[joepetjr]

What

materialize_mask_video now catches the BrokenPipeError from the frame writes, waits for ffmpeg, and raises mask ffmpeg failed (rc=N) after K of N frames: <ffmpeg stderr>. The frame-count check still runs whenever ffmpeg exits 0, so it still fails closed.

Why

The Ace Basin day render (sc-2026-02-21, 352,934 frames at 4K) failed on 2026-10-25 at 18:54 ET with cabin leak repair failed, keeping the original mask: [Errno 32] Broken pipe. The cabin repair rebuilds the whole mask through this function. When ffmpeg exits, the next stdin write raises before proc.wait() and the stderr read, so we lost ffmpeg's reason and how far the stream got. Started by hand on the same timeline, the same ffmpeg command wrote 600 frames cleanly, so the cause is still unknown. A recurrence will now name it.

Tests

• New test_ffmpeg_dying_mid_write_reports_its_own_error in tests/test_mask.py. Its output path is a directory, so ffmpeg exits at once, and 512x512 frames overflow the pipe buffer on the first write. It failed with the same BrokenPipeError: [Errno 32] Broken pipe before the fix and passes after.
• Full suite: 276 passed. ruff check is clean. ruff format --check still flags one existing ffprobe call in tests/test_mask.py that this change doesn't touch; CI runs ruff check only.