@ossclip/core 0.1.24 → 0.1.26

package/assets/fonts/OFL.txt

@@ -0,0 +1,93 @@
+Copyright 2022 The Noto Project Authors (https://github.com/notofonts/nastaliq)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+https://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

package/assets/fonts/README.md

@@ -0,0 +1,15 @@
+# Bundled fonts
+
+## NotoNastaliqUrdu-Bold.ttf
+
+Noto Nastaliq Urdu Bold, from the notofonts/nastaliq **v3.007** GitHub
+release (`googlefonts/ttf/NotoNastaliqUrdu-Bold.ttf`), © 2022 The Noto
+Project Authors — licensed under the SIL Open Font License 1.1 (`OFL.txt`
+beside this file). The OFL permits bundling and redistribution with the
+license text included, which is why the license ships in this directory.
+
+Why it is bundled at all: caption rendering must be deterministic across
+machines, and a Linux CI box (or a fresh Windows install) has no Nastaliq
+face — Urdu captions there fell back to whatever Arabic-script font the OS
+had, or to tofu. Only the Bold face ships because captions render at
+`fontWeight: 900` and one face keeps the package small (~616 KB).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ossclip/core",
-  "version": "0.1.24",
+  "version": "0.1.26",
   "description": "ossclip's framework-free pipeline: schema, transcription, analysis, cutlist, captions, framing, and the LLM producer",
   "type": "module",
   "license": "MIT",
@@ -20,6 +20,7 @@
   ],
   "dependencies": {
     "@anthropic-ai/sdk": "^0.115.0",
+    "@google/genai": "^2.17.1",
     "zod": "^3.25.0"
   },
   "homepage": "https://github.com/AhsanAyaz/ossclip#readme",

package/src/blooper.ts

@@ -1,7 +1,7 @@
 import { normalizeToken } from "./analyze";
 import { isSentenceStart } from "./clip";
 import { levenshtein } from "./phonetics";
-import type { Transcript } from "./schema";
+import type { Span, Transcript } from "./schema";
 
 /**
  * Blooper removal by SPOKEN MARKER (R27 §122).
@@ -55,8 +55,40 @@ export interface BloopSpan {
    * silently cutting a good take (Task 3, editor-dogfood-fixes plan).
    */
   matched: string[];
+  /**
+   * True when the sentence-start backscan hit MAX_WALKBACK_SEC before it
+   * found punctuation — the span was cut short of a real sentence boundary
+   * and the report must say so out loud (`formatBloopSpan`).
+   */
+  truncated?: boolean;
 }
 
+/**
+ * How far past the marker word's STAMPED end a silence may start and still be
+ * treated as the marker's own trailing dead air. Whisper's `-ml 1` stamps
+ * stretch over pauses (§18, PHASE1-FINDINGS.md), so the stamped end of a
+ * spoken marker routinely lands BEFORE its acoustic end — the 2026-08-16
+ * incident: "blooper." stamped to end at 670.0 while the audio ran to ~670.4
+ * (proven by the bracketing silences 668.09–669.3 and 670.4–671.68), so 0.4s
+ * of audible "blooper" leaked into the output at ~10:02. Extending the cut
+ * through any silence starting within this window swallows the acoustic tail
+ * — and the debris sliver ("And", 670.0–670.4) whisper stamped between the
+ * marker and the pause. 0.75s is deliberately wider than the observed 0.4s
+ * stretch but well under the shortest gap a speaker leaves before a real
+ * next take.
+ */
+const MAX_MARKER_BLEED_SEC = 0.75;
+
+/**
+ * Ceiling on the sentence-start backscan, in source seconds. An ASR stretch
+ * with no terminal punctuation (rambling delivery, a non-English fine-tune,
+ * a hallucinated run-on) lets the scan walk back through MINUTES of good
+ * take from one spoken marker — the same failure shape as §133's 7.08s fuzzy
+ * cut, unbounded. 30s is longer than any real single-sentence flub and short
+ * enough that a capped cut is reviewable in the report.
+ */
+const MAX_WALKBACK_SEC = 30;
+
 // Fuzzy matching only turns on once the marker is long enough that a false
 // positive is unlikely — a short marker like "cut" sound-alikes ("cat") and
 // sits within edit distance 2 of half the dictionary ("but", "gut", "cot"),
@@ -120,9 +152,18 @@ function isPluralPair(a: string, b: string): boolean {
  * marker of at least `FUZZY_MIN_MARKER_LEN` characters also matches an ASR
  * mishearing — see `matchMarker`.
  *
+ * `silences` (source seconds, `analysis.silences`' shape) lets a span's end
+ * extend through the marker's own trailing dead air — the §18 stamp-stretch
+ * bleed `MAX_MARKER_BLEED_SEC` documents. Omitting it reproduces the
+ * stamped-end behavior exactly.
+ *
  * Returns spans in transcript order, non-overlapping.
  */
-export function findBloopSpans(transcript: Transcript, marker: string): BloopSpan[] {
+export function findBloopSpans(
+  transcript: Transcript,
+  marker: string,
+  silences?: readonly Span[],
+): BloopSpan[] {
   const want = normalizeToken(marker);
   if (!want) return [];
   const words = transcript.words;
@@ -138,31 +179,67 @@ export function findBloopSpans(transcript: Transcript, marker: string): BloopSpa
 
     // Walk back over the attempt this marker spoiled, to the start of its
     // sentence. The marker's own text usually ENDS a sentence ("blooper."), so
-    // the scan starts at the word before it.
+    // the scan starts at the word before it. Capped at MAX_WALKBACK_SEC of
+    // source time (rationale on the constant); a capped span is flagged so
+    // the report can shout about it.
     let start = i;
-    while (start > 0 && !isSentenceStart(transcript, start)) start--;
+    let truncated = false;
+    while (start > 0 && !isSentenceStart(transcript, start)) {
+      if (words[i]!.end - words[start - 1]!.start > MAX_WALKBACK_SEC) {
+        truncated = true;
+        break;
+      }
+      start--;
+    }
+
+    // Extend the end through the marker's trailing dead air (2026-08-16
+    // incident, see MAX_MARKER_BLEED_SEC): repeatedly absorb any silence that
+    // starts within the bleed window and ends past the current end. The loop
+    // re-scans because absorbing one silence can bring the next within reach
+    // — the chained-silence shape.
+    let endSec = words[i]!.end;
+    if (silences && silences.length > 0) {
+      let extended = true;
+      while (extended) {
+        extended = false;
+        for (const s of silences) {
+          if (s.start <= endSec + MAX_MARKER_BLEED_SEC && s.end > endSec) {
+            endSec = s.end;
+            extended = true;
+          }
+        }
+      }
+    }
 
     // Consecutive attempts: if everything between the previous span's end and
     // this attempt's start is already being dropped, merge rather than leave a
-    // one-word island of a sentence nobody finished.
+    // one-word island of a sentence nobody finished. The seconds arm exists
+    // because the previous span's EXTENDED end can reach past word stamps the
+    // index arm never sees — the incident's "And" debris sat between two
+    // attempts that were not word-index adjacent once the first end grew.
     const prev = spans[spans.length - 1];
     let markers = 1;
     let matched = match.exact ? [] : [match.surface];
-    if (prev && start <= prev.endWord + 1) {
+    if (prev && (start <= prev.endWord + 1 || words[start]!.start <= prev.endSec)) {
       spans.pop();
       start = prev.startWord;
       markers = prev.markers + 1;
       matched = [...prev.matched, ...matched];
+      truncated = truncated || prev.truncated === true;
+      // A merged span must never shrink: the previous extension already
+      // proved that audio dead.
+      endSec = Math.max(endSec, prev.endSec);
     }
 
     spans.push({
       startWord: start,
       endWord: i,
       startSec: words[start]!.start,
-      endSec: words[i]!.end,
+      endSec,
       markers,
       marker: want,
       matched,
+      ...(truncated ? { truncated: true } : {}),
     });
   }
   return spans;
@@ -187,5 +264,11 @@ export function formatBloopSpan(transcript: Transcript, span: BloopSpan): string
     span.matched.length > 0
       ? " " + span.matched.map((m) => `matched "${m}" ~ "${span.marker}"`).join(", ")
       : "";
-  return `"${said}"${attempts}${fuzzy}`;
+  // A capped walk-back is a cut whose start the code chose by fiat, not by
+  // punctuation — the one case where the span boundary is a guess, so the
+  // report line must be loud about it.
+  const capped = span.truncated
+    ? " (walk-back capped at 30s — unpunctuated stretch; check this cut)"
+    : "";
+  return `"${said}"${attempts}${fuzzy}${capped}`;
 }

package/src/browser.ts

@@ -18,6 +18,7 @@ export {
   cropFilter,
   type ContentRect,
   type ContentRectSegment,
+  type FramingSegment,
 } from "./content-rect";
 // lineDirection is a VALUE export but stays browser-safe: captions.ts
 // imports types only. CaptionTrack needs it at render time (Urdu field test
@@ -27,9 +28,16 @@ export {
 // a caption key from it (§137), and the editor imports this surface. Pure, and
 // captions.ts stays browser-safe — it imports types plus timemap, which is
 // itself type-only against ./schema.
+// The Nastaliq trio rides the same browser-safe surface: CaptionTrack needs
+// the family name + served path for its @font-face, and `captionsNeedNastaliq`
+// is the ONE predicate produce and the render share for "does this caption
+// set need the bundled font" (2026-08-17 — two conditions would drift).
 export {
   backfillSrcStart,
+  captionsNeedNastaliq,
   lineDirection,
+  NASTALIQ_FONT_NAME,
+  NASTALIQ_FONT_REL,
   type CaptionLine,
   type CaptionWord,
 } from "./captions";

package/src/captions.ts

@@ -92,6 +92,31 @@ export function lineDirection(text: string): "rtl" | "ltr" {
   return "ltr";
 }
 
+/**
+ * The bundled Nastaliq face (Urdu captions, 2026-08-17): rendering must not
+ * depend on the render machine having an Arabic-script font — a Linux CI box
+ * has none, and macOS/Windows each substitute a DIFFERENT one, so the same
+ * render-props drew three different caption sets. The family name is what
+ * the render-side @font-face registers; the REL path is the served URL under
+ * the render's public dir, POSIX-literal like `sideImageDestRel` (produce.ts:
+ * `staticFile()` splits only on `/`, so `path.join` would break every
+ * Windows render of it).
+ */
+export const NASTALIQ_FONT_NAME = "Noto Nastaliq Urdu";
+export const NASTALIQ_FONT_REL = "fonts/NotoNastaliqUrdu-Bold.ttf";
+
+/**
+ * Whether this caption set needs the bundled Nastaliq face at all — some
+ * line lays out RTL. ONE predicate shared by produce (copies the font into
+ * the public dir) and CaptionTrack (injects the @font-face): if the two
+ * sides tested different conditions, one could fetch a file the other never
+ * wrote. Pure-Latin runs — the overwhelmingly common case — copy nothing and
+ * fetch nothing, so their renders stay byte-identical.
+ */
+export function captionsNeedNastaliq(lines: readonly CaptionLine[]): boolean {
+  return lines.some((l) => lineDirection(l.words.map((w) => w.text).join(" ")) === "rtl");
+}
+
 export interface CaptionOptions {
   maxWordsPerLine?: number;
   maxLineDuration?: number;
@@ -109,6 +134,18 @@ export interface CaptionOptions {
   breakpoints?: number[];
 }
 
+/**
+ * No spoken word takes this long; a stamped interval longer than it is the
+ * §18 contiguous-stamp stretch (`parseWhisperJson` clamps
+ * `next.start = w.end`, so non-speech audio is smeared into the next word's
+ * START — field case 2026-08-17: 21s of played-back video audio put "Okay,"
+ * on screen 21 seconds early). The END stamp is the trustworthy edge — clamp
+ * the start toward it. Display-only: cuts, analysis and the transcript
+ * itself never see this, and `srcStart` keeps the RAW source stamp so the
+ * §137 edit anchor does not move.
+ */
+export const MAX_CAPTION_WORD_LEAD_SEC = 2;
+
 export function buildCaptionLines(
   transcript: Transcript,
   map: TimeMap,
@@ -124,8 +161,14 @@ export function buildCaptionLines(
   for (const w of transcript.words) {
     const m = map.mapWord(w as Word);
     // `w.start` is source time, `m.start` output — both are needed, and only
-    // the source one is stable across a re-cut (§137).
-    if (m) mapped.push({ text: w.text, start: m.start, end: m.end, srcStart: w.start });
+    // the source one is stable across a re-cut (§137). The display start is
+    // clamped toward the end stamp (MAX_CAPTION_WORD_LEAD_SEC above); the
+    // clamped gap to the previous word then exceeds `maxGap`, so the packer
+    // naturally breaks the line and nothing renders during the dead span.
+    if (m) {
+      const start = Math.max(m.start, m.end - MAX_CAPTION_WORD_LEAD_SEC);
+      mapped.push({ text: w.text, start, end: m.end, srcStart: w.start });
+    }
   }
 
   const lines: CaptionLine[] = [];

package/src/concat.ts

@@ -1,6 +1,6 @@
 import { existsSync } from "node:fs";
 import { readdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
-import { join } from "node:path";
+import { isAbsolute, join, relative, resolve } from "node:path";
 import { z } from "zod/v4";
 import { probe, type IngestTools } from "./ingest";
 import { run } from "./exec";
@@ -42,6 +42,78 @@ export interface ConcatEntry {
   size: number;
 }
 
+/**
+ * Whether a produce output path lands INSIDE the folder being produced.
+ * 2026-08-18 field cascade: a folder input's clips are re-enumerated on
+ * EVERY run, so an `--out` written into that folder became a 7th "source
+ * clip" on the next run — the folder-content hash changed, produce minted a
+ * fresh workdir with EMPTY overrides, and the render silently dropped the
+ * user's saved edits while the output's duration doubled. It cascaded three
+ * times before the doubling duration was connected to the out path.
+ *
+ * Containment via `path.relative`, the same idiom as edit.ts's `isInside`:
+ * a `startsWith` string-prefix test has no separator boundary and is fooled
+ * by a sibling folder that merely shares a prefix (`/a/Clips` vs
+ * `/a/Clips-old/out.mp4`) — `child` is inside `parent` iff the relative path
+ * from one to the other never has to climb out with `..`. Both arguments are
+ * resolved here so a relative path is judged against cwd; `~` expansion is
+ * the CALLER's job (the 2026-08-16 rule in the CLI's paths.ts — expandHome
+ * at the call site — which also keeps core homedir-free).
+ */
+export function outPathInsideInput(outPath: string, inputDir: string): boolean {
+  const rel = relative(resolve(inputDir), resolve(outPath));
+  return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
+}
+
+/**
+ * The refusal for `outPathInsideInput`, shared verbatim by produce's own
+ * gate and the edit server's `/api/render` 400 — one message, one place, so
+ * the two boundaries can never describe the same hazard differently. Names
+ * the actual risk (the field cascade above) rather than just "invalid path",
+ * and suggests the exact default a flag-less run would pick (produce's
+ * `defaultOutPath` shape: at most the LAST dot-segment replaced).
+ */
+/**
+ * The default output path for an input: beside it, `.ossclip.mp4` suffix.
+ * Trailing separators are stripped FIRST (2026-08-18 field case, second
+ * report): shells tab-complete folders with the slash, and the bare regex
+ * appended after it — the "default" landed INSIDE the folder as a hidden
+ * `.ossclip.mp4` dotfile, the exact self-ingesting shape
+ * `outPathInsideInput` exists to refuse. One definition shared by produce's
+ * `defaultOutPath` and the refusal message below, so the suggestion can
+ * never disagree with what omitting `--out` actually does.
+ */
+export function ossclipOutputPathFor(input: string): string {
+  return input.replace(/[/\\]+$/, "").replace(/(\.[^.]+)?$/, ".ossclip.mp4");
+}
+
+export function outInsideInputFolderMessage(folder: string): string {
+  const suggestion = ossclipOutputPathFor(folder);
+  return (
+    `refusing to write the output inside the input folder ${folder} — the next ` +
+    `run would ingest this output as a source clip and re-plan from scratch, ` +
+    `abandoning your edits (the folder's content hash changes, so produce mints ` +
+    `a fresh workdir with empty overrides). Write it beside the folder instead, ` +
+    `e.g. --out ${suggestion}`
+  );
+}
+
+/**
+ * Defense-in-depth BEHIND the out-path refusal above (same 2026-08-18 field
+ * cascade): a produce output already sitting in the folder — written by a
+ * pre-fix run, or moved there by hand — must never be ingested as a source
+ * clip, and must be filtered BEFORE `folderManifestKey` sees the entries so
+ * its presence can't re-key the workdir either. Matches any name carrying
+ * the `.ossclip` marker: `X.ossclip.mp4`, `X.ossclip_fixed.mp4`, and
+ * `X.ossclip.mp4.partial.mp4` leftovers all qualify (bare `.ossclip.mp4` is
+ * a dotfile and already skipped upstream). A custom-named output
+ * (`--out final.mp4`) is undetectable here — the out-path refusal is the
+ * real gate; this only keeps a pre-fix folder from compounding further.
+ */
+export function isOssclipOutputName(name: string): boolean {
+  return name.includes(".ossclip");
+}
+
 /**
  * Order clips for concatenation. `name` (default, per the field request "sort
  * them by name or date modified, name being default") is a PLAIN codepoint
@@ -321,6 +393,8 @@ export interface FolderListing {
   entries: ConcatEntry[];
   /** Files skipped for not matching a video extension (dotfiles excluded). */
   nonVideoCount: number;
+  /** Video files skipped as produce's own outputs (`isOssclipOutputName`). */
+  ossclipOutputCount: number;
 }
 
 /**
@@ -339,6 +413,7 @@ export interface FolderListing {
 export async function listFolderVideos(folder: string): Promise<FolderListing> {
   const dirents = await readdir(folder, { withFileTypes: true });
   let nonVideoCount = 0;
+  let ossclipOutputCount = 0;
   const entries: ConcatEntry[] = [];
   for (const d of dirents) {
     if (d.name.startsWith(".")) continue;
@@ -357,11 +432,19 @@ export async function listFolderVideos(folder: string): Promise<FolderListing> {
       nonVideoCount++;
       continue;
     }
+    // Skipped HERE, before the entries ever exist — never in concatFolder —
+    // so an ossclip output left in the folder can neither become a source
+    // clip nor perturb the workdir hash `folderManifestKey` derives from
+    // this listing (2026-08-18 field cascade, see isOssclipOutputName).
+    if (isOssclipOutputName(d.name)) {
+      ossclipOutputCount++;
+      continue;
+    }
     const st = await stat(join(folder, d.name));
     entries.push({ name: d.name, mtimeMs: st.mtimeMs, size: st.size });
   }
   if (entries.length === 0) throw noVideoFilesError(folder);
-  return { entries, nonVideoCount };
+  return { entries, nonVideoCount, ossclipOutputCount };
 }
 
 export interface FolderConcatResult {
@@ -371,6 +454,8 @@ export interface FolderConcatResult {
   clips: Array<{ name: string; durationSec: number }>;
   /** Files skipped for not matching a video extension. */
   nonVideoCount: number;
+  /** Video files skipped as produce's own outputs (`isOssclipOutputName`). */
+  ossclipOutputCount: number;
   /** True when the existing `source-concat.mp4` was reused, not rebuilt. */
   cached: boolean;
   /** The concat's own total duration (ffprobe'd from the output). */
@@ -393,7 +478,7 @@ export async function concatFolder(
   sort: "name" | "mtime",
   target: { w: number; h: number },
 ): Promise<FolderConcatResult> {
-  const { entries: current, nonVideoCount } = listing;
+  const { entries: current, nonVideoCount, ossclipOutputCount } = listing;
   if (current.length === 0) throw noVideoFilesError(folder);
   const order = planFolderConcat(current, sort);
 
@@ -408,6 +493,7 @@ export async function concatFolder(
         path: outPath,
         clips: order.map((name) => ({ name, durationSec: byName.get(name)!.durationSec })),
         nonVideoCount,
+        ossclipOutputCount,
         cached: true,
         durationSec: outProbe.duration,
       };
@@ -424,11 +510,11 @@ export async function concatFolder(
 
   const filter = buildConcatFilter(order.length, target);
   const inputArgs = order.flatMap((name) => ["-i", join(folder, name)]);
-  // Encode to a sibling temp path, rename only on success — same reasoning as
-  // `bakeNormalizedSource` in normalize.ts (R27 §125): ffmpeg writes the
-  // container header as it goes, so a bake that dies mid-graph leaves a file
-  // with no `moov` atom, and a cache keyed on EXISTENCE would reuse that
-  // corpse forever. Rename is atomic on a POSIX filesystem.
+  // Encode to a sibling temp path, rename only on success (R27 §125, learned
+  // on the since-removed normalization bake): ffmpeg writes the container
+  // header as it goes, so an encode that dies mid-graph leaves a file with no
+  // `moov` atom, and a cache keyed on EXISTENCE would reuse that corpse
+  // forever. Rename is atomic on a POSIX filesystem.
   const partial = `${outPath}.partial.mp4`;
   try {
     await run(tools.ffmpegPath, [
@@ -461,6 +547,7 @@ export async function concatFolder(
     path: outPath,
     clips: order.map((name, i) => ({ name, durationSec: probes[i]!.duration })),
     nonVideoCount,
+    ossclipOutputCount,
     cached: false,
     durationSec: outProbe.duration,
   };