@animastor/orchestration 0.1.1

package/src/runtime/reconciliation-engine.js

@@ -0,0 +1,2405 @@
+// ======================================================
+// Reconciliation Engine - v1.0.0
+// ======================================================
+// Self-healing engine that detects and fixes inconsistencies
+// between state machine and actual assets on disk/registry.
+//
+// T6: Единый reconciliation-контур (R4/К4). Включает:
+//   — startup-recovery (version staleness, audio-orch, chunk recovery)
+//   — audio-recovery (scan animastor:result:* keys)
+//   — cleanup-service (expired audio scene locks)
+//   — reconciliation-engine (orphan states, stale leases, drift)
+// Все фазы — через единый цикл reconcileCycle() с распределённым локом.
+
+const fs = require('fs').promises;
+const syncFs = require('fs');
+const syncPath = require('path');
+
+const { lazyHostBinding } = require('../host/host-bindings');
+// §32.30: former host requires resolve lazily through the host-bindings seam.
+const state = lazyHostBinding('state');
+// S-4: filename grammar composed from the canonical owner (bytes unchanged)
+const artifactNaming = require('@animastor/generation').artifactNaming;
+// S-2: registered stage list resolved from media registry
+const mediaRegistry = require('@animastor/generation').mediaRegistry;
+// O-2: persistence arrives ONLY through the PersistencePort (host adapter:
+// storage/runtime-persistence-adapter) — the storage barrel, PG repositories
+// and the database handle left this file. The Redis asset-registry and the
+// audio-path composition are consumed as persistence OPERATIONS through the
+// same port (their implementations stay host-side).
+const persist = require('./persistence-port').persist;
+const config = lazyHostBinding('config');
+// S-5: the event journal is an append-only observability sink (zero requires,
+// no orchestration policy) — the ONLY runtime→Generation dependency allowed
+// without a seam (s5-runtime-orchestration-cycle.test.js S5-A).
+const journal = lazyHostBinding('journal');
+const runtimeScheduler = require('./runtime-scheduler');
+const counterReconciliation = require('./counter-reconciliation');
+const dispatchEngine = require('./dispatch-engine');
+const leaseManager = require('./lease-manager');
+// S-5: orchestration-owned behavior (FSM-safe facade writers, rollbacks)
+// reaches runtime ONLY through the composition-root-injected seam registry.
+// No orchestration module is imported from this file (S-5).
+const orchestrationSeams = lazyHostBinding('seams');
+
+const logPrefix = '[RECONCILE]';
+
+function log(msg) {
+    console.log(`${logPrefix} ${msg}`);
+}
+
+function warn(msg) {
+    console.warn(`${logPrefix} ⚠️ ${msg}`);
+}
+
+function error(msg) {
+    console.error(`${logPrefix} ❌ ${msg}`);
+}
+
+// ======================================================
+// RECONCILIATION REPORT
+// ======================================================
+
+class ReconciliationReport {
+    constructor() {
+        this.orphanStates = [];
+        this.orphanAssets = [];
+        this.partialBuilds = [];
+        this.staleLocks = [];
+        this.inconsistentScenes = [];
+    }
+
+    toSummary() {
+        return {
+            totalOrphanStates: this.orphanStates.length,
+            totalOrphanAssets: this.orphanAssets.length,
+            totalPartialBuilds: this.partialBuilds.length,
+            totalStaleLocks: this.staleLocks.length,
+            totalInconsistent: this.inconsistentScenes.length,
+            orphanStates: this.orphanStates,
+            orphanAssets: this.orphanAssets,
+            partialBuilds: this.partialBuilds,
+            staleLocks: this.staleLocks,
+            inconsistentScenes: this.inconsistentScenes
+        };
+    }
+}
+
+// ======================================================
+// ORPHAN STATE CHECKS
+// ======================================================
+
+/**
+ * Canonical build identity of a book (audit d9d67a3): the SAME source the
+ * rest of the runtime uses (rebuildWorkList, generate-next, dispatch) —
+ * book.json manifest.build_id. The former hardcoded 'default' produced
+ * false orphan detections for every book with a real build directory.
+ */
+function resolveBookBuildId(bookId) {
+    try {
+        // O-3: scene content via the SceneDataPort (host adapter:
+        // storage/scene-data-adapter) — the Book Model facade require left
+        // the reconciliation engine.
+        const loadedBook = require('./scene-data-port').sceneDataOp('loadBook')(bookId);
+        return loadedBook?.manifest?.build_id || 'default';
+    } catch (_) {
+        return 'default';
+    }
+}
+
+/**
+ * Check for VIDEO_READY state but no video file.
+ * T8: использует per-asset state (video=ready) вместо линейного.
+ */
+async function checkOrphanVideoState(redis, bookId, chapterId, sceneId) {
+    const assetStates = await state.getAssetStates(redis, bookId, chapterId, sceneId);
+    const isVideoReady = assetStates && assetStates.video &&
+        (assetStates.video === state.AssetState.READY || assetStates.video === state.AssetState.PLACEHOLDER);
+
+    if (!isVideoReady) {
+        return null;
+    }
+
+    const buildId = resolveBookBuildId(bookId);
+    const videoPath = `/data/output/${buildId}/${bookId}_${chapterId}_${sceneId}.mp4`;
+
+    try {
+        await fs.access(videoPath);
+        return null; // File exists, state is valid
+    } catch (err) {
+        return {
+            type: 'orphan_video_state',
+            scene: { bookId, chapterId, sceneId },
+            state: 'video_ready',
+            missingFile: videoPath,
+            recommendation: 'regenerate_video'
+        };
+    }
+}
+
+/**
+ * Check for IMAGE_READY state but no image file.
+ * T8: использует per-asset state (image=ready) вместо линейного.
+ */
+async function checkOrphanImageState(redis, bookId, chapterId, sceneId) {
+    const assetStates = await state.getAssetStates(redis, bookId, chapterId, sceneId);
+    const isImageReady = assetStates && assetStates.image &&
+        (assetStates.image === state.AssetState.READY || assetStates.image === state.AssetState.PLACEHOLDER);
+
+    if (!isImageReady) {
+        return null;
+    }
+
+    // Note: build_id is read from manifest, not from scene-state (which no longer exists after T8).
+    // Orphan-check uses the canonical book build identity (audit d9d67a3).
+    const buildId = resolveBookBuildId(bookId);
+    const imageModule = lazyHostBinding('media.image');
+    const imageInfo = imageModule.resolveCanonicalSceneImage(
+        '/data/output',
+        buildId,
+        bookId,
+        chapterId,
+        sceneId,
+    );
+
+    if (!imageInfo) {
+        return {
+            type: 'orphan_image_state',
+            scene: { bookId, chapterId, sceneId },
+            state: 'image_ready',
+            missingFile: 'image_not_found',
+            recommendation: 'regenerate_image'
+        };
+    }
+
+    return null;
+}
+
+/**
+ * Check for AUDIO_READY state but no audio file.
+ * T8: использует per-asset state (audio=ready) вместо линейного.
+ */
+async function checkOrphanAudioState(redis, bookId, chapterId, sceneId) {
+    const assetStates = await state.getAssetStates(redis, bookId, chapterId, sceneId);
+    const isAudioReady = assetStates && assetStates.audio &&
+        (assetStates.audio === state.AssetState.READY || assetStates.audio === state.AssetState.PLACEHOLDER);
+
+    if (!isAudioReady) {
+        return null;
+    }
+
+    // Canonical book build identity (audit d9d67a3) — the former hardcoded
+    // 'default' false-flagged every book with a real build directory.
+    const buildId = resolveBookBuildId(bookId);
+
+    // O-2: canonical audio path via the PersistencePort (filesystem op —
+    // the host adapter delegates to storage/filesystem-store unchanged).
+    const audioPath = persist('filesystem.getSceneAudioPath')(
+        config.OUTPUT_DIR,
+        buildId,
+        bookId,
+        chapterId,
+        sceneId
+    );
+
+    try {
+        await fs.access(audioPath);
+        return null; // File exists, state is valid
+    } catch (err) {
+        return {
+            type: 'orphan_audio_state',
+            scene: { bookId, chapterId, sceneId },
+            state: 'audio_ready',
+            missingFile: audioPath,
+            recommendation: 'regenerate_audio'
+        };
+    }
+}
+
+// ======================================================
+// ORPHAN ASSET CHECKS
+// ======================================================
+
+/**
+ * Check for assets in registry but no files.
+ */
+async function checkOrphanAssets(redis, bookId, chapterId, sceneId) {
+    const assets = await persist('registry.getSceneAssetsRedis')(redis, bookId, chapterId, sceneId);
+
+    if (!assets) {
+        return null;
+    }
+
+    const orphanAssets = [];
+
+    if (assets.audio?.canonical && assets.audio.ready) {
+        try {
+            await fs.access(assets.audio.canonical);
+        } catch (err) {
+            orphanAssets.push({
+                type: 'missing_audio_file',
+                scene: { bookId, chapterId, sceneId },
+                path: assets.audio.canonical
+            });
+        }
+    }
+
+    if (assets.image?.path && assets.image.ready) {
+        try {
+            await fs.access(assets.image.path);
+        } catch (err) {
+            orphanAssets.push({
+                type: 'missing_image_file',
+                scene: { bookId, chapterId, sceneId },
+                path: assets.image.path
+            });
+        }
+    }
+
+    if (assets.video?.path && assets.video.ready) {
+        try {
+            await fs.access(assets.video.path);
+        } catch (err) {
+            orphanAssets.push({
+                type: 'missing_video_file',
+                scene: { bookId, chapterId, sceneId },
+                path: assets.video.path
+            });
+        }
+    }
+
+    return orphanAssets.length > 0 ? orphanAssets : null;
+}
+
+// ======================================================
+// ORPHAN GENERATING CHECK (audit d9d67a3)
+// ======================================================
+
+/**
+ * Cancellation precedence helper: true if the user explicitly cancelled
+ * generation for this book (Redis cancel flag and/or PG tombstone).
+ * Reconciliation must never resurrect a cancelled book.
+ */
+async function isBookGenerationCancelled(redis, bookId) {
+    try {
+        const sceneWindow = require('./scene-window');
+        if (await sceneWindow.isCancelled(redis, bookId)) return true;
+    } catch (_) { /* flag unreadable — fall through to tombstone */ }
+    try {
+        return await persist('cancel.isCancelled')(bookId);
+    } catch (_) {
+        return false;
+    }
+}
+
+/**
+ * Check for orphan GENERATING states: a per-asset state stuck in GENERATING
+ * with NO evidence of a live generation — no dispatch lease, no dispatch
+ * metadata, no iu-in-flight marker (image), no active PG generation task.
+ *
+ * A live dispatch always holds lease+metadata from dispatch to finalization
+ * (dispatch order: acquireLease → setDispatchMetadata → markGenerating), so
+ * the absence of ALL evidence proves the generation is dead (crash/restart/
+ * TTL expiry with the rollback swallowed). A live job is NEVER repaired —
+ * age alone is not a reason (long video jobs keep their lease renewed).
+ *
+ * Fail-safe: if PG is unavailable the active-task check is treated as
+ * "task exists" and the state is NOT repaired.
+ */
+async function checkOrphanGeneratingState(redis, bookId, chapterId, sceneId) {
+    const assetStates = await state.getAssetStates(redis, bookId, chapterId, sceneId);
+    const orphans = [];
+
+    for (const stage of mediaRegistry.listMediaTypes()) {
+        if (assetStates[stage] !== state.AssetState.GENERATING) continue;
+
+        const evidence = await dispatchEngine.getDispatchEvidence(redis, bookId, chapterId, sceneId, stage);
+        if (evidence.alive) continue;
+
+        let hasActiveTask = false;
+        try {
+            // Pre-O-2 semantics preserved: a PG error is swallowed by the
+            // caller-side catch and treated as "task exists" (fail-safe).
+            hasActiveTask = await persist('tasks.hasActiveTaskForScene')(bookId, sceneId, stage);
+        } catch (_) {
+            hasActiveTask = true; // PG unavailable — fail safe, do NOT repair
+        }
+        if (hasActiveTask) continue;
+
+        orphans.push({
+            type: 'orphan_generating',
+            stage,
+            scene: { bookId, chapterId, sceneId },
+            state: 'generating',
+            recommendation: 'rollback_to_pending'
+        });
+    }
+
+    return orphans.length > 0 ? orphans : null;
+}
+
+// ======================================================
+// PARTIAL BUILD CHECKS
+// ======================================================
+
+/**
+ * Check for partially built scenes.
+ * T8: использует per-asset state вместо линейного.
+ */
+async function checkPartialBuilds(redis, bookId, chapterId, sceneId) {
+    const assetStates = await state.getAssetStates(redis, bookId, chapterId, sceneId);
+    const assets = await persist('registry.getSceneAssetsRedis')(redis, bookId, chapterId, sceneId);
+
+    // Audio READY/PLACEHOLDER but no image asset
+    const audioReady = assetStates && assetStates.audio &&
+        (assetStates.audio === state.AssetState.READY || assetStates.audio === state.AssetState.PLACEHOLDER);
+    if (audioReady && !assets?.image) {
+        return {
+            type: 'partial_audio_only',
+            scene: { bookId, chapterId, sceneId },
+            currentStage: 'audio_ready',
+            missingStage: 'image',
+            recommendation: 'progress_to_image'
+        };
+    }
+
+    // Image READY but no video asset
+    const imageReady = assetStates && assetStates.image &&
+        (assetStates.image === state.AssetState.READY || assetStates.image === state.AssetState.PLACEHOLDER);
+    if (imageReady && !assets?.video) {
+        return {
+            type: 'partial_image_video_missing',
+            scene: { bookId, chapterId, sceneId },
+            currentStage: 'image_ready',
+            missingStage: 'video',
+            recommendation: 'progress_to_video'
+        };
+    }
+
+    return null;
+}
+
+// ======================================================
+// B1: STALLED AUDIO CHUNKS WATCHDOG
+// ======================================================
+// Сканирует audio-orch state машины в фазе WAITING_CHUNKS.
+// Если last_chunk_at + AUDIO_CHUNK_STALL_MS < Date.now() —
+// сцена зависла: вызываем failWaitingScene(), которая чистит
+// hub-dedup, сбрасывает metadata и публикует failStage.
+//
+// Важно: watchdog НЕ конкурирует с gpu-hub timeout — они ловят
+// разные сценарии (стоп прогресса vs мёртвый воркер).
+
+async function checkStalledAudioScenes(redis, deps) {
+    // O-7: the audio FSM is consumed through the AudioFsmPort (host adapter:
+    // storage/audio-fsm-adapter). The pre-O-7 optional-load semantics are
+    // preserved EXACTLY: when the audio-orchestrator host service cannot be
+    // required, this watchdog leg returns 0 (missing module ≠ stalled scene).
+    // The try/catch therefore wraps the ADAPTER's lazy require — the port
+    // itself stays fail-fast.
+    let audioOrch;
+    let PHASES;
+    try {
+        const audioFsmPort = require('./audio-fsm-port');
+        audioOrch = audioFsmPort.audioFsm();
+        PHASES = audioFsmPort.audioFsmPhases();
+    } catch (_) {
+        return 0;
+    }
+
+    const { AUDIO_CHUNK_STALL_MS } = config.TIMEOUTS;
+    const allStates = await audioOrch.scanAllStates(redis);
+    if (allStates.length === 0) return 0;
+
+    let stalled = 0;
+    for (const entry of allStates) {
+        const { bookId, chapterId, sceneId, state: orchState } = entry;
+        if (orchState.phase !== PHASES.WAITING_CHUNKS) continue;
+
+        const buildId = orchState.build_id || 'default';
+
+        // ── LAST_CHUNK_AT || STARTED_AT ──
+        // Если completeChunk ни разу не был вызван (HTTP 500 на всех чанках),
+        // last_chunk_at = null, но started_at есть. Используем started_at как
+        // точку отсчёта застоя. Если и started_at нет — проверяем чанки на диске.
+        const lastChunkAt = orchState.last_chunk_at;
+        const startedAt = orchState.started_at;
+        const threshold = lastChunkAt || startedAt;
+
+        if (threshold) {
+            const age = Date.now() - threshold;
+            if (age < AUDIO_CHUNK_STALL_MS) continue;
+
+            const reason = `chunk_stall_timeout:${Math.round(age / 1000)}s`;
+            warn(`[STALLED-AUDIO] ${bookId}/${chapterId}/${sceneId} — ${reason} (last_chunk_at=${!!lastChunkAt} started_at=${!!startedAt})`);
+
+            try {
+                await audioOrch.failWaitingScene(redis, bookId, chapterId, sceneId, buildId, reason, {
+                    orchestrator: deps.orchestrator
+                });
+                stalled++;
+            } catch (err) {
+                warn(`[STALLED-AUDIO] failWaitingScene error: ${err.message}`);
+            }
+        } else {
+            // ── НЕТ НИ LAST_CHUNK_AT, НИ STARTED_AT ──
+            // Проверяем чанки на диске. Если все на месте — доигрываем merge.
+            // Если ни одного чанка нет — это fresh state без dispatch, не трогаем.
+            const expectedCount = parseInt(orchState.expected_count || '1', 10);
+            const pad = (n) => String(n).padStart(4, '0');
+            const OUTPUT_DIR = config.OUTPUT_DIR;
+            const buildDir = syncPath.join(OUTPUT_DIR, buildId);
+            let presentCount = 0;
+            for (let i = 1; i <= expectedCount; i++) {
+                const chunkPath = syncPath.join(buildDir, artifactNaming.sceneChunkAudioName(bookId, chapterId, sceneId, i));
+                if (syncFs.existsSync(chunkPath)) presentCount++;
+            }
+
+            if (presentCount === expectedCount) {
+                log(`[STALLED-AUDIO] ${bookId}/${chapterId}/${sceneId} — ALL ${presentCount} chunks on disk, no last_chunk_at. Calling completeChunk to trigger merge.`);
+                try {
+                    await audioOrch.completeChunk(redis, bookId, chapterId, sceneId, 'recovery', buildId, {
+                        audio: deps.audio || lazyHostBinding('media.audio'),
+                        orchestrator: deps.orchestrator,
+                        dispatchId: 'recovery-reconcile',
+                    });
+                    stalled++;
+                } catch (err) {
+                    warn(`[STALLED-AUDIO] completeChunk recovery failed: ${err.message}`);
+                    try {
+                        await audioOrch.failWaitingScene(redis, bookId, chapterId, sceneId, buildId,
+                            `recovery_fallback:${err.message}`, { orchestrator: deps.orchestrator });
+                        stalled++;
+                    } catch (fsErr) {
+                        warn(`[STALLED-AUDIO] failWaitingScene fallback failed: ${fsErr.message}`);
+                    }
+                }
+            } else if (presentCount > 0) {
+                warn(`[STALLED-AUDIO] ${bookId}/${chapterId}/${sceneId} — ${presentCount}/${expectedCount} on disk, no last_chunk_at. Partial chunks, failing scene.`);
+                try {
+                    await audioOrch.failWaitingScene(redis, bookId, chapterId, sceneId, buildId,
+                        `partial_chunks:${presentCount}/${expectedCount}_no_timestamps`, { orchestrator: deps.orchestrator });
+                    stalled++;
+                } catch (err) {
+                    warn(`[STALLED-AUDIO] failWaitingScene failed: ${err.message}`);
+                }
+            }
+            // Если presentCount === 0 — это fresh state, ничего не делаем
+        }
+    }
+
+    if (stalled > 0) log(`[STALLED-AUDIO] ${stalled} stalled audio scenes recovered`);
+    return stalled;
+}
+
+// ======================================================
+// B2: STALLED VIDEO GROUPS WATCHDOG
+// ======================================================
+// Сканирует video-orch state машины в фазе WAITING_CHUNKS.
+// Если last_group_at/started_at + VIDEO_CHUNK_STALL_MS < Date.now() —
+// сцена зависла: вызываем failWaitingScene(), которая чистит hub-dedup
+// недостающих групп и публикует failStage (→ re-dispatch).
+
+async function checkStalledVideoScenes(redis, deps) {
+    // O-8: the video FSM is consumed through the VideoFsmPort (host adapter:
+    // storage/video-fsm-adapter). The pre-O-8 optional-load semantics are
+    // preserved EXACTLY: when the video-orchestrator host service cannot be
+    // required, this watchdog leg returns 0 (missing module ≠ stalled scene).
+    // The try/catch therefore wraps the ADAPTER's lazy require — the port
+    // itself stays fail-fast.
+    let videoOrch;
+    let PHASES;
+    try {
+        const videoFsmPort = require('./video-fsm-port');
+        videoOrch = videoFsmPort.videoFsm();
+        PHASES = videoFsmPort.videoFsmPhases();
+    } catch (_) {
+        return 0;
+    }
+
+    const { VIDEO_CHUNK_STALL_MS } = config.TIMEOUTS;
+    const allStates = await videoOrch.scanAllStates(redis);
+    if (allStates.length === 0) return 0;
+
+    let stalled = 0;
+    for (const entry of allStates) {
+        const { bookId, chapterId, sceneId, state: orchState } = entry;
+        if (orchState.phase !== PHASES.WAITING_CHUNKS) continue;
+
+        // ── ПЕРЕСМОТР ПОРОГА ЗАСТОЯ ──
+        // Видео-генерация долгая по природе (LTX 5-10 мин на группу, на слабом
+        // GPU — 20-30+ мин). Жёсткий константный порог мог бы убить нормальную
+        // долгую генерацию. Порог застоя СТРОГО БОЛЬШЕ per-job timeout из
+        // layer-config (video_timeout_minutes): hub затаймливает воркера раньше,
+        // watchdog срабатывает только если hub/worker НЕ объявили ни результат,
+        // ни ошибку за весь интервал.
+        let stallThreshold = VIDEO_CHUNK_STALL_MS;
+        try {
+            const layerRaw = await redis.get(`animastor:layer-config:${bookId}`);
+            if (layerRaw) {
+                const lc = JSON.parse(layerRaw);
+                const perJobMs = (Number(lc.video_timeout_minutes) || 60) * 60 * 1000;
+                stallThreshold = Math.max(stallThreshold, perJobMs + 5 * 60 * 1000);
+            }
+        } catch (_) {}
+
+        const buildId = orchState.build_id || 'default';
+        const lastGroupAt = orchState.last_group_at;
+        const startedAt = orchState.started_at;
+        const threshold = lastGroupAt || startedAt;
+
+        if (threshold) {
+            const age = Date.now() - threshold;
+            if (age < stallThreshold) continue;
+
+            const reason = `video_group_stall_timeout:${Math.round(age / 1000)}s`;
+            warn(`[STALLED-VIDEO] ${bookId}/${chapterId}/${sceneId} — ${reason} (threshold=${Math.round(stallThreshold / 60000)}min, last_group_at=${!!lastGroupAt} started_at=${!!startedAt})`);
+            try {
+                await videoOrch.failWaitingScene(redis, bookId, chapterId, sceneId, buildId, reason, {
+                    orchestrator: deps.orchestrator,
+                });
+                stalled++;
+            } catch (err) {
+                warn(`[STALLED-VIDEO] failWaitingScene error: ${err.message}`);
+            }
+        } else {
+            // Нет ни last_group_at, ни started_at — свежий state без dispatch.
+            // Если все группы на диске — доигрываем merge.
+            const suffixes = videoOrch.groupSuffixes(orchState);
+            const presentCount = suffixes.filter(s => videoOrch.isGroupFileValid(buildId, bookId, chapterId, sceneId, s)).length;
+            if (presentCount === suffixes.length && suffixes.length > 0) {
+                log(`[STALLED-VIDEO] ${bookId}/${chapterId}/${sceneId} — ALL ${presentCount} groups on disk, no last_group_at. Calling completeGroup to trigger merge.`);
+                try {
+                    await videoOrch.completeGroup(redis, bookId, chapterId, sceneId, '', buildId, {
+                        orchestrator: deps.orchestrator,
+                        dispatchId: 'recovery-reconcile',
+                    });
+                    stalled++;
+                } catch (err) {
+                    warn(`[STALLED-VIDEO] completeGroup recovery failed: ${err.message}`);
+                    try {
+                        await videoOrch.failWaitingScene(redis, bookId, chapterId, sceneId, buildId,
+                            `recovery_fallback:${err.message}`, { orchestrator: deps.orchestrator });
+                        stalled++;
+                    } catch (fsErr) {
+                        warn(`[STALLED-VIDEO] failWaitingScene fallback failed: ${fsErr.message}`);
+                    }
+                }
+            } else if (presentCount > 0) {
+                warn(`[STALLED-VIDEO] ${bookId}/${chapterId}/${sceneId} — ${presentCount}/${suffixes.length} on disk, no last_group_at. Partial groups, failing scene.`);
+                try {
+                    await videoOrch.failWaitingScene(redis, bookId, chapterId, sceneId, buildId,
+                        `partial_groups:${presentCount}/${suffixes.length}_no_timestamps`, { orchestrator: deps.orchestrator });
+                    stalled++;
+                } catch (err) {
+                    warn(`[STALLED-VIDEO] failWaitingScene failed: ${err.message}`);
+                }
+            }
+        }
+    }
+
+    if (stalled > 0) log(`[STALLED-VIDEO] ${stalled} stalled video scenes recovered`);
+    return stalled;
+}
+
+// ======================================================
+// T7.6: AUDIO-ORCH INVARIANT CHECKS
+// ======================================================
+// Проверяет соответствие между audio-orch phase и asset state:
+//   phase=DONE     ⇔ asset.audio = READY
+//   phase=FAILED   ⇒ asset.audio = FAILED (или PENDING — после re-dispatch)
+//   промежуточные  ⇒ asset.audio ∈ {PENDING, GENERATING, DIRTY}
+
+async function checkAudioOrchInvariants(redis, bookId, chapterId, sceneId) {
+    // O-7: through the AudioFsmPort (host adapter: storage/audio-fsm-adapter)
+    // — the audio-orchestrator host service left this file. Mandatory load
+    // (pre-O-7 behavior: a broken require here throws, no optional-load).
+    const audioOrch = require('./audio-fsm-port').audioFsm();
+    const PHASES = require('./audio-fsm-port').audioFsmPhases();
+    const assetStates = await state.getAssetStates(redis, bookId, chapterId, sceneId);
+    const orchState = await audioOrch.getState(redis, bookId, chapterId, sceneId);
+
+    if (!orchState || !assetStates) return null;
+
+    const phase = orchState.phase;
+    const audioState = assetStates.audio;
+    const violations = [];
+
+    if (phase === PHASES.DONE) {
+        if (audioState !== state.AssetState.READY && audioState !== state.AssetState.PLACEHOLDER) {
+            violations.push({
+                type: 'audio_orch_invariant_done',
+                scene: { bookId, chapterId, sceneId },
+                phase,
+                audioState,
+                expected: 'READY or PLACEHOLDER',
+                recommendation: 'run_completeStage'
+            });
+        }
+    } else if (phase === PHASES.FAILED) {
+        if (audioState !== state.AssetState.FAILED && audioState !== state.AssetState.PENDING) {
+            violations.push({
+                type: 'audio_orch_invariant_failed',
+                scene: { bookId, chapterId, sceneId },
+                phase,
+                audioState,
+                expected: 'FAILED or PENDING',
+                recommendation: 'mark_dirty'
+            });
+        }
+    } else if (phase !== PHASES.NEW && phase !== PHASES.PLACEHOLDER_READY) {
+        // Intermediate phases: GENERATING, WAITING_CHUNKS, MERGING
+        if (audioState === state.AssetState.READY) {
+            violations.push({
+                type: 'audio_orch_invariant_intermediate',
+                scene: { bookId, chapterId, sceneId },
+                phase,
+                audioState,
+                expected: 'PENDING|GENERATING|DIRTY',
+                recommendation: 'mark_dirty_or_set_done'
+            });
+        }
+    }
+
+    return violations.length > 0 ? violations : null;
+}
+
+// ======================================================
+// VIDEO-ORCH INVARIANT CHECKS (зеркало checkAudioOrchInvariants)
+// ======================================================
+//   phase=DONE     ⇒ asset.video = READY (или PLACEHOLDER)
+//   phase=FAILED   ⇒ asset.video = FAILED (или PENDING — после re-dispatch)
+//   промежуточные  ⇒ asset.video = PENDING|GENERATING|DIRTY
+
+async function checkVideoOrchInvariants(redis, bookId, chapterId, sceneId) {
+    // O-8: through the VideoFsmPort (host adapter: storage/video-fsm-adapter)
+    // — the video-orchestrator host service left this file. Mandatory load
+    // (pre-O-8 behavior: a broken require here throws, no optional-load).
+    const videoOrch = require('./video-fsm-port').videoFsm();
+    const PHASES = require('./video-fsm-port').videoFsmPhases();
+    const assetStates = await state.getAssetStates(redis, bookId, chapterId, sceneId);
+    const orchState = await videoOrch.getState(redis, bookId, chapterId, sceneId);
+
+    if (!orchState || !assetStates) return null;
+
+    const phase = orchState.phase;
+    const videoState = assetStates.video;
+    const violations = [];
+
+    if (phase === PHASES.DONE) {
+        if (videoState !== state.AssetState.READY && videoState !== state.AssetState.PLACEHOLDER) {
+            violations.push({
+                type: 'video_orch_invariant_done',
+                scene: { bookId, chapterId, sceneId },
+                phase,
+                videoState,
+                expected: 'READY or PLACEHOLDER',
+                recommendation: 'run_completeStage'
+            });
+        }
+    } else if (phase === PHASES.FAILED) {
+        if (videoState !== state.AssetState.FAILED && videoState !== state.AssetState.PENDING) {
+            violations.push({
+                type: 'video_orch_invariant_failed',
+                scene: { bookId, chapterId, sceneId },
+                phase,
+                videoState,
+                expected: 'FAILED or PENDING',
+                recommendation: 'mark_dirty'
+            });
+        }
+    } else if (phase !== PHASES.NEW && phase !== PHASES.GENERATING) {
+        // WAITING_CHUNKS, MERGING — ассет не должен быть READY
+        if (videoState === state.AssetState.READY) {
+            violations.push({
+                type: 'video_orch_invariant_intermediate',
+                scene: { bookId, chapterId, sceneId },
+                phase,
+                videoState,
+                expected: 'PENDING|GENERATING|DIRTY',
+                recommendation: 'mark_dirty_or_set_done'
+            });
+        }
+    }
+
+    return violations.length > 0 ? violations : null;
+}
+
+// ======================================================
+// STALE LOCK CHECKS
+// ======================================================
+
+const LOCK_KEYS = [
+    'animastor:audio-scene-lock',
+    'animastor:video-lock',
+    'animastor:audio-merge-lock',
+    'animastor:scene-transition-lock'
+];
+
+/**
+ * Check for stale locks (lock exists but no heartbeat).
+ */
+async function checkStaleLocks(redis, bookId, chapterId, sceneId) {
+    const staleLocks = [];
+
+    for (const lockPrefix of LOCK_KEYS) {
+        const lockKey = `${lockPrefix}:${bookId}:${chapterId}:${sceneId}`;
+        const lockData = await redis.get(lockKey);
+
+        if (lockData) {
+            // Check heartbeat
+            const heartbeatKey = `animastor:scene-heartbeat:${bookId}:${chapterId}:${sceneId}`;
+            const heartbeatTime = await redis.get(heartbeatKey);
+
+            if (!heartbeatTime) {
+                staleLocks.push({
+                    type: 'lock_without_heartbeat',
+                    lockKey,
+                    scene: { bookId, chapterId, sceneId },
+                    lockData: JSON.parse(lockData),
+                    recommendation: 'release_lock'
+                });
+            } else {
+                // Check if heartbeat is stale (> 5 minutes)
+                const now = Date.now();
+                const lastHeartbeat = parseInt(heartbeatTime, 10);
+                if (now - lastHeartbeat > 5 * 60 * 1000) {
+                    staleLocks.push({
+                        type: 'stale_heartbeat',
+                        lockKey,
+                        scene: { bookId, chapterId, sceneId },
+                        lastHeartbeat,
+                        recommendation: 'clear_heartbeat'
+                    });
+                }
+            }
+        }
+    }
+
+    return staleLocks.length > 0 ? staleLocks : null;
+}
+
+// ======================================================
+// DISPATCH LEASE CHECKS
+// ======================================================
+
+/**
+ * Check for stale dispatch leases.
+ *
+ * Liveness is decided by the lease key's REMAINING TTL — the canonical
+ * signal that renewal is still running — NOT by metadata.started_at.
+ * renewLeaseIfOwner re-pins the TTL to the renewal target every 30 s while
+ * the owner is alive, so a healthy long-running (even 60-min video) dispatch
+ * never goes stale, while a lease whose owner died (crash/restart) decays and
+ * is flagged once its TTL drops below target - STALE_LEASE_GRACE_S.
+ * (audit c8b79f6 / incident 2026-08-28: started_at-based age falsely killed
+ * live renewed video dispatches at 27 min → duplicate re-dispatch loop.)
+ */
+async function checkStaleDispatchLeases(redis, bookId, chapterId, sceneId) {
+    const staleLeases = [];
+
+    // Check all stages for lease existence
+    const stages = mediaRegistry.listMediaTypes();
+
+    for (const stage of stages) {
+        const leaseKey = dispatchEngine.getLeaseKey(bookId, chapterId, sceneId, stage);
+        const token = await redis.get(leaseKey);
+
+        if (token) {
+            // Check dispatch metadata for age
+            const metaKey = dispatchEngine.getDispatchMetaKey(bookId, chapterId, sceneId, stage);
+            const metadata = await redis.get(metaKey);
+
+            if (metadata) {
+                // Remaining TTL is the source of truth for liveness. A lease
+                // being actively renewed keeps its TTL pinned near the renewal
+                // target regardless of how old started_at is.
+                const leaseTtlS = await redis.ttl(leaseKey);
+
+                if (leaseManager.isLeaseStale(leaseTtlS, stage)) {
+                    staleLeases.push({
+                        type: 'stale_dispatch_lease',
+                        stage,
+                        leaseKey,
+                        scene: { bookId, chapterId, sceneId },
+                        leaseTtlS,
+                        renewalTargetS: leaseManager.getRenewalTargetTtlS(stage),
+                        token,
+                        recommendation: 'release_lease_and_move_to_pending'
+                    });
+                }
+            } else {
+                // Lease exists but no metadata - might be orphaned
+                staleLeases.push({
+                    type: 'orphan_dispatch_lease',
+                    stage,
+                    leaseKey,
+                    scene: { bookId, chapterId, sceneId },
+                    token,
+                    recommendation: 'release_lease_and_move_to_pending'
+                });
+            }
+        }
+    }
+
+    return staleLeases.length > 0 ? staleLeases : null;
+}
+
+// ======================================================
+// SCENE RECONCILIATION
+// ======================================================
+
+/**
+ * Reconcile a single scene.
+ */
+async function reconcileScene(redis, bookId, chapterId, sceneId) {
+    const report = new ReconciliationReport();
+
+    try {
+        // Check orphan states
+        const orphanVideo = await checkOrphanVideoState(redis, bookId, chapterId, sceneId);
+        if (orphanVideo) {
+            report.orphanStates.push(orphanVideo);
+            report.inconsistentScenes.push({
+                scene: { bookId, chapterId, sceneId },
+                issue: orphanVideo.type
+            });
+        }
+
+        const orphanImage = await checkOrphanImageState(redis, bookId, chapterId, sceneId);
+        if (orphanImage) {
+            report.orphanStates.push(orphanImage);
+            if (!report.inconsistentScenes.find(s => s.scene.sceneId === sceneId)) {
+                report.inconsistentScenes.push({
+                    scene: { bookId, chapterId, sceneId },
+                    issue: orphanImage.type
+                });
+            }
+        }
+
+        const orphanAudio = await checkOrphanAudioState(redis, bookId, chapterId, sceneId);
+        if (orphanAudio) {
+            report.orphanStates.push(orphanAudio);
+            if (!report.inconsistentScenes.find(s => s.scene.sceneId === sceneId)) {
+                report.inconsistentScenes.push({
+                    scene: { bookId, chapterId, sceneId },
+                    issue: orphanAudio.type
+                });
+            }
+        }
+
+        // Check orphan assets
+        const orphanAssets = await checkOrphanAssets(redis, bookId, chapterId, sceneId);
+        if (orphanAssets) {
+            report.orphanAssets.push(...orphanAssets);
+            if (!report.inconsistentScenes.find(s => s.scene.sceneId === sceneId)) {
+                report.inconsistentScenes.push({
+                    scene: { bookId, chapterId, sceneId },
+                    issue: 'orphan_assets'
+                });
+            }
+        }
+
+        // Check orphan GENERATING states (audit d9d67a3). Pushed BEFORE the
+        // partial-build checks: those de-duplicate by sceneId, and the orphan
+        // repair must win over a PROGRESS_TO_* resurrection attempt.
+        const orphanGenerating = await checkOrphanGeneratingState(redis, bookId, chapterId, sceneId);
+        if (orphanGenerating) {
+            report.orphanStates.push(...orphanGenerating);
+            for (const o of orphanGenerating) {
+                report.inconsistentScenes.push({
+                    scene: { bookId, chapterId, sceneId },
+                    stage: o.stage,
+                    issue: 'orphan_generating'
+                });
+            }
+        }
+
+        // Check partial builds
+        const partial = await checkPartialBuilds(redis, bookId, chapterId, sceneId);
+        if (partial) {
+            report.partialBuilds.push(partial);
+            if (!report.inconsistentScenes.find(s => s.scene.sceneId === sceneId)) {
+                report.inconsistentScenes.push({
+                    scene: { bookId, chapterId, sceneId },
+                    issue: partial.type
+                });
+            }
+        }
+
+        // Check stale locks
+        const staleLocks = await checkStaleLocks(redis, bookId, chapterId, sceneId);
+        if (staleLocks) {
+            report.staleLocks.push(...staleLocks);
+            if (!report.inconsistentScenes.find(s => s.scene.sceneId === sceneId)) {
+                report.inconsistentScenes.push({
+                    scene: { bookId, chapterId, sceneId },
+                    issue: 'stale_locks'
+                });
+            }
+        }
+
+        // Check stale dispatch leases
+        const staleLeases = await checkStaleDispatchLeases(redis, bookId, chapterId, sceneId);
+        if (staleLeases) {
+            report.staleLocks.push(...staleLeases);
+            for (const lease of staleLeases) {
+                if (!report.inconsistentScenes.find(s => s.scene.sceneId === sceneId && s.issue === 'stale_dispatch_lease')) {
+                    report.inconsistentScenes.push({
+                        scene: { bookId, chapterId, sceneId },
+                        issue: 'stale_dispatch_lease'
+                    });
+                }
+            }
+        }
+
+        // T7.6: Check audio-orch invariants
+        const audioOrchViolations = await checkAudioOrchInvariants(redis, bookId, chapterId, sceneId);
+        if (audioOrchViolations) {
+            for (const v of audioOrchViolations) {
+                report.inconsistentScenes.push({
+                    scene: v.scene,
+                    issue: v.type
+                });
+            }
+            log(`[INVARIANT] ${bookId}/${chapterId}/${sceneId}: ${audioOrchViolations.length} audio-orch violations`);
+        }
+
+        // Video-orch invariants (зеркало аудио)
+        const videoOrchViolations = await checkVideoOrchInvariants(redis, bookId, chapterId, sceneId);
+        if (videoOrchViolations) {
+            for (const v of videoOrchViolations) {
+                report.inconsistentScenes.push({
+                    scene: v.scene,
+                    issue: v.type
+                });
+            }
+            log(`[INVARIANT] ${bookId}/${chapterId}/${sceneId}: ${videoOrchViolations.length} video-orch violations`);
+        }
+
+        return report;
+    } catch (err) {
+        error(`Reconciliation error for ${bookId}/${chapterId}/${sceneId}: ${err.message}`);
+        return report;
+    }
+}
+
+// ======================================================
+// RECOMMENDATIONS & AUTO-FIXES
+// ======================================================
+
+/**
+ * Get recommendations for fixing inconsistencies.
+ */
+function getFixRecommendations(inconsistentScenes) {
+    return inconsistentScenes.map(item => {
+        const { scene, issue } = item;
+
+        switch (issue) {
+            case 'orphan_video_state':
+                return {
+                    scene,
+                    action: 'REGENERATE_MISSING_ASSET',
+                    reason: 'VIDEO_READY but no video file',
+                    safeToExecute: true
+                };
+            case 'orphan_image_state':
+                return {
+                    scene,
+                    action: 'REGENERATE_MISSING_ASSET',
+                    reason: 'IMAGE_READY but no image file',
+                    safeToExecute: true
+                };
+            case 'orphan_audio_state':
+                return {
+                    scene,
+                    action: 'REGENERATE_MISSING_ASSET',
+                    reason: 'AUDIO_READY but no audio file',
+                    safeToExecute: true
+                };
+            case 'partial_audio_only':
+                return {
+                    scene,
+                    action: 'PROGRESS_TO_IMAGE',
+                    reason: 'Audio ready but image not started',
+                    safeToExecute: true
+                };
+            case 'partial_image_video_missing':
+                return {
+                    scene,
+                    action: 'PROGRESS_TO_VIDEO',
+                    reason: 'Image ready but video not started',
+                    safeToExecute: true
+                };
+            case 'stale_locks':
+                return {
+                    scene,
+                    action: 'RELEASE_STALE_LOCKS',
+                    reason: 'Locks exist without heartbeat',
+                    safeToExecute: true
+                };
+            case 'orphan_assets':
+                return {
+                    scene,
+                    action: 'RECOVER_ORPHAN_ASSETS',
+                    reason: 'Registry has assets but files are missing',
+                    safeToExecute: true
+                };
+            case 'stuck_state':
+                return {
+                    scene,
+                    action: 'MOVE_TO_PENDING',
+                    reason: `Stuck in ${item.state} for ${item.ageMinutes} minutes`,
+                    safeToExecute: true
+                };
+            case 'orphan_generating':
+                // Audit d9d67a3: GENERATING with no lease/dispatch-meta/
+                // in-flight marker/active PG task — the generation is proven
+                // dead. Stage-scoped MOVE_TO_PENDING performs the strict
+                // FSM-safe repair GENERATING → DIRTY → PENDING.
+                return {
+                    scene,
+                    stage: item.stage,
+                    action: 'MOVE_TO_PENDING',
+                    reason: `Orphan GENERATING (${item.stage}): no lease/dispatch/in-flight/PG task`,
+                    safeToExecute: true
+                };
+            case 'counter_drift':
+                return {
+                    scene,
+                    stage: item.stage,
+                    action: 'RECONCILE_COUNTER_DRIFT',
+                    reason: `Counter drift: ${item.drift} (leases=${item.leaseCount}, counter=${item.counterValue})`,
+                    safeToExecute: true
+                };
+            case 'stale_dispatch_lease':
+                return {
+                    scene,
+                    action: 'RELEASE_STALE_LEASE',
+                    reason: `Stale dispatch lease detected`,
+                    safeToExecute: true
+                };
+            default:
+                return {
+                    scene,
+                    action: 'REVIEW_MANUALLY',
+                    reason: issue,
+                    safeToExecute: false
+                };
+        }
+    });
+}
+
+/**
+ * Fix actions that resurrect work (re-add a scene to the active index /
+ * re-mark stages for generation). Audit d9d67a3: they must NEVER run for a
+ * book the user explicitly cancelled — the cancellation tombstone / cancel
+ * flag takes precedence over any reconciliation recommendation.
+ */
+const RESURRECTION_ACTIONS = new Set([
+    'REGENERATE_MISSING_ASSET',
+    'PROGRESS_TO_IMAGE',
+    'PROGRESS_TO_VIDEO',
+    'RECOVER_ORPHAN_ASSETS',
+    'RELEASE_STALE_LEASE',
+]);
+
+/**
+ * Apply a fix recommendation.
+ * Returns { success: boolean, action, scene, details }
+ */
+async function applyFix(redis, fix) {
+    const { scene, action } = fix;
+
+    try {
+        // Cancellation precedence (audit d9d67a3): a fresh tombstone/cancel
+        // flag blocks every resurrection path. State-hygiene repairs that do
+        // NOT re-add the scene to the active index (stage-scoped
+        // MOVE_TO_PENDING) are still allowed — they remove a ghost, not
+        // resurrect work.
+        if (RESURRECTION_ACTIONS.has(action) &&
+            await isBookGenerationCancelled(redis, scene.bookId)) {
+            return {
+                success: false,
+                action,
+                scene,
+                details: 'skipped: book generation cancelled (tombstone/cancel flag precedence)'
+            };
+        }
+
+        switch (action) {
+            case 'MOVE_TO_PENDING': {
+                // S-5: FSM-safe rollback via the injected orchestration seam
+                const rollbackStageToPending = orchestrationSeams.getOrchestrationSeam('rollbackStageToPending');
+
+                // ── Stage-scoped orphan GENERATING repair (audit d9d67a3) ──
+                if (fix.stage) {
+                    // Strict re-verification right before the write (TOCTOU):
+                    // a concurrent dispatch may have acquired the stage
+                    // between detection and fix. A live stage is NEVER
+                    // rolled back.
+                    const evidence = await dispatchEngine.getDispatchEvidence(
+                        redis, scene.bookId, scene.chapterId, scene.sceneId, fix.stage);
+                    if (evidence.alive) {
+                        return {
+                            success: false, action, scene,
+                            details: `repair aborted: generation alive (${evidence.reason})`
+                        };
+                    }
+                    const currentStates = await state.getAssetStates(
+                        redis, scene.bookId, scene.chapterId, scene.sceneId);
+                    if (currentStates[fix.stage] !== state.AssetState.GENERATING) {
+                        return {
+                            success: false, action, scene,
+                            details: `repair aborted: state now ${currentStates[fix.stage]}`
+                        };
+                    }
+
+                    // FSM-safe path GENERATING → DIRTY → PENDING (a direct
+                    // GENERATING → PENDING is forbidden). Errors are NOT
+                    // swallowed (rollbackStageToPending logs + journals +
+                    // counts failures itself).
+                    const rollback = await rollbackStageToPending(
+                        redis, scene.bookId, scene.chapterId, scene.sceneId,
+                        fix.stage, null, 'orphan_generating_repair');
+                    if (!rollback.changed) {
+                        return { success: false, action, scene, details: rollback.reason || 'rollback_failed' };
+                    }
+
+                    await journal.appendSceneEvent(redis, scene.bookId, scene.chapterId, scene.sceneId,
+                        'AUTO_RECOVER', 'PENDING',
+                        { stage: fix.stage, fromState: 'generating', recoveredBy: 'reconciliation-engine' }
+                    ).catch(() => {});
+
+                    // Make the repaired stage dispatchable again — but never
+                    // for a cancelled book (tombstone/cancel flag precedence:
+                    // only an explicit new generation clears them).
+                    if (!(await isBookGenerationCancelled(redis, scene.bookId))) {
+                        await runtimeScheduler.addSceneToActiveIndex(
+                            redis, scene.bookId, scene.chapterId, scene.sceneId);
+                    }
+
+                    return {
+                        success: true, action, scene,
+                        details: `${fix.stage}: GENERATING → DIRTY → PENDING (orphan repair)`
+                    };
+                }
+
+                // ── Legacy stuck_state path: whole-scene DIRTY ──
+                // Mark all per-asset states as DIRTY for redispatch
+                // M5: Route through orchestrator.markDirtyScene instead of direct state.setAssetState
+                // S-5: asset-state writer via the injected orchestration seam
+                await orchestrationSeams.getOrchestrationSeam('markDirtyScene')(redis, scene.bookId, scene.chapterId, scene.sceneId);
+
+                // Remove from active index to avoid immediate re-scheduling
+                await runtimeScheduler.removeSceneFromActiveIndex(redis, scene.bookId, scene.chapterId, scene.sceneId);
+
+                // Extract previous state from fix reason (format: "Stuck in <state> for <n> minutes")
+                const fromState = fix.reason?.match(/Stuck in (\w+)/)?.[1] || 'unknown';
+
+                // Log to journal
+                await journal.appendSceneEvent(redis, scene.bookId, scene.chapterId, scene.sceneId,
+                    'AUTO_RECOVER', 'DIRTY',
+                    { fromState, recoveredBy: 'reconciliation-engine' }
+                );
+
+                return { success: true, action, scene, details: 'moved to DIRTY + assets DIRTY' };
+            }
+
+            case 'RELEASE_STALE_LOCKS': {
+                let removedCount = 0;
+                for (const lockPrefix of LOCK_KEYS) {
+                    const lockKey = `${lockPrefix}:${scene.bookId}:${scene.chapterId}:${scene.sceneId}`;
+                    const removed = await redis.del(lockKey);
+                    removedCount += removed;
+                }
+
+                return { success: removedCount > 0, action, scene, details: `removed ${removedCount} locks` };
+            }
+
+            case 'RELEASE_STALE_LEASE': {
+                const dispatchEngine = require('./dispatch-engine');
+                let removedCount = 0;
+                const clearedDispatchIds = [];
+
+                // Release all dispatch leases for this scene through the
+                // canonical cancellation path (lease + owned quota + renewal
+                // timer + completion marker). A bare `del` would leak the
+                // quota slot and the in-memory renewal timer, and could race a
+                // concurrent re-acquire (no token check).
+                for (const stage of mediaRegistry.listMediaTypes()) {
+                    const result = await dispatchEngine.cancelActiveDispatch(
+                        redis, scene.bookId, scene.chapterId, scene.sceneId, stage,
+                        'stale_lease_recovery'
+                    );
+                    if (result.cancelled) {
+                        removedCount++;
+                        if (result.dispatchId) clearedDispatchIds.push(result.dispatchId);
+                    }
+                }
+
+                // Defensive de-duplication (audit c8b79f6 §2): purge the hub
+                // queue/running copies owned by the cancelled dispatch(es) so a
+                // recovered scene cannot accumulate duplicate job copies that a
+                // worker would later drain. Best-effort — hub unavailability
+                // must not block state recovery. O-9: the hub call goes
+                // through the HubCancelPort (hub HTTP stays host-side; the
+                // cancelActiveDispatch loop above stays a direct
+                // dispatch-engine call — Redis domain operation).
+                if (clearedDispatchIds.length > 0) {
+                    try {
+                        await require('./hub-cancel-port').hubCancelOp('clearHubDispatches')(clearedDispatchIds, { context: 'STALE_LEASE_RECOVERY' });
+                    } catch (hubErr) {
+                        warn(`RELEASE_STALE_LEASE hub cleanup failed (non-fatal): ${hubErr.message}`);
+                    }
+                }
+
+                // Mark per-asset states as DIRTY for redispatch
+                // M5: Route through orchestrator.markDirtyScene instead of direct state.setAssetState
+                // M5 Шаг 3: syncLinearState уже внутри markDirtyScene
+                // S-5: asset-state writer via the injected orchestration seam
+                const markDirtyScene = orchestrationSeams.getOrchestrationSeam('markDirtyScene');
+                await markDirtyScene(redis, scene.bookId, scene.chapterId, scene.sceneId);
+
+                // Add back to active index
+                await runtimeScheduler.addSceneToActiveIndex(redis, scene.bookId, scene.chapterId, scene.sceneId);
+
+                return { success: removedCount > 0, action, scene, details: `released ${removedCount} stale leases` };
+            }
+
+            case 'REGENERATE_MISSING_ASSET': {
+                // Derive asset type from action reason or issue field
+                const reasons = (fix.reason + ' ' + (fix.issue || '')).toLowerCase();
+                const pendingState =
+                    reasons.includes('audio') || reasons.includes('tts')
+                        ? 'audio_pending'
+                        : reasons.includes('video')
+                        ? 'video_pending'
+                        : reasons.includes('image') || reasons.includes('iu')
+                        ? 'image_pending'
+                        : null;
+
+                if (!pendingState) {
+                    return { success: false, action, scene, details: `unknown asset type (reason: ${fix.reason})` };
+                }
+
+                // M5 Шаг 4: Route through orchestrator.setScenePending (which includes syncLinearState)
+                // S-5: asset-state writer via the injected orchestration seam
+                const setScenePending = orchestrationSeams.getOrchestrationSeam('setScenePending');
+                const assetType = pendingState === 'audio_pending' ? 'audio'
+                    : pendingState === 'image_pending' ? 'image'
+                    : pendingState === 'video_pending' ? 'video'
+                    : null;
+                if (assetType) {
+                    await setScenePending(redis, scene.bookId, scene.chapterId, scene.sceneId, assetType);
+                }
+
+                await runtimeScheduler.addSceneToActiveIndex(
+                    redis,
+                    scene.bookId,
+                    scene.chapterId,
+                    scene.sceneId
+                );
+
+                return { success: true, action, scene, details: `marked as ${pendingState}` };
+            }
+
+            case 'PROGRESS_TO_IMAGE': {
+                // M5 Шаг 4: Route through orchestrator.setScenePending (includes syncLinearState)
+                // S-5: asset-state writer via the injected orchestration seam
+                await orchestrationSeams.getOrchestrationSeam('setScenePending')(redis, scene.bookId, scene.chapterId, scene.sceneId, 'image');
+
+                await runtimeScheduler.addSceneToActiveIndex(
+                    redis,
+                    scene.bookId,
+                    scene.chapterId,
+                    scene.sceneId
+                );
+
+                return { success: true, action, scene, details: 'progressed to IMAGE_PENDING' };
+            }
+
+            case 'RECONCILE_COUNTER_DRIFT': {
+                // Get the current lease count and fix counter
+                const stage = fix.stage || 'audio';
+                const leaseCount = await counterReconciliation.countActiveLeasesByStage(redis, stage);
+
+                await counterReconciliation.correctCounterWithLua(redis, stage, leaseCount);
+
+                return { success: true, action, scene, details: `counter corrected to ${leaseCount}` };
+            }
+
+            case 'PROGRESS_TO_VIDEO': {
+                // M5 Шаг 4: Route through orchestrator.setScenePending (includes syncLinearState)
+                // S-5: asset-state writer via the injected orchestration seam
+                await orchestrationSeams.getOrchestrationSeam('setScenePending')(redis, scene.bookId, scene.chapterId, scene.sceneId, 'video');
+
+                await runtimeScheduler.addSceneToActiveIndex(
+                    redis,
+                    scene.bookId,
+                    scene.chapterId,
+                    scene.sceneId
+                );
+
+                return { success: true, action, scene, details: 'progressed to VIDEO_PENDING' };
+            }
+
+            case 'RECOVER_ORPHAN_ASSETS': {
+                // Clear registry entries for missing assets
+                const assets = await persist('registry.getSceneAssetsRedis')(redis, scene.bookId, scene.chapterId, scene.sceneId);
+                if (assets) {
+                    if (assets.audio && assets.audio.canonical) {
+                        await persist('registry.registerSceneAudioRedis')(redis, scene.bookId, scene.chapterId, scene.sceneId, {
+                            canonicalPath: assets.audio.canonical,
+                            ready: false
+                        });
+                    }
+                    if (assets.image && assets.image.path) {
+                        await persist('registry.registerSceneImageRedis')(redis, scene.bookId, scene.chapterId, scene.sceneId, {
+                            path: assets.image.path,
+                            ready: false
+                        });
+                    }
+                    if (assets.video && assets.video.path) {
+                        await persist('registry.registerSceneVideoRedis')(redis, scene.bookId, scene.chapterId, scene.sceneId, {
+                            path: assets.video.path,
+                            ready: false
+                        });
+                    }
+                }
+
+                // M5 Шаг 4: Route through orchestrator.setScenePending (includes syncLinearState)
+                // S-5: asset-state writer via the injected orchestration seam
+                await orchestrationSeams.getOrchestrationSeam('setScenePending')(redis, scene.bookId, scene.chapterId, scene.sceneId, 'audio');
+
+                return { success: true, action, scene, details: 'registry marked for recovery' };
+            }
+
+            default:
+                return { success: false, action, scene, details: 'unknown_action' };
+        }
+    } catch (err) {
+        error(`Fix execution error for ${scene.bookId}/${scene.chapterId}/${scene.sceneId}: ${err.message}`);
+        return { success: false, action, scene, details: err.message };
+    }
+}
+
+// ======================================================
+// BULK RECONCILIATION
+// ======================================================
+
+/**
+ * Reconcile all scenes for a specific book.
+ */
+async function reconcileBook(redis, bookId) {
+    log(`Starting book reconciliation: ${bookId}`);
+
+    const report = new ReconciliationReport();
+    let scanned = 0;
+
+    // Scan event journals for scenes
+    const journalPattern = `animastor:event-journal:${bookId}:*`;
+    let cursor = 0;
+
+    do {
+        const result = await redis.scan(cursor, 'MATCH', journalPattern, 'COUNT', 200);
+        cursor = parseInt(result[0], 10);
+        const keys = result[1];
+
+        for (const key of keys) {
+            const parts = key.split(':');
+            if (parts.length >= 5) {
+                const chapterId = parts[3];
+                const sceneId = parts[4];
+
+                const sceneReport = await reconcileScene(redis, bookId, chapterId, sceneId);
+
+                report.orphanStates.push(...sceneReport.orphanStates);
+                report.orphanAssets.push(...sceneReport.orphanAssets);
+                report.partialBuilds.push(...sceneReport.partialBuilds);
+                report.staleLocks.push(...sceneReport.staleLocks);
+                report.inconsistentScenes.push(...sceneReport.inconsistentScenes);
+
+                scanned++;
+            }
+        }
+    } while (cursor !== 0);
+
+    log(`Reconciliation complete: ${scanned} scenes scanned, ${report.inconsistentScenes.length} inconsistencies found`);
+
+    return report;
+}
+
+/**
+ * Reconcile all scenes across all books.
+ */
+async function reconcileAll(redis) {
+    log('Starting full system reconciliation');
+
+    const report = new ReconciliationReport();
+    let scanned = 0;
+
+    // Find all scenes via event journal
+    const journalPattern = 'animastor:event-journal:*';
+    let cursor = 0;
+
+    do {
+        const result = await redis.scan(cursor, 'MATCH', journalPattern, 'COUNT', 500);
+        cursor = parseInt(result[0], 10);
+        const keys = result[1];
+
+        for (const key of keys) {
+            const parts = key.split(':');
+            if (parts.length >= 5) {
+                const bookId = parts[2];
+                const chapterId = parts[3];
+                const sceneId = parts[4];
+
+                const sceneReport = await reconcileScene(redis, bookId, chapterId, sceneId);
+
+                report.orphanStates.push(...sceneReport.orphanStates);
+                report.orphanAssets.push(...sceneReport.orphanAssets);
+                report.partialBuilds.push(...sceneReport.partialBuilds);
+                report.staleLocks.push(...sceneReport.staleLocks);
+                report.inconsistentScenes.push(...sceneReport.inconsistentScenes);
+
+                scanned++;
+            }
+        }
+    } while (cursor !== 0);
+
+    // Check counter drift once globally (leases vs counters are system-wide, not per-scene)
+    for (const stage of mediaRegistry.listMediaTypes()) {
+        const driftCheck = await counterReconciliation.getCounterWithDriftCheck(redis, stage);
+        if (driftCheck && !driftCheck.correct) {
+            report.inconsistentScenes.push({
+                scene: { bookId: '*', chapterId: '*', sceneId: '*' },
+                stage,
+                drift: driftCheck.drift,
+                leaseCount: driftCheck.leaseCount,
+                counterValue: driftCheck.counterValue,
+                issue: 'counter_drift'
+            });
+        }
+    }
+
+    log(`Full reconciliation complete: ${scanned} scenes scanned, ${report.inconsistentScenes.length} inconsistencies found`);
+
+    return report;
+}
+
+/**
+ * Get current metrics from reconciliation engine.
+ */
+async function getMetrics(redis) {
+    return {
+        activeChecks: 'all_scenes_via_journal_scan'
+    };
+}
+
+// ======================================================
+// T6: ЕДИНЫЙ RECONCILIATION-ЦИКЛ
+// ======================================================
+// Заменяет 4 несогласованных механизма восстановления:
+//   startup-recovery, audio-recovery, cleanup-service, reconcileAll
+//
+// Фазы:
+//   A. Result/error key recovery (из audio-recovery.cjs)
+//   B. Cleanup expired locks (из cleanup-service.cjs)
+//   C. Startup-specific (из startup-recovery.js) — только при startup:true
+//   D. Full scene reconciliation (из reconciliation-engine)
+//
+// Каждый прогон пишет RECOVERY_STARTED/RECOVERY_COMPLETED в event-journal.
+// Один распределённый CLEANUP_LOCK на цикл — прогоны не пересекаются.
+
+/**
+ * Единый reconciliation-цикл. Выполняет все фазы восстановления.
+ *
+ * @param {Object} redis
+ * @param {Object} deps — зависимости { state, config, postgres, orchestrator, taskHandler, ... }
+ * @param {Object} [options]
+ * @param {boolean} [options.startup=false] — первый прогон при старте (доп. шаги C)
+ * @param {string} [options.scope] — если указан, обработать только одну книгу/сцену
+ *   Формат: "bookId" (книга), "bookId:chapterId:sceneId" (одна сцена)
+ * @returns {Promise<{ok:boolean, phases:string[], summary:object}>}
+ */
+async function reconcileCycle(redis, deps = {}, options = {}) {
+    const { startup = false, scope = null } = options;
+    const startTime = Date.now();
+    const phases = [];
+    const summary = { totalScanned: 0, itemsRecovered: 0, staleLocks: 0, errors: [] };
+
+    // ── Acquire distributed CLEANUP_LOCK ──
+    const lockKey = config.REDIS.CLEANUP_LOCK || 'animastor:cleanup-lock';
+    const lockToken = `reconcile-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+    const lockAcquired = await redis.set(lockKey, lockToken, 'NX', 'EX', 120);
+    if (!lockAcquired) {
+        log('Cycle skipped — CLEANUP_LOCK held by another instance');
+        return { ok: false, reason: 'lock_held', phases: ['lock_skipped'], summary };
+    }
+
+    const releaseLock = async () => {
+        try {
+            const current = await redis.get(lockKey);
+            if (current === lockToken) await redis.del(lockKey);
+        } catch (_) {}
+    };
+
+    try {
+        // ── Journal: RECOVERY_STARTED ──
+        try {
+            await journal.appendSceneEvent(redis, '_system', '_recovery', '_cycle',
+                journal.EventType.RECOVERY_STARTED, 'INITIATED',
+                { startup, scope, phases: [] }
+            );
+        } catch (_) {}
+
+        // ══════════════════════════════════════════════
+        // PHASE A: Result/error key recovery (audio-recovery)
+        // ══════════════════════════════════════════════
+        if (deps.taskHandler) {
+            try {
+                const aCount = await recoverResultKeys(redis, deps, scope);
+                summary.itemsRecovered += aCount;
+                phases.push(`result_recovery:${aCount}`);
+            } catch (err) {
+                warn(`Phase A failed: ${err.message}`);
+                summary.errors.push(`result_recovery: ${err.message}`);
+            }
+        }
+
+        // ══════════════════════════════════════════════
+        // PHASE B1: Stalled audio chunks watchdog
+        // ══════════════════════════════════════════════
+        try {
+            const b1Count = await checkStalledAudioScenes(redis, deps);
+            if (b1Count > 0) phases.push(`stalled_audio:${b1Count}`);
+        } catch (err) {
+            warn(`Phase B1 failed: ${err.message}`);
+            summary.errors.push(`stalled_audio: ${err.message}`);
+        }
+
+        // ══════════════════════════════════════════════
+        // PHASE B2: Stalled video groups watchdog
+        // ══════════════════════════════════════════════
+        try {
+            const b2Count = await checkStalledVideoScenes(redis, deps);
+            if (b2Count > 0) phases.push(`stalled_video:${b2Count}`);
+        } catch (err) {
+            warn(`Phase B2 failed: ${err.message}`);
+            summary.errors.push(`stalled_video: ${err.message}`);
+        }
+
+        // ══════════════════════════════════════════════
+        // PHASE C: Startup-specific (startup-recovery)
+        // ══════════════════════════════════════════════
+        if (startup) {
+            // C0: Recover Redis chunks from disk
+            if (typeof deps.recoverAllBooksFromDisk === 'function') {
+                try {
+                    await deps.recoverAllBooksFromDisk();
+                    phases.push('chunk_recovery:ok');
+                } catch (err) {
+                    warn(`Phase C0 failed: ${err.message}`);
+                    summary.errors.push(`chunk_recovery: ${err.message}`);
+                }
+            }
+
+            // C1: Audio-orch state recovery
+            try {
+                const c1Count = await recoverAudioOrchStates(redis, deps);
+                summary.itemsRecovered += c1Count;
+                phases.push(`audio_orch:${c1Count}`);
+            } catch (err) {
+                warn(`Phase C1 failed: ${err.message}`);
+                summary.errors.push(`audio_orch: ${err.message}`);
+            }
+
+            // C1b: Video-orch state recovery
+            try {
+                const c1bCount = await recoverVideoOrchStates(redis, deps);
+                summary.itemsRecovered += c1bCount;
+                phases.push(`video_orch:${c1bCount}`);
+            } catch (err) {
+                warn(`Phase C1b failed: ${err.message}`);
+                summary.errors.push(`video_orch: ${err.message}`);
+            }
+
+            // C2: Version staleness check
+            try {
+                const c2Count = await checkVersionStaleness(redis, deps);
+                if (c2Count > 0) phases.push(`version_stale:${c2Count}`);
+            } catch (err) {
+                warn(`Phase C2 failed: ${err.message}`);
+                summary.errors.push(`version_stale: ${err.message}`);
+            }
+
+            // C3 removed (S1.4): was log-only PNG scan, no state mutation.
+            // recoverIuImagesFromDisk() too expensive for every 60s cycle without value.
+
+            // C4: Reconcile missing scene counters from PG
+            try {
+                const c4Count = await reconcileMissingSceneState(redis, deps);
+                if (c4Count > 0) phases.push(`counter_reconcile:${c4Count}`);
+            } catch (err) {
+                warn(`Phase C4 failed: ${err.message}`);
+                summary.errors.push(`counter_reconcile: ${err.message}`);
+            }
+
+            // C5: Resume incomplete sessions (optional — requires runBackgroundWindowGeneration)
+            if (typeof deps.resumeIncompleteSessions === 'function' && typeof deps.runBackgroundWindowGeneration === 'function') {
+                try {
+                    await deps.resumeIncompleteSessions(log, deps.runBackgroundWindowGeneration);
+                    phases.push('session_resume');
+                } catch (err) {
+                    warn(`Phase C5 failed: ${err.message}`);
+                    summary.errors.push(`session_resume: ${err.message}`);
+                }
+            }
+        }
+
+        // ══════════════════════════════════════════════
+        // PHASE C6: Restore durable layer-config from book.json (Кирпич №2)
+        // ══════════════════════════════════════════════
+        // Сервис layer-config владеет форматом: заполняет ТОЛЬКО отсутствующие
+        // Redis-ключи из durable-копии (нормализуя значения). В норме — no-op.
+        // Запускается каждый цикл (не только startup), чтобы heal удалений
+        // ключа cleanBookRedisKeys на cache-clear / import / recovery, пока
+        // книга существует — конфиг не пропадает из Redis до рестарта.
+
+        if (!scope) {
+            // O-10: through the LayerConfigPort (host adapter:
+            // storage/layer-config-adapter). The pre-O-10 optional-load
+            // semantics are preserved EXACTLY: when the host service
+            // cannot be loaded, this phase is skipped with a warn (a
+            // missing module ≠ failed recovery). The outer try/catch
+            // wraps the PORT call — the adapter's lazy call-time
+            // resolver throws at the same point the pre-O-10 inner
+            // require did, and the caller's catch handles it
+            // identically (the pre-O-10 inner try set layerConfig to
+            // null and skipped silently; the C6 error path below is
+            // reached only when the CALL fails, same as before).
+            try {
+                const c6Count = await require('./layer-config-port').layerConfigOp('restoreFromBooks')(redis);
+                if (c6Count > 0) phases.push(`layer_config_restore:${c6Count}`);
+            } catch (err) {
+                warn(`Phase C6 failed: ${err.message}`);
+                summary.errors.push(`layer_config_restore: ${err.message}`);
+            }
+        }
+
+        // ══════════════════════════════════════════════
+        // PHASE C7: Retry pending entity purges (deleted scenes/units)
+        // ══════════════════════════════════════════════
+        // The entity-delete cleanup records a marker in the pending-purge set
+        // whenever a purge is only partially complete. Retry here keeps the
+        // "delete = gone everywhere" guarantee without hiding failures.
+        if (deps.entityCleanup && typeof deps.entityCleanup.retryPendingPurges === 'function') {
+            try {
+                const pCount = await deps.entityCleanup.retryPendingPurges();
+                if (pCount > 0) phases.push(`pending_purge:${pCount}`);
+            } catch (err) {
+                warn(`Phase C7 failed: ${err.message}`);
+                summary.errors.push(`pending_purge: ${err.message}`);
+            }
+        }
+
+        // ══════════════════════════════════════════════
+        // PHASE C8: WORK_TO_DO rebuild (Option E) — startup-only
+        // ══════════════════════════════════════════════
+        // Авто-возобновление прерванной генерации после потери Redis. Только
+        // первый цикл (startup:true) — периодический цикл работу НЕ возрождает
+        // (политика Recon #4 §10.3: без user action генерация не стартует).
+        if (startup && !scope) {
+            try {
+                const c7Count = await rebuildWorkList(redis);
+                if (c7Count > 0) phases.push(`worklist_rebuild:${c7Count}`);
+            } catch (err) {
+                warn(`Phase C8 failed: ${err.message}`);
+                summary.errors.push(`worklist_rebuild: ${err.message}`);
+            }
+        }
+
+        // ══════════════════════════════════════════════
+        // PHASE D: Full scene reconciliation
+        // ══════════════════════════════════════════════
+        if (!scope || scope.includes(':')) {
+            try {
+                const dReport = await reconcileAll(redis);
+                summary.totalScanned = dReport.orphanStates.length + dReport.orphanAssets.length;
+                phases.push(`reconcile:${dReport.inconsistentScenes.length}_issues`);
+                // Auto-fix safe issues
+                const fixes = getFixRecommendations(dReport.inconsistentScenes);
+                for (const fix of fixes.filter(f => f.safeToExecute)) {
+                    try {
+                        await applyFix(redis, fix);
+                    } catch (fixErr) {
+                        warn(`Auto-fix failed for ${fix.scene.sceneId}: ${fixErr.message}`);
+                    }
+                }
+            } catch (err) {
+                warn(`Phase D failed: ${err.message}`);
+                summary.errors.push(`reconcile: ${err.message}`);
+            }
+        }
+
+        // ── Journal: RECOVERY_COMPLETED ──
+        try {
+            await journal.appendSceneEvent(redis, '_system', '_recovery', '_cycle',
+                journal.EventType.RECOVERY_COMPLETED, 'DONE',
+                { startup, scope, phases, summary, elapsedMs: Date.now() - startTime }
+            );
+        } catch (_) {}
+
+        log(`Cycle complete [${phases.join(', ')}] in ${Date.now() - startTime}ms`);
+        return { ok: true, phases, summary };
+
+    } finally {
+        await releaseLock();
+    }
+}
+
+// ── PHASE A: Recover result/error keys ─────────────────
+// Из audio-recovery.cjs: сканирует animastor:result:* и animastor:error:*,
+// доигрывает потерянные результаты через taskHandler.handleTaskResult.
+// Для error-ключей вызывает orchestrator.failStage.
+async function recoverResultKeys(redis, deps, scope) {
+    const taskHandler = deps.taskHandler;
+    if (!taskHandler || typeof taskHandler.handleTaskResult !== 'function') return 0;
+
+    let recovered = 0;
+
+    // Отклонения dispatch-identity — терминальные для результата: dispatch
+    // уже финализирован/отменён, файл писать нельзя. Ключ удаляем, чтобы
+    // recovery не ретраил его каждые 60 сек до истечения 1-часового TTL
+    // (бывший бесконечный цикл по _g2.._g5 после no_active_dispatch).
+    const TERMINAL_REJECTIONS = new Set([
+        'no_active_dispatch',
+        'stale_dispatch',
+        'missing_dispatch_id',
+        'metadata_missing_dispatch_id',
+        'dispatch_metadata_changed',
+        'lease_token_mismatch',
+    ]);
+
+    // Scan animastor:result:*
+    let cursor = '0';
+    do {
+        const [nextCursor, keys] = await redis.scan(cursor, 'MATCH', 'animastor:result:*', 'COUNT', 200);
+        cursor = nextCursor;
+        for (const key of keys) {
+            try {
+                const raw = await redis.get(key);
+                if (!raw) continue;
+
+                let job_id, result_base64, buildId, dispatchId;
+
+                // Try JSON (new format: { job_id, result_base64, build_id })
+                if (raw.startsWith('{')) {
+                    try {
+                        const data = JSON.parse(raw);
+                        job_id = data.job_id;
+                        result_base64 = data.result_base64;
+                        buildId = data.build_id;
+                        dispatchId = data.dispatch_id;
+                    } catch (_) {
+                        await redis.del(key);
+                        continue;
+                    }
+                } else {
+                    // Data URL fallback (old format)
+                    result_base64 = raw;
+                    const keyParts = key.split(':');
+                    const buildPart = keyParts[2] || '';
+                    const combinedId = `${keyParts[3] || ''}_${keyParts[4] || ''}_${keyParts[5] || ''}`;
+                    job_id = `${combinedId}:${keyParts[6] || 'audio'}`;
+                    buildId = buildPart;
+                }
+
+                if (!job_id || !result_base64) continue;
+
+                // Scope filter
+                if (scope && !job_id.startsWith(scope)) continue;
+
+                if (!buildId || !dispatchId) {
+                    warn(`Skipping legacy result without build/dispatch identity: ${job_id}`);
+                    continue;
+                }
+                try {
+                    await taskHandler.handleTaskResult(job_id, result_base64, buildId, dispatchId);
+                } catch (rejectErr) {
+                    if (rejectErr && TERMINAL_REJECTIONS.has(rejectErr.code)) {
+                        warn(`Result ${job_id} terminally rejected (${rejectErr.code}) — dropping result key, no infinite retry`);
+                        await redis.del(key);
+                    } else {
+                        throw rejectErr;
+                    }
+                    continue;
+                }
+                await redis.del(key);
+                recovered++;
+            } catch (itemErr) {
+                warn(`Result recovery item failed: ${itemErr.message}`);
+            }
+        }
+    } while (cursor !== '0');
+
+    // Scan animastor:error:* (T3: форвард ошибок, которые не дошли до backend)
+    cursor = '0';
+    do {
+        const [nextCursor, keys] = await redis.scan(cursor, 'MATCH', 'animastor:error:*', 'COUNT', 200);
+        cursor = nextCursor;
+        for (const key of keys) {
+            try {
+                const raw = await redis.get(key);
+                if (!raw) continue;
+
+                let job_id, buildId, reason, dispatchId;
+                try {
+                    const data = JSON.parse(raw);
+                    job_id = data.job_id;
+                    buildId = data.build_id;
+                    reason = data.reason;
+                    dispatchId = data.dispatch_id;
+                } catch (_) {
+                    await redis.del(key);
+                    continue;
+                }
+
+                if (!job_id) continue;
+                if (scope && !job_id.startsWith(scope)) continue;
+
+                // Parse job_id to get stage and scene info
+                const jobSchema = require('@animastor/contracts').jobProtocolV2;
+                const parsed = jobSchema.parseJobId(job_id);
+                if (parsed) {
+                    const stageMap = { audio_chunk: 'audio', iu_image: 'image', scene_image: 'image', scene_video: 'video' };
+                    const stage = stageMap[parsed.kind];
+                    if (stage && deps.orchestrator) {
+                        await deps.orchestrator.failStage(redis, parsed.bookId, parsed.chapterId, parsed.sceneId,
+                            stage, buildId, reason || 'recovered_error', { dispatchId });
+                        recovered++;
+                    }
+                }
+                await redis.del(key);
+            } catch (itemErr) {
+                warn(`Error recovery item failed: ${itemErr.message}`);
+            }
+        }
+    } while (cursor !== '0');
+
+    return recovered;
+}
+
+// ── PHASE C1: Recover audio-orch states ────────────────
+// Из startup-recovery.js: не-терминальные фазы → FAILED,
+// MERGING → DONE если файл есть, иначе FAILED.
+async function recoverAudioOrchStates(redis, deps) {
+    // O-7: through the AudioFsmPort (host adapter: storage/audio-fsm-adapter).
+    // The pre-O-7 optional-load semantics are preserved EXACTLY: when the
+    // audio-orchestrator host service cannot be required, this recovery leg
+    // returns 0 (missing module ≠ recoverable state). The try/catch wraps
+    // the ADAPTER's lazy require — the port itself stays fail-fast.
+    let audioOrch;
+    try {
+        audioOrch = require('./audio-fsm-port').audioFsm();
+    } catch (_) {
+        return 0;
+    }
+
+    const allStates = await audioOrch.scanAllStates(redis);
+    if (allStates.length === 0) return 0;
+
+    let recovered = 0;
+    const OUTPUT_DIR = config.OUTPUT_DIR;
+
+    for (const entry of allStates) {
+        const { bookId, chapterId, sceneId, state: orchState } = entry;
+        const phase = orchState.phase;
+        const buildId = orchState.build_id || 'default';
+        const mergedPath = syncPath.join(OUTPUT_DIR, buildId, artifactNaming.sceneAudioName(bookId, chapterId, sceneId));
+
+        switch (phase) {
+            case 'GENERATING':
+            case 'WAITING_CHUNKS':
+                // ── RECOVERY: сначала проверяем, все ли чанки на диске ──
+                // Если все чанки на месте — доигрываем merge, не FAIL'им.
+                // Иначе FAILED → re-dispatch.
+                const expectedChunkCount = parseInt(orchState.expected_count || '0', 10);
+                const chunks = lazyHostBinding('media.audio.chunks');
+                const presentChunks = chunks.findExistingSceneChunks(bookId, chapterId, sceneId, buildId, expectedChunkCount > 0 ? expectedChunkCount : null);
+                if (presentChunks.length > 0) {
+                    const actualCount = expectedChunkCount > 0 ? expectedChunkCount : presentChunks.length;
+                    log(`[AUDIO-ORCH] Recover ${bookId}/${chapterId}/${sceneId}: ${phase} — ${presentChunks.length}/${actualCount} chunks on disk, driving merge`);
+                    // Восстанавливаем expected_count если он был 0
+                    if (expectedChunkCount === 0 && presentChunks.length > 0) {
+                        orchState.expected_count = presentChunks.length;
+                        await audioOrch.setState(redis, bookId, chapterId, sceneId, orchState);
+                    }
+                    try {
+                        await audioOrch.completeChunk(redis, bookId, chapterId, sceneId, 'recovery', buildId, {
+                            audio: deps.audio || lazyHostBinding('media.audio'),
+                            orchestrator: deps.orchestrator,
+                            dispatchId: 'startup-recovery',
+                        });
+                        recovered++;
+                        break;
+                    } catch (mergeErr) {
+                        warn(`[AUDIO-ORCH] Recover merge failed for ${bookId}/${chapterId}/${sceneId}: ${mergeErr.message} — falling through to FAILED`);
+                    }
+                }
+                log(`[AUDIO-ORCH] Recover ${bookId}/${chapterId}/${sceneId}: ${phase} → FAILED (${presentChunks.length}/${expectedChunkCount || '?'} chunks on disk)`);
+                await audioOrch.setFailed(redis, bookId, chapterId, sceneId, 'restart_recovery');
+                // F1: sync asset.audio → FAILED after audioOrch.setFailed (R3 follow-up)
+                await state.unsafeRestoreAssetState(redis, bookId, chapterId, sceneId, 'audio', state.AssetState.FAILED);
+                // T6: Также сбрасываем asset state, чтобы scheduler передиспатчил
+                if (deps.orchestrator) {
+                    await deps.orchestrator.markDirtyScene(redis, bookId, chapterId, sceneId, ['audio']);
+                }
+                recovered++;
+                break;
+            case 'MERGING':
+                if (syncFs.existsSync(mergedPath)) {
+                    log(`[AUDIO-ORCH] Recover ${bookId}/${chapterId}/${sceneId}: MERGING → DONE`);
+                    await audioOrch.setDone(redis, bookId, chapterId, sceneId);
+                    // R3: sync asset state after audioOrch.setDone — asset.audio → READY
+                    await state.unsafeRestoreAssetState(redis, bookId, chapterId, sceneId, 'audio', state.AssetState.READY);
+                } else {
+                    log(`[AUDIO-ORCH] Recover ${bookId}/${chapterId}/${sceneId}: MERGING → FAILED`);
+                    await audioOrch.setFailed(redis, bookId, chapterId, sceneId, 'restart_merge_missing');
+                    // F1: sync asset.audio → FAILED after audioOrch.setFailed (R3 follow-up)
+                    await state.unsafeRestoreAssetState(redis, bookId, chapterId, sceneId, 'audio', state.AssetState.FAILED);
+                    if (deps.orchestrator) {
+                        await deps.orchestrator.markDirtyScene(redis, bookId, chapterId, sceneId, ['audio']);
+                    }
+                }
+                recovered++;
+                break;
+            case 'PLACEHOLDER_READY':
+                // Leave as is, scheduler will dispatch
+                break;
+            case 'DONE':
+            case 'FAILED':
+                // Terminal, leave as is
+                break;
+            default:
+                await audioOrch.deleteState(redis, bookId, chapterId, sceneId);
+                break;
+        }
+    }
+
+    if (recovered > 0) log(`[AUDIO-ORCH] ${recovered} non-terminal states recovered`);
+    return recovered;
+}
+
+// ── PHASE C1b: Recover video-orch states ───────────────
+// Зеркало recoverAudioOrchStates: не-терминальные фазы → FAILED (re-dispatch),
+// MERGING/WAITING_CHUNKS с полным набором групп → доигрываем merge.
+async function recoverVideoOrchStates(redis, deps) {
+    // O-8: through the VideoFsmPort (host adapter: storage/video-fsm-adapter).
+    // The pre-O-8 optional-load semantics are preserved EXACTLY: when the
+    // video-orchestrator host service cannot be required, this recovery leg
+    // returns 0 (missing module ≠ recoverable state). The try/catch wraps
+    // the ADAPTER's lazy require — the port itself stays fail-fast.
+    let videoOrch;
+    try {
+        videoOrch = require('./video-fsm-port').videoFsm();
+    } catch (_) {
+        return 0;
+    }
+
+    const allStates = await videoOrch.scanAllStates(redis);
+    if (allStates.length === 0) return 0;
+
+    let recovered = 0;
+    const OUTPUT_DIR = config.OUTPUT_DIR;
+
+    for (const entry of allStates) {
+        const { bookId, chapterId, sceneId, state: orchState } = entry;
+        const phase = orchState.phase;
+        const buildId = orchState.build_id || 'default';
+        const suffixes = videoOrch.groupSuffixes(orchState);
+        const mergedPath = syncPath.join(OUTPUT_DIR, buildId, artifactNaming.sceneVideoName(bookId, chapterId, sceneId));
+
+        switch (phase) {
+            case 'GENERATING':
+            case 'WAITING_CHUNKS':
+                // ── RECOVERY: сначала проверяем, все ли группы на диске ──
+                const presentCount = suffixes.filter(s => videoOrch.isGroupFileValid(buildId, bookId, chapterId, sceneId, s)).length;
+                if (presentCount === suffixes.length && suffixes.length > 0) {
+                    log(`[VIDEO-ORCH] Recover ${bookId}/${chapterId}/${sceneId}: ${phase} — ${presentCount}/${suffixes.length} groups on disk, driving merge`);
+                    try {
+                        await videoOrch.completeGroup(redis, bookId, chapterId, sceneId, '', buildId, {
+                            orchestrator: deps.orchestrator,
+                            dispatchId: 'startup-recovery',
+                        });
+                        recovered++;
+                        break;
+                    } catch (mergeErr) {
+                        warn(`[VIDEO-ORCH] Recover merge failed for ${bookId}/${chapterId}/${sceneId}: ${mergeErr.message} — falling through to FAILED`);
+                    }
+                }
+                log(`[VIDEO-ORCH] Recover ${bookId}/${chapterId}/${sceneId}: ${phase} → FAILED (${presentCount}/${suffixes.length} groups on disk)`);
+                await videoOrch.setFailed(redis, bookId, chapterId, sceneId, 'restart_recovery');
+                // F1: sync asset.video → FAILED после videoOrch.setFailed
+                await state.unsafeRestoreAssetState(redis, bookId, chapterId, sceneId, 'video', state.AssetState.FAILED);
+                if (deps.orchestrator) {
+                    await deps.orchestrator.markDirtyScene(redis, bookId, chapterId, sceneId, ['video']);
+                }
+                recovered++;
+                break;
+            case 'MERGING':
+                if (syncFs.existsSync(mergedPath)) {
+                    log(`[VIDEO-ORCH] Recover ${bookId}/${chapterId}/${sceneId}: MERGING → DONE`);
+                    await videoOrch.setDone(redis, bookId, chapterId, sceneId);
+                    await state.unsafeRestoreAssetState(redis, bookId, chapterId, sceneId, 'video', state.AssetState.READY);
+                } else {
+                    log(`[VIDEO-ORCH] Recover ${bookId}/${chapterId}/${sceneId}: MERGING → FAILED`);
+                    await videoOrch.setFailed(redis, bookId, chapterId, sceneId, 'restart_merge_missing');
+                    await state.unsafeRestoreAssetState(redis, bookId, chapterId, sceneId, 'video', state.AssetState.FAILED);
+                    if (deps.orchestrator) {
+                        await deps.orchestrator.markDirtyScene(redis, bookId, chapterId, sceneId, ['video']);
+                    }
+                }
+                recovered++;
+                break;
+            case 'DONE':
+            case 'FAILED':
+                // Terminal — leave as is
+                break;
+            default:
+                await videoOrch.deleteState(redis, bookId, chapterId, sceneId);
+                break;
+        }
+    }
+
+    if (recovered > 0) log(`[VIDEO-ORCH] ${recovered} non-terminal states recovered`);
+    return recovered;
+}
+
+// ── PHASE C2: Version staleness check ───────────────────
+// Из startup-recovery.js: для stale-ассетов → markDirtyScene
+// O-2: the raw deps.postgres handle is GONE — the book-wide version scan is
+// the sceneVersions.getVersionStalenessRows() port op (SQL lives in the host
+// adapter verbatim). Pre-O-2 a missing deps.postgres skipped the phase; the
+// unwired-port throw hits the same catch → warn + return 0.
+async function checkVersionStaleness(redis, deps) {
+    const { orchestrator } = deps;
+    if (!orchestrator) return 0;
+
+    try {
+        const result = { rows: await persist('sceneVersions.getVersionStalenessRows')() };
+
+        const sceneMap = new Map();
+        for (const row of result.rows) {
+            const key = `${row.book_id}|${row.chapter_id}|${row.scene_id}`;
+            if (!sceneMap.has(key)) {
+                sceneMap.set(key, { bookId: row.book_id, chapterId: row.chapter_id, sceneId: row.scene_id, stale: false });
+            }
+            const entry = sceneMap.get(key);
+            if ((row.scene_content_version != null && row.content_version != null && row.scene_content_version < row.content_version) ||
+                (row.scene_audio_config_version != null && row.audio_config_version != null && row.scene_audio_config_version < row.audio_config_version)) {
+                entry.stale = true;
+            }
+        }
+
+        let outdated = 0;
+        for (const entry of sceneMap.values()) {
+            if (entry.stale) {
+                log(`[VERSION-STALE] ${entry.bookId}/${entry.chapterId}/${entry.sceneId}`);
+                await orchestrator.markDirtyScene(redis, entry.bookId, entry.chapterId, entry.sceneId);
+                outdated++;
+            }
+        }
+        return outdated;
+    } catch (err) {
+        warn(`Version staleness check failed: ${err.message}`);
+        return 0;
+    }
+}
+
+// ── PHASE C3: REMOVED in S1.4 (2026-07-19) ─────────────
+// Был log-only PNG scan, сканировал всю OUTPUT_DIR по 60s. Не мутировал состояние,
+// только логировал счётчик сцен с IU images. Полная walks FS без пользы для reconcile.
+// Аналогичная функция recoverIuImagesFromDisk осталась в services/startup-recovery.js
+// (вызывается явно, не на каждый reconcile-цикл).
+
+// ── PHASE C4: Reconcile missing scene counters from PG ─
+// Из startup-recovery.js: логирует книги с PG записями без Redis-счётчиков.
+// O-2: the raw deps.postgres handle is GONE — the DISTINCT book scan is the
+// same listBooks() port op the worklist rebuild uses (identical SQL, host
+// adapter). Unwired port → throw → catch → return 0 (pre-O-2: no
+// deps.postgres → return 0).
+async function reconcileMissingSceneState(redis, deps) {
+    try {
+        const bookResult = { rows: await persist('listBooks')() };
+        let count = 0;
+        for (const row of bookResult.rows) {
+            const totalKey = `animastor:book-scenes:${row.book_id}:total`;
+            const totalRaw = await redis.get(totalKey);
+            if (!totalRaw || parseInt(totalRaw, 10) === 0) {
+                log(`[COUNTER-LOG-ONLY] Book ${row.book_id} has PG records but no Redis counters`);
+                count++;
+            }
+        }
+        return count;
+    } catch (err) {
+        warn(`Missing scene state check failed: ${err.message}`);
+        return 0;
+    }
+}
+
+// ── PHASE C7: WORK_TO_DO rebuild (Option E) ──────────
+// Cathedral Option E — см. docs/architecture/work-list-rebuild-design.md
+// (Recon #4 design proof). После полной потери Redis пересчитывает WORK_TO_DO
+// из PG + FS и МАТЕРИАЛИЗУЕТ runtime-состояние: per-asset Redis states + SADD
+// в active index. Генерацию НЕ запускает — это делает обычный scheduler tick
+// (единственный владелец execution, SCHEDULER_TICK_LOCK).
+//
+// Доказанные в Recon #4 инварианты:
+//  1. Предикат НЕ читает Redis asset state (C0 over-marks READY/READY/READY
+//     для любой сцены с .mp3) — только PG + FS-проба.
+//  2. States пишутся ДО SADD: scheduler решает «что диспатчить» по Redis
+//     states (shouldScheduleAssets), пустой ключ = NEW = «диспатчить всё».
+//  3. build_id пинится из manifest.book_id — та же формула, что в attemptDispatch.
+//  4. Книги с cancellation tombstone (Operation #1) пропускаются fail-closed.
+//  5. Фаза последняя среди state-write C-фаз и идёт ПОСЛЕ C6 (layer-config
+//     восстановлен — нужен для enabled-слоёв).
+//  6. Ошибки PG — fail-closed: без PG предикат невычислим, фаза прерывается
+//     (нельзя воскресить отменённую работу или потерять dirty-маркеры).
+async function rebuildWorkList(redis) {
+    // Все зависимости — lazy require на момент вызова, чтобы фаза была
+    // самодостаточной (не зависит от того, с какими зависимостями был
+    // загружен reconciliation-engine) и чтобы unit-тесты не могли подменить
+    // storage/state через require.cache.
+
+// §32.30: former host requires resolve lazily through the host-bindings seam.
+const state = lazyHostBinding('state');
+    // O-3: scene content via the SceneDataPort (host adapter:
+    // storage/scene-data-adapter) — the Book Model facade require left this
+    // function. loadBook/collectScenes consumed as `sceneData(op)(...)`.
+    const sceneData = require('./scene-data-port').sceneDataOp;
+    // O-2: PG persistence (scene-assets + cancel tombstone + the two raw
+    // barrel queries) via the PersistencePort; the storage barrel require
+    // left this function.
+    const persist = require('./persistence-port').persist;
+    // O-10: per-book layer config arrives ONLY through the LayerConfigPort
+    // (host adapter: storage/layer-config-adapter) — the layer-config host
+    // service (../services/layer-config) left this function.
+    const layerConfigOp = require('./layer-config-port').layerConfigOp;
+    // O-4: placeholder audio arrives ONLY through the PlaceholderAudioPort
+    // (host adapter: storage/placeholder-audio-adapter) — the ffmpeg/fs
+    // host service left this function.
+    const placeholderAudioOp = require('./placeholder-audio-port').placeholderAudioOp;
+    const sceneWindow = require('./scene-window');
+    const runtimeScheduler = require('./runtime-scheduler');
+    // S-5: asset-state writers via the injected orchestration seams
+    const markDirtyScene = orchestrationSeams.getOrchestrationSeam('markDirtyScene');
+    const setScenePending = orchestrationSeams.getOrchestrationSeam('setScenePending');
+
+    const AssetState = state.AssetState;
+    const STAGES = mediaRegistry.listMediaTypes();
+
+    // 0. Fail-closed: книги с cancellation tombstone (Operation #1)
+    const cancelled = new Set();
+    const cancelRows = await persist('cancel.getAllCancelled')();
+    for (const r of cancelRows) cancelled.add(r.book_id);
+
+    // 1. Книги с историей генерации — из PG (у книги без PG-строк нет работы)
+    // O-2: the raw barrel query moved verbatim to the host adapter
+    // (storage/runtime-persistence-adapter.listBooks).
+    const books = (await persist('listBooks')()).map(r => r.book_id);
+
+    let scenesAdded = 0;
+    for (const bookId of books) {
+        if (cancelled.has(bookId)) {
+            log(`[WORKLIST] ${bookId}: skipped (cancellation tombstone)`);
+            continue;
+        }
+
+        try {
+            const loadedBook = sceneData('loadBook')(bookId);
+            if (!loadedBook) {
+                log(`[WORKLIST] ${bookId}: no book.json on disk — skipped`);
+                continue;
+            }
+
+            const buildId = loadedBook?.manifest?.build_id || 'default';
+            const buildDir = syncPath.join(config.OUTPUT_DIR, buildId);
+            const layerCfg = await layerConfigOp('get')(redis, bookId);
+            const enabled = Object.fromEntries(
+                mediaRegistry.listMediaTypes().map(t => [t, layerCfg[t + '_enabled'] !== false])
+            );
+
+            // 2. Dirty-маркеры из PG (audit gap 2): каждый marker РЕАЛЬНО влияет
+            // на WORK_TO_DO. Раньше dirtyScenes собирался, но не использовался —
+            // dirty_unit_ids и per-asset статусы (stale/failed/pending) теряли
+            // regeneration intent. Теперь:
+            //   - staleAssets: ready-строка с version mismatch → PENDING (как раньше)
+            //   - dirtyStages: scene_assets.status IN (stale,failed,pending) → PENDING
+            //     даже при валидном файле на диске (leftover от прошлого билда)
+            //   - unitDirtyScenes: dirty_unit_ids → image PENDING (force-regen юнитов)
+            const staleAssets = {};        // "ch:sc:asset" → ready, но version mismatch
+            const dirtyStages = {};        // "ch:sc:asset" → status IN (stale,failed,pending)
+            const unitDirtyScenes = new Set(); // "ch:sc" → dirty_unit_ids (image force-regen)
+            const dirtyRows = await persist('sceneAssets.getDirtyScenesByVersion')(bookId);
+            for (const row of dirtyRows) {
+                const contentStale = row.scene_content_version != null && row.content_version != null &&
+                    row.scene_content_version < row.content_version;
+                const audioCfgStale = row.scene_audio_config_version != null && row.audio_config_version != null &&
+                    row.scene_audio_config_version < row.audio_config_version;
+                if (row.status === 'ready' &&
+                    (contentStale || (row.asset_type === 'audio' && audioCfgStale))) {
+                    staleAssets[`${row.chapter_id}:${row.scene_id}:${row.asset_type}`] = true;
+                }
+            }
+
+            // 2b. dirty_unit_ids (granular force-regen) → image; per-asset статусы
+            // (stale/failed/pending) → PENDING. asset_type обязателен, чтобы
+            // знать, КАКАЯ стадия грязная (раньше терялся).
+            // O-2: dirty-marker reads via the PersistencePort. Pre-O-2 these
+            // were two raw barrel queries — the SQL moved verbatim into the
+            // host adapter op `sceneAssets.getDirtyMarkers(bookId)` which
+            // returns { unitScenes, assetStages } in the same row shapes.
+            const markers = await persist('sceneAssets.getDirtyMarkers')(bookId);
+            for (const row of markers.unitScenes) unitDirtyScenes.add(`${row.chapter_id}:${row.scene_id}`);
+            for (const row of markers.assetStages) dirtyStages[`${row.chapter_id}:${row.scene_id}:${row.asset_type}`] = true;
+
+            // 3. Пройти все сцены книги: FS-проба + предикат §4 (Recon #3)
+            const scenes = sceneData('collectScenes')(loadedBook);
+            for (const s of scenes) {
+                const chapterId = s.chapter_id;
+                const sceneId = s.scene_id;
+                const key = `${chapterId}:${sceneId}`;
+
+                const fsStatus = await sceneWindow.getSceneFilesStatus(buildDir, bookId, chapterId, sceneId);
+                let audioReal = false;
+                if (fsStatus.audio.exists) {
+                    try { audioReal = await placeholderAudioOp('hasRealAudio')(bookId, chapterId, sceneId, buildId); }
+                    catch (err) { warn(`Rebuild: hasRealAudio probe failed for ${bookId}/${chapterId}/${sceneId}: ${err.message}`); }
+                }
+
+                const stateMap = {};
+                let needsWork = false;
+                for (const stage of STAGES) {
+                    if (!enabled[stage]) continue; // disabled: PENDING не пишем (isInFlight-override в shouldScheduleAssets)
+                    const fileValid = fsStatus[stage].exists && (stage !== 'audio' || audioReal);
+                    const stale = !!staleAssets[`${key}:${stage}`];
+                    const dirty = !!dirtyStages[`${key}:${stage}`];
+                    const unitDirty = stage === 'image' && unitDirtyScenes.has(key);
+                    if (fileValid && !stale && !dirty && !unitDirty) {
+                        stateMap[stage] = AssetState.READY;
+                    } else {
+                        stateMap[stage] = AssetState.PENDING;
+                        needsWork = true;
+                    }
+                }
+
+                if (!needsWork) continue;
+
+                // 4. Материализовать states ДО SADD — через SAFE facade (audit gap 1).
+                // Нельзя downgrade-ить выполняющуюся генерацию:
+                //   GENERATING/PENDING/PLACEHOLDER → НЕ трогаем (in-flight/очередь
+                //   владеют стадией; recovery не имеет права их откатывать).
+                //   PENDING-таргеты → orchestrator.setScenePending (валидация переходов:
+                //   GENERATING→PENDING rejected самой таблицей переходов).
+                //   READY-таргеты → guarded restore-fact write (S2.4): только из
+                //   NEW/DIRTY/FAILED/READY, никогда поверх GENERATING/PENDING.
+                //   C0 over-mark (READY без файла) → READY→DIRTY (markDirtyScene) →
+                //   →PENDING (setScenePending) — self-heal P1 через валидные переходы.
+                const currentStates = await state.getAssetStates(redis, bookId, chapterId, sceneId);
+                for (const [stage, target] of Object.entries(stateMap)) {
+                    const current = currentStates[stage] || state.AssetState.NEW;
+                    // GENERATING/PENDING — выполняющаяся/очередная генерация:
+                    // recovery не имеет права downgrade-ить её (audit gap 1).
+                    if (current === state.AssetState.GENERATING ||
+                        current === state.AssetState.PENDING) {
+                        log(`[WORKLIST] ${bookId}/${chapterId}/${sceneId} ${stage}: ${current} — untouched by recovery (in-flight/queued)`);
+                        continue;
+                    }
+                    if (target === state.AssetState.PENDING) {
+                        if (current === state.AssetState.READY || current === state.AssetState.PLACEHOLDER) {
+                            // C0 over-mark (P1, READY без файла) / placeholder-аудио:
+                            // прямой READY→PENDING / PLACEHOLDER→PENDING невалиден;
+                            // READY→DIRTY / PLACEHOLDER→DIRTY валиден → затем DIRTY→PENDING.
+                            // TOCTOU-guard (audit follow-up): scheduler tick работает
+                            // конкурентно (runtime-loop стартует ДО startup-цикла),
+                            // markVersionStaleDirty → dispatch может успеть выставить
+                            // GENERATING между нашим guard-read и markDirtyScene (который
+                            // пишет DIRTY через unsafe без re-validation). Re-read прямо
+                            // перед записью: если состояние изменилось — стадией уже
+                            // владеет кто-то другой, recovery отступает. setScenePending
+                            // ниже сам re-reads + validates (вторая линия обороны).
+                            const fresh = (await state.getAssetStates(redis, bookId, chapterId, sceneId))[stage] || state.AssetState.NEW;
+                            if (fresh !== current) {
+                                log(`[WORKLIST] ${bookId}/${chapterId}/${sceneId} ${stage}: state changed ${current}→${fresh} during rebuild — untouched (owner present)`);
+                                continue;
+                            }
+                            log(`[WORKLIST] ${bookId}/${chapterId}/${sceneId} ${stage}: ${current} → DIRTY → PENDING (valid transitions)`);
+                            await markDirtyScene(redis, bookId, chapterId, sceneId, [stage]);
+                            await setScenePending(redis, bookId, chapterId, sceneId, stage);
+                        } else {
+                            // NEW/DIRTY/FAILED → PENDING — валидные переходы.
+                            await setScenePending(redis, bookId, chapterId, sceneId, stage);
+                        }
+                    } else {
+                        // target === READY — restore-fact (файл валиден на диске):
+                        // guarded unsafe write, S2.4 (restore path). Пропускаются
+                        // GENERATING/PENDING (см. guard выше); из остальных состояний
+                        // (NEW/DIRTY/FAILED/PLACEHOLDER/READY) восстановить READY
+                        // безопасно — файл доказан FS-пробой.
+                        if (current !== state.AssetState.READY) {
+                            await state.unsafeRestoreAssetState(redis, bookId, chapterId, sceneId, stage, state.AssetState.READY);
+                        }
+                    }
+                }
+                await runtimeScheduler.addSceneToActiveIndex(redis, bookId, chapterId, sceneId);
+                scenesAdded++;
+            }
+        } catch (err) {
+            warn(`Rebuild failed for book ${bookId}: ${err.message}`);
+        }
+    }
+
+    if (scenesAdded > 0) log(`[WORKLIST] ${scenesAdded} scene(s) re-added for generation resume`);
+    return scenesAdded;
+}
+
+// ======================================================
+// EXPORTS
+// ======================================================
+
+module.exports = {
+    reconcileScene,
+    reconcileBook,
+    reconcileAll,
+    reconcileCycle,
+    recoverResultKeys,
+    recoverAudioOrchStates,
+    recoverVideoOrchStates,
+    checkVersionStaleness,
+    reconcileMissingSceneState,
+    rebuildWorkList,
+    checkStalledAudioScenes,
+    checkStalledVideoScenes,
+
+    checkAudioOrchInvariants,
+    checkVideoOrchInvariants,
+
+    checkOrphanVideoState,
+    checkOrphanImageState,
+    checkOrphanAudioState,
+    checkOrphanAssets,
+    checkOrphanGeneratingState,
+    checkPartialBuilds,
+    checkStaleLocks,
+    checkStaleDispatchLeases,
+
+    isBookGenerationCancelled,
+    resolveBookBuildId,
+
+    getFixRecommendations,
+    applyFix,
+    getMetrics,
+    ReconciliationReport
+};