ossclip 0.1.26 → 0.1.28

package/src/produce.ts

@@ -39,8 +39,11 @@ import {
   listFolderVideos,
   outInsideInputFolderMessage,
   outPathInsideInput,
+  COVER_PROVENANCE_BASENAME,
   coverDecision,
   coverHeadline,
+  readCoverProvenance,
+  writeCoverProvenance,
   cropFilter,
   detectContentRect,
   letterboxedSeconds,
@@ -49,6 +52,7 @@ import {
   createProvider,
   createTieredProvider,
   defaultProviderName,
+  fallbackProviderName,
   defaultTheme,
   detectSilences,
   dropHiddenCues,
@@ -88,6 +92,8 @@ import {
   portraitMimeType,
   thumbnailDecision,
   thumbnailImageCacheName,
+  applyCleanupChoices,
+  vetoedRemovals,
   applyUserCuts,
   pruneHidesInsideCuts,
   loadConfig,
@@ -115,6 +121,8 @@ import {
   measureLevels,
   probe,
   produceScenes,
+  PRODUCER_PROMPT_VERSION,
+  type FramingContext,
   reclampPinnedTiming,
   reconcileCopy,
   repairTranscript,
@@ -141,7 +149,9 @@ import {
   type CleanupLevel,
   type ClipWindow,
   type Layout,
+  type LlmEffort,
   type LlmProvider,
+  type LlmUsage,
   type Production,
   ossclipOutputPathFor,
   type ProviderName,
@@ -151,7 +161,7 @@ import {
   type Transcript,
 } from "@ossclip/core";
 import { recordRecentProject } from "./edit";
-import { binOnPath, detectionLine } from "./llm-detect";
+import { binOnPath, detectionLine, fallbackLine } from "./llm-detect";
 import {
   modelImpliedLanguage,
   modelUrl,
@@ -165,6 +175,13 @@ import {
   workdirBaseName,
 } from "./stranded-overrides";
 import { editHint } from "./interactive/edit-hint";
+import {
+  COVER_FRAME_BASENAME,
+  buildCoverRender,
+  coverBannerText,
+  coverTextHold,
+  provenanceVideoPath,
+} from "./cover";
 import { artifactPath, ensureParentDir, expandHome, moveFile } from "./paths";
 import { portraitOverridePath, resolvePortrait } from "./portrait-override";
 import { approveThumbnailConcept, thumbnailRetryLoop } from "./interactive/thumbnail-approve";
@@ -262,11 +279,165 @@ export function transcriptCacheReusable(
   };
 }
 
+/**
+ * The beat-sheet/scenes cache key: everything that changes the plan — which
+ * prompt asked, who was asked, with what editorial steer, about which words,
+ * in what frame. Pure and exported so the §78 posture ("a change that changes
+ * the answer must change the key") is testable without a workdir.
+ *
+ * Two of these are new, and only one of them was a live bug:
+ *  - `promptVersion` (the caller passes PRODUCER_PROMPT_VERSION) is the §78
+ *    fix proper — before it, a warm workdir kept serving a sheet the OLD
+ *    prompt wrote, exactly the failure YOUTUBE_PROMPT_VERSION exists for.
+ *  - `aspect` is LATENT rather than active: it changes the user prompt (the
+ *    LANDSCAPE block, R21 §101), but `--aspect 16:9` also derives its own
+ *    `-16x9` workdir and this cache is a file inside it, so a portrait and a
+ *    landscape plan of the same source cannot meet today. Keyed anyway —
+ *    the collision is one workdir-naming change away, and the key should not
+ *    depend on a different module's directory scheme to stay correct.
+ */
+export function beatSheetCacheKey(parts: {
+  promptVersion: string;
+  /** The primary on reads; on a §143 fallback WRITE, the provider that
+   * actually answered — a plain name from the usage records. */
+  providerName: string;
+  llmModel?: string;
+  /** The §143 effort knob — it steers the editorial call, so it changes the plan. */
+  llmEffort?: LlmEffort;
+  intent?: string;
+  cleanup: CleanupLevel;
+  forceComponent?: SceneComponentId;
+  /** Framing constraints steer layout choice, so a re-measure must replan. */
+  framing?: FramingContext;
+  clipTargetSec?: number;
+  clipWindow?: ClipWindow | null;
+  /** The repaired transcript's TEXT — see the call site on why not the count. */
+  words: readonly string[];
+  aspect: "9:16" | "16:9";
+}): string {
+  return createHash("sha1")
+    .update(
+      JSON.stringify([
+        parts.promptVersion,
+        parts.providerName,
+        parts.llmModel,
+        parts.intent,
+        parts.cleanup,
+        parts.forceComponent ?? null,
+        parts.framing ?? null,
+        // §93f: the clip target and the RESOLVED window key the plan too —
+        // without them a clip run and a full run of the same source would
+        // collide and answer from each other's cache (the §78 failure
+        // mode). Keyed POST-resolution so a replay that derives the same
+        // window hits the same entries.
+        parts.clipTargetSec ?? null,
+        parts.clipWindow ? `${parts.clipWindow.startWord}:${parts.clipWindow.endWord}` : null,
+        parts.words,
+        parts.aspect,
+        // The §143 effort knob — appended at the END, and only when SET: an
+        // unconditional `?? null` would change the serialization of every
+        // existing key and silently re-plan every warm workdir for users who
+        // never touched the knob. §78 only demands that a DIFFERENT effort
+        // miss; an unset one must keep hitting what it always hit.
+        ...(parts.llmEffort !== undefined ? [parts.llmEffort] : []),
+      ]),
+    )
+    .digest("hex")
+    .slice(0, 8);
+}
+
+/**
+ * The clip-window cache key (`clipwindow-<hash>.json`), which answers a
+ * different question — WHICH ~Ns of the take to keep (R19 §93) — but asks it
+ * with the SAME producer prompt, via `produceScenes(…, clip: {…})`. So it
+ * carries the same two fields `beatSheetCacheKey` gained, for the same
+ * reasons:
+ *  - `promptVersion`: without it, editing the producer prompt leaves every
+ *    warm workdir serving a window that was resolved under the OLD prompt —
+ *    the §78 failure mode, one call above where it was just fixed. The
+ *    tradeoff is accepted deliberately: a version bump DOES throw away an
+ *    already-resolved window and costs one LLM call to re-select it. That is
+ *    the correct price. Planning a whole video against a window the current
+ *    prompt would not have chosen is worse than an LLM call.
+ *  - `aspect`: LATENT today, exactly as it is one function down — `--aspect
+ *    16:9` derives its own `-16x9` workdir and this cache is a file inside
+ *    it, so a portrait and a landscape selection of the same source cannot
+ *    meet. Keyed anyway: the aspect reaches the prompt (both halves of it
+ *    since the producerSystem change), and the key should not depend on a
+ *    different module's directory scheme to stay correct.
+ *
+ * Deliberately NOT keyed, matching what the call site passes to the selection
+ * call: cleanup, forced component and the clip window itself. The first two
+ * do not reach this prompt, and the third is what it returns.
+ */
+export function clipWindowCacheKey(parts: {
+  promptVersion: string;
+  /** Same read/write split as `beatSheetCacheKey` (§143). */
+  providerName: string;
+  llmModel?: string;
+  /** The §143 effort knob — the selection rides the same editorial call. */
+  llmEffort?: LlmEffort;
+  intent?: string;
+  clipTargetSec: number;
+  /** Framing constraints steer the selection call the same way (see above). */
+  framing?: FramingContext;
+  /** The repaired transcript's TEXT — the window is word-indexed into it. */
+  words: readonly string[];
+  aspect: "9:16" | "16:9";
+}): string {
+  return createHash("sha1")
+    .update(
+      JSON.stringify([
+        parts.promptVersion,
+        parts.providerName,
+        parts.llmModel,
+        parts.intent,
+        parts.clipTargetSec,
+        parts.framing ?? null,
+        parts.words,
+        parts.aspect,
+        // Appended at the END, only when SET — beatSheetCacheKey's rule: an
+        // unset effort must keep every existing key byte-identical.
+        ...(parts.llmEffort !== undefined ? [parts.llmEffort] : []),
+      ]),
+    )
+    .digest("hex")
+    .slice(0, 8);
+}
+
+/**
+ * The provider that actually answered the call whose output is being cached
+ * (2026-08-22, FINDINGS §143): after a timeout fallback the resolved
+ * `providerName` names the provider that FAILED, and keying a cache write on
+ * it would attribute the fallback's plan to a provider that never produced
+ * it. Last matching record wins — retries and the fallback both append to the
+ * usage log, so the last writer is the one whose answer survived. Pure and
+ * exported so the attribution is testable without a workdir.
+ */
+export function actualProvider(
+  usage: readonly LlmUsage[],
+  schemaName: string,
+  defaultName: string,
+): string {
+  for (let i = usage.length - 1; i >= 0; i--) {
+    if (usage[i]!.schemaName === schemaName) return usage[i]!.provider;
+  }
+  return defaultName;
+}
+
 export interface ProduceOptions {
   out?: string;
   cleanup: CleanupLevel;
   transcript?: string;
   render: boolean;
+  /**
+   * This run is a `--review` (cut review step 1/3): `render` is already
+   * false (reviewFlag resolved that in the action) and the editor opens on
+   * the workdir afterwards. Produce only reads it to phrase the no-render
+   * exit — "the editor is opening" instead of the `--no-render` skip line
+   * plus an `ossclip edit` hint for an editor that is about to open itself.
+   */
+  review?: boolean;
   mezzanine: boolean;
   workdir?: string;
   inspect?: boolean;
@@ -281,6 +452,12 @@ export interface ProduceOptions {
   llmModel?: string;
   /** Model for mechanical calls; "same" sends everything to the main model. */
   llmFastModel?: string;
+  /**
+   * `agy --effort` for the antigravity provider (§143). Already zod-parsed to
+   * the union by program.ts — the CONFIG's `llmEffort` arrives separately, as
+   * an unvalidated string, and `resolveLlmEffort` arbitrates.
+   */
+  llmEffort?: LlmEffort;
   /** Who is on camera — steers repair and exempts their name from grounding. */
   speaker?: string;
   /** Repair ASR mishearings before captions/producer/grounding (default on). */
@@ -306,6 +483,12 @@ export interface ProduceOptions {
   cover?: boolean;
   /** Explicit cover output path, overriding <out>.cover.jpg. */
   coverPath?: string;
+  /**
+   * `--cover-text-reset` — opt back into the GENERATED cover headline on a
+   * workdir whose `cover.json` holds a user-typed one (`coverTextHold`).
+   * Deleting `cover.json` does the same thing.
+   */
+  coverTextReset?: boolean;
   /** Treat the source as an already-edited reel with burned-in graphics. */
   sourceIsEdited?: boolean;
   /**
@@ -467,6 +650,32 @@ export function resolveYoutube(
   return flag ?? configValue === true;
 }
 
+/**
+ * The effective `--llm-effort` — reasoning effort for the antigravity
+ * provider's `agy --effort` flag (§143: exposed after the hang incident;
+ * untested at real scale whether it moves the hang, but the knob existed and
+ * we passed nothing). A TYPED flag always wins, and it arrives already
+ * zod-parsed by program.ts; only the config value is checked here — the
+ * `dictionary` posture, since it comes from hand-editable JSON loadConfig
+ * doesn't zod-parse: exactly low|medium|high, or one warning and agy's
+ * default, never a coerced effort level. Pure so the flag × config matrix is
+ * testable without a config file on disk.
+ */
+export function resolveLlmEffort(
+  flag: LlmEffort | undefined,
+  configValue: unknown,
+): { effort?: LlmEffort; warning?: string } {
+  // Typed-beats-config, and typed also beats a MALFORMED config: the user
+  // asking for an effort on the command line gets it, not a warning about a
+  // config key they did not touch this run.
+  if (flag !== undefined) return { effort: flag };
+  if (configValue === undefined) return {};
+  if (configValue === "low" || configValue === "medium" || configValue === "high") {
+    return { effort: configValue };
+  }
+  return { warning: "⚠ config llmEffort ignored — expected low|medium|high" };
+}
+
 /**
  * How many browser tabs the render runs in parallel (2026-08-17 render-speed
  * pass). Precedence: `--concurrency` beats the config's `renderConcurrency`
@@ -949,7 +1158,23 @@ export async function thumbnailStep(args: ThumbnailStepArgs): Promise<ThumbnailS
         // ceiling). Capped BEFORE caching so the cache and the image key hold
         // what is used.
         concept = { ...fresh, overlayText: approvedOverlayText(fresh.overlayText) };
-        await writeFile(conceptCache, JSON.stringify(concept, null, 2));
+        // §143 read/write split, same as the plan and repair caches: the
+        // concept call rides the editorial provider and can fall back, so the
+        // file goes under whoever actually answered.
+        await writeFile(
+          join(
+            args.work,
+            thumbnailConceptCacheName({
+              ...args,
+              providerName: actualProvider(
+                args.provider.usage,
+                "thumbnail_concept",
+                args.providerName,
+              ),
+            }),
+          ),
+          JSON.stringify(concept, null, 2),
+        );
       } catch (err) {
         log(
           `▸ thumbnail: concept failed (${err instanceof Error ? err.message : String(err)}) ` +
@@ -1133,6 +1358,54 @@ export function resolveJumpCuts(flag: boolean | undefined): JumpCutsMode {
   return "auto";
 }
 
+/**
+ * Resolves `--review` against the two flags it overlaps: produce without
+ * rendering, then open the editor to review the cut — so the ONE render
+ * happens from the editor's Render button, not before the user could look.
+ *
+ * `--review --no-render` is agreement, not a contradiction — both point the
+ * same way (don't render here), unlike the jump-cuts pair — so it resolves
+ * silently. `--review --no-open-editor` IS the contradiction (reviewing is
+ * opening the editor) and follows jumpCutsFlag's rule: a loud error, never a
+ * precedence the user has to memorize. Without --review everything passes
+ * through untouched, tri-states included. Pure so the whole matrix is
+ * assertable without commander or a TTY.
+ */
+export function reviewFlag(
+  review: boolean,
+  render: boolean,
+  openEditor: boolean | undefined,
+): { render: boolean; openEditor: boolean | undefined } {
+  if (!review) return { render, openEditor };
+  if (openEditor === false) {
+    throw new Error("--review contradicts --no-open-editor — reviewing means opening the editor");
+  }
+  return { render: false, openEditor: true };
+}
+
+/**
+ * The one loud line for cleanup vetoes actually changing this run's cut (cut
+ * review step 3) — the `▸ N user cut(s) removed …` voice, inverted: per
+ * declined reason, how many removals came back and how much source time they
+ * restore. Pure so the whole phrasing is assertable without running produce;
+ * callers only print it when `vetoed` is non-empty (a silent no-change run
+ * must stay silent, like the user-cut line's own `cuts.length > 0` gate).
+ */
+export function cleanupChoicesLine(vetoed: readonly Segment[], outputDuration: number): string {
+  const byReason = new Map<string, { count: number; sec: number }>();
+  for (const seg of vetoed) {
+    const key = seg.reason ?? "unlabeled";
+    const entry = byReason.get(key) ?? { count: 0, sec: 0 };
+    entry.count += 1;
+    entry.sec += seg.srcOut - seg.srcIn;
+    byReason.set(key, entry);
+  }
+  const parts = [...byReason.entries()].map(
+    ([reason, { count, sec }]) => `${count} ${reason} removal(s) (+${sec.toFixed(1)}s)`,
+  );
+  return `▸ cleanup choices kept ${parts.join(", ")} — ${outputDuration.toFixed(1)}s output`;
+}
+
 /**
  * The punch scale for spans the plan allows — ~1.5%, replacing the legacy 7%
  * (user decision 2026-08-16, "minimal, ~1%"): the 1.07 punch visibly SLID
@@ -1662,6 +1935,15 @@ export async function produce(inputArg: string, opts: ProduceOptions): Promise<P
   const dictionary = opts.dictionary ?? configDictionary ?? [];
   if (dictionary.length > 0) console.log(`▸ dictionary: ${dictionary.join(", ")}`);
 
+  // Resolved ONCE for the whole run (§143): the provider call, both plan
+  // cache keys and the command.json pin must all see the same effort, or a
+  // replay re-plans under a knob the run never used.
+  const { effort: llmEffort, warning: llmEffortWarning } = resolveLlmEffort(
+    opts.llmEffort,
+    cfg.llmEffort,
+  );
+  if (llmEffortWarning) console.log(llmEffortWarning);
+
   // The run's base theme (F6): config theme over defaultTheme, resolved once
   // and used for BOTH resolveTheme's base and props.baseTheme below — the
   // editor's reset must land on the user's global colors, not the factory's.
@@ -2072,31 +2354,62 @@ export async function produce(inputArg: string, opts: ProduceOptions): Promise<P
     if (!opts.provider) {
       console.log(detectionLine(providerName));
     }
+    // Timeout fallback (2026-08-22, FINDINGS §143): agy hangs persistently on
+    // the real beat-sheet call — 10-minute --print-timeout expiries while
+    // claude-cli planned the same video — and auto-detection picks agy
+    // whenever the CLI is on PATH. When the editorial call times out, ONE
+    // other provider answers it instead of the run dying, announced out loud:
+    // the user must know which model planned their video.
+    const llmFallbackName =
+      providerName === "antigravity"
+        ? fallbackProviderName(providerName, process.env, binOnPath)
+        : undefined;
     provider = createTieredProvider(providerName, {
       model: opts.llmModel,
       fastModel: opts.llmFastModel ?? cfg.fastModel,
+      fallback: llmFallbackName,
+      onFallback: (info) => console.log(fallbackLine(info.from, info.to, info.schemaName)),
+      // §143: rides the editorial antigravity call only — see TieringOptions.
+      effort: llmEffort,
     });
   }
 
   let rawTranscript = transcript;
   let repairs: AppliedRepair[] = [];
   if (provider && opts.repair !== false) {
-    const rawKey = createHash("sha1")
-      .update(
-        JSON.stringify([
-          providerName,
-          opts.llmModel,
-          opts.llmFastModel ?? cfg.fastModel,
-          opts.speaker ?? cfg.speaker,
-          // The dictionary changes both the prompt and the vouched set (F4),
-          // so cached repairs from a different vocabulary must not be reused.
-          dictionary,
-          rawTranscript.words.map((w) => w.text),
-        ]),
-      )
-      .digest("hex")
-      .slice(0, 8);
-    const repairCache = join(work, `repairs-${rawKey}.json`);
+    // Parameterized on the provider so the WRITE below can re-key on who
+    // actually answered (§143) — the same read/write split as the beat-sheet
+    // caches, and load-bearing beyond attribution: repairs REWRITE the words,
+    // and the words are an input to every plan cache key downstream. A repair
+    // set cached under the provider that timed out would fork the transcript
+    // lineage, and the fallback-written plan could never be reached by a
+    // later run that names the fallback provider directly (measured
+    // 2026-08-22: two repair caches, 10 vs 11 repairs — one applied
+    // "Llama," → "LLaVA," — put the same take's beat sheets under keys no
+    // other run computed).
+    const repairKeyFor = (p: string): string =>
+      createHash("sha1")
+        .update(
+          JSON.stringify([
+            p,
+            opts.llmModel,
+            opts.llmFastModel ?? cfg.fastModel,
+            opts.speaker ?? cfg.speaker,
+            // The dictionary changes both the prompt and the vouched set (F4),
+            // so cached repairs from a different vocabulary must not be reused.
+            dictionary,
+            rawTranscript.words.map((w) => w.text),
+            // Repair runs on the EDITORIAL tier (repair.ts: deciding what a
+            // person actually said is semantic work), so the §143 effort knob
+            // changes its answers. Appended at the END, only when SET —
+            // beatSheetCacheKey's rule: an unset effort must keep serving the
+            // repairs every existing workdir already cached.
+            ...(llmEffort !== undefined ? [llmEffort] : []),
+          ]),
+        )
+        .digest("hex")
+        .slice(0, 8);
+    const repairCache = join(work, `repairs-${repairKeyFor(providerName)}.json`);
     if (existsSync(repairCache)) {
       const cached = JSON.parse(await readFile(repairCache, "utf8")) as AppliedRepair[];
       // Re-DECIDE from the cached PROPOSALS; never replay the stored verdicts
@@ -2166,7 +2479,17 @@ export async function produce(inputArg: string, opts: ProduceOptions): Promise<P
             "    (not cached — the next run retries the pass)",
         );
       } else {
-        await writeFile(repairCache, JSON.stringify(repairs, null, 2));
+        // Written under the ANSWERING provider's key (§143): after a timeout
+        // fallback these are the fallback's repairs, and the transcript
+        // lineage they start must be reachable by a run that asks that
+        // provider by name. The primary-keyed read above stays deliberate.
+        await writeFile(
+          join(
+            work,
+            `repairs-${repairKeyFor(actualProvider(provider.usage, "transcript_repair", providerName))}.json`,
+          ),
+          JSON.stringify(repairs, null, 2),
+        );
       }
     }
     for (const r of repairs) {
@@ -2282,19 +2605,19 @@ export async function produce(inputArg: string, opts: ProduceOptions): Promise<P
     // calls; only a first run selects.
     let clipFresh: Awaited<ReturnType<typeof produceScenes>> | null = null;
     if (clipTargetSec !== undefined) {
-      const windowKey = createHash("sha1")
-        .update(
-          JSON.stringify([
-            providerName,
-            opts.llmModel,
-            opts.intent,
-            clipTargetSec,
-            framingCtx ?? null,
-            transcript.words.map((w) => w.text),
-          ]),
-        )
-        .digest("hex")
-        .slice(0, 8);
+      // Parts split from the key so the WRITE below can re-key on the
+      // provider that actually answered (§143) without restating them.
+      const windowKeyParts = {
+        promptVersion: PRODUCER_PROMPT_VERSION,
+        llmModel: opts.llmModel,
+        llmEffort,
+        intent: opts.intent,
+        clipTargetSec,
+        framing: framingCtx,
+        words: transcript.words.map((w) => w.text),
+        aspect: landscape ? ("16:9" as const) : ("9:16" as const),
+      };
+      const windowKey = clipWindowCacheKey({ ...windowKeyParts, providerName });
       const clipWindowCache = join(work, `clipwindow-${windowKey}.json`);
       if (opts.clipWindow) {
         clipWindow = parseClipWindowPin(transcript, opts.clipWindow);
@@ -2321,7 +2644,25 @@ export async function produce(inputArg: string, opts: ProduceOptions): Promise<P
         );
         clipWindow = clipFresh.clip!.window;
         for (const note of clipFresh.clip!.notes) console.log(`  ▸ ${note}`);
-        await writeFile(clipWindowCache, JSON.stringify(clipWindow, null, 2));
+        // The WRITE keys on the provider that actually answered; the READS
+        // above stay keyed on the primary — both deliberate (2026-08-22,
+        // FINDINGS §143). After a timeout fallback the window is the
+        // fallback's work: filing it under agy would let an agy-keyed read
+        // claim a window agy never chose, and would hide it from a later
+        // `--llm claude-cli` run that should hit it. The price of the
+        // primary-keyed read is that a repeat agy run re-attempts agy (10
+        // minutes, today) before falling back again — accepted over ever
+        // serving a cache whose label lies.
+        await writeFile(
+          join(
+            work,
+            `clipwindow-${clipWindowCacheKey({
+              ...windowKeyParts,
+              providerName: actualProvider(provider.usage, "clip_beat_sheet", providerName),
+            })}.json`,
+          ),
+          JSON.stringify(clipWindow, null, 2),
+        );
       }
 
       // Slice the pipeline state to the window (§93.1), then let everything
@@ -2365,29 +2706,22 @@ export async function produce(inputArg: string, opts: ProduceOptions): Promise<P
       map = new TimeMap(cutlist);
     }
 
-    const cacheKey = createHash("sha1")
-      .update(
-        JSON.stringify([
-          providerName,
-          opts.llmModel,
-          opts.intent,
-          opts.cleanup,
-          opts.forceComponent ?? null,
-          // The framing constraints steer layout choice, so a change in the
-          // measured framing must invalidate the cached plan.
-          framingCtx ?? null,
-          // §93f: the clip target and the RESOLVED window key the plan too —
-          // without them a clip run and a full run of the same source would
-          // collide and answer from each other's cache (the §78 failure
-          // mode). Keyed POST-resolution so a replay that derives the same
-          // window hits the same entries.
-          clipTargetSec ?? null,
-          clipWindow ? `${clipWindow.startWord}:${clipWindow.endWord}` : null,
-          transcript.words.map((w) => w.text),
-        ]),
-      )
-      .digest("hex")
-      .slice(0, 8);
+    // Parts split from the key for the same §143 reason as the clip window:
+    // the writes below re-key on the provider that actually answered.
+    const beatKeyParts = {
+      promptVersion: PRODUCER_PROMPT_VERSION,
+      llmModel: opts.llmModel,
+      llmEffort,
+      intent: opts.intent,
+      cleanup: opts.cleanup,
+      forceComponent: opts.forceComponent,
+      framing: framingCtx,
+      clipTargetSec,
+      clipWindow,
+      words: transcript.words.map((w) => w.text),
+      aspect: landscape ? ("16:9" as const) : ("9:16" as const),
+    };
+    const cacheKey = beatSheetCacheKey({ ...beatKeyParts, providerName });
     const sceneCache = join(work, `scenes-${cacheKey}.json`);
     // The cover needs the editorial copy, which is not in the scene list — a
     // cached run must still be able to write one.
@@ -2415,9 +2749,16 @@ export async function produce(inputArg: string, opts: ProduceOptions): Promise<P
         clipFresh.graphics.asked,
         transcript,
       );
-      await writeFile(sceneCache, JSON.stringify(scenes, null, 2));
+      // Written under the ANSWERING provider's key (§143, same rule as the
+      // clip-window write above): the adopted sheet came from the ONE
+      // clip_beat_sheet call, which may have been the fallback's.
+      const adoptKey = beatSheetCacheKey({
+        ...beatKeyParts,
+        providerName: actualProvider(provider.usage, "clip_beat_sheet", providerName),
+      });
+      await writeFile(join(work, `scenes-${adoptKey}.json`), JSON.stringify(scenes, null, 2));
       await writeFile(
-        beatCache,
+        join(work, `beatsheet-${adoptKey}.json`),
         JSON.stringify({ ...beatSheet, graphics: graphicsLine, issues: beatIssues }, null, 2),
       );
     } else if (existsSync(sceneCache)) {
@@ -2477,9 +2818,15 @@ export async function produce(inputArg: string, opts: ProduceOptions): Promise<P
       // Cache props only — overrides are user-owned and live in overrides.json,
       // never in production.json (that file is derived and every `produce`
       // run overwrites it, per the merge rule in `overrides.ts`).
-      await writeFile(sceneCache, JSON.stringify(scenes, null, 2));
+      // Keyed on who answered the beat_sheet call (§143) — see the clip-window
+      // write above for why reads stay primary-keyed while writes do not.
+      const freshKey = beatSheetCacheKey({
+        ...beatKeyParts,
+        providerName: actualProvider(provider.usage, "beat_sheet", providerName),
+      });
+      await writeFile(join(work, `scenes-${freshKey}.json`), JSON.stringify(scenes, null, 2));
       await writeFile(
-        beatCache,
+        join(work, `beatsheet-${freshKey}.json`),
         JSON.stringify({ ...beatSheet, graphics: graphicsLine, issues: beatIssues }, null, 2),
       );
     }
@@ -2515,8 +2862,25 @@ export async function produce(inputArg: string, opts: ProduceOptions): Promise<P
     // …and stamp it onto the artefact it explains, so `production.json` says
     // who planned it without a second file to cross-reference.
     const last = log.runs[log.runs.length - 1]!;
+    // `last.provider` derives from records[0] — the FIRST call's provider,
+    // which after a §143 timeout fallback is the primary that failed the
+    // editorial call. The stamp answers "who planned this", so it is built
+    // from the records that ANSWERED (`failed` attempts stay in usage.json
+    // and every report — their cost is real — but a stamp listing the failed
+    // attempt's placeholder model read "planned by claude-cli
+    // (antigravity-default)" after a fallback run, 2026-08-22). Providers in
+    // first-seen order, the same " → " rendering the usage report uses;
+    // single-provider runs stamp exactly as before.
+    const answered = provider.usage.filter((r) => !r.failed);
+    const providersSeen = [...new Set(answered.map((r) => r.provider))];
     producerStamp = {
-      provider: last.provider ?? providerName,
+      provider:
+        providersSeen.length > 1
+          ? providersSeen.join(" → ")
+          : providersSeen[0] ?? last.provider ?? providerName,
+      // `last.models` already excludes failed attempts' models (usage.ts,
+      // same §143 rule) — a stamp that listed the timed-out placeholder read
+      // "planned by claude-cli (antigravity-default)" after a fallback run.
       models: last.models,
       cached: last.cached,
       at: last.at,
@@ -2616,6 +2980,28 @@ export async function produce(inputArg: string, opts: ProduceOptions): Promise<P
     }
     overrideDoc = parsed.data;
   }
+  // ---- Cleanup choices: the user's veto over the AUTOMATIC cutlist (cut
+  // review step 3) ------------------------------------------------------
+  // Applied here — the same load `cuts` rides, before `applyUserCuts` — and
+  // in exactly this order on purpose: cleanup vetoes reshape the PROPOSAL,
+  // then user cuts subtract from the result as they always did, so a user
+  // cut drawn over a vetoed pause still cuts (an explicit user action
+  // outranks a veto). The proposal itself is captured FIRST for
+  // `production.json`'s `cutlistProposed` — the resolution is lossy (a
+  // vetoed removal merges into a plain keep), and the editor's checkboxes
+  // re-derive the veto state from proposal + choices through the same
+  // `applyCleanupChoices` this run used (ProductionSchema has the full why).
+  // Consumers of `map` ABOVE this point (the repair pass's isCut guard, the
+  // producer's outputDuration hint) saw the pre-veto map: both are
+  // conservative uses — a refused word-merge across a span that comes back,
+  // a duration hint a few seconds short — never a wrong cut.
+  const cutlistProposed = cutlist;
+  const cleanupVetoed = vetoedRemovals(cutlist, overrideDoc.cleanup);
+  if (cleanupVetoed.length > 0) {
+    cutlist = applyCleanupChoices(cutlist, overrideDoc.cleanup);
+    map = new TimeMap(cutlist);
+    console.log(cleanupChoicesLine(cleanupVetoed, map.outputDuration));
+  }
   // `applyUserCuts`'s `priorMap`: a cut's `startSec`/`endSec` (when it has
   // no `src` yet) and any already-re-anchored splits/pins are expressed
   // relative to whatever render-props the user was LAST looking at, not the
@@ -3134,7 +3520,13 @@ export async function produce(inputArg: string, opts: ProduceOptions): Promise<P
     transcript: rawTranscript,
     repairs: repairs.length > 0 ? repairs : undefined,
     analysis,
+    // The APPLIED truth vs the PROPOSAL — see ProductionSchema for why both
+    // are recorded: `cutlist` keeps the report/exporters honest about what
+    // happened; `cutlistProposed` keeps the declined categories recoverable
+    // for the editor (a vetoed removal merges into a plain keep, so the
+    // resolved list alone cannot name what was declined).
     cutlist,
+    cutlistProposed,
     ...(clipWindow && clipTargetSec !== undefined
       ? { clip: { targetSec: clipTargetSec, ...clipWindow } }
       : {}),
@@ -3790,12 +4182,147 @@ export async function produce(inputArg: string, opts: ProduceOptions): Promise<P
     console.log(overridesWriteLine(cutResult.changed));
   }
 
+  // Resolved HERE — above the --no-render exit rather than at the thumbnail
+  // gate / pack section below — so the gate, the post-render consumers AND
+  // the command.json record (which both exits now write) all read one
+  // answer. Typed-beats-config, `typeof` not truthiness (the `portrait`
+  // posture): config.json is hand-edited and unparsed, and a
+  // `"audience": true` typo must resolve to "no audience".
+  const youtube = resolveYoutube(opts.youtube, cfg.youtube);
+  // resolvePortrait (portrait-override.ts) carries the expandHome treatment
+  // of the flag and config paths, and puts the workdir's portrait-override
+  // ABOVE both (editor face swap, 2026-08-17): a per-project expression
+  // chosen in the editor must survive CLI re-renders — the flag/config
+  // portrait is the fallback headshot, and a replay silently reverting the
+  // swapped face would undo the one thing the swap exists for.
+  const portrait = resolvePortrait({
+    overridePath: portraitOverridePath(work),
+    flagPortrait: opts.portrait,
+    cfgPortrait: cfg.portrait,
+  })?.path;
+  const audience = opts.audience ?? (typeof cfg.audience === "string" ? cfg.audience : undefined);
+  const thumbnailBrief =
+    opts.thumbnailBrief ?? (typeof cfg.thumbnailBrief === "string" ? cfg.thumbnailBrief : undefined);
+
+  // Record THIS invocation so the editor's Render button can replay it (R11
+  // Task 4). Nothing else can reconstruct it — production.json has the
+  // source path, cleanup and intent, but not --produce, --out or the LLM
+  // flags — and guessing would silently render a different video than the
+  // one on screen. execArgv carries the module loader (tsx in dev), so the
+  // replay works from source and from a compiled build alike.
+  //
+  // Written BEFORE the render/no-render fork, not after the render (cut-review
+  // step 1): a --no-render workdir used to carry NO command.json at all, so
+  // the editor's Render button 412'd with "run `ossclip produce` once from
+  // the terminal" — a dead end that made `--review` (produce without
+  // rendering, review in the editor, render ONCE from its Render button)
+  // impossible. Every pin below is resolved by this point, so the record is
+  // byte-identical to what the post-render write produced; the side effect is
+  // that a crashed render now leaves a record its own Render button can
+  // retry. recordedProduceArgs strips --review/--no-render at record, so the
+  // replay actually renders instead of looping.
+  //
+  // The provider may have been AUTO-DETECTED from this shell's environment
+  // (a GEMINI_/ANTHROPIC_ key exported here). The editor's Render replays
+  // this argv from the EDIT SERVER's environment, which may not have that
+  // key — and the auto-detection would then silently pick a DIFFERENT
+  // provider (R16 §75). Pin the RESOLVED choice into the recorded args —
+  // never the key itself; secrets stay out of the workdir — so a replay
+  // uses the same configuration or fails loudly asking for it.
+  // §93g: pin the RESOLVED window, exactly as §75 pinned the provider. The
+  // editor's Render replays this argv; if replay re-asked the model and got a
+  // slightly different window, every saved override — anchored to scene ids
+  // and word indices — would land on the wrong words. The word range, not
+  // just `--clip 60`, is what makes replay deterministic with zero LLM calls.
+  //
+  // §129: NOT process.argv. A wizard or bare-path run re-enters commander
+  // with a BUILT argv while process.argv still holds the original invocation
+  // (`ossclip <path>`, no `produce` literal, none of the wizard's answers) —
+  // recording process.argv shipped a command that replays as
+  // `ossclip <path> --llm …` and dies on "unknown option '--llm'".
+  // recordedProduceArgs prefers the argv the re-entry stashed and falls back
+  // to process.argv for a directly typed `ossclip produce …`, which stays
+  // byte-identical to what was always recorded.
+  // Watermark pin, same §75 shape, and in BOTH directions (review,
+  // Important): the effective default comes from THIS machine's
+  // ~/.ossclip/config.json, so an unpinned record replays differently
+  // wherever that config differs — an off-run would silently gain a credit
+  // under a later/foreign config-on, an on-run would silently lose it. The
+  // RESOLVED state is always pinned; a typed flag is already in the argv and
+  // the includes-guard leaves it alone.
+  // Captions pin: the FLAG's resolved state (`opts.captions ?? true`), never
+  // the override-inclusive `captionsHidden` — overrides.json travels with
+  // the workdir and is re-read on every replay, so pinning --no-captions
+  // because the EDITOR hid them would freeze an edit the user may later
+  // undo in that same editor. See recordedProduceArgs for why the pin is
+  // unconditional even though captions' default is config-independent today.
+  // Jump-cuts pin: the RESOLVED mode, but only its typed states reach the
+  // argv — "auto" has no flag spelling and stays unpinned (see
+  // recordedProduceArgs for why that is safe today).
+  // Youtube pin: the watermark's config-dependent-default rationale exactly —
+  // resolved both ways, so a later config edit can't flip what Render
+  // replays. Portrait and dictionary pin the RESOLVED values (a path and
+  // terms, never a secret) for the same reason; recordedProduceArgs owns
+  // the non-empty/includes guards.
+  const recordedArgs = recordedProduceArgs({
+    llm: provider ? providerName : undefined,
+    // The RESOLVED effort (§143), pinned like the dictionary: it may have
+    // come from this machine's config, and it keys the plan caches — an
+    // unpinned record would re-plan on replay after a config edit.
+    llmEffort,
+    clipWindow: clipWindow ? `${clipWindow.startWord}:${clipWindow.endWord}` : undefined,
+    watermark,
+    captions: opts.captions ?? true,
+    jumpCuts: jumpCutsMode,
+    dictionary,
+    youtube,
+    portrait,
+    audience,
+    thumbnailBrief,
+  });
+  // produce is the ONLY command that may write command.json — edit.ts's §129
+  // heal prepends the "produce" literal to any record that doesn't start
+  // with it, so a record made by `transcribe`/`analyze` (which run this same
+  // pipeline with render: false, and used to be kept out by the write
+  // sitting after the early return below) would heal into
+  // `produce transcribe …` and replay garbage. Their argv cannot start with
+  // "produce" (§129: the stash mirrors the parse that ran, and only
+  // produce's re-entries stash), which is the gate.
+  if (recordedArgs[0] === "produce") {
+    await writeFile(
+      join(work, "command.json"),
+      JSON.stringify(
+        {
+          execPath: process.execPath,
+          execArgv: process.execArgv,
+          script: process.argv[1],
+          args: recordedArgs,
+          cwd: process.cwd(),
+          out: outPath,
+        },
+        null,
+        2,
+      ),
+    );
+    // Every produce run is a project the picker should offer (R17 §83) —
+    // best-effort, so a read-only home dir never fails the render.
+    await recordRecentProject(work);
+  }
+
   if (!opts.render) {
     // §140: the breakdown goes above the closing lines on both exits, so the
     // last thing on screen stays the success line and the edit hint.
     console.log(formatPhaseLine(phases.timings(), phases.totalMs()));
-    console.log(`▸ skipping render (--no-render). Props at ${join(work, "render-props.json")}`);
-    console.log(editHint(work));
+    if (opts.review === true) {
+      // --review (step 1's report, fixed in step 3): the editor opens itself
+      // right after this return, so the --no-render skip line plus an
+      // `ossclip edit …` hint would tell the user to do what is already
+      // happening. One line that says what comes next instead.
+      console.log("▸ review: opening the editor — render once from its Render button");
+    } else {
+      console.log(`▸ skipping render (--no-render). Props at ${join(work, "render-props.json")}`);
+      console.log(editHint(work));
+    }
     return {
       workdir: work,
       rendered: false,
@@ -3817,27 +4344,9 @@ export async function produce(inputArg: string, opts: ProduceOptions): Promise<P
   // multi-minute render. Interactive runs approve (or edit, or skip) it
   // here; the file it writes is what thumbnailStep honors after render — and
   // what a non-TTY replay (the editor's Render) reuses, which is the whole
-  // persistence story.
-  //
-  // Resolved HERE rather than at the pack section below so the gate and the
-  // post-render consumers read one answer. Typed-beats-config, `typeof` not
-  // truthiness (the `portrait` posture): config.json is hand-edited and
-  // unparsed, and a `"audience": true` typo must resolve to "no audience".
-  const youtube = resolveYoutube(opts.youtube, cfg.youtube);
-  // resolvePortrait (portrait-override.ts) carries the expandHome treatment
-  // of the flag and config paths, and puts the workdir's portrait-override
-  // ABOVE both (editor face swap, 2026-08-17): a per-project expression
-  // chosen in the editor must survive CLI re-renders — the flag/config
-  // portrait is the fallback headshot, and a replay silently reverting the
-  // swapped face would undo the one thing the swap exists for.
-  const portrait = resolvePortrait({
-    overridePath: portraitOverridePath(work),
-    flagPortrait: opts.portrait,
-    cfgPortrait: cfg.portrait,
-  })?.path;
-  const audience = opts.audience ?? (typeof cfg.audience === "string" ? cfg.audience : undefined);
-  const thumbnailBrief =
-    opts.thumbnailBrief ?? (typeof cfg.thumbnailBrief === "string" ? cfg.thumbnailBrief : undefined);
+  // persistence story. The youtube/portrait/audience/brief resolutions this
+  // gate reads moved above the --no-render exit (cut-review step 1) so the
+  // command.json record pins the same answers on both exits.
   const geminiKey = process.env.GEMINI_API_KEY;
   const approvedConceptPath = join(work, THUMBNAIL_APPROVED_BASENAME);
   // The gate reuses thumbnailDecision (plus the mime check) so the prompt
@@ -4061,7 +4570,20 @@ export async function produce(inputArg: string, opts: ProduceOptions): Promise<P
   {
     // §35's cap applies here too: a cached beat sheet from before the fix, or
     // the hook fallback, must not slip a 13-word paragraph onto a thumbnail.
-    const coverText = coverHeadline(beatSheet?.coverText ?? beatSheet?.hook ?? "");
+    const generatedCoverText = coverHeadline(beatSheet?.coverText ?? beatSheet?.hook ?? "");
+    // A headline someone typed (`ossclip cover --text`, or the editor) is a
+    // user-owned file, exactly like overrides.json and the approved thumbnail
+    // concept: this run does NOT quietly replace it with a fresh beat sheet's
+    // coverText. Read before the decision below, because it decides the text
+    // the decision is made about.
+    const priorCover = await readCoverProvenance(work);
+    const heldCover = coverTextHold({
+      generated: generatedCoverText,
+      persisted: priorCover,
+      reset: opts.coverTextReset === true,
+    });
+    if (heldCover.message) console.log(heldCover.message);
+    const coverText = heldCover.text;
     // Urdu field run 2026-08-05: a run without --produce has no hook text,
     // and skipping the cover for that threw away the part that never needed
     // text — the sharpness-scored face frame. No headline now means a bare
@@ -4088,7 +4610,7 @@ export async function produce(inputArg: string, opts: ProduceOptions): Promise<P
       if (!pick) {
         console.log("▸ no usable cover frame found — skipping cover");
       } else {
-        const frameName = "cover-frame.png";
+        const frameName = COVER_FRAME_BASENAME;
         await run(cfg.ffmpegPath, [
           "-v", "error",
           "-ss", pick.timeSec.toFixed(3),
@@ -4122,16 +4644,26 @@ export async function produce(inputArg: string, opts: ProduceOptions): Promise<P
             `▸ cover from ${pick.timeSec.toFixed(1)}s ` +
               `(${pick.hasFace ? "face" : "no face"}, sharpness ${pick.sharpness.toFixed(0)})…`,
           );
-          if (sourceTitled) {
-            console.log("  ▸ source already has a title in this frame — shipping it without a banner");
-          } else if (pick.face) {
+          // …unless the headline is the user's own, which §34 does not get to
+          // erase (cover.ts's coverBannerText has the reasoning). Unchanged
+          // for a generated headline, including the line it prints.
+          const banner = coverBannerText({
+            text: coverText,
+            textSource: heldCover.textSource,
+            sourceTitled,
+          });
+          if (banner.note) console.log(banner.note);
+          // The band log is about routing a banner around the face, so it
+          // follows whether there IS a banner — for a §34-suppressed cover
+          // there is none, for a surviving user headline there is.
+          if (banner.text !== "" && pick.face) {
             const band = coverTextRect(pick.face, frame);
             console.log(
               `  ▸ banner in the ${band.y + band.h / 2 < pick.face.centerYFrac ? "band above" : "band below"} ` +
                 `the face (${(band.y * 100).toFixed(0)}-${((band.y + band.h) * 100).toFixed(0)}%)`,
             );
           }
-          bannerText = sourceTitled ? "" : coverText;
+          bannerText = banner.text;
         } else {
           console.log(
             `▸ cover from ${pick.timeSec.toFixed(1)}s ` +
@@ -4139,22 +4671,71 @@ export async function produce(inputArg: string, opts: ProduceOptions): Promise<P
               `— no banner text (run --produce for one)`,
           );
         }
-        await renderCover(
-          {
-            frameFileName: frameName,
-            text: bannerText,
-            // The RESOLVED theme — so the cover's banner already carries the
-            // config theme (F6) via resolveTheme's base, no separate wiring.
-            theme,
-            face: pick.face,
-            // The cover is the OUTPUT's thumbnail — a landscape render gets a
-            // landscape cover (R16 §76). The still was already extracted at
-            // this size; only the composition disagreed.
-            frame: { width: frame.width, height: frame.height },
-          },
-          { publicDir: work, outPath: coverPath, browserExecutable: cfg.browserExecutable },
-        );
+        // The shared builder, not an inline props literal: `ossclip cover`
+        // and the editor's regenerate endpoint call the same one, and two
+        // spellings of these arguments drifting apart is the defect that
+        // whole feature exists to prevent (cover.ts).
+        const coverRender = buildCoverRender({
+          frameFileName: frameName,
+          text: bannerText,
+          // The RESOLVED theme — so the cover's banner already carries the
+          // config theme (F6) via resolveTheme's base, no separate wiring.
+          theme,
+          face: pick.face,
+          // The cover is the OUTPUT's thumbnail — a landscape render gets a
+          // landscape cover (R16 §76). The still was already extracted at
+          // this size; only the composition disagreed.
+          frame: { width: frame.width, height: frame.height },
+          publicDir: work,
+          outPath: coverPath,
+          browserExecutable: cfg.browserExecutable,
+        });
+        await renderCover(coverRender.props, coverRender.opts);
         console.log(`✓ cover → ${coverPath}`);
+        // Provenance, so the next headline change costs seconds instead of a
+        // full re-render. Written AFTER the render succeeded and describing
+        // what that render actually used — `pick.face` is the cover-crop
+        // geometry nothing else on disk carries, and `cropVf` is not
+        // reconstructible from the workdir either.
+        //
+        // Additive by contract (§112, the posture the YouTube pack block
+        // below states): the video and the cover are already on disk, so a
+        // failed sidecar write is one loud line, never a dead run.
+        try {
+          await writeCoverProvenance(work, {
+            version: 1,
+            text: bannerText,
+            // "user" only when THIS run kept a headline someone typed
+            // (coverTextHold above) — produce itself never authors one.
+            textSource: heldCover.textSource,
+            frame: {
+              // produce keeps picking from the SOURCE — zero perturbation for
+              // existing users. `ossclip cover` is the one that defaults to
+              // the finished render.
+              source: "source",
+              timeSec: pick.timeSec,
+              face: pick.face ?? null,
+              hasFace: pick.hasFace,
+              sharpness: pick.sharpness,
+              fileName: frameName,
+              // Workdir-relative when the video IS a workdir intermediate (a
+              // folder run's concat mezzanine), absolute otherwise — the rule
+              // `ossclip cover` reads it back with.
+              sourceVideo: provenanceVideoPath(work, input),
+              // cropFilter returns "" for an uncropped source; null says "no
+              // crop" without a caller having to know that convention.
+              cropVf: cropVf || null,
+            },
+            size: { width: frame.width, height: frame.height },
+            out: coverPath,
+          });
+        } catch (err) {
+          console.log(
+            `  ⚠ could not write ${COVER_PROVENANCE_BASENAME} ` +
+              `(${err instanceof Error ? err.message : String(err)}) — ` +
+              `the cover shipped; a later headline change will re-pick the frame`,
+          );
+        }
       }
     }
   }
@@ -4191,14 +4772,20 @@ export async function produce(inputArg: string, opts: ProduceOptions): Promise<P
     } else {
       // Beat-sheet cache shape: keyed on everything that changes the answer —
       // who is asked, with what editorial steer, about which words.
-      const packKey = createHash("sha1")
+      // Parameterized on the provider for the §143 read/write split: the
+      // write below re-keys on who actually answered the pack call.
+      const packKeyFor = (p: string): string => createHash("sha1")
         .update(
           JSON.stringify([
             // Prompt changes change the answer (the §78 posture): the v2
             // rewrite must not serve a pack cached under v1's questions.
             YOUTUBE_PROMPT_VERSION,
-            providerName,
+            p,
             opts.llmModel ?? "",
+            // Appended only when set — the plan-cache rule (§78 via §143's
+            // effort knob): an unset effort must keep every warm workdir's
+            // key byte-identical, and a changed effort is a different answer.
+            ...(llmEffort !== undefined ? [llmEffort] : []),
             opts.intent ?? "",
             // Steer, so part of the key — a changed audience is a different
             // pack, not a cache hit.
@@ -4214,7 +4801,7 @@ export async function produce(inputArg: string, opts: ProduceOptions): Promise<P
         )
         .digest("hex")
         .slice(0, 8);
-      const packCache = join(work, `youtube-${packKey}.json`);
+      const packCache = join(work, `youtube-${packKeyFor(providerName)}.json`);
       if (existsSync(packCache)) {
         pack = YoutubePackSchema.parse(JSON.parse(await readFile(packCache, "utf8")));
         console.log("▸ youtube: metadata cached");
@@ -4234,7 +4821,15 @@ export async function produce(inputArg: string, opts: ProduceOptions): Promise<P
               durationSec: map.outputDuration,
             }),
           );
-          await writeFile(packCache, JSON.stringify(pack, null, 2));
+          // §143 read/write split, same as the plan and repair caches: the
+          // pack files under whoever wrote it.
+          await writeFile(
+            join(
+              work,
+              `youtube-${packKeyFor(actualProvider(provider!.usage, "youtube_pack", providerName))}.json`,
+            ),
+            JSON.stringify(pack, null, 2),
+          );
         } catch (err) {
           // NEVER cache a failure (§106), and never fail the produce that
           // just rendered over a metadata sidecar: one loud line, the video
@@ -4300,84 +4895,8 @@ export async function produce(inputArg: string, opts: ProduceOptions): Promise<P
       });
     }
   }
-  // Record THIS invocation so the editor's Render button can replay it (R11
-  // Task 4). Nothing else can reconstruct it — production.json has the
-  // source path, cleanup and intent, but not --produce, --out or the LLM
-  // flags — and guessing would silently render a different video than the
-  // one on screen. execArgv carries the module loader (tsx in dev), so the
-  // replay works from source and from a compiled build alike.
-  // The provider may have been AUTO-DETECTED from this shell's environment
-  // (a GEMINI_/ANTHROPIC_ key exported here). The editor's Render replays
-  // this argv from the EDIT SERVER's environment, which may not have that
-  // key — and the auto-detection would then silently pick a DIFFERENT
-  // provider (R16 §75). Pin the RESOLVED choice into the recorded args —
-  // never the key itself; secrets stay out of the workdir — so a replay
-  // uses the same configuration or fails loudly asking for it.
-  // §93g: pin the RESOLVED window, exactly as §75 pinned the provider. The
-  // editor's Render replays this argv; if replay re-asked the model and got a
-  // slightly different window, every saved override — anchored to scene ids
-  // and word indices — would land on the wrong words. The word range, not
-  // just `--clip 60`, is what makes replay deterministic with zero LLM calls.
-  //
-  // §129: NOT process.argv. A wizard or bare-path run re-enters commander
-  // with a BUILT argv while process.argv still holds the original invocation
-  // (`ossclip <path>`, no `produce` literal, none of the wizard's answers) —
-  // recording process.argv shipped a command that replays as
-  // `ossclip <path> --llm …` and dies on "unknown option '--llm'".
-  // recordedProduceArgs prefers the argv the re-entry stashed and falls back
-  // to process.argv for a directly typed `ossclip produce …`, which stays
-  // byte-identical to what was always recorded.
-  // Watermark pin, same §75 shape, and in BOTH directions (review,
-  // Important): the effective default comes from THIS machine's
-  // ~/.ossclip/config.json, so an unpinned record replays differently
-  // wherever that config differs — an off-run would silently gain a credit
-  // under a later/foreign config-on, an on-run would silently lose it. The
-  // RESOLVED state is always pinned; a typed flag is already in the argv and
-  // the includes-guard leaves it alone.
-  // Captions pin: the FLAG's resolved state (`opts.captions ?? true`), never
-  // the override-inclusive `captionsHidden` — overrides.json travels with
-  // the workdir and is re-read on every replay, so pinning --no-captions
-  // because the EDITOR hid them would freeze an edit the user may later
-  // undo in that same editor. See recordedProduceArgs for why the pin is
-  // unconditional even though captions' default is config-independent today.
-  // Jump-cuts pin: the RESOLVED mode, but only its typed states reach the
-  // argv — "auto" has no flag spelling and stays unpinned (see
-  // recordedProduceArgs for why that is safe today).
-  // Youtube pin: the watermark's config-dependent-default rationale exactly —
-  // resolved both ways, so a later config edit can't flip what Render
-  // replays. Portrait and dictionary pin the RESOLVED values (a path and
-  // terms, never a secret) for the same reason; recordedProduceArgs owns
-  // the non-empty/includes guards.
-  const recordedArgs = recordedProduceArgs({
-    llm: provider ? providerName : undefined,
-    clipWindow: clipWindow ? `${clipWindow.startWord}:${clipWindow.endWord}` : undefined,
-    watermark,
-    captions: opts.captions ?? true,
-    jumpCuts: jumpCutsMode,
-    dictionary,
-    youtube,
-    portrait,
-    audience,
-    thumbnailBrief,
-  });
-  await writeFile(
-    join(work, "command.json"),
-    JSON.stringify(
-      {
-        execPath: process.execPath,
-        execArgv: process.execArgv,
-        script: process.argv[1],
-        args: recordedArgs,
-        cwd: process.cwd(),
-        out: outPath,
-      },
-      null,
-      2,
-    ),
-  );
-  // Every produce run is a project the picker should offer (R17 §83) —
-  // best-effort, so a read-only home dir never fails the render.
-  await recordRecentProject(work);
+  // command.json was recorded above the --no-render exit (cut-review step 1)
+  // — see the block before that fork for the §75/§93g/§129 pinning story.
   console.log(formatPhaseLine(phases.timings(), phases.totalMs()));
   console.log(`✓ done → ${outPath}`);
   if (isInteractive()) {