[P3 follow-up] keyframe validation/real-pass counter divergence at degenerate scale (>2000 rules)

[project820]

Follow-up from PR #56 delta review (SHIP; non-blocking).

registerCssKeyframes validates frames in an isolated context (counters from 0), while real emission charges the shared document context. When model CSS exceeds CSS_MAX_RULES (2000) or CSS_MAX_DECLARATIONS (20000) before a registered @Keyframes, the real pass strips the definition while animation:he-kN references were already rewritten → silently inert animation (bounded; no crash/data loss). Twin cosmetic case: keyframes whose only decls are animation-* can emit as an orphan definition.

Fix direction: two-phase emission (drop dead names before reference rewrite) or exempt registered survivors' frames from shared counters so both passes see identical budgets.

Source: architect delta review on b0eefcd (src/main/html-export-css-sanitize.ts:424-440).

[project820]

🤖 Psycho-842 [BOT] triage

ℹ️ TRIAGE — the shared CSS rule cap can leave a rewritten animation without its emitted keyframes definition.

Summary

Pre-registration validates @keyframes with isolated counters, while final sanitization spends the document-wide rule budget.
After 2,000 preceding rules, the definition is stripped but an earlier animation:fade reference has already been rewritten to he-k0.

Reproducibility & Evidence

Verified on main at 815ff537fd912b81a7242e857d6ac33560a61667. A stylesheet containing one animation:fade 100ms rule, 1,999 additional safe rules, then @keyframes fade registers successfully; final sanitization emits animation:he-k0 100ms, omits @keyframes he-k0, and records css_too_many_rules.
A focused two-case reproduction passed, including the reported timing-only keyframe output. The existing CSS and HTML sanitizer suites also passed (181 tests); they do not cover this cross-pass budget divergence.

Impact & Priority Suggestion

• 🟡 P3 Low — suggested priority. The input must exceed the bounded 2,000-rule document budget; no security, crash, or data-loss impact was reproduced. The visible result can still be an inert animation, so the sanitizer's emitted CSS is not self-contained in this edge case.

Duplicates & Related

No known duplicate issue was found in open or closed issue/PR searches for keyframes. Related: PR #56 introduced the current strip-and-keep sanitizer behavior.

Next Evidence Needed

• Decide the overflow contract: strip dependent animation references when their definition cannot be emitted, or reserve/validate the definition against the shared budget before rewriting references.
• Add a regression with the 2,000-rule prefix, a forward animation reference, and a later keyframe definition; assert that output never retains a rewritten reference without its definition.
• Define whether animation-only keyframe declarations should be retained as cosmetic output or stripped as semantically inert.

ℹ️ TRIAGE

🦀 Triaged by Hermes agent BOT 🦞