[doubletwisted]

The audit found host-file exposure, unsafe farm receipts, stale snapshots and media/editing errors. This PR corrects those paths while preserving existing project records, source files, success replies and manifest shapes.

• Local-control checks protect host-file operations. Farm receipts enforce identity/path rules; studio markup escapes IDs, take numbers and transition tracks. Authored blob-marker impersonation is rejected.
• Snapshot publication carries an atomic per-publication UUID, detects coarse/same-size replacement, fails on unreadable identities and coordinates marker handles with Windows replacement. Registration is atomic. Maintenance scans use private read generations; project backup reporting uses .spool/backups.
• Copied media remains portable. Orientation, finite source rates, output-folder names, joined-file audio clocks and loader refresh/upload races are corrected. Existing media records remain readable.
• Cloud observation batches settle before reporting failures; cancellation drains storage work. Reconciliation/collection share per-project locks within one collector. Local, farm and Cloud copies own unique partial files and preserve prior outputs on failure. Deadline grace excludes queue/preparation time; recovery lookup failures return retryable 503 without resubmission.
• Save/capture preflight rejects covered malformed clip/take/workflow/recovery containers with 400 before services lookup or staging, including a later malformed recipe. Demo save/value errors match. Valid stale-revision behavior and genuine internal-error handling are preserved. Save-error wording also applies to permanent deletion.
• Imports with many cuts use bounded exact-frame batches and balanced keyframe expressions, avoiding Windows command length and FFmpeg expression-depth failures. Short six-frame GOPs retain seeking behavior. Invalid cuts are rejected before encoding without sorting/deduplication. Requirements document the existing FFmpeg/ffprobe 5.1 minimum.
• Launcher storage, globbing and process creation run off-loop with cancellation draining and protected startup reservations. Failed imports clean only owned destinations/new caches, including early path failures; uncertain/pre-existing caches are retained.
• OTIO publication retries transient Windows sharing denials and owns its exclusive pending file. Comparison frames live in private temporary directories; returned sheets and explicit frame exports remain durable.
• Cancellation preflight uses the read generation, avoiding writer-lock waits and checkpoint rewrites. Plan/delivery transactions retain their supplied connections. FFmpeg audio/export/cut diagnostics decode UTF-8 and preserve Unicode filenames under Windows legacy locales.
• Effective credential status handles empty saved/environment values. Credential creation is safe, the registry action is commit-pinned, permanent deletion flushes drafts, encoded media URLs play/seek, and repeated OTIO exports revoke replaced blobs. Local demo serving returns complete 416 responses.

Refs #3, #36, #37, #38, #39, #40, #41, #42, #43, #44, #45. Head cf37734368c3de9a6d576a7222f26aa345adc107.

Validation:

Evidence	Qualified source	Result
Full Windows gate	Current commit tree	109 commands / 658 Python tests enumerated, 8 skips; JS/format/lint/type checks pass
Real isolated ComfyUI CPU	Current commit tree	19 image/video, collection, restart, import/export and cut checks
Real Chrome deletion replay	e70d2fd	33 F-12 assertions, including save failure/retry and retained file bytes
Real Chrome deletion/download/lifecycle	Current commit tree	151 assertions; three actual completed OTIO link-click downloads
Real Chrome studio/link/security/media	73d084e	187 assertions: 128 studio + 28 linked workflow + 31 dedicated checks
Demo API	Current commit tree	109 Node checks with simulated replies

The current 151 Chrome checks rerun deletion, three actual OTIO downloads, failure handling, blob lifecycle and take cleanup after the export changes. Seven lifecycle checks overlap the historical 187 run; the separate historical 33-case F-12 replay also overlaps the current suite. Counts are not additive. Those browser results remain identified by their actual commits.

Nine OTIO publication tests include a real Windows reader denying rename; they also pass on embedded Python 3.12. Seven comparison tests verify actual FFmpeg/Pillow pixels, repeated/concurrent sheets and failure cleanup. Independent source review approves both. Denied cleanup may retain an owned temporary file.

Five real-process diagnostic tests and six cancellation tests pass. Independent reviews approve both. Native cp1252 HTTP reproduction changes from 500 to readable 400, with normal control 200; embedded Python 3.12 also preserves the error without reader-thread failures. This HTTP harness is separate from the 19 real ComfyUI CPU checks.

The 11 many-cut tests run real fractional-rate imports across batch boundaries, verify frames/colors/source hashes/GOP spacing and cleanup, and execute/decode the largest planned batch against a real 28,020-frame source. Structural Unicode-path cases plan 1,800 and 20,000 cuts with every command at or below 24,000 UTF-16 units including NUL; full imports with all posters at those counts were not run. A representative 10,000-frame shot retains 1,667 keyframes and prior seek performance. Actual qualification used FFmpeg 9.0.2; 5.1 runtime is not claimed.

Other focused checks include 12 isolated HTTP tests/52 malformed requests with project/file-hash preservation, 22 launcher tests (one POSIX skip), and 11 import-cleanup tests with native Windows junctions. Independent source/evidence reviews cover publication, collection, timing, request/demo validation, launcher/import cleanup and the many-cut corrections. External Deadline/Cloud behavior uses doubles, separately from the real ComfyUI CPU evidence. Portable embedded Python loads run_spool.bat --help; this is module resolution, not a full launcher run.

Remaining acceptance: real Deadline, paid Cloud, Mac/Desktop/portable startup, bare UNC share-root containment, native viewport/timeline cases beyond the named fixtures, and original unsafe-source before/fixed comparisons for F-12/F-23. #43 still covers valid-looking stale media staging and acceptance/freeze I/O failures. Other nested fields/routes are outside these structural guards. Mixed-version snapshot detection relies on replacement identity when old writers preserve the UUID. Collector locks do not establish cross-process receipt/ledger idempotence. Joined-file audio is retimed; studio playback/export still uses plain takes. CI on this head is not claimed; broader acceptance keeps this PR draft.

Initial audit/implementation: Claude Code. Follow-up implementation: GPT-6.1 Sol through Codex and DeepSeek V4.1 Flash through OpenCode and Pi in T3 Code.

[doubletwisted]

Tracked leftovers from the audit report:

• Import by path copies the video, contradicting the guide, and records an absolute path to the copy #36 Import by path copies the video, contradicting the guide, and records an absolute path to the copy (N-04, needs decision)
• Snapshot change detection uses (mtime_ns, size): stale reads and lost updates on coarse timestamps #37 Snapshot change detection uses (mtime_ns, size): stale reads and lost updates on coarse timestamps (N-03, needs decision)
• Rotated video and EXIF-rotated images report coded size, not display size #38 Rotated video and EXIF-rotated images report coded size, not display size (N-05, needs decision)
• Joined copy from an extension keeps the render audio without retiming it #39 Joined copy from an extension keeps the render audio without retiming it (N-06, needs decision)
• Clip output folders collide case-insensitively and a name can end in a space #40 Clip output folders collide case-insensitively and a name can end in a space (N-07, needs decision)
• A stored value shaped like a blob marker makes the project unreadable #41 A stored value shaped like a blob marker makes the project unreadable (N-08, needs decision)
• Demo delete-takes ignores media-pool and generation-input rules #42 Demo delete-takes ignores media-pool and generation-input rules (N-10, needs decision)
• A rejected queue request leaves its frozen input copies behind #43 A rejected queue request leaves its frozen input copies behind (N-11, needs decision)
• Verify audit PR #35 on real hardware/hosts #44 Verify audit PR Full audit fixes (2026-11-04) #35 on real hardware/hosts
• Audit follow-ups (2026-11-04): low-severity findings and improvements #45 Audit follow-ups (2026-11-04): low-severity findings and improvements

Existing issues referenced: #17 (Mac Desktop and launcher acceptance), #11 (path import), #5 (project folders, snapshot write amplification).

The remaining needs-decision items (N-01, N-02, N-09) and unconfirmed U-03 are security-related and are not filed as public issues.