fix(review): apply remaining MEDIUM/LOW backlog from multi-agent review

Round-3: clears the deferred backlog after the round-2 CRITICAL/HIGH pass.
7 parallel fixers over disjoint file sets; each finding verified against source.

Concurrency / correctness:
- smartcut._clip_lock: replace size-cap eviction with a reference-counted
  context manager — an entry now lives exactly as long as some caller holds or
  waits on it, closing the residual TOCTOU where two callers could be handed
  different locks for one path (concurrent smart_cut clobbering one output)
- app.py /api/reframe: a metadata-save failure after a successful reframe now
  raises HTTP 500 instead of returning 200 with on-disk/metadata divergence
- app.py /api/batch: clean up the failing item's output dir + jobs entry on the
  build_main_cmd ValueError and QueueFull paths (was leaking orphan dirs)

Resilience / hang protection:
- diarization.extract_audio_to_wav: add 1800s ffmpeg timeout (matches the ASR
  sibling) + broaden except to TimeoutExpired
- social_publisher: 5s bound on the SSRF-guard getaddrinfo (was unbounded,
  could pin a thread-pool slot)
- download.py: re-resolve the URL host at download time and refuse if it now
  points only at internal/loopback ranges (DNS-rebinding past the API SSRF check)

Validation:
- schemas: ZernioConfigRequest gains api_key/timezone max_length + an accounts
  validator (≤16 entries, known platforms, str ≤256); PublishRequest.scheduled_for
  gains max_length=64

Observability (surface silent failures, keep fallbacks):
- main.transcribe_video: WARNING when Deepgram fails before the Whisper fallback
- transcribe_cache.load_cached_transcript: distinguish corrupt entry (warn +
  delete so next run rewrites) from a genuine cache miss
- job_results._build_clips + job_artifacts.relocate_root_job_artifacts: log the
  swallowed exception instead of silent pass/return-False
- social_publisher: scheduling-without-collision-data is now explicit in logs
  (Zernio fetch failure no longer reads like an empty calendar)

Performance / cleanup:
- reframe.py: lazy-init MediaPipe FaceDetection/FaceMesh (was ~300ms TFLite load
  at import on every pipeline + every --reframe-only subprocess); all .process()
  call sites migrated to the getters. Removed dead SpeakerTracker
  stabilization_frames param/attribute (never read; real suppression is cooldown)
- compose._apply_smartcut: drop the dead legacy-sidecar shortcut (the bare
  *_smartcut.mp4 name is never written under the current Subtitles→Smart Cut
  order; smart_cut's own plan-hash cache + legacy fallback already cover it).
  Supersedes the round-1 mtime guard on that now-removed branch.

Frontend (live redesign/):
- useModalA11y: callback-ref for onClose so the focus-trap effect stops re-running
  (and stealing focus mid-type) on every parent re-render
- publish.jsx: mountedRef guards the 500ms post-publish setTimeout
- RedesignApp: track + clear toast auto-dismiss timers on unmount
- create.jsx: aria-pressed on the preset cards

Tests: test_concurrency_fixes.py rewritten for the context-manager _clip_lock
(registry identity + refcount + held-entry-not-evicted). Host 418 passed/3
skipped; Docker integration 23 passed; eslint 0; vite build OK.

Deliberately NOT changed (contract/behavior risk outweighs benefit; documented):
response_model on every endpoint (would risk dropping fields the UI reads),
process_endpoint multipart/json double-parse refactor (no repro, risky),
window.prompt/confirm replacement (cosmetic), global-smooth odd-frame trajectory
(opt-in quality knob — eye-decides per CLAUDE.md). esbuild≤0.24 dev-CORS is
dev-server-only and already mitigated by the backend origin checks.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VDkEfcWP5suCdutKJKnvCM

Author: fralapo

dashboard/src/redesign/RedesignApp.jsx

@@ -2,7 +2,7 @@
 // Visual layer is the Claude Design handoff; data layer reuses the same
 // useJobSubmission / useJobPolling / useHistory / useClipStates the production
 // app uses, so the pipeline behaves identically.
-import { useState, useEffect, useMemo, useCallback } from 'react';
+import { useState, useEffect, useMemo, useCallback, useRef } from 'react';
 import './tokens.css';
 import './app.css';
 import { Icon, Btn } from './primitives';
@@ -91,6 +91,10 @@ export default function RedesignApp() {
   const [preselections, setPreselectionsRaw] = useState(null);
   const [confetti, setConfetti] = useState(false);
   const [toasts, setToasts] = useState([]);
+  // Track all auto-dismiss timer ids so they can be cleared if the component
+  // unmounts before any timer fires (prevents setState on an unmounted tree).
+  const toastTimerIds = useRef([]);
+  useEffect(() => () => { toastTimerIds.current.forEach(clearTimeout); }, []);
   const [publishClips, setPublishClips] = useState(null);
   const [editClip, setEditClip] = useState(null);
   const [viewingHistory, setViewingHistory] = useState(false);
@@ -115,7 +119,8 @@ export default function RedesignApp() {
   const pushToast = useCallback((type, msg) => {
     const id = Date.now() + Math.random();
     setToasts((t) => [...t, { id, type, msg }]);
-    setTimeout(() => setToasts((t) => t.filter((x) => x.id !== id)), 3600);
+    const tid = setTimeout(() => setToasts((t) => t.filter((x) => x.id !== id)), 3600);
+    toastTimerIds.current.push(tid);
   }, []);
 
   // Background clip reprocess: the Edit modal stages the changes and hands them

dashboard/src/redesign/create.jsx

@@ -14,7 +14,7 @@ function PresetCards({ presets, active, defaultId, onPick, onSetDefault, onDelet
         // role=button (not a real <button>) so the star/trash actions inside
         // can be real, keyboard-operable <button>s — interactive-in-interactive
         // is invalid HTML.
-        <div key={p.id} role="button" tabIndex={0} className={'preset' + (active === p.id ? ' on' : '')}
+        <div key={p.id} role="button" tabIndex={0} aria-pressed={active === p.id} className={'preset' + (active === p.id ? ' on' : '')}
           onClick={() => onPick(p)}
           onKeyDown={(e) => { if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); onPick(p); } }}>
           <span className="pcheck"><Icon n="check" /></span>

dashboard/src/redesign/publish.jsx

@@ -2,7 +2,7 @@
 // Every selected clip is published in parallel (Promise.allSettled) — the fix
 // for the old sequential stall — each row showing live queued→uploading→
 // live/error status. Per-clip compose_first honours the clip's toggles.
-import { useState, useEffect } from 'react';
+import { useState, useEffect, useRef } from 'react';
 import { Icon, Social, Btn, Switch, PlatPill, PLATFORMS } from './primitives';
 import { clipVideoSrc } from './realApi';
 import { publishClip, getZernio } from './realApi';
@@ -76,6 +76,11 @@ export function PublishModal({ clips, jobId, clipStates = {}, preselections, onC
   // Accessibility: focus trap + Escape-to-close + focus restore.
   const panelRef = useModalA11y(onClose);
 
+  // Guard the post-publish setTimeout so it never calls setState after the
+  // modal has been unmounted (e.g. parent closes it while the delay is in flight).
+  const mountedRef = useRef(true);
+  useEffect(() => () => { mountedRef.current = false; }, []);
+
   const accounts = zernio?.accounts || {};
   const toggle = (k) => setPlats((p) => ({ ...p, [k]: !p[k] }));
   const platTargets = () => Object.keys(plats)
@@ -133,6 +138,7 @@ export function PublishModal({ clips, jobId, clipStates = {}, preselections, onC
     const ok = results.filter((r) => r.status === 'fulfilled' && r.value).length;
     const fail = clips.length - ok;
     setTimeout(() => {
+      if (!mountedRef.current) return;
       setStage('done');
       pushToast?.(fail === 0 ? 'success' : 'warn', `Published ${ok}/${clips.length}${fail ? `, ${fail} failed` : ''}`);
     }, 500);

dashboard/src/redesign/useModalA11y.js

@@ -7,6 +7,15 @@ import { useEffect, useRef } from 'react';
 export function useModalA11y(onClose) {
   const ref = useRef(null);
 
+  // Keep a ref to the latest onClose so the keydown handler always calls the
+  // current callback without being listed as an effect dependency. Without this
+  // pattern, callers that pass a fresh inline lambda on every render (e.g.
+  // `() => setEditClip(null)`) would cause the effect to re-run — and reset
+  // focus to the first focusable element — on every parent re-render while the
+  // modal is open (e.g. every toast that appears).
+  const onCloseRef = useRef(onClose);
+  useEffect(() => { onCloseRef.current = onClose; }, [onClose]);
+
   useEffect(() => {
     const panel = ref.current;
     const prevActive = document.activeElement;
@@ -26,7 +35,7 @@ export function useModalA11y(onClose) {
     else if (panel) { panel.setAttribute('tabindex', '-1'); panel.focus(); }
 
     const onKey = (e) => {
-      if (e.key === 'Escape') { onClose?.(); return; }
+      if (e.key === 'Escape') { onCloseRef.current?.(); return; }
       if (e.key !== 'Tab') return;
       const items = focusables();
       if (items.length === 0) { e.preventDefault(); return; }
@@ -45,7 +54,8 @@ export function useModalA11y(onClose) {
       // Restore focus to where it was before the modal opened.
       if (prevActive && typeof prevActive.focus === 'function') prevActive.focus();
     };
-  }, [onClose]);
+  // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, []); // run once on mount — onClose changes are handled via onCloseRef above
 
   return ref;
 }

src/clippyme/api/app.py

@@ -519,6 +519,9 @@ async def batch_process(req: BatchRequest, request: Request):
                 model=getattr(req, "model", None),
             )
         except ValueError as exc:
+            # This item's output dir was already created above but it never
+            # made it into `jobs` — clean it up so a bad URL can't orphan a dir.
+            await asyncio.to_thread(shutil.rmtree, job_output_dir, True)
             raise HTTPException(status_code=400, detail=str(exc))
 
         env = os.environ.copy()
@@ -536,8 +539,10 @@ async def batch_process(req: BatchRequest, request: Request):
             job_queue.put_nowait(job_id)
             batch_jobs.append({"url": url, "job_id": job_id})
         except asyncio.QueueFull:
-            del jobs[job_id]
-            shutil.rmtree(job_output_dir, ignore_errors=True)
+            # Only the item that failed to enqueue is cleaned up — already
+            # enqueued jobs stay running. Mirrors the single /api/process path.
+            jobs.pop(job_id, None)
+            await asyncio.to_thread(shutil.rmtree, job_output_dir, True)
             # Stop adding more — queue is full
             break
 
@@ -1080,14 +1085,22 @@ async def reframe_clip(job_id: str, clip_index: int, req: ReframeRequest, reques
     clean_video_url = f"/videos/{job_id}/{original_clip_filename}"
     new_video_url = f"{clean_video_url}?v={cache_bust}"
 
-    # Update metadata.json and in-memory job state with the CLEAN url
+    # Update in-memory metadata structures with the CLEAN url, then persist.
+    clips[clip_index]["video_url"] = clean_video_url
+    clips[clip_index]["reframe_mode"] = mode
+    data["shorts"] = clips
+
+    # A persistence failure must NOT silently succeed: the clip on disk has
+    # already been re-rendered with the new mode, so if metadata.json still
+    # carries the OLD reframe_mode/video_url the divergence is invisible until
+    # a restart reloads stale state. Update in-memory job state regardless
+    # (so the live session is correct), but surface the save failure as a 500.
+    save_failed = None
     try:
-        clips[clip_index]["video_url"] = clean_video_url
-        clips[clip_index]["reframe_mode"] = mode
-        data["shorts"] = clips
         save_job_metadata(metadata_path, data)
     except Exception as e:
-        logger.warning("Failed to update metadata.json after reframe: %s", e)
+        logger.error("Failed to persist metadata.json after reframe: %s", e)
+        save_failed = e
 
     if (
         job_id in jobs
@@ -1100,6 +1113,12 @@ async def reframe_clip(job_id: str, clip_index: int, req: ReframeRequest, reques
         jobs[job_id]["result"]["clips"][clip_index]["video_url"] = clean_video_url
         jobs[job_id]["result"]["clips"][clip_index]["reframe_mode"] = mode
 
+    if save_failed is not None:
+        raise HTTPException(
+            status_code=500,
+            detail="Reframe succeeded but metadata persistence failed; reload may show stale state",
+        )
+
     return {
         "success": True,
         "new_video_url": new_video_url,

src/clippyme/api/schemas.py

@@ -224,7 +224,7 @@ class PublishRequest(BaseModel):
     caption: str = Field("", max_length=2200)
     platforms: List[dict] = Field(..., min_length=1, max_length=14)
     schedule_mode: str = Field("now", pattern=r"^(now|auto|manual)$")
-    scheduled_for: Optional[str] = None
+    scheduled_for: Optional[str] = Field(None, max_length=64)
     # Optional YYYY-MM-DD that defines the day the SmartScheduler should
     # start picking slots from when schedule_mode="auto". Ignored by
     # "now" / "manual". Defaults to today if omitted.
@@ -312,6 +312,21 @@ def _bound_tiktok_settings(cls, v):
 
 class ZernioConfigRequest(BaseModel):
     """Persisted Zernio settings (saved to data/config.json)."""
-    api_key: Optional[str] = None
+    api_key: Optional[str] = Field(None, max_length=512)
     accounts: Optional[dict] = None  # {"tiktok": "...", "instagram": "...", "youtube": "..."}
-    timezone: Optional[str] = None
+    timezone: Optional[str] = Field(None, max_length=64)
+
+    @field_validator("accounts")
+    @classmethod
+    def _validate_accounts(cls, v):
+        if v is None:
+            return v
+        if len(v) > 16:
+            raise ValueError("too many account entries")
+        allowed = {"tiktok", "instagram", "youtube"}
+        for k, val in v.items():
+            if k not in allowed:
+                raise ValueError(f"unknown account platform: {k!r}")
+            if val is not None and (not isinstance(val, str) or len(val) > 256):
+                raise ValueError(f"account id for {k!r} must be a string <= 256 chars")
+        return v

src/clippyme/domain/compose.py

@@ -63,29 +63,14 @@ async def _apply_smartcut(
     intermediate_files: list,
     drop_ranges=None,
 ) -> str:
-    # Cache key must follow the ACTUAL input. The previous implementation
-    # keyed off `base_clip` unconditionally, which meant that if we'd
-    # smart-cut the raw clip before, we'd return the stale raw smart-cut
-    # even when the current call is operating on a subtitled/hooked
-    # variant. Use current_input instead so each input gets its own
-    # sidecar _smartcut.mp4.
-    # Legacy fixed-name sidecar shortcut — only safe for the plain auto cut.
-    # A manual trim (drop_ranges) must NOT reuse it: the same input with
-    # different hand-picked drops would otherwise serve a stale cut. smart_cut
-    # itself plan-hashes the output, so manual trims still cache correctly.
-    smartcut_path = current_input.replace(".mp4", "_smartcut.mp4")
-    # Only reuse the sidecar if it's newer than its source. A post-run reframe
-    # overwrites the clip .mp4 in place, so a stale _smartcut.mp4 from before the
-    # reframe must NOT be served — re-cut instead. (smart_cut itself plan-hashes,
-    # but this fixed-name shortcut bypasses that check, hence the explicit mtime.)
-    if not drop_ranges and os.path.exists(smartcut_path):
-        try:
-            fresh = os.path.getmtime(smartcut_path) >= os.path.getmtime(current_input)
-        except OSError:
-            fresh = False
-        if fresh:
-            intermediate_files.append(smartcut_path)
-            return smartcut_path
+    # Smart Cut caching is delegated entirely to smart_cut() itself, which
+    # writes a plan-hashed output (`{base}_smartcut_{hash}.mp4`) and validates
+    # cache hits against the source mtime (plus a legacy bare-`_smartcut.mp4`
+    # back-compat candidate). The previous fixed-name sidecar shortcut here
+    # built `{base}_smartcut.mp4` — a name smart_cut NEVER produces under the
+    # current Subtitles→Smart Cut ordering (current_input is `composed_sub_N.mp4`)
+    # — so it could only ever match stale artifacts that smart_cut already
+    # handles itself. Removed: always delegate to smart_cut's own correct cache.
     transcript = metadata.get("transcript", {})
     sc_output, _ = await asyncio.to_thread(
         smart_cut,

src/clippyme/domain/job_artifacts.py

@@ -1,10 +1,13 @@
 """Filesystem helpers for locating and relocating job artifacts written by main.py."""
 import glob
 import json
+import logging
 import os
 import shutil
 from typing import Tuple
 
+logger = logging.getLogger("clippyme")
+
 
 def find_job_metadata_path(job_id: str, output_dir: str) -> str:
     """Return the path to a job's ``*_metadata.json`` file.
@@ -94,5 +97,6 @@ def relocate_root_job_artifacts(job_id: str, job_output_dir: str, output_dir: st
                 shutil.move(clip_path, dest_clip)
 
         return True
-    except Exception:
+    except Exception as exc:
+        logger.warning("relocate_root_job_artifacts failed for %s: %s", job_id, exc)
         return False

src/clippyme/domain/job_results.py

@@ -3,9 +3,12 @@
 
 import glob
 import json
+import logging
 import os
 import re
 
+logger = logging.getLogger("clippyme")
+
 ALLOWED_REFRAME_MODES = frozenset({"auto", "disabled", "object"})
 MAX_INSTRUCTIONS_LEN = 2000
 
@@ -112,10 +115,10 @@ def _build_clips(data: dict, base_name: str, job_id: str, output_dir: str, only_
                     'e': w.get('end', 0.0),
                 })
         backfill_hook_text(clips, words, fallback_title=base_name)
-    except Exception:
+    except Exception as exc:
         # Never break result loading because of backfill logic —
         # stale metadata should still render even if hooks are empty.
-        pass
+        logger.debug("backfill_hook_text failed: %s", exc)
 
     result = []
     for i, clip in enumerate(clips):

src/clippyme/domain/smartcut.py

@@ -89,32 +89,41 @@
 # same source clip from clobbering each other's _smartcut.mp4 output.
 # Lazily populated by _clip_lock(). Workers from FastAPI's executor pool
 # may hit the same clip when the user spam-clicks Download.
-_CLIP_LOCKS: dict[str, threading.Lock] = {}
+#
+# path -> [lock, refcount]. The refcount keeps an entry alive for exactly as
+# long as some caller holds or waits on it, so eviction can never hand two
+# callers different locks for one path (the bug a plain size-cap eviction had).
+_CLIP_LOCKS: dict[str, list] = {}
 _CLIP_LOCKS_GUARD = threading.Lock()
 
 
-def _clip_lock(clip_path: str) -> threading.Lock:
-    """Return a process-wide lock unique to `clip_path`. Lazy + thread-safe."""
+@contextlib.contextmanager
+def _clip_lock(clip_path: str):
+    """Process-wide per-path mutex, reference-counted and self-bounding.
+
+    Usage: ``with _clip_lock(path): ...`` — serialises smart_cut on one clip.
+    """
     abs_path = os.path.abspath(clip_path)
     with _CLIP_LOCKS_GUARD:
-        lock = _CLIP_LOCKS.get(abs_path)
-        if lock is None:
-            lock = threading.Lock()
-            _CLIP_LOCKS[abs_path] = lock
-            # Bound the registry WITHOUT ever evicting a lock another thread
-            # may still hold — handing two callers different locks for one
-            # path would defeat the mutex. Only drop currently-free locks.
-            if len(_CLIP_LOCKS) > 256:
-                for k in list(_CLIP_LOCKS.keys()):
-                    if len(_CLIP_LOCKS) <= 256:
-                        break
-                    other = _CLIP_LOCKS[k]
-                    if other is not lock and other.acquire(blocking=False):
-                        try:
-                            del _CLIP_LOCKS[k]
-                        finally:
-                            other.release()
-        return lock
+        entry = _CLIP_LOCKS.get(abs_path)
+        if entry is None:
+            entry = [threading.Lock(), 0]
+            _CLIP_LOCKS[abs_path] = entry
+        entry[1] += 1
+        lock = entry[0]
+    try:
+        with lock:
+            yield lock
+    finally:
+        with _CLIP_LOCKS_GUARD:
+            entry[1] -= 1
+            # Drop only when no one else references this exact entry AND the
+            # registry has grown past the soft cap. Safe: refcount 0 means no
+            # holder/waiter could be handed a stale lock.
+            if entry[1] <= 0 and len(_CLIP_LOCKS) > 256:
+                # Only delete if it's still the same entry object.
+                if _CLIP_LOCKS.get(abs_path) is entry:
+                    del _CLIP_LOCKS[abs_path]
 
 
 # Regex that strips ALL non-alphanumeric chars (unicode-aware) for the