fix(ci): [CI-01] reject rendering substitutions in installed validation

scripts/browser-validation/README.md

@@ -58,6 +58,21 @@ local reports before rerunning the same scope. Invocation JSON records arguments
 and artifact identity; result JSON records the child's actual exit. Preflight
 errors occur before starting Playwright and remain in the terminal/CI tee log.
 Listing tests with `--list` is collection evidence only, not playback validation.
+`verifyInstalledBrowserEnvironment()` in `scope.ts` runs in both the launcher
+and the installed Playwright config, before reading installed artifacts. Direct
+config loading therefore cannot bypass the launcher's existing MediaBunny,
+Iframe, Mask or DASH execution-policy checks. Both paths also reject active
+JASSUB fixture substitutions (custom canvas, on-demand/offscreen/async selection,
+rAF/screenshot observation, bitmap/idle/single-flight controls) and Multiple
+Subtitles' native-event restoration control. Explicit inactive values remain
+valid; source tracing that does not replace the restoration condition remains
+available. This protects the standard test contract, not the player's public
+runtime configuration. The existing native JASSUB test keeps its explicit
+main-thread setting, and hybrid still selects actual browser capability.
+For deliberate alternate scheduling/rendering, use `yarn test:browser` with
+explicit input selection or the source launcher; do not label that run as the
+standard installed scope. No environment variable is silently cleared to turn a
+diagnostic run into an apparent normal result.
 The complete five-package installed main subset was run on Windows with two
 workers: 255 successful cases across 11 files and three engines, including six
 unsupported WebKit Document PiP capability records. See

scripts/browser-validation/scope.ts

@@ -90,16 +90,34 @@ export function browserInvocation(scope: string, args: string[], environment: No
     delete env.ARTPLAYER_BROWSER_ARTIFACTS
   }
   else {
-    assert(env.ARTPLAYER_BROWSER_ARTIFACTS, 'Installed browser checks require ARTPLAYER_BROWSER_ARTIFACTS')
-    assert(env.ARTPLAYER_MB_BROWSER_CANDIDATE !== '1', 'Installed browser checks must retain MediaBunny historical controls')
-    assert(env.ARTPLAYER_MASK_PROFILE !== '1', 'Installed browser checks cannot enable Mask CPU profiling')
-    assert(!['ARTPLAYER_IFRAME_BASELINE', 'ARTPLAYER_IFRAME_LIFECYCLE_ONLY', 'ARTPLAYER_IFRAME_BOUNDARIES_ONLY'].some(name => env[name] === '1'), 'Installed browser checks must retain Iframe candidate and historical controls')
-    assert(!env.ARTPLAYER_DASH_DIAGNOSTIC_SDK || env.ARTPLAYER_DASH_DIAGNOSTIC_SDK === 'none', 'Installed browser checks require the unchanged DASH SDK')
-    assert(!['ARTPLAYER_DASH_DIAGNOSE_STALL', 'ARTPLAYER_DASH_DIAGNOSE_GETTER', 'ARTPLAYER_DASH_DIAGNOSE_METRICS'].some(name => env[name] === '1'), 'Installed browser checks cannot use DASH recovery diagnostics')
+    verifyInstalledBrowserEnvironment(env)
   }
   return { scope, env, args: ['test', `--config=playwright.${scope}.config.js`, ...args], directory: `refactor/.cache/browser-${scope}` }
 }
 
+export function verifyInstalledBrowserEnvironment(env: NodeJS.ProcessEnv) {
+  assert(env.ARTPLAYER_BROWSER_ARTIFACTS, 'Installed browser checks require ARTPLAYER_BROWSER_ARTIFACTS')
+  assert(env.ARTPLAYER_MB_BROWSER_CANDIDATE !== '1', 'Installed browser checks must retain MediaBunny historical controls')
+  assert(env.ARTPLAYER_MASK_PROFILE !== '1', 'Installed browser checks cannot enable Mask CPU profiling')
+  assert(!['ARTPLAYER_IFRAME_BASELINE', 'ARTPLAYER_IFRAME_LIFECYCLE_ONLY', 'ARTPLAYER_IFRAME_BOUNDARIES_ONLY'].some(name => env[name] === '1'), 'Installed browser checks must retain Iframe candidate and historical controls')
+  assert(!env.ARTPLAYER_DASH_DIAGNOSTIC_SDK || env.ARTPLAYER_DASH_DIAGNOSTIC_SDK === 'none', 'Installed browser checks require the unchanged DASH SDK')
+  assert(!['ARTPLAYER_DASH_DIAGNOSE_STALL', 'ARTPLAYER_DASH_DIAGNOSE_GETTER', 'ARTPLAYER_DASH_DIAGNOSE_METRICS'].some(name => env[name] === '1'), 'Installed browser checks cannot use DASH recovery diagnostics')
+  for (const [name, active] of [
+    ['ARTPLAYER_JASSUB_CUSTOM_CANVAS', 'true'],
+    ['ARTPLAYER_JASSUB_ON_DEMAND', 'false'],
+    ['ARTPLAYER_JASSUB_OFFSCREEN', 'default'],
+    ['ARTPLAYER_JASSUB_READBACK_FRAME', 'true'],
+    ['ARTPLAYER_JASSUB_ASYNC_RENDER', 'false'],
+    ['ARTPLAYER_JASSUB_SCREENSHOT', 'true'],
+    ['ARTPLAYER_JASSUB_CONTROL_BITMAP', 'true'],
+    ['ARTPLAYER_JASSUB_CONTROL_IDLE_READBACK', 'true'],
+    ['ARTPLAYER_JASSUB_CONTROL_SINGLE_FLIGHT', 'true'],
+    ['ARTPLAYER_SOURCE_RESTORE_EVENT', '1'],
+  ] as const) {
+    assert(env[name] !== active, `Installed browser checks cannot use ${name}=${active}; use an explicit diagnostic browser run`)
+  }
+}
+
 export function browserScopeConfig(scope: BrowserScope): PlaywrightTestConfig {
   const directory = `refactor/.cache/browser-${scope}`
   return {