Render exports the authored src when a script sets a video's src in a querySelectorAll loop, and check says nothing #7504

Describe the bug

A timed <video> whose src an inline script sets synchronously in a loop renders with its authored src. snapshot and preview show the script's clip, and check passes with 0 warnings.

document.querySelectorAll("[data-clip]").forEach((el) => {
  el.src = "assets/blue-swapped.mp4";
});

extractMediaSrcMutations only keeps writes whose target resolves to a literal getElementById / querySelector lookup, so this write never opens the browser probe. The media_runtime_src_mutation lint rule uses the same parser, so it stays silent too.

Minimal reproduction

https://github.com/ArcadeHQ/hyperframes-repros/tree/patch/untraced-media-src-write

Steps to reproduce

git checkout patch/untraced-media-src-write
npm run check                                                    # passes, 0 warnings
npx hyperframes@0.9.30 snapshot --at 1.5 --no-end -o out/snap    # blue
npm run render -- --quality draft --output out/render.mp4
ffmpeg -ss 1.5 -i out/render.mp4 -frames:v 1 out/render.png      # red

Expected behavior

The render shows the blue clip, like snapshot and preview. If following such writes is out of scope, check warns that a src write could not be traced.

Actual behavior

The render shows the red authored clip. The render log shows no browser probe.

Environment

hyperframes 0.9.30, Node v24.22.2, macOS arm64 (Apple M1 Pro), FFmpeg 9.0.2, chrome-headless-shell 152.0.7977.30.

Additional context

Control: with document.querySelector("#clip").src = "assets/blue-swapped.mp4" instead of the loop, lint warns media_runtime_src_mutation, the log shows "reasons":["runtime-created or source-mutated media"], and the render is blue.

Two possible fixes: teach the parser the loop shape, or treat any src write it cannot resolve as a reason to probe when the document has <video> or <audio>. Happy to send a PR for whichever you prefer.