From 7925eb7dc2d2c202e79dce535f4b96871c1226ec Mon Sep 17 00:00:00 2001
From: Naruto TAKAHASHI <tnaruto@gmail.com>
Date: Sun, 19 Jul 2026 09:53:59 +0900
Subject: [PATCH 1/4] fix(runtime): validate untrusted .ssab/.ssqb before use

SSABResource::is_valid() rejects an animation whose parts_animation_data is longer than the shared parts table: the runtime indexes parts() positionally over it and, parsing unchecked under panic=abort, aborts the whole process at resource-create time on an out-of-range index (only '>' is rejected, so no loadable file is refused). SSQBResource::load_from_file() now runs the FlatBuffers Verifier and rejects a structurally-invalid buffer before any accessor follows its offsets. Also drops the unregistered ssab_file_changed/ssqb_file_changed emits (never ADD_SIGNAL'd, no consumer; reload uses the built-in 'changed' signal).
---
 ss_player/ssab_resource.cpp | 14 +++++++++++++-
 ss_player/ssqb_resource.cpp | 13 ++++++++++---
 2 files changed, 23 insertions(+), 4 deletions(-)

diff --git a/ss_player/ssab_resource.cpp b/ss_player/ssab_resource.cpp
index b98d5e3..f2218f0 100644
--- a/ss_player/ssab_resource.cpp
+++ b/ss_player/ssab_resource.cpp
@@ -39,6 +39,19 @@ bool SSABResource::is_valid() const {
     return false;
   }
 
+  // The runtime indexes parts() positionally over each animation's
+  // parts_animation_data; parsing unchecked under panic=abort, a list longer
+  // than parts() aborts the process at resource-create time. Reject that here
+  // (a shorter list never indexes out of range, so only '>').
+  const uint32_t parts_size = ssab->parts()->size();
+  const auto *animations = ssab->animations();
+  for (uint32_t a = 0; a < animations->size(); a++) {
+    const auto *pad = animations->Get(a)->parts_animation_data();
+    if (pad && pad->size() > parts_size) {
+      return false;
+    }
+  }
+
   return true;
 }
 
@@ -319,7 +332,6 @@ Error SSABResource::copy_from(const Ref<Resource> &p_resource) {
   const Ref<SSABResource> &ssabFile =
       static_cast<const Ref<SSABResource> &>(p_resource);
   this->binary = ssabFile->binary;
-  emit_signal(SNAME("ssab_file_changed"));
   return OK;
 }
 #endif
diff --git a/ss_player/ssqb_resource.cpp b/ss_player/ssqb_resource.cpp
index 4793b54..a6c84fd 100644
--- a/ss_player/ssqb_resource.cpp
+++ b/ss_player/ssqb_resource.cpp
@@ -27,9 +27,15 @@ Error SSQBResource::load_from_file(const String &path) {
     return error;
 #endif
 
-  return error;
+  // .ssqb is untrusted input; reject a structurally-invalid buffer here before
+  // any accessor follows its offsets (see get_ss_sequence_binary).
+  ::flatbuffers::Verifier verifier(binary.ptr(), binary.size());
+  if (!ss::format::VerifySsSequenceBinaryBuffer(verifier)) {
+    binary.clear();
+    return ERR_INVALID_DATA;
+  }
 
-  // return ERR_FILE_UNRECOGNIZED;
+  return error;
 }
 
 Error SSQBResource::save_to_file(const String &path) {
@@ -52,6 +58,8 @@ const ss::format::SsSequenceBinary *SSQBResource::get_ss_sequence_binary() {
   if (binary.size() == 0) {
     return nullptr;
   }
+  // binary is validated at load time (load_from_file runs the FlatBuffers
+  // Verifier and clears the buffer on failure), so this cast is safe.
   return ss::format::GetSsSequenceBinary(this->binary.ptr());
 }
 
@@ -65,7 +73,6 @@ Error SSQBResource::copy_from(const Ref<Resource> &p_resource) {
   const Ref<SSQBResource> &ssqbFile =
       static_cast<const Ref<SSQBResource> &>(p_resource);
   this->binary = ssqbFile->binary;
-  emit_signal(SNAME("ssqb_file_changed"));
   return OK;
 }
 #endif

From e3a5a4ce7ffd62f84eb01f7ccba629f97b328871 Mon Sep 17 00:00:00 2001
From: Naruto TAKAHASHI <tnaruto@gmail.com>
Date: Sun, 19 Jul 2026 09:53:59 +0900
Subject: [PATCH 2/4] perf(render): reuse surface Array and cache SNAME; drop
 TestStub scaffolding

_emit_partcolor_mesh reuses a member scratch Array (and empty blend-shape/LOD args) instead of allocating a fresh Array per call, clearing the element slots afterwards so they never pin the caller's copy-on-write buffers - removing a per-part/per-frame heap allocation from the draw hot path. The GDExtension SNAME macro now caches the interned StringName per call-site. get_world_matrix tightens its bound to p_idx*16 + 16 <= len to match the sibling accessors. Removes the TestStub embedded shader, teststub.fs, and the never-set _test_shader_id_hash_override debug field/branch.
---
 ss_player/shaders/teststub.fs    | 11 ---------
 ss_player/ss_internal_player.cpp | 41 +++++++++++++++++++-------------
 ss_player/ss_internal_player.h   | 19 ++++++++-------
 ss_player/ss_macros.h            |  2 +-
 ss_player/ss_shader_setup.h      | 13 ++--------
 5 files changed, 38 insertions(+), 48 deletions(-)
 delete mode 100644 ss_player/shaders/teststub.fs

diff --git a/ss_player/shaders/teststub.fs b/ss_player/shaders/teststub.fs
deleted file mode 100644
index 6b06117..0000000
--- a/ss_player/shaders/teststub.fs
+++ /dev/null
@@ -1,11 +0,0 @@
-R"GLSL(
-void fragment() {
-    vec4 p = ss_input_texture(TEXTURE, UV);
-    // Stub variant: invert the red channel of the sampled texture so this
-    // shader is visually distinct from Default for dispatch verification.
-    vec3 rgb = vec3(1.0 - p.r, p.g, p.b);
-    rgb = ss_partcolor_blend(rgb, partcolor_color.rgb, partcolor_varg);
-    float a = p.a * partcolor_color.a;
-    COLOR = ss_output_color(vec4(rgb, a), partcolor_varg.w);
-}
-)GLSL"
diff --git a/ss_player/ss_internal_player.cpp b/ss_player/ss_internal_player.cpp
index e28bed9..9023a63 100644
--- a/ss_player/ss_internal_player.cpp
+++ b/ss_player/ss_internal_player.cpp
@@ -1864,8 +1864,8 @@ int SsInternalPlayer::_build_normal(const DrawFrame& f, int p_idx,
         if (blend_idx < 0 || blend_idx > 3) blend_idx = 0;
     }
 
-    // Output PMA flag — parked at 0 for now; wired so the shader path is
-    // ready when the host turns PMA on globally or per texture.
+    // Output premultiplied-alpha flag. Held at 0 (disabled); the shader path
+    // reads this per-vertex so PMA can be enabled globally or per texture.
     const float pma_flag = 0.0f;
 
     for (int j = 0; j < CORNERS_COUNT; j++) {
@@ -2025,12 +2025,6 @@ SsInternalPlayer::PartShaderInfo SsInternalPlayer::_resolve_part_shader_info(con
             psi.map1 = _resolve_map_texture(sh->map1_cellmap_name_hash());
         }
     }
-    // Debug override: when set, force the dispatch through a specific catalog
-    // entry. Useful while verifying the per-part path before authoring .sspj
-    // content that actually exercises a custom shader id.
-    if (_test_shader_id_hash_override != 0) {
-        psi.id_hash = _test_shader_id_hash_override;
-    }
     if (!s_shader_catalog_map.has(psi.id_hash)) {
         psi.id_hash = s_default_shader_id_hash;
     }
@@ -2090,19 +2084,31 @@ void SsInternalPlayer::_emit_partcolor_mesh(RenderingServer* rs, RID ci,
                                             const SsVec2Array& uvs,
                                             const SsFloatArray& custom0,
                                             const RID& texture_rid) {
-    Array arrays;
-    arrays.resize(Mesh::ARRAY_MAX);
-    arrays[Mesh::ARRAY_VERTEX] = verts;
-    arrays[Mesh::ARRAY_TEX_UV] = uvs;
-    arrays[Mesh::ARRAY_COLOR]  = colors;
-    arrays[Mesh::ARRAY_CUSTOM0] = custom0;
-    arrays[Mesh::ARRAY_INDEX]  = indices;
+    // Reuse the member scratch Array instead of allocating one per call.
+    if (_surface_arrays.size() != Mesh::ARRAY_MAX) {
+        _surface_arrays.resize(Mesh::ARRAY_MAX);
+    }
+    _surface_arrays[Mesh::ARRAY_VERTEX]  = verts;
+    _surface_arrays[Mesh::ARRAY_TEX_UV]  = uvs;
+    _surface_arrays[Mesh::ARRAY_COLOR]   = colors;
+    _surface_arrays[Mesh::ARRAY_CUSTOM0] = custom0;
+    _surface_arrays[Mesh::ARRAY_INDEX]   = indices;
     // CUSTOM0 carries 4 floats per vertex (ARRAY_CUSTOM_RGBA_FLOAT).
     const uint64_t flags = (uint64_t)Mesh::ARRAY_CUSTOM_RGBA_FLOAT << Mesh::ARRAY_FORMAT_CUSTOM0_SHIFT;
 
     RID mesh_rid = _acquire_mesh_rid(rs);
-    rs->mesh_add_surface_from_arrays(mesh_rid, RenderingServer::PRIMITIVE_TRIANGLES, arrays, Array(), Dictionary(), flags);
+    rs->mesh_add_surface_from_arrays(mesh_rid, RenderingServer::PRIMITIVE_TRIANGLES, _surface_arrays,
+                                     _surface_empty_blend_shapes, _surface_empty_lods, flags);
     rs->canvas_item_add_mesh(ci, mesh_rid, Transform2D(), Color(1, 1, 1, 1), texture_rid);
+
+    // Drop the CoW references to the caller's scratch buffers so the next
+    // part's writes into them do not trigger a copy-on-write against this
+    // reused Array. mesh_add_surface_from_arrays has already copied the data.
+    _surface_arrays[Mesh::ARRAY_VERTEX]  = Variant();
+    _surface_arrays[Mesh::ARRAY_TEX_UV]  = Variant();
+    _surface_arrays[Mesh::ARRAY_COLOR]   = Variant();
+    _surface_arrays[Mesh::ARRAY_CUSTOM0] = Variant();
+    _surface_arrays[Mesh::ARRAY_INDEX]   = Variant();
 }
 
 RID SsInternalPlayer::_acquire_mesh_rid(RenderingServer* rs) {
@@ -2759,6 +2765,9 @@ void SsInternalPlayer::_fetchAnimation() {
         runtime_res = nullptr;
     }
 
+    // Borrow (do not copy) the resource's buffer to keep loading zero-copy. The
+    // buffer must remain valid and unmodified until runtime_res is destroyed;
+    // every resource change re-creates this borrow via _fetchAnimation.
     runtime_res = ss_resource_create_borrow(_ssabRes->get_data_ptr(), _ssabRes->get_data_size());
     if (runtime_res == nullptr) {
         ERR_PRINT("SSAB Resource Create Failed");
diff --git a/ss_player/ss_internal_player.h b/ss_player/ss_internal_player.h
index b57770d..f936bb0 100644
--- a/ss_player/ss_internal_player.h
+++ b/ss_player/ss_internal_player.h
@@ -254,11 +254,6 @@ class SsInternalPlayer {
     // composite. Shaders themselves are always shareable (the per-part
     // distinction lives on the material, not the underlying shader code).
     HashMap<uint64_t, Ref<Shader>> _partcolor_shaders;
-    // Test-only override: when non-zero, parts that would normally dispatch
-    // through the Default catalog entry pass this id_hash instead. Used to
-    // exercise the dispatch path before the FFI exposes real SS Shader
-    // attribute data. Remove once the FFI wiring lands (task: dispatch FFI).
-    uint32_t _test_shader_id_hash_override = 0;
 
     // Per-part ShaderMaterial pool for variants whose catalog entry has
     // `is_per_part=true`. Godot binds material state per-material (not
@@ -312,6 +307,14 @@ class SsInternalPlayer {
     // instantiating Ref<ArrayMesh> resources. Allocated RIDs are freed in the destructor.
     Vector<RID> _mesh_pool;
     int _mesh_pool_in_use = 0;
+    // Reused scratch for _emit_partcolor_mesh so the per-part/per-frame draw
+    // path does not heap-allocate a fresh surface Array (plus the empty
+    // blend-shape / LOD arguments) on every call. The element slots are cleared
+    // after each surface build so they never pin the caller's scratch buffers
+    // via copy-on-write.
+    Array _surface_arrays;
+    Array _surface_empty_blend_shapes;
+    Dictionary _surface_empty_lods;
     // Per-batch canvas_item pool. Index == draw_batches[i] order. Recyclable
     // across frames; pool grows monotonically to peak batch count, unused
     // entries are hidden rather than freed.
@@ -401,7 +404,7 @@ class SsInternalPlayer {
 
         inline const float* get_world_matrix(int p_idx) const {
             constexpr int FLOATS_PER_MATRIX = 16;
-            if (world_matrices && (uintptr_t)p_idx * FLOATS_PER_MATRIX < world_matrices_len) {
+            if (world_matrices && (uintptr_t)p_idx * FLOATS_PER_MATRIX + FLOATS_PER_MATRIX <= world_matrices_len) {
                 return world_matrices + (p_idx * FLOATS_PER_MATRIX);
             }
             return nullptr;
@@ -742,9 +745,7 @@ class SsInternalPlayer {
     // Read the part's SS Shader attribute (if any) out of the current
     // frame's PartAttributeShader vector and pair it with the catalog entry.
     // When no attribute is present, `id_hash` defaults to "Default" and
-    // `is_per_part` resolves to false (the shared batch path). The
-    // `_test_shader_id_hash_override` field, when non-zero, replaces the
-    // resolved id_hash for debug routing.
+    // `is_per_part` resolves to false (the shared batch path).
     PartShaderInfo _resolve_part_shader_info(const DrawFrame& f, const ss::runtime::PartState* part);
     // Compute the part's cell-rectangle UV bounds for the ss_cell_rect
     // uniform. Returns (left_u, top_v, right_u, bottom_v). Inputs come from
diff --git a/ss_player/ss_macros.h b/ss_player/ss_macros.h
index 0004db1..0290edf 100644
--- a/ss_player/ss_macros.h
+++ b/ss_player/ss_macros.h
@@ -10,7 +10,7 @@
 #ifdef SPRITESTUDIO_GODOT_EXTENSION
   #include <godot_cpp/core/version.hpp>
   #include <godot_cpp/variant/string_name.hpp>
-  #define SNAME(x) godot::StringName(x)
+  #define SNAME(x) ([]() -> const godot::StringName & { static const godot::StringName *_ss_sname = new godot::StringName(x); return *_ss_sname; }())
   #define EMPTY(x) ((x).is_empty())
   #define VARIANT_FLOAT Variant::FLOAT
   #define NOTIFY_PROPERTY_LIST_CHANGED() notify_property_list_changed()
diff --git a/ss_player/ss_shader_setup.h b/ss_player/ss_shader_setup.h
index 7bd8be4..c38d161 100644
--- a/ss_player/ss_shader_setup.h
+++ b/ss_player/ss_shader_setup.h
@@ -43,8 +43,8 @@
 // `ss_output_color()` are I/O extension points: the former wraps the input
 // sampler call (so future variants can fold inverse-PMA or other input-side
 // conversions there), and the latter wraps the output stage (currently
-// optional premultiplied-alpha conversion; future linear/HDR conversions
-// will land here as well).
+// optional premultiplied-alpha conversion; linear/HDR conversions would
+// also go here).
 const char* SHADER_HEADER = "shader_type canvas_item;\n";
 
 const char* LIBRARY_VS =
@@ -63,14 +63,6 @@ const char* DEFAULT_FS =
 #include "shaders/default.fs"
 ;
 
-// Stub fragment shader for per-part material dispatch verification. Inverts
-// the red channel of the sampled texture so the dispatch path is visually
-// distinguishable from Default. Kept around as a known-good per-part path
-// regression check while more SS6-ported variants land.
-const char* TESTSTUB_FS =
-#include "shaders/teststub.fs"
-;
-
 // SS6 SDK port: "ss-sepia". Sepia / grayscale tone with a single signed
 // strength parameter (ss_param0). See shaders/ss_sepia.fs for the
 // migration mapping from the SS6 reference.
@@ -184,7 +176,6 @@ struct EmbeddedShader {
 
 static const EmbeddedShader EMBEDDED_SHADERS[] = {
     { "Default",  DEFAULT_FS,  false },
-    { "TestStub", TESTSTUB_FS, true  },
     { "ss-sepia",   SS_SEPIA_FS,   true  },
     { "ss-outline", SS_OUTLINE_FS, true  },
     { "ss-bmask",   SS_BMASK_FS,   true  },

From b775152ef34ca19ef96fab001704bfd4b1972601 Mon Sep 17 00:00:00 2001
From: Naruto TAKAHASHI <tnaruto@gmail.com>
Date: Sun, 19 Jul 2026 09:54:00 +0900
Subject: [PATCH 3/4] build(ci): bundle third-party licenses, least-privilege
 perms, pin actions

release.yml stages the runtime third-party license files into the artifact and bundles them plus THIRD_PARTY_NOTICES.md and licenses/Apache-2.0.txt into the release zip under addons/spritestudio/licenses/, so the statically linked FlatBuffers/godot-cpp/Rust-crate licenses travel with the binaries. Declares least-privilege permissions on release/pr/weekly and pins third-party actions to full commit SHAs. THIRD_PARTY_NOTICES.md adds godot-cpp (MIT) and references the bundled Apache-2.0 text.
---
 .github/actions/setup-extension/action.yml |   4 +-
 .github/workflows/pr.yml                   |   9 +-
 .github/workflows/release.yml              |  39 +++-
 .github/workflows/weekly.yml               |   9 +-
 THIRD_PARTY_NOTICES.md                     |  36 +++-
 licenses/Apache-2.0.txt                    | 202 +++++++++++++++++++++
 6 files changed, 285 insertions(+), 14 deletions(-)
 create mode 100644 licenses/Apache-2.0.txt

diff --git a/.github/actions/setup-extension/action.yml b/.github/actions/setup-extension/action.yml
index 5306459..7722843 100644
--- a/.github/actions/setup-extension/action.yml
+++ b/.github/actions/setup-extension/action.yml
@@ -22,13 +22,13 @@ runs:
 
     - name: Setup Android dependencies
       if: inputs.platform == 'android'
-      uses: nttld/setup-ndk@v1
+      uses: nttld/setup-ndk@ed92fe6cadad69be94a966a7ee3271275e62f779 # v1
       with:
         ndk-version: r23c
         link-to-sdk: true
 
     - name: Setup Web dependencies
       if: inputs.platform == 'web'
-      uses: mymindstorm/setup-emsdk@v14
+      uses: mymindstorm/setup-emsdk@6ab9eb1bda2574c4ddb79809fc9247783eaf9021 # v14
       with:
         no-cache: true
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 4b049e3..d5c0024 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -12,6 +12,9 @@ env:
   LC_ALL: en_US.UTF-8
   PYTHONIOENCODING: utf8
 
+permissions:
+  contents: read
+
 concurrency:
   group: ci-pr-${{ github.actor }}-${{ github.head_ref || github.run_number }}-${{ github.ref }}
   cancel-in-progress: true
@@ -36,7 +39,7 @@ jobs:
           submodules: recursive
 
       - name: clone Godot Cpp repository
-        uses: GuillaumeFalourd/clone-github-repo-action@v2.3
+        uses: GuillaumeFalourd/clone-github-repo-action@19817562c346ff60f9935158dede6c5ece8fd0ac # v2.3
         with:
           depth: 1
           branch: master
@@ -44,10 +47,10 @@ jobs:
           repository: 'godot-cpp'
 
       - name: Setup Rust (Stable)
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
 
       - name: Setup Rust Cache
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           workspaces: "ss_player/SpriteStudio-SDK"
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1c949f2..4fbfbc0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,6 +30,11 @@ env:
   KEYCHAIN_PATH: app-signing.keychain-db
   SCONS_CACHE: ~/.scons_cache
 
+# Least-privilege default token; the package job below elevates to
+# contents: write only to publish the GitHub Release.
+permissions:
+  contents: read
+
 concurrency:
   group: ci-scons-${{ github.actor }}-${{ github.head_ref || github.run_number }}-${{ github.ref }}
   cancel-in-progress: true
@@ -76,7 +81,7 @@ jobs:
         with:
           submodules: recursive
       - name: clone Godot Cpp repository
-        uses: GuillaumeFalourd/clone-github-repo-action@v2.3
+        uses: GuillaumeFalourd/clone-github-repo-action@19817562c346ff60f9935158dede6c5ece8fd0ac # v2.3
         with:
           depth: 1
           branch: master
@@ -206,8 +211,20 @@ jobs:
         run: |
           ./scripts/release-gdextension-web.sh api_version=${{ env.GODOT_VERSION }}
 
+      # Stage the runtime third-party license files (produced by the SDK
+      # download step) into the uploaded artifact so the packaging job can
+      # bundle them into the release zip, as required by the licenses of the
+      # statically-linked Rust crates. shell: bash so the Windows runner works.
+      - name: Stage third-party license files
+        shell: bash
+        run: |
+          mkdir -p bin/licenses
+          cp ss_player/runtime/THIRD-PARTY-LICENSES.ssruntime.md bin/licenses/
+          cp ss_player/runtime/THIRD-PARTY-LICENSES.ssconverter.md bin/licenses/
+          cp ss_player/runtime/LICENSE.md bin/licenses/runtime-LICENSE.md
+
       - id: commit
-        uses: pr-mpt/actions-commit-hash@v4
+        uses: pr-mpt/actions-commit-hash@9e673021a12f5b5506d4da77ffbb8446e8a37b4a # v4
 
       - name: Upload artifact
         uses: actions/upload-artifact@v7
@@ -219,6 +236,9 @@ jobs:
   package:
     needs: gdextension
     runs-on: ubuntu-latest
+    # Needs write access to publish the GitHub Release (softprops/action-gh-release).
+    permissions:
+      contents: write
 
     steps:
       - uses: actions/checkout@v7
@@ -230,7 +250,7 @@ jobs:
           path: artifacts
 
       - id: commit
-        uses: pr-mpt/actions-commit-hash@v4
+        uses: pr-mpt/actions-commit-hash@9e673021a12f5b5506d4da77ffbb8446e8a37b4a # v4
 
       - name: Zip all artifacts
         run: |
@@ -240,6 +260,17 @@ jobs:
           cp ../misc/spritestudio.gdextension addons/spritestudio/
           cp ../LICENSE.md addons/spritestudio/
 
+          # Bundle third-party license notices next to the statically-linked
+          # native binaries: FlatBuffers (Apache-2.0), godot-cpp (MIT), and the
+          # Rust runtime crates. The runtime crate licenses were staged into
+          # each platform artifact's licenses/ dir and are identical across
+          # platforms, so copy them from the linux artifact.
+          mkdir -p addons/spritestudio/licenses
+          cp ../LICENSE.md addons/spritestudio/licenses/
+          cp ../THIRD_PARTY_NOTICES.md addons/spritestudio/licenses/
+          cp ../licenses/Apache-2.0.txt addons/spritestudio/licenses/
+          cp extension-${{ env.GODOT_VERSION }}-linux-${{ steps.commit.outputs.short }}/licenses/* addons/spritestudio/licenses/
+
           mv extension-${{ env.GODOT_VERSION }}-android-${{ steps.commit.outputs.short }}/android addons/spritestudio/bin/
           mv extension-${{ env.GODOT_VERSION }}-ios-${{ steps.commit.outputs.short }}/ios addons/spritestudio/bin/
           mv extension-${{ env.GODOT_VERSION }}-macos-${{ steps.commit.outputs.short }}/macos addons/spritestudio/bin/
@@ -270,7 +301,7 @@ jobs:
       # upload_release=true を付けた明示的な dispatch のみ。v* タグ上に限る。
       - name: Create GitHub Release
         if: startsWith(github.ref, 'refs/tags/v') && inputs.upload_release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
         with:
           files: |
             output/ssplayer-godot-extension-${{ env.GODOT_VERSION }}.zip
diff --git a/.github/workflows/weekly.yml b/.github/workflows/weekly.yml
index d14b731..1e5ba0b 100644
--- a/.github/workflows/weekly.yml
+++ b/.github/workflows/weekly.yml
@@ -12,6 +12,9 @@ env:
   KEYCHAIN_PATH: app-signing.keychain-db
   SCONS_CACHE: ~/.scons_cache
 
+permissions:
+  contents: read
+
 jobs:
   gdextension:
     name: ${{ matrix.name }}
@@ -55,7 +58,7 @@ jobs:
           submodules: recursive
 
       - name: clone Godot Cpp repository
-        uses: GuillaumeFalourd/clone-github-repo-action@v2.3
+        uses: GuillaumeFalourd/clone-github-repo-action@19817562c346ff60f9935158dede6c5ece8fd0ac # v2.3
         with:
           depth: 1
           branch: master
@@ -69,10 +72,10 @@ jobs:
           os: ${{ matrix.os }}
 
       - name: Setup Rust (Stable)
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
 
       - name: Setup Rust Cache
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           workspaces: "ss_player/SpriteStudio-SDK"
           key: ${{ matrix.platform }}
diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
index a821b68..4d75528 100644
--- a/THIRD_PARTY_NOTICES.md
+++ b/THIRD_PARTY_NOTICES.md
@@ -24,6 +24,38 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 
+The complete Apache License 2.0 text is included in `licenses/Apache-2.0.txt`,
+and is bundled with binary releases under `addons/spritestudio/licenses/`.
+
+---
+
+## godot-cpp
+
+The C++ bindings are built on godot-cpp, which is statically linked into the
+compiled plugin binaries.
+
+MIT License
+
+Copyright (c) 2017-present Godot Engine contributors.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
 ---
 
 ## SpriteStudio-SDK
@@ -40,7 +72,7 @@ Copyright (c) CRI Middleware Co., Ltd. All rights reserved.
 
 **License Location:**
 Because the runtime binaries are generated artifacts and not checked into this repository, the corresponding license documents for the Rust dependencies are generated or downloaded during the build/setup process.
-You can find these third-party licenses inside the `ss_player/runtime/` directory (specifically, `THIRD-PARTY-LICENSES.ssruntime.md` and `LICENSE.md`) after running the setup scripts.
+You can find these third-party licenses inside the `ss_player/runtime/` directory (specifically, `THIRD-PARTY-LICENSES.ssruntime.md`, `THIRD-PARTY-LICENSES.ssconverter.md`, and `LICENSE.md`) after running the setup scripts.
 
 **Distribution Note:**
-If you distribute compiled Godot binaries or GDExtension packages that include `libssruntime`, please ensure you also bundle and distribute the license files (`THIRD-PARTY-LICENSES.ssruntime.md` and `LICENSE.md`) located in `ss_player/runtime/` to comply with the open-source licenses of the underlying Rust crates.
+Official release packages already bundle these third-party license files under `addons/spritestudio/licenses/` (`THIRD-PARTY-LICENSES.ssruntime.md`, `THIRD-PARTY-LICENSES.ssconverter.md`, and the runtime `LICENSE.md`). If you redistribute compiled Godot binaries or GDExtension packages that include `libssruntime`, keep those files alongside your distribution to comply with the open-source licenses of the underlying Rust crates.
diff --git a/licenses/Apache-2.0.txt b/licenses/Apache-2.0.txt
new file mode 100644
index 0000000..d645695
--- /dev/null
+++ b/licenses/Apache-2.0.txt
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

From f0c0869aae419d57afcb959ff1ff582f9ff04ca5 Mon Sep 17 00:00:00 2001
From: Naruto TAKAHASHI <tnaruto@gmail.com>
Date: Sun, 19 Jul 2026 09:54:00 +0900
Subject: [PATCH 4/4] docs: English-ize shipped comments, fix links/prereqs,
 document pause

English-izes non-English comments in shipped scripts/code and rewords development-narrative comments. CONTRIBUTING adds Rust/zsh/godot-cpp prerequisites and a build.md pointer and fixes the Japanese ToC anchors. CHANGELOG uses 'Unreleased' instead of a placeholder date. docs index sample links are made absolute so they resolve on the docs site. The SpriteStudioPlayer2D doc class documents that pause() toggles and is_playing() stays true while paused. Repo self-links kept on cri-middleware.
---
 CHANGELOG.md                                   |  2 +-
 CONTRIBUTING.md                                | 18 ++++++++++++++----
 README.ja.md                                   |  4 ++--
 README.md                                      |  4 ++--
 docs/en/index.md                               | 14 +++++++-------
 docs/en/setup/build.md                         |  2 +-
 docs/en/setup/install.md                       |  2 +-
 docs/ja/index.md                               | 14 +++++++-------
 docs/ja/setup/build.md                         |  2 +-
 docs/ja/setup/install.md                       |  2 +-
 examples/Override_Ringo/override_demo.gd       |  2 +-
 scripts/build-runtime.sh                       |  4 ++--
 scripts/install-template.ps1                   |  4 ++--
 scripts/install-template.sh                    |  4 ++--
 ss_player/doc_classes/SpriteStudioPlayer2D.xml |  4 ++--
 ss_player/ss_progress_dialog.cpp               |  2 +-
 16 files changed, 47 insertions(+), 37 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e2e02bc..8817542 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,7 +5,7 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [7.0.0-beta.1] - 2026-0X-XX
+## [7.0.0-beta.1] - Unreleased
 
 ### Added
 - **Initial Public Release**: SpriteStudio 7 SDK (`ssconverter-cli` + `Godot Plugin`).
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 7bc2efd..d9a7637 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -41,6 +41,11 @@ If you find a bug, please use the provided Issue Templates. Include:
 - Godot Engine 4.x
 - A C++ compiler (GCC, Clang, or MSVC)
 - Python 3 and SCons
+- A Rust toolchain (required to build the `libssruntime` runtime)
+- zsh (the build scripts use a `#!/usr/bin/env zsh` shebang)
+- The `godot-cpp` submodule, cloned via `git submodule update --init --recursive`
+
+For the complete build guide, see [docs/en/setup/build.md](./docs/en/setup/build.md).
 
 ### Build the Plugin
 To compile the Godot Extension, you must first build the Rust runtime from the SDK, and then compile the C++ extension using the provided build scripts:
@@ -85,10 +90,10 @@ By contributing to this project, you agree that your contributions will be licen
 SSPlayerForGodot にご関心をお寄せいただき、ありがとうございます！ バグ報告、機能提案、ドキュメントの改善、コードの提供など、あらゆる形での貢献を歓迎します。
 
 ## 目次
-- [行動規範](#行動規範-1)
-- [貢献する方法](#貢献する方法-1)
-- [開発環境のセットアップ](#開発環境のセットアップ-1)
-- [コーディング規約](#コーディング規約-1)
+- [行動規範](#行動規範)
+- [貢献する方法](#貢献する方法)
+- [開発環境のセットアップ](#開発環境のセットアップ)
+- [コーディング規約](#コーディング規約)
 
 ## 行動規範
 [CODE_OF_CONDUCT.md](./CODE_OF_CONDUCT.md) を参照してください。
@@ -123,6 +128,11 @@ Godot Engineとのネイティブな統合と高いパフォーマンスを維
 - Godot Engine 4.x
 - C++ コンパイラ (GCC, Clang, MSVC のいずれか)
 - Python 3 および SCons
+- Rust ツールチェイン (`libssruntime` ランタイムのビルドに必要です)
+- zsh (ビルドスクリプトは `#!/usr/bin/env zsh` を使用しています)
+- `godot-cpp` サブモジュール (`git submodule update --init --recursive` で取得してください)
+
+完全なビルド手順については、[docs/ja/setup/build.md](./docs/ja/setup/build.md) を参照してください。
 
 ### ビルド方法
 提供されているスクリプトを使用して、まずSDKからRustランタイムをビルドし、次にGDExtensionをコンパイルします。
diff --git a/README.ja.md b/README.ja.md
index 317a934..9c0d8ee 100644
--- a/README.ja.md
+++ b/README.ja.md
@@ -4,7 +4,7 @@
 
 **Godot のゲームに、プロフェッショナルな2Dアニメーションを。直感的な使いやすさと、極限のパフォーマンスを両立するプラグイン。**
 
-> **注意:** 本 `develop` ブランチは現在開発中のバージョンです。安定版は [main ブランチ](https://github.com/SpriteStudio/SSPlayerForGodot/tree/main) または [Releases](https://github.com/SpriteStudio/SSPlayerForGodot/releases) から取得してください。本ブランチで扱う API・ワークフローは予告なく変更される可能性があり、いかなる保証もサポートも提供しません（リクエストやバグ報告への返信もできません）。
+> **注意:** 本 `develop` ブランチは現在開発中のバージョンです。安定版は [main ブランチ](https://github.com/cri-middleware/SSPlayerForGodot/tree/main) または [Releases](https://github.com/cri-middleware/SSPlayerForGodot/releases) から取得してください。本ブランチで扱う API・ワークフローは予告なく変更される可能性があり、いかなる保証もサポートも提供しません（リクエストやバグ報告への返信もできません）。
 
 **[OPTPiX SpriteStudio 7](https://www.webtech.co.jp/spritestudio/)** のアニメーション (`.ssab`) を [Godot Engine](https://godotengine.org/) 上で再生するためのハイパフォーマンスな拡張プラグイン（GDExtension / カスタムモジュール）です。Godot の強力な機能と、専用アニメーションツールの表現力を組み合わせることで、リッチな2Dゲーム開発をサポートします。
 
@@ -45,7 +45,7 @@
 ### 1. サンプルで動作確認する
 
 1. **Godot Engine の準備**: [公式サイト](https://godotengine.org/download/) から 4.6 系のエディタをダウンロードします。
-2. **GDExtension の取得**: [Releases](https://github.com/SpriteStudio/SSPlayerForGodot/releases) から最新パッケージをダウンロードし、展開します。
+2. **GDExtension の取得**: [Releases](https://github.com/cri-middleware/SSPlayerForGodot/releases) から最新パッケージをダウンロードし、展開します。
 3. **サンプルの準備**: 取得した `addons` フォルダを、本リポジトリの [examples/Ringo](./examples/Ringo) フォルダ内にコピーします。
 4. **確認**: Godot Engine で [examples/Ringo](./examples/Ringo) プロジェクトを開き、`Ringo.tscn` を開くことですぐにアニメーションの動作を確認できます。
 
diff --git a/README.md b/README.md
index 1f1d794..50a30b4 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@
 
 **Professional 2D animations for your Godot games. A plugin that balances intuitive usability with extreme performance.**
 
-> **Note:** This `develop` branch is a work-in-progress version. The stable version can be obtained from the [main branch](https://github.com/SpriteStudio/SSPlayerForGodot/tree/main) or from [Releases](https://github.com/SpriteStudio/SSPlayerForGodot/releases). The APIs and workflows in this branch may change without notice, and no warranty or support is provided (we cannot respond to feature requests or bug reports).
+> **Note:** This `develop` branch is a work-in-progress version. The stable version can be obtained from the [main branch](https://github.com/cri-middleware/SSPlayerForGodot/tree/main) or from [Releases](https://github.com/cri-middleware/SSPlayerForGodot/releases). The APIs and workflows in this branch may change without notice, and no warranty or support is provided (we cannot respond to feature requests or bug reports).
 
 A high-performance extension plugin (GDExtension / Custom Module) for playing animations (`.ssab`) created with **[OPTPiX SpriteStudio 7](https://www.webtech.co.jp/spritestudio/)** on [Godot Engine](https://godotengine.org/). By combining Godot's powerful features with the expressive capabilities of a dedicated animation tool, it fully supports the development of rich 2D games.
 
@@ -45,7 +45,7 @@ We provide two Quick Starts: one for quickly checking the operation using a samp
 ### 1. Check Operation with Sample
 
 1. **Get Godot Engine**: Download a 4.6-series editor from the [official site](https://godotengine.org/download/).
-2. **Download GDExtension**: Get the latest package from [Releases](https://github.com/SpriteStudio/SSPlayerForGodot/releases) and extract it.
+2. **Download GDExtension**: Get the latest package from [Releases](https://github.com/cri-middleware/SSPlayerForGodot/releases) and extract it.
 3. **Prepare Sample**: Copy the extracted `addons` folder into the [examples/Ringo](./examples/Ringo) folder of this repository.
 4. **Check**: Open the [examples/Ringo](./examples/Ringo) project in Godot Engine and open `Ringo.tscn` to immediately see the animation working.
 
diff --git a/docs/en/index.md b/docs/en/index.md
index 8917f26..1543a47 100644
--- a/docs/en/index.md
+++ b/docs/en/index.md
@@ -1,7 +1,7 @@
 # SpriteStudioPlayer for Godot
 
 This `develop` branch is a work-in-progress version.  
-The stable version can be obtained from the [main branch](https://github.com/SpriteStudio/SSPlayerForGodot/tree/main) or from [Releases](https://github.com/SpriteStudio/SSPlayerForGodot/releases).  
+The stable version can be obtained from the [main branch](https://github.com/cri-middleware/SSPlayerForGodot/tree/main) or from [Releases](https://github.com/cri-middleware/SSPlayerForGodot/releases).  
 No warranty or support is provided for this branch, and we cannot respond to feature requests or bug reports.  
 Interfaces may change without notice.  
 
@@ -85,12 +85,12 @@ Build and execution have been verified on Windows / macOS.
 
 Sample projects based on SDK test projects are available under the `examples/` folder in the repository.
 
-- [Ringo](../../examples/Ringo) — Test for Ringo
-- [allAttributeV7](../../examples/allAttributeV7) — Functional test for all attributes
-- [allPartsV7](../../examples/allPartsV7) — Functional test for all part types
-- [overall](../../examples/overall) — Comprehensive functional test
-- [overall_gdextension](../../examples/overall_gdextension) — Comprehensive test for GDExtension
-- [ParticleEffect](../../examples/ParticleEffect) — Test for effect features
+- [Ringo](https://github.com/cri-middleware/SSPlayerForGodot/tree/main/examples/Ringo) — Test for Ringo
+- [allAttributeV7](https://github.com/cri-middleware/SSPlayerForGodot/tree/main/examples/allAttributeV7) — Functional test for all attributes
+- [allPartsV7](https://github.com/cri-middleware/SSPlayerForGodot/tree/main/examples/allPartsV7) — Functional test for all part types
+- [overall](https://github.com/cri-middleware/SSPlayerForGodot/tree/main/examples/overall) — Comprehensive functional test
+- [overall_gdextension](https://github.com/cri-middleware/SSPlayerForGodot/tree/main/examples/overall_gdextension) — Comprehensive test for GDExtension
+- [ParticleEffect](https://github.com/cri-middleware/SSPlayerForGodot/tree/main/examples/ParticleEffect) — Test for effect features
 
 ## Related Repositories
 
diff --git a/docs/en/setup/build.md b/docs/en/setup/build.md
index de31b4a..097c812 100644
--- a/docs/en/setup/build.md
+++ b/docs/en/setup/build.md
@@ -14,7 +14,7 @@ The flow for producing Godot binaries from this repository is as follows:
 Clone this repository, and clone Godot Engine / godot-cpp depending on your build target.
 
 ```bash
-git clone https://github.com/SpriteStudio/SSPlayerForGodot.git
+git clone https://github.com/cri-middleware/SSPlayerForGodot.git
 cd SSPlayerForGodot
 git clone https://github.com/godotengine/godot.git -b 4.6
 git clone https://github.com/godotengine/godot-cpp.git -b master
diff --git a/docs/en/setup/install.md b/docs/en/setup/install.md
index 7ad9315..64e6dac 100644
--- a/docs/en/setup/install.md
+++ b/docs/en/setup/install.md
@@ -7,7 +7,7 @@ Steps for getting started with SpriteStudioPlayer for Godot.
 The shortest path to using the plugin without any build work.
 
 1. Download a 4.6-series Godot Engine from the [official site](https://godotengine.org/download/).
-2. Download the GDExtension bundle for your platform from the [SSPlayerForGodot Releases](https://github.com/SpriteStudio/SSPlayerForGodot/releases).
+2. Download the GDExtension bundle for your platform from the [SSPlayerForGodot Releases](https://github.com/cri-middleware/SSPlayerForGodot/releases).
 3. Extract the ZIP and copy the `addons` folder it contains into your Godot project root directory.
    * If placed correctly, `res://addons/spritestudio/spritestudio.gdextension` should exist.
 4. Restart the Godot editor and the `SpriteStudioPlayer2D` node and the SS Import Dock will become available.
diff --git a/docs/ja/index.md b/docs/ja/index.md
index 81e75b9..5ca77f5 100644
--- a/docs/ja/index.md
+++ b/docs/ja/index.md
@@ -1,7 +1,7 @@
 # SpriteStudioPlayer for Godot
 
 本developブランチは現在開発中のバージョンです。  
-安定版は [mainブランチ](https://github.com/SpriteStudio/SSPlayerForGodot/tree/main) または、[Releases](https://github.com/SpriteStudio/SSPlayerForGodot/releases)から取得してください。  
+安定版は [mainブランチ](https://github.com/cri-middleware/SSPlayerForGodot/tree/main) または、[Releases](https://github.com/cri-middleware/SSPlayerForGodot/releases)から取得してください。  
 本developブランチに関してはいかなる保証もサポートも提供しません。リクエストやバグ報告への返信もできません。  
 インターフェースは予告なく変更される可能性があります。
 
@@ -85,12 +85,12 @@ Windows / macOS でのビルドおよび実行を確認しています。
 
 リポジトリの `examples/` フォルダに SDK のテストプロジェクトに基づいたサンプルプロジェクトがあります。
 
-- [Ringo](../../examples/Ringo) — 「りんご」のテスト
-- [allAttributeV7](../../examples/allAttributeV7) — 全属性の機能テスト
-- [allPartsV7](../../examples/allPartsV7) — 全パーツ種の機能テスト
-- [overall](../../examples/overall) — 総合的な機能テスト
-- [overall_gdextension](../../examples/overall_gdextension) — GDExtension 版での総合テスト
-- [ParticleEffect](../../examples/ParticleEffect) — エフェクト機能のテスト
+- [Ringo](https://github.com/cri-middleware/SSPlayerForGodot/tree/main/examples/Ringo) — 「りんご」のテスト
+- [allAttributeV7](https://github.com/cri-middleware/SSPlayerForGodot/tree/main/examples/allAttributeV7) — 全属性の機能テスト
+- [allPartsV7](https://github.com/cri-middleware/SSPlayerForGodot/tree/main/examples/allPartsV7) — 全パーツ種の機能テスト
+- [overall](https://github.com/cri-middleware/SSPlayerForGodot/tree/main/examples/overall) — 総合的な機能テスト
+- [overall_gdextension](https://github.com/cri-middleware/SSPlayerForGodot/tree/main/examples/overall_gdextension) — GDExtension 版での総合テスト
+- [ParticleEffect](https://github.com/cri-middleware/SSPlayerForGodot/tree/main/examples/ParticleEffect) — エフェクト機能のテスト
 
 ## 関連リポジトリ
 
diff --git a/docs/ja/setup/build.md b/docs/ja/setup/build.md
index 952e45b..3268263 100644
--- a/docs/ja/setup/build.md
+++ b/docs/ja/setup/build.md
@@ -14,7 +14,7 @@ GDExtension またはカスタムモジュール組み込み Godot Engine を自
 本リポジトリを取得し、ビルド対象に応じて Godot Engine / godot-cpp を取得します。
 
 ```bash
-git clone https://github.com/SpriteStudio/SSPlayerForGodot.git
+git clone https://github.com/cri-middleware/SSPlayerForGodot.git
 cd SSPlayerForGodot
 git clone https://github.com/godotengine/godot.git -b 4.6
 git clone https://github.com/godotengine/godot-cpp.git -b master
diff --git a/docs/ja/setup/install.md b/docs/ja/setup/install.md
index 1a9babe..1990db7 100644
--- a/docs/ja/setup/install.md
+++ b/docs/ja/setup/install.md
@@ -7,7 +7,7 @@ SpriteStudioPlayer for Godot を使い始めるための手順です。
 ビルド作業なしでプラグインを利用できる最短の手順です。
 
 1. [公式サイト](https://godotengine.org/download/) より 4.6 系の Godot Engine をダウンロードします。
-2. [SSPlayerForGodot の Releases](https://github.com/SpriteStudio/SSPlayerForGodot/releases) から該当プラットフォーム向けの GDExtension 一式をダウンロードします。
+2. [SSPlayerForGodot の Releases](https://github.com/cri-middleware/SSPlayerForGodot/releases) から該当プラットフォーム向けの GDExtension 一式をダウンロードします。
 3. ダウンロードした ZIP を解凍し、中にある `addons` フォルダをそのまま Godot プロジェクトのルートディレクトリにコピーします。
    * 正しく配置されると、`res://addons/spritestudio/spritestudio.gdextension` が存在する状態になります。
 4. Godot エディタを再起動すると `SpriteStudioPlayer2D` ノードや SS Import Dock が利用可能になります。
diff --git a/examples/Override_Ringo/override_demo.gd b/examples/Override_Ringo/override_demo.gd
index 2b84c79..b3abbee 100644
--- a/examples/Override_Ringo/override_demo.gd
+++ b/examples/Override_Ringo/override_demo.gd
@@ -1,5 +1,5 @@
 extends SpriteStudioPlayer2D
-## Override Layer API (Phase 2) demo — runs on the Ringo sample.
+## Override Layer API demo — runs on the Ringo sample.
 ##
 ## Open this project and press Play. The Ringo animation keeps playing while the
 ## demo cycles through the three per-part runtime overrides and shows the current
diff --git a/scripts/build-runtime.sh b/scripts/build-runtime.sh
index 67780da..dc6dd3d 100755
--- a/scripts/build-runtime.sh
+++ b/scripts/build-runtime.sh
@@ -82,14 +82,14 @@ if [[ "$IS_HOST_BUILD" == "true" ]]; then
     fi
     SRC_DIR="target/$BUILD_MODE"
 else
-    # クロスコンパイルまたは特殊なビルド
+    # Cross-compilation or special-case per-platform builds.
     case "$PLATFORM" in
         macos)
             ./scripts/release-macos.sh $BUILD_MODE
             SRC_DIR="target/universal-apple-darwin/$BUILD_MODE"
             ;;
         ios)
-            # The SDK now emits a single XCFramework (device + simulator slices).
+            # The SDK emits a single XCFramework (device + simulator slices).
             # Godot links one variant at a time into its per-variant libSSGodot
             # framework, so pick the matching static slice: device (arm64) or the
             # universal simulator slice (arm64 + x86_64, already lipo'd by the SDK).
diff --git a/scripts/install-template.ps1 b/scripts/install-template.ps1
index b266147..fc2017e 100644
--- a/scripts/install-template.ps1
+++ b/scripts/install-template.ps1
@@ -11,10 +11,10 @@ $RootDir = Resolve-Path "$BaseDir\.." | Select-Object -ExpandProperty Path
 
 Push-Location $RootDir
 
-# 1. 実行OSの判定とベースディレクトリの設定 (Windows)
+# 1. Set the base export-templates directory (Windows / %APPDATA%).
 $TemplatesBase = "$env:APPDATA\Godot\export_templates"
 
-# 2. Godotのバージョン情報を version.py から取得してディレクトリ名を生成
+# 2. Read the Godot version from version.py to build the templates directory name.
 $VersionPy = Get-Content "godot\version.py"
 $GodotMajor = ($VersionPy | Select-String '^major').Line.Split('=')[1].Trim(" `'""")
 $GodotMinor = ($VersionPy | Select-String '^minor').Line.Split('=')[1].Trim(" `'""")
diff --git a/scripts/install-template.sh b/scripts/install-template.sh
index 344643f..c5a6cea 100755
--- a/scripts/install-template.sh
+++ b/scripts/install-template.sh
@@ -16,14 +16,14 @@ ROOTDIR=$(cd "$ROOTDIR" && pwd -P)
 
 pushd "$ROOTDIR" > /dev/null
 
-# 1. 実行OSの判定とベースディレクトリの設定
+# 1. Detect the host OS and choose the base export-templates directory.
 if [ "$(uname)" = "Darwin" ]; then
     TEMPLATES_BASE="$HOME/Library/Application Support/Godot/export_templates"
 else
     TEMPLATES_BASE="$HOME/.local/share/godot/export_templates"
 fi
 
-# 2. Godotのバージョン情報を version.py から取得してディレクトリ名を生成
+# 2. Read the Godot version from version.py to build the templates directory name.
 GODOT_MAJOR=$(grep '^major' godot/version.py | cut -d '=' -f 2 | tr -d ' ')
 GODOT_MINOR=$(grep '^minor' godot/version.py | cut -d '=' -f 2 | tr -d ' ')
 GODOT_PATCH=$(grep '^patch' godot/version.py | cut -d '=' -f 2 | tr -d ' ')
diff --git a/ss_player/doc_classes/SpriteStudioPlayer2D.xml b/ss_player/doc_classes/SpriteStudioPlayer2D.xml
index 131253a..c8b1931 100644
--- a/ss_player/doc_classes/SpriteStudioPlayer2D.xml
+++ b/ss_player/doc_classes/SpriteStudioPlayer2D.xml
@@ -21,7 +21,7 @@
 		<method name="pause">
 			<return type="void" />
 			<description>
-				Pauses playback, keeping the current frame.
+				Toggles the paused state, keeping the current frame: calling [method pause] again while paused resumes playback. A paused animation is still considered playing ([method is_playing] returns [code]true[/code]); use [method is_pausing] to detect the paused state.
 			</description>
 		</method>
 		<method name="stop">
@@ -33,7 +33,7 @@
 		<method name="is_playing" qualifiers="const">
 			<return type="bool" />
 			<description>
-				Returns [code]true[/code] while the animation is playing.
+				Returns [code]true[/code] while the animation is playing, [b]including while it is paused[/b]. Use [method is_pausing] to distinguish a paused animation.
 			</description>
 		</method>
 		<method name="is_pausing" qualifiers="const">
diff --git a/ss_player/ss_progress_dialog.cpp b/ss_player/ss_progress_dialog.cpp
index f5c96e1..c7b9d6b 100644
--- a/ss_player/ss_progress_dialog.cpp
+++ b/ss_player/ss_progress_dialog.cpp
@@ -95,7 +95,7 @@ void SSProgressDialog::step(const String &message, int step_value) {
 void SSProgressDialog::_on_cancel_pressed() {
     canceled = true;
     status_label->set_text("Canceling...");
-    cancel_button->set_disabled(true); // 二重押し防止
+    cancel_button->set_disabled(true); // Prevent a second cancel press while canceling.
 }
 
 bool SSProgressDialog::is_canceled() const {