, so no media file is included either way. The report records `anonymized: true` and counts what was replaced, and the redaction check runs on the anonymized bundle.
 - `translate --cloud` and `caption --translate <lang>` (experimental, unofficial) translate with the subtitle translation behind CapCut's auto-captions, on ByteDance's servers and without an API key. `translate --cloud` writes the translated draft as the Anthropic path does; `caption --translate` translates the cues before they are written and keeps CapCut's timings for the translated words, so `--karaoke` and `--word-reveal` work in the target language. Language names such as `Vietnamese`, `deutsch` or `simplified chinese` map to CapCut's codes. Like `caption --cloud`, it calls CapCut's private endpoints as the desktop app does, so ByteDance can change or refuse them at any time. Every run says on stderr how many lines go to ByteDance, and `--dry-run` sends nothing (`caption --translate --dry-run` reports the lines under `translation`). A reply with more or fewer lines than were sent is refused instead of pairing translations with the wrong timings, and a line that comes back without a translation keeps its original text and is counted in `kept_original` ([#169](https://github.com/renezander030/capcut-cli/pull/169), contributed by @datnt-97).
+- `loudness` can gate a delivery, so a script stops before exporting a mix that misses its target. `--tolerance <LU>` (with `--target`) fails the run when the estimated loudness sits further than that from the target, and `--max-true-peak <dBTP>` fails it when the loudest clip's true peak, at its volume, is above the ceiling. With `--apply` the mix after this run's gain is judged, `--max-gain-db` cap included; without it, the mix as it stands. A miss exits 1 with `ok: false` and the reason on one stderr line, and the result's `gate` carries the target, tolerance, estimate and each verdict. With `--apply` the gain is written either way (journaled, `restore` undoes it). Without either flag the result and exit code are unchanged.
+- `lint --max-still-secs <n>` and `--max-shot-secs <n>` check pacing. A still image (a photo material) that plays longer than n seconds on the timeline is reported as `still-too-long`, and a video clip longer than n seconds, overlay tracks included, as `shot-too-long`. Both are warnings (exit 1) that name the segment, its track, where it starts and how long it plays; neither is fixable, since where to cut is an editing decision. Neither check runs unless its flag is given, so lint's default result is unchanged.
+- `lint --min-silent-secs <n>` reports `silent-stretch` (warning) for every range of n seconds or longer, up to the end of the timeline, where nothing audible plays: no audio clip above volume 0 and no video clip with its own sound. A clip counts as silent only when the draft says so (volume 0 without volume keyframes, a muted track, a photo, or a video whose sound was separated to an audio track), so a video clip whose file may have no sound still counts as sound and the check never reports silence that might not be there. The message gives the range's start, end and length. Not fixable, and off unless the flag is given.
+- `caption` checks that its cues cover the speech it transcribed. After transcribing (local Whisper or `--cloud`), ffmpeg's silencedetect measures the non-silent spans of the audio that was transcribed (the extracted stream with `--audio-stream`), the cue spans are subtracted in the audio's own time, and the result carries `coverage: {speech_s, captioned_s, ratio, uncaptioned: [{start_s, end_s}], tail_uncaptioned_s}`. `uncaptioned` lists the speech no cue covers that lasts at least `--min-uncaptioned` seconds (default 1.5), and `tail_uncaptioned_s` is the part of it after the last cue. When any span is listed, one `[uncaptioned-speech]` warning on stderr names them, so a transcription that stops before the end of the audio, or drops quiet speech, no longer passes unnoticed. The exit code is unchanged. Without ffmpeg the block is `{skipped: "ffmpeg not found"}` and the run goes on; `--no-coverage` skips the check, and `--words` runs, which read no audio, have none.
+- `caption` caches what it transcribed, so a run that only changes the styling, the grouping, `--script` or `--translate` does not transcribe again, and with `--cloud` does not upload again. The raw transcription (cues, words, engine) is stored under the sha256 of the exact audio bytes that were transcribed (after `--audio-stream` extraction) together with the engine, Whisper command, model, language, word-timing mode and `--cloud`, so changing any of those transcribes afresh. The result carries `transcript_cache: "hit" | "miss" | "off"`. Entries live in `CAPCUT_CLI_CACHE_DIR` if set, else `$XDG_CACHE_HOME/capcut-cli/transcripts`, else `~/.cache/capcut-cli/transcripts` (`%LOCALAPPDATA%\capcut-cli\cache\transcripts` on Windows), one JSON file per key written atomically; an entry that cannot be read or does not match its key is ignored and rewritten. `--no-cache` neither reads nor writes it, and `--dry-run` reads it but never writes it.
 
 ### Changed
 
+- `render --burn-captions` draws each caption in its text material's own font file instead of ffmpeg's default face. The font is the first style block's `font.path` in the material's content (what CapCut renders from), else the material's `font_path`, and it is passed to drawtext as `fontfile=` when the file exists and is a `.ttf`, `.otf` or `.ttc`; the path is escaped so commas, brackets, colons and backslashes in it stay inside the option. A caption whose font is missing, of another type or not named keeps the default face as before. The render result, `--dry-run` plans included, reports `caption_fonts: {from_draft, default}`.
 - The Python client's 3.9 job runs on `ubuntu-24.04`. `ubuntu-latest` moved to 26.04, for which `setup-python` has no 3.9 build, so the job failed before it ran a test; the package still supports Python 3.9.
 
 ### Fixed
 
 - `text-style` applies `--font-size`, `--color`, `--align`, `--x` and `--y` without `--preset`. The flags were declared (and shared with `add-text`) but only honoured through a preset, so a plain `text-style <project> <id> --font-size 22 --color #FFD60A` exited 0 and left the text unchanged. Font size and colour are written to the material and to every style block CapCut renders from, `--x`/`--y` move the segment as `restyle` does, and `--color` must be `#RRGGBB`. `compile`'s `text-style` operation accepts and validates `fontSize`, `alignment` and `color` too.
+- Writes under Volta no longer stop with `[editor-open]`. The editor-open guard compared process names only, so the shim named `capcut` that starts node was taken for the CapCut editor and every `--apply` was refused. The guard now leaves out the CLI's own process and each of its parents (on Windows, where `tasklist` lists no parent ids, the direct parent) and still finds an editor running beside it ([#168](https://github.com/renezander030/capcut-cli/issues/168)).
+- `fixture --out` requires a new or empty directory outside the source project. It refuses occupied destinations and output symlinks instead of modifying original drafts, overwriting unrelated files, or leaving private media in a bundle reported as media-free. Bundles are built in a temporary sibling directory and published only after generation and redaction inspection finish; a generation failure leaves a new destination absent or an existing empty destination empty. Existing redaction findings remain available for manual review.
 
 ## [0.32.0] — 2026-10-29
 
diff --git a/README.md b/README.md
index 3b8d75b..872c277 100644
--- a/README.md
+++ b/README.md
@@ -105,7 +105,7 @@ The host reads a draft and passes its JSON as tool input. The component itself h
 
 ## Release notes
 
-> **New in v0.32.0:** time arguments reject malformed or unsafe values before writing; translation responses must contain exactly one string per input; and subtitle imports reject malformed UTF-8 instead of silently corrupting caption text. Full details in the [changelog](./CHANGELOG.md).
+> **New in v0.33.0:** `caption` reports speech its cues leave uncaptioned and reuses a cached transcription when only the styling changes; `loudness --tolerance` and `--max-true-peak` gate a delivery with an exit code; `lint` gains opt-in pacing and silent-stretch checks; `diff --since-write` shows what CapCut changed after the CLI's last write; `fixture --anonymize` makes a shareable bundle; and `render --burn-captions` draws captions in the draft's own font. Full details in the [changelog](./CHANGELOG.md).
 
 > **New in v0.31.0:** experimental, unofficial `caption --cloud` that transcribes without a local Whisper install by uploading the audio to ByteDance's CapCut servers ([#157](https://github.com/renezander030/capcut-cli/pull/157)), uploads nothing in a dry run, retries flaky requests and waits as long as the audio needs; loudness to a delivery target (`loudness --target -14`, applied as segment volume and undoable); faster compiles that reuse media hashes across repeated cuts; and three `lint` checks for clips that play silent after a copy, keyframes on trimmed or re-timed clips, and `UNIFORM_SCALE` zooms on JianYing 11.6+. Full details in the [changelog](./CHANGELOG.md).
 
diff --git a/README.zh-CN.md b/README.zh-CN.md
index 97dc0ea..7f9b666 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -82,7 +82,7 @@ Claude Code 也可以把它作为插件加载：
 
 ## 发布说明
 
-> **v0.32.0 更新：** 时间参数会在写入前拒绝格式错误或超出安全范围的值；翻译结果必须为每条输入提供一个字符串；字幕导入拒绝无效的 UTF-8，避免静默破坏字幕文本。完整说明见[更新日志](./CHANGELOG.md)。
+> **v0.33.0 更新：** `caption` 会报告字幕未覆盖的语音，并在只改样式时复用缓存的转写结果；`loudness --tolerance` 和 `--max-true-peak` 以退出码把关交付响度；`lint` 新增可选的节奏与静音段检查；`diff --since-write` 显示 CapCut 在 CLI 上次写入后改动了什么；`fixture --anonymize` 生成可分享的匿名包；`render --burn-captions` 使用草稿自身的字体绘制字幕。完整说明见[更新日志](./CHANGELOG.md)。
 
 > **v0.31.0 新增：** 实验性、非官方的 `caption --cloud`：无需本地 Whisper，将音频上传到字节跳动的 CapCut 服务器转写（[#157](https://github.com/renezander030/capcut-cli/pull/157)），dry run 中不上传任何内容，请求失败会自动重试，等待时间随音频长度增加；按发布平台的响度目标调整音量（`loudness --target -14`，写入片段音量，可撤销）；同一素材的重复剪辑复用内容哈希，编译更快；新增三项 `lint` 检查：复制后无声的片段、裁剪或变速片段上的关键帧，以及剪映 11.6 及以上版本中的 `UNIFORM_SCALE` 缩放。完整说明见[更新日志](./CHANGELOG.md)。
 
diff --git a/docs/command-reference.json b/docs/command-reference.json
index ee6f70d..732877c 100644
--- a/docs/command-reference.json
+++ b/docs/command-reference.json
@@ -233,6 +233,33 @@
           "required": false,
           "description": "Skip ffprobe media checks (VFR / unreadable media)."
         },
+        {
+          "name": "max_still_secs",
+          "flags": [
+            "--max-still-secs"
+          ],
+          "type": "number",
+          "required": false,
+          "description": "Report still-too-long (warning) for each still image that plays longer than this many seconds. Off unless given."
+        },
+        {
+          "name": "max_shot_secs",
+          "flags": [
+            "--max-shot-secs"
+          ],
+          "type": "number",
+          "required": false,
+          "description": "Report shot-too-long (warning) for each video clip that plays longer than this many seconds. Off unless given."
+        },
+        {
+          "name": "min_silent_secs",
+          "flags": [
+            "--min-silent-secs"
+          ],
+          "type": "number",
+          "required": false,
+          "description": "Report silent-stretch (warning) for every range of this many seconds or more where nothing audible plays. A clip counts as silent only when the draft says so (volume 0, muted track, photo, sound separated). Off unless given."
+        },
         {
           "name": "pip",
           "flags": [
@@ -4437,7 +4464,7 @@
           ],
           "type": "path",
           "required": false,
-          "description": "FFmpeg binary used by --audio-stream."
+          "description": "FFmpeg binary used by --audio-stream and the coverage check."
         },
         {
           "name": "from_segment",
@@ -4561,6 +4588,34 @@
           "required": false,
           "description": "Maximum gap inside a karaoke cue."
         },
+        {
+          "name": "min_uncaptioned",
+          "flags": [
+            "--min-uncaptioned"
+          ],
+          "type": "number",
+          "required": false,
+          "description": "Shortest stretch of speech without a cue, in seconds, that the coverage check lists in coverage.uncaptioned and warns about.",
+          "default": 1.5
+        },
+        {
+          "name": "no_coverage",
+          "flags": [
+            "--no-coverage"
+          ],
+          "type": "boolean",
+          "required": false,
+          "description": "Skip the coverage check. By default, after transcribing (not with --words), ffmpeg measures the speech in the transcribed audio (silencedetect) and the result's `coverage` block reports speech_s, captioned_s, ratio, the uncaptioned spans and tail_uncaptioned_s (speech after the last cue); any uncaptioned span prints one `[uncaptioned-speech]` warning on stderr. Without ffmpeg the block is {skipped: \"ffmpeg not found\"} and the run does not fail."
+        },
+        {
+          "name": "no_cache",
+          "flags": [
+            "--no-cache"
+          ],
+          "type": "boolean",
+          "required": false,
+          "description": "Neither read nor write the transcript cache. By default the raw transcription (before --script, grouping, styling and --translate) is cached, keyed by the sha256 of the transcribed audio bytes, the engine, whisper command, model, language and word-timing mode, so a run that only changes those later steps does not transcribe (or, with --cloud, upload) again. The result reports transcript_cache: hit, miss or off. Cache directory: CAPCUT_CLI_CACHE_DIR, else $XDG_CACHE_HOME/capcut-cli/transcripts, else ~/.cache/capcut-cli/transcripts (%LOCALAPPDATA%\\capcut-cli\\cache\\transcripts on Windows). --dry-run reads it but never writes it."
+        },
         {
           "name": "track_name",
           "flags": [
@@ -5387,8 +5442,8 @@
     },
     {
       "name": "diff",
-      "summary": "Compare two drafts (segments/materials/tracks added/removed/changed).",
-      "usage": "capcut diff <project-a> <project-b>",
+      "summary": "Compare two drafts (segments/materials/tracks added/removed/changed), or with --since-write a draft with what capcut-cli last wrote to it.",
+      "usage": "capcut diff <project-a> (<project-b> | --since-write)",
       "positionals": [
         {
           "name": "project-a",
@@ -5401,7 +5456,17 @@
           "required": true
         }
       ],
-      "options": [],
+      "options": [
+        {
+          "name": "since_write",
+          "flags": [
+            "--since-write"
+          ],
+          "type": "boolean",
+          "required": false,
+          "description": "Compare <project-a> with what capcut-cli itself last wrote to it instead of with a second draft, to see what the app changed when it opened or saved a tool-written draft (a = as written, b = now). Adds since_write: {file, written_at, written_by, written_sha256, current_sha256, changed, top_level_changed, track_order_changed}; changed is false when the file is byte-identical to the write. Every write records its result in the draft's history directory; a draft with no recorded write exits 1."
+        }
+      ],
       "mutates": false,
       "prerequisites": [],
       "output": {
@@ -5898,7 +5963,7 @@
     {
       "name": "fixture",
       "summary": "Build a shareable, redacted compatibility bundle (timeline JSON only) for a version-support issue, including the mask-keyframe evidence report (#44).",
-      "usage": "capcut fixture <project> --out <dir> [--check]",
+      "usage": "capcut fixture <project> --out <dir> [--anonymize] [--check]",
       "positionals": [
         {
           "name": "project",
@@ -5914,7 +5979,16 @@
           ],
           "type": "path",
           "required": false,
-          "description": "Output directory for the sanitized bundle."
+          "description": "Output directory for the sanitized bundle: a new or empty directory outside the source project."
+        },
+        {
+          "name": "anonymize",
+          "flags": [
+            "--anonymize"
+          ],
+          "type": "boolean",
+          "required": false,
+          "description": "Also replace what the draft is about: media file names become media-001.<ext> and folder names on media and project paths folder-001 (consistently across every mirror; standard folders such as Desktop are kept), the project name becomes project, and every text is replaced character by character with placeholders of the same length and script (CJK 字, Latin x/X, digits 0; spaces, punctuation and style ranges kept). The report records anonymized: true and counts what was replaced. Media files are never copied."
         },
         {
           "name": "check",
@@ -6629,7 +6703,7 @@
           ],
           "type": "boolean",
           "required": false,
-          "description": "Burn captions."
+          "description": "Burn captions (ffmpeg drawtext). Each caption uses its text material's own font file (the first style block's font.path, else font_path) when that file exists and is a .ttf, .otf or .ttc, otherwise ffmpeg's default face; the result's caption_fonts counts both."
         },
         {
           "name": "soft_captions",
@@ -6711,7 +6785,7 @@
     {
       "name": "loudness",
       "summary": "Measure each audible clip's loudness (EBU R128) and, with --target, set the gain that brings the export there.",
-      "usage": "capcut loudness <project> [--target <lufs>] [--per-clip] [--max-gain-db <db>] [--apply]",
+      "usage": "capcut loudness <project> [--target <lufs>] [--per-clip] [--max-gain-db <db>] [--apply] [--tolerance <lu>] [--max-true-peak <dbtp>]",
       "positionals": [
         {
           "name": "project",
@@ -6727,6 +6801,16 @@
           "name": "db",
           "type": "string",
           "required": false
+        },
+        {
+          "name": "lu",
+          "type": "string",
+          "required": false
+        },
+        {
+          "name": "dbtp",
+          "type": "string",
+          "required": false
         }
       ],
       "options": [
@@ -6767,6 +6851,24 @@
           "required": false,
           "description": "Write the gain as segment volume (default: report only)."
         },
+        {
+          "name": "tolerance",
+          "flags": [
+            "--tolerance"
+          ],
+          "type": "number",
+          "required": false,
+          "description": "Delivery gate (needs --target): exit 1 when the judged loudness sits more than this many LU from the target. With --apply the mix after this run's gain is judged, without it the mix as it stands."
+        },
+        {
+          "name": "max_true_peak",
+          "flags": [
+            "--max-true-peak"
+          ],
+          "type": "number",
+          "required": false,
+          "description": "Delivery gate: exit 1 when the loudest clip's true peak, at the judged volume, is above this level in dBTP."
+        },
         {
           "name": "ffmpeg_cmd",
           "flags": [
diff --git a/docs/command-reference.md b/docs/command-reference.md
index aa6cbcb..84fc485 100644
--- a/docs/command-reference.md
+++ b/docs/command-reference.md
@@ -68,7 +68,7 @@
 | `replace-media` | `capcut replace-media <project> <segment-id> <new-file> [--retime]` | yes | Swap a segment's source file (placeholder > final) keeping its timing, effects, and keyframes. |
 | `timeline` | `capcut timeline <project> [--cols <number>]` | no | Show the track/segment layout (JSON, or -H ASCII bars). |
 | `projects` | `capcut projects [query] [--drafts <path>] [--names]` | no | List CapCut/JianYing draft folders on disk. |
-| `diff` | `capcut diff <project-a> <project-b>` | no | Compare two drafts (segments/materials/tracks added/removed/changed). |
+| `diff` | `capcut diff <project-a> (<project-b> \| --since-write)` | no | Compare two drafts (segments/materials/tracks added/removed/changed), or with --since-write a draft with what capcut-cli last wrote to it. |
 | `concat` | `capcut concat <project-a> <project-b> [--out <path>]` | yes | Append one draft onto another's timeline (id-safe), write to --out or in place. |
 | `config` | `capcut config` | no | Show the resolved config (.capcutrc + effective defaults). |
 | `describe` | `capcut describe [--compact] [--command <name>]` | no | Emit command contracts as JSON, optionally filtered by name or reduced to a compact discovery index. |
@@ -78,7 +78,7 @@
 | `harvest-enums` | `capcut harvest-enums [<project> \| --sync \| --add <kind> <slug> <resource-id>] [--apply] [--catalogue <path>]` | no | Learn store resource ids into the per-user catalogue: from one draft, the whole library (--sync), or by hand (--add). |
 | `doctor` | `capcut doctor [--drafts <dir>]` | no | Environment preflight (Node, whisper, API key, project dir). |
 | `diagnose` | `capcut diagnose <project> [--bundle <report.json>]` | no | Inspect canonical draft files, divergence, and editor-write safety. |
-| `fixture` | `capcut fixture <project> --out <dir> [--check]` | no | Build a shareable, redacted compatibility bundle (timeline JSON only) for a version-support issue, including the mask-keyframe evidence report (#44). |
+| `fixture` | `capcut fixture <project> --out <dir> [--anonymize] [--check]` | no | Build a shareable, redacted compatibility bundle (timeline JSON only) for a version-support issue, including the mask-keyframe evidence report (#44). |
 | `sync-timelines` | `capcut sync-timelines <project-dir> [--nested] [--apply]` | yes | Reconcile drifted timeline mirrors (template-2.tmp, draft_info.json) from a read-only draft_content.json (plan with mtimes by default; --apply rewrites only the drifted mirrors). |
 | `restore` | `capcut restore <project> [--step <number> \| --list]` | yes | Undo writes from .bak / snapshot history (--step N, --list). |
 | `serve` | `capcut serve [--queue <path>] [options]` | no | Run a stateless JSONL job queue from stdin/--queue. |
@@ -88,7 +88,7 @@
 | `quickstart` | `capcut quickstart <name> [--video <f>] [--audio <f>] [--srt <f>] [--drafts <dir>] [--template auto\|bundled\|<dir>] [--ratio <r> \| --width <px> --height <px>]` | yes | One-command first draft: create + add one input + lint + print the open-in-CapCut step. |
 | `compile` | `capcut compile <spec.json> [--out <draftdir> \| --into <project>] [--template auto\|bundled\|<dir>] [--data <rows.jsonl\|->] [--check \| --plan]` | yes | Build a draft from a declarative JSON spec (the inverse of describe). |
 | `render` | `capcut render <project> [--out <preview.mp4>] [options]` | no | Render a low-res ffmpeg proxy preview (trim+speed+audio, --burn-captions); not CapCut's final render. |
-| `loudness` | `capcut loudness <project> [--target <lufs>] [--per-clip] [--max-gain-db <db>] [--apply]` | no | Measure each audible clip's loudness (EBU R128) and, with --target, set the gain that brings the export there. |
+| `loudness` | `capcut loudness <project> [--target <lufs>] [--per-clip] [--max-gain-db <db>] [--apply] [--tolerance <lu>] [--max-true-peak <dbtp>]` | no | Measure each audible clip's loudness (EBU R128) and, with --target, set the gain that brings the export there. |
 | `detect-scenes` | `capcut detect-scenes <video> [options]` | no | Detect scene-change cut points in a video (ffmpeg scene filter); prints cuts + segments to seed compile/cut. |
 | `detect-silence` | `capcut detect-silence <media> [options]` | no | Detect silence spans in a media file (ffmpeg silencedetect); prints silences + keep segments to seed compile/cut. |
 | `detect-retakes` | `capcut detect-retakes <project> [--track-name <s>] [--window <s>] [--similarity <n>] [--min-words <n>] \| --srt <file>` | no | Find repeated takes in the draft's captions (or an SRT): windowed word-sequence similarity, later take kept; prints cuts + keep segments to seed compile/cut. |
diff --git a/docs/command-reference.zh-CN.md b/docs/command-reference.zh-CN.md
index 22d9550..7dbcb0c 100644
--- a/docs/command-reference.zh-CN.md
+++ b/docs/command-reference.zh-CN.md
@@ -90,6 +90,6 @@
 | `quickstart` | `capcut quickstart <name> [--video <f>] [--audio <f>] [--srt <f>] [--drafts <dir>]` | 是 | 一条命令生成第一个草稿：创建 + 添加一个素材 + lint + 打印“在 CapCut 中打开”的步骤。 |
 | `compile` | `capcut compile <spec.json> [--out <draftdir> \| --into <project>] [--template auto\|bundled\|<dir>] [--data <rows.jsonl\|->] [--check \| --plan]` | 是 | 从声明式 JSON spec 构建草稿；`--into` 填充应用创建的空项目，保留项目身份和注册信息。 |
 | `render` | `capcut render <project> [--out <preview.mp4>] [options]` | 否 | 渲染低清 ffmpeg 代理预览（裁剪+变速+音频，--burn-captions）；支持 --crf / --video-bitrate，大型滤镜图自动走脚本文件；不是 CapCut 的最终渲染。 |
-| `loudness` | `capcut loudness <project> [--target <lufs>] [--per-clip] [--max-gain-db <db>] [--apply]` | 否 | 测量每个有声片段的响度（EBU R128）；配合 --target 计算并写入使导出达到目标响度的增益。 |
+| `loudness` | `capcut loudness <project> [--target <lufs>] [--per-clip] [--max-gain-db <db>] [--apply] [--tolerance <lu>] [--max-true-peak <dbtp>]` | 否 | 测量每个有声片段的响度（EBU R128）；配合 --target 计算并写入使导出达到目标响度的增益；--tolerance / --max-true-peak 作为交付门槛，未达标时退出码为 1。 |
 | `detect-scenes` | `capcut detect-scenes <video> [options]` | 否 | 检测视频中的场景切换切点（ffmpeg scene 滤镜）；输出切点与片段列表，供 compile/cut 使用。 |
 | `detect-silence` | `capcut detect-silence <media> [options]` | 否 | 检测媒体文件中的静音区间（ffmpeg silencedetect）；输出静音与保留片段列表，供 compile/cut 使用。 |
diff --git a/docs/version-support.md b/docs/version-support.md
index 3a5f2d8..bcf4891 100644
--- a/docs/version-support.md
+++ b/docs/version-support.md
@@ -118,6 +118,6 @@ macOS:
 2. Run `capcut diagnose <project> --bundle support.json`.
 3. Run `capcut version <project>`.
 4. Open an issue with app version, OS, exact command, JSON error, and `support.json`.
-5. If possible, attach a sanitized project folder. Run `capcut fixture <project> --out <dir>` to build one automatically: it copies only the timeline JSON (no media), redacts user home paths and emails, and writes a README plus a diagnose report. Review the files before sharing.
+5. If possible, attach a sanitized project folder. Run `capcut fixture <project> --out <dir>` with a new or empty directory outside the source project to build one automatically: it copies only the timeline JSON (no media), redacts user home paths and emails, and writes a README plus a diagnose report. Occupied destinations and output symlinks are refused; generation failures leave no partial bundle. Add `--anonymize` when the draft itself is confidential: media file names become `media-001.<ext>`, folder names on media and project paths `folder-001`, the project name `project`, and every text is replaced with placeholders of the same length and script, so the bundle shows the structure without the work. Review the files before sharing.
 
 A version moves to **fixture-tested** only after the sanitized fixture and regression test are committed.
diff --git a/docs/version-support.zh-CN.md b/docs/version-support.zh-CN.md
index 00de1de..aeb9c6e 100644
--- a/docs/version-support.zh-CN.md
+++ b/docs/version-support.zh-CN.md
@@ -115,6 +115,6 @@ macOS：
 2. 运行 `capcut diagnose <project> --bundle support.json`。
 3. 运行 `capcut version <project>`。
 4. 提交 issue，附上应用版本、操作系统、具体命令、JSON 报错信息，以及 `support.json`。
-5. 如果可以，附上一份脱敏后的项目文件夹。运行 `capcut fixture <project> --out <dir>` 可以自动生成一份：它只拷贝时间线 JSON（不含媒体文件），会脱敏用户主目录路径和邮箱地址，并附带一份 README 和一份 diagnose 报告。分享前请先自行检查这些文件。
+5. 如果可以，附上一份脱敏后的项目文件夹。运行 `capcut fixture <project> --out <dir>`，将输出指定为源项目之外的新目录或空目录：它只拷贝时间线 JSON（不含媒体文件），会脱敏用户主目录路径和邮箱地址，并附带一份 README 和一份 diagnose 报告。非空输出目录和输出符号链接会被拒绝；生成失败不会留下不完整的文件包。如果草稿本身需要保密，请加上 `--anonymize`：媒体文件名改为 `media-001.<扩展名>`，媒体路径和项目路径中的文件夹名改为 `folder-001`，项目名改为 `project`，所有文字都替换为长度和文字类别相同的占位符，这样文件包只展示结构，不暴露作品内容。分享前请先自行检查这些文件。
 
 只有在脱敏后的 fixture 与回归测试都被提交之后，一个版本才会被标注为 **fixture-tested**。
diff --git a/package-lock.json b/package-lock.json
index df59f64..ca4fdb6 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "capcut-cli",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "capcut-cli",
-      "version": "0.32.0",
+      "version": "0.33.0",
       "license": "MIT",
       "bin": {
         "capcut": "dist/index.js",
diff --git a/package.json b/package.json
index 82c9037..a351131 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "capcut-cli",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "description": "Independent, unofficial CLI to create and edit CapCut projects — build drafts from scratch, add video/audio/text, subtitles, timing, speed, volume, templates, cut long-form to shorts. No API needed. Not affiliated with ByteDance.",
   "type": "module",
   "bin": {
diff --git a/skills/capcut-edit/references/api-reference.md b/skills/capcut-edit/references/api-reference.md
index 3c70385..124c15b 100644
--- a/skills/capcut-edit/references/api-reference.md
+++ b/skills/capcut-edit/references/api-reference.md
@@ -34,7 +34,9 @@ capcut <command> <project> [args] [flags]
 Every write conflict-checks the loaded files, prepares same-directory temporary
 files, fsyncs, and renames atomically. Every readable timeline target is
 synchronized and receives a `.bak` plus rolling `.capcut-cli-history/`
-snapshots. Use `capcut restore <project> [--step N | --list]`.
+snapshots. Use `capcut restore <project> [--step N | --list]`. The same
+directory keeps `<file>.last-write`, the content of the most recent write, so
+`capcut diff <project> --since-write` can show what the app changed since.
 
 ### ID prefix rule
 
@@ -671,6 +673,22 @@ With `--cloud --dry-run` nothing is uploaded: the result reports `would_upload`
 (file, bytes, duration, destination) and exits. `--language` has no effect with
 `--cloud`; the service detects the spoken language and a warning says so.
 
+After transcribing, the result's `coverage` block compares the cues with the
+speech ffmpeg's silencedetect finds in the transcribed audio: `speech_s`,
+`captioned_s`, `ratio`, `uncaptioned` (spans of at least `--min-uncaptioned`
+seconds, default 1.5) and `tail_uncaptioned_s` (speech after the last cue). Any
+uncaptioned span prints one `[uncaptioned-speech]` line on stderr; the exit code
+does not change. Without ffmpeg it is `{skipped: "ffmpeg not found"}`;
+`--no-coverage` skips it.
+
+The raw transcription is cached by the transcribed audio's sha256 plus engine,
+Whisper command, model, language and word-timing mode, so re-running `caption`
+with other styling, grouping, `--script` or `--translate` reuses it without
+transcribing or uploading again (`transcript_cache: "hit"`). The cache lives in
+`CAPCUT_CLI_CACHE_DIR`, else `$XDG_CACHE_HOME/capcut-cli/transcripts`, else
+`~/.cache/capcut-cli/transcripts`; `--no-cache` bypasses it and `--dry-run`
+never writes it.
+
 ### `capcut loudness <project> [--target <lufs>] [--per-clip] [--apply]`
 
 Measures each audible clip with ffmpeg's EBU R128 meter over the media range the
@@ -680,10 +698,19 @@ balance; `--per-clip` levels each clip to the target instead. `--max-gain-db`
 caps a boost (default 20). `--apply` writes the gain as segment volume through
 the journal, so `restore` undoes it. Skipped clips carry a `skipped` reason.
 
+Delivery gate: `--tolerance <LU>` (needs `--target`) and `--max-true-peak <dBTP>`
+judge the mix after this run's gain with `--apply` (cap included), the mix as it
+stands without. A miss exits 1 with `ok: false`, one reason line on stderr and a
+`gate` object (`target`, `tolerance`, `estimate_lufs`, `within`, `max_true_peak`,
+`estimate_true_peak`, `true_peak_ok`). Without either flag nothing changes.
+
 ### `capcut render <project> --all-video-tracks --burn-captions`
 
 Composites overlay tracks with transform/opacity, mixes audio fades, and uses
-draft caption colour/size/position. `doctor` reports `drawtext`, `overlay`, and
+draft caption colour/size/position. Burned captions use the text material's font
+file (style `font.path`, else `font_path`) when it exists and is .ttf/.otf/.ttc,
+otherwise ffmpeg's default face; `caption_fonts: {from_draft, default}` counts
+both. `doctor` reports `drawtext`, `overlay`, and
 `libx264`; missing optional filters produce an explicit fallback report.
 
 ### `capcut serve [--workers N] [--retries N] [--timeout MS]`
diff --git a/src/ass.ts b/src/ass.ts
index fa020cb..fa941d4 100644
--- a/src/ass.ts
+++ b/src/ass.ts
@@ -9,6 +9,7 @@
 // UTF-16 code units of the FINAL text (after tag removal, \N -> newline).
 // Every other override ({\an8}, \pos, \k, ...) is stripped as before.
 
+import { fillSolid, rgb01ToHex } from "./decorators.js";
 import { repairDoubledRanges } from "./text-offsets.js";
 
 /** Segment-level defaults a Dialogue's Style line carries into the import. */
@@ -599,15 +600,6 @@ interface NormalizedBlock {
   alpha: number;
 }
 
-function rgb01ToHex(rgb: [number, number, number]): string {
-  const byte = (c: number) =>
-    Math.max(0, Math.min(255, Math.round(c * 255)))
-      .toString(16)
-      .padStart(2, "0")
-      .toUpperCase();
-  return `#${byte(rgb[0])}${byte(rgb[1])}${byte(rgb[2])}`;
-}
-
 function normalizeBlocks(content: string): { text: string; blocks: NormalizedBlock[] } {
   let parsed: { text?: string; styles?: Array<Record<string, unknown>> };
   try {
@@ -625,8 +617,7 @@ function normalizeBlocks(content: string): { text: string; blocks: NormalizedBlo
   const blocks: NormalizedBlock[] = [];
   for (let i = 0; i < styles.length; i++) {
     const s = styles[i];
-    const solid = (s.fill as { content?: { solid?: { color?: [number, number, number]; alpha?: number } } } | undefined)
-      ?.content?.solid;
+    const solid = fillSolid(s.fill);
     const start = Math.max(0, Math.min(repaired[i][0], text.length));
     const end = Math.max(0, Math.min(repaired[i][1], text.length));
     if (end <= start) continue;
diff --git a/src/capcut-cloud-asr.ts b/src/capcut-cloud-asr.ts
index 35545b9..592d9a8 100644
--- a/src/capcut-cloud-asr.ts
+++ b/src/capcut-cloud-asr.ts
@@ -6,7 +6,15 @@
  */
 import { createHash, createHmac, randomUUID } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
-import { capcutEditorHeaders } from "./capcut-cloud-headers.js";
+import {
+  CAPCUT_EDITOR_HOST,
+  type CapcutRequestTiming,
+  capcutEditorHeaders,
+  postEditorApi,
+  requireRetOk,
+  seconds,
+  sendCapcutRequest,
+} from "./capcut-cloud-headers.js";
 import type { CaptionCue, CaptionWord } from "./caption.js";
 
 /** CRC32 lookup table for upload verification. */
@@ -168,57 +176,14 @@ export function pollBudgetMs(durationMs: number): number {
   return Math.min(30 * 60_000, 120_000 + Math.max(0, durationMs) / 2);
 }
 
-interface Timing {
-  requestTimeoutMs: number;
-  retryDelayMs: number;
+/** Request limits plus the recognition's polling. Signing, the upload-node lookup and the
+ * status polls are safe to repeat; the upload, its commit and the task creation are sent once. */
+interface Timing extends CapcutRequestTiming {
   pollIntervalMs: number;
   pollBudgetMs: number;
 }
 
 const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
-const seconds = (ms: number) => (ms >= 1000 ? Math.round(ms / 1000) : ms / 1000);
-
-/** Attempts for the calls that are safe to repeat (signing, upload-node lookup, status polls). */
-const RETRY_ATTEMPTS = 3;
-
-/**
- * One request with a time limit. `retry` repeats a call that is safe to repeat
- * when the network fails, it times out, or the service answers 429 or 5xx,
- * pausing n x retryDelayMs before the n-th retry; the upload, its commit and
- * the task creation are never repeated. Any other answer is returned as is.
- */
-async function send(
-  url: string,
-  init: RequestInit,
-  step: string,
-  t: Timing,
-  retry: boolean,
-  timeoutMs = t.requestTimeoutMs,
-): Promise<Response> {
-  const attempts = retry ? RETRY_ATTEMPTS : 1;
-  for (let attempt = 1; ; attempt++) {
-    let res: Response;
-    try {
-      res = await fetch(url, { ...init, signal: AbortSignal.timeout(timeoutMs) });
-    } catch (e) {
-      if (attempt < attempts) {
-        await sleep(t.retryDelayMs * attempt);
-        continue;
-      }
-      const error = e as Error;
-      throw new Error(
-        error.name === "TimeoutError"
-          ? `CapCut ${step} request timed out after ${seconds(timeoutMs)} s${attempts > 1 ? ` (${attempts} tries)` : ""}.`
-          : `CapCut ${step} request failed: ${error.message}`,
-      );
-    }
-    if (!res.ok && (res.status === 429 || res.status >= 500) && attempt < attempts) {
-      await sleep(t.retryDelayMs * attempt);
-      continue;
-    }
-    return res;
-  }
-}
 
 export interface CloudAsrResult {
   cues: CaptionCue[];
@@ -228,35 +193,6 @@ export interface CloudAsrResult {
   duration_ms?: number;
 }
 
-interface EditorApiReply<T> {
-  ret: string;
-  errmsg: string;
-  data?: T;
-}
-
-/** POST to CapCut's editor API; an HTTP failure names the step. */
-async function postEditorApi<T>(
-  url: string,
-  headers: Record<string, string>,
-  body: string,
-  step: string,
-  t: Timing,
-  retry: boolean,
-): Promise<EditorApiReply<T>> {
-  const res = await send(url, { method: "POST", headers, body }, step, t, retry);
-  if (!res.ok) {
-    throw new Error(`CapCut ${step} HTTP error: ${res.status} ${res.statusText}`);
-  }
-  return (await res.json()) as EditorApiReply<T>;
-}
-
-/** The editor API answers ret "0" (or 0) on success; any other ret is its refusal. */
-function requireRetOk(reply: EditorApiReply<unknown>, step: string): void {
-  if (reply.ret !== "0" && reply.ret !== (0 as unknown as string)) {
-    throw new Error(`CapCut ${step} failed [ret=${reply.ret}]: ${reply.errmsg || "Unknown error"}`);
-  }
-}
-
 interface UploadSignatureData {
   access_key_id: string;
   secret_access_key: string;
@@ -276,7 +212,7 @@ interface ApplyUploadResult {
 
 /** Step 1: Request upload signature from CapCut Web API. */
 async function getUploadSignature(t: Timing): Promise<UploadSignatureData> {
-  const url = "https://editor-api-sg.capcutapi.com/lv/v1/upload_sign?aid=359289&device_platform=windows";
+  const url = `https://${CAPCUT_EDITOR_HOST}/lv/v1/upload_sign?aid=359289&device_platform=windows`;
   const body = JSON.stringify({ biz: "cc_pc_text_recognize", key_version: "v5" });
   const json = await postEditorApi<UploadSignatureData>(url, DEFAULT_CAPCUT_HEADERS, body, "upload_sign", t, true);
   requireRetOk(json, "upload_sign");
@@ -298,7 +234,13 @@ async function applyUpload(creds: UploadSignatureData, t: Timing): Promise<Apply
     creds,
   );
 
-  const res = await send(signed.url, { method: "GET", headers: signed.headers }, "ApplyUploadInner", t, true);
+  const res = await sendCapcutRequest(
+    signed.url,
+    { method: "GET", headers: signed.headers },
+    "ApplyUploadInner",
+    t,
+    true,
+  );
   if (!res.ok) {
     throw new Error(`CapCut ApplyUploadInner HTTP error: ${res.status} ${res.statusText}`);
   }
@@ -345,7 +287,7 @@ async function uploadBinary(applyData: ApplyUploadResult, fileBuffer: Buffer, t:
   const transferUrl = `https://${applyData.host}/upload/v1/${applyData.oid}?uploadid=${applyData.uploadId}&part_number=0&phase=transfer`;
   // The body takes time to send: one more second per 128 KiB on top of the request limit.
   const transferTimeoutMs = t.requestTimeoutMs + Math.ceil(fileBuffer.length / (128 * 1024)) * 1000;
-  const transferRes = await send(
+  const transferRes = await sendCapcutRequest(
     transferUrl,
     {
       method: "POST",
@@ -368,7 +310,7 @@ async function uploadBinary(applyData: ApplyUploadResult, fileBuffer: Buffer, t:
   // 3.2 Finish
   const finishUrl = `https://${applyData.host}/upload/v1/${applyData.oid}?uploadmode=part&phase=finish&uploadid=${applyData.uploadId}`;
   const finishBody = `0:${hash}`;
-  const finishRes = await send(
+  const finishRes = await sendCapcutRequest(
     finishUrl,
     { method: "POST", headers: { ...authHeaders, "Content-Type": "text/plain" }, body: finishBody },
     "TOS finish",
@@ -423,7 +365,13 @@ async function commitUpload(
     creds,
   );
 
-  const res = await send(signed.url, { method: "POST", headers: signed.headers, body }, "CommitUploadInner", t, false);
+  const res = await sendCapcutRequest(
+    signed.url,
+    { method: "POST", headers: signed.headers, body },
+    "CommitUploadInner",
+    t,
+    false,
+  );
   if (!res.ok) {
     throw new Error(`CapCut CommitUploadInner HTTP error: ${res.status} ${res.statusText}`);
   }
@@ -514,7 +462,7 @@ async function pollSttStatus(
   cookie?: string,
   opts?: CloudAsrOptions,
 ): Promise<CloudAsrPayload> {
-  const url = "https://editor-api-sg.capcutapi.com/lv/v1/common_task/query?aid=359289&device_platform=windows";
+  const url = `https://${CAPCUT_EDITOR_HOST}/lv/v1/common_task/query?aid=359289&device_platform=windows`;
   const body = JSON.stringify({
     tasks: [{ id: taskId, req_key: "cc_audio_subtitle_asr", task_version: "v3", token }],
   });
diff --git a/src/capcut-cloud-headers.ts b/src/capcut-cloud-headers.ts
index 4b8b414..4fdc54a 100644
--- a/src/capcut-cloud-headers.ts
+++ b/src/capcut-cloud-headers.ts
@@ -1,10 +1,12 @@
 /**
- * The headers CapCut's desktop app sends to its editor API, as captured from
- * one install. Both experimental cloud clients replay them: `caption --cloud`
+ * CapCut's editor API as both experimental cloud clients call it: `caption --cloud`
  * (capcut-cloud-asr.ts) and `translate --cloud` / `caption --translate`
- * (capcut-cloud-translate.ts). The install's identity is written once here, so
- * when ByteDance stops accepting it there is one place to change; each client
- * keeps the signature captured with its own requests.
+ * (capcut-cloud-translate.ts). It holds the headers CapCut's desktop app sends,
+ * as captured from one install, and the request discipline both clients share:
+ * the time limit, the retries and how a failed call is named. The install's
+ * identity is written once here, so when ByteDance stops accepting it there is
+ * one place to change; each client keeps the signature captured with its own
+ * requests.
  */
 
 /** The editor API host both clients call. */
@@ -42,3 +44,88 @@ export function capcutEditorHeaders(s: CapcutCapturedSignature): Record<string,
     "x-khronos": s.time,
   };
 }
+
+/** How long one request may take, and the pause before its first retry. */
+export interface CapcutRequestTiming {
+  requestTimeoutMs: number;
+  /** Pause before the n-th retry is n times this. */
+  retryDelayMs: number;
+}
+
+const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
+
+/** A duration for a message: whole seconds from one second up, fractions below. */
+export const seconds = (ms: number) => (ms >= 1000 ? Math.round(ms / 1000) : ms / 1000);
+
+/** Attempts for the calls that are safe to repeat. */
+const RETRY_ATTEMPTS = 3;
+
+/**
+ * One request with a time limit. `retry` repeats a call that is safe to repeat
+ * when the network fails, it times out, or the service answers 429 or 5xx,
+ * pausing n x retryDelayMs before the n-th retry; a call that is not safe to
+ * repeat is sent once. Any other answer is returned as is. `step` names the
+ * call in the error.
+ */
+export async function sendCapcutRequest(
+  url: string,
+  init: RequestInit,
+  step: string,
+  t: CapcutRequestTiming,
+  retry: boolean,
+  timeoutMs = t.requestTimeoutMs,
+): Promise<Response> {
+  const attempts = retry ? RETRY_ATTEMPTS : 1;
+  for (let attempt = 1; ; attempt++) {
+    let res: Response;
+    try {
+      res = await fetch(url, { ...init, signal: AbortSignal.timeout(timeoutMs) });
+    } catch (e) {
+      if (attempt < attempts) {
+        await sleep(t.retryDelayMs * attempt);
+        continue;
+      }
+      const error = e as Error;
+      throw new Error(
+        error.name === "TimeoutError"
+          ? `CapCut ${step} request timed out after ${seconds(timeoutMs)} s${attempts > 1 ? ` (${attempts} tries)` : ""}.`
+          : `CapCut ${step} request failed: ${error.message}`,
+      );
+    }
+    if (!res.ok && (res.status === 429 || res.status >= 500) && attempt < attempts) {
+      await sleep(t.retryDelayMs * attempt);
+      continue;
+    }
+    return res;
+  }
+}
+
+/** The editor API's answer: ret "0" (or 0) on success, data with the result. */
+export interface EditorApiReply<T> {
+  ret: string | number;
+  errmsg: string;
+  data?: T;
+}
+
+/** POST to CapCut's editor API; an HTTP failure names the step. */
+export async function postEditorApi<T>(
+  url: string,
+  headers: Record<string, string>,
+  body: string,
+  step: string,
+  t: CapcutRequestTiming,
+  retry: boolean,
+): Promise<EditorApiReply<T>> {
+  const res = await sendCapcutRequest(url, { method: "POST", headers, body }, step, t, retry);
+  if (!res.ok) {
+    throw new Error(`CapCut ${step} HTTP error: ${res.status} ${res.statusText}`);
+  }
+  return (await res.json()) as EditorApiReply<T>;
+}
+
+/** The editor API answers ret "0" (or 0) on success; any other ret is its refusal. */
+export function requireRetOk(reply: EditorApiReply<unknown>, step: string): void {
+  if (reply.ret !== "0" && reply.ret !== 0) {
+    throw new Error(`CapCut ${step} failed [ret=${reply.ret}]: ${reply.errmsg || "Unknown error"}`);
+  }
+}
diff --git a/src/capcut-cloud-translate.ts b/src/capcut-cloud-translate.ts
index abc9875..9cadc1b 100644
--- a/src/capcut-cloud-translate.ts
+++ b/src/capcut-cloud-translate.ts
@@ -5,7 +5,7 @@
  * API: ByteDance can change or refuse them at any time.
  */
 import { randomUUID } from "node:crypto";
-import { CAPCUT_EDITOR_HOST, capcutEditorHeaders } from "./capcut-cloud-headers.js";
+import { CAPCUT_EDITOR_HOST, capcutEditorHeaders, postEditorApi, requireRetOk } from "./capcut-cloud-headers.js";
 import type { CaptionCue, CaptionWord } from "./caption.js";
 
 /** The captured headers this client replays; the shared identity is in capcut-cloud-headers.ts. */
@@ -106,19 +106,16 @@ const LANGUAGE_ALIASES: Record<string, string> = {
 };
 
 /**
- * Normalizes user-supplied language string into CapCut's canonical language code.
+ * Normalizes user-supplied language string into CapCut's canonical language code,
+ * in any letter case. Every alias is written in lower case and every canonical
+ * code is also an alias of itself, so one lookup of the lower-cased input finds
+ * it; anything else passes through trimmed.
  */
 export function normalizeLanguageCode(lang: string): string {
   const clean = lang.trim().toLowerCase();
   if (LANGUAGE_ALIASES[clean]) {
     return LANGUAGE_ALIASES[clean];
   }
-  // Try case-insensitive lookup
-  for (const [k, v] of Object.entries(LANGUAGE_ALIASES)) {
-    if (k.toLowerCase() === clean || v.toLowerCase() === clean) {
-      return v;
-    }
-  }
   return lang.trim();
 }
 
@@ -151,79 +148,32 @@ export interface CloudTranslateOptions {
   chunkSize?: number;
 }
 
-const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
-const RETRY_ATTEMPTS = 3;
-
-/**
- * Send POST request to CapCut editor API with retry and timeout.
- */
-async function sendTranslateRequest(
-  url: string,
-  body: string,
-  timeoutMs: number,
-  retryDelayMs: number,
-): Promise<Response> {
-  for (let attempt = 1; ; attempt++) {
-    try {
-      const res = await fetch(url, {
-        method: "POST",
-        headers: DEFAULT_CAPCUT_TRANSLATE_HEADERS,
-        body,
-        signal: AbortSignal.timeout(timeoutMs),
-      });
-
-      if (res.ok) return res;
-
-      if ((res.status === 429 || res.status >= 500) && attempt < RETRY_ATTEMPTS) {
-        await sleep(retryDelayMs * attempt);
-        continue;
-      }
-      return res;
-    } catch (e) {
-      if (attempt < RETRY_ATTEMPTS) {
-        await sleep(retryDelayMs * attempt);
-        continue;
-      }
-      const err = e as Error;
-      throw new Error(
-        err.name === "TimeoutError"
-          ? `CapCut Cloud Translation request timed out after ${Math.round(timeoutMs / 1000)} s (${RETRY_ATTEMPTS} tries).`
-          : `CapCut Cloud Translation request failed: ${err.message}`,
-      );
-    }
-  }
+/** One translated line as the service sends it; every field may be missing. */
+interface CloudTranslatedLine {
+  text?: string;
+  start_time?: number;
+  end_time?: number;
+  translation_text?: string;
+  translation_words?: Array<{
+    text?: string;
+    start_time?: number;
+    end_time?: number;
+  }>;
 }
 
-interface CommonTaskSyncResponse {
-  ret: string | number;
-  errmsg: string;
-  data?: {
-    tasks?: Array<{
-      id?: string;
-      req_key?: string;
-      status?: string;
-      payload?:
-        | string
-        | {
-            translation?: Record<
-              string,
-              Array<{
-                text?: string;
-                start_time?: number;
-                end_time?: number;
-                translation_text?: string;
-                translation_words?: Array<{
-                  text?: string;
-                  start_time?: number;
-                  end_time?: number;
-                }>;
-              }>
-            >;
-          };
-    }>;
-  };
+/** The data of a common_task/sync answer: the payload arrives as a JSON string or an object. */
+interface CommonTaskSyncData {
+  tasks?: Array<{
+    id?: string;
+    req_key?: string;
+    status?: string;
+    payload?: string | { translation?: Record<string, CloudTranslatedLine[]> };
+  }>;
 }
 
+/** The step name a failed translation request carries ("CapCut Cloud Translation HTTP error: ..."). */
+const STEP = "Cloud Translation";
+
 /**
  * Translate a batch of utterances via ByteDance CapCut cloud translation.
  */
@@ -237,8 +187,7 @@ export async function translateUtterancesCapcutCloud(
   const targetCode = normalizeLanguageCode(targetLang);
   const sourceCode = opts?.from && opts.from !== "auto" ? normalizeLanguageCode(opts.from) : "UNSPECIFIED";
   const chunkSize = opts?.chunkSize ?? 50;
-  const timeoutMs = opts?.requestTimeoutMs ?? 60_000;
-  const retryDelayMs = opts?.retryDelayMs ?? 1500;
+  const timing = { requestTimeoutMs: opts?.requestTimeoutMs ?? 60_000, retryDelayMs: opts?.retryDelayMs ?? 1500 };
   const url = `https://${CAPCUT_EDITOR_HOST}/lv/v1/common_task/sync`;
 
   const allResults: CloudTranslateItem[] = [];
@@ -264,22 +213,22 @@ export async function translateUtterancesCapcutCloud(
       ],
     };
 
-    const res = await sendTranslateRequest(url, JSON.stringify(bodyObj), timeoutMs, retryDelayMs);
-    if (!res.ok) {
-      throw new Error(`CapCut Cloud Translation HTTP error: ${res.status} ${res.statusText}`);
-    }
-
-    const reply = (await res.json()) as CommonTaskSyncResponse;
+    // The translation is safe to repeat: a lost answer is asked for again.
+    const reply = await postEditorApi<CommonTaskSyncData>(
+      url,
+      DEFAULT_CAPCUT_TRANSLATE_HEADERS,
+      JSON.stringify(bodyObj),
+      STEP,
+      timing,
+      true,
+    );
 
     if (String(reply.ret) === "1014") {
       throw new Error(
         "CapCut Cloud Translation returned error 1014 (System Busy / Security Token). Try again later or use Anthropic translation.",
       );
     }
-
-    if (String(reply.ret) !== "0") {
-      throw new Error(`CapCut Cloud Translation failed [ret=${reply.ret}]: ${reply.errmsg || "Unknown error"}`);
-    }
+    requireRetOk(reply, STEP);
 
     const task = reply.data?.tasks?.[0];
     if (!task) {
@@ -295,7 +244,8 @@ export async function translateUtterancesCapcutCloud(
       }
     }
 
-    const translationMap = (payload as { translation?: Record<string, unknown[]> })?.translation;
+    const translationMap = (payload as { translation?: Record<string, CloudTranslatedLine[]> } | undefined)
+      ?.translation;
     const targetItems = translationMap?.[targetCode];
 
     if (!Array.isArray(targetItems)) {
@@ -314,19 +264,7 @@ export async function translateUtterancesCapcutCloud(
 
     for (let j = 0; j < chunk.length; j++) {
       const original = chunk[j];
-      const item = targetItems[j] as
-        | {
-            text?: string;
-            start_time?: number;
-            end_time?: number;
-            translation_text?: string;
-            translation_words?: Array<{
-              text?: string;
-              start_time?: number;
-              end_time?: number;
-            }>;
-          }
-        | undefined;
+      const item: CloudTranslatedLine | undefined = targetItems[j];
 
       const translated = item?.translation_text?.trim() ? item.translation_text : undefined;
       const transWords: CloudTranslateWord[] | undefined = Array.isArray(item?.translation_words)
diff --git a/src/caption-coverage.ts b/src/caption-coverage.ts
new file mode 100644
index 0000000..107390e
--- /dev/null
+++ b/src/caption-coverage.ts
@@ -0,0 +1,148 @@
+import { detectSilence } from "./silence.js";
+
+/**
+ * Caption coverage: how much of the speech in the transcribed audio the
+ * written cues actually cover.
+ *
+ * A transcription can stop before the end of the audio, or skip a quiet
+ * stretch, and still exit cleanly; the draft then simply has no captions
+ * there. After `caption` transcribes, the audio is measured with ffmpeg's
+ * silencedetect (the same pass `detect-silence` runs): its keep spans are the
+ * speech. The cue spans are subtracted from them, and what is left over —
+ * speech no cue covers — is reported. All times are the audio's own seconds,
+ * the same clock the cues are timed on.
+ *
+ * The span math (`mergeSpans`, `subtractSpans`, `captionCoverage`) is pure and
+ * asserted without ffmpeg; `measureSpeech` is the live pass and never throws:
+ * a missing ffmpeg or an unreadable file becomes a `skipped` reason.
+ */
+
+/** A span of the audio, in seconds. */
+export interface TimeSpan {
+  start: number;
+  end: number;
+}
+
+export interface CaptionCoverage {
+  /** Seconds of non-silent audio. */
+  speech_s: number;
+  /** Seconds of that speech a cue covers. */
+  captioned_s: number;
+  /** captioned_s / speech_s (1 when the audio holds no speech). */
+  ratio: number;
+  /** Speech no cue covers, each span at least the --min-uncaptioned length. */
+  uncaptioned: Array<{ start_s: number; end_s: number }>;
+  /** Seconds of the listed spans that come after the last cue ends. */
+  tail_uncaptioned_s: number;
+}
+
+export type CoverageReport = CaptionCoverage | { skipped: string };
+
+/** Shortest uncaptioned speech span reported, seconds. */
+export const DEFAULT_MIN_UNCAPTIONED = 1.5;
+
+// Rounding noise from µs → s conversions must not hide a span sitting exactly
+// at the threshold.
+const EPSILON = 1e-6;
+
+/** Sort spans and merge the ones that overlap or touch. Empty spans drop. */
+export function mergeSpans(spans: TimeSpan[]): TimeSpan[] {
+  const sorted = spans.filter((span) => span.end > span.start).sort((a, b) => a.start - b.start);
+  const merged: TimeSpan[] = [];
+  for (const span of sorted) {
+    const last = merged[merged.length - 1];
+    if (last && span.start <= last.end) last.end = Math.max(last.end, span.end);
+    else merged.push({ start: span.start, end: span.end });
+  }
+  return merged;
+}
+
+/** The parts of `from` that no span of `minus` covers. */
+export function subtractSpans(from: TimeSpan[], minus: TimeSpan[]): TimeSpan[] {
+  const cut = mergeSpans(minus);
+  const left: TimeSpan[] = [];
+  for (const span of mergeSpans(from)) {
+    let cursor = span.start;
+    for (const c of cut) {
+      if (c.end <= cursor) continue;
+      if (c.start >= span.end) break;
+      if (c.start > cursor) left.push({ start: cursor, end: c.start });
+      cursor = Math.max(cursor, c.end);
+      if (cursor >= span.end) break;
+    }
+    if (cursor < span.end) left.push({ start: cursor, end: span.end });
+  }
+  return left;
+}
+
+function total(spans: TimeSpan[]): number {
+  return spans.reduce((sum, span) => sum + (span.end - span.start), 0);
+}
+
+function round3(n: number): number {
+  return Math.round(n * 1000) / 1000;
+}
+
+/**
+ * Compare the speech spans with the cue spans. `uncaptioned` lists only the
+ * uncovered speech spans of at least `minUncaptioned` seconds; shorter ones
+ * (a breath, a cue ending a few frames early) still count against
+ * captioned_s and ratio.
+ */
+export function captionCoverage(
+  speech: TimeSpan[],
+  cues: TimeSpan[],
+  minUncaptioned = DEFAULT_MIN_UNCAPTIONED,
+): CaptionCoverage {
+  const speechSpans = mergeSpans(speech);
+  const speechS = total(speechSpans);
+  const uncovered = subtractSpans(speechSpans, cues);
+  const captionedS = Math.max(0, speechS - total(uncovered));
+  const listed = uncovered.filter((span) => span.end - span.start >= minUncaptioned - EPSILON);
+  const lastCueEnd = cues.reduce((end, cue) => Math.max(end, cue.end), 0);
+  return {
+    speech_s: round3(speechS),
+    captioned_s: round3(captionedS),
+    ratio: speechS > 0 ? Math.round((captionedS / speechS) * 10_000) / 10_000 : 1,
+    uncaptioned: listed.map((span) => ({ start_s: round3(span.start), end_s: round3(span.end) })),
+    tail_uncaptioned_s: round3(total(listed.filter((span) => span.start >= lastCueEnd - EPSILON))),
+  };
+}
+
+/**
+ * The speech in `audioPath` as spans (silencedetect's keep spans, unpadded),
+ * or why it could not be measured. Never throws: the coverage check must not
+ * fail a caption run that already succeeded.
+ */
+export function measureSpeech(audioPath: string, ffmpegCmd: string): TimeSpan[] | { skipped: string } {
+  let keeps: ReturnType<typeof detectSilence>["keeps"];
+  try {
+    keeps = detectSilence(audioPath, { ffmpegCmd, pad: 0 }).keeps;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return { skipped: /is unavailable at/.test(message) ? "ffmpeg not found" : "ffmpeg could not read the audio" };
+  }
+  // An open-ended keep span means neither ffprobe nor ffmpeg reported the
+  // audio's length, so the speech after the last silence has no known end.
+  if (keeps.some((keep) => keep.end === null)) return { skipped: "audio length unknown" };
+  return keeps.map((keep) => ({ start: keep.start, end: keep.end as number }));
+}
+
+function seconds(n: number): string {
+  return `${n.toFixed(2)}s`;
+}
+
+/** The one stderr line a run with uncaptioned speech prints. */
+export function uncaptionedWarning(coverage: CaptionCoverage): string {
+  const spans = coverage.uncaptioned;
+  const missing = spans.reduce((sum, span) => sum + (span.end_s - span.start_s), 0);
+  const list = spans.map((span) => `${span.start_s.toFixed(2)}-${seconds(span.end_s)}`).join(", ");
+  const tail =
+    coverage.tail_uncaptioned_s > 0
+      ? ` ${seconds(coverage.tail_uncaptioned_s)} of it comes after the last cue: the transcription may have stopped before the end of the audio.`
+      : "";
+  return (
+    `[uncaptioned-speech] ${seconds(missing)} of speech in ${spans.length} span${spans.length === 1 ? "" : "s"} ` +
+    `has no caption (${Math.round(coverage.ratio * 100)}% of the speech is captioned): ${list}.${tail}\n`
+  );
+}
diff --git a/src/caption.ts b/src/caption.ts
index 3f6e63f..c31944d 100644
--- a/src/caption.ts
+++ b/src/caption.ts
@@ -6,6 +6,13 @@ import { join } from "node:path";
 import { type AlignmentReport, alignScript, tokenizeScript } from "./align.js";
 import { transcribeAudioCapcutCloud } from "./capcut-cloud-asr.js";
 import { normalizeLanguageCode, translateCuesCapcutCloud } from "./capcut-cloud-translate.js";
+import {
+  type CoverageReport,
+  captionCoverage,
+  DEFAULT_MIN_UNCAPTIONED,
+  measureSpeech,
+  type TimeSpan,
+} from "./caption-coverage.js";
 import {
   buildEmphasisRanges,
   DEFAULT_KEYWORD_SIZE,
@@ -21,6 +28,14 @@ import { type CaptionScript, captionScript, groupingDefaults, wordSeparator } fr
 import { requireSegment } from "./segment-lookup.js";
 import { parseSrt } from "./srt.js";
 import { storedTextLength } from "./text-offsets.js";
+import {
+  readTranscriptCache,
+  sha256File,
+  TRANSCRIPT_CACHE_VERSION,
+  type TranscriptCacheKey,
+  type TranscriptCacheState,
+  writeTranscriptCache,
+} from "./transcript-cache.js";
 import { resolveWhisperCommand, whisperDialect } from "./whisper.js";
 
 export interface CaptionOptions {
@@ -32,7 +47,7 @@ export interface CaptionOptions {
   wordsSource?: string; // where wordsJson came from (path or "stdin"), for the result
   audio?: string; // path to audio file; if absent, derived from --from-segment
   audioStream?: number; // zero-based audio stream inside the input container
-  ffmpegCmd?: string; // ffmpeg binary used only when audioStream is selected
+  ffmpegCmd?: string; // ffmpeg binary for audioStream extraction and the coverage check
   fromSegment?: string; // segment ID of an audio segment in the draft to caption
   cloud?: boolean; // transcribe via CapCut Cloud ASR
   translate?: string; // translate captions to target language via CapCut Cloud
@@ -59,6 +74,12 @@ export interface CaptionOptions {
    * cue boundary, long lines still split at --max-chars.
    */
   scriptText?: string;
+  /** false (--no-coverage) skips measuring which speech the cues leave uncaptioned. */
+  coverage?: boolean;
+  /** Shortest uncaptioned speech span the coverage check lists, seconds (default 1.5). */
+  minUncaptioned?: number;
+  /** false (--no-cache) neither reads nor writes the transcript cache. */
+  cache?: boolean;
 }
 
 export interface CaptionWord {
@@ -101,6 +122,10 @@ export interface CaptionResult {
   color_cycle?: number;
   /** --script alignment quality (only when a script was given). */
   script?: AlignmentReport;
+  /** Speech in the transcribed audio that no cue covers (absent with --words or --no-coverage). */
+  coverage?: CoverageReport;
+  /** Whether the transcription came from the transcript cache (absent with --words: nothing is transcribed). */
+  transcript_cache?: TranscriptCacheState;
   /** The script the transcript is written in, which chose the word separator
    * and the --max-words / --max-chars defaults (see script.ts). */
   caption_script: CaptionScript;
@@ -186,6 +211,9 @@ export function checkCaptionOptions(opts: CaptionOptions): void {
   if (opts.audioStream !== undefined && (!Number.isInteger(opts.audioStream) || opts.audioStream < 0)) {
     throw new Error("--audio-stream must be a zero-based non-negative integer.");
   }
+  if (opts.minUncaptioned !== undefined && (!Number.isFinite(opts.minUncaptioned) || opts.minUncaptioned < 0)) {
+    throw new Error("--min-uncaptioned must be a number of seconds, 0 or more.");
+  }
   const conflict = transcriptionSourceConflict({ ...opts, words: opts.wordsJson !== undefined });
   if (conflict) throw new Error(conflict);
 }
@@ -196,6 +224,12 @@ export async function captionDraft(draft: Draft, opts: CaptionOptions): Promise<
   let sourceAudio: string | undefined;
   let transcription: TranscriptionResult;
   let external: ParsedWordTimings | undefined;
+  // The speech in the audio that was transcribed, measured before a temporary
+  // extracted stream is cleaned up; compared with the cues once they exist.
+  let speech: TimeSpan[] | { skipped: string } | undefined;
+  let transcriptCache: TranscriptCacheState | undefined;
+  const measure = (audio: string) =>
+    opts.coverage === false ? undefined : measureSpeech(audio, opts.ffmpegCmd ?? "ffmpeg");
   if (fromWords) {
     // External aligner output stands in for the Whisper run; everything after
     // this point (script detection, grouping, --script, karaoke, reveal,
@@ -208,40 +242,34 @@ export async function captionDraft(draft: Draft, opts: CaptionOptions): Promise<
     }
     transcription = { cues: [], words: external.words, engine: "words" };
   } else if (opts.cloud) {
-    sourceAudio = resolveAudio(draft, opts);
-    const selectedAudio =
-      opts.audioStream === undefined
-        ? undefined
-        : extractAudioStream(sourceAudio, opts.audioStream, opts.ffmpegCmd ?? "ffmpeg");
-    try {
-      const cloudAudio = selectedAudio?.path ?? sourceAudio;
-      const durationMs = cloudAudioDurationMs(draft, opts, cloudAudio);
-      if (isDryRun()) throw new Error("--cloud never uploads under --dry-run; plan the upload with planCloudUpload.");
-      process.stderr.write(
-        `WARNING: --cloud is experimental and unofficial: uploading ${cloudAudio} to ByteDance's CapCut servers for recognition.\n`,
-      );
-      const languageWarning = cloudLanguageWarning(opts);
-      if (languageWarning) process.stderr.write(languageWarning);
-      const cloudRes = await transcribeAudioCapcutCloud(cloudAudio, { durationMs });
-      transcription = {
-        cues: cloudRes.cues,
-        words: cloudRes.words,
-        engine: "capcut-cloud",
-      };
-    } finally {
-      selectedAudio?.cleanup();
-    }
+    const heard = await withCaptionAudio(draft, opts, async (cloudAudio) => {
+      // A cache hit uploads nothing: the recognition below runs only on a miss.
+      const cached = await transcribeWithCache(cloudAudio, opts, async (): Promise<TranscriptionResult> => {
+        const durationMs = cloudAudioDurationMs(draft, opts, cloudAudio);
+        if (isDryRun()) throw new Error("--cloud never uploads under --dry-run; plan the upload with planCloudUpload.");
+        process.stderr.write(
+          `WARNING: --cloud is experimental and unofficial: uploading ${cloudAudio} to ByteDance's CapCut servers for recognition.\n`,
+        );
+        const languageWarning = cloudLanguageWarning(opts);
+        if (languageWarning) process.stderr.write(languageWarning);
+        const cloudRes = await transcribeAudioCapcutCloud(cloudAudio, { durationMs });
+        return { cues: cloudRes.cues, words: cloudRes.words, engine: "capcut-cloud" };
+      });
+      speech = measure(cloudAudio);
+      return cached;
+    });
+    sourceAudio = heard.source;
+    transcription = heard.result.transcription;
+    transcriptCache = heard.result.state;
   } else {
-    sourceAudio = resolveAudio(draft, opts);
-    const selectedAudio =
-      opts.audioStream === undefined
-        ? undefined
-        : extractAudioStream(sourceAudio, opts.audioStream, opts.ffmpegCmd ?? "ffmpeg");
-    try {
-      transcription = runWhisper(selectedAudio?.path ?? sourceAudio, opts);
-    } finally {
-      selectedAudio?.cleanup();
-    }
+    const heard = await withCaptionAudio(draft, opts, async (audio) => {
+      const cached = await transcribeWithCache(audio, opts, () => runWhisper(audio, opts));
+      speech = measure(audio);
+      return cached;
+    });
+    sourceAudio = heard.source;
+    transcription = heard.result.transcription;
+    transcriptCache = heard.result.state;
   }
   const recognizedWords = transcription.words.length > 0 ? transcription.words : wordsFromCues(transcription.cues);
   // The transcript's script decides how words join into a cue (no space inside
@@ -314,6 +342,18 @@ export async function captionDraft(draft: Draft, opts: CaptionOptions): Promise<
   if (cues.length === 0) {
     throw new Error("Whisper produced no cues. Check the audio file is not silent and the model name is valid.");
   }
+  // Cue times are the audio's own clock (they are written at those positions),
+  // so they compare directly with the measured speech.
+  const coverage: CoverageReport | undefined =
+    speech === undefined
+      ? undefined
+      : "skipped" in speech
+        ? speech
+        : captionCoverage(
+            speech,
+            cues.map((cue) => ({ start: cue.startUs / 1_000_000, end: cue.endUs / 1_000_000 })),
+            opts.minUncaptioned ?? DEFAULT_MIN_UNCAPTIONED,
+          );
 
   let translation: CaptionResult["translation"];
   if (opts.translate) {
@@ -450,13 +490,77 @@ export async function captionDraft(draft: Draft, opts: CaptionOptions): Promise<
     keyword_matches: highlightWords.length > 0 ? keywordMatches : undefined,
     color_cycle: colorCycle.length > 0 ? colorCycle.length : undefined,
     script: scriptReport,
+    coverage,
+    transcript_cache: transcriptCache,
+  };
+}
+
+/**
+ * The transcript cache key for this run: the transcribed audio's bytes plus
+ * every setting that changes what the engine returns. --cloud takes no model
+ * or language (the service detects the language), so those stay null there.
+ */
+export function transcriptCacheKey(opts: CaptionOptions, audioSha256: string): TranscriptCacheKey {
+  const cloud = opts.cloud === true;
+  return {
+    version: TRANSCRIPT_CACHE_VERSION,
+    audio_sha256: audioSha256,
+    engine: cloud ? "capcut-cloud" : detectEngine(opts),
+    whisper_cmd: cloud ? null : whisperCommand(opts),
+    model: cloud ? null : (opts.whisperModel ?? "base"),
+    language: cloud ? null : (opts.language ?? "auto"),
+    // Whisper is asked for word-timestamp JSON only for these modes (runWhisper).
+    word_timing: cloud || opts.karaoke === true || opts.wordReveal === true ? "words" : "lines",
+    cloud,
   };
 }
 
+/**
+ * Run `transcribe` unless the cache already holds its result for this audio
+ * and these settings. A dry run reads the cache but never writes it.
+ */
+async function transcribeWithCache(
+  audio: string,
+  opts: CaptionOptions,
+  transcribe: () => TranscriptionResult | Promise<TranscriptionResult>,
+): Promise<{ transcription: TranscriptionResult; state: TranscriptCacheState }> {
+  if (opts.cache === false) return { transcription: await transcribe(), state: "off" };
+  const key = transcriptCacheKey(opts, sha256File(audio));
+  const cached = readTranscriptCache(key);
+  // readTranscriptCache only returns an entry whose engine equals key.engine.
+  if (cached) return { transcription: cached as TranscriptionResult, state: "hit" };
+  const transcription = await transcribe();
+  if (!isDryRun()) writeTranscriptCache(key, transcription);
+  return { transcription, state: "miss" };
+}
+
 export function buildAudioStreamInvocation(audio: string, stream: number, output: string): string[] {
   return ["-y", "-i", audio, "-map", `0:a:${stream}`, "-vn", "-ac", "1", "-ar", "16000", "-c:a", "pcm_s16le", output];
 }
 
+/**
+ * The audio a transcription reads, for as long as `use` runs: --audio or the
+ * --from-segment's file, or with --audio-stream that stream extracted to a
+ * temporary WAV, which is removed afterwards whether `use` succeeds or throws.
+ * `source` is the file the result reports, never the temporary copy.
+ */
+async function withCaptionAudio<T>(
+  draft: Draft,
+  opts: CaptionOptions,
+  use: (audioPath: string) => T | Promise<T>,
+): Promise<{ source: string; result: T }> {
+  const source = resolveAudio(draft, opts);
+  const selected =
+    opts.audioStream === undefined
+      ? undefined
+      : extractAudioStream(source, opts.audioStream, opts.ffmpegCmd ?? "ffmpeg");
+  try {
+    return { source, result: await use(selected?.path ?? source) };
+  } finally {
+    selected?.cleanup();
+  }
+}
+
 function extractAudioStream(audio: string, stream: number, command: string): { path: string; cleanup: () => void } {
   const dir = mkdtempSync(join(tmpdir(), "capcut-caption-audio-"));
   const output = join(dir, "selected.wav");
diff --git a/src/command-specs.ts b/src/command-specs.ts
index 02dd61e..7f63db3 100644
--- a/src/command-specs.ts
+++ b/src/command-specs.ts
@@ -240,7 +240,7 @@ const usages = {
   relink: "capcut relink <project> (--dir <path> [--recursive] | --from <prefix> --to <prefix>) [--stage]",
   timeline: "capcut timeline <project> [--cols <number>]",
   projects: "capcut projects [query] [--drafts <path>] [--names]",
-  diff: "capcut diff <project-a> <project-b>",
+  diff: "capcut diff <project-a> (<project-b> | --since-write)",
   concat: "capcut concat <project-a> <project-b> [--out <path>]",
   config: "capcut config",
   describe: "capcut describe [--compact] [--command <name>]",
@@ -251,7 +251,7 @@ const usages = {
     "capcut harvest-enums [<project> | --sync | --add <kind> <slug> <resource-id>] [--apply] [--catalogue <path>]",
   doctor: "capcut doctor [--drafts <dir>]",
   diagnose: "capcut diagnose <project> [--bundle <report.json>]",
-  fixture: "capcut fixture <project> --out <dir> [--check]",
+  fixture: "capcut fixture <project> --out <dir> [--anonymize] [--check]",
   "sync-timelines": "capcut sync-timelines <project-dir> [--nested] [--apply]",
   restore: "capcut restore <project> [--step <number> | --list]",
   serve: "capcut serve [--queue <path>] [options]",
@@ -266,7 +266,8 @@ const usages = {
   render: "capcut render <project> [--out <preview.mp4>] [options]",
   "detect-scenes": "capcut detect-scenes <video> [options]",
   "detect-silence": "capcut detect-silence <media> [options]",
-  loudness: "capcut loudness <project> [--target <lufs>] [--per-clip] [--max-gain-db <db>] [--apply]",
+  loudness:
+    "capcut loudness <project> [--target <lufs>] [--per-clip] [--max-gain-db <db>] [--apply] [--tolerance <lu>] [--max-true-peak <dbtp>]",
   "detect-retakes":
     "capcut detect-retakes <project> [--track-name <s>] [--window <s>] [--similarity <n>] [--min-words <n>] | --srt <file>",
 } as const satisfies Record<string, string>;
@@ -318,6 +319,25 @@ const optionsByCommand: Record<string, OptionSpec[]> = {
       "Check target ranges against draft.fps; --fix snaps boundaries and derives duration.",
     ),
     option("no_probe", ["--no-probe"], "boolean", "Skip ffprobe media checks (VFR / unreadable media)."),
+    option(
+      "max_still_secs",
+      ["--max-still-secs"],
+      "number",
+      "Report still-too-long (warning) for each still image that plays longer than this many seconds. Off unless given.",
+    ),
+    option(
+      "max_shot_secs",
+      ["--max-shot-secs"],
+      "number",
+      "Report shot-too-long (warning) for each video clip that plays longer than this many seconds. Off unless given.",
+    ),
+    option(
+      "min_silent_secs",
+      ["--min-silent-secs"],
+      "number",
+      "Report silent-stretch (warning) for every range of this many seconds or more where nothing audible plays. " +
+        "A clip counts as silent only when the draft says so (volume 0, muted track, photo, sound separated). Off unless given.",
+    ),
     option(
       "pip",
       ["--pip"],
@@ -598,7 +618,7 @@ const optionsByCommand: Record<string, OptionSpec[]> = {
       "number",
       "Zero-based audio stream to extract from the input container before transcription.",
     ),
-    option("ffmpeg_cmd", ["--ffmpeg-cmd"], "path", "FFmpeg binary used by --audio-stream."),
+    option("ffmpeg_cmd", ["--ffmpeg-cmd"], "path", "FFmpeg binary used by --audio-stream and the coverage check."),
     option("from_segment", ["--from-segment"], "id", "Audio segment input."),
     option(
       "cloud",
@@ -644,6 +664,25 @@ const optionsByCommand: Record<string, OptionSpec[]> = {
       "Maximum characters per cue (karaoke) or per script line. Unset: 28 / 42; Chinese 16 / 16, Japanese 13 / 13, Korean 16 / 16.",
     ),
     option("max_gap_ms", ["--max-gap-ms"], "number", "Maximum gap inside a karaoke cue."),
+    option(
+      "min_uncaptioned",
+      ["--min-uncaptioned"],
+      "number",
+      "Shortest stretch of speech without a cue, in seconds, that the coverage check lists in coverage.uncaptioned and warns about.",
+      { default: 1.5 },
+    ),
+    option(
+      "no_coverage",
+      ["--no-coverage"],
+      "boolean",
+      'Skip the coverage check. By default, after transcribing (not with --words), ffmpeg measures the speech in the transcribed audio (silencedetect) and the result\'s `coverage` block reports speech_s, captioned_s, ratio, the uncaptioned spans and tail_uncaptioned_s (speech after the last cue); any uncaptioned span prints one `[uncaptioned-speech]` warning on stderr. Without ffmpeg the block is {skipped: "ffmpeg not found"} and the run does not fail.',
+    ),
+    option(
+      "no_cache",
+      ["--no-cache"],
+      "boolean",
+      "Neither read nor write the transcript cache. By default the raw transcription (before --script, grouping, styling and --translate) is cached, keyed by the sha256 of the transcribed audio bytes, the engine, whisper command, model, language and word-timing mode, so a run that only changes those later steps does not transcribe (or, with --cloud, upload) again. The result reports transcript_cache: hit, miss or off. Cache directory: CAPCUT_CLI_CACHE_DIR, else $XDG_CACHE_HOME/capcut-cli/transcripts, else ~/.cache/capcut-cli/transcripts (%LOCALAPPDATA%\\capcut-cli\\cache\\transcripts on Windows). --dry-run reads it but never writes it.",
+    ),
     TRACK_NAME,
     STYLE_REF,
     PRESET,
@@ -778,6 +817,18 @@ const optionsByCommand: Record<string, OptionSpec[]> = {
     option("names", ["--names"], "boolean", "Read project display names."),
   ],
   concat: [OUT],
+  diff: [
+    option(
+      "since_write",
+      ["--since-write"],
+      "boolean",
+      "Compare <project-a> with what capcut-cli itself last wrote to it instead of with a second draft, to see " +
+        "what the app changed when it opened or saved a tool-written draft (a = as written, b = now). Adds " +
+        "since_write: {file, written_at, written_by, written_sha256, current_sha256, changed, top_level_changed, " +
+        "track_order_changed}; changed is false when the file is byte-identical to the write. Every write records " +
+        "its result in the draft's history directory; a draft with no recorded write exits 1.",
+    ),
+  ],
   doctor: [
     option(
       "drafts",
@@ -788,7 +839,22 @@ const optionsByCommand: Record<string, OptionSpec[]> = {
   ],
   diagnose: [option("bundle", ["--bundle"], "path", "Write a redacted JSON diagnostic bundle.")],
   fixture: [
-    option("out", ["--out"], "path", "Output directory for the sanitized bundle."),
+    option(
+      "out",
+      ["--out"],
+      "path",
+      "Output directory for the sanitized bundle: a new or empty directory outside the source project.",
+    ),
+    option(
+      "anonymize",
+      ["--anonymize"],
+      "boolean",
+      "Also replace what the draft is about: media file names become media-001.<ext> and folder names on media " +
+        "and project paths folder-001 (consistently across every mirror; standard folders such as Desktop are kept), " +
+        "the project name becomes project, and every text is replaced character by character with placeholders " +
+        "of the same length and script (CJK 字, Latin x/X, digits 0; spaces, punctuation and style ranges kept). " +
+        "The report records anonymized: true and counts what was replaced. Media files are never copied.",
+    ),
     option(
       "check",
       ["--check"],
@@ -904,7 +970,12 @@ const optionsByCommand: Record<string, OptionSpec[]> = {
       "string",
       "Target video bitrate such as 2500k or 4M; switches the proxy from CRF to bitrate mode.",
     ),
-    option("burn_captions", ["--burn-captions"], "boolean", "Burn captions."),
+    option(
+      "burn_captions",
+      ["--burn-captions"],
+      "boolean",
+      "Burn captions (ffmpeg drawtext). Each caption uses its text material's own font file (the first style block's font.path, else font_path) when that file exists and is a .ttf, .otf or .ttc, otherwise ffmpeg's default face; the result's caption_fonts counts both.",
+    ),
     option(
       "soft_captions",
       ["--soft-captions"],
@@ -957,6 +1028,19 @@ const optionsByCommand: Record<string, OptionSpec[]> = {
     ),
     option("max_gain_db", ["--max-gain-db"], "number", "Largest boost any clip may get, in dB.", { default: 20 }),
     option("apply", ["--apply"], "boolean", "Write the gain as segment volume (default: report only)."),
+    option(
+      "tolerance",
+      ["--tolerance"],
+      "number",
+      "Delivery gate (needs --target): exit 1 when the judged loudness sits more than this many LU from the target. " +
+        "With --apply the mix after this run's gain is judged, without it the mix as it stands.",
+    ),
+    option(
+      "max_true_peak",
+      ["--max-true-peak"],
+      "number",
+      "Delivery gate: exit 1 when the loudest clip's true peak, at the judged volume, is above this level in dBTP.",
+    ),
     option("ffmpeg_cmd", ["--ffmpeg-cmd"], "path", "FFmpeg binary (needs the ebur128 filter)."),
   ],
   "detect-silence": [
@@ -1028,6 +1112,7 @@ optionsByCommand["image-anim"] = optionsByCommand["text-anim"];
 //   --crf, --video-bitrate -> render (v0.26 proxy quality controls)
 //   --threshold-db, --min-silence, --pad -> detect-silence (v0.20 silence spans)
 //   --target, --per-clip, --max-gain-db -> loudness (v0.31 EBU R128 delivery gain)
+//   --tolerance, --max-true-peak -> loudness (delivery gate on the judged mix)
 //   --text, --text-file, --tts-cmd -> tts (v0.20 voiceover synthesis)
 //   --lexicon            -> tts (pronunciation rules for the spoken text)
 //   --nested             -> sync-timelines (v0.21 nested Timelines/ repair)
@@ -1043,10 +1128,16 @@ optionsByCommand["image-anim"] = optionsByCommand["text-anim"];
 //   --strict, --verify   -> render (v0.29 fidelity census gate + output duration check)
 //   --like, --from-store -> migrate (v0.23 schema-marker restamp from a donor project)
 //   --word-reveal, --min-script-match, --audio-stream -> caption (v0.26 caption controls)
+//   --min-uncaptioned, --no-coverage -> caption (coverage check)
+//   --no-cache           -> caption (transcript cache)
 //   --apply-plan         -> batch (v0.29 reviewed batch plans)
 //   --from -> shift-all; --ripple -> remove (v0.26 boundary-safe ripple editing)
 //   --frame-grid -> lint (v0.26 exact integer timeline preflight)
+//   --max-still-secs, --max-shot-secs -> lint (opt-in pacing checks)
+//   --min-silent-secs    -> lint (opt-in silent-stretch check)
 //   --recursive -> relink (v0.27 nested media search)
+//   --anonymize -> fixture (neutral media, folder, project and text placeholders)
+//   --since-write -> diff (compare with the CLI's last recorded write)
 // Everywhere else they fall through to the positional stream verbatim, matching
 // pre-release behaviour where these tokens were unknown and preserved.
 export const RELEASE_SCOPED_FLAGS: ReadonlySet<string> = new Set([
@@ -1054,9 +1145,12 @@ export const RELEASE_SCOPED_FLAGS: ReadonlySet<string> = new Set([
   "--target",
   "--per-clip",
   "--max-gain-db",
+  "--tolerance",
+  "--max-true-peak",
   "--compact",
   "--command",
   "--add",
+  "--anonymize",
   "--audio-stream",
   "--apply",
   "--apply-plan",
@@ -1074,9 +1168,15 @@ export const RELEASE_SCOPED_FLAGS: ReadonlySet<string> = new Set([
   "--word-reveal",
   "--video-bitrate",
   "--min-script-match",
+  "--min-uncaptioned",
+  "--no-cache",
+  "--no-coverage",
   "--from",
   "--ripple",
   "--frame-grid",
+  "--max-still-secs",
+  "--max-shot-secs",
+  "--min-silent-secs",
   "--full",
   "--granularity",
   "--highlight-words",
@@ -1107,6 +1207,7 @@ export const RELEASE_SCOPED_FLAGS: ReadonlySet<string> = new Set([
   "--reset",
   "--script",
   "--similarity",
+  "--since-write",
   "--soft-captions",
   "--strict",
   "--sync",
diff --git a/src/decorators.ts b/src/decorators.ts
index 0594c60..e71080e 100644
--- a/src/decorators.ts
+++ b/src/decorators.ts
@@ -689,10 +689,7 @@ export function setTextStyle(
       for (const block of content.styles) {
         if (opts.fontSize !== undefined) block.size = opts.fontSize;
         if (opts.color !== undefined) {
-          block.fill = {
-            alpha: 1,
-            content: { render_type: "solid", solid: { alpha: 1, color: hexToRgb01(opts.color) } },
-          };
+          block.fill = solidFill(hexToRgb01(opts.color));
         }
       }
       text.content = JSON.stringify(content);
@@ -1170,11 +1167,36 @@ export interface TextRangeInput {
   underline?: boolean;
 }
 
+// --- Text colour as CapCut stores it ---
+// A style block's colour is three channels in 0..1 inside a solid fill; the CLI
+// speaks "#RRGGBB". These three are the only places that know either encoding.
+
 export function hexToRgb01(hex: string): [number, number, number] {
   const h = hex.replace("#", "");
   return [parseInt(h.slice(0, 2), 16) / 255, parseInt(h.slice(2, 4), 16) / 255, parseInt(h.slice(4, 6), 16) / 255];
 }
 
+/** Stored 0..1 channels back to "#RRGGBB" (upper case), each channel clamped to a byte. */
+export function rgb01ToHex(rgb: [number, number, number]): string {
+  const byte = (c: number) =>
+    Math.max(0, Math.min(255, Math.round(c * 255)))
+      .toString(16)
+      .padStart(2, "0")
+      .toUpperCase();
+  return `#${byte(rgb[0])}${byte(rgb[1])}${byte(rgb[2])}`;
+}
+
+/** The fill a style block stores for one solid colour (0..1 channels) at `alpha`. */
+export function solidFill(color: [number, number, number], alpha = 1) {
+  return { alpha: 1, content: { render_type: "solid", solid: { alpha, color } } };
+}
+
+/** The solid colour and alpha of a stored fill, when it has one. */
+export function fillSolid(fill: unknown): { color?: [number, number, number]; alpha?: number } | undefined {
+  return (fill as { content?: { solid?: { color?: [number, number, number]; alpha?: number } } } | undefined)?.content
+    ?.solid;
+}
+
 export function setTextRanges(
   draft: Draft,
   segmentId: string,
@@ -1192,9 +1214,7 @@ export function setTextRanges(
 
   // Baseline style inherited for fields the user didn't override.
   const base = content.styles?.[0] ?? {};
-  const baseFill = (
-    base.fill as { content?: { solid?: { color?: [number, number, number]; alpha?: number } } } | undefined
-  )?.content?.solid;
+  const baseFill = fillSolid(base.fill);
   const defaultColor: [number, number, number] = baseFill?.color ?? [1, 1, 1];
   const defaultAlpha = baseFill?.alpha ?? 1;
   const defaultSize = (base.size as number | undefined) ?? 15;
@@ -1232,13 +1252,7 @@ export function setTextRanges(
       bold: r?.bold ?? defaultBold,
       italic: r?.italic ?? defaultItalic,
       underline: r?.underline ?? defaultUnderline,
-      fill: {
-        alpha: 1,
-        content: {
-          render_type: "solid",
-          solid: { alpha, color },
-        },
-      },
+      fill: solidFill(color, alpha),
     };
   };
 
diff --git a/src/draft.ts b/src/draft.ts
index 8d3728a..402cd33 100644
--- a/src/draft.ts
+++ b/src/draft.ts
@@ -339,6 +339,74 @@ function trimJournal(filePath: string, kept: Set<number>): void {
   }
 }
 
+// The state the most recent write left: `<draftbase>.last-write` in the
+// history directory, one per draft file, replaced on every write. Snapshots
+// and `.bak` keep the content BEFORE each write and the journal only hashes,
+// so this is the one copy of what the CLI itself wrote, which `diff
+// --since-write` compares the file on disk with to show what the app changed
+// afterwards. It is not a snapshot: restore never reads it, `restore --list`
+// never lists it, and the history cap does not count it.
+export interface LastWrite {
+  written_at: string;
+  sha256: string;
+  command: string | null;
+  content: string;
+}
+
+function lastWritePath(filePath: string): string {
+  return join(historyDir(filePath), `${basename(filePath)}.last-write`);
+}
+
+/** The digest a record carries (the journal's rule), for comparing a file with it. */
+export function contentDigest(content: string): string {
+  return journalDigest(content);
+}
+
+/** Record `content` as what the CLI just wrote to `filePath` (temp + rename). */
+export function recordLastWrite(filePath: string, content: string): void {
+  const record: LastWrite = {
+    written_at: new Date().toISOString(),
+    sha256: journalDigest(content),
+    command: writeContext.command,
+    content,
+  };
+  try {
+    mkdirSync(historyDir(filePath), { recursive: true });
+    writeAtomic(lastWritePath(filePath), `${JSON.stringify(record)}\n`);
+  } catch {
+    // Best effort, like the journal: the draft write already happened. A
+    // record of an older write must not outlive this one, though, or the
+    // comparison would show this write as a change made by the app.
+    try {
+      rmSync(lastWritePath(filePath), { force: true });
+    } catch {
+      // Nothing more to do; `diff --since-write` then reports no record.
+    }
+  }
+}
+
+/** The last recorded write to `filePath`, or null when there is none (or it is unreadable). */
+export function readLastWrite(filePath: string): LastWrite | null {
+  try {
+    const record = JSON.parse(readFileSync(lastWritePath(filePath), "utf-8")) as Partial<LastWrite>;
+    if (
+      typeof record?.content !== "string" ||
+      typeof record.sha256 !== "string" ||
+      typeof record.written_at !== "string"
+    ) {
+      return null;
+    }
+    return {
+      written_at: record.written_at,
+      sha256: record.sha256,
+      command: typeof record.command === "string" ? record.command : null,
+      content: record.content,
+    };
+  } catch {
+    return null;
+  }
+}
+
 // Snapshots newest-first, step 1 = most recent write (equivalent to `.bak`).
 export function listSnapshots(filePath: string): Array<{ step: number; index: number; path: string }> {
   const dir = historyDir(filePath);
@@ -474,6 +542,12 @@ export function commitDraftTargets(
     }
     throw error;
   }
+  // Every timeline file this commit wrote, recorded as written. Sidecars are
+  // not timelines and have nothing for `diff --since-write` to compare.
+  const timelinePaths = new Set(targets.map((target) => target.path));
+  for (const item of committed) {
+    if (timelinePaths.has(item.target.path)) recordLastWrite(item.target.path, item.content);
+  }
   // Target path -> the content committed there, so a caller holding a store
   // for these targets can roll it forward without re-reading the project.
   return written;
diff --git a/src/factory.ts b/src/factory.ts
index 4178a24..c7c13be 100644
--- a/src/factory.ts
+++ b/src/factory.ts
@@ -18,7 +18,7 @@ import {
 } from "node:fs";
 import { basename, dirname, resolve } from "node:path";
 import { readJsonObjectFile, readTextIfPresent, stripBom } from "./bom.js";
-import { hexToRgb01, uuidHex } from "./decorators.js";
+import { hexToRgb01, solidFill, uuidHex } from "./decorators.js";
 import { detectEncryption } from "./decrypt.js";
 import type { Draft, Segment, Timerange, Track } from "./draft.js";
 import { findMaterialGlobal, findSegment, loadedDraftProjectDir, makeTrack, writeAtomic } from "./draft.js";
@@ -1795,13 +1795,7 @@ function buildTextContent(text: string, fontSize: number, color: [number, number
         bold: false,
         italic: false,
         underline: false,
-        fill: {
-          alpha: 1,
-          content: {
-            render_type: "solid",
-            solid: { alpha: 1, color },
-          },
-        },
+        fill: solidFill(color),
       },
     ],
     text,
diff --git a/src/fixture-anonymize.ts b/src/fixture-anonymize.ts
new file mode 100644
index 0000000..14b334f
--- /dev/null
+++ b/src/fixture-anonymize.ts
@@ -0,0 +1,518 @@
+// `fixture --anonymize` — a bundle that can be shared without disclosing the
+// work it came from. Redaction (fixture.ts) removes who made a draft: home
+// paths, emails, device ids. Anonymization removes what the draft is about:
+// media file names and the folders they live in, the project name, and every
+// caption or title. What stays is the evidence a compatibility report needs —
+// the JSON structure, ids, timings, styles, the path shape of each reference
+// and the length and script class of every text, so line wrapping and style
+// range offsets behave as they did in the original.
+//
+// Files are rewritten string by string over their raw text: only the strings
+// that are replaced change, so key order, whitespace and number formatting of
+// everything else stay byte-identical (a parse + stringify round trip would
+// normalise numbers and could lose precision on large integers).
+
+type JsonPath = Array<string | number>;
+
+export interface AnonymizationCounts {
+  /** Distinct media files given a neutral name. */
+  media_files: number;
+  /** Media path and media name strings rewritten, in every mirror. */
+  media_references: number;
+  /** Distinct folder names replaced on media and project paths. */
+  folders: number;
+  /** Strings set to the neutral project name. */
+  project_names: number;
+  /** Text strings replaced with placeholders. */
+  text_fields: number;
+  /** Characters replaced inside those text strings. */
+  characters: number;
+}
+
+export const NEUTRAL_PROJECT_NAME = "project";
+
+// Folder names that say where a file sits on a standard machine or inside the
+// app, never what the user is working on. They are kept so a path still shows
+// whether media lives in the project, in the app's cache or on the desktop.
+const GENERIC_FOLDERS = new Set(
+  [
+    "users",
+    "user",
+    "home",
+    "appdata",
+    "local",
+    "locallow",
+    "roaming",
+    "library",
+    "application support",
+    "containers",
+    "group containers",
+    "data",
+    "documents",
+    "desktop",
+    "downloads",
+    "movies",
+    "videos",
+    "pictures",
+    "music",
+    "public",
+    "shared",
+    "volumes",
+    "capcut",
+    "capcut drafts",
+    "jianyingpro",
+    "jianyingpro drafts",
+    "jianying",
+    "user data",
+    "projects",
+    "com.lveditor.draft",
+    "cache",
+    "resources",
+    "apps",
+    "assets",
+    "video",
+    "audio",
+    "image",
+    "images",
+    "photo",
+    "materials",
+    "media",
+    "temp",
+    "tmp",
+    "timelines",
+  ].map((name) => name.toLowerCase()),
+);
+
+// Keys on media materials that name a file on disk.
+const MEDIA_PATH_KEY = /(?:^|_)path$/i;
+const MEDIA_MATERIALS: Record<string, { paths: (key: string) => boolean; names: string[] }> = {
+  videos: { paths: (key) => MEDIA_PATH_KEY.test(key), names: ["material_name"] },
+  audios: { paths: (key) => MEDIA_PATH_KEY.test(key), names: ["name"] },
+  canvases: { paths: (key) => key === "image" || key === "album_image", names: ["image_name"] },
+};
+
+// Text material fields. `content` (and `base_content`) carry CapCut's
+// JSON-in-string document, whose `text` is replaced and whose `styles` ranges
+// are left exactly as they are; the others hold plain words.
+const TEXT_DOCUMENT_FIELDS = ["content", "base_content"];
+const TEXT_PLAIN_FIELDS = ["text", "name", "recognize_text", "translate_original_text"];
+const TEXT_WORD_LISTS = ["words", "current_words"];
+
+const CJK = /[\p{scx=Han}\p{scx=Hiragana}\p{scx=Katakana}\p{scx=Hangul}\p{scx=Bopomofo}]/u;
+const LETTER = /\p{L}/u;
+const UPPER = /[\p{Lu}\p{Lt}]/u;
+const DIGIT = /\p{Nd}/u;
+// One placeholder per script, so a right-to-left or shaped script stays one.
+const SCRIPT_PLACEHOLDERS: Array<{ test: RegExp; lower: string; upper: string }> = [
+  { test: /\p{Script=Latin}/u, lower: "x", upper: "X" },
+  { test: /\p{Script=Greek}/u, lower: "ω", upper: "Ω" },
+  { test: /\p{Script=Cyrillic}/u, lower: "я", upper: "Я" },
+  { test: /\p{Script=Arabic}/u, lower: "ب", upper: "ب" },
+  { test: /\p{Script=Hebrew}/u, lower: "א", upper: "א" },
+  { test: /\p{Script=Thai}/u, lower: "ก", upper: "ก" },
+  { test: /\p{Script=Devanagari}/u, lower: "क", upper: "क" },
+];
+
+/**
+ * Replace every letter and digit with a placeholder of the same UTF-16 length
+ * and script class: CJK ideographs, kana and Hangul become 字, Latin letters
+ * x/X by case (full-width ones ｘ/Ｘ), digits 0. Whitespace, punctuation,
+ * symbols and combining marks are kept, so the string keeps its length in code
+ * units (the unit CapCut's style ranges count) and its line-break opportunities.
+ */
+export function maskText(text: string): { text: string; replaced: number } {
+  let out = "";
+  let replaced = 0;
+  for (const ch of text) {
+    const cp = ch.codePointAt(0) ?? 0;
+    const astral = cp > 0xffff;
+    let next = ch;
+    if (LETTER.test(ch)) {
+      const upper = UPPER.test(ch);
+      const script = SCRIPT_PLACEHOLDERS.find((s) => s.test.test(ch));
+      // Astral letters get astral placeholders, so the UTF-16 length holds.
+      if (CJK.test(ch)) next = astral ? "\u{20000}" : "字";
+      else if (astral) next = upper ? "\u{1D417}" : "\u{1D431}";
+      else if (cp >= 0xff21 && cp <= 0xff5a) next = upper ? "Ｘ" : "ｘ";
+      else if (script) next = upper ? script.upper : script.lower;
+      else next = upper ? "X" : "x";
+    } else if (DIGIT.test(ch)) {
+      next = astral ? "\u{1D7CE}" : cp >= 0xff10 && cp <= 0xff19 ? "０" : "0";
+    }
+    if (next !== ch) replaced++;
+    out += next;
+  }
+  return { text: out, replaced };
+}
+
+// Markup content (the legacy `<font …>[text]</font>` form, SSML) keeps its
+// tags and has the text between them masked; anything else is plain text.
+function maskMarkup(value: string): { text: string; replaced: number } {
+  if (!value.trimStart().startsWith("<")) return maskText(value);
+  let replaced = 0;
+  const text = value.replace(/(<[^>]*>)|[^<]+/g, (whole, tag: string | undefined) => {
+    if (tag) return tag;
+    const r = maskText(whole);
+    replaced += r.replaced;
+    return r.text;
+  });
+  return { text, replaced };
+}
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function isTimeline(value: Record<string, unknown>): boolean {
+  return Array.isArray(value.tracks) && isPlainObject(value.materials);
+}
+
+function isProjectMeta(value: Record<string, unknown>): boolean {
+  return Array.isArray(value.draft_materials) || "draft_fold_path" in value || "draft_name" in value;
+}
+
+function parseEmbedded(value: string): unknown {
+  const t = value.trim();
+  if (!(t.startsWith("{") || t.startsWith("["))) return undefined;
+  try {
+    const parsed: unknown = JSON.parse(value);
+    return typeof parsed === "object" && parsed !== null ? parsed : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Re-emit `raw` (valid JSON) with the string values at the given paths
+ * replaced, every other byte unchanged. Keys of `edits` are JSON-encoded paths.
+ */
+export function replaceJsonStrings(raw: string, edits: ReadonlyMap<string, string>): string {
+  if (edits.size === 0) return raw;
+  const parts: string[] = [];
+  let last = 0;
+  let i = 0;
+  const path: JsonPath = [];
+  const skipSpace = (): void => {
+    while (i < raw.length && (raw[i] === " " || raw[i] === "\n" || raw[i] === "\r" || raw[i] === "\t")) i++;
+  };
+  const stringEnd = (): number => {
+    let j = i + 1;
+    while (j < raw.length) {
+      const c = raw.charCodeAt(j);
+      if (c === 0x5c) j += 2;
+      else if (c === 0x22) return j + 1;
+      else j++;
+    }
+    throw new Error("Unterminated JSON string");
+  };
+  const value = (): void => {
+    skipSpace();
+    const c = raw[i];
+    if (c === "{") {
+      i++;
+      skipSpace();
+      if (raw[i] === "}") {
+        i++;
+        return;
+      }
+      for (;;) {
+        skipSpace();
+        const end = stringEnd();
+        const key = JSON.parse(raw.slice(i, end)) as string;
+        i = end;
+        skipSpace();
+        i++; // ':'
+        path.push(key);
+        value();
+        path.pop();
+        skipSpace();
+        if (raw[i++] === "}") return;
+      }
+    }
+    if (c === "[") {
+      i++;
+      skipSpace();
+      if (raw[i] === "]") {
+        i++;
+        return;
+      }
+      for (let index = 0; ; index++) {
+        path.push(index);
+        value();
+        path.pop();
+        skipSpace();
+        if (raw[i++] === "]") return;
+      }
+    }
+    if (c === '"') {
+      const end = stringEnd();
+      const edit = edits.get(JSON.stringify(path));
+      if (edit !== undefined) {
+        parts.push(raw.slice(last, i), JSON.stringify(edit));
+        last = end;
+      }
+      i = end;
+      return;
+    }
+    while (i < raw.length && !",]} \n\r\t".includes(raw[i])) i++;
+  };
+  value();
+  parts.push(raw.slice(last));
+  return parts.join("");
+}
+
+/**
+ * One anonymizer per bundle: the same media file, folder and project name map
+ * to the same neutral name in every file it rewrites.
+ */
+export class BundleAnonymizer {
+  private readonly projectNames: Set<string>;
+  private readonly media = new Map<string, string>();
+  private readonly mediaNames = new Map<string, string>();
+  private readonly folders = new Map<string, string>();
+  private readonly counts: AnonymizationCounts = {
+    media_files: 0,
+    media_references: 0,
+    folders: 0,
+    project_names: 0,
+    text_fields: 0,
+    characters: 0,
+  };
+
+  /** `projectNames`: the project folder's name and the draft's display names. */
+  constructor(projectNames: Iterable<string>) {
+    this.projectNames = new Set([...projectNames].filter((name) => name.length > 0));
+  }
+
+  summary(): AnonymizationCounts {
+    return { ...this.counts, media_files: this.media.size + this.mediaNames.size, folders: this.folders.size };
+  }
+
+  /** Anonymize one bundled file's text; text that is not JSON is returned unchanged. */
+  anonymizeDocument(raw: string): string {
+    let root: unknown;
+    try {
+      root = JSON.parse(raw);
+    } catch {
+      return raw;
+    }
+    const edits = new Map<string, string>();
+    this.walk(root, [], edits, false);
+    return replaceJsonStrings(raw, edits);
+  }
+
+  /** A folder path shown in the report (source or output directory). */
+  anonymizeFolderPath(value: string): string {
+    return this.folderPath(value);
+  }
+
+  private walk(node: unknown, path: JsonPath, edits: Map<string, string>, insideMaterials: boolean): void {
+    if (Array.isArray(node)) {
+      node.forEach((child, index) => {
+        this.walk(child, [...path, index], edits, insideMaterials);
+      });
+      return;
+    }
+    if (typeof node === "string") {
+      const key = JSON.stringify(path);
+      if (edits.has(key) || !/^\s*[{[]/.test(node)) return;
+      // Whole timeline documents nested as string-JSON (template-2.tmp).
+      const next = this.anonymizeDocument(node);
+      if (next !== node) edits.set(key, next);
+      return;
+    }
+    if (!isPlainObject(node)) return;
+    if (isTimeline(node)) this.timeline(node, path, edits, insideMaterials);
+    if (isProjectMeta(node)) this.projectMeta(node, path, edits);
+    for (const [key, child] of Object.entries(node)) {
+      this.walk(child, [...path, key], edits, insideMaterials || key === "materials");
+    }
+  }
+
+  private set(edits: Map<string, string>, path: JsonPath, value: string): void {
+    edits.set(JSON.stringify(path), value);
+  }
+
+  private timeline(draft: Record<string, unknown>, path: JsonPath, edits: Map<string, string>, nested: boolean) {
+    if (typeof draft.name === "string" && draft.name !== "") {
+      if (nested) this.maskPlain(draft.name, [...path, "name"], edits);
+      else {
+        this.set(edits, [...path, "name"], NEUTRAL_PROJECT_NAME);
+        this.counts.project_names++;
+      }
+    }
+    if (typeof draft.path === "string" && draft.path !== "") {
+      this.set(edits, [...path, "path"], this.folderPath(draft.path));
+    }
+    const materials = draft.materials as Record<string, unknown>;
+    for (const [kind, rule] of Object.entries(MEDIA_MATERIALS)) {
+      const list = materials[kind];
+      if (!Array.isArray(list)) continue;
+      list.forEach((material, index) => {
+        if (!isPlainObject(material)) return;
+        const at = [...path, "materials", kind, index];
+        let neutral: string | null = null;
+        for (const [key, value] of Object.entries(material)) {
+          if (typeof value !== "string" || value === "" || !rule.paths(key)) continue;
+          const next = this.mediaPath(value);
+          if (key === "path" || key === "image") neutral = baseName(next);
+          this.set(edits, [...at, key], next);
+          this.counts.media_references++;
+        }
+        for (const key of rule.names) {
+          const value = material[key];
+          if (typeof value !== "string" || value === "") continue;
+          this.set(edits, [...at, key], neutral ?? this.mediaName(value));
+          this.counts.media_references++;
+        }
+      });
+    }
+    const texts = materials.texts;
+    if (!Array.isArray(texts)) return;
+    texts.forEach((material, index) => {
+      if (!isPlainObject(material)) return;
+      const at = [...path, "materials", "texts", index];
+      for (const key of TEXT_DOCUMENT_FIELDS) {
+        const value = material[key];
+        if (typeof value === "string" && value !== "") this.maskDocument(value, [...at, key], edits);
+      }
+      for (const key of TEXT_PLAIN_FIELDS) {
+        const value = material[key];
+        if (typeof value === "string" && value !== "") this.maskPlain(value, [...at, key], edits);
+      }
+      if (typeof material.ssml_content === "string" && material.ssml_content !== "") {
+        const r = maskMarkup(material.ssml_content);
+        this.record(edits, [...at, "ssml_content"], material.ssml_content, r);
+      }
+      for (const list of TEXT_WORD_LISTS) {
+        const words = isPlainObject(material[list]) ? (material[list] as Record<string, unknown>).text : undefined;
+        if (!Array.isArray(words)) continue;
+        words.forEach((word, wordIndex) => {
+          if (typeof word === "string" && word !== "") this.maskPlain(word, [...at, list, "text", wordIndex], edits);
+        });
+      }
+    });
+  }
+
+  private projectMeta(meta: Record<string, unknown>, path: JsonPath, edits: Map<string, string>): void {
+    if (typeof meta.draft_name === "string" && meta.draft_name !== "") {
+      this.set(edits, [...path, "draft_name"], NEUTRAL_PROJECT_NAME);
+      this.counts.project_names++;
+    }
+    for (const key of ["draft_fold_path", "draft_root_path"]) {
+      const value = meta[key];
+      if (typeof value === "string" && value !== "") this.set(edits, [...path, key], this.folderPath(value));
+    }
+    if (!Array.isArray(meta.draft_materials)) return;
+    meta.draft_materials.forEach((group, groupIndex) => {
+      const entries = isPlainObject(group) ? group.value : undefined;
+      if (!Array.isArray(entries)) return;
+      entries.forEach((entry, index) => {
+        if (!isPlainObject(entry)) return;
+        const at = [...path, "draft_materials", groupIndex, "value", index];
+        let neutral: string | null = null;
+        if (typeof entry.file_Path === "string" && entry.file_Path !== "") {
+          const next = this.mediaPath(entry.file_Path);
+          neutral = baseName(next);
+          this.set(edits, [...at, "file_Path"], next);
+          this.counts.media_references++;
+        }
+        if (typeof entry.extra_info === "string" && entry.extra_info !== "") {
+          this.set(edits, [...at, "extra_info"], neutral ?? this.mediaName(entry.extra_info));
+          this.counts.media_references++;
+        }
+      });
+    });
+  }
+
+  private maskPlain(value: string, path: JsonPath, edits: Map<string, string>): void {
+    this.record(edits, path, value, maskText(value));
+  }
+
+  // CapCut's text document: `{"text": …, "styles": [{"range": [a, b], …}]}`
+  // as a string. Only `text` changes; the styles keep their bytes.
+  private maskDocument(value: string, path: JsonPath, edits: Map<string, string>): void {
+    const doc = parseEmbedded(value);
+    if (isPlainObject(doc)) {
+      if (typeof doc.text !== "string" || doc.text === "") return;
+      const r = maskText(doc.text);
+      const inner = replaceJsonStrings(value, new Map([[JSON.stringify(["text"]), r.text]]));
+      this.record(edits, path, value, { text: inner, replaced: r.replaced });
+      return;
+    }
+    this.record(edits, path, value, maskMarkup(value));
+  }
+
+  private record(
+    edits: Map<string, string>,
+    path: JsonPath,
+    before: string,
+    after: { text: string; replaced: number },
+  ): void {
+    if (after.text === before) return;
+    this.set(edits, path, after.text);
+    this.counts.text_fields++;
+    this.counts.characters += after.replaced;
+  }
+
+  private nextMediaName(original: string): string {
+    const n = this.media.size + this.mediaNames.size + 1;
+    return `media-${String(n).padStart(3, "0")}${extensionOf(original)}`;
+  }
+
+  // The same file maps to one neutral name whatever separators a mirror uses.
+  private mediaName(nameOrPath: string): string {
+    const key = normalisePath(nameOrPath);
+    const known = this.media.get(key) ?? this.mediaNames.get(key);
+    if (known) return known;
+    const name = this.nextMediaName(baseName(nameOrPath));
+    this.mediaNames.set(key, name);
+    return name;
+  }
+
+  private mediaPath(value: string): string {
+    const key = normalisePath(value);
+    let name = this.media.get(key);
+    if (!name) {
+      name = this.nextMediaName(baseName(value));
+      this.media.set(key, name);
+    }
+    const parts = value.split(/([\\/]+)/);
+    parts[parts.length - 1] = name;
+    for (let i = 0; i < parts.length - 1; i += 2) parts[i] = this.folder(parts[i]);
+    return parts.join("");
+  }
+
+  private folderPath(value: string): string {
+    const parts = value.split(/([\\/]+)/);
+    for (let i = 0; i < parts.length; i += 2) parts[i] = this.folder(parts[i]);
+    return parts.join("");
+  }
+
+  private folder(segment: string): string {
+    if (segment === "" || segment === "." || segment === ".." || segment === "USER") return segment;
+    if (/^[A-Za-z]:$/.test(segment) || /^##_.*_##$/.test(segment)) return segment;
+    if (this.projectNames.has(segment)) return NEUTRAL_PROJECT_NAME;
+    if (GENERIC_FOLDERS.has(segment.toLowerCase())) return segment;
+    let name = this.folders.get(segment);
+    if (!name) {
+      name = `folder-${String(this.folders.size + 1).padStart(3, "0")}`;
+      this.folders.set(segment, name);
+    }
+    return name;
+  }
+}
+
+function normalisePath(value: string): string {
+  return value.replace(/[\\/]+/g, "/");
+}
+
+function baseName(value: string): string {
+  const parts = value.split(/[\\/]+/);
+  return parts[parts.length - 1] ?? value;
+}
+
+function extensionOf(name: string): string {
+  const dot = name.lastIndexOf(".");
+  return dot > 0 ? name.slice(dot) : "";
+}
diff --git a/src/fixture.ts b/src/fixture.ts
index 8a5bfa6..269b5c7 100644
--- a/src/fixture.ts
+++ b/src/fixture.ts
@@ -9,11 +9,25 @@
 // CapCut 8.7 desktop) can only happen on Windows.
 
 import { createHash } from "node:crypto";
-import { existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
+import {
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  realpathSync,
+  renameSync,
+  rmdirSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { stripBom } from "./bom.js";
 import { keyframePropertyTypes } from "./decorators.js";
 import type { Draft } from "./draft.js";
+import { type AnonymizationCounts, BundleAnonymizer } from "./fixture-anonymize.js";
 import { MASK_FIELD_NAMES } from "./mask-fields.js";
 import { diagnoseDraftStore, discoverDraftStore, parseCandidate } from "./store.js";
 import { detectVersion } from "./version.js";
@@ -67,11 +81,19 @@ export interface SanitizeReport {
   files: SanitizeFileResult[];
   redaction_kinds: Record<string, number>;
   media_excluded: boolean;
+  /** True when built with --anonymize; `anonymization` then counts what was replaced. */
+  anonymized: boolean;
+  anonymization?: AnonymizationCounts;
   mask_keyframe_evidence: MaskKeyframeSummary;
   notes: string[];
   redaction_check: RedactionCheck;
 }
 
+export interface SanitizeOptions {
+  /** Also replace media names, folder names, the project name and every text (fixture --anonymize). */
+  anonymize?: boolean;
+}
+
 function redact(raw: string, tally: Record<string, number>): { text: string; count: number } {
   let text = raw;
   let count = 0;
@@ -326,6 +348,7 @@ function reporterReadme(
   modernStorage: boolean,
   nestedTimelines: string[],
   maskEvidenceFound: boolean,
+  anonymized: boolean,
 ): string {
   const nestedLine =
     nestedTimelines.length > 0
@@ -343,7 +366,7 @@ This folder was produced by \`capcut fixture\`. It contains **only** the timelin
 JSON files from a real project, with user home paths, email addresses and the
 device identifiers CapCut stamps into every draft (\`device_id\`,
 \`mac_address\`, \`hard_disk_id\`) redacted. No media from \`assets/\` was copied.
-
+${anonymized ? ANONYMIZED_README : ""}
 - Detected app version: ${version ?? "unknown"}
 - Modern storage layout (CapCut >= 8.7): ${modernStorage ? "yes" : "no"}${nestedLine}
 
@@ -373,24 +396,99 @@ needs a manual open-in-CapCut check on the real machine.
 `;
 }
 
+const ANONYMIZED_README = `
+It was also built with \`--anonymize\`: media file names became \`media-001\`,
+\`media-002\`, … (each keeps its extension), folder names on media and project
+paths became \`folder-001\`, … (standard folders such as Desktop and the app's
+own are kept), the project name became \`project\`, and every text was replaced
+character by character (CJK with 字, Latin letters with x/X, digits with 0;
+spaces, punctuation and style ranges kept), so lengths and line wrapping match
+the original. \`SANITIZE_REPORT.json\` counts what was replaced.
+`;
+
 /**
  * Build a shareable, redacted fixture bundle from a real draft folder.
  * Reuses the same storage discovery the `diagnose` command uses, so the
  * reported version/canonical-file analysis matches.
  */
-export function sanitizeDraftBundle(input: string, outDir: string): SanitizeReport {
+export function sanitizeDraftBundle(input: string, outDir: string, options: SanitizeOptions = {}): SanitizeReport {
   const store = discoverDraftStore(input); // throws if no readable draft
-  const out = resolve(outDir);
-  mkdirSync(out, { recursive: true });
+  const displayOut = resolve(outDir);
+  emptyBundleDestination(displayOut);
+  const destination = resolveBundleDestination(displayOut);
+  const fromSource = relative(realpathSync(store.projectDir), destination);
+  if (!fromSource || (!isAbsolute(fromSource) && fromSource !== ".." && !fromSource.startsWith(`..${sep}`))) {
+    throw new Error("Fixture --out must be outside the source project; choose a separate directory.");
+  }
+  const parent = dirname(destination);
+  mkdirSync(parent, { recursive: true });
+  const original = emptyBundleDestination(destination);
+  const stage = mkdtempSync(join(parent, ".capcut-fixture-"));
+  let removedEmptyDestination = false;
+  try {
+    const report = writeDraftBundle(input, store, stage, displayOut, options);
+    const current = emptyBundleDestination(destination);
+    if (original?.dev !== current?.dev || original?.ino !== current?.ino) {
+      throw new Error("Fixture output changed while building the bundle; choose a new --out directory.");
+    }
+    // Windows cannot rename a directory over an existing empty directory.
+    // rmdir refuses a newly occupied destination instead of deleting its files.
+    if (current) {
+      rmdirSync(destination);
+      removedEmptyDestination = true;
+    }
+    renameSync(stage, destination);
+    return report;
+  } catch (error) {
+    if (removedEmptyDestination && !lstatSync(destination, { throwIfNoEntry: false })) {
+      mkdirSync(destination);
+    }
+    throw error;
+  } finally {
+    rmSync(stage, { recursive: true, force: true });
+  }
+}
+
+// Resolve existing ancestors before creating directories, including aliases
+// into the source project. Missing output parents remain valid.
+function resolveBundleDestination(out: string): string {
+  if (lstatSync(out, { throwIfNoEntry: false })) return realpathSync(out);
+  return join(resolveBundleDestination(dirname(out)), basename(out));
+}
 
+function emptyBundleDestination(out: string): ReturnType<typeof lstatSync> | undefined {
+  const stat = lstatSync(out, { throwIfNoEntry: false });
+  if (stat && (!stat.isDirectory() || readdirSync(out).length > 0)) {
+    throw new Error(
+      "Fixture --out must be a new or empty directory; existing files and source projects are never overwritten.",
+    );
+  }
+  return stat;
+}
+
+function writeDraftBundle(
+  input: string,
+  store: ReturnType<typeof discoverDraftStore>,
+  out: string,
+  displayOut: string,
+  options: SanitizeOptions,
+): SanitizeReport {
   const tally: Record<string, number> = {};
   const files: SanitizeFileResult[] = [];
   const bundledTexts: Array<{ file: string; text: string }> = [];
+  // Anonymization runs on the redacted text, so every path it sees already
+  // carries the home placeholder, and one instance keeps names consistent
+  // across all the mirrors below.
+  const anonymizer = options.anonymize ? new BundleAnonymizer(projectNames(store)) : null;
+  const sanitizeText = (raw: string): { text: string; count: number } => {
+    const redacted = redact(raw, tally);
+    return anonymizer ? { text: anonymizer.anonymizeDocument(redacted.text), count: redacted.count } : redacted;
+  };
   for (const name of TIMELINE_FILES) {
     const src = join(store.projectDir, name);
     if (!existsSync(src)) continue;
     const raw = stripBom(readFileSync(src, "utf-8"));
-    const { text, count } = redact(raw, tally);
+    const { text, count } = sanitizeText(raw);
     writeFileSync(join(out, name), text, "utf-8");
     files.push({ file: name, bytes_in: Buffer.byteLength(raw), bytes_out: Buffer.byteLength(text), redactions: count });
     bundledTexts.push({ file: name, text });
@@ -405,7 +503,7 @@ export function sanitizeDraftBundle(input: string, outDir: string): SanitizeRepo
     const src = join(store.projectDir, ...rel.split("/"));
     if (!existsSync(src)) continue;
     const raw = stripBom(readFileSync(src, "utf-8"));
-    const { text, count } = redact(raw, tally);
+    const { text, count } = sanitizeText(raw);
     const dest = join(out, ...rel.split("/"));
     mkdirSync(dirname(dest), { recursive: true });
     writeFileSync(dest, text, "utf-8");
@@ -431,15 +529,22 @@ export function sanitizeDraftBundle(input: string, outDir: string): SanitizeRepo
   writeFileSync(join(out, "diagnose.json"), `${JSON.stringify(reportOut, null, 2)}\n`, "utf-8");
   writeFileSync(
     join(out, "README.md"),
-    reporterReadme(store.version, store.modernStorage, store.nestedTimelines, maskEvidenceFound),
+    reporterReadme(store.version, store.modernStorage, store.nestedTimelines, maskEvidenceFound, anonymizer !== null),
     "utf-8",
   );
 
   // The report ships inside the bundle, so its own path fields go through the
   // redactor too (#59). Written raw, they reintroduce the username that every
   // bundled timeline file just had scrubbed.
-  const { text: safeSourceDir } = redact(store.projectDir, tally);
-  const { text: safeOutDir } = redact(out, tally);
+  // With --anonymize their folder names are replaced like those on media paths
+  // (after the counts are taken, which describe the bundled draft files).
+  const anonymization = anonymizer?.summary();
+  const reportPath = (path: string): string => {
+    const { text } = redact(path, tally);
+    return anonymizer ? anonymizer.anonymizeFolderPath(text) : text;
+  };
+  const safeSourceDir = reportPath(store.projectDir);
+  const safeOutDir = reportPath(displayOut);
 
   const sanitize: Omit<SanitizeReport, "redaction_check"> = {
     ok: true,
@@ -450,11 +555,20 @@ export function sanitizeDraftBundle(input: string, outDir: string): SanitizeRepo
     files,
     redaction_kinds: tally,
     media_excluded: true,
+    anonymized: anonymizer !== null,
+    ...(anonymization ? { anonymization } : {}),
     mask_keyframe_evidence: maskReport.summary,
     notes: [
       "Binary media under assets/ was intentionally excluded — only timeline JSON files are bundled.",
       "User home paths, email addresses and device identifiers (device_id, mac_address, hard_disk_id) " +
         "were redacted; review the files before sharing.",
+      ...(anonymizer
+        ? [
+            "Anonymized (--anonymize): media file names, folder names on media and project paths, the project " +
+              "name and every text were replaced with neutral placeholders of the same length; `anonymization` " +
+              "counts them. Media files are never copied, so none were substituted.",
+          ]
+        : []),
       "Attach this folder to issue #35 (or a new issue) to move the version toward fixture-tested.",
       "mask-keyframe-report.json maps the draft's mask + keyframe structures — the #44 harvest " +
         "(the mask-geometry keyframe encoding has no public ground truth).",
@@ -484,6 +598,20 @@ export function sanitizeDraftBundle(input: string, outDir: string): SanitizeRepo
   return checked;
 }
 
+// The names a project goes by: its folder, the display name the app lists it
+// under (draft_meta_info.json), and the timeline's own name.
+function projectNames(store: ReturnType<typeof discoverDraftStore>): string[] {
+  const names = [basename(store.projectDir)];
+  try {
+    const meta = JSON.parse(stripBom(readFileSync(join(store.projectDir, "draft_meta_info.json"), "utf-8")));
+    if (typeof meta?.draft_name === "string") names.push(meta.draft_name);
+  } catch {
+    // No readable sidecar: the folder name still identifies the project.
+  }
+  if (typeof store.canonical.draft?.name === "string") names.push(store.canonical.draft.name);
+  return names;
+}
+
 // --- Nested-Timelines evidence (issue #50) ----------------------------------
 // #50 (CapCut 7.x is reported to keep the live document at
 // Timelines/<id>/draft_info.json) is stalled on four evidence items:
diff --git a/src/index.ts b/src/index.ts
index e87ee2d..d647793 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -38,6 +38,7 @@ import type { Draft, MaterialText, Segment, Timerange, Track } from "./draft.js"
 import {
   assertTargetsUnchangedOnDisk,
   commitDraftTargets,
+  contentDigest,
   extractCodeUnitStyleRanges,
   extractText,
   findDraft,
@@ -49,6 +50,8 @@ import {
   isDryRun,
   loadDraft,
   loadedDraftStore,
+  readLastWrite,
+  recordLastWrite,
   saveDraft,
   setDryRun,
   setForceWrite,
@@ -77,6 +80,7 @@ import {
   parseCandidate,
   planTimelineSync,
   setActiveTimelineSelection,
+  timelineFromText,
 } from "./store.js";
 import { formatDuration, formatTime, parseTimeInput } from "./time.js";
 import type { UserEnumEntry } from "./user-enums.js";
@@ -209,6 +213,15 @@ Overview (start here):
                --max-cue-secs <n>  Caption duration cap (default 7)
                --min-gap-ms <n>    Min gap between captions (default 0)
                --no-check-paths    Skip local-file existence checks
+               --max-still-secs <n> Warn (still-too-long) on a still image
+                                   that plays longer than n seconds
+               --max-shot-secs <n> Warn (shot-too-long) on a video clip
+                                   that plays longer than n seconds
+               --min-silent-secs <n> Warn (silent-stretch) on every range of
+                                   n seconds or more where nothing audible
+                                   plays; a clip counts as silent only when
+                                   the draft says so (volume 0, muted
+                                   track, photo, sound separated)
                --fix               Auto-repair issues stamped fixable:true
                                    (cue-too-long, caption-overlap,
                                    caption-gap-too-small, line-too-long,
@@ -266,6 +279,7 @@ Create:
 
 Preview:
   loudness   <project> [--target <LUFS>] [--per-clip] [--max-gain-db <dB>] [--apply]
+             [--tolerance <LU>] [--max-true-peak <dBTP>]
              Measure every audible clip with ffmpeg's EBU R128 meter (over the
              part of its media the timeline plays) and estimate the export's
              integrated loudness. A draft carries no master gain, so a quiet
@@ -273,6 +287,10 @@ Preview:
              adds the gain that reaches it, one gain for the whole mix (keeps
              the balance) or per clip with --per-clip; --apply writes it as
              segment volume. Boosts are capped at --max-gain-db (default 20).
+             Delivery gate: --tolerance (needs --target) and --max-true-peak
+             judge the mix after this run's gain with --apply, the mix as it
+             stands without; a miss exits 1 with the reason on stderr, and
+             the result's "gate" object says which check failed.
   render     <project> [--out <file.mp4>] [options]
              Render a low-res ffmpeg PROXY preview of the timeline so you can
              watch an edit without opening CapCut. Flattens the main video
@@ -281,7 +299,11 @@ Preview:
              Options:
                --scale <f>        Proxy scale of canvas dims (default 0.5)
                --fps <n>          Output fps (default draft fps)
-               --burn-captions    Draw text-track segments onto the video
+               --burn-captions    Draw text-track segments onto the video, each
+                                  in its text material's font file when the
+                                  draft names an existing .ttf/.otf/.ttc
+                                  (else ffmpeg's default face); the result's
+                                  caption_fonts counts both
                --soft-captions    Mux the text-track cues as a toggleable
                                   subtitle stream (mov_text) instead of, or
                                   as well as, burning them: the SRT is written
@@ -517,13 +539,16 @@ Maintenance & inspection:
   timeline   <project> [--cols N]               Show track/segment layout (JSON, or -H ASCII bars)
   projects   [query] [--drafts <dir>] [--names] List CapCut/JianYing draft folders on disk
   diff       <projectA> <projectB>             Compare two drafts (added/removed/changed)
+             --since-write: compare <projectA> with what capcut-cli last wrote
+             to it, to see what the app changed after opening or saving it.
   concat     <projectA> <draftB> [--out <p>]   Append draftB onto projectA's timeline (id-safe)
   config                                       Show resolved .capcutrc + effective defaults
   describe [--compact] [--command <name>]        Emit command contracts or a compact discovery index
   diagnose   <project> [--bundle <report.json>] Inspect canonical draft files and divergence
   fixture    <project> --out <dir>              Build a shareable, redacted compatibility bundle
              (timeline JSON only, no media; home paths + emails redacted) to
-             attach to a version-support issue like #35.
+             attach to a version-support issue like #35. --anonymize also
+             replaces media names, folder names, the project name and texts.
   sync-timelines <project-dir> [--apply]        Reconcile timeline mirrors (template-2.tmp,
              draft_info.json) that drifted from draft_content.json, so a CLI
              edit is honored by CapCut >= 8.7 (issue #35). Prints the plan
@@ -725,7 +750,32 @@ Caption (v0.4 — real subtitle objects, fixes import-srt mimicry):
                --whisper-cmd <cmd>  Path to whisper binary (default: "whisper")
                --whisper-model <m>  Model name (default: "base")
                --audio-stream <n>   Zero-based audio stream in the input
-               --ffmpeg-cmd <cmd>   ffmpeg used to extract --audio-stream
+               --ffmpeg-cmd <cmd>   ffmpeg used to extract --audio-stream and
+                                    to measure caption coverage
+               --min-uncaptioned <secs>
+                                    Shortest stretch of speech without a cue
+                                    the coverage check reports (default 1.5)
+               --no-coverage        Skip the coverage check. By default, after
+                                    transcribing, ffmpeg measures the speech in
+                                    the audio (silencedetect) and the result's
+                                    "coverage" block lists the speech no cue
+                                    covers; any found prints one
+                                    [uncaptioned-speech] warning on stderr.
+                                    Without ffmpeg it is skipped, never fatal.
+               --no-cache           Transcribe again even when the transcript
+                                    cache holds this audio. By default the raw
+                                    transcription is cached (keyed by the audio
+                                    bytes, engine, whisper command, model,
+                                    language and word-timing mode), so a run
+                                    that only changes styling, grouping,
+                                    --script or --translate does not transcribe
+                                    (or, with --cloud, upload) again; the result
+                                    says transcript_cache hit|miss|off. Cache
+                                    dir: CAPCUT_CLI_CACHE_DIR, else
+                                    $XDG_CACHE_HOME/capcut-cli/transcripts, else
+                                    ~/.cache/capcut-cli/transcripts
+                                    (%LOCALAPPDATA%\\capcut-cli\\cache\\transcripts
+                                    on Windows). --dry-run never writes it.
                --language <code>    ISO code or "auto" (default)
                --track-name <s>     Caption track name (default: "captions")
                --style-ref <seg-id> Mirror styling from existing text segment
@@ -952,6 +1002,10 @@ interface Flags {
   script?: string;
   wordReveal?: boolean;
   minScriptMatch?: number;
+  // caption coverage check + transcript cache
+  noCoverage?: boolean;
+  minUncaptioned?: number;
+  noCache?: boolean;
   // detect-retakes
   window?: number;
   similarity?: number;
@@ -1047,6 +1101,9 @@ interface Flags {
   minGapMs?: number;
   noCheckPaths?: boolean;
   fix?: boolean;
+  maxStillSecs?: number;
+  maxShotSecs?: number;
+  minSilentSecs?: number;
   // caption
   audio?: string;
   /** caption --words: word timings from an external aligner (path or "-"). */
@@ -1119,10 +1176,12 @@ interface Flags {
   videoBitrate?: string;
   burnCaptions?: boolean;
   allVideoTracks?: boolean;
-  // loudness: delivery target, per-clip normalization, boost cap
+  // loudness: delivery target, per-clip normalization, boost cap, delivery gate
   target?: number;
   perClip?: boolean;
   maxGainDb?: number;
+  tolerance?: number;
+  maxTruePeak?: number;
   // render: refuse an unfaithful proxy / fail on output duration drift
   strict?: boolean;
   verify?: boolean;
@@ -1134,6 +1193,10 @@ interface Flags {
   bundle?: string;
   continueOnError?: boolean;
   check?: boolean;
+  // fixture --anonymize
+  anonymize?: boolean;
+  // diff --since-write
+  sinceWrite?: boolean;
   plan?: boolean;
   apply?: boolean;
   // batch --plan <file> / --apply-plan <file>
@@ -1257,6 +1320,8 @@ const BOOLEAN_FLAGS = new Map<string, FlagKey<boolean>>([
   ["--fix", "fix"],
   ["--karaoke", "karaoke"],
   ["--no-probe", "noProbe"],
+  ["--no-coverage", "noCoverage"],
+  ["--no-cache", "noCache"],
   ["--retime", "retime"],
   ["--dry-run", "dryRun"],
   ["--fail-fast", "failFast"],
@@ -1268,6 +1333,8 @@ const BOOLEAN_FLAGS = new Map<string, FlagKey<boolean>>([
   ["--force-write", "forceWrite"],
   ["--continue-on-error", "continueOnError"],
   ["--check", "check"],
+  ["--anonymize", "anonymize"],
+  ["--since-write", "sinceWrite"],
   ["--apply", "apply"],
   ["--nested", "nested"],
   ["--pip", "pip"],
@@ -1356,7 +1423,10 @@ const FLOAT_FLAGS = new Map<string, FlagKey<number>>([
   ["--volume", "volume"],
   ["--target", "target"],
   ["--max-gain-db", "maxGainDb"],
+  ["--tolerance", "tolerance"],
+  ["--max-true-peak", "maxTruePeak"],
   ["--min-script-match", "minScriptMatch"],
+  ["--min-uncaptioned", "minUncaptioned"],
   ["--window", "window"],
   ["--similarity", "similarity"],
   ["--center-x", "centerX"],
@@ -1383,6 +1453,9 @@ const FLOAT_FLAGS = new Map<string, FlagKey<number>>([
   ["--bg-v-offset", "bgVOffset"],
   ["--scale", "scale"],
   ["--max-cue-secs", "maxCueSecs"],
+  ["--max-still-secs", "maxStillSecs"],
+  ["--max-shot-secs", "maxShotSecs"],
+  ["--min-silent-secs", "minSilentSecs"],
   ["--min-gap-ms", "minGapMs"],
   ["--max-cps", "maxCps"],
   ["--safe-area", "safeArea"],
@@ -1913,9 +1986,12 @@ function cmdSpeed(draft: Draft, filePath: string, segId: string, multiplier: str
 
 // `loudness` measures the draft's audible clips (EBU R128) and, with
 // --target, the gain that brings the export there; --apply writes it as
-// segment volume through the normal journaled save.
+// segment volume through the normal journaled save. --tolerance and
+// --max-true-peak make it a delivery gate: the result carries `gate`, and a
+// miss exits 1 with one line on stderr (with --apply the gain is still
+// written, as lint --fix writes its repairs before reporting what remains).
 async function cmdLoudness(draft: Draft, filePath: string, flags: Flags): Promise<void> {
-  const { applyLoudness, measureLoudness } = await import("./loudness.js");
+  const { applyLoudness, judgeLoudness, measureLoudness } = await import("./loudness.js");
   if (flags.apply && flags.target === undefined) die("--apply needs --target <LUFS>: say what loudness to reach.");
   let report: ReturnType<typeof measureLoudness>;
   try {
@@ -1925,6 +2001,8 @@ async function cmdLoudness(draft: Draft, filePath: string, flags: Flags): Promis
       perClip: flags.perClip,
       maxGainDb: flags.maxGainDb,
       draftDir: draftProjectDir(filePath),
+      tolerance: flags.tolerance,
+      maxTruePeak: flags.maxTruePeak,
     });
   } catch (e) {
     die((e as Error).message);
@@ -1934,7 +2012,26 @@ async function cmdLoudness(draft: Draft, filePath: string, flags: Flags): Promis
     changed = applyLoudness(draft, report);
     if (changed > 0) saveDraft(filePath, draft);
   }
-  out({ ok: true, ...report, applied: Boolean(flags.apply) && !isDryRun(), changed }, flags);
+  const judged = judgeLoudness(report, {
+    tolerance: flags.tolerance,
+    maxTruePeak: flags.maxTruePeak,
+    afterGain: Boolean(flags.apply),
+  });
+  const failure = judged?.failure ?? null;
+  out(
+    {
+      ok: failure === null,
+      ...report,
+      ...(judged ? { gate: judged.gate } : {}),
+      applied: Boolean(flags.apply) && !isDryRun(),
+      changed,
+    },
+    flags,
+  );
+  if (failure !== null) {
+    process.stderr.write(`loudness gate failed: ${failure}\n`);
+    process.exitCode = 1;
+  }
 }
 
 function cmdVolume(draft: Draft, filePath: string, segId: string, levelStr: string, flags: Flags, save = true): void {
@@ -3872,6 +3969,13 @@ async function cmdLint(draft: Draft, filePath: string, flags: Flags): Promise<{
     scriptLimitsExcept,
     summarize,
   } = await import("./lint.js");
+  // Opt-in thresholds in seconds; a value that is not a positive number would
+  // otherwise switch the check off without a word.
+  const thresholdUs = (seconds: number | undefined, flag: string): number | undefined => {
+    if (seconds === undefined) return undefined;
+    if (!Number.isFinite(seconds) || seconds <= 0) die(`${flag} must be a number of seconds > 0`);
+    return Math.round(seconds * 1_000_000);
+  };
   const opts: LintOptions = {
     maxCharsPerLine: flags.maxChars ?? DEFAULT_LINT_OPTIONS.maxCharsPerLine,
     maxCueDurationUs:
@@ -3892,6 +3996,9 @@ async function cmdLint(draft: Draft, filePath: string, flags: Flags): Promise<{
     draftDir: draftProjectDir(filePath),
     dryRun: isDryRun(),
     frameGrid: flags.frameGrid,
+    maxStillUs: thresholdUs(flags.maxStillSecs, "--max-still-secs"),
+    maxShotUs: thresholdUs(flags.maxShotSecs, "--max-shot-secs"),
+    minSilentUs: thresholdUs(flags.minSilentSecs, "--min-silent-secs"),
   };
   // template-stale (#67, #111) needs the store's newest app version, which
   // costs one timeline read per sibling project — so it is looked up only for
@@ -4028,6 +4135,9 @@ async function cmdCaption(draft: Draft, filePath: string, flags: Flags): Promise
   if (flags.audioStream !== undefined && (!Number.isInteger(flags.audioStream) || flags.audioStream < 0)) {
     die("--audio-stream must be a zero-based non-negative integer.");
   }
+  if (flags.minUncaptioned !== undefined && (!Number.isFinite(flags.minUncaptioned) || flags.minUncaptioned < 0)) {
+    die("--min-uncaptioned must be a number of seconds, 0 or more.");
+  }
   const emphasis = await keywordEmphasisFromFlags(flags);
   let scriptText: string | undefined;
   if (flags.script !== undefined) {
@@ -4068,6 +4178,9 @@ async function cmdCaption(draft: Draft, filePath: string, flags: Flags): Promise
     keywordColor: emphasis.color,
     keywordSize: emphasis.size,
     colorCycle: emphasis.cycle,
+    coverage: flags.noCoverage ? false : undefined,
+    minUncaptioned: flags.minUncaptioned,
+    cache: flags.noCache ? false : undefined,
   };
   if (flags.cloud && isDryRun()) {
     // A dry run sends nothing anywhere: report what --cloud would upload.
@@ -4114,6 +4227,13 @@ async function cmdCaption(draft: Draft, filePath: string, flags: Flags): Promise
         `(${result.script.matched}/${result.script.script_words}). Check that --script belongs to this audio.\n`,
     );
   }
+  // Speech the cues leave uncaptioned: a transcription that stopped early or
+  // dropped quiet speech. Warn, never fail — the captions that exist are fine.
+  const coverage = result.coverage;
+  if (coverage && "uncaptioned" in coverage && coverage.uncaptioned.length > 0 && !flags.quiet) {
+    const { uncaptionedWarning } = await import("./caption-coverage.js");
+    process.stderr.write(uncaptionedWarning(coverage));
+  }
   out(result, flags);
 }
 
@@ -5172,6 +5292,9 @@ async function cmdRestore(projectPath: string | undefined, flags: Flags): Promis
   const restoreSource = (source: string): void => {
     if (!hasSynchronizedSiblings) {
       copyFileSync(source, filePath);
+      // A restore is the CLI's own write; `diff --since-write` compares with it
+      // (a multi-file restore records through saveDraft).
+      recordLastWrite(filePath, readFileSync(filePath, "utf-8"));
       return;
     }
     const restored = loadDraft(filePath);
@@ -5434,7 +5557,7 @@ const SUMMARIES: Record<string, string> = {
   relink: "Repair broken media paths (--dir or --from/--to).",
   timeline: "Show the track/segment layout (JSON, or -H ASCII bars).",
   projects: "List CapCut/JianYing draft folders on disk.",
-  diff: "Compare two drafts (segments/materials/tracks added/removed/changed).",
+  diff: "Compare two drafts (segments/materials/tracks added/removed/changed), or with --since-write a draft with what capcut-cli last wrote to it.",
   concat: "Append one draft onto another's timeline (id-safe), write to --out or in place.",
   config: "Show the resolved config (.capcutrc + effective defaults).",
   describe: "Emit command contracts as JSON, optionally filtered by name or reduced to a compact discovery index.",
@@ -5619,15 +5742,9 @@ function indexMaterialContent(draft: Draft): Map<string, string> {
   return m;
 }
 
-// `diff` reports what changed between two drafts: segments added/removed/changed
-// and materials added/removed. Read-only.
-function cmdDiff(positional: string[], flags: Flags): void {
-  const aPath = positional[1];
-  const bPath = positional[2];
-  if (!aPath || !bPath) die("Usage: capcut diff <projectA> <projectB>");
-  const a = readDraft(aPath).draft;
-  const b = readDraft(bPath).draft;
-
+// What changed from draft `a` to draft `b`: segments added/removed/changed and
+// materials added/removed/changed, the shape `diff` prints.
+function diffDrafts(a: Draft, b: Draft) {
   const aSeg = indexSegments(a);
   const bSeg = indexSegments(b);
   const segAdded: string[] = [];
@@ -5661,16 +5778,87 @@ function cmdDiff(positional: string[], flags: Flags): void {
   const changed =
     segAdded.length + segRemoved.length + segChanged.length + matAdded.length + matRemoved.length + matChanged.length >
     0;
+  return {
+    changed,
+    tracks: { a: a.tracks.length, b: b.tracks.length },
+    segments: { added: segAdded, removed: segRemoved, changed: segChanged },
+    materials: { added: matAdded, removed: matRemoved, changed: matChanged },
+  };
+}
+
+// `diff` reports what changed between two drafts: segments added/removed/changed
+// and materials added/removed. Read-only.
+function cmdDiff(positional: string[], flags: Flags): void {
+  if (flags.sinceWrite) {
+    cmdDiffSinceWrite(positional, flags);
+    return;
+  }
+  const aPath = positional[1];
+  const bPath = positional[2];
+  if (!aPath || !bPath) die("Usage: capcut diff <projectA> <projectB>  |  capcut diff <project> --since-write");
+  const a = readDraft(aPath).draft;
+  const b = readDraft(bPath).draft;
+  out({ ok: true, ...diffDrafts(a, b) }, flags);
+}
+
+// `diff <project> --since-write`: the draft on disk against what capcut-cli
+// itself last wrote to it (the record every write keeps in the history
+// directory), so the changes the app made when it opened or saved a
+// tool-written draft show up as `a` = written, `b` = now. Read-only.
+function cmdDiffSinceWrite(positional: string[], flags: Flags): void {
+  const project = positional[1];
+  if (!project || positional[2]) die("Usage: capcut diff <project> --since-write");
+  const filePath = findDraft(project);
+  const record = readLastWrite(filePath);
+  if (!record) {
+    die(
+      `No record of a capcut-cli write to ${filePath}. --since-write compares the draft with what this CLI last ` +
+        "wrote to it, which every edit command records from this version on; this draft has not been written since.",
+    );
+  }
+  const raw = readFileSync(filePath, "utf-8");
+  const written = timelineFromText(record.content);
+  const current = timelineFromText(stripBom(raw));
+  if (!written) die(`The recorded write to ${filePath} does not contain a readable timeline.`);
+  if (!current) die(`${filePath} does not contain a readable timeline.`);
+
+  const currentSha = contentDigest(raw);
+  const changed = currentSha !== record.sha256;
+  // The segment/material diff leaves out the rest of the document, which is
+  // where an app re-save usually shows: list the top-level fields that differ
+  // and whether the tracks were reordered.
+  const keys = [...new Set([...Object.keys(written), ...Object.keys(current)])].sort();
+  const topLevelChanged = keys.filter((key) => JSON.stringify(written[key]) !== JSON.stringify(current[key]));
+  const writtenIds = written.tracks.map((track) => track.id);
+  const currentIds = current.tracks.map((track) => track.id);
+  const shared = (ids: string[], other: string[]) => ids.filter((id) => other.includes(id));
+  const trackOrderChanged =
+    JSON.stringify(shared(writtenIds, currentIds)) !== JSON.stringify(shared(currentIds, writtenIds));
+
   out(
     {
       ok: true,
-      changed,
-      tracks: { a: a.tracks.length, b: b.tracks.length },
-      segments: { added: segAdded, removed: segRemoved, changed: segChanged },
-      materials: { added: matAdded, removed: matRemoved, changed: matChanged },
+      ...diffDrafts(written, current),
+      since_write: {
+        file: path.basename(filePath),
+        written_at: record.written_at,
+        written_by: record.command,
+        written_sha256: record.sha256,
+        current_sha256: currentSha,
+        changed,
+        top_level_changed: topLevelChanged,
+        track_order_changed: trackOrderChanged,
+      },
     },
     flags,
   );
+  if (!flags.quiet) {
+    process.stderr.write(
+      changed
+        ? `${path.basename(filePath)} changed since capcut-cli wrote it at ${record.written_at}.\n`
+        : `No changes: ${path.basename(filePath)} is exactly what capcut-cli wrote at ${record.written_at}.\n`,
+    );
+  }
 }
 
 // `concat` appends draftB onto draftA's timeline. B's segments are time-shifted
@@ -6286,10 +6474,12 @@ async function main(): Promise<void> {
       process.exit(check.ok ? 0 : 1);
     }
     if (!projectPath) {
-      die("Usage: capcut fixture <project> --out <dir> [--check]  |  capcut fixture <bundle-dir> --check");
+      die(
+        "Usage: capcut fixture <project> --out <dir> [--anonymize] [--check]  |  capcut fixture <bundle-dir> --check",
+      );
     }
-    if (!flags.out) die("Missing --out <dir>. Usage: capcut fixture <project> --out <dir> [--check]");
-    const report = sanitizeDraftBundle(projectPath, flags.out);
+    if (!flags.out) die("Missing --out <dir>. Usage: capcut fixture <project> --out <dir> [--anonymize] [--check]");
+    const report = sanitizeDraftBundle(projectPath, flags.out, { anonymize: flags.anonymize === true });
     // Scan the real output path from the flag: report.out_dir is itself
     // redacted (a home-dir project reports /home/USER/…), so it is display
     // data, not a filesystem path.
@@ -6298,6 +6488,13 @@ async function main(): Promise<void> {
     if (!flags.quiet) {
       const total = Object.values(report.redaction_kinds).reduce((a, b) => a + b, 0);
       process.stderr.write(`Sanitized bundle: ${report.out_dir} (${report.files.length} files, ${total} redactions)\n`);
+      if (report.anonymization) {
+        const a = report.anonymization;
+        process.stderr.write(
+          `Anonymized: media files ${a.media_files}, folder names ${a.folders}, texts ${a.text_fields} ` +
+            `(${a.characters} characters).\n`,
+        );
+      }
       process.stderr.write(
         check.ok
           ? "Review the files, then attach the folder to the relevant issue.\n"
diff --git a/src/lint.ts b/src/lint.ts
index a308076..62b00aa 100644
--- a/src/lint.ts
+++ b/src/lint.ts
@@ -1,7 +1,7 @@
 import { existsSync, statSync } from "node:fs";
 import { basename, resolve } from "node:path";
 import { bubbleCatalogue, imageAnimCatalogue } from "./decorators.js";
-import type { Draft, Segment, Track } from "./draft.js";
+import type { Draft, MaterialVideo, Segment, Track } from "./draft.js";
 import { extractStyleRanges, extractText, findMaterial, getTracksByType } from "./draft.js";
 import { type Category, listEnum, type Namespace } from "./enums.js";
 import { copyAssetDeduped, effectCatalogue, filterCatalogue, storeOutgrowsTemplate } from "./factory.js";
@@ -161,6 +161,15 @@ export interface LintOptions {
    * start and end are snapped together so duration is derived, never rounded
    * independently into a 1us overlap. */
   frameGrid?: boolean;
+  /** Opt-in pacing: report still-too-long for a still image (a photo
+   * material) that plays longer than this on the timeline, in microseconds. */
+  maxStillUs?: number;
+  /** Opt-in pacing: report shot-too-long for a video clip (any material but a
+   * photo) that plays longer than this on the timeline, in microseconds. */
+  maxShotUs?: number;
+  /** Opt-in: report silent-stretch for every range of at least this many
+   * microseconds, inside the timeline, where nothing audible plays. */
+  minSilentUs?: number;
 }
 
 export const DEFAULT_LINT_OPTIONS: LintOptions = {
@@ -634,6 +643,57 @@ export function lintDraft(draft: Draft, opts: LintOptions = DEFAULT_LINT_OPTIONS
     }
   }
 
+  // Pacing, opt-in: a still image held on screen, or one shot running on,
+  // longer than the limit the caller set. Judged on the timeline duration
+  // (what the viewer sits through), every video track included, by the
+  // material's kind (materials.videos marks a still as type "photo"); a
+  // segment whose material is missing is missing-material's finding.
+  // Report-only: where to cut, or what motion to add, is an editing decision.
+  if (opts.maxStillUs !== undefined || opts.maxShotUs !== undefined) {
+    const videoMaterials = new Map((draft.materials?.videos ?? []).map((m) => [m.id, m]));
+    for (const track of draft.tracks) {
+      if (track.type !== "video" && track.type !== "image") continue;
+      for (const s of track.segments) {
+        const mat = videoMaterials.get(s.material_id);
+        if (!mat) continue;
+        const still = mat.type === "photo";
+        const limit = still ? opts.maxStillUs : opts.maxShotUs;
+        const { start, duration } = s.target_timerange;
+        if (limit === undefined || !(duration > limit)) continue;
+        const code = still ? "still-too-long" : "shot-too-long";
+        issues.push({
+          severity: "warning",
+          code,
+          message:
+            `${still ? "Still image" : "Video clip"} ${shortId(s.id)} on ${track.type} track "${track.name}" ` +
+            `starts at ${formatSecs(start)} and plays ${formatSecs(duration)}, longer than the ` +
+            `${formatSecs(limit)} ${still ? "--max-still-secs" : "--max-shot-secs"} limit`,
+          fixable: FIXABLE_CODES.has(code),
+          location: { track: track.name, segment_id: s.id, material_id: mat.id },
+        });
+      }
+    }
+  }
+
+  // Silent stretches, opt-in: dead air the export carries. Conservative by
+  // design, so it never cries wolf: a clip counts as silent only when the
+  // draft itself says so (see playsSound), and everything else counts as
+  // sound. Report-only: what belongs in the gap is an editing decision.
+  if (opts.minSilentUs !== undefined) {
+    const limit = opts.minSilentUs;
+    for (const [start, end] of silentStretches(draft, limit)) {
+      issues.push({
+        severity: "warning",
+        code: "silent-stretch",
+        message:
+          `Nothing audible plays from ${formatSecs(start)} to ${formatSecs(end)} (${formatSecs(end - start)}, ` +
+          `at least the ${formatSecs(limit)} --min-silent-secs limit): no audio clip above volume 0 and no ` +
+          "video clip with its own sound covers it",
+        fixable: FIXABLE_CODES.has("silent-stretch"),
+      });
+    }
+  }
+
   if (opts.checkLocalPaths) {
     // Media probing (VFR / unreadable) is best-effort: only files that exist,
     // only when ffprobe runs — a host without ffprobe lints exactly as before.
@@ -1745,6 +1805,58 @@ function soundSeparatedOrphans(draft: Draft): Array<{ id: string; has_sound_sepa
   return (draft.materials?.videos ?? []).filter((video) => video.has_sound_separated === true && used.has(video.id));
 }
 
+// Whether a segment on an audio or video track sends sound to the export.
+// Silent only on the draft's own word: volume 0 with no volume keyframes, a
+// photo, or a video whose sound was separated to an audio track (the
+// sound-separated-orphan reading: the clip itself then plays silent, and the
+// separated audio counts on its own track). A material the draft does not
+// hold, or a video file that may have no audio stream, counts as sound.
+function playsSound(track: Track, segment: Segment, videos: Map<string, MaterialVideo>): boolean {
+  const volume = typeof segment.volume === "number" ? segment.volume : 1;
+  if (volume <= 0 && !keyframedProperties(segment).has("KFTypeVolume")) return false;
+  if (track.type === "audio") return true;
+  const material = videos.get(segment.material_id);
+  if (!material) return true;
+  return material.type !== "photo" && material.has_sound_separated !== true;
+}
+
+// Ranges of at least minUs where no segment plays sound, from 0 to the end of
+// the export: draft.duration, but never past the last segment on any track (a
+// stale duration is no silence the export carries). A muted track (attribute
+// bit 1, as `tracks` reads it) contributes nothing.
+function silentStretches(draft: Draft, minUs: number): Array<[number, number]> {
+  let contentEnd = 0;
+  for (const { segment } of allSegments(draft)) {
+    contentEnd = Math.max(contentEnd, segment.target_timerange.start + segment.target_timerange.duration);
+  }
+  const declared = draft.duration;
+  const end =
+    typeof declared === "number" && Number.isFinite(declared) && declared > 0
+      ? Math.min(declared, contentEnd)
+      : contentEnd;
+  const videos = new Map((draft.materials?.videos ?? []).map((m) => [m.id, m]));
+  const sound: Array<[number, number]> = [];
+  for (const track of draft.tracks) {
+    if (track.type !== "audio" && track.type !== "video") continue;
+    if (typeof track.attribute === "number" && (track.attribute & 1) !== 0) continue;
+    for (const segment of track.segments) {
+      if (!playsSound(track, segment, videos)) continue;
+      const start = segment.target_timerange.start;
+      sound.push([start, start + segment.target_timerange.duration]);
+    }
+  }
+  sound.sort((a, b) => a[0] - b[0]);
+  const stretches: Array<[number, number]> = [];
+  let cursor = 0;
+  for (const [start, stop] of sound) {
+    if (start >= end) break;
+    if (start - cursor >= minUs) stretches.push([cursor, start]);
+    cursor = Math.max(cursor, stop);
+  }
+  if (end - cursor >= minUs) stretches.push([cursor, end]);
+  return stretches;
+}
+
 function allSegments(draft: Draft): Array<{ track: Track; segment: Segment }> {
   const result: Array<{ track: Track; segment: Segment }> = [];
   for (const track of draft.tracks) {
@@ -1803,3 +1915,8 @@ function isUnderDir(p: string, dir: string): boolean {
 function shortId(id: string): string {
   return id.slice(0, 8);
 }
+
+// Microseconds as seconds for a message, to the millisecond: 12500000 -> "12.5s".
+function formatSecs(us: number): string {
+  return `${Number((us / 1_000_000).toFixed(3))}s`;
+}
diff --git a/src/loudness.ts b/src/loudness.ts
index 95c9272..de39c9e 100644
--- a/src/loudness.ts
+++ b/src/loudness.ts
@@ -6,6 +6,8 @@
  * measured with ffmpeg's EBU R128 meter over the part of its media the
  * timeline plays; the gain is written as segment volume, which the app applies
  * on export (its master bus is limited, so a boost cannot hard-clip it).
+ * With a tolerance or a true-peak ceiling the report is also a delivery gate
+ * (`judgeLoudness`) that a script can stop an export on.
  */
 import { spawnSync } from "node:child_process";
 import { existsSync } from "node:fs";
@@ -23,6 +25,10 @@ export interface LoudnessOptions {
   maxGainDb?: number;
   /** Folder relative media paths resolve against. */
   draftDir?: string;
+  /** How far the judged loudness may sit from the target, in LU (needs target). */
+  tolerance?: number;
+  /** Ceiling for the judged true peak, in dBTP. */
+  maxTruePeak?: number;
 }
 
 export interface ClipLoudness {
@@ -53,6 +59,21 @@ export interface LoudnessReport {
   clips: ClipLoudness[];
 }
 
+/** The delivery check: did the judged mix land within the tolerance of the
+ * target, and does its loudest clip stay under the true-peak ceiling. */
+export interface LoudnessGate {
+  target?: number;
+  tolerance?: number;
+  /** The loudness judged: the mix after this run's gain when it is applied,
+   * the mix as it stands otherwise. */
+  estimate_lufs: number | null;
+  within?: boolean;
+  max_true_peak?: number;
+  /** Highest clip true peak at the volume judged, in dBTP. */
+  estimate_true_peak?: number | null;
+  true_peak_ok?: boolean;
+}
+
 /** Below this the meter reads silence (ffmpeg reports -70 LUFS). */
 const SILENCE_LUFS = -69.9;
 export const DEFAULT_MAX_GAIN_DB = 20;
@@ -129,6 +150,15 @@ export function measureLoudness(draft: Draft, opts: LoudnessOptions = {}): Loudn
   if (opts.target !== undefined && (!Number.isFinite(opts.target) || opts.target > 0 || opts.target < -70)) {
     throw new Error("--target must be a loudness in LUFS between -70 and 0 (for example -14).");
   }
+  if (opts.tolerance !== undefined) {
+    if (opts.target === undefined) throw new Error("--tolerance needs --target <LUFS>: say what loudness to hold.");
+    if (!Number.isFinite(opts.tolerance) || opts.tolerance < 0) {
+      throw new Error("--tolerance must be a number of LU >= 0 (for example 1).");
+    }
+  }
+  if (opts.maxTruePeak !== undefined && !Number.isFinite(opts.maxTruePeak)) {
+    throw new Error("--max-true-peak must be a true-peak level in dBTP (for example -1).");
+  }
   const clips: ClipLoudness[] = [];
   for (const { segment, track, path, why } of audibleSegments(draft)) {
     const volume = typeof segment.volume === "number" ? segment.volume : 1;
@@ -172,19 +202,8 @@ export function measureLoudness(draft: Draft, opts: LoudnessOptions = {}): Loudn
     clip.effective_lufs = round(lufs + 20 * Math.log10(volume), 2);
   }
 
-  const measured = clips.filter((clip) => clip.effective_lufs !== null && clip.duration_us > 0);
-  const totalUs = measured.reduce((sum, clip) => sum + clip.duration_us, 0);
-  const program =
-    totalUs > 0
-      ? round(
-          10 *
-            Math.log10(
-              measured.reduce((sum, clip) => sum + clip.duration_us * 10 ** ((clip.effective_lufs as number) / 10), 0) /
-                totalUs,
-            ),
-          2,
-        )
-      : null;
+  const measured = measuredClips(clips);
+  const program = programLufs(measured, (clip) => clip.effective_lufs as number);
 
   const report: LoudnessReport = {
     mode: opts.perClip ? "per-clip" : "uniform",
@@ -210,6 +229,78 @@ export function measureLoudness(draft: Draft, opts: LoudnessOptions = {}): Loudn
   return report;
 }
 
+/** Clips with a loudness reading and a length on the timeline. */
+function measuredClips(clips: ClipLoudness[]): ClipLoudness[] {
+  return clips.filter((clip) => clip.effective_lufs !== null && clip.duration_us > 0);
+}
+
+/** Duration-weighted energy mean of the clips' loudness, or null with nothing to weigh. */
+function programLufs(measured: ClipLoudness[], lufsOf: (clip: ClipLoudness) => number): number | null {
+  const totalUs = measured.reduce((sum, clip) => sum + clip.duration_us, 0);
+  if (totalUs <= 0) return null;
+  const energy = measured.reduce((sum, clip) => sum + clip.duration_us * 10 ** (lufsOf(clip) / 10), 0);
+  return round(10 * Math.log10(energy / totalUs), 2);
+}
+
+/**
+ * Judge the report against a delivery tolerance and a true-peak ceiling; null
+ * when neither was asked for. `afterGain` judges the mix with this run's gain
+ * (the volumes `applyLoudness` writes, --max-gain-db cap included); without
+ * it, the mix as it stands. `failure` is a one-line reason, null on a pass.
+ */
+export function judgeLoudness(
+  report: LoudnessReport,
+  opts: { tolerance?: number; maxTruePeak?: number; afterGain?: boolean },
+): { gate: LoudnessGate; failure: string | null } | null {
+  if (opts.tolerance === undefined && opts.maxTruePeak === undefined) return null;
+  const afterGain = Boolean(opts.afterGain) && report.target !== undefined;
+  const volumeOf = (clip: ClipLoudness): number =>
+    afterGain && clip.new_volume !== undefined ? clip.new_volume : clip.volume;
+  const mix = afterGain ? "the mix after this run's gain" : "the mix as it stands";
+  const estimate = programLufs(measuredClips(report.clips), (clip) =>
+    round((clip.measured_lufs as number) + 20 * Math.log10(volumeOf(clip)), 2),
+  );
+  const target = report.target;
+  if (opts.tolerance !== undefined && target === undefined) {
+    throw new Error("--tolerance needs --target <LUFS>: say what loudness to hold.");
+  }
+  const gate: LoudnessGate =
+    opts.tolerance !== undefined
+      ? { target, tolerance: opts.tolerance, estimate_lufs: estimate }
+      : { estimate_lufs: estimate };
+  const failures: string[] = [];
+
+  if (opts.tolerance !== undefined && target !== undefined) {
+    const within = estimate !== null && Math.abs(estimate - target) <= opts.tolerance + 1e-9;
+    gate.within = within;
+    if (estimate === null) failures.push("no clip could be measured, so the loudness cannot be judged");
+    else if (!within) {
+      const capped = afterGain && report.clips.some((clip) => clip.clamped);
+      failures.push(
+        `${mix} is estimated at ${estimate} LUFS, ${round(Math.abs(estimate - target), 2)} LU ` +
+          `${estimate < target ? "below" : "above"} the ${target} LUFS target (tolerance ${opts.tolerance} LU)` +
+          (capped ? `; --max-gain-db ${report.max_gain_db} capped the boost` : ""),
+      );
+    }
+  }
+
+  if (opts.maxTruePeak !== undefined) {
+    const peaks = report.clips
+      .filter((clip) => clip.true_peak_dbfs !== null && volumeOf(clip) > 0)
+      .map((clip) => (clip.true_peak_dbfs as number) + 20 * Math.log10(volumeOf(clip)));
+    const peak = peaks.length > 0 ? round(Math.max(...peaks), 2) : null;
+    const ok = peak !== null && peak <= opts.maxTruePeak + 1e-9;
+    gate.max_true_peak = opts.maxTruePeak;
+    gate.estimate_true_peak = peak;
+    gate.true_peak_ok = ok;
+    if (peak === null) failures.push("no clip could be measured, so the true peak cannot be judged");
+    else if (!ok) {
+      failures.push(`the loudest clip in ${mix} peaks at ${peak} dBTP, above the ${opts.maxTruePeak} dBTP ceiling`);
+    }
+  }
+  return { gate, failure: failures.length > 0 ? failures.join("; ") : null };
+}
+
 /** Write each measured clip's new volume into the draft; returns how many changed. */
 export function applyLoudness(draft: Draft, report: LoudnessReport): number {
   const byId = new Map(report.clips.filter((c) => c.new_volume !== undefined).map((c) => [c.segment_id, c]));
diff --git a/src/preset.ts b/src/preset.ts
index 38aca5c..8c99600 100644
--- a/src/preset.ts
+++ b/src/preset.ts
@@ -1,6 +1,14 @@
 import { readFileSync } from "node:fs";
 import { stripBom } from "./bom.js";
-import { hexToRgb01, requireTextMaterial, setBubble, setTextRanges, type TextRangeInput } from "./decorators.js";
+import {
+  hexToRgb01,
+  requireTextMaterial,
+  rgb01ToHex,
+  setBubble,
+  setTextRanges,
+  solidFill,
+  type TextRangeInput,
+} from "./decorators.js";
 import type { Draft, MaterialText } from "./draft.js";
 import { STYLE_FIELDS } from "./factory.js";
 import { fromStoredOffset, repairDoubledRanges, storedTextLength } from "./text-offsets.js";
@@ -25,14 +33,6 @@ export interface TextStylePreset {
   text_ranges?: TextRangeInput[];
 }
 
-function rgb01ToHex(rgb: [number, number, number]): string {
-  const channel = (v: number) =>
-    Math.round(Math.min(1, Math.max(0, v)) * 255)
-      .toString(16)
-      .padStart(2, "0");
-  return `#${channel(rgb[0])}${channel(rgb[1])}${channel(rgb[2])}`.toUpperCase();
-}
-
 interface ContentStyleBlock {
   range?: [number, number];
   size?: number;
@@ -308,10 +308,7 @@ export function applyTextPreset(
     if (typeof preset.style.italic === "boolean") base.italic = preset.style.italic;
     if (typeof preset.style.underline === "boolean") base.underline = preset.style.underline;
     if (typeof preset.style.text_color === "string") {
-      base.fill = {
-        alpha: 1,
-        content: { render_type: "solid", solid: { alpha: 1, color: hexToRgb01(preset.style.text_color) } },
-      };
+      base.fill = solidFill(hexToRgb01(preset.style.text_color));
     }
     if (typeof preset.style.font_path === "string") {
       base.font = {
@@ -370,7 +367,7 @@ export function captionStyleFromPreset(preset: TextStylePreset): Record<string,
     bold: preset.style.bold ?? false,
     italic: preset.style.italic ?? false,
     underline: preset.style.underline ?? false,
-    fill: { alpha: 1, content: { render_type: "solid", solid: { alpha: 1, color: hexToRgb01(color) } } },
+    fill: solidFill(hexToRgb01(color)),
   };
   if (typeof preset.style.font_path === "string") {
     block.font = {
diff --git a/src/render.ts b/src/render.ts
index 703dc1f..1f98090 100644
--- a/src/render.ts
+++ b/src/render.ts
@@ -1,5 +1,5 @@
 import { spawnSync } from "node:child_process";
-import { existsSync, unlinkSync, writeFileSync } from "node:fs";
+import { existsSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, extname, join } from "node:path";
 import type { Draft, Segment } from "./draft.js";
 import { extractText } from "./draft.js";
@@ -167,6 +167,8 @@ export interface RenderPlan {
   softCaptions?: SoftCaptionsPlan;
   /** Long graphs are supplied through a file so Windows command-line limits cannot truncate them. */
   filterScript?: { path: string; content: string };
+  /** Present only with --burn-captions: how many burned captions use the draft's own font file, how many ffmpeg's default face. */
+  caption_fonts?: { from_draft: number; default: number };
   quality: { mode: "crf"; crf: number } | { mode: "bitrate"; bitrate: string };
   /** What the draft carries that this proxy does not reproduce (see fidelityCensus). */
   fidelity: FidelityCensus;
@@ -383,8 +385,19 @@ function audioSegments(draft: Draft): Segment[] {
   return segs.sort((a, b) => a.target_timerange.start - b.target_timerange.start);
 }
 
-function textSegments(draft: Draft): Array<{ seg: Segment; text: string; color: string; fontSize: number; y: number }> {
-  const out: Array<{ seg: Segment; text: string; color: string; fontSize: number; y: number }> = [];
+interface TextOverlay {
+  seg: Segment;
+  text: string;
+  color: string;
+  fontSize: number;
+  y: number;
+  /** The draft's font file, already escaped for drawtext's fontfile option; undefined = ffmpeg's default face. */
+  fontFile?: string;
+}
+
+function textSegments(draft: Draft): TextOverlay[] {
+  const out: TextOverlay[] = [];
+  const fonts = new Map<string, string | undefined>();
   for (const t of draft.tracks) {
     if (t.type !== "text") continue;
     for (const s of t.segments) {
@@ -392,12 +405,14 @@ function textSegments(draft: Draft): Array<{ seg: Segment; text: string; color:
       const raw = typeof mat?.content === "string" ? extractText(mat.content) : "";
       if (raw) {
         const material = mat as unknown as Record<string, unknown>;
+        if (!fonts.has(s.material_id)) fonts.set(s.material_id, draftFontFile(material));
         out.push({
           seg: s,
           text: raw,
           color: safeColor(material.text_color),
           fontSize: Number(material.font_size ?? 15),
           y: s.clip?.transform.y ?? -0.6,
+          fontFile: fonts.get(s.material_id),
         });
       }
     }
@@ -405,6 +420,39 @@ function textSegments(draft: Draft): Array<{ seg: Segment; text: string; color:
   return out.sort((a, b) => a.seg.target_timerange.start - b.seg.target_timerange.start);
 }
 
+const FONT_FILE_EXTENSIONS = new Set([".ttf", ".otf", ".ttc"]);
+
+/**
+ * The font file a text material uses, escaped for drawtext's `fontfile=`, or
+ * undefined to keep ffmpeg's default face. CapCut renders from the content's
+ * style blocks, so the first block's `font.path` is tried first, then the
+ * material's own `font_path`. Only an existing .ttf/.otf/.ttc file whose path
+ * can be written into the filter graph is used.
+ */
+function draftFontFile(material: Record<string, unknown>): string | undefined {
+  const candidates: unknown[] = [];
+  if (typeof material.content === "string") {
+    try {
+      const parsed = JSON.parse(material.content) as { styles?: Array<{ font?: { path?: unknown } }> };
+      candidates.push(parsed.styles?.[0]?.font?.path);
+    } catch {
+      /* content without style blocks: only font_path can name the font */
+    }
+  }
+  candidates.push(material.font_path);
+  for (const path of candidates) {
+    if (typeof path !== "string" || !FONT_FILE_EXTENSIONS.has(extname(path).toLowerCase())) continue;
+    const escaped = escapeFilterPath(path);
+    if (escaped === undefined) continue;
+    try {
+      if (statSync(path).isFile()) return escaped;
+    } catch {
+      /* missing or unreadable: try the next candidate */
+    }
+  }
+  return undefined;
+}
+
 /**
  * Fidelity census: what the draft carries that this proxy does not put on the
  * picture. The header comment above states the limits (main track only unless
@@ -671,6 +719,18 @@ function safeColor(raw: unknown): string {
   return FFMPEG_COLOR.test(color) ? color : "white";
 }
 
+// A file path cannot be sanitized the way caption text is (dropping a `:` or a
+// `\` names another file), so it is escaped instead and written inside single
+// quotes: the quotes keep the filtergraph parser off `[],;`, and drawtext's
+// option parser then reads `\\` as a backslash and `\:` as a colon, so the
+// path cannot end the option early and append options of its own. A single
+// quote cannot be written inside the quotes and a control character has no
+// place in a font path; a path with either is not used.
+function escapeFilterPath(path: string): string | undefined {
+  if (path.includes("'") || /\p{Cc}/u.test(path)) return undefined;
+  return path.replace(/\\/g, "\\\\").replace(/:/g, "\\:");
+}
+
 // drawtext is whitespace/colon/quote sensitive; sanitize aggressively for a proxy.
 function escapeDrawtext(s: string): string {
   return s
@@ -825,14 +885,17 @@ export function buildRenderPlan(draft: Draft, opts: RenderOptions): RenderPlan {
   // --- captions (optional) ---
   const texts = opts.burnCaptions ? textSegments(draft) : [];
   let textOverlays = 0;
-  for (const { seg, text, color, fontSize, y } of texts) {
+  const captionFonts = { from_draft: 0, default: 0 };
+  for (const { seg, text, color, fontSize, y, fontFile } of texts) {
     const t = escapeDrawtext(text);
     if (!t) continue;
     const start = round3(seg.target_timerange.start / US);
     const end = round3((seg.target_timerange.start + seg.target_timerange.duration) / US);
     const next = `vt${textOverlays}`;
+    if (fontFile) captionFonts.from_draft++;
+    else captionFonts.default++;
     filterParts.push(
-      `[${vOut}]drawtext=text='${t}':fontcolor=${color}:fontsize=${Math.max(12, Math.round((height / 640) * fontSize))}:` +
+      `[${vOut}]drawtext=text='${t}':${fontFile ? `fontfile='${fontFile}':` : ""}fontcolor=${color}:fontsize=${Math.max(12, Math.round((height / 640) * fontSize))}:` +
         `box=1:boxcolor=black@0.5:boxborderw=8:x=(w-text_w)/2:y=(h-text_h)/2-(${round3(y)}*h/2):` +
         `enable='between(t,${start},${end})'[${next}]`,
     );
@@ -953,6 +1016,7 @@ export function buildRenderPlan(draft: Draft, opts: RenderOptions): RenderPlan {
     skipped,
     ...(softCaptions ? { softCaptions } : {}),
     ...(filterScript ? { filterScript } : {}),
+    ...(opts.burnCaptions ? { caption_fonts: captionFonts } : {}),
     quality,
     fidelity: fidelityCensus(draft, opts, skipped),
   };
diff --git a/src/store.ts b/src/store.ts
index 3031bc7..7110ae3 100644
--- a/src/store.ts
+++ b/src/store.ts
@@ -152,6 +152,15 @@ function findTimeline(value: unknown, path: string[] = [], depth = 0): { draft:
   return null;
 }
 
+/** The timeline in a draft file's text, at the root or inside an envelope; null when there is none. */
+export function timelineFromText(raw: string): Draft | null {
+  try {
+    return findTimeline(JSON.parse(raw) as unknown)?.draft ?? null;
+  } catch {
+    return null;
+  }
+}
+
 // Exported for factory.ts (register): read one file into a DraftCandidate —
 // BOM-stripped, envelope-aware — without the sibling discovery a full
 // discoverDraftStore would do.
diff --git a/src/transcript-cache.ts b/src/transcript-cache.ts
new file mode 100644
index 0000000..e752ceb
--- /dev/null
+++ b/src/transcript-cache.ts
@@ -0,0 +1,163 @@
+import { createHash } from "node:crypto";
+import { closeSync, mkdirSync, openSync, readFileSync, readSync, renameSync, unlinkSync } from "node:fs";
+import { homedir, platform } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { writeTemp } from "./atomic-write.js";
+import type { CaptionCue, CaptionWord } from "./caption.js";
+
+/**
+ * Transcript cache for `caption`.
+ *
+ * Transcribing is the slow (and, with --cloud, the uploading) step of a
+ * caption run; everything after it — --script matching, grouping, styling,
+ * --translate — is cheap and deterministic. So the raw transcription is kept,
+ * keyed by the exact audio bytes that were transcribed plus every setting that
+ * changes what the engine returns, and a run that only changes the styling
+ * reads it back instead of transcribing again.
+ *
+ * One JSON file per key under `transcriptCacheDir()`, written with the same
+ * temp + fsync + rename as a draft save. An entry that cannot be read, does
+ * not parse, or does not match its key is a miss and is rewritten.
+ */
+
+/** Bump when the stored shape, or what a stored transcription means, changes. */
+export const TRANSCRIPT_CACHE_VERSION = 1;
+export const TRANSCRIPT_CACHE_ENV = "CAPCUT_CLI_CACHE_DIR";
+
+export type TranscriptCacheState = "hit" | "miss" | "off";
+
+/** Everything that decides what a transcription returns. */
+export interface TranscriptCacheKey {
+  version: number;
+  /** sha256 of the audio bytes handed to the engine (after any stream extraction). */
+  audio_sha256: string;
+  engine: string;
+  whisper_cmd: string | null;
+  model: string | null;
+  language: string | null;
+  /** "words": word-timestamp JSON (--karaoke / --word-reveal, --cloud); "lines": SRT cues. */
+  word_timing: "words" | "lines";
+  cloud: boolean;
+}
+
+export interface CachedTranscription {
+  engine: string;
+  cues: CaptionCue[];
+  words: CaptionWord[];
+}
+
+interface CacheEntry {
+  key: TranscriptCacheKey;
+  transcription: CachedTranscription;
+}
+
+/**
+ * Where entries live: CAPCUT_CLI_CACHE_DIR, else $XDG_CACHE_HOME/capcut-cli/transcripts,
+ * else ~/.cache/capcut-cli/transcripts (%LOCALAPPDATA%\capcut-cli\cache\transcripts on
+ * Windows, where HOME is usually unset).
+ */
+export function transcriptCacheDir(): string {
+  const override = process.env[TRANSCRIPT_CACHE_ENV];
+  if (override) return resolve(override);
+  const xdg = process.env.XDG_CACHE_HOME;
+  if (xdg) return join(xdg, "capcut-cli", "transcripts");
+  if (platform() === "win32") {
+    const local = process.env.LOCALAPPDATA ?? join(process.env.USERPROFILE ?? homedir(), "AppData/Local");
+    return join(local, "capcut-cli", "cache", "transcripts");
+  }
+  return join(homedir(), ".cache", "capcut-cli", "transcripts");
+}
+
+/** sha256 of a file, read in chunks so long recordings are not held in memory. */
+export function sha256File(path: string): string {
+  const hash = createHash("sha256");
+  const fd = openSync(path, "r");
+  try {
+    const buffer = Buffer.allocUnsafe(1 << 20);
+    for (;;) {
+      const read = readSync(fd, buffer, 0, buffer.length, null);
+      if (read === 0) break;
+      hash.update(buffer.subarray(0, read));
+    }
+  } finally {
+    closeSync(fd);
+  }
+  return hash.digest("hex");
+}
+
+export function transcriptCachePath(key: TranscriptCacheKey, dir = transcriptCacheDir()): string {
+  return join(dir, `${createHash("sha256").update(JSON.stringify(key)).digest("hex")}.json`);
+}
+
+function isWord(value: unknown): value is CaptionWord {
+  const word = value as CaptionWord | null;
+  return (
+    typeof word === "object" &&
+    word !== null &&
+    typeof word.word === "string" &&
+    Number.isFinite(word.startUs) &&
+    Number.isFinite(word.endUs)
+  );
+}
+
+function isCue(value: unknown): value is CaptionCue {
+  const cue = value as CaptionCue | null;
+  return (
+    typeof cue === "object" &&
+    cue !== null &&
+    typeof cue.text === "string" &&
+    Number.isFinite(cue.startUs) &&
+    Number.isFinite(cue.endUs) &&
+    (cue.words === undefined || (Array.isArray(cue.words) && cue.words.every(isWord)))
+  );
+}
+
+/** The stored transcription for `key`, or undefined when there is no usable entry. */
+export function readTranscriptCache(key: TranscriptCacheKey): CachedTranscription | undefined {
+  let entry: Partial<CacheEntry>;
+  try {
+    entry = JSON.parse(readFileSync(transcriptCachePath(key), "utf-8")) as Partial<CacheEntry>;
+  } catch {
+    return undefined;
+  }
+  const transcription = entry?.transcription;
+  if (
+    JSON.stringify(entry?.key) !== JSON.stringify(key) ||
+    typeof transcription !== "object" ||
+    transcription === null ||
+    transcription.engine !== key.engine ||
+    !Array.isArray(transcription.cues) ||
+    !transcription.cues.every(isCue) ||
+    !Array.isArray(transcription.words) ||
+    !transcription.words.every(isWord)
+  ) {
+    return undefined;
+  }
+  return { engine: transcription.engine, cues: transcription.cues, words: transcription.words };
+}
+
+/**
+ * Store a transcription under `key`, atomically. Best effort: a cache that
+ * cannot be written never fails the caption run that produced the result.
+ */
+export function writeTranscriptCache(key: TranscriptCacheKey, transcription: CachedTranscription): void {
+  const target = transcriptCachePath(key);
+  const entry: CacheEntry = {
+    key,
+    transcription: { engine: transcription.engine, cues: transcription.cues, words: transcription.words },
+  };
+  let temp: string | undefined;
+  try {
+    mkdirSync(dirname(target), { recursive: true });
+    temp = writeTemp(target, JSON.stringify(entry));
+    renameSync(temp, target);
+  } catch {
+    if (temp) {
+      try {
+        unlinkSync(temp);
+      } catch {
+        /* ignore */
+      }
+    }
+  }
+}
diff --git a/test/caption-cache.test.mjs b/test/caption-cache.test.mjs
new file mode 100644
index 0000000..e1e8892
--- /dev/null
+++ b/test/caption-cache.test.mjs
@@ -0,0 +1,305 @@
+import assert from "node:assert/strict";
+import { existsSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { afterEach, describe, it } from "node:test";
+import { fileURLToPath } from "node:url";
+import { captionDraft, transcriptCacheKey } from "../dist/caption.js";
+import { extractText, loadDraft } from "../dist/draft.js";
+import { TRANSCRIPT_CACHE_VERSION, transcriptCacheDir } from "../dist/transcript-cache.js";
+import { spawnCli } from "./helpers/spawn-cli.mjs";
+import { tmpDraft } from "./helpers/tmp-draft.mjs";
+
+// `caption` keeps the raw transcription, keyed by the transcribed audio bytes
+// and the transcription settings, so a run that only restyles reads it back
+// instead of transcribing again. The CLI path counts fake-whisper runs; the
+// --cloud path counts requests to a stand-in fetch.
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const FAKE_WHISPER = join(__dirname, "helpers", "fake-whisper.mjs");
+const isWindows = process.platform === "win32"; // fake whisper is a shebang script
+
+function setup(t) {
+  const dir = mkdtempSync(join(tmpdir(), "capcut-caption-cache-"));
+  t.after(() => rmSync(dir, { recursive: true, force: true }));
+  const audio = join(dir, "voice.wav");
+  writeFileSync(audio, "voice bytes");
+  const heard = join(dir, "heard.srt");
+  writeFileSync(
+    heard,
+    "1\n00:00:00,000 --> 00:00:01,000\nhello there\n\n2\n00:00:01,500 --> 00:00:02,500\nsecond line\n",
+  );
+  const cache = join(dir, "cache");
+  const calls = join(dir, "calls.log");
+  const run = (extra = []) => {
+    const fix = tmpDraft();
+    t.after(fix.cleanup);
+    const r = spawnCli(
+      ["caption", fix.path, "--audio", audio, "--whisper-cmd", FAKE_WHISPER, "--no-coverage", ...extra],
+      { env: { FAKE_WHISPER_SOURCE: heard, FAKE_WHISPER_CALLS: calls, CAPCUT_CLI_CACHE_DIR: cache } },
+    );
+    assert.equal(r.status, 0, r.stderr);
+    return { ...r.json, draft: fix.path };
+  };
+  const engineRuns = () => (existsSync(calls) ? readFileSync(calls, "utf-8").trim().split("\n").length : 0);
+  const entries = () => (existsSync(cache) ? readdirSync(cache).filter((name) => name.endsWith(".json")) : []);
+  return { dir, audio, cache, run, engineRuns, entries };
+}
+
+function captionTexts(path, trackName = "captions") {
+  const draft = JSON.parse(readFileSync(path, "utf-8"));
+  const track = draft.tracks.find((tr) => tr.type === "text" && tr.name === trackName);
+  return track.segments.map((seg) => extractText(draft.materials.texts.find((m) => m.id === seg.material_id).content));
+}
+
+describe("caption transcript cache (CLI)", { skip: isWindows }, () => {
+  it("a second identical run is a hit and does not run the engine; restyling stays a hit", (t) => {
+    const s = setup(t);
+    const first = s.run();
+    assert.equal(first.transcript_cache, "miss");
+    assert.equal(s.engineRuns(), 1);
+    assert.equal(s.entries().length, 1);
+
+    const second = s.run();
+    assert.equal(second.transcript_cache, "hit");
+    assert.equal(s.engineRuns(), 1, "the engine must not run on a hit");
+    assert.deepEqual(captionTexts(second.draft), captionTexts(first.draft));
+
+    const restyled = s.run(["--track-name", "styled", "--highlight-words", "hello", "--max-chars", "8"]);
+    assert.equal(restyled.transcript_cache, "hit");
+    assert.equal(s.engineRuns(), 1);
+    assert.deepEqual(captionTexts(restyled.draft, "styled"), ["hello there", "second line"]);
+  });
+
+  it("a changed model, language or audio is a miss", (t) => {
+    const s = setup(t);
+    assert.equal(s.run().transcript_cache, "miss");
+    assert.equal(s.run(["--whisper-model", "small"]).transcript_cache, "miss");
+    assert.equal(s.engineRuns(), 2);
+    assert.equal(s.run(["--language", "de"]).transcript_cache, "miss");
+    assert.equal(s.engineRuns(), 3);
+    assert.equal(s.run(["--language", "de"]).transcript_cache, "hit");
+    assert.equal(s.engineRuns(), 3);
+    writeFileSync(s.audio, "other voice bytes");
+    assert.equal(s.run().transcript_cache, "miss");
+    assert.equal(s.engineRuns(), 4);
+  });
+
+  it("--no-cache neither reads nor writes the cache", (t) => {
+    const s = setup(t);
+    assert.equal(s.run(["--no-cache"]).transcript_cache, "off");
+    assert.equal(s.entries().length, 0, "--no-cache must not write an entry");
+    assert.equal(s.run().transcript_cache, "miss");
+    assert.equal(s.run(["--no-cache"]).transcript_cache, "off");
+    assert.equal(s.engineRuns(), 3, "--no-cache must transcribe even when an entry exists");
+  });
+
+  it("a corrupt or mismatched entry is ignored and rewritten", (t) => {
+    const s = setup(t);
+    s.run();
+    const [entry] = s.entries();
+    const path = join(s.cache, entry);
+    const good = readFileSync(path, "utf-8");
+
+    writeFileSync(path, "{ not json");
+    assert.equal(s.run().transcript_cache, "miss");
+    assert.equal(s.engineRuns(), 2);
+    assert.deepEqual(JSON.parse(readFileSync(path, "utf-8")), JSON.parse(good), "the entry is rewritten");
+    assert.equal(s.run().transcript_cache, "hit");
+
+    const tampered = JSON.parse(good);
+    tampered.transcription.cues = "not cues";
+    writeFileSync(path, JSON.stringify(tampered));
+    assert.equal(s.run().transcript_cache, "miss");
+    assert.equal(s.engineRuns(), 3);
+    assert.equal(s.run().transcript_cache, "hit");
+  });
+
+  it("--dry-run reads the cache but never writes it", (t) => {
+    const s = setup(t);
+    assert.equal(s.run(["--dry-run"]).transcript_cache, "miss");
+    assert.equal(s.entries().length, 0, "a dry run must not write the cache");
+    assert.equal(s.run().transcript_cache, "miss");
+    assert.equal(s.run(["--dry-run"]).transcript_cache, "hit");
+    assert.equal(s.engineRuns(), 2);
+  });
+
+  it("--words transcribes nothing and reports no cache state", (t) => {
+    const fix = tmpDraft();
+    t.after(fix.cleanup);
+    const s = setup(t);
+    const words = join(s.dir, "words.json");
+    writeFileSync(words, JSON.stringify([{ word: "hi", start: 0, end: 0.5 }]));
+    const r = spawnCli(["caption", fix.path, "--words", words], { env: { CAPCUT_CLI_CACHE_DIR: s.cache } });
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(r.json.transcript_cache, undefined);
+    assert.equal(s.entries().length, 0);
+  });
+});
+
+describe("transcript cache key and location", () => {
+  it("keys on the audio and every transcription setting; --cloud ignores model and language", () => {
+    const base = transcriptCacheKey({ whisperCmd: "whisper", whisperEngine: "openai" }, "abc");
+    assert.deepEqual(base, {
+      version: TRANSCRIPT_CACHE_VERSION,
+      audio_sha256: "abc",
+      engine: "openai",
+      whisper_cmd: "whisper",
+      model: "base",
+      language: "auto",
+      word_timing: "lines",
+      cloud: false,
+    });
+    assert.equal(
+      transcriptCacheKey({ whisperCmd: "whisper", whisperEngine: "openai", karaoke: true }, "abc").word_timing,
+      "words",
+    );
+    assert.deepEqual(transcriptCacheKey({ cloud: true, language: "de" }, "abc"), {
+      version: TRANSCRIPT_CACHE_VERSION,
+      audio_sha256: "abc",
+      engine: "capcut-cloud",
+      whisper_cmd: null,
+      model: null,
+      language: null,
+      word_timing: "words",
+      cloud: true,
+    });
+  });
+
+  it("CAPCUT_CLI_CACHE_DIR wins, then XDG_CACHE_HOME, then the platform cache dir", (t) => {
+    const saved = { dir: process.env.CAPCUT_CLI_CACHE_DIR, xdg: process.env.XDG_CACHE_HOME };
+    t.after(() => {
+      for (const [name, value] of [
+        ["CAPCUT_CLI_CACHE_DIR", saved.dir],
+        ["XDG_CACHE_HOME", saved.xdg],
+      ]) {
+        if (value === undefined) delete process.env[name];
+        else process.env[name] = value;
+      }
+    });
+    const root = mkdtempSync(join(tmpdir(), "capcut-cache-dir-"));
+    t.after(() => rmSync(root, { recursive: true, force: true }));
+    process.env.CAPCUT_CLI_CACHE_DIR = join(root, "mine");
+    process.env.XDG_CACHE_HOME = join(root, "xdg");
+    assert.equal(transcriptCacheDir(), join(root, "mine"));
+    delete process.env.CAPCUT_CLI_CACHE_DIR;
+    assert.equal(transcriptCacheDir(), join(root, "xdg", "capcut-cli", "transcripts"));
+    delete process.env.XDG_CACHE_HOME;
+    if (process.platform !== "win32") {
+      assert.equal(transcriptCacheDir(), join(homedir(), ".cache", "capcut-cli", "transcripts"));
+    } else {
+      assert.match(transcriptCacheDir(), /capcut-cli[\\/]cache[\\/]transcripts$/);
+    }
+  });
+});
+
+describe("caption --cloud transcript cache (offline)", () => {
+  const realFetch = globalThis.fetch;
+  const savedDir = process.env.CAPCUT_CLI_CACHE_DIR;
+  afterEach(() => {
+    globalThis.fetch = realFetch;
+    if (savedDir === undefined) delete process.env.CAPCUT_CLI_CACHE_DIR;
+    else process.env.CAPCUT_CLI_CACHE_DIR = savedDir;
+  });
+
+  const json = (body, init = {}) =>
+    new Response(JSON.stringify(body), { status: 200, headers: { "content-type": "application/json" }, ...init });
+
+  /** A stand-in for CapCut's upload + recognition endpoints; returns the list of requests made. */
+  function cloudService() {
+    const calls = [];
+    const answer = (url) => {
+      if (url.includes("upload_sign")) {
+        return json({
+          ret: "0",
+          data: {
+            access_key_id: "AK",
+            secret_access_key: "SK",
+            session_token: "ST",
+            space_name: "sp",
+            domain: "vod.test",
+          },
+        });
+      }
+      if (url.includes("ApplyUploadInner")) {
+        return json({
+          Result: {
+            Results: [
+              {
+                Vid: "vid1",
+                UploadHost: "up.test",
+                SessionKey: "sess",
+                StoreInfos: [{ StoreUri: "oid1", Auth: "auth1", UploadID: "u1" }],
+              },
+            ],
+          },
+        });
+      }
+      if (url.includes("phase=transfer")) return json({});
+      if (url.includes("phase=finish")) return json({ data: { key: "key1" } });
+      if (url.includes("CommitUploadInner")) {
+        return json({}, { headers: { "set-cookie": "odin_tt=abc123; Path=/; HttpOnly" } });
+      }
+      if (url.includes("common_task/new")) return json({ ret: "0", data: { tasks: [{ id: "task1", token: "tok1" }] } });
+      return json({
+        ret: "0",
+        data: {
+          tasks: [
+            {
+              id: "task1",
+              status: "succeed",
+              progress: 100,
+              payload: JSON.stringify({
+                utterances: [
+                  {
+                    text: "hello world",
+                    start_time: 100,
+                    end_time: 900,
+                    words: [
+                      { text: "hello", start_time: 100, end_time: 400 },
+                      { text: "world", start_time: 450, end_time: 900 },
+                    ],
+                  },
+                ],
+              }),
+            },
+          ],
+        },
+      });
+    };
+    globalThis.fetch = async (url) => {
+      calls.push(String(url));
+      return answer(String(url));
+    };
+    return calls;
+  }
+
+  it("a hit uploads nothing", async (t) => {
+    const fix = tmpDraft();
+    t.after(fix.cleanup);
+    const cacheDir = mkdtempSync(join(tmpdir(), "capcut-cloud-cache-"));
+    t.after(() => rmSync(cacheDir, { recursive: true, force: true }));
+    process.env.CAPCUT_CLI_CACHE_DIR = cacheDir;
+    // The fixture's audio segment points at a local, undecodable file: the
+    // audio length comes from the draft's material, as in a --cloud dry run.
+    const stored = JSON.parse(readFileSync(fix.path, "utf-8"));
+    const audio = join(fix.dir, "voice.mp3");
+    writeFileSync(audio, "x".repeat(4096));
+    stored.materials.audios[0].path = audio;
+    writeFileSync(fix.path, JSON.stringify(stored));
+    const segment = stored.tracks.find((tr) => tr.type === "audio").segments[0].id;
+    const opts = { fromSegment: segment, cloud: true, coverage: false };
+
+    const first = cloudService();
+    const missed = await captionDraft(loadDraft(fix.path).draft, opts);
+    assert.equal(missed.transcript_cache, "miss");
+    assert.ok(first.length > 0, "a miss uploads and recognizes");
+
+    const second = cloudService();
+    const hit = await captionDraft(loadDraft(fix.path).draft, opts);
+    assert.equal(hit.transcript_cache, "hit");
+    assert.deepEqual(second, [], "a hit must not upload anything");
+    assert.equal(hit.cues, missed.cues);
+    assert.deepEqual(hit.first_cue, missed.first_cue);
+  });
+});
diff --git a/test/caption-coverage.test.mjs b/test/caption-coverage.test.mjs
new file mode 100644
index 0000000..813bc71
--- /dev/null
+++ b/test/caption-coverage.test.mjs
@@ -0,0 +1,304 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { describe, it } from "node:test";
+import { fileURLToPath } from "node:url";
+import { captionCoverage, mergeSpans, subtractSpans, uncaptionedWarning } from "../dist/caption-coverage.js";
+import { spawnCli } from "./helpers/spawn-cli.mjs";
+import { tmpDraft } from "./helpers/tmp-draft.mjs";
+
+// After `caption` transcribes, the speech in the audio (ffmpeg silencedetect)
+// is compared with the cues: speech no cue covers is reported. The span math
+// is asserted directly; the CLI path runs a fake whisper over a generated
+// tone/silence clip.
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const FAKE_WHISPER = join(__dirname, "helpers", "fake-whisper.mjs");
+const isWindows = process.platform === "win32"; // fake whisper is a shebang script
+const hasFfmpeg = spawnSync("ffmpeg", ["-version"], { encoding: "utf-8" }).status === 0;
+
+// Speech at 0-2, 3-5 and 6-9 seconds of a 10 s clip.
+const SPEECH = [
+  { start: 0, end: 2 },
+  { start: 3, end: 5 },
+  { start: 6, end: 9 },
+];
+
+describe("caption coverage span math", () => {
+  it("merges overlapping and touching spans and drops empty ones", () => {
+    assert.deepEqual(
+      mergeSpans([
+        { start: 3, end: 4 },
+        { start: 0, end: 1 },
+        { start: 1, end: 2 },
+        { start: 3.5, end: 5 },
+        { start: 7, end: 7 },
+      ]),
+      [
+        { start: 0, end: 2 },
+        { start: 3, end: 5 },
+      ],
+    );
+  });
+
+  it("subtracts the covered parts, keeping what is left over", () => {
+    assert.deepEqual(
+      subtractSpans(
+        [
+          { start: 0, end: 10 },
+          { start: 12, end: 14 },
+        ],
+        [
+          { start: 1, end: 2 },
+          { start: 1.5, end: 3 },
+          { start: 9, end: 13 },
+        ],
+      ),
+      [
+        { start: 0, end: 1 },
+        { start: 3, end: 9 },
+        { start: 13, end: 14 },
+      ],
+    );
+    assert.deepEqual(subtractSpans([{ start: 0, end: 5 }], []), [{ start: 0, end: 5 }]);
+    assert.deepEqual(subtractSpans([{ start: 0, end: 5 }], [{ start: -1, end: 6 }]), []);
+  });
+
+  it("a transcription that stops early leaves the tail uncaptioned", () => {
+    const coverage = captionCoverage(SPEECH, [
+      { start: 0, end: 2 },
+      { start: 3, end: 5 },
+    ]);
+    assert.deepEqual(coverage, {
+      speech_s: 7,
+      captioned_s: 4,
+      ratio: 0.5714,
+      uncaptioned: [{ start_s: 6, end_s: 9 }],
+      tail_uncaptioned_s: 3,
+    });
+  });
+
+  it("an internal gap is listed but is not tail", () => {
+    const coverage = captionCoverage(SPEECH, [
+      { start: 0, end: 2 },
+      { start: 6, end: 9 },
+    ]);
+    assert.deepEqual(coverage.uncaptioned, [{ start_s: 3, end_s: 5 }]);
+    assert.equal(coverage.tail_uncaptioned_s, 0);
+    assert.equal(coverage.captioned_s, 5);
+  });
+
+  it("full coverage lists nothing; slivers below the minimum still count in the ratio", () => {
+    const full = captionCoverage(SPEECH, [
+      { start: 0, end: 2.5 },
+      { start: 2.9, end: 9 },
+    ]);
+    assert.deepEqual(full, { speech_s: 7, captioned_s: 7, ratio: 1, uncaptioned: [], tail_uncaptioned_s: 0 });
+    const early = captionCoverage(SPEECH, [
+      { start: 0, end: 2 },
+      { start: 3, end: 5 },
+      { start: 6, end: 8 },
+    ]);
+    assert.deepEqual(early.uncaptioned, [], "a 1 s miss is below the 1.5 s default");
+    assert.equal(early.captioned_s, 6);
+    assert.equal(captionCoverage(SPEECH, [{ start: 0, end: 8 }], 1).uncaptioned.length, 1);
+  });
+
+  it("audio without speech counts as covered", () => {
+    assert.deepEqual(captionCoverage([], [{ start: 0, end: 1 }]), {
+      speech_s: 0,
+      captioned_s: 0,
+      ratio: 1,
+      uncaptioned: [],
+      tail_uncaptioned_s: 0,
+    });
+  });
+
+  it("the warning names every span and the tail", () => {
+    const warning = uncaptionedWarning(
+      captionCoverage(SPEECH, [
+        { start: 0, end: 2 },
+        { start: 6, end: 7 },
+      ]),
+    );
+    assert.match(warning, /^\[uncaptioned-speech\] 4\.00s of speech in 2 spans has no caption \(43%/);
+    assert.match(warning, /3\.00-5\.00s, 7\.00-9\.00s/);
+    assert.match(warning, /2\.00s of it comes after the last cue/);
+    assert.ok(warning.endsWith("\n"));
+  });
+});
+
+function scratch() {
+  const dir = mkdtempSync(join(tmpdir(), "capcut-caption-coverage-"));
+  return { dir, cleanup: () => rmSync(dir, { recursive: true, force: true }) };
+}
+
+/** 2 s tone, 1 s silence, 2 s tone, 1 s silence, 3 s tone, 1 s silence. */
+function makeSpeechClip(dir) {
+  const clip = join(dir, "speech.wav");
+  const parts = [
+    ["sine", 2],
+    ["silence", 1],
+    ["sine", 2],
+    ["silence", 1],
+    ["sine", 3],
+    ["silence", 1],
+  ];
+  const inputs = parts.flatMap(([kind, d]) => [
+    "-f",
+    "lavfi",
+    "-i",
+    kind === "sine" ? `sine=frequency=440:sample_rate=16000:duration=${d}` : `anullsrc=r=16000:cl=mono:d=${d}`,
+  ]);
+  const labels = parts.map((_, i) => `[${i}:a]`).join("");
+  const r = spawnSync(
+    "ffmpeg",
+    [
+      "-y",
+      "-loglevel",
+      "error",
+      ...inputs,
+      "-filter_complex",
+      `${labels}concat=n=${parts.length}:v=0:a=1[a]`,
+      "-map",
+      "[a]",
+      "-ac",
+      "1",
+      clip,
+    ],
+    { encoding: "utf-8" },
+  );
+  assert.equal(r.status, 0, r.stderr);
+  return clip;
+}
+
+function srt(cues) {
+  const stamp = (s) => {
+    const ms = Math.round(s * 1000);
+    const pad = (n, w = 2) => String(n).padStart(w, "0");
+    return `00:00:${pad(Math.floor(ms / 1000))},${pad(ms % 1000, 3)}`;
+  };
+  return cues.map(([start, end, text], i) => `${i + 1}\n${stamp(start)} --> ${stamp(end)}\n${text}\n`).join("\n");
+}
+
+function caption(t, cues, extra = [], audio) {
+  const fix = tmpDraft();
+  const s = scratch();
+  t.after(fix.cleanup);
+  t.after(s.cleanup);
+  const clip = audio ?? makeSpeechClip(s.dir);
+  const heard = join(s.dir, "heard.srt");
+  writeFileSync(heard, srt(cues));
+  return spawnCli(["caption", fix.path, "--audio", clip, "--whisper-cmd", FAKE_WHISPER, ...extra], {
+    env: { FAKE_WHISPER_SOURCE: heard },
+  });
+}
+
+const near = (actual, expected, label) =>
+  assert.ok(Math.abs(actual - expected) < 0.1, `${label}: ${actual} is not ~${expected}`);
+
+describe("caption coverage check (CLI)", { skip: isWindows }, () => {
+  it("reports a truncated tail and warns once on stderr", { skip: !hasFfmpeg }, (t) => {
+    const r = caption(t, [
+      [0, 2, "first words"],
+      [3, 5, "then more"],
+    ]);
+    assert.equal(r.status, 0, r.stderr);
+    const c = r.json.coverage;
+    near(c.speech_s, 7, "speech_s");
+    near(c.captioned_s, 4, "captioned_s");
+    assert.equal(c.uncaptioned.length, 1, JSON.stringify(c));
+    near(c.uncaptioned[0].start_s, 6, "uncaptioned start");
+    near(c.uncaptioned[0].end_s, 9, "uncaptioned end");
+    near(c.tail_uncaptioned_s, 3, "tail");
+    assert.ok(c.ratio > 0.5 && c.ratio < 0.65, `ratio ${c.ratio}`);
+    const warnings = r.stderr.split("\n").filter((line) => line.startsWith("[uncaptioned-speech]"));
+    assert.equal(warnings.length, 1, r.stderr);
+    assert.match(warnings[0], /after the last cue/);
+  });
+
+  it("reports an internal gap without a tail", { skip: !hasFfmpeg }, (t) => {
+    const r = caption(t, [
+      [0, 2, "first words"],
+      [6, 9, "the ending"],
+    ]);
+    assert.equal(r.status, 0, r.stderr);
+    const c = r.json.coverage;
+    assert.equal(c.uncaptioned.length, 1, JSON.stringify(c));
+    near(c.uncaptioned[0].start_s, 3, "uncaptioned start");
+    near(c.uncaptioned[0].end_s, 5, "uncaptioned end");
+    assert.equal(c.tail_uncaptioned_s, 0);
+    assert.match(r.stderr, /^\[uncaptioned-speech\]/m);
+    assert.doesNotMatch(r.stderr, /after the last cue/);
+  });
+
+  it("full coverage lists nothing and stays quiet", { skip: !hasFfmpeg }, (t) => {
+    const r = caption(t, [
+      [0, 2, "first words"],
+      [3, 5, "then more"],
+      [6, 9, "the ending"],
+    ]);
+    assert.equal(r.status, 0, r.stderr);
+    assert.deepEqual(r.json.coverage.uncaptioned, []);
+    assert.equal(r.json.coverage.tail_uncaptioned_s, 0);
+    assert.ok(r.json.coverage.ratio > 0.97, `ratio ${r.json.coverage.ratio}`);
+    assert.doesNotMatch(r.stderr, /uncaptioned-speech/);
+  });
+
+  it("--min-uncaptioned raises the bar for what is listed", { skip: !hasFfmpeg }, (t) => {
+    const r = caption(
+      t,
+      [
+        [0, 2, "first words"],
+        [3, 5, "then more"],
+      ],
+      ["--min-uncaptioned", "5"],
+    );
+    assert.equal(r.status, 0, r.stderr);
+    assert.deepEqual(r.json.coverage.uncaptioned, []);
+    assert.ok(r.json.coverage.ratio < 0.65, "the missing tail still lowers the ratio");
+    assert.doesNotMatch(r.stderr, /uncaptioned-speech/);
+  });
+
+  it("is skipped, not fatal, when ffmpeg is missing", (t) => {
+    const s = scratch();
+    t.after(s.cleanup);
+    const audio = join(s.dir, "voice.wav");
+    writeFileSync(audio, "stub");
+    const r = caption(t, [[0, 1, "hello"]], ["--ffmpeg-cmd", join(s.dir, "no-such-ffmpeg")], audio);
+    assert.equal(r.status, 0, r.stderr);
+    assert.deepEqual(r.json.coverage, { skipped: "ffmpeg not found" });
+    assert.equal(r.json.cues, 1);
+    assert.doesNotMatch(r.stderr, /uncaptioned-speech/);
+  });
+
+  it("--no-coverage leaves the check out", (t) => {
+    const s = scratch();
+    t.after(s.cleanup);
+    const audio = join(s.dir, "voice.wav");
+    writeFileSync(audio, "stub");
+    const r = caption(t, [[0, 1, "hello"]], ["--no-coverage"], audio);
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(r.json.coverage, undefined);
+  });
+
+  it("--words reads no audio, so there is nothing to measure", (t) => {
+    const fix = tmpDraft();
+    const s = scratch();
+    t.after(fix.cleanup);
+    t.after(s.cleanup);
+    const words = join(s.dir, "words.json");
+    writeFileSync(words, JSON.stringify([{ word: "hello", start: 0, end: 0.5 }]));
+    const r = spawnCli(["caption", fix.path, "--words", words]);
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(r.json.coverage, undefined);
+  });
+
+  it("refuses a negative --min-uncaptioned", (t) => {
+    const r = caption(t, [[0, 1, "hello"]], ["--min-uncaptioned", "-1"], "/dev/null");
+    assert.equal(r.status, 1);
+    assert.match(r.stderr, /--min-uncaptioned/);
+  });
+});
diff --git a/test/caption-stream-reveal.test.mjs b/test/caption-stream-reveal.test.mjs
index 727ed91..8a99698 100644
--- a/test/caption-stream-reveal.test.mjs
+++ b/test/caption-stream-reveal.test.mjs
@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { chmodSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { describe, it } from "node:test";
@@ -75,6 +75,9 @@ describe("caption audio stream selection", () => {
         FAKE_WHISPER,
         "--track-name",
         "selected",
+        // The stand-in ffmpeg only extracts streams: it would write its last
+        // argument ("-", the null muxer's output) as a file in the cwd.
+        "--no-coverage",
       ],
       { env: { FAKE_WHISPER_SOURCE: transcript } },
     );
@@ -88,6 +91,58 @@ describe("caption audio stream selection", () => {
   });
 });
 
+describe("caption audio stream clean-up", { skip: isWindows }, () => {
+  // The fake ffmpeg writes the extracted stream and records where, so the test
+  // can see the temporary copy is gone once the command has finished.
+  function fakeFfmpeg(dir) {
+    const record = join(dir, "extracted-to.txt");
+    const ffmpeg = join(dir, "fake-ffmpeg");
+    writeFileSync(
+      ffmpeg,
+      `#!/bin/sh\nfor last do :; done\nprintf selected > "$last"\nprintf %s "$last" > "${record}"\n`,
+    );
+    chmodSync(ffmpeg, 0o755);
+    return { ffmpeg, extracted: () => readFileSync(record, "utf-8") };
+  }
+
+  for (const outcome of ["succeeds", "fails"]) {
+    it(`removes the extracted stream when the transcription ${outcome}`, (t) => {
+      const fix = tmpDraft();
+      const s = scratch();
+      t.after(() => fix.cleanup());
+      t.after(s.cleanup);
+      const media = join(s.dir, "multi-audio.mov");
+      const transcript = join(s.dir, "heard.srt");
+      writeFileSync(media, "container");
+      writeFileSync(transcript, "1\n00:00:00,000 --> 00:00:01,000\nselected voice\n");
+      const failingWhisper = join(s.dir, "failing-whisper");
+      writeFileSync(failingWhisper, "#!/bin/sh\necho no model >&2\nexit 3\n");
+      chmodSync(failingWhisper, 0o755);
+      const { ffmpeg, extracted } = fakeFfmpeg(s.dir);
+      const r = spawnCli(
+        [
+          "caption",
+          fix.path,
+          "--audio",
+          media,
+          "--audio-stream",
+          "0",
+          "--ffmpeg-cmd",
+          ffmpeg,
+          "--whisper-cmd",
+          outcome === "succeeds" ? FAKE_WHISPER : failingWhisper,
+          // The fake ffmpeg only extracts; the coverage check would run it again.
+          "--no-coverage",
+        ],
+        { env: { FAKE_WHISPER_SOURCE: transcript } },
+      );
+      assert.equal(r.status, outcome === "succeeds" ? 0 : 1, `stderr: ${r.stderr}`);
+      assert.match(extracted(), /selected\.wav$/);
+      assert.equal(existsSync(dirname(extracted())), false);
+    });
+  }
+});
+
 describe("caption --word-reveal", { skip: isWindows }, () => {
   it("creates progressive prefix captions on word timestamps", (t) => {
     const fix = tmpDraft();
diff --git a/test/cloud-translate.test.mjs b/test/cloud-translate.test.mjs
index 2a9bcc7..436df1a 100644
--- a/test/cloud-translate.test.mjs
+++ b/test/cloud-translate.test.mjs
@@ -81,6 +81,16 @@ describe("capcut-cloud-translate — language normalization", () => {
     assert.equal(normalizeLanguageCode("Arabic"), "ar-SA");
     assert.equal(normalizeLanguageCode("unknown-lang"), "unknown-lang");
   });
+
+  it("finds every canonical code in any letter case and passes unknown codes through trimmed", () => {
+    const canonical = ["en", "vi", "es", "fr", "de", "zh-CN", "zh-TW", "ja", "ko", "pt", "ru", "id", "th", "it"];
+    for (const code of [...canonical, "ar-SA", "tr", "nl", "pl", "ms", "hi"]) {
+      assert.equal(normalizeLanguageCode(code), code);
+      assert.equal(normalizeLanguageCode(` ${code.toUpperCase()} `), code);
+      assert.equal(normalizeLanguageCode(code.toLowerCase()), code);
+    }
+    assert.equal(normalizeLanguageCode("  Klingon "), "Klingon");
+  });
 });
 
 describe("capcut-cloud-translate — captured headers", () => {
@@ -224,6 +234,43 @@ describe("capcut-cloud-translate — exchange (offline)", () => {
     assert.equal(res[0].translation_text, "vi:a");
   });
 
+  it("gives up after three tries on a 5xx answer and names the HTTP error", async () => {
+    const calls = service(() => new Response("down", { status: 503, statusText: "Busy" }));
+    await assert.rejects(translateUtterancesCapcutCloud([{ start_time: 0, end_time: 1, text: "a" }], "vi", FAST), {
+      message: "CapCut Cloud Translation HTTP error: 503 Busy",
+    });
+    assert.equal(calls.length, 3);
+  });
+
+  it("sends a refused request once and names the HTTP error", async () => {
+    const calls = service(() => new Response("no", { status: 400, statusText: "Bad Request" }));
+    await assert.rejects(translateUtterancesCapcutCloud([{ start_time: 0, end_time: 1, text: "a" }], "vi", FAST), {
+      message: "CapCut Cloud Translation HTTP error: 400 Bad Request",
+    });
+    assert.equal(calls.length, 1);
+  });
+
+  it("retries a network failure, then names it", async () => {
+    let n = 0;
+    globalThis.fetch = async () => {
+      n++;
+      throw new TypeError("fetch failed");
+    };
+    await assert.rejects(translateUtterancesCapcutCloud([{ start_time: 0, end_time: 1, text: "a" }], "vi", FAST), {
+      message: "CapCut Cloud Translation request failed: fetch failed",
+    });
+    assert.equal(n, 3);
+  });
+
+  it("names a request that timed out on every try", async () => {
+    globalThis.fetch = async () => {
+      throw new DOMException("The operation was aborted due to timeout", "TimeoutError");
+    };
+    await assert.rejects(translateUtterancesCapcutCloud([{ start_time: 0, end_time: 1, text: "a" }], "vi", FAST), {
+      message: "CapCut Cloud Translation request timed out after 60 s (3 tries).",
+    });
+  });
+
   it("turns translated words into µs cue words and leaves an untranslated cue exactly as it was", async () => {
     service((sent) =>
       reply("vi", [
diff --git a/test/diff-since-write.test.mjs b/test/diff-since-write.test.mjs
new file mode 100644
index 0000000..a4415c7
--- /dev/null
+++ b/test/diff-since-write.test.mjs
@@ -0,0 +1,155 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { copyFileSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { describe, it } from "node:test";
+import { spawnCli } from "./helpers/spawn-cli.mjs";
+import { tmpDraft } from "./helpers/tmp-draft.mjs";
+
+const sha = (text) => createHash("sha256").update(text).digest("hex");
+const HISTORY = ".capcut-cli-history";
+
+// A CLI write, then the draft as the app would leave it after an edit.
+function written(t) {
+  const fix = tmpDraft();
+  t.after(fix.cleanup);
+  const textId = spawnCli(["texts", fix.path]).json[0].id;
+  assert.equal(spawnCli(["set-text", fix.path, textId, "Written by the CLI", "-q"]).status, 0);
+  return { ...fix, textId, content: readFileSync(fix.path, "utf-8") };
+}
+
+function appEdit(path, edit) {
+  const draft = JSON.parse(readFileSync(path, "utf-8"));
+  edit(draft);
+  writeFileSync(path, JSON.stringify(draft));
+}
+
+const nothing = { added: [], removed: [], changed: [] };
+
+describe("diff --since-write", () => {
+  it("reports no change when the draft is exactly what the CLI wrote", (t) => {
+    const fix = written(t);
+    const r = spawnCli(["diff", fix.path, "--since-write"]);
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(r.json.changed, false);
+    assert.deepEqual(r.json.segments, nothing);
+    assert.deepEqual(r.json.materials, nothing);
+    assert.equal(r.json.since_write.changed, false);
+    assert.equal(r.json.since_write.written_sha256, sha(fix.content));
+    assert.equal(r.json.since_write.current_sha256, sha(fix.content));
+    assert.equal(r.json.since_write.written_by, "set-text");
+    assert.ok(!Number.isNaN(Date.parse(r.json.since_write.written_at)));
+    assert.deepEqual(r.json.since_write.top_level_changed, []);
+    assert.equal(r.json.since_write.track_order_changed, false);
+    assert.match(r.stderr, /No changes/);
+  });
+
+  it("shows a reordering of the tracks and nothing else", (t) => {
+    const fix = written(t);
+    appEdit(fix.path, (draft) => draft.tracks.reverse());
+    const r = spawnCli(["diff", fix.path, "--since-write"]);
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(r.json.changed, false, "no segment or material changed");
+    assert.deepEqual(r.json.segments, nothing);
+    assert.deepEqual(r.json.materials, nothing);
+    assert.equal(r.json.since_write.changed, true);
+    assert.equal(r.json.since_write.track_order_changed, true);
+    assert.deepEqual(r.json.since_write.top_level_changed, ["tracks"]);
+    assert.equal(r.json.since_write.current_sha256, sha(readFileSync(fix.path, "utf-8")));
+  });
+
+  it("shows a changed value on one segment", (t) => {
+    const fix = written(t);
+    let segmentId;
+    appEdit(fix.path, (draft) => {
+      const segment = draft.tracks.find((track) => track.type === "video").segments[0];
+      segmentId = segment.id;
+      segment.volume = 0.25;
+    });
+    const r = spawnCli(["diff", fix.path, "--since-write"]);
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(r.json.changed, true);
+    assert.deepEqual(r.json.segments, { added: [], removed: [], changed: [{ id: segmentId, fields: ["volume"] }] });
+    assert.deepEqual(r.json.materials, nothing);
+    assert.deepEqual(r.json.since_write.top_level_changed, ["tracks"]);
+    assert.equal(r.json.since_write.track_order_changed, false);
+  });
+
+  it("shows a material the app added", (t) => {
+    const fix = written(t);
+    appEdit(fix.path, (draft) => {
+      draft.materials.texts.push({ id: "APP-ADDED", type: "text", content: "{}" });
+    });
+    const r = spawnCli(["diff", fix.path, "--since-write"]);
+    assert.equal(r.status, 0, r.stderr);
+    assert.deepEqual(r.json.segments, nothing);
+    assert.deepEqual(r.json.materials, { added: ["APP-ADDED"], removed: [], changed: [] });
+    assert.deepEqual(r.json.since_write.top_level_changed, ["materials"]);
+    assert.equal(r.json.since_write.changed, true);
+  });
+
+  it("exits 1 when the CLI has no record of writing the draft", (t) => {
+    const fix = tmpDraft();
+    t.after(fix.cleanup);
+    const r = spawnCli(["diff", fix.path, "--since-write"]);
+    assert.equal(r.status, 1);
+    assert.match(JSON.parse(r.stderr.trim()).error, /No record of a capcut-cli write/);
+  });
+
+  it("keeps one record per draft file, replaced on each write", (t) => {
+    const fix = tmpDraft();
+    t.after(fix.cleanup);
+    // A project with a mirror: every file a write touches gets its own record.
+    copyFileSync(fix.path, join(fix.dir, "draft_info.json"));
+    const textId = spawnCli(["texts", fix.dir]).json[0].id;
+    for (const text of ["one", "two"]) {
+      assert.equal(spawnCli(["set-text", fix.dir, textId, text, "-q"]).status, 0);
+    }
+    const records = readdirSync(join(fix.dir, HISTORY))
+      .filter((name) => name.endsWith(".last-write"))
+      .sort();
+    assert.deepEqual(records, ["draft_content.json.last-write", "draft_info.json.last-write"]);
+    for (const file of ["draft_content.json", "draft_info.json"]) {
+      const record = JSON.parse(readFileSync(join(fix.dir, HISTORY, `${file}.last-write`), "utf-8"));
+      assert.equal(record.content, readFileSync(join(fix.dir, file), "utf-8"));
+      assert.equal(record.sha256, sha(record.content));
+    }
+  });
+
+  it("leaves restore and its history listing as they were", (t) => {
+    const fix = written(t);
+    const segment = spawnCli(["segments", fix.path]).json[0];
+    assert.equal(spawnCli(["shift", fix.path, segment.id, "+1s", "-q"]).status, 0);
+
+    const list = spawnCli(["restore", fix.path, "--list"]);
+    assert.equal(list.status, 0, list.stderr);
+    assert.equal(list.json.count, 2);
+    assert.deepEqual(
+      list.json.snapshots.map((s) => [s.step, s.command, s.integrity]),
+      [
+        [1, "shift", "intact"],
+        [2, "set-text", "intact"],
+      ],
+    );
+    assert.ok(list.json.snapshots.every((s) => s.path.endsWith(".snap")));
+
+    const restored = spawnCli(["restore", fix.path]);
+    assert.equal(restored.status, 0, restored.stderr);
+    assert.equal(restored.json.integrity, "intact");
+    assert.equal(readFileSync(fix.path, "utf-8"), fix.content, "restore brings back the state before the shift");
+    assert.equal(spawnCli(["restore", fix.path, "--list"]).json.count, 2);
+
+    // The restore is the CLI's own write, so the draft matches the record again.
+    const since = spawnCli(["diff", fix.path, "--since-write"]);
+    assert.equal(since.status, 0, since.stderr);
+    assert.equal(since.json.since_write.changed, false);
+    assert.equal(since.json.since_write.written_sha256, sha(fix.content));
+  });
+
+  it("refuses a second project together with --since-write", (t) => {
+    const fix = written(t);
+    const r = spawnCli(["diff", fix.path, fix.path, "--since-write"]);
+    assert.equal(r.status, 1);
+    assert.match(r.stderr, /--since-write/);
+  });
+});
diff --git a/test/fixture-anonymize.test.mjs b/test/fixture-anonymize.test.mjs
new file mode 100644
index 0000000..375dfa0
--- /dev/null
+++ b/test/fixture-anonymize.test.mjs
@@ -0,0 +1,262 @@
+import assert from "node:assert/strict";
+import { mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, it } from "node:test";
+import { maskText, replaceJsonStrings } from "../dist/fixture-anonymize.js";
+import { spawnCli } from "./helpers/spawn-cli.mjs";
+
+const TIMELINE_ID = "5B3D7A10-0000-4000-8000-00000000A001";
+const VIDEO = "/home/alice/Clients/Acme Corp/interview-final.MP4";
+const AUDIO = "/home/alice/Music/acme theme.mp3";
+const MIXED = "你好 World 2026！";
+const MIXED_RANGES = [
+  [0, 2],
+  [3, 8],
+  [9, 14],
+];
+const KANA = "カタカナ ひらがな 한국어 Ünïcode";
+// The markup form older drafts store instead of a JSON text document.
+const LEGACY = '<font id="" path="/home/alice/fonts/a.ttf"><size=8.000000>[Hi 你好 7]</size></font>';
+const PRIVATE = ["alice", "Acme", "interview", "theme", "你好", "World", "カタカナ", "ひらがな", "한국어", "Ünïcode"];
+
+function textContent(text, ranges) {
+  return JSON.stringify({
+    styles: ranges.map(([start, end], i) => ({
+      fill: { content: { render_type: "solid", solid: { color: [1, 1, 1] } } },
+      range: [start, end],
+      size: 15 - i,
+      bold: i === 1,
+    })),
+    text,
+  });
+}
+
+function draft() {
+  return {
+    id: TIMELINE_ID,
+    name: "Acme Launch Teaser",
+    duration: 6000000,
+    fps: 30,
+    canvas_config: { width: 1920, height: 1080, ratio: "16:9" },
+    tracks: [
+      {
+        id: "track-video",
+        type: "video",
+        segments: [
+          { id: "seg-v1", material_id: "mat-v1", target_timerange: { start: 0, duration: 3000000 } },
+          { id: "seg-v2", material_id: "mat-v2", target_timerange: { start: 3000000, duration: 3000000 } },
+        ],
+      },
+      {
+        id: "track-audio",
+        type: "audio",
+        segments: [{ id: "seg-a1", material_id: "mat-a1", target_timerange: { start: 0, duration: 6000000 } }],
+      },
+      {
+        id: "track-text",
+        type: "text",
+        segments: [
+          { id: "seg-t1", material_id: "mat-t1", target_timerange: { start: 0, duration: 3000000 } },
+          { id: "seg-t2", material_id: "mat-t2", target_timerange: { start: 3000000, duration: 3000000 } },
+        ],
+      },
+    ],
+    materials: {
+      // The same file under two materials must get one neutral name.
+      videos: [
+        { id: "mat-v1", type: "video", path: VIDEO, material_name: "interview-final.MP4", reverse_path: "" },
+        { id: "mat-v2", type: "video", path: VIDEO, material_name: "interview-final.MP4", reverse_path: "" },
+      ],
+      audios: [{ id: "mat-a1", type: "extract_music", path: AUDIO, name: "acme theme.mp3" }],
+      texts: [
+        { id: "mat-t1", type: "text", content: textContent(MIXED, MIXED_RANGES), font_path: "", name: "" },
+        {
+          id: "mat-t2",
+          type: "subtitle",
+          content: textContent(KANA, [[0, KANA.length]]),
+          words: { start_time: [0, 500], end_time: [500, 1000], text: ["カタカナ", "ひらがな"] },
+        },
+        { id: "mat-t3", type: "text", content: LEGACY },
+      ],
+      speeds: [],
+    },
+  };
+}
+
+function project(t) {
+  const root = mkdtempSync(join(tmpdir(), "capcut-fixture-anon-"));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const dir = join(root, "Acme Launch Teaser");
+  mkdirSync(join(dir, "Timelines", TIMELINE_ID), { recursive: true });
+  const doc = JSON.stringify(draft());
+  writeFileSync(join(dir, "draft_content.json"), doc);
+  writeFileSync(join(dir, "draft_info.json"), doc);
+  // A string-JSON envelope, the shape whose escaped quotes the redactor also handles.
+  writeFileSync(join(dir, "template-2.tmp"), JSON.stringify({ draft_content: doc }));
+  writeFileSync(join(dir, "Timelines", TIMELINE_ID, "draft_info.json"), doc);
+  writeFileSync(
+    join(dir, "Timelines", "project.json"),
+    JSON.stringify({ main_timeline_id: TIMELINE_ID, timelines: [{ id: TIMELINE_ID, name: "Timeline 01" }] }),
+  );
+  writeFileSync(
+    join(dir, "draft_meta_info.json"),
+    JSON.stringify({
+      draft_name: "Acme Launch Teaser",
+      draft_fold_path: "/home/alice/Movies/CapCut/User Data/Projects/com.lveditor.draft/Acme Launch Teaser",
+      draft_root_path: "/home/alice/Movies/CapCut/User Data/Projects/com.lveditor.draft",
+      draft_cover: "draft_cover.jpg",
+      draft_materials: [
+        {
+          type: 0,
+          value: [
+            { file_Path: VIDEO, extra_info: "interview-final.MP4", metetype: "video" },
+            { file_Path: AUDIO, extra_info: "acme theme.mp3", metetype: "music" },
+          ],
+        },
+        { type: 1, value: [] },
+      ],
+    }),
+  );
+  return { dir, out: join(root, "bundle") };
+}
+
+function bundledFiles(dir, prefix = "") {
+  const files = [];
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
+    if (entry.isDirectory()) files.push(...bundledFiles(join(dir, entry.name), rel));
+    else files.push({ rel, text: readFileSync(join(dir, entry.name), "utf-8") });
+  }
+  return files;
+}
+
+const read = (out, rel) => JSON.parse(readFileSync(join(out, ...rel.split("/")), "utf-8"));
+
+describe("fixture --anonymize", () => {
+  it("renames media, folders and the project consistently across every mirror", (t) => {
+    const p = project(t);
+    const r = spawnCli(["fixture", p.dir, "--out", p.out, "--anonymize"]);
+    assert.equal(r.status, 0, `stderr: ${r.stderr}`);
+    assert.equal(r.json.ok, true);
+    assert.equal(r.json.redaction_check.ok, true);
+    assert.equal(r.json.anonymized, true);
+
+    const video = "/home/USER/folder-001/folder-002/media-001.MP4";
+    const audio = "/home/USER/Music/media-002.mp3";
+    const timelines = [
+      read(p.out, "draft_content.json"),
+      read(p.out, "draft_info.json"),
+      JSON.parse(read(p.out, "template-2.tmp").draft_content),
+      read(p.out, `Timelines/${TIMELINE_ID}/draft_info.json`),
+    ];
+    for (const doc of timelines) {
+      assert.equal(doc.name, "project");
+      assert.deepEqual(
+        doc.materials.videos.map((m) => [m.path, m.material_name, m.reverse_path]),
+        [
+          [video, "media-001.MP4", ""],
+          [video, "media-001.MP4", ""],
+        ],
+      );
+      assert.deepEqual(
+        doc.materials.audios.map((m) => [m.path, m.name]),
+        [[audio, "media-002.mp3"]],
+      );
+      // Everything that is not a name or a text is left as it was.
+      assert.deepEqual(doc.tracks, draft().tracks);
+    }
+
+    const meta = read(p.out, "draft_meta_info.json");
+    assert.equal(meta.draft_name, "project");
+    assert.equal(meta.draft_fold_path, "/home/USER/Movies/CapCut/User Data/Projects/com.lveditor.draft/project");
+    assert.equal(meta.draft_root_path, "/home/USER/Movies/CapCut/User Data/Projects/com.lveditor.draft");
+    assert.equal(meta.draft_cover, "draft_cover.jpg");
+    assert.deepEqual(
+      meta.draft_materials[0].value.map((v) => [v.file_Path, v.extra_info]),
+      [
+        [video, "media-001.MP4"],
+        [audio, "media-002.mp3"],
+      ],
+    );
+
+    const report = read(p.out, "SANITIZE_REPORT.json");
+    assert.equal(report.anonymized, true);
+    assert.equal(report.anonymization.media_files, 2);
+    assert.equal(report.anonymization.folders, 2);
+    assert.match(report.source_dir, /\/project$/);
+    assert.match(readFileSync(join(p.out, "README.md"), "utf-8"), /--anonymize/);
+
+    for (const { rel, text } of bundledFiles(p.out)) {
+      for (const original of PRIVATE) assert.ok(!text.includes(original), `${rel} still carries ${original}`);
+    }
+    assert.ok(!r.stdout.includes("Acme") && !r.stderr.includes("Acme"));
+  });
+
+  it("replaces texts with same-length placeholders and keeps style ranges", (t) => {
+    const p = project(t);
+    const r = spawnCli(["fixture", p.dir, "--out", p.out, "--anonymize"]);
+    assert.equal(r.status, 0, `stderr: ${r.stderr}`);
+
+    const original = draft().materials.texts;
+    for (const rel of ["draft_content.json", "draft_info.json", `Timelines/${TIMELINE_ID}/draft_info.json`]) {
+      const texts = read(p.out, rel).materials.texts;
+      const first = JSON.parse(texts[0].content);
+      assert.equal(first.text, "字字 Xxxxx 0000！");
+      assert.equal(first.text.length, MIXED.length);
+      assert.deepEqual(
+        first.styles.map((s) => s.range),
+        MIXED_RANGES,
+      );
+      assert.deepEqual(
+        MIXED_RANGES.map(([start, end]) => first.text.slice(start, end)),
+        ["字字", "Xxxxx", "0000！"],
+      );
+      // Only `text` changed inside the content string; the styles keep their bytes.
+      assert.equal(texts[0].content.replace(first.text, MIXED), original[0].content);
+
+      const second = JSON.parse(texts[1].content);
+      assert.equal(second.text, "字字字字 字字字字 字字字 Xxxxxxx");
+      assert.deepEqual(second.styles[0].range, [0, KANA.length]);
+      assert.deepEqual(texts[1].words.text, ["字字字字", "字字字字"]);
+      assert.deepEqual(texts[1].words.start_time, [0, 500]);
+
+      assert.equal(
+        texts[2].content,
+        '<font id="" path="/home/USER/fonts/a.ttf"><size=8.000000>[Xx 字字 0]</size></font>',
+      );
+    }
+
+    const report = read(p.out, "SANITIZE_REPORT.json");
+    // Three contents plus two karaoke words, in each of the four timeline copies.
+    assert.equal(report.anonymization.text_fields, 20);
+    // The four timeline names and the sidecar's display name.
+    assert.equal(report.anonymization.project_names, 5);
+    assert.ok(!JSON.stringify(report).includes("你好"));
+  });
+
+  it("leaves names and texts alone without the flag", (t) => {
+    const p = project(t);
+    const r = spawnCli(["fixture", p.dir, "--out", p.out]);
+    assert.equal(r.status, 0, `stderr: ${r.stderr}`);
+    assert.equal(r.json.anonymized, false);
+    assert.equal(r.json.anonymization, undefined);
+    const doc = read(p.out, "draft_content.json");
+    assert.equal(JSON.parse(doc.materials.texts[0].content).text, MIXED);
+    assert.equal(doc.materials.videos[0].path, "/home/USER/Clients/Acme Corp/interview-final.MP4");
+  });
+
+  it("masks each script with a placeholder of the same UTF-16 length", () => {
+    const input = "Ａｂ１𠮷 Σж-ي é́ (42%)";
+    const { text, replaced } = maskText(input);
+    assert.equal(text, "Ｘｘ０\u{20000} Ωя-ب x́ (00%)");
+    assert.equal(text.length, input.length);
+    assert.equal(replaced, 10);
+  });
+
+  it("rewrites only the addressed strings and keeps every other byte", () => {
+    const raw = '{ "a" : [1.50, "keep", {"b":"x\\u00e9"}],\n "c": 12345678901234567890 }';
+    const out = replaceJsonStrings(raw, new Map([[JSON.stringify(["a", 2, "b"]), "y"]]));
+    assert.equal(out, '{ "a" : [1.50, "keep", {"b":"y"}],\n "c": 12345678901234567890 }');
+  });
+});
diff --git a/test/fixture-check.test.mjs b/test/fixture-check.test.mjs
index c8d3a0a..e604601 100644
--- a/test/fixture-check.test.mjs
+++ b/test/fixture-check.test.mjs
@@ -1,12 +1,14 @@
 import assert from "node:assert/strict";
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { after, describe, it } from "node:test";
 import { spawnCli } from "./helpers/spawn-cli.mjs";
 
 function project() {
-  const dir = mkdtempSync(join(tmpdir(), "capcut-fixture-check-"));
+  const root = mkdtempSync(join(tmpdir(), "capcut-fixture-check-"));
+  const dir = join(root, "project");
+  mkdirSync(dir);
   const draft = {
     id: "guid-fixture",
     name: "fixture-draft",
@@ -18,14 +20,14 @@ function project() {
     materials: { videos: [], audios: [], texts: [], speeds: [] },
   };
   writeFileSync(join(dir, "draft_content.json"), JSON.stringify(draft, null, 2));
-  return { dir, cleanup: () => rmSync(dir, { recursive: true, force: true }) };
+  return { dir, out: join(root, "bundle"), cleanup: () => rmSync(root, { recursive: true, force: true }) };
 }
 
 describe("fixture --check (redaction verification)", () => {
   it("redacts JSON-escaped Windows paths and embedded JSON without --check (#134)", () => {
     const p = project();
     after(p.cleanup);
-    const out = join(p.dir, "bundle");
+    const out = p.out;
     const privatePath = "C:\\Users\\Francesco Rossi\\AppData\\Local\\CapCut";
     writeFileSync(join(p.dir, "draft_meta_info.json"), JSON.stringify({ draft_root_path: privatePath }));
     const path = join(p.dir, "draft_content.json");
@@ -43,24 +45,32 @@ describe("fixture --check (redaction verification)", () => {
     assert.equal(JSON.parse(bundled.embedded).path, "C:\\Users\\USER\\AppData\\Local\\CapCut");
   });
 
-  it("fails bundle creation automatically when a recognizable username survives", () => {
+  it("fails bundle creation automatically when a device identifier survives", () => {
     const p = project();
     after(p.cleanup);
-    const out = join(p.dir, "bundle");
-    // Existing files in a reused output directory are part of the bundle too.
-    assert.equal(spawnCli(["fixture", p.dir, "--out", out]).status, 0);
-    writeFileSync(join(out, "unrecognized.json"), JSON.stringify({ a: "/home/USER/ok", b: "C:\\Users\\É\\secret" }));
+    const out = p.out;
+    // An escaped value the redactor leaves must still fail its automatic check.
+    const source = join(p.dir, "draft_content.json");
+    const draft = JSON.parse(readFileSync(source, "utf-8"));
+    draft.device_id = "synthetic\\device";
+    const original = JSON.stringify(draft);
+    writeFileSync(source, original);
     const r = spawnCli(["fixture", p.dir, "--out", out]);
     assert.equal(r.status, 1, r.stderr);
     assert.equal(r.json.ok, false);
     assert.equal(JSON.parse(readFileSync(join(out, "SANITIZE_REPORT.json"), "utf-8")).ok, false);
-    assert.ok(r.json.redaction_check.findings.some((finding) => finding.file === "unrecognized.json"));
-    assert.doesNotMatch(r.stderr, /É/);
+    assert.ok(
+      r.json.redaction_check.findings.some(
+        (finding) => finding.file === "draft_content.json" && finding.kind === "device-key",
+      ),
+    );
+    assert.doesNotMatch(r.stderr, /synthetic/);
+    assert.equal(readFileSync(source, "utf-8"), original);
   });
   it("builds a bundle and passes the check when nothing private survives", () => {
     const p = project();
     after(p.cleanup);
-    const out = join(p.dir, "bundle");
+    const out = p.out;
 
     const r = spawnCli(["fixture", p.dir, "--out", out, "--check"]);
     assert.equal(r.status, 0, `stderr: ${r.stderr}`);
@@ -72,7 +82,7 @@ describe("fixture --check (redaction verification)", () => {
   it("verify-only mode fails an existing bundle that leaks a home path, naming file and line", () => {
     const p = project();
     after(p.cleanup);
-    const out = join(p.dir, "bundle");
+    const out = p.out;
     assert.equal(spawnCli(["fixture", p.dir, "--out", out]).status, 0);
     writeFileSync(join(out, "leak.json"), JSON.stringify({ note: "/Users/hansmustermann/secret.mov" }));
 
@@ -90,7 +100,7 @@ describe("fixture --check (redaction verification)", () => {
   it("flags real emails and unredacted device keys, allows the redactor's placeholder", () => {
     const p = project();
     after(p.cleanup);
-    const out = join(p.dir, "bundle");
+    const out = p.out;
     assert.equal(spawnCli(["fixture", p.dir, "--out", out]).status, 0);
     writeFileSync(
       join(out, "extra.json"),
@@ -109,7 +119,7 @@ describe("fixture --check (redaction verification)", () => {
   it("allows the redactor's own USER home-path placeholder but flags a real account name", () => {
     const p = project();
     after(p.cleanup);
-    const out = join(p.dir, "bundle");
+    const out = p.out;
     assert.equal(spawnCli(["fixture", p.dir, "--out", out]).status, 0);
     // What a correctly redacted report looks like when the project lives under
     // a home directory (and what every Windows/macOS temp dir produces).
diff --git a/test/fixture-output.test.mjs b/test/fixture-output.test.mjs
new file mode 100644
index 0000000..439a2e9
--- /dev/null
+++ b/test/fixture-output.test.mjs
@@ -0,0 +1,130 @@
+import assert from "node:assert/strict";
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, it } from "node:test";
+import { sanitizeDraftBundle } from "../dist/fixture.js";
+import { spawnCli } from "./helpers/spawn-cli.mjs";
+
+function setup(t) {
+  const root = mkdtempSync(join(tmpdir(), "fixture-output-"));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const source = join(root, "project");
+  mkdirSync(source);
+  const draft = join(source, "draft_content.json");
+  const original = JSON.stringify({
+    id: "example-project",
+    name: "/home/example/clip.mp4",
+    tracks: [],
+    materials: { videos: [], texts: [], audios: [] },
+  });
+  writeFileSync(draft, original);
+  return { root, source, draft, original, out: join(root, "bundle") };
+}
+
+describe("fixture output isolation", () => {
+  for (const inputFile of [false, true]) {
+    it(`refuses the source directory when input is a ${inputFile ? "file" : "directory"}`, (t) => {
+      const f = setup(t);
+      assert.throws(() => sanitizeDraftBundle(inputFile ? f.draft : f.source, f.source), /new or empty/);
+      assert.equal(readFileSync(f.draft, "utf8"), f.original);
+      assert.deepEqual(readdirSync(f.source), ["draft_content.json"]);
+    });
+  }
+
+  it("returns a CLI error without changing the source", (t) => {
+    const f = setup(t);
+    const result = spawnCli(["fixture", f.source, "--out", f.source]);
+    assert.notEqual(result.status, 0);
+    assert.match(result.stderr, /new or empty/);
+    assert.equal(readFileSync(f.draft, "utf8"), f.original);
+  });
+
+  it("refuses occupied output without keeping unrelated media in a successful bundle", (t) => {
+    const f = setup(t);
+    mkdirSync(f.out);
+    writeFileSync(join(f.out, "recording.mp4"), "synthetic-media");
+    assert.throws(() => sanitizeDraftBundle(f.source, f.out), /new or empty/);
+    assert.deepEqual(readdirSync(f.out), ["recording.mp4"]);
+    assert.equal(readFileSync(join(f.out, "recording.mp4"), "utf8"), "synthetic-media");
+  });
+
+  it("refuses an existing output-file link without overwriting its target", {
+    skip: process.platform === "win32",
+  }, (t) => {
+    const f = setup(t);
+    mkdirSync(f.out);
+    const outside = join(f.root, "unrelated.json");
+    writeFileSync(outside, "keep");
+    symlinkSync(outside, join(f.out, "draft_content.json"));
+    assert.throws(() => sanitizeDraftBundle(f.source, f.out), /new or empty/);
+    assert.equal(readFileSync(outside, "utf8"), "keep");
+  });
+
+  it("refuses directory and dangling output links", { skip: process.platform === "win32" }, (t) => {
+    const f = setup(t);
+    const empty = join(f.root, "empty");
+    mkdirSync(empty);
+    symlinkSync(empty, f.out, "dir");
+    assert.throws(() => sanitizeDraftBundle(f.source, f.out), /new or empty/);
+    assert.deepEqual(readdirSync(empty), []);
+    rmSync(f.out);
+    symlinkSync(join(f.root, "absent"), f.out, "dir");
+    assert.throws(() => sanitizeDraftBundle(f.source, f.out), /new or empty/);
+    assert.equal(existsSync(join(f.root, "absent")), false);
+  });
+
+  it("refuses output inside the source before creating missing parents", (t) => {
+    const f = setup(t);
+    assert.throws(() => sanitizeDraftBundle(f.source, join(f.source, "new", "bundle")), /outside the source/);
+    assert.deepEqual(readdirSync(f.source), ["draft_content.json"]);
+  });
+
+  it("detects a source alias in an output ancestor", { skip: process.platform === "win32" }, (t) => {
+    const f = setup(t);
+    const alias = join(f.root, "alias");
+    symlinkSync(f.source, alias, "dir");
+    assert.throws(() => sanitizeDraftBundle(f.source, join(alias, "new", "bundle")), /outside the source/);
+    assert.deepEqual(readdirSync(f.source), ["draft_content.json"]);
+  });
+
+  for (const existing of [false, true]) {
+    it(`publishes a complete bundle to ${existing ? "empty" : "new nested"} output`, (t) => {
+      const f = setup(t);
+      const output = existing ? f.out : join(f.out, "parent", "export");
+      if (existing) mkdirSync(output);
+      const report = sanitizeDraftBundle(f.source, output);
+      assert.equal(report.ok, true);
+      assert.equal(report.media_excluded, true);
+      assert.equal(report.files.length, 1);
+      const saved = readFileSync(join(output, "SANITIZE_REPORT.json"), "utf8");
+      assert.ok(!saved.includes(".capcut-fixture-"));
+      assert.ok(existsSync(join(output, "README.md")));
+      assert.equal(readFileSync(f.draft, "utf8"), f.original);
+      assert.ok(!readdirSync(f.root).some((name) => name.startsWith(".capcut-fixture-")));
+    });
+  }
+
+  for (const existing of [false, true]) {
+    it(`keeps ${existing ? "empty output empty" : "new output absent"} after an input read failure`, (t) => {
+      const f = setup(t);
+      // This late timeline read fails after the first timeline has been staged.
+      mkdirSync(join(f.source, "draft_meta_info.json"));
+      if (existing) mkdirSync(f.out);
+      assert.throws(() => sanitizeDraftBundle(f.source, f.out));
+      if (existing) assert.deepEqual(readdirSync(f.out), []);
+      else assert.equal(existsSync(f.out), false);
+      assert.equal(readFileSync(f.draft, "utf8"), f.original);
+      assert.ok(!readdirSync(f.root).some((name) => name.startsWith(".capcut-fixture-")));
+    });
+  }
+});
diff --git a/test/helpers/fake-whisper.mjs b/test/helpers/fake-whisper.mjs
index 76b3729..e9b2186 100755
--- a/test/helpers/fake-whisper.mjs
+++ b/test/helpers/fake-whisper.mjs
@@ -3,7 +3,9 @@
 // the transcript named by FAKE_WHISPER_SOURCE into --output_dir under the
 // requested --output_format (json → transcript.json, srt → transcript.srt).
 // Lets caption's pipeline run end-to-end in tests without a model or audio.
-import { copyFileSync } from "node:fs";
+// With FAKE_WHISPER_CALLS set, every run appends one line to that file, so a
+// test can count how often the engine was invoked.
+import { appendFileSync, copyFileSync } from "node:fs";
 import { join } from "node:path";
 
 const args = process.argv.slice(2);
@@ -21,4 +23,5 @@ if (!outDir || !source) {
   process.stderr.write("fake-whisper: need --output_dir and FAKE_WHISPER_SOURCE\n");
   process.exit(2);
 }
+if (process.env.FAKE_WHISPER_CALLS) appendFileSync(process.env.FAKE_WHISPER_CALLS, `${args.join(" ")}\n`);
 copyFileSync(source, join(outDir, `transcript.${format}`));
diff --git a/test/helpers/spawn-cli.mjs b/test/helpers/spawn-cli.mjs
index 9f8c70c..e49bcba 100644
--- a/test/helpers/spawn-cli.mjs
+++ b/test/helpers/spawn-cli.mjs
@@ -25,13 +25,15 @@ export function spawnCli(args, opts = {}) {
     r = spawnSync("node", [CLI, ...args], {
       cwd: opts.cwd,
       input: opts.input,
-      // Isolate the app-version tripwire state per spawn (removed with
-      // captureDir) so mutating-command tests never touch the developer's
-      // real ~/.config/capcut-cli/app-versions.json. Tests that exercise the
-      // tripwire across invocations pass their own path via opts.env.
+      // Isolate the app-version tripwire state and the transcript cache per
+      // spawn (removed with captureDir) so tests never touch the developer's
+      // real ~/.config/capcut-cli/app-versions.json or ~/.cache/capcut-cli.
+      // Tests that exercise either across invocations pass their own path via
+      // opts.env.
       env: {
         ...process.env,
         CAPCUT_CLI_APP_VERSIONS: join(captureDir, "app-versions.json"),
+        CAPCUT_CLI_CACHE_DIR: join(captureDir, "transcripts"),
         ...(opts.env ?? {}),
       },
       timeout: opts.timeout ?? 30_000,
diff --git a/test/lint-pacing.test.mjs b/test/lint-pacing.test.mjs
new file mode 100644
index 0000000..3a6d4a3
--- /dev/null
+++ b/test/lint-pacing.test.mjs
@@ -0,0 +1,147 @@
+import assert from "node:assert/strict";
+import { readFileSync, writeFileSync } from "node:fs";
+import { describe, it } from "node:test";
+import { DEFAULT_LINT_OPTIONS, fixDraft, lintDraft } from "../dist/lint.js";
+import { spawnCli } from "./helpers/spawn-cli.mjs";
+import { tmpDraft } from "./helpers/tmp-draft.mjs";
+
+const opts = { ...DEFAULT_LINT_OPTIONS, checkLocalPaths: false, probeMedia: false };
+
+function seg(id, materialId, start, duration) {
+  return {
+    id,
+    material_id: materialId,
+    target_timerange: { start, duration },
+    source_timerange: { start: 0, duration },
+    speed: 1,
+    volume: 1,
+    visible: true,
+    clip: { alpha: 1, rotation: 0, scale: { x: 1, y: 1 }, transform: { x: 0, y: 0 } },
+    extra_material_refs: [],
+    render_index: 0,
+  };
+}
+
+const track = (type, name, segments) => ({ id: name, type, name, attribute: 0, segments });
+
+// A still held 10 s, a 15 s shot, a 2 s still and an 8 s still on the main
+// track; a 20 s picture-in-picture shot on an overlay track.
+function pacedDraft() {
+  return {
+    fps: 30,
+    duration: 35_000_000,
+    canvas_config: { width: 1080, height: 1920, ratio: "9:16" },
+    materials: {
+      videos: [
+        { id: "p", type: "photo", path: "", duration: 10_800_000_000 },
+        { id: "v", type: "video", path: "", duration: 60_000_000 },
+      ],
+      audios: [],
+      texts: [],
+      speeds: [],
+    },
+    tracks: [
+      track("video", "main", [
+        seg("still-long", "p", 0, 10_000_000),
+        seg("shot-long", "v", 10_000_000, 15_000_000),
+        seg("still-short", "p", 25_000_000, 2_000_000),
+        seg("still-edge", "p", 27_000_000, 8_000_000),
+      ]),
+      track("video", "overlay", [seg("pip-long", "v", 0, 20_000_000)]),
+    ],
+  };
+}
+
+const codes = (issues, code) => issues.filter((issue) => issue.code === code);
+
+describe("lint pacing — still-too-long and shot-too-long", () => {
+  it("runs neither check unless its threshold is given", () => {
+    const issues = lintDraft(pacedDraft(), opts);
+    assert.deepEqual(codes(issues, "still-too-long"), []);
+    assert.deepEqual(codes(issues, "shot-too-long"), []);
+  });
+
+  it("reports a still image that plays longer than --max-still-secs", () => {
+    const issues = codes(lintDraft(pacedDraft(), { ...opts, maxStillUs: 8_000_000 }), "still-too-long");
+    assert.deepEqual(
+      issues.map((issue) => [issue.location.segment_id, issue.location.track, issue.severity, issue.fixable]),
+      [["still-long", "main", "warning", false]],
+      "the 2 s still and the still of exactly 8 s are not longer than the limit",
+    );
+    assert.equal(
+      issues[0].message,
+      'Still image still-lo on video track "main" starts at 0s and plays 10s, longer than the 8s --max-still-secs limit',
+    );
+    assert.deepEqual(codes(lintDraft(pacedDraft(), { ...opts, maxStillUs: 8_000_000 }), "shot-too-long"), []);
+  });
+
+  it("reports every video clip, overlays included, longer than --max-shot-secs and never a still", () => {
+    const issues = codes(lintDraft(pacedDraft(), { ...opts, maxShotUs: 12_000_000 }), "shot-too-long");
+    assert.deepEqual(
+      issues.map((issue) => [issue.location.segment_id, issue.location.track]),
+      [
+        ["shot-long", "main"],
+        ["pip-long", "overlay"],
+      ],
+    );
+    assert.match(
+      issues[0].message,
+      /^Video clip shot-lon on video track "main" starts at 10s and plays 15s, longer than the 12s --max-shot-secs limit$/,
+    );
+    assert.deepEqual(codes(lintDraft(pacedDraft(), { ...opts, maxShotUs: 12_000_000 }), "still-too-long"), []);
+  });
+
+  it("skips a segment whose material is missing and stays report-only under --fix", () => {
+    const draft = pacedDraft();
+    draft.tracks[0].segments[0].material_id = "gone";
+    const strict = { ...opts, maxStillUs: 1_000_000, maxShotUs: 1_000_000 };
+    const issues = lintDraft(draft, strict);
+    assert.ok(!issues.some((issue) => issue.location?.segment_id === "still-long" && issue.code.endsWith("-too-long")));
+    const { fixed, remaining } = fixDraft(draft, strict);
+    assert.ok(!fixed.some((issue) => issue.code === "still-too-long" || issue.code === "shot-too-long"));
+    assert.equal(codes(remaining, "still-too-long").length, 2);
+    assert.equal(codes(remaining, "shot-too-long").length, 2);
+  });
+});
+
+describe("lint pacing — on the command line", () => {
+  it("--max-still-secs and --max-shot-secs warn with exit 1; without them the result is unchanged", (t) => {
+    const fix = tmpDraft();
+    t.after(fix.cleanup);
+    const draft = JSON.parse(readFileSync(fix.path, "utf-8"));
+    draft.materials.videos[0].type = "photo"; // the first 5 s clip becomes a still
+    writeFileSync(fix.path, JSON.stringify(draft));
+
+    const plain = spawnCli(["lint", fix.path, "--no-check-paths", "--no-probe"]);
+    assert.equal(plain.status, 0, plain.stdout);
+    assert.equal(plain.json.summary.total, 0);
+
+    const still = spawnCli(["lint", fix.path, "--no-check-paths", "--no-probe", "--max-still-secs", "4"]);
+    assert.equal(still.status, 1, still.stdout);
+    assert.deepEqual(
+      still.json.issues.map((issue) => [issue.code, issue.location.segment_id]),
+      [["still-too-long", draft.tracks[0].segments[0].id]],
+    );
+
+    const shot = spawnCli(["lint", fix.path, "--no-check-paths", "--no-probe", "--max-shot-secs", "4.5", "-H"]);
+    assert.equal(shot.status, 1, shot.stdout);
+    assert.match(
+      shot.stdout,
+      /WARNING shot-too-long +\[aaaaaa02\] +Video clip aaaaaa02 on video track "Track 1" starts at 5s and plays 5s, longer than the 4\.5s --max-shot-secs limit/,
+    );
+  });
+
+  it("refuses a threshold that is not a positive number of seconds", (t) => {
+    const fix = tmpDraft();
+    t.after(fix.cleanup);
+    for (const [flag, value] of [
+      ["--max-still-secs", "0"],
+      ["--max-shot-secs", "-2"],
+      ["--max-shot-secs", "long"],
+    ]) {
+      const r = spawnCli(["lint", fix.path, flag, value]);
+      assert.equal(r.status, 1, `${flag} ${value}`);
+      assert.match(r.stderr, new RegExp(`${flag} must be a number of seconds > 0`));
+    }
+  });
+});
diff --git a/test/lint-silent-stretch.test.mjs b/test/lint-silent-stretch.test.mjs
new file mode 100644
index 0000000..e512616
--- /dev/null
+++ b/test/lint-silent-stretch.test.mjs
@@ -0,0 +1,149 @@
+import assert from "node:assert/strict";
+import { readFileSync, writeFileSync } from "node:fs";
+import { describe, it } from "node:test";
+import { DEFAULT_LINT_OPTIONS, lintDraft } from "../dist/lint.js";
+import { spawnCli } from "./helpers/spawn-cli.mjs";
+import { tmpDraft } from "./helpers/tmp-draft.mjs";
+
+const opts = { ...DEFAULT_LINT_OPTIONS, checkLocalPaths: false, probeMedia: false };
+
+function seg(id, materialId, start, duration, extra = {}) {
+  return {
+    id,
+    material_id: materialId,
+    target_timerange: { start, duration },
+    source_timerange: { start: 0, duration },
+    speed: 1,
+    volume: 1,
+    visible: true,
+    clip: null,
+    extra_material_refs: [],
+    render_index: 0,
+    ...extra,
+  };
+}
+
+const track = (type, name, segments, attribute = 0) => ({ id: name, type, name, attribute, segments });
+
+// A 30 s draft whose music bed stops from 10 s to 18 s.
+function bedWithGap(extraTracks = [], videos = []) {
+  return {
+    fps: 30,
+    duration: 30_000_000,
+    canvas_config: { width: 1920, height: 1080, ratio: "16:9" },
+    materials: {
+      videos: [
+        { id: "v", type: "video", path: "", duration: 60_000_000 },
+        { id: "p", type: "photo", path: "", duration: 10_800_000_000 },
+        ...videos,
+      ],
+      audios: [{ id: "m", type: "extract_music", path: "", duration: 60_000_000 }],
+      texts: [],
+      speeds: [],
+    },
+    tracks: [
+      track("audio", "music", [seg("bed-a", "m", 0, 10_000_000), seg("bed-b", "m", 18_000_000, 12_000_000)]),
+      ...extraTracks,
+    ],
+  };
+}
+
+const stretches = (draft, minUs) =>
+  lintDraft(draft, { ...opts, minSilentUs: minUs })
+    .filter((issue) => issue.code === "silent-stretch")
+    .map((issue) => issue.message.match(/from (\S+) to (\S+) \((\S+),/).slice(1));
+
+const cover = (materialId, extra = {}, attribute = 0) => [
+  track("video", "main", [seg("clip", materialId, 9_000_000, 10_000_000, extra)], attribute),
+];
+
+describe("lint silent-stretch — ranges where nothing audible plays", () => {
+  it("does not run without --min-silent-secs", () => {
+    assert.deepEqual(
+      lintDraft(bedWithGap(), opts).filter((issue) => issue.code === "silent-stretch"),
+      [],
+    );
+  });
+
+  it("reports the gap in a music bed once it is at least the limit", () => {
+    const [issue] = lintDraft(bedWithGap(), { ...opts, minSilentUs: 5_000_000 }).filter(
+      (i) => i.code === "silent-stretch",
+    );
+    assert.equal(issue.severity, "warning");
+    assert.equal(issue.fixable, false);
+    assert.equal(
+      issue.message,
+      "Nothing audible plays from 10s to 18s (8s, at least the 5s --min-silent-secs limit): " +
+        "no audio clip above volume 0 and no video clip with its own sound covers it",
+    );
+    assert.deepEqual(stretches(bedWithGap(), 8_000_000), [["10s", "18s", "8s"]], "exactly the limit counts");
+    assert.deepEqual(stretches(bedWithGap(), 9_000_000), []);
+  });
+
+  it("a video clip that carries sound covers the gap, unless its track is muted", () => {
+    assert.deepEqual(stretches(bedWithGap(cover("v")), 5_000_000), []);
+    assert.deepEqual(stretches(bedWithGap(cover("v", {}, 1)), 5_000_000), [["10s", "18s", "8s"]]);
+  });
+
+  it("counts a clip as silent only when the draft says so", () => {
+    // Silent: a photo, a clip whose sound was separated, a clip at volume 0.
+    const separated = { id: "s", type: "video", path: "", duration: 60_000_000, has_sound_separated: true };
+    assert.deepEqual(stretches(bedWithGap(cover("p")), 5_000_000), [["10s", "18s", "8s"]]);
+    assert.deepEqual(stretches(bedWithGap(cover("s"), [separated]), 5_000_000), [["10s", "18s", "8s"]]);
+    assert.deepEqual(stretches(bedWithGap(cover("v", { volume: 0 })), 5_000_000), [["10s", "18s", "8s"]]);
+    // Unsure, so counted as sound: a material the draft does not hold, and a
+    // muted clip whose volume is keyframed.
+    assert.deepEqual(stretches(bedWithGap(cover("unknown")), 5_000_000), []);
+    const keyed = {
+      volume: 0,
+      common_keyframes: [{ property_type: "KFTypeVolume", keyframe_list: [{ id: "k", time_offset: 0, values: [1] }] }],
+    };
+    assert.deepEqual(stretches(bedWithGap(cover("v", keyed)), 5_000_000), []);
+  });
+
+  it("a muted music track leaves only what else plays, inside the timeline's end", () => {
+    const draft = bedWithGap([track("text", "subs", [seg("cap", "t", 0, 20_000_000)])]);
+    draft.tracks[0].attribute = 1;
+    draft.duration = 60_000_000; // longer than anything on the timeline
+    assert.deepEqual(stretches(draft, 5_000_000), [["0s", "30s", "30s"]]);
+    draft.tracks[0].attribute = 0;
+    draft.tracks[0].segments = [seg("bed", "m", 5_000_000, 10_000_000)];
+    assert.deepEqual(
+      stretches(draft, 3_000_000),
+      [
+        ["0s", "5s", "5s"],
+        ["15s", "20s", "5s"],
+      ],
+      "leading and trailing silence, the end being the last segment on any track",
+    );
+  });
+});
+
+describe("lint silent-stretch — on the command line", () => {
+  it("--min-silent-secs warns with exit 1; without it the result is unchanged", (t) => {
+    const fix = tmpDraft();
+    t.after(fix.cleanup);
+    const draft = JSON.parse(readFileSync(fix.path, "utf-8"));
+    draft.tracks.find((tr) => tr.type === "video").attribute = 1; // muted
+    const [bed] = draft.tracks.find((tr) => tr.type === "audio").segments;
+    bed.target_timerange = { start: 4_000_000, duration: 6_000_000 };
+    bed.source_timerange = { start: 0, duration: 6_000_000 };
+    writeFileSync(fix.path, JSON.stringify(draft));
+
+    const plain = spawnCli(["lint", fix.path, "--no-check-paths", "--no-probe"]);
+    assert.equal(plain.status, 0, plain.stdout);
+    assert.equal(plain.json.summary.total, 0);
+
+    const gated = spawnCli(["lint", fix.path, "--no-check-paths", "--no-probe", "--min-silent-secs", "3"]);
+    assert.equal(gated.status, 1, gated.stdout);
+    assert.deepEqual(
+      gated.json.issues.map((issue) => [issue.code, issue.severity]),
+      [["silent-stretch", "warning"]],
+    );
+    assert.match(gated.json.issues[0].message, /^Nothing audible plays from 0s to 4s \(4s,/);
+
+    const refused = spawnCli(["lint", fix.path, "--min-silent-secs", "0"]);
+    assert.equal(refused.status, 1);
+    assert.match(refused.stderr, /--min-silent-secs must be a number of seconds > 0/);
+  });
+});
diff --git a/test/loudness-gate.test.mjs b/test/loudness-gate.test.mjs
new file mode 100644
index 0000000..9490126
--- /dev/null
+++ b/test/loudness-gate.test.mjs
@@ -0,0 +1,231 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { describe, it } from "node:test";
+import { judgeLoudness } from "../dist/loudness.js";
+import { spawnCli } from "./helpers/spawn-cli.mjs";
+import { tmpDraft } from "./helpers/tmp-draft.mjs";
+
+const hasFfmpeg = spawnSync("ffmpeg", ["-version"], { encoding: "utf-8" }).status === 0;
+
+// lavfi's 1 kHz sine reads about -21.1 LUFS with a -18.1 dBTP true peak; at
+// -10 dB that is about -31.1 LUFS and -28.1 dBTP. The levels below keep
+// several LU of margin around those readings.
+function toneDraft(t, db) {
+  const fix = tmpDraft();
+  t.after(fix.cleanup);
+  const tone = join(fix.dir, "tone.wav");
+  const made = spawnSync(
+    "ffmpeg",
+    [
+      "-hide_banner",
+      "-loglevel",
+      "error",
+      "-f",
+      "lavfi",
+      "-i",
+      "sine=frequency=1000:duration=5",
+      "-af",
+      `volume=${db}dB`,
+      tone,
+    ],
+    { encoding: "utf-8" },
+  );
+  assert.equal(made.status, 0, made.stderr);
+  const draft = JSON.parse(readFileSync(fix.path, "utf-8"));
+  draft.tracks = draft.tracks.filter((tr) => tr.type === "audio");
+  const [segment] = draft.tracks[0].segments;
+  segment.volume = 1;
+  segment.target_timerange = { start: 0, duration: 5_000_000 };
+  segment.source_timerange = { start: 0, duration: 5_000_000 };
+  draft.materials.audios[0].path = tone;
+  writeFileSync(fix.path, JSON.stringify(draft));
+  return fix;
+}
+
+const volumeOf = (path) => JSON.parse(readFileSync(path, "utf-8")).tracks[0].segments[0].volume;
+
+describe("loudness gate — --tolerance and --max-true-peak on the judged mix", () => {
+  it("without a tolerance or a ceiling the result and exit code stay as they were", { skip: !hasFfmpeg }, (t) => {
+    const f = toneDraft(t, -10);
+    const r = spawnCli(["loudness", f.path, "--target", "-14"]);
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(r.json.ok, true);
+    assert.equal(r.json.gate, undefined);
+    assert.equal(r.stderr, "");
+  });
+
+  it("passes when the mix as it stands is within the tolerance", { skip: !hasFfmpeg }, (t) => {
+    const f = toneDraft(t, -10);
+    const r = spawnCli(["loudness", f.path, "--target", "-31", "--tolerance", "1"]);
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(r.json.ok, true);
+    assert.equal(r.json.gate.target, -31);
+    assert.equal(r.json.gate.tolerance, 1);
+    assert.equal(r.json.gate.within, true);
+    assert.equal(r.json.gate.estimate_lufs, r.json.program_lufs, "without --apply the mix as it stands is judged");
+    assert.equal(r.json.gate.true_peak_ok, undefined, "no ceiling, no peak verdict");
+    assert.equal(r.stderr, "");
+  });
+
+  it("exits 1 with a one-line reason when the mix misses the tolerance", { skip: !hasFfmpeg }, (t) => {
+    const f = toneDraft(t, -10);
+    const r = spawnCli(["loudness", f.path, "--target", "-14", "--tolerance", "1"]);
+    assert.equal(r.status, 1);
+    assert.equal(r.json.ok, false);
+    assert.equal(r.json.gate.within, false);
+    assert.ok(r.json.gate.estimate_lufs < -25, `estimate ${r.json.gate.estimate_lufs}`);
+    assert.equal(r.stderr.trim().split("\n").length, 1, r.stderr);
+    assert.match(
+      r.stderr,
+      /^loudness gate failed: the mix as it stands is estimated at -3\d(\.\d+)? LUFS, .* below the -14 LUFS target \(tolerance 1 LU\)/,
+    );
+    assert.equal(volumeOf(f.path), 1, "no --apply, nothing written");
+  });
+
+  it("with --apply judges the mix after the gain, and the cap can make it miss", { skip: !hasFfmpeg }, (t) => {
+    const f = toneDraft(t, -10);
+    const reached = spawnCli(["loudness", f.path, "--target", "-20", "--tolerance", "0.5", "--apply"]);
+    assert.equal(reached.status, 0, reached.stderr);
+    assert.equal(reached.json.ok, true);
+    assert.equal(reached.json.gate.within, true);
+    assert.ok(Math.abs(reached.json.gate.estimate_lufs - -20) < 0.05, `estimate ${reached.json.gate.estimate_lufs}`);
+    assert.ok(reached.json.program_lufs < -25, "program_lufs still reports the mix before the gain");
+    assert.ok(volumeOf(f.path) > 3, "the gain is written");
+    // Measured again, the written volume reads as the gate predicted.
+    const again = spawnCli(["loudness", f.path]);
+    assert.equal(again.json.program_lufs, reached.json.gate.estimate_lufs);
+
+    const g = toneDraft(t, -10);
+    const capped = spawnCli([
+      "loudness",
+      g.path,
+      "--target",
+      "-14",
+      "--tolerance",
+      "1",
+      "--apply",
+      "--max-gain-db",
+      "5",
+    ]);
+    assert.equal(capped.status, 1);
+    assert.equal(capped.json.ok, false);
+    assert.equal(capped.json.gate.within, false);
+    assert.ok(Math.abs(capped.json.gate.estimate_lufs - (capped.json.program_lufs + 5)) < 0.05);
+    assert.match(capped.stderr, /the mix after this run's gain .* --max-gain-db 5 capped the boost/);
+    assert.equal(capped.json.applied, true, "the capped gain is still written, as lint --fix writes its repairs");
+    assert.equal(capped.json.changed, 1);
+    assert.ok(Math.abs(volumeOf(g.path) - 10 ** (5 / 20)) < 0.001);
+  });
+
+  it("--max-true-peak judges the loudest clip at the volume judged", { skip: !hasFfmpeg }, (t) => {
+    const f = toneDraft(t, -10);
+    const over = spawnCli(["loudness", f.path, "--max-true-peak", "-35"]);
+    assert.equal(over.status, 1);
+    assert.equal(over.json.ok, false);
+    assert.equal(over.json.gate.max_true_peak, -35);
+    assert.equal(over.json.gate.true_peak_ok, false);
+    assert.equal(over.json.gate.within, undefined, "no tolerance, no loudness verdict");
+    assert.match(over.stderr, /peaks at -2\d(\.\d+)? dBTP, above the -35 dBTP ceiling/);
+
+    const under = spawnCli(["loudness", f.path, "--max-true-peak", "-20"]);
+    assert.equal(under.status, 0, under.stderr);
+    assert.equal(under.json.gate.true_peak_ok, true);
+    assert.ok(under.json.gate.estimate_true_peak < -25);
+
+    // The same ceiling fails once this run's +11 dB gain is judged.
+    const boosted = spawnCli([
+      "loudness",
+      f.path,
+      "--target",
+      "-20",
+      "--tolerance",
+      "1",
+      "--max-true-peak",
+      "-20",
+      "--apply",
+      "--dry-run",
+    ]);
+    assert.equal(boosted.status, 1);
+    assert.equal(boosted.json.gate.within, true);
+    assert.equal(boosted.json.gate.true_peak_ok, false);
+    assert.ok(boosted.json.gate.estimate_true_peak > -20);
+    assert.equal(volumeOf(f.path), 1, "--dry-run writes nothing");
+  });
+
+  it("refuses --tolerance without a target and values that are not numbers", (t) => {
+    const fix = tmpDraft();
+    t.after(fix.cleanup);
+    assert.match(spawnCli(["loudness", fix.path, "--tolerance", "1"]).stderr, /--tolerance needs --target/);
+    assert.match(
+      spawnCli(["loudness", fix.path, "--target", "-14", "--tolerance", "-1"]).stderr,
+      /--tolerance must be a number of LU >= 0/,
+    );
+    assert.match(
+      spawnCli(["loudness", fix.path, "--max-true-peak", "loud"]).stderr,
+      /--max-true-peak must be a true-peak level in dBTP/,
+    );
+  });
+});
+
+describe("judgeLoudness", () => {
+  const report = () => ({
+    mode: "uniform",
+    program_lufs: -20,
+    target: -14,
+    max_gain_db: 3,
+    clips: [
+      {
+        segment_id: "c1",
+        track: "AAA",
+        path: "a.wav",
+        duration_us: 1_000_000,
+        volume: 1,
+        measured_lufs: -20,
+        true_peak_dbfs: -6,
+        effective_lufs: -20,
+        gain_db: 3,
+        new_volume: 1.4125,
+        clamped: true,
+      },
+    ],
+  });
+
+  it("is null without a tolerance or a ceiling", () => {
+    assert.equal(judgeLoudness(report(), {}), null);
+  });
+
+  it("judges the mix as it stands, or after the gain", () => {
+    const standing = judgeLoudness(report(), { tolerance: 1 });
+    assert.deepEqual(standing.gate, { target: -14, tolerance: 1, estimate_lufs: -20, within: false });
+    assert.match(standing.failure, /as it stands is estimated at -20 LUFS, 6 LU below/);
+
+    const after = judgeLoudness(report(), { tolerance: 2, afterGain: true });
+    assert.equal(after.gate.estimate_lufs, -17);
+    assert.equal(after.gate.within, false);
+    assert.match(after.failure, /after this run's gain .* --max-gain-db 3 capped the boost/);
+    assert.equal(judgeLoudness(report(), { tolerance: 3, afterGain: true }).failure, null, "the edge counts as within");
+  });
+
+  it("judges the true peak at the volume judged", () => {
+    assert.equal(judgeLoudness(report(), { maxTruePeak: -4 }).gate.true_peak_ok, true);
+    const after = judgeLoudness(report(), { maxTruePeak: -4, afterGain: true });
+    assert.equal(after.gate.estimate_true_peak, -3);
+    assert.equal(after.gate.true_peak_ok, false);
+    assert.match(after.failure, /peaks at -3 dBTP, above the -4 dBTP ceiling/);
+  });
+
+  it("fails what it cannot measure and refuses a tolerance without a target", () => {
+    const silent = report();
+    silent.program_lufs = null;
+    Object.assign(silent.clips[0], { measured_lufs: null, effective_lufs: null, true_peak_dbfs: null });
+    const judged = judgeLoudness(silent, { tolerance: 1, maxTruePeak: -1 });
+    assert.equal(judged.gate.within, false);
+    assert.equal(judged.gate.true_peak_ok, false);
+    assert.match(judged.failure, /loudness cannot be judged; .* true peak cannot be judged/);
+    const untargeted = report();
+    delete untargeted.target;
+    assert.throws(() => judgeLoudness(untargeted, { tolerance: 1 }), /--tolerance needs --target/);
+  });
+});
diff --git a/test/render-caption-fonts.test.mjs b/test/render-caption-fonts.test.mjs
new file mode 100644
index 0000000..08f3470
--- /dev/null
+++ b/test/render-caption-fonts.test.mjs
@@ -0,0 +1,214 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, it } from "node:test";
+import { buildRenderPlan, probeFfmpegCapabilities } from "../dist/render.js";
+import { spawnCli } from "./helpers/spawn-cli.mjs";
+
+// `render --burn-captions` draws each caption in its text material's own font
+// file (drawtext fontfile=) when the draft names one that exists, and keeps
+// ffmpeg's default face otherwise; `caption_fonts` counts both.
+
+const US = 1_000_000;
+const isWindows = process.platform === "win32"; // ':' and '\' are not file-name characters there
+
+function scratch(t) {
+  const dir = mkdtempSync(join(tmpdir(), "capcut-render-fonts-"));
+  t.after(() => rmSync(dir, { recursive: true, force: true }));
+  return dir;
+}
+
+/** A font-shaped file: drawtext is never run on it in the plan tests. */
+function fakeFont(dir, name = "Caption.ttf") {
+  const path = join(dir, name);
+  writeFileSync(path, "not a real font");
+  return path;
+}
+
+/** One video clip and one caption per entry of `texts` ({ content, font_path }). */
+function draftWith(dir, texts) {
+  const clip = join(dir, "clip.mp4");
+  if (!existsSync(clip)) writeFileSync(clip, "");
+  const seg = (id, matId, start, dur) => ({
+    id,
+    material_id: matId,
+    target_timerange: { start, duration: dur },
+    source_timerange: { start: 0, duration: dur },
+    speed: 1,
+    volume: 1,
+    visible: true,
+    clip: null,
+    extra_material_refs: [],
+    render_index: 0,
+  });
+  return {
+    id: "d",
+    name: "fonts",
+    duration: 2 * US,
+    fps: 30,
+    canvas_config: { width: 720, height: 1280, ratio: "9:16" },
+    tracks: [
+      { id: "tv", type: "video", name: "video", attribute: 0, segments: [seg("sv", "mv", 0, 2 * US)] },
+      {
+        id: "tt",
+        type: "text",
+        name: "captions",
+        attribute: 0,
+        segments: texts.map((_, i) => seg(`st${i}`, `mt${i}`, i * 500_000, 400_000)),
+      },
+    ],
+    materials: {
+      videos: [{ id: "mv", path: clip, type: "video", duration: 2 * US, width: 320, height: 240 }],
+      audios: [],
+      texts: texts.map((text, i) => ({ id: `mt${i}`, type: "text", ...text })),
+      speeds: [],
+      material_animations: [],
+      audio_fades: [],
+      transitions: [],
+    },
+  };
+}
+
+/** How a path appears inside drawtext's quoted fontfile option. */
+const escapedPath = (path) => path.replace(/\\/g, "\\\\").replace(/:/g, "\\:");
+
+const content = (text, fontPath) =>
+  JSON.stringify({
+    text,
+    styles: [{ range: [0, text.length], size: 15, ...(fontPath ? { font: { id: "", path: fontPath } } : {}) }],
+  });
+
+describe("render --burn-captions — draft fonts (plan)", () => {
+  it("passes the material's font_path to drawtext as fontfile", (t) => {
+    const dir = scratch(t);
+    const font = fakeFont(dir);
+    const plan = buildRenderPlan(draftWith(dir, [{ content: content("Hello"), font_path: font }]), {
+      out: join(dir, "p.mp4"),
+      burnCaptions: true,
+    });
+    assert.ok(plan.filterComplex.includes(`drawtext=text='Hello':fontfile='${escapedPath(font)}':`));
+    assert.deepEqual(plan.caption_fonts, { from_draft: 1, default: 0 });
+  });
+
+  it("prefers the content's style font, which CapCut renders from, over font_path", (t) => {
+    const dir = scratch(t);
+    const styled = fakeFont(dir, "Styled.otf");
+    const material = fakeFont(dir, "Material.ttf");
+    const plan = buildRenderPlan(draftWith(dir, [{ content: content("Hi", styled), font_path: material }]), {
+      out: join(dir, "p.mp4"),
+      burnCaptions: true,
+    });
+    assert.match(plan.filterComplex, /fontfile='[^']*Styled\.otf'/);
+    assert.doesNotMatch(plan.filterComplex, /Material\.ttf/);
+  });
+
+  it("falls back to font_path, then to ffmpeg's default face", (t) => {
+    const dir = scratch(t);
+    const ttc = fakeFont(dir, "Collection.TTC");
+    mkdirSync(join(dir, "folder.ttf"));
+    const texts = [
+      { content: content("One", join(dir, "missing.ttf")), font_path: ttc }, // missing style font -> font_path
+      { content: content("Two"), font_path: join(dir, "absent.ttf") }, // file does not exist
+      { content: content("Three"), font_path: fakeFont(dir, "web.woff2") }, // not a font type drawtext reads
+      { content: content("Four"), font_path: join(dir, "folder.ttf") }, // a directory
+      { content: content("Five"), font_path: fakeFont(dir, "it's.ttf") }, // a quote cannot be written in the graph
+      { content: content("Six") }, // no font named at all
+    ];
+    const plan = buildRenderPlan(draftWith(dir, texts), { out: join(dir, "p.mp4"), burnCaptions: true });
+    assert.deepEqual(plan.caption_fonts, { from_draft: 1, default: 5 });
+    assert.equal((plan.filterComplex.match(/fontfile=/g) ?? []).length, 1);
+    assert.match(plan.filterComplex, /drawtext=text='One':fontfile='[^']*Collection\.TTC':/);
+    for (const text of ["Two", "Three", "Four", "Five", "Six"]) {
+      assert.match(plan.filterComplex, new RegExp(`drawtext=text='${text}':fontcolor=`));
+    }
+  });
+
+  it("escapes a font path so it cannot leave the fontfile option", { skip: isWindows }, (t) => {
+    const dir = scratch(t);
+    const odd = join(dir, "fonts, [a]; b:c\\d");
+    mkdirSync(odd);
+    const font = fakeFont(odd, "x:fontcolor=red.ttf");
+    const plan = buildRenderPlan(draftWith(dir, [{ content: content("Hey"), font_path: font }]), {
+      out: join(dir, "p.mp4"),
+      burnCaptions: true,
+    });
+    assert.ok(plan.filterComplex.includes(`fontfile='${escapedPath(font)}':fontcolor=white`), plan.filterComplex);
+    assert.ok(escapedPath(font).endsWith("x\\:fontcolor=red.ttf"), "the colon in the file name is escaped");
+    assert.deepEqual(plan.caption_fonts, { from_draft: 1, default: 0 });
+  });
+
+  it("reports no caption_fonts without --burn-captions", (t) => {
+    const dir = scratch(t);
+    const plan = buildRenderPlan(draftWith(dir, [{ content: content("Hello"), font_path: fakeFont(dir) }]), {
+      out: join(dir, "p.mp4"),
+    });
+    assert.equal(plan.caption_fonts, undefined);
+    assert.doesNotMatch(plan.filterComplex, /fontfile/);
+  });
+
+  it("--dry-run plans carry caption_fonts", (t) => {
+    const dir = scratch(t);
+    const draftPath = join(dir, "draft_content.json");
+    writeFileSync(
+      draftPath,
+      JSON.stringify(
+        draftWith(dir, [{ content: content("Hello"), font_path: fakeFont(dir) }, { content: content("World") }]),
+      ),
+    );
+    const r = spawnCli(["render", draftPath, "--out", join(dir, "p.mp4"), "--burn-captions", "--dry-run"]);
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(r.json.executed, false);
+    assert.deepEqual(r.json.caption_fonts, { from_draft: 1, default: 1 });
+  });
+});
+
+// A real render needs ffmpeg with drawtext and a font on the machine.
+const SYSTEM_FONTS = [
+  "/usr/share/fonts/truetype/dejavu/DejaVuSans.ttf",
+  "/usr/share/fonts/dejavu/DejaVuSans.ttf",
+  "/usr/share/fonts/TTF/DejaVuSans.ttf",
+  "/usr/share/fonts/truetype/liberation/LiberationSans-Regular.ttf",
+  "/System/Library/Fonts/Supplemental/Arial.ttf",
+  "/Library/Fonts/Arial.ttf",
+];
+const systemFont = SYSTEM_FONTS.find((path) => existsSync(path));
+const hasFfmpeg = spawnSync("ffmpeg", ["-version"], { encoding: "utf-8" }).status === 0;
+const canBurn = !isWindows && hasFfmpeg && systemFont !== undefined && probeFfmpegCapabilities("ffmpeg").drawtext;
+
+describe("render --burn-captions — draft fonts (ffmpeg)", () => {
+  it("renders captions in the draft's font, even from an awkward path", { skip: !canBurn }, (t) => {
+    const dir = scratch(t);
+    const odd = join(dir, "fonts, [a]; b:c");
+    mkdirSync(odd);
+    const font = join(odd, "Caption Font.ttf");
+    copyFileSync(systemFont, font);
+    const draft = draftWith(dir, [{ content: content("Hello"), font_path: font }]);
+    const clip = join(dir, "clip.mp4");
+    const gen = spawnSync(
+      "ffmpeg",
+      [
+        "-y",
+        "-loglevel",
+        "error",
+        "-f",
+        "lavfi",
+        "-i",
+        "testsrc=duration=2:size=320x240:rate=15",
+        "-pix_fmt",
+        "yuv420p",
+        clip,
+      ],
+      { encoding: "utf-8" },
+    );
+    assert.equal(gen.status, 0, gen.stderr);
+    const draftPath = join(dir, "draft_content.json");
+    writeFileSync(draftPath, JSON.stringify(draft));
+    const out = join(dir, "preview.mp4");
+    const r = spawnCli(["render", draftPath, "--out", out, "--burn-captions"], { timeout: 120_000 });
+    assert.equal(r.status, 0, r.stderr);
+    assert.deepEqual(r.json.caption_fonts, { from_draft: 1, default: 0 });
+    assert.ok(existsSync(out) && statSync(out).size > 0, "expected a non-empty proxy file");
+  });
+});