diff --git a/.comfyignore b/.comfyignore
index d943fef..36b573d 100644
--- a/.comfyignore
+++ b/.comfyignore
@@ -4,6 +4,7 @@ pages/
 promo/
 .native-test/
 docs/archive/
+docs/audits/
 __pycache__/
 *.pyc
 AGENTS.local.md
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 0c27197..cc0f521 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -16,6 +16,7 @@ jobs:
     if: github.repository_owner == 'doubletwisted'
     steps:
       - uses: actions/checkout@v4
-      - uses: Comfy-Org/publish-node-action@main
+      # Reviewed upstream main on 2026-11-07; re-review before updating.
+      - uses: Comfy-Org/publish-node-action@d2366e7abb6ab16f3bb03e3520ae25c8cf749bc9
         with:
           personal_access_token: ${{ secrets.REGISTRY_ACCESS_TOKEN }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c0bb67e..08e60c3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,154 @@
 All notable changes to Spool are recorded here. Versions follow
 [semantic versioning](https://semver.org/).
 
+## Unreleased
+
+### Tests
+
+- Native browser checks cover permanent take deletion with pending and failed
+  saves, plus completed OTIO downloads and export failures. They verify project
+  revisions, retained file bytes, downloaded timelines and blob URL replacement.
+
+### Fixes
+
+- OTIO export retries transient Windows sharing denials and removes only its own
+  unfinished file if writing or publication fails.
+- Comparison sheets use temporary frames that are cleaned after success or
+  failure. Saved sheets and explicitly exported frames remain available.
+- FFmpeg errors retain Unicode filenames on Windows instead of failing while
+  decoding diagnostics during audio preparation, export or cut detection.
+- Cancellation preflight reads avoid writer locks and checkpoint rewrites;
+  cancellation plans and delivery acknowledgements keep their transactions.
+- Footage with many cuts imports without Windows command or FFmpeg expression
+  limits, while keeping exact shot frames and short keyframe intervals for seeking.
+  The existing FFmpeg/ffprobe 5.1 minimum is documented.
+- Save and capture validate clip, take and workflow containers before staging
+  input files, returning request errors for invalid types. Demo save and take
+  validation replies include matching error codes.
+- Unresolved-save messages also apply to pending actions such as take deletion.
+- Transition buttons escape project track values, preventing a crafted track
+  from executing script when the timeline opens.
+- Failed imports remove only their own new working cache, preserving existing or
+  redirected caches and the original import error when cleanup is denied. Cache
+  path setup failures also remove the import's empty destination.
+- Storage reports include project backups from their managed cache directory.
+- Slow launcher settings, startup-file scans and process creation run in workers,
+  keeping the host responsive. Delayed state updates preserve newer startup
+  reservations, and cancellation waits for an in-flight launch to finish.
+- Local, Deadline and Cloud collection own their temporary files, so concurrent
+  collectors cannot overwrite or remove each other's unfinished copies.
+- Finding an existing Deadline job reports an unavailable service with a retry
+  action when its recovery lookup fails.
+- Missing required revision/request fields return validation errors before the
+  operation starts, including the save and take actions simulated by the demo.
+- Manual reconciliation and background collection serialize work for each
+  project, preventing duplicate artifact copies. Shutdown waits for collection
+  workers to finish before releasing ownership.
+- Deadline submission grace no longer includes time waiting in the queue or
+  preparing inputs, so old queued takes can still be submitted.
+- Maintenance dry runs scan a private snapshot, so a long report does not block
+  another editor's save on Windows.
+- Invalid or nonfinite probed frame rates produce a clear validation error.
+- Cloud observation batches settle before reporting failures; cancellation
+  preserves other errors and always releases executor ownership on shutdown.
+
+- The local demo server rejects inverted or out-of-bounds byte ranges with a
+  complete 416 response instead of a negative content length.
+
+- Cloud key status follows the effective saved or environment credential,
+  including empty or whitespace-only values.
+- Registry publishing pins its external action to a reviewed commit.
+
+- Failed input staging and export muxing remove their own partial files while
+  preserving published inputs, successful exports and the original error.
+
+- Linked Comfy image-loader choices refresh when a workflow opens or reloads,
+  keeping valid staged images selectable without changing the saved input.
+- Newly described image/video dimensions follow EXIF and display-matrix
+  orientation. Existing media records and originals are unchanged.
+- Path-imported video copies keep project-relative original references, so
+  moving a project also preserves its shot and audio source references.
+- Joined extension audio follows the measured frame shift and sequence frame
+  rate, keeping its duration aligned with the joined video.
+- Snapshot publications carry an identity inside the SQLite snapshot, so
+  same-size saves with coarse timestamps do not hide newer revisions.
+- Demo take deletion follows host media-pool and generation-input protection
+  rules and removes aliases of a deleted original.
+
+- New clip output folders stay distinct when names differ only by case, and
+  Windows device names and truncated trailing spaces/dots are made portable.
+  Existing assigned output folders are preserved.
+- Queue preparation validates every item and source before freezing inputs,
+  so an invalid later item does not leave copies from earlier items.
+
+- Authored JSON that impersonates a project evidence blob is rejected before
+  saving, so an imported value cannot leave the project unreadable.
+
+- Comparing takes and detecting cuts in a take whose original lies outside the
+  project and Comfy folders now answer only this computer, as downloading that
+  original already did. Another machine could otherwise read frames of any image
+  or video on the Spool computer.
+- `python -m spool` agent commands reach a Spool on this computer directly when
+  `http_proxy` is set for other traffic, instead of failing through the proxy.
+- **Find existing Deadline job** works again. It failed on every call, so a
+  Deadline render whose submission was uncertain could not be resolved.
+- A Deadline receipt whose artifact or execution ID is not the ID Spool's worker
+  writes is rejected. A forged ID could make collection copy a file outside the
+  project.
+- A Deadline receipt that is valid JSON of the wrong shape is recorded as invalid
+  instead of stopping collection of every later receipt and project.
+- Reopening a project after Spool stopped in the middle of a save restores the
+  last published snapshot. The interrupted save could be rolled into the fresh
+  copy and, on the next save, undo work published from another computer.
+- Applying a workflow or using a take no longer stores another copy of the
+  project's workflows each time. Repeated without a save in between, it grew the
+  project until it could not be opened.
+- `python -m spool prune --confirm` no longer removes previews the edit uses when
+  their file names contain spaces or accented letters.
+- Opening a project no longer runs script hidden in its clip, take or media IDs,
+  take numbers or track numbers. The studio now escapes them like names, so an
+  imported project or shared project folder cannot act as the studio.
+- `run_spool.bat` finds Spool with the Windows portable build's Python, whose
+  `._pth` file leaves the Spool folder off Python's module path.
+- Importing footage again after an interrupted import works. A review copy, poster
+  or waveform cut short by a timeout or a stopped Spool was kept and reused, so
+  that file could never be imported again.
+- MP4 export works for a Windows account whose name contains an apostrophe.
+- **Delete from disk** saves your edits first. An edit not yet saved was replaced
+  by the reply, and one still saving made the delete report a conflict.
+- A Deadline task that the farm retried no longer adds its second render to the
+  clip as an extra take; the accepted result stays the only take.
+- A project folder Spool cannot open, such as one a newer Spool upgraded, is
+  listed as unavailable instead of stopping the project list and every other
+  project's renders. A folder whose upgrade fails is retried less and less often,
+  not every few seconds with a new backup each time.
+- `python -m spool prune --confirm` and `reclaim --confirm` keep their working copy
+  in a private temporary folder and remove it afterwards. Another user of the
+  computer could plant a database at the shared path they used, which a run then
+  published into the project.
+- Projects created, opened or imported at the same moment all stay in the project
+  list. One could drop another from the list, leaving its folder unreachable.
+- Files whose names contain a percent sign followed by two hex digits, such as
+  `a%41.mp4`, play, export and collect. Their names were decoded a second time
+  and pointed at a different file.
+- The studio shows footage whose file name contains `#`, `?` or `%`, such as an
+  imported `Take #3.mp4`. Its address was cut at that character.
+- A Comfy Cloud workflow whose result is an image is refused before it renders.
+  Cloud results are collected as video, so the paid render could never arrive.
+- Importing a file that is not readable media says so and keeps nothing, instead
+  of a generic server error with the file left in the project.
+- A project folder at the root of a drive or network share (`E:\`,
+  `\\nas\projects\`) can use its media. Every path in it was refused as outside
+  the project.
+- `python -m spool command` reports a missing or invalid `--file` as a JSON error
+  (`invalid_request`) instead of a Python traceback.
+- A waveform is drawn again when its audio file is replaced at the same path,
+  instead of showing the old sound.
+- Standalone Spool starts, and its Comfy connection status loads, from a checkout
+  close to the drive root such as `C:\Spool` or `/opt/spool`.
+- On macOS and Linux the saved Comfy Cloud key file is private from the moment it
+  is written; it was briefly readable by other users of the computer.
+
 ## 0.1.1 (2026-11-03)
 
 ### Directing tools
diff --git a/README.md b/README.md
index b7c2bec..4a76826 100644
--- a/README.md
+++ b/README.md
@@ -42,7 +42,7 @@ review takes and change the edit there; generating takes needs Spool with ComfyU
 - ComfyUI 0.39.0 or newer (tested with 0.43.1 / frontend 1.57.4 on Windows,
   and 0.43.0 / frontend 1.57.4 on Apple Silicon)
 - Python 3.11 or newer
-- `ffmpeg` and `ffprobe` on the PATH of the process running ComfyUI (on macOS,
+- `ffmpeg` and `ffprobe` 5.1 or newer on the PATH of the process running ComfyUI (on macOS,
   Spool also finds a Homebrew or MacPorts install)
 - For Comfy Cloud: a Comfy API key
 
diff --git a/docs/audits/2026-11-04-full-audit.md b/docs/audits/2026-11-04-full-audit.md
new file mode 100644
index 0000000..9eb4c77
--- /dev/null
+++ b/docs/audits/2026-11-04-full-audit.md
@@ -0,0 +1,402 @@
+# Full audit, 2026-11-04
+
+## Summary
+
+A read of the whole repository (backend, studio, Comfy page extension, demo,
+launchers, CI and docs) found 44 problems that could be shown to be real. 29 are
+fixed on branch `claude/full-audit-2026-11-04-hta0pw`, each in its own commit and
+with a regression test where one can run in the gate. 11 need an owner decision,
+because the fix would change documented behaviour or a stored format, or because
+it is a trade-off. 4 are plausible but could not be confirmed here.
+
+| Severity | Fixed | Needs decision | Unconfirmed | Total |
+| --- | --- | --- | --- | --- |
+| Critical | 0 | 0 | 0 | 0 |
+| High | 6 | 1 | 0 | 7 |
+| Medium | 12 | 4 | 0 | 16 |
+| Low | 11 | 6 | 4 | 21 |
+
+The most serious problems were:
+
+- **Host files reachable from another machine.** Routes that are not local-only
+  could read any image or video on the Spool computer: one was fixed (F-01), the
+  larger one needs a decision (N-01).
+- **A file write outside the project** from a forged Deadline receipt (F-02).
+- **A crashed save rolling back another computer's work** (F-04).
+- **Stored XSS** through project IDs and take numbers (F-05).
+- **Find existing Deadline job** failing on every call (F-03).
+
+## Methodology
+
+1. Read `README.md`, `AGENTS.md`, `CLAUDE.md`, `CONTRIBUTING.md`, `docs/` and
+   `tests/`, then installed the gate's tools as CI does
+   (`python -m pip install aiohttp pillow -r requirements.txt -r requirements-dev.txt`
+   and `npm ci`) and ran every gate command separately to get a full baseline
+   instead of stopping at the first failure.
+2. Reviewed the HTTP surface (`spool/routes.py`, local-control guard, entry points,
+   CLI) directly, and ran four parallel read-only reviews of persistence, execution
+   targets, media/host code and browser JavaScript. Every reported finding was
+   re-run or re-read before it was accepted; two candidates were dropped as false
+   (a "missing" public route that is documented, and an `executionId` traversal
+   that the receipt namespace check already stopped).
+3. For each confirmed defect: a failing test or repro first, the smallest fix, the
+   test run with and without the fix, then the full gate before the commit.
+4. Kept public behaviour and file formats unchanged. Where a fix would change
+   either, it is listed under _Needs decision_ instead.
+
+### What could and could not run in this sandbox (Linux, no GPU)
+
+- **Ran:** the full gate (ruff, Prettier, ESLint, knip, `tsc`, every
+  `tests/*_checks.mjs` and `tests/test_*.py`), ffmpeg/ffprobe media repros, and a
+  standalone `python -m spool` host driven by headless Chromium for the studio XSS
+  and media-address checks (live studio evidence, standalone host).
+- **Node 22.23** here; the repository and CI use Node 24. All Node checks passed.
+- **Not run:** browser checks and live checks against ComfyUI (no ComfyUI install
+  or GPU), Deadline and Comfy Cloud (no farm or key; paid checks are opt-in), and
+  Windows or macOS. Deadline and Cloud findings use the repository's own fixtures
+  with `deadlinecommand` and the Cloud SDK patched: they are mocked results, not
+  live evidence. Windows-only findings are marked _review-only_; where the cause
+  can be shown on Linux (F-09 with `python -I`, F-21 with `/`) it was.
+
+## Findings
+
+Lines refer to the code before the fix (`main` at `7caf5c9`).
+
+| ID | Severity | Area | Location | Finding | Status |
+| --- | --- | --- | --- | --- | --- |
+| F-01 | High | Security | `spool/routes.py:418`, `:938` | `/comparison` and `/detect-cuts` read takes' originals outside the project for non-local callers | fixed |
+| F-02 | High | Security / Deadline | `spool/farm_protocol.py:177`, `spool/farm.py:156` | A receipt's `artifactId` names the ingestion copy's path: file write outside the project | fixed |
+| F-03 | High | Deadline | `spool/commands.py:525` | `recover_submission` (**Find existing Deadline job**) raises `UnboundLocalError` on every call | fixed |
+| F-04 | High | Data loss | `spool/projects.py:115` | A crashed save's `-journal` is rolled into the fresh working copy, undoing other computers' work | fixed |
+| F-05 | High | Security / studio | `ui/timeline-renderer.js:299` and 27 more sinks | Stored XSS through clip/take/media IDs, take and track numbers | fixed |
+| F-06 | Medium | Data loss | `spool/store.py:657` | `prune --confirm` deletes previews the edit uses when names hold spaces or non-ASCII | fixed |
+| F-07 | Medium | Deadline | `spool/farm.py:130`, `spool/collection.py:76` | A receipt of the wrong JSON shape aborts every scan | fixed |
+| F-08 | Medium | Persistence | `spool/store.py:1232` | Each capture re-wraps the packed document until reads hit `RecursionError` | fixed |
+| F-09 | High | Launcher (Windows, review-only) | `run_spool.bat:17` | The portable build's `._pth` Python cannot find `spool` with `-m` | fixed |
+| F-10 | Medium | Media | `spool/media.py:384`, `:444`, `:459` | An interrupted proxy/poster/waveform encode is reused forever | fixed |
+| F-11 | Medium | Export | `spool/export.py:85` | MP4 export fails when the temp path holds an apostrophe | fixed |
+| F-12 | Medium | Studio | `ui/take-actions.js:197` | **Delete from disk** replaces an unsaved draft or reports a false conflict | fixed |
+| F-13 | Medium | Deadline | `spool/store.py:1158` | A retried farm task's copy becomes a second take | fixed |
+| F-14 | Medium | Persistence | `spool/projects.py:342`, `:362` | One unopenable folder stops listing and rendering for every project; failing upgrades back up every tick | fixed |
+| F-15 | Medium | Security | `spool/projects.py:54` | Confirmed maintenance trusts a working copy at a predictable shared temp path | fixed |
+| F-16 | Low | Concurrency | `spool/projects.py:323`, `:392` | Concurrent create/open/import drop each other's registration | fixed |
+| F-17 | Medium | Media | `spool/media.py:139` | Paths are URL-decoded twice (`a%41.mp4` resolves to `aA.mp4`) | fixed |
+| F-18 | Medium | Studio | `ui/editor.js:232` | Media addresses are not encoded; a `#` in a file name breaks playback | fixed |
+| F-19 | Medium | Cloud | `spool/requests.py:207`, `spool/cloud.py:189` | Cloud renders with an image result are paid for and never collected | fixed |
+| F-20 | Low | Media / routes | `spool/media.py:34`, `spool/routes.py:878` | Unreadable media answers 500 and the upload is kept | fixed |
+| F-21 | Low | Paths (Windows, review-only) | `spool/media.py:140`, `spool/routes.py:101` | A project at a drive or share root refuses every media path | fixed |
+| F-22 | Low | CLI | `spool/cli.py:51` | A missing or invalid `--file` prints a traceback, not the documented JSON error | fixed |
+| F-23 | Low | Studio | `ui/exports.js:277` | Timeline export leaks a blob URL per export | fixed |
+| F-24 | Low | Media | `spool/media.py:453` | Waveform cache ignores size and mtime: replaced audio keeps its old waveform | fixed |
+| F-25 | Low | Startup | `spool/launcher.py:152`, `spool/__main__.py:19`, `spool/maintenance.py:11` | A shallow checkout raises `IndexError` | fixed |
+| F-26 | Low | Security | `spool/credentials.py:37` | The Cloud key file is briefly created with umask permissions | fixed |
+| F-27 | Low | CLI | `spool/cli.py:58` | `http_proxy` captures CLI requests to 127.0.0.1 | fixed |
+| F-28 | Low | Tests | `tests/test_take_files.py:339`, `:360` | Clip-folder tests depend on `xdg-open`; one fails headless, one passes for the wrong reason | fixed |
+| F-29 | Low | Docs | `docs/guide/deadline.md:54`, `docs/dev/durable-names.md:27`, `docs/dev/architecture.md:89` | Three docs contradict the code | fixed |
+| N-01 | High | Security | `spool/requests.py:292-362`, `spool/routes.py:827` | Generation preview and queue bake host files for non-local callers; the copy is then served | needs-decision |
+| N-02 | Medium | Security | `spool/routes.py:183` | DNS rebinding reaches every route that is not local-only | needs-decision |
+| N-03 | Medium | Persistence | `spool/projects.py:96` | Snapshot change detection is `(mtime_ns, size)`: stale reads and lost updates on coarse timestamps | needs-decision |
+| N-04 | Medium | Media / docs | `spool/routes.py:896`, `spool/media.py:567`, `docs/guide/editing.md:153` | Import by path copies the video, contradicting the guide, and records an absolute path to the copy | needs-decision |
+| N-05 | Medium | Media | `spool/media.py:333`, `:371` | Rotated video and EXIF-rotated images report coded, not display, size | needs-decision |
+| N-06 | Low | Media | `spool/joins.py:332` | An extension's joined copy keeps the render's audio without retiming it | needs-decision |
+| N-07 | Low | Paths | `spool/projects.py:27`, `:258` | Clip output folders collide case-insensitively; a name can end in a space | needs-decision |
+| N-08 | Low | Persistence | `spool/store.py:457` | A stored value shaped like `{"__spool_blob__": …}` makes the project unreadable | needs-decision |
+| N-09 | Low | CI / supply chain | `.github/workflows/publish.yml:20` | `Comfy-Org/publish-node-action@main` runs unpinned with the registry token | needs-decision |
+| N-10 | Low | Demo | `pages/demo-api.js:85` | The demo's delete-takes ignores media-pool and generation-input rules | needs-decision |
+| N-11 | Low | Execution | `spool/requests.py:425` | A rejected queue request leaves its frozen input copies behind | needs-decision |
+| U-01 | Low | Deadline (review-only) | `spool/farm.py:86` | A submission is timed from attempt creation and may be marked uncertain while still submitting | unconfirmed |
+| U-02 | Low | Windows (review-only) | `spool/store.py:771` | A dry-run `prune`/`reclaim` holding `project.spool` open may make a live publish fail | unconfirmed |
+| U-03 | Low | Comfy page | `web/template-browser.js:13` | Any loopback origin, on any port, may frame the template chooser and receive the capture | unconfirmed |
+| U-04 | Low | Export | `spool/export.py:13` | A fixed 180 s ffmpeg timeout surfaces as a 500 for long exports | unconfirmed |
+
+## Details of fixed findings
+
+Each fix commit names the finding in its message. "Test" names the regression
+test; it fails without the fix and passes with it.
+
+**F-01 Comparison and cut detection read outside footage for remote callers.**
+`/frame` and `/take-file` refuse footage outside the project and Comfy folders to
+non-local callers, as the security guide promises, but `/comparison` and
+`/detect-cuts` read the same originals. A client on another machine (or a
+DNS-rebound page) could create a project whose take points at
+`/home/user/private.png`, request a comparison and download the PNG sheet
+(reproduced: 403 from `/frame`, 200 and the image from `/comparison`). Both routes
+now apply the same rule. Test: `test_security.RouteGuardTests.test_frames_of_footage_outside_the_project_stay_on_this_computer`.
+
+**F-02 Forged receipt IDs steer the ingestion copy.** `farm_protocol.verify`
+checked only that artifact IDs were unique; `Media.result_path` joins them into
+the destination. A receipt with `artifactId: "../../../../ESCAPED"` wrote
+`ESCAPED.png` outside the store and the attempt completed. Anyone who can write
+the farm share could choose the content and the place. Both IDs must now be the
+32-hex `uuid4` the worker writes. Test:
+`test_farm_protocol…test_receipt_identities_cannot_name_files_outside_the_attempt`.
+
+**F-03 Find existing Deadline job.** `apply()` assigns `attempt` and `submission`
+in its cancel branch, which makes both local to the whole function, so the
+recover branch read unbound names (`UnboundLocalError` with and without a matching
+job). An uncertain Deadline submission could not be resolved. Test:
+`test_farm_protocol…test_find_existing_deadline_job_adopts_it_or_reports_still_uncertain`.
+
+**F-04 Stale rollback journal.** The working copy refresh deleted the database and
+its `-wal`/`-shm` but not `-journal`. After a writer died mid-transaction, the
+journal was rolled into the newly copied snapshot and the next save published a
+rolled-back project over another computer's revisions (reproduced with a real
+crashed process). Test: `test_project_folders.CrashRecoveryTests`.
+
+**F-05 Stored XSS.** IDs, workflow keys, take numbers and track numbers were joined
+into `innerHTML` raw, next to escaped names. Imported projects and shared folders
+keep them as written. Live check on a standalone host with headless Chromium: the
+unpatched studio ran injected handlers from a clip ID and a take number; patched,
+none ran. Inside ComfyUI the studio shares Comfy's origin. Test:
+`tests/html_escape_checks.mjs`, a gate check that fails when one of these fields
+reaches markup without `esc()` (it reported all 28 sites before the fix).
+
+**F-06 Prune deletes referenced previews.** References were collected by an ASCII
+token regex over stored JSON, so `Desert walk-….mp4` and `café-….mp4` (stored as
+`café`) never matched and were evicted. Whole decoded JSON strings are now
+matched as well. Test: `test_native…test_prune_keeps_referenced_previews_named_with_spaces_or_accents`.
+
+**F-07 Wrong-shape receipts.** `{"artifacts": ["x"]}` raised `TypeError` past the
+handlers that catch only `ValueError`/`KeyError`/`OSError`, aborting the scan for
+every later receipt and project; the guide promises an invalid receipt cannot hide
+a later valid one. Test: `test_farm_protocol…test_receipt_of_the_wrong_shape_does_not_block_a_later_valid_execution`.
+
+**F-08 Capture re-wrapping.** `Store.capture` loaded the packed document with
+`json.loads` and saved it, adding one blob layer per capture; after about 990
+captures without an ordinary save, reads raised `RecursionError`. Test:
+`test_store_interface.RepeatedCaptureTests`.
+
+**F-09 `run_spool.bat` on the portable build (review-only).** A `._pth` file
+makes CPython leave the current folder off `sys.path`, so `python -m spool` failed
+with "No module named spool". The script now adds the folder and runs the package
+with `runpy`. Shown on Linux with an embeddable-style interpreter and with
+`python -I`, which has the same effect. Not run on Windows. Test:
+`test_launcher.StandaloneScriptTests`.
+
+**F-10 Interrupted encodes.** `describe()` encoded straight to the cache name and
+reuses any file there; a timeout left a 4.9 MB truncated MP4 and every later
+describe failed. Encodes now go to a unique pending name and are renamed into
+place. Test: `test_media.InterruptedEncodeTests`.
+
+**F-11 Apostrophe in the concat list.** `file '<path>'` was written unescaped; with
+a temp folder under `O'Brien`, ffmpeg opened a different path. Test:
+`test_media.ExportPathTests`.
+
+**F-12 Delete from disk without flushing.** `projectEdit.change()` accepts the
+reply when the draft did not change during the request, which replaced an edit
+left unsaved after a failed save (mocked transport repro: the retried save wrote
+the old name). The action now flushes first, as the other authored actions do;
+`flush()` refuses while the draft is unsaved. No gate test: the take actions run
+only in browser checks.
+
+**F-13 Retried farm task as a second take.** Collection copies every execution's
+primary into the clip folder, but the folder inventory knew only the winning
+attempt's artifacts. Every recorded execution's artifacts are now known. Test:
+`test_project_folders…test_a_retried_farm_task_does_not_become_a_second_take`.
+
+**F-14 One unopenable folder.** `list`, `project_stores` and `lookup` raised on a
+folder in a newer format, stopping the collector, dispatcher and Cloud loop for
+all projects; a failing upgrade wrote a full backup on every 2 s scan (10 in
+20 s). Such a folder is now listed as unavailable and skipped, with retries backing
+off from 5 s to an hour unless its files change. Tests:
+`test_project_folders.UnavailableFolderTests`.
+
+**F-15 Shared maintenance cache.** Without a workspace, `prune`/`reclaim
+--confirm` used `<tmp>/spool-maintenance/<sha256(folder)>` and trusted its
+working copy; a planted database was published into the project. Writable runs now
+use a private `mkdtemp` folder, removed afterwards. Test:
+`test_project_folders.MaintenanceCacheTests`.
+
+**F-16 Registration race.** `project_folders` was read and written back separately
+from worker threads; 8 concurrent imports left 4–6 listed. It is now one
+`BEGIN IMMEDIATE` transaction. Test:
+`test_project_folders…test_projects_imported_at_once_all_stay_listed` (the race
+fails it in most unfixed runs; fixed, it passes every run). Two existing import
+tests used `set_setting` as their seam and were pointed at `register_folder`.
+
+**F-17 Double URL decoding.** aiohttp decodes route paths once (including `%2F`);
+`contained()` decoded again. `a%41.png` resolved to `aA.png`, and an upload named
+`..%252F..%252Foutput%252Fclip%252F…` landed in a clip's output folder. Tests:
+`test_uploads…test_upload_names_are_decoded_once`,
+`…test_stored_names_holding_a_percent_sign_resolve_to_that_file`.
+
+**F-18 Unencoded media addresses.** `url()` appended project paths unencoded;
+an imported `Take #3.png` requested `…/Take ` (400, broken image). Each segment is
+now encoded. Live check on a standalone host: 400 before, 200 after. No gate test.
+
+**F-19 Cloud image results.** Freezing accepted SaveImage/PreviewImage for Cloud,
+but Cloud collection accepts only video files, so the job rendered (paid) and then
+polled as `collection_pending` forever. It is now refused when queued, and the
+guide says so. Test: `test_queue_operations…test_cloud_refuses_an_image_result_it_could_never_collect`.
+
+**F-20 to F-29, low.**
+
+- F-20: ffprobe failures are a 400 (still a `SubprocessError` for existing
+  handlers), and the upload is deleted. The message no longer carries ffprobe's
+  absolute path.
+- F-21: containment strips a root's trailing separator.
+- F-22: the CLI reports `invalid_request` for an unreadable or invalid
+  `--file` (guide and skill updated).
+- F-23: the previous timeline blob URL is revoked when an export replaces it.
+- F-24: the waveform key includes size and mtime.
+- F-25: missing parents mean "not installed under ComfyUI".
+- F-26: the key file is created `0600` with `os.open`.
+- F-27: the CLI bypasses proxies for loopback hosts.
+- F-28: both clip-folder tests stub the file manager.
+- F-29: docs corrected.
+
+Tests for F-20 to F-28 are in `test_uploads`, `test_unc_paths.RootFolderTests`,
+`test_cli`, `test_media.WaveformCacheTests`, `test_launcher.ShallowCheckoutTests`,
+`test_credentials` and `test_take_files`. F-23 has no gate test.
+
+## Needs owner decision
+
+**N-01 (High) Generation preview and queue copy host files for remote callers.**
+Repro (`/generation-preview`, open route): create a project whose original take
+is any image on the host, capture a one-loader workflow with a shot input, and
+request a preview. Spool bakes the file into Comfy's input folder and returns its
+name, and `GET /spool/api/input/<name>` (or ComfyUI's own `/view`) serves the
+pixels to that caller. The same happens through `/queue` and the command API. A
+fix means refusing non-local callers a request that reads an absolute original
+outside the project and Comfy folders, which would stop remote collaborators on a
+`--listen` host from generating from footage imported by path. Recommendation:
+apply the take-download rule (`outside_footage` in `routes.py`) to request
+preparation, and document it as a local-only case.
+
+**N-02 (Medium) DNS rebinding.** The host-name check protects only local-only
+routes. A page whose name re-resolves to 127.0.0.1 sends matching `Host` and
+`Origin`, so it can read and edit projects, queue renders (spending Cloud credits)
+and delete takes (reproduced: 200 on list and save, 403 on a local-only route).
+ComfyUI's own routes have the same exposure. Refusing a loopback peer that names a
+non-loopback host would stop it, but it breaks a same-machine reverse proxy that
+preserves `Host`, a setup the security guide recommends.
+
+**N-03 (Medium) Snapshot signatures.** Changes are detected by `(mtime_ns, size)`,
+and SQLite snapshots rarely change size. On storage with 1–2 s timestamps (FAT32,
+HFS+, some SMB servers) a reader kept revision 300 after 302 was published, and a
+second host saved over newer work (simulated; 0 of 300 on ext4). A per-publication
+token in `project.json` would fix it, but changes the manifest.
+
+**N-04 (Medium) Import by path.** `docs/guide/editing.md` says this "reads a video
+where it is, without copying it", but `keep_input` copies it into
+`input/video/`, and the shots record an absolute `originalFile` for that copy, so
+the project breaks when the folder is opened from another mount. Decide whether
+to reference in place (and fix the copy) or keep the copy, then store a
+project-relative path and correct the guide.
+
+**N-05 (Medium) Rotation.** A 64×48 video with a 90° display matrix is described
+as 64×48 while every render is 48×64; an EXIF-rotated JPEG likewise. The directing
+tools take generation size from these fields. Fixing it changes recorded
+`width`/`height` for newly described media.
+
+**N-06 (Low) Joined copy audio.** A 25 fps render in a 24 fps sequence: the plain
+take's audio is retimed (5.201 s) but the joined copy copies the stream (5.0 s), so
+it drifts up to 0.2 s and ignores the measured shift.
+
+**N-07 (Low) Folder names.** `Intro` and `intro` get separate folders that are one
+directory on Windows and macOS, so a dropped file joins both clips. Truncation runs
+after stripping, so a name can end in a space; `CONIN$` is not reserved. A fix
+changes the folder names of new clips.
+
+**N-08 (Low) Reserved markers.** An authored value equal to
+`{"__spool_blob__": "<hash>"}` is read back as a storage reference; the save
+commits and then every `get` fails. Escaping or rejecting reserved keys on write
+changes what imports accept.
+
+**N-09 (Low) Unpinned publish action.** `publish.yml` runs
+`Comfy-Org/publish-node-action@main` with `REGISTRY_ACCESS_TOKEN`. Pin it to a
+commit SHA. This was not changed here, because the workflow holds a secret and
+publishes releases.
+
+**N-10 (Low) Demo delete-takes.** The host also removes media-pool records that
+share the deleted file, and refuses to delete generation inputs; the demo does
+neither (demo `["media-b"]`, host `["media-b", "pool-1"]`). Mirror the rules in
+`pages/demo-api.js` and `tests/demo_api_checks.mjs`, or document the simplification.
+
+**N-11 (Low) Frozen copies of a rejected request.** Inputs are frozen before later
+items are validated; three rejected requests left three copies in
+`input/spool-frozen/`. Validating every item before freezing would change the
+order in which errors are reported.
+
+## Unconfirmed
+
+- **U-01:** the 30 s uncertainty timer starts at attempt creation, not at
+  submission (review-only).
+- **U-02:** on Windows, SQLite opens files without delete sharing, so a long
+  dry-run report may block a live publish beyond its retry window. Not testable
+  here.
+- **U-03:** `web/template-browser.js` accepts any loopback origin as its parent.
+  It needs ComfyUI to test.
+- **U-04:** the exception type is certain; whether real exports exceed 180 s was
+  not measured.
+
+## Improvements not done
+
+These are not demonstrated defects:
+
+- **Request fields.** Missing request fields (`data["revision"]`,
+  `X-Spool-Revision`) answer 500 `internal_error` instead of 400.
+- **Cloud and collection.**
+  - The Cloud loop's `gather` has no `return_exceptions`, so one failed observation
+    lets the next pass overlap the others.
+  - `POST /reconcile` scans alongside the loop without a lock.
+  - `DeadlineAdapter.recover`'s `RuntimeError` reaches the route as a 500.
+- **Cloud settings.**
+  - `COMFY_BASE_URL` accepts `http://` for remote hosts.
+  - `key_status` reports `saved` for an empty key file.
+- **Leftover files.**
+  - `stage_input` leaves its `.partial` file on failure.
+  - `collect` uses a fixed `.partial` name.
+  - A failed export mux leaves a partial MP4.
+  - Comparison PNGs accumulate in `exports/`.
+  - `interchange.py` writes with a plain `replace`.
+  - Atomic renames never fsync the directory.
+- **Media tools.**
+  - Windows text-mode subprocesses decode ffmpeg output with the locale code page.
+  - `-force_key_frames` for about 1,800 cuts exceeds Windows' command-line limit.
+  - `-fps_mode` needs ffmpeg 5.1 or newer, which is not documented.
+  - `media._rate` would divide by zero on `0/0`; `timing.rate` is safer.
+- **Event loop.** The launcher runs SQLite and file globbing on the event loop.
+- **Storage housekeeping.**
+  - `ProjectStore.reading()` holds the per-project read lock for the whole read.
+  - `blobs` is never garbage-collected.
+  - `cancellation_done` opens a writer connection just to read.
+  - `derived_storage` reports backups at the root, not `.spool/backups`.
+  - `reclaim` can report a negative `reclaimed` value.
+- **Import.**
+  - `import_project` creates `0700` folders with generic names.
+  - A failed import leaves its cache folder behind.
+- **Path containment.** `contained()` is lexical: a symlink inside a project folder
+  can point outside it.
+- **Studio.**
+  - The escaping check covers ID, number and track fields; turning the
+    reviewer's general concatenation scan into a gate check would cover more.
+  - The studio has three copies of `esc`.
+  - The flush error shown in the delete dialog says "before queueing or capturing".
+- **Demo.** `pages/serve.py` answers an inverted byte range with a negative
+  `Content-Length` (local dev tool only).
+- **Repository policy.** AGENTS.md keeps outstanding work in GitHub issues. The
+  _Needs decision_ items could be filed as issues if this report should not stay
+  in the repository.
+
+## Final test run
+
+Baseline on `main` (`7caf5c9`): 80 of 81 gate commands passed. `test_take_files`
+failed `test_open_clip_folder_uses_stable_identity_and_supports_empty_shots`
+because this sandbox has no `xdg-open` (F-28).
+
+Final run on the branch, after the last commit:
+
+```text
+$ python3 tests/run_architecture_checks.py
+… 82 commands run (ruff format/check, Prettier, ESLint, knip, tsc,
+  editor_contract_checks.py, 35 *_checks.mjs, 40 test_*.py files)
+exit 0 — 454 Python tests OK, 8 skipped:
+  5 need ComfyUI-Deadline-Plugin checked out beside the Spool checkout
+  2 UNC paths are a Windows path form
+  1 Windows streaming workaround
+real 1m35.7s
+```
+
+Environment: Linux, Python 3.13.18, Node 22.23.4, ffmpeg from the distribution,
+aiohttp 3.14.5, comfy-sdk 0.5.0.
diff --git a/docs/dev/architecture.md b/docs/dev/architecture.md
index 03c9c64..181f5fa 100644
--- a/docs/dev/architecture.md
+++ b/docs/dev/architecture.md
@@ -73,6 +73,17 @@ Storage and project-folder work runs off ComfyUI's event loop through
 the published snapshot, import proxies and other referenced media. Playback cache
 keys include source path/size/mtime, project size/FPS and the cache format version.
 The preview route enqueues work and returns preparing until its local file is ready.
+Launcher probes, status and startup use cancellation-draining workers for their
+SQLite and filesystem work, including process creation. Startup reservation and
+spawn stay in one worker. Status/error writers replace only the launch state
+they observed, so a delayed worker cannot overwrite a newer reservation.
+
+Cancellation preflight reads the acknowledgement through the immutable read
+generation. Planning and recording delivery still use their writer transactions.
+FFmpeg text diagnostics use UTF-8 with replacement for invalid bytes, independent
+of the host locale; subprocess failure types and timeouts remain unchanged.
+Comparison sheets extract frames in a private temporary directory and retain
+only the returned sheet. Explicit frame exports remain durable user outputs.
 
 ## Project format
 
@@ -86,7 +97,9 @@ imports reject unknown export versions before creating a destination.
 
 `store.py` owns ordered, numbered migration steps. Each commits its data and
 version together, version last; a failed step rolls back and can run again.
-Completed earlier steps remain committed. Released steps are frozen: changes
+Completed earlier steps remain committed in that database; a project folder
+publishes its upgraded working copy only after every step succeeds, so a failure
+leaves the published snapshot at its old version. Released steps are frozen: changes
 require a new number. Before upgrading a folder, Spool copies its last published
 snapshot to `.spool/backups/project-schema<old>-<UTC timestamp>.spool`. Schema 6
 packs existing evidence, then compacts through the existing local-cache path
@@ -142,6 +155,23 @@ lock. Only a changed published signature refreshes it under the share lock;
 writers serialize working-copy refresh/replacement with a different local lock.
 A writer can publish while an existing reader finishes its older generation.
 
+Each newly published snapshot contains an additive `spool_publication` table
+with a fresh publication UUID. The marker is written into the copied database
+before it is fsynced and atomically replaces `project.spool`; it travels with the
+snapshot even if manifest publication is interrupted. Change detection combines
+the marker with timestamp, size and file identity. Unchanged high-resolution
+file identities cache the marker; coarse timestamps re-read it. Legacy snapshots
+without the table remain readable and gain it on their next new-version save.
+Marker reads hold the project lock until their SQLite handle closes, so they
+cannot obstruct a concurrent snapshot replacement on Windows. An unreadable
+identity fails the operation instead of authorizing reuse of an older runtime.
+The manifest, document, API and SQLite schema-version number are unchanged.
+Older writers preserve the marker but do not refresh it; mixed-version detection
+then relies on the replacement file's identity.
+Failed project imports clean their exclusively created destination and new local
+working cache. Cleanup preserves pre-existing caches and refuses redirected or
+uninspectable paths; a denied cleanup retains the original import failure.
+
 Receipt scans visit pending attempts every two seconds and settled history every
 five minutes (also on collector startup). Folder scans cache projection/inventory
 at a revision/event cursor and recheck both inside the save transaction. Collected
@@ -154,6 +184,24 @@ and cross-directory moves become new takes. Changed bytes at an indexed path
 create a new take; the old record points to a missing source instead of silently
 playing the replacement. Renames/replacements discard old file-owned evidence.
 
+Manual reconciliation, local result observation and Cloud receipt ingestion use
+the same collector's per-project thread lock as periodic scans. File collection
+for one project cannot reuse another worker's partial files; other projects have
+independent locks. Cancellation drains these storage workers before their
+executor lock or lifecycle ownership is released, including repeated cancellation.
+Local, Deadline and Cloud artifact copies use unique sibling temporary files,
+including when independent workspaces collect into the same project. Publication
+uses the common replacement retry; cleanup removes only the operation's own
+temporary file and retains an original failure if cleanup is denied. This file
+ownership does not serialize separate collectors' receipt or ledger decisions.
+
+Deadline's 30-second missing-acknowledgment grace starts when collection first
+observes the durable `submitting.json` marker written immediately before the
+external call. Queued time, validation and staging do not consume it. Restarting
+the collector grants fresh grace. An observed marker remains evidence if share
+files disappear; a never-observed missing marker stays pending conservatively.
+Recovery does not automatically submit another job.
+
 Once daily, collection expires events and operation/result payloads older than
 30 days, retaining each project's latest event cursor and cancellation effects whose
 delivery is unconfirmed or whose attempt is still active. Operation ID/project/digest tombstones live forever: expired retries
@@ -161,12 +209,19 @@ return an operation conflict and never execute again. Attempt ownership rows
 expire with old terminal attempts. Attempts, dispatches and execution receipts
 remain evidence for recovery and deduplication; they are not diagnostic logs.
 No Python/JavaScript authored document fields or wire versions change.
-Maintenance reports open immutable read-only snapshots: no migrations, directory
-creation, cache refresh or take-file recovery.
+Maintenance reports scan immutable read-only snapshots in private temporary
+directories, removed after the report. They do not migrate, create project
+directories, refresh the workspace cache or recover take files. Copying holds an
+existing project lock until the source handle closes; SQLite then opens only the
+private copy, letting writers publish during long scans on Windows. Read-only
+inspection never creates a lock. A legacy folder without one can still briefly
+obstruct Windows replacement while the source is being copied.
 
 `durable.py` owns unique temporary files, flush/fsync, atomic replacement with
 SMB retry, and failure cleanup for JSON receipts, take sidecars, farm JSON and
 manifests. `ownership.atomic_replace` reexports the same replacement primitive.
+OTIO exports use the same replacement retry and exclusively created pending
+files, cleaning only their own unfinished file after a failure.
 Deadline submissions copy the stdlib-only helper beside their worker protocol.
 Local `receipt.json` writes use schema 2 and `primaryArtifactId`; collection still
 verifies schema 1 from older executions. Farm protocol 2 already uses that
diff --git a/docs/dev/demo.md b/docs/dev/demo.md
index b1ac9d5..74d045e 100644
--- a/docs/dev/demo.md
+++ b/docs/dev/demo.md
@@ -40,6 +40,12 @@ saved under both the escaped and the unescaped path.
 The fake mirrors five host replies: the project, the unchanged-project poll, the
 save, take deletion and Use take. If one of those routes changes shape, change
 `pages/demo-api.js` and `tests/demo_api_checks.mjs` in the same commit.
+The simulated mutations also match the host's required-field validation: missing
+fields are `400 invalid_request`; a supplied stale revision remains a conflict.
+Supported saves also mirror the host's structural checks for document, clip,
+take and capture containers, including input-recovery lists. Executable graph
+meaning and input preparation remain host responsibilities. Demo take-value
+validation errors carry the same `invalid_request` code as the host.
 
 ## Recording the project
 
diff --git a/docs/dev/development.md b/docs/dev/development.md
index f941c06..b2e415f 100644
--- a/docs/dev/development.md
+++ b/docs/dev/development.md
@@ -27,7 +27,7 @@ python -m pip install -r ComfyUI/custom_nodes/Spool/requirements.txt
 ```
 
 The checks need Python 3.11+ (3.12 is used in development) with aiohttp and
-Pillow, Node 24, and `ffmpeg` and `ffprobe` on PATH. Browser checks also need
+Pillow, Node 24, and `ffmpeg` and `ffprobe` 5.1 or newer on PATH. Browser checks also need
 Chrome or Edge. Install the formatter and linters once per checkout or worktree:
 
 ```powershell
@@ -101,6 +101,15 @@ fails on any page exception. Without names it runs every check except the opt-in
 profiles (`workflow-project-profile`, `workflow-capture-bundle`); check names are
 the keys of `CHECKS` in `tests/run_browser_checks.cjs`.
 
+`native-take-delete-flush` checks permanent deletion while a save is pending,
+after an injected save failure, and after retry. Successful saves and deletion
+reach the test host; the runner also checks media/workflow files on disk.
+`native-take-export-download` clicks the real OTIO download link, waits for
+Chrome's completed-download event, and compares parsed bytes with the host's
+export. Its failure cases distinguish injected network failures from an HTTP
+400 produced by sending an empty export plan. Evidence includes screenshots,
+download events, completed files and the observed blob URL lifecycle.
+
 `embedded-templates-live` uses the installed native Comfy chooser. Wait for its
 search indicator to settle before clicking a result: frontend 1.57 debounces
 search and cancels pending template preparation when the results change, even
diff --git a/docs/dev/durable-names.md b/docs/dev/durable-names.md
index 603c35d..e094698 100644
--- a/docs/dev/durable-names.md
+++ b/docs/dev/durable-names.md
@@ -17,6 +17,7 @@ against `spool.__version__`; protocol fixtures pin API and bridge versions.
 | Template modes `embedded`, `prepare`; messages `spool-template-request`, `spool-template-state`, `spool-prepare-template`, `spool-template-preparation` | `ui/bridge.js` |
 | Browser bridge identity `spool-comfy-bridge` | `ui/bridge.js` (session storage) |
 | `project.spool`, `.spool/project.lock`, `app.sqlite3` | `spool/projects.py`, `spool/store.py` |
+| Additive snapshot table `spool_publication` | `spool/projects.py` |
 | Project `input/images`, `input/audio`, `input/video`, `output` (per-clip output folders), `.spool/previews`, `.spool/receipts` | `spool/projects.py` |
 | `receipt.json` | `spool/receipts.py`, `spool/farm_protocol.py` |
 | Media-stem `.json` sidecars | `spool/sidecars.py` |
@@ -24,8 +25,8 @@ against `spool.__version__`; protocol fixtures pin API and bridge versions.
 | Environment `SPOOL_STORAGE`, `SPOOL_CREDENTIALS`, `COMFY_API_KEY`, `COMFY_BASE_URL` | `spool/__main__.py`, root `__init__.py`, `spool/credentials.py`, `spool/cloud.py` |
 | Pending envelopes `spool-native-<project ID>:queue-request`, `spool-native-<project ID>:experiment-request` | `ui/editor.js`, `ui/generation.js` (session storage) |
 
-The parallel project-storage lane plans a `project.json` manifest inside project
-folders; treat that name as durable when the format lands. Do not rename pending
+Project folders hold a `project.json` manifest (`spool/projects.py`); treat its
+name and fields as durable. Do not rename pending
 envelope keys casually: losing an operation ID can cause duplicate submissions
 after an uncertain reply. The same compatibility rule covers error codes,
 command action/capability names and the exact-integer tag `__spool_int__`.
diff --git a/docs/guide/automation.md b/docs/guide/automation.md
index 760ffc2..a820bf9 100644
--- a/docs/guide/automation.md
+++ b/docs/guide/automation.md
@@ -163,6 +163,10 @@ Read `code`, not message text: `not_found` (404), `invalid_request` (400),
 changed: a sidecar write can fail after a commit. Inspect state and reuse the
 identical operation envelope when retrying uncertain operations.
 
+Deadline recovery lookup failures use `unavailable` (503). Retry the same
+`recover_submission` envelope when Deadline is reachable again; successful
+lookup still verifies the existing job's submission and attempt identity.
+
 The studio sends `X-Spool-Api-Version` on every HTTP request. A mismatching
 version blocks writes and asks for a reload while keeping the tab's draft.
 Versionless requests from the CLI, agents and curl remain supported. A bridge
@@ -170,7 +174,8 @@ version mismatch asks you to reload the ComfyUI page. These rules apply both
 inside ComfyUI and standalone, independently of local, Cloud or Deadline targets.
 
 The CLI writes JSON errors to stderr and returns 1, including `network_error`,
-`http_error` for non-JSON HTTP failures, and `invalid_response` for invalid JSON.
+`http_error` for non-JSON HTTP failures, `invalid_response` for invalid JSON, and
+`invalid_request` for a command file it cannot read or parse.
 
 ### Public routes
 
diff --git a/docs/guide/deadline.md b/docs/guide/deadline.md
index 442bc51..1f57a26 100644
--- a/docs/guide/deadline.md
+++ b/docs/guide/deadline.md
@@ -51,8 +51,10 @@ On the worker, that script:
 Job scripts follow Deadline's
 [pre- and post-job/task script](https://docs.thinkboxsoftware.com/products/deadline/10.4/1_User%20Manual/manual/job-scripts.html)
 contract. Submission files live under
-`<project output>/spool-submissions/<submissionId>/` and receipts under
-`spool-receipts/`.
+`<result root>/spool-submissions/<submissionId>/` and receipts under
+`<result root>/spool-receipts/`. For a project folder the result root is the
+project's `.spool/deadline` folder; otherwise it is the submit node's output
+directory.
 
 ## Collecting results
 
diff --git a/docs/guide/editing.md b/docs/guide/editing.md
index 18e8740..5910ab8 100644
--- a/docs/guide/editing.md
+++ b/docs/guide/editing.md
@@ -150,8 +150,10 @@ The **Media** tab lists the project's footage, images and audio, with filters,
 search and grid or list views.
 
 - **Import footage…** adds files. Drop files onto the sidebar or the timeline.
-- **Project → Import video from path…** reads a video where it is, without copying
-  it, and splits it at detected hard cuts. Each shot becomes a clip whose first
+- **Project → Import video from path…** copies a video into the project's
+  `input/video/` folder and splits it at detected hard cuts. Its original-file
+  references are project-relative, so they remain valid when the project moves.
+  Each shot becomes a clip whose first
   take is **Original clip**; the source audio goes once on A2.
 - **Detect cuts in selected clip…** (in **Project**, or a clip's right-click menu)
   finds hard cuts inside the clip, shows the count and splits on request.
@@ -171,6 +173,10 @@ seconds of 25 fps footage (125 frames) plays in 4.17 seconds on a 30 fps timelin
 Linked audio follows the speed change with its pitch preserved. Original files
 are never changed.
 
+Joined extension copies also retime their own audio and apply the measured
+frame alignment. Newly imported media reports its displayed orientation, including
+rotated videos and EXIF-oriented images; saved records are not re-described.
+
 ## Export
 
 **Export** writes an MP4 of the sequence with its audio mix.
diff --git a/docs/guide/generation.md b/docs/guide/generation.md
index fc3ea2f..6093c3b 100644
--- a/docs/guide/generation.md
+++ b/docs/guide/generation.md
@@ -166,6 +166,11 @@ before sending it. Results are copied into the clip's folder and checked against
 that record before they become takes. New takes never replace the take in the
 edit.
 
+Spool checks all batch items and their input sources before creating frozen
+copies. Fix any reported input or clip error, then submit the batch again.
+New clip output folder names are distinct even on disks that ignore case;
+previously assigned folders are kept when you rename a clip.
+
 Queue requests use the same defaults in embedded and standalone Spool: an
 omitted count means one take. An explicit empty item list is rejected rather
 than replaced with another selection. Scoped experiments use the same item form.
@@ -200,6 +205,9 @@ path and execution record.
 - **Retry submission** appears only when Spool could not confirm a submission.
   **Find existing Deadline job** looks for a farm job that was accepted before
   the connection was lost. Neither starts a second render.
+  If the lookup is temporarily unavailable, retry it when Deadline is reachable.
+  Deadline's confirmation grace excludes time waiting in the queue or preparing
+  inputs. A slow preparation does not by itself make submission uncertain.
 - **Retry collection** appears when a finished render could not be collected.
 - **Clear from queue** and **Clear finished** tidy the list. Takes, files and
   records stay. Dismissing a failed take on the take rail clears it here too.
@@ -251,7 +259,8 @@ render, and agents act on them only when asked.
   and VHS_LoadVideo. Other loaders with file inputs are refused. Models and
   custom-node dependencies must already be installed where the render runs.
 - **Results.** Spool collects SaveImage, PreviewImage, SaveVideo and
-  VHS_VideoCombine video outputs. VHS `meta_batch` is not supported.
+  VHS_VideoCombine video outputs. VHS `meta_batch` is not supported. Comfy Cloud
+  renders return video only, so a Cloud workflow needs a SaveVideo result.
 - **Old takes.** Opening the workflow of an imported or historical take does not
   map its saved values back into widgets; its exact recorded workflow stays
   available.
diff --git a/docs/guide/projects.md b/docs/guide/projects.md
index f8bce29..65c5d74 100644
--- a/docs/guide/projects.md
+++ b/docs/guide/projects.md
@@ -81,7 +81,7 @@ ComfyUI as ComfyUI Desktop makes, and open the studio at
 python -m spool --open
 ```
 
-Either way you need Python 3.11+ with aiohttp and Pillow, and ffmpeg on PATH. Inside `ComfyUI/custom_nodes`, it uses the same settings
+Either way you need Python 3.11+ with aiohttp and Pillow, and ffmpeg/ffprobe 5.1 or newer on PATH. Inside `ComfyUI/custom_nodes`, it uses the same settings
 folder as the ComfyUI extension (`ComfyUI/user/spool`). Options: `--open`, `--port`,
 `--storage` (or `SPOOL_STORAGE`) for the settings folder, and `--host`. See
 [Security and network access](security.md) before changing the host.
@@ -115,6 +115,9 @@ no clip uses, including obsolete playback copies from older versions in
 window still apply. `reclaim` also compacts the project
 database and publishes a new snapshot.
 
+Dry runs read a temporary local copy, so a long report can finish while another
+editor saves. They leave the project files unchanged.
+
 ## Diagnostics
 
 The status in the top bar shows the current operation and how long it has taken.
diff --git a/docs/guide/security.md b/docs/guide/security.md
index 64fc5a4..3591313 100644
--- a/docs/guide/security.md
+++ b/docs/guide/security.md
@@ -1,5 +1,9 @@
 # Security and network access
 
+Imported or authored JSON cannot contain a dictionary whose only key is
+`__spool_blob__`. That shape is reserved for internal evidence references.
+Spool rejects it before saving and retains the previous project revision.
+
 Spool has no user accounts. Who can use it depends on who can reach the port of
 the ComfyUI it runs in, or of `python -m spool`.
 
@@ -19,7 +23,8 @@ does not apply.
 - revealing a take or clip folder in the file manager
 - Comfy connection settings and the Cloud API key
 - starting ComfyUI
-- serving original footage, or any footage stored outside the project and Comfy folders
+- serving original footage, or any footage stored outside the project and Comfy folders,
+  and comparing takes or detecting cuts in that footage
 - preparing playback and exporting frames
 
 A request to them must come from a loopback address. It must also use a loopback
diff --git a/pages/demo-api.js b/pages/demo-api.js
index a9d2589..36fe290 100644
--- a/pages/demo-api.js
+++ b/pages/demo-api.js
@@ -52,6 +52,97 @@
   }
   const conflict = () =>
     reply(409, { error: 'This project changed. Reload to see it.', code: 'revision_conflict', current: copy(project) });
+  const invalid = error => reply(400, { error, code: 'invalid_request' });
+  const object = value => value !== null && typeof value === 'object' && !Array.isArray(value);
+  function objectRows(value, field, ...keys) {
+    if (!Array.isArray(value) || value.some(row => !object(row))) return field + ' must be a list of JSON objects';
+    if (value.some(row => keys.some(key => typeof row[key] !== 'string')))
+      return field + ' entries need string fields: ' + keys.join(', ');
+    return null;
+  }
+  // Match the host's save-container boundary; preparation and graph meaning stay on the host.
+  function saveShape(document, recipes) {
+    if (!object(document) || !Array.isArray(document.clips))
+      return 'Project document must be an object with a clips list';
+    for (const [field, keys] of [
+      ['clips', ['id']],
+      ['media', ['id']],
+      ['audioClips', []],
+      ['importedWorkflows', []],
+    ]) {
+      const error = objectRows(Object.hasOwn(document, field) ? document[field] : [], 'Document ' + field, ...keys);
+      if (error) return error;
+    }
+    for (const clip of document.clips) {
+      for (const [field, keys] of [
+        ['takes', ['id']],
+        ['bindings', ['key']],
+      ]) {
+        const error = objectRows(Object.hasOwn(clip, field) ? clip[field] : [], 'Clip ' + field, ...keys);
+        if (error) return error;
+      }
+      for (const take of clip.takes || [])
+        if (!object(take.media) || typeof take.media.id !== 'string')
+          return 'Take media must be a JSON object with an id';
+      if (Object.hasOwn(clip, 'inputValues') && !object(clip.inputValues))
+        return 'Clip inputValues must be a JSON object';
+    }
+    if (!object(recipes)) return 'workflowRecipes must be a JSON object';
+    for (const capture of Object.values(recipes)) {
+      if (!object(capture)) return 'The captured workflow must be a JSON object';
+      const error = objectRows(
+        Object.hasOwn(capture, 'bindings') ? capture.bindings : [],
+        'Capture bindings',
+        'key',
+        'nodeId',
+        'input',
+      );
+      if (error) return error;
+      for (const field of ['provenance', 'result', 'inputRecovery'])
+        if (Object.hasOwn(capture, field) && !object(capture[field]))
+          return 'Capture ' + field + ' must be a JSON object';
+      if (
+        Object.hasOwn(capture, 'inputRecovery') &&
+        Object.hasOwn(capture.inputRecovery, 'recovered') &&
+        !Array.isArray(capture.inputRecovery.recovered)
+      )
+        return 'Capture inputRecovery.recovered must be a list';
+      if (Object.hasOwn(capture, 'result') && typeof capture.result.nodeId !== 'string')
+        return 'Capture result needs a string nodeId';
+      const builtin = capture.provenance?.builtinTemplate;
+      if (builtin != null && typeof builtin !== 'string') return 'Capture builtinTemplate must be a string';
+      const graphs = capture.workflow == null ? [] : [capture.workflow];
+      while (graphs.length) {
+        const graph = graphs.pop();
+        if (!object(graph)) return 'Capture workflow must be a JSON object';
+        const nodes = Object.hasOwn(graph, 'nodes') ? graph.nodes : [];
+        const nodeError = objectRows(nodes, 'Workflow nodes', 'type');
+        if (nodeError) return nodeError;
+        if (nodes.some(node => !Object.hasOwn(node, 'id'))) return 'Workflow nodes need an id';
+        const definitions = Object.hasOwn(graph, 'definitions') ? graph.definitions : {};
+        if (!object(definitions)) return 'Workflow definitions must be a JSON object';
+        const subgraphs = Object.hasOwn(definitions, 'subgraphs') ? definitions.subgraphs : [];
+        const subgraphError = objectRows(subgraphs, 'Workflow subgraphs', 'id');
+        if (subgraphError) return subgraphError;
+        graphs.push(...subgraphs);
+      }
+    }
+    return null;
+  }
+  function requiredBody(body, ...fields) {
+    let value;
+    try {
+      value = JSON.parse(body);
+    } catch {
+      return { error: invalid('Request body must be valid JSON') };
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+      return { error: invalid('Request body must be a JSON object') };
+    for (const field of fields)
+      if (!Object.hasOwn(value, field))
+        return { error: invalid('Request body is missing the required ' + field + ' field') };
+    return { value };
+  }
   function recorded(method, path) {
     const value = replies[method + ' ' + path];
     if (value === undefined) return null;
@@ -73,44 +164,97 @@
     const deleted = new Set(document.deletedTakeIds || []);
     for (const clip of document.clips)
       clip.takes = [
-        ...clip.takes.filter(t => !t.generated),
+        ...(clip.takes || []).filter(t => !t.generated),
         ...generated.filter(a => !deleted.has(a.takeId) && owns(clip, a)).map(a => copy(a.take)),
       ];
     return document;
   }
-  const files = media => [media?.originalFile, media?.file, media?.poster].filter(Boolean);
+  const filePath = value => {
+    if (typeof value !== 'string' || !value) return null;
+    let path = value;
+    try {
+      path = decodeURIComponent(path);
+    } catch {
+      // A literal percent sign is valid in a recorded file name.
+    }
+    path = path.replaceAll('\\', '/');
+    const parts = [];
+    for (const part of path.split('/')) {
+      if (!part || part === '.') continue;
+      if (part === '..' && parts.length && parts.at(-1) !== '..') parts.pop();
+      else parts.push(part);
+    }
+    return (path.startsWith('/') ? '/' : '') + parts.join('/');
+  };
+  const original = media => filePath(media?.originalFile || media?.file);
+  const sidecar = path => (path ? path.replace(/\.[^/.]+$/, '') + '.json' : null);
+  const files = media =>
+    [...new Set([media?.originalFile, media?.file, media?.poster].map(filePath)), sidecar(original(media))].filter(
+      Boolean,
+    );
 
   // Delete takes as the host does: never the take in the edit, then record the
   // deletion so the takes stay gone. Nothing is on disk to remove.
   function deleteTakes(clipId, body) {
     const clip = project.document.clips.find(c => c.id === clipId),
-      ids = body.takeIds;
-    if (!clip || !Array.isArray(ids) || !ids.length) return reply(400, { error: 'Select the takes to delete' });
+      requested = body.takeIds;
+    if (!clip || !Array.isArray(requested) || !requested.length || requested.some(id => typeof id !== 'string'))
+      return invalid('Select the takes to delete');
+    const ids = [...new Set(requested)].sort();
     const hidden = new Set(clip.hiddenTakeIds || []);
     const available = new Map(clip.takes.filter(t => !t.placeholder && !hidden.has(t.id)).map(t => [t.id, t]));
-    if (!ids.every(id => available.has(id)))
-      return reply(400, { error: 'Some selected takes are no longer available' });
+    if (!ids.every(id => available.has(id))) return invalid('Some selected takes are no longer available');
     if (ids.includes(clip.takeId))
-      return reply(400, { error: 'The take in the edit is kept. Choose another take before deleting it.' });
+      return invalid('The take in the edit is kept. Choose another take before deleting it.');
     const document = project.document;
+    const originals = new Set(ids.map(id => original(available.get(id).media)));
+    if (
+      [...originals].some(
+        path =>
+          !/^(output|input|\.spool)\//.test(path || '') ||
+          !/\.(mp4|mov|webm|mkv|m4v|png|jpg|jpeg|webp|wav|mp3|m4a|aac|ogg|flac|opus)$/i.test(path),
+      )
+    )
+      return invalid('Delete from disk only manages media owned by this project; archive this take instead.');
+    // Match the host's deletion plan: original, sidecar and project preview files.
+    // Other referenced files are protected but are not automatically deleted.
+    const selected = new Set([...originals, ...[...originals].map(sidecar)]);
+    for (const id of ids)
+      for (const path of files(available.get(id).media)) if (path.startsWith('.spool/previews/')) selected.add(path);
     // A file another take or timeline audio still uses stays: a split shares its takes.
-    const selected = new Set(ids.flatMap(id => files(available.get(id).media)));
     for (const other of document.clips)
       for (const take of other.takes || [])
         if (!(other.id === clipId && ids.includes(take.id)) && files(take.media).some(f => selected.has(f)))
-          return reply(400, {
-            error:
-              'A selected file is also used by another take in ' +
-              (other.name || 'this clip') +
-              '. Archive it instead.',
-          });
+          return invalid(
+            'A selected file is also used by another take in ' + (other.name || 'this clip') + '. Archive it instead.',
+          );
     if ((document.audioClips || []).some(a => files(a.media).some(f => selected.has(f))))
-      return reply(400, { error: 'A selected file is used by timeline audio. Archive it instead.' });
+      return invalid('A selected file is used by timeline audio. Archive it instead.');
+    for (const other of document.clips)
+      for (const binding of other.bindings || []) {
+        const value = other.inputValues?.[binding.key];
+        if (!binding.asset || typeof value !== 'string') continue;
+        const staged = value.startsWith('spool-projects/')
+          ? value
+              .replace(/ \[input\]$/, '')
+              .split('/')
+              .slice(2)
+              .join('/')
+          : null;
+        const candidate = staged ? filePath(staged) : /^(\/|[A-Za-z]:[\\/])/.test(value) ? filePath(value) : null;
+        if (originals.has(candidate)) return invalid('A selected file is a generation input. Archive it instead.');
+      }
+    const mediaIds = new Set(ids.map(id => available.get(id).media?.id).filter(Boolean));
+    for (const media of document.media || [])
+      if (files(media).some(path => selected.has(path))) {
+        if (!originals.has(original(media)))
+          return invalid('A selected file is shared with another media-pool asset. Archive it instead.');
+        if (media.id) mediaIds.add(media.id);
+      }
     document.deletedTakeIds = [...new Set([...(document.deletedTakeIds || []), ...ids])].sort();
-    document.deletedMediaIds = [
-      ...new Set([...(document.deletedMediaIds || []), ...ids.map(id => available.get(id).media?.id).filter(Boolean)]),
-    ].sort();
+    document.deletedMediaIds = [...new Set([...(document.deletedMediaIds || []), ...mediaIds])].sort();
     clip.takes = clip.takes.filter(t => !ids.includes(t.id));
+    document.media = (document.media || []).filter(media => !mediaIds.has(media.id));
     changed();
     return reply(200, { project: copy(project), deleted: ids, pendingFiles: 0 });
   }
@@ -125,10 +269,9 @@
     if (!clip) return reply(404, { error: 'Clip not found' });
     const take = clip.takes.find(t => t.id === takeId && !t.placeholder);
     if (!take || ((clip.hiddenTakeIds || []).includes(takeId) && takeId !== clip.takeId))
-      return reply(400, { error: 'This take is no longer available for the shot' });
+      return invalid('This take is no longer available for the shot');
     const takeBase = capture?.provenance?.takeBase;
-    if (capture && takeBase?.takeId !== takeId)
-      return reply(400, { error: 'Generation setup must belong to the chosen take' });
+    if (capture && takeBase?.takeId !== takeId) return invalid('Generation setup must belong to the chosen take');
     timeline.chooseTake(project.document, clipId, takeId);
     clip.generationBase = takeBase || { takeId, source: 'No executable metadata' };
     for (const field of ['workflow', 'shotInputs', 'seedKey']) delete clip[field];
@@ -164,7 +307,13 @@
       return reply(200, copy(project));
     }
     if (method === 'PUT' && path === PROJECT) {
-      const value = JSON.parse(body);
+      const { value, error } = requiredBody(body, 'revision', 'document');
+      if (error) return error;
+      const shapeError = saveShape(
+        value.document,
+        Object.hasOwn(value, 'workflowRecipes') ? value.workflowRecipes : {},
+      );
+      if (shapeError) return invalid(shapeError);
       if (value.revision !== project.revision) return conflict();
       // The studio leaves out jobs, which the host owns and adds back to every reply.
       project.document = attach({ ...value.document, jobs: project.document.jobs });
@@ -174,13 +323,15 @@
     if (method === 'POST' && path.startsWith(PROJECT + '/focus/')) return reply(200, { ok: true });
     const deletion = method === 'POST' && path.match(/^projects\/[^/]+\/delete-takes\/([^/]+)$/);
     if (deletion) {
-      const value = JSON.parse(body);
+      const { value, error } = requiredBody(body, 'revision', 'takeIds');
+      if (error) return error;
       if (value.revision !== project.revision) return conflict();
       return deleteTakes(decodeURIComponent(deletion[1]), value);
     }
     const use = method === 'POST' && path.match(/^projects\/[^/]+\/use-take\/([^/]+)$/);
     if (use) {
-      const value = JSON.parse(body);
+      const { value, error } = requiredBody(body, 'revision', 'takeId');
+      if (error) return error;
       if (value.revision !== project.revision) return conflict();
       return useTake(decodeURIComponent(use[1]), value);
     }
diff --git a/pages/serve.py b/pages/serve.py
index 02c7f91..b09e43c 100644
--- a/pages/serve.py
+++ b/pages/serve.py
@@ -27,6 +27,7 @@ def translate_path(self, path):
         return super().translate_path("/" + clean[len(self.base) :])
 
     def send_head(self):
+        self.remaining = None
         path = self.translate_path(self.path)
         if os.path.isdir(path):
             path = os.path.join(path, "index.html")
@@ -34,10 +35,14 @@ def send_head(self):
         if not match or not os.path.isfile(path):
             return super().send_head()
         size = os.path.getsize(path)
-        start = int(match[1]) if match[1] else max(0, size - int(match[2] or 0))
-        end = min(int(match[2]), size - 1) if match[1] and match[2] else size - 1
-        if start >= size:
-            self.send_error(416)
+        if match[1]:
+            start = int(match[1])
+            end = min(int(match[2]), size - 1) if match[2] else size - 1
+        else:
+            start = max(0, size - int(match[2] or 0))
+            end = size - 1
+        if start >= size or end < start:
+            self.send_unsatisfiable_range(size)
             return None
         handle = open(path, "rb")
         handle.seek(start)
@@ -49,6 +54,12 @@ def send_head(self):
         self.remaining = end - start + 1
         return handle
 
+    def send_unsatisfiable_range(self, size):
+        self.send_response(416)
+        self.send_header("Content-Range", f"bytes */{size}")
+        self.send_header("Content-Length", "0")
+        self.end_headers()
+
     def copyfile(self, source, outputfile):
         remaining = getattr(self, "remaining", None)
         if remaining is None:
diff --git a/run_spool.bat b/run_spool.bat
index 16abc05..6633b1f 100644
--- a/run_spool.bat
+++ b/run_spool.bat
@@ -14,5 +14,7 @@ set "PY=%~dp0..\..\.venv\Scripts\python.exe"
 if exist "%PY%" goto run
 set "PY=python"
 :run
-"%PY%" %FLAGS% -m spool --open %*
+rem The portable build's python_embeded has a ._pth file, so Python leaves this folder
+rem off sys.path and "-m spool" alone cannot find Spool; add it before running.
+"%PY%" %FLAGS% -c "import runpy, sys; sys.path.insert(0, '.'); runpy.run_module('spool', run_name='__main__', alter_sys=True)" --open %*
 if errorlevel 1 pause
diff --git a/skills/spool-control/references/commands.md b/skills/spool-control/references/commands.md
index 3b2ae8f..1701edd 100644
--- a/skills/spool-control/references/commands.md
+++ b/skills/spool-control/references/commands.md
@@ -100,7 +100,8 @@ Read `code` rather than parsing message text: `invalid_request`, `not_found`,
 An error does not prove nothing changed: sidecar writes can fail after a commit.
 Inspect status before retrying, preserving the exact pending operation envelope.
 The CLI reports non-JSON HTTP failures as `http_error`, connection failures as
-`network_error`, and invalid JSON as `invalid_response` on stderr (exit 1).
+`network_error`, invalid JSON as `invalid_response`, and a command file it cannot
+read or parse as `invalid_request` on stderr (exit 1).
 Pass `--wire-json` to preserve tagged exact integers in machine stdout; the default
 prints readable integers. Versionless CLI/agent requests remain supported.
 
diff --git a/spool/__main__.py b/spool/__main__.py
index d81a199..81578d3 100644
--- a/spool/__main__.py
+++ b/spool/__main__.py
@@ -16,7 +16,8 @@
 from . import cli
 
 # Installed under ComfyUI/custom_nodes, the standalone editor shares the plugin's projects and Comfy's folders.
-COMFY = Path(__file__).resolve().parents[3]
+# A checkout outside custom_nodes may sit too close to the drive root to have one.
+COMFY = Path(__file__).resolve().parents[min(3, len(Path(__file__).resolve().parents) - 1)]
 
 
 def main():
diff --git a/spool/cli.py b/spool/cli.py
index 97f7615..75eed08 100644
--- a/spool/cli.py
+++ b/spool/cli.py
@@ -11,6 +11,18 @@
 from .wire import wire, unwire
 
 ACTIONS = {"status", "shot", "events", "focus", "command", "compare"}
+LOOPBACK = {"localhost", "127.0.0.1", "::1"}
+
+
+def urlopen(request, timeout):
+    """Reach a Spool on this computer directly, even when a proxy is set for other traffic.
+
+    urllib sends loopback requests to `http_proxy` unless `no_proxy` names them, and a
+    proxy cannot reach this computer's Spool or would make the request look remote.
+    """
+    if (urllib.parse.urlsplit(request.full_url).hostname or "").lower() in LOOPBACK:
+        return urllib.request.build_opener(urllib.request.ProxyHandler({})).open(request, timeout=timeout)
+    return urllib.request.urlopen(request, timeout=timeout)
 
 
 def run():
@@ -49,14 +61,21 @@ def run():
         if not args.file:
             parser.error("command requires --file")
         path += "/commands"
-        body = json.loads(sys.stdin.read() if str(args.file) == "-" else args.file.read_text(encoding="utf-8"))
+        try:
+            body = json.loads(sys.stdin.read() if str(args.file) == "-" else args.file.read_text(encoding="utf-8"))
+        except (OSError, UnicodeError, ValueError) as error:
+            print(
+                json.dumps({"error": "Could not read the command file: " + str(error), "code": "invalid_request"}),
+                file=sys.stderr,
+            )
+            return 1
     request = urllib.request.Request(
         args.url.rstrip("/") + path,
         data=json.dumps(wire(body)).encode() if body is not None else None,
         headers={"Content-Type": "application/json"},
     )
     try:
-        with urllib.request.urlopen(request, timeout=120) as response:
+        with urlopen(request, timeout=120) as response:
             value = json.load(response)
             if not args.wire_json:
                 value = unwire(value)
diff --git a/spool/cloud.py b/spool/cloud.py
index 789b630..d1b1466 100644
--- a/spool/cloud.py
+++ b/spool/cloud.py
@@ -23,6 +23,8 @@ class InvalidWorkflow(Exception):
 from .ownership import ExecutorLock, ExecutorBusy
 from .store import uid
 from .execution_targets import adapter_for
+from .media import unique_partial
+from .durable import atomic_replace
 
 
 FREE_TIER = "Running on Comfy Cloud needs a plan that allows API keys. To pay with Comfy credits instead, choose Execute on: Local ComfyUI · Partner Nodes."
@@ -87,11 +89,22 @@ async def storage_call(function, *args, **kwargs):
     # Cancellation must not leave a SQLite/file operation running after the
     # server releases its executor lock or closes the project workspace.
     task = asyncio.create_task(asyncio.to_thread(function, *args, **kwargs))
-    try:
-        return await asyncio.shield(task)
-    except asyncio.CancelledError:
-        await task
-        raise
+    cancelled = None
+    while True:
+        try:
+            result = await asyncio.shield(task)
+        except asyncio.CancelledError as error:
+            if task.cancelled():
+                raise
+            cancelled = cancelled or error
+        except BaseException as error:
+            if cancelled is not None:
+                raise cancelled from error
+            raise
+        else:
+            if cancelled is not None:
+                raise cancelled
+            return result
 
 
 class CloudExecutor:
@@ -197,19 +210,22 @@ async def collect(self, attempt, media, job, address):
         identity = uid()
         destination = await storage_call(media.result_path, attempt, identity, extension, True)
         await storage_call(destination.parent.mkdir, parents=True, exist_ok=True)
-        pending = destination.with_suffix(extension + ".partial")
+        pending = unique_partial(destination)
         try:
             await output.to_file(pending)
             await storage_call(
                 self.finish_download, attempt, media, job, address, output, identity, destination, pending
             )
         finally:
-            await storage_call(pending.unlink, missing_ok=True)
+            try:
+                await storage_call(pending.unlink, missing_ok=True)
+            except OSError:
+                pass  # Preserve the download or replacement failure if cleanup is denied.
 
     def finish_download(self, attempt, media, job, address, output, identity, destination, pending):
         if pending.stat().st_size != output.size_bytes:
             raise ValueError("Comfy Cloud video download is incomplete")
-        pending.replace(destination)
+        atomic_replace(pending, destination)
         selection = attempt["request"]["capture"]["result"]
         with destination.open("rb") as handle:
             checksum = hashlib.file_digest(handle, "sha256").hexdigest()
@@ -239,7 +255,24 @@ async def run_once(self):
                 for a in store.scan_attempts(target="cloud", pending_only=True)
             ]
         )
-        await asyncio.gather(*(self.observe(a) for a in pending))
+        # Let every observation settle before reporting a failure. An early return
+        # would orphan the rest of this batch while the lifecycle starts the next
+        # one, observing the same attempts concurrently.
+        results = await asyncio.gather(*(self.observe(a) for a in pending), return_exceptions=True)
+        failures = [result for result in results if isinstance(result, BaseException)]
+        if not failures:
+            return
+        control = next((error for error in failures if not isinstance(error, Exception)), None)
+        if control is not None:
+            errors = [error for error in failures if isinstance(error, Exception)]
+            if errors:
+                cause = ExceptionGroup("Spool Cloud observations failed before cancellation", errors)
+                logging.error("Spool Cloud observations failed before cancellation", exc_info=cause)
+                raise control from cause
+            raise control
+        if len(failures) == 1:
+            raise failures[0]
+        raise ExceptionGroup("Spool Cloud observation batch failed", failures)
 
     async def lifecycle(self, app):
         try:
@@ -265,4 +298,5 @@ async def run():
                 await task
             except asyncio.CancelledError:
                 pass
-            self.ownership.close()
+            finally:
+                self.ownership.close()
diff --git a/spool/collection.py b/spool/collection.py
index 641ab55..06a9029 100644
--- a/spool/collection.py
+++ b/spool/collection.py
@@ -2,10 +2,13 @@
 
 import asyncio
 import logging
+import os
 import subprocess
+import threading
 import time
 
 from . import attempts, joins, receipts, sidecars
+from .cloud import storage_call
 from .farm import FarmCollector
 from .folder_takes import FolderTakes
 from .store import Conflict
@@ -21,6 +24,16 @@ def __init__(self, store, media):
         self.history_checked = {}
         self.retained_at = {}
         self.playback_checkpoints = {}
+        self.project_locks = {}
+        self.project_locks_lock = threading.Lock()
+
+    def project_lock(self, store):
+        # Routes, local observations and Cloud ingestion share this collector.
+        # Lock the synchronous file work in its worker thread, per project; a
+        # cancelled await must not let another worker reuse its partial files.
+        key = os.path.normcase(os.path.abspath(store.root))
+        with self.project_locks_lock:
+            return self.project_locks.setdefault(key, threading.RLock())
 
     def annotate_progress(self, project):
         for job in project["document"]["jobs"]:
@@ -35,6 +48,10 @@ def annotate_progress(self, project):
 
     def ingest(self, attempt):
         store = self.store.for_project(attempt["project_id"])
+        with self.project_lock(store):
+            return self._ingest(store, attempt)
+
+    def _ingest(self, store, attempt):
         media = self.media.for_project(store, attempt["project_id"])
         observed = store.attempt(attempt["id"])["status"]
         if observed == attempts.COMPLETE:
@@ -61,6 +78,10 @@ def scan(self):
                 logging.exception("Spool project folder is temporarily unavailable: %s", store.root)
 
     def scan_project(self, store):
+        with self.project_lock(store):
+            self._scan_project(store)
+
+    def _scan_project(self, store):
         projects = store.list()
         project_id = projects[0]["id"] if projects else None
         media = self.media.for_project(store, project_id)
@@ -73,7 +94,17 @@ def scan_project(self, store):
             if attempts.target_of(attempt["request"]) == attempts.DEADLINE:
                 try:
                     farm.collect(attempt)
-                except (ValueError, KeyError, OSError, RuntimeError, subprocess.SubprocessError) as error:
+                # Submission files on the farm share may hold valid JSON of the wrong shape.
+                except (
+                    ValueError,
+                    KeyError,
+                    OSError,
+                    RuntimeError,
+                    subprocess.SubprocessError,
+                    TypeError,
+                    AttributeError,
+                    IndexError,
+                ) as error:
                     store.transition(
                         attempt["id"], attempts.COLLECTION_PENDING, error=str(error), expected=attempt["status"]
                     )
@@ -96,17 +127,19 @@ def scan_project(self, store):
 
     async def lifecycle(self, app):
         task = asyncio.create_task(self.run())
-        yield
-        task.cancel()
         try:
-            await task
-        except asyncio.CancelledError:
-            pass
+            yield
+        finally:
+            task.cancel()
+            try:
+                await task
+            except asyncio.CancelledError:
+                pass
 
     async def run(self):
         while True:
             try:
-                await asyncio.to_thread(self.scan)
+                await storage_call(self.scan)
             except Exception:
                 logging.exception("Spool receipt scan failed; evidence retained for retry")
             await asyncio.sleep(2)
diff --git a/spool/commands.py b/spool/commands.py
index 323e20a..d05d1a4 100644
--- a/spool/commands.py
+++ b/spool/commands.py
@@ -398,18 +398,20 @@ def execute(store, media, project_id, data):
         if attempt["project_id"] != project_id or attempt["clip_id"] not in scope.get("clipIds", []):
             raise ValueError("Attempt is outside the cancellation scope")
         submission = store.submission_for(attempt["id"])
-        with store.connect() as db:
+        with store.reading() as db:
             done = store.cancellation_done(db, attempt["id"])
         adapter = adapter_for(attempt["request"], submission)
         cancellation = asyncio.run(
             adapter.cancel(attempt, {"stage": "check", "submission": submission, "done": done})
         ).get("delivery")
     if action == "recover_submission":
-        attempt = store.attempt(arguments["attemptId"])
-        if attempt["project_id"] != project_id or attempt["clip_id"] not in scope.get("clipIds", []):
+        # Named apart from apply()'s cancel locals: a name assigned anywhere in
+        # apply() is local to all of it, so reading `attempt` there would fail.
+        recovering = store.attempt(arguments["attemptId"])
+        if recovering["project_id"] != project_id or recovering["clip_id"] not in scope.get("clipIds", []):
             raise ValueError("Submission is outside recovery scope")
-        submission = store.submission_for(attempt["id"])
-        adopted = adapter_for(attempt["request"], submission).recover(attempt, {"submission": submission})["jobId"]
+        recovered = store.submission_for(recovering["id"])
+        adopted = adapter_for(recovering["request"], recovered).recover(recovering, {"submission": recovered})["jobId"]
 
     def apply(db, document):
         clips = [*document["clips"], *document.get("audioClips", [])] if action in note_actions else document["clips"]
@@ -524,9 +526,9 @@ def apply(db, document):
             return plan["result"], False
         elif action == "recover_submission":
             if adopted:
-                store.adopt_submission_job(db, submission["id"], adopted)
+                store.adopt_submission_job(db, recovered["id"], adopted)
             return {
-                "attemptId": attempt["id"],
+                "attemptId": recovering["id"],
                 "jobId": adopted,
                 "status": "adopted" if adopted else "submission_uncertain",
                 "note": "No automatic resubmission",
diff --git a/spool/credentials.py b/spool/credentials.py
index 094ca7d..035850f 100644
--- a/spool/credentials.py
+++ b/spool/credentials.py
@@ -11,17 +11,23 @@ def key_path():
     return Path(os.environ.get("LOCALAPPDATA") or Path.home() / ".config") / "Spool" / "comfy-cloud.key"
 
 
-def cloud_key():
+def _effective_key():
+    # One read resolves both the key and its source, so status always matches cloud_key.
     path = key_path()
     saved = path.read_text(encoding="utf-8").strip() if path.is_file() else ""
-    return saved or os.environ.get("COMFY_API_KEY", "").strip()
+    if saved:
+        return saved, "saved"
+    environment = os.environ.get("COMFY_API_KEY", "").strip()
+    return (environment, "environment") if environment else ("", None)
+
+
+def cloud_key():
+    return _effective_key()[0]
 
 
 def key_status():
-    return {
-        "hasApiKey": bool(cloud_key()),
-        "apiKeySource": "saved" if key_path().is_file() else "environment" if os.environ.get("COMFY_API_KEY") else None,
-    }
+    key, source = _effective_key()
+    return {"hasApiKey": bool(key), "apiKeySource": source}
 
 
 def save_key(value):
@@ -34,8 +40,15 @@ def save_key(value):
     if value:
         path.parent.mkdir(parents=True, exist_ok=True)
         pending = path.with_suffix(".tmp")
-        pending.write_text(value, encoding="utf-8")
-        pending.chmod(0o600)
+        # Private from creation: writing first and narrowing afterwards left the key
+        # readable by other users of the computer until the chmod.
+        handle = os.open(pending, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+        try:
+            if hasattr(os, "fchmod"):
+                os.fchmod(handle, 0o600)  # a leftover file keeps its old mode otherwise
+            os.write(handle, value.encode("utf-8"))
+        finally:
+            os.close(handle)
         pending.replace(path)
     else:
         path.unlink(missing_ok=True)
diff --git a/spool/cuts.py b/spool/cuts.py
index a916978..489d150 100644
--- a/spool/cuts.py
+++ b/spool/cuts.py
@@ -64,6 +64,8 @@ def scene_scores(ffmpeg, video, cache_dir=None):
         ],
         capture_output=True,
         text=True,
+        encoding="utf-8",
+        errors="replace",
         check=True,
         timeout=600,
     )
diff --git a/spool/execution.py b/spool/execution.py
index 590edeb..a93d85e 100644
--- a/spool/execution.py
+++ b/spool/execution.py
@@ -9,6 +9,7 @@
 from . import requests
 from .store import uid, Conflict
 from .collection import Collector
+from .cloud import storage_call
 from .execution_targets import adapter_for
 
 
@@ -105,7 +106,7 @@ async def queue(self, project_id, revision, items, operation_id=None, actor="hum
         store = self.store.for_project(project_id)
         media = self.media.for_project(store, project_id)
         async with self.lock:
-            project = await asyncio.to_thread(
+            project = await storage_call(
                 requests.accept,
                 store,
                 media,
@@ -119,8 +120,8 @@ async def queue(self, project_id, revision, items, operation_id=None, actor="hum
                 return project
             for job in project["document"]["jobs"]:
                 if job["status"] in {attempts.INTENT, attempts.WAITING}:
-                    await self.dispatch(await asyncio.to_thread(store.attempt, job["id"]))
-            return await asyncio.to_thread(store.get, project_id)
+                    await self.dispatch(await storage_call(store.attempt, job["id"]))
+            return await storage_call(store.get, project_id)
 
     async def dispatch(self, attempt):
         """Hand one frozen attempt to this Comfy's queue or to Deadline.
@@ -137,16 +138,16 @@ async def dispatch(self, attempt):
         store = self.store.for_project(attempt["project_id"])
         media = self.media.for_project(store, attempt["project_id"])
         request = attempt["request"]
-        if self.managed and (await asyncio.to_thread(self.store.host))["sessionId"] != self.session_id:
+        if self.managed and (await storage_call(self.store.host))["sessionId"] != self.session_id:
             raise RuntimeError("Spool executor ownership changed")
-        if not await asyncio.to_thread(store.claim, attempt["id"], self.session_id):
+        if not await storage_call(store.claim, attempt["id"], self.session_id):
             return
 
         observed = attempts.DISPATCHING  # claim atomically moved the intent.
 
         async def transition(status, **kwargs):
             nonlocal observed
-            changed = await asyncio.to_thread(store.transition, attempt["id"], status, expected=observed, **kwargs)
+            changed = await storage_call(store.transition, attempt["id"], status, expected=observed, **kwargs)
             if changed:
                 observed = status
             return changed
@@ -156,7 +157,7 @@ async def transition(status, **kwargs):
             prepared = adapter.prepare(attempt, {})
             package = prepared.get("package")
             if package is not None:
-                submission = await asyncio.to_thread(store.submission, attempt["id"], package)
+                submission = await storage_call(store.submission, attempt["id"], package)
                 package["submissionId"] = submission["id"]
             payload = prepared["payload"]
             payload = self.server.trigger_on_prompt(payload)
@@ -172,7 +173,7 @@ async def transition(status, **kwargs):
                 else payload.get("partial_execution_targets")
             )
             valid = await self.validate(attempt["prompt_id"], prompt, targets)
-            await asyncio.to_thread(
+            await storage_call(
                 store.dispatched,
                 attempt["id"],
                 payload,
@@ -195,7 +196,7 @@ async def transition(status, **kwargs):
                 if not checked[0] or check["output"] not in checked[2]:
                     await transition(attempts.FAILED, error=check["error"] + json.dumps(checked[1]))
                     return
-            await asyncio.to_thread(verify_frozen_inputs, media, request, prompt)
+            await storage_call(verify_frozen_inputs, media, request, prompt)
             if not await transition(
                 attempts.DISPATCHING, result={"validation": {"acceptedOutputs": valid[2], "nodeErrors": valid[3]}}
             ):
@@ -206,7 +207,7 @@ async def transition(status, **kwargs):
                 attempt, {**prepared, "server": self.server, "payload": payload, "valid": valid}
             )
             if "jobId" in submitted:
-                await asyncio.to_thread(store.acknowledge, package["submissionId"], submitted["jobId"])
+                await storage_call(store.acknowledge, package["submissionId"], submitted["jobId"])
             await transition(submitted["status"])
         except Exception as error:
             await transition(attempts.UNCERTAIN, error=str(error))
@@ -228,6 +229,10 @@ def pending_attempts(self):
 
     def observe(self, store, media, attempt, running_ids, pending_ids):
         """Record what Comfy reports for one local attempt; True when it still needs dispatch."""
+        with self.collector.project_lock(store):
+            return self._observe(store, media, attempt, running_ids, pending_ids)
+
+    def _observe(self, store, media, attempt, running_ids, pending_ids):
         attempt_id = attempt["id"]
         observed = attempt["status"]
 
@@ -297,17 +302,17 @@ async def reconcile(self):
         async with self.lock:
             running, pending = self.server.prompt_queue.get_current_queue()
             running_ids, pending_ids = {x[1] for x in running}, {x[1] for x in pending}
-            for store, media, attempt in await asyncio.to_thread(self.pending_attempts):
+            for store, media, attempt in await storage_call(self.pending_attempts):
                 if attempts.target_of(attempt["request"]) == attempts.DEADLINE:
                     if attempt["status"] in {attempts.INTENT, attempts.WAITING}:
                         await self.dispatch(attempt)
                     continue
                 if attempt["status"] == attempts.CANCEL_REQUESTED and not (
                     (store.owner(attempt["id"]) or "").startswith(self.identity)
-                    and await asyncio.to_thread(self.stop, store, attempt, running_ids, pending_ids)
+                    and await storage_call(self.stop, store, attempt, running_ids, pending_ids)
                 ):
                     continue
-                if await asyncio.to_thread(self.observe, store, media, attempt, running_ids, pending_ids):
+                if await storage_call(self.observe, store, media, attempt, running_ids, pending_ids):
                     await self.dispatch(attempt)
 
     async def poll(self, app):
@@ -331,25 +336,29 @@ async def poll(self, app):
             task = asyncio.create_task(self.run())
             yield
         finally:
-            if task is not None:
-                task.cancel()
+            try:
+                if task is not None:
+                    task.cancel()
+                    try:
+                        await task
+                    except asyncio.CancelledError:
+                        pass
+            finally:
                 try:
-                    await task
-                except asyncio.CancelledError:
-                    pass
-            if self.managed:
-                self.store.retire_host(self.session_id)
-            self.managed = False
-            self.ownership.close()
+                    if self.managed:
+                        self.store.retire_host(self.session_id)
+                finally:
+                    self.managed = False
+                    self.ownership.close()
 
     async def run(self):
         while True:
             try:
                 if self.managed:
-                    await asyncio.to_thread(self.store.publish_host, self.configuration, self.session_id)
+                    await storage_call(self.store.publish_host, self.configuration, self.session_id)
                 await self.reconcile()
-                await asyncio.to_thread(self.collector.scan)
-                await asyncio.to_thread(self.notify_progress)
+                await storage_call(self.collector.scan)
+                await storage_call(self.notify_progress)
             except Exception:
                 logging.exception("Spool reconciliation failed; saved attempts remain pending")
             await asyncio.sleep(2)
diff --git a/spool/execution_targets.py b/spool/execution_targets.py
index d3cbd1b..388bd73 100644
--- a/spool/execution_targets.py
+++ b/spool/execution_targets.py
@@ -17,10 +17,16 @@
 from typing import Protocol
 
 from . import attempts, deadline_job
+from .errors import Unavailable
 from .media import check_frozen, contained
 from .credentials import cloud_key
 from .store import Conflict
 
+DEADLINE_LOOKUP_UNAVAILABLE = (
+    "Deadline did not answer the recovery lookup; no work was changed and nothing was resubmitted. "
+    "Retry submission recovery when Deadline is reachable again"
+)
+
 
 class ExecutionAdapter(Protocol):
     def prepare(self, attempt: dict, context: dict) -> dict: ...
@@ -30,6 +36,14 @@ async def cancel(self, attempt: dict, context: dict) -> dict: ...
     def recover(self, attempt: dict, context: dict) -> dict: ...
 
 
+def _deadline_lookup(call, *arguments):
+    """External lookup failures are service unavailability, not Spool bugs."""
+    try:
+        return call(*arguments)
+    except (OSError, RuntimeError, subprocess.SubprocessError) as error:
+        raise Unavailable(DEADLINE_LOOKUP_UNAVAILABLE) from error
+
+
 def cancellation(attempt, target, submission=None):
     outcome = attempts.cancel_action(attempt["status"], target, bool(submission and submission["external_id"]))
     if outcome == "refused":
@@ -244,12 +258,12 @@ def recover(self, attempt, context):
         submission = context.get("submission")
         if not submission:
             raise ValueError("This attempt has no Deadline submission")
-        found = farm.submission_jobs(submission["id"])
+        found = _deadline_lookup(farm.submission_jobs, submission["id"])
         if len(found) > 1:
             raise Conflict("Multiple jobs match; operator resolution required")
         if found and (
-            farm.job_value(found[0], "SpoolSubmissionId") != submission["id"]
-            or farm.job_value(found[0], "SpoolAttemptId") != attempt["id"]
+            _deadline_lookup(farm.job_value, found[0], "SpoolSubmissionId") != submission["id"]
+            or _deadline_lookup(farm.job_value, found[0], "SpoolAttemptId") != attempt["id"]
         ):
             raise ValueError("Deadline job identity failed ownership verification")
         return {"jobId": found[0] if found else None}
diff --git a/spool/export.py b/spool/export.py
index f98e03a..83acb65 100644
--- a/spool/export.py
+++ b/spool/export.py
@@ -10,7 +10,7 @@
 
 
 def run_ffmpeg(command, message):
-    result = subprocess.run(command, capture_output=True, text=True, timeout=180)
+    result = subprocess.run(command, capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=180)
     if result.returncode:
         raise ValueError(result.stderr[-1200:] or message)
 
@@ -82,7 +82,10 @@ def export_sequence(data, *, root, resolve, probe, image_extensions, sources=Non
             run_ffmpeg(command, "Could not render a clip.")
             rendered.append(target)
         concat = Path(temp) / "sequence.txt"
-        concat.write_text("\n".join(f"file '{p.as_posix()}'" for p in rendered), encoding="utf-8")
+        # The concat demuxer reads quoted paths; a quote inside one (a Windows user named O'Brien) is '\''.
+        concat.write_text(
+            "\n".join("file '" + p.as_posix().replace("'", "'\\''") + "'" for p in rendered), encoding="utf-8"
+        )
         video = Path(temp) / "video.mp4"
         run_ffmpeg(
             [
@@ -167,5 +170,12 @@ def export_sequence(data, *, root, resolve, probe, image_extensions, sources=Non
         else:
             command += ["-map", "0:v:0", "-an"]
         command += ["-c:v", "copy", "-t", str(duration), "-movflags", "+faststart", str(output)]
-        run_ffmpeg(command, "Could not render the audio mix.")
+        try:
+            run_ffmpeg(command, "Could not render the audio mix.")
+        except BaseException:
+            try:
+                output.unlink(missing_ok=True)
+            except OSError:
+                pass  # Preserve the mux failure if cleanup is also denied.
+            raise
     return {"url": f"exports/{output.name}", "filename": output.name}
diff --git a/spool/farm.py b/spool/farm.py
index 0e7d254..0a97747 100644
--- a/spool/farm.py
+++ b/spool/farm.py
@@ -10,7 +10,8 @@
 from pathlib import Path
 
 from . import attempts, farm_protocol, joins, sidecars, system
-from .media import contained
+from .durable import atomic_replace
+from .media import contained, unique_partial
 from .execution_targets import adapter_for
 
 
@@ -20,6 +21,21 @@ def __init__(self, store, media):
         self.observed_at = {}
         self.observations = {}
         self.verified_receipts = {}
+        self.submitting_at = {}
+
+    def submission_overdue(self, attempt, row, directory):
+        identity = attempt["id"]
+        if row["external_id"] or attempt["status"] in attempts.TERMINAL | {attempts.SUBMISSION_UNCERTAIN}:
+            self.submitting_at.pop(identity, None)
+            return False
+        # The submitter writes this marker immediately before the external call,
+        # after host validation and asset staging. Attempt age includes queued time.
+        # First observation gives a conservative fresh grace period after restart,
+        # without depending on wall clocks or timestamps from the farm share.
+        if identity not in self.submitting_at and (directory / "submitting.json").is_file():
+            self.submitting_at[identity] = time.monotonic()
+        started = self.submitting_at.get(identity)
+        return started is not None and time.monotonic() - started > 30
 
     def receipt_checkpoint(self, package, receipt, root):
         files = []
@@ -38,16 +54,20 @@ def transition(status, **kwargs):
             changed = self.store.transition(attempt["id"], status, expected=observed, **kwargs)
             if changed:
                 observed = status
+                if status in attempts.TERMINAL | {attempts.SUBMISSION_UNCERTAIN}:
+                    self.submitting_at.pop(attempt["id"], None)
             return changed
 
         row = self.store.submission_for(attempt["id"])
         if not row:
+            self.submitting_at.pop(attempt["id"], None)
             return
         root = Path(attempt["request"]["prompt"][attempt["request"]["launcherNodeId"]]["inputs"]["output_directory"])
         directory = contained(root, "spool-submissions/" + row["id"])
         request_file, ack_file = directory / "request.json", directory / "ack.json"
+        overdue = self.submission_overdue(attempt, row, directory)
         if not request_file.is_file():
-            if attempt["status"] != attempts.COMPLETE and time.time() - attempt["created"] > 30:
+            if overdue:
                 transition(
                     attempts.SUBMISSION_UNCERTAIN,
                     error="No durable submission package or acknowledgment yet; no automatic resubmission",
@@ -79,6 +99,7 @@ def transition(status, **kwargs):
             if any(ack.get(k) != package[k] for k in ("schemaVersion", "submissionId", "attemptId", "fingerprint")):
                 raise ValueError("Submission acknowledgment belongs to another request")
             self.store.acknowledge(row["id"], ack["jobId"])
+            self.submitting_at.pop(attempt["id"], None)
             if attempt["status"] not in (
                 attempts.COMPLETE,
                 attempts.CANCELLED,
@@ -90,7 +111,7 @@ def transition(status, **kwargs):
                 transition(attempts.FARM_QUEUED)
         elif row["external_id"]:
             ack = {"jobId": row["external_id"]}
-        elif attempt["status"] != attempts.COMPLETE and time.time() - attempt["created"] > 30:
+        elif overdue:
             transition(
                 attempts.SUBMISSION_UNCERTAIN,
                 error="Submission response or acknowledgment unavailable; no automatic resubmission",
@@ -126,11 +147,12 @@ def transition(status, **kwargs):
                 ):
                     self.verified_receipts.pop(path, None)
                     farm_protocol.verify(package, receipt, root)
-            except (ValueError, KeyError, OSError) as error:
+            # Valid JSON of the wrong shape fails like invalid JSON: the farm share is not trusted.
+            except (ValueError, KeyError, OSError, TypeError, AttributeError, IndexError) as error:
                 self.verified_receipts.pop(path, None)
                 self.store.reject_receipt(attempt["id"], str(path), str(error))
                 continue
-            if not job or job != receipt["jobId"]:
+            if not job or job != receipt.get("jobId"):
                 self.store.reject_receipt(
                     attempt["id"], str(path), "Worker receipt lacks the owned Deadline job association"
                 )
@@ -172,11 +194,17 @@ def transition(status, **kwargs):
                     receipt["executionId"],
                 )
                 destination.parent.mkdir(parents=True, exist_ok=True)
-                pending = destination.with_name(destination.name + ".partial")
-                shutil.copyfile(source, pending)
-                if farm_protocol.checksum(pending) != artifact["sha256"]:
-                    raise ValueError("Farm ingestion copy changed checksum")
-                pending.replace(destination)
+                pending = unique_partial(destination)
+                try:
+                    shutil.copyfile(source, pending)
+                    if farm_protocol.checksum(pending) != artifact["sha256"]:
+                        raise ValueError("Farm ingestion copy changed checksum")
+                    atomic_replace(pending, destination)
+                finally:
+                    try:
+                        pending.unlink(missing_ok=True)
+                    except OSError:
+                        pass  # Preserve the copy, checksum or replacement failure if cleanup is denied.
                 metadata = self.media.describe(destination, fps=attempt["request"].get("sequenceFps", 24))
                 artifacts.append({**metadata, **artifact})
             result = {
diff --git a/spool/farm_protocol.py b/spool/farm_protocol.py
index ae5e8f9..382898c 100644
--- a/spool/farm_protocol.py
+++ b/spool/farm_protocol.py
@@ -3,6 +3,7 @@
 import copy
 import hashlib
 import json
+import re
 import shutil
 import uuid
 from pathlib import Path
@@ -18,6 +19,8 @@
     atomic_json = _durable.atomic_json
 
 SCHEMA = 2
+# Execution and artifact IDs are uuid4().hex; they name the files Spool writes on ingestion.
+IDENTITY = re.compile(r"[0-9a-f]{32}")
 SAVERS = {
     "SaveImage": {"images"},
     "PreviewImage": {"images"},
@@ -152,13 +155,17 @@ def finalize(package, execution, prompt_id, history, roots, worker, job_id):
     return receipt
 
 
+def identity(value):
+    return isinstance(value, str) and IDENTITY.fullmatch(value) is not None
+
+
 def verify(package, receipt, result_root):
     if receipt.get("schemaVersion") != SCHEMA:
         raise ValueError("Unsupported farm receipt version")
     for key in ("projectId", "clipId", "takeId", "attemptId", "fingerprint", "submissionId", "variationIndex"):
         if receipt.get(key) != package[key]:
             raise ValueError("Farm receipt belongs to another request: " + key)
-    if receipt.get("outcome") != "success" or not receipt.get("promptId") or not receipt.get("executionId"):
+    if receipt.get("outcome") != "success" or not receipt.get("promptId") or not identity(receipt.get("executionId")):
         raise ValueError("Farm receipt lacks execution identity or success")
     history = receipt.get("history", {})
     if history.get("status", {}).get("status_str") != "success" or not history.get("status", {}).get("completed"):
@@ -174,6 +181,8 @@ def verify(package, receipt, result_root):
     ):
         raise ValueError("Farm observed prompt differs from the permitted execution copy")
     artifacts = receipt["artifacts"]
+    if not all(identity(a["artifactId"]) for a in artifacts):
+        raise ValueError("Farm receipt has an invalid artifact identity")
     if len({a["artifactId"] for a in artifacts}) != len(artifacts):
         raise ValueError("Duplicate artifact identity")
     reported = {
diff --git a/spool/interchange.py b/spool/interchange.py
index f619c37..e6e04bc 100644
--- a/spool/interchange.py
+++ b/spool/interchange.py
@@ -12,6 +12,7 @@
 import re
 import uuid
 from pathlib import Path
+from .durable import atomic_replace
 from .timing import rate
 
 
@@ -170,7 +171,19 @@ def gap(frames):
     output_dir.mkdir(exist_ok=True)
     stem = re.sub(r"[^\w.-]+", "-", name or "spool").strip("-.") or "spool"
     output = output_dir / f"{stem}-{uuid.uuid4().hex[:10]}.otio"
-    pending = output.with_name(output.name + ".partial")
-    pending.write_text(json.dumps(timeline, indent=2, ensure_ascii=False), encoding="utf-8")
-    pending.replace(output)
+    pending = output.with_name(output.name + "." + uuid.uuid4().hex + ".partial")
+    pending_owned = False
+    try:
+        with pending.open("x", encoding="utf-8") as handle:
+            pending_owned = True
+            json.dump(timeline, handle, indent=2, ensure_ascii=False)
+        atomic_replace(pending, output)
+        pending_owned = False
+    finally:
+        if pending_owned:
+            try:
+                pending.unlink(missing_ok=True)
+            except OSError:
+                # A denied cleanup must not replace the write/publication error.
+                pass
     return {"filename": output.name, "path": str(output), "timeline": timeline}
diff --git a/spool/joins.py b/spool/joins.py
index fca4cf1..4ecf02b 100644
--- a/spool/joins.py
+++ b/spool/joins.py
@@ -8,7 +8,8 @@
 The joined copy fixes all three in the take itself, so the viewer and both exports only
 play it. Its overlap is the shot's own frames, the last `BLEND` of them dissolve into
 the re-render, its new frames start exactly where the shot ends, and the first `SETTLE`
-new frames are eased back to the shot's brightness. The studio shows it from `BLEND`
+new frames are eased back to the shot's brightness. Its audio follows those new frames
+on the sequence clock, so it keeps the copy's duration. The studio shows it from `BLEND`
 frames before the cut while the shot is still the one it was made from
 (ui/timeline.js:joinedTake). The render and its receipt stay untouched; the copy lives
 in the project cache and is recorded as the take media's `join`.
@@ -21,6 +22,7 @@
 
 from .media import _probe
 from .system import find_tool
+from .timing import rate, tempo_filter
 
 BLEND = 2  # frames the shot dissolves into the extension over, before the cut
 SETTLE = 8  # new frames whose brightness is eased back to the shot's
@@ -133,6 +135,25 @@ def _graded(image, gain):
     )
 
 
+def _audio_filter(shift, native, fps, duration):
+    """Time the render's audio as the joined copy plays its frames.
+
+    Joined frame `j` shows render frame `j + shift`, so the audio starts `shift`
+    source frames in (or waits when it is negative) and is played at the sequence
+    rate, exactly as a plain take's source audio is retimed. `duration` cuts it to
+    the joined copy's own length, padding a short render with silence.
+    """
+    speed = fps / native
+    offset = shift / native
+    filters = ["aresample=48000", "asetpts=PTS-STARTPTS"]
+    if offset > 0:
+        filters += [f"atrim=start={offset:.9f}", "asetpts=PTS-STARTPTS"]
+    elif offset < 0:
+        filters.append(f"adelay={round(-offset * 48000)}S:all=1")
+    filters += [tempo_filter(speed), f"apad,atrim=duration={duration:.9f}", "asetpts=PTS-STARTPTS"]
+    return ",".join(filters)
+
+
 def build(media, request, primary, joining):
     """Write the joined copy of `primary` and return its media record, or None."""
     ffmpeg = find_tool("ffmpeg")
@@ -145,7 +166,11 @@ def build(media, request, primary, joining):
     # The copy takes the shot's own size: the workflow stretched the shot to its render size,
     # and a copy that kept that size would be fitted into the shot's frame with bars beside it.
     shot_video = next(s for s in _probe(guide)["streams"] if s["codec_type"] == "video")
+    render_probe = _probe(render)
+    render_video = next((s for s in render_probe["streams"] if s["codec_type"] == "video"), None)
     overlap, frames = joining["overlap"], primary["frames"]
+    fps = request.get("sequenceFps", 24)
+    native = rate(primary.get("fps") or (render_video or {}).get("avg_frame_rate"), fps)
     size = (int(shot_video["width"]), int(shot_video["height"]))
     head = measure(ffmpeg, guide, render, overlap)
     shift, grade = head - overlap, gains(ffmpeg, guide, render, head)
@@ -153,19 +178,21 @@ def build(media, request, primary, joining):
     target = media.cache / "joins" / f"{primary['artifactId']}.mp4"
     target.parent.mkdir(parents=True, exist_ok=True)
     pending = target.with_name(target.stem + ".partial.mp4")
-    encoder = subprocess.Popen(
-        [
-            ffmpeg, "-v", "error", "-y",
-            "-f", "rawvideo", "-pix_fmt", "rgb24", "-s", f"{size[0]}x{size[1]}",
-            "-r", str(request.get("sequenceFps", 24)), "-i", "-",
-            "-i", str(render), "-map", "0:v:0", "-map", "1:a?", "-c:a", "copy",
-            "-vf", "scale=out_color_matrix=bt709:out_range=tv:flags=accurate_rnd+full_chroma_int,format=yuv420p",
-            "-c:v", "libx264", "-crf", "14", "-preset", "medium",
-            "-colorspace", "bt709", "-color_primaries", "bt709", "-color_trc", "iec61966-2-1",
-            "-movflags", "+faststart", str(pending),
-        ],
-        stdin=subprocess.PIPE, stderr=subprocess.PIPE,
-    )  # fmt: skip
+    command = [
+        ffmpeg, "-v", "error", "-y",
+        "-f", "rawvideo", "-pix_fmt", "rgb24", "-s", f"{size[0]}x{size[1]}",
+        "-r", str(fps), "-i", "-",
+        "-i", str(render), "-map", "0:v:0",
+    ]  # fmt: skip
+    if any(s["codec_type"] == "audio" for s in render_probe["streams"]):
+        command += ["-map", "1:a:0", "-af", _audio_filter(shift, native, fps, frames / fps), "-c:a", "aac", "-b:a", "192k"]  # fmt: skip
+    command += [
+        "-vf", "scale=out_color_matrix=bt709:out_range=tv:flags=accurate_rnd+full_chroma_int,format=yuv420p",
+        "-c:v", "libx264", "-crf", "14", "-preset", "medium",
+        "-colorspace", "bt709", "-color_primaries", "bt709", "-color_trc", "iec61966-2-1",
+        "-movflags", "+faststart", str(pending),
+    ]  # fmt: skip
+    encoder = subprocess.Popen(command, stdin=subprocess.PIPE, stderr=subprocess.PIPE)
     source = _frames(ffmpeg, render, size)
     state = {"index": -1, "frame": None}
 
diff --git a/spool/launcher.py b/spool/launcher.py
index 110508a..9870bdc 100644
--- a/spool/launcher.py
+++ b/spool/launcher.py
@@ -10,6 +10,7 @@
 
 from aiohttp import ClientSession, ClientConnectorError, ClientError, ClientTimeout
 
+from .cloud import storage_call
 from .store import Conflict, encode, uid
 
 # Scripts that run through /bin/sh when they are not marked executable.
@@ -98,8 +99,10 @@ def save(self, data):
             db.execute("INSERT OR REPLACE INTO settings VALUES(?,?)", ("comfy_startup", encode(settings)))
         return settings
 
-    async def probe(self):
-        url = local_url(self.settings()["comfyUrl"])
+    async def probe(self, address=None):
+        if address is None:
+            address = (await storage_call(self.settings))["comfyUrl"]
+        url = local_url(address)
         try:
             async with ClientSession(timeout=ClientTimeout(total=5)) as client:
                 async with client.get(url + "/spool/api/health", allow_redirects=False) as response:
@@ -130,31 +133,44 @@ async def probe(self):
                 "The Comfy address did not return its connection details. Check the address before starting another instance.",
             )
 
+    def _startup_files(self):
+        # ComfyUI_windows_portable/ComfyUI/custom_nodes/Spool/spool; a shallower checkout is not portable.
+        above = Path(__file__).resolve().parents
+        portable = above[4] if len(above) > 4 else None
+        if not portable or not (portable / "python_embeded/python.exe").is_file():
+            return []
+        return [str(p) for p in sorted(portable.glob("run*.bat")) if "Deadline" not in p.name]
+
+    def _replace_launch(self, expected, replacement):
+        """A delayed worker cannot replace a newer startup reservation or state."""
+        with self.store.connect() as db:
+            db.execute("BEGIN IMMEDIATE")
+            if (self.store.setting("comfy_launch") or {}) != expected:
+                return False
+            db.execute("INSERT OR REPLACE INTO settings VALUES(?,?)", ("comfy_launch", encode(replacement)))
+        return True
+
     async def status(self):
-        settings = self.settings()
-        state, error = await self.probe()
-        launch = self.store.setting("comfy_launch") or {}
+        settings = await storage_call(self.settings)
+        state, error = await self.probe(settings["comfyUrl"])
+        launch = (await storage_call(self.store.setting, "comfy_launch")) or {}
         if state == "connected":
             if launch.get("state") == "starting":
-                self.store.set_setting("comfy_launch", {**launch, "state": "connected"})
+                await storage_call(self._replace_launch, launch, {**launch, "state": "connected"})
         elif state == "stopped" and launch.get("state") == "starting":
             if time.time() - launch["created"] > 180 or self.process and self.process.poll() not in (None, 0):
+                previous = launch
                 launch = {
                     **launch,
                     "state": "error",
                     "error": "Comfy did not become ready. Check the startup file, its port and the startup log.",
                 }
-                self.store.set_setting("comfy_launch", launch)
+                await storage_call(self._replace_launch, previous, launch)
             else:
                 state = "starting"
         if state == "stopped" and launch.get("state") == "error":
             state, error = "error", launch["error"]
-        portable = Path(__file__).resolve().parents[4]
-        files = (
-            [str(p) for p in sorted(portable.glob("run*.bat")) if "Deadline" not in p.name]
-            if (portable / "python_embeded/python.exe").is_file()
-            else []
-        )
+        files = await storage_call(self._startup_files)
         return {
             "settings": settings,
             "state": state,
@@ -170,50 +186,58 @@ async def start(self):
                 return status
             if status["state"] in ("unpaired", "unavailable"):
                 raise ValueError(status["error"])
-            settings = self.save(status["settings"])
+            settings = await storage_call(self.save, status["settings"])
             if not settings["startupFile"]:
                 raise ValueError("Choose a Comfy startup file in Comfy settings first")
             identity = uid()
             log_path = self.store.root / "logs" / ("comfy-startup-" + identity + ".log")
-            log_path.parent.mkdir(exist_ok=True)
-            with self.store.connect() as db:
-                db.execute("BEGIN IMMEDIATE")
-                launch = self.store.setting("comfy_launch") or {}
-                if launch.get("state") == "starting" and time.time() - launch["created"] < 180:
-                    return {**status, "state": "starting"}
-                db.execute(
-                    "INSERT OR REPLACE INTO settings VALUES(?,?)",
-                    (
-                        "comfy_launch",
-                        encode({"id": identity, "state": "starting", "created": time.time(), "log": str(log_path)}),
-                    ),
-                )
-            path = Path(settings["startupFile"])
-            command = [str(path)]
-            if os.name == "nt" and path.suffix.lower() in (".bat", ".cmd"):
-                command = '"' + os.environ.get("COMSPEC", "cmd.exe") + '" /d /s /c ""' + str(path) + '""'
-            elif os.name != "nt" and not os.access(path, os.X_OK):
-                command = ["/bin/sh", str(path)]
-            try:
-                with log_path.open("ab") as log:
-                    # Its own process group or session, so stopping Spool's terminal leaves Comfy running.
-                    self.process = subprocess.Popen(
-                        command,
-                        cwd=path.parent,
-                        env={**os.environ, "SPOOL_STORAGE": str(self.store.root)},
-                        stdin=subprocess.DEVNULL,
-                        stdout=log,
-                        stderr=log,
-                        creationflags=0x08000200 if os.name == "nt" else 0,
-                        start_new_session=os.name != "nt",
-                    )
-            except OSError as error:
-                self.store.set_setting(
-                    "comfy_launch", {"id": identity, "state": "error", "error": str(error), "log": str(log_path)}
-                )
-                raise ValueError("Comfy could not start: " + str(error)) from error
+            if not await storage_call(self._launch, settings, identity, log_path):
+                return {**status, "state": "starting"}
             return {**status, "state": "starting", "error": None, "logAvailable": True}
 
+    def _launch(self, settings, identity, log_path):
+        """Reserve startup and spawn the child in one worker; cancellation waits for both."""
+        log_path.parent.mkdir(exist_ok=True)
+        with self.store.connect() as db:
+            db.execute("BEGIN IMMEDIATE")
+            launch = self.store.setting("comfy_launch") or {}
+            if launch.get("state") == "starting" and time.time() - launch["created"] < 180:
+                return False
+            reservation = {"id": identity, "state": "starting", "created": time.time(), "log": str(log_path)}
+            db.execute(
+                "INSERT OR REPLACE INTO settings VALUES(?,?)",
+                (
+                    "comfy_launch",
+                    encode(reservation),
+                ),
+            )
+        path = Path(settings["startupFile"])
+        command = [str(path)]
+        if os.name == "nt" and path.suffix.lower() in (".bat", ".cmd"):
+            command = '"' + os.environ.get("COMSPEC", "cmd.exe") + '" /d /s /c ""' + str(path) + '""'
+        elif os.name != "nt" and not os.access(path, os.X_OK):
+            command = ["/bin/sh", str(path)]
+        try:
+            with log_path.open("ab") as log:
+                # Its own process group or session, so stopping Spool's terminal leaves Comfy running.
+                process = subprocess.Popen(
+                    command,
+                    cwd=path.parent,
+                    env={**os.environ, "SPOOL_STORAGE": str(self.store.root)},
+                    stdin=subprocess.DEVNULL,
+                    stdout=log,
+                    stderr=log,
+                    creationflags=0x08000200 if os.name == "nt" else 0,
+                    start_new_session=os.name != "nt",
+                )
+        except OSError as error:
+            self._replace_launch(
+                reservation, {"id": identity, "state": "error", "error": str(error), "log": str(log_path)}
+            )
+            raise ValueError("Comfy could not start: " + str(error)) from error
+        self.process = process
+        return True
+
     def log(self):
         launch = self.store.setting("comfy_launch") or {}
         if not launch.get("log"):
@@ -223,7 +247,7 @@ def log(self):
             return handle.read().decode("utf-8", errors="replace")
 
     async def lifecycle(self, app):
-        if self.settings()["autoStart"]:
+        if (await storage_call(self.settings))["autoStart"]:
             try:
                 await self.start()
             except ValueError as error:
diff --git a/spool/maintenance.py b/spool/maintenance.py
index 109e74e..62a5bcf 100644
--- a/spool/maintenance.py
+++ b/spool/maintenance.py
@@ -3,11 +3,13 @@
 import argparse
 import json
 import os
+import shutil
 from pathlib import Path
 
 from .projects import ProjectStore
 
-COMFY = Path(__file__).resolve().parents[3]
+# A checkout outside custom_nodes may sit too close to the drive root to have one.
+COMFY = Path(__file__).resolve().parents[min(3, len(Path(__file__).resolve().parents) - 1)]
 
 
 def default_root():
@@ -19,6 +21,12 @@ def megabytes(value):
     return "%.1f MB" % (value / 1e6)
 
 
+def discard_cache(store):
+    """Remove the private working copy a confirmed run made; the project folder keeps what it published."""
+    if store.private_cache:
+        shutil.rmtree(store.private_cache, ignore_errors=True)
+
+
 def run_prune(argv=None):
     parser = argparse.ArgumentParser(
         prog="python -m spool prune",
@@ -36,7 +44,10 @@ def run_prune(argv=None):
     if not (args.storage / "project.spool").is_file():
         parser.error("Choose a project folder containing project.spool")
     store = ProjectStore(args.storage, migrate=False, writable=args.confirm)
-    report = store.prune(confirm=args.confirm, budget=int(args.budget_gb * 1024**3), grace=args.grace_minutes * 60)
+    try:
+        report = store.prune(confirm=args.confirm, budget=int(args.budget_gb * 1024**3), grace=args.grace_minutes * 60)
+    finally:
+        discard_cache(store)
     if args.json:
         print(json.dumps({**report, "unreferencedPreviews": None}, indent=2, default=str))
         return 0
@@ -68,7 +79,10 @@ def run(argv=None):
     if not (args.storage / "project.spool").is_file():
         parser.error("Choose a project folder containing project.spool")
     store = ProjectStore(args.storage, migrate=False, writable=args.confirm)
-    report = store.reclaim(confirm=args.confirm)
+    try:
+        report = store.reclaim(confirm=args.confirm)
+    finally:
+        discard_cache(store)
     if args.json:
         print(json.dumps(report, indent=2))
         return 0
diff --git a/spool/media.py b/spool/media.py
index bb23a5e..3560223 100644
--- a/spool/media.py
+++ b/spool/media.py
@@ -1,11 +1,14 @@
 import copy
 import hashlib
 import json
+import math
 import os
 import shutil
 import subprocess
+import tempfile
+from bisect import bisect_right
+from fractions import Fraction
 from pathlib import Path
-from urllib.parse import unquote
 
 from PIL import Image, ImageDraw, ImageOps
 
@@ -21,33 +24,173 @@
 
 PLAYBACK_VERSION = "playback-2"
 
+# Windows CreateProcess counts the quoted command in UTF-16 code units,
+# including its terminating NUL. Leave room below its 32767-unit limit.
+_SPLIT_COMMAND_BUDGET = 24000
+_SPLIT_BATCH_FRAMES = 100000
+
 IMAGE_EXTENSIONS = {".png", ".jpg", ".jpeg", ".webp"}
 AUDIO_EXTENSIONS = {".wav", ".mp3", ".m4a", ".aac", ".ogg", ".flac", ".opus"}
 VIDEO_EXTENSIONS = {".mp4", ".mov", ".webm", ".mkv", ".m4v"}
 EXTENSIONS = VIDEO_EXTENSIONS | IMAGE_EXTENSIONS | AUDIO_EXTENSIONS
 
 
+class UnreadableMedia(ValueError, subprocess.SubprocessError):
+    """ffprobe could not read a file: the caller's request is at fault, not Spool."""
+
+
 def _probe(source):
     ffprobe = find_tool("ffprobe")
     if not ffprobe:
         raise ValueError("Install ffprobe for native media review")
-    result = subprocess.run(
-        [ffprobe, "-v", "error", "-show_streams", "-show_format", "-of", "json", str(source)],
-        capture_output=True,
-        text=True,
-        encoding="utf-8",
-        check=True,
-        timeout=30,
-    )
+    try:
+        result = subprocess.run(
+            [ffprobe, "-v", "error", "-show_streams", "-show_format", "-of", "json", str(source)],
+            capture_output=True,
+            text=True,
+            encoding="utf-8",
+            check=True,
+            timeout=30,
+        )
+    except subprocess.CalledProcessError as error:
+        # ffprobe's message names this computer's path, so it stays in the traceback.
+        raise UnreadableMedia("This file is not readable video, image or audio") from error
+    except subprocess.TimeoutExpired as error:
+        raise UnreadableMedia("Reading this media took too long") from error
     return json.loads(result.stdout)
 
 
 def _rate(value):
-    numerator, _, denominator = str(value).partition("/")
-    rate = float(numerator) / float(denominator or 1)
-    if rate <= 0:
+    """A usable positive source rate from ffprobe, or a caller-facing validation error.
+
+    ffprobe reports missing video clocks as `0/0`, and broken metadata may hold
+    `nan` or an infinity. Import needs a real source rate, so never propagate a
+    division error or a nonfinite timing.
+    """
+    try:
+        numerator, separator, denominator = str(value).strip().partition("/")
+        if separator and not denominator.strip():
+            result = math.nan
+        else:
+            result = float(numerator) / float(denominator or 1)
+    except (TypeError, ValueError, ZeroDivisionError, OverflowError):
+        result = math.nan
+    if not math.isfinite(result) or result <= 0:
         raise ValueError("The video has no usable frame rate")
-    return rate
+    return result
+
+
+def _exact_rate(value, fallback):
+    """An exact frame rate for frame-number timing, preferring ffprobe's rational.
+
+    A float approximation would drift against the proxy's rational frame clock
+    when seeking into later batches. ffprobe reports that clock exactly.
+    """
+    try:
+        result = Fraction(str(value))
+    except (TypeError, ValueError, ZeroDivisionError):
+        result = Fraction(str(fallback)).limit_denominator(1_000_000)
+    if result <= 0:
+        result = Fraction(str(fallback)).limit_denominator(1_000_000)
+    return result
+
+
+def _command_length(command):
+    return len(subprocess.list2cmdline(command).encode("utf-16-le")) // 2 + 1
+
+
+def _split_command(ffmpeg, proxy, folder, cuts, start, end, first, frame_rate, time_base, start_pts):
+    """Encode one contiguous batch, with frame numbers local to its first shot."""
+    command = [ffmpeg, "-v", "error", "-y", "-i", str(proxy)]
+    if start:
+        # Seek one frame early, then select the exact original timestamp. copyts
+        # prevents seek-time rounding from moving the trim boundary. The proxy
+        # has six-frame GOPs, so each batch decodes only a few preceding frames.
+        seek = (start - 1) * 1_000_000 // frame_rate
+        command = [ffmpeg, "-v", "error", "-y", "-copyts", "-ss", f"{seek}us", "-i", str(proxy)]
+        command += ["-vf", f"trim=start_pts={start_pts + round(start / frame_rate / time_base)},setpts=PTS-STARTPTS"]
+    command += [
+        "-an",
+        "-frames:v",
+        str(end - start),
+        "-c:v",
+        "libx264",
+        "-preset",
+        "ultrafast",
+        "-pix_fmt",
+        "yuv420p",
+        "-g",
+        "6",
+        "-bf",
+        "0",
+    ]
+    if cuts:
+        local = [cut - start for cut in cuts]
+        # FFmpeg rejects deeply nested expressions, including long flat sums.
+        # Pair terms so parser depth grows logarithmically with the cut count.
+        terms = [f"eq(n,{cut})" for cut in local]
+        while len(terms) > 1:
+            terms = [
+                f"({terms[index]}+{terms[index + 1]})" if index + 1 < len(terms) else terms[index]
+                for index in range(0, len(terms), 2)
+            ]
+        command += [
+            "-force_key_frames",
+            "expr:" + terms[0],
+            "-f",
+            "segment",
+            "-segment_frames",
+            ",".join(map(str, local)),
+            "-segment_start_number",
+            str(first),
+            "-reset_timestamps",
+            "1",
+            str(folder / "%03d.mp4"),
+        ]
+    else:
+        command.append(str(folder / f"{first:03d}.mp4"))
+    return command
+
+
+def _split_commands(ffmpeg, proxy, folder, cuts, frames, frame_rate, time_base, start_pts=0):
+    """Bound both explicit cut lists without losing short GOPs inside each shot.
+
+    Batches meet at actual cuts and encode disjoint frame ranges. The frame cap
+    is a grouping target: a single longer shot stays in one batch. The command
+    budget is hard and includes quoted paths, Unicode and the terminating NUL.
+    """
+    boundaries = [0, *cuts, frames]
+    if any(end <= start for start, end in zip(boundaries, boundaries[1:])):
+        raise ValueError("Detected cuts must increase inside the source")
+    first = 0
+    while first < len(boundaries) - 1:
+        start = boundaries[first]
+        last = max(first + 1, bisect_right(boundaries, start + _SPLIT_BATCH_FRAMES) - 1)
+        low, high = first + 1, last
+        command = None
+        while low <= high:
+            middle = (low + high) // 2
+            candidate = _split_command(
+                ffmpeg,
+                proxy,
+                folder,
+                boundaries[first + 1 : middle],
+                start,
+                boundaries[middle],
+                first,
+                frame_rate,
+                time_base,
+                start_pts,
+            )
+            if _command_length(candidate) <= _SPLIT_COMMAND_BUDGET:
+                command, last = candidate, middle
+                low = middle + 1
+            else:
+                high = middle - 1
+        if command is None:
+            raise ValueError("The media path is too long for FFmpeg's command line")
+        yield command
+        first = last
 
 
 def _video_stream(probe):
@@ -61,6 +204,27 @@ def _video_stream(probe):
     )
 
 
+def _video_display_size(stream):
+    """Pixel dimensions after ffmpeg's default autorotation, not the coded frame.
+
+    A display matrix supersedes the older rotate tag. FFmpeg transposes quarter
+    turns (within one degree); its arbitrary-angle rotate keeps the coded canvas.
+    Reflections change the pixels but do not change this size rule.
+    """
+    matrix = next(
+        (item for item in stream.get("side_data_list", []) if item.get("side_data_type") == "Display Matrix"), None
+    )
+    rotation = matrix.get("rotation", 0) if matrix is not None else stream.get("tags", {}).get("rotate", 0)
+    try:
+        rotation = float(rotation) % 360
+    except (TypeError, ValueError):
+        rotation = 0
+    width, height = stream["width"], stream["height"]
+    if math.isfinite(rotation) and (abs(rotation - 90) < 1 or abs(rotation - 270) < 1):
+        return height, width
+    return width, height
+
+
 def _review_probe(path, fps, run=None):
     run = run or subprocess.run
     probe = _probe(path)
@@ -127,6 +291,12 @@ def resolved_root(root):
     return held
 
 
+def unique_partial(destination):
+    """A sibling temporary file only the copy that created it may publish or remove."""
+    destination = Path(destination)
+    return destination.with_name(destination.name + "." + uid() + ".partial")
+
+
 def contained(root, relative):
     """Resolve a stored relative path, refusing anything outside its root.
 
@@ -136,8 +306,10 @@ def contained(root, relative):
     containment depended on whether a directory had already been created.
     """
     base = resolved_root(str(root))
-    target = Path(os.path.normpath(os.path.join(str(base), unquote(relative))))
-    key, prefix = os.path.normcase(str(target)), os.path.normcase(str(base))
+    # Not URL-decoded: aiohttp decodes route paths once, and a stored name may hold a literal "%41".
+    target = Path(os.path.normpath(os.path.join(str(base), relative)))
+    # A drive or share root ("E:\\", "\\\\nas\\projects\\") already ends in a separator.
+    key, prefix = os.path.normcase(str(target)).rstrip(os.sep), os.path.normcase(str(base)).rstrip(os.sep)
     if key == prefix or not key.startswith(prefix + os.sep):
         raise ValueError("Media path escapes its storage root")
     return target
@@ -166,6 +338,20 @@ def check_frozen(path, asset, message="A frozen input changed before execution")
         raise ValueError(message)
 
 
+def encode(command, target, timeout):
+    """Run an ffmpeg command whose last argument is `target`, publishing the file only when it finishes.
+
+    Cache files are reused whenever they exist, so an encode cut short by a timeout,
+    a stopped host or a full disk must not leave a truncated file at that name.
+    """
+    pending = target.with_name(target.stem + "-" + uid() + target.suffix)
+    try:
+        subprocess.run([*command, str(pending)], check=True, capture_output=True, timeout=timeout)
+        pending.replace(target)
+    finally:
+        pending.unlink(missing_ok=True)
+
+
 class Media:
     def __init__(self, root, input_root, output_root, temp_root, project_id=None, playback_cache=None, playback=None):
         self.root = Path(root).resolve()
@@ -277,8 +463,15 @@ def stage_input(self, source):
             source.stat().st_mtime_ns,
         ):
             pending = target.with_name(uid() + ".partial")
-            shutil.copy2(source, pending)
-            pending.replace(target)
+            try:
+                shutil.copy2(source, pending)
+                pending.replace(target)
+            except BaseException:
+                try:
+                    pending.unlink(missing_ok=True)
+                except OSError:
+                    pass  # Preserve the staging failure if cleanup is also denied.
+                raise
         return name
 
     def prepare_input(self, value):
@@ -333,11 +526,17 @@ def describe(self, path, name=None, fps=24):
             with Image.open(path) as image:
                 if getattr(image, "n_frames", 1) > 1:
                     raise ValueError("Animated image review is not supported yet. Import a video instead.")
+                width, height = image.size
+                # Pillow applies these orientations, including mirrored quarter
+                # turns, when preparing generation inputs and previews. Leave the
+                # original file untouched so its pixels are not rotated twice.
+                if image.getexif().get(274) in (5, 6, 7, 8):
+                    width, height = height, width
                 result.update(
                     {
                         "kind": "image",
-                        "width": image.width,
-                        "height": image.height,
+                        "width": width,
+                        "height": height,
                         "frames": round(5 * fps),
                         "poster": relative,
                     }
@@ -366,10 +565,11 @@ def describe(self, path, name=None, fps=24):
         if not ffmpeg:
             raise ValueError("Install ffmpeg for native media review")
         if video:
+            width, height = _video_display_size(video)
             result.update(
                 {
-                    "width": video["width"],
-                    "height": video["height"],
+                    "width": width,
+                    "height": height,
                     "fps": video.get("avg_frame_rate"),
                     "timeBase": video.get("time_base"),
                     "sourceFrameCount": video.get("nb_frames"),
@@ -382,7 +582,7 @@ def describe(self, path, name=None, fps=24):
             )
             proxy = previews / (path.stem + "-" + hashlib.sha256(signature.encode()).hexdigest()[:24] + ".mp4")
             if not proxy.exists():
-                subprocess.run(
+                encode(
                     [
                         ffmpeg,
                         "-v",
@@ -416,11 +616,9 @@ def describe(self, path, name=None, fps=24):
                         "-shortest",
                         "-movflags",
                         "+faststart",
-                        str(proxy),
                     ],
-                    check=True,
-                    capture_output=True,
-                    timeout=300,
+                    proxy,
+                    300,
                 )
             result["file"] = proxy.relative_to(self.root).as_posix()
             proxy_probe = _review_probe(proxy, fps)
@@ -442,22 +640,25 @@ def describe(self, path, name=None, fps=24):
             }
             poster = proxy.with_suffix(".jpg")
             if not poster.exists():
-                subprocess.run(
-                    [ffmpeg, "-v", "error", "-y", "-i", str(proxy), "-frames:v", "1", str(poster)],
-                    check=True,
-                    capture_output=True,
-                    timeout=30,
-                )
+                encode([ffmpeg, "-v", "error", "-y", "-i", str(proxy), "-frames:v", "1"], poster, 30)
             result["poster"] = poster.relative_to(self.root).as_posix()
         if audio:
-            wave = previews / (
-                path.stem
-                + "-"
-                + hashlib.sha256((str(path.resolve()) + "-wave-1").encode()).hexdigest()[:24]
-                + "-wave.png"
+            wave = (
+                previews
+                / (
+                    path.stem
+                    + "-"
+                    # Like the proxy's key: new bytes at the same path draw a new waveform.
+                    + hashlib.sha256(
+                        json.dumps(
+                            [str(path.resolve()), path.stat().st_size, path.stat().st_mtime_ns, "wave-2"]
+                        ).encode()
+                    ).hexdigest()[:24]
+                    + "-wave.png"
+                )
             )
             if not wave.exists():
-                subprocess.run(
+                encode(
                     [
                         ffmpeg,
                         "-v",
@@ -469,11 +670,9 @@ def describe(self, path, name=None, fps=24):
                         "aformat=channel_layouts=mono,showwavespic=s=1280x80:colors=0x91dab1",
                         "-frames:v",
                         "1",
-                        str(wave),
                     ],
-                    check=True,
-                    capture_output=True,
-                    timeout=60,
+                    wave,
+                    60,
                 )
             result["wave"] = wave.relative_to(self.root).as_posix()
             if not video:
@@ -481,8 +680,10 @@ def describe(self, path, name=None, fps=24):
         return result
 
     def import_footage(self, source, fps=None, detect=True):
-        """Reference a local video in place and split its review proxy into one file per detected shot.
+        """Split a local video's review proxy into one file per detected shot.
 
+        Project imports retain their owned copy using a project-relative original
+        path. Unscoped imports keep the existing absolute in-place reference.
         Shots carry no audio; the source's own audio track is returned separately for the soundtrack lane."""
         source = Path(source)
         if not source.is_absolute() or not source.is_file() or source.suffix.lower() not in VIDEO_EXTENSIONS:
@@ -490,132 +691,120 @@ def import_footage(self, source, fps=None, detect=True):
         video = _video_stream(_probe(source))
         if not video:
             raise ValueError("The file has no video stream")
-        fps = fps or _rate(video["avg_frame_rate"])
+        fps = fps or _rate(video.get("avg_frame_rate"))
         whole = self.describe(source, source.name, fps)
+        original = whole["originalFile"] if self.project_id else str(source)
         ffmpeg = find_tool("ffmpeg")
         proxy = self.root / whole["file"]
         cuts = detect_cuts(scene_scores(ffmpeg, proxy, self.cache / "previews" / "cut-scores"), fps) if detect else []
+        frame_rate = time_base = None
+        start_pts = 0
+        if cuts:
+            proxy_video = _video_stream(_probe(proxy)) or {}
+            frame_rate = _exact_rate(proxy_video.get("avg_frame_rate"), fps)
+            time_base = Fraction(proxy_video.get("time_base", "1/1000000"))
+            start_pts = int(proxy_video.get("start_pts", 0))
         folder = self.cache / "shots" / uid()
         folder.mkdir(parents=True)
-        command = [
-            ffmpeg,
-            "-v",
-            "error",
-            "-y",
-            "-i",
-            str(proxy),
-            "-an",
-            "-c:v",
-            "libx264",
-            "-preset",
-            "ultrafast",
-            "-pix_fmt",
-            "yuv420p",
-            "-g",
-            "6",
-            "-bf",
-            "0",
-        ]
-        if cuts:
-            command += [
-                "-force_key_frames",
-                "expr:" + "+".join(f"eq(n,{cut})" for cut in cuts),
-                "-f",
-                "segment",
-                "-segment_frames",
-                ",".join(map(str, cuts)),
-                "-reset_timestamps",
-                "1",
-                str(folder / "%03d.mp4"),
-            ]
-        else:
-            command.append(str(folder / "000.mp4"))
-        subprocess.run(command, check=True, capture_output=True, timeout=600)
-        shots = []
-        for index, (start, end) in enumerate(zip([0, *cuts], [*cuts, whole["frames"]])):
-            file = folder / f"{index:03d}.mp4"
-            count = int(_probe(file)["streams"][0]["nb_frames"])
-            if count != end - start:
-                raise ValueError(
-                    f"Shot {index + 1} has {count} frames instead of {end - start}; the source could not be split exactly"
+        track = None
+        try:
+            for command in _split_commands(
+                ffmpeg, proxy, folder, cuts, whole["frames"], frame_rate, time_base, start_pts
+            ):
+                subprocess.run(command, check=True, capture_output=True, timeout=600)
+            shots = []
+            for index, (start, end) in enumerate(zip([0, *cuts], [*cuts, whole["frames"]])):
+                file = folder / f"{index:03d}.mp4"
+                count = int(_probe(file)["streams"][0]["nb_frames"])
+                if count != end - start:
+                    raise ValueError(
+                        f"Shot {index + 1} has {count} frames instead of {end - start}; the source could not be split exactly"
+                    )
+                poster = file.with_suffix(".jpg")
+                subprocess.run(
+                    [
+                        ffmpeg,
+                        "-v",
+                        "error",
+                        "-y",
+                        "-ss",
+                        str(count / 2 / fps),
+                        "-i",
+                        str(file),
+                        "-frames:v",
+                        "1",
+                        str(poster),
+                    ],
+                    check=True,
+                    capture_output=True,
+                    timeout=30,
                 )
-            poster = file.with_suffix(".jpg")
-            subprocess.run(
-                [
-                    ffmpeg,
-                    "-v",
-                    "error",
-                    "-y",
-                    "-ss",
-                    str(count / 2 / fps),
-                    "-i",
-                    str(file),
-                    "-frames:v",
-                    "1",
-                    str(poster),
-                ],
-                check=True,
-                capture_output=True,
-                timeout=30,
-            )
-            shots.append(
-                {
-                    "id": uid(),
-                    "kind": "video",
-                    "name": f"Shot {index + 1:02d}",
-                    "file": file.relative_to(self.root).as_posix(),
-                    "originalFile": str(source),
-                    "poster": poster.relative_to(self.root).as_posix(),
-                    "frames": count,
-                    "duration": count / fps,
-                    "audio": False,
-                    "sequenceFps": fps,
-                    "fps": whole["fps"],
-                    "width": whole["width"],
-                    "height": whole["height"],
-                    "sourceRange": {"start": start, "frames": count},
-                    "sourceFrameCount": whole["sourceFrameCount"],
-                    "sourceDuration": whole["sourceDuration"],
-                    "frameRateMode": "interpret",
-                    "review": {**whole["review"], "frames": count, "duration": count / fps},
-                }
-            )
-        audio = None
-        if whole["audio"]:
-            track = self.cache / "previews" / (source.stem + "-" + uid() + "-audio.m4a")
-            subprocess.run(
-                [
-                    ffmpeg,
-                    "-v",
-                    "error",
-                    "-y",
-                    "-i",
-                    str(proxy),
-                    "-map",
-                    "0:a:0",
-                    "-vn",
-                    "-c:a",
-                    "aac",
-                    "-b:a",
-                    "256k",
-                    str(track),
-                ],
-                check=True,
-                capture_output=True,
-                timeout=300,
-            )
-            audio = self.describe(track, source.stem + " audio", fps)
-            audio["originalFile"] = str(source)
-            audio.update(
-                fps=whole["fps"],
-                frames=whole["frames"],
-                duration=whole["duration"],
-                sourceFrameCount=whole["sourceFrameCount"],
-                sourceDuration=whole["sourceDuration"],
-                frameRateMode="interpret",
-                review={"frameRateMode": "interpret"},
-            )
-        return {"fps": fps, "source": whole, "shots": shots, "audio": audio}
+                shots.append(
+                    {
+                        "id": uid(),
+                        "kind": "video",
+                        "name": f"Shot {index + 1:02d}",
+                        "file": file.relative_to(self.root).as_posix(),
+                        "originalFile": original,
+                        "poster": poster.relative_to(self.root).as_posix(),
+                        "frames": count,
+                        "duration": count / fps,
+                        "audio": False,
+                        "sequenceFps": fps,
+                        "fps": whole["fps"],
+                        "width": whole["width"],
+                        "height": whole["height"],
+                        "sourceRange": {"start": start, "frames": count},
+                        "sourceFrameCount": whole["sourceFrameCount"],
+                        "sourceDuration": whole["sourceDuration"],
+                        "frameRateMode": "interpret",
+                        "review": {**whole["review"], "frames": count, "duration": count / fps},
+                    }
+                )
+            audio = None
+            if whole["audio"]:
+                track = self.cache / "previews" / (source.stem + "-" + uid() + "-audio.m4a")
+                subprocess.run(
+                    [
+                        ffmpeg,
+                        "-v",
+                        "error",
+                        "-y",
+                        "-i",
+                        str(proxy),
+                        "-map",
+                        "0:a:0",
+                        "-vn",
+                        "-c:a",
+                        "aac",
+                        "-b:a",
+                        "256k",
+                        str(track),
+                    ],
+                    check=True,
+                    capture_output=True,
+                    timeout=300,
+                )
+                audio = self.describe(track, source.stem + " audio", fps)
+                audio["originalFile"] = original
+                audio.update(
+                    fps=whole["fps"],
+                    frames=whole["frames"],
+                    duration=whole["duration"],
+                    sourceFrameCount=whole["sourceFrameCount"],
+                    sourceDuration=whole["sourceDuration"],
+                    frameRateMode="interpret",
+                    review={"frameRateMode": "interpret"},
+                )
+            return {"fps": fps, "source": whole, "shots": shots, "audio": audio}
+        except BaseException:
+            shutil.rmtree(folder, ignore_errors=True)
+            if track is not None:
+                try:
+                    track.unlink(missing_ok=True)
+                except OSError:
+                    pass  # Preserve the ffmpeg or verification failure if cleanup is denied.
+            raise
 
     def reported(self, record):
         file_type = record.get("type", "output")
@@ -650,9 +839,15 @@ def collect(self, attempt, history, review=True):
                     selected = (node_id, group, index) == (selection["nodeId"], selection["group"], selection["index"])
                     destination = self.result_path(attempt, artifact_id, source.suffix.lower(), selected)
                     destination.parent.mkdir(parents=True, exist_ok=True)
-                    pending = destination.with_suffix(destination.suffix + ".partial")
-                    shutil.copyfile(source, pending)
-                    pending.replace(destination)
+                    pending = unique_partial(destination)
+                    try:
+                        shutil.copyfile(source, pending)
+                        atomic_replace(pending, destination)
+                    finally:
+                        try:
+                            pending.unlink(missing_ok=True)
+                        except OSError:
+                            pass  # Preserve the copy or replacement failure if cleanup is denied.
                     metadata = (
                         self.describe(destination, fps=request.get("sequenceFps", 24))
                         if review
@@ -1052,6 +1247,8 @@ def bake_audio(self, segments, fps, frames):
                     ],
                     capture_output=True,
                     text=True,
+                    encoding="utf-8",
+                    errors="replace",
                     timeout=1800,
                 )
                 if result.returncode:
@@ -1168,7 +1365,7 @@ def preview_result(self, metadata, width, height, fps, output=None):
             "offset": metadata.get("sourceRange", {}).get("start", 0) / fps,
         }
 
-    def export_frame(self, metadata, frame, fps):
+    def _write_frame(self, metadata, frame, output):
         frame = int(frame)
         if metadata["kind"] not in ("video", "image") or not 0 <= frame < metadata["frames"]:
             raise ValueError("Choose a frame inside the footage")
@@ -1176,9 +1373,7 @@ def export_frame(self, metadata, frame, fps):
         if not ffmpeg:
             raise ValueError("Install ffmpeg to export frames")
         original = self.original_source(metadata)
-        folder = self.root / "exports"
-        folder.mkdir(exist_ok=True)
-        output = folder / f"spool-frame-{frame:06d}-{uid()[:8]}.png"
+        output.parent.mkdir(exist_ok=True)
         command = [ffmpeg, "-v", "error", "-y"]
         if metadata["kind"] == "video":
             command += [
@@ -1193,6 +1388,11 @@ def export_frame(self, metadata, frame, fps):
         subprocess.run(command, check=True, capture_output=True, timeout=60)
         if not output.is_file():
             raise ValueError("The source has no frame at this position")
+
+    def export_frame(self, metadata, frame, fps):
+        frame = int(frame)
+        output = self.root / "exports" / f"spool-frame-{frame:06d}-{uid()[:8]}.png"
+        self._write_frame(metadata, frame, output)
         return {
             "url": ("/spool/media/" + self.project_id + "/exports/" if self.project_id else "/spool/media/exports/")
             + output.name,
@@ -1212,25 +1412,34 @@ def comparison(self, clip, take_ids, fps):
         canvas = Image.new("RGB", (columns * 384, ((len(takes) + columns - 1) // columns) * 256), "#181818")
         drawing = ImageDraw.Draw(canvas)
         evidence = []
-        for index, take in enumerate(takes):
-            metadata = take["media"]
-            frame = min(
-                metadata["frames"] - 1,
-                max(0, (clip.get("in", 0) + min(clip.get("out", metadata["frames"]), metadata["frames"]) - 1) // 2),
-            )
-            result = self.export_frame(metadata, frame, fps)
-            with Image.open(self.root / "exports" / result["filename"]) as image:
-                tile = ImageOps.contain(image.convert("RGB"), (384, 216))
-                x, y = index % columns * 384, index // columns * 256
-                canvas.paste(tile, (x + (384 - tile.width) // 2, y + (216 - tile.height) // 2))
-                drawing.text((x + 8, y + 224), take["id"][:32], fill="white")
-            evidence.append(
-                {
-                    "takeId": take["id"],
-                    "sampleFrame": frame,
-                    **{k: metadata.get(k) for k in ("kind", "duration", "width", "height", "fps", "audio")},
-                }
-            )
+        temporary = tempfile.TemporaryDirectory(prefix="spool-comparison-", dir=self.cache, ignore_cleanup_errors=True)
+        try:
+            for index, take in enumerate(takes):
+                metadata = take["media"]
+                frame = min(
+                    metadata["frames"] - 1,
+                    max(0, (clip.get("in", 0) + min(clip.get("out", metadata["frames"]), metadata["frames"]) - 1) // 2),
+                )
+                output = Path(temporary.name) / (str(index) + ".png")
+                self._write_frame(metadata, frame, output)
+                with Image.open(output) as image:
+                    tile = ImageOps.contain(image.convert("RGB"), (384, 216))
+                    x, y = index % columns * 384, index // columns * 256
+                    canvas.paste(tile, (x + (384 - tile.width) // 2, y + (216 - tile.height) // 2))
+                    drawing.text((x + 8, y + 224), take["id"][:32], fill="white")
+                evidence.append(
+                    {
+                        "takeId": take["id"],
+                        "sampleFrame": frame,
+                        **{k: metadata.get(k) for k in ("kind", "duration", "width", "height", "fps", "audio")},
+                    }
+                )
+        finally:
+            try:
+                temporary.cleanup()
+            except OSError:
+                pass  # Retain the comparison result or original failure if cleanup is denied.
+        (self.root / "exports").mkdir(exist_ok=True)
         target = self.root / "exports" / ("comparison-" + uid() + ".png")
         canvas.save(target)
         return {
diff --git a/spool/ownership.py b/spool/ownership.py
index 4110371..1920275 100644
--- a/spool/ownership.py
+++ b/spool/ownership.py
@@ -63,9 +63,6 @@ def file_lock(path):
     # One coarse lock covers refresh, transaction and atomic publication. No live
     # SQLite/WAL file is opened on the share, including by the offline editor.
     with path.open("a+b") as handle:
-        if handle.tell() == 0:
-            handle.write(b"0")
-            handle.flush()
         deadline = time.monotonic() + 30
         while True:
             handle.seek(0)
@@ -82,6 +79,11 @@ def file_lock(path):
                     raise Conflict("Project is busy in another editor. Try again.") from error
                 time.sleep(0.05)
         try:
+            # Byte locks may cover an empty file. Initialize only after taking
+            # the lock: a read-only maintenance copy may already own byte zero.
+            if handle.seek(0, os.SEEK_END) == 0:
+                handle.write(b"0")
+                handle.flush()
             yield
         finally:
             if os.name == "nt":
diff --git a/spool/projects.py b/spool/projects.py
index a1ef946..51c184c 100644
--- a/spool/projects.py
+++ b/spool/projects.py
@@ -1,6 +1,7 @@
 """Project folders are durable; SQLite working files stay on the editing computer."""
 
 import copy
+import errno
 import hashlib
 import json
 import logging
@@ -8,28 +9,110 @@
 import re
 import shutil
 import sqlite3
+import stat
 import tempfile
 import threading
+import time
 from datetime import datetime, timezone
-from contextlib import contextmanager, closing
+from contextlib import contextmanager, closing, nullcontext
 from pathlib import Path
 
 from .errors import NotFound
 from . import take_files
 from .media import Media
 from .ownership import file_lock, atomic_replace
-from .store import Store, Conflict, uid, SCHEMA_VERSION, validate_import, read_only_uri
+from .store import Store, Conflict, uid, SCHEMA_VERSION, encode, validate_import, read_only_uri
 from .durable import atomic_json, write as durable_write
 from . import __version__
 
 
+@contextmanager
+def existing_project_lock(path):
+    """Coordinate a copy without creating or writing the project's lock file.
+
+    Legacy folders can have no lock yet. They remain inspectable, but a writer
+    opening one concurrently can still encounter the source-copy handle. Once
+    a lock exists, hold its same byte until that handle has closed on Windows.
+    """
+    try:
+        source = path.open("rb")
+    except FileNotFoundError:
+        yield
+        return
+    with source:
+        if os.name == "nt":
+            import ctypes
+            import msvcrt
+            from ctypes import wintypes
+
+            kernel = ctypes.WinDLL("kernel32", use_last_error=True)
+            lock, unlock = kernel.LockFile, kernel.UnlockFile
+            for operation in (lock, unlock):
+                operation.argtypes = (wintypes.HANDLE, wintypes.DWORD, wintypes.DWORD, wintypes.DWORD, wintypes.DWORD)
+                operation.restype = wintypes.BOOL
+            handle = msvcrt.get_osfhandle(source.fileno())
+
+            def acquire():
+                # Unlike CRT locking, LockFile accepts an rb handle, including
+                # an empty file: locking beyond EOF does not extend it.
+                if not lock(handle, 0, 0, 1, 0):
+                    raise ctypes.WinError(ctypes.get_last_error())
+
+            def release():
+                if not unlock(handle, 0, 0, 1, 0):
+                    raise ctypes.WinError(ctypes.get_last_error())
+
+        else:
+            import fcntl
+
+            def acquire():
+                fcntl.flock(source, fcntl.LOCK_EX | fcntl.LOCK_NB)
+
+            def release():
+                fcntl.flock(source, fcntl.LOCK_UN)
+
+        deadline = time.monotonic() + 30
+        while True:
+            try:
+                acquire()
+                break
+            except OSError as error:
+                retryable = (
+                    getattr(error, "winerror", None) in (32, 33)
+                    if os.name == "nt"
+                    else error.errno in (errno.EACCES, errno.EAGAIN)
+                )
+                if not retryable:
+                    raise
+                if time.monotonic() >= deadline:
+                    raise Conflict("Project is busy in another editor. Try again.") from error
+                time.sleep(0.05)
+        try:
+            yield
+        finally:
+            release()
+
+
+@contextmanager
+def private_snapshot(path):
+    """Copy one immutable, atomically published generation to a private directory."""
+    with tempfile.TemporaryDirectory(prefix="spool-maintenance-read-") as directory:
+        local = Path(directory) / "read.sqlite3"
+        with existing_project_lock(path.parent / ".spool" / "project.lock"):
+            with path.open("rb") as source, local.open("xb") as target:
+                shutil.copyfileobj(source, target)
+        yield local
+
+
 def folder_name(name):
-    name = re.sub(r'[<>:"/\\|?*\x00-\x1f]', "-", str(name)).strip(" .")[:100]
+    name = re.sub(r'[<>:"/\\|?*\x00-\x1f]', "-", str(name)).strip(" .")[:100].rstrip(" .")
     if not name or name.upper().split(".")[0] in {
         "CON",
         "PRN",
         "AUX",
         "NUL",
+        "CONIN$",
+        "CONOUT$",
         *["COM" + str(i) for i in range(1, 10)],
         *["LPT" + str(i) for i in range(1, 10)],
     }:
@@ -37,21 +120,95 @@ def folder_name(name):
     return name
 
 
+def working_cache(workspace, folder):
+    """The local editing cache a ProjectStore derives from one project folder.
+
+    Import cleanup needs this identity before a failed constructor leaves no store,
+    and it must stay exactly the path ProjectStore.__init__ uses.
+    """
+    folder = Path(folder).resolve()
+    key = hashlib.sha256(str(folder).encode()).hexdigest()
+    return Path(workspace.root) / "cache" / key
+
+
+def _redirected(path):
+    """Reject redirects and paths whose redirection status cannot be inspected."""
+    try:
+        info = path.lstat()
+    except FileNotFoundError:
+        return False
+    except OSError:
+        return True  # Unreadable metadata cannot authorize recursive cleanup.
+    if stat.S_ISLNK(info.st_mode):
+        return True
+    return bool(getattr(info, "st_file_attributes", 0) & getattr(stat, "FILE_ATTRIBUTE_REPARSE_POINT", 0))
+
+
+def _discard_import(workspace, folder, destination, parent, cache, cache_existed):
+    """Remove only the folder and cache one failed import created.
+
+    Constructor, import transaction and registration failures can leave the local
+    working cache behind even when the project folder is gone. Cleanup is best
+    effort so the caller still raises its original error.
+    """
+    if cache is None:
+        # Cache setup failed before construction. Remove only the empty leaf
+        # mkdtemp created under the already resolved projects directory.
+        try:
+            if folder.parent == parent and not _redirected(folder):
+                folder.rmdir()
+        except OSError:
+            pass
+        return
+    try:
+        if destination.parent == parent and folder.resolve() == destination and not _redirected(folder):
+            shutil.rmtree(destination)
+    except Exception:
+        pass  # Preserve the import failure if cleanup is also denied.
+    if cache_existed:
+        return
+    try:
+        cache_root = Path(workspace.root) / "cache"
+        # A redirected cache root or cache could make the delete reach outside this
+        # workspace. Requiring the exact child of the real cache root also keeps a
+        # broad path from ever reaching the root itself.
+        if _redirected(cache_root) or _redirected(cache) or cache != working_cache(workspace, destination):
+            return
+        root, target = cache_root.resolve(), cache.resolve()
+        if target.parent != root or target == root or not target.is_dir():
+            return
+        shutil.rmtree(target)
+    except Exception:
+        pass  # Preserve the import failure if cleanup is also denied.
+
+
 class ProjectStore(Store):
     def __init__(self, folder, workspace=None, *, migrate=True, writable=False):
         self.workspace = workspace
         self.migrate_on_open = migrate
+        self.publication_lock = threading.Lock()
+        self.publication_cache = None
         folder = Path(folder).resolve()
         self.manifest = folder / "project.json"
         self.check_manifest()
         self.snapshot = folder / "project.spool"
+        read_only = not (migrate or writable)
         # Refuse newer SQLite formats before creating even the lock/cache folders.
         if self.snapshot.exists():
-            with closing(sqlite3.connect(read_only_uri(self.snapshot), uri=True)) as db:
-                if db.execute("PRAGMA user_version").fetchone()[0] > SCHEMA_VERSION:
-                    raise ValueError("This Spool project needs a newer extension version")
-        key = hashlib.sha256(str(folder).encode()).hexdigest()
-        cache = (workspace.root / "cache" if workspace else Path(tempfile.gettempdir()) / "spool-maintenance") / key
+            with private_snapshot(self.snapshot) if read_only else nullcontext(self.snapshot) as path:
+                with closing(sqlite3.connect(read_only_uri(path), uri=True)) as db:
+                    if db.execute("PRAGMA user_version").fetchone()[0] > SCHEMA_VERSION:
+                        raise ValueError("This Spool project needs a newer extension version")
+        # Maintenance without a workspace trusts whatever working copy its cache holds, so
+        # a writable one gets a folder of its own: another user could fill a shared path.
+        self.private_cache = None
+        if workspace:
+            cache = working_cache(workspace, folder)
+        elif migrate or writable:
+            cache = self.private_cache = Path(tempfile.mkdtemp(prefix="spool-maintenance-"))
+        else:
+            key = hashlib.sha256(str(folder).encode()).hexdigest()
+            cache = Path(tempfile.gettempdir()) / "spool-maintenance" / key  # never created when read-only
         self.runtime = cache / "working.sqlite3"
         self.stamp = cache / "checkpoint.json"
         self.read_runtime = cache / "read.sqlite3"
@@ -93,26 +250,91 @@ def write_manifest(self, db):
             }
             atomic_json(self.manifest, value)
 
-    def signature(self):
+    def signature(self, *, locked=False):
+        """Name one published snapshot, not merely a timestamp and a size.
+
+        FAT, HFS+ and some SMB servers give files a one- or two-second timestamp, and a
+        SQLite snapshot usually keeps its size. A save in the same tick therefore used to
+        look unchanged, so a reader kept an old revision and could later save over newer
+        work. Every publication puts a fresh UUID in the snapshot itself. The stat fields
+        still make an old snapshot without that marker detectable when it is replaced, and
+        they let a reader reuse the cached marker without opening the share on every poll.
+        Cache misses open SQLite under the project lock so its Windows handle cannot
+        prevent a concurrent replacement. Callers holding that lock pass locked=True.
+        """
         stat = self.snapshot.stat()
-        return [stat.st_mtime_ns, stat.st_size]
+        fields = [stat.st_mtime_ns, stat.st_size, stat.st_dev, stat.st_ino, stat.st_ctime_ns]
+        key = (stat.st_dev, stat.st_ino, stat.st_mtime_ns, stat.st_ctime_ns, stat.st_size)
+        # Whole-millisecond or whole-second timestamps are the filesystems where two
+        # publications can share every visible stat field; there the marker is read each
+        # time instead of trusted from the cache.
+        cacheable = stat.st_ino != 0 and stat.st_mtime_ns % 1_000_000 and stat.st_ctime_ns % 1_000_000
+        with self.publication_lock:
+            if cacheable and self.publication_cache is not None and self.publication_cache[0] == key:
+                return [*fields, self.publication_cache[1]]
+        if not locked:
+            with file_lock(self.lock_file):
+                # Publication may have changed while waiting: stat and marker must
+                # identify the same file, and a file lock must never be reacquired.
+                return self.signature(locked=True)
+        value = self.read_publication()
+        # A snapshot is never edited in place: publications replace the file. File identity
+        # lets unchanged polls avoid opening SQLite while a replacement still misses the cache.
+        with self.publication_lock:
+            if cacheable:
+                self.publication_cache = (key, value)
+        return [*fields, value]
+
+    def read_publication(self):
+        """Read under the project lock; only an absent legacy table has no identity."""
+        with closing(sqlite3.connect(read_only_uri(self.snapshot), uri=True)) as db:
+            exists = db.execute(
+                "SELECT 1 FROM sqlite_master WHERE type='table' AND name='spool_publication'"
+            ).fetchone()
+            if not exists:
+                return None
+            row = db.execute("SELECT publication FROM spool_publication WHERE id=1").fetchone()
+        if not row or not isinstance(row[0], str) or not row[0]:
+            raise sqlite3.DatabaseError("Spool snapshot publication identity is missing or invalid")
+        return row[0]
+
+    def write_publication(self, path):
+        """Stamp the copy that is about to replace project.spool, before it is visible.
+
+        The marker is an additive table, not a schema-version change: older Spool readers
+        ignore it, and the project document and manifest keep their existing shape.
+        """
+        token = uid()
+        db = sqlite3.connect(path, timeout=30)
+        try:
+            db.execute("PRAGMA journal_mode=DELETE")
+            db.execute(
+                "CREATE TABLE IF NOT EXISTS spool_publication("
+                "id INTEGER PRIMARY KEY CHECK(id=1), publication TEXT NOT NULL)"
+            )
+            db.execute("INSERT OR REPLACE INTO spool_publication VALUES(1,?)", (token,))
+            db.commit()
+        finally:
+            db.close()
+        return token
 
     @contextmanager
     def connect(self):
         if self.read_only:
-            with Store.connect(self) as db:
+            with self.reading() as db:
                 yield db
             return
         notifications = []
         with file_lock(self.local_lock), file_lock(self.lock_file):
             self.check_manifest()
-            signature = self.signature() if self.snapshot.exists() else None
+            signature = self.signature(locked=True) if self.snapshot.exists() else None
             try:
                 saved = json.loads(self.stamp.read_text()) if self.stamp.exists() else None
             except json.JSONDecodeError:
                 saved = None
             if signature is None or not self.runtime.exists() or saved != signature:
-                for suffix in ("", "-wal", "-shm"):
+                # A crash leaves "-journal" beside the old copy; SQLite would roll it into the new one.
+                for suffix in ("", "-journal", "-wal", "-shm"):
                     self.runtime.with_name(self.runtime.name + suffix).unlink(missing_ok=True)
                 if signature is not None:
                     shutil.copyfile(self.snapshot, self.runtime)
@@ -153,13 +375,14 @@ def connect(self):
                             backup.execute("PRAGMA journal_mode=DELETE")
                         finally:
                             backup.close()
+                        self.write_publication(local)
                         with local.open("rb") as source, pending.open("wb") as target:
                             shutil.copyfileobj(source, target)
                             target.flush()
                             os.fsync(target.fileno())
                         atomic_replace(pending, self.snapshot)
                         self.write_manifest(db)
-                        self.stamp.write_text(json.dumps(self.signature()))
+                        self.stamp.write_text(json.dumps(self.signature(locked=True)))
                         if notify:
                             notifications = [
                                 {"projectId": identity, "revision": token[0], "cursor": token[1]}
@@ -201,8 +424,13 @@ def reading(self):
         Writers use a different local file and can publish while a read is open.
         """
         if self.read_only:
-            with Store.connect(self) as db:
-                yield db
+            self.check_manifest()
+            with private_snapshot(self.snapshot) as path:
+                with closing(sqlite3.connect(read_only_uri(path), uri=True)) as db:
+                    if db.execute("PRAGMA user_version").fetchone()[0] > SCHEMA_VERSION:
+                        raise ValueError("This Spool project needs a newer extension version")
+                    db.row_factory = sqlite3.Row
+                    yield db
             return
         with file_lock(self.read_lock):
             self.check_manifest()
@@ -214,7 +442,7 @@ def reading(self):
             if saved != signature or not self.read_runtime.exists():
                 with file_lock(self.lock_file):
                     self.check_manifest()
-                    signature = self.signature()
+                    signature = self.signature(locked=True)
                     pending = self.read_runtime.with_suffix(".partial")
                     try:
                         shutil.copyfile(self.snapshot, pending)
@@ -251,15 +479,22 @@ def _write_document(self, db, project_id, document):
                 t for t in clip.get("takes", []) if t["id"] not in deleted and t["media"]["id"] not in media_ids
             ]
         document["media"] = [m for m in document.get("media", []) if m["id"] not in media_ids]
-        folders = {c.get("outputFolder") for c in document.get("clips", [])}
+
+        # Allocate portable names even on a case-sensitive host. Assigned paths
+        # stay unchanged, including shared folders in existing projects.
+        def folder_key(value):
+            return str((self.root / value).resolve()).casefold()
+
+        folders = {folder_key(c["outputFolder"]) for c in document.get("clips", []) if c.get("outputFolder")}
         existing_folders = {c.get("outputFolder") for c in previous.get("clips", [])}
         for clip in document.get("clips", []):
             if not clip.get("outputFolder"):
-                name = "output/" + folder_name(clip.get("name", "Clip"))
-                if name in folders:
-                    name += "-" + uid()[:8]
+                base = "output/" + folder_name(clip.get("name", "Clip"))
+                name = base
+                while folder_key(name) in folders:
+                    name = base + "-" + uid()[:8]
                 clip["outputFolder"] = name
-                folders.add(name)
+                folders.add(folder_key(name))
             if clip["outputFolder"] not in existing_folders:
                 path = (self.root / clip["outputFolder"]).resolve()
                 if path == self.root / "output" or not path.is_relative_to(self.root / "output"):
@@ -303,6 +538,7 @@ def __init__(self, root):
         super().__init__(root, filename="app.sqlite3")
         self.opened = {}
         self.opening = threading.RLock()  # handlers open project stores from worker threads
+        self.unavailable = {}  # folder -> (files, error, retry after, delay) for folders that failed to open
 
     def folders(self):
         return self.setting("project_folders") or []
@@ -316,17 +552,31 @@ def open_folder(self, folder):
         if len(projects) != 1:
             raise ValueError("A project folder must contain exactly one project")
         project_id = projects[0]["id"]
-        folders = self.folders()
-        old = next((row for row in folders if row["id"] == project_id), None)
-        if old and Path(old["folder"]) != folder and (Path(old["folder"]) / "project.spool").exists():
-            raise Conflict("This project is already open from another folder")
-        self.set_setting(
-            "project_folders",
-            [row for row in folders if row["id"] != project_id] + [{"id": project_id, "folder": str(folder)}],
-        )
+
+        def check(folders):
+            old = next((row for row in folders if row["id"] == project_id), None)
+            if old and Path(old["folder"]) != folder and (Path(old["folder"]) / "project.spool").exists():
+                raise Conflict("This project is already open from another folder")
+
+        self.register_folder(project_id, folder, check)
         self.opened[project_id] = store
         return store.get(project_id)
 
+    def register_folder(self, project_id, folder, check=None):
+        """Add one project folder to the list in a single transaction.
+
+        Creating, opening and importing run in worker threads (and maybe another
+        process); reading the list and writing it back separately lost entries.
+        """
+        with self.connect() as db:
+            db.execute("BEGIN IMMEDIATE")
+            row = db.execute("SELECT document FROM settings WHERE key='project_folders'").fetchone()
+            folders = json.loads(row[0]) if row else []
+            if check:
+                check(folders)
+            folders = [row for row in folders if row["id"] != project_id] + [{"id": project_id, "folder": str(folder)}]
+            db.execute("INSERT OR REPLACE INTO settings VALUES(?,?)", ("project_folders", encode(folders)))
+
     def for_project(self, project_id):
         row = next((r for r in self.folders() if r["id"] == project_id), None)
         if row is None:
@@ -336,13 +586,49 @@ def for_project(self, project_id):
             raise ValueError("Project folder is unavailable: " + str(folder))
         with self.opening:
             if project_id not in self.opened or self.opened[project_id].root != folder:
-                self.opened[project_id] = ProjectStore(folder, self)
+                self.opened[project_id] = self.open_store(folder)
             return self.opened[project_id]
 
+    def open_store(self, folder):
+        """Open a project folder, waiting longer between attempts while it keeps failing.
+
+        The receipt scan and dispatcher open every folder every few seconds, and each
+        attempt at a failing migration first writes a backup of the snapshot. A changed
+        snapshot or manifest is tried again at once.
+        """
+
+        def state(path):
+            if not path.exists():
+                return None
+            stat = path.stat()
+            return (stat.st_mtime_ns, stat.st_size, stat.st_dev, stat.st_ino, stat.st_ctime_ns)
+
+        files = tuple(state(path) for path in (folder / "project.spool", folder / "project.json"))
+        held = self.unavailable.get(str(folder))
+        if held and held[0] == files and time.monotonic() < held[2]:
+            raise held[1].with_traceback(None)
+        try:
+            store = ProjectStore(folder, self)
+        except (ValueError, OSError, sqlite3.Error) as error:
+            delay = min(3600, held[3] * 2) if held and held[0] == files else 5
+            self.unavailable[str(folder)] = (files, error, time.monotonic() + delay, delay)
+            logging.warning("Spool could not open the project folder %s: %s", folder, error)
+            raise
+        self.unavailable.pop(str(folder), None)
+        return store
+
     def project_stores(self):
-        return [
-            self.for_project(row["id"]) for row in self.folders() if (Path(row["folder"]) / "project.spool").is_file()
-        ]
+        """Every project folder that opens; one that cannot is skipped, not fatal to the others."""
+        stores = []
+        for row in self.folders():
+            if (Path(row["folder"]) / "project.spool").is_file():
+                try:
+                    store = self.for_project(row["id"])
+                    store.check_manifest()  # an already-open folder may have been upgraded since
+                    stores.append(store)
+                except (ValueError, OSError, sqlite3.Error):
+                    continue
+        return stores
 
     def create(self, document=None, folder=None):
         if folder is None:
@@ -367,7 +653,17 @@ def list(self):
                     {"id": held["id"], "name": Path(held["folder"]).name, "folder": held["folder"], "unavailable": True}
                 )
                 continue
-            rows += [{**row, "folder": held["folder"]} for row in self.for_project(held["id"]).list()]
+            try:
+                listed = self.for_project(held["id"]).list()
+            except (ValueError, OSError, sqlite3.Error):
+                # A newer format or damaged folder is listed as unavailable, not a failed list.
+                listed = None
+            if listed is None:
+                rows.append(
+                    {"id": held["id"], "name": Path(held["folder"]).name, "folder": held["folder"], "unavailable": True}
+                )
+                continue
+            rows += [{**row, "folder": held["folder"]} for row in listed]
         return rows
 
     def get(self, project_id):
@@ -386,14 +682,23 @@ def import_project(self, value):
         parent = Path(self.setting("projects_directory") or self.root / "projects").resolve()
         parent.mkdir(parents=True, exist_ok=True)
         folder = Path(tempfile.mkdtemp(prefix="Untitled Spool project-", dir=parent))
+        destination, cache = folder, None
+        cache_existed = True
         try:
+            destination = folder.resolve()
+            cache = working_cache(self, folder)
+            try:
+                cache.lstat()
+            except FileNotFoundError:
+                cache_existed = False
+            except OSError:
+                pass  # Only confirmed absence establishes this import's ownership.
             store = ProjectStore(folder, self)
             project = store.import_project(value)
-            self.set_setting("project_folders", [*self.folders(), {"id": project["id"], "folder": str(folder)}])
+            self.register_folder(project["id"], folder)
         except Exception:
-            # Only this import's exclusively created destination belongs to us.
-            if folder.resolve().parent == parent:
-                shutil.rmtree(folder)
+            # The constructor creates the local working cache before it can fail.
+            _discard_import(self, folder, destination, parent, cache, cache_existed)
             raise
         self.opened[project["id"]] = store
         return project
diff --git a/spool/requests.py b/spool/requests.py
index 5e77640..3e9e2db 100644
--- a/spool/requests.py
+++ b/spool/requests.py
@@ -194,6 +194,9 @@ def audio_input_segments(document, clip, setting):
     ]
 
 
+IMAGE_SAVERS = {"SaveImage", "PreviewImage"}
+
+
 def local_compatibility(prompt, result):
     if any(node["class_type"] in LAUNCHERS for node in prompt.values()):
         raise ValueError(
@@ -261,6 +264,9 @@ def prepare(store, media, project, items, freeze=True):
             raise ValueError("Choose local ComfyUI, Comfy Cloud or Deadline execution")
         if target == attempts.CLOUD and not cloud.available():
             raise ValueError(cloud.UNAVAILABLE)
+        if target == attempts.CLOUD and capture["prompt"][capture["result"]["nodeId"]]["class_type"] in IMAGE_SAVERS:
+            # Cloud results are collected as video files; an image result would render and never arrive.
+            raise ValueError("Comfy Cloud renders video only. Choose a SaveVideo result for this workflow.")
         local_compatibility({k: v for k, v in capture["prompt"].items() if k not in launchers}, capture["result"])
         # A clip set to Deadline whose workflow has no submit node gets one in each
         # frozen request only; the saved workflow and its takes' workflows stay as made.
@@ -422,7 +428,10 @@ def prepare(store, media, project, items, freeze=True):
                 original = media.prepare_input(original)
                 source = contained(media.host_roots["input"], original.removesuffix(" [input]"))
                 if source not in frozen_assets:
-                    replacement = media.freeze_asset(original) if freeze else original.removesuffix(" [input]")
+                    # Resolve and validate the whole batch before making immutable
+                    # snapshots. A later invalid clip or missing input must not
+                    # leave copies from the requests that preceded it.
+                    replacement = original.removesuffix(" [input]")
                     path = contained(media.host_roots["input"], replacement)
                     frozen_assets[source] = {
                         "frozen": replacement,
@@ -465,6 +474,16 @@ def prepare(store, media, project, items, freeze=True):
                     },
                 )
             )
+    if freeze:
+        for asset in frozen_assets.values():
+            replacement = media.freeze_asset(asset["frozen"])
+            path = contained(media.host_roots["input"], replacement)
+            asset.update({"frozen": replacement, "byteSize": path.stat().st_size, "sha256": sha256(path)})
+        for _, request in requests:
+            for asset in request["assets"]:
+                source = contained(media.host_roots["input"], asset["source"].removesuffix(" [input]"))
+                asset.update(frozen_assets[source])
+                request["prompt"][asset["nodeId"]]["inputs"][asset["input"]] = asset["frozen"]
     return requests
 
 
diff --git a/spool/routes.py b/spool/routes.py
index 9b0bac9..2c0c1f8 100644
--- a/spool/routes.py
+++ b/spool/routes.py
@@ -12,6 +12,7 @@
 
 from .errors import NotFound, SpoolError, Forbidden, RevisionConflict, StudioOutdated
 from .protocol import API_VERSION
+from .store import validate_capture
 from .editor import editor_html
 from .media import EXTENSIONS, contained, staged_relative
 from .playback import PlaybackQueue
@@ -98,10 +99,96 @@
 
 def inside(path, root):
     """Lexical containment, matching `contained`; mapped drives are not resolved to UNC."""
-    base = os.path.normcase(os.path.abspath(root))
+    base = os.path.normcase(os.path.abspath(root)).rstrip(os.sep)  # a drive root keeps its separator
     return os.path.normcase(os.path.abspath(path)).startswith(base + os.sep)
 
 
+def required_fields(data, *fields):
+    """Read required top-level JSON fields as a client error, before any work.
+
+    A missing field is a malformed request, not an internal failure. The route
+    still validates each value, so accepted types do not change here.
+    """
+    if not isinstance(data, dict):
+        raise ValueError("Request body must be a JSON object")
+    for field in fields:
+        if field not in data:
+            raise ValueError("Request body is missing the required %s field" % field)
+    return [data[field] for field in fields]
+
+
+def revision_header(request):
+    """The saved revision a workflow import is written against."""
+    value = request.headers.get("X-Spool-Revision")
+    if value is None:
+        raise ValueError("The X-Spool-Revision header is required")
+    try:
+        return int(value)
+    except ValueError:
+        raise ValueError("The X-Spool-Revision header must be an integer") from None
+
+
+def object_rows(value, field, *keys):
+    """Check containers consumed by save/preparation, without defining a project schema."""
+    if not isinstance(value, list) or any(not isinstance(row, dict) for row in value):
+        raise ValueError(f"{field} must be a list of JSON objects")
+    if any(not isinstance(row.get(key), str) for row in value for key in keys):
+        raise ValueError(f"{field} entries need string fields: {', '.join(keys)}")
+    return value
+
+
+def capture_shape(capture):
+    """Reject malformed capture containers before file preparation; Store owns their meaning."""
+    if not isinstance(capture, dict):
+        raise ValueError("The captured workflow must be a JSON object")
+    object_rows(capture.get("bindings", []), "Capture bindings", "key", "nodeId", "input")
+    for field in ("provenance", "result", "inputRecovery"):
+        if field in capture and not isinstance(capture[field], dict):
+            raise ValueError(f"Capture {field} must be a JSON object")
+    if not isinstance(capture.get("inputRecovery", {}).get("recovered", []), list):
+        raise ValueError("Capture inputRecovery.recovered must be a list")
+    if "result" in capture and not isinstance(capture["result"].get("nodeId"), str):
+        raise ValueError("Capture result needs a string nodeId")
+    builtin = capture.get("provenance", {}).get("builtinTemplate")
+    if builtin is not None and not isinstance(builtin, str):
+        raise ValueError("Capture builtinTemplate must be a string")
+    graphs = [capture["workflow"]] if capture.get("workflow") is not None else []
+    while graphs:
+        graph = graphs.pop()
+        if not isinstance(graph, dict):
+            raise ValueError("Capture workflow must be a JSON object")
+        nodes = object_rows(graph.get("nodes", []), "Workflow nodes", "type")
+        if any("id" not in node for node in nodes):
+            raise ValueError("Workflow nodes need an id")
+        definitions = graph.get("definitions", {})
+        if not isinstance(definitions, dict):
+            raise ValueError("Workflow definitions must be a JSON object")
+        graphs.extend(object_rows(definitions.get("subgraphs", []), "Workflow subgraphs", "id"))
+    validate_capture(capture)
+
+
+def save_shapes(document, recipes):
+    """Preflight every save container before any recipe can stage input files."""
+    if not isinstance(document, dict) or not isinstance(document.get("clips"), list):
+        raise ValueError("Project document must be an object with a clips list")
+    clips = object_rows(document["clips"], "Document clips", "id")
+    object_rows(document.get("media", []), "Document media", "id")
+    for field in ("audioClips", "importedWorkflows"):
+        object_rows(document.get(field, []), "Document " + field)
+    for clip in clips:
+        takes = object_rows(clip.get("takes", []), "Clip takes", "id")
+        for take in takes:
+            if not isinstance(take.get("media"), dict) or not isinstance(take["media"].get("id"), str):
+                raise ValueError("Take media must be a JSON object with an id")
+        object_rows(clip.get("bindings", []), "Clip bindings", "key")
+        if not isinstance(clip.get("inputValues", {}), dict):
+            raise ValueError("Clip inputValues must be a JSON object")
+    if not isinstance(recipes, dict):
+        raise ValueError("workflowRecipes must be a JSON object")
+    for capture in recipes.values():
+        capture_shape(capture)
+
+
 def register(server, store, media, executor=None):
     """Executor is None when Spool runs without ComfyUI; editing, import and export still work."""
     routes = server.routes
@@ -367,10 +454,9 @@ async def upload_input(request):
     async def generation_preview(request):
         store, media = await asyncio.to_thread(services, request)
         data = unwire(await request.json())
+        revision, clip_id = required_fields(data, "revision", "clipId")
         return response(
-            await asyncio.to_thread(
-                requests.preview, store, media, request.match_info["project"], data["revision"], data["clipId"]
-            )
+            await asyncio.to_thread(requests.preview, store, media, request.match_info["project"], revision, clip_id)
         )
 
     @routes.get("/spool/api/projects/{project}/status")
@@ -421,6 +507,10 @@ async def comparison(request):
         store, media = await asyncio.to_thread(services, request)
         data = await request.json()
         clip = await asyncio.to_thread(store.clip, request.match_info["project"], data["clipId"])
+        chosen = data["takeIds"] if isinstance(data["takeIds"], list) else []
+        # The sheet is served to the caller, so it reads only footage the caller may download.
+        records = [t["media"] for t in clip["takes"] if t["id"] in chosen and not t.get("placeholder")]
+        await asyncio.to_thread(guard_originals, request, store, media, records)
         fps = await asyncio.to_thread(store.frame_rate, request.match_info["project"])
         return response(await asyncio.to_thread(media.comparison, clip, data["takeIds"], fps))
 
@@ -504,42 +594,45 @@ async def project_import(request):
     @routes.put("/spool/api/projects/{project}")
     @endpoint
     async def save(request):
-        store, media = await asyncio.to_thread(services, request)
         text = await request.text()
         data = await asyncio.to_thread(lambda: unwire(json.loads(text)))
+        revision, document = required_fields(data, "revision", "document")
+        workflow_recipes = data.get("workflowRecipes", {})
+        save_shapes(document, workflow_recipes)
+        store, media = await asyncio.to_thread(services, request)
         recipes = {}
-        for version, capture in data.get("workflowRecipes", {}).items():
+        for version, capture in workflow_recipes.items():
             recipes[version] = await prepare_capture(capture, request)
-            for clip in data["document"]["clips"]:
+            for clip in document["clips"]:
                 if clip.get("workflowVersion") == version and clip.get("inputValues"):
                     operations.restage(capture, recipes[version], clip["inputValues"])
         return await project_response(
             request,
-            await asyncio.to_thread(
-                store.save, request.match_info["project"], data["revision"], data["document"], recipes
-            ),
+            await asyncio.to_thread(store.save, request.match_info["project"], revision, document, recipes),
         )
 
     @routes.post("/spool/api/projects/{project}/import-workflow")
     @endpoint
     async def import_workflow(request):
         store, media = await asyncio.to_thread(services, request)
+        revision = revision_header(request)
         imported = parse_import(await request.text(), unquote(request.headers.get("X-Filename", "Imported workflow")))
         imported["data"] = await prepare_inputs(imported["data"], request)
         project_id = request.match_info["project"]
         project = await asyncio.to_thread(store.get, project_id)
         project["document"].setdefault("importedWorkflows", []).append(imported)
-        saved = await asyncio.to_thread(
-            store.save, project_id, int(request.headers["X-Spool-Revision"]), project["document"]
-        )
+        saved = await asyncio.to_thread(store.save, project_id, revision, project["document"])
         return response({"project": saved, "workflow": imported})
 
     @routes.post("/spool/api/projects/{project}/capture/{clip}")
     @endpoint
     async def capture(request):
-        store, media = await asyncio.to_thread(services, request)
         data = unwire(await request.json())
-        original = data["capture"]
+        revision, original = required_fields(data, "revision", "capture")
+        capture_shape(original)
+        if data.get("overrides") is not None and not isinstance(data["overrides"], dict):
+            raise ValueError("Capture overrides must be a JSON object")
+        store, media = await asyncio.to_thread(services, request)
         data["capture"] = await prepare_capture(original, request)
         if data.get("overrides"):
             operations.restage(original, data["capture"], data["overrides"])
@@ -547,7 +640,7 @@ async def capture(request):
             operations.apply_capture,
             store,
             request.match_info["project"],
-            data["revision"],
+            revision,
             request.match_info["clip"],
             data["capture"],
             data.get("overrides"),
@@ -569,6 +662,19 @@ async def take_setup(request):
         )
         return response(await prepare_inputs(capture, request, True) if capture else None)
 
+    def outside_footage(request, selected, project_media, path):
+        """Footage outside the project and Comfy folders is read only for this computer."""
+        roots = [selected.root, *project_media.host_roots.values()]
+        if not any(inside(path, root) for root in roots):
+            local_control(request, "Use footage outside this project from the computer running Spool")
+
+    def guard_originals(request, selected, project_media, records):
+        """Refuse a remote caller a result made from footage it could not download."""
+        for metadata in records:
+            original = metadata.get("originalFile", metadata.get("file", ""))
+            if isinstance(original, str) and Path(original).is_absolute():
+                outside_footage(request, selected, project_media, original)
+
     def take_source(request):
         selected, project_media = services(request)
         clip = selected.clip(request.match_info["project"], request.match_info["clip"])
@@ -578,9 +684,7 @@ def take_source(request):
         if not take:
             raise NotFound("Take not found")
         path = project_media.original_source(take["media"])["path"]
-        roots = [selected.root, *project_media.host_roots.values()]
-        if not any(inside(path, root) for root in roots):
-            local_control(request, "Use footage outside this project from the computer running Spool")
+        outside_footage(request, selected, project_media, path)
         return path
 
     @routes.get("/spool/api/projects/{project}/take-file/{clip}/{take}")
@@ -625,14 +729,15 @@ def folder():
     async def use_take(request):
         store, media = await asyncio.to_thread(services, request)
         data = unwire(await request.json())
+        revision, take_id = required_fields(data, "revision", "takeId")
         capture = await prepare_inputs(data["capture"], request, True) if data.get("capture") else None
         saved = await asyncio.to_thread(
             operations.use_take,
             store,
             request.match_info["project"],
-            data["revision"],
+            revision,
             request.match_info["clip"],
-            data["takeId"],
+            take_id,
             capture,
         )
         return await project_response(request, saved)
@@ -648,14 +753,15 @@ async def prepare_workflow(request):
     async def delete_take_files(request):
         selected, _ = await asyncio.to_thread(services, request)
         data = await request.json()
+        revision, take_ids = required_fields(data, "revision", "takeIds")
         return response(
             await asyncio.to_thread(
                 take_files.delete,
                 selected,
                 request.match_info["project"],
-                data["revision"],
+                revision,
                 request.match_info["clip"],
-                data["takeIds"],
+                take_ids,
             )
         )
 
@@ -697,12 +803,13 @@ async def finish_handoff(request):
     async def queue(request):
         store, media = await asyncio.to_thread(services, request)
         data = unwire(await request.json())
+        (revision,) = required_fields(data, "revision")
         project_id = request.match_info["project"]
         items = requests.queue_items(data)
         if executor is not None:
             value = await executor.queue(
                 project_id,
-                data["revision"],
+                revision,
                 items,
                 data.get("operationId"),
                 data.get("actor", "human"),
@@ -713,7 +820,7 @@ async def queue(request):
                 store,
                 media,
                 project_id,
-                data["revision"],
+                revision,
                 items,
                 data.get("operationId"),
                 data.get("actor", "human"),
@@ -847,7 +954,7 @@ async def reconcile(request):
         store, media = await asyncio.to_thread(services, request)
         if executor is not None:
             await executor.reconcile()
-        await asyncio.to_thread(collector.scan)
+        await cloud_module.storage_call(collector.scan)
         return web.json_response({"ok": True})
 
     @routes.get("/spool/api/attempts/{attempt}")
@@ -876,7 +983,12 @@ async def upload(request):
             raise ValueError("Import a video, image, or audio file")
         target = await asyncio.to_thread(media.input_destination, name, unique=True)
         await receive_file(request, target)
-        description = await asyncio.to_thread(media.describe, target, name, float(request.query.get("fps", 24)))
+        try:
+            description = await asyncio.to_thread(media.describe, target, name, float(request.query.get("fps", 24)))
+        except Exception:
+            # Nothing refers to a file that could not be described.
+            target.unlink(missing_ok=True)
+            raise
         if description.get("workflow"):
             description["workflowData"] = await prepare_inputs(
                 {"workflow": description["workflow"], "prompt": description.get("prompt")}, request
@@ -944,6 +1056,7 @@ async def detect_clip_cuts(request):
         take = next((t for t in clip["takes"] if t["id"] == data["takeId"]), None)
         if not take or take.get("placeholder"):
             raise ValueError("Select a video take in this project")
+        await asyncio.to_thread(guard_originals, request, store, media, [take["media"]])
         fps = await asyncio.to_thread(store.frame_rate, request.match_info["project"])
         document = await asyncio.to_thread(store.document, request.match_info["project"])
         size = document.get("resolution") or {"width": 960, "height": 540}
diff --git a/spool/store.py b/spool/store.py
index ca53bdc..6394579 100644
--- a/spool/store.py
+++ b/spool/store.py
@@ -175,6 +175,21 @@ def forget_media_evidence(self, media_ids):
         )
 
 
+def json_strings(value):
+    """Every string in a decoded JSON value, keys included."""
+    found, pending = [], [value]
+    while pending:
+        item = pending.pop()
+        if isinstance(item, str):
+            found.append(item)
+        elif isinstance(item, dict):
+            found.extend(k for k in item if isinstance(k, str))
+            pending.extend(item.values())
+        elif isinstance(item, list):
+            pending.extend(item)
+    return found
+
+
 class Store:
     def __init__(self, root, migrate=True, filename="spool.sqlite3"):
         self.focus_store = self
@@ -416,6 +431,20 @@ def _pack(self, db, value):
         }
 
     def _dump(self, db, value, *, receipt=False, capture=False):
+        # Storage references are created below, never accepted as authored JSON.
+        # Reject before packing so a failed save rolls back instead of publishing
+        # a document that every subsequent read interprets as a missing blob.
+        def check_authored(held):
+            if isinstance(held, dict):
+                if set(held) == {"__spool_blob__"}:
+                    raise ValueError("Authored values cannot contain a project evidence blob reference")
+                for child in held.values():
+                    check_authored(child)
+            elif isinstance(held, list):
+                for child in held:
+                    check_authored(child)
+
+        check_authored(value)
         if receipt:
             value = copy.deepcopy(value)
             if "primary" in value and "artifacts" in value:
@@ -654,7 +683,14 @@ def referenced_names(self):
                 except sqlite3.OperationalError:
                     continue
                 for row in rows:
-                    for token in re.findall(r"[A-Za-z0-9_\-./\\]+", row[0]):
+                    tokens = re.findall(r"[A-Za-z0-9_\-./\\]+", row[0])
+                    try:
+                        # Whole string values too: file names may hold spaces, and JSON
+                        # escapes non-ASCII characters, which the tokens alone would miss.
+                        tokens += json_strings(json.loads(row[0]))
+                    except (TypeError, ValueError):
+                        pass
+                    for token in tokens:
                         names.add(token)
                         if "/" in token or "\\" in token:
                             names.add(token.replace("\\", "/").rsplit("/", 1)[-1])
@@ -665,7 +701,7 @@ def derived_storage(self):
         names = self.referenced_names()
         folders = {}
         for folder in ("previews", "exports", "uploads", "shots", "artifacts", "assets", "backups"):
-            directory = (self.cache if folder in ("previews", "shots") else self.root) / folder
+            directory = (self.cache if folder in ("previews", "shots", "backups") else self.root) / folder
             if not directory.is_dir():
                 continue
             files = [path for path in directory.rglob("*") if path.is_file()]
@@ -1147,6 +1183,13 @@ def folder_inventory(self, project_id):
                     pending.add(row["take_id"][:8])
                 result = self._load(row["result"], db, memo=memo) or {}
                 known.update(a.get("originalFile", a.get("file")) for a in result.get("artifacts", []))
+            # A retried farm task's copy is evidence of the same take, not a file dropped into the folder.
+            for row in db.execute(
+                "SELECT e.receipt FROM executions e JOIN attempts a ON a.id=e.attempt_id WHERE a.project_id=?",
+                (project_id,),
+            ):
+                receipt = self._load(row["receipt"], db, memo=memo) or {}
+                known.update(a.get("originalFile", a.get("file")) for a in receipt.get("artifacts", []))
             return known, numbers, pending
 
     def get(self, project_id):
@@ -1229,7 +1272,8 @@ def capture(
             row = db.execute("SELECT document FROM projects WHERE id=?", (project_id,)).fetchone()
             if not row:
                 raise NotFound("Project not found")
-            document = json.loads(row[0])
+            # Unpacked as editing() reads it: this document is saved, and saving packs it again.
+            document = self._load(row[0], db)
             generated = (
                 db.execute(
                     "SELECT clip_id,take_id,result FROM attempts WHERE project_id=? AND take_id=? AND status='complete'",
diff --git a/tests/comfy_link_browser_checks.js b/tests/comfy_link_browser_checks.js
index 74d5591..fe443eb 100644
--- a/tests/comfy_link_browser_checks.js
+++ b/tests/comfy_link_browser_checks.js
@@ -88,6 +88,7 @@
     );
     const image = () =>
       app.rootGraph.nodes.find(node => node.type === 'LoadImage').widgets.find(widget => widget.name === 'image');
+    check('Refreshed loader choices include the current staged image', image().options.values.includes(chosenImage));
     check(
       'Opened graph uses the current clip input instead of a stale editor widget (' +
         image().value +
@@ -272,6 +273,13 @@
           comfy.comfyAPI?.app?.app?.extensionManager?.workflow?.activeWorkflow,
       );
       await n.editWorkflow();
+      const restoredImage = comfy.comfyAPI.app.app.rootGraph.nodes
+        .find(node => node.type === 'LoadImage')
+        .widgets.find(widget => widget.name === 'image');
+      check(
+        'Reloaded linked loader keeps its staged value in refreshed choices',
+        restoredImage.options.values.includes(restoredImage.value),
+      );
       check(
         'Reloaded Comfy keeps the existing editor bridge',
         popups.length === count &&
diff --git a/tests/demo_api_checks.mjs b/tests/demo_api_checks.mjs
index 777fa38..2819e84 100644
--- a/tests/demo_api_checks.mjs
+++ b/tests/demo_api_checks.mjs
@@ -87,6 +87,103 @@ const send = (method, path, value, headers) => api(path, { method, body: JSON.st
   check('Recorded errors replay', (await api('projects/' + ID + '/takes/c'))[0] === 400);
   check('Static files still load', (await window.fetch('/site/spool/ui/editor.js').then(r => r.text())) === 'static');
 }
+{
+  const path = 'projects/' + ID;
+  const [, before] = await api(path);
+  const cases = [
+    ['PUT', path, { document: before.document }, 'revision'],
+    ['PUT', path, { revision: before.revision }, 'document'],
+    ['PUT', path, { revision: before.revision, document: null }, 'document'],
+    ['PUT', path, { revision: before.revision, document: { clips: null } }, 'document'],
+    ['POST', path + '/use-take/clip-1', { takeId: 'b' }, 'revision'],
+    ['POST', path + '/use-take/clip-1', { revision: before.revision }, 'takeId'],
+    ['POST', path + '/delete-takes/clip-1', { takeIds: ['c'] }, 'revision'],
+    ['POST', path + '/delete-takes/clip-1', { revision: before.revision }, 'takeIds'],
+  ];
+  for (const [method, target, value, field] of cases) {
+    const [status, error] = await send(method, target, value);
+    check(
+      'Missing/invalid ' + field + ' on ' + method + ' ' + target + ' is a client error',
+      status === 400 && error.code === 'invalid_request' && error.error.includes(field),
+    );
+  }
+  for (const [method, target] of [
+    ['PUT', path],
+    ['POST', path + '/use-take/clip-1'],
+    ['POST', path + '/delete-takes/clip-1'],
+  ]) {
+    for (const raw of ['null', '[]', '"wrong shape"', '{']) {
+      const [status, error] = await api(target, { method, body: raw });
+      check('Malformed ' + method + ' ' + target + ': ' + raw, status === 400 && error.code === 'invalid_request');
+    }
+  }
+  for (const [route, value] of [
+    ['/delete-takes/clip-1', { takeIds: null }],
+    ['/delete-takes/clip-1', { takeIds: [] }],
+    ['/delete-takes/clip-1', { takeIds: {} }],
+    ['/delete-takes/clip-1', { takeIds: [1] }],
+    ['/delete-takes/clip-1', { takeIds: ['missing'] }],
+    ['/delete-takes/clip-1', { takeIds: ['a'] }],
+    ['/use-take/clip-1', { takeId: null }],
+    ['/use-take/clip-1', { takeId: 'missing' }],
+    ['/use-take/clip-1', { takeId: 'b', capture: { provenance: { takeBase: { takeId: 'a' } } } }],
+  ]) {
+    const [status, error] = await send('POST', path + route, { revision: before.revision, ...value });
+    check(
+      'Invalid demo take values carry the host error code: ' + JSON.stringify(value),
+      status === 400 && error.code === 'invalid_request' && typeof error.error === 'string',
+    );
+  }
+  // Representative identical payload shapes are rejected by test_nested_request_shapes.py.
+  for (const [keys, replacement, field] of [
+    [['document', 'clips'], [1], 'clips'],
+    [['document', 'clips'], [{}], 'clips'],
+    [['document', 'media'], null, 'media'],
+    [['document', 'media'], [1], 'media'],
+    [['document', 'audioClips'], [1], 'audioClips'],
+    [['document', 'importedWorkflows'], {}, 'importedWorkflows'],
+    [['document', 'clips', 0, 'takes'], [1], 'takes'],
+    [['document', 'clips', 0, 'takes'], [{ id: 'take', media: null }], 'media'],
+    [['document', 'clips', 0, 'bindings'], [{}], 'bindings'],
+    [['document', 'clips', 0, 'inputValues'], [], 'inputValues'],
+    [['workflowRecipes'], null, 'workflowRecipes'],
+    [['workflowRecipes'], [], 'workflowRecipes'],
+    [['workflowRecipes'], { recipe: null }, 'workflow'],
+    [['workflowRecipes'], { recipe: { bindings: [1] } }, 'bindings'],
+    [['workflowRecipes'], { recipe: { provenance: [] } }, 'provenance'],
+    [['workflowRecipes'], { recipe: { inputRecovery: null } }, 'inputRecovery'],
+    [['workflowRecipes'], { recipe: { inputRecovery: { recovered: {} } } }, 'inputRecovery'],
+    [['workflowRecipes'], { recipe: { inputRecovery: { recovered: null } } }, 'inputRecovery'],
+    [['workflowRecipes'], { recipe: { result: null } }, 'result'],
+    [['workflowRecipes'], { recipe: { result: { nodeId: [] } } }, 'nodeId'],
+    [['workflowRecipes'], { recipe: { provenance: { builtinTemplate: [] } } }, 'builtinTemplate'],
+    [['workflowRecipes'], { recipe: { workflow: [] } }, 'workflow'],
+    [['workflowRecipes'], { recipe: { workflow: { nodes: [1] } } }, 'nodes'],
+    [['workflowRecipes'], { recipe: { workflow: { nodes: [{ type: 'LoadImage' }] } } }, 'id'],
+    [['workflowRecipes'], { recipe: { workflow: { definitions: null } } }, 'definitions'],
+    [['workflowRecipes'], { recipe: { workflow: { definitions: { subgraphs: [1] } } } }, 'subgraphs'],
+  ]) {
+    const value = { revision: before.revision, document: structuredClone(before.document) };
+    let target = value;
+    for (const key of keys.slice(0, -1)) target = target[key];
+    target[keys.at(-1)] = replacement;
+    const [status, error] = await send('PUT', path, value);
+    check(
+      'Nested demo save ' + field + ' matches host validation: ' + JSON.stringify(value.workflowRecipes ?? field),
+      status === 400 && error.code === 'invalid_request' && error.error.includes(field),
+    );
+  }
+  const [unavailable, unavailableError] = await send('POST', path + '/queue', { revision: before.revision, items: [] });
+  check(
+    'Unsupported demo operations keep their distinct response',
+    unavailable === 403 && unavailableError.code === 'demo_unavailable',
+  );
+  const [, after] = await api(path);
+  check(
+    'Malformed demo requests preserve revision, document and sync token',
+    JSON.stringify(after) === JSON.stringify(before),
+  );
+}
 {
   const [, current] = await api('projects/' + ID);
   const document = structuredClone(current.document);
@@ -108,7 +205,10 @@ const send = (method, path, value, headers) => api(path, { method, body: JSON.st
 {
   const path = 'projects/' + ID + '/delete-takes/clip-1';
   const [refused, error] = await send('POST', path, { revision: 6, takeIds: ['a'] });
-  check('The take in the edit is never deleted', refused === 400 && /kept/.test(error.error));
+  check(
+    'The take in the edit is never deleted',
+    refused === 400 && error.code === 'invalid_request' && /kept/.test(error.error),
+  );
   const [status, value] = await send('POST', path, { revision: 6, takeIds: ['c'] });
   check('Deleting takes replies with the project', status === 200 && value.pendingFiles === 0);
   check('Deleted takes are gone and recorded', value.project.document.clips[0].takes.length === 2);
@@ -154,7 +254,109 @@ const send = (method, path, value, headers) => api(path, { method, body: JSON.st
   check('A split half reads the recorded setup of its take', status === 200 && Array.isArray(setup.bindings));
   const path = 'projects/' + ID + '/delete-takes/clip-2';
   const [refused, error] = await send('POST', path, { revision: saved.revision, takeIds: ['d'] });
-  check('A file the other half uses is not deleted', refused === 400 && /c2/.test(error.error));
+  check(
+    'A file the other half uses is not deleted',
+    refused === 400 && error.code === 'invalid_request' && /c2/.test(error.error),
+  );
+}
+
+{
+  // The demo mirrors host take_files.plan using recorded paths; no files are removed.
+  const deletion = 'projects/' + ID + '/delete-takes/clip-1';
+  const edit = async mutate => {
+    const [, current] = await api('projects/' + ID);
+    const document = structuredClone(current.document);
+    mutate(document);
+    const [status, saved] = await send('PUT', 'projects/' + ID, { revision: current.revision, document });
+    check('Deletion fixture saves at the current revision', status === 200);
+    return saved;
+  };
+  const refused = async (label, current, ids, message) => {
+    const [status, error] = await send('POST', deletion, { revision: current.revision, takeIds: ids });
+    check(label, status === 400 && error.code === 'invalid_request' && message.test(error.error));
+    const [, after] = await api('projects/' + ID);
+    check(
+      label + ' leaves the document, revision and token unchanged',
+      JSON.stringify(after) === JSON.stringify(current),
+    );
+  };
+  let current = await edit(document => {
+    document.media = [
+      { ...take('a').media, id: 'pool-a' },
+      { ...take('unrelated').media, id: 'pool-keep' },
+    ];
+    document.clips[1].bindings = [{ key: 'source', asset: true }];
+    document.clips[1].inputValues = { source: 'spool-projects/' + ID + '/output/a.mp4 [input]' };
+  });
+  await refused('A selected file used as a staged generation input is protected', current, ['a'], /generation input/);
+  current = await edit(document => {
+    document.clips[1].inputValues.source = 'spool-projects/' + ID + '/output/./a.mp4';
+  });
+  await refused('Generation input path aliases are protected', current, ['a'], /generation input/);
+  current = await edit(document => {
+    document.clips[1].inputValues.source = 'not-a-file';
+    document.audioClips = [{ id: 'audio', media: take('a').media }];
+  });
+  await refused('Timeline audio protects the selected source', current, ['a'], /timeline audio/);
+  current = await edit(document => {
+    document.audioClips = [];
+    document.media.push({ id: 'pool-shared', file: 'output/another.mp4', poster: 'output/a.json' });
+  });
+  await refused('A pool asset sharing the deleted sidecar is protected', current, ['a'], /media-pool asset/);
+  current = await edit(document => {
+    document.media = document.media.filter(media => media.id !== 'pool-shared');
+    document.clips[1].takes.push({ ...take('alias'), media: { ...take('alias').media, file: 'output/a.mov' } });
+  });
+  await refused('Another take sharing the selected sidecar is protected', current, ['a'], /another take/);
+  current = await edit(document => {
+    document.clips[1].takes = document.clips[1].takes.filter(take => take.id !== 'alias');
+    document.clips[1].bindings = [{ key: 'text', asset: false }];
+    document.clips[1].inputValues = { text: 'spool-projects/' + ID + '/output/a.mp4' };
+  });
+  const [status, value] = await send('POST', deletion, { revision: current.revision, takeIds: ['a', 'a'] });
+  check('Non-asset text matching a file does not block deletion', status === 200);
+  check('Deleted take IDs are deduplicated as on the host', JSON.stringify(value.deleted) === '["a"]');
+  check(
+    'Media-pool aliases of a deleted original are recorded with the take media',
+    value.project.document.deletedMediaIds.includes('media-a') &&
+      value.project.document.deletedMediaIds.includes('pool-a'),
+  );
+  check(
+    'Only media-pool records using deleted originals are removed',
+    value.project.document.media.length === 1 && value.project.document.media[0].id === 'pool-keep',
+  );
+  const [, unchanged] = await api('projects/' + ID, { headers: { 'X-Spool-Since': value.project.syncToken } });
+  check(
+    'Deletion publishes a new poll token with the host reply shape',
+    !unchanged.document && unchanged.jobs.length === 1,
+  );
+
+  current = await edit(document => {
+    document.clips[0].takes.push({ ...take('external'), media: { ...take('external').media, file: '../outside.mp4' } });
+  });
+  await refused(
+    'A take outside project-owned media folders cannot be deleted',
+    current,
+    ['external'],
+    /owned by this project/,
+  );
+  await refused('Invalid take-ID types use the host validation message', current, [3], /Select the takes/);
+}
+
+{
+  const path = 'projects/' + ID;
+  const [, current] = await api(path);
+  const document = { project: 'Minimal valid save', clips: [{ id: 'empty', in: 0, out: 24 }] };
+  const [status, saved] = await send('PUT', path, { revision: current.revision, document, workflowRecipes: {} });
+  check(
+    'Valid minimal saves keep the host defaults for omitted takes',
+    status === 200 && saved.revision === current.revision + 1 && saved.document.clips[0].takes.length === 0,
+  );
+  const [stale, error] = await send('PUT', path, { revision: current.revision, document });
+  check(
+    'Nested shape validation preserves stale revision conflicts',
+    stale === 409 && error.code === 'revision_conflict',
+  );
 }
 
 console.log(checks.length + ' demo API checks passed');
diff --git a/tests/html_escape_checks.mjs b/tests/html_escape_checks.mjs
new file mode 100644
index 0000000..de501e3
--- /dev/null
+++ b/tests/html_escape_checks.mjs
@@ -0,0 +1,91 @@
+// Identity and number fields from a project reach HTML only through esc().
+//
+// A project is data from whoever made it: an imported export or a shared project
+// folder keeps clip, take and media IDs, take numbers and track numbers exactly as
+// written. Joined raw into markup they ran script when the project was opened.
+import assert from 'node:assert/strict';
+import { readdirSync, readFileSync } from 'node:fs';
+import { Linter } from 'eslint';
+
+const FIELDS = new Set(['id', 'number', 'workflow', 'videoTrack', 'track', 'sourceLane']);
+const CALLS = new Set(['videoTrack', 'sourceLane', 'takeName']);
+const markup = node =>
+  (node.type === 'Literal' && typeof node.value === 'string' && /[<>]|="/.test(node.value)) ||
+  (node.type === 'TemplateLiteral' && node.quasis.some(q => /[<>]|="/.test(q.value.raw)));
+const parts = (node, out = []) => {
+  if (node.type === 'BinaryExpression' && node.operator === '+') {
+    parts(node.left, out);
+    parts(node.right, out);
+  } else out.push(node);
+  return out;
+};
+const name = node =>
+  node.type === 'Identifier' ? node.name : node.type === 'MemberExpression' ? node.property.name : '';
+function raw(node) {
+  switch (node.type) {
+    case 'MemberExpression':
+      return !node.computed && FIELDS.has(node.property.name);
+    case 'CallExpression': {
+      const callee = name(node.callee);
+      if (CALLS.has(callee)) return true;
+      if (callee === 'String') return node.arguments.some(raw);
+      if (node.callee.type === 'MemberExpression' && ['padStart', 'toString'].includes(callee))
+        return raw(node.callee.object);
+      return false;
+    }
+    case 'ConditionalExpression':
+      return raw(node.consequent) || raw(node.alternate);
+    case 'LogicalExpression':
+      return raw(node.left) || raw(node.right);
+    case 'BinaryExpression':
+      return node.operator === '+' && parts(node).some(raw);
+    case 'TemplateLiteral':
+      return node.expressions.some(raw);
+    default:
+      return false;
+  }
+}
+const rule = {
+  create(context) {
+    return {
+      BinaryExpression(node) {
+        if (node.operator !== '+' || (node.parent.type === 'BinaryExpression' && node.parent.operator === '+')) return;
+        const all = parts(node);
+        if (!all.some(markup)) return;
+        for (const part of all) if (raw(part)) context.report({ node: part, message: 'Escape with esc()' });
+      },
+      TemplateLiteral(node) {
+        if (!markup(node)) return;
+        for (const part of node.expressions)
+          if (raw(part)) context.report({ node: part, message: 'Escape with esc()' });
+      },
+    };
+  },
+};
+
+const linter = new Linter();
+const config = {
+  languageOptions: { ecmaVersion: 'latest', sourceType: 'module' },
+  plugins: { spool: { rules: { 'escape-fields': rule } } },
+  rules: { 'spool/escape-fields': 'error' },
+};
+const check = source => linter.verify(source, config).map(m => m.line + ':' + m.column + ' ' + m.message);
+
+// The check itself finds the shapes that were unescaped.
+assert.equal(check(`h.innerHTML = '<div data-clip="' + c.id + '">';`).length, 1);
+assert.equal(check(`h.innerHTML = '<b>' + 'T' + String(t.number).padStart(2, '0') + '</b>';`).length, 1);
+assert.equal(check(`h.innerHTML = '<i style="top:var(--v-' + T.videoTrack(c) + ')">';`).length, 1);
+assert.equal(check(`h.innerHTML = '<button style="top:var(--v-' + cut.track + ')">';`).length, 1);
+assert.equal(check(`h.innerHTML = '<p>' + (x ? takeName(t) : 'None') + '</p>';`).length, 1);
+assert.equal(check('h.innerHTML = `<p>${m.id}</p>`;').length, 1);
+assert.deepEqual(check(`h.innerHTML = '<div data-clip="' + esc(c.id) + '">' + (a.id === b.id ? ' on' : '');`), []);
+assert.deepEqual(check(`label.textContent = 'Take ' + t.number;`), []);
+assert.deepEqual(check(`h.innerHTML = '<button style="top:var(--v-' + esc(cut.track) + ')">';`), []);
+
+const problems = [];
+for (const folder of ['ui', 'web'])
+  for (const file of readdirSync(folder).filter(f => f.endsWith('.js')))
+    for (const problem of check(readFileSync(folder + '/' + file, 'utf8')))
+      problems.push(folder + '/' + file + ':' + problem);
+assert.deepEqual(problems, [], 'Unescaped project fields in HTML:\n' + problems.join('\n'));
+console.log('html escape checks passed');
diff --git a/tests/loader_refresh_checks.mjs b/tests/loader_refresh_checks.mjs
new file mode 100644
index 0000000..2eadcea
--- /dev/null
+++ b/tests/loader_refresh_checks.mjs
@@ -0,0 +1,296 @@
+import assert from 'node:assert/strict';
+import { refreshLoaderOptions } from '../web/graph-inputs.js';
+import { createWorkflowLinks } from '../web/workflow-link.js';
+
+const checks = [];
+const checked = label => checks.push(label);
+const loader = (type = 'LoadImage', value = 'old.png') => ({
+  id: 1,
+  type,
+  properties: { authored: 'unchanged' },
+  widgets: [
+    {
+      name: 'image',
+      type: 'combo',
+      value,
+      options: { values: ['old.png'] },
+      callback() {
+        assert.fail('Refreshing choices must not invoke an input callback');
+      },
+    },
+  ],
+});
+const definition = (type, values) => ({ [type]: { input: { required: { image: [values, { image_upload: true }] } } } });
+const response = data => ({ ok: true, json: async () => data });
+
+{
+  const image = loader('LoadImage', 'spool-projects/project/input/new.png'),
+    mask = loader('LoadImageMask', 'spool-projects/project/input/new.png'),
+    root = { nodes: [image, { type: 'Subgraph', subgraph: { nodes: [mask] } }, { type: 'KSampler' }] };
+  const calls = [],
+    originalValue = image.widgets[0].value,
+    properties = JSON.stringify(image.properties);
+  const fetcher = async (url, options) => {
+    calls.push([url, options]);
+    return response(definition(url.split('/').at(-1), ['old.png', originalValue]));
+  };
+  await refreshLoaderOptions(root, fetcher);
+  assert.deepEqual(calls.map(([url]) => url).sort(), ['/object_info/LoadImage', '/object_info/LoadImageMask']);
+  assert.ok(calls.every(([, options]) => options.cache === 'no-store'));
+  assert.ok(image.widgets[0].options.values.includes(originalValue));
+  assert.ok(mask.widgets[0].options.values.includes(originalValue));
+  assert.equal(image.widgets[0].value, originalValue);
+  assert.equal(JSON.stringify(image.properties), properties);
+  checked('Staged images and nested mask loaders refresh only their exact definitions, preserving source and metadata');
+
+  image.widgets[0].value = 'actually-missing.png';
+  await refreshLoaderOptions(root, fetcher);
+  assert.equal(image.widgets[0].value, 'actually-missing.png');
+  assert.ok(!image.widgets[0].options.values.includes('actually-missing.png'));
+  checked('A genuinely missing selected source remains missing and is never rewritten or invented as an option');
+}
+
+{
+  const selected = 'spool-projects/project/input/new image.png [input]',
+    image = loader('LoadImage', selected),
+    mask = loader('LoadImageMask', selected),
+    root = { nodes: [image, mask] },
+    calls = [];
+  let present = true;
+  const fetcher = async (url, options) => {
+    calls.push([url, options]);
+    if (options.method !== 'HEAD') return response(definition(url.split('/').at(-1), ['old.png']));
+    const query = new URL(url, 'http://localhost').searchParams;
+    assert.equal(query.get('filename'), 'new image.png');
+    assert.equal(query.get('subfolder'), 'spool-projects/project/input');
+    assert.equal(query.get('type'), 'input');
+    return { ok: present, status: present ? 200 : 404, headers: new Headers({ 'Content-Type': 'image/png' }) };
+  };
+  await refreshLoaderOptions(root, fetcher);
+  assert.equal(calls.filter(([, options]) => options.method === 'HEAD').length, 1);
+  assert.deepEqual(image.widgets[0].options.values, ['old.png', selected]);
+  assert.deepEqual(mask.widgets[0].options.values, ['old.png', selected]);
+  assert.equal(image.widgets[0].value, selected);
+  checked('Nested staged selections absent from native definitions are confirmed with one HEAD request and retained');
+  present = false;
+  await refreshLoaderOptions(root, fetcher);
+  assert.deepEqual(image.widgets[0].options.values, ['old.png']);
+  assert.equal(image.widgets[0].value, selected);
+  checked('A removed staged image is no longer offered while its authored selection remains unchanged');
+
+  image.widgets[0].options.values = ['before.png'];
+  await assert.rejects(
+    refreshLoaderOptions(root, async (url, options) =>
+      options.method === 'HEAD' ? { ok: false, status: 500 } : response(definition(url.split('/').at(-1), [])),
+    ),
+    /Could not check/,
+  );
+  assert.deepEqual(image.widgets[0].options.values, ['before.png']);
+  checked('Availability errors preserve previous choices instead of hiding a valid staged source');
+}
+
+{
+  const image = loader('LoadImage', 'folder/a.png'),
+    root = { nodes: [image] };
+  let complete, headStarted;
+  const held = new Promise(resolve => (complete = resolve)),
+    started = new Promise(resolve => (headStarted = resolve));
+  const pending = refreshLoaderOptions(root, async (url, options) => {
+    if (options.method !== 'HEAD') return response(definition('LoadImage', ['old.png']));
+    headStarted();
+    await held;
+    return { ok: true, status: 200, headers: new Headers({ 'Content-Type': 'image/png' }) };
+  });
+  await started;
+  image.widgets[0].value = 'folder/newly-uploaded.png';
+  image.widgets[0].options.values.push(image.widgets[0].value);
+  const uploadedChoices = [...image.widgets[0].options.values];
+  complete();
+  await pending;
+  assert.deepEqual(image.widgets[0].options.values, uploadedChoices);
+  assert.ok(image.widgets[0].options.values.includes(image.widgets[0].value));
+  checked('An upload selected during a pending availability request retains its newer choices and selection');
+}
+
+{
+  const inner = loader(),
+    exposed = { name: 'reference', type: 'combo', value: 'new.png', options: { values: ['old.png'] } },
+    parent = { id: 2, type: 'Subgraph', widgets: [exposed] };
+  inner.inputs = [{ name: 'image', link: 1 }];
+  parent.subgraph = {
+    nodes: [inner],
+    inputs: [{ name: 'reference' }],
+    links: new Map([[1, { origin_id: -10, origin_slot: 0 }]]),
+    getNodeById: id => (String(id) === String(inner.id) ? inner : null),
+  };
+  const root = {
+    nodes: [parent],
+    getNodeById: id => (String(id) === String(parent.id) ? parent : null),
+  };
+  await refreshLoaderOptions(root, async () => response(definition('LoadImage', ['old.png', 'new.png'])));
+  assert.deepEqual(exposed.options.values, ['old.png', 'new.png']);
+  assert.equal(exposed.value, 'new.png');
+  checked('Exposed subgraph image inputs refresh their parent-owned choices without changing their selected value');
+}
+
+{
+  const first = loader(),
+    second = loader(),
+    root = { nodes: [first, second] };
+  let complete,
+    calls = 0;
+  const held = new Promise(resolve => (complete = resolve));
+  const fetcher = async () => {
+    calls++;
+    await held;
+    return response(definition('LoadImage', ['fresh.png']));
+  };
+  const one = refreshLoaderOptions(root, fetcher),
+    two = refreshLoaderOptions(root, fetcher);
+  complete();
+  await Promise.all([one, two]);
+  assert.equal(calls, 1);
+  assert.deepEqual(first.widgets[0].options.values, ['fresh.png']);
+  first.widgets[0].options.values.push('only-first.png');
+  assert.deepEqual(second.widgets[0].options.values, ['fresh.png']);
+  await refreshLoaderOptions(root, fetcher);
+  assert.equal(calls, 2);
+  checked('Concurrent refreshes share a request, widgets own independent option arrays, and later imports fetch again');
+}
+
+{
+  const previous = loader(),
+    replacement = loader(),
+    root = { nodes: [previous] };
+  let complete;
+  const held = new Promise(resolve => (complete = resolve));
+  const pending = refreshLoaderOptions(root, async () => {
+    await held;
+    return response(definition('LoadImage', ['late.png']));
+  });
+  root.nodes = [replacement];
+  complete();
+  await pending;
+  assert.deepEqual(previous.widgets[0].options.values, ['old.png']);
+  assert.deepEqual(replacement.widgets[0].options.values, ['old.png']);
+  checked('A response for a detached graph cannot change the replacement workflow or old widgets');
+}
+
+{
+  const child = loader(),
+    parent = { type: 'Subgraph', subgraph: { nodes: [child] } },
+    root = { nodes: [parent] };
+  let complete;
+  const held = new Promise(resolve => (complete = resolve));
+  const pending = refreshLoaderOptions(root, async () => {
+    await held;
+    return response(definition('LoadImage', ['late.png']));
+  });
+  root.nodes = [];
+  complete();
+  await pending;
+  assert.deepEqual(child.widgets[0].options.values, ['old.png']);
+  const replaced = loader();
+  await refreshLoaderOptions(
+    { nodes: [replaced] },
+    async () => response(definition('LoadImage', ['late.png'])),
+    () => false,
+  );
+  assert.deepEqual(replaced.widgets[0].options.values, ['old.png']);
+  checked('Detached subgraphs and superseded root graphs cannot receive late choices');
+}
+
+{
+  const image = loader(),
+    root = { nodes: [image] };
+  let calls = 0;
+  const fetcher = async () => {
+    calls++;
+    return calls === 1 ? { ok: false } : response(definition('LoadImage', ['recovered.png']));
+  };
+  await assert.rejects(refreshLoaderOptions(root, fetcher), /Could not refresh/);
+  assert.deepEqual(image.widgets[0].options.values, ['old.png']);
+  await refreshLoaderOptions(root, fetcher);
+  assert.equal(calls, 2);
+  assert.deepEqual(image.widgets[0].options.values, ['recovered.png']);
+  checked('Failed requests preserve choices, report failure and can be retried without a cached rejection');
+
+  await assert.rejects(
+    refreshLoaderOptions(root, async () => response({ LoadImage: {} })),
+    /no image choices/,
+  );
+  assert.deepEqual(image.widgets[0].options.values, ['recovered.png']);
+  await refreshLoaderOptions(root, async () =>
+    response({ LoadImage: { input: { required: { image: ['COMBO', { options: ['modern.png'] }] } } } }),
+  );
+  assert.deepEqual(image.widgets[0].options.values, ['modern.png']);
+  checked('Malformed definitions never erase choices; modern COMBO option definitions are supported');
+}
+
+{
+  const savedFetch = globalThis.fetch;
+  const storageValues = new Map(),
+    storage = { getItem: key => storageValues.get(key), setItem: (key, value) => storageValues.set(key, value) },
+    current = { path: 'linked.json', changeTracker: { activeState: {} } },
+    manager = { openWorkflows: [current], activeWorkflow: current },
+    image = loader(),
+    app = { rootGraph: { nodes: [image] }, extensionManager: { workflow: manager, spinner: false } },
+    link = { projectId: 'project', clipId: 'clip', sourceKey: 'v1' };
+  let loads = 0,
+    requests = 0,
+    choices = ['old.png'];
+  const load = async () => {
+    loads++;
+    return { opened: true };
+  };
+  const capture = async () => ({ prompt: {}, provenance: {} });
+  globalThis.fetch = async url => {
+    requests++;
+    assert.equal(url, '/object_info/LoadImage');
+    return response(definition('LoadImage', choices));
+  };
+  try {
+    const links = createWorkflowLinks(app, load, capture, storage);
+    await links.open({ link, name: 'Linked clip' });
+    choices = ['old.png', image.widgets[0].value];
+    const restored = createWorkflowLinks(app, load, capture, storage);
+    const reopened = await restored.open({ link, name: 'Linked clip' });
+    assert.ok(reopened.reused);
+    assert.equal(loads, 1);
+    assert.equal(requests, 1);
+    assert.ok(image.widgets[0].options.values.includes(image.widgets[0].value));
+    const captured = await restored.capture({ link });
+    assert.equal(captured.provenance.spoolLink.workflowPath, current.path);
+    checked(
+      'Restored links refresh a reused active tab after a new upload without loading or recapturing another graph',
+    );
+
+    globalThis.fetch = async () => ({ ok: false });
+    await assert.rejects(restored.open({ link, name: 'Linked clip' }), /Could not refresh/);
+    assert.equal(manager.activeWorkflow, current);
+    assert.equal(image.widgets[0].value, 'old.png');
+    checked('An explicit linked-tab refresh failure leaves the active workflow and selected input intact');
+
+    let complete;
+    const held = new Promise(resolve => (complete = resolve));
+    globalThis.fetch = async () => {
+      await held;
+      return response(definition('LoadImage', choices));
+    };
+    const opening = restored.open({ link, name: 'Linked clip' });
+    const same = restored.open({ link, name: 'Linked clip' });
+    await assert.rejects(restored.open({ link: { ...link, clipId: 'other' } }), /Finish opening/);
+    await assert.rejects(restored.capture({ link }), /Finish opening/);
+    manager.activeWorkflow = { path: 'unrelated.json' };
+    complete();
+    await assert.rejects(opening, /linked workflow changed/);
+    await assert.rejects(same, /linked workflow changed/);
+    checked(
+      'Concurrent repeated opens share work, block other captures, and cannot claim success after switching tabs',
+    );
+  } finally {
+    globalThis.fetch = savedFetch;
+  }
+}
+
+console.log(JSON.stringify({ passed: checks.length, checks }, null, 2));
diff --git a/tests/native_security_browser_checks.js b/tests/native_security_browser_checks.js
new file mode 100644
index 0000000..febf000
--- /dev/null
+++ b/tests/native_security_browser_checks.js
@@ -0,0 +1,299 @@
+// Native acceptance checks for audit findings F-05, F-18 and F-23.
+//
+// These run against the real studio in headless Chrome and the isolated ComfyUI host.
+// The XSS cases use only a local window counter: a crafted project value may render as
+// text, but it must never execute the harmless marker. The media case uploads a real
+// project-owned MP4 and PNG whose names hold "#", a literal "%41" and a literal "%",
+// then loads, seeks and range-requests them through the actual host routes.
+(async () => {
+  const w = window,
+    d = document,
+    n = w.spoolNative,
+    $ = id => d.getElementById(id),
+    checks = [],
+    sleep = ms => new Promise(resolve => setTimeout(resolve, ms)),
+    check = (label, ok) => {
+      if (!ok) throw Error(label);
+      checks.push(label);
+    },
+    wait = async (label, fn, timeout = 30000) => {
+      const end = Date.now() + timeout;
+      while (!(await fn())) {
+        if (Date.now() > end) throw Error(label + (n ? ' · ' + n.state?.project : ''));
+        await sleep(100);
+      }
+    },
+    marker = () => w.__nativeSecurityXss || 0,
+    mediaUrl = relative =>
+      '/spool/media/' + encodeURIComponent(n.projectKey) + '/' + relative.split('/').map(encodeURIComponent).join('/'),
+    absoluteMediaUrl = relative => new URL(mediaUrl(relative), location.origin).href,
+    caseName = w.__nativeSecurityCase || 'xss';
+
+  if (caseName === 'xss-before') {
+    await wait('Timeline did not render the before-fix fixture', () => d.querySelector('#clipLane [data-clip]'));
+    check('The isolated before-fix renderer executes a crafted take number', marker() > 0);
+    check(
+      'The isolated before-fix renderer inserts the crafted handler image',
+      d.querySelectorAll('#editor img[src="x"]').length > 0,
+    );
+    const banner = d.createElement('div');
+    banner.id = 'nativeSecurityBeforeBanner';
+    banner.textContent = 'F-05 before the fix: crafted take number executed window.__nativeSecurityXss=' + marker();
+    banner.style.cssText =
+      'position:fixed;left:24px;bottom:24px;z-index:2147483647;padding:12px 16px;background:#b91c1c;color:#fff;font:600 13px sans-serif;border-radius:8px';
+    d.body.append(banner);
+    return { checks };
+  }
+
+  if (caseName === 'xss') {
+    const casePayload = '<img src=x onerror="window.__nativeSecurityXss=(window.__nativeSecurityXss||0)+1">';
+    await wait('Timeline did not render the crafted fixture', () => d.querySelector('#clipLane [data-clip]'));
+    check('Opening a project with crafted IDs runs no script marker', marker() === 0);
+    check(
+      'The marker detector itself still catches an injected handler',
+      await (async () => {
+        const control = d.createElement('div');
+        control.innerHTML =
+          '<img src=x onerror="window.__nativeSecurityControl=(window.__nativeSecurityControl||0)+1">';
+        d.body.append(control);
+        await wait('Positive XSS control did not execute', () => w.__nativeSecurityControl === 1, 5000);
+        control.remove();
+        return true;
+      })(),
+    );
+    const clipNode = [...d.querySelectorAll('#clipLane [data-clip]')].find(node => node.dataset.clip === casePayload);
+    check('A crafted clip ID is a data attribute value, not a new element', !!clipNode);
+    check(
+      'The crafted take number renders as text inside the clip meta',
+      clipNode.querySelector('.clip-meta span')?.textContent.includes(casePayload),
+    );
+    check(
+      'Crafted clip fields inserted no event-handler image',
+      clipNode.querySelectorAll('img[src="x"]').length === 0 && d.querySelectorAll('#editor [onerror]').length === 0,
+    );
+    n.selectClip(casePayload);
+    await wait(
+      'Inspector did not render the crafted take',
+      () => $('takeList').querySelectorAll('[data-view]').length > 0,
+    );
+    const clip = n.state.clips.find(value => value.id === casePayload),
+      take = clip.takes[0],
+      takeCard = [...$('takeList').querySelectorAll('[data-view]')]
+        .find(node => node.dataset.view === take.id)
+        ?.closest('.take-card');
+    check('A crafted take ID is a data attribute value', !!takeCard && takeCard.dataset.take === take.id);
+    check('The crafted take number renders as text on the take card', takeCard.textContent.includes(casePayload));
+    const mediaCard = [...d.querySelectorAll('#mediaPanel [data-media]')].find(
+      node => node.dataset.media === take.media.id,
+    );
+    check('A crafted media ID is a data attribute value', !!mediaCard);
+    check('A crafted media name renders as text in the media pool', mediaCard.textContent.includes(casePayload));
+    check(
+      'No crafted identity field executed the script marker after inspector and media rendering',
+      marker() === 0 && d.querySelectorAll('#editor img[src="x"]').length === 0,
+    );
+    return { checks };
+  }
+
+  if (caseName === 'track') {
+    await wait('Timeline did not render the crafted track fixture', () => d.querySelector('#clipLane [data-clip]'));
+    const cut = d.querySelector('#clipLane .cut-transition'),
+      injected = d.querySelectorAll('#editor img[src="x"]');
+    if (marker() !== 0 || injected.length) {
+      throw Error(
+        'Crafted track number executed the script marker · marker=' +
+          marker() +
+          ' · injected=' +
+          injected.length +
+          ' · html=' +
+          (injected[0]?.outerHTML || 'none') +
+          ' · cut=' +
+          (cut?.getAttribute('style') || 'missing'),
+      );
+    }
+    check('A crafted track number does not execute the script marker', marker() === 0);
+    check('Two touching shots on the crafted track produce a cut marker', !!cut);
+    check(
+      'The crafted track number stays inside the cut style attribute as text',
+      cut.getAttribute('style').includes('__nativeSecurityXss') && cut.querySelectorAll('img').length === 0,
+    );
+    check('The crafted track number inserted no image element', injected.length === 0);
+    return { checks };
+  }
+
+  if (caseName === 'media-before') {
+    const imageNode = d.querySelector('#clipLane [data-clip="native-encoded-image"] .filmstrip img');
+    await wait('Timeline did not request the before-fix image', () => imageNode);
+    await wait('The before-fix image request did not settle', () => imageNode.complete, 15000);
+    check(
+      'The isolated before-fix url() leaves a raw # in the media address',
+      imageNode.getAttribute('src').includes('#'),
+    );
+    check('The raw # truncates the project image address and the image does not decode', imageNode.naturalWidth === 0);
+    const banner = d.createElement('div');
+    banner.id = 'nativeSecurityMediaBeforeBanner';
+    banner.textContent = 'F-18 before the fix: raw # in the media address truncated the request';
+    banner.style.cssText =
+      'position:fixed;left:24px;bottom:24px;z-index:2147483647;padding:12px 16px;background:#b91c1c;color:#fff;font:600 13px sans-serif;border-radius:8px';
+    d.body.append(banner);
+    return { checks };
+  }
+
+  if (caseName === 'media') {
+    const image = n.state.clips.find(clip => clip.id === 'native-encoded-image').takes[0].media,
+      video = n.state.clips.find(clip => clip.id === 'native-encoded-video').takes[0].media,
+      imageNode = d.querySelector('#clipLane [data-clip="native-encoded-image"] .filmstrip img');
+    await wait('Timeline did not request the encoded image', () => imageNode);
+    await wait('The encoded image did not decode', () => imageNode.complete && imageNode.naturalWidth > 0, 20000);
+    check(
+      'A real # and literal %41 in a project image name load through the encoded media URL',
+      imageNode.src === absoluteMediaUrl(image.poster) &&
+        imageNode.src.includes('%23') &&
+        imageNode.src.includes('%2541') &&
+        imageNode.naturalWidth === 64,
+    );
+    check(
+      'The encoded image URL keeps the literal percent-encoded 41 instead of an A',
+      !imageNode.src.includes('%41%') && imageNode.src.includes('100%25'),
+    );
+
+    const videoElement = d.createElement('video');
+    videoElement.preload = 'auto';
+    videoElement.muted = true;
+    videoElement.playsInline = true;
+    videoElement.src = absoluteMediaUrl(video.originalFile);
+    d.body.append(videoElement);
+    await wait(
+      'The encoded project video did not load',
+      () => videoElement.readyState >= 2 && videoElement.videoWidth === 320,
+      30000,
+    );
+    check(
+      'A real # and literal %41 in a project video name load through the encoded media URL',
+      videoElement.src === absoluteMediaUrl(video.originalFile) &&
+        videoElement.src.includes('%23') &&
+        videoElement.src.includes('%2541'),
+    );
+    check(
+      'The encoded video decodes its real dimensions',
+      videoElement.videoWidth === 320 && videoElement.videoHeight === 180 && Math.abs(videoElement.duration - 2) < 0.1,
+    );
+    await new Promise((resolve, reject) => {
+      const timer = setTimeout(() => reject(Error('The encoded video did not seek')), 15000);
+      videoElement.addEventListener(
+        'seeked',
+        () => {
+          clearTimeout(timer);
+          resolve();
+        },
+        { once: true },
+      );
+      videoElement.currentTime = 1.25;
+    });
+    await wait(
+      'The encoded video seek did not settle',
+      () => !videoElement.seeking && Math.abs(videoElement.currentTime - 1.25) < 0.12,
+      10000,
+    );
+    check('The encoded video seeks inside the real project file', Math.abs(videoElement.currentTime - 1.25) < 0.12);
+    videoElement.remove();
+
+    const range = await fetch(mediaUrl(video.file), { headers: { Range: 'bytes=0-63' } }),
+      rangeBytes = new Uint8Array(await range.arrayBuffer());
+    check(
+      'The host range route serves the generated video with # and %41',
+      range.status === 206 &&
+        /^bytes 0-63\/\d+$/.test(range.headers.get('Content-Range') || '') &&
+        rangeBytes.length === 64 &&
+        String.fromCharCode(...rangeBytes.slice(4, 8)) === 'ftyp',
+    );
+    const originalRange = await fetch(mediaUrl(video.originalFile), { headers: { Range: 'bytes=0-63' } });
+    check(
+      'The host range route also serves the original project input name',
+      originalRange.status === 206 && originalRange.headers.get('Content-Range')?.startsWith('bytes 0-63/'),
+    );
+    const queryRange = await fetch(mediaUrl(video.file) + '?native-security=query', {
+      headers: { Range: 'bytes=0-63' },
+    });
+    check(
+      'A URI query after the encoded file name is not part of the real name',
+      queryRange.status === 206 && queryRange.headers.get('Content-Range')?.startsWith('bytes 0-63/'),
+    );
+    const imageResponse = await fetch(mediaUrl(image.poster));
+    check(
+      'The host serves the project image whose name holds # and literal %41',
+      imageResponse.status === 200 && (await imageResponse.arrayBuffer()).byteLength > 100,
+    );
+    const doubleDecoded = await fetch(mediaUrl(video.file).replace('%2541', '%41'));
+    check('The host does not double-decode a literal %41 in a project name', doubleDecoded.status >= 400);
+    return { checks };
+  }
+
+  if (caseName === 'export') {
+    const created = [],
+      revoked = [],
+      events = [],
+      originalCreate = URL.createObjectURL,
+      originalRevoke = URL.revokeObjectURL;
+    URL.createObjectURL = value => {
+      const url = originalCreate.call(URL, value);
+      created.push(url);
+      events.push({ type: 'create', url });
+      return url;
+    };
+    URL.revokeObjectURL = url => {
+      revoked.push(url);
+      events.push({ type: 'revoke', url });
+      return originalRevoke.call(URL, url);
+    };
+    const link = () => $('exportResult').querySelector('a.download-link'),
+      openExport = async () => {
+        $('export').click();
+        await wait('The export dialog did not open', () => $('exportFormat') && $('renderExport'));
+        $('exportFormat').value = 'otio';
+        $('exportFormat').dispatchEvent(new Event('change'));
+        await wait('The timeline export button did not enable', () => !$('renderExport').disabled);
+      },
+      exportOnce = async previous => {
+        $('renderExport').click();
+        await wait(
+          previous ? 'The replacement timeline export did not finish' : 'The timeline export did not finish',
+          () => link() && link().href !== previous,
+          30000,
+        );
+        return link().href;
+      };
+    await openExport();
+    const first = await exportOnce(null),
+      firstCreated = events.findIndex(event => event.type === 'create' && event.url === first);
+    check('The first timeline export creates a blob download URL', first.startsWith('blob:') && firstCreated >= 0);
+    $('exportCancel').click();
+    await wait('The first export dialog did not close', () => $('modalOverlay').hidden);
+    await openExport();
+    const second = await exportOnce(first),
+      secondCreated = events.findIndex(
+        (event, index) => index > firstCreated && event.type === 'create' && event.url === second,
+      ),
+      revokedFirst = events.findIndex(event => event.type === 'revoke' && event.url === first);
+    check('The second timeline export replaces the download link', second !== first && secondCreated > firstCreated);
+    check(
+      'The previous timeline blob URL is revoked before the replacement is created',
+      revokedFirst > firstCreated && revokedFirst < secondCreated,
+    );
+    check('The current timeline blob URL is still live', !revoked.includes(second));
+    const firstStillResolves = await fetch(first).then(
+      () => true,
+      () => false,
+    );
+    check('The revoked timeline blob URL no longer resolves', !firstStillResolves);
+    const downloaded = await fetch(second);
+    check(
+      'The current timeline blob URL contains the exported OTIO timeline',
+      downloaded.ok && JSON.parse(await downloaded.text()).tracks,
+    );
+    check('Each timeline export creates exactly one new blob URL', created.length === 2);
+    return { checks };
+  }
+
+  throw Error('Unknown native security case: ' + caseName);
+})();
diff --git a/tests/native_take_export_browser_checks.js b/tests/native_take_export_browser_checks.js
new file mode 100644
index 0000000..d9cb699
--- /dev/null
+++ b/tests/native_take_export_browser_checks.js
@@ -0,0 +1,701 @@
+// Native acceptance for audit findings F-12 and F-23.
+//
+// The F-12 cases drive the real take inspector and permanent-deletion dialog against
+// project-owned PNG takes plus their workflow JSON. A delayed project PUT and an
+// injected project-save network failure are test faults at window.fetch; successful
+// saves and the delete-takes request still reach the isolated host.
+//
+// The F-23 cases open the real OTIO export dialog, click the actual download anchor
+// (the runner supplies a CDP download directory). Faults include a window.fetch
+// network rejection and a deliberately empty plan sent to the real host for HTTP
+// rejection. The runner parses completed bytes and compares the host-written file.
+(async () => {
+  const w = window,
+    d = document,
+    n = w.spoolNative,
+    $ = id => n.dialogRoot.getElementById(id) || d.getElementById(id),
+    state = (w.__nativeTakeExport = {
+      checks: [],
+      gaps: [],
+      deleted: [],
+      events: [],
+      urlEvents: [],
+      downloads: [],
+      evidence: {},
+    }),
+    sleep = ms => new Promise(resolve => setTimeout(resolve, ms)),
+    check = (label, ok) => {
+      if (!ok) throw Error(label);
+      state.checks.push(label);
+    },
+    wait = async (label, fn, timeout = 30000) => {
+      const end = Date.now() + timeout;
+      while (!(await fn())) {
+        if (Date.now() > end) throw Error(label);
+        await sleep(50);
+      }
+    },
+    paint = () =>
+      new Promise(resolve => requestAnimationFrame(() => requestAnimationFrame(() => requestAnimationFrame(resolve)))),
+    clip = () => n.state.clips.find(value => value.id === 'shot'),
+    card = id => d.querySelector('#takeList [data-take="' + id + '"]'),
+    menu = () => [...d.querySelectorAll('#native-clip-menu [role=menuitem]')],
+    menuAction = label => {
+      const button = menu().find(value => value.textContent.startsWith(label));
+      if (!button || button.disabled) throw Error('Unavailable menu action: ' + label);
+      return button;
+    },
+    closeMenu = async () => {
+      d.dispatchEvent(new KeyboardEvent('keydown', { key: 'Escape', bubbles: true }));
+      await wait(
+        'Take menu did not close',
+        () => !d.getElementById('native-clip-menu') || d.getElementById('native-clip-menu').hidden,
+      );
+    },
+    selectTake = async id => {
+      const checkbox = card(id)?.querySelector('[data-select-take]');
+      if (!checkbox) throw Error('No take card for ' + id);
+      checkbox.click();
+      await paint();
+    },
+    openDiskDelete = async (label = 'Permanently delete selected') => {
+      $('deleteTakesFromDisk').click();
+      await wait('Permanent-delete menu did not open', () => menu().length === 2);
+      menuAction(label).click();
+      await wait(
+        'Permanent-delete confirmation did not open',
+        () => !$('modalOverlay').hidden && $('takeDeleteConfirm'),
+      );
+    },
+    mediaUrl = relative =>
+      '/spool/media/' + encodeURIComponent(n.projectKey) + '/' + relative.split('/').map(encodeURIComponent).join('/'),
+    mediaExists = async relative =>
+      (
+        await state.realFetch(mediaUrl(relative) + '?native-take-export=' + Date.now(), {
+          cache: 'no-store',
+        })
+      ).ok,
+    serverProject = async () =>
+      (await state.realFetch('/spool/api/projects/' + encodeURIComponent(n.projectKey))).json(),
+    relativeOf = id => {
+      const take = clip()?.takes.find(value => value.id === id);
+      return take && (take.media.originalFile || take.media.file);
+    },
+    renameClip = value => {
+      const input = $('clipName');
+      input.value = value;
+      input.dispatchEvent(new Event('change', { bubbles: true }));
+    },
+    installFetchProbe = () => {
+      if (state.installed) return;
+      state.installed = true;
+      state.realFetch = w.fetch.bind(w);
+      w.fetch = async (input, options = {}) => {
+        const url = String(input),
+          method = String(options.method || 'GET').toUpperCase(),
+          projectPut = method === 'PUT' && url === '/spool/api/projects/' + n.projectKey,
+          deleteTakes = method === 'POST' && url.includes('/delete-takes/'),
+          otio = method === 'POST' && url === '/spool/api/export/otio?projectId=' + encodeURIComponent(n.projectKey);
+        if (projectPut) {
+          const payload = JSON.parse(options.body);
+          state.events.push({ type: 'save-start', revision: payload.revision, name: payload.document.clips[0].name });
+          if (state.failSave)
+            throw new TypeError('Injected project-save network failure (test fault; no HTTP request was sent)');
+          if (state.holdSave) {
+            state.holdSave = false;
+            state.putStarted = true;
+            const response = await new Promise(resolve => {
+              state.releaseSave = () => {
+                state.events.push({ type: 'save-release' });
+                resolve(state.realFetch(input, options));
+              };
+            });
+            state.events.push({
+              type: 'save-response',
+              status: response.status,
+              revision: (await response.clone().json()).revision,
+            });
+            return response;
+          }
+        }
+        if (deleteTakes) state.events.push({ type: 'delete-start', ...JSON.parse(options.body) });
+        if (otio && state.failExport)
+          throw new TypeError('Injected OTIO export network failure (test fault; no HTTP request was sent)');
+        if (otio) {
+          if (state.rejectExport)
+            options = { ...options, body: JSON.stringify({ ...JSON.parse(options.body), tracks: [] }) };
+          state.events.push({ type: 'otio-start', injectedEmptyPlan: !!state.rejectExport });
+        }
+        const response = await state.realFetch(input, options);
+        if (projectPut || deleteTakes || otio) {
+          const value = await response.clone().json();
+          state.events.push({
+            type: otio ? 'otio-response' : projectPut ? 'save-response' : 'delete-response',
+            status: response.status,
+            revision: value.project?.revision ?? value.revision,
+            ...(otio && { error: value.error }),
+          });
+        }
+        return response;
+      };
+    },
+    noStatus = status => !state.events.some(event => event.status === status),
+    projectPutCount = () => state.events.filter(event => event.type === 'save-start').length,
+    deleteStartCount = () => state.events.filter(event => event.type === 'delete-start').length,
+    deleteResponseCount = () => state.events.filter(event => event.type === 'delete-response').length,
+    timelinePlan = async range => {
+      const T = await import('/spool/ui/timeline.js');
+      return T.timelinePlan(n.state, range || T.exportRange(n.state));
+    },
+    planClips = plan => {
+      const track = plan.tracks.find(value => value.kind === 'video' && value.clips.length);
+      return (track?.clips || []).map(value => ({
+        name: value.name,
+        start: value.start,
+        sourceStart: value.in,
+        duration: value.out - value.in,
+      }));
+    },
+    totalFrames = async () => (await import('/spool/ui/timeline.js')).total(n.state),
+    expectedTimeline = async range => {
+      const plan = await timelinePlan(range);
+      return {
+        project: n.state.project,
+        fps: n.state.fps,
+        width: (n.state.resolution || { width: 960 }).width,
+        height: (n.state.resolution || { height: 540 }).height,
+        duration: plan.duration,
+        clips: planClips(plan),
+      };
+    },
+    installUrlProbe = () => {
+      if (state.urlProbe) return;
+      state.urlProbe = true;
+      const create = URL.createObjectURL,
+        revoke = URL.revokeObjectURL;
+      URL.createObjectURL = value => {
+        const url = create.call(URL, value);
+        state.urlEvents.push({ type: 'create', url });
+        return url;
+      };
+      URL.revokeObjectURL = url => {
+        state.urlEvents.push({ type: 'revoke', url });
+        return revoke.call(URL, url);
+      };
+    },
+    downloadLink = () => $('exportResult').querySelector('a.download-link'),
+    clickDownload = () => {
+      const anchor = downloadLink();
+      if (!anchor) throw Error('No timeline download link is shown');
+      const item = { name: anchor.getAttribute('download'), href: anchor.href };
+      if (!item.name || !item.href.startsWith('blob:')) throw Error('Timeline download link is malformed');
+      state.downloads.push(item);
+      return item;
+    },
+    openOtioDialog = async () => {
+      $('export').click();
+      await wait('Export dialog did not open', () => $('exportFormat') && $('renderExport'));
+      $('exportFormat').value = 'otio';
+      $('exportFormat').dispatchEvent(new Event('change'));
+      await wait('Timeline export controls did not become ready', () => !$('renderExport').disabled);
+    },
+    closeExportDialog = async () => {
+      $('exportCancel').click();
+      await wait('Export dialog did not close', () => $('modalOverlay').hidden);
+    },
+    exportOnce = async previous => {
+      $('renderExport').click();
+      await wait(
+        previous ? 'Replacement timeline export did not finish' : 'Timeline export did not finish',
+        () => downloadLink() && downloadLink().href !== previous,
+        30000,
+      );
+      return downloadLink().href;
+    },
+    stages = {
+      async f12_baseline() {
+        installFetchProbe();
+        n.selectClip('shot');
+        await n.flush();
+        await wait('Take inspector did not show the fixture takes', () => card('one'));
+        state.revisionBefore = n.revision;
+        state.relative = Object.fromEntries(['one', 'two', 'three', 'chosen'].map(id => [id, relativeOf(id)]));
+        check('The F-12 fixture has five real takes and one chosen in the edit', clip().takes.length === 5);
+        check(
+          'The chosen take and the first deletion candidate have project-owned PNG files',
+          Object.values(state.relative).every(Boolean) && (await mediaExists(state.relative.chosen)),
+        );
+        check('The inspector opens with the chosen take unchanged', clip().takeId === 'chosen');
+        return { checks: [] };
+      },
+      async f12_prepare() {
+        installFetchProbe();
+        await selectTake('chosen');
+        $('deleteTakesFromDisk').click();
+        await wait('Permanent-delete menu did not open for the chosen take', () => menu().length === 2);
+        check('The take in the edit is protected in the permanent-delete menu', menu()[0].disabled);
+        await closeMenu();
+        await selectTake('chosen');
+
+        await selectTake('three');
+        await openDiskDelete();
+        check(
+          'Permanent deletion asks for confirmation while the selected file and take still exist',
+          card('three') && (await mediaExists(state.relative.three)) && $('takeDeleteCancel'),
+        );
+        $('takeDeleteCancel').click();
+        await wait('Permanent-delete cancellation did not close', () => $('modalOverlay').hidden);
+        check(
+          'Cancelling permanent deletion keeps the selected take and its files',
+          card('three') && (await mediaExists(state.relative.three)) && deleteStartCount() === 0,
+        );
+        await selectTake('three');
+
+        state.holdSave = true;
+        await selectTake('one');
+        renameClip('Flush keeps the pending rename');
+        await wait('The delayed project save did not start', () => state.putStarted);
+        await openDiskDelete();
+        $('takeDeleteConfirm').click();
+        await wait(
+          'Permanent deletion did not start while the delayed save was pending',
+          () => $('takeDeleteConfirm').textContent === 'Deleting…',
+        );
+        check(
+          'Permanent deletion starts while its preceding project save is still pending',
+          $('takeDeleteConfirm').disabled && $('takeDeleteConfirm').textContent === 'Deleting…',
+        );
+        check(
+          'No delete-takes request is sent while the delayed save is pending',
+          deleteStartCount() === 0 && state.holdSave === false,
+        );
+        check(
+          'The pending rename and both take files are intact before the save resolves',
+          clip().name === 'Flush keeps the pending rename' &&
+            (await mediaExists(state.relative.one)) &&
+            (await mediaExists(state.relative.chosen)),
+        );
+        state.evidence.pendingSave = {
+          requests: projectPutCount(),
+          deleteRequests: deleteStartCount(),
+          revision: n.revision,
+        };
+        return { checks: [] };
+      },
+      async f12_release() {
+        if (!state.releaseSave) throw Error('The delayed project save was not released');
+        state.releaseSave();
+        await wait('Permanent deletion did not finish after the save resolved', () => deleteResponseCount() === 1);
+        await wait('Deleted take did not leave the editor', () => !clip().takes.some(take => take.id === 'one'));
+        await wait('Permanent-delete dialog did not close', () => $('modalOverlay').hidden);
+        const saveResponse = state.events.findIndex(event => event.type === 'save-response');
+        const deleteStart = state.events.findIndex(event => event.type === 'delete-start');
+        const deleteResponse = state.events.find(event => event.type === 'delete-response');
+        const saved = await serverProject();
+        check(
+          'The pending save completed before the delete-takes request started',
+          saveResponse >= 0 && deleteStart > saveResponse,
+        );
+        check(
+          'Permanent deletion sends the revision returned by the flushed save',
+          state.events[deleteStart].revision === state.events[saveResponse].revision,
+        );
+        check(
+          'The save and delete-takes replies are successful and never a revision conflict',
+          state.events[saveResponse].status === 200 && deleteResponse?.status === 200 && noStatus(409),
+        );
+        check(
+          'The authored rename survives the confirmed permanent deletion',
+          clip().name === 'Flush keeps the pending rename' &&
+            saved.document.clips[0].name === 'Flush keeps the pending rename',
+        );
+        check(
+          'The saved project records exactly the deleted take and keeps the chosen take',
+          saved.document.deletedTakeIds.includes('one') &&
+            saved.document.clips[0].takes.some(take => take.id === 'chosen') &&
+            !saved.document.clips[0].takes.some(take => take.id === 'one'),
+        );
+        const oneExists = await mediaExists(state.relative.one),
+          chosenExists = await mediaExists(state.relative.chosen),
+          twoExists = await mediaExists(state.relative.two);
+        state.evidence.releaseFiles = { oneExists, chosenExists, twoExists, relative: state.relative };
+        check(
+          'The deleted take file is gone while the chosen and remaining files stay',
+          !oneExists && chosenExists && twoExists,
+        );
+        state.revisionAfterFirst = n.revision;
+        state.deleted.push('one');
+        state.evidence.pendingSave.result = {
+          events: state.events.slice(),
+          revision: n.revision,
+          name: clip().name,
+        };
+        return { checks: [] };
+      },
+      async f12_prepareFailure() {
+        await selectTake('two');
+        state.failSave = true;
+        renameClip('Flush keeps the authored draft');
+        await wait('The injected save failure did not reach the editor', () =>
+          $('toast').textContent.includes('Injected project-save network failure'),
+        );
+        const failedPuts = projectPutCount(),
+          deleteBefore = deleteStartCount();
+        await openDiskDelete();
+        $('takeDeleteConfirm').click();
+        await wait('Permanent deletion did not refuse the failed save', () =>
+          $('takeDeleteError').textContent.includes('Resolve the project save before continuing.'),
+        );
+        const saved = await serverProject();
+        check(
+          'A failed draft save refuses permanent deletion without replacing the draft',
+          clip().name === 'Flush keeps the authored draft' && n.dirty && $('takeDeleteConfirm').disabled === false,
+        );
+        check(
+          'The refusal keeps the confirmation dialog and names the save requirement',
+          !$('modalOverlay').hidden && $('takeDeleteError').textContent.includes('Resolve the project save'),
+        );
+        check(
+          'The refused deletion sends no delete-takes request and leaves the files alone',
+          deleteStartCount() === deleteBefore &&
+            (await mediaExists(state.relative.one)) === false &&
+            (await mediaExists(state.relative.two)) &&
+            (await mediaExists(state.relative.chosen)),
+        );
+        check(
+          'The failed save leaves the server project unchanged at the previous revision',
+          saved.document.clips[0].name === 'Flush keeps the pending rename' &&
+            saved.revision === state.revisionAfterFirst &&
+            n.revision === state.revisionAfterFirst,
+        );
+        check(
+          'The failed save never reports a false revision conflict',
+          noStatus(409) && !$('modal').textContent.includes('changed'),
+        );
+        state.evidence.failedSave = {
+          failedPutAttempts: projectPutCount() - failedPuts,
+          deleteRequests: deleteStartCount() - deleteBefore,
+          revision: n.revision,
+          serverRevision: saved.revision,
+          draftName: clip().name,
+          error: $('takeDeleteError').textContent,
+        };
+        return { checks: [] };
+      },
+      async f12_retry() {
+        state.failSave = false;
+        $('takeDeleteConfirm').click();
+        await wait('Retry after the save failure did not finish deletion', () => deleteResponseCount() === 2);
+        await wait('Retried deletion did not leave the editor', () => !clip().takes.some(take => take.id === 'two'));
+        await wait('Retried deletion did not close the dialog', () => $('modalOverlay').hidden);
+        const response = state.events.filter(event => event.type === 'delete-response').at(-1),
+          saved = await serverProject();
+        check(
+          'Retrying after the save succeeds deletes the take without a conflict',
+          response?.status === 200 && noStatus(409) && n.revision === state.revisionAfterFirst + 2,
+        );
+        check(
+          'The retried save keeps the authored draft that the failed attempt preserved',
+          clip().name === 'Flush keeps the authored draft' &&
+            saved.document.clips[0].name === 'Flush keeps the authored draft',
+        );
+        check(
+          'The retried deletion removes only the selected file and keeps the chosen file',
+          !(await mediaExists(state.relative.two)) &&
+            (await mediaExists(state.relative.chosen)) &&
+            (await mediaExists(state.relative.three)),
+        );
+        check(
+          'Both accepted deletions are durable and the chosen take is still in the edit',
+          saved.document.deletedTakeIds.includes('one') &&
+            saved.document.deletedTakeIds.includes('two') &&
+            saved.document.clips[0].takeId === 'chosen' &&
+            !saved.document.clips[0].takes.some(take => take.id === 'two'),
+        );
+        state.deleted.push('two');
+        state.evidence.retry = {
+          events: state.events.slice(),
+          revision: n.revision,
+          serverRevision: saved.revision,
+          name: clip().name,
+          remaining: clip().takes.map(take => take.id),
+        };
+        return { checks: [] };
+      },
+      async f12_final() {
+        check(
+          'The final editor still shows the authored draft, chosen take and untouched takes',
+          clip().name === 'Flush keeps the authored draft' &&
+            clip().takeId === 'chosen' &&
+            ['chosen', 'three', 'four'].every(id => clip().takes.some(take => take.id === id)),
+        );
+        check(
+          'The final take-card count and selected set are consistent after both deletions',
+          d.querySelectorAll('#takeList [data-take]').length === 3 && n.view.takeSelection.ids.length === 0,
+        );
+        return { checks: [] };
+      },
+      async export_baseline() {
+        installFetchProbe();
+        n.selectClip('shot');
+        await n.flush();
+        installUrlProbe();
+        await wait('Timeline did not render the export shot', () => d.querySelector('#clipLane [data-clip="shot"]'));
+        state.relative = { chosen: relativeOf('chosen') };
+        state.firstPlan = await expectedTimeline();
+        check(
+          'The export fixture has one real video take with a project-owned source',
+          clip().takes.length === 1 && clip().takes[0].id === 'chosen' && !!state.relative.chosen,
+        );
+        check(
+          'The baseline timeline plan has one clip trimmed to the authored range',
+          state.firstPlan.clips.length === 1 &&
+            state.firstPlan.clips[0].start === 0 &&
+            state.firstPlan.clips[0].sourceStart === 12 &&
+            state.firstPlan.clips[0].duration === 24,
+        );
+        return { checks: [] };
+      },
+      async export_prepare() {
+        await openOtioDialog();
+        check(
+          'The export dialog selects OpenTimelineIO and names the timeline action',
+          $('exportFormat').value === 'otio' && $('renderExport').textContent === 'Export timeline',
+        );
+        return { checks: [] };
+      },
+      async export_serverFailure() {
+        state.rejectExport = true;
+        $('renderExport').click();
+        await wait('The real host did not reject the injected empty export plan', () =>
+          $('exportResult').textContent.includes('Add a clip before exporting.'),
+        );
+        const response = state.events.filter(event => event.type === 'otio-response').at(-1);
+        check(
+          'The real export route rejects the deliberately empty plan with HTTP 400',
+          response?.status === 400 && response.error === 'Add a clip before exporting.',
+        );
+        check(
+          'A failed first export shows the host error and enables retry without a download link',
+          !$('renderExport').disabled && $('renderExport').textContent === 'Try again' && !downloadLink(),
+        );
+        check('A failed first export creates and revokes no blob URLs', state.urlEvents.length === 0);
+        state.evidence.serverFailure = {
+          injectedCondition: 'The test sends tracks: [] in the otherwise real OTIO request.',
+          actualHttpResponse: response,
+          error: $('exportResult').textContent,
+        };
+        state.rejectExport = false;
+        return { checks: [] };
+      },
+      async export_first() {
+        const href = await exportOnce(null);
+        state.first = { href, plan: state.firstPlan, created: state.urlEvents.length, revoked: 0 };
+        check(
+          'The first OTIO export creates exactly one download URL and no revoke happens yet',
+          href.startsWith('blob:') &&
+            state.urlEvents.filter(event => event.type === 'create').length === 1 &&
+            state.urlEvents.filter(event => event.type === 'revoke').length === 0,
+        );
+        const item = clickDownload();
+        state.first.download = item;
+        check(
+          'The real Download timeline anchor names the exported OTIO file',
+          item.name.endsWith('.otio') && linkText().includes(item.name),
+        );
+        return {
+          checks: [],
+          download: { name: item.name, href: item.href, expected: state.first.plan },
+        };
+      },
+      async export_second() {
+        await closeExportDialog();
+        await openOtioDialog();
+        $('exportStart').value = '00:00:00:18';
+        const plan = await expectedTimeline({ start: 18, end: await totalFrames() });
+        state.secondPlan = plan;
+        const href = await exportOnce(state.first.href);
+        state.second = { href, plan };
+        const firstCreate = state.urlEvents.findIndex(
+            event => event.type === 'create' && event.url === state.first.href,
+          ),
+          firstRevoke = state.urlEvents.findIndex(event => event.type === 'revoke' && event.url === state.first.href),
+          secondCreate = state.urlEvents.findIndex(event => event.type === 'create' && event.url === href);
+        check(
+          'The replacement OTIO export revokes the previous blob URL before creating the new one',
+          firstRevoke > firstCreate && secondCreate > firstRevoke,
+        );
+        check(
+          'Each successful OTIO export creates exactly one new blob download URL',
+          state.urlEvents.filter(event => event.type === 'create').length === 2,
+        );
+        const item = clickDownload();
+        state.second.download = item;
+        check(
+          'The second timeline anchor downloads its own OTIO filename',
+          item.name !== state.first.download.name && item.href !== state.first.href,
+        );
+        return {
+          checks: [],
+          download: { name: item.name, href: item.href, expected: state.second.plan },
+        };
+      },
+      async export_failed() {
+        await closeExportDialog();
+        await openOtioDialog();
+        $('exportStart').value = '00:00:00:18';
+        state.failExport = true;
+        $('renderExport').click();
+        await wait('The injected OTIO export failure did not reach the dialog', () =>
+          $('exportResult').textContent.includes('Injected OTIO export network failure'),
+        );
+        const created = state.urlEvents.filter(event => event.type === 'create').length,
+          revoked = state.urlEvents.filter(event => event.type === 'revoke').length,
+          live = await w.fetch(state.second.href).then(
+            () => true,
+            () => false,
+          );
+        check(
+          'A failed OTIO export restores the retry button and shows the failure text',
+          $('renderExport').disabled === false &&
+            $('renderExport').textContent === 'Try again' &&
+            $('exportResult').textContent.includes('Injected OTIO export network failure'),
+        );
+        check(
+          'A failed OTIO export creates no blob URL and removes the displayed download link',
+          created === 2 && revoked === 1 && !downloadLink(),
+        );
+        check('The failed export retains one previous blob URL although its link is no longer shown', live);
+        state.evidence.failedExport = {
+          injected: true,
+          created,
+          revoked,
+          previousUrlStillLive: live,
+          button: $('renderExport').textContent,
+          error: $('exportResult').textContent,
+        };
+        return { checks: [] };
+      },
+      async export_failedAgain() {
+        $('renderExport').click();
+        await wait(
+          'Repeated network failure did not restore the retry button',
+          () => !$('renderExport').disabled && $('renderExport').textContent === 'Try again',
+        );
+        const created = state.urlEvents.filter(event => event.type === 'create').length,
+          revoked = state.urlEvents.filter(event => event.type === 'revoke').length;
+        check(
+          'Repeated failed exports retain exactly one existing URL without accumulating new blobs',
+          created === 2 && revoked === 1 && !downloadLink(),
+        );
+        await closeExportDialog();
+        const previousUrlLiveAfterClose = await w.fetch(state.second.href).then(
+          () => true,
+          () => false,
+        );
+        await openOtioDialog();
+        $('exportStart').value = '00:00:00:18';
+        check(
+          'Closing and reopening after failure keeps one prior URL and presents fresh export controls',
+          previousUrlLiveAfterClose && !downloadLink() && !$('renderExport').disabled,
+        );
+        state.evidence.failedExport.repeatedFailure = { created, revoked, previousUrlLiveAfterClose };
+        state.evidence.failedExport.lifecycle =
+          'A failed export discards the displayed link but keeps one previous blob until a later successful export replaces it or the page is destroyed. Closing the dialog does not revoke it.';
+        return { checks: [] };
+      },
+      async export_retry() {
+        state.failExport = false;
+        $('renderExport').click();
+        await wait(
+          'Retry after the failed export did not finish',
+          () => downloadLink() && downloadLink().href !== state.second.href,
+          30000,
+        );
+        const href = downloadLink().href;
+        state.third = { href, plan: state.secondPlan };
+        const secondRevoke = state.urlEvents.findIndex(
+            event => event.type === 'revoke' && event.url === state.second.href,
+          ),
+          thirdCreate = state.urlEvents.findIndex(event => event.type === 'create' && event.url === href);
+        check(
+          'A successful retry revokes the old blob URL and creates the next download URL',
+          secondRevoke >= 0 && thirdCreate > secondRevoke,
+        );
+        const item = clickDownload();
+        state.third.download = item;
+        return {
+          checks: [],
+          download: { name: item.name, href: item.href, expected: state.third.plan },
+        };
+      },
+      async export_final() {
+        const created = state.urlEvents.filter(event => event.type === 'create').map(event => event.url),
+          revoked = state.urlEvents.filter(event => event.type === 'revoke').map(event => event.url),
+          firstLive = await w.fetch(state.first.href).then(
+            () => true,
+            () => false,
+          ),
+          secondLive = await w.fetch(state.second.href).then(
+            () => true,
+            () => false,
+          ),
+          thirdLive = await w.fetch(state.third.href).then(
+            () => true,
+            () => false,
+          );
+        check(
+          'After the retry exactly two old URLs are revoked and the newest URL stays live',
+          created.length === 3 &&
+            revoked.length === 2 &&
+            !firstLive &&
+            !secondLive &&
+            thirdLive &&
+            revoked.includes(state.first.href) &&
+            revoked.includes(state.second.href),
+        );
+        check(
+          'The failed exports added no fourth URL or download',
+          created.length === 3 && state.downloads.length === 3,
+        );
+        await closeExportDialog();
+        check('The timeline export dialog closes without changing project state', clip().takes.length === 1);
+        state.evidence.urls = { created, revoked, firstLive, secondLive, thirdLive };
+        return { checks: [] };
+      },
+    };
+  function linkText() {
+    return $('exportResult').textContent;
+  }
+  w.__nativeTakeExportStages = stages;
+  const caseName = w.__nativeTakeExportCase || 'f12',
+    steps =
+      caseName === 'f12'
+        ? [
+            { name: 'f12_baseline', capture: 'f12-before', deleted: [] },
+            { name: 'f12_prepare', capture: 'f12-pending-save', deleted: [] },
+            { name: 'f12_release', capture: 'f12-after-first-delete', deleted: ['one'] },
+            { name: 'f12_prepareFailure', capture: 'f12-failed-save-refusal', deleted: ['one'] },
+            { name: 'f12_retry', deleted: ['one', 'two'] },
+            { name: 'f12_final', capture: 'f12-after-retry-delete', deleted: ['one', 'two'] },
+          ]
+        : [
+            { name: 'export_baseline', capture: 'f23-before' },
+            { name: 'export_prepare', capture: 'f23-export-dialog' },
+            { name: 'export_serverFailure', capture: 'f23-server-rejection', noDownload: true },
+            { name: 'export_first', capture: 'f23-first-export', download: true },
+            { name: 'export_second', capture: 'f23-second-export', download: true },
+            { name: 'export_failed', capture: 'f23-failed-export', noDownload: true },
+            { name: 'export_failedAgain', capture: 'f23-repeated-failure-reopen', noDownload: true },
+            { name: 'export_retry', capture: 'f23-retry-export', download: true },
+            { name: 'export_final' },
+          ];
+  w.__nativeTakeExportSummary = () => ({
+    checks: state.checks,
+    gaps: state.gaps,
+    deleted: state.deleted,
+    downloads: state.downloads,
+    evidence: state.evidence,
+  });
+  return { staged: true, steps, checks: [] };
+})();
diff --git a/tests/run_browser_checks.cjs b/tests/run_browser_checks.cjs
index 5cd5af3..79bddd6 100644
--- a/tests/run_browser_checks.cjs
+++ b/tests/run_browser_checks.cjs
@@ -20,6 +20,101 @@ const apiBase = process.env.SPOOL_API_BASE || base;
 const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
 const nextPaint = evaluate =>
   evaluate('new Promise(resolve => requestAnimationFrame(() => requestAnimationFrame(resolve)))');
+const safeLabel = name => name.replaceAll('/', '-');
+async function capture(page, evidence, label, name) {
+  const shot = await page.send('Page.captureScreenshot', { format: 'png' });
+  fs.writeFileSync(
+    path.join(evidence, label.replace('/', '-') + '-' + name + '.png'),
+    Buffer.from(shot.data, 'base64'),
+  );
+}
+
+async function waitForDownload(directory, name, start, downloads) {
+  const file = path.join(directory, name);
+  let lastSize = -1;
+  for (let attempt = 0; attempt < 300; attempt++) {
+    const entry = downloads.slice(start).find(value => value.suggestedFilename === name && value.state === 'completed');
+    if (fs.existsSync(file) && !fs.existsSync(file + '.crdownload')) {
+      const size = fs.statSync(file).size;
+      if (entry && size > 0 && size === lastSize) return { file, entry };
+      lastSize = size;
+    }
+    await sleep(100);
+  }
+  throw Error(
+    'Chrome did not complete download ' +
+      name +
+      ' in ' +
+      directory +
+      '; files=' +
+      (fs.existsSync(directory) ? fs.readdirSync(directory).join(', ') : 'missing') +
+      '; events=' +
+      JSON.stringify(downloads.slice(start)),
+  );
+}
+
+function verifyOtioDownload({ bytes, expected, fixture, serverFile, name }) {
+  const timeline = JSON.parse(bytes.toString('utf8')),
+    labels = [],
+    equal = (label, actual, wanted) => {
+      assert.equal(actual, wanted, label);
+      labels.push(label);
+    },
+    stack = timeline.tracks,
+    videoTrack = stack.children.find(track => track.kind === 'Video'),
+    clips = videoTrack.children.filter(item => item.OTIO_SCHEMA === 'Clip.1');
+  equal('The downloaded ' + name + ' parses as an OpenTimelineIO Timeline.1', timeline.OTIO_SCHEMA, 'Timeline.1');
+  equal('The downloaded timeline carries the project name', timeline.name, expected.project);
+  equal('The downloaded timeline has no global start time', timeline.global_start_time, null);
+  equal('The downloaded timeline records the project frame rate', timeline.metadata.spool.fps, expected.fps);
+  equal('The downloaded timeline records the project width', timeline.metadata.spool.width, expected.width);
+  equal('The downloaded timeline records the project height', timeline.metadata.spool.height, expected.height);
+  equal('The downloaded timeline has one video track for this fixture', !!videoTrack, true);
+  equal('The downloaded timeline keeps the expected clip count', clips.length, expected.clips.length);
+  equal(
+    'The downloaded video track keeps the export range duration',
+    videoTrack.children.reduce((sum, item) => sum + Number(item.source_range?.duration?.value || 0), 0),
+    expected.duration,
+  );
+  let position = 0,
+    clipIndex = 0;
+  for (const item of videoTrack.children) {
+    const duration = Number(item.source_range?.duration?.value || 0),
+      start = Number(item.source_range?.start_time?.value || 0);
+    if (item.OTIO_SCHEMA === 'Gap.1') {
+      position += duration;
+      continue;
+    }
+    if (item.OTIO_SCHEMA !== 'Clip.1') continue;
+    const wanted = expected.clips[clipIndex];
+    if (!wanted) throw Error('The downloaded timeline has more clips than the plan');
+    equal('The downloaded clip ' + (clipIndex + 1) + ' keeps its authored name', item.name, wanted.name);
+    equal('The downloaded clip ' + (clipIndex + 1) + ' keeps its timeline start', position, wanted.start);
+    equal('The downloaded clip ' + (clipIndex + 1) + ' keeps its source in point', start, wanted.sourceStart);
+    equal('The downloaded clip ' + (clipIndex + 1) + ' keeps its trimmed duration', duration, wanted.duration);
+    equal(
+      'The downloaded clip ' + (clipIndex + 1) + ' keeps its native source rate',
+      item.source_range.start_time.rate,
+      fixture.nativeRate,
+    );
+    equal(
+      'The downloaded clip ' + (clipIndex + 1) + ' references the project-owned source path',
+      path.resolve(item.media_reference.target_url),
+      path.resolve(fixture.expectedFile),
+    );
+    position += duration;
+    clipIndex++;
+  }
+  equal('The downloaded timeline contains every planned clip', clipIndex, expected.clips.length);
+  assert.ok(fs.existsSync(serverFile), 'The host-written OTIO file is missing: ' + serverFile);
+  assert.deepEqual(
+    JSON.parse(fs.readFileSync(serverFile, 'utf8')),
+    timeline,
+    'The downloaded OTIO timeline differs from the host-written file: ' + serverFile,
+  );
+  labels.push('The downloaded OTIO parses to the same timeline as the host-written file at ' + serverFile);
+  return labels;
+}
 
 // Chrome can list a DevTools socket a moment before it accepts connections.
 async function connect(url, attempts = 5) {
@@ -246,6 +341,207 @@ async function embeddedWorkflowFixture() {
   return { id: created.id, bridge: 'embedded-workflow-qa' };
 }
 
+// Real project-owned media for the native security checks. The names hold a hash,
+// a literal "%41" and a percent sign; upload receives them URI-encoded exactly once.
+function nativeSecurityMediaSource(extension) {
+  const folder = path.resolve(evidence, 'native-security-fixtures'),
+    source = path.join(folder, 'native-security-weird' + extension);
+  fs.mkdirSync(folder, { recursive: true });
+  if (!fs.existsSync(source)) {
+    execFileSync(
+      'ffmpeg',
+      extension === '.mp4'
+        ? [
+            '-v',
+            'error',
+            '-y',
+            '-f',
+            'lavfi',
+            '-i',
+            'testsrc=size=320x180:rate=24:duration=2',
+            '-c:v',
+            'libx264',
+            '-pix_fmt',
+            'yuv420p',
+            '-movflags',
+            '+faststart',
+            source,
+          ]
+        : ['-v', 'error', '-y', '-f', 'lavfi', '-i', 'color=c=teal:s=64x36:d=1', '-frames:v', '1', source],
+      { windowsHide: true },
+    );
+  }
+  return source;
+}
+
+async function nativeSecurityUpload(projectId, extension) {
+  const response = await fetch(apiBase + '/spool/api/upload?projectId=' + projectId + '&fps=24', {
+    method: 'POST',
+    headers: { 'X-Filename': encodeURIComponent('Native #7 %41 100%' + extension) },
+    body: fs.readFileSync(nativeSecurityMediaSource(extension)),
+  });
+  const value = await response.json();
+  if (!response.ok) throw Error(value.error || 'Native security media upload failed');
+  return value;
+}
+
+async function nativeSecurityFixture(kind) {
+  const payload = '<img src=x onerror="window.__nativeSecurityXss=(window.__nativeSecurityXss||0)+1">';
+  if (kind === 'xss') {
+    const media = {
+      ...still(payload, { kind: 'image', name: payload + '.png' }),
+      file: 'assets/black.png',
+      originalFile: 'assets/black.png',
+      poster: 'assets/black.png',
+    };
+    return api('projects', {
+      document: {
+        project: 'Native security XSS QA',
+        fps: 24,
+        resolution: { width: 960, height: 540 },
+        media: [media],
+        importedWorkflows: [],
+        audioClips: [],
+        tailGap: 0,
+        videoTracks: 1,
+        clips: [
+          {
+            id: payload,
+            name: 'Crafted identities',
+            in: 0,
+            out: 24,
+            count: 1,
+            revision: 1,
+            takeId: payload + '-take',
+            sources: [],
+            takes: [{ id: payload + '-take', number: payload, media }],
+          },
+        ],
+      },
+    });
+  }
+  if (kind === 'xss-before') {
+    const media = { ...still('before-media', { kind: 'image' }) };
+    return api('projects', {
+      document: {
+        project: 'Native security XSS before QA',
+        fps: 24,
+        resolution: { width: 960, height: 540 },
+        media: [media],
+        importedWorkflows: [],
+        audioClips: [],
+        tailGap: 0,
+        videoTracks: 1,
+        clips: [
+          {
+            id: 'before-clip',
+            name: 'Before-fix take number',
+            in: 0,
+            out: 24,
+            count: 1,
+            revision: 1,
+            takeId: 'before-take',
+            sources: [],
+            takes: [{ id: 'before-take', number: payload, media }],
+          },
+        ],
+      },
+    });
+  }
+  if (kind === 'track') {
+    const track = '1)"><img src=x onerror="window.__nativeSecurityXss=(window.__nativeSecurityXss||0)+1">',
+      clips = ['track-left', 'track-right'].map((id, index) => ({
+        id,
+        name: 'Crafted track ' + (index + 1),
+        videoTrack: track,
+        in: 0,
+        out: 24,
+        count: 1,
+        revision: 1,
+        takeId: id + '-take',
+        sources: [],
+        takes: [{ id: id + '-take', number: 1, media: still(id + '-media', { kind: 'image' }) }],
+      }));
+    return api('projects', {
+      document: {
+        project: 'Native security track QA',
+        fps: 24,
+        resolution: { width: 960, height: 540 },
+        media: [],
+        importedWorkflows: [],
+        audioClips: [],
+        tailGap: 0,
+        videoTracks: 1,
+        clips,
+      },
+    });
+  }
+  const created = await api('projects', {
+      document: {
+        project: 'Native security media QA',
+        fps: 24,
+        resolution: { width: 960, height: 540 },
+        media: [],
+        importedWorkflows: [],
+        audioClips: [],
+        tailGap: 0,
+        videoTracks: 1,
+        clips: [],
+      },
+    }),
+    video = await nativeSecurityUpload(created.id, '.mp4'),
+    image = await nativeSecurityUpload(created.id, '.png'),
+    record = ({ probe, ...value }) => value,
+    videoTake = record(video);
+  const document = {
+    project: 'Native security media QA',
+    fps: 24,
+    resolution: { width: 960, height: 540 },
+    media: [record(video), record(image)],
+    importedWorkflows: [],
+    audioClips: [],
+    tailGap: 0,
+    videoTracks: 1,
+    clips: [
+      {
+        id: 'native-encoded-image',
+        name: 'Encoded image',
+        in: 0,
+        out: 24,
+        count: 1,
+        revision: 1,
+        takeId: 'native-encoded-image-take',
+        sources: [],
+        takes: [
+          {
+            id: 'native-encoded-image-take',
+            number: 1,
+            media: {
+              ...image,
+              file: image.file,
+              originalFile: image.originalFile,
+              poster: image.poster,
+            },
+          },
+        ],
+      },
+      {
+        id: 'native-encoded-video',
+        name: 'Encoded video',
+        in: 0,
+        out: 24,
+        count: 1,
+        revision: 1,
+        takeId: 'native-encoded-video-take',
+        sources: [],
+        takes: [{ id: 'native-encoded-video-take', number: 1, media: videoTake }],
+      },
+    ],
+  };
+  await api('projects/' + created.id, { revision: created.revision, document }, 'PUT');
+  return { id: created.id };
+}
+
 async function reviewFixture() {
   const takes = ['one', 'two', 'three'].map((id, index) => ({
     id,
@@ -580,6 +876,64 @@ async function firstWorkflowFixture() {
 }
 const CHECKS = {
   'stale-tab': { fixture: workflowPreviewFixture, modes: ['full'], file: 'stale_tab_browser_checks.js' },
+  'native-security-xss': {
+    fixture: () => nativeSecurityFixture('xss'),
+    modes: ['full'],
+    globals: () => ({ __nativeSecurityCase: 'xss' }),
+    file: 'native_security_browser_checks.js',
+  },
+  'native-security-xss-before': {
+    fixture: () => nativeSecurityFixture('xss-before'),
+    modes: ['full'],
+    securityBefore: true,
+    globals: () => ({ __nativeSecurityCase: 'xss-before' }),
+    file: 'native_security_browser_checks.js',
+  },
+  // Keep the cut-transition track sink in normal native acceptance.
+  'native-security-track': {
+    fixture: () => nativeSecurityFixture('track'),
+    modes: ['full'],
+    globals: () => ({ __nativeSecurityCase: 'track' }),
+    file: 'native_security_browser_checks.js',
+  },
+  'native-security-media': {
+    fixture: () => nativeSecurityFixture('media'),
+    modes: ['full'],
+    globals: () => ({ __nativeSecurityCase: 'media' }),
+    file: 'native_security_browser_checks.js',
+  },
+  'native-security-media-before': {
+    fixture: () => nativeSecurityFixture('media'),
+    modes: ['full'],
+    securityBeforeMedia: true,
+    globals: () => ({ __nativeSecurityCase: 'media-before' }),
+    file: 'native_security_browser_checks.js',
+  },
+  'native-security-export': {
+    fixture: () => nativeSecurityFixture('media'),
+    modes: ['full'],
+    globals: () => ({ __nativeSecurityCase: 'export' }),
+    file: 'native_security_browser_checks.js',
+  },
+  // F-12: real project files, a delayed save, an injected save failure and retry.
+  'native-take-delete-flush': {
+    fixture: () => takeCleanupFixture('Take disk flush QA', 'take-flush'),
+    modes: ['full'],
+    staged: true,
+    verifyTakeFiles: true,
+    globals: () => ({ __nativeTakeExportCase: 'f12' }),
+    file: 'native_take_export_browser_checks.js',
+  },
+  // F-23: real OTIO download clicks, repeated replacement and an injected export failure.
+  'native-take-export-download': {
+    fixture: nativeTakeExportFixture,
+    modes: ['full'],
+    staged: true,
+    downloads: true,
+    userGesture: true,
+    globals: () => ({ __nativeTakeExportCase: 'export' }),
+    file: 'native_take_export_browser_checks.js',
+  },
   'frame-interpretation': {
     fixture: frameInterpretationFixture,
     modes: ['full'],
@@ -1190,18 +1544,18 @@ async function clipFolderFixture() {
   return { id: project.id };
 }
 
-async function takeCleanupFixture() {
+async function takeCleanupFixture(projectName = 'Take cleanup QA', prefix = 'cleanup') {
   let project = await api('projects', {
-    document: { project: 'Take cleanup QA', fps: 24, clips: [], media: [], audioClips: [] },
+    document: { project: projectName, fps: 24, clips: [], media: [], audioClips: [] },
   });
   const takes = [],
     files = {};
   for (const [index, id] of ['chosen', 'one', 'two', 'three', 'four'].entries()) {
-    const file = path.resolve(evidence, 'cleanup-' + id + '.png');
+    const file = path.resolve(evidence, prefix + '-' + id + '.png');
     execFileSync('ffmpeg', ['-v', 'error', '-y', '-f', 'lavfi', '-i', 'color=c=red:s=96x64', '-frames:v', '1', file], {
       windowsHide: true,
     });
-    const response = await fetch(base + '/spool/api/upload?projectId=' + project.id + '&fps=24', {
+    const response = await fetch(apiBase + '/spool/api/upload?projectId=' + project.id + '&fps=24', {
       method: 'POST',
       headers: { 'X-Filename': id + '.png' },
       body: fs.readFileSync(file),
@@ -1226,7 +1580,76 @@ async function takeCleanupFixture() {
     },
     'PUT',
   );
-  return { id: project.id, files };
+  return { id: project.id, folder: project.folder, files };
+}
+
+async function nativeTakeExportFixture() {
+  let project = await api('projects', {
+    document: {
+      project: 'Native take export QA',
+      fps: 24,
+      resolution: { width: 320, height: 180 },
+      clips: [],
+      media: [],
+      audioClips: [],
+    },
+  });
+  const file = path.resolve(evidence, 'native-take-export.mp4');
+  execFileSync(
+    'ffmpeg',
+    [
+      '-v',
+      'error',
+      '-y',
+      '-f',
+      'lavfi',
+      '-i',
+      'testsrc=size=96x64:rate=24:duration=2',
+      '-c:v',
+      'libx264',
+      '-pix_fmt',
+      'yuv420p',
+      file,
+    ],
+    { windowsHide: true },
+  );
+  const response = await fetch(apiBase + '/spool/api/upload?projectId=' + project.id + '&fps=24', {
+      method: 'POST',
+      headers: { 'X-Filename': 'native-take-export.mp4' },
+      body: fs.readFileSync(file),
+    }),
+    media = await response.json();
+  if (!response.ok) throw Error('Native take export fixture upload failed: ' + JSON.stringify(media));
+  const take = { id: 'chosen', number: 1, media: { ...media, frames: 48 } };
+  project = await api(
+    'projects/' + project.id,
+    {
+      revision: project.revision,
+      document: {
+        ...project.document,
+        clips: [
+          {
+            id: 'shot',
+            name: 'Export shot',
+            takeId: 'chosen',
+            takes: [take],
+            in: 12,
+            out: 36,
+            revision: 1,
+          },
+        ],
+        media: [take.media],
+      },
+    },
+    'PUT',
+  );
+  return {
+    id: project.id,
+    folder: project.folder,
+    projectName: project.document.project,
+    expectedFile: path.resolve(project.folder, media.originalFile),
+    nativeRate: Number(media.fps) || 24,
+  };
 }
 
 async function sidecarFixture() {
@@ -2182,7 +2605,15 @@ async function runLibraryDrop(page, evaluate, label) {
   const names = requested.length
     ? requested
     : Object.keys(CHECKS).filter(
-        name => !['workflow-project-profile', 'workflow-capture-bundle', 'cloud-smoke', 'stale-tab'].includes(name),
+        name =>
+          ![
+            'workflow-project-profile',
+            'workflow-capture-bundle',
+            'cloud-smoke',
+            'stale-tab',
+            'native-security-xss-before',
+            'native-security-media-before',
+          ].includes(name),
       );
   for (const name of names) if (!CHECKS[name]) throw Error('Unknown check: ' + name);
   // Frontend checks can share an older CPU host. Cover new backend routes with
@@ -2230,6 +2661,10 @@ async function runLibraryDrop(page, evaluate, label) {
     ],
     { windowsHide: true, stdio: 'ignore' },
   );
+  fs.writeFileSync(
+    path.join(evidence, 'browser-session.json'),
+    JSON.stringify({ pid: child.pid, executable, debugPort: port, base, apiBase }, null, 2),
+  );
   let browser;
   const summary = [];
   try {
@@ -2243,7 +2678,17 @@ async function runLibraryDrop(page, evaluate, label) {
       }
     }
     if (!version) throw Error('Owned Chromium did not start');
+    fs.writeFileSync(
+      path.join(evidence, 'browser-session.json'),
+      JSON.stringify({ pid: child.pid, executable, debugPort: port, base, apiBase, version }, null, 2),
+    );
     browser = await connect(version.webSocketDebuggerUrl);
+    const browserDownloads = [];
+    browser.on('Browser.downloadWillBegin', params => browserDownloads.push({ ...params, state: 'started' }));
+    browser.on('Browser.downloadProgress', params => {
+      const entry = browserDownloads.find(value => value.guid === params.guid);
+      if (entry) Object.assign(entry, params);
+    });
 
     for (const name of names) {
       const check = CHECKS[name];
@@ -2254,7 +2699,18 @@ async function runLibraryDrop(page, evaluate, label) {
         const page = await connect(targets.find(t => t.id === target.targetId).webSocketDebuggerUrl);
         const pageErrors = [];
         const label = name + '/' + mode;
+        let downloadDir = null;
         try {
+          if (check.downloads) {
+            downloadDir = path.join(evidence, safeLabel(label) + '-downloads');
+            fs.mkdirSync(downloadDir, { recursive: true });
+            assert.equal(fs.readdirSync(downloadDir).length, 0, 'Use a fresh empty download evidence directory');
+            await browser.send('Browser.setDownloadBehavior', {
+              behavior: 'allow',
+              downloadPath: path.resolve(downloadDir),
+              eventsEnabled: true,
+            });
+          }
           page.on('Runtime.exceptionThrown', ({ exceptionDetails }) =>
             pageErrors.push(exceptionDetails.exception?.description || exceptionDetails.text),
           );
@@ -2460,6 +2916,13 @@ async function runLibraryDrop(page, evaluate, label) {
               pathname.split('/').at(-1),
             );
             if (fs.existsSync(file) && fs.statSync(file).isFile()) {
+              let body = fs.readFileSync(file);
+              if (check.securityBefore && path.basename(file) === 'timeline-renderer.js')
+                body = Buffer.from(body.toString('utf8').replace(/\besc\(/g, 'String('));
+              if (check.securityBeforeMedia && path.basename(file) === 'editor.js')
+                body = Buffer.from(
+                  body.toString('utf8').replace("path.split('/').map(encodeURIComponent).join('/')", 'path'),
+                );
               await page.send('Fetch.fulfillRequest', {
                 requestId,
                 responseCode: 200,
@@ -2467,7 +2930,7 @@ async function runLibraryDrop(page, evaluate, label) {
                   { name: 'Content-Type', value: file.endsWith('.css') ? 'text/css' : 'text/javascript' },
                   { name: 'Cache-Control', value: 'no-store' },
                 ],
-                body: fs.readFileSync(file).toString('base64'),
+                body: body.toString('base64'),
               });
             } else await page.send('Fetch.continueRequest', { requestId });
           });
@@ -2571,8 +3034,121 @@ async function runLibraryDrop(page, evaluate, label) {
           }
 
           const takeDeleteKeys = check.takeFiles ? await runTakeDeleteKeys(page, evaluate) : [];
-          const result = await evaluate(fs.readFileSync(path.join(__dirname, check.file), 'utf8'));
+          let result = await evaluate(fs.readFileSync(path.join(__dirname, check.file), 'utf8'));
           result.checks.push(...takeDeleteKeys);
+          if (result.staged) {
+            const labels = [...result.checks],
+              gaps = [...(result.gaps || [])],
+              deleted = [...(result.deleted || [])],
+              stageEvidence = {},
+              exportsDir = path.join(project.folder, 'exports'),
+              originalTakeFiles = check.verifyTakeFiles
+                ? new Map(
+                    Object.values(project.files)
+                      .flatMap(files => Object.values(files))
+                      .map(file => [file, fs.readFileSync(file)]),
+                  )
+                : null;
+            for (const step of result.steps || []) {
+              const beforeDownloads = browserDownloads.length,
+                existingFiles = downloadDir && fs.existsSync(downloadDir) ? fs.readdirSync(downloadDir) : [],
+                existingExports = fs.existsSync(exportsDir) ? fs.readdirSync(exportsDir) : [];
+              const stage = await evaluate(`window.__nativeTakeExportStages[${JSON.stringify(step.name)}]()`);
+              labels.push(...(stage?.checks || []));
+              if (step.download) {
+                if (!stage?.download || !downloadDir) throw Error('Stage returned no OTIO download: ' + step.name);
+                const download = stage.download,
+                  point = await evaluate(
+                    `(()=>{const a=document.querySelector('#exportResult a.download-link');if(!a)return null;const r=a.getBoundingClientRect();const x=r.left+r.width/2,y=r.top+r.height/2,hit=document.elementFromPoint(x,y);return {x,y,onLink:hit===a||a.contains(hit)};})()`,
+                  );
+                if (!point?.onLink) throw Error('The OTIO download link is not clickable at ' + JSON.stringify(point));
+                await page.send('Input.dispatchMouseEvent', { type: 'mouseMoved', x: point.x, y: point.y });
+                await page.send('Input.dispatchMouseEvent', {
+                  type: 'mousePressed',
+                  x: point.x,
+                  y: point.y,
+                  button: 'left',
+                  buttons: 1,
+                  clickCount: 1,
+                });
+                await page.send('Input.dispatchMouseEvent', {
+                  type: 'mouseReleased',
+                  x: point.x,
+                  y: point.y,
+                  button: 'left',
+                  buttons: 0,
+                  clickCount: 1,
+                });
+                labels.push('A trusted Chrome mouse click activates the real timeline download anchor');
+                const completed = await waitForDownload(downloadDir, download.name, beforeDownloads, browserDownloads),
+                  bytes = fs.readFileSync(completed.file),
+                  serverFile = path.join(project.folder, 'exports', download.name);
+                labels.push(
+                  ...verifyOtioDownload({
+                    bytes,
+                    expected: download.expected,
+                    fixture: project,
+                    serverFile,
+                    name: download.name,
+                  }),
+                );
+                stageEvidence[step.name] = {
+                  file: completed.file,
+                  href: download.href,
+                  size: bytes.length,
+                  downloadState: completed.entry.state,
+                  guid: completed.entry.guid,
+                  totalBytes: completed.entry.totalBytes,
+                };
+              } else if (step.noDownload) {
+                await sleep(800);
+                assert.equal(
+                  browserDownloads.length,
+                  beforeDownloads,
+                  'Failed export started a new Chrome download: ' + step.name,
+                );
+                assert.deepEqual(
+                  fs.readdirSync(downloadDir).filter(name => name.endsWith('.otio')),
+                  existingFiles.filter(name => name.endsWith('.otio')),
+                  'Failed export wrote a new OTIO file: ' + step.name,
+                );
+                labels.push('The failed OTIO export produced no new Chrome download file');
+                assert.deepEqual(
+                  fs.existsSync(exportsDir) ? fs.readdirSync(exportsDir) : [],
+                  existingExports,
+                  'Failed export wrote a new host export file: ' + step.name,
+                );
+                labels.push('The failed OTIO export produced no new host export file');
+                stageEvidence[step.name] = { newDownloads: 0 };
+              } else stageEvidence[step.name] = { checks: stage?.checks?.length || 0 };
+              if (check.verifyTakeFiles && step.deleted) {
+                const files = [];
+                for (const [id, takeFiles] of Object.entries(project.files))
+                  for (const file of Object.values(takeFiles)) {
+                    const exists = fs.existsSync(file);
+                    assert.equal(exists, !step.deleted.includes(id), step.name + ': take file ' + file);
+                    if (exists)
+                      assert.deepEqual(
+                        fs.readFileSync(file),
+                        originalTakeFiles.get(file),
+                        'Take bytes changed: ' + file,
+                      );
+                    files.push({ take: id, file, exists, unchanged: exists ? true : null });
+                  }
+                labels.push('Filesystem media/JSON pairs match the expected deletion state at ' + step.name);
+                stageEvidence[step.name].files = files;
+              }
+              if (step.capture) await capture(page, evidence, label, step.capture);
+            }
+            const final = await evaluate('window.__nativeTakeExportSummary()');
+            result = {
+              checks: [...labels, ...(final?.checks || [])],
+              gaps: [...gaps, ...(final?.gaps || [])],
+              deleted: [...new Set([...deleted, ...(final?.deleted || [])])],
+              evidence: { ...(final?.evidence || {}), stages: stageEvidence },
+            };
+            if (result.gaps.length) console.log(label + ': gaps: ' + result.gaps.join(' | '));
+          }
           if (check.libraryDrop) result.checks.push(...(await runLibraryDrop(page, evaluate, label)));
           if (check.takeFiles) {
             for (const [id, files] of Object.entries(project.files))
@@ -2586,6 +3162,18 @@ async function runLibraryDrop(page, evaluate, label) {
               'Filesystem verification confirms deleted media and matching JSON are gone, with archived/kept files intact',
             );
           }
+          if (check.verifyTakeFiles) {
+            for (const [id, files] of Object.entries(project.files))
+              for (const file of Object.values(files))
+                assert.equal(
+                  fs.existsSync(file),
+                  !result.deleted.includes(id),
+                  'Verified take file exists: ' + file + ' (' + id + ')',
+                );
+            result.checks.push(
+              'Filesystem verification confirms the two deleted media/JSON pairs are gone and the chosen/remaining files are intact',
+            );
+          }
           if (check.continuation) {
             const extra = await evaluate('window.__continueWorkflowChecks?.()');
             if (extra) result.checks.push(...extra.checks);
@@ -2636,6 +3224,8 @@ async function runLibraryDrop(page, evaluate, label) {
           throw Error(label + ': ' + error.message, { cause: error });
         } finally {
           page.close();
+          if (check.downloads)
+            await browser.send('Browser.setDownloadBehavior', { behavior: 'default' }).catch(() => {});
           await browser.send('Target.closeTarget', { targetId: target.targetId });
         }
       }
diff --git a/tests/test_cancellation_read_path.py b/tests/test_cancellation_read_path.py
new file mode 100644
index 0000000..7c85c2e
--- /dev/null
+++ b/tests/test_cancellation_read_path.py
@@ -0,0 +1,205 @@
+"""Cancellation checks read published state without entering a writer transaction."""
+
+import os
+import sqlite3
+import tempfile
+import threading
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+from spool import commands
+from spool.ownership import file_lock
+from spool.projects import ProjectStore, Workspace
+from spool.store import Store
+
+
+class CancellationObserved(Exception):
+    def __init__(self, done):
+        self.done = done
+
+
+class CheckOnlyAdapter:
+    async def cancel(self, attempt, context):
+        # Stop before command persistence or external delivery. Everything through
+        # the actual cancellation preflight has read the real project store.
+        if context["stage"] != "check":
+            raise AssertionError("Only the cancellation check should run")
+        raise CancellationObserved(context["done"])
+
+
+class CancellationReadPathTests(unittest.TestCase):
+    def setUp(self):
+        temp = tempfile.TemporaryDirectory()
+        self.addCleanup(temp.cleanup)
+        self.root = Path(temp.name)
+        self.workspace = Workspace(self.root / "writer")
+        self.project = self.workspace.create(
+            {"clips": [{"id": "clip", "name": "Shot", "takes": []}], "media": []}, self.root / "project"
+        )
+        self.store = self.workspace.for_project(self.project["id"])
+        self.assertIsInstance(self.store, ProjectStore)
+        self.attempt = self.store.intent(
+            self.project["id"], {"id": "clip", "name": "Shot"}, {"capture": {}, "target": "deadline"}
+        )
+        self.submission = self.store.submission(self.attempt["id"], {})
+        self.store.acknowledge(self.submission["id"], "owned-job")
+        self.store.transition(self.attempt["id"], "farm_running")
+        self.envelope = {
+            "operationId": "cancel",
+            "revision": self.project["revision"],
+            "actor": "test",
+            "scope": {"projectId": self.project["id"], "clipIds": ["clip"], "capabilities": ["cancel"]},
+            "action": "cancel",
+            "arguments": {"attemptId": self.attempt["id"]},
+        }
+        self.plan(self.store)
+
+    def plan(self, store):
+        def apply(db, document):
+            store.claim_cancellation(db, self.envelope["operationId"])
+            store.transition(self.attempt["id"], "cancel_requested", db=db, expected="farm_running")
+            return {"attemptId": self.attempt["id"], "jobId": "owned-job", "status": "cancel_requested"}, False
+
+        return store.command(
+            self.envelope["operationId"],
+            self.project["id"],
+            self.project["revision"],
+            self.envelope,
+            apply,
+        )
+
+    def preflight(self, store):
+        with patch.object(commands, "adapter_for", return_value=CheckOnlyAdapter()):
+            with self.assertRaises(CancellationObserved) as observed:
+                commands.execute(store, None, self.project["id"], self.envelope)
+        return observed.exception.done
+
+    def other_store(self):
+        workspace = Workspace(self.root / "reader")
+        workspace.open_folder(self.store.root)
+        return workspace.for_project(self.project["id"])
+
+    @staticmethod
+    def file_state(path):
+        stat = path.stat()
+        return path.read_bytes(), stat.st_mtime_ns, stat.st_ino
+
+    def test_preflight_keeps_publication_manifest_backups_and_writer_checkpoint_unchanged(self):
+        self.store.finish_cancellation("cancel")
+        self.assertTrue(self.preflight(self.store))
+        # Pin an old timestamp so another checkpoint write is detected even on
+        # filesystems whose clock resolution would hide two quick writes.
+        os.utime(self.store.stamp, ns=(1_000_000_000, 1_000_000_000))
+        snapshot = self.file_state(self.store.snapshot)
+        publication = self.store.signature()
+        manifest = self.file_state(self.store.manifest)
+        checkpoint = self.file_state(self.store.stamp)
+        backups = list((self.store.root / ".spool" / "backups").glob("*"))
+
+        for _ in range(3):
+            self.assertTrue(self.preflight(self.store))
+
+        self.assertEqual(self.file_state(self.store.snapshot), snapshot)
+        self.assertEqual(self.store.signature(), publication)
+        self.assertEqual(self.file_state(self.store.manifest), manifest)
+        self.assertEqual(list((self.store.root / ".spool" / "backups").glob("*")), backups)
+        self.assertEqual(self.file_state(self.store.stamp), checkpoint)
+
+    def test_warm_preflight_finishes_while_the_local_writer_lock_is_held(self):
+        self.store.finish_cancellation("cancel")
+        self.assertTrue(self.preflight(self.store))
+        finished = threading.Event()
+        results, errors = [], []
+
+        def poll():
+            try:
+                results.append(self.preflight(self.store))
+            except BaseException as error:
+                errors.append(error)
+            finally:
+                finished.set()
+
+        thread = threading.Thread(target=poll)
+        with file_lock(self.store.local_lock):
+            thread.start()
+            completed_without_writer = finished.wait(2)
+        thread.join(5)
+        self.assertFalse(thread.is_alive())
+        self.assertEqual(errors, [])
+        self.assertEqual(results, [True])
+        self.assertTrue(completed_without_writer, "Cancellation preflight needlessly waits for the writer lock")
+
+    def test_preflight_refreshes_an_acknowledgement_from_another_workspace(self):
+        reader = self.other_store()
+        self.assertFalse(self.preflight(reader))
+        self.store.finish_cancellation("cancel", "delivery unconfirmed")
+        self.assertFalse(self.preflight(reader))
+
+        self.store.finish_cancellation("cancel")
+        snapshot = self.file_state(self.store.snapshot)
+        publication = self.store.signature()
+        manifest = self.file_state(self.store.manifest)
+        checkpoint = self.file_state(reader.stamp)
+        for _ in range(3):
+            self.assertTrue(self.preflight(reader))
+        self.assertEqual(self.file_state(self.store.snapshot), snapshot)
+        self.assertEqual(self.store.signature(), publication)
+        self.assertEqual(self.file_state(self.store.manifest), manifest)
+        self.assertEqual(self.file_state(reader.stamp), checkpoint)
+
+    def test_supplied_transaction_sees_unpublished_acknowledgement_and_legacy_sent_state(self):
+        # The planner must observe its own writes, while an existing reader must
+        # keep the older generation until its context ends.
+        with self.store.reading() as published:
+            self.assertFalse(self.store.cancellation_done(published, self.attempt["id"]))
+            with self.store.connect() as db:
+                db.execute("BEGIN IMMEDIATE")
+                db.execute("UPDATE effects SET state='sent' WHERE operation_id='cancel'")
+                self.assertTrue(self.store.cancellation_done(db, self.attempt["id"]))
+                self.assertFalse(self.store.cancellation_done(published, self.attempt["id"]))
+            self.assertFalse(self.store.cancellation_done(published, self.attempt["id"]))
+        self.assertTrue(self.preflight(self.store))
+
+    def test_plain_store_keeps_false_true_missing_and_query_errors(self):
+        store = Store(self.root / "legacy")
+        project = store.create({"clips": [{"id": "clip", "name": "Shot", "takes": []}], "media": []})
+        attempt = store.intent(project["id"], {"id": "clip", "name": "Shot"}, {"capture": {}})
+        envelope = {"actor": "test", "action": "cancel", "arguments": {"attemptId": attempt["id"]}}
+
+        def apply(db, document):
+            store.claim_cancellation(db, "cancel")
+            store.transition(attempt["id"], "cancel_requested", db=db)
+            return {"attemptId": attempt["id"], "status": "cancel_requested"}, False
+
+        store.command("cancel", project["id"], project["revision"], envelope, apply)
+        for error, expected in (("delivery unconfirmed", False), (None, True)):
+            store.finish_cancellation("cancel", error)
+            with store.reading() as db:
+                self.assertIs(store.cancellation_done(db, attempt["id"]), expected)
+                for missing in ("missing-attempt", "", None):
+                    self.assertIs(store.cancellation_done(db, missing), False)
+                with self.assertRaises(sqlite3.ProgrammingError):
+                    store.cancellation_done(db, object())
+
+    def test_real_cancel_delivery_and_replay_preserve_result_and_send_once(self):
+        # Only the farm boundary is replaced; the adapter, command replay and
+        # cancellation acknowledgement all use their real implementation.
+        envelope = {**self.envelope, "operationId": "delivered-cancel"}
+        with (
+            patch("spool.farm.job_value", return_value=self.submission["id"]) as ownership,
+            patch("spool.farm.fail_job") as delivery,
+        ):
+            result = commands.execute(self.store, None, self.project["id"], envelope)
+            snapshot = self.file_state(self.store.snapshot)
+            replay = commands.execute(self.store, None, self.project["id"], envelope)
+        self.assertEqual(result, replay)
+        self.assertEqual(result["status"], "cancel_requested")
+        self.assertEqual(self.file_state(self.store.snapshot), snapshot)
+        ownership.assert_called_once_with("owned-job", "SpoolSubmissionId")
+        delivery.assert_called_once_with("owned-job")
+        self.assertTrue(self.preflight(self.store))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_cli.py b/tests/test_cli.py
index 5b640c4..d14a395 100644
--- a/tests/test_cli.py
+++ b/tests/test_cli.py
@@ -1,8 +1,13 @@
 import contextlib
+import http.server
 import io
 import json
+import os
+import tempfile
+import threading
 import unittest
 import urllib.error
+from pathlib import Path
 from unittest.mock import patch
 
 from spool.cli import run
@@ -13,7 +18,7 @@ def invoke(self, reply, *args):
         out, err = io.StringIO(), io.StringIO()
         with (
             patch("sys.argv", ["spool", "status", "project", *args]),
-            patch("urllib.request.urlopen") as send,
+            patch("spool.cli.urlopen") as send,
             contextlib.redirect_stdout(out),
             contextlib.redirect_stderr(err),
         ):
@@ -49,3 +54,50 @@ def test_http_network_and_non_json_failures(self):
         ):
             code, out, err = self.invoke(failure)
             self.assertEqual((code, out, json.loads(err)["code"]), (1, "", expected))
+
+    def test_unreadable_command_file_is_a_json_error(self):
+        with tempfile.TemporaryDirectory() as folder:
+            broken = Path(folder) / "command.json"
+            broken.write_text("{not json", encoding="utf-8")
+            for path in (broken, Path(folder) / "missing.json"):
+                err = io.StringIO()
+                with (
+                    patch("sys.argv", ["spool", "command", "project", "--file", str(path)]),
+                    patch("spool.cli.urlopen") as send,
+                    contextlib.redirect_stdout(io.StringIO()),
+                    contextlib.redirect_stderr(err),
+                ):
+                    self.assertEqual(run(), 1)
+                send.assert_not_called()
+                self.assertEqual(json.loads(err.getvalue())["code"], "invalid_request")
+
+
+class LoopbackTests(unittest.TestCase):
+    def test_a_proxy_for_other_traffic_does_not_capture_this_computer(self):
+        class Spool(http.server.BaseHTTPRequestHandler):
+            def do_GET(self):
+                body = b'{"ok":true}'
+                self.send_response(200)
+                self.send_header("Content-Length", str(len(body)))
+                self.end_headers()
+                self.wfile.write(body)
+
+            def log_message(self, *args):
+                pass
+
+        server = http.server.HTTPServer(("127.0.0.1", 0), Spool)
+        threading.Thread(target=server.serve_forever, daemon=True).start()
+        self.addCleanup(server.server_close)
+        self.addCleanup(server.shutdown)
+        url = "http://127.0.0.1:%d" % server.server_port
+        # Port 9 on loopback refuses: a request sent to this proxy would fail.
+        environment = {key: value for key, value in os.environ.items() if "proxy" not in key.lower()}
+        out = io.StringIO()
+        with (
+            patch.dict(os.environ, {**environment, "http_proxy": "http://127.0.0.1:9"}, clear=True),
+            patch("sys.argv", ["spool", "status", "project", "--url", url]),
+            contextlib.redirect_stdout(out),
+            contextlib.redirect_stderr(io.StringIO()),
+        ):
+            self.assertEqual(run(), 0)
+        self.assertEqual(json.loads(out.getvalue()), {"ok": True})
diff --git a/tests/test_cloud_collection_partials.py b/tests/test_cloud_collection_partials.py
new file mode 100644
index 0000000..7bcfbfa
--- /dev/null
+++ b/tests/test_cloud_collection_partials.py
@@ -0,0 +1,165 @@
+"""Cloud download ownership with local byte fixtures; no SDK or service calls."""
+
+import asyncio
+import errno
+import tempfile
+import unittest
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from spool import receipts, requests
+from spool.cloud import CloudExecutor
+from spool.media import Media
+from spool.projects import Workspace
+
+
+class CloudCollectionPartialTests(unittest.IsolatedAsyncioTestCase):
+    def setUp(self):
+        self.temporary = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temporary.cleanup)
+        self.root = Path(self.temporary.name)
+        for kind in ("input", "output", "temp"):
+            (self.root / kind).mkdir()
+        self.workspace = Workspace(self.root / "app")
+        project = self.workspace.create(
+            {"project": "Cloud ownership", "clips": [{"id": "shot", "name": "Shot", "takes": []}]},
+            self.root / "Film",
+        )
+        self.store = self.workspace.for_project(project["id"])
+        self.media = Media(
+            self.store.root, self.root / "input", self.root / "output", self.root / "temp", project_id=project["id"]
+        )
+        recipe = {
+            "prompt": {"save": {"class_type": "SaveVideo", "inputs": {"filename_prefix": "cloud"}}},
+            "bindings": [],
+            "result": {"nodeId": "save", "group": "videos", "index": 0},
+            "executionTarget": "cloud",
+        }
+        project = self.store.capture(project["id"], project["revision"], "shot", recipe)
+        with patch("spool.cloud.available", return_value=True):
+            project = requests.accept(
+                self.store, self.media, project["id"], project["revision"], [{"clipId": "shot", "count": 1}], "cloud"
+            )
+        self.attempt = self.store.attempt(project["document"]["jobs"][0]["id"])
+        self.executor = CloudExecutor(self.workspace, self.media, None)
+        self.destination = self.media.result_path(self.attempt, "any-id", ".mp4", True)
+        self.destination.parent.mkdir(parents=True, exist_ok=True)
+        self.destination.write_bytes(b"previous successful download")
+        self.unrelated = self.destination.with_name(self.destination.name + ".other-worker.partial")
+        self.unrelated.write_bytes(b"another worker")
+        self.data = b"download byte fixture" * 10
+        self.paths = []
+
+    def job(self, download):
+        output = SimpleNamespace(name="result.mp4", id="output", size_bytes=len(self.data), to_file=download)
+        return SimpleNamespace(id="job", get_outputs=lambda node: [output])
+
+    async def collect(self, download, executor=None):
+        await (executor or self.executor).collect(
+            self.attempt, self.media, self.job(download), "https://fixture.invalid"
+        )
+
+    def assert_preserved(self):
+        self.assertEqual(self.destination.read_bytes(), b"previous successful download")
+        self.assertEqual(self.unrelated.read_bytes(), b"another worker")
+        self.assertEqual(set(self.destination.parent.glob("*.partial")), {self.unrelated})
+
+    async def test_two_workspaces_download_without_sharing_a_partial(self):
+        second_workspace = Workspace(self.root / "second-app")
+        second_workspace.open_folder(self.store.root)
+        second = CloudExecutor(second_workspace, self.media, None)
+        # These independent workspaces can both legally own their Cloud loop.
+        self.executor.ownership.acquire()
+        second.ownership.acquire()
+        self.addCleanup(self.executor.ownership.close)
+        self.addCleanup(second.ownership.close)
+        first_written, second_open, first_finished = asyncio.Event(), asyncio.Event(), asyncio.Event()
+
+        async def first_download(path):
+            self.paths.append(path)
+            path.write_bytes(self.data)
+            first_written.set()
+            await asyncio.wait_for(second_open.wait(), 5)
+
+        async def second_download(path):
+            await asyncio.wait_for(first_written.wait(), 5)
+            self.paths.append(path)
+            with path.open("wb") as handle:
+                handle.write(self.data[:1])
+                handle.flush()
+                second_open.set()
+                await asyncio.wait_for(first_finished.wait(), 5)
+                handle.write(self.data[1:])
+
+        async def first_collect():
+            try:
+                await self.collect(first_download)
+            finally:
+                first_finished.set()
+
+        results = await asyncio.gather(first_collect(), self.collect(second_download, second), return_exceptions=True)
+        self.assertEqual(results, [None, None])
+        self.assertEqual(len(set(self.paths)), 2)
+        self.assertEqual(self.destination.read_bytes(), self.data)
+        self.assertEqual(set(self.destination.parent.glob("*.partial")), {self.unrelated})
+        result = receipts.verify(self.attempt, self.media.receipt_path(self.attempt), self.media)
+        self.assertEqual(result["primary"]["file"], self.destination.relative_to(self.media.root).as_posix())
+        self.assertEqual(result["primary"]["byteSize"], len(self.data))
+
+    async def test_download_failure_cleans_only_owned_partial(self):
+        error = OSError("download failed")
+
+        async def download(path):
+            self.paths.append(path)
+            path.write_bytes(self.data[:1])
+            raise error
+
+        with self.assertRaises(OSError) as caught:
+            await self.collect(download)
+        self.assertIs(caught.exception, error)
+        self.assert_preserved()
+
+    async def test_replacement_failure_preserves_destination_and_cleans_owned_partial(self):
+        error = OSError(errno.EIO, "replacement failed")
+        original = Path.replace
+
+        async def download(path):
+            self.paths.append(path)
+            path.write_bytes(self.data)
+
+        def replace(path, target):
+            if target == self.destination:
+                raise error
+            return original(path, target)
+
+        with patch.object(Path, "replace", replace):
+            with self.assertRaises(OSError) as caught:
+                await self.collect(download)
+        self.assertIs(caught.exception, error)
+        self.assert_preserved()
+
+    async def test_denied_cleanup_retains_original_download_error(self):
+        error = OSError("original download failure")
+        original = Path.unlink
+
+        async def download(path):
+            self.paths.append(path)
+            path.write_bytes(self.data[:1])
+            raise error
+
+        def unlink(path, *args, **kwargs):
+            if path in self.paths:
+                raise PermissionError("cleanup denied")
+            return original(path, *args, **kwargs)
+
+        with patch.object(Path, "unlink", unlink):
+            with self.assertRaises(OSError) as caught:
+                await self.collect(download)
+        self.assertIs(caught.exception, error)
+        self.assertEqual(self.destination.read_bytes(), b"previous successful download")
+        self.assertEqual(self.unrelated.read_bytes(), b"another worker")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_cloud_observation_batches.py b/tests/test_cloud_observation_batches.py
new file mode 100644
index 0000000..2da88d4
--- /dev/null
+++ b/tests/test_cloud_observation_batches.py
@@ -0,0 +1,254 @@
+"""A Cloud observation batch settles before its failure reaches the lifecycle."""
+
+import asyncio
+import os
+import tempfile
+import unittest
+from collections import defaultdict
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from spool import attempts, requests
+from spool.cloud import CloudExecutor
+from spool.collection import Collector
+from spool.media import Media
+from spool.store import Store, empty_project
+
+
+class ObservationAdapter:
+    """A local Cloud adapter double whose observations can be held or failed."""
+
+    def __init__(self):
+        self.held = set()
+        self.entered = {}
+        self.released = {}
+        self.failures = {}
+        self.failed = {}
+        self.calls = defaultdict(int)
+        self.active = defaultdict(int)
+        self.maximum_active = defaultdict(int)
+        self.cancelled = set()
+
+    def hold(self, identity):
+        self.held.add(identity)
+        self.entered[identity] = asyncio.Event()
+        self.released[identity] = asyncio.Event()
+
+    def fail(self, identity, message):
+        self.failures[identity] = message
+        self.failed[identity] = asyncio.Event()
+
+    def release(self, identity):
+        self.released[identity].set()
+
+    def recover(self, attempt, context):
+        identity = attempt["id"]
+        if identity in self.failures:
+            self.failed[identity].set()
+            error = self.failures[identity]
+            raise error if isinstance(error, BaseException) else RuntimeError(error)
+        return {"observe": True}
+
+    async def observe(self, attempt, context):
+        identity = attempt["id"]
+        self.calls[identity] += 1
+        self.active[identity] += 1
+        self.maximum_active[identity] = max(self.maximum_active[identity], self.active[identity])
+        try:
+            if identity in self.held:
+                self.entered[identity].set()
+                await self.released[identity].wait()
+            return {"job": SimpleNamespace(id="cloud-job", status="running"), "status": attempts.RUNNING}
+        except asyncio.CancelledError:
+            self.cancelled.add(identity)
+            raise
+        finally:
+            self.active[identity] -= 1
+
+
+class CloudObservationBatchTests(unittest.IsolatedAsyncioTestCase):
+    ENDPOINT = "https://cloud.example.test"
+
+    def setUp(self):
+        self.temporary = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temporary.cleanup)
+        self.root = Path(self.temporary.name)
+        self.store = Store(self.root / "store")
+        for kind in ("input", "output", "temp"):
+            (self.root / kind).mkdir()
+        self.media = Media(self.store.root, self.root / "input", self.root / "output", self.root / "temp")
+        self.environment = patch.dict(os.environ, {"COMFY_BASE_URL": self.ENDPOINT})
+        self.environment.start()
+        self.addCleanup(self.environment.stop)
+        self.key = patch("spool.cloud.cloud_key", return_value="comfyui-observation-fixture")
+        self.key.start()
+        self.addCleanup(self.key.stop)
+        self.available = patch("spool.cloud.available", return_value=True)
+        self.available.start()
+        self.addCleanup(self.available.stop)
+
+        document = empty_project()
+        document["clips"] = [{"id": "shot", "name": "Shot", "revision": 1, "takes": [], "takeId": "original"}]
+        project = self.store.create(document)
+        capture = {
+            "prompt": {"save": {"class_type": "SaveVideo", "inputs": {"filename_prefix": "observation"}}},
+            "bindings": [],
+            "result": {"nodeId": "save", "group": "videos", "index": 0},
+            "executionTarget": "cloud",
+        }
+        self.project = self.store.capture(project["id"], project["revision"], "shot", capture)
+        self.project = requests.accept(
+            self.store,
+            self.media,
+            self.project["id"],
+            self.project["revision"],
+            [{"clipId": "shot", "count": 2}],
+            "observation-batches",
+        )
+        self.held_id, self.failing_id = [job["id"] for job in self.project["document"]["jobs"]]
+        self.store.set_setting(
+            "cloud:" + self.held_id,
+            {"jobId": "held-cloud-job", "endpoint": self.ENDPOINT},
+        )
+        self.executor = CloudExecutor(self.store, self.media, Collector(self.store, self.media))
+        self.adapter = ObservationAdapter()
+        self.executor.adapter = self.adapter
+
+    def accept_more(self, operation):
+        project = self.store.get(self.project["id"])
+        self.project = requests.accept(
+            self.store,
+            self.media,
+            project["id"],
+            project["revision"],
+            [{"clipId": "shot", "count": 1}],
+            operation,
+        )
+        return self.project["document"]["jobs"][-1]["id"]
+
+    async def await_events(self, *events):
+        await asyncio.wait_for(asyncio.gather(*(event.wait() for event in events)), 5)
+
+    async def allow_failure_to_surface(self):
+        # The old gather future completed with the first failure after a turn or two.
+        for _ in range(20):
+            await asyncio.sleep(0)
+
+    async def test_batch_drains_held_observation_before_reporting_failure(self):
+        self.adapter.hold(self.held_id)
+        self.adapter.fail(self.failing_id, "observation failed")
+        task = asyncio.create_task(self.executor.run_once())
+        await self.await_events(self.adapter.entered[self.held_id], self.adapter.failed[self.failing_id])
+        await self.allow_failure_to_surface()
+
+        self.assertFalse(task.done(), "run_once reported the failure while another observation was still running")
+        self.assertEqual(self.adapter.active[self.held_id], 1)
+
+        self.adapter.release(self.held_id)
+        with self.assertRaisesRegex(RuntimeError, "observation failed"):
+            await asyncio.wait_for(task, 5)
+        self.assertEqual(self.store.attempt(self.held_id)["status"], attempts.RUNNING)
+        self.assertEqual(self.adapter.active[self.held_id], 0)
+        self.assertEqual(self.adapter.maximum_active[self.held_id], 1)
+
+    async def test_next_pass_does_not_overtake_a_running_batch(self):
+        self.adapter.hold(self.held_id)
+        self.adapter.fail(self.failing_id, "first pass failed")
+        first = asyncio.create_task(self.executor.run_once())
+        await self.await_events(self.adapter.entered[self.held_id], self.adapter.failed[self.failing_id])
+        await self.allow_failure_to_surface()
+
+        self.assertFalse(first.done(), "the failed batch handed control to the next pass before it settled")
+        self.adapter.release(self.held_id)
+        with self.assertRaisesRegex(RuntimeError, "first pass failed"):
+            await asyncio.wait_for(first, 5)
+
+        before = self.adapter.calls[self.held_id]
+        second = asyncio.create_task(self.executor.run_once())
+        with self.assertRaisesRegex(RuntimeError, "first pass failed"):
+            await asyncio.wait_for(second, 5)
+        self.assertGreater(self.adapter.calls[self.held_id], before)
+        self.assertEqual(self.adapter.maximum_active[self.held_id], 1)
+        self.assertEqual(self.adapter.active[self.held_id], 0)
+
+    async def test_all_observations_settle_and_every_failure_is_reported(self):
+        extra_id = self.accept_more("observation-batches-extra")
+        self.adapter.hold(self.held_id)
+        self.adapter.fail(self.failing_id, "first failure")
+        self.adapter.fail(extra_id, "second failure")
+        task = asyncio.create_task(self.executor.run_once())
+        await self.await_events(
+            self.adapter.entered[self.held_id],
+            self.adapter.failed[self.failing_id],
+            self.adapter.failed[extra_id],
+        )
+        await self.allow_failure_to_surface()
+
+        self.assertFalse(task.done(), "run_once reported failures before the held observation settled")
+        self.adapter.release(self.held_id)
+        with self.assertRaises(ExceptionGroup) as raised:
+            await asyncio.wait_for(task, 5)
+        self.assertEqual(
+            sorted(str(error) for error in raised.exception.exceptions),
+            ["first failure", "second failure"],
+        )
+        self.assertEqual(self.store.attempt(self.held_id)["status"], attempts.RUNNING)
+        self.assertEqual(self.adapter.active[self.held_id], 0)
+        self.assertEqual(self.adapter.maximum_active[self.held_id], 1)
+
+    async def test_parent_cancellation_leaves_no_orphan_observations(self):
+        self.adapter.hold(self.held_id)
+        self.adapter.fail(self.failing_id, "failure before cancellation")
+        task = asyncio.create_task(self.executor.run_once())
+        await self.await_events(self.adapter.entered[self.held_id], self.adapter.failed[self.failing_id])
+        await self.allow_failure_to_surface()
+
+        self.assertFalse(task.done(), "run_once settled the batch before the held observation finished")
+        task.cancel()
+        with self.assertRaises(asyncio.CancelledError):
+            await task
+        self.assertIn(self.held_id, self.adapter.cancelled)
+        self.assertEqual(self.adapter.active[self.held_id], 0)
+        await self.allow_failure_to_surface()
+        self.assertEqual(self.adapter.active[self.held_id], 0)
+
+    async def test_child_cancellation_drains_and_reports_other_failures(self):
+        extra_id = self.accept_more("observation-cancelled-child")
+        self.adapter.hold(self.held_id)
+        self.adapter.fail(self.failing_id, asyncio.CancelledError("child cancelled"))
+        self.adapter.fail(extra_id, "ordinary failure beside cancellation")
+        task = asyncio.create_task(self.executor.run_once())
+        await self.await_events(
+            self.adapter.entered[self.held_id],
+            self.adapter.failed[self.failing_id],
+            self.adapter.failed[extra_id],
+        )
+        self.assertFalse(task.done())
+        with self.assertLogs(level="ERROR") as logged:
+            self.adapter.release(self.held_id)
+            with self.assertRaises(asyncio.CancelledError) as raised:
+                await asyncio.wait_for(task, 5)
+        self.assertIsInstance(raised.exception.__cause__, ExceptionGroup)
+        self.assertEqual(
+            [str(error) for error in raised.exception.__cause__.exceptions],
+            ["ordinary failure beside cancellation"],
+        )
+        self.assertIn("ordinary failure beside cancellation", "\n".join(logged.output))
+        self.assertEqual(self.adapter.active[self.held_id], 0)
+
+    async def test_lifecycle_releases_ownership_when_task_has_failed(self):
+        entered, closed = asyncio.Event(), asyncio.Event()
+
+        async def failed_batch():
+            entered.set()
+            raise BaseExceptionGroup("unexpected batch failure", [RuntimeError("failure"), asyncio.CancelledError()])
+
+        self.executor.run_once = failed_batch
+        self.executor.ownership = SimpleNamespace(acquire=lambda: None, close=closed.set)
+        lifecycle = self.executor.lifecycle(None)
+        await anext(lifecycle)
+        await self.await_events(entered)
+        with self.assertRaises(BaseExceptionGroup):
+            await lifecycle.aclose()
+        self.assertTrue(closed.is_set(), "Executor ownership must close even when awaiting its task fails")
diff --git a/tests/test_collection_partial_ownership.py b/tests/test_collection_partial_ownership.py
new file mode 100644
index 0000000..3f18f58
--- /dev/null
+++ b/tests/test_collection_partial_ownership.py
@@ -0,0 +1,508 @@
+"""Collection copies own their temporary files; another collector never shares them.
+
+These checks use real project stores, project folders and farm receipt files. No
+Comfy, Cloud or Deadline service is contacted.
+"""
+
+import copy
+import hashlib
+import shutil
+import sys
+import tempfile
+import threading
+import time
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+from PIL import Image
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+from spool import attempts, farm_protocol, requests
+from spool.farm import FarmCollector
+from spool.media import Media
+from spool.store import Store, empty_project
+
+LOCAL_RECIPE = {
+    "prompt": {
+        "save": {"class_type": "SaveImage", "inputs": {"images": ["load", 0], "filename_prefix": "ordinary"}},
+    },
+    "bindings": [],
+    "result": {"nodeId": "save", "group": "images", "index": 0},
+}
+
+FARM_RECIPE = {
+    "prompt": {
+        "save": {"class_type": "SaveImage", "inputs": {"images": ["load", 0], "filename_prefix": "ordinary"}},
+        "submit": {
+            "class_type": "DeadlineSubmit",
+            "inputs": {"batch_count": 9, "chunk_size": 3, "output_directory": "unused-by-project-requests"},
+        },
+    },
+    "bindings": [],
+    "result": {"nodeId": "save", "group": "images", "index": 0},
+}
+
+
+class CollectionFixture(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory(prefix="spool-collection-ownership-")
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name).resolve()
+        self.store = Store(self.root / "store")
+        for kind in ("input", "output", "temp"):
+            (self.root / kind).mkdir()
+        document = empty_project()
+        document["clips"] = [
+            {"id": "shot", "name": "Shot", "revision": 1, "takes": [], "takeId": "original", "outputFolder": "output"}
+        ]
+        self.project = self.store.create(document)
+        self.media = Media(
+            self.store.root,
+            self.root / "input",
+            self.root / "output",
+            self.root / "temp",
+            project_id=self.project["id"],
+        )
+        self.identity = "operation-id"
+
+    def accept(self, recipe, operation):
+        project = self.store.capture(self.project["id"], self.project["revision"], "shot", recipe)
+        project = requests.accept(
+            self.store,
+            self.media,
+            project["id"],
+            project["revision"],
+            [{"clipId": "shot", "count": 1}],
+            operation,
+        )
+        self.project = project
+        return self.store.attempt(project["document"]["jobs"][-1]["id"])
+
+    def preserve_destination(self, destination):
+        destination.parent.mkdir(parents=True, exist_ok=True)
+        destination.write_bytes(b"previous successful artifact")
+        unrelated = destination.with_name(destination.name + ".another-worker.partial")
+        unrelated.write_bytes(b"another worker temporary")
+        return unrelated
+
+    def pending(self, destination):
+        return destination.with_name(destination.name + "." + self.identity + ".partial")
+
+    def fixed_partial(self, destination):
+        return destination.with_name(destination.name + ".partial")
+
+    def attach_source(self):
+        self.source = self.root / "output" / "finished.png"
+        Image.new("RGB", (8, 8), "blue").save(self.source)
+        self.history = {
+            "status": {"completed": True, "status_str": "success"},
+            "outputs": {"save": {"images": [{"filename": "finished.png", "type": "output"}]}},
+        }
+
+    def assert_preserved(self, destination, unrelated):
+        self.assertEqual(destination.read_bytes(), b"previous successful artifact")
+        self.assertEqual(unrelated.read_bytes(), b"another worker temporary")
+        self.assertFalse(self.pending(destination).exists())
+        self.assertFalse(self.fixed_partial(destination).exists())
+        self.assertEqual({path.name for path in destination.parent.glob("*.partial")}, {unrelated.name})
+
+    def assert_published(self, destination, unrelated, expected):
+        self.assertEqual(destination.read_bytes(), expected)
+        self.assertEqual(unrelated.read_bytes(), b"another worker temporary")
+        self.assertFalse(self.pending(destination).exists())
+        self.assertFalse(self.fixed_partial(destination).exists())
+        self.assertEqual({path.name for path in destination.parent.glob("*.partial")}, {unrelated.name})
+
+
+class LocalCollectionOwnershipTests(CollectionFixture):
+    def setUp(self):
+        super().setUp()
+        self.attempt = self.accept(LOCAL_RECIPE, "local-accept")
+        self.attach_source()
+        self.destination = self.media.result_path(self.attempt, "artifact-id", ".png", True)
+        self.unrelated = self.preserve_destination(self.destination)
+
+    def collect(self, media=None):
+        return (media or self.media).collect(self.attempt, self.history, False)
+
+    def test_failed_copy_removes_only_its_own_partial(self):
+        error = OSError("injected copy failure")
+
+        def copy(source, destination):
+            self.assertEqual(Path(source), self.source)
+            Path(destination).write_bytes(b"partially copied artifact")
+            raise error
+
+        with (
+            patch("spool.media.uid", return_value=self.identity),
+            patch("spool.media.shutil.copyfile", side_effect=copy),
+        ):
+            with self.assertRaises(OSError) as raised:
+                self.collect()
+        self.assertIs(raised.exception, error)
+        self.assert_preserved(self.destination, self.unrelated)
+
+    def test_failed_replace_removes_only_its_own_partial(self):
+        error = PermissionError("injected replacement failure")
+        original = Path.replace
+
+        def replace(source, destination):
+            if Path(source) == self.pending(self.destination):
+                self.assertEqual(Path(destination), self.destination)
+                raise error
+            return original(source, destination)
+
+        with (
+            patch("spool.media.uid", return_value=self.identity),
+            patch.object(Path, "replace", replace),
+        ):
+            with self.assertRaises(PermissionError) as raised:
+                self.collect()
+        self.assertIs(raised.exception, error)
+        self.assert_preserved(self.destination, self.unrelated)
+
+    def test_cleanup_failure_preserves_the_original_copy_error(self):
+        error = OSError("original copy error")
+        attempted = []
+        original = Path.unlink
+
+        def copy(source, destination):
+            Path(destination).write_bytes(b"partially copied artifact")
+            raise error
+
+        def unlink(path, *args, **kwargs):
+            if path == self.pending(self.destination):
+                attempted.append(path)
+                raise PermissionError("cleanup was denied")
+            return original(path, *args, **kwargs)
+
+        with (
+            patch("spool.media.uid", return_value=self.identity),
+            patch("spool.media.shutil.copyfile", side_effect=copy),
+            patch.object(Path, "unlink", unlink),
+        ):
+            with self.assertRaises(OSError) as raised:
+                self.collect()
+        self.assertIs(raised.exception, error)
+        self.assertEqual(attempted, [self.pending(self.destination)])
+
+    def test_concurrent_collectors_use_distinct_partials_and_both_complete(self):
+        second_media = Media(
+            self.store.root,
+            self.root / "input",
+            self.root / "output",
+            self.root / "temp",
+            project_id=self.project["id"],
+        )
+        source_bytes = self.source.read_bytes()
+        original_copy, original_replace = shutil.copyfile, Path.replace
+        first_copied, second_writing, first_published = (
+            threading.Event(),
+            threading.Event(),
+            threading.Event(),
+        )
+        pending_paths, results, errors = [], [], []
+
+        def copyfile(source, destination, *args, **kwargs):
+            destination = Path(destination)
+            pending_paths.append(destination)
+            if threading.current_thread().name == "second":
+                if not first_copied.wait(5):
+                    raise RuntimeError("The first collector never copied its artifact")
+                data = Path(source).read_bytes()
+                handle = destination.open("wb")
+                try:
+                    handle.write(data[:1])
+                    handle.flush()
+                    second_writing.set()
+                    if not first_published.wait(5):
+                        raise RuntimeError("The first collector never published its artifact")
+                    handle.write(data[1:])
+                finally:
+                    handle.close()
+                return len(data)
+            result = original_copy(source, destination, *args, **kwargs)
+            first_copied.set()
+            return result
+
+        def replace(source, destination):
+            if threading.current_thread().name == "first" and Path(source).name.endswith(".partial"):
+                if not second_writing.wait(5):
+                    raise RuntimeError("The second collector never started its copy")
+                try:
+                    return original_replace(source, destination)
+                finally:
+                    first_published.set()
+            return original_replace(source, destination)
+
+        def run(media):
+            try:
+                results.append(self.collect(media))
+            except BaseException as error:  # noqa: BLE001 - reported below with thread identity
+                errors.append(error)
+
+        with patch("spool.media.shutil.copyfile", copyfile), patch.object(Path, "replace", replace):
+            threads = [
+                threading.Thread(target=run, args=(media,), name=name)
+                for media, name in ((self.media, "first"), (second_media, "second"))
+            ]
+            for thread in threads:
+                thread.start()
+            for thread in threads:
+                thread.join(10)
+        self.assertFalse(any(thread.is_alive() for thread in threads))
+        self.assertEqual(errors, [])
+        self.assertEqual(len(results), 2)
+        self.assertEqual(len(set(pending_paths)), 2)
+        self.assertEqual(len({path.name for path in pending_paths}), 2)
+        self.assertTrue(all(path.name.endswith(".partial") for path in pending_paths))
+        self.assert_published(self.destination, self.unrelated, source_bytes)
+        for artifacts, primary in results:
+            self.assertEqual(primary["sha256"], hashlib.sha256(source_bytes).hexdigest())
+            self.assertEqual(primary["byteSize"], len(source_bytes))
+
+    def test_successful_collection_keeps_its_destination_and_metadata(self):
+        artifacts, primary = self.collect()
+        source_bytes = self.source.read_bytes()
+        self.assertEqual(primary, artifacts[-1])
+        self.assertEqual(primary["file"], self.destination.relative_to(self.media.root).as_posix())
+        self.assertEqual(primary["originalFile"], self.destination.relative_to(self.media.root).as_posix())
+        self.assertEqual(primary["sha256"], hashlib.sha256(source_bytes).hexdigest())
+        self.assertEqual(primary["byteSize"], len(source_bytes))
+        self.assertEqual((primary["nodeId"], primary["group"], primary["index"]), ("save", "images", 0))
+        self.assert_published(self.destination, self.unrelated, source_bytes)
+
+
+class FarmCollectionOwnershipTests(CollectionFixture):
+    def setUp(self):
+        super().setUp()
+        self.attempt = self.accept(FARM_RECIPE, "farm-accept")
+        self.package = self.stage(self.attempt)
+        self.store.acknowledge(self.submission["id"], "job-" + self.attempt["id"])
+        self.store.transition(self.attempt["id"], attempts.FARM_RUNNING)
+        self.attempt = self.store.attempt(self.attempt["id"])
+        self.receipt = self.finish(self.package)
+        self.execution_id = self.receipt["executionId"]
+        self.artifact = self.receipt["artifacts"][0]
+        self.source = farm_protocol.contained(self.result_root, self.artifact["path"])
+        self.destination = self.media.result_path(
+            self.attempt, self.artifact["artifactId"], self.source.suffix.lower(), True, self.execution_id
+        )
+        self.unrelated = self.preserve_destination(self.destination)
+
+    def stage(self, attempt):
+        request = attempt["request"]
+        root = Path(request["prompt"][request["launcherNodeId"]]["inputs"]["output_directory"]).resolve()
+        package = {
+            "schemaVersion": 2,
+            **{key: request[key] for key in ("projectId", "clipId", "takeId", "attemptId", "fingerprint")},
+            "variationIndex": 0,
+            "resultRoot": str(root),
+            "result": request["capture"]["result"],
+            "assets": copy.deepcopy(request["assets"]),
+            "stagedPrompt": {
+                key: copy.deepcopy(value)
+                for key, value in request["prompt"].items()
+                if key != request["launcherNodeId"]
+            },
+        }
+        submission = self.store.submission(attempt["id"], package)
+        package["submissionId"] = submission["id"]
+        directory = root / "spool-submissions" / submission["id"]
+        farm_protocol.atomic_json(directory / "request.json", package)
+        farm_protocol.atomic_json(
+            directory / "ack.json",
+            {
+                **{key: package[key] for key in ("schemaVersion", "submissionId", "attemptId", "fingerprint")},
+                "jobId": "job-" + attempt["id"],
+            },
+        )
+        self.result_root, self.submission = root, submission
+        return package
+
+    def finish(self, package):
+        physical = farm_protocol.prepare_execution(package, package["stagedPrompt"], self.media.host_roots["input"], 0)
+        filename = physical["executionId"] + ".png"
+        Image.new("RGB", (8, 8), "blue").save(self.root / "output" / filename)
+        history = {
+            "prompt": [0, "worker-prompt", physical["prompt"]],
+            "status": {"status_str": "success", "completed": True},
+            "outputs": {"save": {"images": [{"filename": filename, "type": "output"}]}},
+        }
+        receipt = farm_protocol.finalize(
+            package,
+            physical,
+            "worker-prompt",
+            history,
+            self.media.host_roots,
+            "render-01",
+            "job-" + self.attempt["id"],
+        )
+        farm_protocol.verify(package, receipt, package["resultRoot"])
+        return receipt
+
+    def collector(self, store=None, media=None):
+        store = store or self.store
+        collector = FarmCollector(store, media or self.media)
+        collector.observed_at[store.submission_for(self.attempt["id"])["id"]] = time.monotonic()
+        return collector
+
+    def test_failed_copy_removes_only_its_own_partial(self):
+        error = OSError("injected farm copy failure")
+
+        def copy(source, destination):
+            Path(destination).write_bytes(b"partially copied farm artifact")
+            raise error
+
+        with (
+            patch("spool.media.uid", return_value=self.identity),
+            patch("spool.farm.shutil.copyfile", side_effect=copy),
+        ):
+            with self.assertRaises(OSError) as raised:
+                self.collector().collect(self.attempt)
+        self.assertIs(raised.exception, error)
+        self.assert_preserved(self.destination, self.unrelated)
+
+    def test_checksum_failure_removes_only_its_own_partial(self):
+        original = farm_protocol.checksum
+
+        def checksum(path):
+            return "0" * 64 if Path(path).name.endswith(".partial") else original(path)
+
+        with (
+            patch("spool.media.uid", return_value=self.identity),
+            patch("spool.farm.farm_protocol.checksum", side_effect=checksum),
+        ):
+            with self.assertRaisesRegex(ValueError, "changed checksum"):
+                self.collector().collect(self.attempt)
+        self.assert_preserved(self.destination, self.unrelated)
+
+    def test_failed_replace_removes_only_its_own_partial(self):
+        error = PermissionError("injected farm replacement failure")
+        original = Path.replace
+
+        def replace(source, destination):
+            if Path(source) == self.pending(self.destination):
+                self.assertEqual(Path(destination), self.destination)
+                raise error
+            return original(source, destination)
+
+        with (
+            patch("spool.media.uid", return_value=self.identity),
+            patch.object(Path, "replace", replace),
+        ):
+            with self.assertRaises(PermissionError) as raised:
+                self.collector().collect(self.attempt)
+        self.assertIs(raised.exception, error)
+        self.assert_preserved(self.destination, self.unrelated)
+
+    def test_concurrent_collectors_use_distinct_partials_and_both_complete(self):
+        second_store = Store(self.store.root)
+        second_media = Media(
+            second_store.root,
+            self.root / "input",
+            self.root / "output",
+            self.root / "temp",
+            project_id=self.project["id"],
+        )
+        first, second = self.collector(), self.collector(second_store, second_media)
+        source_bytes = self.source.read_bytes()
+        original_copy = shutil.copyfile
+        original_checksum = farm_protocol.checksum
+        first_copied, second_writing, first_verified = (
+            threading.Event(),
+            threading.Event(),
+            threading.Event(),
+        )
+        pending_paths, errors = [], []
+        original_describe = Media.describe
+
+        def describe(media, path, *args, **kwargs):
+            metadata = original_describe(media, path, *args, **kwargs)
+            # Both collectors describe the same artifact bytes. Keep the one
+            # random review identity stable so duplicate acceptance compares the
+            # same evidence instead of a per-collector ID.
+            metadata["id"] = "shared-artifact"
+            return metadata
+
+        def copyfile(source, destination, *args, **kwargs):
+            destination = Path(destination)
+            pending_paths.append(destination)
+            if threading.current_thread().name == "second":
+                if not first_copied.wait(5):
+                    raise RuntimeError("The first collector never copied its artifact")
+                data = Path(source).read_bytes()
+                handle = destination.open("wb")
+                try:
+                    handle.write(data[:1])
+                    handle.flush()
+                    second_writing.set()
+                    if not first_verified.wait(5):
+                        raise RuntimeError("The first collector never verified its artifact")
+                    handle.write(data[1:])
+                finally:
+                    handle.close()
+                return len(data)
+            result = original_copy(source, destination, *args, **kwargs)
+            first_copied.set()
+            return result
+
+        def checksum(path):
+            if threading.current_thread().name == "first" and Path(path).name.endswith(".partial"):
+                if not second_writing.wait(5):
+                    raise RuntimeError("The second collector never started its copy")
+                try:
+                    return original_checksum(path)
+                finally:
+                    first_verified.set()
+            return original_checksum(path)
+
+        def run(collector):
+            try:
+                collector.collect(self.attempt)
+            except BaseException as error:  # noqa: BLE001 - reported below with thread identity
+                errors.append(error)
+
+        with (
+            patch.object(Media, "describe", describe),
+            patch("spool.farm.shutil.copyfile", copyfile),
+            patch("spool.farm.farm_protocol.checksum", side_effect=checksum),
+        ):
+            threads = [
+                threading.Thread(target=run, args=(collector,), name=name)
+                for collector, name in ((first, "first"), (second, "second"))
+            ]
+            for thread in threads:
+                thread.start()
+            for thread in threads:
+                thread.join(10)
+        self.assertFalse(any(thread.is_alive() for thread in threads))
+        self.assertEqual(errors, [])
+        self.assertEqual(len(set(pending_paths)), 2)
+        self.assertTrue(all(path.name.endswith(".partial") for path in pending_paths))
+        self.assert_published(self.destination, self.unrelated, source_bytes)
+        self.assertEqual(self.store.attempt(self.attempt["id"])["status"], attempts.COMPLETE)
+        execution = self.store.execution(self.execution_id)
+        self.assertIsNotNone(execution)
+        self.assertEqual(execution["receipt"]["primaryArtifactId"], self.receipt["primaryArtifactId"])
+        saved = execution["receipt"]["artifacts"][0]
+        self.assertEqual(saved["sha256"], self.artifact["sha256"])
+        self.assertEqual(saved["file"], self.destination.relative_to(self.media.root).as_posix())
+
+    def test_successful_ingestion_keeps_its_farm_receipt_and_destination(self):
+        self.collector().collect(self.attempt)
+        source_bytes = self.source.read_bytes()
+        self.assert_published(self.destination, self.unrelated, source_bytes)
+        self.assertEqual(self.store.attempt(self.attempt["id"])["status"], attempts.COMPLETE)
+        execution = self.store.execution(self.execution_id)
+        self.assertIsNotNone(execution)
+        self.assertEqual(execution["receipt"]["primaryArtifactId"], self.receipt["primaryArtifactId"])
+        saved = execution["receipt"]["artifacts"][0]
+        self.assertEqual(saved["sha256"], self.artifact["sha256"])
+        self.assertEqual(saved["byteSize"], self.artifact["byteSize"])
+        self.assertEqual(saved["file"], self.destination.relative_to(self.media.root).as_posix())
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_comparison_intermediates.py b/tests/test_comparison_intermediates.py
new file mode 100644
index 0000000..9177b81
--- /dev/null
+++ b/tests/test_comparison_intermediates.py
@@ -0,0 +1,182 @@
+"""Comparison sheets keep their export while removing only their own frame files."""
+
+import os
+import shutil
+import subprocess
+import tempfile
+import threading
+import unittest
+from concurrent.futures import ThreadPoolExecutor
+from pathlib import Path
+from unittest.mock import patch
+
+from PIL import Image, ImageOps
+
+from spool.media import Media
+
+
+@unittest.skipUnless(shutil.which("ffmpeg"), "ffmpeg is required for frame extraction")
+class ComparisonIntermediateTests(unittest.TestCase):
+    def setUp(self):
+        temp = tempfile.TemporaryDirectory()
+        self.addCleanup(temp.cleanup)
+        self.root = Path(temp.name)
+        self.media = Media(self.root / "project", self.root / "input", self.root / "output", self.root / "temp", "film")
+        self.exports = self.media.root / "exports"
+        self.clip = {"in": 2, "out": 10, "takes": []}
+        self.sources = {}
+        for identity, color in (("red", "red"), ("blue", "blue")):
+            source = self.media.root / "assets" / (identity + ".png")
+            Image.new("RGB", (64, 32), color).save(source)
+            self.sources[source] = source.read_bytes()
+            self.clip["takes"].append(
+                {
+                    "id": identity,
+                    "media": {
+                        "kind": "image",
+                        "file": "assets/" + source.name,
+                        "frames": 24,
+                        "duration": 1,
+                        "width": 64,
+                        "height": 32,
+                        "fps": 24,
+                        "audio": False,
+                    },
+                }
+            )
+        exported = self.media.export_frame(self.clip["takes"][0]["media"], 0, 24)
+        self.user_frame = self.exports / exported["filename"]
+        Image.new("RGB", (3, 3), "green").save(self.exports / "comparison-previous.png")
+        (self.exports / "spool-frame-unrelated.png").write_bytes(b"An unrelated user file")
+        self.kept = {path: path.read_bytes() for path in self.exports.iterdir()}
+        self.cache_entries = set(self.media.cache.iterdir())
+
+    def compare(self):
+        return self.media.comparison(self.clip, ["red", "blue"], 24)
+
+    def assert_kept(self):
+        for path, data in {**self.sources, **self.kept}.items():
+            self.assertEqual(path.read_bytes(), data, str(path))
+
+    def assert_only_new(self, paths):
+        self.assertEqual(set(self.exports.iterdir()) - set(self.kept), set(paths))
+        self.assertEqual(set(self.media.cache.iterdir()), self.cache_entries)
+        self.assert_kept()
+
+    def test_success_keeps_the_sheet_and_existing_exports_without_frame_intermediates(self):
+        result = self.compare()
+        sheet = self.exports / result["url"].rsplit("/", 1)[1]
+        self.assertTrue(result["url"].startswith("/spool/media/film/exports/comparison-"))
+        self.assertEqual([take["takeId"] for take in result["takes"]], ["red", "blue"])
+        self.assertEqual([take["sampleFrame"] for take in result["takes"]], [5, 5])
+        with Image.open(sheet) as image:
+            self.assertEqual(image.size, (768, 256))
+            self.assertEqual(image.getpixel((192, 108)), (255, 0, 0))
+            self.assertEqual(image.getpixel((576, 108)), (0, 0, 255))
+        self.assert_only_new([sheet])
+
+        later = self.compare()
+        later_sheet = self.exports / later["url"].rsplit("/", 1)[1]
+        self.assertNotEqual(sheet, later_sheet)
+        self.assert_only_new([sheet, later_sheet])
+
+    def test_failed_later_extraction_removes_completed_and_partial_intermediates(self):
+        run = subprocess.run
+        generated = []
+        original_error = subprocess.CalledProcessError(9, ["ffmpeg"], stderr=b"Extraction failed")
+
+        def extract(command, *args, **kwargs):
+            output = Path(command[-1])
+            generated.append(output)
+            if len(generated) == 2:
+                output.write_bytes(b"Partial frame")
+                raise original_error
+            return run(command, *args, **kwargs)
+
+        with patch("spool.media.subprocess.run", side_effect=extract):
+            with self.assertRaises(subprocess.CalledProcessError) as raised:
+                self.compare()
+        self.assertIs(raised.exception, original_error)
+        self.assertEqual(len(generated), 2)
+        self.assertTrue(all(not path.exists() for path in generated))
+        self.assert_only_new([])
+
+    def test_composition_failure_removes_the_extracted_frame(self):
+        error = ValueError("Composition failed")
+        with patch("spool.media.ImageOps.contain", side_effect=error):
+            with self.assertRaises(ValueError) as raised:
+                self.compare()
+        self.assertIs(raised.exception, error)
+        self.assert_only_new([])
+
+    def test_denied_cleanup_preserves_the_original_extraction_error(self):
+        original_error = subprocess.TimeoutExpired(["ffmpeg"], 60)
+        generated = []
+        denied_paths = []
+        unlink = os.unlink
+
+        def extract(command, *args, **kwargs):
+            output = Path(command[-1])
+            generated.append(output)
+            output.write_bytes(b"Partial frame")
+            raise original_error
+
+        def denied(path, *args, **kwargs):
+            if Path(path).name in {output.name for output in generated}:
+                denied_paths.append(path)
+                raise PermissionError("Intermediate is temporarily locked")
+            return unlink(path, *args, **kwargs)
+
+        with patch("spool.media.subprocess.run", side_effect=extract), patch.object(os, "unlink", denied):
+            with self.assertRaises(subprocess.TimeoutExpired) as raised:
+                self.compare()
+        self.assertIs(raised.exception, original_error)
+        self.assertTrue(denied_paths, "Cleanup must encounter an actual denied filesystem deletion")
+        self.assertTrue(generated[0].is_file())
+        self.assert_kept()
+
+    def test_final_save_failure_has_no_frame_intermediates(self):
+        error = OSError("Comparison destination is full")
+        save = Image.Image.save
+
+        def failed(image, destination, *args, **kwargs):
+            if Path(destination).parent == self.exports:
+                raise error
+            return save(image, destination, *args, **kwargs)
+
+        with patch.object(Image.Image, "save", failed):
+            with self.assertRaises(OSError) as raised:
+                self.compare()
+        self.assertIs(raised.exception, error)
+        self.assert_only_new([])
+
+    def test_first_comparison_creates_the_durable_export_folder(self):
+        media = Media(self.root / "fresh", *self.media.host_roots.values())
+        take = self.clip["takes"][0]
+        clip = {
+            **self.clip,
+            "takes": [{**take, "media": {**take["media"], "originalFile": str(next(iter(self.sources)))}}],
+        }
+        self.assertFalse((media.root / "exports").exists())
+        result = media.comparison(clip, [take["id"]], 24)
+        self.assertTrue((media.root / "exports" / result["url"].rsplit("/", 1)[1]).is_file())
+        self.assertFalse(list(media.cache.glob("spool-comparison-*")))
+        self.assert_kept()
+
+    def test_concurrent_comparisons_keep_both_sheets_and_remove_only_their_frames(self):
+        barrier = threading.Barrier(2)
+        contain = ImageOps.contain
+
+        def overlap(*args, **kwargs):
+            barrier.wait(10)
+            return contain(*args, **kwargs)
+
+        with patch("spool.media.ImageOps.contain", side_effect=overlap), ThreadPoolExecutor(2) as pool:
+            results = list(pool.map(lambda _: self.compare(), range(2)))
+        sheets = [self.exports / result["url"].rsplit("/", 1)[1] for result in results]
+        self.assertEqual(len(set(sheets)), 2)
+        self.assert_only_new(sheets)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_credential_status.py b/tests/test_credential_status.py
new file mode 100644
index 0000000..953f272
--- /dev/null
+++ b/tests/test_credential_status.py
@@ -0,0 +1,78 @@
+import os
+import tempfile
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+from spool import credentials
+
+
+class CredentialStatusTests(unittest.TestCase):
+    def setUp(self):
+        self.directory = tempfile.TemporaryDirectory()
+        self.addCleanup(self.directory.cleanup)
+        self.folder = Path(self.directory.name)
+        self.key = self.folder / "comfy-cloud.key"
+
+    def environment(self, api_key=None):
+        values = {"SPOOL_CREDENTIALS": str(self.folder)}
+        if api_key is not None:
+            values["COMFY_API_KEY"] = api_key
+        return patch.dict(os.environ, values, clear=True)
+
+    def test_absent_saved_key_uses_trimmed_environment(self):
+        with self.environment("  comfyui-environment-fixture\n"):
+            self.assertEqual(credentials.cloud_key(), "comfyui-environment-fixture")
+            self.assertEqual(credentials.key_status(), {"hasApiKey": True, "apiKeySource": "environment"})
+
+    def test_empty_saved_key_falls_back_to_environment(self):
+        self.key.write_text("", encoding="utf-8")
+        with self.environment("comfyui-environment-fixture"):
+            self.assertEqual(credentials.cloud_key(), "comfyui-environment-fixture")
+            self.assertEqual(credentials.key_status(), {"hasApiKey": True, "apiKeySource": "environment"})
+
+    def test_whitespace_saved_key_falls_back_to_environment(self):
+        self.key.write_text(" \n\t", encoding="utf-8")
+        with self.environment("comfyui-environment-fixture"):
+            self.assertEqual(credentials.cloud_key(), "comfyui-environment-fixture")
+            self.assertEqual(credentials.key_status(), {"hasApiKey": True, "apiKeySource": "environment"})
+
+    def test_valid_saved_key_wins_over_environment(self):
+        self.key.write_text("  comfyui-saved-fixture\n", encoding="utf-8")
+        with self.environment("comfyui-environment-fixture"):
+            self.assertEqual(credentials.cloud_key(), "comfyui-saved-fixture")
+            self.assertEqual(credentials.key_status(), {"hasApiKey": True, "apiKeySource": "saved"})
+
+    def test_no_saved_or_environment_key_reports_none(self):
+        with self.environment():
+            self.assertEqual(credentials.cloud_key(), "")
+            self.assertEqual(credentials.key_status(), {"hasApiKey": False, "apiKeySource": None})
+
+    def test_whitespace_environment_alone_reports_no_key(self):
+        with self.environment(" \n\t"):
+            self.assertEqual(credentials.cloud_key(), "")
+            self.assertEqual(credentials.key_status(), {"hasApiKey": False, "apiKeySource": None})
+
+    def test_whitespace_saved_and_environment_report_no_key(self):
+        self.key.write_text(" \n", encoding="utf-8")
+        with self.environment("\t "):
+            self.assertEqual(credentials.cloud_key(), "")
+            self.assertEqual(credentials.key_status(), {"hasApiKey": False, "apiKeySource": None})
+
+    def test_save_and_delete_update_status(self):
+        with self.environment("comfyui-environment-fixture"):
+            credentials.save_key("comfyui-saved-fixture")
+            self.assertEqual(credentials.cloud_key(), "comfyui-saved-fixture")
+            self.assertEqual(credentials.key_status(), {"hasApiKey": True, "apiKeySource": "saved"})
+            credentials.save_key("")
+            self.assertFalse(self.key.exists())
+            self.assertEqual(credentials.cloud_key(), "comfyui-environment-fixture")
+            self.assertEqual(credentials.key_status(), {"hasApiKey": True, "apiKeySource": "environment"})
+
+    def test_invalid_save_keeps_the_saved_key(self):
+        with self.environment("comfyui-environment-fixture"):
+            credentials.save_key("comfyui-saved-fixture")
+            with self.assertRaises(ValueError):
+                credentials.save_key("wrong-prefix")
+            self.assertEqual(credentials.cloud_key(), "comfyui-saved-fixture")
+            self.assertEqual(credentials.key_status(), {"hasApiKey": True, "apiKeySource": "saved"})
diff --git a/tests/test_credentials.py b/tests/test_credentials.py
index 27259e9..e2652dc 100644
--- a/tests/test_credentials.py
+++ b/tests/test_credentials.py
@@ -29,6 +29,18 @@ def test_machine_key_overrides_environment_without_exposing_either(self):
         self.assertFalse(self.path.exists())
         self.assertEqual(credentials.cloud_key(), "comfyui-environment-fixture")
 
+    @unittest.skipIf(os.name == "nt", "POSIX file modes")
+    def test_the_key_file_is_private_from_creation(self):
+        previous = os.umask(0)
+        try:
+            # Even before any later chmod, nobody else may read what was written.
+            with patch.object(Path, "chmod"):
+                credentials.save_key("comfyui-private")
+        finally:
+            os.umask(previous)
+        self.assertEqual(self.path.stat().st_mode & 0o777, 0o600)
+        self.assertEqual(self.path.read_text(encoding="utf-8"), "comfyui-private")
+
     def test_credentials_folder_moves_the_key(self):
         self.key_path.stop()
         folder = Path(self.directory.name) / "isolated"
diff --git a/tests/test_deadline_recovery_failures.py b/tests/test_deadline_recovery_failures.py
new file mode 100644
index 0000000..5e14aa4
--- /dev/null
+++ b/tests/test_deadline_recovery_failures.py
@@ -0,0 +1,298 @@
+"""Deadline recovery lookup failures are service errors, not generic Spool bugs."""
+
+import subprocess
+import tempfile
+import unittest
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from aiohttp import web
+from aiohttp.test_utils import TestClient, TestServer
+
+from spool import attempts, commands, requests
+from spool.errors import Unavailable
+from spool.execution_targets import DEADLINE_LOOKUP_UNAVAILABLE, adapter_for
+from spool.media import Media
+from spool.projects import Workspace
+from spool.routes import register
+from spool.store import Conflict, Store, empty_project
+
+JOB = "a" * 24
+SECRET = "deadlinecommand failed: C:\\private\\agent\\stderr token=secret"
+
+
+def deadline_recipe(output):
+    return {
+        "prompt": {
+            "save": {"class_type": "SaveImage", "inputs": {"images": [], "filename_prefix": "ordinary"}},
+            "submit": {
+                "class_type": "DeadlineSubmit",
+                "inputs": {"batch_count": 1, "chunk_size": 1, "output_directory": str(output)},
+            },
+        },
+        "bindings": [],
+        "result": {"nodeId": "save", "group": "images", "index": 0},
+    }
+
+
+def deadline_document():
+    document = empty_project()
+    document["clips"] = [{"id": "shot", "name": "Shot", "revision": 1, "takes": [], "takeId": "original"}]
+    return document
+
+
+def assert_safe_unavailable(test, error):
+    message = str(error)
+    test.assertIsInstance(error, Unavailable)
+    test.assertEqual((error.status, error.code), (503, "unavailable"))
+    test.assertEqual(message, DEADLINE_LOOKUP_UNAVAILABLE)
+    test.assertIn("Retry submission recovery", message)
+    test.assertNotIn("secret", message)
+    test.assertNotIn("stderr", message)
+    test.assertNotIn("C:\\", message)
+
+
+class DeadlineRecoveryLookupTests(unittest.TestCase):
+    def setUp(self):
+        self.adapter = adapter_for({"target": "deadline"})
+        self.attempt = {"id": "attempt", "status": attempts.WAITING, "request": {"target": "deadline"}}
+        self.submission = {"id": "submission", "external_id": None}
+
+    def recover(self):
+        return self.adapter.recover(self.attempt, {"submission": self.submission})
+
+    def test_failed_find_lookup_is_unavailable_with_safe_message_and_cause(self):
+        for error in (
+            RuntimeError(SECRET),
+            OSError(SECRET),
+            subprocess.TimeoutExpired(["deadlinecommand"], 30),
+        ):
+            with self.subTest(error=type(error).__name__):
+                with patch("spool.farm.deadline_command", side_effect=error):
+                    with self.assertRaises(Unavailable) as caught:
+                        self.recover()
+                self.assertIs(caught.exception.__cause__, error)
+                assert_safe_unavailable(self, caught.exception)
+
+    def test_failed_identity_lookup_is_unavailable_with_safe_message_and_cause(self):
+        error = RuntimeError(SECRET)
+        with patch("spool.farm.deadline_command", side_effect=[JOB, error]) as external:
+            with self.assertRaises(Unavailable) as caught:
+                self.recover()
+        self.assertIs(caught.exception.__cause__, error)
+        assert_safe_unavailable(self, caught.exception)
+        self.assertEqual(external.call_args_list[0].args[0], ["-GetJobIdsFilter", "ExtraInfo0=spool:submission"])
+        self.assertEqual(
+            external.call_args_list[1].args[0],
+            ["-GetJobExtraInfoKeyValue", JOB, "SpoolSubmissionId"],
+        )
+
+    def test_matching_job_is_returned(self):
+        with patch("spool.farm.deadline_command", side_effect=[JOB, "submission", "attempt"]):
+            self.assertEqual(self.recover(), {"jobId": JOB})
+
+    def test_no_match_is_not_a_failure(self):
+        with patch("spool.farm.deadline_command", return_value="") as external:
+            self.assertEqual(self.recover(), {"jobId": None})
+        self.assertEqual(external.call_count, 1)
+
+    def test_multiple_matches_are_a_conflict_not_unavailable(self):
+        with patch("spool.farm.deadline_command", return_value=JOB + "\n" + "b" * 24) as external:
+            with self.assertRaises(Conflict) as caught:
+                self.recover()
+        self.assertNotIsInstance(caught.exception, Unavailable)
+        self.assertIn("Multiple jobs match", str(caught.exception))
+        self.assertEqual(external.call_count, 1)
+
+    def test_mismatched_job_ownership_is_invalid_not_unavailable(self):
+        for values in (["other-submission"], ["submission", "other-attempt"]):
+            with self.subTest(values=values):
+                with patch("spool.farm.deadline_command", side_effect=[JOB, *values]):
+                    with self.assertRaises(ValueError) as caught:
+                        self.recover()
+                self.assertNotIsInstance(caught.exception, Unavailable)
+                self.assertIn("identity failed ownership verification", str(caught.exception))
+
+    def test_missing_submission_is_invalid_not_unavailable(self):
+        with self.assertRaisesRegex(ValueError, "no Deadline submission"):
+            self.adapter.recover(self.attempt, {})
+
+    def test_a_failed_lookup_can_be_retried(self):
+        with patch("spool.farm.deadline_command", side_effect=RuntimeError(SECRET)):
+            with self.assertRaises(Unavailable):
+                self.recover()
+        with patch("spool.farm.deadline_command", side_effect=[JOB, "submission", "attempt"]):
+            self.assertEqual(self.recover(), {"jobId": JOB})
+
+
+class DeadlineRecoveryCommandTests(unittest.TestCase):
+    def setUp(self):
+        self.directory = tempfile.TemporaryDirectory()
+        self.addCleanup(self.directory.cleanup)
+        root = Path(self.directory.name)
+        for kind in ("input", "output", "temp"):
+            (root / kind).mkdir()
+        self.store = Store(root / "store")
+        self.media = Media(self.store.root, root / "input", root / "output", root / "temp")
+        self.project = self.store.create(deadline_document())
+        self.project = self.store.capture(
+            self.project["id"], self.project["revision"], "shot", deadline_recipe(root / "farm")
+        )
+        self.project = requests.accept(
+            self.store,
+            self.media,
+            self.project["id"],
+            self.project["revision"],
+            [{"clipId": "shot", "count": 1}],
+            "queue",
+        )
+        self.attempt = self.store.attempt(self.project["document"]["jobs"][0]["id"])
+        self.submission = self.store.submission(self.attempt["id"], {})
+        self.envelope = {
+            "operationId": "recover-1",
+            "revision": self.project["revision"],
+            "actor": "agent:test",
+            "scope": {"projectId": self.project["id"], "clipIds": ["shot"], "capabilities": ["recover"]},
+            "action": "recover_submission",
+            "arguments": {"attemptId": self.attempt["id"]},
+        }
+
+    def execute(self, **changes):
+        return commands.execute(self.store, self.media, self.project["id"], {**self.envelope, **changes})
+
+    def assert_untouched(self):
+        self.assertIsNone(self.store.operation(self.envelope["operationId"], self.project["id"], self.envelope))
+        self.assertIsNone(self.store.submission_for(self.attempt["id"])["external_id"])
+        self.assertEqual(self.store.attempt(self.attempt["id"])["status"], attempts.WAITING)
+
+    def test_failed_find_lookup_returns_unavailable_and_records_nothing(self):
+        error = RuntimeError(SECRET)
+        with patch("spool.farm.deadline_command", side_effect=error) as external:
+            with self.assertRaises(Unavailable) as caught:
+                self.execute()
+        self.assertIs(caught.exception.__cause__, error)
+        assert_safe_unavailable(self, caught.exception)
+        self.assertEqual(external.call_count, 1)
+        self.assertEqual(external.call_args.args[0], ["-GetJobIdsFilter", "ExtraInfo0=spool:" + self.submission["id"]])
+        self.assert_untouched()
+
+    def test_failed_identity_lookup_returns_unavailable_and_records_nothing(self):
+        error = RuntimeError(SECRET)
+        with patch("spool.farm.deadline_command", side_effect=[JOB, error]) as external:
+            with self.assertRaises(Unavailable) as caught:
+                self.execute()
+        self.assertIs(caught.exception.__cause__, error)
+        assert_safe_unavailable(self, caught.exception)
+        self.assertEqual(external.call_count, 2)
+        self.assert_untouched()
+
+    def test_retry_after_a_failed_lookup_adopts_the_same_submission(self):
+        with patch("spool.farm.deadline_command", side_effect=RuntimeError(SECRET)):
+            with self.assertRaises(Unavailable):
+                self.execute()
+        with patch("spool.farm.deadline_command", side_effect=[JOB, self.submission["id"], self.attempt["id"]]):
+            result = self.execute()
+        self.assertEqual(
+            (result["attemptId"], result["jobId"], result["status"], result["note"]),
+            (self.attempt["id"], JOB, "adopted", "No automatic resubmission"),
+        )
+        self.assertEqual(self.store.submission_for(self.attempt["id"])["external_id"], JOB)
+        self.assertIsNotNone(self.store.operation(self.envelope["operationId"], self.project["id"], self.envelope))
+
+    def test_no_match_remains_submission_uncertain(self):
+        with patch("spool.farm.deadline_command", return_value=""):
+            result = self.execute()
+        self.assertEqual((result["jobId"], result["status"]), (None, "submission_uncertain"))
+        self.assertIsNone(self.store.submission_for(self.attempt["id"])["external_id"])
+
+    def test_multiple_matches_are_a_conflict_not_service_unavailable(self):
+        with patch("spool.farm.deadline_command", return_value=JOB + "\n" + "b" * 24):
+            with self.assertRaises(Conflict) as caught:
+                self.execute(operationId="recover-conflict")
+        self.assertNotIsInstance(caught.exception, Unavailable)
+        self.assertIsNone(
+            self.store.operation(
+                "recover-conflict", self.project["id"], {**self.envelope, "operationId": "recover-conflict"}
+            )
+        )
+        self.assertIsNone(self.store.submission_for(self.attempt["id"])["external_id"])
+
+    def test_ownership_mismatch_is_invalid_not_service_unavailable(self):
+        with patch("spool.farm.deadline_command", side_effect=[JOB, "other-submission"]):
+            with self.assertRaises(ValueError) as caught:
+                self.execute(operationId="recover-ownership")
+        self.assertNotIsInstance(caught.exception, Unavailable)
+        self.assertIsNone(
+            self.store.operation(
+                "recover-ownership", self.project["id"], {**self.envelope, "operationId": "recover-ownership"}
+            )
+        )
+        self.assertIsNone(self.store.submission_for(self.attempt["id"])["external_id"])
+
+
+class DeadlineRecoveryHttpTests(unittest.IsolatedAsyncioTestCase):
+    def setUp(self):
+        self.directory = tempfile.TemporaryDirectory()
+        self.addCleanup(self.directory.cleanup)
+        root = Path(self.directory.name)
+        for kind in ("input", "output", "temp"):
+            (root / kind).mkdir()
+        self.workspace = Workspace(root / "app")
+        project = self.workspace.create(deadline_document())
+        self.store = self.workspace.for_project(project["id"])
+        media = Media(self.workspace.root, root / "input", root / "output", root / "temp")
+        project = self.store.capture(project["id"], project["revision"], "shot", deadline_recipe(root / "farm"))
+        project = requests.accept(
+            self.store, media, project["id"], project["revision"], [{"clipId": "shot", "count": 1}], "queue"
+        )
+        self.project = project
+        self.attempt = self.store.attempt(project["document"]["jobs"][0]["id"])
+        self.submission = self.store.submission(self.attempt["id"], {})
+        self.base = "/spool/api/projects/" + project["id"]
+        self.envelope = {
+            "operationId": "recover-http",
+            "revision": project["revision"],
+            "actor": "agent:test",
+            "scope": {"projectId": project["id"], "clipIds": ["shot"], "capabilities": ["recover"]},
+            "action": "recover_submission",
+            "arguments": {"attemptId": self.attempt["id"]},
+        }
+        self.server = SimpleNamespace(routes=web.RouteTableDef(), app=web.Application())
+        register(self.server, self.workspace, media)
+        self.server.app.cleanup_ctx.clear()
+        self.server.app.add_routes(self.server.routes)
+
+    async def asyncSetUp(self):
+        self.client = TestClient(TestServer(self.server.app))
+        await self.client.start_server()
+        self.addAsyncCleanup(self.client.close)
+
+    async def post_recovery(self):
+        return await self.client.post(self.base + "/commands", json=self.envelope)
+
+    async def test_lookup_failure_is_a_503_without_mutating_or_resubmitting(self):
+        with patch("spool.farm.deadline_command", side_effect=RuntimeError(SECRET)) as external:
+            response = await self.post_recovery()
+        value = await response.json()
+        self.assertEqual(response.status, 503)
+        self.assertEqual(value["code"], "unavailable")
+        self.assertEqual(value["error"], DEADLINE_LOOKUP_UNAVAILABLE)
+        self.assertNotIn("secret", value["error"])
+        self.assertEqual(external.call_count, 1)
+        self.assertIsNone(self.store.operation(self.envelope["operationId"], self.project["id"], self.envelope))
+        self.assertIsNone(self.store.submission_for(self.attempt["id"])["external_id"])
+        self.assertEqual(self.store.attempt(self.attempt["id"])["status"], attempts.WAITING)
+
+    async def test_retry_after_a_503_adopts_the_job(self):
+        with patch("spool.farm.deadline_command", side_effect=RuntimeError(SECRET)):
+            self.assertEqual((await self.post_recovery()).status, 503)
+        with patch("spool.farm.deadline_command", side_effect=[JOB, self.submission["id"], self.attempt["id"]]):
+            response = await self.post_recovery()
+        value = await response.json()
+        self.assertEqual((response.status, value["status"], value["jobId"]), (200, "adopted", JOB))
+        self.assertEqual(self.store.submission_for(self.attempt["id"])["external_id"], JOB)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_deadline_uncertainty_timer.py b/tests/test_deadline_uncertainty_timer.py
new file mode 100644
index 0000000..53d230d
--- /dev/null
+++ b/tests/test_deadline_uncertainty_timer.py
@@ -0,0 +1,247 @@
+"""Deadline submission grace periods through dispatch and periodic collection."""
+
+import asyncio
+import copy
+import sys
+import types
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+from spool import attempts, farm_protocol
+from spool.collection import Collector
+from spool.execution import LocalExecutor
+import test_queue_operations as fixtures
+
+
+class Clock:
+    def __init__(self, wall):
+        self.wall, self.elapsed = wall, 1000
+
+    def time(self):
+        return self.wall
+
+    def monotonic(self):
+        return self.elapsed
+
+    def advance(self, seconds):
+        self.wall += seconds
+        self.elapsed += seconds
+
+
+class DeadlineUncertaintyTimerTests(unittest.TestCase):
+    tearDown = fixtures.QueueOperationTests.tearDown
+    accept = fixtures.QueueOperationTests.accept
+
+    def setUp(self):
+        fixtures.QueueOperationTests.setUp(self)
+        recipe = copy.deepcopy(self.recipe)
+        recipe["prompt"]["submit"] = {
+            "class_type": "DeadlineSubmit",
+            "inputs": {
+                "batch_count": 1,
+                "chunk_size": 1,
+                "job_name": "Submission timing",
+                "output_directory": str(self.root / "farm"),
+            },
+        }
+        self.project = self.store.capture(self.project["id"], self.project["revision"], "shot", recipe)
+        self.items = [{"clipId": "shot", "count": 1}]
+        self.attempt = self.store.attempt(self.accept()["document"]["jobs"][0]["id"])
+        # The attempt waited an hour for an executor. Only farm's clocks are replaced.
+        self.clock = Clock(self.attempt["created"] + 3600)
+        clock = patch("spool.farm.time", self.clock)
+        clock.start()
+        self.addCleanup(clock.stop)
+        observation = patch("spool.farm.deadline_command", return_value="JobStatus=Rendering")
+        observation.start()
+        self.addCleanup(observation.stop)
+        self.collector = Collector(self.store, self.media)
+        self.commands = []
+        self.server = types.SimpleNamespace(
+            number=0,
+            trigger_on_prompt=lambda payload: payload,
+            node_replace_manager=types.SimpleNamespace(apply_replacements=lambda prompt: None),
+            prompt_queue=types.SimpleNamespace(get_current_queue=lambda: ([], [])),
+        )
+
+    def status(self):
+        return self.store.attempt(self.attempt["id"])["status"]
+
+    def scan_status(self, collector=None):
+        (collector or self.collector).scan()
+        return self.status()
+
+    def directory(self):
+        row = self.store.submission_for(self.attempt["id"])
+        return self.root / "farm" / "spool-submissions" / row["id"]
+
+    def dispatch(self, validation=None, staging=None, submitting=None):
+        # Exercise the real executor, adapter, package/marker/ack writer and collector.
+        # Only the optional installed plugin and its external Deadline call are doubled.
+        module = types.ModuleType("deadline_uncertainty_fixture")
+        node = type(
+            "DeadlineSubmit",
+            (),
+            {
+                "__module__": module.__name__,
+                "_prepare_output_directory": lambda _self, root: root,
+                "_rewrite_prompt_asset_references": lambda _self, worker, assets: None,
+            },
+        )
+
+        def stage(worker):
+            if staging:
+                staging()
+            return str(self.media.host_roots["input"]), "", {}
+
+        def job_files(directory):
+            job, plugin = Path(directory) / "job.info", Path(directory) / "plugin.info"
+            job.write_text("", encoding="utf-8")
+            plugin.write_text("", encoding="utf-8")
+            return str(job), str(plugin), []
+
+        def command(arguments):
+            self.commands.append(arguments)
+            if submitting:
+                submitting()
+            return "JobID=owned-job"
+
+        module.WorkflowProcessor = types.SimpleNamespace(
+            prepare_for_worker=lambda prompt: {k: copy.deepcopy(v) for k, v in prompt.items() if k != "submit"}
+        )
+        module.InputAssetStager = lambda *_: types.SimpleNamespace(stage_referenced_assets=stage)
+        module.DeadlineJobSubmitter = lambda *_: types.SimpleNamespace(_create_submission_files=job_files)
+        module.DeadlineCommandHelper = types.SimpleNamespace(
+            call_deadline_command=command, get_job_id_from_submission=lambda result: "owned-job"
+        )
+
+        async def validate(identity, prompt, targets):
+            if validation:
+                validation()
+            return True, None, ["submit"] if "submit" in prompt else ["save"], {}
+
+        executor = LocalExecutor(self.store, self.media, self.server, validate)
+        with patch.dict(
+            sys.modules,
+            {module.__name__: module, "nodes": types.SimpleNamespace(NODE_CLASS_MAPPINGS={"DeadlineSubmit": node})},
+        ):
+            asyncio.run(executor.dispatch(self.attempt))
+        return executor
+
+    def test_old_queued_attempt_keeps_its_dispatch_claim_during_host_validation(self):
+        statuses = []
+
+        def validate():
+            statuses.append(self.scan_status())
+            self.clock.advance(120)
+            statuses.append(self.scan_status())
+
+        self.dispatch(validation=validate)
+        self.assertTrue(statuses)
+        self.assertEqual(set(statuses), {attempts.DISPATCHING})
+        self.assertEqual(len(self.commands), 1)
+        self.assertEqual(self.status(), attempts.FARM_QUEUED)
+
+    def test_slow_asset_staging_does_not_spend_submission_grace(self):
+        statuses = []
+
+        def stage():
+            statuses.append(self.scan_status())
+            self.clock.advance(120)
+            statuses.append(self.scan_status())
+
+        self.dispatch(staging=stage)
+        self.assertEqual(statuses, [attempts.SUBMITTING, attempts.SUBMITTING])
+        self.assertEqual(len(self.commands), 1)
+        self.assertEqual(self.status(), attempts.FARM_QUEUED)
+
+    def test_package_before_submission_marker_does_not_start_grace(self):
+        statuses = []
+        write = farm_protocol.atomic_json
+
+        def pause_before_marker(path, value):
+            write(path, value)
+            if path.name == "request.json":
+                statuses.append(self.scan_status())
+                self.clock.advance(120)
+                statuses.append(self.scan_status())
+
+        with patch("spool.deadline_job.farm_protocol.atomic_json", side_effect=pause_before_marker):
+            self.dispatch()
+        self.assertEqual(statuses, [attempts.SUBMITTING, attempts.SUBMITTING])
+        self.assertEqual(len(self.commands), 1)
+        self.assertEqual(self.status(), attempts.FARM_QUEUED)
+
+    def test_missing_response_gets_grace_then_uncertainty_without_resubmission(self):
+        statuses = []
+
+        def submit():
+            statuses.append(self.scan_status())
+            self.clock.advance(29)
+            statuses.append(self.scan_status())
+            self.clock.advance(2)
+            statuses.append(self.scan_status())
+
+        executor = self.dispatch(submitting=submit)
+        self.assertEqual(statuses, [attempts.SUBMITTING, attempts.SUBMITTING, attempts.SUBMISSION_UNCERTAIN])
+        with patch("spool.execution_targets.deadline_job.submit") as resubmit:
+            asyncio.run(executor.reconcile())
+            restarted = LocalExecutor(self.store, self.media, self.server, executor.validate)
+            asyncio.run(restarted.dispatch(self.store.attempt(self.attempt["id"])))
+            resubmit.assert_not_called()
+        self.assertEqual(len(self.commands), 1)
+        self.assertEqual(self.scan_status(), attempts.FARM_RUNNING)
+
+    def test_acknowledgment_releases_active_timer(self):
+        def submit():
+            self.scan_status()
+
+        self.dispatch(submitting=submit)
+        farm = next(iter(self.collector.farms.values()))
+        self.assertEqual(len(farm.submitting_at), 1)
+        self.assertEqual(self.scan_status(), attempts.FARM_RUNNING)
+        self.assertEqual(farm.submitting_at, {})
+
+    def test_settled_history_observation_releases_active_timer(self):
+        counts = []
+
+        def submit():
+            self.scan_status()
+            farm = next(iter(self.collector.farms.values()))
+            counts.append(len(farm.submitting_at))
+            self.store.transition(self.attempt["id"], attempts.FAILED)
+            self.collector.history_checked.clear()
+            self.scan_status()
+            counts.append(len(farm.submitting_at))
+
+        self.dispatch(submitting=submit)
+        self.assertEqual(counts, [1, 0])
+        self.assertEqual(self.status(), attempts.FAILED)
+
+    def test_restart_grants_fresh_grace_and_remembers_missing_marker(self):
+        statuses = []
+
+        def submit():
+            statuses.append(self.scan_status())
+            self.clock.advance(29)
+            restarted = Collector(self.store, self.media)
+            statuses.append(self.scan_status(restarted))
+            # A temporarily lost share package must not reset evidence already observed.
+            (self.directory() / "request.json").unlink()
+            (self.directory() / "submitting.json").unlink()
+            self.clock.advance(29)
+            statuses.append(self.scan_status(restarted))
+            self.clock.advance(2)
+            statuses.append(self.scan_status(restarted))
+
+        self.dispatch(submitting=submit)
+        self.assertEqual(
+            statuses,
+            [attempts.SUBMITTING, attempts.SUBMITTING, attempts.SUBMITTING, attempts.SUBMISSION_UNCERTAIN],
+        )
+        self.assertEqual(len(self.commands), 1)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_demo_byte_ranges.py b/tests/test_demo_byte_ranges.py
new file mode 100644
index 0000000..bd5af68
--- /dev/null
+++ b/tests/test_demo_byte_ranges.py
@@ -0,0 +1,145 @@
+"""Exercise the local demo server over real loopback HTTP.
+
+``pages/serve.py`` is only the local preview used before publishing the online
+demo. GitHub Pages never runs it, so these checks cover the page base path and
+byte ranges of that local server, not Pages' own serving behavior.
+"""
+
+import hashlib
+import http.client
+import tempfile
+import threading
+import unittest
+from functools import partial
+from http.server import ThreadingHTTPServer
+from pathlib import Path
+
+from pages.serve import Handler
+
+PAYLOAD = bytes(range(256)) * 4
+SIZE = len(PAYLOAD)
+BASE = "/ComfyUI-Spool/demo/"
+INDEX = b"<!doctype html><title>Spool demo</title>"
+
+
+class DemoByteRangeTests(unittest.TestCase):
+    def setUp(self):
+        self.directory = tempfile.TemporaryDirectory()
+        self.addCleanup(self.directory.cleanup)
+        self.site = Path(self.directory.name)
+        self.fixture = self.site / "media.bin"
+        self.fixture.write_bytes(PAYLOAD)
+        (self.site / "index.html").write_bytes(INDEX)
+        self.original_hash = hashlib.sha256(self.fixture.read_bytes()).hexdigest()
+        handler = partial(Handler, directory=str(self.site), base=BASE)
+        self.server = ThreadingHTTPServer(("127.0.0.1", 0), handler)
+        self.thread = threading.Thread(target=self.server.serve_forever, daemon=True)
+        self.thread.start()
+        self.addCleanup(self.stop_server)
+
+    def stop_server(self):
+        try:
+            self.server.shutdown()
+        finally:
+            self.server.server_close()
+            self.thread.join(timeout=5)
+        self.assertFalse(self.thread.is_alive(), "demo server thread did not stop")
+
+    def tearDown(self):
+        self.assertEqual(self.fixture.read_bytes(), PAYLOAD)
+        self.assertEqual(hashlib.sha256(self.fixture.read_bytes()).hexdigest(), self.original_hash)
+
+    def request(self, path, range_header=None, method="GET"):
+        connection = http.client.HTTPConnection("127.0.0.1", self.server.server_port, timeout=5)
+        try:
+            headers = {} if range_header is None else {"Range": range_header}
+            connection.request(method, path, headers=headers)
+            response = connection.getresponse()
+            body = response.read()
+            return response.status, {name.lower(): value for name, value in response.getheaders()}, body
+        finally:
+            connection.close()
+
+    def ranged(self, value, method="GET"):
+        return self.request(BASE + "media.bin", value, method)
+
+    def test_ordinary_full_response_and_base_path(self):
+        for path in (BASE + "media.bin", BASE + "media.bin?cache=1", BASE):
+            with self.subTest(path=path):
+                status, headers, body = self.request(path)
+                expected = INDEX if path == BASE else PAYLOAD
+                self.assertEqual(status, 200)
+                self.assertEqual(headers["content-length"], str(len(expected)))
+                self.assertEqual(headers["accept-ranges"], "bytes")
+                self.assertEqual(body, expected)
+
+    def test_paths_outside_the_base_are_not_served(self):
+        for path in ("/media.bin", "/demo/media.bin", "/ComfyUI-Spool/other/media.bin"):
+            with self.subTest(path=path):
+                status, _, body = self.request(path)
+                self.assertEqual(status, 404)
+                self.assertNotIn(PAYLOAD, body)
+
+    def test_closed_ranges_return_exact_bytes(self):
+        for value, start, end in (
+            ("bytes=0-0", 0, 0),
+            ("bytes=100-199", 100, 199),
+            ("bytes=1023-1023", SIZE - 1, SIZE - 1),
+        ):
+            with self.subTest(range=value):
+                status, headers, body = self.ranged(value)
+                self.assertEqual(status, 206)
+                self.assertEqual(headers["content-range"], f"bytes {start}-{end}/{SIZE}")
+                self.assertEqual(headers["content-length"], str(end - start + 1))
+                self.assertEqual(headers["accept-ranges"], "bytes")
+                self.assertEqual(body, PAYLOAD[start : end + 1])
+
+    def test_open_ended_range_runs_to_the_end(self):
+        status, headers, body = self.ranged("bytes=1000-")
+        self.assertEqual(status, 206)
+        self.assertEqual(headers["content-range"], f"bytes 1000-{SIZE - 1}/{SIZE}")
+        self.assertEqual(headers["content-length"], str(SIZE - 1000))
+        self.assertEqual(body, PAYLOAD[1000:])
+
+    def test_suffix_range_reads_from_the_end(self):
+        status, headers, body = self.ranged("bytes=-17")
+        self.assertEqual(status, 206)
+        self.assertEqual(headers["content-range"], f"bytes {SIZE - 17}-{SIZE - 1}/{SIZE}")
+        self.assertEqual(headers["content-length"], "17")
+        self.assertEqual(body, PAYLOAD[-17:])
+
+    def test_clamped_ranges_stay_inside_the_file(self):
+        for value, start, end in (
+            ("bytes=-5000", 0, SIZE - 1),
+            ("bytes=1000-5000", 1000, SIZE - 1),
+        ):
+            with self.subTest(range=value):
+                status, headers, body = self.ranged(value)
+                self.assertEqual(status, 206)
+                self.assertEqual(headers["content-range"], f"bytes {start}-{end}/{SIZE}")
+                self.assertEqual(headers["content-length"], str(end - start + 1))
+                self.assertEqual(body, PAYLOAD[start : end + 1])
+
+    def test_unsatisfiable_ranges_return_416_without_a_body(self):
+        for value in ("bytes=100-50", "bytes=700-200", "bytes=1024-", "bytes=1024-5000", "bytes=-0"):
+            with self.subTest(range=value):
+                status, headers, body = self.ranged(value)
+                self.assertEqual(status, 416)
+                self.assertEqual(headers["content-range"], f"bytes */{SIZE}")
+                self.assertEqual(headers["content-length"], "0")
+                self.assertEqual(headers["accept-ranges"], "bytes")
+                self.assertEqual(body, b"")
+
+    def test_head_has_the_same_headers_and_no_body(self):
+        cases = (
+            (None, 200, None, str(SIZE)),
+            ("bytes=100-199", 206, f"bytes 100-199/{SIZE}", "100"),
+            ("bytes=700-200", 416, f"bytes */{SIZE}", "0"),
+        )
+        for value, status_code, content_range, content_length in cases:
+            with self.subTest(range=value):
+                status, headers, body = self.ranged(value, method="HEAD")
+                self.assertEqual(status, status_code)
+                self.assertEqual(headers.get("content-range"), content_range)
+                self.assertEqual(headers["content-length"], content_length)
+                self.assertEqual(body, b"")
diff --git a/tests/test_failed_write_cleanup.py b/tests/test_failed_write_cleanup.py
new file mode 100644
index 0000000..92fa173
--- /dev/null
+++ b/tests/test_failed_write_cleanup.py
@@ -0,0 +1,202 @@
+"""Failed staging and final mux writes clean only their own unpublished files."""
+
+import shutil
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+from spool.export import export_sequence
+from spool.media import Media
+
+
+class InputStagingCleanupTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory(prefix="spool-stage-cleanup-")
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name).resolve()
+        self.media = Media(
+            self.root / "project", self.root / "input", self.root / "output", self.root / "temp", project_id="p1"
+        )
+        self.source = self.media.root / "input/images/source.png"
+        self.source.parent.mkdir(parents=True)
+        self.source.write_bytes(b"new source")
+        self.target = self.root / "input/spool-projects/p1/input/images/source.png"
+        self.target.parent.mkdir(parents=True)
+        self.target.write_bytes(b"older published staged input")
+        self.pending = self.target.with_name("owned-operation.partial")
+        self.unrelated = self.target.with_name("unrelated.partial")
+        self.unrelated.write_bytes(b"another operation's bytes")
+        uid = patch("spool.media.uid", return_value="owned-operation")
+        uid.start()
+        self.addCleanup(uid.stop)
+
+    def assert_preserved(self):
+        self.assertEqual(self.source.read_bytes(), b"new source")
+        self.assertEqual(self.target.read_bytes(), b"older published staged input")
+        self.assertEqual(self.unrelated.read_bytes(), b"another operation's bytes")
+
+    def failing_copy(self, error):
+        def copy(source, destination):
+            self.assertEqual(Path(source), self.source)
+            self.assertEqual(Path(destination), self.pending)
+            Path(destination).write_bytes(b"partial copied bytes")
+            raise error
+
+        return copy
+
+    def test_a_partial_copy_failure_removes_only_its_pending_file(self):
+        error = OSError("injected copy failure")
+        with patch("spool.media.shutil.copy2", side_effect=self.failing_copy(error)):
+            with self.assertRaises(OSError) as raised:
+                self.media.stage_input(self.source)
+        self.assertIs(raised.exception, error)
+        self.assertFalse(self.pending.exists())
+        self.assert_preserved()
+
+    def test_a_replace_failure_removes_the_copied_pending_file(self):
+        error = PermissionError("injected replacement failure")
+        original_replace = Path.replace
+
+        def replace(source, destination):
+            if source == self.pending:
+                self.assertEqual(Path(destination), self.target)
+                self.assertEqual(source.read_bytes(), b"new source")
+                raise error
+            return original_replace(source, destination)
+
+        with patch.object(Path, "replace", replace):
+            with self.assertRaises(PermissionError) as raised:
+                self.media.stage_input(self.source)
+        self.assertIs(raised.exception, error)
+        self.assertFalse(self.pending.exists())
+        self.assert_preserved()
+
+    def test_cleanup_failure_preserves_the_original_copy_exception(self):
+        error = OSError("original copy error")
+        original_unlink = Path.unlink
+        attempted = []
+
+        def unlink(path, *args, **kwargs):
+            if path == self.pending:
+                attempted.append(path)
+                raise PermissionError("cleanup was denied")
+            return original_unlink(path, *args, **kwargs)
+
+        with (
+            patch("spool.media.shutil.copy2", side_effect=self.failing_copy(error)),
+            patch.object(Path, "unlink", unlink),
+        ):
+            with self.assertRaises(OSError) as raised:
+                self.media.stage_input(self.source)
+        self.assertIs(raised.exception, error)
+        self.assertEqual(attempted, [self.pending])
+        self.assert_preserved()
+
+    def test_success_publishes_and_reuses_the_staged_input(self):
+        with patch("spool.media.shutil.copy2", wraps=shutil.copy2) as copy:
+            name = self.media.stage_input(self.source)
+            self.assertEqual(self.media.stage_input(self.source), name)
+        self.assertEqual(name, "spool-projects/p1/input/images/source.png")
+        self.assertEqual(copy.call_count, 1)
+        self.assertEqual(self.target.read_bytes(), self.source.read_bytes())
+        self.assertFalse(self.pending.exists())
+        self.assertEqual(self.unrelated.read_bytes(), b"another operation's bytes")
+
+
+class ExportMuxCleanupTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory(prefix="spool-export-cleanup-")
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name).resolve()
+        self.source = self.root / "image.png"
+        self.source.write_bytes(b"source image")
+        self.folder = self.root / "exports"
+        self.folder.mkdir()
+        self.output = self.folder / "spool-0123456789.mp4"
+        self.previous = self.folder / "previous-success.mp4"
+        self.previous.write_bytes(b"successful export")
+        self.unrelated = self.folder / "another-operation.partial.mp4"
+        self.unrelated.write_bytes(b"unrelated in-progress export")
+        self.commands = []
+
+    def run_export(self, failure=None):
+        def run(command, **kwargs):
+            self.commands.append(command)
+            destination = Path(command[-1])
+            destination.write_bytes(b"partial mux bytes" if destination == self.output and failure else b"complete")
+            if destination == self.output:
+                if isinstance(failure, BaseException):
+                    raise failure
+                if failure:
+                    return subprocess.CompletedProcess(command, 1, stdout="", stderr="injected mux failure")
+            return subprocess.CompletedProcess(command, 0, stdout="", stderr="")
+
+        with (
+            patch("spool.export.find_tool", return_value="fixture-ffmpeg"),
+            patch("spool.export.subprocess.run", side_effect=run),
+            patch("spool.export.uuid.uuid4", return_value=SimpleNamespace(hex="0123456789abcdef")),
+        ):
+            return export_sequence(
+                {"audio": False, "clips": [{"file": "image.png", "in": 0, "out": 24}]},
+                root=self.root,
+                resolve=lambda name: self.root / name,
+                probe=lambda source: {"streams": []},
+                image_extensions={".png"},
+            )
+
+    def assert_preserved(self):
+        self.assertEqual(self.source.read_bytes(), b"source image")
+        self.assertEqual(self.previous.read_bytes(), b"successful export")
+        self.assertEqual(self.unrelated.read_bytes(), b"unrelated in-progress export")
+        # Clip and concat outputs are owned by TemporaryDirectory, independently
+        # of the final mux output exposed under exports/.
+        for command in self.commands[:-1]:
+            self.assertFalse(Path(command[-1]).exists())
+
+    def test_nonzero_mux_exit_removes_the_partial_mp4(self):
+        with self.assertRaisesRegex(ValueError, "injected mux failure"):
+            self.run_export("nonzero")
+        self.assertEqual(len(self.commands), 3)
+        self.assertFalse(self.output.exists())
+        self.assert_preserved()
+
+    def test_mux_timeout_removes_the_partial_mp4_and_preserves_the_timeout(self):
+        error = subprocess.TimeoutExpired(["fixture-ffmpeg"], 180)
+        with self.assertRaises(subprocess.TimeoutExpired) as raised:
+            self.run_export(error)
+        self.assertIs(raised.exception, error)
+        self.assertFalse(self.output.exists())
+        self.assert_preserved()
+
+    def test_cleanup_failure_preserves_the_original_mux_exception(self):
+        error = subprocess.TimeoutExpired(["fixture-ffmpeg"], 180)
+        original_unlink = Path.unlink
+        attempted = []
+
+        def unlink(path, *args, **kwargs):
+            if path == self.output:
+                attempted.append(path)
+                raise PermissionError("cleanup was denied")
+            return original_unlink(path, *args, **kwargs)
+
+        with patch.object(Path, "unlink", unlink):
+            with self.assertRaises(subprocess.TimeoutExpired) as raised:
+                self.run_export(error)
+        self.assertIs(raised.exception, error)
+        self.assertEqual(attempted, [self.output])
+        self.assert_preserved()
+
+    def test_success_keeps_the_complete_export_and_its_returned_url(self):
+        result = self.run_export()
+        self.assertEqual(result, {"url": "exports/spool-0123456789.mp4", "filename": "spool-0123456789.mp4"})
+        self.assertEqual(self.output.read_bytes(), b"complete")
+        self.assert_preserved()
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_farm_protocol.py b/tests/test_farm_protocol.py
index 9bb988d..9f76ea3 100644
--- a/tests/test_farm_protocol.py
+++ b/tests/test_farm_protocol.py
@@ -1,3 +1,4 @@
+import json
 import copy
 import os
 import unittest
@@ -91,6 +92,40 @@ def test_invalid_receipt_does_not_block_a_later_valid_execution(self):
         events = self.store.events(self.project["id"])["events"]
         self.assertEqual(sum(e["kind"] == "receipt.rejected" for e in events), 1)
 
+    def test_receipt_identities_cannot_name_files_outside_the_attempt(self):
+        for field, forged in (("artifactId", "../../../../escaped"), ("executionId", "../../../../escaped")):
+            with self.subTest(field=field):
+                attempt = self.farm_attempts[0 if field == "artifactId" else 1]
+                package, receipt = self.finish(attempt)
+                if field == "artifactId":
+                    receipt["artifacts"][0]["artifactId"] = receipt["primaryArtifactId"] = forged
+                else:
+                    receipt["executionId"] = forged
+                with self.assertRaises(ValueError):
+                    protocol.verify(package, receipt, package["resultRoot"])
+                folder = self.root / "farm" / "spool-receipts" / attempt["id"]
+                protocol.atomic_json(next(folder.glob("*/receipt.json")), receipt)
+                Collector(self.store, self.media).scan()
+                self.assertNotEqual(self.store.attempt(attempt["id"])["status"], "complete")
+                self.assertEqual(list(self.root.rglob("escaped*")), [])
+
+    def test_receipt_of_the_wrong_shape_does_not_block_a_later_valid_execution(self):
+        attempt = self.farm_attempts[0]
+        self.finish(attempt)
+        folder = self.root / "farm" / "spool-receipts" / attempt["id"]
+        valid = json.loads(next(folder.glob("*/receipt.json")).read_text(encoding="utf-8"))
+        unowned = {k: v for k, v in valid.items() if k != "jobId"}
+        for index, value in enumerate(([], {"artifacts": ["x"]}, {"schemaVersion": 2, "history": []}, unowned)):
+            path = folder / ("000-shape-%d" % index) / "receipt.json"
+            path.parent.mkdir(parents=True)
+            protocol.atomic_json(path, value)
+        collector = Collector(self.store, self.media)
+        collector.scan()
+        collector.scan()
+        self.assertEqual(self.store.attempt(attempt["id"])["status"], "complete")
+        events = self.store.events(self.project["id"])["events"]
+        self.assertEqual(sum(e["kind"] == "receipt.rejected" for e in events), 4)
+
     def test_cancel_during_farm_observation_cannot_be_overwritten(self):
         attempt = self.farm_attempts[0]
         self.package(attempt)
@@ -319,6 +354,31 @@ def test_unavailable_progress_does_not_invent_a_percentage_or_fail_the_job(self)
         self.assertIsNone(job["farmProgress"]["percent"])
         self.assertEqual(job["status"], "farm_running")
 
+    def test_find_existing_deadline_job_adopts_it_or_reports_still_uncertain(self):
+        from spool import commands
+
+        attempt = self.farm_attempts[0]
+        package = self.package(attempt)
+        project = self.store.get(self.project["id"])
+        envelope = {
+            "revision": project["revision"],
+            "actor": "agent:test",
+            "scope": {"projectId": project["id"], "clipIds": ["shot"], "capabilities": ["recover"]},
+            "action": "recover_submission",
+            "arguments": {"attemptId": attempt["id"]},
+        }
+        values = {"SpoolSubmissionId": package["submissionId"], "SpoolAttemptId": attempt["id"]}
+        for jobs, status in (([], "submission_uncertain"), (["a" * 24], "adopted")):
+            with (
+                patch("spool.farm.submission_jobs", return_value=jobs),
+                patch("spool.farm.job_value", side_effect=lambda job, key: values[key]),
+            ):
+                result = commands.execute(
+                    self.store, self.media, project["id"], {**envelope, "operationId": "recover-" + status}
+                )
+            self.assertEqual((result["attemptId"], result["status"]), (attempt["id"], status))
+        self.assertEqual(self.store.submission_for(attempt["id"])["external_id"], "a" * 24)
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/tests/test_ffmpeg_text_decoding.py b/tests/test_ffmpeg_text_decoding.py
new file mode 100644
index 0000000..d5ce7b0
--- /dev/null
+++ b/tests/test_ffmpeg_text_decoding.py
@@ -0,0 +1,129 @@
+"""Real subprocess diagnostics survive Windows legacy text defaults."""
+
+import contextlib
+import locale
+import shutil
+import subprocess
+import sys
+import tempfile
+import threading
+import unittest
+import wave
+from pathlib import Path
+from unittest.mock import patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+from spool.cuts import scene_scores
+from spool.export import run_ffmpeg
+from spool.media import Media
+
+
+@contextlib.contextmanager
+def legacy_text_default():
+    # Windows normally supplies this default. Other CI platforms exercise that
+    # same fallback without changing the encoding of the actual child process.
+    if locale.getencoding().lower() == "cp1252":
+        yield
+    else:
+        with patch("subprocess._text_encoding", return_value="cp1252"):
+            yield
+
+
+@unittest.skipUnless(shutil.which("ffmpeg") and shutil.which("ffprobe"), "ffmpeg/ffprobe required")
+class FFmpegTextDecodingTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory(prefix="spool-\u0141-diagnostics-")
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name).resolve()
+        self.ffmpeg = shutil.which("ffmpeg")
+        self.thread_errors = []
+        hook = patch.object(threading, "excepthook", side_effect=self.thread_errors.append)
+        hook.start()
+        self.addCleanup(hook.stop)
+        self.addCleanup(self.assertEqual, self.thread_errors, [])
+
+    def test_export_failure_retains_the_unicode_source_in_the_validation_error(self):
+        missing = self.root / "\u0141-missing.wav"
+        with legacy_text_default(), self.assertRaises(ValueError) as caught:
+            run_ffmpeg([self.ffmpeg, "-v", "error", "-i", str(missing), "-f", "null", "-"], "Export failed")
+        self.assertIn(str(missing), str(caught.exception))
+        self.assertFalse(missing.exists())
+
+    def test_scene_failure_retains_decoded_diagnostics_and_does_not_cache_scores(self):
+        corrupt = self.root / "\u0141-corrupt.mp4"
+        original = b"not a valid movie"
+        corrupt.write_bytes(original)
+        cache = self.root / "scores"
+        with legacy_text_default(), self.assertRaises(subprocess.CalledProcessError) as caught:
+            scene_scores(self.ffmpeg, corrupt, cache)
+        self.assertIsInstance(caught.exception.stderr, str)
+        self.assertIn(str(corrupt), caught.exception.stderr)
+        self.assertEqual(corrupt.read_bytes(), original)
+        self.assertFalse(cache.exists())
+
+    def test_bake_failure_after_probe_is_readable_cleans_pending_and_can_retry(self):
+        (self.root / "input").mkdir()
+        media = Media(self.root / "project", self.root / "input", self.root / "output", self.root / "temp")
+        source = media.root / "\u0141-tone.wav"
+        with wave.open(str(source), "wb") as wav:
+            wav.setnchannels(1)
+            wav.setsampwidth(2)
+            wav.setframerate(48000)
+            wav.writeframes(b"\0\0" * 48000)
+        original = source.read_bytes()
+        segment = {"media": {"id": "tone", "file": source.name, "fps": 24}, "start": 0, "in": 0, "out": 24}
+        real_run = subprocess.run
+        moved = source.with_suffix(".held")
+        failed_commands = []
+
+        def disappear_after_validation(command, **kwargs):
+            if "-filter_complex" in command and str(source) in command:
+                # The real probe and checksum have already read valid audio.
+                # Only this operation's source disappears for real FFmpeg.
+                source.rename(moved)
+                failed_commands.append(command)
+                try:
+                    return real_run(command, **kwargs)
+                finally:
+                    moved.rename(source)
+            return real_run(command, **kwargs)
+
+        with (
+            legacy_text_default(),
+            patch("spool.media.subprocess.run", side_effect=disappear_after_validation),
+            self.assertRaises(ValueError) as caught,
+        ):
+            media.bake_audio([segment], 24, 24)
+        self.assertEqual(len(failed_commands), 1)
+        self.assertIn(str(source), str(caught.exception))
+        self.assertEqual(source.read_bytes(), original)
+        self.assertEqual(list((self.root / "input/spool-baked").iterdir()), [])
+        with legacy_text_default():
+            result = media.bake_audio([segment], 24, 24)
+        output = self.root / "input" / result["file"]
+        with wave.open(str(output), "rb") as wav:
+            self.assertEqual(wav.getnframes(), 48000)
+            self.assertEqual(wav.getnchannels(), 2)
+        self.assertEqual(source.read_bytes(), original)
+
+    def test_scene_score_stdout_still_parses_with_unicode_paths(self):
+        source = self.root / "\u0141-valid.mp4"
+        subprocess.run(
+            [self.ffmpeg, "-v", "error", "-f", "lavfi", "-i", "color=s=32x32:r=24:d=1", "-c:v", "libx264", str(source)],
+            check=True,
+            capture_output=True,
+        )
+        with legacy_text_default():
+            scores = scene_scores(self.ffmpeg, source, self.root / "scores")
+        self.assertEqual(scores, [0.0] * 24)
+
+    def test_invalid_diagnostic_bytes_keep_the_failure_readable(self):
+        # A process boundary fixture covers non-UTF-8 tool/build diagnostics;
+        # the three other failure cases run the actual installed FFmpeg.
+        command = [sys.executable, "-c", "import sys;sys.stderr.buffer.write(b'failure: \\xff\\x81');sys.exit(2)"]
+        with legacy_text_default(), self.assertRaisesRegex(ValueError, "failure: \ufffd\ufffd"):
+            run_ffmpeg(command, "Export failed")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_import_failure_cleanup.py b/tests/test_import_failure_cleanup.py
new file mode 100644
index 0000000..a171496
--- /dev/null
+++ b/tests/test_import_failure_cleanup.py
@@ -0,0 +1,253 @@
+"""A failed import removes only its own destination and local working cache."""
+
+import copy
+import hashlib
+import os
+import shutil
+import stat
+import subprocess
+import tempfile
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+from spool.projects import Workspace
+
+
+class ImportFailureCleanupTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.root = Path(self.temp.name).resolve()
+        self.workspace = Workspace(self.root / "app")
+        self.projects = self.root / "projects"
+        self.workspace.set_setting("projects_directory", str(self.projects))
+        self.source = self.workspace.create({"project": "Source", "clips": [], "media": []}, self.root / "source")
+        self.store = self.workspace.for_project(self.source["id"])
+        self.exported = self.store.export_project(self.source["id"])
+
+    def tearDown(self):
+        self.temp.cleanup()
+
+    def cache_names(self):
+        root = self.workspace.root / "cache"
+        return {path.name for path in root.iterdir()} if root.is_dir() else set()
+
+    @staticmethod
+    def cache_for(workspace, folder):
+        folder = Path(folder).resolve()
+        key = hashlib.sha256(str(folder).encode()).hexdigest()
+        return Path(workspace.root) / "cache" / key
+
+    def invalid_import(self):
+        value = copy.deepcopy(self.exported)
+        value["document"]["invalidNumber"] = float("inf")
+        return value
+
+    def fixed_destination(self, name):
+        destination = self.projects / name
+
+        def make(*args, **kwargs):
+            destination.mkdir(parents=True)
+            return str(destination)
+
+        return destination, make
+
+    def assert_only_source_remains(self, folders, caches):
+        self.assertEqual(self.workspace.folders(), folders)
+        self.assertEqual(self.cache_names(), caches)
+        self.assertEqual(set(self.workspace.opened), {self.source["id"]})
+        self.assertEqual(list(self.projects.iterdir()), [])
+
+    def test_constructor_failure_after_cache_creation_removes_new_cache(self):
+        folders, caches = self.workspace.folders(), self.cache_names()
+        with patch("spool.projects.take_files.recover", side_effect=RuntimeError("constructor failed")):
+            with self.assertRaisesRegex(RuntimeError, "constructor failed"):
+                self.workspace.import_project(self.exported)
+        self.assert_only_source_remains(folders, caches)
+
+    def test_cache_path_failure_removes_the_empty_destination(self):
+        folders, caches = self.workspace.folders(), self.cache_names()
+        error = OSError("cache path unavailable")
+        with patch("spool.projects.working_cache", side_effect=error):
+            with self.assertRaises(OSError) as caught:
+                self.workspace.import_project(self.exported)
+        self.assertIs(caught.exception, error)
+        self.assert_only_source_remains(folders, caches)
+
+    def test_destination_resolution_failure_removes_only_the_empty_destination(self):
+        folders, caches = self.workspace.folders(), self.cache_names()
+        real_resolve = Path.resolve
+        error = OSError("destination resolution unavailable")
+
+        def resolve(path, *args, **kwargs):
+            if path.parent == self.projects and path.name.startswith("Untitled Spool project-"):
+                raise error
+            return real_resolve(path, *args, **kwargs)
+
+        with patch.object(Path, "resolve", resolve):
+            with self.assertRaises(OSError) as caught:
+                self.workspace.import_project(self.exported)
+        self.assertIs(caught.exception, error)
+        self.assert_only_source_remains(folders, caches)
+
+    def test_invalid_import_transaction_removes_new_cache(self):
+        folders, caches = self.workspace.folders(), self.cache_names()
+        with self.assertRaises(ValueError):
+            self.workspace.import_project(self.invalid_import())
+        self.assert_only_source_remains(folders, caches)
+
+    def test_registration_failure_removes_new_cache_and_destination(self):
+        folders, caches = self.workspace.folders(), self.cache_names()
+        with patch.object(self.workspace, "register_folder", side_effect=OSError("Registry unavailable")):
+            with self.assertRaisesRegex(OSError, "Registry unavailable"):
+                self.workspace.import_project(self.exported)
+        self.assert_only_source_remains(folders, caches)
+
+    def test_success_keeps_and_reopens_the_import_cache(self):
+        imported = self.workspace.import_project(self.exported)
+        folder = Path(next(row["folder"] for row in self.workspace.folders() if row["id"] == imported["id"]))
+        cache = self.cache_for(self.workspace, folder)
+        self.assertTrue(cache.is_dir())
+        self.assertTrue((cache / "working.sqlite3").is_file())
+        reopened = Workspace(self.workspace.root).get(imported["id"])
+        self.assertEqual(reopened["document"], imported["document"])
+        self.assertTrue(cache.is_dir())
+
+    def test_pre_existing_cache_at_the_derived_path_is_preserved(self):
+        destination, make = self.fixed_destination("preserved-cache")
+        cache = self.cache_for(self.workspace, destination)
+        cache.mkdir(parents=True)
+        sentinel = cache / "keep.txt"
+        sentinel.write_text("keep", encoding="utf-8")
+        with patch("spool.projects.tempfile.mkdtemp", side_effect=make):
+            with self.assertRaises(ValueError):
+                self.workspace.import_project(self.invalid_import())
+        self.assertEqual(sentinel.read_text(encoding="utf-8"), "keep")
+        self.assertTrue((cache / "working.sqlite3").is_file())
+        self.assertFalse(destination.exists())
+        self.assertEqual(len(self.workspace.list()), 1)
+
+    def test_redirected_cache_root_is_not_deleted(self):
+        workspace = Workspace(self.root / "redirected-app")
+        projects = self.root / "redirected-projects"
+        workspace.set_setting("projects_directory", str(projects))
+        external = self.root / "external-cache"
+        external.mkdir()
+        cache_root = workspace.root / "cache"
+        self.make_directory_redirect(cache_root, external)
+        try:
+            with self.assertRaises(ValueError):
+                workspace.import_project(self.invalid_import())
+            created = list(external.iterdir())
+            self.assertEqual(len(created), 1)
+            self.assertTrue(created[0].is_dir())
+            self.assertTrue((created[0] / "working.sqlite3").is_file())
+            self.assertEqual(list(projects.iterdir()), [])
+            self.assertEqual(workspace.folders(), [])
+        finally:
+            self.remove_directory_redirect(cache_root)
+
+    def test_unreadable_redirect_metadata_cannot_authorize_external_cleanup(self):
+        workspace = Workspace(self.root / "uncertain-app")
+        projects = self.root / "uncertain-projects"
+        workspace.set_setting("projects_directory", str(projects))
+        external = self.root / "uncertain-external"
+        external.mkdir()
+        cache_root = workspace.root / "cache"
+        self.make_directory_redirect(cache_root, external)
+        original = Path.lstat
+
+        def inspect(path):
+            if path == cache_root:
+                raise PermissionError("redirect metadata unavailable")
+            return original(path)
+
+        try:
+            with patch.object(Path, "lstat", inspect):
+                with self.assertRaises(ValueError):
+                    workspace.import_project(self.invalid_import())
+            self.assertEqual(len(list(external.iterdir())), 1)
+            self.assertEqual(list(projects.iterdir()), [])
+        finally:
+            self.remove_directory_redirect(cache_root)
+
+    def test_transient_cache_inspection_failure_preserves_existing_cache(self):
+        destination, make = self.fixed_destination("uncertain-existing-cache")
+        cache = self.cache_for(self.workspace, destination)
+        cache.mkdir(parents=True)
+        sentinel = cache / "keep.txt"
+        sentinel.write_bytes(b"existing cache")
+        real_lstat = Path.lstat
+        failures = []
+
+        def inspect(path):
+            if path == cache and not failures:
+                failures.append(path)
+                raise PermissionError("transient cache metadata error")
+            return real_lstat(path)
+
+        with (
+            patch("spool.projects.tempfile.mkdtemp", side_effect=make),
+            patch.object(Path, "lstat", inspect),
+        ):
+            with self.assertRaises(ValueError):
+                self.workspace.import_project(self.invalid_import())
+        self.assertEqual(len(failures), 1)
+        self.assertEqual(sentinel.read_bytes(), b"existing cache")
+        self.assertFalse(destination.exists())
+
+    def test_denied_cleanup_preserves_the_import_error(self):
+        for denied in ("folder", "cache"):
+            with self.subTest(denied=denied):
+                destination, make = self.fixed_destination("denied-" + denied)
+                cache = self.cache_for(self.workspace, destination)
+                real_rmtree = shutil.rmtree
+                blocked = []
+
+                def refuse(path, *args, **kwargs):
+                    target = Path(path)
+                    if (denied == "folder" and target == destination) or (denied == "cache" and target == cache):
+                        blocked.append(target)
+                        raise PermissionError(denied + " cleanup denied")
+                    return real_rmtree(path, *args, **kwargs)
+
+                with (
+                    patch("spool.projects.tempfile.mkdtemp", side_effect=make),
+                    patch("spool.projects.shutil.rmtree", refuse),
+                ):
+                    with self.assertRaisesRegex(ValueError, "JSON compliant"):
+                        self.workspace.import_project(self.invalid_import())
+                self.assertEqual(blocked, [destination if denied == "folder" else cache])
+                if denied == "folder":
+                    self.assertTrue(destination.is_dir())
+                    self.assertFalse(cache.exists())
+                else:
+                    self.assertFalse(destination.exists())
+                    self.assertTrue(cache.is_dir())
+
+    def make_directory_redirect(self, link, target):
+        target.mkdir(parents=True, exist_ok=True)
+        try:
+            os.symlink(target, link, target_is_directory=True)
+            return
+        except (OSError, NotImplementedError):
+            if os.name != "nt":
+                self.skipTest("Directory symlinks are unavailable")
+        result = subprocess.run(["cmd", "/c", "mklink", "/J", str(link), str(target)], capture_output=True, text=True)
+        if result.returncode:
+            self.skipTest("Directory links are unavailable: " + (result.stderr or result.stdout).strip())
+
+    @staticmethod
+    def remove_directory_redirect(link):
+        try:
+            info = link.lstat()
+        except FileNotFoundError:
+            return
+        if stat.S_ISLNK(info.st_mode):
+            link.unlink()
+        elif getattr(info, "st_file_attributes", 0) & getattr(stat, "FILE_ATTRIBUTE_REPARSE_POINT", 0):
+            os.rmdir(link)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_interchange_publication.py b/tests/test_interchange_publication.py
new file mode 100644
index 0000000..221e0b0
--- /dev/null
+++ b/tests/test_interchange_publication.py
@@ -0,0 +1,262 @@
+"""OTIO publication retries sharing denials and owns only its unpublished file."""
+
+import errno
+import json
+import os
+import tempfile
+import threading
+import unittest
+from concurrent.futures import ThreadPoolExecutor
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from PIL import Image
+
+from spool.media import Media
+from spool.durable import atomic_replace
+
+
+class InterchangePublicationTests(unittest.TestCase):
+    def setUp(self):
+        directory = tempfile.TemporaryDirectory(prefix="spool-otio-\u0141-")
+        self.addCleanup(directory.cleanup)
+        self.root = Path(directory.name)
+        roots = [self.root / name for name in ("input", "output", "temp")]
+        for root in roots:
+            root.mkdir()
+        self.media = Media(self.root / "project", *roots)
+        self.source = self.media.root / "source.png"
+        Image.new("RGB", (8, 8), "red").save(self.source)
+        self.source_bytes = self.source.read_bytes()
+        self.plan = {
+            "fps": 24,
+            "width": 320,
+            "height": 180,
+            "name": "Cut \u0141",
+            "duration": 24,
+            "tracks": [
+                {
+                    "kind": "video",
+                    "name": "V1",
+                    "clips": [{"id": "clip", "file": "source.png", "in": 0, "out": 24, "start": 0}],
+                }
+            ],
+        }
+        self.prior = self.media.export_timeline(self.plan)
+        self.exports = self.media.root / "exports"
+        self.foreign = self.exports / "another-operation.partial"
+        self.foreign.write_bytes(b"another writer's bytes")
+        self.before = self.files()
+
+    def files(self):
+        return {path.name: path.read_bytes() for path in self.exports.iterdir() if path.is_file()}
+
+    def assert_preserved(self):
+        self.assertEqual(self.source.read_bytes(), self.source_bytes)
+        for name, data in self.before.items():
+            self.assertEqual((self.exports / name).read_bytes(), data)
+
+    def assert_export(self, result):
+        self.assertEqual(set(result), {"filename", "path", "timeline"})
+        self.assertEqual(Path(result["path"]), self.exports / result["filename"])
+        self.assertEqual(Path(result["filename"]).suffix, ".otio")
+        self.assertEqual(json.loads(Path(result["path"]).read_text(encoding="utf-8")), result["timeline"])
+        self.assertEqual(result["timeline"]["OTIO_SCHEMA"], "Timeline.1")
+        self.assertEqual(result["timeline"]["name"], self.plan["name"])
+        clip = result["timeline"]["tracks"]["children"][0]["children"][0]
+        self.assertEqual(clip["media_reference"]["target_url"], str(self.source.resolve()))
+        self.assertEqual(clip["source_range"]["duration"]["value"], 24)
+        self.assert_preserved()
+
+    def test_transient_sharing_denials_retry_and_publish_the_same_timeline(self):
+        replace = Path.replace
+        attempts = []
+
+        def busy(source, target):
+            attempts.append((source, Path(target)))
+            if len(attempts) < 3:
+                raise PermissionError(errno.EACCES, "injected transient sharing denial")
+            return replace(source, target)
+
+        with patch.object(Path, "replace", busy), patch("spool.durable.time.sleep"):
+            result = self.media.export_timeline(self.plan)
+        self.assertEqual(len(attempts), 3)
+        self.assertEqual(len({source for source, _ in attempts}), 1)
+        self.assertFalse(attempts[0][0].exists())
+        self.assert_export(result)
+        self.assertEqual(set(self.files()), set(self.before) | {result["filename"]})
+
+    def test_failed_publication_removes_only_its_pending_file(self):
+        error = OSError(errno.EIO, "injected publication failure")
+        with patch.object(Path, "replace", side_effect=error):
+            with self.assertRaises(OSError) as raised:
+                self.media.export_timeline(self.plan)
+        self.assertIs(raised.exception, error)
+        self.assertEqual(self.files(), self.before)
+        self.assert_preserved()
+
+    def test_exhausted_sharing_retries_remove_only_the_owned_pending(self):
+        error = PermissionError(errno.EACCES, "injected persistent sharing denial")
+        with patch.object(Path, "replace", side_effect=error) as replace, patch("spool.durable.time.sleep"):
+            with self.assertRaises(PermissionError) as raised:
+                self.media.export_timeline(self.plan)
+        self.assertIs(raised.exception, error)
+        self.assertGreater(replace.call_count, 1)
+        self.assertEqual(self.files(), self.before)
+        self.assert_preserved()
+
+    def fail_write(self, error):
+        def write(value, handle, **kwargs):
+            handle.write('{"unfinished":')
+            raise error
+
+        return write
+
+    def test_partial_json_write_failure_is_cleaned_without_changing_prior_exports(self):
+        error = OSError(errno.ENOSPC, "injected partial JSON write failure")
+        with patch("spool.interchange.json.dump", side_effect=self.fail_write(error)):
+            with self.assertRaises(OSError) as raised:
+                self.media.export_timeline(self.plan)
+        self.assertIs(raised.exception, error)
+        self.assertEqual(self.files(), self.before)
+        self.assert_preserved()
+
+    def denied_cleanup(self, attempted):
+        unlink = Path.unlink
+
+        def denied(path, *args, **kwargs):
+            if path.parent == self.exports and path != self.foreign and path.suffix == ".partial":
+                attempted.append(path)
+                raise PermissionError("injected cleanup denial")
+            return unlink(path, *args, **kwargs)
+
+        return denied
+
+    def test_cleanup_denial_preserves_the_primary_write_error(self):
+        error = OSError(errno.ENOSPC, "primary write failure")
+        attempted = []
+        with (
+            patch("spool.interchange.json.dump", side_effect=self.fail_write(error)),
+            patch.object(Path, "unlink", self.denied_cleanup(attempted)),
+        ):
+            with self.assertRaises(OSError) as raised:
+                self.media.export_timeline(self.plan)
+        self.assertIs(raised.exception, error)
+        self.assertEqual(len(attempted), 1)
+        self.assertEqual(attempted[0].read_text(encoding="utf-8"), '{"unfinished":')
+        self.assertEqual(set(self.files()), set(self.before) | {attempted[0].name})
+        self.assert_preserved()
+
+    def test_cleanup_denial_preserves_the_primary_publication_error(self):
+        error = OSError(errno.EIO, "primary publication failure")
+        attempted = []
+        with (
+            patch.object(Path, "replace", side_effect=error),
+            patch.object(Path, "unlink", self.denied_cleanup(attempted)),
+        ):
+            with self.assertRaises(OSError) as raised:
+                self.media.export_timeline(self.plan)
+        self.assertIs(raised.exception, error)
+        self.assertEqual(len(attempted), 1)
+        self.assertEqual(json.loads(attempted[0].read_text(encoding="utf-8"))["OTIO_SCHEMA"], "Timeline.1")
+        self.assertEqual(set(self.files()), set(self.before) | {attempted[0].name})
+        self.assert_preserved()
+
+    def test_pending_name_collision_does_not_truncate_or_remove_another_writers_file(self):
+        output = self.exports / ("Cut-\u0141-" + "a" * 10 + ".otio")
+        output.write_bytes(Path(self.prior["path"]).read_bytes())
+        pending = output.with_name(output.name + "." + "b" * 32 + ".partial")
+        pending.write_bytes(b"pending bytes belonging to another operation")
+        self.before = self.files()
+        identities = [SimpleNamespace(hex="a" * 32), SimpleNamespace(hex="b" * 32)]
+        with patch("spool.interchange.uuid.uuid4", side_effect=identities):
+            with self.assertRaises(FileExistsError):
+                self.media.export_timeline(self.plan)
+        self.assertEqual(self.files(), self.before)
+        self.assert_preserved()
+
+    def test_concurrent_exports_own_distinct_partials_and_both_publish(self):
+        barrier = threading.Barrier(2)
+        pending_paths = []
+        lock = threading.Lock()
+
+        def publish(pending, output):
+            self.assertEqual(json.loads(pending.read_text(encoding="utf-8"))["OTIO_SCHEMA"], "Timeline.1")
+            with lock:
+                pending_paths.append(pending)
+            barrier.wait(timeout=5)
+            return atomic_replace(pending, output)
+
+        with patch("spool.interchange.atomic_replace", side_effect=publish), ThreadPoolExecutor(max_workers=2) as pool:
+            futures = [pool.submit(self.media.export_timeline, self.plan) for _ in range(2)]
+            results = [future.result(timeout=5) for future in futures]
+        self.assertEqual(len(set(pending_paths)), 2)
+        self.assertEqual(len({result["filename"] for result in results}), 2)
+        for result in results:
+            self.assert_export(result)
+        self.assertTrue(all(not pending.exists() for pending in pending_paths))
+        self.assertEqual(set(self.files()), set(self.before) | {result["filename"] for result in results})
+
+    @unittest.skipUnless(os.name == "nt", "Native Windows delete-sharing semantics")
+    def test_native_windows_sharing_denial_retries_real_rename(self):
+        """Inject a real temporary reader without FILE_SHARE_DELETE; do not mock rename errors."""
+        import ctypes
+        from ctypes import wintypes
+
+        kernel = ctypes.WinDLL("kernel32", use_last_error=True)
+        kernel.CreateFileW.argtypes = [
+            wintypes.LPCWSTR,
+            wintypes.DWORD,
+            wintypes.DWORD,
+            wintypes.LPVOID,
+            wintypes.DWORD,
+            wintypes.DWORD,
+            wintypes.HANDLE,
+        ]
+        kernel.CreateFileW.restype = wintypes.HANDLE
+        kernel.CloseHandle.argtypes = [wintypes.HANDLE]
+        kernel.CloseHandle.restype = wintypes.BOOL
+        denials = []
+        replace = Path.replace
+
+        def publish(pending, output):
+            handle = kernel.CreateFileW(str(pending), 0x80000000, 3, None, 3, 0, None)
+            if handle == wintypes.HANDLE(-1).value:
+                raise ctypes.WinError(ctypes.get_last_error())
+            release = threading.Event()
+
+            def close_reader():
+                release.wait(timeout=5)
+                kernel.CloseHandle(handle)
+
+            reader = threading.Thread(target=close_reader)
+            reader.start()
+
+            def observed_replace(source, target):
+                try:
+                    return replace(source, target)
+                except PermissionError as error:
+                    if source == pending:
+                        denials.append(error.winerror)
+                        release.set()
+                    raise
+
+            try:
+                with patch.object(Path, "replace", observed_replace):
+                    return atomic_replace(pending, output)
+            finally:
+                release.set()
+                reader.join(timeout=5)
+                self.assertFalse(reader.is_alive())
+
+        with patch("spool.interchange.atomic_replace", side_effect=publish):
+            result = self.media.export_timeline(self.plan)
+        self.assertTrue(denials)
+        self.assertTrue(all(code in (32, 33) for code in denials))
+        self.assert_export(result)
+        self.assertEqual(set(self.files()), set(self.before) | {result["filename"]})
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_join_audio_retiming.py b/tests/test_join_audio_retiming.py
new file mode 100644
index 0000000..188959f
--- /dev/null
+++ b/tests/test_join_audio_retiming.py
@@ -0,0 +1,180 @@
+"""A joined extension's audio follows its video and the plain take's interpreted timing.
+
+Joined frame `j` shows render frame `j + shift`; the copy's audio must advance by the measured
+shift and play at the sequence rate, then last exactly as long as the joined video. A render
+without audio stays without one.
+"""
+
+import array
+import json
+import shutil
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+from spool import joins
+from spool.media import Media
+from spool.timing import tempo_filter
+
+FFMPEG = shutil.which("ffmpeg")
+FFPROBE = shutil.which("ffprobe")
+SIZE = (320, 192)
+RATE = 25  # the render's own frame rate; the sequence below runs at 24
+FPS = 24
+FRAMES = 125  # five seconds at 25 fps, interpreted as 125 frames at 24 fps
+BEEP = 2.0
+BEEP_LENGTH = 0.1
+
+
+def encode(path, source, frames, beep=None):
+    """`frames` frames of a moving pattern from pattern frame `source`, plus an optional beep."""
+    graph = (
+        f"testsrc2=size={SIZE[0]}x{SIZE[1]}:rate={RATE},"
+        f"trim=start_frame={source}:end_frame={source + frames},setpts=PTS-STARTPTS"
+    )
+    command = [FFMPEG, "-v", "error", "-y", "-f", "lavfi", "-i", graph]
+    if beep is not None:
+        tone = f"aevalsrc=0.8*sin(2*PI*1000*t)*between(t\\,{beep}\\,{beep + BEEP_LENGTH}):s=48000:d={frames / RATE}"
+        command += ["-f", "lavfi", "-i", tone, "-c:a", "aac", "-b:a", "192k"]
+    command += ["-c:v", "libx264", "-crf", "8", "-pix_fmt", "yuv420p"]
+    if beep is not None:
+        command += ["-shortest"]
+    command.append(str(path))
+    subprocess.run(command, check=True)
+
+
+def probe(path):
+    result = subprocess.run(
+        [
+            FFPROBE,
+            "-v",
+            "error",
+            "-show_streams",
+            "-show_format",
+            "-of",
+            "json",
+            str(path),
+        ],
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+    return json.loads(result.stdout)
+
+
+def durations(path):
+    streams = probe(path)["streams"]
+    video = next((s for s in streams if s["codec_type"] == "video"), None)
+    audio = next((s for s in streams if s["codec_type"] == "audio"), None)
+    return (
+        float(video["duration"]) if video and "duration" in video else None,
+        float(audio["duration"]) if audio and "duration" in audio else None,
+    )
+
+
+def beep_time(path, audio_filter=None):
+    """When the first loud sample starts in the first audio stream."""
+    command = [FFMPEG, "-v", "error", "-i", str(path), "-map", "0:a:0"]
+    if audio_filter:
+        command += ["-af", audio_filter]
+    command += ["-ac", "1", "-ar", "48000", "-f", "f32le", "-"]
+    data = subprocess.run(command, check=True, capture_output=True).stdout
+    samples = array.array("f")
+    samples.frombytes(data)
+    return next(index for index, sample in enumerate(samples) if abs(sample) > 0.2) / 48000
+
+
+def plain_beep_time(path):
+    """When the plain take's audio has its beep after the sequence rate retimes it."""
+    return beep_time(path, tempo_filter(FPS / RATE))
+
+
+def request(frozen, overlap=22):
+    return {
+        "takeId": "take-1",
+        "sequenceFps": FPS,
+        "shotInputs": [
+            {
+                "clipId": "shot",
+                "takeId": "shot-take",
+                "in": 0,
+                "out": 50,
+                "key": "16/file",
+                "source": "previous",
+                "settings": {"slot": "video", "frame": "last", "frames": overlap},
+            }
+        ],
+        "assets": [{"nodeId": "16", "input": "file", "frozen": frozen}],
+    }
+
+
+@unittest.skipUnless(FFMPEG and FFPROBE, "ffmpeg and ffprobe are required")
+class JoinAudioRetimingTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = Path(tempfile.mkdtemp())
+        self.addCleanup(shutil.rmtree, self.temp, ignore_errors=True)
+        for name in ("project", "input", "output", "temp"):
+            (self.temp / name).mkdir()
+        self.media = Media(*(self.temp / n for n in ("project", "input", "output", "temp")), project_id="p")
+        # The shot is pattern frames 100..121; the extension is given its last 22.
+        encode(self.temp / "input" / "guide.mp4", 100, 22)
+        self.render_path = self.temp / "project" / "output" / "take.mp4"
+
+    def render(self, drift, beep=BEEP):
+        """A 25 fps extension take: the 22 given frames rendered again, slipped by `drift`."""
+        (self.temp / "project" / "output").mkdir(exist_ok=True)
+        encode(self.render_path, 100 - drift, FRAMES, beep)
+        primary = {
+            "artifactId": "a1",
+            "kind": "video",
+            "width": SIZE[0],
+            "height": SIZE[1],
+            "frames": FRAMES,
+            "duration": FRAMES / RATE,
+            "audio": beep is not None,
+            "fps": f"{RATE}/1",
+            "sequenceFps": FPS,
+            "originalFile": "output/take.mp4",
+        }
+        return {"primary": primary, "artifacts": [dict(primary)]}
+
+    def attached(self, drift, beep=BEEP):
+        result = joins.attach(self.media, request("guide.mp4", overlap=22), self.render(drift, beep))
+        return result, result["primary"]["join"]
+
+    def test_the_audio_is_retimed_and_follows_the_measured_shift(self):
+        for drift in (-1, 0, 1):
+            with self.subTest(drift=drift):
+                result, join = self.attached(drift)
+                self.assertTrue(join["audio"])
+                self.assertEqual(join["frames"], FRAMES, "interpreted source frames are preserved")
+                self.assertEqual(result["primary"]["originalFile"], "output/take.mp4", "the render is untouched")
+                joined = self.media.resolve(join["originalFile"])
+                video, audio = durations(joined)
+                self.assertAlmostEqual(video, FRAMES / FPS, delta=0.04, msg="the join keeps the take's frame clock")
+                self.assertAlmostEqual(audio, video, delta=0.04, msg="the join's audio lasts its own video")
+                # A stream copy would still be five seconds; the plain take lasts 125/24.
+                self.assertGreater(audio, 5.15)
+                # Joined frame j is render frame j + drift, retimed at 24/25 speed.
+                expected = plain_beep_time(self.render_path) - drift / FPS
+                self.assertAlmostEqual(beep_time(joined), expected, delta=0.015, msg="audio follows the video shift")
+                self.assertAlmostEqual(
+                    durations(self.render_path)[1], FRAMES / RATE, delta=0.04, msg="the source audio is unchanged"
+                )
+
+    def test_a_render_without_audio_joins_without_one(self):
+        result, join = self.attached(0, beep=None)
+        self.assertFalse(join["audio"])
+        self.assertEqual(join["frames"], FRAMES)
+        self.assertFalse(
+            any(s["codec_type"] == "audio" for s in probe(self.media.resolve(join["originalFile"]))["streams"])
+        )
+        self.assertEqual(result["primary"]["originalFile"], "output/take.mp4")
+        self.assertTrue(list(joins._frames(FFMPEG, self.media.resolve(join["originalFile"]), SIZE)))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_launcher.py b/tests/test_launcher.py
index f12d8d8..45e516a 100644
--- a/tests/test_launcher.py
+++ b/tests/test_launcher.py
@@ -1,5 +1,8 @@
 import asyncio
 import os
+import re
+import subprocess
+import sys
 import tempfile
 import time
 import unittest
@@ -166,3 +169,28 @@ async def test_startup_routes_reject_cross_origin_mutations(self):
                 )
                 self.assertEqual(response.status, 403)
                 spawn.assert_not_called()
+
+
+class ShallowCheckoutTests(unittest.TestCase):
+    def test_status_works_for_a_checkout_near_the_drive_root(self):
+        with tempfile.TemporaryDirectory() as folder:
+            launcher = ComfyLauncher(Store(Path(folder)))
+            launcher.probe = AsyncMock(return_value=("stopped", None))
+            # Outside ComfyUI_windows_portable/ComfyUI/custom_nodes there may be no fourth parent.
+            with patch("spool.launcher.__file__", os.path.join(os.path.abspath(os.sep), "spool", "launcher.py")):
+                status = asyncio.run(launcher.status())
+        self.assertEqual(status["state"], "stopped")
+
+
+class StandaloneScriptTests(unittest.TestCase):
+    def test_windows_script_finds_spool_with_an_isolated_python(self):
+        # ComfyUI portable's python_embeded has a ._pth file, which runs Python like -I:
+        # the current folder is not on sys.path, so "-m spool" alone finds nothing.
+        root = Path(__file__).resolve().parent.parent
+        script = (root / "run_spool.bat").read_text(encoding="utf-8")
+        code = re.search(r'^"%PY%" %FLAGS% -c "([^"]+)" --open %\*$', script, re.M).group(1)
+        result = subprocess.run(
+            [sys.executable, "-I", "-c", code, "--help"], cwd=root, capture_output=True, text=True, timeout=60
+        )
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertIn("usage: python -m spool", result.stdout)
diff --git a/tests/test_launcher_nonblocking.py b/tests/test_launcher_nonblocking.py
new file mode 100644
index 0000000..9f80f49
--- /dev/null
+++ b/tests/test_launcher_nonblocking.py
@@ -0,0 +1,361 @@
+"""Launcher storage and filesystem work stays off the host event loop."""
+
+import asyncio
+import os
+import tempfile
+import threading
+import time
+import unittest
+from pathlib import Path
+from unittest.mock import AsyncMock, Mock, patch
+
+from aiohttp import web
+from aiohttp.test_utils import TestClient, TestServer
+
+from spool.launcher import ComfyLauncher
+from spool.store import Conflict, Store
+
+
+class Gate:
+    """Hold a storage worker, either for a fixed time or until released."""
+
+    def __init__(self, hold=None):
+        self.hold = hold
+        self.entered = threading.Event()
+        self.released = threading.Event()
+
+    def wait(self):
+        self.entered.set()
+        if self.hold is not None:
+            time.sleep(self.hold)
+        elif not self.released.wait(10):
+            raise TimeoutError("The test gate was not released")
+
+    def release(self):
+        self.released.set()
+
+
+class BlockingStore(Store):
+    """A real SQLite store whose chosen synchronous call can be held in its worker."""
+
+    def __init__(self, root):
+        super().__init__(root)
+        self.block = None
+
+    def _hold(self, method, key=None):
+        block = self.block
+        if block and block[0] == method and (block[1] is None or block[1] == key):
+            block[2].wait()
+
+    def setting(self, key):
+        self._hold("setting", key)
+        return super().setting(key)
+
+    def set_setting(self, key, value):
+        self._hold("set_setting", key)
+        return super().set_setting(key, value)
+
+    def host(self, include_definitions=True):
+        self._hold("host", include_definitions)
+        return super().host(include_definitions)
+
+
+class LauncherNonblockingTests(unittest.IsolatedAsyncioTestCase):
+    def setUp(self):
+        self.directory = tempfile.TemporaryDirectory()
+        self.addCleanup(self.directory.cleanup)
+        self.root = Path(self.directory.name)
+        self.file = self.root / ("Comfy startup.bat" if os.name == "nt" else "Comfy startup.sh")
+        self.file.write_text("test fixture", encoding="utf-8")
+        self.store = BlockingStore(self.root / "store")
+        self.launcher = ComfyLauncher(self.store)
+
+    def settings(self, **values):
+        return {"startupFile": str(self.file), "comfyUrl": "http://127.0.0.1:8195", "autoStart": False, **values}
+
+    async def assert_loop_progress(self, operation, minimum=0.45):
+        """Run operation while a heartbeat proves the loop turns during its blocked worker."""
+        stamps = []
+        stop = threading.Event()
+
+        async def heartbeat():
+            while not stop.is_set():
+                stamps.append(time.monotonic())
+                await asyncio.sleep(0.005)
+
+        beat = asyncio.create_task(heartbeat())
+        try:
+            await asyncio.sleep(0.03)
+            started = time.monotonic()
+            result = await operation()
+            elapsed = time.monotonic() - started
+            await asyncio.sleep(0.05)
+        finally:
+            stop.set()
+            await beat
+        gap = max((later - earlier for earlier, later in zip(stamps, stamps[1:])), default=0)
+        self.assertGreaterEqual(elapsed, minimum)
+        self.assertLess(gap, minimum * 0.75)
+        return result
+
+    async def test_status_settings_and_host_reads_do_not_stall_the_loop(self):
+        self.launcher.probe = AsyncMock(return_value=("stopped", None))
+        for method, key in (("setting", "comfy_startup"), ("host", False)):
+            with self.subTest(method=method):
+                gate = Gate(hold=0.5)
+                self.store.block = (method, key, gate)
+                try:
+                    status = await self.assert_loop_progress(self.launcher.status)
+                finally:
+                    self.store.block = None
+                self.assertEqual(status["state"], "stopped")
+                self.assertTrue(gate.entered.is_set())
+
+    async def test_probe_without_an_address_reads_settings_off_loop(self):
+        app = web.Application()
+
+        async def health(request):
+            return web.json_response({"executor": True, "storePath": str(self.store.root)})
+
+        app.router.add_get("/spool/api/health", health)
+        async with TestServer(app) as server:
+            self.launcher.save(self.settings(comfyUrl=str(server.make_url("/"))))
+            gate = Gate(hold=0.5)
+            self.store.block = ("setting", "comfy_startup", gate)
+            try:
+                state, error = await self.assert_loop_progress(self.launcher.probe)
+            finally:
+                self.store.block = None
+        self.assertEqual((state, error), ("connected", None))
+        self.assertTrue(gate.entered.is_set())
+
+    async def test_startup_file_scan_does_not_stall_the_loop(self):
+        portable = self.root / "ComfyUI_windows_portable"
+        (portable / "python_embeded").mkdir(parents=True)
+        (portable / "python_embeded" / "python.exe").write_bytes(b"")
+        (portable / "run_spool.bat").write_text("", encoding="utf-8")
+        (portable / "run_Deadline.bat").write_text("", encoding="utf-8")
+        checkout = portable / "ComfyUI" / "custom_nodes" / "Spool" / "spool" / "launcher.py"
+        gate = Gate(hold=0.5)
+        real_glob = Path.glob
+
+        def glob(path, pattern):
+            if pattern == "run*.bat":
+                gate.wait()
+            return real_glob(path, pattern)
+
+        self.launcher.probe = AsyncMock(return_value=("stopped", None))
+        with (
+            patch("spool.launcher.__file__", str(checkout)),
+            patch.object(Path, "glob", glob),
+        ):
+            status = await self.assert_loop_progress(self.launcher.status)
+        self.assertEqual(status["startupFiles"], [str(portable / "run_spool.bat")])
+        self.assertTrue(gate.entered.is_set())
+
+    async def test_start_spawn_does_not_stall_the_loop(self):
+        self.launcher.save(self.settings())
+        gate = Gate(hold=0.5)
+        process = Mock(poll=lambda: None)
+        spawned = []
+
+        def popen(*args, **kwargs):
+            gate.wait()
+            spawned.append((args, kwargs))
+            return process
+
+        with (
+            patch.object(self.launcher, "probe", AsyncMock(return_value=("stopped", None))),
+            patch("spool.launcher.subprocess.Popen", side_effect=popen),
+        ):
+            status = await self.assert_loop_progress(self.launcher.start)
+        self.assertEqual(status["state"], "starting")
+        self.assertEqual(len(spawned), 1)
+        self.assertIs(self.launcher.process, process)
+
+    async def test_lifecycle_settings_read_does_not_stall_the_loop(self):
+        gate = Gate(hold=0.5)
+        self.store.block = ("setting", "comfy_startup", gate)
+        lifecycle = self.launcher.lifecycle(None)
+        with patch.object(self.launcher, "start", new_callable=AsyncMock) as start:
+            try:
+                await self.assert_loop_progress(lambda: anext(lifecycle))
+            finally:
+                await lifecycle.aclose()
+            start.assert_not_awaited()
+        self.assertTrue(gate.entered.is_set())
+
+    async def test_blocked_status_leaves_an_unrelated_http_request_responsive(self):
+        gate = Gate()
+        self.addCleanup(gate.release)
+        self.store.block = ("setting", "comfy_launch", gate)
+        self.launcher.probe = AsyncMock(return_value=("stopped", None))
+        app = web.Application()
+
+        async def status(request):
+            return web.json_response(await self.launcher.status())
+
+        async def ping(request):
+            return web.json_response({"ok": True})
+
+        app.router.add_get("/status", status)
+        app.router.add_get("/ping", ping)
+        async with TestClient(TestServer(app)) as client:
+            blocked = asyncio.create_task(client.get("/status"))
+            await asyncio.to_thread(gate.entered.wait, 5)
+            response = await asyncio.wait_for(client.get("/ping"), 0.5)
+            self.assertEqual(response.status, 200)
+            self.assertFalse(blocked.done())
+            gate.release()
+            self.assertEqual((await blocked).status, 200)
+
+    async def test_cancelled_start_drains_spawn_before_releasing_startup(self):
+        self.launcher.save(self.settings())
+        gate = Gate()
+        self.addCleanup(gate.release)
+        process = Mock(poll=lambda: None)
+        spawned = []
+
+        def popen(*args, **kwargs):
+            gate.wait()
+            spawned.append((args, kwargs))
+            return process
+
+        with (
+            patch.object(self.launcher, "probe", AsyncMock(return_value=("stopped", None))),
+            patch("spool.launcher.subprocess.Popen", side_effect=popen),
+        ):
+            task = asyncio.create_task(self.launcher.start())
+            await asyncio.to_thread(gate.entered.wait, 5)
+            task.cancel()
+            await asyncio.sleep(0.05)
+            # The launch worker still owns startup while it is about to spawn.
+            self.assertFalse(task.done())
+            self.assertEqual(spawned, [])
+            gate.release()
+            with self.assertRaises(asyncio.CancelledError):
+                await task
+            self.assertEqual(len(spawned), 1)
+            self.assertIs(self.launcher.process, process)
+            self.assertEqual(self.store.setting("comfy_launch")["state"], "starting")
+            with patch("spool.launcher.subprocess.Popen") as second_spawn:
+                status = await self.launcher.start()
+            second_spawn.assert_not_called()
+        self.assertEqual(status["state"], "starting")
+        self.assertEqual(len(spawned), 1)
+
+    async def test_cancelled_status_drains_the_launch_state_write(self):
+        self.store.set_setting("comfy_launch", {"state": "starting", "created": time.time()})
+        gate = Gate()
+        self.addCleanup(gate.release)
+        self.launcher.probe = AsyncMock(return_value=("connected", None))
+        replace = self.launcher._replace_launch
+
+        def held_replace(*args):
+            gate.wait()
+            return replace(*args)
+
+        with patch.object(self.launcher, "_replace_launch", held_replace):
+            task = asyncio.create_task(self.launcher.status())
+            self.assertTrue(await asyncio.to_thread(gate.entered.wait, 5))
+            task.cancel()
+            await asyncio.sleep(0.05)
+            self.assertFalse(task.done())
+            gate.release()
+            with self.assertRaises(asyncio.CancelledError):
+                await task
+        self.assertEqual(self.store.setting("comfy_launch")["state"], "connected")
+
+    async def test_settings_saved_during_start_keep_the_startup_reservation(self):
+        self.launcher.save(self.settings())
+        gate = Gate()
+        self.addCleanup(gate.release)
+        process = Mock(poll=lambda: None)
+        spawned = []
+
+        def popen(*args, **kwargs):
+            gate.wait()
+            spawned.append((args, kwargs))
+            return process
+
+        with (
+            patch.object(self.launcher, "probe", AsyncMock(return_value=("stopped", None))),
+            patch("spool.launcher.subprocess.Popen", side_effect=popen),
+        ):
+            task = asyncio.create_task(self.launcher.start())
+            await asyncio.to_thread(gate.entered.wait, 5)
+            with self.assertRaises(Conflict):
+                await asyncio.to_thread(self.launcher.save, self.settings(comfyUrl="http://127.0.0.1:8188"))
+            await asyncio.to_thread(self.launcher.save, self.settings())
+            second = ComfyLauncher(self.store)
+            with patch.object(second, "probe", AsyncMock(return_value=("stopped", None))):
+                status = await second.start()
+            self.assertEqual(status["state"], "starting")
+            gate.release()
+            self.assertEqual((await task)["state"], "starting")
+        self.assertEqual(len(spawned), 1)
+        self.assertEqual(self.launcher.settings()["comfyUrl"], "http://127.0.0.1:8195")
+
+    async def test_delayed_status_write_preserves_a_new_launch_reservation(self):
+        old = {"id": "old", "state": "starting", "created": time.time() - 300}
+        self.store.set_setting("comfy_launch", old)
+        self.launcher.probe = AsyncMock(return_value=("connected", None))
+        gate = Gate()
+        self.addCleanup(gate.release)
+        replace = self.launcher._replace_launch
+
+        def held_replace(*args):
+            gate.wait()
+            return replace(*args)
+
+        with patch.object(self.launcher, "_replace_launch", held_replace):
+            status = asyncio.create_task(self.launcher.status())
+            try:
+                self.assertTrue(await asyncio.to_thread(gate.entered.wait, 5))
+                next_launcher = ComfyLauncher(self.store)
+                with patch("spool.launcher.subprocess.Popen", return_value=Mock(poll=lambda: None)):
+                    started = await asyncio.to_thread(
+                        next_launcher._launch, self.settings(), "new", self.store.root / "logs" / "new.log"
+                    )
+                self.assertTrue(started)
+                self.assertEqual(self.store.setting("comfy_launch")["id"], "new")
+            finally:
+                gate.release()
+                await status
+        self.assertEqual(self.store.setting("comfy_launch")["id"], "new")
+
+    async def test_delayed_spawn_failure_preserves_a_new_launch_reservation(self):
+        gate = Gate()
+        self.addCleanup(gate.release)
+        spawn_error = OSError("old spawn failed")
+        calls = []
+
+        def popen(*args, **kwargs):
+            calls.append(True)
+            if len(calls) == 1:
+                gate.wait()
+                raise spawn_error
+            return Mock(poll=lambda: None)
+
+        with patch("spool.launcher.subprocess.Popen", side_effect=popen):
+            first = asyncio.create_task(
+                asyncio.to_thread(self.launcher._launch, self.settings(), "old", self.store.root / "logs" / "old.log")
+            )
+            try:
+                self.assertTrue(await asyncio.to_thread(gate.entered.wait, 5))
+                # An expired reservation may be replaced while its spawn worker
+                # is still waiting on the operating system or a network drive.
+                reservation = self.store.setting("comfy_launch")
+                self.store.set_setting("comfy_launch", {**reservation, "created": time.time() - 300})
+                next_launcher = ComfyLauncher(self.store)
+                self.assertTrue(
+                    await asyncio.to_thread(
+                        next_launcher._launch, self.settings(), "new", self.store.root / "logs" / "new.log"
+                    )
+                )
+            finally:
+                gate.release()
+                with self.assertRaisesRegex(ValueError, "old spawn failed"):
+                    await first
+        self.assertEqual(self.store.setting("comfy_launch")["id"], "new")
+        self.assertEqual(self.store.setting("comfy_launch")["state"], "starting")
diff --git a/tests/test_maintenance_publication.py b/tests/test_maintenance_publication.py
new file mode 100644
index 0000000..bd2c849
--- /dev/null
+++ b/tests/test_maintenance_publication.py
@@ -0,0 +1,420 @@
+"""Read-only maintenance pins private generations without obstructing publication."""
+
+import contextlib
+import io
+import json
+import os
+import shutil
+import sqlite3
+import subprocess
+import sys
+import tempfile
+import time
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+from spool import maintenance
+from spool.errors import NotFound
+from spool.projects import ProjectStore, Workspace, existing_project_lock
+from spool.store import SCHEMA_VERSION, Conflict
+
+
+ROOT = Path(__file__).resolve().parent.parent
+FIXTURES = Path(__file__).parent / "fixtures"
+READ_STATE = "SELECT revision, json_extract(document,'$.project') FROM projects"
+
+# Exercise the production CLI dispatcher. The only interception pauses a real
+# source copy or SQLite reader, leaving its handle open until the writer finishes.
+MAINTENANCE_CHILD = r"""
+import contextlib
+import json
+import runpy
+import sqlite3
+import sys
+import time
+from pathlib import Path
+from unittest.mock import patch
+
+from spool.projects import ProjectStore
+from spool.store import read_only_uri
+
+mode, command, folder, ready_name, release_name, result_name = sys.argv[1:]
+ready, release, result = map(Path, (ready_name, release_name, result_name))
+observed = {}
+query = "SELECT revision, json_extract(document,'$.project') FROM projects"
+
+def wait():
+    pending = ready.with_suffix(".partial")
+    pending.write_text(json.dumps(observed))
+    pending.replace(ready)
+    deadline = time.monotonic() + 30
+    while not release.exists():
+        if time.monotonic() >= deadline:
+            raise RuntimeError("writer did not release maintenance")
+        time.sleep(0.01)
+
+reading = ProjectStore.reading
+
+@contextlib.contextmanager
+def paused_reading(store):
+    with reading(store) as db:
+        if store.read_only and hasattr(store, "path") and "before" not in observed:
+            observed["database"] = db.execute("PRAGMA database_list").fetchone()[2]
+            observed["before"] = list(db.execute(query).fetchone())
+            if mode == "reader":
+                wait()
+            yield db
+            observed["after"] = list(db.execute(query).fetchone())
+        else:
+            yield db
+
+def paused_copy(source, target, length=0):
+    # Pause after consuming only a prefix: the remainder must still come from
+    # this same immutable generation after project.spool has been replaced.
+    target.write(source.read(4096))
+    first = "source" not in observed
+    if first:
+        observed["source"] = str(source.name)
+        wait()
+    while chunk := source.read(65536):
+        target.write(chunk)
+    if first:
+        target.flush()
+        with contextlib.closing(sqlite3.connect(read_only_uri(Path(target.name)), uri=True)) as db:
+            observed["copied"] = list(db.execute(query).fetchone())
+
+sys.argv = ["spool", command, "--storage", folder, "--json"]
+with contextlib.ExitStack() as stack:
+    stack.enter_context(patch.object(ProjectStore, "reading", paused_reading))
+    if mode == "copy":
+        stack.enter_context(patch("spool.projects.shutil.copyfileobj", paused_copy))
+    try:
+        runpy.run_module("spool", run_name="__main__")
+    except SystemExit as done:
+        if done.code:
+            raise
+result.write_text(json.dumps(observed))
+"""
+
+WRITER_CHILD = r"""
+import contextlib
+import json
+import sys
+from pathlib import Path
+from unittest.mock import patch
+from spool.projects import Workspace
+from spool.projects import file_lock
+
+@contextlib.contextmanager
+def observed_lock(path):
+    if len(sys.argv) > 4 and path == Path(sys.argv[2]) / ".spool" / "project.lock":
+        Path(sys.argv[4]).touch()
+    with file_lock(path):
+        yield
+
+workspace = Workspace(sys.argv[1])
+with patch("spool.projects.file_lock", observed_lock):
+    current = workspace.open_folder(sys.argv[2])
+    store = workspace.for_project(current["id"])
+    saved = store.save(current["id"], current["revision"], {**current["document"], "project": sys.argv[3]})
+print(json.dumps([saved["revision"], saved["document"]["project"]]))
+"""
+
+
+class MaintenancePublicationTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name)
+        self.workspace = Workspace(self.root / "app")
+        self.folder = self.root / "Film #1"
+        self.project = self.workspace.create({"project": "Before", "clips": [], "media": []}, self.folder)
+
+    def start_maintenance(self, mode, command):
+        ready = self.root / (mode + command + "-ready.json")
+        release = self.root / (mode + command + "-release")
+        result = self.root / (mode + command + "-result.json")
+        process = subprocess.Popen(
+            [
+                sys.executable,
+                "-c",
+                MAINTENANCE_CHILD,
+                mode,
+                command,
+                str(self.folder),
+                str(ready),
+                str(release),
+                str(result),
+            ],
+            cwd=ROOT,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            text=True,
+        )
+        deadline = time.monotonic() + 15
+        try:
+            while not ready.exists():
+                if process.poll() is not None:
+                    stdout, stderr = process.communicate()
+                    self.fail(f"Maintenance exited before opening its handle: {stdout}\n{stderr}")
+                if time.monotonic() >= deadline:
+                    self.fail("Maintenance did not open its handle")
+                time.sleep(0.01)
+            # The ready file is written before the child starts waiting.
+            observed = json.loads(ready.read_text())
+            return process, release, result, observed
+        except BaseException:
+            release.touch()
+            process.communicate(timeout=10)
+            raise
+
+    def publish(self, name):
+        result = subprocess.run(
+            [sys.executable, "-c", WRITER_CHILD, str(self.root / (name + "-app")), str(self.folder), name],
+            cwd=ROOT,
+            capture_output=True,
+            text=True,
+            timeout=20,
+        )
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+        return json.loads(result.stdout)
+
+    def test_cli_dry_run_reader_does_not_block_another_process_publication(self):
+        for command in ("prune", "reclaim"):
+            with self.subTest(command=command):
+                process, release, result, observed = self.start_maintenance("reader", command)
+                try:
+                    database = Path(observed["database"])
+                    saved = self.publish(command)
+                    self.assertNotEqual(database, self.folder / "project.spool")
+                    self.assertFalse(database.is_relative_to(self.folder))
+                    self.assertTrue(database.is_file())
+                    self.assertIsNone(process.poll(), "Maintenance must still hold its SQLite handle")
+                    self.assertGreater(saved[0], observed["before"][0])
+                finally:
+                    release.touch()
+                    stdout, stderr = process.communicate(timeout=15)
+                self.assertEqual(process.returncode, 0, stdout + stderr)
+                self.assertIsInstance(json.loads(stdout), dict)
+                final = json.loads(result.read_text())
+                self.assertEqual(final["before"], final["after"])
+                self.assertFalse(database.parent.exists(), "Private generations must be cleaned up")
+                with ProjectStore(self.folder, migrate=False).reading() as db:
+                    self.assertEqual(list(db.execute(READ_STATE).fetchone()), saved)
+
+    def test_slow_source_copy_coordinates_with_a_writer_and_retains_one_generation(self):
+        self.assert_slow_copy_serializes_writer()
+
+    def test_empty_lock_source_copy_coordinates_with_a_writer(self):
+        (self.folder / ".spool" / "project.lock").write_bytes(b"")
+        self.assert_slow_copy_serializes_writer()
+
+    def assert_slow_copy_serializes_writer(self):
+        process, release, result, observed = self.start_maintenance("copy", "reclaim")
+        attempted = self.root / "writer-attempted"
+        writer = subprocess.Popen(
+            [
+                sys.executable,
+                "-c",
+                WRITER_CHILD,
+                str(self.root / "copy-app"),
+                str(self.folder),
+                "During copy",
+                str(attempted),
+            ],
+            cwd=ROOT,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            text=True,
+        )
+        try:
+            deadline = time.monotonic() + 10
+            while not attempted.exists():
+                self.assertIsNone(writer.poll(), "Writer must try acquiring the project lock")
+                self.assertLess(time.monotonic(), deadline)
+                time.sleep(0.01)
+            # Longer than atomic_replace's retry window: the writer waits on
+            # the lock instead of trying to replace an open Windows source.
+            with self.assertRaises(subprocess.TimeoutExpired):
+                writer.communicate(timeout=2.2)
+            self.assertIsNone(process.poll(), "The snapshot source handle must still be open")
+        finally:
+            release.touch()
+            writer_stdout, writer_stderr = writer.communicate(timeout=15)
+            stdout, stderr = process.communicate(timeout=15)
+        self.assertEqual(writer.returncode, 0, writer_stdout + writer_stderr)
+        saved = json.loads(writer_stdout)
+        self.assertEqual(process.returncode, 0, stdout + stderr)
+        final = json.loads(result.read_text())
+        before = [self.project["revision"], "Before"]
+        self.assertEqual(final["copied"], before)
+        self.assertIn(final["before"], (before, saved))
+        self.assertEqual(final["after"], final["before"])
+        self.assertFalse(Path(final["database"]).parent.exists())
+        with ProjectStore(self.folder, migrate=False).reading() as db:
+            self.assertEqual(list(db.execute(READ_STATE).fetchone()), saved)
+
+    def test_legacy_reports_do_not_create_migrate_recover_or_use_project_locks(self):
+        folder = self.root / "legacy"
+        folder.mkdir()
+        shutil.copyfile(FIXTURES / "project-schema5.spool", folder / "project.spool")
+        before = {p.relative_to(folder): p.read_bytes() for p in folder.rglob("*") if p.is_file()}
+        with (
+            patch("spool.projects.file_lock", side_effect=AssertionError("No project lock writes")),
+            patch("spool.projects.take_files.recover", side_effect=AssertionError("No recovery")),
+            contextlib.redirect_stdout(io.StringIO()),
+        ):
+            for command in (maintenance.run, maintenance.run_prune):
+                self.assertEqual(command(["--storage", str(folder), "--json"]), 0)
+        self.assertEqual({p.relative_to(folder): p.read_bytes() for p in folder.rglob("*") if p.is_file()}, before)
+        self.assertFalse((folder / ".spool").exists())
+
+        # An existing but empty, read-only lock file must not acquire a byte.
+        (folder / ".spool").mkdir()
+        lock = folder / ".spool" / "project.lock"
+        lock.touch()
+        lock.chmod(0o444)
+        self.addCleanup(lock.chmod, 0o666)
+        with patch("spool.projects.file_lock", side_effect=AssertionError("No project lock writes")):
+            store = ProjectStore(folder, migrate=False)
+            with store.connect() as db:
+                self.assertEqual(db.execute("PRAGMA user_version").fetchone()[0], 5)
+                self.assertIsNone(
+                    db.execute("SELECT name FROM sqlite_master WHERE name='spool_publication'").fetchone()
+                )
+                with self.assertRaises(sqlite3.OperationalError):
+                    db.execute("CREATE TABLE forbidden(id)")
+        self.assertEqual(lock.read_bytes(), b"")
+
+    def test_private_generations_clean_up_on_reader_copy_and_open_failures(self):
+        store = ProjectStore(self.folder, migrate=False)
+        with self.assertRaisesRegex(RuntimeError, "report interrupted"):
+            with store.reading() as db:
+                database = Path(db.execute("PRAGMA database_list").fetchone()[2])
+                raise RuntimeError("report interrupted")
+        self.assertFalse(database.parent.exists())
+
+        temporary = tempfile.TemporaryDirectory
+        generations = []
+        path_open = Path.open
+        handles = []
+
+        def tracked_open(path, *args, **kwargs):
+            handle = path_open(path, *args, **kwargs)
+            if path in (store.snapshot, store.lock_file):
+                handles.append(handle)
+            return handle
+
+        def tracked_temporary(*args, **kwargs):
+            directory = temporary(*args, **kwargs)
+            generations.append(Path(directory.name))
+            return directory
+
+        with (
+            patch("spool.projects.tempfile.TemporaryDirectory", tracked_temporary),
+            patch.object(Path, "open", tracked_open),
+        ):
+            with patch("spool.projects.shutil.copyfileobj", side_effect=OSError("copy interrupted")):
+                with self.assertRaisesRegex(OSError, "copy interrupted"):
+                    with store.reading():
+                        self.fail("Incomplete copies must never be opened")
+            with patch("spool.projects.sqlite3.connect", side_effect=sqlite3.DatabaseError("open interrupted")):
+                with self.assertRaisesRegex(sqlite3.DatabaseError, "open interrupted"):
+                    with store.reading():
+                        self.fail("Unreadable snapshots must fail")
+        self.assertEqual(len(generations), 2)
+        self.assertTrue(all(not path.exists() for path in generations))
+        self.assertEqual(len(handles), 4)
+        self.assertTrue(all(handle.closed for handle in handles))
+
+    def test_constructor_and_new_reads_validate_private_schema_before_reporting(self):
+        folder = self.root / "newer"
+        folder.mkdir()
+        snapshot = folder / "project.spool"
+        with contextlib.closing(sqlite3.connect(snapshot)) as db:
+            db.execute(f"PRAGMA user_version={SCHEMA_VERSION + 1}")
+        before = snapshot.read_bytes()
+        connect = sqlite3.connect
+        opened = []
+
+        def private_connect(path, *args, **kwargs):
+            self.assertNotIn("project.spool", str(path))
+            db = connect(path, *args, **kwargs)
+            opened.append(Path(db.execute("PRAGMA database_list").fetchone()[2]))
+            return db
+
+        with patch("spool.projects.sqlite3.connect", private_connect):
+            with self.assertRaisesRegex(ValueError, "newer extension"):
+                ProjectStore(folder, migrate=False)
+        self.assertEqual(snapshot.read_bytes(), before)
+        self.assertEqual(list(folder.iterdir()), [snapshot])
+        self.assertEqual(len(opened), 1)
+        self.assertFalse(opened[0].parent.exists())
+
+        store = ProjectStore(self.folder, migrate=False)
+        # A different publisher can change the format after construction.
+        replacement = self.root / "newer.spool"
+        shutil.copyfile(snapshot, replacement)
+        replacement.replace(store.snapshot)
+        with self.assertRaisesRegex(ValueError, "newer extension"):
+            with store.reading():
+                self.fail("A newer publication must never be reported as compatible")
+
+    @unittest.skipUnless(os.name == "nt", "Native Windows read-only byte locks")
+    def test_native_lock_failures_close_the_read_only_handle_without_copying(self):
+        from unittest.mock import Mock
+
+        lock = self.folder / ".spool" / "project.lock"
+        path_open = Path.open
+        opened = []
+
+        def tracked_open(path, *args, **kwargs):
+            handle = path_open(path, *args, **kwargs)
+            if path == lock:
+                opened.append(handle)
+            return handle
+
+        with patch.object(Path, "open", tracked_open):
+            with patch("msvcrt.get_osfhandle", side_effect=OSError("handle unavailable")):
+                with self.assertRaisesRegex(OSError, "handle unavailable"):
+                    with existing_project_lock(lock):
+                        self.fail("Handle errors must not allow uncoordinated copies")
+            for error_code in (5, 87):
+                kernel = Mock()
+                kernel.LockFile.return_value = False
+                with (
+                    patch("ctypes.WinDLL", return_value=kernel),
+                    patch("ctypes.get_last_error", return_value=error_code),
+                ):
+                    with self.assertRaises(OSError) as raised:
+                        with existing_project_lock(lock):
+                            self.fail("Lock errors must not allow uncoordinated copies")
+                self.assertEqual(raised.exception.winerror, error_code)
+                kernel.UnlockFile.assert_not_called()
+            with (
+                patch("ctypes.WinDLL", return_value=kernel),
+                patch("ctypes.get_last_error", return_value=33),
+                patch("spool.projects.time.monotonic", side_effect=(0, 31)),
+            ):
+                with self.assertRaisesRegex(Conflict, "busy in another editor"):
+                    with existing_project_lock(lock):
+                        self.fail("Timed-out locks must not allow uncoordinated copies")
+            kernel.UnlockFile.assert_not_called()
+        self.assertEqual(len(opened), 4)
+        self.assertTrue(all(handle.closed for handle in opened))
+
+    def test_missing_snapshot_does_not_create_project_or_local_cache(self):
+        folder = self.root / "missing"
+        with patch("spool.projects.tempfile.TemporaryDirectory", side_effect=AssertionError("No missing copy")):
+            with self.assertRaises(NotFound):
+                ProjectStore(folder, migrate=False)
+            with contextlib.redirect_stderr(io.StringIO()):
+                for command in (maintenance.run, maintenance.run_prune):
+                    with self.assertRaises(SystemExit):
+                        command(["--storage", str(folder), "--json"])
+        self.assertFalse(folder.exists())
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_many_cut_import.py b/tests/test_many_cut_import.py
new file mode 100644
index 0000000..df84aec
--- /dev/null
+++ b/tests/test_many_cut_import.py
@@ -0,0 +1,589 @@
+"""Bounded split commands retain exact cuts and the review files' short GOPs."""
+
+import json
+import os
+import re
+import shutil
+import subprocess
+import sys
+import tempfile
+import unittest
+from fractions import Fraction
+from pathlib import Path
+from unittest.mock import patch
+
+from PIL import Image
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+from spool.media import Media, _SPLIT_COMMAND_BUDGET, _command_length, _probe, _split_commands, sha256
+
+FFPROBE = shutil.which("ffprobe")
+FFMPEG = shutil.which("ffmpeg", path=str(Path(FFPROBE).parent)) if FFPROBE else None
+FFMPEG_FOLDER = str(Path(FFPROBE).parent) if FFPROBE else None
+WINDOWS_COMMAND_LIMIT = 32767
+
+
+def _frame_color(index):
+    return (16 + (index % 10) * 24, 16 + ((index // 10) % 10) * 24, 16 + ((index // 100) % 10) * 24)
+
+
+def _make_source(path, rate, frames, audio=False):
+    images = path.parent / (path.stem + "-frames")
+    images.mkdir()
+    for index in range(frames):
+        Image.new("RGB", (64, 36), _frame_color(index)).save(images / f"{index:05d}.png")
+    command = [FFMPEG, "-v", "error", "-y", "-framerate", rate, "-i", str(images / "%05d.png")]
+    if audio:
+        command += [
+            "-f",
+            "lavfi",
+            "-i",
+            "sine=frequency=440:sample_rate=48000",
+            "-map",
+            "0:v:0",
+            "-map",
+            "1:a:0",
+            "-c:a",
+            "aac",
+            "-shortest",
+        ]
+    command += ["-c:v", "libx264", "-pix_fmt", "yuv420p", "-g", "6", "-bf", "0", str(path)]
+    subprocess.run(command, check=True, capture_output=True, timeout=120)
+    shutil.rmtree(images)
+    return path
+
+
+class SplitCommandTests(unittest.TestCase):
+    def assert_plan(self, commands, cuts, frames):
+        reconstructed, start, first = [], 0, 0
+        for command in commands:
+            length = len(subprocess.list2cmdline(command).encode("utf-16-le")) // 2 + 1
+            self.assertEqual(_command_length(command), length)
+            self.assertLess(length, WINDOWS_COMMAND_LIMIT)
+            self.assertLessEqual(length, _SPLIT_COMMAND_BUDGET)
+            self.assertEqual(command[command.index("-g") + 1], "6")
+            count = int(command[command.index("-frames:v") + 1])
+            local = []
+            if "-segment_frames" in command:
+                local = list(map(int, command[command.index("-segment_frames") + 1].split(",")))
+                expression = command[command.index("-force_key_frames") + 1]
+                self.assertTrue(expression.startswith("expr:"))
+                self.assertEqual([int(value) for value in re.findall(r"eq\(n,(\d+)\)", expression)], local)
+                self.assertEqual(int(command[command.index("-segment_start_number") + 1]), first)
+            else:
+                self.assertEqual(Path(command[-1]).name, f"{first:03d}.mp4")
+            if start:
+                reconstructed.append(start)
+                self.assertIn("-copyts", command)
+                self.assertLess(int(command[command.index("-ss") + 1][:-2]), start * 1_000_000 * 1001 // 30000)
+            reconstructed.extend(start + cut for cut in local)
+            start += count
+            first += len(local) + 1
+        self.assertEqual(reconstructed, cuts)
+        self.assertEqual(start, frames)
+
+    def test_1800_and_20000_cut_plans_bound_both_lists_and_encode_every_frame_once(self):
+        # Structural command evidence with a consistent large proxy frame count;
+        # this does not claim to encode an 1800-shot import or its posters.
+        for count in (1800, 20000):
+            with self.subTest(cuts=count):
+                cuts = [10000 + index * 10 for index in range(count)]
+                frames = cuts[-1] + 1000
+                commands = list(
+                    _split_commands(
+                        "C:/tools/ffmpeg.exe",
+                        Path("C:/source clip's żółć 🧵/proxy.mp4"),
+                        Path("C:/project ' ü 🧵/shots"),
+                        cuts,
+                        frames,
+                        Fraction(30000, 1001),
+                        Fraction(1, 30000),
+                    )
+                )
+                self.assertGreater(len(commands), 1)
+                self.assertLess(len(commands), count // 100)
+                self.assert_plan(commands, cuts, frames)
+
+    def test_budget_includes_quoted_paths_and_surrogate_pairs(self):
+        folder = Path("C:/" + "long folder 🧵 ' " * 300 + "/shots")
+        commands = list(
+            _split_commands(
+                "ffmpeg",
+                Path("source clip's ü.mp4"),
+                folder,
+                list(range(1, 5000)),
+                5001,
+                Fraction(30000, 1001),
+                Fraction(1, 30000),
+            )
+        )
+        self.assertGreaterEqual(len(commands), 4)
+        self.assert_plan(commands, list(range(1, 5000)), 5001)
+        with self.assertRaisesRegex(ValueError, "path is too long"):
+            list(_split_commands("ffmpeg", Path("🧵" * 13000), folder, [], 1, None, None))
+
+    def test_frame_target_meets_at_cuts_and_keeps_a_long_shot_whole(self):
+        with patch("spool.media._SPLIT_BATCH_FRAMES", 100):
+            commands = list(
+                _split_commands(
+                    "ffmpeg",
+                    Path("proxy.mp4"),
+                    Path("shots"),
+                    [7, 99, 123, 500, 550],
+                    600,
+                    Fraction(30000, 1001),
+                    Fraction(1, 30000),
+                )
+            )
+        self.assertEqual([int(c[c.index("-frames:v") + 1]) for c in commands], [99, 24, 377, 100])
+        self.assert_plan(commands, [7, 99, 123, 500, 550], 600)
+
+
+@unittest.skipUnless(FFMPEG and FFPROBE, "ffmpeg and ffprobe are required")
+class ManyCutImportTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        # Scoped to this Python process; the machine PATH is never modified.
+        cls.path = patch.dict(os.environ, {"PATH": FFMPEG_FOLDER + os.pathsep + os.environ.get("PATH", "")})
+        cls.path.start()
+        cls.fixtures = tempfile.TemporaryDirectory(prefix="spool-many-cut-fixtures-")
+        cls.addClassCleanup(cls.fixtures.cleanup)
+        cls.addClassCleanup(cls.path.stop)
+        folder = Path(cls.fixtures.name)
+        cls.sources = {
+            "30": (_make_source(folder / "source clip's żółć 30.mp4", "30000/1001", 600, audio=True), 600),
+            "24": (_make_source(folder / "source clip's żółć 24.mp4", "24000/1001", 480), 480),
+        }
+
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory(prefix="spool-many-cut-")
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name) / "project ' ü"
+        self.root.mkdir()
+        for name in ("input", "output", "temp"):
+            (self.root / name).mkdir()
+        self.media = Media(self.root / "store", self.root / "input", self.root / "output", self.root / "temp")
+
+    def import_with_cuts(self, source, cuts, fps):
+        with patch("spool.media.scene_scores", return_value=[]), patch("spool.media.detect_cuts", return_value=cuts):
+            return self.media.import_footage(source, fps=fps)
+
+    def test_worst_many_cut_batch_executes_with_a_real_full_length_source(self):
+        source = self.root / "parser-source.mp4"
+        frames = 28020
+        subprocess.run(
+            [
+                FFMPEG,
+                "-v",
+                "error",
+                "-y",
+                "-f",
+                "lavfi",
+                "-i",
+                "color=red:s=64x36:r=30000/1001",
+                "-frames:v",
+                str(frames),
+                "-c:v",
+                "libx264",
+                "-preset",
+                "ultrafast",
+                "-g",
+                "6",
+                "-bf",
+                "0",
+                str(source),
+            ],
+            check=True,
+            capture_output=True,
+            timeout=120,
+        )
+        stream = _probe(source)["streams"][0]
+        folder = self.root / "parser-shots"
+        folder.mkdir()
+        cuts = [10000 + index * 10 for index in range(1800)]
+        commands = list(
+            _split_commands(
+                FFMPEG,
+                source,
+                folder,
+                cuts,
+                frames,
+                Fraction(stream["avg_frame_rate"]),
+                Fraction(stream["time_base"]),
+                int(stream.get("start_pts", 0)),
+            )
+        )
+        command = max(commands, key=_command_length)
+        local_cuts = command[command.index("-segment_frames") + 1].split(",")
+        self.assertGreater(len(local_cuts), 100)
+        self.assertLessEqual(_command_length(command), _SPLIT_COMMAND_BUDGET)
+        result = subprocess.run(command, capture_output=True, timeout=120)
+        self.assertEqual(result.returncode, 0, result.stderr.decode("utf-8", errors="replace")[-2000:])
+        segments = sorted(folder.glob("*.mp4"), key=lambda path: int(path.stem))
+        self.assertEqual(len(segments), len(local_cuts) + 1)
+        # A single decoder checks the entire real batch without one ffprobe
+        # process per shot. Relative numeric names need no path escaping.
+        manifest = folder / "verify.ffconcat"
+        manifest.write_text("ffconcat version 1.0\n" + "".join(f"file '{path.name}'\n" for path in segments))
+        counted = subprocess.run(
+            [
+                FFPROBE,
+                "-v",
+                "error",
+                "-f",
+                "concat",
+                "-safe",
+                "0",
+                "-i",
+                str(manifest),
+                "-select_streams",
+                "v:0",
+                "-count_frames",
+                "-show_entries",
+                "stream=nb_read_frames",
+                "-of",
+                "json",
+            ],
+            check=True,
+            capture_output=True,
+            timeout=120,
+        )
+        self.assertEqual(
+            int(json.loads(counted.stdout)["streams"][0]["nb_read_frames"]),
+            int(command[command.index("-frames:v") + 1]),
+        )
+
+    def shot_color(self, path, frame, width=960, height=540):
+        raw = subprocess.run(
+            [
+                FFMPEG,
+                "-v",
+                "error",
+                "-i",
+                str(path),
+                "-vf",
+                f"select=eq(n\\,{frame})",
+                "-frames:v",
+                "1",
+                "-f",
+                "rawvideo",
+                "-pix_fmt",
+                "rgb24",
+                "-",
+            ],
+            check=True,
+            capture_output=True,
+            timeout=60,
+        ).stdout
+        offset = ((height // 2) * width + width // 2) * 3
+        return tuple(raw[offset : offset + 3])
+
+    def assert_color(self, actual, expected):
+        self.assertEqual(len(actual), 3)
+        for got, want in zip(actual, expected):
+            # Below half the 24-level frame step, so an adjacent frame fails.
+            self.assertLessEqual(abs(got - want), 8, (actual, expected))
+
+    def assert_short_gop(self, path, count):
+        frames = json.loads(
+            subprocess.run(
+                [
+                    FFPROBE,
+                    "-v",
+                    "error",
+                    "-select_streams",
+                    "v:0",
+                    "-show_frames",
+                    "-show_entries",
+                    "frame=key_frame",
+                    "-of",
+                    "json",
+                    str(path),
+                ],
+                check=True,
+                capture_output=True,
+                timeout=60,
+            ).stdout
+        )["frames"]
+        self.assertEqual(len(frames), count)
+        keys = [index for index, frame in enumerate(frames) if frame["key_frame"]]
+        self.assertEqual(keys[0], 0)
+        self.assertLessEqual(max(b - a for a, b in zip(keys, [*keys[1:], count])), 6)
+
+    def test_fractional_imports_cross_batches_with_exact_ranges_colors_and_short_gops(self):
+        cases = {"30": [7, 143, 213, 391, 512], "24": [5, 129, 211, 317, 401]}
+        for key, cuts in cases.items():
+            with self.subTest(rate=key):
+                source, frame_count = self.sources[key]
+                before = sha256(source)
+                rate = 30000 / 1001 if key == "30" else 24000 / 1001
+                whole_before = self.media.describe(source, fps=rate)
+                proxy = self.media.resolve(whole_before["file"])
+                proxy_before = sha256(proxy)
+                real_run, batches = subprocess.run, []
+
+                def capture(command, **options):
+                    if "-frames:v" in command and "-c:v" in command:
+                        batches.append(command)
+                    return real_run(command, **options)
+
+                with (
+                    patch("spool.media._SPLIT_BATCH_FRAMES", 180),
+                    patch("spool.media.subprocess.run", side_effect=capture),
+                ):
+                    result = self.import_with_cuts(source, cuts, rate)
+                self.assertGreaterEqual(len(batches), 3)
+                whole = result["source"]
+                self.assertEqual(whole["frames"], frame_count)
+                self.assertEqual(
+                    [(s["sourceRange"]["start"], s["frames"]) for s in result["shots"]],
+                    [(start, end - start) for start, end in zip([0, *cuts], [*cuts, frame_count])],
+                )
+                self.assertEqual(sum(s["frames"] for s in result["shots"]), frame_count)
+                self.assertEqual(
+                    [s["name"] for s in result["shots"]], [f"Shot {i + 1:02d}" for i in range(len(cuts) + 1)]
+                )
+                for index, shot in enumerate(result["shots"]):
+                    file = self.media.resolve(shot["file"])
+                    self.assertEqual(file.name, f"{index:03d}.mp4")
+                    self.assertFalse(Path(shot["file"]).is_absolute())
+                    self.assertTrue(self.media.resolve(shot["poster"]).is_file())
+                    self.assertEqual(int(_probe(file)["streams"][0]["nb_frames"]), shot["frames"])
+                    self.assertFalse(shot["audio"])
+                    self.assertFalse(any(s["codec_type"] == "audio" for s in _probe(file)["streams"]))
+                    self.assertEqual(shot["sourceFrameCount"], frame_count)
+                    self.assertEqual(shot["review"]["frames"], shot["frames"])
+                    self.assertEqual(shot["originalFile"], str(source))
+                    start = shot["sourceRange"]["start"]
+                    self.assert_color(self.shot_color(file, 0), _frame_color(start))
+                    self.assert_color(
+                        self.shot_color(file, shot["frames"] - 1), _frame_color(start + shot["frames"] - 1)
+                    )
+                    self.assert_short_gop(file, shot["frames"])
+                self.assertEqual(sha256(source), before)
+                self.assertEqual(sha256(proxy), proxy_before)
+                folder = self.media.resolve(result["shots"][0]["file"]).parent
+                self.assertEqual({path.suffix for path in folder.iterdir()}, {".mp4", ".jpg"})
+                self.assertEqual(result["audio"] is not None, key == "30")
+                if result["audio"] is not None:
+                    self.assertEqual(result["audio"]["kind"], "audio")
+                    self.assertEqual(result["audio"]["originalFile"], str(source))
+                    self.assertEqual(result["audio"]["frames"], frame_count)
+                    self.assertTrue(self.media.resolve(result["audio"]["file"]).is_file())
+
+    def test_large_fractional_offsets_seek_to_the_exact_boundary(self):
+        # A local temporary 64x36 proxy proves seek/PTS math far beyond the small
+        # import fixture, without committing a binary or encoding large posters.
+        frame_count, cuts = 10053, [10000, 10007, 10023, 10043]
+        for clock in ("30000/1001", "24000/1001"):
+            with self.subTest(clock=clock):
+                source = self.root / (clock.replace("/", "-") + ".mp4")
+                pixels = b"".join(bytes(_frame_color(n)) * (64 * 36) for n in range(frame_count))
+                subprocess.run(
+                    [
+                        FFMPEG,
+                        "-v",
+                        "error",
+                        "-y",
+                        "-f",
+                        "rawvideo",
+                        "-pix_fmt",
+                        "rgb24",
+                        "-s",
+                        "64x36",
+                        "-r",
+                        clock,
+                        "-i",
+                        "-",
+                        "-c:v",
+                        "libx264",
+                        "-preset",
+                        "ultrafast",
+                        "-pix_fmt",
+                        "yuv420p",
+                        "-g",
+                        "6",
+                        "-bf",
+                        "0",
+                        str(source),
+                    ],
+                    input=pixels,
+                    check=True,
+                    capture_output=True,
+                    timeout=120,
+                )
+                del pixels
+                before = sha256(source)
+                stream = _probe(source)["streams"][0]
+                folder = source.with_suffix("")
+                folder.mkdir()
+                with patch("spool.media._SPLIT_BATCH_FRAMES", 10005):
+                    commands = list(
+                        _split_commands(
+                            FFMPEG,
+                            source,
+                            folder,
+                            cuts,
+                            frame_count,
+                            Fraction(clock),
+                            Fraction(stream["time_base"]),
+                        )
+                    )
+                self.assertGreater(len(commands), 1)
+                for command in commands:
+                    subprocess.run(command, check=True, capture_output=True, timeout=120)
+                for index, (start, end) in enumerate(zip([0, *cuts], [*cuts, frame_count])):
+                    file = folder / f"{index:03d}.mp4"
+                    self.assertEqual(int(_probe(file)["streams"][0]["nb_frames"]), end - start)
+                    self.assert_color(self.shot_color(file, 0, 64, 36), _frame_color(start))
+                    self.assert_color(self.shot_color(file, end - start - 1, 64, 36), _frame_color(end - 1))
+                    self.assert_short_gop(file, end - start)
+                self.assertEqual(sha256(source), before)
+
+    def test_zero_and_one_cut_imports_keep_the_same_shot_contract(self):
+        source, frame_count = self.sources["24"]
+        fps = 24000 / 1001
+        whole = self.media.import_footage(source, fps=fps, detect=False)
+        one = self.import_with_cuts(source, [123], fps)
+        for result, expected in ((whole, [(0, frame_count)]), (one, [(0, 123), (123, frame_count - 123)])):
+            self.assertEqual([(s["sourceRange"]["start"], s["frames"]) for s in result["shots"]], expected)
+            for shot in result["shots"]:
+                self.assert_short_gop(self.media.resolve(shot["file"]), shot["frames"])
+
+    def test_project_owned_original_and_all_shot_paths_stay_relative_across_batches(self):
+        media = Media(
+            self.root / "owned", self.root / "input", self.root / "output", self.root / "temp", project_id="project"
+        )
+        source, frame_count = self.sources["30"]
+        kept = media.keep_input(source)
+        before = sha256(kept)
+        with (
+            patch("spool.media._SPLIT_BATCH_FRAMES", 180),
+            patch("spool.media.scene_scores", return_value=[]),
+            patch("spool.media.detect_cuts", return_value=[7, 213, 391, 512]),
+        ):
+            result = media.import_footage(kept, fps=30000 / 1001)
+        for item in [result["source"], *result["shots"], result["audio"]]:
+            self.assertFalse(Path(item["file"]).is_absolute())
+            self.assertTrue(item["originalFile"].startswith("input/video/"))
+            self.assertEqual(media.resolve(item["originalFile"]), kept)
+        self.assertEqual(sum(s["frames"] for s in result["shots"]), frame_count)
+        self.assertEqual(sha256(kept), before)
+
+    def test_large_import_production_seam_captures_all_batches_before_verification(self):
+        source, _ = self.sources["30"]
+        for count in (1800, 20000):
+            with self.subTest(cuts=count):
+                cuts = [10000 + index * 10 for index in range(count)]
+                frames = cuts[-1] + 1000
+                proxy = self.media.cache / "previews" / "large simulated proxy.mp4"
+                proxy.parent.mkdir(exist_ok=True)
+                proxy.write_bytes(b"mocked proxy with a consistent large frame count")
+                captured = []
+
+                class StopBeforePosters(Exception):
+                    pass
+
+                def probe(path):
+                    if Path(path).parent.parent.name == "shots":
+                        raise StopBeforePosters()
+                    return {
+                        "streams": [
+                            {
+                                "codec_type": "video",
+                                "avg_frame_rate": "30000/1001",
+                                "time_base": "1/30000",
+                                "nb_frames": str(frames),
+                            }
+                        ]
+                    }
+
+                def capture(command, **options):
+                    captured.append(command)
+                    (Path(command[-1]).parent / "incomplete.mp4").write_bytes(b"owned partial")
+
+                with (
+                    patch.object(
+                        self.media,
+                        "describe",
+                        return_value={"frames": frames, "file": proxy.relative_to(self.media.root).as_posix()},
+                    ),
+                    patch("spool.media._probe", side_effect=probe),
+                    patch("spool.media.subprocess.run", side_effect=capture),
+                    patch("spool.media.scene_scores", return_value=[]),
+                    patch("spool.media.detect_cuts", return_value=cuts),
+                    self.assertRaises(StopBeforePosters),
+                ):
+                    self.media.import_footage(source, fps=30000 / 1001)
+                SplitCommandTests().assert_plan(captured, cuts, frames)
+                self.assertEqual(list((self.media.cache / "shots").glob("*")), [])
+                self.assertEqual(proxy.read_bytes(), b"mocked proxy with a consistent large frame count")
+
+    def test_failures_remove_only_the_owned_operation_folder_and_audio_partial(self):
+        source, _ = self.sources["30"]
+        fps = 30000 / 1001
+        whole = self.media.describe(source, fps=fps)
+        proxy = self.media.resolve(whole["file"])
+        source_hash, proxy_hash = sha256(source), sha256(proxy)
+        other = self.media.cache / "shots" / "another-operation"
+        other.mkdir(parents=True)
+        sentinel = other / "keep.mp4"
+        sentinel.write_bytes(b"another import's asset")
+        previews_before = {p.name for p in proxy.parent.iterdir()}
+        real_run, real_probe, real_describe = subprocess.run, _probe, self.media.describe
+        for failure in ("batch2", "verification", "poster", "audio", "audio-describe"):
+            with self.subTest(failure=failure):
+                batches = []
+
+                def run(command, **options):
+                    target = Path(command[-1])
+                    is_split = "-frames:v" in command and "-c:v" in command
+                    if is_split:
+                        batches.append(command)
+                    fail = (
+                        (failure == "batch2" and is_split and len(batches) == 2)
+                        or (failure == "poster" and target.suffix == ".jpg" and target.parent.parent.name == "shots")
+                        or (failure == "audio" and target.name.endswith("-audio.m4a"))
+                    )
+                    if fail:
+                        target.with_name("injected.partial" if is_split else target.name).write_bytes(b"partial")
+                        raise subprocess.CalledProcessError(1, command, stderr=b"injected failure")
+                    return real_run(command, **options)
+
+                def probe(path):
+                    result = real_probe(path)
+                    if failure == "verification" and Path(path).parent.parent.name == "shots":
+                        result["streams"][0]["nb_frames"] = "999"
+                    return result
+
+                def describe(path, *args, **kwargs):
+                    if failure == "audio-describe" and str(path).endswith("-audio.m4a"):
+                        raise ValueError("injected audio verification failure")
+                    return real_describe(path, *args, **kwargs)
+
+                with (
+                    patch("spool.media._SPLIT_BATCH_FRAMES", 180),
+                    patch("spool.media.subprocess.run", side_effect=run),
+                    patch("spool.media._probe", side_effect=probe),
+                    patch.object(self.media, "describe", side_effect=describe),
+                    self.assertRaises((ValueError, subprocess.CalledProcessError)),
+                ):
+                    self.import_with_cuts(source, [7, 143, 213, 391, 512], fps)
+                if failure == "batch2":
+                    self.assertEqual(len(batches), 2)
+                self.assertEqual(list((self.media.cache / "shots").iterdir()), [other])
+                self.assertEqual(sentinel.read_bytes(), b"another import's asset")
+                self.assertEqual({p.name for p in proxy.parent.iterdir()}, previews_before)
+                self.assertEqual(sha256(source), source_hash)
+                self.assertEqual(sha256(proxy), proxy_hash)
+
+    def test_duplicate_and_invalid_cuts_still_fail_without_publishing_shots(self):
+        source, frame_count = self.sources["24"]
+        for cuts in ([123, 123], [0], [-1], [frame_count], [frame_count + 1], [123, 60]):
+            with self.subTest(cuts=cuts), self.assertRaises(ValueError):
+                self.import_with_cuts(source, cuts, 24000 / 1001)
+            self.assertEqual(list((self.media.cache / "shots").glob("*")), [])
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_media.py b/tests/test_media.py
index f61365f..46240e9 100644
--- a/tests/test_media.py
+++ b/tests/test_media.py
@@ -9,6 +9,7 @@
 import subprocess
 import sys
 import tempfile
+import time
 import unittest
 import wave
 from pathlib import Path
@@ -880,6 +881,74 @@ def test_real_mp4_and_webm_tags_keep_workflow_unicode(self):
     unittest.main()
 
 
+class InterruptedEncodeTests(unittest.TestCase):
+    def test_an_interrupted_proxy_encode_leaves_no_file_to_reuse(self):
+        temp = tempfile.TemporaryDirectory()
+        self.addCleanup(temp.cleanup)
+        root = Path(temp.name)
+        source = root / "clip.mp4"
+        subprocess.run(
+            [FFMPEG, "-v", "error", "-y", "-f", "lavfi", "-i", "color=c=red:s=64x36:r=24:d=1", str(source)],
+            check=True,
+        )
+        media = Media(root / "project", root, root, root, project_id="project")
+        real = subprocess.run
+
+        def stopped(command, **options):
+            # The encode is cut short after writing part of its output, as a timeout or a stopped host would.
+            if "libx264" in command:
+                Path(command[-1]).write_bytes(b"truncated")
+                raise subprocess.TimeoutExpired(command, options.get("timeout"))
+            return real(command, **options)
+
+        with patch("spool.media.subprocess.run", side_effect=stopped), self.assertRaises(subprocess.TimeoutExpired):
+            media.describe(source, fps=24)
+        self.assertEqual(list((root / "project" / ".spool" / "previews").glob("*.mp4")), [])
+        self.assertEqual(media.describe(source, fps=24)["frames"], 24)
+
+
+class WaveformCacheTests(unittest.TestCase):
+    def test_new_audio_at_the_same_path_draws_a_new_waveform(self):
+        temp = tempfile.TemporaryDirectory()
+        self.addCleanup(temp.cleanup)
+        root = Path(temp.name)
+        media = Media(root / "project", root, root, root, project_id="project")
+        target = root / "project" / "output" / "clip" / "take.wav"
+        target.parent.mkdir(parents=True)
+        waves = []
+        for source in ("anullsrc=d=2", "sine=f=440:d=2:sample_rate=44100"):
+            subprocess.run([FFMPEG, "-v", "error", "-y", "-f", "lavfi", "-i", source, str(target)], check=True)
+            os.utime(target, ns=(time.time_ns(), time.time_ns() + len(waves)))
+            waves.append((root / "project" / media.describe(target, fps=24)["wave"]).read_bytes())
+        self.assertNotEqual(waves[0], waves[1])
+
+
+class ExportPathTests(unittest.TestCase):
+    def test_export_works_when_the_temporary_folder_holds_a_quote(self):
+        temp = tempfile.TemporaryDirectory()
+        self.addCleanup(temp.cleanup)
+        root = Path(temp.name)
+        # A Windows account such as O'Brien puts its quote in every temporary path.
+        quoted = root / "O'Brien" / "Temp"
+        quoted.mkdir(parents=True)
+        media = Media(root / "project", root, root, root, project_id="project")
+        subprocess.run(
+            [FFMPEG, "-v", "error", "-y", "-f", "lavfi", "-i", "color=c=red:s=64x48:r=24:d=1"]
+            + [str(root / "project" / "a.mp4")],
+            check=True,
+        )
+        data = {
+            "fps": 24,
+            "width": 64,
+            "height": 48,
+            "audio": False,
+            "clips": [{"file": "a.mp4", "in": 0, "out": 10}, {"file": "a.mp4", "in": 10, "out": 20}],
+        }
+        with patch("tempfile.tempdir", str(quoted)):
+            result = media.export(data)
+        self.assertTrue((root / "project" / "exports" / result["filename"]).is_file())
+
+
 class InputStagingTests(unittest.TestCase):
     def test_staged_names_resolve_to_the_project_file_they_came_from(self):
         from spool.media import Media, STAGED_PREFIX, staged_relative
diff --git a/tests/test_media_orientation.py b/tests/test_media_orientation.py
new file mode 100644
index 0000000..0609672
--- /dev/null
+++ b/tests/test_media_orientation.py
@@ -0,0 +1,124 @@
+import io
+import json
+import shutil
+import subprocess
+import tempfile
+import unittest
+from pathlib import Path
+
+from PIL import Image, ImageOps
+
+from spool.media import Media, _video_display_size
+
+
+class MediaOrientationTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name)
+        for name in ("input", "output", "temp"):
+            (self.root / name).mkdir()
+        self.media = Media(self.root / "store", self.root / "input", self.root / "output", self.root / "temp")
+
+    def test_all_exif_orientations_match_pillows_decoded_dimensions(self):
+        for orientation in range(1, 9):
+            with self.subTest(orientation=orientation):
+                path = self.root / "input" / f"orientation-{orientation}.jpg"
+                image = Image.new("RGB", (64, 48), "red")
+                exif = Image.Exif()
+                exif[274] = orientation
+                image.save(path, exif=exif)
+                before = path.read_bytes()
+                metadata = self.media.describe(path)
+                with Image.open(path) as original:
+                    display = ImageOps.exif_transpose(original)
+                    self.assertEqual((metadata["width"], metadata["height"]), display.size)
+                self.assertEqual(path.read_bytes(), before)
+                self.assertEqual(metadata["frames"], 120)
+
+    def test_legacy_rotation_and_matrix_precedence(self):
+        stream = {"width": 64, "height": 48, "tags": {"rotate": "90"}}
+        self.assertEqual(_video_display_size(stream), (48, 64))
+        stream["side_data_list"] = [{"side_data_type": "Display Matrix", "rotation": 0}]
+        self.assertEqual(_video_display_size(stream), (64, 48))
+        stream["side_data_list"][0]["rotation"] = -90
+        self.assertEqual(_video_display_size(stream), (48, 64))
+
+    def test_arbitrary_and_invalid_rotations_do_not_invent_an_expanded_canvas(self):
+        for rotation in (45, -45, 360, "invalid", "NaN", "Infinity"):
+            with self.subTest(rotation=rotation):
+                stream = {"width": 64, "height": 48, "tags": {"rotate": rotation}}
+                self.assertEqual(_video_display_size(stream), (64, 48))
+
+    @unittest.skipUnless(shutil.which("ffmpeg") and shutil.which("ffprobe"), "needs ffmpeg and ffprobe")
+    def test_real_display_matrices_match_ffmpegs_decoded_frame(self):
+        source = self.root / "input" / "coded.mp4"
+        ffmpeg, ffprobe = shutil.which("ffmpeg"), shutil.which("ffprobe")
+        subprocess.run(
+            [
+                ffmpeg,
+                "-v",
+                "error",
+                "-y",
+                "-f",
+                "lavfi",
+                "-i",
+                "testsrc2=s=64x48:r=2:d=1",
+                "-c:v",
+                "libx264",
+                str(source),
+            ],
+            capture_output=True,
+            check=True,
+            timeout=30,
+        )
+        for rotation, flipped in (
+            (0, False),
+            (90, False),
+            (180, False),
+            (270, False),
+            (-90, False),
+            (45, False),
+            (90, True),
+        ):
+            with self.subTest(rotation=rotation, flipped=flipped):
+                path = source.with_name(f"display-{rotation}-{flipped}.mp4")
+                command = [ffmpeg, "-v", "error", "-y"]
+                if flipped:
+                    help_text = subprocess.run(
+                        [ffmpeg, "-h", "full"], capture_output=True, check=True, timeout=30
+                    ).stdout
+                    if b"-display_hflip" not in help_text:
+                        self.skipTest("this ffmpeg cannot create a reflected display-matrix fixture")
+                    command += ["-display_rotation", str(rotation), "-display_hflip"]
+                command += ["-i", str(source), "-map", "0", "-c", "copy"]
+                if not flipped:
+                    command += ["-metadata:s:v:0", f"rotate={rotation}"]
+                command += [str(path)]
+                subprocess.run(command, capture_output=True, check=True, timeout=30)
+                raw = subprocess.run(
+                    [ffmpeg, "-v", "error", "-i", str(path), "-frames:v", "1", "-f", "image2pipe", "-c:v", "png", "-"],
+                    capture_output=True,
+                    check=True,
+                    timeout=30,
+                ).stdout
+                probe = json.loads(
+                    subprocess.run(
+                        [ffprobe, "-v", "error", "-show_streams", "-of", "json", str(path)],
+                        capture_output=True,
+                        check=True,
+                        timeout=30,
+                    ).stdout
+                )
+                video = next(stream for stream in probe["streams"] if stream["codec_type"] == "video")
+                self.assertEqual((video["width"], video["height"]), (64, 48))
+                with Image.open(io.BytesIO(raw)) as decoded:
+                    metadata = self.media.describe(path)
+                    self.assertEqual((metadata["width"], metadata["height"]), decoded.size)
+                self.assertEqual(
+                    (metadata["probe"]["streams"][0]["width"], metadata["probe"]["streams"][0]["height"]), (64, 48)
+                )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_media_rate_validation.py b/tests/test_media_rate_validation.py
new file mode 100644
index 0000000..fcf838b
--- /dev/null
+++ b/tests/test_media_rate_validation.py
@@ -0,0 +1,170 @@
+"""ffprobe frame rates must be usable: invalid clocks fail as ValueError; real rates keep timing."""
+
+import asyncio
+import shutil
+import subprocess
+import tempfile
+import unittest
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from aiohttp import web
+from aiohttp.test_utils import TestClient, TestServer
+
+from spool.media import Media, _rate
+from spool.projects import Workspace
+from spool.routes import register
+
+FFMPEG, FFPROBE = shutil.which("ffmpeg"), shutil.which("ffprobe")
+
+
+def video_probe(rate, *, include_rate=True):
+    stream = {
+        "codec_type": "video",
+        "nb_frames": "24",
+        "width": 64,
+        "height": 36,
+        "time_base": "1/24",
+    }
+    if include_rate:
+        stream["avg_frame_rate"] = rate
+    return {"streams": [stream], "format": {"duration": "1"}}
+
+
+class RateValidationTests(unittest.TestCase):
+    def test_zero_denominator_nonfinite_and_invalid_rates_are_rejected(self):
+        for value in ("0/0", "1/0", "-1/0", "nan", "NaN", "inf", "-inf", "", "N/A", "x/1", "1/2/3", "24/", None):
+            with self.subTest(value=value), self.assertRaisesRegex(ValueError, "no usable frame rate"):
+                _rate(value)
+
+    def test_zero_and_negative_rates_are_rejected(self):
+        for value in ("0", "0/1", "0.0", "-24", "-24/1"):
+            with self.subTest(value=value), self.assertRaisesRegex(ValueError, "no usable frame rate"):
+                _rate(value)
+
+    def test_positive_integer_float_and_rational_rates_are_preserved(self):
+        cases = (
+            (24, 24.0),
+            ("24/1", 24.0),
+            ("25", 25.0),
+            ("23.976", 23.976),
+            ("24000/1001", 24000 / 1001),
+            ("30000/1001", 30000 / 1001),
+            ("60000/1001", 60000 / 1001),
+        )
+        for value, expected in cases:
+            with self.subTest(value=value):
+                self.assertEqual(_rate(value), expected)
+
+
+class ImportRateValidationTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory(prefix="spool-rate-")
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name)
+        for name in ("input", "output", "temp"):
+            (self.root / name).mkdir()
+        self.media = Media(self.root / "store", self.root / "input", self.root / "output", self.root / "temp")
+        self.source = self.root / "input" / "probe.mp4"
+        self.source.write_bytes(b"ffprobe is mocked for this fixture")
+
+    def test_import_rejects_unusable_probe_rate_before_describing(self):
+        for value in ("0/0", "1/0", "nan", "inf"):
+            with (
+                self.subTest(value=value),
+                patch("spool.media._probe", return_value=video_probe(value)),
+                patch.object(Media, "describe", side_effect=AssertionError("Describe must not run")),
+            ):
+                with self.assertRaisesRegex(ValueError, "no usable frame rate"):
+                    self.media.import_footage(self.source, detect=False)
+        self.assertFalse((self.root / "store" / "shots").exists())
+
+    def test_import_rejects_a_probe_without_a_frame_rate(self):
+        with (
+            patch("spool.media._probe", return_value=video_probe(None, include_rate=False)),
+            patch.object(Media, "describe", side_effect=AssertionError("Describe must not run")),
+        ):
+            with self.assertRaisesRegex(ValueError, "no usable frame rate"):
+                self.media.import_footage(self.source, detect=False)
+
+
+class ImportRouteValidationTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory(prefix="spool-rate-route-")
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name)
+        self.workspace = Workspace(self.root / "app")
+        for name in ("input", "output", "temp"):
+            (self.root / name).mkdir()
+        self.media = Media(self.workspace.root, *(self.root / name for name in ("input", "output", "temp")))
+        self.source = self.root / "input" / "probe.mp4"
+        self.source.write_bytes(b"ffprobe is mocked for this fixture")
+
+    def test_import_footage_route_reports_an_unusable_probe_rate_as_a_validation_error(self):
+        async def check():
+            server = SimpleNamespace(routes=web.RouteTableDef(), app=web.Application())
+            register(server, self.workspace, self.media)
+            server.app.cleanup_ctx.clear()
+            server.app.add_routes(server.routes)
+            with patch("spool.media._probe", return_value=video_probe("0/0")):
+                async with TestClient(TestServer(server.app)) as client:
+                    response = await client.post(
+                        "/spool/api/import-footage",
+                        json={"path": str(self.source), "detectCuts": False},
+                    )
+                    self.assertEqual(response.status, 400)
+                    self.assertEqual(
+                        await response.json(),
+                        {"error": "The video has no usable frame rate", "code": "invalid_request"},
+                    )
+
+        asyncio.run(check())
+
+
+@unittest.skipUnless(FFMPEG and FFPROBE, "ffmpeg and ffprobe are required")
+class FractionalImportTimingTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory(prefix="spool-rate-fractional-")
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name)
+        for name in ("input", "output", "temp"):
+            (self.root / name).mkdir()
+        self.media = Media(self.root / "store", self.root / "input", self.root / "output", self.root / "temp")
+        self.source = self.root / "input" / "fractional.mp4"
+        subprocess.run(
+            [
+                FFMPEG,
+                "-v",
+                "error",
+                "-y",
+                "-f",
+                "lavfi",
+                "-i",
+                "testsrc2=s=64x36:r=30000/1001:d=1",
+                "-c:v",
+                "libx264",
+                "-pix_fmt",
+                "yuv420p",
+                str(self.source),
+            ],
+            check=True,
+            timeout=120,
+        )
+
+    def test_import_keeps_a_positive_fractional_source_rate(self):
+        result = self.media.import_footage(self.source, detect=False)
+        expected = 30000 / 1001
+        source, shot = result["source"], result["shots"][0]
+        self.assertAlmostEqual(result["fps"], expected, places=9)
+        self.assertAlmostEqual(_rate(source["fps"]), expected, places=9)
+        self.assertEqual(source["sequenceFps"], result["fps"])
+        self.assertEqual(shot["fps"], source["fps"])
+        self.assertEqual(shot["frames"], source["frames"])
+        self.assertAlmostEqual(shot["duration"], shot["frames"] / expected, places=9)
+        self.assertEqual(shot["review"]["fps"], result["fps"])
+        self.assertAlmostEqual(shot["review"]["duration"], shot["duration"], places=9)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_native.py b/tests/test_native.py
index e55c0e6..4f3417b 100644
--- a/tests/test_native.py
+++ b/tests/test_native.py
@@ -346,6 +346,23 @@ def test_prune_reports_and_only_evicts_unreferenced_previews(self):
         self.assertEqual(self.store.prune(confirm=True, budget=1, grace=600)["evicted"], [])
         self.assertTrue(fresh.is_file())
 
+    def test_prune_keeps_referenced_previews_named_with_spaces_or_accents(self):
+        previews = self.store.root / "previews"
+        previews.mkdir(exist_ok=True)
+        kept = [previews / "Desert walk-abc.mp4", previews / "café-abc.mp4"]
+        orphan = previews / "Desert walk-orphan.mp4"
+        for path in (*kept, orphan):
+            path.write_bytes(b"preview" * 100)
+        document = store_module.empty_project()
+        document["media"] = [
+            {"id": "media-%d" % i, "kind": "video", "name": p.name, "file": "previews/" + p.name, "frames": 24}
+            for i, p in enumerate(kept)
+        ]
+        self.store.create(document)
+        evicted = self.store.prune(confirm=True, budget=1, grace=0)
+        self.assertEqual(evicted["evicted"], ["previews/Desert walk-orphan.mp4"])
+        self.assertTrue(all(path.is_file() for path in kept))
+
     def test_prune_evicts_disposable_cut_scores_but_preserves_source(self):
         scores = self.store.root / "previews" / "cut-scores" / "scan.json"
         scores.parent.mkdir(parents=True)
diff --git a/tests/test_nested_request_shapes.py b/tests/test_nested_request_shapes.py
new file mode 100644
index 0000000..604efb5
--- /dev/null
+++ b/tests/test_nested_request_shapes.py
@@ -0,0 +1,259 @@
+"""Nested save payloads fail at the HTTP boundary before staging or publication."""
+
+import copy
+import hashlib
+import tempfile
+import unittest
+from contextlib import nullcontext
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from aiohttp import web
+from aiohttp.test_utils import TestClient, TestServer
+from PIL import Image
+
+from spool.media import Media
+from spool.projects import Workspace
+from spool.routes import register
+
+
+def capture():
+    return {
+        "workflow": {"nodes": []},
+        "prompt": {
+            "load": {"class_type": "LoadImage", "inputs": {"image": "source.png"}},
+            "save": {"class_type": "SaveImage", "inputs": {"images": ["load", 0]}},
+        },
+        "bindings": [],
+        "result": {"nodeId": "save", "group": "images", "index": 0},
+    }
+
+
+class NestedRequestShapeTests(unittest.IsolatedAsyncioTestCase):
+    async def asyncSetUp(self):
+        directory = tempfile.TemporaryDirectory()
+        self.addCleanup(directory.cleanup)
+        self.root = Path(directory.name)
+        self.roots = [self.root / kind for kind in ("input", "output", "temp")]
+        for root in self.roots:
+            root.mkdir()
+        Image.new("RGB", (8, 8), "red").save(self.roots[0] / "source.png")
+        self.workspace = Workspace(self.root / "app")
+        self.project = self.workspace.create(
+            {
+                "project": "Nested shape QA",
+                "clips": [{"id": "shot", "name": "Original", "takes": [], "in": 0, "out": 24}],
+                "media": [],
+            }
+        )
+        self.store = self.workspace.for_project(self.project["id"])
+        self.media = Media(self.workspace.root, *self.roots)
+        server = SimpleNamespace(routes=web.RouteTableDef(), app=web.Application())
+        register(server, self.workspace, self.media)
+        server.app.cleanup_ctx.clear()
+        server.app.add_routes(server.routes)
+        self.client = TestClient(TestServer(server.app))
+        await self.client.start_server()
+        self.addAsyncCleanup(self.client.close)
+        self.base = "/spool/api/projects/" + self.project["id"]
+
+    def files(self):
+        return {
+            str(file.relative_to(self.root)): hashlib.sha256(file.read_bytes()).hexdigest()
+            for root in [*self.roots, self.store.root]
+            for file in root.rglob("*")
+            if file.is_file()
+        }
+
+    def body(self):
+        return {"revision": self.project["revision"], "document": copy.deepcopy(self.project["document"])}
+
+    def recipe_body(self):
+        body = self.body()
+        body["document"]["clips"][0]["workflowVersion"] = "recipe"
+        body["workflowRecipes"] = {"recipe": capture()}
+        return body
+
+    async def rejected(self, body, field, path=None, method="put", spy=True):
+        before = self.store.get(self.project["id"])
+        files = self.files()
+        preparation = (
+            patch.object(Media, "prepare_workflow", side_effect=AssertionError("Preparation ran before validation"))
+            if spy
+            else nullcontext()
+        )
+        with preparation as prepare:
+            response = await getattr(self.client, method)(path or self.base, json=body)
+            value = await response.json()
+            self.assertEqual((response.status, value.get("code")), (400, "invalid_request"), value)
+            self.assertIn(field, value["error"])
+            if prepare is not None:
+                prepare.assert_not_called()
+        self.assertEqual(self.store.get(self.project["id"]), before)
+        self.assertEqual(self.files(), files)
+
+    async def test_scalar_clip_is_invalid_before_mutation(self):
+        body = self.body()
+        body["document"]["clips"] = [1]
+        await self.rejected(body, "clips", spy=False)
+
+    async def test_null_recipe_map_is_invalid_before_preparation(self):
+        body = self.body()
+        body["workflowRecipes"] = None
+        await self.rejected(body, "workflowRecipes", spy=False)
+
+    async def test_clip_and_media_entries_need_objects_and_ids(self):
+        for field, value in (
+            ("clips", [None]),
+            ("clips", [[]]),
+            ("clips", [{}]),
+            ("clips", [{"id": []}]),
+            ("media", None),
+            ("media", {}),
+            ("media", [1]),
+            ("media", [{}]),
+            ("audioClips", None),
+            ("audioClips", [1]),
+            ("importedWorkflows", {}),
+            ("importedWorkflows", [None]),
+        ):
+            with self.subTest(field=field, value=value):
+                body = self.recipe_body()
+                body["document"][field] = value
+                await self.rejected(body, field)
+
+    async def test_take_binding_and_input_containers_are_checked_before_recipes(self):
+        for field, value in (
+            ("takes", None),
+            ("takes", [1]),
+            ("takes", [{}]),
+            ("takes", [{"id": "take", "media": None}]),
+            ("takes", [{"id": "take", "media": {}}]),
+            ("bindings", None),
+            ("bindings", [1]),
+            ("bindings", [{}]),
+            ("inputValues", None),
+            ("inputValues", []),
+        ):
+            with self.subTest(field=field, value=value):
+                body = self.recipe_body()
+                body["document"]["clips"][0][field] = value
+                expected = (
+                    "media"
+                    if field == "takes"
+                    and isinstance(value, list)
+                    and value
+                    and isinstance(value[0], dict)
+                    and "media" in value[0]
+                    else field
+                )
+                await self.rejected(body, expected)
+
+    async def test_recipe_map_and_capture_containers_are_checked_before_preparation(self):
+        for value in ([], "recipes", 1):
+            with self.subTest(value=value):
+                body = self.body()
+                body["workflowRecipes"] = value
+                await self.rejected(body, "workflowRecipes")
+        for value, field in (
+            (None, "workflow"),
+            ([], "workflow"),
+            ({**capture(), "bindings": None}, "bindings"),
+            ({**capture(), "bindings": [1]}, "bindings"),
+            ({**capture(), "bindings": [{}]}, "bindings"),
+            ({**capture(), "provenance": []}, "provenance"),
+            ({**capture(), "provenance": {"builtinTemplate": []}}, "builtinTemplate"),
+            ({**capture(), "result": None}, "result"),
+            ({**capture(), "result": {"nodeId": []}}, "nodeId"),
+            ({**capture(), "prompt": {"load": 1}}, "prompt"),
+            ({**capture(), "workflow": []}, "workflow"),
+            ({**capture(), "workflow": {"nodes": [1]}}, "nodes"),
+            ({**capture(), "workflow": {"nodes": [{"type": "LoadImage"}]}}, "id"),
+            ({**capture(), "workflow": {"definitions": None}}, "definitions"),
+            ({**capture(), "workflow": {"definitions": {"subgraphs": [1]}}}, "subgraphs"),
+        ):
+            with self.subTest(value=value):
+                body = self.recipe_body()
+                body["workflowRecipes"]["recipe"] = value
+                await self.rejected(body, field)
+
+    async def test_all_recipes_are_validated_before_the_first_one_stages_files(self):
+        body = self.recipe_body()
+        body["workflowRecipes"]["later"] = {**capture(), "result": None}
+        await self.rejected(body, "result")
+
+    async def test_later_input_recovery_is_validated_before_any_files_are_staged(self):
+        for recovery in (None, {"recovered": {}}, {"recovered": None}):
+            with self.subTest(recovery=recovery):
+                body = self.recipe_body()
+                body["workflowRecipes"]["later"] = {**capture(), "inputRecovery": recovery}
+                await self.rejected(body, "inputRecovery", spy=False)
+
+    async def test_capture_input_recovery_is_rejected_without_file_mutation(self):
+        for recovery in (None, {"recovered": {}}, {"recovered": None}):
+            with self.subTest(recovery=recovery):
+                await self.rejected(
+                    {"revision": self.project["revision"], "capture": {**capture(), "inputRecovery": recovery}},
+                    "inputRecovery",
+                    self.base + "/capture/shot",
+                    "post",
+                    spy=False,
+                )
+
+    async def test_capture_route_rejects_shapes_before_preparing_inputs(self):
+        for value, field in ((None, "workflow"), ({**capture(), "bindings": [1]}, "bindings")):
+            await self.rejected(
+                {"revision": self.project["revision"], "capture": value},
+                field,
+                self.base + "/capture/shot",
+                "post",
+            )
+        await self.rejected(
+            {"revision": self.project["revision"], "capture": capture(), "overrides": []},
+            "overrides",
+            self.base + "/capture/shot",
+            "post",
+        )
+
+    async def test_valid_recipe_stages_real_input_and_stale_save_still_conflicts(self):
+        before = self.files()
+        body = self.recipe_body()
+        body["workflowRecipes"]["recipe"]["inputRecovery"] = {"recovered": []}
+        response = await self.client.put(self.base, json=body)
+        self.assertEqual(response.status, 200, await response.text())
+        saved = await response.json()
+        self.assertEqual(saved["revision"], self.project["revision"] + 1)
+        self.assertEqual(saved["document"]["clips"][0]["name"], "Original")
+        self.assertIn("recipe", saved["recipes"])
+        self.assertTrue(list((self.store.root / "input").rglob("*.png")))
+        self.assertNotEqual(self.files(), before)
+        response = await self.client.put(self.base, json={"revision": body["revision"], "document": saved["document"]})
+        value = await response.json()
+        self.assertEqual((response.status, value["code"]), (409, "revision_conflict"))
+        self.assertEqual(self.store.get(self.project["id"]), saved)
+
+    async def test_capture_without_optional_overrides_still_succeeds(self):
+        response = await self.client.post(
+            self.base + "/capture/shot",
+            json={"revision": self.project["revision"], "capture": capture(), "overrides": None},
+        )
+        self.assertEqual(response.status, 200, await response.text())
+
+    async def test_minimal_save_defaults_match_the_demo_control(self):
+        response = await self.client.put(
+            self.base,
+            json={
+                "revision": self.project["revision"],
+                "document": {"project": "Minimal valid save", "clips": [{"id": "empty", "in": 0, "out": 24}]},
+                "workflowRecipes": {},
+            },
+        )
+        self.assertEqual(response.status, 200, await response.text())
+        saved = await response.json()
+        self.assertEqual(saved["revision"], self.project["revision"] + 1)
+        self.assertEqual(saved["document"]["clips"][0]["takes"], [])
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_output_folders.py b/tests/test_output_folders.py
new file mode 100644
index 0000000..99bc371
--- /dev/null
+++ b/tests/test_output_folders.py
@@ -0,0 +1,77 @@
+"""Output ownership uses portable new names without moving existing media."""
+
+import copy
+import tempfile
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+from spool.projects import Workspace, folder_name
+from spool.store import uid
+
+
+class OutputFolderTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name)
+        self.workspace = Workspace(self.root / "app")
+
+    def create(self, names):
+        project = self.workspace.create(
+            {
+                "project": "Folder names",
+                "clips": [{"id": str(i), "name": name, "takes": []} for i, name in enumerate(names)],
+                "media": [],
+            },
+            self.root / "project",
+        )
+        return self.workspace.for_project(project["id"]), project
+
+    def test_case_variants_and_duplicate_names_have_distinct_folders(self):
+        store, project = self.create(["Intro", "intro", "INTRO", "Intro"])
+        folders = [clip["outputFolder"] for clip in project["document"]["clips"]]
+        self.assertEqual(folders[0], "output/Intro")
+        self.assertEqual(len({folder.casefold() for folder in folders}), len(folders))
+        self.assertTrue(all((store.root / folder).is_dir() for folder in folders))
+        self.assertEqual(len(list((store.root / "output").iterdir())), len(folders))
+
+    def test_allocating_a_new_clip_keeps_assigned_paths_and_retries_suffix_collisions(self):
+        store, project = self.create(["Intro", "intro-aaaaaaaa"])
+        before = [clip["outputFolder"] for clip in project["document"]["clips"]]
+        document = copy.deepcopy(project["document"])
+        document["clips"][0]["name"] = "Renamed"
+        document["clips"].append({"id": "new", "name": "intro", "takes": []})
+        allocated = iter(["aaaaaaaa-first", "bbbbbbbb-second"])
+        with patch("spool.projects.uid", side_effect=lambda: next(allocated, uid())):
+            saved = store.save(project["id"], project["revision"], document)
+        folders = [clip["outputFolder"] for clip in saved["document"]["clips"]]
+        self.assertEqual(folders[:2], before)
+        self.assertEqual(folders[2], "output/intro-bbbbbbbb")
+
+    def test_existing_shared_output_folders_are_preserved(self):
+        store, project = self.create(["Original"])
+        document = copy.deepcopy(project["document"])
+        duplicate = copy.deepcopy(document["clips"][0])
+        duplicate["id"] = "duplicate"
+        document["clips"].append(duplicate)
+        saved = store.save(project["id"], project["revision"], document)
+        self.assertEqual([clip["outputFolder"] for clip in saved["document"]["clips"]], ["output/Original"] * 2)
+
+    def test_truncation_cannot_leave_a_trailing_space_or_dot(self):
+        for character in (" ", "."):
+            with self.subTest(character=character):
+                name = "a" * 99 + character + "discarded"
+                self.assertEqual(folder_name(name), "a" * 99)
+
+    def test_windows_console_device_names_are_portable(self):
+        names = ["CONIN$", "conin$.png", "CONOUT$", "conout$.txt"]
+        store, project = self.create(names)
+        folders = [clip["outputFolder"] for clip in project["document"]["clips"]]
+        self.assertEqual(folders[0], "output/Untitled")
+        self.assertTrue(all(Path(folder).name.startswith("Untitled") for folder in folders))
+        self.assertTrue(all((store.root / folder).is_dir() for folder in folders))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_path_import_portability.py b/tests/test_path_import_portability.py
new file mode 100644
index 0000000..f20beb4
--- /dev/null
+++ b/tests/test_path_import_portability.py
@@ -0,0 +1,196 @@
+"""Owned path imports stay portable; external references and upload scope stay intact."""
+
+import asyncio
+import copy
+import io
+import shutil
+import subprocess
+import tempfile
+import unittest
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from aiohttp import web
+from aiohttp.test_utils import TestClient, TestServer
+from PIL import Image
+
+from spool.collection import Collector
+from spool.media import Media, _probe
+from spool.projects import Workspace
+from spool.routes import register
+
+
+FFMPEG, FFPROBE = shutil.which("ffmpeg"), shutil.which("ffprobe")
+
+
+@unittest.skipUnless(FFMPEG and FFPROBE, "needs ffmpeg and ffprobe")
+class PathImportPortabilityTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.sources = tempfile.TemporaryDirectory()
+        cls.source = Path(cls.sources.name) / "outside.mp4"
+        subprocess.run(
+            [
+                FFMPEG,
+                "-v",
+                "error",
+                "-y",
+                "-f",
+                "lavfi",
+                "-i",
+                "color=c=red:s=64x48:r=12:d=0.5",
+                "-f",
+                "lavfi",
+                "-i",
+                "sine=frequency=440:duration=0.5",
+                "-c:v",
+                "libx264",
+                "-pix_fmt",
+                "yuv420p",
+                "-c:a",
+                "aac",
+                str(cls.source),
+            ],
+            capture_output=True,
+            check=True,
+            timeout=30,
+        )
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.sources.cleanup()
+
+    def setUp(self):
+        self.directory = tempfile.TemporaryDirectory()
+        self.addCleanup(self.directory.cleanup)
+        self.root = Path(self.directory.name).resolve()
+        self.workspace = Workspace(self.root / "app")
+        roots = [self.root / name for name in ("input", "output", "temp")]
+        for path in roots:
+            path.mkdir()
+        self.base_media = Media(self.workspace.root, *roots)
+        self.project = self.workspace.create(
+            {"project": "Portable path import", "fps": 12, "clips": [], "media": []}, self.root / "project"
+        )
+        self.store = self.workspace.for_project(self.project["id"])
+        self.media = self.base_media.for_project(self.store, self.project["id"])
+
+    def originals(self, footage):
+        return [footage["source"], *footage["shots"], *([footage["audio"]] if footage["audio"] else [])]
+
+    def assert_owned_originals(self, footage, media):
+        records = self.originals(footage)
+        self.assertGreaterEqual(len(records), 3, "The video fixture must exercise source, shot and audio")
+        original = records[0]["originalFile"]
+        self.assertTrue(original.startswith("input/video/"))
+        self.assertFalse(Path(original).is_absolute())
+        for record in records:
+            self.assertEqual(record["originalFile"], original)
+            self.assertEqual(media.resolve(original).read_bytes(), self.source.read_bytes())
+            self.assertTrue(media.resolve(record["file"]).is_file())
+
+    def test_copied_originals_survive_moving_and_reopening_the_project(self):
+        before = self.source.read_bytes()
+        kept = self.media.keep_input(self.source)
+        self.assertEqual(self.media.keep_input(self.source), kept)
+        self.assertNotEqual(kept, self.source)
+        footage = self.media.import_footage(kept, detect=False)
+        self.assert_owned_originals(footage, self.media)
+        self.assertEqual(self.source.read_bytes(), before)
+        shot = footage["shots"][0]
+        document = copy.deepcopy(self.project["document"])
+        document["media"] = [footage["source"], footage["audio"]]
+        document["clips"] = [
+            {
+                "id": "shot",
+                "name": "Imported",
+                "in": 0,
+                "out": shot["frames"],
+                "takeId": "take",
+                "takes": [{"id": "take", "number": 0, "original": True, "media": shot}],
+            }
+        ]
+        self.store.save(self.project["id"], self.project["revision"], document)
+        moved = self.root / "another-mount" / "project"
+        moved.parent.mkdir()
+        shutil.move(str(self.store.root), moved)
+        reopened = Workspace(self.root / "other-app")
+        project = reopened.open_folder(moved)
+        media = self.base_media.for_project(reopened.for_project(project["id"]), project["id"])
+        records = [*project["document"]["media"], project["document"]["clips"][0]["takes"][0]["media"]]
+        for record in records:
+            self.assertTrue(media.resolve(record["file"]).is_file())
+            self.assertEqual(media.original_source(record)["path"], moved / record["originalFile"])
+            self.assertTrue(media.original_source(record)["path"].is_file())
+        baked = media.bake_shot(records[-1], 0, shot["frames"], 12, "video")
+        self.assertEqual(int(_probe(media.input_source(baked["file"]))["streams"][0]["nb_frames"]), shot["frames"])
+
+    def test_explicit_external_and_unscoped_references_stay_in_place(self):
+        for media in (self.media, self.base_media):
+            with self.subTest(project=media.project_id):
+                footage = media.import_footage(self.source, detect=False)
+                for record in self.originals(footage):
+                    self.assertEqual(record["originalFile"], str(self.source))
+        self.assertEqual(self.base_media.keep_input(self.source), self.source)
+        self.assertFalse(any(path.is_file() for path in (self.store.root / "input").rglob("*")))
+
+    def test_import_and_upload_routes_use_portable_paths_in_both_host_modes(self):
+        async def check():
+            async def idle(app):
+                yield
+
+            for embedded in (False, True):
+                server = SimpleNamespace(routes=web.RouteTableDef(), app=web.Application())
+                executor = (
+                    SimpleNamespace(collector=Collector(self.workspace, self.base_media), poll=idle)
+                    if embedded
+                    else None
+                )
+                register(server, self.workspace, self.base_media, executor)
+                server.app.cleanup_ctx.clear()
+                server.app.add_routes(server.routes)
+                with patch.object(Media, "prepare_playback"):
+                    async with TestClient(TestServer(server.app)) as client:
+                        response = await client.post(
+                            "/spool/api/import-footage?projectId=" + self.project["id"],
+                            json={"path": str(self.source), "detectCuts": False},
+                        )
+                        self.assertEqual(response.status, 200, await response.text())
+                        self.assert_owned_originals(await response.json(), self.media)
+                        image = io.BytesIO()
+                        Image.new("RGB", (32, 16), "blue").save(image, format="PNG")
+                        response = await client.post(
+                            "/spool/api/upload?projectId=" + self.project["id"],
+                            data=image.getvalue(),
+                            headers={"X-Filename": "upload.png"},
+                        )
+                        self.assertEqual(response.status, 200, await response.text())
+                        uploaded = await response.json()
+                        self.assertTrue(uploaded["originalFile"].startswith("input/images/"))
+                        self.assertEqual((uploaded["width"], uploaded["height"]), (32, 16))
+                        self.assertTrue(self.media.resolve(uploaded["originalFile"]).is_file())
+
+        asyncio.run(check())
+
+    def test_nonlocal_path_import_is_refused_before_copying(self):
+        async def check():
+            server = SimpleNamespace(routes=web.RouteTableDef(), app=web.Application())
+            register(server, self.workspace, self.base_media)
+            server.app.cleanup_ctx.clear()
+            server.app.add_routes(server.routes)
+            with patch.object(Media, "keep_input", side_effect=AssertionError("Must not copy for a nonlocal caller")):
+                async with TestClient(TestServer(server.app)) as client:
+                    response = await client.post(
+                        "/spool/api/import-footage?projectId=" + self.project["id"],
+                        json={"path": str(self.source), "detectCuts": False},
+                        headers={"Host": "elsewhere.example"},
+                    )
+                    self.assertEqual(response.status, 403, await response.text())
+            self.assertFalse(any(path.is_file() for path in (self.store.root / "input").rglob("*")))
+
+        asyncio.run(check())
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_project_folders.py b/tests/test_project_folders.py
index b6b73ec..4197a1e 100644
--- a/tests/test_project_folders.py
+++ b/tests/test_project_folders.py
@@ -1,16 +1,23 @@
 """Project folder durability, portable inputs, discovery and exact receipt collection."""
 
 import asyncio
+import contextlib
 import copy
 import gzip
+import hashlib
+import io
 import json
 import os
 import shutil
+import sqlite3
 import subprocess
+import sys
 import tempfile
+import threading
 import time
 import unittest
 from concurrent.futures import ThreadPoolExecutor
+from contextlib import closing
 from threading import Event
 from pathlib import Path
 from types import SimpleNamespace
@@ -20,10 +27,11 @@
 from aiohttp.test_utils import TestClient, TestServer
 from PIL import Image, PngImagePlugin
 
-from spool import commands, farm_protocol, operations, receipts, requests, sidecars, take_files, ledger
+from spool import commands, farm_protocol, maintenance, operations, receipts, requests, sidecars, take_files, ledger
 from spool.wire import unwire, wire
 from spool.collection import Collector
 from spool.execution import LocalExecutor
+from spool.errors import NotFound
 from spool.folder_takes import FolderTakes
 from spool.media import Media
 from spool.projects import Workspace
@@ -31,6 +39,9 @@
 from spool.store import Conflict, Store
 
 
+ROOT = Path(__file__).resolve().parent.parent
+
+
 class ProjectFolderTests(unittest.TestCase):
     def setUp(self):
         self.temp = tempfile.TemporaryDirectory()
@@ -512,7 +523,7 @@ def disconnected(path, target):
         self.assertEqual(len(publications), 2, "Fail the imported document, after schema initialization")
         self.assertEqual(list(parent.iterdir()), [])
         self.assertEqual(self.workspace.folders(), folders)
-        with patch.object(self.workspace, "set_setting", side_effect=OSError("Registry unavailable")):
+        with patch.object(self.workspace, "register_folder", side_effect=OSError("Registry unavailable")):
             with self.assertRaisesRegex(OSError, "Registry unavailable"):
                 self.workspace.import_project(exported)
         self.assertEqual(list(parent.iterdir()), [])
@@ -523,22 +534,20 @@ def disconnected(path, target):
     def test_import_registers_only_a_durable_complete_project(self):
         exported = self.store.export_project(self.project["id"])
         original = copy.deepcopy(exported)
-        set_setting = self.workspace.set_setting
+        register_folder = self.workspace.register_folder
         checked = []
 
-        def register(key, value):
-            if key == "project_folders":
-                new = value[-1]
-                reader = Workspace(self.root / "import-reader")
-                durable = reader.open_folder(new["folder"])
-                self.assertEqual(durable["id"], new["id"])
-                clip = durable["document"]["clips"][0]
-                self.assertIn(clip["workflowVersion"], durable["recipes"])
-                self.assertEqual(clip["takeId"], "original")
-                checked.append(durable)
-            return set_setting(key, value)
-
-        with patch.object(self.workspace, "set_setting", register):
+        def register(project_id, folder, check=None):
+            reader = Workspace(self.root / "import-reader")
+            durable = reader.open_folder(folder)
+            self.assertEqual(durable["id"], project_id)
+            clip = durable["document"]["clips"][0]
+            self.assertIn(clip["workflowVersion"], durable["recipes"])
+            self.assertEqual(clip["takeId"], "original")
+            checked.append(durable)
+            return register_folder(project_id, folder, check)
+
+        with patch.object(self.workspace, "register_folder", register):
             imported = self.workspace.import_project(exported)
         self.assertEqual(checked, [imported])
         self.assertNotEqual(imported["id"], self.project["id"])
@@ -1641,6 +1650,195 @@ def slow_storage(*args, **kwargs):
 
         asyncio.run(check())
 
+    def test_a_retried_farm_task_does_not_become_a_second_take(self):
+        capture = copy.deepcopy(self.capture)
+        capture["prompt"]["submit"] = {
+            "class_type": "DeadlineSubmit",
+            "inputs": {"output_directory": "", "batch_count": 1, "chunk_size": 1},
+        }
+        saved = self.store.capture(
+            self.project["id"], self.project["revision"], "clip-a", self.media.prepare_workflow(capture, True)
+        )
+        project = requests.accept(
+            self.store, self.media, saved["id"], saved["revision"], [{"clipId": "clip-a", "count": 1}]
+        )
+        attempt = self.store.attempt(project["document"]["jobs"][0]["id"])
+        request = attempt["request"]
+        root = Path(request["prompt"]["submit"]["inputs"]["output_directory"])
+        package = {
+            "schemaVersion": 2,
+            **{k: request[k] for k in ("projectId", "clipId", "takeId", "attemptId", "fingerprint")},
+            "variationIndex": 0,
+            "result": request["capture"]["result"],
+            "assets": copy.deepcopy(request["assets"]),
+            "resultRoot": str(root),
+            "stagedPrompt": {k: copy.deepcopy(v) for k, v in request["prompt"].items() if k != "submit"},
+        }
+        package["submissionId"] = self.store.submission(attempt["id"], package)["id"]
+        for asset in package["assets"]:
+            asset["staged"] = asset["frozen"]
+        folder = root / "spool-submissions" / package["submissionId"]
+        farm_protocol.atomic_json(folder / "request.json", package)
+        farm_protocol.atomic_json(
+            folder / "ack.json",
+            {**{k: package[k] for k in ("schemaVersion", "submissionId", "attemptId", "fingerprint")}, "jobId": "job"},
+        )
+
+        def execute(colour):
+            execution = farm_protocol.prepare_execution(package, package["stagedPrompt"], self.roots[0], 0)
+            name = execution["executionId"] + ".png"
+            Image.new("RGB", (16, 16), colour).save(self.roots[1] / name)
+            history = {
+                "prompt": [0, "worker", execution["prompt"]],
+                "status": {"completed": True, "status_str": "success"},
+                "outputs": {"save": {"images": [{"filename": name, "type": "output"}]}},
+            }
+            farm_protocol.finalize(package, execution, "worker", history, self.media.host_roots, "render", "job")
+
+        collector = Collector(self.workspace, self.base_media)
+        execute("blue")
+        with patch("spool.farm.deadline_command", return_value=""):
+            collector.scan()
+        takes = self.store.get(self.project["id"])["document"]["clips"][0]["takes"]
+        # Deadline retries the task: a second, later execution of the same request.
+        execute("green")
+        with (
+            patch("spool.farm.deadline_command", return_value=""),
+            patch("spool.collection.Collector.HISTORY_INTERVAL", 0),
+        ):
+            collector.scan()
+            clip_folder = self.store.root / "output" / "Desert walk"
+            self.assertEqual(len(list(clip_folder.glob("take-*.png"))), 2)
+            for path in clip_folder.iterdir():
+                os.utime(path, (time.time() - 60, time.time() - 60))  # past the settle time
+            collector.scan()
+            collector.scan()
+        self.assertEqual(self.store.get(self.project["id"])["document"]["clips"][0]["takes"], takes)
+
+
+class UnavailableFolderTests(unittest.TestCase):
+    def setUp(self):
+        temp = tempfile.TemporaryDirectory()
+        self.addCleanup(temp.cleanup)
+        self.root = Path(temp.name)
+
+    def test_a_folder_that_cannot_open_leaves_the_other_projects_working(self):
+        workspace = Workspace(self.root / "app")
+        good = workspace.create({"project": "Good", "clips": [], "media": []}, self.root / "projects" / "Good")
+        workspace.create({"project": "Newer", "clips": [], "media": []}, self.root / "projects" / "Newer")
+        manifest = self.root / "projects" / "Newer" / "project.json"
+        # A newer Spool on another computer upgraded the shared folder.
+        manifest.write_text(json.dumps({**json.loads(manifest.read_text()), "formatVersion": 99}))
+        restarted = Workspace(self.root / "app")
+        listed = {row["name"]: row for row in restarted.list()}
+        self.assertTrue(listed["Newer"]["unavailable"])
+        self.assertEqual(listed["Good"]["id"], good["id"])
+        self.assertEqual([store.root.name for store in restarted.project_stores()], ["Good"])
+        with self.assertRaises(NotFound):
+            restarted.lookup("attempts", "missing")
+
+    def test_a_folder_upgraded_while_open_is_skipped_by_later_scans(self):
+        workspace = Workspace(self.root / "app")
+        workspace.create({"project": "Good", "clips": [], "media": []}, self.root / "projects" / "Good")
+        workspace.create({"project": "Newer", "clips": [], "media": []}, self.root / "projects" / "Newer")
+        self.assertEqual(len(workspace.project_stores()), 2)
+        manifest = self.root / "projects" / "Newer" / "project.json"
+        manifest.write_text(json.dumps({**json.loads(manifest.read_text()), "formatVersion": 99}))
+        stores = workspace.project_stores()
+        self.assertEqual([store.root.name for store in stores], ["Good"])
+        for store in stores:
+            store.pending()
+
+    def test_a_failing_upgrade_is_not_retried_on_every_scan(self):
+        workspace = Workspace(self.root / "app")
+        folder = self.root / "projects" / "Old"
+        workspace.create({"project": "Old", "clips": [], "media": []}, folder)
+        with closing(sqlite3.connect(folder / "project.spool")) as db, db:
+            db.execute("PRAGMA user_version=6")
+        (folder / "project.json").unlink()
+        restarted = Workspace(self.root / "app")
+        with patch.object(Store, "_migration7", side_effect=sqlite3.OperationalError("step 7 failed")):
+            for _ in range(10):
+                self.assertEqual(restarted.project_stores(), [])
+        self.assertEqual(len(list((folder / ".spool" / "backups").iterdir())), 1)
+
+    def test_projects_imported_at_once_all_stay_listed(self):
+        workspace = Workspace(self.root / "app")
+        export = {"spoolVersion": 1, "document": {"project": "Imported", "clips": [], "media": []}}
+        start = threading.Barrier(8)
+
+        def imported(_):
+            start.wait()
+            return workspace.import_project(export)["id"]
+
+        with ThreadPoolExecutor(8) as pool:
+            created = set(pool.map(imported, range(8)))
+        self.assertEqual({row["id"] for row in workspace.folders()}, created)
+        self.assertEqual({row["id"] for row in Workspace(self.root / "app").list()}, created)
+
+
+class MaintenanceCacheTests(unittest.TestCase):
+    def test_confirmed_maintenance_ignores_a_working_copy_planted_in_shared_temp(self):
+        temp = tempfile.TemporaryDirectory()
+        self.addCleanup(temp.cleanup)
+        folder = (Path(temp.name) / "projects" / "Film").resolve()
+        Workspace(Path(temp.name) / "app").create({"project": "Film", "clips": [], "media": []}, folder)
+        # Another user of this computer can write the system temporary folder.
+        shared = Path(tempfile.gettempdir()) / "spool-maintenance" / hashlib.sha256(str(folder).encode()).hexdigest()
+        shared.mkdir(parents=True, exist_ok=True)
+        self.addCleanup(shutil.rmtree, shared, True)
+        shutil.copyfile(folder / "project.spool", shared / "working.sqlite3")
+        with closing(sqlite3.connect(shared / "working.sqlite3")) as db, db:
+            db.execute("UPDATE projects SET document=json_set(document,'$.project','Forged')")
+            db.execute("CREATE TABLE revisions(document TEXT)")
+        stat = (folder / "project.spool").stat()
+        (shared / "checkpoint.json").write_text(json.dumps([stat.st_mtime_ns, stat.st_size]))
+        before = set(Path(tempfile.gettempdir()).glob("spool-maintenance-*"))
+        with contextlib.redirect_stdout(io.StringIO()):
+            self.assertEqual(maintenance.run(["--storage", str(folder), "--confirm", "--json"]), 0)
+        with closing(sqlite3.connect(folder / "project.spool")) as db:
+            name = db.execute("SELECT json_extract(document,'$.project') FROM projects").fetchone()[0]
+        self.assertEqual(name, "Film")
+        self.assertEqual(set(Path(tempfile.gettempdir()).glob("spool-maintenance-*")), before)
+
+
+class CrashRecoveryTests(unittest.TestCase):
+    def test_a_crashed_save_cannot_roll_back_another_computers_publications(self):
+        temp = tempfile.TemporaryDirectory()
+        self.addCleanup(temp.cleanup)
+        root = Path(temp.name)
+        folder = root / "projects" / "Film"
+        here = Workspace(root / "here")
+        project_id = here.create({"project": "initial", "clips": [], "media": []}, folder)["id"]
+        # A writer on this computer dies inside a transaction, leaving a hot rollback journal.
+        crash = (
+            "import os, sys\n"
+            "from spool.projects import Workspace\n"
+            "store = Workspace(sys.argv[1]).for_project(sys.argv[2])\n"
+            "with store.editing(sys.argv[2], 0) as edit:\n"
+            "    edit.db.execute('PRAGMA cache_size=1')\n"
+            "    edit.save({'project': 'uncommitted', 'clips': [], 'media': []})\n"
+            "    edit.db.execute('CREATE TABLE junk(x)')\n"
+            "    edit.db.executemany('INSERT INTO junk VALUES(?)', ((os.urandom(2000),) for _ in range(50)))\n"
+            "    os._exit(9)\n"
+        )
+        subprocess.run([sys.executable, "-c", crash, str(here.root), project_id], cwd=ROOT, check=False)
+        journal = here.for_project(project_id).runtime.with_name("working.sqlite3-journal")
+        self.assertTrue(journal.exists())
+        # Another computer publishes newer work to the shared folder meanwhile.
+        there = Workspace(root / "there").open_folder(folder)
+        other = Workspace(root / "there").for_project(project_id)
+        revision = there["revision"]
+        for index in range(3):
+            revision = other.save(project_id, revision, {"project": "there %d" % index, "clips": [], "media": []})[
+                "revision"
+            ]
+        restarted = Workspace(root / "here").for_project(project_id)
+        self.assertEqual(restarted.get(project_id)["document"]["project"], "there 2")
+        saved = restarted.save(project_id, revision, {"project": "here", "clips": [], "media": []})
+        self.assertEqual(saved["revision"], revision + 1)
+        self.assertEqual(Workspace(root / "third").open_folder(folder)["document"]["project"], "here")
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/tests/test_queue_operations.py b/tests/test_queue_operations.py
index 9eba0fb..9921951 100644
--- a/tests/test_queue_operations.py
+++ b/tests/test_queue_operations.py
@@ -85,6 +85,12 @@ def test_prepare_handoff_supports_new_shot_and_rejects_stale_graph_request(self)
         with self.assertRaises(ValueError):
             self.store.handoff(self.project["id"], {**data, "workflow": {}})
 
+    def test_cloud_refuses_an_image_result_it_could_never_collect(self):
+        recipe = {**copy.deepcopy(self.recipe), "executionTarget": "cloud"}
+        self.project = self.store.capture(self.project["id"], self.project["revision"], "shot", recipe)
+        with patch("spool.cloud.available", return_value=True), self.assertRaisesRegex(ValueError, "video only"):
+            requests.prepare(self.store, self.media, self.store.get(self.project["id"]), self.items)
+
     def tearDown(self):
         self.temp.cleanup()
 
diff --git a/tests/test_reconcile_serialization.py b/tests/test_reconcile_serialization.py
new file mode 100644
index 0000000..9a1ebf9
--- /dev/null
+++ b/tests/test_reconcile_serialization.py
@@ -0,0 +1,378 @@
+"""Manual reconciliation shares collection ownership with the host loops.
+
+These checks use local files, real stores/collectors and an isolated HTTP host;
+no Comfy, Cloud or Deadline service is contacted.
+"""
+
+import asyncio
+import shutil
+import subprocess
+import threading
+import unittest
+from contextlib import contextmanager
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from aiohttp import web
+from aiohttp.test_utils import TestClient, TestServer
+from PIL import Image
+
+from spool import attempts, receipts, requests
+from spool.cloud import CloudExecutor, storage_call
+from spool.collection import Collector
+from spool.execution import LocalExecutor
+from spool.media import Media
+from spool.ownership import ExecutorBusy, ExecutorLock
+from spool.projects import Workspace
+from spool.routes import register
+import test_farm_protocol as fixtures
+
+
+class ReconcileSerializationTests(unittest.IsolatedAsyncioTestCase):
+    setUp = fixtures.FarmProtocolTests.setUp
+    tearDown = fixtures.FarmProtocolTests.tearDown
+    accept = fixtures.FarmProtocolTests.accept
+    package = fixtures.FarmProtocolTests.package
+    finish = fixtures.FarmProtocolTests.finish
+
+    async def wait_for(self, event):
+        await asyncio.wait_for(event.wait(), 5)
+
+    async def checkpoint(self):
+        turn = asyncio.get_running_loop().create_future()
+        asyncio.get_running_loop().call_soon(turn.set_result, None)
+        await turn
+
+    @contextmanager
+    def watch_waiters(self, collector, waiting):
+        """Notify when a production collection operation has reached a held lock."""
+        loop, original = asyncio.get_running_loop(), collector.project_lock
+
+        @contextmanager
+        def observed(store):
+            lock = original(store)
+            if not lock.acquire(blocking=False):
+                loop.call_soon_threadsafe(waiting.set)
+                lock.acquire()
+            try:
+                yield
+            finally:
+                lock.release()
+
+        with patch.object(collector, "project_lock", observed):
+            yield
+
+    def server(self):
+        queue = SimpleNamespace(get_current_queue=lambda: ([], []), get_history=lambda prompt_id=None: {})
+        return SimpleNamespace(routes=web.RouteTableDef(), app=web.Application(), prompt_queue=queue)
+
+    def executor(self, server=None):
+        # An already submitted farm attempt must never go through submit again.
+        for attempt in self.farm_attempts:
+            self.store.transition(attempt["id"], attempts.FARM_RUNNING)
+        return LocalExecutor(self.store, self.media, server or self.server(), validate=None)
+
+    async def check_route_during_deadline_collection(self, embedded):
+        attempt = self.farm_attempts[0]
+        self.finish(attempt)
+        server = self.server()
+        executor = self.executor(server) if embedded else None
+        collector = executor.collector if executor else Collector(self.store, self.media)
+        loop = asyncio.get_running_loop()
+        copying, waiting, release = asyncio.Event(), asyncio.Event(), threading.Event()
+        original, copies = shutil.copyfile, []
+
+        def held_copy(source, target, *args, **kwargs):
+            if str(target).endswith(".partial"):
+                copies.append(str(target))
+                loop.call_soon_threadsafe(copying.set)
+                self.assertTrue(release.wait(5), "Test did not release the farm artifact copy")
+            return original(source, target, *args, **kwargs)
+
+        with patch("spool.routes.Collector", return_value=collector):
+            register(server, self.store, self.media, executor)
+        # Run the production collection/local lifecycle alone, without launching
+        # Comfy or Cloud clients in this isolated host.
+        server.app.cleanup_ctx.clear()
+        server.app.cleanup_ctx.append(executor.poll if executor else collector.lifecycle)
+        server.app.add_routes(server.routes)
+        with self.watch_waiters(collector, waiting), patch("spool.farm.shutil.copyfile", held_copy):
+            async with TestClient(TestServer(server.app)) as client:
+                request = None
+                try:
+                    await self.wait_for(copying)
+                    request = asyncio.create_task(client.post("/spool/api/reconcile", json={}))
+                    await self.wait_for(waiting)
+                    self.assertFalse(request.done())
+                    fast = await asyncio.wait_for(client.get("/spool/ui/bootstrap.js"), 2)
+                    self.assertEqual(fast.status, 200)
+                    self.assertEqual(len(copies), 1)
+                finally:
+                    release.set()
+                    if request:
+                        response = await asyncio.wait_for(request, 5)
+                        self.assertEqual(response.status, 200, await response.text())
+        self.assertEqual(len(copies), 1, "Overlapping scans recopied the same farm artifact")
+        self.assertEqual(self.store.attempt(attempt["id"])["status"], attempts.COMPLETE)
+        project = self.store.get(self.project["id"])
+        self.assertEqual(len(project["document"]["clips"][0]["takes"]), 1)
+        self.assertEqual(project["document"]["clips"][0]["takeId"], "original")
+        self.assertFalse(list(self.store.root.rglob("*.partial")))
+
+    async def test_standalone_route_waits_for_periodic_deadline_collection(self):
+        await self.check_route_during_deadline_collection(embedded=False)
+
+    async def test_embedded_route_waits_for_local_loop_deadline_collection(self):
+        await self.check_route_during_deadline_collection(embedded=True)
+
+    def local_attempt(self):
+        project = self.store.get(self.project["id"])
+        project = self.store.capture(project["id"], project["revision"], "shot", self.recipe)
+        project = requests.accept(
+            self.store, self.media, project["id"], project["revision"], [{"clipId": "shot", "count": 1}], "local-result"
+        )
+        return self.store.attempt(project["document"]["jobs"][-1]["id"])
+
+    def write_local_receipt(self, attempt, group="images", filename="finished.png"):
+        history = {
+            "status": {"completed": True, "status_str": "success"},
+            "outputs": {"save": {group: [{"filename": filename, "type": "output"}]}},
+        }
+        artifacts, primary = self.media.collect(attempt, history, False)
+        receipts.write(self.media.receipt_path(attempt).parent, attempt, artifacts, primary, history)
+        return history
+
+    async def check_ingestion_during_scan(self, cloud):
+        if cloud:
+            project = self.store.get(self.project["id"])
+            recipe = {
+                "prompt": {"save": {"class_type": "SaveVideo", "inputs": {"filename_prefix": "cloud"}}},
+                "bindings": [],
+                "result": {"nodeId": "save", "group": "videos", "index": 0},
+                "executionTarget": "cloud",
+            }
+            project = self.store.capture(project["id"], project["revision"], "shot", recipe)
+            with patch("spool.cloud.available", return_value=True):
+                project = requests.accept(
+                    self.store,
+                    self.media,
+                    project["id"],
+                    project["revision"],
+                    [{"clipId": "shot", "count": 1}],
+                    "cloud-receipt",
+                )
+            attempt = self.store.attempt(project["document"]["jobs"][-1]["id"])
+            subprocess.run(
+                [
+                    "ffmpeg", "-v", "error", "-y", "-f", "lavfi", "-i", "color=c=blue:s=16x16:r=24:d=0.125",
+                    "-c:v", "libx264", "-pix_fmt", "yuv420p", str(self.root / "output" / "finished.mp4"),
+                ],
+                check=True,
+                capture_output=True,
+            )  # fmt: skip
+            self.write_local_receipt(attempt, "videos", "finished.mp4")
+            collector = Collector(self.store, self.media)
+            executor = CloudExecutor(self.store, self.media, collector)
+            observe = lambda: executor.observe(attempt)
+        else:
+            attempt = self.local_attempt()
+            Image.new("RGB", (8, 8), "blue").save(self.root / "output" / "finished.png")
+            history = self.write_local_receipt(attempt)
+            executor = self.executor()
+            self.store.claim(attempt["id"], executor.session_id)
+            self.store.transition(attempt["id"], attempts.QUEUED)
+            executor.server.prompt_queue.get_history = lambda prompt_id: {prompt_id: history}
+            collector = executor.collector
+            observe = executor.reconcile
+
+        loop = asyncio.get_running_loop()
+        reviewing, waiting, release = asyncio.Event(), asyncio.Event(), threading.Event()
+        original, reviews = self.media.review_receipt, []
+
+        def held_review(*args, **kwargs):
+            reviews.append(args[0]["attemptId"])
+            loop.call_soon_threadsafe(reviewing.set)
+            self.assertTrue(release.wait(5), "Test did not release receipt review")
+            return original(*args, **kwargs)
+
+        with (
+            self.watch_waiters(collector, waiting),
+            patch.object(self.media, "review_receipt", held_review),
+            patch("spool.cloud.cloud_key", side_effect=AssertionError("Receipt recovery must not use a Cloud key")),
+        ):
+            scan = asyncio.create_task(storage_call(collector.scan))
+            observation = None
+            try:
+                await self.wait_for(reviewing)
+                observation = asyncio.create_task(observe())
+                await self.wait_for(waiting)
+                self.assertFalse(observation.done())
+                self.assertEqual(reviews, [attempt["id"]])
+            finally:
+                release.set()
+                await asyncio.wait_for(scan, 5)
+                if observation:
+                    await asyncio.wait_for(observation, 5)
+        self.assertEqual(reviews, [attempt["id"]], "Concurrent ingestion repeated media review/sidecar preparation")
+        self.assertEqual(self.store.attempt(attempt["id"])["status"], attempts.COMPLETE)
+        self.assertEqual(len(self.store.get(self.project["id"])["document"]["clips"][0]["takes"]), 1)
+
+    async def test_cloud_receipt_ingestion_waits_for_scan(self):
+        await self.check_ingestion_during_scan(cloud=True)
+
+    async def test_local_observation_waits_for_scan(self):
+        await self.check_ingestion_during_scan(cloud=False)
+
+    async def test_cancelled_local_reconcile_retains_async_ownership_until_worker_finishes(self):
+        executor = self.executor()
+        loop = asyncio.get_running_loop()
+        entered, release, finished = asyncio.Event(), threading.Event(), threading.Event()
+        original, calls = executor.pending_attempts, []
+
+        def held_pending():
+            calls.append(True)
+            if len(calls) == 1:
+                loop.call_soon_threadsafe(entered.set)
+                self.assertTrue(release.wait(5))
+                finished.set()
+            return original()
+
+        with patch.object(executor, "pending_attempts", held_pending):
+            first = asyncio.create_task(executor.reconcile())
+            second = None
+            try:
+                await self.wait_for(entered)
+                first.cancel()
+                await self.checkpoint()
+                # A second cancellation must not cancel the drain's own task.
+                first.cancel()
+                await self.checkpoint()
+                second = asyncio.create_task(executor.reconcile())
+                await self.checkpoint()
+                self.assertFalse(first.done())
+                self.assertTrue(executor.lock.locked())
+                self.assertEqual(len(calls), 1)
+            finally:
+                release.set()
+                with self.assertRaises(asyncio.CancelledError):
+                    await first
+                if second:
+                    await asyncio.wait_for(second, 5)
+        self.assertTrue(finished.is_set())
+        self.assertEqual(len(calls), 2)
+        self.assertFalse(executor.lock.locked())
+
+    async def test_local_lifecycle_drains_worker_before_retiring_host_and_releasing_process_lock(self):
+        executor = self.executor()
+        loop = asyncio.get_running_loop()
+        entered, release, finished = asyncio.Event(), threading.Event(), threading.Event()
+        original = executor.pending_attempts
+
+        def held_pending():
+            loop.call_soon_threadsafe(entered.set)
+            self.assertTrue(release.wait(5))
+            result = original()
+            finished.set()
+            return result
+
+        with patch.object(executor, "pending_attempts", held_pending):
+            lifecycle = executor.poll(None)
+            await anext(lifecycle)
+            closing = None
+            try:
+                await self.wait_for(entered)
+                closing = asyncio.create_task(lifecycle.aclose())
+                await self.checkpoint()
+                self.assertFalse(closing.done())
+                self.assertTrue(self.store.host()["connected"])
+                competing = ExecutorLock(self.store.root)
+                with self.assertRaises(ExecutorBusy):
+                    competing.acquire()
+            finally:
+                release.set()
+                if closing:
+                    await asyncio.wait_for(closing, 5)
+                else:
+                    await lifecycle.aclose()
+        self.assertTrue(finished.is_set())
+        self.assertFalse(self.store.host()["connected"])
+        competing = ExecutorLock(self.store.root)
+        competing.acquire()
+        competing.close()
+
+    async def test_collector_lifecycle_drains_scan_before_closing(self):
+        collector = Collector(self.store, self.media)
+        loop = asyncio.get_running_loop()
+        entered, release, finished = asyncio.Event(), threading.Event(), threading.Event()
+        original = collector.scan
+
+        def held_scan():
+            loop.call_soon_threadsafe(entered.set)
+            self.assertTrue(release.wait(5))
+            original()
+            finished.set()
+
+        with patch.object(collector, "scan", held_scan):
+            lifecycle = collector.lifecycle(None)
+            await anext(lifecycle)
+            closing = None
+            try:
+                await self.wait_for(entered)
+                closing = asyncio.create_task(lifecycle.aclose())
+                await self.checkpoint()
+                self.assertFalse(closing.done())
+                self.assertFalse(finished.is_set())
+            finally:
+                release.set()
+                if closing:
+                    await asyncio.wait_for(closing, 5)
+                else:
+                    await lifecycle.aclose()
+        self.assertTrue(finished.is_set())
+
+    async def test_different_projects_can_collect_while_one_project_is_blocked(self):
+        workspace = Workspace(self.root / "multi-project-app")
+        first = workspace.create({"project": "First", "clips": []})
+        second = workspace.create({"project": "Second", "clips": []})
+        first_store, second_store = workspace.for_project(first["id"]), workspace.for_project(second["id"])
+        media = Media(workspace.root, *self.media.host_roots.values())
+        collector = Collector(workspace, media)
+        loop = asyncio.get_running_loop()
+        entered, release = asyncio.Event(), threading.Event()
+        original = first_store.scan_attempts
+
+        def held_attempts(*args, **kwargs):
+            loop.call_soon_threadsafe(entered.set)
+            self.assertTrue(release.wait(5))
+            return original(*args, **kwargs)
+
+        with patch.object(first_store, "scan_attempts", held_attempts):
+            blocked = asyncio.create_task(storage_call(collector.scan_project, first_store))
+            try:
+                await self.wait_for(entered)
+                await asyncio.wait_for(storage_call(collector.scan_project, second_store), 2)
+                self.assertFalse(blocked.done())
+                self.assertIn(str(second_store.root), collector.retained_at)
+            finally:
+                release.set()
+                await asyncio.wait_for(blocked, 5)
+
+    async def test_failed_local_lifecycle_still_releases_ownership(self):
+        executor = self.executor()
+        entered = asyncio.Event()
+
+        async def failed_run():
+            entered.set()
+            raise BaseExceptionGroup("loop failed", [RuntimeError("failure"), asyncio.CancelledError()])
+
+        with patch.object(executor, "run", failed_run):
+            lifecycle = executor.poll(None)
+            await anext(lifecycle)
+            await self.wait_for(entered)
+            with self.assertRaises(BaseExceptionGroup):
+                await lifecycle.aclose()
+        self.assertFalse(executor.managed)
+        self.assertFalse(self.store.host()["connected"])
+        competing = ExecutorLock(self.store.root)
+        competing.acquire()
+        competing.close()
diff --git a/tests/test_request_rejection.py b/tests/test_request_rejection.py
new file mode 100644
index 0000000..7dffede
--- /dev/null
+++ b/tests/test_request_rejection.py
@@ -0,0 +1,101 @@
+import tempfile
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+from spool import requests
+from spool.media import Media, sha256
+from spool.store import Store
+
+
+class RequestRejectionTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name)
+        self.store = Store(self.root / "store")
+        for folder in ("input", "output", "temp"):
+            (self.root / folder).mkdir()
+        (self.root / "input" / "source.png").write_bytes(b"unchanged source")
+        self.media = Media(self.store.root, self.root / "input", self.root / "output", self.root / "temp")
+        self.project = self.store.create(
+            {
+                "project": "Queue rejection",
+                "clips": [
+                    {"id": identity, "name": identity, "in": 0, "out": 24, "takes": []}
+                    for identity in ("first", "second")
+                ],
+                "media": [],
+            }
+        )
+        for identity in ("first", "second"):
+            self.capture(identity)
+
+    def capture(self, identity, filename="source.png"):
+        self.project = self.store.capture(
+            self.project["id"],
+            self.project["revision"],
+            identity,
+            {
+                "workflow": {"nodes": [], "links": []},
+                "prompt": {
+                    "load": {"class_type": "LoadImage", "inputs": {"image": filename}},
+                    "save": {
+                        "class_type": "SaveImage",
+                        "inputs": {"images": ["load", 0], "filename_prefix": "test"},
+                    },
+                },
+                "bindings": [],
+                "result": {"nodeId": "save", "group": "images", "index": 0},
+            },
+        )
+
+    def items(self, count=1):
+        return [{"clipId": "first", "count": 1}, {"clipId": "second", "count": count}]
+
+    def snapshots(self):
+        return set((self.root / "input" / "spool-frozen").glob("*"))
+
+    def test_later_invalid_item_creates_no_snapshots_and_keeps_accepted_ones(self):
+        accepted = requests.prepare(self.store, self.media, self.project, self.items())
+        before = {path: path.read_bytes() for path in self.snapshots()}
+        with patch.object(self.media, "freeze_asset", wraps=self.media.freeze_asset) as freeze:
+            with self.assertRaisesRegex(ValueError, "1-16"):
+                requests.prepare(self.store, self.media, self.project, self.items(0))
+            freeze.assert_not_called()
+        self.assertEqual({path: path.read_bytes() for path in self.snapshots()}, before)
+        self.assertEqual(accepted[0][1]["assets"][0]["frozen"], accepted[1][1]["assets"][0]["frozen"])
+
+    def test_later_missing_input_creates_no_snapshot(self):
+        self.capture("second", "missing.png")
+        with patch.object(self.media, "freeze_asset", wraps=self.media.freeze_asset) as freeze:
+            with self.assertRaises((ValueError, FileNotFoundError)):
+                requests.prepare(self.store, self.media, self.project, self.items())
+            freeze.assert_not_called()
+        self.assertEqual(self.snapshots(), set())
+
+    def test_accepted_batch_shares_one_snapshot_and_a_new_batch_gets_new_bytes(self):
+        with patch.object(self.media, "freeze_asset", wraps=self.media.freeze_asset) as freeze:
+            accepted = requests.prepare(self.store, self.media, self.project, self.items())
+            self.assertEqual(freeze.call_count, 1)
+        first = accepted[0][1]["assets"][0]
+        frozen = self.root / "input" / first["frozen"]
+        self.assertEqual(first["sha256"], sha256(frozen))
+        for _, request in accepted:
+            self.assertEqual(request["assets"][0]["frozen"], first["frozen"])
+            self.assertEqual(request["prompt"]["load"]["inputs"]["image"], first["frozen"])
+        (self.root / "input" / "source.png").write_bytes(b"later source")
+        later = requests.prepare(self.store, self.media, self.project, self.items())
+        self.assertEqual(frozen.read_bytes(), b"unchanged source")
+        self.assertNotEqual(later[0][1]["assets"][0]["frozen"], first["frozen"])
+
+    def test_preview_never_creates_a_snapshot(self):
+        with patch.object(self.media, "freeze_asset", wraps=self.media.freeze_asset) as freeze:
+            prepared = requests.prepare(self.store, self.media, self.project, self.items(), freeze=False)
+            freeze.assert_not_called()
+        self.assertEqual(prepared[0][1]["prompt"]["load"]["inputs"]["image"], "source.png")
+        self.assertEqual(self.snapshots(), set())
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_required_request_fields.py b/tests/test_required_request_fields.py
new file mode 100644
index 0000000..f37d917
--- /dev/null
+++ b/tests/test_required_request_fields.py
@@ -0,0 +1,247 @@
+"""Required request fields fail as client errors before a route changes anything."""
+
+import json
+import tempfile
+import unittest
+from pathlib import Path
+from types import SimpleNamespace
+
+from aiohttp import web
+from aiohttp.test_utils import TestClient, TestServer
+
+from spool.media import Media
+from spool.projects import Workspace
+from spool.routes import register
+
+
+def capture():
+    """A capture with no media inputs, so validation never stages a file."""
+    return {
+        "workflow": {"nodes": []},
+        "prompt": {
+            "solid": {
+                "class_type": "EmptyImage",
+                "inputs": {"width": 16, "height": 16, "batch_size": 1, "color": 0},
+            },
+            "save": {
+                "class_type": "SaveImage",
+                "inputs": {"images": ["solid", 0], "filename_prefix": "required-fields"},
+            },
+        },
+        "bindings": [],
+        "result": {"nodeId": "save", "group": "images", "index": 0},
+    }
+
+
+class RequiredRequestFieldTests(unittest.IsolatedAsyncioTestCase):
+    async def asyncSetUp(self):
+        self.directory = tempfile.TemporaryDirectory()
+        self.addCleanup(self.directory.cleanup)
+        root = Path(self.directory.name)
+        for kind in ("input", "output", "temp"):
+            (root / kind).mkdir()
+        self.workspace = Workspace(root / "app")
+        self.project = self.workspace.create(
+            {
+                "project": "Required fields QA",
+                "clips": [
+                    {
+                        "id": "shot",
+                        "name": "shot",
+                        "in": 0,
+                        "out": 24,
+                        "takeId": "original",
+                        "takes": [
+                            {
+                                "id": "original",
+                                "number": 0,
+                                "media": {
+                                    "id": "original",
+                                    "kind": "image",
+                                    "file": "output/Shot/original.png",
+                                    "frames": 24,
+                                },
+                            },
+                            {
+                                "id": "spare",
+                                "number": 1,
+                                "media": {
+                                    "id": "spare",
+                                    "kind": "image",
+                                    "file": "output/Shot/spare.png",
+                                    "frames": 24,
+                                },
+                            },
+                        ],
+                    }
+                ],
+                "media": [],
+            }
+        )
+        self.store = self.workspace.for_project(self.project["id"])
+        for name in ("original", "spare"):
+            path = self.store.root / "output" / "Shot" / (name + ".png")
+            path.parent.mkdir(parents=True, exist_ok=True)
+            path.write_bytes(name.encode())
+        self.media = Media(self.workspace.root, root / "input", root / "output", root / "temp")
+        server = SimpleNamespace(routes=web.RouteTableDef(), app=web.Application())
+        register(server, self.workspace, self.media)
+        server.app.cleanup_ctx.clear()
+        server.app.add_routes(server.routes)
+        self.client = TestClient(TestServer(server.app))
+        await self.client.start_server()
+        self.addAsyncCleanup(self.client.close)
+        self.base = "/spool/api/projects/" + self.project["id"]
+
+    def state(self):
+        return self.store.get(self.project["id"])
+
+    async def send(self, method, path, body):
+        return await getattr(self.client, method.lower())(path, json=body)
+
+    async def test_missing_revision_is_invalid_before_any_change(self):
+        before = self.state()
+        cases = [
+            ("PUT", self.base, {"document": before["document"]}),
+            ("POST", self.base + "/generation-preview", {"clipId": "shot"}),
+            ("POST", self.base + "/capture/shot", {"capture": capture()}),
+            ("POST", self.base + "/use-take/shot", {"takeId": "original"}),
+            ("POST", self.base + "/delete-takes/shot", {"takeIds": ["spare"]}),
+            ("POST", self.base + "/queue", {"items": [{"clipId": "shot", "count": 1}]}),
+        ]
+        for method, path, body in cases:
+            response = await self.send(method, path, body)
+            value = await response.json()
+            self.assertEqual((response.status, value["code"]), (400, "invalid_request"), path)
+            self.assertIn("revision", value["error"], path)
+            self.assertEqual(self.state(), before, path)
+
+    async def test_missing_required_body_fields_are_invalid_before_any_change(self):
+        before = self.state()
+        revision = before["revision"]
+        cases = [
+            ("PUT", self.base, {"revision": revision}, "document"),
+            ("POST", self.base + "/generation-preview", {"revision": revision}, "clipId"),
+            ("POST", self.base + "/capture/shot", {"revision": revision}, "capture"),
+            ("POST", self.base + "/use-take/shot", {"revision": revision}, "takeId"),
+            ("POST", self.base + "/delete-takes/shot", {"revision": revision}, "takeIds"),
+        ]
+        for method, path, body, field in cases:
+            response = await self.send(method, path, body)
+            value = await response.json()
+            self.assertEqual((response.status, value["code"]), (400, "invalid_request"), path)
+            self.assertIn(field, value["error"], path)
+            self.assertEqual(self.state(), before, path)
+
+    async def test_missing_or_malformed_import_revision_header_is_invalid_before_import(self):
+        before = self.state()
+        body = json.dumps({"nodes": [], "links": []})
+        for headers in (
+            {"X-Filename": "empty.json"},
+            {"X-Filename": "empty.json", "X-Spool-Revision": "not-a-number"},
+            {"X-Filename": "empty.json", "X-Spool-Revision": ""},
+        ):
+            response = await self.client.post(self.base + "/import-workflow", data=body, headers=headers)
+            value = await response.json()
+            self.assertEqual((response.status, value["code"]), (400, "invalid_request"), headers)
+            self.assertIn("X-Spool-Revision", value["error"])
+            self.assertEqual(self.state(), before)
+        response = await self.client.post(
+            self.base + "/import-workflow",
+            data=body,
+            headers={"X-Filename": "empty.json", "X-Spool-Revision": str(before["revision"])},
+        )
+        self.assertEqual(response.status, 200, await response.text())
+        imported = await response.json()
+        self.assertEqual(len(imported["project"]["document"]["importedWorkflows"]), 1)
+        self.assertEqual(imported["project"]["revision"], before["revision"] + 1)
+
+    async def test_stale_revision_still_conflicts(self):
+        before = self.state()
+        stale = before["revision"] + 1
+        cases = [
+            ("PUT", self.base, {"revision": stale, "document": before["document"]}),
+            ("POST", self.base + "/generation-preview", {"revision": stale, "clipId": "shot"}),
+            ("POST", self.base + "/capture/shot", {"revision": stale, "capture": capture()}),
+            ("POST", self.base + "/use-take/shot", {"revision": stale, "takeId": "original"}),
+            ("POST", self.base + "/delete-takes/shot", {"revision": stale, "takeIds": ["spare"]}),
+            ("POST", self.base + "/queue", {"revision": stale, "items": [{"clipId": "shot", "count": 1}]}),
+        ]
+        for method, path, body in cases:
+            response = await self.send(method, path, body)
+            value = await response.json()
+            self.assertEqual((response.status, value["code"]), (409, "revision_conflict"), path)
+            self.assertEqual(self.state(), before, path)
+        response = await self.client.post(
+            self.base + "/import-workflow",
+            data=json.dumps({"nodes": [], "links": []}),
+            headers={"X-Filename": "empty.json", "X-Spool-Revision": str(stale)},
+        )
+        value = await response.json()
+        self.assertEqual((response.status, value["code"]), (409, "revision_conflict"))
+        self.assertEqual(self.state(), before)
+
+    async def test_malformed_body_and_payload_shapes_are_invalid(self):
+        before = self.state()
+        cases = [
+            ("PUT", self.base, "[]"),
+            ("PUT", self.base, "null"),
+            ("POST", self.base + "/queue", '"queue"'),
+            ("POST", self.base + "/capture/shot", "{}"),
+        ]
+        for method, path, raw in cases:
+            response = await getattr(self.client, method.lower())(
+                path, data=raw, headers={"Content-Type": "application/json"}
+            )
+            value = await response.json()
+            self.assertEqual((response.status, value["code"]), (400, "invalid_request"), path)
+            self.assertEqual(self.state(), before, path)
+        for body, field in (
+            ({"revision": before["revision"], "document": None}, "document"),
+            ({"revision": before["revision"], "capture": None}, "capture"),
+        ):
+            path = self.base if field == "document" else self.base + "/capture/shot"
+            response = await self.send("PUT" if field == "document" else "POST", path, body)
+            value = await response.json()
+            self.assertEqual((response.status, value["code"]), (400, "invalid_request"), field)
+            self.assertIn(field, value["error"])
+            self.assertEqual(self.state(), before, field)
+
+    async def test_valid_revisions_still_reach_each_route(self):
+        before = self.state()
+        response = await self.send("PUT", self.base, {"revision": before["revision"], "document": before["document"]})
+        self.assertEqual(response.status, 200, await response.text())
+        saved = await response.json()
+        response = await self.send(
+            "POST", self.base + "/capture/shot", {"revision": saved["revision"], "capture": capture()}
+        )
+        self.assertEqual(response.status, 200, await response.text())
+        saved = await response.json()
+        response = await self.send(
+            "POST", self.base + "/generation-preview", {"revision": saved["revision"], "clipId": "shot"}
+        )
+        self.assertEqual(response.status, 200, await response.text())
+        response = await self.send(
+            "POST",
+            self.base + "/queue",
+            {"revision": saved["revision"], "items": [{"clipId": "shot", "count": 1}]},
+        )
+        self.assertEqual(response.status, 200, await response.text())
+        queued = await response.json()
+        self.assertEqual(len(queued["document"]["jobs"]), 1)
+        response = await self.send(
+            "POST", self.base + "/use-take/shot", {"revision": queued["revision"], "takeId": "original"}
+        )
+        self.assertEqual(response.status, 200, await response.text())
+        chosen = await response.json()
+        response = await self.send(
+            "POST", self.base + "/delete-takes/shot", {"revision": chosen["revision"], "takeIds": ["spare"]}
+        )
+        self.assertEqual(response.status, 200, await response.text())
+        deleted = await response.json()
+        self.assertEqual(deleted["deleted"], ["spare"])
+        self.assertEqual(deleted["project"]["revision"], chosen["revision"] + 1)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_security.py b/tests/test_security.py
index 85a2f8b..7a93dfb 100644
--- a/tests/test_security.py
+++ b/tests/test_security.py
@@ -131,6 +131,38 @@ async def test_take_downloads_outside_the_project_stay_on_this_computer(self):
         self.assertEqual(response.status, 200, await response.text())
         self.assertEqual(await response.read(), b"project footage")
 
+    async def test_frames_of_footage_outside_the_project_stay_on_this_computer(self):
+        # A comparison sheet or cut list is made from the original, so it is read
+        # under the same rule as downloading that original.
+        with patch.object(Media, "comparison", return_value={"url": "", "takes": []}) as compare:
+            for take_ids in (["outside"], ["inside", "outside"]):
+                response = await self.client.post(
+                    self.base + "/comparison", json={"clipId": "shot", "takeIds": take_ids}, headers=REBOUND
+                )
+                self.assertEqual(response.status, 403, await response.text())
+            compare.assert_not_called()
+            response = await self.client.post(
+                self.base + "/comparison", json={"clipId": "shot", "takeIds": ["inside"]}, headers=REBOUND
+            )
+            self.assertEqual(response.status, 200, await response.text())
+            response = await self.client.post(
+                self.base + "/comparison", json={"clipId": "shot", "takeIds": ["outside"]}
+            )
+            self.assertEqual(response.status, 200, await response.text())
+        with patch.object(Media, "find_cuts", return_value=[]) as cuts:
+            response = await self.client.post(
+                self.base + "/detect-cuts", json={"clipId": "shot", "takeId": "outside"}, headers=REBOUND
+            )
+            self.assertEqual(response.status, 403, await response.text())
+            cuts.assert_not_called()
+            for headers in (REBOUND, {}):
+                response = await self.client.post(
+                    self.base + "/detect-cuts",
+                    json={"clipId": "shot", "takeId": "inside" if headers else "outside"},
+                    headers=headers,
+                )
+                self.assertEqual(response.status, 200, await response.text())
+
     async def test_reads_and_listed_comfy_address_remain_available(self):
         response = await self.client.get("/spool/api/projects", headers=ELSEWHERE)
         self.assertEqual(response.status, 200)
diff --git a/tests/test_snapshot_publication.py b/tests/test_snapshot_publication.py
new file mode 100644
index 0000000..c190cf4
--- /dev/null
+++ b/tests/test_snapshot_publication.py
@@ -0,0 +1,352 @@
+"""A publication is identified by its contents, not by a timestamp that may repeat."""
+
+import json
+import os
+import sqlite3
+import tempfile
+import threading
+import unittest
+from contextlib import closing, contextmanager
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import patch
+
+import spool.projects as projects
+from spool.projects import ProjectStore, Workspace
+from spool.store import Conflict
+
+
+class SnapshotPublicationTests(unittest.TestCase):
+    def setUp(self):
+        temp = tempfile.TemporaryDirectory()
+        self.addCleanup(temp.cleanup)
+        self.root = Path(temp.name)
+        self.folder = self.root / "projects" / "Film"
+        self.writer = Workspace(self.root / "writer")
+        self.project = self.writer.create({"project": "Alpha", "clips": [], "media": []}, self.folder)
+        self.project_id = self.project["id"]
+        self.reader = Workspace(self.root / "reader")
+        opened = self.reader.open_folder(self.folder)
+        self.assertEqual(opened["document"]["project"], "Alpha")
+        # FAT32/HFS+ round timestamps to one or two seconds. Pinning the mtime to the
+        # value a reader already knows reproduces the stale-cache case on every filesystem.
+        self.baseline = self.snapshot().stat()
+
+    def snapshot(self):
+        return self.folder / "project.spool"
+
+    def manifest(self):
+        return self.folder / "project.json"
+
+    def save(self, workspace, name):
+        store = workspace.for_project(self.project_id)
+        current = store.get(self.project_id)
+        return store.save(self.project_id, current["revision"], {**current["document"], "project": name})
+
+    def flatten_timestamp(self):
+        os.utime(self.snapshot(), ns=(self.baseline.st_atime_ns, self.baseline.st_mtime_ns))
+        stat = self.snapshot().stat()
+        self.assertEqual((stat.st_mtime_ns, stat.st_size), (self.baseline.st_mtime_ns, self.baseline.st_size))
+
+    @contextmanager
+    def fixed_stat_identity(self, *, coarse=True):
+        """Model a share that reports the same identity for every replacement."""
+        original = Path.stat
+        fixed = {
+            name: getattr(self.baseline, name) for name in ("st_dev", "st_ino", "st_size", "st_mtime_ns", "st_ctime_ns")
+        }
+        for name in ("st_mtime_ns", "st_ctime_ns"):
+            fixed[name] = fixed[name] // 1_000_000 * 1_000_000 + (0 if coarse else 123)
+
+        def stat(path, *args, **kwargs):
+            result = original(path, *args, **kwargs)
+            if path == self.snapshot():
+                values = {name: getattr(result, name) for name in dir(result) if name.startswith("st_")}
+                return SimpleNamespace(**{**values, **fixed})
+            return result
+
+        with patch.object(Path, "stat", stat):
+            yield
+
+    def test_publication_uuid_alone_detects_replacement_with_every_stat_field_fixed(self):
+        store = self.reader.for_project(self.project_id)
+        with self.fixed_stat_identity():
+            before = store.signature()
+            self.assertEqual(store.get(self.project_id)["revision"], 0)
+            self.save(self.writer, "Bravo")
+            after = store.signature()
+            self.assertEqual(after[:-1], before[:-1])
+            self.assertNotEqual(after[-1], before[-1])
+            self.assertEqual(store.get(self.project_id)["document"]["project"], "Bravo")
+            with self.assertRaises(Conflict):
+                store.save(self.project_id, 0, {**self.project["document"], "project": "Stale"})
+
+    def test_only_high_resolution_unchanged_identities_reuse_the_marker_cache(self):
+        store = self.reader.for_project(self.project_id)
+        for coarse, expected_reads in ((False, 1), (True, 5)):
+            with self.subTest(coarse=coarse), self.fixed_stat_identity(coarse=coarse):
+                store.publication_cache = None
+                with patch.object(store, "read_publication", wraps=store.read_publication) as read:
+                    signatures = [store.signature() for _ in range(5)]
+                self.assertTrue(all(signature == signatures[0] for signature in signatures))
+                self.assertEqual(read.call_count, expected_reads)
+
+    def test_a_present_marker_table_without_an_identity_is_not_a_legacy_snapshot(self):
+        store = self.reader.for_project(self.project_id)
+        with closing(sqlite3.connect(self.snapshot())) as db, db:
+            db.execute("DELETE FROM spool_publication")
+        with (
+            self.fixed_stat_identity(),
+            self.assertRaisesRegex(sqlite3.DatabaseError, "identity is missing or invalid"),
+        ):
+            with store.connect():
+                pass
+
+    def test_marker_read_errors_cannot_authorize_a_stale_runtime_save(self):
+        store = self.reader.for_project(self.project_id)
+        original = sqlite3.connect
+        snapshot_uri = projects.read_only_uri(self.snapshot())
+
+        class FailedMarker:
+            def __init__(self, db):
+                self.db = db
+
+            def execute(self, sql, *args):
+                if sql.startswith("SELECT publication FROM spool_publication"):
+                    raise sqlite3.OperationalError("Injected marker disk I/O error")
+                return self.db.execute(sql, *args)
+
+            def close(self):
+                self.db.close()
+
+        def connect(path, *args, **kwargs):
+            db = original(path, *args, **kwargs)
+            return FailedMarker(db) if path == snapshot_uri else db
+
+        failures = []
+        with self.fixed_stat_identity():
+            with patch.object(projects.sqlite3, "connect", connect):
+                try:
+                    with store.connect():
+                        pass
+                except sqlite3.Error as error:
+                    failures.append(error)
+            self.save(self.writer, "Bravo")
+            with patch.object(projects.sqlite3, "connect", connect):
+                try:
+                    store.save(self.project_id, 0, {**self.project["document"], "project": "Stale"})
+                except sqlite3.Error as error:
+                    failures.append(error)
+            # With the old fallback both failed reads become the same trusted None
+            # identity, so the second operation publishes revision zero over Bravo.
+            self.assertEqual(self.writer.get(self.project_id)["document"]["project"], "Bravo")
+            self.assertEqual(len(failures), 2)
+            self.assertTrue(all("Injected marker" in str(error) for error in failures))
+            self.assertEqual(store.get(self.project_id)["document"]["project"], "Bravo")
+
+    def test_a_paused_marker_handle_serializes_with_snapshot_replacement(self):
+        store = self.reader.for_project(self.project_id)
+        writer_store = self.writer.for_project(self.project_id)
+        store.publication_cache = None
+        opened = threading.Event()
+        release = threading.Event()
+        writer_waiting = threading.Event()
+        writer_done = threading.Event()
+        replacing = threading.Event()
+        errors = []
+        observed = []
+        original_connect = sqlite3.connect
+        original_lock = projects.file_lock
+        original_replace = projects.atomic_replace
+        snapshot_uri = projects.read_only_uri(self.snapshot())
+
+        class PausedMarker:
+            def __init__(self, db):
+                self.db = db
+
+            def execute(self, sql, *args):
+                if sql.startswith("SELECT publication FROM spool_publication"):
+                    opened.set()
+                    if not release.wait(10):
+                        raise RuntimeError("Paused marker read was not released")
+                return self.db.execute(sql, *args)
+
+            def close(self):
+                self.db.close()
+
+        def connect(path, *args, **kwargs):
+            db = original_connect(path, *args, **kwargs)
+            if path == snapshot_uri and threading.current_thread().name == "marker-reader":
+                return PausedMarker(db)
+            return db
+
+        @contextmanager
+        def file_lock(path):
+            if path == writer_store.lock_file and threading.current_thread().name == "snapshot-writer":
+                writer_waiting.set()
+            with original_lock(path):
+                yield
+
+        def replace(pending, target):
+            if target == self.snapshot():
+                replacing.set()
+            return original_replace(pending, target)
+
+        def reader():
+            try:
+                observed.append(store.signature())
+            except Exception as error:
+                errors.append(error)
+
+        def writer():
+            try:
+                self.save(self.writer, "Bravo")
+            except Exception as error:
+                errors.append(error)
+            finally:
+                writer_done.set()
+
+        threads = [
+            threading.Thread(target=reader, name="marker-reader"),
+            threading.Thread(target=writer, name="snapshot-writer"),
+        ]
+        with (
+            patch.object(projects.sqlite3, "connect", connect),
+            patch.object(projects, "file_lock", file_lock),
+            patch.object(projects, "atomic_replace", replace),
+        ):
+            try:
+                threads[0].start()
+                self.assertTrue(opened.wait(5), "Reader must hold an actual SQLite snapshot handle")
+                threads[1].start()
+                self.assertTrue(writer_waiting.wait(5), "Writer must attempt the project lock")
+                # Longer than atomic_replace's Windows sharing-violation retry budget:
+                # the writer must wait before replacement, not exhaust that retry.
+                self.assertFalse(writer_done.wait(2.5), "Publication must wait for the marker handle to close")
+                self.assertFalse(replacing.is_set(), "Replacement must not run against an open marker handle")
+            finally:
+                release.set()
+                for thread in threads:
+                    if thread.ident is not None:
+                        thread.join(10)
+        self.assertTrue(all(not thread.is_alive() for thread in threads), "Nested project locks must not deadlock")
+        self.assertEqual(errors, [])
+        self.assertEqual(len(observed), 1)
+        self.assertTrue(replacing.is_set())
+        self.assertEqual(self.writer.get(self.project_id)["document"]["project"], "Bravo")
+
+    def test_same_size_and_timestamp_publications_are_visible_to_another_workspace(self):
+        reader_store = self.reader.for_project(self.project_id)
+        state = reader_store.sync_state(self.project_id)
+        self.assertEqual(state["revision"], 0)
+        previous = reader_store.signature()
+        previous_publication = reader_store.signature()[-1]
+        for revision, name in enumerate(("Bravo", "Cello", "Delta"), start=1):
+            with self.subTest(revision=revision):
+                self.save(self.writer, name)
+                self.flatten_timestamp()
+                publication = reader_store.signature()[-1]
+                self.assertNotEqual(publication, previous_publication)
+                self.assertNotEqual(reader_store.signature(), previous)
+                self.assertEqual(reader_store.get(self.project_id)["document"]["project"], name)
+                self.assertEqual(reader_store.sync_state(self.project_id)["revision"], revision)
+                previous, previous_publication = reader_store.signature(), publication
+
+    def test_two_independent_writers_alternate_with_the_same_timestamp_and_size(self):
+        other = Workspace(self.root / "other-writer")
+        other.open_folder(self.folder)
+        for revision, (workspace, name) in enumerate(
+            ((self.writer, "Bravo"), (other, "Cello"), (self.writer, "Delta")), start=1
+        ):
+            with self.subTest(revision=revision):
+                self.assertEqual(self.save(workspace, name)["revision"], revision)
+                self.flatten_timestamp()
+                self.assertEqual(
+                    Workspace(self.root / ("observer-%d" % revision)).open_folder(self.folder)["document"]["project"],
+                    name,
+                )
+
+    def test_a_reader_holding_an_old_revision_cannot_overwrite_the_publication(self):
+        opened = self.reader.open_folder(self.folder)
+        old_document, old_revision = opened["document"], opened["revision"]
+        self.save(self.writer, "Bravo")
+        self.flatten_timestamp()
+        reader_store = self.reader.for_project(self.project_id)
+        with self.assertRaises(Conflict):
+            reader_store.save(self.project_id, old_revision, {**old_document, "project": "Stale"})
+        self.assertEqual(reader_store.get(self.project_id)["document"]["project"], "Bravo")
+        self.assertEqual(self.writer.for_project(self.project_id).get(self.project_id)["document"]["project"], "Bravo")
+
+    def test_a_legacy_snapshot_and_manifest_still_read_and_gain_an_identity(self):
+        # A folder written before this change has no marker in its snapshot and the old
+        # four-field manifest. A reader must still open it.
+        with closing(sqlite3.connect(self.snapshot())) as db, db:
+            db.execute("DROP TABLE spool_publication")
+        value = json.loads(self.manifest().read_text(encoding="utf-8"))
+        self.assertEqual(set(value), {"format", "formatVersion", "projectId", "writtenBy"})
+        value["writtenByFutureSpool"] = {"ignored": True}
+        self.manifest().write_text(json.dumps(value), encoding="utf-8")
+
+        legacy = Workspace(self.root / "legacy-reader")
+        opened = legacy.open_folder(self.folder)
+        store = legacy.for_project(self.project_id)
+        self.assertEqual(opened["document"]["project"], "Alpha")
+        self.assertIsNone(store.signature()[-1])
+
+        self.save(self.writer, "Bravo")
+        self.flatten_timestamp()
+        self.assertEqual(store.get(self.project_id)["document"]["project"], "Bravo")
+        self.assertIsInstance(store.signature()[-1], str)
+        written = json.loads(self.manifest().read_text(encoding="utf-8"))
+        self.assertEqual(set(written), {"format", "formatVersion", "projectId", "writtenBy"})
+
+    def test_a_failed_publication_keeps_the_previous_snapshot_and_identity(self):
+        store = self.reader.for_project(self.project_id)
+        before = store.signature()
+        snapshot = self.snapshot().read_bytes()
+        manifest = self.manifest().read_bytes()
+        original = projects.atomic_replace
+
+        def disconnected(pending, target):
+            if Path(target) == self.snapshot():
+                raise OSError("Share disconnected")
+            return original(pending, target)
+
+        with patch("spool.projects.atomic_replace", side_effect=disconnected):
+            with self.assertRaisesRegex(OSError, "Share disconnected"):
+                self.save(self.writer, "Bravo")
+        self.assertEqual(self.snapshot().read_bytes(), snapshot)
+        self.assertEqual(self.manifest().read_bytes(), manifest)
+        self.assertEqual(store.signature(), before)
+        self.assertEqual(store.get(self.project_id)["document"]["project"], "Alpha")
+
+        self.save(self.writer, "Cello")
+        self.flatten_timestamp()
+        self.assertEqual(store.get(self.project_id)["document"]["project"], "Cello")
+
+    def test_a_crash_between_snapshot_and_manifest_does_not_leave_a_stale_identity(self):
+        store = self.reader.for_project(self.project_id)
+        before = store.signature()
+        manifest = self.manifest().read_bytes()
+
+        def disconnected(store, db):
+            raise OSError("Manifest share disconnected")
+
+        with patch.object(ProjectStore, "write_manifest", disconnected):
+            with self.assertRaisesRegex(OSError, "Manifest share disconnected"):
+                self.save(self.writer, "Bravo")
+        # The snapshot was replaced atomically, so it is the new publication even though
+        # the manifest and the local checkpoint were not updated.
+        self.assertEqual(self.manifest().read_bytes(), manifest)
+        self.assertNotEqual(store.signature(), before)
+        self.assertEqual(Workspace(self.root / "after-crash").open_folder(self.folder)["document"]["project"], "Bravo")
+
+        reopened = Workspace(self.root / "after-crash").for_project(self.project_id)
+        self.assertIsInstance(reopened.signature()[-1], str)
+        with self.assertRaises(Conflict):
+            reopened.save(self.project_id, 0, {"project": "Stale", "clips": [], "media": []})
+        self.assertEqual(reopened.get(self.project_id)["document"]["project"], "Bravo")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_store_interface.py b/tests/test_store_interface.py
index ed799a3..d256bf5 100644
--- a/tests/test_store_interface.py
+++ b/tests/test_store_interface.py
@@ -34,6 +34,22 @@ def test_a_stale_revision_changes_nothing(self):
                 edit.save()
         self.assertEqual(self.store.get(self.project["id"])["revision"], self.project["revision"])
 
+    def test_authored_blob_marker_rejection_keeps_the_project_readable(self):
+        for value in ({"__spool_blob__": "missing"}, [{"nested": {"__spool_blob__": "missing"}}]):
+            with self.subTest(value=value):
+                with self.assertRaisesRegex(ValueError, "evidence blob reference"):
+                    with self.store.editing(self.project["id"], self.project["revision"]) as edit:
+                        edit.document["brief"] = value
+                        edit.save()
+                self.assertEqual(self.store.get(self.project["id"]), self.project)
+
+    def test_workflow_blob_marker_is_rejected_before_capture(self):
+        with self.assertRaisesRegex(ValueError, "evidence blob reference"):
+            self.store.create(
+                {**self.project["document"], "importedWorkflows": [{"prompt": {"__spool_blob__": "missing"}}]}
+            )
+        self.assertEqual(self.store.get(self.project["id"]), self.project)
+
     def test_a_failing_block_rolls_back_its_save(self):
         with self.assertRaises(RuntimeError):
             with self.store.editing(self.project["id"], self.project["revision"]) as edit:
@@ -62,5 +78,41 @@ def test_project_tables_stay_inside_the_storage_modules(self):
                 self.assertIsNone(re.search(r"\._(write_document|event)\(", source), path.name)
 
 
+class RepeatedCaptureTests(unittest.TestCase):
+    def test_repeated_workflow_assignment_does_not_wrap_stored_values_again(self):
+        temp = tempfile.TemporaryDirectory()
+        self.addCleanup(temp.cleanup)
+        store = Store(Path(temp.name))
+        graph = {"nodes": [{"id": 1, "type": "LoadImage"}], "links": []}
+        project = store.create(
+            {
+                "project": "Captures",
+                "clips": [{"id": "shot", "name": "Shot", "in": 0, "out": 24, "takes": []}],
+                "media": [],
+                "importedWorkflows": [{"id": "imported", "name": "Imported", "workflow": graph}],
+            }
+        )
+        capture = {
+            "workflow": {"nodes": []},
+            "prompt": {
+                "save": {"class_type": "SaveImage", "inputs": {"images": ["image", 0], "filename_prefix": "p"}},
+                "image": {"class_type": "EmptyImage", "inputs": {"width": 64}},
+            },
+            "bindings": [],
+            "result": {"nodeId": "save", "group": "images", "index": 0},
+        }
+
+        def blobs():
+            with store.reading() as db:
+                return db.execute("SELECT count(*) FROM blobs").fetchone()[0]
+
+        revision = store.capture(project["id"], project["revision"], "shot", capture)["revision"]
+        before = blobs()
+        for _ in range(5):
+            revision = store.capture(project["id"], revision, "shot", capture)["revision"]
+        self.assertEqual(blobs(), before)
+        self.assertEqual(store.get(project["id"])["document"]["importedWorkflows"][0]["workflow"], graph)
+
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/tests/test_take_files.py b/tests/test_take_files.py
index e7814c2..3e2042f 100644
--- a/tests/test_take_files.py
+++ b/tests/test_take_files.py
@@ -336,7 +336,8 @@ async def test_open_clip_folder_uses_stable_identity_and_supports_empty_shots(se
         saved = self.store.save(self.project["id"], self.project["revision"], document)
         empty_folder = self.store.root / saved["document"]["clips"][1]["outputFolder"]
         empty_folder.rmdir()
-        with patch("spool.system.show") as launch:
+        # The route asks for a file manager first; a headless runner has none.
+        with patch("spool.system.file_manager", return_value="file manager"), patch("spool.system.show") as launch:
             for clip_id, folder in (("shot", self.store.root / original_folder), ("empty", empty_folder)):
                 result = await self.client.post(
                     "/spool/api/projects/" + self.project["id"] + "/clip-folder/" + clip_id + "/reveal", json={}
@@ -359,7 +360,8 @@ async def test_open_clip_folder_uses_stable_identity_and_supports_empty_shots(se
 
     async def test_open_clip_folder_rejects_unknown_clip_cross_origin_and_invalid_folder(self):
         path = "/spool/api/projects/" + self.project["id"] + "/clip-folder/shot/reveal"
-        with patch("spool.system.show") as launch:
+        # With a file manager present, each 400 below comes from the folder checks.
+        with patch("spool.system.file_manager", return_value="file manager"), patch("spool.system.show") as launch:
             self.assertEqual((await self.client.post(path.replace("/shot/", "/unknown/"), json={})).status, 400)
             self.assertEqual(
                 (await self.client.post(path, headers={"Origin": "https://elsewhere.invalid"}, json={})).status, 403
diff --git a/tests/test_unc_paths.py b/tests/test_unc_paths.py
index de626b5..5b270f5 100644
--- a/tests/test_unc_paths.py
+++ b/tests/test_unc_paths.py
@@ -12,12 +12,25 @@
 import unittest
 from pathlib import Path
 
+from spool.media import contained
 from spool.projects import Workspace
+from spool.routes import inside
 from spool.store import SCHEMA_VERSION
 
 FIXTURE = Path(__file__).resolve().parent / "fixtures" / "project-schema5.spool"
 
 
+class RootFolderTests(unittest.TestCase):
+    def test_a_root_that_ends_in_a_separator_still_contains_its_files(self):
+        # A project at E:\\ or \\\\nas\\projects\\ resolves with a trailing separator, as / does here.
+        root = Path(os.path.abspath(os.sep))
+        inner = root / "spool-root-check" / "take.mp4"
+        self.assertEqual(contained(root, "spool-root-check/take.mp4"), inner)
+        self.assertTrue(inside(inner, root))
+        with self.assertRaises(ValueError):
+            contained(root, "")
+
+
 def network_path(local):
     local = Path(local).resolve()
     return Path("\\\\localhost\\" + local.drive.rstrip(":") + "$" + str(local)[len(local.drive) :])
diff --git a/tests/test_uploads.py b/tests/test_uploads.py
index aa6127d..38928e2 100644
--- a/tests/test_uploads.py
+++ b/tests/test_uploads.py
@@ -69,6 +69,37 @@ async def test_accepted_upload_is_complete_and_has_no_partial_file(self):
         self.assertTrue(files)
         self.assertFalse([p for p in files if p.name.endswith(".partial")])
 
+    async def test_unreadable_media_is_refused_and_not_kept(self):
+        response = await self.client.post(
+            "/spool/api/upload?projectId=" + self.project["id"],
+            data=b"not a video" * 100,
+            headers={"X-Filename": "clip.mp4"},
+        )
+        self.assertEqual(response.status, 400, await response.text())
+        self.assertNotIn(str(self.store_root), (await response.json())["error"])
+        self.assertEqual(self.written(), [])
+
+    async def test_upload_names_are_decoded_once(self):
+        # The studio encodes the name once; a name that decodes to a path a second time
+        # must stay a file name in the upload folder, not reach a clip's output folder.
+        response = await self.client.post(
+            "/spool/api/upload?projectId=" + self.project["id"],
+            data=png(),
+            headers={"X-Filename": "..%252F..%252Foutput%252Fclip%252Fa%2541.png"},
+        )
+        self.assertEqual(response.status, 200, await response.text())
+        file = (await response.json())["file"]
+        self.assertTrue(file.startswith("input/images/..%2F..%2Foutput%2Fclip%2Fa%41-"), file)
+        self.assertTrue((self.store_root / file).is_file())
+        self.assertFalse((self.store_root / "output" / "clip").exists())
+
+    def test_stored_names_holding_a_percent_sign_resolve_to_that_file(self):
+        media = Media(self.store_root, self.input, self.input, self.input, project_id=self.project["id"])
+        literal = self.store_root / "output" / "a%41.png"
+        literal.parent.mkdir(parents=True, exist_ok=True)
+        literal.write_bytes(png())
+        self.assertEqual(media.resolve("output/a%41.png"), literal)
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/ui/action-menu.js b/ui/action-menu.js
index 60ff911..1fe6002 100644
--- a/ui/action-menu.js
+++ b/ui/action-menu.js
@@ -14,7 +14,7 @@ export function createActionMenu({ $, esc, menuParent }) {
     if (menuOrigin?.hasAttribute('aria-expanded')) menuOrigin.setAttribute('aria-expanded', 'false');
     const origin = menuOrigin?.isConnected
       ? menuOrigin
-      : $('clipLane').querySelector('[data-clip="' + menuClipId + '"]');
+      : $('clipLane').querySelector('[data-clip="' + CSS.escape(menuClipId) + '"]');
     menuClipId = null;
     menuOrigin = null;
     if (returnFocus) origin?.focus({ preventScroll: true });
diff --git a/ui/audio-editor.js b/ui/audio-editor.js
index 95827d1..958c027 100644
--- a/ui/audio-editor.js
+++ b/ui/audio-editor.js
@@ -103,11 +103,11 @@ export function createAudioEditor({
             '<div class="audio-clip music-clip' +
             (!T.enabled(c) || getAudioSettings()(c).muted || !getTrackAudible()(track) ? ' muted' : '') +
             '" data-audio="' +
-            c.id +
+            esc(c.id) +
             '" style="top:calc(' +
-            (track === 'source' ? 'var(--source-top-' + T.sourceLane(c) + ')' : '0px') +
+            (track === 'source' ? 'var(--source-top-' + esc(T.sourceLane(c)) + ')' : '0px') +
             ' + 5px);height:calc(' +
-            (track === 'source' ? 'var(--source-height-' + T.sourceLane(c) + ')' : 'var(--music-height)') +
+            (track === 'source' ? 'var(--source-height-' + esc(T.sourceLane(c)) + ')' : 'var(--music-height)') +
             ' - 10px);left:' +
             c.start * getPpf() +
             'px;width:' +
@@ -145,11 +145,11 @@ export function createAudioEditor({
               (!m.audio ? 'no-audio' : '') +
               (muted ? ' muted' : '') +
               '" data-linked-audio="' +
-              c.id +
+              esc(c.id) +
               '" style="top:calc(var(--source-top-' +
-              T.videoTrack(c) +
+              esc(T.videoTrack(c)) +
               ') + 5px);height:calc(var(--source-height-' +
-              T.videoTrack(c) +
+              esc(T.videoTrack(c)) +
               ') - 10px);left:' +
               start * getPpf() +
               'px;width:' +
@@ -235,7 +235,7 @@ export function createAudioEditor({
       '</span></div><p class="audio-summary">' +
       seconds(c.out - c.in) +
       ' · ' +
-      (bed ? 'at ' + tc(c.start) : takeName(take(c))) +
+      (bed ? 'at ' + tc(c.start) : esc(takeName(take(c)))) +
       '</p>' +
       (m.audio
         ? '<div class="audio-controls"><div><label class="field"><span class="audio-level-head">Level <input id="audioGainNumber" type="number" min="-60" max="6" step="1" value="' +
diff --git a/ui/editor.js b/ui/editor.js
index 8cf4332..cb0a1a9 100644
--- a/ui/editor.js
+++ b/ui/editor.js
@@ -229,8 +229,13 @@ async function startEditor(isFailed) {
   const projectKey = BOOT.id,
     STORAGE_KEY = 'spool-native-' + projectKey,
     VIEW_KEY = STORAGE_KEY + ':view';
+  // Project paths are file names: "#", "?" or "%" in one is part of the name, not URL syntax.
   const url = path =>
-    path.startsWith('api/') ? '/spool/' + path : path.startsWith('/') || path.startsWith('data:') ? path : BASE + path;
+    path.startsWith('api/')
+      ? '/spool/' + path
+      : path.startsWith('/') || path.startsWith('data:')
+        ? path
+        : BASE + path.split('/').map(encodeURIComponent).join('/');
   const thumbnails = createThumbnails(url, diagnostics, $('viewerStage'), async (m, rate) => {
     const entry = reviewSource(m, rate);
     if (entry.pending) await entry.pending;
@@ -1188,6 +1193,7 @@ async function startEditor(isFailed) {
     hideTrimPreview,
     clearHeld,
     getProjectEdit: () => projectEdit,
+    flushNative,
     getShowActionMenu: () => showActionMenu,
   });
   function takeSelection(c = selected()) {
diff --git a/ui/exports.js b/ui/exports.js
index 2f13857..d97bc8d 100644
--- a/ui/exports.js
+++ b/ui/exports.js
@@ -263,6 +263,8 @@ export function createExports({
       }
     };
   }
+  // The download link stays valid while it is shown; a later export replaces it.
+  let timelineLink = null;
   async function exportTimeline(button) {
     $('exportResult').textContent = 'Writing the timeline…';
     try {
@@ -274,9 +276,10 @@ export function createExports({
         body: { ...plan, fps: getFps(), ...getResolution()(), name: getState().project, projectId: projectKey },
         fallback: 'Export failed.',
       });
-      const link = URL.createObjectURL(
+      if (timelineLink) URL.revokeObjectURL(timelineLink);
+      const link = (timelineLink = URL.createObjectURL(
         new Blob([JSON.stringify(result.timeline, null, 2)], { type: 'application/json' }),
-      );
+      ));
       if ($('exportResult'))
         $('exportResult').innerHTML =
           '<p>Export complete. <a class="download-link" href="' +
diff --git a/ui/library-renderer.js b/ui/library-renderer.js
index 112bdcb..9b3f3c8 100644
--- a/ui/library-renderer.js
+++ b/ui/library-renderer.js
@@ -91,14 +91,14 @@ export function createLibraryRenderer({
       '" draggable="true" tabindex="0" role="button" aria-label="Preview ' +
       esc(label) +
       '" data-media="' +
-      m.id +
+      esc(m.id) +
       '"><img src="' +
       esc(url(m.poster)) +
       '" alt=""><span class="bin-tag">' +
-      (owner && !owner.take.original ? 'T' + String(owner.take.number).padStart(2, '0') + ' · ' : '') +
+      (owner && !owner.take.original ? 'T' + esc(String(owner.take.number).padStart(2, '0')) + ' · ' : '') +
       (m.kind === 'image' ? 'Image' : m.kind === 'audio' ? 'Audio' : seconds(m.frames)) +
       '</span><button class="add" data-add-media="' +
-      m.id +
+      esc(m.id) +
       '" title="Add to timeline" aria-label="Add ' +
       esc(m.name) +
       ' to timeline">' +
diff --git a/ui/project-edit.js b/ui/project-edit.js
index c90ff5f..fbca822 100644
--- a/ui/project-edit.js
+++ b/ui/project-edit.js
@@ -97,10 +97,10 @@ export function createProjectEdit({ project, document, apply, request, blocked,
     }
   }
   async function flush() {
-    if (blocked('save')) throw Error('Resolve the project save before queueing or capturing.');
+    if (blocked('save')) throw Error('Resolve the project save before continuing.');
     save();
     while (draining) await draining;
-    if (dirty()) throw Error('Resolve the project save before queueing or capturing.');
+    if (dirty()) throw Error('Resolve the project save before continuing.');
   }
   function pollBlocked() {
     return (
diff --git a/ui/take-actions.js b/ui/take-actions.js
index 2861a0c..100ac44 100644
--- a/ui/take-actions.js
+++ b/ui/take-actions.js
@@ -54,6 +54,7 @@ export function createTakeActions({
   clearHeld,
   getProjectEdit,
   getShowActionMenu,
+  flushNative,
 }) {
   function takeSelection(c = selected()) {
     if (c?.id !== getSelectedTakeClip()) {
@@ -194,6 +195,8 @@ export function createTakeActions({
         editView();
         review.clear();
         getViewer().clearVideos();
+        // Save the draft first: the reply replaces the document, and an unsaved edit would be lost with it.
+        await flushNative();
         const { value } = await getProjectEdit().change(revision =>
           request('projects/' + projectKey + '/delete-takes/' + clipId, { revision, takeIds: ids }),
         );
diff --git a/ui/take-renderer.js b/ui/take-renderer.js
index e98604a..2845b7f 100644
--- a/ui/take-renderer.js
+++ b/ui/take-renderer.js
@@ -225,7 +225,7 @@ export function createTakeRenderer({
               : '';
             const body =
               '<div class="take-heading"><strong>' +
-              title +
+              esc(title) +
               '</strong>' +
               (chosen || preview
                 ? '<span class="take-badge ' +
@@ -239,7 +239,7 @@ export function createTakeRenderer({
                 ? '<span class="take-badge draft" title="Quick low-resolution draft; Make final refines it">Draft</span>'
                 : '') +
               '</div><button class="take-thumb" data-view="' +
-              t.id +
+              esc(t.id) +
               '" aria-label="Preview ' +
               esc(title) +
               '"><img src="' +
@@ -261,10 +261,10 @@ export function createTakeRenderer({
                 : '') +
               (t.summary?.quality === 'draft' && G.canDraft(c)
                 ? '<button class="make-final" data-final="' +
-                  t.id +
+                  esc(t.id) +
                   '" title="Refine this draft to full size; it keeps its motion and framing">Make final</button>'
                 : '') +
-              (!setupChosen ? '<button class="use-take" data-use="' + t.id + '">Use take</button>' : '') +
+              (!setupChosen ? '<button class="use-take" data-use="' + esc(t.id) + '">Use take</button>' : '') +
               '</div>';
             return (
               '<article class="take-card' +
diff --git a/ui/timeline-renderer.js b/ui/timeline-renderer.js
index de07fda..30e2549 100644
--- a/ui/timeline-renderer.js
+++ b/ui/timeline-renderer.js
@@ -232,9 +232,9 @@ export function createTimelineRenderer({
               r = rowFor(c.id);
             return (
               '<div class="source-handles" style="top:var(--video-top-' +
-              T.videoTrack(c) +
+              esc(T.videoTrack(c)) +
               ');height:calc(var(--video-height-' +
-              T.videoTrack(c) +
+              esc(T.videoTrack(c)) +
               ') - 2px);left:' +
               (r.start - c.in) * getPixelScale() +
               'px;width:' +
@@ -296,13 +296,13 @@ export function createTimelineRenderer({
               (extended.has(c.id) ? ' extended' : '') +
               (!T.videoEnabled(getState(), c) ? ' disabled-clip' : '') +
               '" data-clip="' +
-              c.id +
+              esc(c.id) +
               '" data-workflow="' +
-              c.workflow +
+              esc(c.workflow) +
               '" style="top:calc(var(--video-top-' +
-              T.videoTrack(c) +
+              esc(T.videoTrack(c)) +
               ') + 6px);height:calc(var(--video-height-' +
-              T.videoTrack(c) +
+              esc(T.videoTrack(c)) +
               ') - 12px);left:' +
               start * getPixelScale() +
               'px;width:' +
@@ -336,11 +336,13 @@ export function createTimelineRenderer({
                 : '') +
               clipAttention(c) +
               '</div><div class="clip-meta"><span>' +
-              (trial
-                ? 'T' + String(trial.number).padStart(2, '0') + ' trial'
-                : t.placeholder
-                  ? 'No take'
-                  : 'T' + String(t.number).padStart(2, '0')) +
+              esc(
+                trial
+                  ? 'T' + String(trial.number).padStart(2, '0') + ' trial'
+                  : t.placeholder
+                    ? 'No take'
+                    : 'T' + String(t.number).padStart(2, '0'),
+              ) +
               '</span><span class="clip-takes-status' +
               (pending ? ' busy' : '') +
               '">' +
@@ -367,7 +369,7 @@ export function createTimelineRenderer({
               '" style="left:' +
               row.end * getPixelScale() +
               'px;top:calc(var(--video-top-' +
-              cut.track +
+              esc(cut.track) +
               ') + 6px)" title="Add transition" aria-label="Add transition between ' +
               esc(getState().clips.find(c => c.id === cut.left)?.name || '') +
               ' and ' +
@@ -387,9 +389,9 @@ export function createTimelineRenderer({
               '" style="left:' +
               row.end * getPixelScale() +
               'px;top:calc(var(--video-top-' +
-              T.videoTrack(parent) +
+              esc(T.videoTrack(parent)) +
               ') + var(--video-height-' +
-              T.videoTrack(parent) +
+              esc(T.videoTrack(parent)) +
               ') / 2)" title="' +
               esc(getState().clips.find(c => c.id === id)?.name + ' extends ' + parent.name) +
               '" aria-hidden="true">' +
diff --git a/ui/viewer.js b/ui/viewer.js
index f13ff49..75e2eb9 100644
--- a/ui/viewer.js
+++ b/ui/viewer.js
@@ -151,7 +151,7 @@ export function createViewer({
           ? '<b>' +
             esc(c.name) +
             '</b> · ' +
-            takeName(t) +
+            esc(takeName(t)) +
             ' · ' +
             (t.id === c.takeId
               ? '<span class="in-edit">in edit</span>'
@@ -159,7 +159,7 @@ export function createViewer({
           : '<b>Media</b> · ' + esc(review.source?.media.name || '')
         : trial
           ? '<span class="not-in-edit">Trying ' +
-            takeName(trial) +
+            esc(takeName(trial)) +
             ' in ' +
             esc(tried.name) +
             '</span> · not saved until you use it'
@@ -234,7 +234,7 @@ export function createViewer({
             '</span><span class="' +
             (trial ? 'preview-only' : 'in-edit') +
             '">' +
-            (d.take.placeholder ? 'No take in edit' : takeName(d.take)) +
+            (d.take.placeholder ? 'No take in edit' : esc(takeName(d.take))) +
             (trial ? ' · trial' : '') +
             '</span>',
     );
diff --git a/ui/workflow-coordinator.js b/ui/workflow-coordinator.js
index 8046c1c..0ead7a6 100644
--- a/ui/workflow-coordinator.js
+++ b/ui/workflow-coordinator.js
@@ -196,7 +196,10 @@ export function createWorkflowCoordinator({
       'Add shot',
       '<div class="shot-picker"><section><h3>Workflows</h3><div class="shot-workflows">' +
         Object.entries(workflows)
-          .map(([id, w]) => '<button class="workflow-row" data-shot-workflow="' + id + '">' + esc(w.name) + '</button>')
+          .map(
+            ([id, w]) =>
+              '<button class="workflow-row" data-shot-workflow="' + esc(id) + '">' + esc(w.name) + '</button>',
+          )
           .join('') +
         '</div><button class="outline" id="shotImportWorkflow">' +
         svg('plus') +
@@ -206,7 +209,7 @@ export function createWorkflowCoordinator({
           .map(
             m =>
               '<button class="shot-media-item" data-shot-media="' +
-              m.id +
+              esc(m.id) +
               '"><img src="' +
               esc(url(m.poster)) +
               '" alt=""><span>' +
diff --git a/web/graph-inputs.js b/web/graph-inputs.js
index c4de9ea..d15914b 100644
--- a/web/graph-inputs.js
+++ b/web/graph-inputs.js
@@ -1,5 +1,112 @@
 // Resolve the same execution addresses that Comfy serializes, including exposed
 // subgraph inputs. Widget names come from the live nodes, never array guesses.
+const imageLoaders = new Set(['LoadImage', 'LoadImageMask']);
+const loaderRequests = new WeakMap();
+
+// Comfy's file choices come from node definitions captured before Spool staged
+// project inputs. Refresh only the image loaders present in this graph. Keep
+// values and callbacks untouched: choices are discovery, not an authored edit.
+export async function refreshLoaderOptions(root, fetcher = globalThis.fetch, current = () => true) {
+  const targets = [];
+  const visit = (graph, prefix = '') => {
+    for (const node of graph.nodes || []) {
+      if (imageLoaders.has(node.type)) {
+        for (const widget of node.widgets || [])
+          if (widget.name === 'image') targets.push({ node, owner: node, widget, type: node.type });
+        // An exposed subgraph input owns its value/choices on the parent node,
+        // while the execution address still names the inner image loader.
+        if (root.getNodeById) {
+          try {
+            const { node: owner, widget } = widgetForInput(root, { nodeId: prefix + node.id, input: 'image' });
+            if (owner !== node && widget.type === 'combo') targets.push({ node, owner, widget, type: node.type });
+          } catch {
+            // Linked execution inputs without an editable widget have no choices.
+          }
+        }
+      }
+      if (node.subgraph) visit(node.subgraph, prefix + node.id + ':');
+    }
+  };
+  visit(root);
+  if (!targets.length) return;
+  for (const target of targets) target.selected = target.widget.value;
+  let requests = loaderRequests.get(fetcher);
+  if (!requests) loaderRequests.set(fetcher, (requests = new Map()));
+  const definitions = await Promise.all(
+    [...new Set(targets.map(({ type }) => type))].map(async type => {
+      if (!requests.has(type)) {
+        const request = (async () => {
+          const response = await fetcher('/object_info/' + encodeURIComponent(type), { cache: 'no-store' });
+          if (!response.ok) throw Error('Could not refresh Comfy image choices for ' + type);
+          const definition = (await response.json())[type];
+          const spec = definition?.input?.required?.image || definition?.input?.optional?.image;
+          const values = Array.isArray(spec?.[0]) ? spec[0] : spec?.[0] === 'COMBO' ? spec[1]?.options : null;
+          if (!Array.isArray(values)) throw Error('Comfy returned no image choices for ' + type);
+          return values;
+        })();
+        requests.set(type, request);
+        void request.finally(() => requests.delete(type)).catch(() => {});
+      }
+      return [type, await requests.get(type)];
+    }),
+  );
+  const choices = new Map(definitions);
+  const selectedImages = new Map();
+  await Promise.all(
+    targets.map(async ({ selected: value, type }) => {
+      if (typeof value !== 'string' || !value.includes('/') || choices.get(type).includes(value)) return;
+      // Native definitions list only the input directory's immediate files.
+      // A project-staged selection lives below it. Confirm that exact image
+      // before adding it, so genuinely missing sources still stay missing.
+      const key = 'image:' + value;
+      if (!requests.has(key)) {
+        const request = (async () => {
+          const annotation = / \[(input|output|temp)\]$/.exec(value),
+            path = annotation ? value.slice(0, annotation.index) : value,
+            slash = path.lastIndexOf('/'),
+            query = new URLSearchParams({
+              filename: path.slice(slash + 1),
+              subfolder: path.slice(0, slash),
+              type: annotation?.[1] || 'input',
+            });
+          const response = await fetcher('/view?' + query, { method: 'HEAD', cache: 'no-store' });
+          if (response.status === 404) return false;
+          if (!response.ok) throw Error('Could not check the selected Comfy image');
+          return response.headers?.get('Content-Type')?.startsWith('image/') || false;
+        })();
+        requests.set(key, request);
+        void request.finally(() => requests.delete(key)).catch(() => {});
+      }
+      selectedImages.set(value, await requests.get(key));
+    }),
+  );
+  if (!current()) return;
+  const liveNodes = new Set();
+  const collect = graph => {
+    for (const node of graph.nodes || []) {
+      liveNodes.add(node);
+      if (node.subgraph) collect(node.subgraph);
+    }
+  };
+  collect(root);
+  for (const { node, owner, widget, type, selected } of targets) {
+    // A graph can be replaced while discovery is in flight. Never update a
+    // detached widget or use another workflow's current selection as a fallback.
+    if (
+      !liveNodes.has(node) ||
+      !liveNodes.has(owner) ||
+      node.type !== type ||
+      !owner.widgets?.includes(widget) ||
+      widget.value !== selected
+    )
+      continue;
+    widget.options ||= {};
+    widget.options.values = [...choices.get(type)];
+    if (selectedImages.get(widget.value) && !widget.options.values.includes(widget.value))
+      widget.options.values.push(widget.value);
+  }
+}
+
 function widgetForInput(root, control) {
   const ids = control.nodeId.split(':'),
     parents = [];
diff --git a/web/spool.js b/web/spool.js
index 3c77fc3..d022e4a 100644
--- a/web/spool.js
+++ b/web/spool.js
@@ -17,7 +17,7 @@ import { containsExactInt } from '/spool/ui/wire.js';
 import { keyText } from '/spool/ui/keys.js';
 import { createEmbeddedTemplates } from './template-browser.js';
 import { createWorkflowLinks } from './workflow-link.js';
-import { applyGraphInputs } from './graph-inputs.js';
+import { applyGraphInputs, refreshLoaderOptions } from './graph-inputs.js';
 import { captureComfyGraph } from './graph-capture.js';
 
 // crypto.randomUUID exists only in secure contexts; Comfy opened over plain HTTP from another machine still needs IDs.
@@ -249,7 +249,15 @@ app.registerExtension({
   name: 'Spool.Timeline',
   commands: [{ id: 'Spool.OpenStudio', label: 'Open Spool', category: 'view-controls', function: openStudio }],
   // Workflow identity is finalized afterConfigureGraph; capture only after load.
-  afterLoadGraph() {
+  async afterLoadGraph() {
+    // This hook also runs for Comfy's restored/imported tabs, before its missing
+    // media scan. Discovery failures leave the selected source and graph intact.
+    try {
+      const graph = app.rootGraph;
+      await refreshLoaderOptions(graph, globalThis.fetch, () => app.rootGraph === graph);
+    } catch (error) {
+      console.warn('Spool image choices:', error);
+    }
     embeddedTemplates?.selected();
   },
   setup() {
diff --git a/web/workflow-link.js b/web/workflow-link.js
index 8cccffe..50f3d8a 100644
--- a/web/workflow-link.js
+++ b/web/workflow-link.js
@@ -1,4 +1,6 @@
 // Comfy owns live graph tabs; Spool owns the immutable recipe applied to a clip.
+import { refreshLoaderOptions } from './graph-inputs.js';
+
 export function createWorkflowLinks(app, load, capture, storage) {
   const key = 'spool-workflow-links';
   let links = new Map(),
@@ -31,7 +33,18 @@ export function createWorkflowLinks(app, load, capture, storage) {
         const loaded = await app.loadGraphData(graph, true, true, existing);
         if (loaded === false || app.extensionManager.workflow.activeWorkflow !== existing)
           throw Error('Comfy could not focus the linked workflow');
+      } else if (app.rootGraph) {
+        const graph = app.rootGraph;
+        await refreshLoaderOptions(
+          graph,
+          globalThis.fetch,
+          () => app.rootGraph === graph && app.extensionManager.workflow.activeWorkflow === existing,
+        );
+        if (app.rootGraph !== graph)
+          throw Error('The linked workflow changed while refreshing its image choices. Open it again.');
       }
+      if (app.extensionManager.workflow.activeWorkflow !== existing || workflow(record) !== existing)
+        throw Error('The linked workflow changed while refreshing its image choices. Open it again.');
       return { opened: true, reused: true };
     }
     await load(data);