diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1569867..ec02070 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,25 @@ All notable changes to capcut-cli are documented here. The format follows [Keep
 
 ## [Unreleased]
 
+## [0.29.0] — 2026-10-09
+
+### Added
+
+- `caption --words <file.json|->` builds captions from word timings produced by an external aligner, so Whisper does not have to be installed. The format is detected automatically: Whisper / whisper.cpp `segments[].words[]`, WhisperX `word_segments[]`, or a plain `{word|text|char, start, end}` array with times in seconds, `start_ms`/`end_ms` or `start_time`/`end_time` (per-character forced-aligner output). The result reports `words_format`, `words_skipped` and `source_words`. Entries without timing are skipped; entries that end before they start or go back in time are refused with `refused [words-invalid]` naming the entry. Grouping, CJK joining without spaces, `--script`, `--karaoke` and `--word-reveal` behave exactly as with Whisper words. `--words` cannot be combined with `--audio`, `--from-segment`, `--audio-stream`, `--ffmpeg-cmd` or `--whisper-*`.
+- `batch <project> --plan <plan.json> < ops.jsonl` validates the operations under dry-run without touching the draft and writes a reviewable plan: `project`, `draft_sha256`, the normalized `operations`, `operations_sha256` (over key-sorted JSON) and a per-operation `preview`. `batch <project> --apply-plan <plan.json>` reads no stdin and applies the plan through the normal transactional batch. It refuses with `refused [plan-draft-changed]` when the draft changed since the plan was written, `refused [plan-tampered]` when the operations no longer match their hash, and `refused [plan-project-mismatch]` when the plan names another project. Without `--continue-on-error` a failing operation writes no plan.
+- `render` (including `--dry-run`) reports a `fidelity` census of what the proxy leaves out compared with the app: `faithful`, `expected_duration_us`, the `checked` categories, and per dropped category a count, up to 20 segment ids and a hint (missing media, closed main-track gaps, uncomposited overlay tracks, unburned text, stickers, transitions, effects, filters, masks, keyframes, text/video animations, blend modes, chroma key, matting). `render --strict` refuses with `refused [render-unfaithful]` before anything is written.
+- After a real render, `render` probes the written file with ffprobe (`--ffprobe-cmd` selects the binary) and reports `verification`: `{ verified, duration_us, expected_duration_us, drift_us, tolerance_us, within_tolerance }`, with a tolerance of one frame at the render fps. When ffprobe is missing or cannot read the file it reports `verified: false` with a reason. `render --verify` exits non-zero on drift beyond tolerance or an unverifiable file; the file stays on disk and the JSON result is still printed.
+- `tts --lexicon <file.json>` applies pronunciation rules (`{"rules":[{"text","say","case_sensitive"?}]}` or a bare array) to the text handed to the TTS engine only: longest match first, at word boundaries for rule edges that are word characters (`SQL` never fires inside `MySQLite`; CJK rules match anywhere). Malformed lexicons refuse with `refused [lexicon-invalid]`, and equal-length rules that say different things at the same position refuse with `refused [lexicon-ambiguous]`, both before any engine runs. The result reports `lexicon: { rules, applied, spoken_text }` with offsets in UTF-16 code units into the trimmed text. Works with `--text` and `--text-file`.
+- `lint` reports `segment-overlap` (error) when two segments on the same non-text track (video, audio, sticker, effect, filter …) overlap, naming the track, both segment ids and the overlap in µs. `lint --fix` repairs overlaps of at most one frame at the draft's fps (the independent-rounding overlap) by ending the earlier segment where the next begins, keeping its source duration in proportion to speed. Wider overlaps are reported, not fixed. Text tracks keep `caption-overlap`.
+- `lint` reports `segment-offscreen` (warning) for video, photo, sticker and text segments that cannot be seen: the clip's box lies entirely outside the canvas (material size fitted into `canvas_config`, rotation allowed for), a scale axis is 0, or opacity is 0. Segments whose position, scale or alpha is keyframed are not judged on that property. No `--fix`.
+- Every undo-history snapshot now records what made it: `.capcut-cli-history/<draft>.journal.jsonl` gets `{ index, time, command, argv, before_sha256, after_sha256 }` per write (library callers record `command: null`), trimmed together with the snapshots. `restore --list` shows `command`, `argv` and `time` per step; older snapshots without a journal line list with nulls. A torn or unreadable journal never breaks a write or a restore.
+- Whisper-free caption routes are documented in `docs/quickstart.zh-CN.md` (不装 Whisper 的字幕路线) and `examples/short-video-narration.md`: the app's own auto captions followed by `restyle` / `export-srt`, `import-srt`, and `caption --words`.
+
+### Changed
+
+- `doctor`'s Whisper hint names `caption --words` and `import-srt` as routes that work without Whisper. The check's status is unchanged.
+- `lint --frame-grid --fix` derives repaired source durations through the same helper as the new overlap repair: at speed 1 nothing changes; on clips at other speeds whose source duration matched target × speed (within 1%), the source duration now follows the snapped target duration instead of being left as it was.
+
 ## [0.28.0] — 2026-10-03
 
 ### Added
diff --git a/README.md b/README.md
index 5350520..b47fb16 100644
--- a/README.md
+++ b/README.md
@@ -105,9 +105,10 @@ The host reads a draft and passes its JSON as tool input. The component itself h
 
 ## Release notes
 
+> **New in v0.29.0:** captions from any aligner's word timings without Whisper (`caption --words`); reviewed batch plans bound to the draft (`batch --plan` / `--apply-plan`); a render fidelity census and output-duration check (`render --strict` / `--verify`); TTS pronunciation lexicons (`tts --lexicon`); `segment-overlap` and `segment-offscreen` lint checks; and `restore --list` naming the command behind each step. Full details in the [changelog](./CHANGELOG.md).
+
 > **New in v0.28.0:** opt-in active-timeline selection; compilation into empty app-created projects; compact command discovery and selection by name for agents; Windows command-path quoting fixed in Python client v0.1.3; and Python client CI on Linux, macOS, and Windows. Full details in the [changelog](./CHANGELOG.md).
 
-> **New in v0.27.0:** content-safe media replacement; automatic import registration after replacement and relink; recursive, ambiguity-safe relinking; exact fractional-second compile boundaries; operation preflight and failed-build cleanup; payload-bound queue IDs; canonical project locks; bounded queue results; and local OTIO file/relative references. Full details in the [changelog](./CHANGELOG.md).
 
 For an existing nested project, use `capcut diagnose <project> --active-timeline` to inspect the selected document before editing. The opt-in follows the pointer on unverified builds and refuses invalid or conflicting selected documents; it does not bypass write guards.
 
diff --git a/README.zh-CN.md b/README.zh-CN.md
index ec02a4d..343fb82 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -82,9 +82,10 @@ Claude Code 也可以把它作为插件加载：
 
 ## 发布说明
 
+> **v0.29.0 新增：** 用任意对齐工具的逐字/逐词时间戳生成字幕，无需安装 Whisper（`caption --words`）；与草稿哈希绑定、可先审后执行的批量计划（`batch --plan` / `--apply-plan`）；渲染保真度清单与输出时长校验（`render --strict` / `--verify`）；TTS 发音词典（`tts --lexicon`）；`segment-overlap` 与 `segment-offscreen` 两项 lint 检查；`restore --list` 显示每一步由哪条命令产生。完整说明见[更新日志](./CHANGELOG.md)。
+
 > **v0.28.0 新增：** 显式选择活动时间线、向应用创建的空项目编译，以及精简的命令发现索引与按命令名筛选；Python 客户端 v0.1.3 修复 Windows 命令路径的引号解析，并在 Linux、macOS、Windows 上运行客户端 CI。详见 [更新日志](./CHANGELOG.md)。
 
-> **v0.27.0 新增：** 按文件内容安全替换媒体；替换和重链接后自动更新媒体导入登记；递归搜索并报告同名歧义；精确处理小数秒时间边界；编译前校验操作并清理失败输出；将队列 ID 绑定到任务参数；统一项目锁；限制队列输出；以及解析 OTIO 的本地文件 URL 和相对路径。完整说明见[更新日志](./CHANGELOG.md)。
 
 ## 使用 capcut-cli 构建
 
diff --git a/docs/command-reference.json b/docs/command-reference.json
index 60a64aa..5c4fc61 100644
--- a/docs/command-reference.json
+++ b/docs/command-reference.json
@@ -1,6 +1,6 @@
 {
   "name": "capcut-cli",
-  "version": "0.28.0",
+  "version": "0.29.0",
   "schema_version": 2,
   "description": "Edit CapCut/JianYing draft_content.json directly. JSON in, JSON out.",
   "global_flags": [
@@ -1405,7 +1405,7 @@
     {
       "name": "tts",
       "summary": "Synthesize a voiceover from text via a local TTS command (--tts-cmd) and add it as an audio segment.",
-      "usage": "capcut tts <project> [start] [duration] (--text <string> | --text-file <path>) --tts-cmd <template> [options]",
+      "usage": "capcut tts <project> [start] [duration] (--text <string> | --text-file <path>) --tts-cmd <template> [--lexicon <file>] [options]",
       "positionals": [
         {
           "name": "project",
@@ -1417,6 +1417,11 @@
           "type": "string",
           "required": true
         },
+        {
+          "name": "file",
+          "type": "path",
+          "required": false
+        },
         {
           "name": "start",
           "type": "time",
@@ -1456,6 +1461,15 @@
           "required": false,
           "description": "TTS command template, run without a shell: {out} (required) is replaced with the .wav path the tool must write, {text} with the text as one argument; without {text} the text is piped to stdin."
         },
+        {
+          "name": "lexicon",
+          "flags": [
+            "--lexicon"
+          ],
+          "type": "path",
+          "required": false,
+          "description": "Pronunciation lexicon JSON ({\"rules\": [{\"text\", \"say\", \"case_sensitive\"?}]} or a bare array) applied to the spoken text only: longest match first, at word boundaries (CJK rules match anywhere). Equal-length rules that say different things refuse [lexicon-ambiguous]; lexicon.applied offsets are UTF-16 code unit indices into the trimmed text."
+        },
         {
           "name": "volume",
           "flags": [
@@ -3588,12 +3602,17 @@
     {
       "name": "batch",
       "summary": "Run multiple edits from stdin (JSONL), one file write.",
-      "usage": "capcut batch <project> [--continue-on-error] < operations.jsonl",
+      "usage": "capcut batch <project> [--continue-on-error] [--plan <plan.json>] < operations.jsonl | capcut batch <project> --apply-plan <plan.json>",
       "positionals": [
         {
           "name": "project",
           "type": "path",
           "required": true
+        },
+        {
+          "name": "plan.json",
+          "type": "string",
+          "required": false
         }
       ],
       "options": [
@@ -3606,6 +3625,24 @@
           "required": false,
           "description": "Commit only successful operations and exit 1 if any fail."
         },
+        {
+          "name": "plan",
+          "flags": [
+            "--plan"
+          ],
+          "type": "path",
+          "required": false,
+          "description": "Validate the stdin operations as a real run would and write a reviewable plan file (draft and operations sha256, per-operation preview) instead of changing the draft."
+        },
+        {
+          "name": "apply_plan",
+          "flags": [
+            "--apply-plan"
+          ],
+          "type": "path",
+          "required": false,
+          "description": "Apply a plan written by --plan (no stdin). Refused if the draft changed since the plan or its operations were edited."
+        },
         {
           "name": "active_timeline",
           "flags": [
@@ -4343,7 +4380,7 @@
     {
       "name": "caption",
       "summary": "Transcribe audio via whisper into real caption-track segments.",
-      "usage": "capcut caption <project> (--audio <path> | --from-segment <id>) [options]",
+      "usage": "capcut caption <project> (--audio <path> | --from-segment <id> | --words <file.json|->) [options]",
       "positionals": [
         {
           "name": "project",
@@ -4375,6 +4412,15 @@
           "required": false,
           "description": "Audio input."
         },
+        {
+          "name": "words",
+          "flags": [
+            "--words"
+          ],
+          "type": "path",
+          "required": false,
+          "description": "Word timings from an external aligner instead of running Whisper (path or - for stdin): Whisper/whisper.cpp segments[].words[], WhisperX word_segments[], or an array of {word|text|char, start, end} (seconds; start_ms/end_ms and start_time/end_time also read). The result reports words_format and words_skipped. Not combinable with --audio, --from-segment, --audio-stream or --whisper-*."
+        },
         {
           "name": "audio_stream",
           "flags": [
@@ -5956,7 +6002,7 @@
           ],
           "type": "boolean",
           "required": false,
-          "description": "List snapshots."
+          "description": "List snapshots, newest first, with the command that made each write."
         },
         {
           "name": "active_timeline",
@@ -6584,6 +6630,33 @@
           "required": false,
           "description": "Stream ffmpeg's progress to stderr instead of buffering it."
         },
+        {
+          "name": "strict",
+          "flags": [
+            "--strict"
+          ],
+          "type": "boolean",
+          "required": false,
+          "description": "Refuse (refused [render-unfaithful], nothing rendered) when the fidelity census finds anything the proxy drops: transitions, effects, filters, masks, keyframes, uncomposited tracks, stickers, text, animations, blend modes, chroma, matting, gaps or missing media."
+        },
+        {
+          "name": "verify",
+          "flags": [
+            "--verify"
+          ],
+          "type": "boolean",
+          "required": false,
+          "description": "Probe the written file with ffprobe and exit non-zero when its duration drifts from the draft's by more than one frame, or when it cannot be probed. The file is kept."
+        },
+        {
+          "name": "ffprobe_cmd",
+          "flags": [
+            "--ffprobe-cmd"
+          ],
+          "type": "path",
+          "required": false,
+          "description": "ffprobe binary for output verification."
+        },
         {
           "name": "active_timeline",
           "flags": [
diff --git a/docs/command-reference.md b/docs/command-reference.md
index 32b8966..a3ec9bc 100644
--- a/docs/command-reference.md
+++ b/docs/command-reference.md
@@ -27,7 +27,7 @@
 | `add-audio` | `capcut add-audio <project> <file-or-url> <start> [duration] [options]` | yes | Add a local or Wikimedia audio file on an audio track. |
 | `add-video` | `capcut add-video <project> <file-or-url> <start> [duration] [options]` | yes | Add a local or Wikimedia video/image on a video track. |
 | `add-text` | `capcut add-text <project> <start> <duration> <text> [options]` | yes | Add a text segment with font/color/position options. |
-| `tts` | `capcut tts <project> [start] [duration] (--text <string> \| --text-file <path>) --tts-cmd <template> [options]` | yes | Synthesize a voiceover from text via a local TTS command (--tts-cmd) and add it as an audio segment. |
+| `tts` | `capcut tts <project> [start] [duration] (--text <string> \| --text-file <path>) --tts-cmd <template> [--lexicon <file>] [options]` | yes | Synthesize a voiceover from text via a local TTS command (--tts-cmd) and add it as an audio segment. |
 | `crop` | `capcut crop <project> <segment-id> [--ratio <r> \| --rect <x,y,w,h> \| --reset]` | yes | Read or set a video/photo segment's source-material crop (--ratio preset, --rect x,y,w,h, or --reset). |
 | `cut` | `capcut cut <project> <start> <end> --out <path>` | yes | Extract a time range into a new standalone draft. |
 | `duplicate` | `capcut duplicate <project> <segment-id> [--track <track-name>] [--new-track]` | yes | Duplicate a segment at its same timeline position onto a track above the source. |
@@ -51,11 +51,11 @@
 | `apply-template` | `capcut apply-template <project> <template> <start> <duration> [text] [options]` | yes | Stamp a template into a project with new timing/text. |
 | `make-preset` | `capcut make-preset <project> <text-segment-id> --out <preset.json>` | no | Extract a text segment's styling as a reusable preset JSON (apply via --preset). |
 | `templates` | `capcut templates <project>` | no | List bundled reusable templates. |
-| `batch` | `capcut batch <project> [--continue-on-error] < operations.jsonl` | yes | Run multiple edits from stdin (JSONL), one file write. |
+| `batch` | `capcut batch <project> [--continue-on-error] [--plan <plan.json>] < operations.jsonl \| capcut batch <project> --apply-plan <plan.json>` | yes | Run multiple edits from stdin (JSONL), one file write. |
 | `import-srt` | `capcut import-srt <project> <srt-or-> [options]` | yes | Import an SRT file/stdin as one text segment per cue. |
 | `import-ass` | `capcut import-ass <project> <ass-or-> [options]` | yes | Import an ASS/SSA subtitle file as text segments, keeping inline overrides as per-range styles. |
 | `text-ranges` | `capcut text-ranges <project> <id> --styles <json-or-@file>` | yes | Apply byte-accurate multi-style ranges to a text segment. |
-| `caption` | `capcut caption <project> (--audio <path> \| --from-segment <id>) [options]` | yes | Transcribe audio via whisper into real caption-track segments. |
+| `caption` | `capcut caption <project> (--audio <path> \| --from-segment <id> \| --words <file.json\|->) [options]` | yes | Transcribe audio via whisper into real caption-track segments. |
 | `translate` | `capcut translate <project> --to <language> --out <path> [options]` | yes | Clone a draft into another language via the Anthropic API. |
 | `migrate` | `capcut migrate <project> (--from <version> --to <version> \| --like <project> \| --from-store)` | yes | Apply known schema migrations across version boundaries. |
 | `add-sfx` | `capcut add-sfx <project> <slug> <start> <duration> [options]` | yes | Add a sound effect on a dedicated track. |
diff --git a/docs/quickstart.zh-CN.md b/docs/quickstart.zh-CN.md
index 241f6bc..79712d6 100644
--- a/docs/quickstart.zh-CN.md
+++ b/docs/quickstart.zh-CN.md
@@ -87,6 +87,38 @@ capcut transition <草稿> <片段ID> "_3D空间" --jianying
 
 完整的命令、参数与说明见 **[命令参考（简体中文）](./command-reference.zh-CN.md)**。
 
+## 不装 Whisper 的字幕路线
+
+`caption --audio` 需要本机装好 Whisper。装不上或不想装，也有三条路：
+
+**(a) 剪映 / CapCut 自带「识别字幕」，再用 CLI 继续处理。** 在应用里识别完字幕、保存并关闭应用，然后：
+
+```bash
+capcut restyle <草稿> --preset 字幕样式.json            # 统一套用一套样式（可加 --track-name 只改某条字幕轨）
+capcut export-srt <草稿> > 字幕.srt                     # 导出 SRT；--format vtt 导出 WebVTT
+capcut export-srt <草稿> --granularity word > 逐字.srt  # 逐字/逐词一条
+```
+
+样式文件可以用 `capcut make-preset` 从你在应用里调好的一条字幕提取。
+
+**(b) 已有 SRT（比如剪映导出的），用 `import-srt`。**
+
+```bash
+capcut import-srt <草稿> 字幕.srt --track-name 字幕 --clone-style
+capcut import-srt <草稿> 字幕.srt --time-offset 2s     # 整体后移 2 秒
+```
+
+**(c) 用外部强制对齐工具输出逐字 / 逐词时间戳 JSON，再用 `caption --words`。** 例如 Qwen3-ForcedAligner（中文逐字）、WhisperX（`whisperx 音频.wav --output_format json`）。`--words` 自动识别三种格式：Whisper / whisper.cpp 的 `segments[].words[]`、WhisperX 的 `word_segments[]`，以及普通数组 `[{"text": "今", "start_time": 0.0, "end_time": 0.2}, ...]`（键名也可以是 `word` / `char`，时间可以是秒的 `start` / `end`，或毫秒的 `start_ms` / `end_ms`）。这条路不调用 Whisper。
+
+```bash
+capcut caption <草稿> --words 对齐结果.json                       # 中文逐字自动拼成不带空格的字幕
+capcut caption <草稿> --words 对齐结果.json --script 文稿.txt     # 时间用对齐结果，文字保留文稿原文（每行一条字幕）
+capcut caption <草稿> --words 对齐结果.json --karaoke             # 卡拉 OK 逐字高亮
+cat 对齐结果.json | capcut caption <草稿> --words -              # 从标准输入读取
+```
+
+时间戳按时间线位置写入（和 `--audio` 一样从 0 开始）。没有时间戳的条目会被跳过并计入结果里的 `words_skipped`；结束早于开始、或顺序倒退的条目会以 `refused [words-invalid]` 拒绝并指出是第几条。结果里的 `words_format` 显示识别到的格式。
+
 ## 写入安全
 
 - 每次写入都是原子操作，先留 `.bak` 再落盘；`capcut restore <草稿>` 可按步撤销。
diff --git a/examples/short-video-narration.md b/examples/short-video-narration.md
index 2cafa6c..d3f10f5 100644
--- a/examples/short-video-narration.md
+++ b/examples/short-video-narration.md
@@ -63,6 +63,14 @@ Restart CapCut / JianYing once so it lists the new draft, then open it.
 - other engines: any command that writes a WAV to `{out}`. `{text}` is optional; without it the script is piped to stdin (how piper works). macOS `say`: `--tts-cmd "say -o {out} --data-format=LEI16@24000 {text}"`; in the script, override with the `CAPCUT_TTS_CMD` environment variable
 - caption styling: `caption --preset <preset.json>` (extract one with `make-preset` from a caption you styled in the app) or `--style-ref <segment-id>`; `--karaoke` for word highlighting
 
+### Captions without Whisper
+
+`caption --audio` / `--from-segment` need Whisper installed. Three routes work without it:
+
+- **The app's own auto captions.** Run CapCut's "Auto captions" (JianYing 识别字幕), save, close the app, then keep going from the CLI: `capcut restyle "<draft_path>" --preset preset.json` (add `--track-name <name>` to touch one caption track) and `capcut export-srt "<draft_path>" > captions.srt` (`--format vtt`, `--granularity word`).
+- **An SRT you already have**, for example one the app exported: `capcut import-srt "<draft_path>" captions.srt --clone-style` (`--time-offset 2s` shifts it).
+- **Word timings from an external forced aligner** such as WhisperX (`whisperx voice.wav --output_format json`) or Qwen3-ForcedAligner (per character for Chinese): `capcut caption "<draft_path>" --words aligned.json`, with `--script script.txt` to keep your script's wording on the aligner's timing, `--karaoke` / `--word-reveal` as usual, and `--words -` to read stdin. Accepted shapes, detected automatically and reported as `words_format`: Whisper / whisper.cpp `segments[].words[]`, WhisperX `word_segments[]`, or a plain array of `{"word"|"text"|"char", "start", "end"}` in seconds (`start_ms`/`end_ms` and `start_time`/`end_time` keys work too). Times are timeline positions, as with `--audio`. Entries without timing are skipped (`words_skipped`); an entry that ends before it starts or goes back in time is refused with `refused [words-invalid]` and its index.
+
 ## JianYing 6.0+
 
 A draft created this way is plaintext; JianYing 11.4 (macOS) is reported to open and upgrade it in place, other builds are unverified. Existing encrypted drafts are not read by this CLI; `capcut decrypt <project>` reports the state, and [jianying-encryption.md](../docs/jianying-encryption.md) has the background.
diff --git a/package-lock.json b/package-lock.json
index 00c7615..ae7f634 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "capcut-cli",
-  "version": "0.28.0",
+  "version": "0.29.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "capcut-cli",
-      "version": "0.28.0",
+      "version": "0.29.0",
       "license": "MIT",
       "bin": {
         "capcut": "dist/index.js",
diff --git a/package.json b/package.json
index 0f03e35..c1b9b0c 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "capcut-cli",
-  "version": "0.28.0",
+  "version": "0.29.0",
   "description": "Independent, unofficial CLI to create and edit CapCut projects — build drafts from scratch, add video/audio/text, subtitles, timing, speed, volume, templates, cut long-form to shorts. No API needed. Not affiliated with ByteDance.",
   "type": "module",
   "bin": {
diff --git a/src/caption.ts b/src/caption.ts
index 4576428..3e2e1a6 100644
--- a/src/caption.ts
+++ b/src/caption.ts
@@ -19,6 +19,12 @@ import { parseSrt } from "./srt.js";
 import { storedTextLength } from "./text-offsets.js";
 
 export interface CaptionOptions {
+  /**
+   * --words: the raw JSON of word timings from an external aligner. When set,
+   * Whisper does not run; see parseWordTimings for the accepted shapes.
+   */
+  wordsJson?: string;
+  wordsSource?: string; // where wordsJson came from (path or "stdin"), for the result
   audio?: string; // path to audio file; if absent, derived from --from-segment
   audioStream?: number; // zero-based audio stream inside the input container
   ffmpegCmd?: string; // ffmpeg binary used only when audioStream is selected
@@ -68,13 +74,19 @@ export interface CaptionResult {
   track_name: string;
   first_cue?: { start_us: number; text: string };
   last_cue?: { start_us: number; text: string };
-  source_audio: string;
-  engine: "whisper-cli" | "shell" | "openai" | "stdin-srt";
+  /** Absent with --words: no audio was read. */
+  source_audio?: string;
+  engine: "whisper-cli" | "shell" | "openai" | "stdin-srt" | "words";
   engine_name?: string;
   words?: number;
   karaoke?: boolean;
   word_reveal?: boolean;
   audio_stream?: number;
+  /** --words: the file the timings came from, its detected shape, and how
+   * many entries had no usable timing and were left out. */
+  source_words?: string;
+  words_format?: WordsFormat;
+  words_skipped?: number;
   keyword_matches?: number;
   color_cycle?: number;
   /** --script alignment quality (only when a script was given). */
@@ -115,16 +127,43 @@ export function captionDraft(draft: Draft, opts: CaptionOptions): CaptionResult
   if (opts.audioStream !== undefined && (!Number.isInteger(opts.audioStream) || opts.audioStream < 0)) {
     throw new Error("--audio-stream must be a zero-based non-negative integer.");
   }
-  const sourceAudio = resolveAudio(draft, opts);
-  const selectedAudio =
-    opts.audioStream === undefined
-      ? undefined
-      : extractAudioStream(sourceAudio, opts.audioStream, opts.ffmpegCmd ?? "ffmpeg");
+  const fromWords = opts.wordsJson !== undefined;
+  if (
+    fromWords &&
+    (opts.audio !== undefined ||
+      opts.fromSegment !== undefined ||
+      opts.audioStream !== undefined ||
+      opts.whisperCmd !== undefined ||
+      opts.whisperEngine !== undefined ||
+      opts.whisperModel !== undefined)
+  ) {
+    throw new Error("--words is mutually exclusive with --audio, --from-segment, --audio-stream and --whisper-*.");
+  }
+  let sourceAudio: string | undefined;
   let transcription: TranscriptionResult;
-  try {
-    transcription = runWhisper(selectedAudio?.path ?? sourceAudio, opts);
-  } finally {
-    selectedAudio?.cleanup();
+  let external: ParsedWordTimings | undefined;
+  if (fromWords) {
+    // External aligner output stands in for the Whisper run; everything after
+    // this point (script detection, grouping, --script, karaoke, reveal,
+    // track writing) is the same path the Whisper words take.
+    external = parseWordTimings(opts.wordsJson as string);
+    if (external.words.length === 0) {
+      throw new Error(
+        `--words has no timed words (${external.skipped} entr${external.skipped === 1 ? "y" : "ies"} without timing skipped).`,
+      );
+    }
+    transcription = { cues: [], words: external.words, engine: "words" };
+  } else {
+    sourceAudio = resolveAudio(draft, opts);
+    const selectedAudio =
+      opts.audioStream === undefined
+        ? undefined
+        : extractAudioStream(sourceAudio, opts.audioStream, opts.ffmpegCmd ?? "ffmpeg");
+    try {
+      transcription = runWhisper(selectedAudio?.path ?? sourceAudio, opts);
+    } finally {
+      selectedAudio?.cleanup();
+    }
   }
   const recognizedWords = transcription.words.length > 0 ? transcription.words : wordsFromCues(transcription.cues);
   // The transcript's script decides how words join into a cue (no space inside
@@ -181,7 +220,18 @@ export function captionDraft(draft: Draft, opts: CaptionOptions): CaptionResult
             (opts.maxGapMs ?? 500) * 1000,
             separator,
           )
-        : transcription.cues;
+        : fromWords
+          ? // Aligner output carries words only, no sentence segments: line
+            // cues group the words at the script's line width and close on a
+            // pause, as the karaoke grouping does.
+            groupWords(
+              recognizedWords,
+              opts.maxWords ?? Number.POSITIVE_INFINITY,
+              opts.maxChars ?? grouping.lineMaxChars,
+              (opts.maxGapMs ?? 500) * 1000,
+              separator,
+            )
+          : transcription.cues;
   }
   if (cues.length === 0) {
     throw new Error("Whisper produced no cues. Check the audio file is not silent and the model name is valid.");
@@ -288,13 +338,16 @@ export function captionDraft(draft: Draft, opts: CaptionOptions): CaptionResult
     first_cue: { start_us: cues[0].startUs, text: cues[0].text },
     last_cue: { start_us: cues[cues.length - 1].startUs, text: cues[cues.length - 1].text },
     source_audio: sourceAudio,
-    engine: opts.whisperCmd ? "shell" : "whisper-cli",
-    engine_name: transcription.engine,
+    engine: fromWords ? "words" : opts.whisperCmd ? "shell" : "whisper-cli",
+    engine_name: fromWords ? undefined : transcription.engine,
     caption_script: textScript,
     words: transcription.words.length,
     karaoke: opts.karaoke ?? false,
     word_reveal: opts.wordReveal || undefined,
     audio_stream: opts.audioStream,
+    source_words: external ? (opts.wordsSource ?? "stdin") : undefined,
+    words_format: external?.format,
+    words_skipped: external?.skipped,
     // undefined when the flags are off, so JSON output stays byte-identical.
     keyword_matches: highlightWords.length > 0 ? keywordMatches : undefined,
     color_cycle: colorCycle.length > 0 ? colorCycle.length : undefined,
@@ -392,7 +445,128 @@ function resolveAudio(draft: Draft, opts: CaptionOptions): string {
 interface TranscriptionResult {
   cues: CaptionCue[];
   words: CaptionWord[];
-  engine: "openai" | "whisper-cpp" | "faster-whisper";
+  engine: "openai" | "whisper-cpp" | "faster-whisper" | "words";
+}
+
+/**
+ * The word-timing shapes --words recognises:
+ *   whisper   — openai-whisper / whisper.cpp JSON, segments[].words[] {word,start,end}
+ *   whisperx  — WhisperX, word_segments[] (or segments[].words[] carrying a score)
+ *   word-list — a plain array of {word|text|char, start, end} in seconds, or
+ *               start_ms/end_ms, or start_time/end_time (Qwen3-ForcedAligner)
+ */
+export type WordsFormat = "whisper" | "whisperx" | "word-list";
+
+export interface ParsedWordTimings {
+  format: WordsFormat;
+  words: CaptionWord[];
+  /** Entries with text but no usable start/end (WhisperX leaves digits unaligned). */
+  skipped: number;
+}
+
+function timeValue(value: unknown): number | undefined {
+  if (typeof value === "number") return Number.isFinite(value) ? value : undefined;
+  if (typeof value === "string" && value.trim() !== "") {
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : undefined;
+  }
+  return undefined;
+}
+
+/**
+ * Parse word timings from an external aligner into caption words, detecting
+ * the shape. Entries without timing are skipped and counted; an entry whose
+ * end precedes its start, or that starts before the previous timed entry, is
+ * refused with its index, since every cue built from it would be wrong.
+ */
+export function parseWordTimings(raw: string): ParsedWordTimings {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error) {
+    throw new Error(`refused [words-format]: --words is not valid JSON (${(error as Error).message}).`);
+  }
+  let format: WordsFormat;
+  const entries: Array<{ item: unknown; path: string }> = [];
+  if (Array.isArray(parsed)) {
+    format = "word-list";
+    parsed.forEach((item, index) => {
+      entries.push({ item, path: `[${index}]` });
+    });
+  } else if (parsed !== null && typeof parsed === "object") {
+    const record = parsed as Record<string, unknown>;
+    const segments = Array.isArray(record.segments) ? (record.segments as unknown[]) : [];
+    if (Array.isArray(record.word_segments)) {
+      format = "whisperx";
+      record.word_segments.forEach((item, index) => {
+        entries.push({ item, path: `word_segments[${index}]` });
+      });
+    } else if (segments.some((segment) => Array.isArray((segment as Record<string, unknown> | null)?.words))) {
+      // WhisperX writes the same segments[].words[] layout plus a per-word score.
+      let scored = false;
+      segments.forEach((segment, segmentIndex) => {
+        const words = (segment as Record<string, unknown> | null)?.words;
+        if (!Array.isArray(words)) return;
+        words.forEach((item, index) => {
+          if (item !== null && typeof item === "object" && "score" in item) scored = true;
+          entries.push({ item, path: `segments[${segmentIndex}].words[${index}]` });
+        });
+      });
+      format = scored ? "whisperx" : "whisper";
+    } else {
+      throw new Error(
+        "refused [words-format]: --words JSON has no word timings. Expected segments[].words[], word_segments[], " +
+          "or an array of {word|text|char, start, end}.",
+      );
+    }
+  } else {
+    throw new Error("refused [words-format]: --words JSON must be an object or an array of word entries.");
+  }
+
+  const words: CaptionWord[] = [];
+  let skipped = 0;
+  let previous: { startUs: number; path: string } | undefined;
+  for (const { item, path } of entries) {
+    if (item === null || typeof item !== "object") {
+      throw new Error(`refused [words-invalid]: entry ${path} is not an object.`);
+    }
+    const entry = item as Record<string, unknown>;
+    const text = String(entry.word ?? entry.text ?? entry.char ?? "").trim();
+    if (!text) continue;
+    let start: number | undefined;
+    let end: number | undefined;
+    let scale = 1_000_000; // seconds → µs
+    if (timeValue(entry.start) !== undefined || timeValue(entry.end) !== undefined) {
+      start = timeValue(entry.start);
+      end = timeValue(entry.end);
+    } else if (timeValue(entry.start_ms) !== undefined || timeValue(entry.end_ms) !== undefined) {
+      start = timeValue(entry.start_ms);
+      end = timeValue(entry.end_ms);
+      scale = 1000;
+    } else {
+      start = timeValue(entry.start_time);
+      end = timeValue(entry.end_time);
+    }
+    if (start === undefined || end === undefined) {
+      skipped++;
+      continue;
+    }
+    const startUs = Math.round(start * scale);
+    const endUs = Math.round(end * scale);
+    if (startUs < 0) throw new Error(`refused [words-invalid]: entry ${path} ("${text}") starts before 0.`);
+    if (endUs < startUs) {
+      throw new Error(`refused [words-invalid]: entry ${path} ("${text}") ends before it starts (${start} > ${end}).`);
+    }
+    if (previous && startUs < previous.startUs) {
+      throw new Error(
+        `refused [words-invalid]: entry ${path} ("${text}") starts before entry ${previous.path}; ` +
+          "word timings must be in time order.",
+      );
+    }
+    previous = { startUs, path };
+    words.push({ word: text, startUs, endUs });
+  }
+  return { format, words, skipped };
 }
 
 function detectEngine(opts: CaptionOptions): TranscriptionResult["engine"] {
diff --git a/src/command-specs.ts b/src/command-specs.ts
index 888d8ca..dd3cefc 100644
--- a/src/command-specs.ts
+++ b/src/command-specs.ts
@@ -198,7 +198,7 @@ const usages = {
   segment: "capcut segment <project> <id>",
   material: "capcut material <project> <id>",
   "add-audio": "capcut add-audio <project> <file-or-url> <start> [duration] [options]",
-  tts: "capcut tts <project> [start] [duration] (--text <string> | --text-file <path>) --tts-cmd <template> [options]",
+  tts: "capcut tts <project> [start] [duration] (--text <string> | --text-file <path>) --tts-cmd <template> [--lexicon <file>] [options]",
   "add-video": "capcut add-video <project> <file-or-url> <start> [duration] [options]",
   "add-text": "capcut add-text <project> <start> <duration> <text> [options]",
   crop: "capcut crop <project> <segment-id> [--ratio <r> | --rect <x,y,w,h> | --reset]",
@@ -223,11 +223,12 @@ const usages = {
   "save-template": "capcut save-template <project> <id> <name> --out <path>",
   "apply-template": "capcut apply-template <project> <template> <start> <duration> [text] [options]",
   "make-preset": "capcut make-preset <project> <text-segment-id> --out <preset.json>",
-  batch: "capcut batch <project> [--continue-on-error] < operations.jsonl",
+  batch:
+    "capcut batch <project> [--continue-on-error] [--plan <plan.json>] < operations.jsonl | capcut batch <project> --apply-plan <plan.json>",
   "import-srt": "capcut import-srt <project> <srt-or-> [options]",
   "import-ass": "capcut import-ass <project> <ass-or-> [options]",
   "text-ranges": "capcut text-ranges <project> <id> --styles <json-or-@file>",
-  caption: "capcut caption <project> (--audio <path> | --from-segment <id>) [options]",
+  caption: "capcut caption <project> (--audio <path> | --from-segment <id> | --words <file.json|->) [options]",
   translate: "capcut translate <project> --to <language> --out <path> [options]",
   migrate: "capcut migrate <project> (--from <version> --to <version> | --like <project> | --from-store)",
   "add-sfx": "capcut add-sfx <project> <slug> <start> <duration> [options]",
@@ -353,6 +354,15 @@ const optionsByCommand: Record<string, OptionSpec[]> = {
       "TTS command template, run without a shell: {out} (required) is replaced with the .wav path the tool must " +
         "write, {text} with the text as one argument; without {text} the text is piped to stdin.",
     ),
+    option(
+      "lexicon",
+      ["--lexicon"],
+      "path",
+      'Pronunciation lexicon JSON ({"rules": [{"text", "say", "case_sensitive"?}]} or a bare array) applied to the ' +
+        "spoken text only: longest match first, at word boundaries (CJK rules match anywhere). Equal-length rules " +
+        "that say different things refuse [lexicon-ambiguous]; lexicon.applied offsets are UTF-16 code unit " +
+        "indices into the trimmed text.",
+    ),
     option("volume", ["--volume"], "number", "Audio volume.", { default: 1 }),
     TRACK_NAME,
     option("no_probe", ["--no-probe"], "boolean", "Disable automatic media probing."),
@@ -502,6 +512,18 @@ const optionsByCommand: Record<string, OptionSpec[]> = {
       "boolean",
       "Commit only successful operations and exit 1 if any fail.",
     ),
+    option(
+      "plan",
+      ["--plan"],
+      "path",
+      "Validate the stdin operations as a real run would and write a reviewable plan file (draft and operations sha256, per-operation preview) instead of changing the draft.",
+    ),
+    option(
+      "apply_plan",
+      ["--apply-plan"],
+      "path",
+      "Apply a plan written by --plan (no stdin). Refused if the draft changed since the plan or its operations were edited.",
+    ),
   ],
   "export-srt": [
     option("granularity", ["--granularity"], "enum", "Cue granularity: one cue per caption or per word.", {
@@ -563,6 +585,12 @@ const optionsByCommand: Record<string, OptionSpec[]> = {
       "Known transcript (plain text). Whisper's word timing is kept, the script's wording is used; each non-empty line is a cue boundary. The result's `script` block reports matched/substituted/inserted words.",
     ),
     option("audio", ["--audio"], "path", "Audio input."),
+    option(
+      "words",
+      ["--words"],
+      "path",
+      "Word timings from an external aligner instead of running Whisper (path or - for stdin): Whisper/whisper.cpp segments[].words[], WhisperX word_segments[], or an array of {word|text|char, start, end} (seconds; start_ms/end_ms and start_time/end_time also read). The result reports words_format and words_skipped. Not combinable with --audio, --from-segment, --audio-stream or --whisper-*.",
+    ),
     option(
       "audio_stream",
       ["--audio-stream"],
@@ -776,7 +804,7 @@ const optionsByCommand: Record<string, OptionSpec[]> = {
   ],
   restore: [
     option("step", ["--step"], "number", "Snapshot number."),
-    option("list", ["--list"], "boolean", "List snapshots."),
+    option("list", ["--list"], "boolean", "List snapshots, newest first, with the command that made each write."),
   ],
   serve: [
     option("queue", ["--queue"], "path", "JSONL queue file."),
@@ -861,6 +889,19 @@ const optionsByCommand: Record<string, OptionSpec[]> = {
     ),
     option("all_video_tracks", ["--all-video-tracks"], "boolean", "Composite every video track."),
     option("progress", ["--progress"], "boolean", "Stream ffmpeg's progress to stderr instead of buffering it."),
+    option(
+      "strict",
+      ["--strict"],
+      "boolean",
+      "Refuse (refused [render-unfaithful], nothing rendered) when the fidelity census finds anything the proxy drops: transitions, effects, filters, masks, keyframes, uncomposited tracks, stickers, text, animations, blend modes, chroma, matting, gaps or missing media.",
+    ),
+    option(
+      "verify",
+      ["--verify"],
+      "boolean",
+      "Probe the written file with ffprobe and exit non-zero when its duration drifts from the draft's by more than one frame, or when it cannot be probed. The file is kept.",
+    ),
+    option("ffprobe_cmd", ["--ffprobe-cmd"], "path", "ffprobe binary for output verification."),
   ],
   "detect-scenes": [
     option("threshold", ["--threshold"], "number", "Scene-change score a cut must exceed (0..1).", { default: 0.4 }),
@@ -946,6 +987,7 @@ optionsByCommand["image-anim"] = optionsByCommand["text-anim"];
 //   --crf, --video-bitrate -> render (v0.26 proxy quality controls)
 //   --threshold-db, --min-silence, --pad -> detect-silence (v0.20 silence spans)
 //   --text, --text-file, --tts-cmd -> tts (v0.20 voiceover synthesis)
+//   --lexicon            -> tts (pronunciation rules for the spoken text)
 //   --nested             -> sync-timelines (v0.21 nested Timelines/ repair)
 //   --pip                -> lint (v0.21 PIP + mask validation report)
 //   --kind               -> catalogue (v0.21 cross-category lookup); --limit also scopes there
@@ -956,8 +998,10 @@ optionsByCommand["image-anim"] = optionsByCommand["text-anim"];
 //   --script             -> caption (v0.22 transcript-guided alignment)
 //   --window, --similarity, --min-words -> detect-retakes (v0.22); --json also scopes there
 //   --soft-captions      -> render (v0.22 mov_text subtitle stream)
+//   --strict, --verify   -> render (v0.29 fidelity census gate + output duration check)
 //   --like, --from-store -> migrate (v0.23 schema-marker restamp from a donor project)
 //   --word-reveal, --min-script-match, --audio-stream -> caption (v0.26 caption controls)
+//   --apply-plan         -> batch (v0.29 reviewed batch plans)
 //   --from -> shift-all; --ripple -> remove (v0.26 boundary-safe ripple editing)
 //   --frame-grid -> lint (v0.26 exact integer timeline preflight)
 //   --recursive -> relink (v0.27 nested media search)
@@ -970,6 +1014,7 @@ export const RELEASE_SCOPED_FLAGS: ReadonlySet<string> = new Set([
   "--add",
   "--audio-stream",
   "--apply",
+  "--apply-plan",
   "--bind",
   "--captions",
   "--catalogue",
@@ -997,6 +1042,7 @@ export const RELEASE_SCOPED_FLAGS: ReadonlySet<string> = new Set([
   "--keyword-color",
   "--keyword-size",
   "--kind",
+  "--lexicon",
   "--like",
   "--limit",
   "--mask-field",
@@ -1017,12 +1063,14 @@ export const RELEASE_SCOPED_FLAGS: ReadonlySet<string> = new Set([
   "--script",
   "--similarity",
   "--soft-captions",
+  "--strict",
   "--sync",
   "--text",
   "--text-file",
   "--threshold",
   "--threshold-db",
   "--tts-cmd",
+  "--verify",
   "--window",
 ]);
 
diff --git a/src/doctor.ts b/src/doctor.ts
index 231b657..1f83a6d 100644
--- a/src/doctor.ts
+++ b/src/doctor.ts
@@ -133,7 +133,10 @@ export function runDoctor(options: DoctorOptions = {}): DoctorReport {
     status: whisper ? "ok" : "warn",
     detail: whisper ? `found: ${whisper}` : "no whisper binary on PATH",
     affects: ["caption"],
-    fix: whisper ? undefined : "pip install openai-whisper · brew install whisper-cpp · or pass --whisper-cmd <path>",
+    fix: whisper
+      ? undefined
+      : "pip install openai-whisper · brew install whisper-cpp · or pass --whisper-cmd <path>" +
+        " · without Whisper: caption --words <aligner.json> or import-srt <file.srt>",
   });
 
   // TTS — needed by `tts`. --tts-cmd takes any local tool, so this only
diff --git a/src/draft.ts b/src/draft.ts
index fb987fc..4957a88 100644
--- a/src/draft.ts
+++ b/src/draft.ts
@@ -1,5 +1,6 @@
-import { randomBytes, randomUUID } from "node:crypto";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import {
+  appendFileSync,
   closeSync,
   existsSync,
   fsyncSync,
@@ -244,12 +245,12 @@ function snapshotFiles(filePath: string): string[] {
 // never diverge afterwards: every writer here replaces a name by rename or
 // unlink, never edits a file in place, so the next write gives `.bak` a fresh
 // file and leaves this snapshot holding what it always held.
-function writeHistorySnapshot(filePath: string, content: string, source?: string): void {
+function writeHistorySnapshot(filePath: string, content: string, source?: string, after?: string): void {
   const dir = historyDir(filePath);
   if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
   const existing = snapshotFiles(filePath);
   const last = existing[existing.length - 1];
-  const lastIndex = last ? Number.parseInt(last.match(/\.(\d+)\.snap$/)?.[1] ?? "0", 10) : 0;
+  const lastIndex = last ? snapshotIndex(last) : 0;
   const name = `${basename(filePath)}.${String(lastIndex + 1).padStart(6, "0")}.snap`;
   const snapshot = join(dir, name);
   let linked = false;
@@ -264,11 +265,100 @@ function writeHistorySnapshot(filePath: string, content: string, source?: string
     }
   }
   if (!linked) writeFileSync(snapshot, content, "utf-8");
+  appendJournal(filePath, {
+    index: lastIndex + 1,
+    time: new Date().toISOString(),
+    command: writeContext.command,
+    argv: writeContext.argv,
+    before_sha256: sha256(content),
+    after_sha256: after === undefined ? null : sha256(after),
+  });
   // Trim oldest beyond the cap.
   const all = snapshotFiles(filePath);
+  let trimmed = false;
   while (all.length > HISTORY_MAX) {
     const oldest = all.shift();
     if (oldest) rmSync(join(dir, oldest));
+    trimmed = true;
+  }
+  if (trimmed) trimJournal(filePath, new Set(all.map(snapshotIndex)));
+}
+
+// Write journal: one JSON line per snapshot in `<draftbase>.journal.jsonl`,
+// naming the command that made the write, so `restore --list` can say what
+// each step undoes. The journal is a best-effort annotation of the snapshots,
+// never part of the recovery path: a journal that cannot be written, read or
+// parsed is skipped and the write or restore goes ahead regardless.
+export interface JournalEntry {
+  index: number;
+  time: string;
+  command: string | null;
+  argv: string[] | null;
+  before_sha256: string;
+  after_sha256: string | null;
+}
+
+// Set once by the CLI entry point (like setDryRun). Library callers that never
+// set it journal `command: null`.
+let writeContext: { command: string | null; argv: string[] | null } = { command: null, argv: null };
+
+export function setWriteContext(command: string | null, argv: string[] | null): void {
+  writeContext = { command, argv: argv === null ? null : [...argv] };
+}
+
+function sha256(content: string): string {
+  return createHash("sha256").update(content, "utf-8").digest("hex");
+}
+
+function snapshotIndex(name: string): number {
+  return Number.parseInt(name.match(/\.(\d+)\.snap$/)?.[1] ?? "0", 10);
+}
+
+function journalPath(filePath: string): string {
+  return join(historyDir(filePath), `${basename(filePath)}.journal.jsonl`);
+}
+
+function appendJournal(filePath: string, entry: JournalEntry): void {
+  try {
+    appendFileSync(journalPath(filePath), `${JSON.stringify(entry)}\n`, "utf-8");
+  } catch {
+    // Best effort: the snapshot is the record that matters.
+  }
+}
+
+// Parsed journal lines keyed by snapshot index. Unreadable files and lines
+// that are not a JSON object with a numeric index are skipped.
+export function readJournal(filePath: string): Map<number, JournalEntry> {
+  const entries = new Map<number, JournalEntry>();
+  let raw: string;
+  try {
+    raw = readFileSync(journalPath(filePath), "utf-8");
+  } catch {
+    return entries;
+  }
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      const entry = JSON.parse(line) as JournalEntry;
+      if (entry && typeof entry === "object" && Number.isInteger(entry.index)) entries.set(entry.index, entry);
+    } catch {
+      // A torn or hand-edited line never breaks the history listing.
+    }
+  }
+  return entries;
+}
+
+// Keep the journal aligned with the snapshots HISTORY_MAX left on disk.
+function trimJournal(filePath: string, kept: Set<number>): void {
+  try {
+    const entries = readJournal(filePath);
+    const lines = [...entries.values()]
+      .filter((entry) => kept.has(entry.index))
+      .sort((a, b) => a.index - b.index)
+      .map((entry) => `${JSON.stringify(entry)}\n`);
+    writeAtomic(journalPath(filePath), lines.join(""));
+  } catch {
+    // Best effort, like the append.
   }
 }
 
@@ -276,7 +366,7 @@ function writeHistorySnapshot(filePath: string, content: string, source?: string
 export function listSnapshots(filePath: string): Array<{ step: number; index: number; path: string }> {
   const dir = historyDir(filePath);
   return snapshotFiles(filePath)
-    .map((f) => ({ index: Number.parseInt(f.match(/\.(\d+)\.snap$/)?.[1] ?? "0", 10), path: join(dir, f) }))
+    .map((f) => ({ index: snapshotIndex(f), path: join(dir, f) }))
     .sort((a, b) => b.index - a.index)
     .map((s, i) => ({ step: i + 1, index: s.index, path: s.path }));
 }
@@ -390,7 +480,7 @@ export function commitDraftTargets(
         // (what `restore --step 1` reads).
         const bak = `${item.target.path}.bak`;
         writeAtomic(bak, item.target.raw);
-        writeHistorySnapshot(item.target.path, item.target.raw, bak);
+        writeHistorySnapshot(item.target.path, item.target.raw, bak, item.content);
       }
     }
     for (const item of prepared) {
diff --git a/src/index.ts b/src/index.ts
index d4b17de..40e3178 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 
+import { createHash } from "node:crypto";
 import { copyFileSync, existsSync, readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { homedir, platform } from "node:os";
 import path from "node:path";
@@ -46,15 +47,19 @@ import {
   isDryRun,
   listSnapshots,
   loadDraft,
+  loadedDraftStore,
+  readJournal,
   saveDraft,
   setDryRun,
   setForceWrite,
+  setWriteContext,
   updateTextContent,
 } from "./draft.js";
 import type { Category, Namespace } from "./enums.js";
 import type { AddAudioOptions, AddTextOptions, AddVideoOptions, CropRect, CutOptions } from "./factory.js";
 import type { NestedTimelinesEvidence } from "./fixture.js";
 import type { ImportPlan } from "./interchange.js";
+import type { LexiconApplied } from "./lexicon.js";
 import type { LintOptions } from "./lint.js";
 import type { TextStylePreset } from "./preset.js";
 import type { SegmentCue } from "./srt.js";
@@ -384,6 +389,9 @@ Add:
                --tts-cmd 'say -o {out} {text}'          (macOS)
                --tts-cmd 'espeak-ng -w {out} {text}'
              Options:
+               --lexicon <file>   Pronunciation rules {"rules":[{"text","say",
+                                  "case_sensitive"?}]} applied to the spoken
+                                  text only (longest match, word boundaries)
                --volume <n>       Volume 0.0-1.0 (default: 1.0)
                --track-name <s>   Track name (default: "audio")
 
@@ -686,7 +694,17 @@ Discovery (Phase 3):
 Caption (v0.4 — real subtitle objects, fixes import-srt mimicry):
   caption    <project> --audio <path> [options]
   caption    <project> --from-segment <id> [options]
+  caption    <project> --words <file.json|-> [options]
              Auto-caption via whisper; emits real CapCut subtitle-track objects.
+             --words takes word timings from any external aligner instead
+             (Whisper / whisper.cpp JSON with segments[].words[], WhisperX
+             word_segments[], or a plain [{word|text|char, start, end}] array
+             in seconds, start_ms/end_ms or start_time/end_time keys — e.g.
+             Qwen3-ForcedAligner's per-character Chinese output) and does not
+             need Whisper installed. Times are timeline positions, as with
+             --audio. Entries without timing are skipped (words_skipped);
+             end<start or out-of-order entries are refused. Not combinable
+             with --audio/--from-segment/--audio-stream/--whisper-*.
              Options:
                --whisper-cmd <cmd>  Path to whisper binary (default: "whisper")
                --whisper-model <m>  Model name (default: "base")
@@ -1013,6 +1031,8 @@ interface Flags {
   fix?: boolean;
   // caption
   audio?: string;
+  /** caption --words: word timings from an external aligner (path or "-"). */
+  words?: string;
   audioStream?: number;
   fromSegment?: string;
   whisperCmd?: string;
@@ -1033,6 +1053,7 @@ interface Flags {
   text?: string;
   textFile?: string;
   ttsCmd?: string;
+  lexicon?: string;
   // export-srt
   granularity?: "line" | "word";
   format?: "srt" | "vtt";
@@ -1078,6 +1099,9 @@ interface Flags {
   videoBitrate?: string;
   burnCaptions?: boolean;
   allVideoTracks?: boolean;
+  // render: refuse an unfaithful proxy / fail on output duration drift
+  strict?: boolean;
+  verify?: boolean;
   progress?: boolean;
   maxCps?: number;
   safeArea?: number;
@@ -1088,6 +1112,11 @@ interface Flags {
   check?: boolean;
   plan?: boolean;
   apply?: boolean;
+  // batch --plan <file> / --apply-plan <file>
+  planFile?: string;
+  applyPlan?: string;
+  // Batch previews: when set, out() collects the result here instead of printing.
+  collect?: unknown[];
   // harvest-enums library sweep / manual entry
   sync?: boolean;
   add?: boolean;
@@ -1263,6 +1292,10 @@ function parseFlags(args: string[]): { positional: string[]; flags: Flags } {
       flags.minWords = parseInt(args[++i], 10);
     } else if (a === "--soft-captions") {
       flags.softCaptions = true;
+    } else if (a === "--strict") {
+      flags.strict = true;
+    } else if (a === "--verify") {
+      flags.verify = true;
     } else if (a === "--center-x" && i + 1 < args.length) {
       flags.centerX = parseFloat(args[++i]);
     } else if (a === "--center-y" && i + 1 < args.length) {
@@ -1401,6 +1434,8 @@ function parseFlags(args: string[]): { positional: string[]; flags: Flags } {
       flags.audio = args[++i];
     } else if (a === "--from-segment" && i + 1 < args.length) {
       flags.fromSegment = args[++i];
+    } else if (a === "--words" && i + 1 < args.length) {
+      flags.words = args[++i];
     } else if (a === "--whisper-cmd" && i + 1 < args.length) {
       flags.whisperCmd = args[++i];
     } else if (a === "--whisper-engine" && i + 1 < args.length) {
@@ -1435,6 +1470,8 @@ function parseFlags(args: string[]): { positional: string[]; flags: Flags } {
       flags.textFile = args[++i];
     } else if (a === "--tts-cmd" && i + 1 < args.length) {
       flags.ttsCmd = args[++i];
+    } else if (a === "--lexicon" && i + 1 < args.length) {
+      flags.lexicon = args[++i];
     } else if (a === "--granularity" && i + 1 < args.length) {
       const granularity = args[++i];
       if (!["line", "word"].includes(granularity)) {
@@ -1521,6 +1558,14 @@ function parseFlags(args: string[]): { positional: string[]; flags: Flags } {
       flags.into = args[++i];
     } else if (a === "--check") {
       flags.check = true;
+    } else if (a === "--plan" && command === "batch") {
+      const file = args[++i];
+      if (!file || file.startsWith("-")) die("--plan requires a plan file path (batch --plan <plan.json>)");
+      flags.planFile = file;
+    } else if (a === "--apply-plan") {
+      const file = args[++i];
+      if (!file || file.startsWith("-")) die("--apply-plan requires a plan file path");
+      flags.applyPlan = file;
     } else if (a === "--plan") {
       flags.plan = true;
     } else if (a === "--apply") {
@@ -1580,6 +1625,10 @@ function parseFlags(args: string[]): { positional: string[]; flags: Flags } {
 // --- Output ---
 
 function out(data: unknown, flags: Flags): void {
+  if (flags.collect) {
+    flags.collect.push(data);
+    return;
+  }
   if (flags.quiet) return;
   // In --dry-run, stamp an object result with dryRun:true so callers can tell a
   // preview from a committed write. Arrays (read commands) are left untouched.
@@ -2698,13 +2747,38 @@ async function cmdTts(draft: Draft, filePath: string, positional: string[], flag
         "The tool must write a wav (or other CapCut-supported) audio file at {out}.",
     );
   }
+  // The lexicon rewrites only what the engine hears; refusals land here,
+  // before any engine runs.
+  let lexicon: { rules: number; applied: LexiconApplied[]; spoken_text: string } | undefined;
+  if (flags.lexicon !== undefined) {
+    const { applyLexicon, LexiconError, parseLexicon } = await import("./lexicon.js");
+    if (!existsSync(flags.lexicon)) die(`refused [lexicon-invalid]: lexicon file not found: ${flags.lexicon}`);
+    let doc: unknown;
+    try {
+      doc = JSON.parse(stripBom(readFileSync(flags.lexicon, "utf-8")));
+    } catch (e) {
+      die(`refused [lexicon-invalid]: ${flags.lexicon} is not valid JSON (${(e as Error).message}).`);
+    }
+    try {
+      const rules = parseLexicon(doc);
+      const r = applyLexicon(text, rules);
+      lexicon = { rules: rules.length, applied: r.applied, spoken_text: r.spoken_text };
+    } catch (e) {
+      if (e instanceof LexiconError) die(`refused [${e.gate}]: ${flags.lexicon}: ${e.message}`);
+      throw e;
+    }
+    if (lexicon.spoken_text.trim().length === 0) {
+      die("refused [lexicon-invalid]: the lexicon rewrote the voiceover text to nothing; there is nothing to speak.");
+    }
+  }
+  const spokenText = lexicon?.spoken_text ?? text;
   const start = positional[2] ? parseTimeInput(positional[2]) : 0;
   const durationStr = positional[3];
   // Synthesize straight into the dir addAudio copies into (like the Wikimedia
   // fetch path) so its copyAssetDeduped becomes a no-op on the same file.
   const assetsDir = path.resolve(draftProjectDir(filePath), "assets", "audio");
   const outPath = collisionSafeOutPath(assetsDir);
-  const synthesis = synthesizeSpeech(text, flags.ttsCmd, outPath);
+  const synthesis = synthesizeSpeech(spokenText, flags.ttsCmd, outPath);
   const media = flags.noProbe ? null : probeMedia(outPath, flags.ffprobeCmd);
   const duration = durationStr ? parseTimeInput(durationStr) : media?.durationUs;
   if (!duration || duration <= 0) {
@@ -2735,6 +2809,9 @@ async function cmdTts(draft: Draft, filePath: string, positional: string[], flag
       duration_us: duration,
       duration_source: durationStr ? "argument" : "ffprobe",
       media_probe: media,
+      // Offsets are UTF-16 code unit indices into the trimmed source text;
+      // text_chars above stays the original (displayed) text's length.
+      ...(lexicon ? { lexicon } : {}),
     },
     flags,
   );
@@ -3972,8 +4049,25 @@ async function cmdLint(draft: Draft, filePath: string, flags: Flags): Promise<{
 async function cmdCaption(draft: Draft, filePath: string, flags: Flags): Promise<void> {
   const { loadPresetFile } = await import("./preset.js");
   const { captionDraft } = await import("./caption.js");
-  if (!flags.audio && !flags.fromSegment) {
-    die("Missing --audio <path> or --from-segment <id>. One is required.");
+  if (flags.words !== undefined) {
+    // --words replaces the transcription step entirely, so every flag that
+    // only steers Whisper (or the audio it would hear) is a contradiction.
+    const conflicting = [
+      flags.audio !== undefined && "--audio",
+      flags.fromSegment !== undefined && "--from-segment",
+      flags.audioStream !== undefined && "--audio-stream",
+      flags.ffmpegCmd !== undefined && "--ffmpeg-cmd",
+      flags.whisperCmd !== undefined && "--whisper-cmd",
+      flags.whisperEngine !== undefined && "--whisper-engine",
+      flags.whisperModel !== undefined && "--whisper-model",
+    ].filter(Boolean);
+    if (conflicting.length > 0) {
+      die(
+        `--words is mutually exclusive with ${conflicting.join(", ")}: the word timings come from the file, Whisper does not run.`,
+      );
+    }
+  } else if (!flags.audio && !flags.fromSegment) {
+    die("Missing --audio <path>, --from-segment <id> or --words <file.json>. One is required.");
   }
   if (flags.karaoke && flags.wordReveal) die("--karaoke and --word-reveal are mutually exclusive.");
   if (
@@ -3994,7 +4088,16 @@ async function cmdCaption(draft: Draft, filePath: string, flags: Flags): Promise
     if (!existsSync(flags.script)) die(`--script file not found: ${flags.script}`);
     scriptText = stripBom(readFileSync(flags.script, "utf-8"));
   }
+  let wordsJson: string | undefined;
+  if (flags.words !== undefined) {
+    if (flags.words !== "-" && !existsSync(flags.words)) die(`--words file not found: ${flags.words}`);
+    wordsJson = stripBom(readFileSync(flags.words === "-" ? 0 : flags.words, "utf-8"));
+    if (!wordsJson.trim())
+      die(flags.words === "-" ? "No input on stdin for --words" : `--words file is empty: ${flags.words}`);
+  }
   const result = captionDraft(draft, {
+    wordsJson,
+    wordsSource: flags.words === "-" ? "stdin" : flags.words,
     audio: flags.audio,
     audioStream: flags.audioStream,
     ffmpegCmd: flags.ffmpegCmd,
@@ -4024,7 +4127,7 @@ async function cmdCaption(draft: Draft, filePath: string, flags: Flags): Promise
   // refuse — a heavy accent or a noisy room legitimately lowers the ratio.
   if (result.script && result.script.match_ratio < 0.5 && !flags.quiet) {
     process.stderr.write(
-      `Warning: only ${Math.round(result.script.match_ratio * 100)}% of the script's words matched what whisper heard ` +
+      `Warning: only ${Math.round(result.script.match_ratio * 100)}% of the script's words matched ${flags.words !== undefined ? "the --words timings" : "what whisper heard"} ` +
         `(${result.script.matched}/${result.script.script_words}). Check that --script belongs to this audio.\n`,
     );
   }
@@ -4223,7 +4326,7 @@ interface BatchOp {
 }
 
 function execBatchOp(draft: Draft, filePath: string, op: BatchOp, flags: Flags): void {
-  const silent = { ...flags, quiet: true };
+  const silent = { ...flags, quiet: true, collect: flags.collect };
   switch (op.cmd) {
     case "set-text":
       if (!op.id || op.text === undefined) die(`batch set-text requires id and text`);
@@ -4258,34 +4361,171 @@ function execBatchOp(draft: Draft, filePath: string, op: BatchOp, flags: Flags):
   }
 }
 
-function cmdBatch(draft: Draft, filePath: string, flags: Flags): void {
-  const input = stripBom(readFileSync(0, "utf-8")).trim();
-  if (!input) die("No input on stdin");
+type BatchLine = { line: number; input: string; op: BatchOp | null; parseError?: string };
+
+function parseBatchLines(input: string): BatchLine[] {
+  const parsed: BatchLine[] = [];
   const lines = input.split("\n");
-  let working = structuredClone(draft);
-  const errors: Array<{ line: number; input: string; error: string }> = [];
-  let succeeded = 0;
   for (let index = 0; index < lines.length; index++) {
-    const line = lines[index];
-    const trimmed = line.trim();
+    const trimmed = lines[index].trim();
     if (!trimmed) continue;
     try {
       const op = JSON.parse(trimmed) as BatchOp;
       if (!op || typeof op !== "object" || typeof op.cmd !== "string") {
         throw new Error("batch line must be an object with a string cmd field");
       }
+      parsed.push({ line: index + 1, input: trimmed, op });
+    } catch (e) {
+      parsed.push({
+        line: index + 1,
+        input: trimmed,
+        op: null,
+        parseError: e instanceof Error ? e.message : String(e),
+      });
+    }
+  }
+  return parsed;
+}
+
+// Run parsed operations against a clone of `draft`. `previews`, when given,
+// receives each operation's own result object (what the command would have
+// printed) for the reviewed-plan file.
+function runBatchOps(
+  draft: Draft,
+  filePath: string,
+  ops: BatchLine[],
+  flags: Flags,
+  previews?: Array<Record<string, unknown>>,
+): { working: Draft; succeeded: number; errors: Array<{ line: number; input: string; error: string }> } {
+  let working = structuredClone(draft);
+  const errors: Array<{ line: number; input: string; error: string }> = [];
+  let succeeded = 0;
+  for (const { line, input, op, parseError } of ops) {
+    const collect: unknown[] = [];
+    try {
+      if (op === null) throw new Error(parseError ?? "batch line must be an object with a string cmd field");
       // Each operation runs against its own clone. A failing operation can
       // never leave a partial mutation behind, even in --continue-on-error.
       const candidate = structuredClone(working);
-      execBatchOp(candidate, filePath, op, flags);
+      execBatchOp(candidate, filePath, op, previews ? { ...flags, collect } : flags);
       working = candidate;
       succeeded++;
+      previews?.push({ line, cmd: op.cmd, ok: true, result: collect[collect.length - 1] ?? null });
     } catch (e) {
       const msg = e instanceof Error ? e.message : String(e);
-      errors.push({ line: index + 1, input: trimmed, error: msg });
+      errors.push({ line, input, error: msg });
+      previews?.push({ line, cmd: op?.cmd ?? null, ok: false, error: msg });
       if (!flags.continueOnError) break;
     }
   }
+  return { working, succeeded, errors };
+}
+
+// Reviewed batch plans. `batch --plan <file>` validates the operations the way
+// a real run would (in memory, under dry-run) and records them with two
+// hashes: the timeline document as loaded, and a canonical serialization of
+// the operations. `batch --apply-plan <file>` re-checks both before applying,
+// so what runs is exactly what was reviewed, against exactly the draft it was
+// reviewed on.
+const BATCH_PLAN_FORMAT = "capcut-cli.batch-plan";
+const BATCH_PLAN_VERSION = 1;
+
+// JSON with object keys sorted at every level: equal operations hash equal
+// however the plan file was re-indented or its keys reordered.
+function canonicalJson(value: unknown): string {
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  if (value !== null && typeof value === "object") {
+    const record = value as Record<string, unknown>;
+    const entries = Object.keys(record)
+      .filter((key) => record[key] !== undefined)
+      .sort()
+      .map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`);
+    return `{${entries.join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+
+function sha256Hex(content: string): string {
+  return createHash("sha256").update(content, "utf-8").digest("hex");
+}
+
+// Hash of the canonical timeline document's bytes as loaded (BOM-stripped,
+// as the changed-on-disk guard compares them).
+function loadedDraftSha256(filePath: string): string {
+  const raw = loadedDraftStore(filePath).canonical.raw;
+  return sha256Hex(raw ?? stripBom(readFileSync(filePath, "utf-8")));
+}
+
+function cmdBatch(draft: Draft, filePath: string, flags: Flags): void {
+  if (flags.planFile !== undefined && flags.applyPlan !== undefined)
+    die("--plan and --apply-plan are mutually exclusive: write a plan, review it, then apply it.");
+  // --apply-plan takes its operations from the reviewed plan only; stdin is never read.
+  if (flags.applyPlan !== undefined) {
+    cmdBatchApplyPlan(draft, filePath, flags.applyPlan, flags);
+    return;
+  }
+
+  const input = stripBom(readFileSync(0, "utf-8")).trim();
+  if (!input) die("No input on stdin");
+  const ops = parseBatchLines(input);
+  if (flags.planFile !== undefined) writeBatchPlan(draft, filePath, ops, flags.planFile, flags);
+  else commitBatch(draft, filePath, ops, flags);
+}
+
+function writeBatchPlan(draft: Draft, filePath: string, ops: BatchLine[], planFile: string, flags: Flags): void {
+  const previews: Array<Record<string, unknown>> = [];
+  const wasDryRun = isDryRun();
+  setDryRun(true);
+  let run: ReturnType<typeof runBatchOps>;
+  try {
+    run = runBatchOps(draft, filePath, ops, flags, previews);
+  } finally {
+    setDryRun(wasDryRun);
+  }
+  if (run.errors.length > 0 && !flags.continueOnError) {
+    throw new Error(
+      `batch plan rejected at line ${run.errors[0].line}; no plan written: ${run.errors[0].error}. ` +
+        "Pass --continue-on-error to plan only the operations that validate.",
+    );
+  }
+  // Only operations that validated go into the plan, so applying it is the
+  // transactional run the preview showed.
+  const failed = new Set(run.errors.map((error) => error.line));
+  const operations = ops.filter((item) => !failed.has(item.line)).map((item) => item.op as BatchOp);
+  const plan = {
+    format: BATCH_PLAN_FORMAT,
+    version: BATCH_PLAN_VERSION,
+    project: filePath,
+    draft_sha256: loadedDraftSha256(filePath),
+    operations,
+    operations_sha256: sha256Hex(canonicalJson(operations)),
+    preview: previews,
+  };
+  writeFileSync(planFile, `${JSON.stringify(plan, null, 2)}\n`, "utf-8");
+  if (run.errors.length > 0) process.exitCode = 1;
+  out(
+    {
+      ok: run.errors.length === 0,
+      plan: planFile,
+      project: filePath,
+      operations: operations.length,
+      failed: run.errors.length,
+      errors: run.errors,
+      draft_sha256: plan.draft_sha256,
+      operations_sha256: plan.operations_sha256,
+    },
+    flags,
+  );
+}
+
+function commitBatch(
+  draft: Draft,
+  filePath: string,
+  ops: BatchLine[],
+  flags: Flags,
+  extra: Record<string, unknown> = {},
+): void {
+  const { working, succeeded, errors } = runBatchOps(draft, filePath, ops, flags);
 
   if (errors.length > 0 && !flags.continueOnError) {
     throw new Error(
@@ -4300,11 +4540,68 @@ function cmdBatch(draft: Draft, filePath: string, flags: Flags): void {
   }
   if (errors.length > 0) process.exitCode = 1;
   out(
-    { ok: errors.length === 0, transactional: !flags.continueOnError, succeeded, failed: errors.length, errors },
+    {
+      ok: errors.length === 0,
+      transactional: !flags.continueOnError,
+      succeeded,
+      failed: errors.length,
+      errors,
+      ...extra,
+    },
     flags,
   );
 }
 
+function cmdBatchApplyPlan(draft: Draft, filePath: string, planPath: string, flags: Flags): void {
+  let plan: Record<string, unknown>;
+  try {
+    plan = JSON.parse(stripBom(readFileSync(planPath, "utf-8"))) as Record<string, unknown>;
+  } catch (e) {
+    die(`Cannot read plan ${planPath}: ${e instanceof Error ? e.message : String(e)}`);
+  }
+  if (!plan || typeof plan !== "object" || plan.format !== BATCH_PLAN_FORMAT)
+    die(`${planPath} is not a batch plan (expected format "${BATCH_PLAN_FORMAT}").`);
+  if (plan.version !== BATCH_PLAN_VERSION)
+    die(
+      `Unsupported batch plan version ${String(plan.version)} in ${planPath} (this CLI reads ${BATCH_PLAN_VERSION}).`,
+    );
+  if (
+    !Array.isArray(plan.operations) ||
+    typeof plan.operations_sha256 !== "string" ||
+    typeof plan.draft_sha256 !== "string"
+  )
+    die(`Batch plan ${planPath} is missing operations, operations_sha256 or draft_sha256.`);
+  if (typeof plan.project === "string" && path.resolve(plan.project) !== path.resolve(filePath)) {
+    throw new Error(
+      `refused [plan-project-mismatch]: plan ${planPath} was made for ${plan.project}, not ${filePath}. ` +
+        "Apply it to the project it was planned on.",
+    );
+  }
+  const draftSha = loadedDraftSha256(filePath);
+  if (draftSha !== plan.draft_sha256) {
+    throw new Error(
+      `refused [plan-draft-changed]: ${filePath} changed since the plan was made ` +
+        `(${draftSha} != ${plan.draft_sha256}). Re-run batch --plan against the current draft and review it again.`,
+    );
+  }
+  const operationsSha = sha256Hex(canonicalJson(plan.operations));
+  if (operationsSha !== plan.operations_sha256) {
+    throw new Error(
+      `refused [plan-tampered]: the operations in ${planPath} no longer match its operations_sha256 ` +
+        `(${operationsSha} != ${plan.operations_sha256}). Re-run batch --plan and review the new plan.`,
+    );
+  }
+  const ops: BatchLine[] = (plan.operations as unknown[]).map((op, index) => {
+    const valid = op !== null && typeof op === "object" && typeof (op as BatchOp).cmd === "string";
+    return {
+      line: index + 1,
+      input: JSON.stringify(op),
+      op: valid ? (op as BatchOp) : null,
+    };
+  });
+  commitBatch(draft, filePath, ops, flags, { plan: planPath, operations_sha256: operationsSha });
+}
+
 async function cmdDoctor(flags: Flags): Promise<boolean> {
   const { runDoctor } = await import("./doctor.js");
   const report = runDoctor({ drafts: flags.drafts });
@@ -4877,7 +5174,20 @@ function cmdRestore(projectPath: string | undefined, flags: Flags): void {
   const snaps = listSnapshots(filePath);
 
   if (flags.list) {
-    out({ ok: true, count: snaps.length, snapshots: snaps.map((s) => ({ step: s.step, path: s.path })) }, flags);
+    // Each step names the write it undoes when the journal has its index;
+    // snapshots from before the journal (or with a torn line) list with nulls.
+    const journal = readJournal(filePath);
+    const snapshots = snaps.map((s) => {
+      const entry = journal.get(s.index);
+      return {
+        step: s.step,
+        path: s.path,
+        command: entry?.command ?? null,
+        argv: entry?.argv ?? null,
+        time: entry?.time ?? null,
+      };
+    });
+    out({ ok: true, count: snaps.length, snapshots }, flags);
     return;
   }
 
@@ -5591,7 +5901,7 @@ async function cmdCompileData(specPath: string, flags: Flags): Promise<void> {
 // it never mutates the draft. With --dry-run it returns the ffmpeg plan without
 // executing, so the filter graph is inspectable (and the path is ffmpeg-free).
 async function cmdRender(draft: Draft, filePath: string, flags: Flags): Promise<void> {
-  const { buildRenderPlan, renderDraft } = await import("./render.js");
+  const { assertFaithful, buildRenderPlan, renderDraft } = await import("./render.js");
   if (flags.crf !== undefined && flags.videoBitrate !== undefined) {
     die("--crf and --video-bitrate are mutually exclusive.");
   }
@@ -5614,6 +5924,8 @@ async function cmdRender(draft: Draft, filePath: string, flags: Flags): Promise<
     allVideoTracks: flags.allVideoTracks,
     dryRun: isDryRun(),
     progress: flags.progress,
+    strict: flags.strict,
+    ffprobeCmd: flags.ffprobeCmd,
   };
   if (opts.dryRun) {
     // Build-only: surface the plan; no ffmpeg needed.
@@ -5621,12 +5933,25 @@ async function cmdRender(draft: Draft, filePath: string, flags: Flags): Promise<
       ...opts,
       out: opts.out ?? path.join(draftProjectDir(filePath), "preview.mp4"),
     });
+    if (opts.strict) assertFaithful(plan.fidelity);
     out({ ok: true, executed: false, ...plan }, flags);
     return;
   }
   const result = renderDraft(draft, filePath, opts);
   out(result, flags);
   if (!flags.quiet) process.stderr.write(`Rendered: ${result.output}\n`);
+  // --verify: the file stays on disk either way; the result above says why.
+  const check = result.verification;
+  if (flags.verify && check) {
+    if (!check.verified) die(`render --verify: output could not be verified: ${check.reason}`);
+    if (!check.within_tolerance) {
+      die(
+        `render --verify: output duration ${check.duration_us}us drifts ${check.drift_us}us from the draft's ` +
+          `${check.expected_duration_us}us, beyond the one-frame tolerance of ${check.tolerance_us}us. ` +
+          `The file was kept at ${result.output}; the result's \`fidelity\` lists what the proxy dropped (main_track_gaps shortens it).`,
+      );
+    }
+  }
 }
 
 async function cmdDetectScenes(positional: string[], flags: Flags): Promise<void> {
@@ -5851,6 +6176,11 @@ async function main(): Promise<void> {
   // Global --dry-run: gate every saveDraft write (see src/draft.ts).
   setDryRun(flags.dryRun === true);
   setForceWrite(flags.forceWrite === true);
+  // Write journal: every history snapshot records the command that made it.
+  if (positional[0] !== undefined) {
+    const at = raw.indexOf(positional[0]);
+    setWriteContext(positional[0], at >= 0 ? raw.slice(at + 1) : []);
+  }
   if (flags.activeTimeline && ["compile", "import-timeline"].includes(positional[0]) && !flags.into)
     die("--active-timeline requires --into for this command.");
   setActiveTimelineSelection(flags.activeTimeline === true);
diff --git a/src/lexicon.ts b/src/lexicon.ts
new file mode 100644
index 0000000..28b244d
--- /dev/null
+++ b/src/lexicon.ts
@@ -0,0 +1,156 @@
+/**
+ * Pronunciation lexicon for `tts --lexicon`: rewrite only the text handed to
+ * the TTS engine ("Nguyen" -> "Win"), never what the draft shows.
+ *
+ * Matching is leftmost-longest over the source text. A rule whose first/last
+ * character is a word character (letter, digit, mark, underscore) only matches
+ * where the neighbouring text character is not one, so "SQL" never fires inside
+ * "MySQLite". CJK scripts have no word boundaries: CJK characters neither need
+ * nor block a boundary, so a CJK rule matches anywhere and "SQL" still matches
+ * in "我用SQL". Offsets are JS string (UTF-16 code unit) indices into the
+ * source text. Pure: no I/O, so the matcher is unit-testable on its own.
+ */
+
+export interface LexiconRule {
+  text: string;
+  say: string;
+  /** Default true. */
+  case_sensitive: boolean;
+}
+
+export interface LexiconApplied {
+  rule_text: string;
+  say: string;
+  /** UTF-16 code unit offsets into the source text, end exclusive. */
+  source_start: number;
+  source_end: number;
+}
+
+export interface LexiconResult {
+  spoken_text: string;
+  applied: LexiconApplied[];
+}
+
+/** A lexicon problem carrying its refusal gate id (`lexicon-invalid` / `lexicon-ambiguous`). */
+export class LexiconError extends Error {
+  constructor(
+    readonly gate: "lexicon-invalid" | "lexicon-ambiguous",
+    message: string,
+  ) {
+    super(message);
+    this.name = "LexiconError";
+  }
+}
+
+const WORD_CHAR = /^[\p{L}\p{N}\p{M}_]$/u;
+const CJK_CHAR = /^[\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Hangul}\p{Script=Bopomofo}]$/u;
+
+function isCjk(ch: string): boolean {
+  return CJK_CHAR.test(ch);
+}
+
+/** A character that forms a word with an adjacent rule edge (CJK excluded). */
+function bindsWord(ch: string | undefined): boolean {
+  return ch !== undefined && WORD_CHAR.test(ch) && !isCjk(ch);
+}
+
+/** The full code point ending just before code unit `i`. */
+function charBefore(s: string, i: number): string | undefined {
+  if (i <= 0) return undefined;
+  const low = s.charCodeAt(i - 1);
+  if (low >= 0xdc00 && low <= 0xdfff && i >= 2) {
+    const high = s.charCodeAt(i - 2);
+    if (high >= 0xd800 && high <= 0xdbff) return s.slice(i - 2, i);
+  }
+  return s[i - 1];
+}
+
+/** The full code point starting at code unit `i`. */
+function charAt(s: string, i: number): string | undefined {
+  if (i >= s.length) return undefined;
+  const cp = s.codePointAt(i);
+  return cp === undefined ? undefined : String.fromCodePoint(cp);
+}
+
+/**
+ * Validate a parsed lexicon document: `{ "rules": [...] }` or a bare array of
+ * `{ text, say, case_sensitive? }`. Throws LexiconError(lexicon-invalid).
+ */
+export function parseLexicon(doc: unknown): LexiconRule[] {
+  const list = Array.isArray(doc)
+    ? doc
+    : doc !== null && typeof doc === "object" && Array.isArray((doc as { rules?: unknown }).rules)
+      ? (doc as { rules: unknown[] }).rules
+      : undefined;
+  if (list === undefined) {
+    throw new LexiconError(
+      "lexicon-invalid",
+      'the lexicon must be { "rules": [ { "text": ..., "say": ... } ] } or a top-level array of rules.',
+    );
+  }
+  return list.map((raw, i): LexiconRule => {
+    const where = `rule ${i}`;
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+      throw new LexiconError("lexicon-invalid", `${where} is not an object.`);
+    }
+    const r = raw as Record<string, unknown>;
+    if (typeof r.text !== "string") throw new LexiconError("lexicon-invalid", `${where} needs a string "text".`);
+    if (r.text.length === 0) throw new LexiconError("lexicon-invalid", `${where} has an empty "text".`);
+    if (typeof r.say !== "string") {
+      throw new LexiconError("lexicon-invalid", `${where} ("${r.text}") needs a string "say".`);
+    }
+    if (r.case_sensitive !== undefined && typeof r.case_sensitive !== "boolean") {
+      throw new LexiconError("lexicon-invalid", `${where} ("${r.text}") has a non-boolean "case_sensitive".`);
+    }
+    return { text: r.text, say: r.say, case_sensitive: r.case_sensitive !== false };
+  });
+}
+
+function matchesAt(source: string, i: number, rule: LexiconRule): boolean {
+  const end = i + rule.text.length;
+  if (end > source.length) return false;
+  const slice = source.slice(i, end);
+  if (rule.case_sensitive ? slice !== rule.text : slice.toLowerCase() !== rule.text.toLowerCase()) return false;
+  // Boundaries are only demanded at rule edges that are themselves word
+  // characters: "C++" may be followed by a letter, "SQL" may not.
+  if (bindsWord(charAt(rule.text, 0)) && bindsWord(charBefore(source, i))) return false;
+  if (bindsWord(charBefore(rule.text, rule.text.length)) && bindsWord(charAt(source, end))) return false;
+  return true;
+}
+
+/**
+ * Apply the rules to `source`: at each position the longest matching rule
+ * wins; equally long matches that would say different things refuse with
+ * LexiconError(lexicon-ambiguous). Replaced spans are not rescanned.
+ */
+export function applyLexicon(source: string, rules: readonly LexiconRule[]): LexiconResult {
+  const byLength = [...rules].sort((a, b) => b.text.length - a.text.length);
+  const applied: LexiconApplied[] = [];
+  let spoken = "";
+  let i = 0;
+  while (i < source.length) {
+    let winner: LexiconRule | undefined;
+    for (const rule of byLength) {
+      if (winner !== undefined && rule.text.length < winner.text.length) break;
+      if (!matchesAt(source, i, rule)) continue;
+      if (winner === undefined) winner = rule;
+      else if (winner.say !== rule.say) {
+        throw new LexiconError(
+          "lexicon-ambiguous",
+          `rules "${winner.text}" (say "${winner.say}") and "${rule.text}" (say "${rule.say}") both match ` +
+            `"${source.slice(i, i + rule.text.length)}" at offset ${i}. Remove one or make them distinct.`,
+        );
+      }
+    }
+    if (winner === undefined) {
+      spoken += source[i];
+      i++;
+      continue;
+    }
+    const end = i + winner.text.length;
+    applied.push({ rule_text: winner.text, say: winner.say, source_start: i, source_end: end });
+    spoken += winner.say;
+    i = end;
+  }
+  return { spoken_text: spoken, applied };
+}
diff --git a/src/lint.ts b/src/lint.ts
index ec7d1f9..2109330 100644
--- a/src/lint.ts
+++ b/src/lint.ts
@@ -40,7 +40,8 @@ export interface LintIssue {
 
 // Codes that lintDraft can mechanically repair via fixDraft. Membership here
 // is necessary but not sufficient for fixable:true — line-too-long,
-// caption-gap-too-small, main-track-gap, and media-outside-draft are
+// caption-gap-too-small, main-track-gap, segment-overlap (only overlaps of at
+// most one frame), and media-outside-draft are
 // additionally stamped per instance, so an issue is only marked fixable when
 // fixDraft can actually clear that exact instance. dangling-companion-ref is
 // always safely fixable: the repair drops a ref that points at nothing —
@@ -62,6 +63,7 @@ const FIXABLE_CODES = new Set<string>([
   "media-unlinked",
   "text-range-doubled",
   "segment-off-frame-grid",
+  "segment-overlap",
 ]);
 
 // Floor for any duration --fix writes: 100ms = three frames at the 30fps
@@ -182,7 +184,7 @@ export function lintDraft(draft: Draft, opts: LintOptions = DEFAULT_LINT_OPTIONS
   };
 
   if (opts.frameGrid) {
-    const fps = typeof draft.fps === "number" && Number.isFinite(draft.fps) && draft.fps > 0 ? draft.fps : 30;
+    const fps = draftFps(draft);
     for (const track of draft.tracks) {
       for (const segment of track.segments) {
         const start = segment.target_timerange.start;
@@ -372,6 +374,128 @@ export function lintDraft(draft: Draft, opts: LintOptions = DEFAULT_LINT_OPTIONS
     }
   }
 
+  // Overlaps on every other track type. Text tracks keep caption-overlap
+  // above; on a video, audio, sticker, effect or filter track two segments
+  // sharing the same microseconds is a draft the app either refuses or
+  // resolves by its own rule (one clip hides the other, or the later one is
+  // pushed to a new track on the first edit). Consecutive pairs by start, the
+  // caption-overlap walk. The classic cause is independent rounding — start
+  // and duration rounded separately leave the earlier clip a microsecond past
+  // the next one's start — so an overlap of at most one frame is fixable
+  // (--fix pulls the earlier end back to the next start); anything wider is a
+  // real edit collision and stays report-only, because which clip should give
+  // way is an authoring decision.
+  const overlapFrameUs = Math.ceil(1_000_000 / draftFps(draft));
+  for (const track of draft.tracks) {
+    if (track.type === "text") continue;
+    const segs = [...track.segments].sort((a, b) => a.target_timerange.start - b.target_timerange.start);
+    for (let i = 0; i < segs.length - 1; i++) {
+      const s = segs[i];
+      const next = segs[i + 1];
+      const overlap = s.target_timerange.start + s.target_timerange.duration - next.target_timerange.start;
+      if (overlap <= 0) continue;
+      const repairable = overlap <= overlapFrameUs && s.target_timerange.duration - overlap > 0;
+      issues.push({
+        severity: "error",
+        code: "segment-overlap",
+        message:
+          `Segments ${shortId(s.id)} and ${shortId(next.id)} overlap by ${overlap}us on ${track.type} track "${track.name}"` +
+          (repairable
+            ? " — a sub-frame rounding overlap; --fix ends the earlier segment where the next begins"
+            : ` — wider than one frame (${overlapFrameUs}us at ${draftFps(draft)}fps), so --fix leaves it: trim or move one of them`),
+        fixable: FIXABLE_CODES.has("segment-overlap") && repairable,
+        location: { track: track.name, segment_id: s.id },
+      });
+    }
+  }
+
+  // Visual segments nobody can see: a clip transform that parks the whole
+  // bounding box off the canvas, a zero scale on either axis, or zero
+  // opacity. Usually the leftover of a botched batch edit (a percent written
+  // where a fraction was meant, x in pixels instead of canvas units), and
+  // invisible in every timeline view except the preview itself.
+  //
+  // Transform convention (render.ts's overlay math, the same one the app
+  // uses): clip.transform x/y are normalized to the canvas with the origin at
+  // its centre, one unit = half the canvas — x = +/-1 puts the clip's centre
+  // on the right/left edge, y = +/-1 on the top/bottom edge (y points up).
+  // The material is first fitted inside the canvas (contain, aspect kept),
+  // then multiplied by clip.scale. A box of width w (pixels) is therefore
+  // fully off-canvas once |x| * W/2 >= W/2 + w/2, i.e. |x| >= 1 + w/W; same
+  // for y. Rotation widens the box to its rotated bounding box. Without a
+  // known material size (stickers, text, a video material with no
+  // width/height) the material is assumed to fill the canvas at scale 1 —
+  // the generous reading, so an unknown size never produces a false alarm.
+  //
+  // `visible` is not judged: the CLI only ever writes `visible: true` and
+  // nothing in the code base establishes how the app treats false.
+  //
+  // Keyframes: a reason is skipped when the segment animates the property
+  // behind it (position for off-canvas, scale for zero scale, alpha for zero
+  // opacity) — the static value is then only the pre-animation value, and a
+  // fade-in from alpha 0 is the most common keyframe there is. Warning, no
+  // --fix: where the clip was meant to be is not recoverable.
+  const canvasW = draft.canvas_config?.width;
+  const canvasH = draft.canvas_config?.height;
+  const hasCanvas = typeof canvasW === "number" && canvasW > 0 && typeof canvasH === "number" && canvasH > 0;
+  for (const track of draft.tracks) {
+    if (track.type !== "video" && track.type !== "sticker" && track.type !== "text") continue;
+    for (const s of track.segments) {
+      const clip = s.clip;
+      if (!clip || typeof clip !== "object") continue;
+      const animated = keyframedProperties(s);
+      const reasons: string[] = [];
+      const sx = clip.scale?.x;
+      const sy = clip.scale?.y;
+      const scaleAnimated =
+        animated.has("KFTypeScaleX") || animated.has("KFTypeScaleY") || animated.has("UNIFORM_SCALE");
+      if (!scaleAnimated && (sx === 0 || sy === 0)) reasons.push("zero scale");
+      if (!animated.has("KFTypeAlpha") && clip.alpha === 0) reasons.push("zero opacity");
+      const x = clip.transform?.x;
+      const y = clip.transform?.y;
+      const positionAnimated = animated.has("KFTypePositionX") || animated.has("KFTypePositionY");
+      if (!positionAnimated && typeof x === "number" && typeof y === "number" && !reasons.includes("zero scale")) {
+        // Fitted material size as a fraction of the canvas (1 = fills that axis).
+        let fitW = 1;
+        let fitH = 1;
+        if (track.type === "video" && hasCanvas) {
+          const mat = findMaterial(draft.materials?.videos ?? [], s.material_id) as
+            | { width?: unknown; height?: unknown }
+            | undefined;
+          const mw = mat?.width;
+          const mh = mat?.height;
+          if (typeof mw === "number" && mw > 0 && typeof mh === "number" && mh > 0) {
+            const fit = Math.min(canvasW / mw, canvasH / mh);
+            fitW = (mw * fit) / canvasW;
+            fitH = (mh * fit) / canvasH;
+          }
+        }
+        // Work in pixels so a rotation mixes the axes at the right aspect; an
+        // unknown canvas uses a square unit canvas (only the ratio matters).
+        const W = hasCanvas ? canvasW : 1;
+        const H = hasCanvas ? canvasH : 1;
+        const w = fitW * W * Math.abs(typeof sx === "number" ? sx : 1);
+        const h = fitH * H * Math.abs(typeof sy === "number" ? sy : 1);
+        const rad = ((typeof clip.rotation === "number" ? clip.rotation : 0) * Math.PI) / 180;
+        const cos = Math.abs(Math.cos(rad));
+        const sin = Math.abs(Math.sin(rad));
+        const boxW = w * cos + h * sin;
+        const boxH = w * sin + h * cos;
+        if (Math.abs(x) >= 1 + boxW / W || Math.abs(y) >= 1 + boxH / H) reasons.push("outside canvas");
+      }
+      if (reasons.length === 0) continue;
+      issues.push({
+        severity: "warning",
+        code: "segment-offscreen",
+        message:
+          `Segment ${shortId(s.id)} on ${track.type} track "${track.name}" cannot be seen: ${reasons.join(", ")}` +
+          ` (scale ${sx ?? "?"}x${sy ?? "?"}, alpha ${clip.alpha ?? "?"}, position ${x ?? "?"},${y ?? "?"} in canvas half-widths)`,
+        fixable: false,
+        location: { track: track.name, segment_id: s.id },
+      });
+    }
+  }
+
   // Source range against the material it reads from. CapCut treats a
   // `source_timerange` that reaches past the material's duration as out of
   // range and clamps the in-point to zero, so every such clip plays from the
@@ -1059,7 +1183,7 @@ export function fixDraft(draft: Draft, opts: LintOptions = DEFAULT_LINT_OPTIONS)
   // Pass -2: snap the two boundaries, then derive duration. Rounding start
   // and duration independently is the exact 1us-overlap failure this fixes.
   if (opts.frameGrid) {
-    const fps = typeof draft.fps === "number" && Number.isFinite(draft.fps) && draft.fps > 0 ? draft.fps : 30;
+    const fps = draftFps(draft);
     const timelineEnd = (): number => {
       let maxEnd = 0;
       for (const track of draft.tracks) {
@@ -1078,10 +1202,7 @@ export function fixDraft(draft: Draft, opts: LintOptions = DEFAULT_LINT_OPTIONS)
         const newEnd = quantizeToFrame(oldStart + oldDuration, fps);
         if (newEnd <= newStart) continue;
         segment.target_timerange.start = newStart;
-        segment.target_timerange.duration = newEnd - newStart;
-        if (segment.source_timerange?.duration === oldDuration && (segment.speed ?? 1) === 1) {
-          segment.source_timerange.duration = newEnd - newStart;
-        }
+        setTargetDuration(segment, newEnd - newStart);
       }
     }
     if (draft.duration === oldMaxEnd) {
@@ -1122,6 +1243,25 @@ export function fixDraft(draft: Draft, opts: LintOptions = DEFAULT_LINT_OPTIONS)
     }
   }
 
+  // Pass 0b: end the earlier of two overlapping non-text segments where the
+  // next one begins — only for overlaps of at most one frame, exactly the
+  // instances lintDraft stamped fixable. After pass 0 on purpose: shortening
+  // a non-main-track clip could flip canCloseMainTrackGap from unsafe to
+  // safe, and pass 0 must act on the state the stamp was read from. Pass 0
+  // moves both members of an overlapping pair by the same shift, so the
+  // overlap widths read here are the ones lint reported.
+  const overlapFrameUs = Math.ceil(1_000_000 / draftFps(draft));
+  for (const track of draft.tracks) {
+    if (track.type === "text") continue;
+    const segs = [...track.segments].sort((a, b) => a.target_timerange.start - b.target_timerange.start);
+    for (let i = 0; i < segs.length - 1; i++) {
+      const s = segs[i];
+      const overlap = s.target_timerange.start + s.target_timerange.duration - segs[i + 1].target_timerange.start;
+      if (overlap <= 0 || overlap > overlapFrameUs || s.target_timerange.duration - overlap <= 0) continue;
+      setTargetDuration(s, s.target_timerange.duration - overlap);
+    }
+  }
+
   // Pass 1: cap over-long cues. Shrinking these first can also close overlaps.
   for (const track of getTracksByType(draft, "text")) {
     for (const s of track.segments) {
@@ -1451,6 +1591,49 @@ function undoubleContent(content: string): string | null {
   return JSON.stringify(parsed);
 }
 
+// The draft's frame rate, 30 when absent or malformed (the template default).
+function draftFps(draft: Draft): number {
+  return typeof draft.fps === "number" && Number.isFinite(draft.fps) && draft.fps > 0 ? draft.fps : 30;
+}
+
+// Set a segment's target duration and keep its source span consistent with
+// it: source.duration = target.duration * speed, the invariant `capcut speed`
+// maintains. The source span is only rewritten when it satisfied that
+// invariant before (exactly at speed 1, within the speed-timerange-mismatch
+// 1% tolerance otherwise) — a span that already disagreed is
+// speed-timerange-mismatch's report, not something a timing repair should
+// silently reinterpret.
+function setTargetDuration(segment: Segment, newDuration: number): void {
+  const oldDuration = segment.target_timerange.duration;
+  segment.target_timerange.duration = newDuration;
+  const src = segment.source_timerange;
+  if (!src || typeof src.duration !== "number") return;
+  const speed =
+    typeof segment.speed === "number" && Number.isFinite(segment.speed) && segment.speed > 0 ? segment.speed : 1;
+  if (speed === 1) {
+    if (src.duration === oldDuration) src.duration = newDuration;
+    return;
+  }
+  if (oldDuration > 0 && Math.abs(src.duration / oldDuration - speed) / speed <= 0.01) {
+    src.duration = Math.round(newDuration * speed);
+  }
+}
+
+// Keyframed property types on a segment (common_keyframes[].property_type,
+// e.g. KFTypePositionX), for checks that judge a static clip value only when
+// nothing animates it.
+function keyframedProperties(segment: Segment): Set<string> {
+  const out = new Set<string>();
+  const lists = (segment as { common_keyframes?: unknown }).common_keyframes;
+  if (!Array.isArray(lists)) return out;
+  for (const list of lists as Array<{ property_type?: unknown; keyframe_list?: unknown }>) {
+    if (typeof list?.property_type !== "string") continue;
+    if (Array.isArray(list.keyframe_list) && list.keyframe_list.length === 0) continue;
+    out.add(list.property_type);
+  }
+  return out;
+}
+
 // True when closing the main-track gap that opens at `gapStartUs` is
 // mechanically safe: no OTHER track has a segment still playing at or
 // starting after that point, so the later main-track segments can move left
diff --git a/src/render.ts b/src/render.ts
index 692a8fe..b0015e0 100644
--- a/src/render.ts
+++ b/src/render.ts
@@ -3,6 +3,7 @@ import { existsSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, extname, join } from "node:path";
 import type { Draft, Segment } from "./draft.js";
 import { extractText } from "./draft.js";
+import { ffprobeAvailable, probeMedia } from "./probe.js";
 import { renderSrt } from "./srt.js";
 import { draftProjectDir } from "./store.js";
 
@@ -16,6 +17,9 @@ import { draftProjectDir } from "./store.js";
  * with `--burn-captions`. The result is a watchable preview MP4 — NOT CapCut's
  * final render (no multi-track video compositing, no effects/transitions). It
  * exists to verify "did my edit land where I meant it" without launching CapCut.
+ * Every plan carries a `fidelity` census of what this proxy leaves out for the
+ * draft at hand (`--strict` refuses when it is not faithful), and a real render
+ * probes the written file's duration against the draft's (`--verify` gates it).
  *
  * Architecture mirrors `caption` (shell-out to an external binary, here ffmpeg)
  * and `export --batch` (a deterministic, unit-tested command builder, with the
@@ -39,6 +43,8 @@ export interface RenderOptions {
   allVideoTracks?: boolean; // composite overlay video tracks
   dryRun?: boolean; // build the plan, do not execute ffmpeg
   progress?: boolean; // stream ffmpeg's own stderr instead of buffering it
+  strict?: boolean; // refuse (nothing rendered) when the fidelity census is not faithful
+  ffprobeCmd?: string; // ffprobe binary for output verification (default "ffprobe")
 }
 
 /**
@@ -161,11 +167,27 @@ export interface RenderPlan {
   /** Long graphs are supplied through a file so Windows command-line limits cannot truncate them. */
   filterScript?: { path: string; content: string };
   quality: { mode: "crf"; crf: number } | { mode: "bitrate"; bitrate: string };
+  /** What the draft carries that this proxy does not reproduce (see fidelityCensus). */
+  fidelity: FidelityCensus;
 }
 
 export interface RenderResult extends RenderPlan {
   ok: boolean;
   executed: boolean;
+  /** Present after a real render: the written file's duration against the draft's. */
+  verification?: OutputVerification;
+}
+
+/**
+ * The --strict gate, shared by renderDraft and the CLI's ffmpeg-free dry-run
+ * path. Throws before anything is written.
+ */
+export function assertFaithful(census: FidelityCensus): void {
+  if (census.faithful) return;
+  throw new Error(
+    `refused [render-unfaithful]: the proxy would drop ${describeDropped(census)} that the app shows. ` +
+      "Nothing was rendered. Drop --strict to render the approximation anyway; the result's `fidelity` lists the affected segment ids.",
+  );
 }
 
 /**
@@ -386,6 +408,247 @@ function textSegments(draft: Draft): Array<{ seg: Segment; text: string; color:
   return out.sort((a, b) => a.seg.target_timerange.start - b.seg.target_timerange.start);
 }
 
+/**
+ * Fidelity census: what the draft carries that this proxy does not put on the
+ * picture. The header comment above states the limits (main track only unless
+ * --all-video-tracks, no effects/transitions); the census turns those limits
+ * into counts for THIS draft, so a reader of `render`'s JSON knows whether the
+ * preview can be trusted as "what the app shows" or only as a timing check.
+ *
+ * Pure, deterministic and one pass over tracks + materials (no ffmpeg, no
+ * clock). It is computed from the options the plan was actually built with,
+ * so renderDraft's drawtext/overlay fallbacks show up as dropped text/overlays.
+ */
+export const FIDELITY_CATEGORIES = [
+  "missing_media",
+  "main_track_gaps",
+  "overlay_tracks",
+  "text",
+  "stickers",
+  "transitions",
+  "effects",
+  "filters",
+  "masks",
+  "keyframes",
+  "text_animations",
+  "video_animations",
+  "mix_modes",
+  "chroma",
+  "matting",
+] as const;
+
+export type FidelityCategory = (typeof FIDELITY_CATEGORIES)[number];
+
+/** Affected segment ids are listed up to this many per category; `count` is always the full total. */
+export const FIDELITY_ID_CAP = 20;
+
+const FIDELITY_HINTS: Record<FidelityCategory, string> = {
+  missing_media: "segment media is missing or has no path; `capcut relink` repairs moved media",
+  main_track_gaps: "the proxy concatenates main-track segments, so timeline gaps close up and later clips play early",
+  overlay_tracks: "extra video tracks are not composited; pass --all-video-tracks",
+  text: "text is not drawn on the picture; pass --burn-captions (--soft-captions only adds a subtitle stream)",
+  stickers: "sticker tracks are not rendered",
+  transitions: "transitions are not rendered; segments cut hard",
+  effects: "video effects are not rendered",
+  filters: "filters (colour looks) are not rendered",
+  masks: "masks are not applied",
+  keyframes: "keyframed animation is not applied; segments hold their base transform/volume",
+  text_animations: "text intro/outro animations are not rendered",
+  video_animations: "video/photo in/out/combo animations are not rendered",
+  mix_modes: "blend modes are not applied; overlays composite as Normal",
+  chroma: "chroma key is not applied",
+  matting: "smart portrait matting is not applied",
+};
+
+// The three on-disk mask array spellings (decorators.ts MASK_FIELDS; inlined
+// so render does not load the decorator module).
+const MASK_MATERIAL_FIELDS = ["common_masks", "common_mask", "masks"] as const;
+
+export interface FidelityEntry {
+  count: number;
+  segment_ids: string[];
+  hint: string;
+}
+
+export interface FidelityCensus {
+  /** True when no category below has anything dropped. */
+  faithful: boolean;
+  /** The draft duration the proxy targets (draft.duration, else the last segment end). */
+  expected_duration_us: number;
+  /** Only categories with at least one affected segment, in FIDELITY_CATEGORIES order. */
+  dropped: Partial<Record<FidelityCategory, FidelityEntry>>;
+  /** Every category the census checks, so an absent key reads as "checked, none". */
+  checked: FidelityCategory[];
+}
+
+export function expectedDurationUs(draft: Draft): number {
+  if (Number.isFinite(draft.duration) && draft.duration > 0) return draft.duration;
+  let end = 0;
+  for (const track of draft.tracks) {
+    for (const seg of track.segments) {
+      end = Math.max(end, seg.target_timerange.start + seg.target_timerange.duration);
+    }
+  }
+  return end;
+}
+
+function hasKeyframes(seg: Segment): boolean {
+  const lists = seg.common_keyframes;
+  if (!Array.isArray(lists)) return false;
+  return lists.some((list) => {
+    const frames = (list as { keyframe_list?: unknown } | null)?.keyframe_list;
+    return !Array.isArray(frames) || frames.length > 0;
+  });
+}
+
+export function fidelityCensus(
+  draft: Draft,
+  opts: Pick<RenderOptions, "allVideoTracks" | "burnCaptions">,
+  skipped: Array<{ segmentId: string; reason: string }> = [],
+): FidelityCensus {
+  const hits = new Map<FidelityCategory, string[]>();
+  const add = (category: FidelityCategory, segId: string) => {
+    const list = hits.get(category) ?? [];
+    if (!list.includes(segId)) list.push(segId);
+    hits.set(category, list);
+  };
+  const materials = draft.materials as Record<string, unknown>;
+  const byId = (field: string): Map<string, Record<string, unknown>> => {
+    const arr = materials[field];
+    const map = new Map<string, Record<string, unknown>>();
+    if (Array.isArray(arr)) {
+      for (const m of arr as Array<Record<string, unknown>>) if (m && typeof m.id === "string") map.set(m.id, m);
+    }
+    return map;
+  };
+  const transitions = byId("transitions");
+  const chromas = byId("chromas");
+  const animations = byId("material_animations");
+  const effectMaterials = new Map([...byId("effects"), ...byId("video_effects")]);
+  const maskIds = new Set(MASK_MATERIAL_FIELDS.flatMap((field) => [...byId(field).keys()]));
+  const videoMaterials = new Map((draft.materials.videos ?? []).map((v) => [v.id, v as Record<string, unknown>]));
+
+  const segmentIds = new Set(draft.tracks.flatMap((t) => t.segments.map((s) => s.id)));
+  for (const { segmentId } of skipped) if (segmentIds.has(segmentId)) add("missing_media", segmentId);
+
+  // Gaps on the main track: concat ignores target starts, so any segment that
+  // begins after the previous one ended (or after 0) is shifted earlier.
+  let cursor = 0;
+  for (const seg of mainVideoSegments(draft)) {
+    if (seg.target_timerange.start > cursor) add("main_track_gaps", seg.id);
+    cursor = Math.max(cursor, seg.target_timerange.start + seg.target_timerange.duration);
+  }
+
+  const mainTrack = draft.tracks.find((t) => t.type === "video");
+  for (const track of draft.tracks) {
+    for (const seg of track.segments) {
+      if (track.type === "video" && track !== mainTrack && !opts.allVideoTracks) add("overlay_tracks", seg.id);
+      if (track.type === "sticker") add("stickers", seg.id);
+      if (track.type === "effect") add("effects", seg.id);
+      if (track.type === "filter") add("filters", seg.id);
+      if (hasKeyframes(seg)) add("keyframes", seg.id);
+      for (const ref of seg.extra_material_refs ?? []) {
+        if (transitions.has(ref)) add("transitions", seg.id);
+        if (maskIds.has(ref)) add("masks", seg.id);
+        if (chromas.has(ref)) add("chroma", seg.id);
+        const effect = effectMaterials.get(ref);
+        if (effect) add(effect.type === "filter" ? "filters" : "effects", seg.id);
+        const anim = animations.get(ref);
+        if (anim && Array.isArray(anim.animations) && anim.animations.length > 0) {
+          if (track.type === "text") add("text_animations", seg.id);
+          else if (track.type === "video") add("video_animations", seg.id);
+        }
+      }
+      if (track.type === "video") {
+        const mat = videoMaterials.get(seg.material_id);
+        const mix = mat?.mix_mode;
+        if (typeof mix === "string" && mix !== "" && mix !== "Normal") add("mix_modes", seg.id);
+        const flag = (mat?.matting as { flag?: unknown } | undefined)?.flag;
+        if (typeof flag === "number" && flag !== 0) add("matting", seg.id);
+      }
+    }
+  }
+  if (!opts.burnCaptions) for (const { seg } of textSegments(draft)) add("text", seg.id);
+
+  const dropped: Partial<Record<FidelityCategory, FidelityEntry>> = {};
+  for (const category of FIDELITY_CATEGORIES) {
+    const ids = hits.get(category);
+    if (!ids || ids.length === 0) continue;
+    dropped[category] = {
+      count: ids.length,
+      segment_ids: ids.slice(0, FIDELITY_ID_CAP),
+      hint: FIDELITY_HINTS[category],
+    };
+  }
+  return {
+    faithful: Object.keys(dropped).length === 0,
+    expected_duration_us: expectedDurationUs(draft),
+    dropped,
+    checked: [...FIDELITY_CATEGORIES],
+  };
+}
+
+/** One-line summary of a census for refusal messages: "transitions 2, masks 1". */
+export function describeDropped(census: FidelityCensus): string {
+  return Object.entries(census.dropped)
+    .map(([category, entry]) => `${category} ${entry?.count}`)
+    .join(", ");
+}
+
+/**
+ * Output verification: the written file's duration against the draft's, with
+ * a one-frame tolerance at the render fps. Pure so the arithmetic is testable
+ * without ffprobe; probeRenderOutput does the probing.
+ */
+export interface OutputVerification {
+  verified: boolean;
+  /** Present when verified is false. */
+  reason?: string;
+  duration_us?: number;
+  expected_duration_us: number;
+  drift_us?: number;
+  tolerance_us: number;
+  within_tolerance?: boolean;
+}
+
+export function frameToleranceUs(fps: number): number {
+  return Math.round(US / (fps > 0 ? fps : 30));
+}
+
+export function checkOutputDuration(durationUs: number, expectedUs: number, fps: number): OutputVerification {
+  const tolerance = frameToleranceUs(fps);
+  const drift = durationUs - expectedUs;
+  return {
+    verified: true,
+    duration_us: durationUs,
+    expected_duration_us: expectedUs,
+    drift_us: drift,
+    tolerance_us: tolerance,
+    within_tolerance: Math.abs(drift) <= tolerance,
+  };
+}
+
+export function probeRenderOutput(
+  output: string,
+  expectedUs: number,
+  fps: number,
+  ffprobeCmd = "ffprobe",
+): OutputVerification {
+  const unverified = (reason: string): OutputVerification => ({
+    verified: false,
+    reason,
+    expected_duration_us: expectedUs,
+    tolerance_us: frameToleranceUs(fps),
+  });
+  if (!existsSync(output)) return unverified(`output file not found: ${output}`);
+  if (!ffprobeAvailable(ffprobeCmd)) {
+    return unverified(`ffprobe is unavailable at '${ffprobeCmd}'; install ffmpeg or pass --ffprobe-cmd <path>`);
+  }
+  const probe = probeMedia(output, ffprobeCmd, false);
+  if (!probe || probe.durationUs === null) return unverified(`ffprobe could not read a duration from ${output}`);
+  return checkOutputDuration(probe.durationUs, expectedUs, fps);
+}
+
 // atempo only accepts 0.5..2.0 per filter instance; we keep proxy audio simple
 // and only retime when a single atempo can express it.
 function atempoFor(speed: number): string | null {
@@ -698,6 +961,7 @@ export function buildRenderPlan(draft: Draft, opts: RenderOptions): RenderPlan {
     ...(softCaptions ? { softCaptions } : {}),
     ...(filterScript ? { filterScript } : {}),
     quality,
+    fidelity: fidelityCensus(draft, opts, skipped),
   };
 }
 
@@ -765,6 +1029,7 @@ export function renderDraft(draft: Draft, filePath: string, opts: RenderOptions)
   }
   const basePlan = buildRenderPlan(draft, effective);
   const plan = { ...basePlan, capabilities, skipped: [...basePlan.skipped, ...fallbackSkipped] };
+  if (opts.strict) assertFaithful(plan.fidelity);
 
   // Speed/volume/fade filters are checked against the plan actually built:
   // a draft that never sets them must keep rendering on a build without them,
@@ -865,5 +1130,11 @@ export function renderDraft(draft: Draft, filePath: string, opts: RenderOptions)
         "Re-run with --dry-run to inspect the filter graph without executing.",
     );
   }
-  return { ...plan, ok: true, executed: true };
+  const verification = probeRenderOutput(
+    plan.output,
+    plan.fidelity.expected_duration_us,
+    plan.fps,
+    opts.ffprobeCmd ?? "ffprobe",
+  );
+  return { ...plan, ok: true, executed: true, verification };
 }
diff --git a/test/batch-plan.test.mjs b/test/batch-plan.test.mjs
new file mode 100644
index 0000000..3ba8633
--- /dev/null
+++ b/test/batch-plan.test.mjs
@@ -0,0 +1,122 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { after, describe, it } from "node:test";
+import { spawnCli } from "./helpers/spawn-cli.mjs";
+import { tmpDraft } from "./helpers/tmp-draft.mjs";
+
+function firstText(path) {
+  const draft = JSON.parse(readFileSync(path, "utf-8"));
+  return draft.tracks.find((item) => item.type === "text").segments[0].id;
+}
+
+function setup() {
+  const fix = tmpDraft();
+  after(fix.cleanup);
+  const id = firstText(fix.path);
+  const planPath = join(fix.dir, "plan.json");
+  const input = [
+    JSON.stringify({ cmd: "set-text", id, text: "planned" }),
+    JSON.stringify({ cmd: "shift", id, offset: "+1s" }),
+  ].join("\n");
+  return { fix, id, planPath, input };
+}
+
+describe("batch --plan / --apply-plan", () => {
+  it("--plan writes a plan and leaves the draft untouched", () => {
+    const { fix, planPath, input } = setup();
+    const before = readFileSync(fix.path, "utf-8");
+    const result = spawnCli(["batch", fix.path, "--plan", planPath], { input });
+    assert.equal(result.status, 0, result.stderr);
+    assert.equal(result.json.ok, true);
+    assert.equal(result.json.operations, 2);
+    assert.equal(readFileSync(fix.path, "utf-8"), before);
+    assert.equal(existsSync(`${fix.path}.bak`), false);
+    assert.equal(existsSync(join(fix.dir, ".capcut-cli-history")), false);
+
+    const plan = JSON.parse(readFileSync(planPath, "utf-8"));
+    assert.equal(plan.format, "capcut-cli.batch-plan");
+    assert.equal(plan.version, 1);
+    assert.equal(plan.project, fix.path);
+    assert.equal(plan.draft_sha256, createHash("sha256").update(before).digest("hex"));
+    assert.equal(plan.operations.length, 2);
+    assert.match(plan.operations_sha256, /^[0-9a-f]{64}$/);
+    assert.equal(plan.preview.length, 2);
+    assert.equal(plan.preview[0].cmd, "set-text");
+    assert.equal(plan.preview[0].result.new, "planned");
+    assert.equal(plan.preview[1].result.new_start_us - plan.preview[1].result.old_start_us, 1_000_000);
+  });
+
+  it("--plan refuses invalid operations and writes no plan", () => {
+    const { fix, planPath } = setup();
+    const input = JSON.stringify({ cmd: "shift", id: "missing-segment", offset: "+1s" });
+    const result = spawnCli(["batch", fix.path, "--plan", planPath], { input });
+    assert.equal(result.status, 1);
+    assert.match(result.stderr, /no plan written/);
+    assert.equal(existsSync(planPath), false);
+  });
+
+  it("--apply-plan applies the reviewed operations on an unchanged draft", () => {
+    const { fix, planPath, input } = setup();
+    assert.equal(spawnCli(["batch", fix.path, "--plan", planPath], { input }).status, 0);
+    const result = spawnCli(["batch", fix.path, "--apply-plan", planPath]);
+    assert.equal(result.status, 0, result.stderr);
+    assert.equal(result.json.ok, true);
+    assert.equal(result.json.succeeded, 2);
+    assert.match(readFileSync(fix.path, "utf-8"), /planned/);
+    assert.equal(existsSync(`${fix.path}.bak`), true);
+  });
+
+  it("--apply-plan refuses after another command edited the draft", () => {
+    const { fix, id, planPath, input } = setup();
+    assert.equal(spawnCli(["batch", fix.path, "--plan", planPath], { input }).status, 0);
+    assert.equal(spawnCli(["set-text", fix.path, id, "someone else", "-q"]).status, 0);
+    const edited = readFileSync(fix.path, "utf-8");
+    const result = spawnCli(["batch", fix.path, "--apply-plan", planPath]);
+    assert.equal(result.status, 1);
+    assert.match(result.stderr, /refused \[plan-draft-changed\]/);
+    assert.equal(readFileSync(fix.path, "utf-8"), edited);
+  });
+
+  it("--apply-plan refuses when the plan's operations were edited", () => {
+    const { fix, planPath, input } = setup();
+    assert.equal(spawnCli(["batch", fix.path, "--plan", planPath], { input }).status, 0);
+    const before = readFileSync(fix.path, "utf-8");
+    const plan = JSON.parse(readFileSync(planPath, "utf-8"));
+    plan.operations[0].text = "swapped after review";
+    writeFileSync(planPath, JSON.stringify(plan, null, 2));
+    const result = spawnCli(["batch", fix.path, "--apply-plan", planPath]);
+    assert.equal(result.status, 1);
+    assert.match(result.stderr, /refused \[plan-tampered\]/);
+    assert.equal(readFileSync(fix.path, "utf-8"), before);
+  });
+
+  it("re-indenting or reordering keys in the plan is not tampering", () => {
+    const { fix, planPath, input } = setup();
+    assert.equal(spawnCli(["batch", fix.path, "--plan", planPath], { input }).status, 0);
+    const plan = JSON.parse(readFileSync(planPath, "utf-8"));
+    plan.operations = plan.operations.map((op) => Object.fromEntries(Object.entries(op).reverse()));
+    writeFileSync(planPath, JSON.stringify(plan));
+    const result = spawnCli(["batch", fix.path, "--apply-plan", planPath]);
+    assert.equal(result.status, 0, result.stderr);
+  });
+
+  it("--plan and --apply-plan are mutually exclusive", () => {
+    const { fix, planPath, input } = setup();
+    const result = spawnCli(["batch", fix.path, "--plan", planPath, "--apply-plan", planPath], { input });
+    assert.equal(result.status, 1);
+    assert.match(result.stderr, /mutually exclusive/);
+  });
+
+  it("--apply-plan ignores stdin operations", () => {
+    const { fix, planPath, input } = setup();
+    assert.equal(spawnCli(["batch", fix.path, "--plan", planPath], { input }).status, 0);
+    const stray = JSON.stringify({ cmd: "set-text", id: firstText(fix.path), text: "from stdin" });
+    const result = spawnCli(["batch", fix.path, "--apply-plan", planPath], { input: stray });
+    assert.equal(result.status, 0, result.stderr);
+    const after = readFileSync(fix.path, "utf-8");
+    assert.match(after, /planned/);
+    assert.doesNotMatch(after, /from stdin/);
+  });
+});
diff --git a/test/caption-words.test.mjs b/test/caption-words.test.mjs
new file mode 100644
index 0000000..7aa0aa4
--- /dev/null
+++ b/test/caption-words.test.mjs
@@ -0,0 +1,273 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { describe, it } from "node:test";
+import { fileURLToPath } from "node:url";
+import { parseWordTimings } from "../dist/caption.js";
+import { spawnCli } from "./helpers/spawn-cli.mjs";
+import { tmpDraft } from "./helpers/tmp-draft.mjs";
+
+// caption --words: word timings from an external aligner (Whisper JSON,
+// WhisperX, Qwen3-ForcedAligner, any {word,start,end} list) go through the
+// same grouping / karaoke / reveal / --script path as Whisper's own words,
+// without Whisper being installed.
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const FIXTURES = join(__dirname, "fixtures", "words");
+const CLI = join(__dirname, "..", "dist", "index.js");
+const fixture = (name) => join(FIXTURES, name);
+// Only node's own directory on PATH: no whisper binary can be found.
+const NO_WHISPER_ENV = { PATH: dirname(process.execPath) };
+
+function trackTexts(draftPath, trackName = "captions") {
+  const draft = JSON.parse(readFileSync(draftPath, "utf-8"));
+  const track = draft.tracks.find((t) => t.type === "text" && t.name === trackName);
+  assert.ok(track, `track ${trackName} present`);
+  return track.segments.map((s) => {
+    const mat = draft.materials.texts.find((m) => m.id === s.material_id);
+    return { start: s.target_timerange.start, text: JSON.parse(mat.content).text };
+  });
+}
+
+function tmpWords(t, content) {
+  const dir = mkdtempSync(join(tmpdir(), "capcut-caption-words-"));
+  t.after(() => rmSync(dir, { recursive: true, force: true }));
+  const path = join(dir, "words.json");
+  writeFileSync(path, typeof content === "string" ? content : JSON.stringify(content));
+  return path;
+}
+
+describe("parseWordTimings format detection", () => {
+  it("reads openai-whisper segments[].words[] as whisper", () => {
+    const parsed = parseWordTimings(readFileSync(fixture("whisper.json"), "utf-8"));
+    assert.equal(parsed.format, "whisper");
+    assert.equal(parsed.skipped, 0);
+    assert.deepEqual(parsed.words[0], { word: "Hello", startUs: 0, endUs: 400_000 });
+    assert.equal(parsed.words.length, 5);
+  });
+
+  it("reads WhisperX word_segments and counts unaligned words as skipped", () => {
+    const parsed = parseWordTimings(readFileSync(fixture("whisperx.json"), "utf-8"));
+    assert.equal(parsed.format, "whisperx");
+    assert.equal(parsed.skipped, 1);
+    assert.deepEqual(
+      parsed.words.map((w) => w.word),
+      ["We", "shipped", "drafts", "today."],
+    );
+  });
+
+  it("recognises WhisperX segments[].words[] by the per-word score", () => {
+    const raw = JSON.parse(readFileSync(fixture("whisperx.json"), "utf-8"));
+    delete raw.word_segments;
+    const parsed = parseWordTimings(JSON.stringify(raw));
+    assert.equal(parsed.format, "whisperx");
+    assert.equal(parsed.skipped, 1);
+  });
+
+  it("reads plain lists with start_time/end_time (Qwen3) and start_ms/end_ms", () => {
+    const zh = parseWordTimings(readFileSync(fixture("qwen3-zh.json"), "utf-8"));
+    assert.equal(zh.format, "word-list");
+    assert.equal(zh.words.length, 18);
+    assert.deepEqual(zh.words[1], { word: "天", startUs: 200_000, endUs: 400_000 });
+    const ms = parseWordTimings(readFileSync(fixture("word-list-ms.json"), "utf-8"));
+    assert.deepEqual(ms.words[0], { word: "Cut", startUs: 1_000_000, endUs: 1_300_000 });
+  });
+
+  it("accepts a char key and seconds start/end", () => {
+    const parsed = parseWordTimings(JSON.stringify([{ char: "好", start: 0.5, end: 0.7 }]));
+    assert.deepEqual(parsed.words, [{ word: "好", startUs: 500_000, endUs: 700_000 }]);
+  });
+
+  it("refuses end before start, naming the entry", () => {
+    assert.throws(
+      () =>
+        parseWordTimings(
+          JSON.stringify([
+            { word: "a", start: 0, end: 0.2 },
+            { word: "b", start: 0.5, end: 0.3 },
+          ]),
+        ),
+      /refused \[words-invalid\]: entry \[1\] \("b"\) ends before it starts/,
+    );
+  });
+
+  it("refuses out-of-order entries, naming both", () => {
+    assert.throws(
+      () =>
+        parseWordTimings(
+          JSON.stringify({
+            segments: [
+              {
+                words: [
+                  { word: "a", start: 1, end: 1.2 },
+                  { word: "b", start: 0.5, end: 0.7 },
+                ],
+              },
+            ],
+          }),
+        ),
+      /refused \[words-invalid\]: entry segments\[0\]\.words\[1\] \("b"\) starts before entry segments\[0\]\.words\[0\]/,
+    );
+  });
+
+  it("refuses JSON that carries no word timings", () => {
+    assert.throws(() => parseWordTimings('{"text":"hi"}'), /refused \[words-format\]/);
+    assert.throws(() => parseWordTimings("not json"), /refused \[words-format\]: --words is not valid JSON/);
+  });
+});
+
+describe("capcut caption --words", () => {
+  it("captions a whisper JSON without whisper installed", (t) => {
+    const fix = tmpDraft();
+    t.after(() => fix.cleanup());
+    const r = spawnCli(["caption", fix.path, "--words", fixture("whisper.json")], { env: NO_WHISPER_ENV });
+    assert.equal(r.status, 0, `stderr: ${r.stderr}`);
+    assert.equal(r.json.engine, "words");
+    assert.equal(r.json.words_format, "whisper");
+    assert.equal(r.json.words_skipped, 0);
+    assert.equal(r.json.words, 5);
+    assert.equal(r.json.source_words, fixture("whisper.json"));
+    assert.equal(r.json.source_audio, undefined);
+    assert.deepEqual(trackTexts(fix.path), [{ start: 0, text: "Hello world from the timeline." }]);
+  });
+
+  it("splits WhisperX words at a pause and reports the skipped entry", (t) => {
+    const fix = tmpDraft();
+    t.after(() => fix.cleanup());
+    const r = spawnCli(["caption", fix.path, "--words", fixture("whisperx.json")]);
+    assert.equal(r.status, 0, `stderr: ${r.stderr}`);
+    assert.equal(r.json.words_format, "whisperx");
+    assert.equal(r.json.words_skipped, 1);
+    assert.deepEqual(
+      trackTexts(fix.path).map((c) => c.text),
+      ["We shipped", "drafts today."],
+    );
+  });
+
+  it("joins Chinese per-character Qwen3 output into space-free cues", (t) => {
+    const fix = tmpDraft();
+    t.after(() => fix.cleanup());
+    const r = spawnCli(["caption", fix.path, "--words", fixture("qwen3-zh.json")], { env: NO_WHISPER_ENV });
+    assert.equal(r.status, 0, `stderr: ${r.stderr}`);
+    assert.equal(r.json.words_format, "word-list");
+    assert.equal(r.json.caption_script, "zh");
+    assert.deepEqual(
+      trackTexts(fix.path).map((c) => c.text),
+      ["今天我们来聊一聊剪映草稿的自动化", "处理"],
+    );
+  });
+
+  it("places cues at the timings' own positions (start_ms list)", (t) => {
+    const fix = tmpDraft();
+    t.after(() => fix.cleanup());
+    const r = spawnCli(["caption", fix.path, "--words", fixture("word-list-ms.json")]);
+    assert.equal(r.status, 0, `stderr: ${r.stderr}`);
+    assert.deepEqual(trackTexts(fix.path), [
+      { start: 1_000_000, text: "Cut the silence" },
+      { start: 3_000_000, text: "first" },
+    ]);
+  });
+
+  it("drives --karaoke and --word-reveal like whisper words", (t) => {
+    const karaoke = tmpDraft();
+    t.after(() => karaoke.cleanup());
+    const k = spawnCli(["caption", karaoke.path, "--words", fixture("whisper.json"), "--karaoke"]);
+    assert.equal(k.status, 0, `stderr: ${k.stderr}`);
+    assert.equal(k.json.cues, 5, "one karaoke segment per word");
+    assert.equal(k.json.first_cue.text, "Hello world from the");
+
+    const reveal = tmpDraft();
+    t.after(() => reveal.cleanup());
+    const w = spawnCli(["caption", reveal.path, "--words", fixture("word-list-ms.json"), "--word-reveal"]);
+    assert.equal(w.status, 0, `stderr: ${w.stderr}`);
+    assert.deepEqual(
+      trackTexts(reveal.path).map((c) => c.text),
+      ["Cut", "Cut the", "Cut the silence", "first"],
+    );
+  });
+
+  it("keeps the --script wording on the aligner's timing", (t) => {
+    const fix = tmpDraft();
+    t.after(() => fix.cleanup());
+    const script = tmpWords(t, "今天我们来聊一聊\n剪映草稿的自动化处理\n");
+    const r = spawnCli(["caption", fix.path, "--words", fixture("qwen3-zh.json"), "--script", script]);
+    assert.equal(r.status, 0, `stderr: ${r.stderr}`);
+    assert.equal(r.json.script.matched, 18);
+    assert.deepEqual(trackTexts(fix.path), [
+      { start: 0, text: "今天我们来聊一聊" },
+      { start: 1_600_000, text: "剪映草稿的自动化处理" },
+    ]);
+  });
+
+  it("reads the timings from stdin with --words -", (t) => {
+    const fix = tmpDraft();
+    t.after(() => fix.cleanup());
+    const r = spawnCli(["caption", fix.path, "--words", "-"], {
+      input: readFileSync(fixture("word-list-ms.json"), "utf-8"),
+    });
+    assert.equal(r.status, 0, `stderr: ${r.stderr}`);
+    assert.equal(r.json.source_words, "stdin");
+    assert.equal(r.json.words, 4);
+  });
+
+  it("refuses invalid timings without touching the draft", (t) => {
+    const fix = tmpDraft();
+    t.after(() => fix.cleanup());
+    const before = readFileSync(fix.path, "utf-8");
+    const bad = tmpWords(t, [
+      { word: "a", start: 0, end: 0.2 },
+      { word: "b", start: 0.6, end: 0.4 },
+    ]);
+    const r = spawnCli(["caption", fix.path, "--words", bad]);
+    assert.notEqual(r.status, 0);
+    assert.match(r.stderr, /refused \[words-invalid\]: entry \[1\]/);
+    assert.equal(readFileSync(fix.path, "utf-8"), before);
+  });
+
+  it("refuses a file where no entry has timing", (t) => {
+    const fix = tmpDraft();
+    t.after(() => fix.cleanup());
+    const empty = tmpWords(t, [{ word: "a" }, { word: "b" }]);
+    const r = spawnCli(["caption", fix.path, "--words", empty]);
+    assert.notEqual(r.status, 0);
+    assert.match(r.stderr, /no timed words \(2 entries without timing skipped\)/);
+  });
+
+  for (const extra of [
+    ["--audio", "voice.wav"],
+    ["--from-segment", "abc"],
+    ["--whisper-model", "small"],
+    ["--audio-stream", "1"],
+  ]) {
+    it(`is mutually exclusive with ${extra[0]}`, (t) => {
+      const fix = tmpDraft();
+      t.after(() => fix.cleanup());
+      const r = spawnCli(["caption", fix.path, "--words", fixture("whisper.json"), ...extra]);
+      assert.notEqual(r.status, 0);
+      assert.match(r.stderr, new RegExp(`--words is mutually exclusive with ${extra[0]}`));
+    });
+  }
+
+  it("is declared in describe", () => {
+    const r = spawnCli(["describe", "--command", "caption"]);
+    assert.equal(r.status, 0, `stderr: ${r.stderr}`);
+    assert.match(r.stdout, /--words/);
+  });
+});
+
+describe("doctor whisper hint", () => {
+  it("names the Whisper-free routes when no whisper is on PATH, still as a warning", () => {
+    const r = spawnSync(process.execPath, [CLI, "doctor"], {
+      encoding: "utf-8",
+      env: { ...process.env, ...NO_WHISPER_ENV },
+    });
+    const report = JSON.parse(r.stdout);
+    const whisper = report.checks.find((c) => c.name === "whisper");
+    if (whisper.status === "ok") return; // a whisper beside node: nothing to hint
+    assert.equal(whisper.status, "warn");
+    assert.match(whisper.fix, /caption --words/);
+    assert.match(whisper.fix, /import-srt/);
+  });
+});
diff --git a/test/fixtures/words/qwen3-zh.json b/test/fixtures/words/qwen3-zh.json
new file mode 100644
index 0000000..2f6df52
--- /dev/null
+++ b/test/fixtures/words/qwen3-zh.json
@@ -0,0 +1,20 @@
+[
+  { "text": "今", "start_time": 0.0, "end_time": 0.2 },
+  { "text": "天", "start_time": 0.2, "end_time": 0.4 },
+  { "text": "我", "start_time": 0.4, "end_time": 0.6 },
+  { "text": "们", "start_time": 0.6, "end_time": 0.8 },
+  { "text": "来", "start_time": 0.8, "end_time": 1.0 },
+  { "text": "聊", "start_time": 1.0, "end_time": 1.2 },
+  { "text": "一", "start_time": 1.2, "end_time": 1.4 },
+  { "text": "聊", "start_time": 1.4, "end_time": 1.6 },
+  { "text": "剪", "start_time": 1.6, "end_time": 1.8 },
+  { "text": "映", "start_time": 1.8, "end_time": 2.0 },
+  { "text": "草", "start_time": 2.0, "end_time": 2.2 },
+  { "text": "稿", "start_time": 2.2, "end_time": 2.4 },
+  { "text": "的", "start_time": 2.4, "end_time": 2.6 },
+  { "text": "自", "start_time": 2.6, "end_time": 2.8 },
+  { "text": "动", "start_time": 2.8, "end_time": 3.0 },
+  { "text": "化", "start_time": 3.0, "end_time": 3.2 },
+  { "text": "处", "start_time": 3.2, "end_time": 3.4 },
+  { "text": "理", "start_time": 3.4, "end_time": 3.6 }
+]
diff --git a/test/fixtures/words/whisper.json b/test/fixtures/words/whisper.json
new file mode 100644
index 0000000..84b5ed6
--- /dev/null
+++ b/test/fixtures/words/whisper.json
@@ -0,0 +1,19 @@
+{
+  "text": " Hello world from the timeline.",
+  "language": "en",
+  "segments": [
+    {
+      "id": 0,
+      "start": 0.0,
+      "end": 2.1,
+      "text": " Hello world from the timeline.",
+      "words": [
+        { "word": " Hello", "start": 0.0, "end": 0.4, "probability": 0.98 },
+        { "word": " world", "start": 0.45, "end": 0.9, "probability": 0.97 },
+        { "word": " from", "start": 1.0, "end": 1.2, "probability": 0.99 },
+        { "word": " the", "start": 1.25, "end": 1.4, "probability": 0.99 },
+        { "word": " timeline.", "start": 1.45, "end": 2.1, "probability": 0.95 }
+      ]
+    }
+  ]
+}
diff --git a/test/fixtures/words/whisperx.json b/test/fixtures/words/whisperx.json
new file mode 100644
index 0000000..be80107
--- /dev/null
+++ b/test/fixtures/words/whisperx.json
@@ -0,0 +1,23 @@
+{
+  "segments": [
+    {
+      "start": 0.5,
+      "end": 3.0,
+      "text": "We shipped 42 drafts today.",
+      "words": [
+        { "word": "We", "start": 0.5, "end": 0.7, "score": 0.91 },
+        { "word": "shipped", "start": 0.75, "end": 1.2, "score": 0.88 },
+        { "word": "42" },
+        { "word": "drafts", "start": 1.9, "end": 2.4, "score": 0.9 },
+        { "word": "today.", "start": 2.45, "end": 3.0, "score": 0.93 }
+      ]
+    }
+  ],
+  "word_segments": [
+    { "word": "We", "start": 0.5, "end": 0.7, "score": 0.91 },
+    { "word": "shipped", "start": 0.75, "end": 1.2, "score": 0.88 },
+    { "word": "42" },
+    { "word": "drafts", "start": 1.9, "end": 2.4, "score": 0.9 },
+    { "word": "today.", "start": 2.45, "end": 3.0, "score": 0.93 }
+  ]
+}
diff --git a/test/fixtures/words/word-list-ms.json b/test/fixtures/words/word-list-ms.json
new file mode 100644
index 0000000..c169cc6
--- /dev/null
+++ b/test/fixtures/words/word-list-ms.json
@@ -0,0 +1,6 @@
+[
+  { "word": "Cut", "start_ms": 1000, "end_ms": 1300 },
+  { "word": "the", "start_ms": 1350, "end_ms": 1450 },
+  { "word": "silence", "start_ms": 1500, "end_ms": 2000 },
+  { "word": "first", "start_ms": 3000, "end_ms": 3400 }
+]
diff --git a/test/lint-overlap-offscreen.test.mjs b/test/lint-overlap-offscreen.test.mjs
new file mode 100644
index 0000000..e3cb111
--- /dev/null
+++ b/test/lint-overlap-offscreen.test.mjs
@@ -0,0 +1,181 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { DEFAULT_LINT_OPTIONS, fixDraft, lintDraft } from "../dist/lint.js";
+
+const opts = { ...DEFAULT_LINT_OPTIONS, checkLocalPaths: false, probeMedia: false };
+
+function seg(id, materialId, start, duration, extra = {}) {
+  return {
+    id,
+    material_id: materialId,
+    target_timerange: { start, duration },
+    source_timerange: { start: 0, duration },
+    speed: 1,
+    volume: 1,
+    visible: true,
+    clip: { alpha: 1, rotation: 0, scale: { x: 1, y: 1 }, transform: { x: 0, y: 0 } },
+    extra_material_refs: [],
+    render_index: 0,
+    ...extra,
+  };
+}
+
+function draftWith(tracks, videos = [{ id: "v", type: "video", path: "", duration: 60_000_000 }]) {
+  return {
+    fps: 30,
+    duration: 10_000_000,
+    canvas_config: { width: 1920, height: 1080, ratio: "16:9" },
+    materials: {
+      videos,
+      audios: [{ id: "a", type: "extract_music", path: "", duration: 60_000_000 }],
+      texts: [],
+      speeds: [],
+    },
+    tracks,
+  };
+}
+
+function track(type, name, segments) {
+  return { id: name, type, name, attribute: 0, segments };
+}
+
+const codes = (issues, code) => issues.filter((i) => i.code === code);
+
+describe("lint segment-overlap", () => {
+  it("fixes a 1us rounding overlap between back-to-back clips", () => {
+    const draft = draftWith([
+      track("video", "main", [seg("clip-a", "v", 0, 2_000_001), seg("clip-b", "v", 2_000_000, 2_000_000)]),
+    ]);
+    const [issue] = codes(lintDraft(draft, opts), "segment-overlap");
+    assert.equal(issue.severity, "error");
+    assert.equal(issue.fixable, true);
+    assert.equal(issue.location.segment_id, "clip-a");
+    assert.match(issue.message, /clip-b/);
+    assert.match(issue.message, /1us on video track "main"/);
+
+    const result = fixDraft(draft, opts);
+    assert.ok(result.fixed.some((i) => i.code === "segment-overlap"));
+    assert.equal(codes(result.remaining, "segment-overlap").length, 0);
+    const a = draft.tracks[0].segments[0];
+    assert.equal(a.target_timerange.duration, 2_000_000);
+    assert.equal(a.source_timerange.duration, 2_000_000);
+    assert.equal(draft.tracks[0].segments[1].target_timerange.start, 2_000_000);
+  });
+
+  it("keeps the source span proportional to speed when shortening", () => {
+    const fast = seg("fast", "v", 0, 1_000_010, { speed: 2, source_timerange: { start: 0, duration: 2_000_020 } });
+    const draft = draftWith([track("video", "main", [fast, seg("next", "v", 1_000_000, 1_000_000)])]);
+    fixDraft(draft, opts);
+    assert.equal(fast.target_timerange.duration, 1_000_000);
+    assert.equal(fast.source_timerange.duration, 2_000_000);
+  });
+
+  it("reports a 2s overlap on an audio track without fixing it", () => {
+    const draft = draftWith([
+      track("audio", "music", [seg("bed-a", "a", 0, 5_000_000), seg("bed-b", "a", 3_000_000, 4_000_000)]),
+    ]);
+    const [issue] = codes(lintDraft(draft, opts), "segment-overlap");
+    assert.equal(issue.fixable, false);
+    assert.match(issue.message, /2000000us on audio track "music"/);
+    assert.match(issue.message, /--fix leaves it/);
+
+    const result = fixDraft(draft, opts);
+    assert.equal(codes(result.remaining, "segment-overlap").length, 1);
+    assert.equal(draft.tracks[0].segments[0].target_timerange.duration, 5_000_000);
+  });
+
+  it("leaves text tracks to caption-overlap", () => {
+    const draft = draftWith([
+      track("text", "subs", [seg("cap-a", "t", 0, 2_000_001), seg("cap-b", "t", 2_000_000, 1_000_000)]),
+    ]);
+    const issues = lintDraft(draft, opts);
+    assert.equal(codes(issues, "segment-overlap").length, 0);
+    assert.equal(codes(issues, "caption-overlap").length, 1);
+  });
+
+  it("stays quiet on touching and gapped segments", () => {
+    const draft = draftWith([
+      track("sticker", "stickers", [seg("s1", "x", 0, 1_000_000), seg("s2", "x", 1_000_000, 1_000_000)]),
+      track("effect", "fx", [seg("e1", "x", 0, 1_000_000), seg("e2", "x", 1_500_000, 1_000_000)]),
+    ]);
+    assert.equal(codes(lintDraft(draft, opts), "segment-overlap").length, 0);
+  });
+});
+
+describe("lint segment-offscreen", () => {
+  const clip = (over) => ({ alpha: 1, rotation: 0, scale: { x: 1, y: 1 }, transform: { x: 0, y: 0 }, ...over });
+
+  it("keeps an on-screen segment clean, including one partly off the edge", () => {
+    const draft = draftWith([
+      track("video", "main", [seg("centre", "v", 0, 1_000_000)]),
+      track("video", "pip", [
+        seg("corner", "v", 0, 1_000_000, { clip: clip({ scale: { x: 0.3, y: 0.3 }, transform: { x: 1.2, y: 0.9 } }) }),
+      ]),
+      track("text", "subs", [seg("caption", "t", 0, 1_000_000, { clip: clip({ transform: { x: 0, y: -0.8 } }) })]),
+    ]);
+    assert.equal(codes(lintDraft(draft, opts), "segment-offscreen").length, 0);
+  });
+
+  it("flags a clip whose box sits entirely outside the canvas", () => {
+    // 0.3 scale on a 1920-wide canvas: box half-width is 0.3 canvas
+    // half-widths, so the clip leaves the canvas once |x| >= 1.3.
+    const draft = draftWith([
+      track("video", "pip", [
+        seg("gone", "v", 0, 1_000_000, { clip: clip({ scale: { x: 0.3, y: 0.3 }, transform: { x: 1.35, y: 0 } }) }),
+      ]),
+    ]);
+    const [issue] = codes(lintDraft(draft, opts), "segment-offscreen");
+    assert.equal(issue.severity, "warning");
+    assert.equal(issue.fixable, false);
+    assert.equal(issue.location.segment_id, "gone");
+    assert.match(issue.message, /outside canvas/);
+  });
+
+  it("uses the material size: a portrait clip on a landscape canvas leaves sooner", () => {
+    // 1080x1920 fitted into 1920x1080 is 607.5px wide (0.316 of the canvas),
+    // so at x = 1.5 it is fully off; a canvas-filling assumption would not be.
+    const videos = [{ id: "portrait", type: "video", path: "", duration: 60_000_000, width: 1080, height: 1920 }];
+    const draft = draftWith(
+      [track("video", "pip", [seg("tall", "portrait", 0, 1_000_000, { clip: clip({ transform: { x: 1.5, y: 0 } }) })])],
+      videos,
+    );
+    assert.match(codes(lintDraft(draft, opts), "segment-offscreen")[0].message, /outside canvas/);
+    // Same position with unknown size: assumed to fill the canvas, still visible.
+    const unknown = draftWith([
+      track("video", "pip", [seg("tall", "v", 0, 1_000_000, { clip: clip({ transform: { x: 1.5, y: 0 } }) })]),
+    ]);
+    assert.equal(codes(lintDraft(unknown, opts), "segment-offscreen").length, 0);
+  });
+
+  it("flags zero scale and zero opacity", () => {
+    const draft = draftWith([
+      track("sticker", "stickers", [
+        seg("flat", "x", 0, 1_000_000, { clip: clip({ scale: { x: 1, y: 0 } }) }),
+        seg("clear", "x", 1_000_000, 1_000_000, { clip: clip({ alpha: 0 }) }),
+      ]),
+    ]);
+    const issues = codes(lintDraft(draft, opts), "segment-offscreen");
+    assert.equal(issues.length, 2);
+    assert.match(issues.find((i) => i.location.segment_id === "flat").message, /zero scale/);
+    assert.match(issues.find((i) => i.location.segment_id === "clear").message, /zero opacity/);
+  });
+
+  it("skips a reason whose property is keyframed", () => {
+    const keyframes = (type) => [{ id: "k", property_type: type, keyframe_list: [{ id: "k1", time_offset: 0 }] }];
+    const draft = draftWith([
+      track("video", "pip", [
+        seg("fade-in", "v", 0, 1_000_000, { clip: clip({ alpha: 0 }), common_keyframes: keyframes("KFTypeAlpha") }),
+        seg("slide-in", "v", 1_000_000, 1_000_000, {
+          clip: clip({ transform: { x: 3, y: 0 } }),
+          common_keyframes: keyframes("KFTypePositionX"),
+        }),
+      ]),
+    ]);
+    assert.equal(codes(lintDraft(draft, opts), "segment-offscreen").length, 0);
+  });
+
+  it("ignores audio tracks", () => {
+    const draft = draftWith([track("audio", "music", [seg("bed", "a", 0, 1_000_000, { clip: clip({ alpha: 0 }) })])]);
+    assert.equal(codes(lintDraft(draft, opts), "segment-offscreen").length, 0);
+  });
+});
diff --git a/test/render-fidelity.test.mjs b/test/render-fidelity.test.mjs
new file mode 100644
index 0000000..bf958e2
--- /dev/null
+++ b/test/render-fidelity.test.mjs
@@ -0,0 +1,432 @@
+import assert from "node:assert/strict";
+import { chmodSync, existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { after, describe, it } from "node:test";
+import {
+  buildRenderPlan,
+  checkOutputDuration,
+  FIDELITY_CATEGORIES,
+  FIDELITY_ID_CAP,
+  fidelityCensus,
+  frameToleranceUs,
+  probeRenderOutput,
+  renderDraft,
+} from "../dist/render.js";
+import { spawnCli } from "./helpers/spawn-cli.mjs";
+
+const US = 1_000_000;
+const isWindows = process.platform === "win32"; // fake ffmpeg/ffprobe are /bin/sh scripts
+
+function setup() {
+  const dir = mkdtempSync(join(tmpdir(), "capcut-render-fidelity-"));
+  return { dir, cleanup: () => rmSync(dir, { recursive: true, force: true }) };
+}
+
+const seg = (id, matId, start, dur, extra = {}) => ({
+  id,
+  material_id: matId,
+  target_timerange: { start, duration: dur },
+  source_timerange: { start: 0, duration: dur },
+  speed: 1,
+  volume: 1,
+  visible: true,
+  clip: null,
+  extra_material_refs: [],
+  render_index: 0,
+  ...extra,
+});
+
+// Two contiguous main-track clips, one audio bed, one caption: everything the
+// proxy reproduces once --burn-captions is on.
+function plainDraft(dir) {
+  const v1 = join(dir, "clip1.mp4");
+  const v2 = join(dir, "clip2.mp4");
+  const a1 = join(dir, "music.mp3");
+  for (const p of [v1, v2, a1]) writeFileSync(p, "");
+  return {
+    id: "d",
+    name: "t",
+    duration: 4 * US,
+    fps: 30,
+    canvas_config: { width: 720, height: 1280, ratio: "9:16" },
+    tracks: [
+      {
+        id: "tv",
+        type: "video",
+        name: "video",
+        attribute: 0,
+        segments: [seg("v1", "mv1", 0, 2 * US), seg("v2", "mv2", 2 * US, 2 * US)],
+      },
+      { id: "ta", type: "audio", name: "audio", attribute: 0, segments: [seg("a1", "ma1", 0, 4 * US)] },
+      { id: "tt", type: "text", name: "captions", attribute: 0, segments: [seg("t1", "mt1", 0, 2 * US)] },
+    ],
+    materials: {
+      videos: [
+        { id: "mv1", path: v1, type: "video", material_name: "clip1.mp4", duration: 2 * US },
+        { id: "mv2", path: v2, type: "video", material_name: "clip2.mp4", duration: 2 * US },
+      ],
+      audios: [{ id: "ma1", path: a1, name: "music", type: "extract_music", duration: 4 * US }],
+      texts: [{ id: "mt1", type: "text", content: JSON.stringify({ text: "Hook line" }) }],
+      speeds: [],
+      material_animations: [],
+      audio_fades: [],
+      transitions: [],
+    },
+  };
+}
+
+// Every category the census checks, one segment each where possible.
+function richDraft(dir) {
+  const d = plainDraft(dir);
+  const ov = join(dir, "overlay.mp4");
+  writeFileSync(ov, "");
+  const main = d.tracks[0].segments;
+  main[0].extra_material_refs = ["tr1", "mask1", "chroma1", "anim-video"];
+  main[0].common_keyframes = [{ property_type: "KFTypePositionX", keyframe_list: [{ time_offset: 0 }] }];
+  // A gap before the second clip: concat would pull it to 2s.
+  main[1].target_timerange = { start: 3 * US, duration: 1 * US };
+  main[1].source_timerange = { start: 0, duration: 1 * US };
+  // An empty keyframe list is not animation.
+  main[1].common_keyframes = [{ property_type: "KFTypeScaleX", keyframe_list: [] }];
+  d.tracks[2].segments[0].extra_material_refs = ["anim-text"];
+  d.tracks.push(
+    { id: "to", type: "video", name: "overlay", attribute: 0, segments: [seg("o1", "mov", 0, 1 * US)] },
+    { id: "ts", type: "sticker", name: "sticker", attribute: 0, segments: [seg("s1", "st1", 0, 1 * US)] },
+    { id: "te", type: "effect", name: "effect", attribute: 0, segments: [seg("e1", "fx1", 0, 1 * US)] },
+    { id: "tf", type: "filter", name: "filter", attribute: 0, segments: [seg("f1", "flt1", 0, 1 * US)] },
+  );
+  d.materials.videos[1].mix_mode = "Screen";
+  d.materials.videos[1].matting = { flag: 2 };
+  d.materials.videos.push({ id: "mov", path: ov, type: "video", material_name: "overlay.mp4", duration: US });
+  d.materials.transitions = [{ id: "tr1", name: "Dissolve" }];
+  d.materials.common_mask = [{ id: "mask1", type: "mask" }];
+  d.materials.chromas = [{ id: "chroma1", type: "chromas" }];
+  d.materials.video_effects = [
+    { id: "fx1", type: "video_effect" },
+    { id: "flt1", type: "filter" },
+  ];
+  d.materials.material_animations = [
+    { id: "anim-video", type: "sticker_animation", animations: [{ type: "in" }] },
+    { id: "anim-text", type: "sticker_animation", animations: [{ type: "out" }] },
+  ];
+  return d;
+}
+
+describe("render fidelity census (pure)", () => {
+  it("a plain draft with burned captions is faithful and targets the draft duration", () => {
+    const s = setup();
+    after(s.cleanup);
+    const plan = buildRenderPlan(plainDraft(s.dir), { out: join(s.dir, "p.mp4"), burnCaptions: true });
+    assert.equal(plan.fidelity.faithful, true);
+    assert.deepEqual(plan.fidelity.dropped, {});
+    assert.equal(plan.fidelity.expected_duration_us, 4 * US);
+    assert.deepEqual(plan.fidelity.checked, [...FIDELITY_CATEGORIES]);
+  });
+
+  it("text that is not burned counts as dropped", () => {
+    const s = setup();
+    after(s.cleanup);
+    const plan = buildRenderPlan(plainDraft(s.dir), { out: join(s.dir, "p.mp4"), softCaptions: true });
+    assert.equal(plan.fidelity.faithful, false);
+    assert.deepEqual(plan.fidelity.dropped.text.segment_ids, ["t1"]);
+    assert.match(plan.fidelity.dropped.text.hint, /--burn-captions/);
+  });
+
+  it("names every category the draft carries, with the affected segment ids", () => {
+    const s = setup();
+    after(s.cleanup);
+    const census = buildRenderPlan(richDraft(s.dir), { out: join(s.dir, "p.mp4"), burnCaptions: true }).fidelity;
+    const ids = Object.fromEntries(Object.entries(census.dropped).map(([k, v]) => [k, v.segment_ids]));
+    assert.deepEqual(ids, {
+      main_track_gaps: ["v2"],
+      overlay_tracks: ["o1"],
+      stickers: ["s1"],
+      transitions: ["v1"],
+      effects: ["e1"],
+      filters: ["f1"],
+      masks: ["v1"],
+      keyframes: ["v1"],
+      text_animations: ["t1"],
+      video_animations: ["v1"],
+      mix_modes: ["v2"],
+      chroma: ["v1"],
+      matting: ["v2"],
+    });
+    assert.equal(census.faithful, false);
+    for (const entry of Object.values(census.dropped)) assert.equal(entry.count, entry.segment_ids.length);
+  });
+
+  it("--all-video-tracks composites overlays, so they leave the census", () => {
+    const s = setup();
+    after(s.cleanup);
+    const census = fidelityCensus(richDraft(s.dir), { allVideoTracks: true, burnCaptions: true });
+    assert.equal(census.dropped.overlay_tracks, undefined);
+  });
+
+  it("caps the id list but keeps the full count", () => {
+    const s = setup();
+    after(s.cleanup);
+    const d = plainDraft(s.dir);
+    const n = FIDELITY_ID_CAP + 5;
+    d.tracks.push({
+      id: "ts",
+      type: "sticker",
+      name: "sticker",
+      attribute: 0,
+      segments: Array.from({ length: n }, (_, i) => seg(`s${i}`, "st", i * 1000, 1000)),
+    });
+    const census = fidelityCensus(d, { burnCaptions: true });
+    assert.equal(census.dropped.stickers.count, n);
+    assert.equal(census.dropped.stickers.segment_ids.length, FIDELITY_ID_CAP);
+  });
+
+  it("main-track segments whose media is missing count as missing_media", () => {
+    const s = setup();
+    after(s.cleanup);
+    const d = plainDraft(s.dir);
+    d.materials.videos[1].path = join(s.dir, "gone.mp4");
+    const plan = buildRenderPlan(d, { out: join(s.dir, "p.mp4"), burnCaptions: true });
+    assert.deepEqual(plan.fidelity.dropped.missing_media.segment_ids, ["v2"]);
+  });
+
+  it("falls back to the last segment end when draft.duration is unset", () => {
+    const s = setup();
+    after(s.cleanup);
+    const d = plainDraft(s.dir);
+    d.duration = 0;
+    assert.equal(fidelityCensus(d, {}).expected_duration_us, 4 * US);
+  });
+});
+
+describe("render output verification (pure)", () => {
+  it("tolerance is one frame at the render fps; drift within it passes", () => {
+    assert.equal(frameToleranceUs(30), 33_333);
+    assert.equal(frameToleranceUs(25), 40_000);
+    const ok = checkOutputDuration(4 * US + 33_333, 4 * US, 30);
+    assert.deepEqual(ok, {
+      verified: true,
+      duration_us: 4 * US + 33_333,
+      expected_duration_us: 4 * US,
+      drift_us: 33_333,
+      tolerance_us: 33_333,
+      within_tolerance: true,
+    });
+    const short = checkOutputDuration(3 * US, 4 * US, 30);
+    assert.equal(short.drift_us, -US);
+    assert.equal(short.within_tolerance, false);
+  });
+
+  it("an unprobeable output reports verified:false with a reason instead of failing", () => {
+    const s = setup();
+    after(s.cleanup);
+    const missing = probeRenderOutput(join(s.dir, "nope.mp4"), 4 * US, 30);
+    assert.equal(missing.verified, false);
+    assert.match(missing.reason, /not found/);
+    const out = join(s.dir, "p.mp4");
+    writeFileSync(out, "");
+    const noProbe = probeRenderOutput(out, 4 * US, 30, join(s.dir, "no-ffprobe"));
+    assert.equal(noProbe.verified, false);
+    assert.match(noProbe.reason, /ffprobe is unavailable/);
+  });
+});
+
+// A fake ffmpeg with every probed filter and libx264 that "renders" by
+// touching its last argument (the output path).
+function fakeFfmpeg(dir) {
+  const path = join(dir, "fake-ffmpeg");
+  const filters = [
+    "fps",
+    "scale",
+    "pad",
+    "setsar",
+    "format",
+    "trim",
+    "setpts",
+    "concat",
+    "atrim",
+    "asetpts",
+    "adelay",
+    "anull",
+    "amix",
+    "atempo",
+    "volume",
+    "afade",
+    "drawtext",
+    "overlay",
+  ];
+  writeFileSync(
+    path,
+    [
+      "#!/bin/sh",
+      'case "$*" in',
+      "  *-filters*)",
+      "    cat <<'EOF'",
+      ...filters.map((name) => ` ... ${name.padEnd(18)} V->V       fake.`),
+      "EOF",
+      "    exit 0 ;;",
+      "  *-encoders*)",
+      "    cat <<'EOF'",
+      " V..... libx264              H.264",
+      " S..... mov_text             3GPP Timed Text subtitle",
+      "EOF",
+      "    exit 0 ;;",
+      "esac",
+      'for last; do :; done; : > "$last"',
+      "exit 0",
+      "",
+    ].join("\n"),
+  );
+  chmodSync(path, 0o755);
+  return path;
+}
+
+// A fake ffprobe reporting the container duration given in FAKE_FFPROBE_DURATION (seconds).
+function fakeFfprobe(dir) {
+  const path = join(dir, "fake-ffprobe");
+  writeFileSync(
+    path,
+    [
+      "#!/bin/sh",
+      'if [ "$1" = "-version" ]; then echo "ffprobe version fake"; exit 0; fi',
+      'printf \'{"streams":[{"codec_type":"video","width":360,"height":640}],"format":{"duration":"%s"}}\' "$FAKE_FFPROBE_DURATION"',
+      "",
+    ].join("\n"),
+  );
+  chmodSync(path, 0o755);
+  return path;
+}
+
+function writeDraft(dir, draft) {
+  const path = join(dir, "draft_content.json");
+  writeFileSync(path, JSON.stringify(draft));
+  return path;
+}
+
+describe("render --strict", () => {
+  it("--dry-run reports the census; --strict refuses an unfaithful plan", () => {
+    const s = setup();
+    after(s.cleanup);
+    const draftPath = writeDraft(s.dir, richDraft(s.dir));
+    const plain = spawnCli(["render", draftPath, "--out", join(s.dir, "p.mp4"), "--dry-run"]);
+    assert.equal(plain.status, 0, plain.stderr);
+    assert.equal(plain.json.fidelity.faithful, false);
+    assert.equal(plain.json.fidelity.dropped.transitions.count, 1);
+
+    const strict = spawnCli(["render", draftPath, "--out", join(s.dir, "p.mp4"), "--dry-run", "--strict"]);
+    assert.notEqual(strict.status, 0);
+    assert.match(strict.stderr, /refused \[render-unfaithful\]/);
+    assert.match(strict.stderr, /transitions 1/);
+  });
+
+  it("--strict passes a faithful plan through", () => {
+    const s = setup();
+    after(s.cleanup);
+    const draftPath = writeDraft(s.dir, plainDraft(s.dir));
+    const r = spawnCli([
+      "render",
+      draftPath,
+      "--out",
+      join(s.dir, "p.mp4"),
+      "--dry-run",
+      "--strict",
+      "--burn-captions",
+    ]);
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(r.json.fidelity.faithful, true);
+  });
+
+  it("refuses before ffmpeg runs, so nothing is written", { skip: isWindows }, () => {
+    const s = setup();
+    after(s.cleanup);
+    const out = join(s.dir, "p.mp4");
+    assert.throws(
+      () =>
+        renderDraft(richDraft(s.dir), join(s.dir, "draft_content.json"), {
+          out,
+          ffmpegCmd: fakeFfmpeg(s.dir),
+          strict: true,
+        }),
+      /refused \[render-unfaithful\]/,
+    );
+    assert.equal(existsSync(out), false);
+  });
+});
+
+describe("render output verification (fake ffmpeg + ffprobe)", { skip: isWindows }, () => {
+  function run(dir, durationSeconds, extra = []) {
+    const draftPath = writeDraft(dir, plainDraft(dir));
+    const out = join(dir, "p.mp4");
+    const r = spawnCli(
+      [
+        "render",
+        draftPath,
+        "--out",
+        out,
+        "--ffmpeg-cmd",
+        fakeFfmpeg(dir),
+        "--ffprobe-cmd",
+        fakeFfprobe(dir),
+        "--burn-captions",
+        ...extra,
+      ],
+      { env: { FAKE_FFPROBE_DURATION: String(durationSeconds) } },
+    );
+    return { r, out };
+  }
+
+  it("reports the probed duration and drift within one frame", () => {
+    const s = setup();
+    after(s.cleanup);
+    const { r } = run(s.dir, "4.02", ["--verify"]);
+    assert.equal(r.status, 0, r.stderr);
+    assert.deepEqual(r.json.verification, {
+      verified: true,
+      duration_us: 4_020_000,
+      expected_duration_us: 4 * US,
+      drift_us: 20_000,
+      tolerance_us: 33_333,
+      within_tolerance: true,
+    });
+    assert.equal(typeof r.json.output, "string", "the existing output path field is unchanged");
+  });
+
+  it("drift beyond tolerance is reported; only --verify turns it into a failure, and the file stays", () => {
+    const s = setup();
+    after(s.cleanup);
+    const lax = run(s.dir, "3.5");
+    assert.equal(lax.r.status, 0, lax.r.stderr);
+    assert.equal(lax.r.json.verification.within_tolerance, false);
+    assert.equal(lax.r.json.verification.drift_us, -500_000);
+
+    const strict = run(s.dir, "3.5", ["--verify"]);
+    assert.notEqual(strict.r.status, 0);
+    assert.equal(strict.r.json.verification.within_tolerance, false);
+    assert.match(strict.r.stderr, /drifts -500000us/);
+    assert.ok(existsSync(strict.out), "the rendered file is kept");
+  });
+
+  it("missing ffprobe: verified:false normally, a clear failure with --verify", () => {
+    const s = setup();
+    after(s.cleanup);
+    const draftPath = writeDraft(s.dir, plainDraft(s.dir));
+    const args = [
+      "render",
+      draftPath,
+      "--out",
+      join(s.dir, "p.mp4"),
+      "--ffmpeg-cmd",
+      fakeFfmpeg(s.dir),
+      "--ffprobe-cmd",
+      join(s.dir, "no-such-ffprobe"),
+    ];
+    const lax = spawnCli(args);
+    assert.equal(lax.status, 0, lax.stderr);
+    assert.equal(lax.json.verification.verified, false);
+    assert.match(lax.json.verification.reason, /ffprobe is unavailable/);
+
+    const strict = spawnCli([...args, "--verify"]);
+    assert.notEqual(strict.status, 0);
+    assert.match(strict.stderr, /could not be verified: ffprobe is unavailable/);
+  });
+});
diff --git a/test/tts-lexicon.test.mjs b/test/tts-lexicon.test.mjs
new file mode 100644
index 0000000..ff3ae6a
--- /dev/null
+++ b/test/tts-lexicon.test.mjs
@@ -0,0 +1,229 @@
+import assert from "node:assert/strict";
+import { chmodSync, existsSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { after, describe, it } from "node:test";
+import { applyLexicon, LexiconError, parseLexicon } from "../dist/lexicon.js";
+import { spawnCli } from "./helpers/spawn-cli.mjs";
+import { tmpDraft } from "./helpers/tmp-draft.mjs";
+
+const isWindows = process.platform === "win32"; // fake-TTS tests use /bin/sh scripts
+
+const rules = (...list) => parseLexicon(list);
+const spoken = (text, ...list) => applyLexicon(text, rules(...list)).spoken_text;
+
+describe("lexicon — parsing", () => {
+  it("accepts { rules: [...] } and a bare array, defaulting case_sensitive to true", () => {
+    const wrapped = parseLexicon({ rules: [{ text: "Nguyen", say: "Win" }] });
+    const bare = parseLexicon([{ text: "Nguyen", say: "Win" }]);
+    assert.deepEqual(wrapped, [{ text: "Nguyen", say: "Win", case_sensitive: true }]);
+    assert.deepEqual(bare, wrapped);
+    assert.equal(parseLexicon([{ text: "a", say: "b", case_sensitive: false }])[0].case_sensitive, false);
+  });
+
+  for (const [label, doc] of [
+    ["a non-array document", { rule: [] }],
+    ["a missing say", [{ text: "x" }]],
+    ["a missing text", [{ say: "x" }]],
+    ["an empty text", [{ text: "", say: "x" }]],
+    ["a non-string say", [{ text: "x", say: 3 }]],
+    ["a non-object rule", ["x"]],
+    ["a non-boolean case_sensitive", [{ text: "x", say: "y", case_sensitive: "no" }]],
+  ]) {
+    it(`refuses ${label} as lexicon-invalid`, () => {
+      assert.throws(
+        () => parseLexicon(doc),
+        (e) => e instanceof LexiconError && e.gate === "lexicon-invalid",
+      );
+    });
+  }
+});
+
+describe("lexicon — matcher", () => {
+  it("replaces at word boundaries only", () => {
+    assert.equal(
+      spoken("SQL and MySQLite and SQL_x, (SQL).", { text: "SQL", say: "sequel" }),
+      "sequel and MySQLite and SQL_x, (sequel).",
+    );
+  });
+
+  it("does not require a boundary at a non-word rule edge", () => {
+    assert.equal(spoken("C++is fun", { text: "C++", say: "C plus plus" }), "C plus plusis fun");
+  });
+
+  it("prefers the longest match at a position", () => {
+    const r = applyLexicon(
+      "New York City and New York",
+      rules({ text: "New York", say: "NY" }, { text: "New York City", say: "NYC" }),
+    );
+    assert.equal(r.spoken_text, "NYC and NY");
+    assert.deepEqual(
+      r.applied.map((a) => [a.rule_text, a.source_start, a.source_end]),
+      [
+        ["New York City", 0, 13],
+        ["New York", 18, 26],
+      ],
+    );
+  });
+
+  it("matches CJK rules anywhere and lets Latin rules sit next to CJK text", () => {
+    assert.equal(spoken("我喜欢重庆火锅", { text: "重庆", say: "Chongqing" }), "我喜欢Chongqing火锅");
+    assert.equal(spoken("我用SQL查询", { text: "SQL", say: "sequel" }), "我用sequel查询");
+  });
+
+  it("refuses equal-length matches that say different things, but allows identical duplicates", () => {
+    assert.throws(
+      () =>
+        applyLexicon(
+          "use SQL",
+          rules({ text: "SQL", say: "sequel" }, { text: "sql", say: "S Q L", case_sensitive: false }),
+        ),
+      (e) => e instanceof LexiconError && e.gate === "lexicon-ambiguous",
+    );
+    assert.equal(spoken("use SQL", { text: "SQL", say: "sequel" }, { text: "SQL", say: "sequel" }), "use sequel");
+    // A conflicting pair that never matches the text is not ambiguous.
+    assert.equal(spoken("hello", { text: "SQL", say: "a" }, { text: "SQL", say: "b" }), "hello");
+  });
+
+  it("is case-sensitive by default and case-insensitive on request", () => {
+    assert.equal(spoken("nguyen Nguyen", { text: "Nguyen", say: "Win" }), "nguyen Win");
+    assert.equal(spoken("nguyen NGUYEN", { text: "Nguyen", say: "Win", case_sensitive: false }), "Win Win");
+  });
+
+  it("reports offsets in UTF-16 code units past astral characters", () => {
+    const r = applyLexicon("😀 Nguyen", rules({ text: "Nguyen", say: "Win" }));
+    assert.deepEqual(r.applied, [{ rule_text: "Nguyen", say: "Win", source_start: 3, source_end: 9 }]);
+  });
+});
+
+/** Minimal valid PCM WAV the fake TTS copies to {out}. */
+function writeTinyWav(path) {
+  const dataSize = 8000 * 2;
+  const b = Buffer.alloc(44 + dataSize);
+  b.write("RIFF", 0);
+  b.writeUInt32LE(36 + dataSize, 4);
+  b.write("WAVE", 8);
+  b.write("fmt ", 12);
+  b.writeUInt32LE(16, 16);
+  b.writeUInt16LE(1, 20);
+  b.writeUInt16LE(1, 22);
+  b.writeUInt32LE(8000, 24);
+  b.writeUInt32LE(16000, 28);
+  b.writeUInt16LE(2, 32);
+  b.writeUInt16LE(16, 34);
+  b.write("data", 36);
+  b.writeUInt32LE(dataSize, 40);
+  writeFileSync(path, b);
+}
+
+function setup() {
+  const dir = mkdtempSync(join(tmpdir(), "capcut-tts-lexicon-"));
+  const srcWav = join(dir, "src.wav");
+  writeTinyWav(srcWav);
+  const fakeFfprobe = join(dir, "fake-ffprobe");
+  const probeJson = JSON.stringify({
+    streams: [{ codec_type: "audio", codec_name: "pcm_s16le", channels: 1 }],
+    format: { duration: "1.5" },
+  });
+  writeFileSync(fakeFfprobe, `#!/bin/sh\necho '${probeJson}'\n`);
+  chmodSync(fakeFfprobe, 0o755);
+  const capture = join(dir, "capture");
+  const ran = join(dir, "ran");
+  // Records the stdin text it was handed, then writes the wav.
+  const fakeTts = join(dir, "fake-tts");
+  writeFileSync(fakeTts, `#!/bin/sh\ntouch "${ran}"\ncat > "${capture}"\ncp "${srcWav}" "$1"\n`);
+  chmodSync(fakeTts, 0o755);
+  const lexicon = (doc) => {
+    const p = join(dir, `lexicon-${Math.random().toString(36).slice(2)}.json`);
+    writeFileSync(p, typeof doc === "string" ? doc : JSON.stringify(doc));
+    return p;
+  };
+  return {
+    dir,
+    fakeFfprobe,
+    fakeTts,
+    capture,
+    ran,
+    lexicon,
+    cleanup: () => rmSync(dir, { recursive: true, force: true }),
+  };
+}
+
+describe("capcut tts --lexicon — end to end with a fake TTS", () => {
+  const s = setup();
+  const fix = tmpDraft();
+  after(() => {
+    s.cleanup();
+    fix.cleanup();
+  });
+  const run = (extra) =>
+    spawnCli(["tts", fix.path, ...extra, "--tts-cmd", `${s.fakeTts} {out}`, "--ffprobe-cmd", s.fakeFfprobe]);
+
+  it("speaks the rewritten text and reports the applied rules", { skip: isWindows }, () => {
+    const text = "Dr. Nguyen explains SQL, not MySQLite.";
+    const lex = s.lexicon({
+      rules: [
+        { text: "Nguyen", say: "Win" },
+        { text: "sql", say: "sequel", case_sensitive: false },
+      ],
+    });
+    const r = run(["--text", text, "--lexicon", lex]);
+    assert.equal(r.status, 0, `stderr: ${r.stderr}`);
+    assert.equal(readFileSync(s.capture, "utf-8"), "Dr. Win explains sequel, not MySQLite.");
+    assert.equal(r.json.text_chars, text.length, "text_chars keeps describing the original text");
+    assert.equal(r.json.lexicon.rules, 2);
+    assert.equal(r.json.lexicon.spoken_text, "Dr. Win explains sequel, not MySQLite.");
+    assert.deepEqual(
+      r.json.lexicon.applied.map((a) => [a.rule_text, a.source_start, a.source_end]),
+      [
+        ["Nguyen", 4, 10],
+        ["sql", 20, 23],
+      ],
+    );
+    assert.equal(text.slice(4, 10), "Nguyen");
+    // tts writes no visible text: nothing in the draft carries the spoken spelling.
+    const draftText = readFileSync(fix.path, "utf-8");
+    assert.ok(!draftText.includes("sequel"), "the draft must not contain the spoken rewrite");
+  });
+
+  it("applies to --text-file content and accepts a top-level array", { skip: isWindows }, () => {
+    const textFile = join(s.dir, "script.txt");
+    writeFileSync(textFile, "我在重庆\n");
+    const r = run(["--text-file", textFile, "--lexicon", s.lexicon([{ text: "重庆", say: "Chongqing" }])]);
+    assert.equal(r.status, 0, `stderr: ${r.stderr}`);
+    assert.equal(readFileSync(s.capture, "utf-8"), "我在Chongqing");
+    assert.equal(r.json.lexicon.applied[0].source_start, 2);
+  });
+
+  for (const [label, doc, gate] of [
+    ["a rule without say", { rules: [{ text: "x" }] }, "lexicon-invalid"],
+    ["an empty text rule", [{ text: "", say: "y" }], "lexicon-invalid"],
+    ["unparseable JSON", "{ rules: ", "lexicon-invalid"],
+    [
+      "equal-length rules with different say values",
+      [
+        { text: "Nguyen", say: "Win" },
+        { text: "nguyen", say: "New-yen", case_sensitive: false },
+      ],
+      "lexicon-ambiguous",
+    ],
+  ]) {
+    it(`refuses ${label} before the engine runs`, { skip: isWindows }, () => {
+      rmSync(s.ran, { force: true });
+      const audioDir = join(fix.dir, "assets", "audio");
+      const count = () => (existsSync(audioDir) ? readdirSync(audioDir).length : 0);
+      const before = count();
+      const r = run(["--text", "Dr. Nguyen", "--lexicon", s.lexicon(doc)]);
+      assert.notEqual(r.status, 0);
+      assert.match(r.stderr, new RegExp(`refused \\[${gate}\\]`));
+      assert.equal(existsSync(s.ran), false, "the TTS engine must not run");
+      assert.equal(count(), before);
+    });
+  }
+
+  it("refuses a missing lexicon file", () => {
+    const r = run(["--text", "hello", "--lexicon", join(s.dir, "nope.json")]);
+    assert.notEqual(r.status, 0);
+    assert.match(r.stderr, /refused \[lexicon-invalid\]/);
+  });
+});
diff --git a/test/write-journal.test.mjs b/test/write-journal.test.mjs
new file mode 100644
index 0000000..0f6863e
--- /dev/null
+++ b/test/write-journal.test.mjs
@@ -0,0 +1,109 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { appendFileSync, readdirSync, readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { after, describe, it } from "node:test";
+import { spawnCli } from "./helpers/spawn-cli.mjs";
+import { tmpDraft } from "./helpers/tmp-draft.mjs";
+
+const sha = (text) => createHash("sha256").update(text).digest("hex");
+
+function journalLines(fix) {
+  const path = join(fix.dir, ".capcut-cli-history", "draft_content.json.journal.jsonl");
+  return readFileSync(path, "utf-8")
+    .split("\n")
+    .filter((line) => line.trim())
+    .map((line) => JSON.parse(line));
+}
+
+describe("write journal", () => {
+  it("records each write and restore --list names the commands newest-first", () => {
+    const fix = tmpDraft();
+    after(fix.cleanup);
+    const id = spawnCli(["texts", fix.path]).json[0].id;
+    const original = readFileSync(fix.path, "utf-8");
+    assert.equal(spawnCli(["set-text", fix.path, id, "J1", "-q"]).status, 0);
+    const afterFirst = readFileSync(fix.path, "utf-8");
+    assert.equal(spawnCli(["shift", fix.path, id, "+1s", "-q"]).status, 0);
+
+    const lines = journalLines(fix);
+    assert.equal(lines.length, 2);
+    assert.equal(lines[0].index, 1);
+    assert.equal(lines[0].command, "set-text");
+    assert.deepEqual(lines[0].argv, [fix.path, id, "J1", "-q"]);
+    assert.equal(lines[0].before_sha256, sha(original));
+    assert.equal(lines[0].after_sha256, sha(afterFirst));
+    assert.equal(lines[1].before_sha256, sha(afterFirst));
+    assert.ok(!Number.isNaN(Date.parse(lines[0].time)));
+
+    const list = spawnCli(["restore", fix.path, "--list"]);
+    assert.equal(list.status, 0, list.stderr);
+    assert.equal(list.json.count, 2);
+    assert.deepEqual(
+      list.json.snapshots.map((s) => s.command),
+      ["shift", "set-text"],
+    );
+    assert.deepEqual(list.json.snapshots[0].argv, [fix.path, id, "+1s", "-q"]);
+    assert.equal(typeof list.json.snapshots[0].time, "string");
+  });
+
+  it("trims journal lines with the snapshots beyond the history cap", () => {
+    const fix = tmpDraft();
+    after(fix.cleanup);
+    const id = spawnCli(["texts", fix.path]).json[0].id;
+    for (let i = 1; i <= 22; i++) assert.equal(spawnCli(["set-text", fix.path, id, `T${i}`, "-q"]).status, 0);
+
+    const snaps = readdirSync(join(fix.dir, ".capcut-cli-history"))
+      .filter((f) => f.endsWith(".snap"))
+      .map((f) => Number.parseInt(f.match(/\.(\d+)\.snap$/)[1], 10))
+      .sort((a, b) => a - b);
+    const lines = journalLines(fix);
+    assert.equal(snaps.length, 20);
+    assert.deepEqual(
+      lines.map((l) => l.index),
+      snaps,
+    );
+    assert.equal(lines[0].index, 3);
+    assert.deepEqual(lines.at(-1).argv, [fix.path, id, "T22", "-q"]);
+
+    const list = spawnCli(["restore", fix.path, "--list"]);
+    assert.equal(list.json.count, 20);
+    assert.ok(list.json.snapshots.every((s) => s.command === "set-text"));
+  });
+
+  it("skips a corrupted journal line without breaking writes or restore", () => {
+    const fix = tmpDraft();
+    after(fix.cleanup);
+    const id = spawnCli(["texts", fix.path]).json[0].id;
+    assert.equal(spawnCli(["set-text", fix.path, id, "A", "-q"]).status, 0);
+    const journal = join(fix.dir, ".capcut-cli-history", "draft_content.json.journal.jsonl");
+    appendFileSync(journal, '{"index": 2, "command": torn\n');
+    assert.equal(spawnCli(["set-text", fix.path, id, "B", "-q"]).status, 0);
+
+    const list = spawnCli(["restore", fix.path, "--list"]);
+    assert.equal(list.status, 0, list.stderr);
+    assert.deepEqual(
+      list.json.snapshots.map((s) => s.command),
+      ["set-text", "set-text"],
+    );
+
+    const restored = spawnCli(["restore", fix.path, "--step", "1"]);
+    assert.equal(restored.status, 0, restored.stderr);
+    assert.equal(spawnCli(["texts", fix.path]).json[0].text, "A");
+  });
+
+  it("lists snapshots without a journal line with null fields", () => {
+    const fix = tmpDraft();
+    after(fix.cleanup);
+    const id = spawnCli(["texts", fix.path]).json[0].id;
+    assert.equal(spawnCli(["set-text", fix.path, id, "A", "-q"]).status, 0);
+    const journal = join(fix.dir, ".capcut-cli-history", "draft_content.json.journal.jsonl");
+    // Simulate a snapshot written before the journal existed.
+    rmSync(journal);
+    const list = spawnCli(["restore", fix.path, "--list"]);
+    assert.equal(list.json.count, 1);
+    assert.equal(list.json.snapshots[0].command, null);
+    assert.equal(list.json.snapshots[0].argv, null);
+    assert.equal(list.json.snapshots[0].time, null);
+  });
+});