Verify audit PR #35 on real hardware/hosts #44

Acceptance for PR #35, head cf37734368c3de9a6d576a7222f26aa345adc107. The original audit ran in a Linux sandbox; the results below distinguish current native evidence from remaining acceptance.

• Windows architecture gate: 109 commands / 658 Python tests enumerated, with 8 skips listed below; JavaScript contracts, format/lint/type checks pass.
• Node v24.11.1 on the current local gate and browser harness. This is separate from CI.
• Real isolated ComfyUI CPU host on the current commit tree: 19 checks, covering image/video collection, restarts, backup/import, cuts and export.
• Real Chrome against embedded ComfyUI's origin: 187 checks at 73d084e: 128 studio + 28 linked workflow + 31 dedicated security/media/export assertions.
• Portable embedded-Python run_spool.bat --help: verifies module resolution, not a full server/browser launch.
• Windows drive-root containment and UNC project create/save/reopen/upgrade; previously skipped UNC and Windows streaming checks run in the gate.
• Native crafted clip/take/media fields and transition-track injection cases: 14 assertions inside ComfyUI's origin. The newly found transition-track sink is corrected; this does not claim exhaustive coverage of every HTML context.
• Native encoded-filename/media-address acceptance: real #, literal %41 and 100% PNG/MP4 files decode and seek; generated/original range routes return 206 and literal percent text is not decoded twice (10 assertions).
• OTIO blob URL lifecycle: 7 native assertions cover replacement, revocation and current exported JSON; the latest clean-checkout run also covers actual downloads and failures below.
• Real Deadline acceptance for F-02/F-03/F-07/F-13. External command doubles are not a farm run.
• Real Comfy Cloud acceptance for F-19; paid checks remain opt-in.
• Full portable batch-server/browser startup, downloaded launcher, macOS and Desktop acceptance (also Finish Mac Desktop and downloaded-launcher acceptance #17).
• Bare UNC share-root media containment.
• F-05/F-18 before/after screenshots retained locally. Earlier unsafe-source comparisons use isolated browser source interception; the transition-track before run exercised the actual unfixed source.
• F-12: 33 native assertions verify pending-save flush/revision ordering, failed-save draft and file preservation, and successful retry without false conflict. Real PNG/JSON bytes are checked at each stage; delay/network failure are labeled test injections.
• F-23: 80 native assertions include three actual Chrome link-click downloads, completion events, parsed OTIO trims/paths equal to host files, real host rejection of an injected empty plan, and injected network failures. Failed retries retain one bounded prior blob until successful replacement revokes it.
• Original unsafe-source before/fixed screenshot comparisons for F-12/F-23. Current before/after action, refusal and retry screenshots are retained locally.
• Remaining 8 skips: 5 adjacent Deadline-plugin checks, 2 POSIX checks and 1 Windows symlink-privilege check.
• CI on this head. Earlier CI on ad02e58 is not substituted for it.

The current commit tree reruns and passes 151 Chrome assertions (33 deletion + 80 download/failure + 7 lifecycle + 31 take cleanup); the seven lifecycle assertions overlap the earlier 187-check run. This latest replay includes three actual completed OTIO downloads after the publication retry correction; private comparison frames have seven additional real-FFmpeg/Pillow tests, separate from browser counts. Scope: isolated Windows ComfyUI CPU, Chrome, one video clip at 24 fps. Expected export plans reuse the production timeline planner, so this is not independent validation of all timeline planning. An independent source/evidence review approves. The e70d2fd change adds structural request guards and save-error wording; 12 isolated HTTP tests, 109 Node demo checks and its native F-12 replay (33 assertions) pass. The latest source tree also corrects OTIO publication retry/owned cleanup and comparison intermediates. Unicode FFmpeg diagnostics and read-only cancellation preflight remain covered; 11 new focused tests, native cp1252 HTTP/embedded reproductions and independent reviews pass. It also passes 19 real ComfyUI CPU checks. Many-cut imports remain covered by the full gate. Earlier 151, 187 browser and 19 CPU results retain their recorded commits.

The demo API separately passes 109 Node checks with simulated replies. No paid service was exercised. Audit source: PR #35 report.