Audit follow-ups (2026-11-04): low-severity findings and improvements #45

Audit follow-ups; reproduced corrections and remaining limits are recorded below:

• U-01: queued, validation and staging time no longer consume Deadline submission grace. Seven production-path tests pass with fake clocks/command doubles (PR Full audit fixes (2026-11-04) #35); real farm acceptance remains open.
• U-02, partly corrected in PR Full audit fixes (2026-11-04) #35: long dry-run SQLite scans now use private copies; native Windows concurrent-writer tests pass. A legacy folder without an existing project lock can still obstruct replacement during the source-copy window. This residual case remains open.
• U-04: a fixed 180 s ffmpeg timeout surfaces as a 500 for long exports. The exception type is certain; whether real exports exceed 180 s was not measured (spool/export.py:13).

Additional audit follow-ups:

• Missing required top-level request fields and the import revision header return 400 invalid_request before preparation; demo save/use/delete replies match (PR Full audit fixes (2026-11-04) #35). Nested payload validation remains separate.
• Cloud lifecycle observation batches drain before reporting failures; cancellation and ownership cleanup are covered (spool/cloud.py, PR Full audit fixes (2026-11-04) #35).
• POST /reconcile and background collection share per-project serialization with local observation and Cloud ingestion. Nine deterministic tests and independent review pass (PR Full audit fixes (2026-11-04) #35). This is shared-collector/process scope; cross-process collection remains separate.
• Expected Deadline recovery lookup failures return safe, retryable 503 unavailable; ownership and multiple-match errors retain 400/409, with no resubmission (PR Full audit fixes (2026-11-04) #35).
• key_status reports the effective saved/environment credential, including empty/whitespace files (spool/credentials.py, PR Full audit fixes (2026-11-04) #35).
• stage_input removes its own .partial after copy/replacement failure (PR Full audit fixes (2026-11-04) #35).
• Local, Deadline and Cloud collection use operation-owned temporary files and preserve original errors during cleanup (PR Full audit fixes (2026-11-04) #35). Receipt/ledger idempotence is separate.
• A failed export mux removes its own partial MP4 (spool/export.py, PR Full audit fixes (2026-11-04) #35).
• Comparison-only frame intermediates use exclusive private temporary directories and are cleaned on success/failure. Saved comparison sheets and explicitly exported frames remain durable user exports; automatic expiry of returned exports is not part of this fix (PR Full audit fixes (2026-11-04) #35).
• OTIO publication uses the existing Windows sharing retry, exclusively owns its pending file and preserves primary errors during cleanup. Nine tests include actual Windows sharing-denial/rename retry and embedded Python 3.12 acceptance (PR Full audit fixes (2026-11-04) #35).
• Atomic renames never fsync the directory.
• Audio preparation, sequence export and cut scoring decode FFmpeg diagnostics as UTF-8 with invalid-byte replacement, retaining Unicode filenames on Windows. Five real-process tests and native cp1252 HTTP/embedded checks pass (PR Full audit fixes (2026-11-04) #35).
• Many-cut imports use bounded explicit batches and balanced keyframe expressions, preserving short GOPs and exact fractional frame boundaries. Eleven real/structural tests plus independent re-review pass; full imports with all posters at 1,800/20,000 cuts remain unrun (PR Full audit fixes (2026-11-04) #35).
• The existing FFmpeg/ffprobe 5.1 minimum is documented in README, development and standalone setup. Runtime qualification used 9.0.2 (PR Full audit fixes (2026-11-04) #35).
• Invalid, zero-denominator and nonfinite probed rates raise validation errors without inventing a fallback FPS (spool/media.py, PR Full audit fixes (2026-11-04) #35).
• Launcher storage, globbing and process creation run in cancellation-draining workers. Conditional launch-state replacement protects newer startup reservations (PR Full audit fixes (2026-11-04) #35); focused tests and independent review pass. Real process startup remains a separate acceptance item.
• ProjectStore.reading() holds the per-project read lock for the whole read (spool/store.py).
• blobs is never garbage-collected (spool/store.py).
• Cancellation preflight uses reading() instead of opening a writer connection. Six tests and independent review confirm unchanged working checkpoints and no warm-read writer-lock wait; transactional cancellation checks retain their supplied connections. Published snapshots were already unchanged before this correction (PR Full audit fixes (2026-11-04) #35).
• Maintenance reports schema backups from .spool/backups for project folders; legacy stores retain root-backup reporting. Real dry-run CLI verification preserves project bytes (PR Full audit fixes (2026-11-04) #35).
• reclaim can report a negative reclaimed value (spool/store.py).
• import_project creates 0700 folders with generic names (spool/projects.py).
• Failed imports remove only their owned destination and confirmed-new local cache, preserving pre-existing, redirected or uninspectable caches and the original failure (PR Full audit fixes (2026-11-04) #35). Denied cleanup may leave an orphan intentionally.
• Studio: turn the reviewer's general concatenation scan into a gate check; the escaping check covers only ID, number and track fields (tests/html_escape_checks.mjs).
• The studio has three copies of esc.
• The shared save error now says "before continuing", including permanent deletion. The current clean-tree F-12 native replay passes 33 assertions (PR Full audit fixes (2026-11-04) #35).
• Local demo serving rejects unsatisfiable byte ranges with 416 and complete range headers (pages/serve.py, PR Full audit fixes (2026-11-04) #35).

Source: PR #35, report section "Unconfirmed / Improvements not done" (report). Line numbers refer to main at 7caf5c9, before the PR.

Additional behavior confirmed during independent review of the latest fixes:

• Independent collectors can conflict on receipt/ledger evidence because review metadata identities differ. Unique temporary files fix copy ownership; they do not serialize cross-workspace acceptance.
• Save/capture preflight rejects the covered malformed clip/take/workflow/recovery containers with 400 before services lookup or preparation, including a malformed later recipe. Twelve isolated HTTP tests check project/file preservation and valid controls (PR Full audit fixes (2026-11-04) #35). This is structural coverage, not a full project schema.
• Demo value-validation errors include code: invalid_request; supported save-shape checks match the covered host cases. All 109 Node demo checks pass (PR Full audit fixes (2026-11-04) #35).