feat(connector): build a QC review session for a whole project

Build QC Review Session (QC section) makes a QC_{shot}_{version} comp
for every shot in the project's QC queue. The export sits over its
earlier versions and plates, and only the export and the main plate are
switched on. Each scene also gets a continuous edit, cut to the edit
with the handles trimmed, and a contact sheet. QC Pass/Fail now act on
the shot comp in the viewer, the selected shot in a scene comp, or the
shot under the playhead in a scene edit, and label the result
green/red. The QC queue now also returns seqTimecodeStart, handleHead
and handleTail.

Compare Versions now lines versions up by EXR timecode, then by file
frame number. It used to use Export.frameStart, which is
timecode-anchored, not 1001-based.

Also includes Keep AEP (panel 2.9.0): Queue Export saves a reduced
.aep copy in each export's version folder.

Panel 2.10.0. Not yet run in After Effects.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.claude/launch.json

@@ -0,0 +1,11 @@
+{
+  "version": "0.0.1",
+  "configurations": [
+    {
+      "name": "web",
+      "runtimeExecutable": "npm",
+      "runtimeArgs": ["run", "dev"],
+      "port": 3000
+    }
+  ]
+}

.gitignore

@@ -32,5 +32,5 @@ yarn-error.log*
 *.tsbuildinfo
 next-env.d.ts
 
-# Local tooling
+# RenderWorker build output is covered by RenderWorker/.gitignore (bin/, obj/,
-RenderWorker/
+# publish/) — the worker's source is tracked like the rest of the repo.

BlenderPanel/README.md

@@ -0,0 +1,96 @@
+# VFXReview — Blender Submit
+
+A Blender add-on that queues the open `.blend` on the studio render farm instead
+of rendering it locally. Ctrl+F12, but on the farm.
+
+---
+
+## What a Blender job is (and is not)
+
+Deliberately the simplest thing in the pipeline: **a queue entry and nothing
+more**. It has no Export, takes no shot version, and is never validated, QC'd or
+delivered. The `.blend` is expected to be ready to render — output path, format
+and frame range already set — and the farm just runs it.
+
+That is the whole difference from an After Effects export, which is a shot
+submission and carries the full lifecycle behind it.
+
+---
+
+## Install
+
+1. **Edit → Preferences → Add-ons → Install…** and pick `vfxreview_submit.py`.
+2. Enable **Render: VFXReview — Submit Render**.
+3. Expand its preferences and set:
+
+| Setting | Value |
+|---|---|
+| **Server URL** | `https://review.twotalesvfx.com` |
+| **API Key** | matches `API_SECRET_KEY` on the server (same key the AE panel uses) |
+| **Artist Email** | recorded against the job so the queue shows who submitted it |
+
+The panel appears under **Properties → Output → VFXReview**.
+
+---
+
+## Submitting
+
+1. **Refresh Projects** (the circular arrow) and pick the project.
+2. Optionally set a **Label** — defaults to the `.blend` filename, and is what
+   the render queue shows, since there is no shot code.
+3. **Urgent** makes the job claimable outside the render window, ahead of normal
+   work.
+4. **Submit to Render Farm**.
+
+The panel shows the frame range, engine and output path it will send, read from
+the file as saved. Nothing is changed on submission.
+
+**The file must be saved first.** The farm opens the `.blend` from disk, so
+unsaved changes would render the previous state without warning — the add-on
+refuses to submit a dirty file rather than let that happen.
+
+Track the job on the web app under **Pipeline → Blender renders**: live
+progress, current frame, ETA and the machine running it, with cancel and requeue.
+
+---
+
+## Which machines can render it
+
+Only workers with `blenderPath` set in their `config.json` and the executable
+present. The worker reports Blender at registration and the server hands
+`BLENDER_RENDER` jobs only to machines that have it — a machine without Blender
+can never claim work it could only fail.
+
+Verify on a worker with:
+
+```powershell
+.\VFXReviewWorker.exe --check
+```
+
+Blender is listed as optional there: a machine without it stays perfectly valid
+for After Effects work.
+
+---
+
+## Notes
+
+**Paths must resolve on the render machine.** The `.blend` path and its output
+path are submitted as the artist sees them; the worker applies its own
+`pathMappings` before opening the file. A path on a drive letter the render
+account cannot see is the most common reason a job fails immediately.
+
+**Renders as saved.** The add-on sends the scene's own settings. The manifest
+supports overrides (samples, resolution %, device, engine) for future use, but
+nothing in the UI sets them today — one place for render settings is the point.
+
+**Exit code 0 with no frames is treated as a failure.** Blender exits cleanly
+when a frame range is empty or an output path is unwritable, so the worker
+checks that frames were actually saved before reporting success.
+
+**The add-on sends its own User-Agent** (`VFXReviewBlender/<version>`). Python's
+`urllib` otherwise identifies itself as `Python-urllib/3.x`, which Cloudflare
+blocks outright as a scripted signature — a 403 with error 1010 before the
+request ever reaches the server. Verified against the live zone: `Python-urllib`
+gets 403, the add-on's own agent gets 200. If a future Cloudflare rule blocks it
+anyway, the add-on says so in plain language rather than showing the raw JSON,
+and the fix is a WAF allow rule on the agent or on `/api/ext/*`.

BlenderPanel/vfxreview_submit.py

@@ -0,0 +1,289 @@
+bl_info = {
+    "name": "VFXReview — Submit Render",
+    "author": "Two Tales",
+    "version": (1, 0, 2),
+    "blender": (3, 6, 0),
+    "location": "Properties > Output > VFXReview",
+    "description": "Queue this .blend on the studio render farm instead of rendering locally",
+    "category": "Render",
+}
+
+import json
+import os
+import urllib.error
+import urllib.request
+
+import bpy
+from bpy.props import BoolProperty, EnumProperty, StringProperty
+from bpy.types import AddonPreferences, Operator, Panel
+
+
+# ── Preferences (per artist machine, like the AE panel's Settings) ────────────
+
+class VFXRPreferences(AddonPreferences):
+    bl_idname = __name__
+
+    server_url: StringProperty(
+        name="Server URL",
+        default="https://review.twotalesvfx.com",
+    )
+    api_key: StringProperty(
+        name="API Key",
+        subtype="PASSWORD",
+        description="Matches API_SECRET_KEY on the server",
+    )
+    artist_email: StringProperty(
+        name="Artist Email",
+        description="Recorded against the job so the queue shows who submitted it",
+    )
+
+    def draw(self, context):
+        col = self.layout.column()
+        col.prop(self, "server_url")
+        col.prop(self, "api_key")
+        col.prop(self, "artist_email")
+
+
+def prefs():
+    return bpy.context.preferences.addons[__name__].preferences
+
+
+ADDON_VERSION = ".".join(str(n) for n in bl_info["version"])
+USER_AGENT = "VFXReviewBlender/%s (Blender %s)" % (ADDON_VERSION, bpy.app.version_string)
+
+
+# ── API ───────────────────────────────────────────────────────────────────────
+
+def api_request(path, payload=None, method="GET"):
+    """Minimal JSON client. urllib keeps the add-on dependency-free."""
+    p = prefs()
+    if not p.server_url or not p.api_key:
+        raise RuntimeError("Set the server URL and API key in Add-on Preferences")
+
+    url = p.server_url.rstrip("/") + path
+    data = json.dumps(payload).encode("utf-8") if payload is not None else None
+    req = urllib.request.Request(url, data=data, method=method)
+    req.add_header("Authorization", "Bearer " + p.api_key)
+    req.add_header("Accept", "application/json")
+    # urllib identifies itself as "Python-urllib/3.x" by default, which
+    # Cloudflare blocks outright as a scripted signature (error 1010). Sending a
+    # real name for this tool is also the honest thing: the studio's logs should
+    # say what is calling them.
+    req.add_header("User-Agent", USER_AGENT)
+    if data:
+        req.add_header("Content-Type", "application/json")
+
+    try:
+        with urllib.request.urlopen(req, timeout=30) as res:
+            return json.loads(res.read().decode("utf-8"))
+    except urllib.error.HTTPError as e:
+        body = e.read().decode("utf-8", "replace")
+        try:
+            parsed = json.loads(body)
+        except Exception:
+            parsed = {}
+
+        # A Cloudflare block is not a pipeline error and reads nothing like one,
+        # so say what it actually is rather than showing the artist a wall of
+        # JSON about browser signatures.
+        if parsed.get("cloudflare_error") or parsed.get("error_code") == 1010:
+            raise RuntimeError(
+                "Blocked by Cloudflare before reaching the server (error %s). "
+                "The studio's firewall needs to allow this add-on — ask the pipeline TD."
+                % parsed.get("error_code", e.code)
+            )
+
+        message = parsed.get("error", body) if parsed else body
+        raise RuntimeError("Server said %s: %s" % (e.code, message))
+    except urllib.error.URLError as e:
+        raise RuntimeError("Could not reach %s (%s)" % (url, e.reason))
+
+
+_project_cache = []
+
+# Blender does not copy the strings an EnumProperty callback returns — Python
+# must keep a reference to them or the UI renders freed memory, which shows up
+# as garbled labels rather than as a crash. So the items are built once when the
+# project list changes and held here; the callback only ever returns this list.
+_enum_items = [("", "Refresh projects...", "")]
+
+
+def rebuild_enum_items():
+    global _enum_items
+    if _project_cache:
+        _enum_items = [
+            (p["code"], "%s - %s" % (p["code"], p["name"]), "")
+            for p in _project_cache
+        ]
+    else:
+        _enum_items = [("", "Refresh projects...", "")]
+    return _enum_items
+
+
+def project_items(self, context):
+    """Called on every redraw, so it does no work and allocates nothing."""
+    return _enum_items
+
+
+# ── Scene → job ───────────────────────────────────────────────────────────────
+
+def scene_summary(scene):
+    """
+    Everything the farm needs, read from the file as saved. The .blend is
+    expected to be ready to render, so nothing here changes settings — it only
+    reports them.
+    """
+    return {
+        "blendFile": bpy.data.filepath.replace("\\", "/"),
+        "scene": scene.name,
+        "frameStart": scene.frame_start,
+        "frameEnd": scene.frame_end,
+        "outputPath": bpy.path.abspath(scene.render.filepath).replace("\\", "/"),
+        "engine": scene.render.engine,
+        "blenderVersion": bpy.app.version_string,
+    }
+
+
+class VFXR_OT_refresh_projects(Operator):
+    bl_idname = "vfxreview.refresh_projects"
+    bl_label = "Refresh Projects"
+    bl_description = "Load the project list from the server"
+
+    def execute(self, context):
+        global _project_cache
+        try:
+            data = api_request("/api/ext/projects")
+        except RuntimeError as err:
+            self.report({"ERROR"}, str(err))
+            return {"CANCELLED"}
+
+        _project_cache = data.get("projects", [])
+        rebuild_enum_items()
+        self.report({"INFO"}, "%d project(s) loaded" % len(_project_cache))
+        return {"FINISHED"}
+
+
+class VFXR_OT_submit(Operator):
+    bl_idname = "vfxreview.submit"
+    bl_label = "Submit to Render Farm"
+    bl_description = "Queue this .blend on the farm instead of rendering locally"
+
+    def execute(self, context):
+        scene = context.scene
+        settings = scene.vfxreview
+
+        if not bpy.data.filepath:
+            self.report({"ERROR"}, "Save the .blend first — the farm opens it from disk")
+            return {"CANCELLED"}
+        if bpy.data.is_dirty:
+            # Unsaved changes would render the previous state without warning.
+            self.report({"ERROR"}, "Unsaved changes — save the file before submitting")
+            return {"CANCELLED"}
+        if not settings.project_code:
+            self.report({"ERROR"}, "Pick a project (Refresh Projects first)")
+            return {"CANCELLED"}
+
+        manifest = scene_summary(scene)
+        if manifest["frameEnd"] < manifest["frameStart"]:
+            self.report({"ERROR"}, "Frame end is before frame start")
+            return {"CANCELLED"}
+
+        label = settings.label.strip() or os.path.splitext(os.path.basename(bpy.data.filepath))[0]
+
+        try:
+            result = api_request(
+                "/api/ext/render/blender",
+                {
+                    "projectCode": settings.project_code,
+                    "label": label,
+                    "manifest": manifest,
+                    "submittedByEmail": prefs().artist_email or None,
+                    "urgent": settings.urgent,
+                },
+                method="POST",
+            )
+        except RuntimeError as err:
+            self.report({"ERROR"}, str(err))
+            return {"CANCELLED"}
+
+        job = result.get("job", {})
+        self.report(
+            {"INFO"},
+            "Queued '%s' — %d frames%s" % (label, job.get("frames", 0), " (urgent)" if settings.urgent else ""),
+        )
+        return {"FINISHED"}
+
+
+class VFXRSceneSettings(bpy.types.PropertyGroup):
+    project_code: EnumProperty(name="Project", items=project_items)
+    label: StringProperty(
+        name="Label",
+        description="Shown in the render queue. Defaults to the .blend filename",
+    )
+    urgent: BoolProperty(
+        name="Urgent",
+        description="Claimable outside the render window, ahead of normal jobs",
+        default=False,
+    )
+
+
+# ── UI ────────────────────────────────────────────────────────────────────────
+
+class VFXR_PT_submit(Panel):
+    bl_label = "VFXReview"
+    bl_space_type = "PROPERTIES"
+    bl_region_type = "WINDOW"
+    bl_context = "output"
+
+    def draw(self, context):
+        scene = context.scene
+        settings = scene.vfxreview
+        col = self.layout.column()
+
+        row = col.row(align=True)
+        row.prop(settings, "project_code", text="")
+        row.operator("vfxreview.refresh_projects", text="", icon="FILE_REFRESH")
+
+        col.prop(settings, "label")
+        col.prop(settings, "urgent")
+
+        box = col.box()
+        box.label(text="Renders as saved:", icon="INFO")
+        box.label(text="Frames %d–%d  (%d)" % (
+            scene.frame_start, scene.frame_end, scene.frame_end - scene.frame_start + 1))
+        box.label(text="Engine: %s" % scene.render.engine)
+        output = bpy.path.abspath(scene.render.filepath)
+        box.label(text="Output: %s" % (output[-48:] if len(output) > 48 else output))
+
+        if bpy.data.is_dirty or not bpy.data.filepath:
+            warn = col.row()
+            warn.alert = True
+            warn.label(text="Save the file before submitting", icon="ERROR")
+
+        col.separator()
+        col.operator("vfxreview.submit", icon="RENDER_ANIMATION")
+
+
+classes = (
+    VFXRPreferences,
+    VFXRSceneSettings,
+    VFXR_OT_refresh_projects,
+    VFXR_OT_submit,
+    VFXR_PT_submit,
+)
+
+
+def register():
+    for cls in classes:
+        bpy.utils.register_class(cls)
+    bpy.types.Scene.vfxreview = bpy.props.PointerProperty(type=VFXRSceneSettings)
+
+
+def unregister():
+    del bpy.types.Scene.vfxreview
+    for cls in reversed(classes):
+        bpy.utils.unregister_class(cls)
+
+
+if __name__ == "__main__":
+    register()

DELIVERY_WORKFLOW.md

@@ -0,0 +1,367 @@
+# Delivery Packages — Workflow Guide
+
+How a finished shot becomes a dated folder ready to upload to the client.
+
+There are two kinds of package. An **EXR delivery** is the shippable one and is
+what most of this guide describes. A **MOV review** is a flat folder of preview
+MOVs shared for a formal review — see
+[MOV review packages](#mov-review-packages) at the end.
+
+This is the operational guide. The design rationale and normative rules live in
+[RenderPipeline2.md](RenderPipeline2.md) §11.
+
+---
+
+## The short version
+
+1. A shot renders, validates, gets a preview, and **passes QC** → it becomes
+   eligible for delivery.
+2. On **Pipeline → Deliveries**, pick the project, see *"Episode 101 — Ready:
+   18 shots"*, click **Build delivery**.
+3. A render worker builds the folder on the delivery volume, verifies every
+   file, and writes a manifest and CSV report.
+4. A human uploads that folder to the client and clicks **Record upload**,
+   pasting the link to where it now lives.
+5. They send the client that link and click **Share link**, recording who it
+   went to. Only then is the package `DELIVERED`.
+
+Nothing is ever sent to the client automatically. Steps 4 and 5 are deliberately
+manual — but until both are recorded the package sits in **Awaiting delivery**
+at the top of the dashboard.
+
+---
+
+## What makes a shot eligible
+
+An Export reaches `READY_FOR_DELIVERY` only by passing QC — from the AE panel
+or the web. That is the single gate; there is no way to package an export that
+has not been QC'd.
+
+A render that failed automated validation can still get there: **Override
+validation** on the Export detail page (admin/producer/supervisor, reason
+required) resumes the pipeline at the preview stage, so the shot still goes
+through QC like any other. The failed checks stay on record and keep appearing
+as warnings in the QC queue, so whoever QCs it knows what was waved through.
+
+Two rules worth knowing:
+
+- **Newest version per shot only.** If a shot has two exports sitting ready, the
+  older one is history and is not offered. Building refuses outright if you
+  somehow select two versions of the same shot.
+- **Version locking.** A package references the exact Export rows it was built
+  from and copies the shot code and version string at creation time. Re-render a
+  shot afterwards and the package is untouched — delivery history is immutable
+  by construction.
+
+---
+
+## Building a package
+
+**Pipeline → Deliveries**, choose a project. Each episode with ready shots shows
+its count and the shots themselves, with frame counts and sizes.
+
+**Build delivery** creates the package (`QUEUED`) and a `DELIVERY_BUILD` job on
+the same queue the renders use. Requires **admin, producer or supervisor**.
+
+Delivery jobs run at priority 10, which is inside the urgent threshold — so they
+claim immediately even during work hours, when a render would wait for the
+evening window. Packaging is file work with no After Effects involvement, so it
+does not disturb an artist at the machine.
+
+Watch the package status on the same page:
+
+| Status | Meaning |
+|---|---|
+| `QUEUED` | Waiting for a worker to pick it up |
+| `BUILDING` | A worker is creating folders and linking files |
+| `READY` | Built and verified. Shown as *Built — not uploaded*, then *Uploaded — link not shared* |
+| `DELIVERED` | The upload location and who the link was sent to are both on record |
+| `FAILED` | Something did not verify — see the error and the per-shot list |
+| `CANCELLED` | Abandoned before delivery |
+
+---
+
+## What lands on disk
+
+Default layout (the studio's confirmed structure):
+
+```
+{deliveryRoot}/{episode}/{YYMMDD}_Delivery/
+├── {SHOT_CODE}/
+│   ├── {shot}_cmp_TT_{ver}.[#####].exr     ← the EXR sequence
+│   └── {shot}_cmp_TT_{ver}.mov             ← slate/burn-in delivery MOV
+├── manifest.json                            ← every file, size, checksum, source export
+└── {YYMMDD}_Delivery_report.csv             ← one row per shot (client-facing)
+```
+
+EXRs and the MOV sit side by side in each shot folder — no `exr/` and `mov/`
+subfolders, matching current practice.
+
+The CSV carries: shot, version, frame range, frame count, file count, bytes,
+checksum, MOV filename and status. Confirm these columns against the
+production's delivery spec before the first real delivery.
+
+---
+
+## Hard links, and why the package appears instantly
+
+Files are **hard-linked**, not copied, when the source and destination are on the
+same volume. A hard link is a second name for the same data — not a shortcut and
+not a copy — so an 18-shot EXR package builds in seconds and consumes
+essentially no extra disk.
+
+Verified on the studio SAN (`\\TRUENAS\vfx` over SMB): hard links work there, and
+renders and deliveries live on the same share.
+
+**Is that safe?** Deleting the delivery folder does not delete the render — the
+data survives until the last name referring to it is gone. And nothing in the
+pipeline ever rewrites an existing EXR: a new version is always a new directory.
+
+Two escape hatches:
+
+- A delivery root on a **different volume** falls back to copying automatically.
+- `"copyMode": "always-copy"` in the project's delivery config forces real copies
+  for a production that mandates physical separation.
+
+The `linkMode` column on each item records what actually happened, so a package
+never claims to have linked when it copied.
+
+---
+
+## Verification
+
+Verification is proportional to what the builder actually did, which is what
+keeps a package fast:
+
+| Mode | How it verifies | Cost for a 25-shot episode |
+|---|---|---|
+| **Hard-linked** (default) | The entry *is* the source data, so the validation-time digest already describes it. Checks each file exists, and that no source was modified after it passed QC. | seconds |
+| **Copied** | Read back in full and hashed; the sequence digest must match the one recorded at validation. | ~30 s per 2.8 GB shot |
+
+Re-reading a hard link cannot disagree with validation — it is the same bytes
+under a second name — and at ~100 MB/s over SMB it costs roughly half an hour
+per episode to prove something that cannot be false. A copy is genuinely
+different: it can be truncated or corrupted, so it is always read back.
+
+Set `"verifyMode": "always-hash"` in the delivery config to read everything back
+regardless, for a production that requires it contractually.
+
+An item fails, and the whole package fails with it, when:
+
+| Failure | Meaning |
+|---|---|
+| Checksum mismatch (copied items) | The delivered bytes differ from what passed QC |
+| A source file modified after validation | The render changed after it passed QC — a link would carry the new bytes faithfully |
+| Frame count differs from the export record | The render folder changed after QC — someone re-rendered in place |
+| Source folder missing | The render is not where the export says it is |
+| No matching files | The folder exists but holds nothing matching the output pattern |
+
+**A package only reaches `READY` when every shot verified.** One bad shot means
+`FAILED`, and no export is marked as packaged — there is no partial delivery.
+
+A missing delivery MOV is the one non-fatal case: the EXRs are the deliverable,
+so it is logged and the package continues without it.
+
+> **Without validation there is nothing to verify against.** An export whose
+> checksum was never recorded (validation disabled, or rendered before it
+> shipped) still packages, but the digest is computed with nothing to compare it
+> to. The ready list flags these as *"N without a validation checksum"*.
+
+---
+
+## Marking delivered
+
+A built package is not a delivered one, so delivery is two recorded steps. Both
+require admin, producer or supervisor.
+
+1. **Record upload** — paste the link to the folder on the client's portal and
+   confirm it matches the shot, frame and MOV counts shown. The link can be
+   corrected until it is shared.
+2. **Share link** — copy the generated message (link, shots, versions), send it,
+   and record who it went to. This moves every packaged export to `DELIVERED`.
+
+The second step is refused until the first is on record. Meanwhile the package
+is listed under **Awaiting delivery** on the dashboard, amber after a day and
+red after two.
+
+This is still a human statement of fact — the client's portal has no API, so
+the app cannot see the upload itself. What it guarantees is that nothing reads
+as delivered without a link, a recipient, a name and a time behind it. Packages
+delivered before this existed show as delivered with no evidence recorded.
+
+---
+
+## Delivery requests
+
+When a client asks for something ("EXRs for 116"), log it so it cannot be
+forgotten. Requires admin, producer or supervisor.
+
+- **Dashboard → Awaiting delivery → Log request**, or the same button on
+  **Pipeline → Deliveries**: pick the project, then a whole episode or a pasted
+  list of shot codes (ours or the client's; a code that matches nothing is
+  refused rather than skipped).
+- **Shot Status → Bulk Actions → Log Delivery Request** for a ticked selection.
+
+The shot list is a snapshot taken when the request is logged. The request then
+sits in **Awaiting delivery** showing *"3 of 9 delivered"*, and on the
+deliveries page every shot shows where it stands: not through QC, in QC, ready
+to package, building, built, uploaded, delivered. **Build N ready** packages
+the shots that have passed QC.
+
+A request has no "done" button. A shot's line closes only when:
+
+- a package containing it is shared (step 2 of marking delivered) after the
+  request was logged, or
+- it is marked **Delivered Outside Pipeline** with the upload link and who the
+  link was sent to, dated on or after the day the request was logged. For a
+  shot on an open request those two fields are required.
+
+The request closes when every line has. A delivery made *before* the request
+was logged does not count — a client asking again is asking for it again. The
+only other way out is **Cancel request**, which needs a reason and stays in the
+history.
+
+The *Wanted* field (EXRs, MOVs, both) records what was asked for; it does not
+change what closes a line. A MOV-only ask is closed through Delivered Outside
+Pipeline, since a MOV review package has no delivered state.
+
+---
+
+## When something goes wrong
+
+**A package failed.** Expand it: every shot shows its own status and error. Fix
+the cause (usually a re-render after QC), then build a new package. Packages are
+never deleted; a mistaken one is cancelled.
+
+**The worker died mid-build.** The package is marked `FAILED` with *"check the
+package folder before rebuilding"*. It is deliberately not retried
+automatically — a half-written folder on the delivery volume is something a
+human should look at first.
+
+**Cancelling.** Only `DRAFT`, `QUEUED` and `FAILED` packages can be cancelled. A
+`READY` or `DELIVERED` package stays in the history permanently; supersede it by
+building a new one.
+
+---
+
+## Configuration
+
+Per project, in `Project.deliveryConfig`; studio-wide defaults in the
+`delivery.defaultConfig` SystemConfig key; built-in defaults otherwise. Merged
+key by key, so a project can override just `deliveryRoot`.
+
+```json
+{
+  "packageNameTemplate": "{yymmdd}_Delivery",
+  "layout": {
+    "packageDir": "{deliveryRoot}/{episode}/{packageName}",
+    "shotDir":    "{packageDir}/{shotCode}",
+    "reportFile": "{packageDir}/{packageName}_report.csv"
+  },
+  "deliveryRoot": "//SAN/DELIVERY",
+  "includeMovs": true,
+  "checksumAlgo": "xxh64",
+  "reportFormats": ["csv", "json"],
+  "copyMode": "auto",
+  "verifyMode": "auto"
+}
+```
+
+Tokens: `{showId} {episode} {yymmdd} {yyyymmdd} {packageName} {packageDir}
+{deliveryRoot} {shotCode} {versionString} {packageNumber}`.
+
+The resolved config is **snapshotted onto the package** at build time, so a
+historic package always shows the rules it was built with, and a production with
+a different spec is a config change rather than a code change.
+
+`deliveryRoot` must be reachable *from the worker machine* — check with
+`VFXReviewWorker.exe --check` if a build fails on paths.
+
+---
+
+## API
+
+| # | Method | Path | Purpose |
+|---|--------|------|---------|
+| E16 | `POST` | `/api/deliveries` | Create a package and queue the build |
+| E17 | `GET` | `/api/deliveries` | List packages / history |
+| E18 | `GET` | `/api/deliveries/ready` | Ready exports grouped by episode |
+| — | `POST` | `/api/deliveries/{id}/uploaded` | Record the upload: `{ uploadUrl, contentsConfirmed: true }` |
+| E19 | `POST` | `/api/deliveries/{id}/delivered` | Record the share and mark delivered: `{ sharedWith, note? }` |
+| — | `POST` | `/api/deliveries/{id}/cancel` | Cancel a package |
+| — | `GET` | `/api/delivery-requests` | List requests with per-shot stages (`?projectId=`, `?open=1`) |
+| — | `POST` | `/api/delivery-requests` | Log a request: `{ projectId, episode \| shotIds \| shotCodes, deliverable, requestedBy, dueDate?, note? }` |
+| — | `POST` | `/api/delivery-requests/{id}/cancel` | Cancel a request: `{ reason }` |
+| — | `POST` | `/api/ext/render/jobs/{jobId}/delivery` | Worker reports a build (API key) |
+
+`POST /api/deliveries` takes `{ projectId, episode?, exportIds?, options? }`.
+Omit `exportIds` to take every ready export in the episode; `options` accepts
+`date`, `name`, `includeMovs` and `copyMode` to override the config for one
+build.
+
+---
+
+## MOV review packages
+
+For a formal review you share the preview MOVs, not the EXRs. That is its own
+kind of package, built the same way and listed on the same page.
+
+### Building one
+
+**Shot Status**, tick the shots, then **Bulk Actions → Build MOV Review
+Package**. A dialog shows exactly what would be built before anything happens:
+the folder name, the version each shot contributes, and any shots being left
+out. Requires **admin, producer or supervisor**.
+
+The version each shot contributes is its **newest export that actually has a
+preview MOV** — not necessarily its newest export. A shot whose latest version
+is still rendering goes into the review as the version that can be watched.
+A shot with no MOV at all is listed as left out, with the reason, rather than
+quietly reducing the folder.
+
+### What lands on disk
+
+```
+{deliveryRoot}/PRODUCER_REVIEWS/20260828_Producer_review/
+├── EP6_VFX_012_v004.mov
+├── EP6_VFX_013_v002.mov
+└── UNG_106_010_040_cmp_TT_v001.mov
+```
+
+Flat — the MOVs sit beside each other so they can be scrubbed through in order.
+Names follow the same client-naming rule as a delivery: the production's own
+code where it has one, ours where it does not, so a shot reads identically in a
+review folder and in the delivery that follows it.
+
+The folder is **exactly the MOVs**: no CSV, no `manifest.json` beside them. The
+manifest still goes back to the app, so the record of what was shared is kept
+without cluttering the share.
+
+Second review the same day is `20260828_Producer_review_02`, then `_03`. A
+number is never reused, even if the package that took it was cancelled.
+
+### What it does not do
+
+**A review never moves a shot along.** Reviews happen throughout a shot's life,
+long before QC passes it, and the same version is routinely shown twice — so
+building one changes nothing about the exports in it, and there is no
+**Mark delivered** on a review package. Shots stay exactly where they are in
+the pipeline.
+
+A **missing MOV fails the package** here, unlike in an EXR delivery where a
+missing MOV is logged and the build continues. In a review the MOV is the
+deliverable, and a review folder quietly one shot short is worse than one that
+says so.
+
+### Configuration
+
+Two more keys in the same `deliveryConfig` (§11.6):
+
+```json
+{
+  "reviewNameTemplate": "{yyyymmdd}_Producer_review",
+  "layout": {
+    "reviewDir": "{deliveryRoot}/PRODUCER_REVIEWS/{packageName}"
+  }
+}
+```

EXT_API_REFERENCE.md

@@ -24,6 +24,30 @@ X-Api-Key: <API_SECRET_KEY>
 | `POST` | `/api/ext/shots` | Create a new shot |
 | `PATCH` | `/api/ext/shots/{shotId}` | Update shot fields (e.g. increment version) |
 
+### Render pipeline (RenderPipeline2)
+
+| # | Method | Path | Caller | Description |
+|---|--------|------|--------|-------------|
+| E1 | `POST` | `/api/ext/exports` | panel | Queue Export — creates Export + RenderJob |
+| E2 | `GET` | `/api/ext/exports/latest` | panel | Latest export + live status for the panel header |
+| E3 | `GET` | `/api/ext/exports/{exportId}` | panel/worker | Export detail incl. validations and QC |
+| E4 | `POST` | `/api/ext/exports/{exportId}/qc` | panel | QC Pass / QC Fail |
+| E5 | `GET` | `/api/ext/qc/queue` | panel | Exports in READY_FOR_QC |
+| E6 | `POST` | `/api/ext/workers/register` | worker | Register machine, receive tuning |
+| E7 | `POST` | `/api/ext/workers/{machineId}/heartbeat` | worker | Heartbeat + cancel channel |
+| E8 | `POST` | `/api/ext/render/jobs/claim` | worker | Atomically claim the next job |
+| E9 | `PATCH` | `/api/ext/render/jobs/{jobId}/progress` | worker | Progress/ETA; renews the lease |
+| E10 | `POST` | `/api/ext/render/jobs/{jobId}/fail` | worker | Report failure |
+| E11 | `POST` | `/api/ext/render/jobs/{jobId}/complete-render` | worker | aerender finished → VALIDATING |
+| E12 | `POST` | `/api/ext/render/jobs/{jobId}/validation` | worker | Report all validation results |
+| E13 | `POST` | `/api/ext/render/jobs/{jobId}/finalize` | worker | Preview artifacts done → READY_FOR_QC |
+| E14 | `POST` | `/api/ext/exports/{exportId}/retry` | panel | Retry a failed export |
+| E20 | `POST` | `/api/ext/render/jobs/{jobId}/artifact-presign` | worker | Presigned upload URL |
+| — | `POST` | `/api/ext/render/jobs/{jobId}/delivery` | worker | Report a DELIVERY_BUILD result |
+
+Session-authenticated twins for the web UI live under `/api/render/*` and
+`/api/deliveries/*` — same service layer, no API key.
+
 ---
 
 ## Shot Status Values
@@ -513,3 +537,10 @@ For reference, the endpoints called by `VFXReviewConnector.jsx`:
 | Populate Shot dropdown | `GET /api/ext/projects/{PROJECT_CODE}/shots?episode={value}` |
 | All shot operations (overlay, queue, preview, delivery) | `GET /api/ext/shots/lookup?shotCode={code}&projectCode={PROJECT_CODE}` |
 | Increment Shot Version | `PATCH /api/ext/shots/{shot.id}` with `{ "shotVersion": "v00X" }` |
+| Queue Export | `POST /api/ext/exports` (E1) |
+| Refresh Status / poll | `GET /api/ext/exports/latest` (E2) |
+| Retry Export | `POST /api/ext/exports/{id}/retry` (E14) |
+| Regenerate Previews | `POST /api/ext/exports/{id}/regenerate-preview` |
+| Load QC Queue | `GET /api/ext/qc/queue?projectCode={PROJECT_CODE}` (E5) |
+| Build QC Review Session | `GET /api/ext/qc/queue?projectCode={PROJECT_CODE}` (E5): uses `scene`, `episode`, `seqTimecodeStart`, `handleHead`, `handleTail` |
+| QC Pass / QC Fail | `POST /api/ext/exports/{id}/qc` (E4) |

README.md

@@ -166,6 +166,20 @@ prisma/                  — schema.prisma, seed.ts
 
 ---
 
+## Documentation
+
+| Doc | Covers |
+|---|---|
+| [RenderPipeline2.md](RenderPipeline2.md) | Render pipeline specification — normative design, state machine, API contracts |
+| [DELIVERY_WORKFLOW.md](DELIVERY_WORKFLOW.md) | Building and shipping delivery packages (how-to) |
+| [VFXReviewConnector.md](VFXReviewConnector.md) | After Effects panel — setup, Shot Builder, QC, diagnostics |
+| [RenderWorker/README.md](RenderWorker/README.md) | Render worker service — packaging, install, validation, delivery builds |
+| [BlenderPanel/README.md](BlenderPanel/README.md) | Blender add-on — queueing a .blend on the farm |
+| [EXT_API_REFERENCE.md](EXT_API_REFERENCE.md) | External API (`/api/ext/*`) used by the panel and workers |
+| [Shot task workflow.md](Shot%20task%20workflow.md) | Shot and task lifecycle in the web app |
+
+---
+
 ## License
 
 MIT

RenderPipeline2.md

@@ -207,7 +207,7 @@ stateDiagram-v2
 | T9 | VALIDATION_FAILED | QUEUED | Retry (full re-render) | User | new attempt; old validation rows kept for history |
 | T10 | GENERATING_PREVIEW | PREVIEW_FAILED | ffmpeg/upload failure | Worker | error stored |
 | T11 | PREVIEW_FAILED | GENERATING_PREVIEW | Retry preview | User | validation is NOT re-run |
-| T12 | GENERATING_PREVIEW | READY_FOR_QC | `finalize` report | Worker | `Version` row created (isLatest, **never client-shared**), thumbnail set, metadata JSON key stored; **no task/shot status change** — QC typically runs on already client-approved shots and must not disturb review state (Section 10) |
+| T12 | GENERATING_PREVIEW | READY_FOR_QC | `finalize` report | Worker | `Version` row created (isLatest, **never client-shared**), thumbnail set, metadata JSON key stored; `Shot.generatedThumbnailUrl` set when the project opts in (§9.1a) — never `Shot.thumbnailUrl`; **no task/shot status change** — QC typically runs on already client-approved shots and must not disturb review state (Section 10) |
 | T13 | READY_FOR_QC | QC_FAILED | `POST .../qc {FAIL}` | Artist (AE) or user (web) | `QCReview` row; task → CHANGES (drives existing Shot REVISIONS derivation) |
 | T14 | READY_FOR_QC | READY_FOR_DELIVERY | `POST .../qc {PASS}` | Artist / user | `QCReview` row |
 | T15 | READY_FOR_DELIVERY | PACKAGED | Delivery build completes | Worker | `DeliveryItem` links Export to package |
@@ -268,6 +268,9 @@ model Export {
   shot            Shot         @relation(fields: [shotId], references: [id])
   projectId       String
   taskId          String?      // comp task the preview Version attaches to
+                               // (E1 creates one named after the preview file
+                               //  when the shot has none, so the preview lands
+                               //  somewhere the app shows it)
   versionId       String?      // preview Version created at READY_FOR_QC
   versionNumber   Int          // 4
   versionString   String       // "v004"
@@ -448,6 +451,7 @@ model DeliveryPackage {
   projectId      String
   episode        String         // "101"
   name           String         // "260805_Delivery" (per 18.1-Q6 convention)
+  kind           DeliveryKind   @default(EXR_DELIVERY) // EXR_DELIVERY | MOV_REVIEW (§11.6)
   packageNumber  Int            // sequential per project → "Package #15"
   status         DeliveryStatus @default(DRAFT)
   rootPath       String?        // final path on delivery volume
@@ -464,6 +468,7 @@ model DeliveryPackage {
 
   @@unique([projectId, packageNumber])
   @@index([projectId, episode])
+  @@index([projectId, kind])
 }
 
 model DeliveryItem {
@@ -488,6 +493,8 @@ model DeliveryItem {
 
 **Version locking:** the package references `Export` rows, and items denormalise `shotCode`/`versionString` at creation. Later re-renders of a shot never mutate a package — delivery history is immutable by construction.
 
+**`kind`** distinguishes a shippable EXR delivery from a MOV review folder (§11.6). Both use these two models and the same `DELIVERY_BUILD` job; only a review leaves `exrPath` null, and only a delivery advances its exports to PACKAGED/DELIVERED.
+
 ### 5.8 Changes to existing models (additive only)
 
 | Model | Addition | Purpose |
@@ -579,6 +586,19 @@ Uploaded by the AE panel on Queue Export; snapshotted verbatim into `RenderJob.m
     "alpha": false,
     "timecodeStart": "00:59:49:12"
   },
+  "source": {
+    "startSource": "footage metadata",
+    "handleFrames": 8,
+    "timingPlate": {
+      "path": "V:/_FOOTAGE/UNG/UNG_106/UNG_106_010_020_BG01_TT_v001/UNG_106_010_020_BG01_TT_v001.01001.exr",
+      "frameStart": 1001,
+      "frameEnd": 1120
+    },
+    "plates": [
+      { "element": "BG01_TT_v001", "path": "V:/_FOOTAGE/UNG/UNG_106/UNG_106_010_020_BG01_TT_v001/UNG_106_010_020_BG01_TT_v001.01001.exr", "frameStart": 1001, "frameEnd": 1120 },
+      { "element": "FG01_TT_v001", "path": "V:/_FOOTAGE/UNG/UNG_106/UNG_106_010_020_FG01_TT_v001/UNG_106_010_020_FG01_TT_v001.01001.exr", "frameStart": 1001, "frameEnd": 1120 }
+    ]
+  },
   "preview": {
     "template": "default",
     "burnins": true
@@ -588,6 +608,15 @@ Uploaded by the AE panel on Queue Export; snapshotted verbatim into `RenderJob.m
 
 The server validates the manifest with Zod, cross-checks `shotId`/`shotCode`/frame range against the DB, and **the server (not the panel) decides the new version number** — race-free single source of truth.
 
+**`source` (required from manifestVersion 2)** — the plate provenance the timecode check depends on (§8.1a). The panel resolves these from the *comp's own footage layers*, not by re-deriving paths, so the manifest records what was actually comped:
+
+- `timingPlate` — the delivered plate the render's timecode is checked against. A shot's elements routinely carry unrelated camera timecodes, so "the plate" must be named explicitly rather than guessed by the worker. **Only footage under the Footage Root qualifies**: a comp usually also holds pre-renders and CG passes of identical length, and anchoring on one of those is circular — it was rendered from this comp, so it can only ever agree with it, including when both are wrong. Among delivered plates, longest duration wins.
+- `frameStart`/`frameEnd` on a plate are its **own file numbering**, and are omitted when the filename carries no frame number. They are never filled from the comp's frame range: the render's first frame is in output numbering, so a comp-frame anchor skews the comparison by the gap between the two systems.
+- `startSource` — verbatim from the panel's existing start-frame resolution: `"footage metadata"` (probed from the plate, trustworthy) or `"API timecode …"` (fallback, suspect). This is known at queue time, so an export built from the API fallback can be flagged **before** it burns render hours.
+- `plates[]` — every element imported into the comp, for the record and for cross-element diagnostics.
+
+Manifests without `source` (manifestVersion 1) are still accepted; the timecode check degrades per §8.1a.
+
 ### 6.3 Endpoint summary
 
 | # | Method | Path | Auth | Caller | Purpose |
@@ -1009,15 +1038,64 @@ Runs on the worker immediately after a successful render (Export = VALIDATING).
 | `exr_type` | header: scanline vs tiled, compression | ≠ `expected.exrCompression` (WARN if compression differs but readable; FAIL if not valid EXR) |
 | `alpha_channel` | channel list contains A | presence ≠ `expected.alpha` |
 | `colourspace` | EXR metadata (`chromaticities` / ACES container flag / colorspace attr written by AE OCIO) | ≠ `expected.colorspace` (working space is linear ACES2065-1 per 18.1-Q4); `colorPipeline` is required per project (18.1-Q12), so SKIPPED only on legacy projects predating pipeline enablement |
-| `timecode_consistency` | EXR `timeCode` attr across sampled frames | non-monotonic, or first frame ≠ `expected.timecodeStart` when set |
+| `timecode_plate_match` | **primary check — see §8.1a** | render `timeCode` ≠ the timing plate's `timeCode` at the corresponding frame |
+| `timecode_consistency` | EXR `timeCode` attr across sampled frames | non-monotonic (gap, repeat, or frozen value) |
+| `timecode_fps` | EXR `framesPerSecond` on the render vs manifest `fps` | any disagreement |
+| `plate_fps` | EXR `framesPerSecond` on the render vs **the timing plate's** | WARN on any difference — never FAIL: a whole-number multiple is a legitimate over-crank (50 fps plate on a 25 fps show), and anything else is reported as a probable rate mistake |
 | `zero_byte / corrupt` | every file size > 0; oiiotool header-read on sampled frames (first, last, every Nth) | any zero-byte or unreadable file |
 
 Full-sequence checks (count, gaps, names, sizes) run on every file; header checks sample first/middle/last + every 25th frame (fast, catches systemic issues; per-frame full decode is not worth minutes per shot — tunable via `SystemConfig: validation.sampleEvery`).
 
+**Two coordinate systems, never conflated.** A render carries frame numbers in two unrelated systems, and every check states which one it uses:
+
+| | Meaning | Example |
+|---|---|---|
+| `frameStart`/`frameEnd` | The **comp's timeline**, handed to aerender as `-s`/`-e`. A comp anchored to its plate's timecode starts at the absolute frame that timecode represents. | `1247792`–`1247896` |
+| `outputFrameStart` | The number the **first output file** carries, set by the output module template. House convention: every sequence starts at 1001. | `1001` |
+
+`file_count`, `missing_frames` and `duplicate_frames` are measured on the *output* numbering; `first_frame`/`last_frame` compare against `outputFrameStart` and are SKIPPED when a manifest predates the field, since the count and contiguity checks still hold. Comparing file numbers against comp frames fails every correctly-rendered shot by ~1.2 million frames, and the timecode reference must be anchored on the render's own first frame for the same reason.
+
+### 8.1a Timecode: the primary check (studio decision)
+
+Timecode is the check this engine exists for. It is validated **against the source plate**, never against the API, because the API and the plate do not agree by design.
+
+**Measured on the live show (2026-08-13, 85 rendered sequences + 106 delivered sequences on `V:/`):**
+
+- AE-written EXRs *do* carry `timeCode` (plus a `timeCodeString` mirror) and `framesPerSecond` — the §17.3 "metadata may be absent" risk does not apply to the studio's current EXR output module. A render whose TC is absent means the output module changed, and is a FAIL.
+- `Shot.timecodeStart` from the API is the **editorial in-point**; the plate on disk starts `handleFrames` earlier. Measured on three shots, the API value was consistently the plate's TC **+8 frames** — the exact handle count. Validating a render against the API would therefore **pass the defective exports and fail the correct ones**: on `UNG_102_019_010` the correctly-built render (`18:58:57:12`, matching its BG01 plate) differs from the API value (`18:58:57:20`), while on `UNG_102_040_010` the *defective* render matches the API exactly and is 8 frames off its plate.
+- 95 of 106 delivered sequences match their plate's timecode exactly. The 11 that do not fall into three classes this check catches: **+8 handle offset** (comp anchored to the editorial in-point instead of the plate head), **frame-derived TC** (`00:00:41:17` = frame 1001 at 24 fps, i.e. a comp with no source timecode at all — also seen as `00:00:00:00`), and **one timecode shared across four different shots** in a single delivery package.
+
+**Reference precedence** — the check records which source it used and never silently substitutes a weaker one:
+
+| Rank | Source | Verdict semantics |
+|---|---|---|
+| 1 | `source.timingPlate` from the manifest — the element the comp was actually anchored to | PASS / FAIL, authoritative |
+| 2 | Plate re-derived on the worker from the footage root + shot code (manifestVersion 1, or a timing plate that no longer resolves). If elements disagree, the one matching the render's frame count wins; still ambiguous → WARN, never PASS | PASS / FAIL, `reference: "derived"` |
+| 3 | API `Shot.timecodeStart` **minus `handleFrames`** | **WARN only, never PASS** — `reference: "api"`, message states the plate could not be read |
+
+**Several delivered elements.** When the rank-1 timing plate does not match, the worker tries the manifest's other `plates[]` before failing — the panel's longest-duration pick is not always the element the comp was anchored to. A match against one of them is a PASS naming that element; no match still FAILs against the timing plate, listing the others tried. Only delivered footage qualifies: plates under a configured plate search root, or (with none configured) alongside the timing plate in its footage folder. `plates[]` also holds pre-renders, which agree with the render by construction and must never rescue it.
+
+Rank 3 is a diagnostic, not a verification: it depends on the show's handle count being correct for that specific plate, which is exactly the assumption the defects above violate.
+
+**Comparison, given the plate reference:**
+
+```
+expectedTc = plateTc + (render.frameStart - plate.frameStart)     // frames, at manifest fps
+```
+
+The offset term matters — a shot may render a sub-range of a long plate (observed: 37 rendered frames from a 709-frame plate). Sampled frames must then increment by exactly one frame each; a constant value across the sequence is the frame-derived-TC defect, not a rounding artifact. `timeCodeString` is cross-checked against the packed `timeCode` as a writer sanity check.
+
+**Queue-time pre-flight.** The panel already knows whether it read the start time from the plate's metadata or fell back to the API (`source.startSource`). When the manifest says the API fallback was used, the Export is flagged at queue time — the render is very likely to fail this check, and there is no point spending machine hours to find out.
+
+**Delivery-package cross-check (Phase 5).** Within one package, two shots sharing a first-frame timecode is a FAIL on the package: it is cheap, and it is precisely the defect that reached a built delivery package above.
+
+**Tooling note.** `timeCode`, `timeCodeString` and `framesPerSecond` live in the EXR header, so this check needs one 64 KB read per sampled frame and no pixel decode — the header parse is ~40 lines (attribute list: `name\0 type\0 int32 size data`; `timeCode` is two `uint32`, the first packed SMPTE 12M BCD, which reads back as its own hex digits: `0x18585712` → `18:58:57:12`). It does **not** depend on oiiotool, so the timecode check can ship ahead of the OIIO-based resolution/bit-depth/channel checks.
+
 ### 8.2 Semantics
 
 - Any FAIL → whole run FAIL → Export = VALIDATION_FAILED, pipeline stops, exact reasons in `ValidationResult` rows (E12 example above shows a missing-frame report).
 - WARN never stops the pipeline but is shown in QC and delivery UIs.
+- **Manual override.** A check can fail on a render that is genuinely fine — an unreachable plate, an expectation that does not apply to this shot — so a VALIDATION_FAILED export is not a dead end. An admin/producer/supervisor can override it from the Export detail page with a **required reason**, and the pipeline resumes exactly where a pass would have handed off: preview, then READY_FOR_QC. **An override never skips QC and never delivers directly** — a human still looks at the frames. The failed `ValidationResult` rows are left untouched, so the QC queue keeps listing them as warnings, and the reason plus the checks waved through are recorded on the Export's timeline.
 - Checksum: xxHash64 per file, sequence digest = xxHash64 of sorted per-file digests; stored on `Export.checksum` and reused by the delivery builder for copy verification (MD5 available for the client-facing manifest per 18.1-Q13).
 
 ---
@@ -1031,18 +1109,36 @@ Runs on the worker after validation passes (Export = GENERATING_PREVIEW).
 ### 9.1 Stages
 
 1. **Build + render preview comp (AE, headless).** The worker launches `AfterFX.com -noui -r vfxr_build_preview.jsx`, passing a job-context JSON file (manifest + slate/overlay fields fetched from E3). The script is the connector's existing preview-comp code, packaged with the worker: it imports the *validated* EXR sequence, builds the preview comp from the studio template (head slate populated from API data, overlays/burn-ins throughout), applies the colour chain (linear → log → show LUT from `colorPipeline` config), queues it with the project's MOV output-module template, and renders the **delivery-grade preview MOV** to the SAN beside the EXRs (`Export.deliveryMovPath`). This is the "MOV LT Preview" that ships inside delivery packages (Section 11).
-2. **Web transcode (ffmpeg).** The delivery MOV is transcoded to a web-playable H.264 (1920-wide, CRF 18) and a thumbnail JPEG (frame at 25% duration, 960-wide), uploaded via E20 presign.
+2. **Web transcode (ffmpeg).** The delivery MOV is transcoded to a web-playable H.264 (1920-wide, CRF 18) and a thumbnail JPEG (960-wide), uploaded via E20 presign. The thumbnail is taken at **25% of *picture* duration**, seeking past the head slate: the build script reports the SHOT layer's in-point as `pictureStartSeconds`, and the worker seeks to `pictureStart + 25%`. Builds that report no picture start fall back to scanning the whole file. (Until 2026-08-27 this used ffmpeg's `thumbnail` filter, which only considers the first 100 frames — on a slated preview, the slate card. Every thumbnail produced before then is a picture of the slate.)
 3. **Metadata JSON.** Worker-composed (manifest + validation summary + render stats + checksums + tool/template versions), uploaded via E20.
 
 | Artifact | Produced by | Destination |
 |---|---|---|
 | Delivery MOV (slate + burn-ins, graded via show LUT, delivery codec from AE output template) | AE headless render | SAN → `Export.deliveryMovPath`; copied/linked into delivery packages |
 | Web preview MOV (H.264) | ffmpeg transcode of the delivery MOV | object storage `videos/` → `Version.fileUrl` |
-| Thumbnail | ffmpeg | `image/` → `Version.thumbnailUrl` + `Export.thumbnailKey` |
+| Thumbnail | ffmpeg | `image/` → `Version.thumbnailUrl` + `Export.thumbnailKey`; also `Shot.generatedThumbnailUrl` when the project opts in (§9.3) |
 | Metadata JSON | worker | `renders/` → `Export.metadataKey` |
 
 Because the web preview is a transcode of the AE-generated MOV, review media and delivery media are guaranteed to show identical slates, burn-ins, and colour — one source of truth.
 
+### 9.1a Render frames as shot thumbnails
+
+Shots carry two stills, in two columns, and the distinction is the whole design:
+
+| Column | Written by | Meaning |
+|---|---|---|
+| `Shot.thumbnailUrl` | humans only — single upload, batch upload, ext API | The reference frame that came with the brief. Editorial data. |
+| `Shot.generatedThumbnailUrl` | the pipeline, and the manual promote action | A frame lifted from a finished export. |
+
+Display resolution is `thumbnailUrl ?? generatedThumbnailUrl` (`lib/shot-thumbnail.ts`), applied at every shot surface: shot grid, kanban, schedule, shot status, storyboard (screen and PDF), shoot log, slate tab, client portal, and the ext APIs the Nuke/AE panel reads. **The reference always wins**, so the pipeline can only fill a gap and can never overwrite the brief — clearing the generated one always falls back.
+
+Promotion happens two ways:
+
+* **Automatically**, for projects with `pipelineConfig.autoShotThumbnail` set (Project Settings → *Use render frames as shot thumbnails*). Off by default and deliberately per-show: productions that ship a still with every shot already have a reference frame and the renders should not compete with it. It exists for shows that arrive with no stills at all, where the alternative is an empty grid. `finalizePreview` writes the column and notes it on the export timeline.
+* **By hand**, via `promoteExportThumbnail` / `clearGeneratedThumbnail` (Shot Settings → Thumbnail → *From renders*), which work regardless of the project flag — one shot on an otherwise hands-off show. With no explicit export, the newest export of that shot that has a thumbnail is used.
+
+Note this is the one place a render-derived artifact reaches the client portal. It is a still, not a `Version`, so §10.0 is intact — no technical render re-enters the review flow and no approval state moves — but a client viewing a shot with no supplied still now sees a frame from the render rather than a placeholder.
+
 ### 9.2 Colour configuration
 
 `Project.deliveryConfig.colorPipeline` (per 18.1-Q4/Q12) — **required and unique per project**; enabling the pipeline on a project without it is a validation error, and values must never be carried over from another show:
@@ -1063,6 +1159,47 @@ Cost note: the AE preview pass roughly doubles machine time per export. This mat
 
 Finalize (E13) then creates the `Version` row server-side (Section 6.4) in pipeline mode — visible internally, never client-shared, no task/shot status changes.
 
+**Re-exports inherit approval, and carry no artist-facing text.** A shot is routinely re-exported after client approval — most often for an unscaled/un-punched-in delivery pass — and that must not read as new work awaiting review. The new `Version.approvalStatus` is copied from the task's previous latest version rather than left at its `PENDING_REVIEW` default; an export that starts a task's history has nothing to inherit and gets `PENDING_REVIEW` as before. `Version.notes` is left unset rather than stamped with an internal description: `notes` is the artist's message to reviewers and is rendered verbatim in the client portal and the review player, so pipeline provenance belongs on the Export and its `ExportEvent` timeline — where a human would go looking for it — not in a field a client can read.
+
+**Known gap:** `shareWithClient` (and the per-task share action) promote whichever `Version` is `isLatest` for a task to `isClientVisible: true`, with no awareness that a pipeline-created version is meant to stay internal permanently (this section, "never client-shared"). Re-sharing a shot after a pipeline re-export will currently expose the internal version if it is the task's latest. Closing this needs a way to identify a pipeline-origin version at the share call sites — `Export.versionId` is presently a one-way scalar with no inverse relation on `Version` — and is not yet implemented.
+
+### 9.3a Where a preview sits in the queue
+
+The queue is ordered `priority ASC, createdAt ASC`, and a preview job is only created when its render *finishes* — so at equal priority it sorts behind every render queued alongside it. Ten shots queued together would run as ten renders and then ten previews, with nothing reviewable until the end.
+
+`SystemConfig: render.previewPriorityBoost` (default 1) subtracts from the render's priority when the preview job is created, so a finished shot completes before the next render starts. Priority is otherwise inherited, which is what keeps an urgent export urgent all the way to READY_FOR_QC. The boost never promotes a job across `render.urgentPriorityThreshold`: a normal preview must not gain permission to run outside the render window that its render never had. Set the boost to `0` for the old phase behaviour.
+
+Independently of priority, a worker **does not claim `PREVIEW_ONLY` jobs while an interactive After Effects is running** on that machine (§9.1) — a headless launch would hijack the artist's session. During the working day previews therefore queue regardless of rank, which is usually the larger effect on when they run.
+
+### 9.4 Skipping the preview (`Export.skipPreview`)
+
+Not every export is framed like its review. A deliverable rendered unscaled or without the punch-in shares a shot and a version history with the review, but a preview rebuilt from *its* frames would show the wrong picture — the earlier export's MOV is the correct one.
+
+`skipPreview` (set at Queue Export, or per-action when overriding a validation failure) renders the EXRs and goes straight to READY_FOR_QC, **inheriting** `deliveryMovPath`, `previewMovKey`, `thumbnailKey` and `versionId` from the newest earlier export of that shot which has them. Inheritance matters as much as the skip: the delivery builder takes its MOV from `deliveryMovPath`, so an export with none would package EXRs alone. QC is unaffected — the export still needs a human pass before it can be delivered.
+
+With no earlier export to inherit from, the export still reaches READY_FOR_QC and the timeline records that it has no review media.
+
+### 9.5 Handles in review (metadata only)
+
+Renders run past the cut at each end (8 + 8 by house convention). Handles ship with the EXRs and stay in the preview, but reviewers must be able to tell them from the cut, or a glitch in a handle gets flagged as a problem in the shot. **Nothing is trimmed or burned in** — this is deliberately not the reverted picture-lock trim (which desynced the overlay timecode); the render and every delivered file are unchanged.
+
+- **Panel:** "Includes handles [8] frames each end" (default on, prefilled from Handle Frames) sends `manifest.review = { handleHead, handleTail }`; unticked sends 0/0. Manifests without `review` (older panels) fall back to `source.handleFrames` (`manifestHandles`, exports.ts).
+- **Export → Version:** `createExport` stores `Export.handleHead/handleTail`; `finalizePreview` copies them onto the Version, plus `pictureStartFrame` = the head slate length from the build's `pictureStartSeconds` (worker ≥ 1.6.4). Left null, the player infers the slate as MP4 frames − `frameCount` (the EXR count), within 0–5 frames.
+- **Player** (`lib/handles.ts` → `computeEditRange`): the timeline hatches the handles amber and labels them HANDLE (the slate, SLATE); while the playhead is in a handle the picture gets an amber frame and a "HEAD/TAIL HANDLE · NOT IN EDIT" tag; notes on handle frames carry a HANDLE badge. "Edit range only" (scissors) keeps play, reverse and go-to-start/end inside the cut — on by default in the client portal, off for staff.
+- **Staff override:** the review page's Handles button edits a version's head/tail/slate — for manual uploads, or to correct a render.
+- **Backfill** (`20260922000000_version_handles`): every existing export takes its manifest's `source.handleFrames` (else 8), and the Versions they produced take the same.
+
+### 9.6 High quality playback and the ProRes download
+
+The Standard review MP4 is AE's H.264 (UHD, ~35 Mbps). ProRes itself can't be the player's source — only Safari on a Mac decodes it in a web page, and UHD ProRes LT is ~280 Mbps — so the worker (≥ 1.7.0, when `preview.highQuality` is on) adds two things after the AE render, both **best-effort** (a failure costs the extras, never the preview):
+
+- **High quality MP4:** ffmpeg re-encodes the delivery MOV as full-res H.264 High, CRF 14 capped at 100 Mbps, yuv420p, faststart → `Version.hqFileUrl`. The player shows an **HQ** switch when present; switching keeps frame, play state, speed and zoom, is remembered per browser (`review:quality`), and falls back to Standard if the file won't load. Same comp as the Standard MP4, so slate and handles line up frame for frame.
+- **ProRes download:** the MOV itself is uploaded (presign kind `highres`) → `Version.highResKey/highResFilename/highResSize`. It is the version's **High Res** download in the client portal (named with the client code, `clientHighResFilename`) and a **ProRes** button on the staff review page. The shot's manually uploaded High Res remains the fallback for versions without one. Since worker 1.7.1 the MOV uploads **in the background after finalize** (`HighResUploader`, queue in `%ProgramData%\VFXReviewWorker\highres-queue`, resumes after a restart, 5 attempts) and attaches via `POST /api/ext/render/jobs/{id}/attach-highres` (E13b); a MOV from a preview that a newer preview has superseded is discarded. While a preview job uploads, the worker replaces the job's log tail with live upload status. Since 1.7.2, artifacts of 16 MB or more upload as S3 multipart: `artifact-presign` with `multipart: true, size` returns `uploadId`, `partSize` (8 MB minimum) and one presigned URL per part; the worker PUTs parts on `uploadConcurrency` connections (default 16), retries each part up to 4 times, then calls `artifact-complete` (E20b) to stitch them, or with `abort: true` to discard them. A single connection from the studio to nbg1 is capped near 0.1 MB/s.
+
+A lease keep-alive runs during the encode and uploads (they can outlast the 300 s lease). The export timeline records what was attached.
+
+**Housekeeping** (`lib/render-pipeline/high-res.ts`): a version keeps its HQ MP4 and ProRes while it is the task's latest, shared with the client, approved, or younger than `preview.highResRetentionDays` (14). Otherwise both are deleted from storage and the row gets `highResPrunedAt`; the Standard MP4 is never touched. It runs for the task after every finalize and studio-wide hourly from the reaper; deleting a version deletes its files. A reslate replaces (and deletes) the version's previous HQ/ProRes.
+
 ---
 
 ## 10. QC Workflow
@@ -1126,7 +1263,11 @@ Tokens: `{showId} {episode} {yymmdd} {yyyymmdd} {packageName} {packageDir} {shot
 
 ### 11.3 Hard links vs copying
 
-**Recommendation: hard link when `deliveryRoot` and render root share an NTFS volume; transparent fallback to copy otherwise (cross-volume links are impossible).** Hard links make an 18-shot EXR package near-instant and ~zero extra disk; the risk (mutating a linked file changes both) is acceptable because rendered EXR versions are immutable by pipeline design — a version is never re-rendered in place (new version → new directory). Post-link verification: link target identity check; post-copy verification: size + xxHash against validation-time values. `DeliveryItem.status` → VERIFIED per item. Config override `"copyMode": "always-copy"` for productions that mandate physical separation.
+**Recommendation: hard link when `deliveryRoot` and render root share an NTFS volume; transparent fallback to copy otherwise (cross-volume links are impossible).** Hard links make an 18-shot EXR package near-instant and ~zero extra disk; the risk (mutating a linked file changes both) is acceptable because rendered EXR versions are immutable by pipeline design — a version is never re-rendered in place (new version → new directory).
+
+**Verified on the studio volume (2026-08-13):** `V:` is `\\TRUENAS\vfx` over SMB, and hard links work on it — `mklink /H` succeeds and a write through one name is visible through the other. Renders (`V:/_EXPORTS/UNG/{ep}/{shot}/{ver}`) and the delivery root (`V:/_EXPORTS/UNG/DELIVERY`) are on the same share, so the fast path applies to real deliveries today.
+
+**Implementation trap:** `fsutil hardlink list` fails over SMB (`Error 50: The request is not supported`), so the builder **cannot enumerate links to verify them** on a network volume. Verify instead by hashing the delivery-side file and comparing against the validation-time xxHash — that reads the same bytes whether the entry is a link or a copy, so one verification path covers both modes. Post-copy verification is the same check plus size. `DeliveryItem.status` → VERIFIED per item. Config override `"copyMode": "always-copy"` for productions that mandate physical separation.
 
 ### 11.4 Manifest and delivery report
 
@@ -1137,6 +1278,27 @@ Tokens: `{showId} {episode} {yymmdd} {yyyymmdd} {packageName} {packageDir} {shot
 
 The Delivery Packages page (Section 13) lists every package permanently: `#15 · 101/260805_Delivery · Episode 101 · 18 shots · built 2026-08-05 · delivered 2026-08-05 by Chris`, expandable to items → Export → full render/validation/QC history. Packages are never deleted; a mistaken package is CANCELLED (DRAFT/QUEUED/FAILED only) or superseded by building a new one.
 
+### 11.6 MOV review packages (`DeliveryPackage.kind = MOV_REVIEW`)
+
+A formal review is shared as a flat, dated folder of the preview MOVs — the same package/job/verification machinery as §11.1–11.5, a different shape on disk:
+
+```
+{deliveryRoot}/PRODUCER_REVIEWS/20260828_Producer_review/
+├── EP6_VFX_012_v004.mov          ← client naming where the production supplies it
+├── EP6_VFX_013_v002.mov
+└── UNG_106_010_040_cmp_TT_v001.mov   ← ours where it does not
+```
+
+The second review that day is `_02`, the third `_03`; the first carries no suffix. Numbering counts every package built under that base — cancelled and failed ones included — so a number is never reused for a different folder. Config: `reviewNameTemplate` (default `{yyyymmdd}_Producer_review`) and `layout.reviewDir` (default `{deliveryRoot}/PRODUCER_REVIEWS/{packageName}`).
+
+Three rules separate a review from a delivery:
+
+- **It never advances an Export.** Reviews happen throughout a shot's life, long before QC passes it, and the same version is routinely shown twice. Nothing is marked PACKAGED or DELIVERED when the folder is built, and `Mark delivered` is refused on a review package.
+- **Selection is by shot, not by export.** The user picks shots on Shot Status → *Bulk Actions → Build MOV Review Package*; the server resolves each to its **newest export that actually has a `deliveryMovPath`** — not necessarily its newest export, since a shot whose latest version is still rendering should go into the review as the version that can be watched. Shots with no MOV at all are listed in the confirm dialog and left out rather than silently dropped.
+- **The folder is exactly the MOVs.** No CSV, no `manifest.json` written beside them. The manifest still returns to the server, so the record of what was shared is kept without cluttering the share.
+
+Verification is proportional as in §11.3, adapted to a single file with no validation-time digest: a hard link is the source and needs nothing; a copy is checked against its source by length always, and by full hash under `"verifyMode": "always-hash"`. A missing MOV **fails the item** here — in an EXR delivery the MOV is a viewing copy beside the real deliverable, but in a review it *is* the deliverable, and a review folder quietly one shot short is worse than one that says so.
+
 ---
 
 ## 12. AE Panel Changes
@@ -1153,6 +1315,11 @@ The panel keeps all existing capabilities (episode/shot discovery, overlays, pic
 | Latest Export + QC status | new E2 `exports/latest` — e.g. `v004 — READY_FOR_QC`, `v004 — RENDERING 42% (ETA 1:36 on RENDER-01)`, `v003 — QC FAILED: "grain mismatch"` |
 
 While an export is active the panel polls E2 every 15 s to live-update the header.
+The poll stops when the export leaves an active status, and also when the panel is
+closed or reloaded — `app.scheduleTask` outlives the panel instance that armed it,
+so the task id is kept in ExtendScript global scope where the next instance can
+still cancel it. The export is unaffected either way: it runs on the farm, and the
+header picks its status back up on the next Refresh.
 
 ### 12.2 Buttons and their API calls
 
@@ -1278,7 +1445,7 @@ Five independently deployable phases. Each phase leaves the previous workflow fu
 | API | E12; transitions T3→T7/T8 activated (Phase 2 interim: complete-render goes straight to a provisional READY_FOR_QC; Phase 3 inserts VALIDATING between) |
 | UI | Validation table on Export detail; Validation Results browser; failure badge in queue |
 | Worker | Validation engine (oiiotool integration, all Section 8.1 checks, checksums); oiiotool bundled with installer |
-| Risks | Colourspace/timecode metadata may be absent in AE-written EXRs → those checks SKIPPED until per-project expectations configured (18.2-Q1); false FAILs block artists → per-check severity override in SystemConfig (`validation.overrides: {"exr_type": "warn"}`) |
+| Risks | ~~Timecode metadata may be absent in AE-written EXRs~~ — disproved on the live show (§8.1a): AE writes `timeCode`, so absence is now itself a FAIL. Colourspace metadata may still be absent → that check SKIPPED until per-project expectations configured (18.2-Q1); false FAILs block artists → per-check severity override in SystemConfig (`validation.overrides: {"exr_type": "warn"}`). **The timecode check is the phase's priority and ships first** — it needs no oiiotool, and 11 of 106 delivered sequences on the current show would have been caught by it |
 | Testing | Golden EXR fixture sets: complete, gapped, duplicate, wrong-res, wrong-depth, no-alpha, corrupt, zero-byte; checksum determinism; large-sequence perf (500 frames < 60 s) |
 | Migration | Additive; existing in-flight exports unaffected (transition map keys off manifest version) |
 

RenderWorker/.gitignore

@@ -2,3 +2,8 @@ bin/
 obj/
 publish/
 *.user
+
+# Published packages — rebuildable from any commit with scripts/publish.ps1,
+# and the version stamp (e.g. 1.1.0+a4f8226) already traces a deployed exe
+# back to its source. Keeping ~29 MB per publish in history buys nothing.
+VFXReviewWorker_*.zip

RenderWorker/README.md

@@ -60,8 +60,82 @@ the artist's AEP (then it is pure `aerender`), or the ffmpeg engine.
   are never resumed — the next attempt clears its own output files and re-renders.
 - Durable reporting: complete/fail reports spool to disk and replay in order with backoff —
   rendering continues while the server is down.
+- **Validation (Phase 3)**: after a successful render the worker checks the sequence it just
+  produced and reports every result in one call (E12). See below.
 
-Preview generation (Phase 4) and validation (Phase 3) plug into this same service later.
+## Validation stage
+
+Runs on the worker straight after the render, while it still holds the job and the files are
+local. The Export sits in `VALIDATING` until the report lands; the server decides what the
+results mean (any FAIL → `VALIDATION_FAILED`, otherwise the preview stage is queued).
+
+Checks: `file_count`, `missing_frames`, `duplicate_frames`, `first_frame`, `last_frame`,
+`filename_consistency`, `zero_byte`, `corrupt`, `resolution`, `bit_depth`, `alpha_channel`,
+`exr_type`, `timecode_plate_match`, `timecode_consistency`, `timecode_fps`.
+
+**No oiiotool needed.** Everything is read from the EXR header — one 64 KB read per sampled
+frame, no pixel decode. Full-sequence checks (count, gaps, names, sizes) touch every file;
+header checks sample first/middle/last plus every Nth frame (`validation.sampleEvery`).
+
+**Timecode is the primary check** (spec §8.1a) and is compared against *the plate*, in this
+order: the timing plate named in the manifest → a plate found under `plateSearchRoots` →
+the API timecode minus handles, which is **WARN-only** because the API stores the editorial
+in-point and is a handle-length ahead of the plate by design.
+
+Checksums are xxHash64 per file, with a sequence digest stored on the Export and reused by
+the delivery builder to verify what it packaged.
+
+Server-side switches (SystemConfig, no worker redeploy): `validation.enabled`,
+`validation.sampleEvery`, `validation.handleFrames`, and `validation.overrides` for per-check
+severity, e.g. `{"exr_type":"warn"}`.
+
+## Blender renders
+
+The worker also claims `BLENDER_RENDER` jobs: standalone renders submitted from
+the Blender add-on, with no Export behind them — nothing to validate, preview or
+QC. It runs `blender -b file.blend -s N -e M -a`, parses `Fra:`/`Saved:` output
+for progress, and reports complete or failed like any other job.
+
+Set `blenderPath` in `config.json` to make a machine eligible. The version is
+reported at registration and **the server only hands Blender jobs to machines
+that have it**, so a workstation without Blender can never claim work it could
+only fail. A machine without it stays perfectly valid for After Effects work.
+
+Blender exits 0 when a frame range is empty or an output path is unwritable, so
+a run that saves no frames is reported as a failure rather than a success.
+
+See [BlenderPanel/README.md](../BlenderPanel/README.md).
+
+## Delivery builds
+
+The same service also claims `DELIVERY_BUILD` jobs: creating a dated package
+folder, hard-linking (or copying) each shot's EXRs and delivery MOV into it,
+verifying every file against the validation-time checksum, and writing
+`manifest.json` plus the CSV report.
+
+No After Effects involved, so these are claimed **even while an artist has AE
+open** — and at priority 10, inside the urgent threshold, so they run during the
+day rather than waiting for the render window. Someone is usually waiting on the
+folder.
+
+`deliveryRoot` has to be reachable from this machine under the service account:
+`--check` verifies `pathMappings` targets, which is where a build most often
+falls over.
+
+Full workflow: [DELIVERY_WORKFLOW.md](../DELIVERY_WORKFLOW.md).
+
+### Checking a render by hand
+
+```powershell
+.\VFXReviewWorker.exe --validate "V:\_EXPORTS\UNG\102\UNG_102_019_010\v005" --plate "V:\_FOOTAGE\UNG\UNG_102\UNG_102_019_010_BG01_TT_v001\UNG_102_019_010_BG01_TT_v001.01001.exr"
+```
+
+Runs the whole engine over an existing folder with no server, job or queue, and prints the
+report. The frame range, pattern and resolution are inferred from the files. Exits non-zero
+if any check fails, so it also works in a script. Useful for auditing work that predates the
+pipeline, and for proving the checks on real shots before turning the stage on.
+
+Preview generation (Phase 4) plugs into this same service.
 
 ## Packaging for another machine
 
@@ -117,14 +191,27 @@ Create `C:\ProgramData\VFXReviewWorker\config.json` (§7.8):
   "aerenderPath": "C:\\Program Files\\Adobe\\Adobe After Effects 2026\\Support Files\\aerender.exe",
   "aeVersion": "24.3",
   "ffmpegPath": "C:\\pipeline\\bin\\ffmpeg.exe",
+  "blenderPath": "C:\\Program Files\\Blender Foundation\\Blender 4.2\\blender.exe",
+  "plateSearchRoots": ["V:/_FOOTAGE/UNG"],
   "pathMappings": [
     { "from": "//SAN/", "to": "S:/" }
   ]
 }
 ```
 
+There is no `workerVersion` key: the version is stamped into the exe at build time and
+read back from the assembly, so a machine can never report a version it is not running.
+`publish.ps1` appends the git commit, giving `1.1.0+feb1c7b`. Bump `<Version>` in
+`VFXReviewWorker.csproj` when publishing a change; the worker reports it on startup and
+**Pipeline → Machines** flags any machine still on an older one.
+
 `pathMappings` translate the manifest's canonical UNC paths to this machine's drive
-mappings. Everything tunable (poll interval, lease, stall timeout, max attempts) lives in
+mappings. `plateSearchRoots` is optional: it is only consulted when a manifest carries no
+timing plate (older panel versions), to find the shot's plates for the timecode check.
+`uploadConcurrency` (default 16) is how many parallel connections a file of 16 MB or more
+uploads over. Each connection to object storage is capped near 0.1 MB/s from the studio, so
+throughput scales with it (measured 2026-10-01: 1 → 0.13 MB/s, 8 → 0.64, 24 → 1.69 MB/s).
+Everything tunable (poll interval, lease, stall timeout, max attempts, validation) lives in
 the server's SystemConfig and arrives at registration — no per-machine tuning files.
 
 ## Run interactively (first-time smoke test)

RenderWorker/VFXReviewWorker.Tests/BlenderProgressParserTests.cs

@@ -0,0 +1,132 @@
+using System.Text;
+using VFXReviewWorker;
+using Xunit;
+
+namespace VFXReviewWorker.Tests;
+
+/// <summary>
+/// Blender writes its render status with a carriage return so it overwrites one
+/// line in the terminal, and only emits a newline when a frame is saved. A
+/// reader that splits on newlines alone therefore sees nothing at all while a
+/// long frame renders — which had the stall watchdog killing healthy jobs.
+/// </summary>
+public class BlenderProgressParserTests
+{
+    [Theory]
+    [InlineData("Fra:1042 Mem:512.00M (Peak 640.00M) | Time:00:12.34 | Path Tracing Sample 12/128", 1042)]
+    [InlineData("Fra:1 Mem:64.00M | Syncing Cube", 1)]
+    [InlineData("Saved: 'X:/renders/frame_1042.exr'", null)]
+    [InlineData("Blender quit", null)]
+    public void ParsesTheFrameBeingRendered(string line, int? expected)
+    {
+        Assert.Equal(expected, BlenderProgressParser.ParseFrame(line));
+    }
+
+    [Theory]
+    [InlineData("Saved: 'X:/renders/frame_1042.exr'", "X:/renders/frame_1042.exr")]
+    [InlineData(" Saved: 'nope'", null)] // leading space: not the real form
+    [InlineData("Fra:1042 Mem:512.00M", null)]
+    public void ParsesSavedFrames(string line, string? expected)
+    {
+        Assert.Equal(expected, BlenderProgressParser.ParseSaved(line));
+    }
+
+    [Fact]
+    public void TreatsAMissingBlendAsNonRetryable()
+    {
+        const string line = "Error: Cannot read file 'X:/gone.blend': No such file or directory";
+        Assert.True(BlenderProgressParser.IsErrorLine(line));
+        Assert.True(BlenderProgressParser.IsNonRetryableError(line));
+    }
+
+    [Fact]
+    public void TreatsAnUnknownFailureAsRetryable()
+    {
+        const string line = "Error: CUDA device lost, out of memory";
+        Assert.True(BlenderProgressParser.IsErrorLine(line));
+        Assert.False(BlenderProgressParser.IsNonRetryableError(line));
+    }
+
+    /// <summary>
+    /// The regression itself: a realistic stdout chunk where progress is
+    /// separated by CR and only the saved lines end in LF.
+    /// </summary>
+    [Fact]
+    public void CarriageReturnProgressIsSeenWithoutWaitingForANewline()
+    {
+        var stdout =
+            "Fra:1001 Mem:64.00M | Sample 1/128\r" +
+            "Fra:1001 Mem:120.00M | Sample 64/128\r" +
+            "Fra:1001 Mem:128.00M | Sample 128/128\r" +
+            "\nSaved: 'X:/renders/frame_1001.exr'\n" +
+            "Fra:1002 Mem:128.00M | Sample 1/128\r";
+
+        var lines = SplitLikeThePump(stdout);
+
+        var frames = lines.Select(BlenderProgressParser.ParseFrame).Where(f => f is not null).ToList();
+        var saved = lines.Select(BlenderProgressParser.ParseSaved).Where(s => s is not null).ToList();
+
+        // Four status updates and one saved frame; splitting on "\n" alone
+        // would have yielded a single unusable blob and no progress at all.
+        Assert.Equal(4, frames.Count);
+        Assert.Single(saved);
+        Assert.Equal(1002, frames[^1]);
+    }
+
+    /// <summary>
+    /// Blender 5.x prefixes every line with elapsed time and a log category.
+    /// Anchored on "Saved:", the parser counted no frames from a render that
+    /// wrote every one, and the job failed as "saved no frames".
+    /// These lines are verbatim Blender 5.2 output.
+    /// </summary>
+    [Fact]
+    public void ParsesBlender5PrefixedOutput()
+    {
+        Assert.Equal(@"X:\renders\frame_0001.png",
+            BlenderProgressParser.ParseSaved(@"00:02.954  render           | Saved: 'X:\renders\frame_0001.png'"));
+        Assert.Equal(1, BlenderProgressParser.ParseFrame("00:02.469  render           | Fra: 1 | Mem: 0M | Synchronizing object | Cube"));
+        Assert.Null(BlenderProgressParser.ParseSaved("00:02.954  render           | Time: 00:00.87 (Saving: 00:00.14)"));
+        Assert.Null(BlenderProgressParser.ParseFrame("00:02.079  render           | Rendering frame 1"));
+    }
+
+    [Fact]
+    public void RecognisesBlender5Errors()
+    {
+        const string unwritable = @"00:03.063  reports          | ERROR Render error (No such file or directory) cannot save: 'Q:\out\f_0001.png'";
+        Assert.True(BlenderProgressParser.IsErrorLine(unwritable));
+        Assert.True(BlenderProgressParser.IsNonRetryableError(unwritable));
+
+        const string missing = @"00:13.250  reports          | ERROR Cannot read file ""X:\gone.blend"": No such file or directory";
+        Assert.True(BlenderProgressParser.IsErrorLine(missing));
+        Assert.True(BlenderProgressParser.IsNonRetryableError(missing));
+    }
+
+    /// <summary>
+    /// Add-ons print warnings on every launch; one must never become the
+    /// reported reason a render failed.
+    /// </summary>
+    [Theory]
+    [InlineData("Warning: add-on missing 'bl_info', this can cause poor performance!: 'G:\\addons\\x\\__init__.py'")]
+    [InlineData("00:01.000  addon            | WARNING something harmless")]
+    public void WarningsAreNotErrors(string line)
+    {
+        Assert.False(BlenderProgressParser.IsErrorLine(line));
+    }
+
+    /// <summary>Mirrors BlenderRunner.PumpAsync: CR and LF both end a line.</summary>
+    private static List<string> SplitLikeThePump(string text)
+    {
+        var lines = new List<string>();
+        var current = new StringBuilder();
+        foreach (var c in text)
+        {
+            if (c == '\r' || c == '\n')
+            {
+                if (current.Length > 0) { lines.Add(current.ToString()); current.Clear(); }
+            }
+            else current.Append(c);
+        }
+        if (current.Length > 0) lines.Add(current.ToString());
+        return lines;
+    }
+}

RenderWorker/VFXReviewWorker.Tests/DeliveryStageTests.cs

@@ -0,0 +1,341 @@
+using Microsoft.Extensions.Logging.Abstractions;
+using VFXReviewWorker;
+using Xunit;
+
+namespace VFXReviewWorker.Tests;
+
+/// <summary>
+/// Packaging is the last step before files leave the studio, so the parts that
+/// could silently ship the wrong thing — checksum verification, frame-count
+/// drift, hard-link vs copy — are pinned here.
+/// </summary>
+public class DeliveryStageTests : IDisposable
+{
+    private readonly string _root = Path.Combine(Path.GetTempPath(), $"vfxr_delivery_{Guid.NewGuid():N}");
+    private readonly string _sourceDir;
+    private readonly string _packageDir;
+
+    public DeliveryStageTests()
+    {
+        _sourceDir = Path.Combine(_root, "renders", "SHOT_001", "v001");
+        _packageDir = Path.Combine(_root, "DELIVERY", "101", "260813_Delivery");
+        Directory.CreateDirectory(_sourceDir);
+    }
+
+    public void Dispose()
+    {
+        try { Directory.Delete(_root, recursive: true); } catch { }
+    }
+
+    private void WriteFrames(int count, int startFrame = 1001)
+    {
+        for (var i = 0; i < count; i++)
+        {
+            var name = $"SHOT_001_cmp_TT_v001.{startFrame + i:D5}.exr";
+            File.WriteAllText(Path.Combine(_sourceDir, name), $"frame {startFrame + i} pixels");
+        }
+    }
+
+    private DeliveryManifest Manifest(string? checksum = null, int fileCount = 3, string copyMode = "auto") => new()
+    {
+        PackageId = "pkg1",
+        PackageName = "260813_Delivery",
+        PackageNumber = 1,
+        Episode = "101",
+        PackageDir = _packageDir,
+        ReportFile = Path.Combine(_packageDir, "260813_Delivery_report.csv"),
+        CopyMode = copyMode,
+        Items = new List<DeliveryManifestItem>
+        {
+            new()
+            {
+                ItemId = "item1",
+                ExportId = "exp1",
+                ShotCode = "SHOT_001",
+                VersionString = "v001",
+                SourceDir = _sourceDir,
+                OutputPattern = "SHOT_001_cmp_TT_v001.[#####].exr",
+                FrameStart = 1001,
+                FrameEnd = 1000 + fileCount,
+                FileCount = fileCount,
+                Checksum = checksum,
+                ShotDir = Path.Combine(_packageDir, "SHOT_001"),
+            },
+        },
+    };
+
+    private DeliveryStage NewStage() => new(
+        new WorkerOptions { ServerUrl = "n/a", ApiKey = "n/a" },
+        new ApiClient(new WorkerOptions { ServerUrl = "http://localhost:1", ApiKey = "x" }, NullLogger<ApiClient>.Instance),
+        NullLogger<DeliveryStage>.Instance);
+
+    [Fact]
+    public async Task PackagesFramesAndWritesReport()
+    {
+        WriteFrames(3);
+        var result = await NewStage().RunAsync(new ClaimedJob { Id = "job1" }, Manifest(), "machine1",
+            CancellationToken.None, CancellationToken.None);
+
+        Assert.True(result.Ok);
+        var item = Assert.Single(result.Items);
+        Assert.Equal("VERIFIED", item.Status);
+        Assert.Equal(3, item.FileCount);
+
+        var delivered = Directory.GetFiles(Path.Combine(_packageDir, "SHOT_001"), "*.exr");
+        Assert.Equal(3, delivered.Length);
+        Assert.True(File.Exists(Path.Combine(_packageDir, "manifest.json")));
+
+        var report = File.ReadAllText(Path.Combine(_packageDir, "260813_Delivery_report.csv"));
+        Assert.Contains("Shot,Version,FrameStart", report);
+        Assert.Contains("SHOT_001,v001,1001,1003,3,3", report);
+    }
+
+    [Fact]
+    public async Task HardLinksOnTheSameVolumeSoNoExtraBytesAreWritten()
+    {
+        WriteFrames(2);
+        var result = await NewStage().RunAsync(new ClaimedJob { Id = "job1" }, Manifest(fileCount: 2), "machine1",
+            CancellationToken.None, CancellationToken.None);
+
+        Assert.Equal("hardlink", result.Items[0].LinkMode);
+
+        // A hard link is the same file: writing through one name is visible via
+        // the other. That is what makes packaging near-instant and free.
+        var source = Path.Combine(_sourceDir, "SHOT_001_cmp_TT_v001.01001.exr");
+        var linked = Path.Combine(_packageDir, "SHOT_001", "SHOT_001_cmp_TT_v001.01001.exr");
+        File.WriteAllText(source, "rewritten");
+        Assert.Equal("rewritten", File.ReadAllText(linked));
+    }
+
+    [Fact]
+    public async Task AlwaysCopyModeProducesIndependentFiles()
+    {
+        WriteFrames(2);
+        var result = await NewStage().RunAsync(new ClaimedJob { Id = "job1" }, Manifest(fileCount: 2, copyMode: "always-copy"),
+            "machine1", CancellationToken.None, CancellationToken.None);
+
+        Assert.Equal("copy", result.Items[0].LinkMode);
+
+        var source = Path.Combine(_sourceDir, "SHOT_001_cmp_TT_v001.01001.exr");
+        var copied = Path.Combine(_packageDir, "SHOT_001", "SHOT_001_cmp_TT_v001.01001.exr");
+        File.WriteAllText(source, "rewritten");
+        Assert.NotEqual("rewritten", File.ReadAllText(copied));
+    }
+
+    [Fact]
+    public async Task ChecksumMismatchFailsACopiedItem()
+    {
+        WriteFrames(3);
+        var manifest = Manifest(checksum: "deadbeefdeadbeef", copyMode: "always-copy");
+        var result = await NewStage().RunAsync(new ClaimedJob { Id = "job1" }, manifest, "machine1",
+            CancellationToken.None, CancellationToken.None);
+
+        Assert.False(result.Ok);
+        Assert.Equal("FAILED", result.Items[0].Status);
+        Assert.Contains("Checksum mismatch", result.Items[0].ErrorMessage!);
+    }
+
+    [Fact]
+    public async Task HardLinkedItemsAreNotReadBack()
+    {
+        // A hard link is the same data as the source, so re-hashing it re-reads
+        // the exact bytes validation already hashed — half an hour per episode
+        // over SMB to prove something that cannot be false. A deliberately wrong
+        // recorded checksum is therefore not consulted on the linked path, and
+        // the validation-time digest carries over unchanged.
+        WriteFrames(3);
+        var result = await NewStage().RunAsync(new ClaimedJob { Id = "job1" },
+            Manifest(checksum: "deadbeefdeadbeef"), "machine1", CancellationToken.None, CancellationToken.None);
+
+        Assert.True(result.Ok);
+        Assert.Equal("VERIFIED", result.Items[0].Status);
+        Assert.Equal("hardlink", result.Items[0].LinkMode);
+        Assert.Equal("deadbeefdeadbeef", result.Items[0].Checksum);
+    }
+
+    [Fact]
+    public async Task AlwaysHashForcesReadBackEvenWhenLinked()
+    {
+        WriteFrames(3);
+        var manifest = Manifest(checksum: "deadbeefdeadbeef");
+        manifest.VerifyMode = "always-hash";
+        var result = await NewStage().RunAsync(new ClaimedJob { Id = "job1" }, manifest, "machine1",
+            CancellationToken.None, CancellationToken.None);
+
+        Assert.False(result.Ok);
+        Assert.Contains("Checksum mismatch", result.Items[0].ErrorMessage!);
+    }
+
+    [Fact]
+    public async Task SourceTouchedAfterValidationFailsTheLinkedItem()
+    {
+        // The one thing linking cannot rule out: the source changing after it
+        // passed QC. The link would faithfully carry the new bytes.
+        WriteFrames(3);
+        var manifest = Manifest();
+        manifest.Items[0].ValidatedAt = DateTimeOffset.UtcNow.AddHours(-2);
+        File.SetLastWriteTimeUtc(
+            Path.Combine(_sourceDir, "SHOT_001_cmp_TT_v001.01002.exr"), DateTime.UtcNow);
+
+        var result = await NewStage().RunAsync(new ClaimedJob { Id = "job1" }, manifest, "machine1",
+            CancellationToken.None, CancellationToken.None);
+
+        Assert.False(result.Ok);
+        Assert.Contains("modified after validation", result.Items[0].ErrorMessage!);
+    }
+
+    [Fact]
+    public async Task UntouchedSourcesPassTheValidationTimestampCheck()
+    {
+        WriteFrames(3);
+        var manifest = Manifest();
+        manifest.Items[0].ValidatedAt = DateTimeOffset.UtcNow.AddHours(1);
+
+        var result = await NewStage().RunAsync(new ClaimedJob { Id = "job1" }, manifest, "machine1",
+            CancellationToken.None, CancellationToken.None);
+
+        Assert.True(result.Ok);
+    }
+
+    [Fact]
+    public async Task FrameCountDriftSinceQcFailsTheItem()
+    {
+        // The export recorded 3 frames at validation; the folder now has 2.
+        WriteFrames(2);
+        var result = await NewStage().RunAsync(new ClaimedJob { Id = "job1" }, Manifest(fileCount: 3), "machine1",
+            CancellationToken.None, CancellationToken.None);
+
+        Assert.False(result.Ok);
+        Assert.Contains("the render changed since QC", result.Items[0].ErrorMessage!);
+    }
+
+    [Fact]
+    public async Task MissingSourceFolderFailsWithThePath()
+    {
+        var manifest = Manifest();
+        manifest.Items[0].SourceDir = Path.Combine(_root, "does-not-exist");
+
+        var result = await NewStage().RunAsync(new ClaimedJob { Id = "job1" }, manifest, "machine1",
+            CancellationToken.None, CancellationToken.None);
+
+        Assert.False(result.Ok);
+        Assert.Contains("Source folder not found", result.Items[0].ErrorMessage!);
+    }
+
+    [Fact]
+    public async Task ChecksumMatchesTheValidationTimeDigestForIdenticalContent()
+    {
+        WriteFrames(3);
+        var first = await NewStage().RunAsync(new ClaimedJob { Id = "job1" },
+            Manifest(copyMode: "always-copy"), "machine1", CancellationToken.None, CancellationToken.None);
+
+        // Feeding the recorded digest back in must verify, which is exactly what
+        // the delivery builder does against Export.checksum on the copy path.
+        Directory.Delete(_packageDir, recursive: true);
+        var second = await NewStage().RunAsync(new ClaimedJob { Id = "job1" },
+            Manifest(checksum: first.Items[0].Checksum, copyMode: "always-copy"), "machine1",
+            CancellationToken.None, CancellationToken.None);
+
+        Assert.True(second.Ok);
+    }
+
+    [Fact]
+    public async Task NoClientCodeKeepsTheInternalRenderFilenames()
+    {
+        // Regression pin: DeliveredBaseName defaults to "" for a shot with no
+        // client code, and delivery must render byte-identical to before this
+        // feature existed.
+        WriteFrames(2);
+        var manifest = Manifest(fileCount: 2);
+        Assert.Equal("", manifest.Items[0].DeliveredBaseName);
+
+        var result = await NewStage().RunAsync(new ClaimedJob { Id = "job1" }, manifest, "machine1",
+            CancellationToken.None, CancellationToken.None);
+
+        Assert.True(result.Ok);
+        Assert.True(File.Exists(Path.Combine(_packageDir, "SHOT_001", "SHOT_001_cmp_TT_v001.01001.exr")));
+        Assert.True(File.Exists(Path.Combine(_packageDir, "SHOT_001", "SHOT_001_cmp_TT_v001.01002.exr")));
+    }
+
+    [Fact]
+    public async Task ClientCodeRenamesDeliveredFramesPreservingNumberAndPadding()
+    {
+        WriteFrames(3, startFrame: 1001);
+        var manifest = Manifest(fileCount: 3);
+        manifest.Items[0].DeliveredBaseName = "SNV_101_0461_CP_CAMF_PL_v001";
+
+        var result = await NewStage().RunAsync(new ClaimedJob { Id = "job1" }, manifest, "machine1",
+            CancellationToken.None, CancellationToken.None);
+
+        Assert.True(result.Ok);
+        var deliveredDir = Path.Combine(_packageDir, "SHOT_001");
+        Assert.True(File.Exists(Path.Combine(deliveredDir, "SNV_101_0461_CP_CAMF_PL_v001.01001.exr")));
+        Assert.True(File.Exists(Path.Combine(deliveredDir, "SNV_101_0461_CP_CAMF_PL_v001.01002.exr")));
+        Assert.True(File.Exists(Path.Combine(deliveredDir, "SNV_101_0461_CP_CAMF_PL_v001.01003.exr")));
+        // The internal shotCode-based name must not leak into the delivery.
+        Assert.False(File.Exists(Path.Combine(deliveredDir, "SHOT_001_cmp_TT_v001.01001.exr")));
+        Assert.Equal(3, Directory.GetFiles(deliveredDir, "*.exr").Length);
+    }
+
+    [Fact]
+    public async Task ClientCodeRenamesTheDeliveryMov()
+    {
+        WriteFrames(2);
+        var movSrc = Path.Combine(_sourceDir, "SHOT_001_cmp_TT_v001.mov");
+        File.WriteAllText(movSrc, "mov bytes");
+
+        var manifest = Manifest(fileCount: 2);
+        manifest.IncludeMovs = true;
+        manifest.Items[0].DeliveryMovPath = movSrc;
+        manifest.Items[0].DeliveredBaseName = "SNV_101_0461_CP_CAMF_PL_v001";
+
+        var result = await NewStage().RunAsync(new ClaimedJob { Id = "job1" }, manifest, "machine1",
+            CancellationToken.None, CancellationToken.None);
+
+        Assert.True(result.Ok);
+        var deliveredDir = Path.Combine(_packageDir, "SHOT_001");
+        Assert.True(File.Exists(Path.Combine(deliveredDir, "SNV_101_0461_CP_CAMF_PL_v001.mov")));
+        Assert.Equal(Path.Combine(deliveredDir, "SNV_101_0461_CP_CAMF_PL_v001.mov"), result.Items[0].MovPath);
+    }
+
+    [Fact]
+    public async Task ClientCodeRenameStillVerifiesAgainstTheValidationTimeChecksum()
+    {
+        // Renaming must not change file *content*, so a checksum recorded at
+        // validation time (against the internal name) has to still match the
+        // delivered (renamed) files — the hash is content-based, not name-based.
+        WriteFrames(3);
+        var manifest = Manifest(copyMode: "always-copy");
+        manifest.Items[0].DeliveredBaseName = "SNV_101_0461_CP_CAMF_PL_v001";
+        var first = await NewStage().RunAsync(new ClaimedJob { Id = "job1" }, manifest, "machine1",
+            CancellationToken.None, CancellationToken.None);
+        Assert.True(first.Ok);
+
+        Directory.Delete(_packageDir, recursive: true);
+        var replay = Manifest(checksum: first.Items[0].Checksum, copyMode: "always-copy");
+        replay.Items[0].DeliveredBaseName = "SNV_101_0461_CP_CAMF_PL_v001";
+        var second = await NewStage().RunAsync(new ClaimedJob { Id = "job1" }, replay, "machine1",
+            CancellationToken.None, CancellationToken.None);
+
+        Assert.True(second.Ok);
+    }
+
+    [Fact]
+    public async Task UnparseableFrameNumberFallsBackToTheSourceFilename()
+    {
+        // A file that doesn't match the render's own numbering convention
+        // (shouldn't happen for a real render, but must never crash a delivery)
+        // is delivered under its original name rather than failing the item.
+        Directory.CreateDirectory(_sourceDir);
+        File.WriteAllText(Path.Combine(_sourceDir, "SHOT_001_cmp_TT_v001_no_frame_number.exr"), "junk");
+        var manifest = Manifest(fileCount: 1);
+        manifest.Items[0].OutputPattern = "SHOT_001_cmp_TT_v001_no_frame_number.exr";
+        manifest.Items[0].DeliveredBaseName = "SNV_101_0461_CP_CAMF_PL_v001";
+
+        var result = await NewStage().RunAsync(new ClaimedJob { Id = "job1" }, manifest, "machine1",
+            CancellationToken.None, CancellationToken.None);
+
+        Assert.True(result.Ok);
+        Assert.True(File.Exists(Path.Combine(_packageDir, "SHOT_001", "SHOT_001_cmp_TT_v001_no_frame_number.exr")));
+    }
+}

RenderWorker/VFXReviewWorker.Tests/ExrHeaderTests.cs

@@ -0,0 +1,199 @@
+using VFXReviewWorker;
+using Xunit;
+
+namespace VFXReviewWorker.Tests;
+
+/// <summary>
+/// The timecode check is the reason the validation engine exists (§8.1a), so
+/// the header parse and the timecode arithmetic are pinned here against a
+/// synthetic EXR built byte by byte.
+/// </summary>
+public class ExrHeaderTests
+{
+    [Fact]
+    public void ReadsTimecodeResolutionChannelsAndFps()
+    {
+        var path = ExrFixture.Write(timecode: "18:58:57:12", width: 1920, height: 1080,
+            channels: new[] { ("A", 1), ("B", 1), ("G", 1), ("R", 1) }, fpsNum: 24, compression: 4);
+        try
+        {
+            var header = ExrHeader.Read(path);
+
+            Assert.Equal(new Timecode(18, 58, 57, 12, false), header.Timecode);
+            Assert.Equal(1920, header.DataWidth);
+            Assert.Equal(1080, header.DataHeight);
+            Assert.Equal(24, header.FramesPerSecond);
+            Assert.Equal("half", header.BitDepth);
+            Assert.True(header.HasAlpha);
+            Assert.Equal("PIZ", header.CompressionName);
+        }
+        finally { File.Delete(path); }
+    }
+
+    [Fact]
+    public void MissingTimecodeIsReportedAsAbsentNotAsZero()
+    {
+        var path = ExrFixture.Write(timecode: null, width: 1920, height: 1080,
+            channels: new[] { ("B", 1), ("G", 1), ("R", 1) }, fpsNum: 24, compression: 3);
+        try
+        {
+            var header = ExrHeader.Read(path);
+            Assert.Null(header.Timecode);
+            Assert.False(header.HasAlpha);
+        }
+        finally { File.Delete(path); }
+    }
+
+    [Fact]
+    public void NonExrFileThrows()
+    {
+        var path = Path.GetTempFileName();
+        try
+        {
+            File.WriteAllText(path, "this is not an exr at all, not even close");
+            Assert.Throws<InvalidDataException>(() => ExrHeader.Read(path));
+            Assert.Null(ExrHeader.TryRead(path));
+        }
+        finally { File.Delete(path); }
+    }
+
+    [Theory]
+    // The BCD packing means the raw value reads back as its own hex digits.
+    [InlineData(0x18585712u, 18, 58, 57, 12)]
+    [InlineData(0x00004117u, 0, 0, 41, 17)]
+    [InlineData(0x00000000u, 0, 0, 0, 0)]
+    public void DecodesPackedSmpteTimecode(uint packed, int hh, int mm, int ss, int ff)
+    {
+        Assert.Equal(new Timecode(hh, mm, ss, ff, false), Timecode.FromPacked(packed));
+    }
+
+    [Fact]
+    public void FrameArithmeticRoundTrips()
+    {
+        var tc = new Timecode(18, 58, 57, 12, false);
+        Assert.Equal(tc, Timecode.FromFrames(tc.ToFrames(24), 24));
+
+        // 133 frames on from 18:58:57:12 at 24 fps is 18:59:03:01 — the real
+        // first/last frame pair measured on UNG_102_019_010 v005.
+        Assert.Equal(new Timecode(18, 59, 3, 1, false), Timecode.FromFrames(tc.ToFrames(24) + 133, 24));
+    }
+
+    [Fact]
+    public void ApiTimecodeIsOneHandleAheadOfThePlate()
+    {
+        // The defect class from §8.1a: the API stores the editorial in-point and
+        // the plate starts 8 frames earlier, so a comp anchored to the API value
+        // renders 8 frames late.
+        var plate = Timecode.Parse("13:44:06:02")!.Value;
+        var api = Timecode.Parse("13:44:06:10")!.Value;
+        Assert.Equal(8, api.ToFrames(24) - plate.ToFrames(24));
+    }
+
+    [Fact]
+    public void FrameDerivedTimecodeIsFrameNumberOverFps()
+    {
+        // 00:00:41:17 is frame 1001 at 24 fps — the signature of a comp built
+        // with no source timecode at all.
+        Assert.Equal(1001, Timecode.Parse("00:00:41:17")!.Value.ToFrames(24));
+    }
+
+    [Theory]
+    [InlineData("UNG_102_019_010_cmp_TT_v005.01001.exr", 1001)]
+    [InlineData("UNG_108_030_010_cmp_TT_v003.01204.exr", 1204)]
+    // AE-written renders separate the frame with an underscore, and turn up as
+    // layers in a shot comp alongside dot-separated delivered plates.
+    [InlineData("UNG_110_030_010_PRERENDER_01001.exr", 1001)]
+    [InlineData("UNG_110_030_010_render_1001.exr", 1001)]
+    [InlineData("no_frame_number.exr", null)]
+    // A version suffix is not a frame number.
+    [InlineData("UNG_110_030_010_BG01_TT_v001.exr", null)]
+    public void ParsesFrameNumbersFromFilenames(string name, int? expected)
+    {
+        Assert.Equal(expected, SequencePattern.FrameFromName(name));
+    }
+
+    [Fact]
+    public void ParsesOutputPattern()
+    {
+        var p = SequencePattern.FromOutputPattern("UNG_102_019_010_cmp_TT_v005.[#####].exr");
+        Assert.Equal("UNG_102_019_010_cmp_TT_v005", p.Prefix);
+        Assert.Equal(".exr", p.Extension);
+        Assert.Equal(5, p.Padding);
+    }
+}
+
+/// <summary>Builds a minimal but structurally real EXR header on disk.</summary>
+internal static class ExrFixture
+{
+    public static string Write(string? timecode, int width, int height,
+        (string Name, int PixelType)[] channels, int fpsNum, byte compression)
+    {
+        var path = Path.Combine(Path.GetTempPath(), $"vfxr_test_{Guid.NewGuid():N}.exr");
+        using var fs = new FileStream(path, FileMode.Create, FileAccess.Write);
+        using var w = new BinaryWriter(fs);
+
+        w.Write(ExrHeader.Magic);
+        w.Write(2); // version 2, no flags
+
+        // channels (chlist)
+        using (var chData = new MemoryStream())
+        using (var cw = new BinaryWriter(chData))
+        {
+            foreach (var (name, pixelType) in channels)
+            {
+                WriteCString(cw, name);
+                cw.Write(pixelType);
+                cw.Write((byte)0);          // pLinear
+                cw.Write(new byte[3]);      // reserved
+                cw.Write(1);                // xSampling
+                cw.Write(1);                // ySampling
+            }
+            cw.Write((byte)0);              // list terminator
+            WriteAttr(w, "channels", "chlist", chData.ToArray());
+        }
+
+        WriteAttr(w, "compression", "compression", new[] { compression });
+
+        var window = new byte[16];
+        BitConverter.GetBytes(0).CopyTo(window, 0);
+        BitConverter.GetBytes(0).CopyTo(window, 4);
+        BitConverter.GetBytes(width - 1).CopyTo(window, 8);
+        BitConverter.GetBytes(height - 1).CopyTo(window, 12);
+        WriteAttr(w, "dataWindow", "box2i", window);
+        WriteAttr(w, "displayWindow", "box2i", window);
+
+        var rational = new byte[8];
+        BitConverter.GetBytes(fpsNum).CopyTo(rational, 0);
+        BitConverter.GetBytes(1u).CopyTo(rational, 4);
+        WriteAttr(w, "framesPerSecond", "rational", rational);
+
+        if (timecode is not null)
+        {
+            var parts = timecode.Split(':');
+            uint Bcd(int v) => (uint)((v / 10) * 16 + v % 10);
+            var packed = (Bcd(int.Parse(parts[0])) << 24) | (Bcd(int.Parse(parts[1])) << 16)
+                       | (Bcd(int.Parse(parts[2])) << 8) | Bcd(int.Parse(parts[3]));
+            var tcData = new byte[8];
+            BitConverter.GetBytes(packed).CopyTo(tcData, 0);
+            WriteAttr(w, "timeCode", "timecode", tcData);
+            WriteAttr(w, "timeCodeString", "string", System.Text.Encoding.ASCII.GetBytes(timecode));
+        }
+
+        w.Write((byte)0); // end of header
+        return path;
+    }
+
+    private static void WriteAttr(BinaryWriter w, string name, string type, byte[] data)
+    {
+        WriteCString(w, name);
+        WriteCString(w, type);
+        w.Write(data.Length);
+        w.Write(data);
+    }
+
+    private static void WriteCString(BinaryWriter w, string s)
+    {
+        w.Write(System.Text.Encoding.ASCII.GetBytes(s));
+        w.Write((byte)0);
+    }
+}

RenderWorker/VFXReviewWorker.Tests/MovReviewStageTests.cs

@@ -0,0 +1,193 @@
+using Microsoft.Extensions.Logging.Abstractions;
+using VFXReviewWorker;
+using Xunit;
+
+namespace VFXReviewWorker.Tests;
+
+/// <summary>
+/// MOV review packages (RenderPipeline2 §11.6). A review folder is opened
+/// directly by a producer, so the things pinned here are the ones they would
+/// notice: it is flat, it carries the client's own naming, and it contains the
+/// MOVs and nothing else.
+/// </summary>
+public class MovReviewStageTests : IDisposable
+{
+    private readonly string _root = Path.Combine(Path.GetTempPath(), $"vfxr_review_{Guid.NewGuid():N}");
+    private readonly string _renderDir;
+    private readonly string _reviewDir;
+
+    public MovReviewStageTests()
+    {
+        _renderDir = Path.Combine(_root, "renders", "SHOT_001", "v004");
+        _reviewDir = Path.Combine(_root, "DELIVERY", "PRODUCER_REVIEWS", "20260828_Producer_review");
+        Directory.CreateDirectory(_renderDir);
+    }
+
+    public void Dispose()
+    {
+        try { Directory.Delete(_root, recursive: true); } catch { }
+    }
+
+    private string WriteMov(string shotCode, string version, string contents = "mov bytes")
+    {
+        var path = Path.Combine(_renderDir, $"{shotCode}_cmp_TT_{version}.mov");
+        File.WriteAllText(path, contents);
+        return path;
+    }
+
+    private DeliveryManifest Manifest(params DeliveryManifestItem[] items) => new()
+    {
+        Kind = "MOV_REVIEW",
+        PackageId = "pkg1",
+        PackageName = "20260828_Producer_review",
+        PackageNumber = 7,
+        Episode = "101",
+        PackageDir = _reviewDir,
+        // A review writes no report; the server keeps the record instead.
+        ReportFile = "",
+        Items = items.ToList(),
+    };
+
+    private DeliveryManifestItem Item(
+        string shotCode, string version, string? movPath, string? deliveredBase = null) => new()
+    {
+        ItemId = $"item_{shotCode}",
+        ExportId = $"exp_{shotCode}",
+        ShotCode = shotCode,
+        VersionString = version,
+        SourceDir = "",
+        OutputPattern = "",
+        FrameStart = 1001,
+        FrameEnd = 1050,
+        DeliveryMovPath = movPath,
+        // Flat: every item's folder is the package folder itself.
+        ShotDir = _reviewDir,
+        DeliveredBaseName = deliveredBase ?? $"{shotCode}_cmp_TT_{version}",
+    };
+
+    private DeliveryStage NewStage() => new(
+        new WorkerOptions { ServerUrl = "n/a", ApiKey = "n/a" },
+        new ApiClient(new WorkerOptions { ServerUrl = "http://localhost:1", ApiKey = "x" }, NullLogger<ApiClient>.Instance),
+        NullLogger<DeliveryStage>.Instance);
+
+    [Fact]
+    public async Task BuildsAFlatFolderOfMovsUnderTheClientFacingName()
+    {
+        var mov = WriteMov("SHOT_001", "v004");
+        var manifest = Manifest(Item("SHOT_001", "v004", mov, deliveredBase: "EP6_VFX_012_v004"));
+
+        var result = await NewStage().RunAsync(new ClaimedJob { Id = "job1" }, manifest, "machine1",
+            CancellationToken.None, CancellationToken.None);
+
+        Assert.True(result.Ok);
+        var item = Assert.Single(result.Items);
+        Assert.Equal("VERIFIED", item.Status);
+        Assert.Equal(1, item.FileCount);
+        // No shot subfolder: the MOVs sit beside each other to be scrubbed through.
+        Assert.Null(item.ExrPath);
+        Assert.Equal(Path.Combine(_reviewDir, "EP6_VFX_012_v004.mov"), item.MovPath);
+        Assert.Single(Directory.GetDirectories(_reviewDir).Concat(Directory.GetFiles(_reviewDir)));
+    }
+
+    [Fact]
+    public async Task LeavesNoReportOrManifestBesideTheMovs()
+    {
+        var manifest = Manifest(Item("SHOT_001", "v004", WriteMov("SHOT_001", "v004")));
+
+        var result = await NewStage().RunAsync(new ClaimedJob { Id = "job1" }, manifest, "machine1",
+            CancellationToken.None, CancellationToken.None);
+
+        Assert.True(result.Ok);
+        Assert.Null(result.ReportPath);
+        // What a producer opens is exactly the MOVs — no manifest.json, no CSV.
+        Assert.False(File.Exists(Path.Combine(_reviewDir, "manifest.json")));
+        Assert.All(Directory.GetFiles(_reviewDir), f => Assert.EndsWith(".mov", f));
+    }
+
+    [Fact]
+    public async Task HardLinksSoASeventyShotReviewCostsNoDisk()
+    {
+        var mov = WriteMov("SHOT_001", "v004");
+        var manifest = Manifest(Item("SHOT_001", "v004", mov));
+
+        var result = await NewStage().RunAsync(new ClaimedJob { Id = "job1" }, manifest, "machine1",
+            CancellationToken.None, CancellationToken.None);
+
+        Assert.Equal("hardlink", result.Items[0].LinkMode);
+        File.WriteAllText(mov, "rewritten");
+        Assert.Equal("rewritten", File.ReadAllText(result.Items[0].MovPath!));
+    }
+
+    [Fact]
+    public async Task AlwaysCopyModeProducesAnIndependentFile()
+    {
+        var mov = WriteMov("SHOT_001", "v004");
+        var manifest = Manifest(Item("SHOT_001", "v004", mov));
+        manifest.CopyMode = "always-copy";
+
+        var result = await NewStage().RunAsync(new ClaimedJob { Id = "job1" }, manifest, "machine1",
+            CancellationToken.None, CancellationToken.None);
+
+        Assert.True(result.Ok);
+        Assert.Equal("copy", result.Items[0].LinkMode);
+        File.WriteAllText(mov, "rewritten");
+        Assert.NotEqual("rewritten", File.ReadAllText(result.Items[0].MovPath!));
+    }
+
+    [Fact]
+    public async Task AMissingMovFailsTheReviewRatherThanShippingItShort()
+    {
+        // In an EXR delivery a missing MOV is a missing viewing copy and the
+        // package continues. In a review the MOV *is* the deliverable.
+        var manifest = Manifest(Item("SHOT_001", "v004", Path.Combine(_renderDir, "never_rendered.mov")));
+
+        var result = await NewStage().RunAsync(new ClaimedJob { Id = "job1" }, manifest, "machine1",
+            CancellationToken.None, CancellationToken.None);
+
+        Assert.False(result.Ok);
+        Assert.Equal("FAILED", result.Items[0].Status);
+        Assert.Contains("Preview MOV not found", result.Items[0].ErrorMessage!);
+    }
+
+    [Fact]
+    public async Task AnItemWithNoRecordedMovFails()
+    {
+        var manifest = Manifest(Item("SHOT_001", "v004", null));
+
+        var result = await NewStage().RunAsync(new ClaimedJob { Id = "job1" }, manifest, "machine1",
+            CancellationToken.None, CancellationToken.None);
+
+        Assert.False(result.Ok);
+        Assert.Contains("No preview MOV", result.Items[0].ErrorMessage!);
+    }
+
+    [Fact]
+    public async Task HashesEveryFileWhenTheConfigDemandsIt()
+    {
+        var manifest = Manifest(Item("SHOT_001", "v004", WriteMov("SHOT_001", "v004")));
+        manifest.VerifyMode = "always-hash";
+
+        var result = await NewStage().RunAsync(new ClaimedJob { Id = "job1" }, manifest, "machine1",
+            CancellationToken.None, CancellationToken.None);
+
+        Assert.True(result.Ok);
+        // A MOV has no validation-time digest of its own, so the one recorded
+        // here is the one this build computed.
+        Assert.False(string.IsNullOrWhiteSpace(result.Items[0].Checksum));
+    }
+
+    [Fact]
+    public async Task OneBadShotFailsThePackageAndTheRestStillReport()
+    {
+        var manifest = Manifest(
+            Item("SHOT_001", "v004", WriteMov("SHOT_001", "v004")),
+            Item("SHOT_002", "v002", Path.Combine(_renderDir, "absent.mov")));
+
+        var result = await NewStage().RunAsync(new ClaimedJob { Id = "job1" }, manifest, "machine1",
+            CancellationToken.None, CancellationToken.None);
+
+        Assert.False(result.Ok);
+        Assert.Equal("VERIFIED", result.Items[0].Status);
+        Assert.Equal("FAILED", result.Items[1].Status);
+    }
+}

RenderWorker/VFXReviewWorker.Tests/MultipartUploadTests.cs

@@ -0,0 +1,205 @@
+using System.Collections.Concurrent;
+using System.Net;
+using System.Net.Sockets;
+using System.Text.Json;
+using Microsoft.Extensions.Logging.Abstractions;
+using VFXReviewWorker;
+using Xunit;
+
+namespace VFXReviewWorker.Tests;
+
+/// <summary>
+/// Large artifacts go up as parallel multipart parts: from the studio a single
+/// connection to object storage is capped near 0.1 MB/s, so a ProRes MOV could
+/// not finish inside the 30 min request timeout. These drive the real upload
+/// code against a local fake of the server + storage.
+/// </summary>
+public class MultipartUploadTests : IDisposable
+{
+    private const int PartSize = 8 * 1024 * 1024;
+
+    private readonly HttpListener _listener = new();
+    private readonly string _base;
+    private readonly ConcurrentDictionary<int, byte[]> _parts = new();
+    private readonly ConcurrentDictionary<int, int> _failuresLeft = new();
+    private readonly ConcurrentBag<string> _completions = new();
+    private int _inFlight, _maxInFlight;
+    private bool _multipartSupported = true;
+    private byte[]? _singlePut;
+
+    public MultipartUploadTests()
+    {
+        var port = FreePort();
+        _base = $"http://localhost:{port}/";
+        _listener.Prefixes.Add(_base);
+        _listener.Start();
+        _ = Task.Run(Serve);
+    }
+
+    private static int FreePort()
+    {
+        var l = new TcpListener(IPAddress.Loopback, 0);
+        l.Start();
+        var port = ((IPEndPoint)l.LocalEndpoint).Port;
+        l.Stop();
+        return port;
+    }
+
+    private async Task Serve()
+    {
+        while (_listener.IsListening)
+        {
+            HttpListenerContext ctx;
+            try { ctx = await _listener.GetContextAsync(); } catch { return; }
+            _ = Task.Run(() => Handle(ctx));
+        }
+    }
+
+    private async Task Handle(HttpListenerContext ctx)
+    {
+        var path = ctx.Request.Url!.AbsolutePath;
+        using var ms = new MemoryStream();
+        await ctx.Request.InputStream.CopyToAsync(ms);
+        var body = ms.ToArray();
+        var res = ctx.Response;
+
+        if (path.EndsWith("/artifact-presign"))
+        {
+            var req = JsonDocument.Parse(body).RootElement;
+            var size = req.GetProperty("size").GetInt64();
+            object payload = _multipartSupported && req.GetProperty("multipart").GetBoolean()
+                ? new
+                {
+                    key = "highres/x.mov",
+                    uploadId = "up1",
+                    partSize = PartSize,
+                    partUrls = Enumerable.Range(1, (int)((size + PartSize - 1) / PartSize))
+                        .Select(n => $"{_base}part/{n}").ToList(),
+                }
+                : new { key = "highres/x.mov", presignedUrl = $"{_base}single" };
+            await Json(res, payload);
+        }
+        else if (path.StartsWith("/part/"))
+        {
+            var n = int.Parse(path["/part/".Length..]);
+            var now = Interlocked.Increment(ref _inFlight);
+            InterlockedMax(ref _maxInFlight, now);
+            await Task.Delay(50);
+            Interlocked.Decrement(ref _inFlight);
+            if (_failuresLeft.TryGetValue(n, out var left) && left > 0)
+            {
+                _failuresLeft[n] = left - 1;
+                res.StatusCode = 500;
+                res.Close();
+                return;
+            }
+            _parts[n] = body;
+            res.Headers["ETag"] = $"\"etag-{n}\"";
+            res.Close();
+        }
+        else if (path == "/single")
+        {
+            _singlePut = body;
+            res.Close();
+        }
+        else if (path.EndsWith("/artifact-complete"))
+        {
+            _completions.Add(System.Text.Encoding.UTF8.GetString(body));
+            await Json(res, new { ok = true });
+        }
+        else
+        {
+            res.StatusCode = 404;
+            res.Close();
+        }
+    }
+
+    private static void InterlockedMax(ref int target, int value)
+    {
+        int seen;
+        while ((seen = Volatile.Read(ref target)) < value && Interlocked.CompareExchange(ref target, value, seen) != seen) { }
+    }
+
+    private static async Task Json(HttpListenerResponse res, object payload)
+    {
+        var bytes = JsonSerializer.SerializeToUtf8Bytes(payload, WorkerOptions.JsonOpts);
+        res.ContentType = "application/json";
+        await res.OutputStream.WriteAsync(bytes);
+        res.Close();
+    }
+
+    private ApiClient Client(int concurrency = 4) =>
+        new(new WorkerOptions { ServerUrl = _base, ApiKey = "k", UploadConcurrency = concurrency },
+            NullLogger<ApiClient>.Instance);
+
+    private static string TempFile(int bytes)
+    {
+        var path = Path.GetTempFileName();
+        var data = new byte[bytes];
+        new Random(42).NextBytes(data);
+        File.WriteAllBytes(path, data);
+        return path;
+    }
+
+    [Fact]
+    public async Task Uploads_parts_in_parallel_and_stitches_them_in_order()
+    {
+        var file = TempFile(PartSize * 5 + 12345);
+        long lastProgress = 0;
+        var key = await Client(4).UploadArtifactAsync("job1", "m1", "highres", file, "video/quicktime",
+            CancellationToken.None, sent => Interlocked.Exchange(ref lastProgress, sent));
+
+        Assert.Equal("highres/x.mov", key);
+        var stitched = Enumerable.Range(1, 6).SelectMany(n => _parts[n]).ToArray();
+        Assert.Equal(File.ReadAllBytes(file), stitched);
+        Assert.True(_maxInFlight > 1, "parts should upload concurrently");
+        Assert.True(_maxInFlight <= 4, "concurrency is capped by UploadConcurrency");
+        Assert.Equal(new FileInfo(file).Length, Interlocked.Read(ref lastProgress));
+
+        var complete = JsonDocument.Parse(Assert.Single(_completions)).RootElement;
+        Assert.False(complete.TryGetProperty("abort", out _));
+        Assert.Equal(6, complete.GetProperty("parts").GetArrayLength());
+        Assert.Equal("\"etag-1\"", complete.GetProperty("parts")[0].GetProperty("etag").GetString());
+        File.Delete(file);
+    }
+
+    [Fact]
+    public async Task A_failed_part_is_retried_on_its_own()
+    {
+        var file = TempFile(PartSize * 3);
+        _failuresLeft[2] = 2;
+        var key = await Client().UploadArtifactAsync("job1", "m1", "highres", file, "video/quicktime", CancellationToken.None);
+
+        Assert.NotNull(key);
+        Assert.Equal(File.ReadAllBytes(file), Enumerable.Range(1, 3).SelectMany(n => _parts[n]).ToArray());
+        File.Delete(file);
+    }
+
+    [Fact]
+    public async Task A_part_that_keeps_failing_aborts_the_upload()
+    {
+        var file = TempFile(PartSize * 3);
+        _failuresLeft[3] = 99;
+        var key = await Client().UploadArtifactAsync("job1", "m1", "highres", file, "video/quicktime", CancellationToken.None);
+
+        Assert.Null(key);
+        var abort = JsonDocument.Parse(Assert.Single(_completions)).RootElement;
+        Assert.True(abort.GetProperty("abort").GetBoolean());
+        File.Delete(file);
+    }
+
+    [Fact]
+    public async Task Falls_back_to_a_single_put_on_a_server_without_multipart()
+    {
+        _multipartSupported = false;
+        var file = TempFile(PartSize * 3);
+        var key = await Client().UploadArtifactAsync("job1", "m1", "highres", file, "video/quicktime", CancellationToken.None);
+
+        Assert.Equal("highres/x.mov", key);
+        Assert.Equal(File.ReadAllBytes(file), _singlePut);
+        Assert.Empty(_completions);
+        File.Delete(file);
+    }
+
+    public void Dispose() => _listener.Close();
+}

RenderWorker/VFXReviewWorker.Tests/PathMapperTests.cs

@@ -70,6 +70,59 @@ public class PrepareOutputDirTests
         }
     }
 
+    /// <summary>
+    /// The version folder holds the preview MOV/MP4 built from the same
+    /// basename. A shot re-rendered at the same version — the "No preview"
+    /// workflow, where the EXRs are re-exported unscaled and the earlier MOV is
+    /// inherited as the review media — must not have that MOV cleared out from
+    /// under it before aerender starts.
+    /// </summary>
+    [Fact]
+    public void KeepsPreviewMediaSharingThePatternPrefix()
+    {
+        var dir = Path.Combine(Path.GetTempPath(), "vfxr-test-" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(dir);
+        try
+        {
+            File.WriteAllText(Path.Combine(dir, "SHOT_cmp_TT_v004.1001.exr"), "old");
+            File.WriteAllText(Path.Combine(dir, "SHOT_cmp_TT_v004.mov"), "delivery mov");
+            File.WriteAllText(Path.Combine(dir, "SHOT_cmp_TT_v004.mp4"), "review mp4");
+
+            AerenderRunner.PrepareOutputDir(dir, "SHOT_cmp_TT_v004.[####].exr");
+
+            Assert.False(File.Exists(Path.Combine(dir, "SHOT_cmp_TT_v004.1001.exr")));
+            Assert.True(File.Exists(Path.Combine(dir, "SHOT_cmp_TT_v004.mov")));
+            Assert.True(File.Exists(Path.Combine(dir, "SHOT_cmp_TT_v004.mp4")));
+        }
+        finally
+        {
+            Directory.Delete(dir, recursive: true);
+        }
+    }
+
+    [Fact]
+    public void ClearsOnlyThisVersionsFrames()
+    {
+        var dir = Path.Combine(Path.GetTempPath(), "vfxr-test-" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(dir);
+        try
+        {
+            File.WriteAllText(Path.Combine(dir, "SHOT_cmp_TT_v004.1001.exr"), "old");
+            File.WriteAllText(Path.Combine(dir, "SHOT_cmp_TT_v005.1001.exr"), "other version");
+            File.WriteAllText(Path.Combine(dir, "OTHERSHOT_cmp_TT_v004.1001.exr"), "other shot");
+
+            AerenderRunner.PrepareOutputDir(dir, "SHOT_cmp_TT_v004.[####].exr");
+
+            Assert.False(File.Exists(Path.Combine(dir, "SHOT_cmp_TT_v004.1001.exr")));
+            Assert.True(File.Exists(Path.Combine(dir, "SHOT_cmp_TT_v005.1001.exr")));
+            Assert.True(File.Exists(Path.Combine(dir, "OTHERSHOT_cmp_TT_v004.1001.exr")));
+        }
+        finally
+        {
+            Directory.Delete(dir, recursive: true);
+        }
+    }
+
     [Fact]
     public void CreatesMissingDirectory()
     {

RenderWorker/VFXReviewWorker.Tests/ProgressParserTests.cs

@@ -117,4 +117,21 @@ public class LogTailTests
         for (var i = 1; i <= 5; i++) tail.Add($"line {i}");
         Assert.Equal("line 3\nline 4\nline 5", tail.ToString());
     }
+
+    [Fact]
+    public async Task ReadingWhileAnotherThreadWritesDoesNotThrow()
+    {
+        // The Blender runner's output pumps add lines while its progress loop
+        // reads the tail; unsynchronised this threw "Collection was modified".
+        var tail = new LogTail(200);
+        using var stop = new CancellationTokenSource(TimeSpan.FromSeconds(1));
+        var writer = Task.Run(() =>
+        {
+            var i = 0;
+            while (!stop.IsCancellationRequested) tail.Add($"Fra:1001 Sample {i++}/128");
+        });
+
+        while (!stop.IsCancellationRequested) _ = tail.ToString();
+        await writer;
+    }
 }

RenderWorker/VFXReviewWorker.Tests/ThumbnailSeekTests.cs

@@ -0,0 +1,54 @@
+using VFXReviewWorker;
+using Xunit;
+
+namespace VFXReviewWorker.Tests;
+
+/// <summary>
+/// The preview MP4 opens on the Netflix slate. ffmpeg's <c>thumbnail</c> filter
+/// only considers the first 100 frames, so every thumbnail the pipeline has ever
+/// produced was a picture of the slate card rather than of the shot — invisible
+/// while thumbnails were only decoration in the QC queue, and unacceptable now
+/// they can become a shot's thumbnail.
+///
+/// The fix is to seek past the slate, so the seek arithmetic is worth pinning.
+/// </summary>
+public class ThumbnailSeekTests
+{
+    private static PreviewBuildResult Build(double? pictureStart, int? frameCount) =>
+        new() { PictureStartSeconds = pictureStart, FrameCount = frameCount };
+
+    [Fact]
+    public void SeeksAQuarterIntoPictureNotIntoTheFile()
+    {
+        // 5s slate, then 96 frames (4s) of picture at 24fps → 5 + 1 = 6s.
+        var seek = PreviewStage.ThumbnailSeekSeconds(Build(5.0, 96), 24);
+        Assert.NotNull(seek);
+        Assert.Equal(6.0, seek!.Value, 3);
+    }
+
+    [Fact]
+    public void HandlesATemplateWithNoSlateAtAll()
+    {
+        var seek = PreviewStage.ThumbnailSeekSeconds(Build(0.0, 240), 24);
+        Assert.Equal(2.5, seek!.Value, 3);
+    }
+
+    [Fact]
+    public void FallsBackWhenTheBuildDidNotReportWherePictureStarts()
+    {
+        // Older worker, or a template with no SHOT layer: null means "keep the
+        // old whole-file behaviour" rather than guessing an offset.
+        Assert.Null(PreviewStage.ThumbnailSeekSeconds(Build(null, 96), 24));
+        Assert.Null(PreviewStage.ThumbnailSeekSeconds(null, 24));
+    }
+
+    [Theory]
+    [InlineData(-1.0, 96, 24)]   // negative slate length
+    [InlineData(5.0, 0, 24)]     // no picture frames
+    [InlineData(5.0, -5, 24)]    // nonsense frame count
+    [InlineData(5.0, 96, 0)]     // no fps to divide by
+    public void RefusesNumbersThatDoNotDescribeARealClip(double start, int frames, double fps)
+    {
+        Assert.Null(PreviewStage.ThumbnailSeekSeconds(Build(start, frames), fps));
+    }
+}

RenderWorker/VFXReviewWorker.Tests/ValidationStageTests.cs

@@ -0,0 +1,262 @@
+using Microsoft.Extensions.Logging.Abstractions;
+using VFXReviewWorker;
+using Xunit;
+
+namespace VFXReviewWorker.Tests;
+
+/// <summary>
+/// Regression cover for the two coordinate systems a render lives in, taken
+/// from a real failure on UNG_107_051_010 v004:
+///
+///   comp frames  1247792-1247896  (anchored to the plate's timecode 14:26:31:08)
+///   file numbers 1001-1105        (the output module's starting number)
+///
+/// Checking file numbers against comp frames failed every render, and using
+/// the comp range as the timecode anchor produced a million-frame offset.
+/// </summary>
+public class ValidationStageTests : IDisposable
+{
+    private readonly string _dir = Path.Combine(Path.GetTempPath(), $"vfxr_val_{Guid.NewGuid():N}");
+
+    public ValidationStageTests() => Directory.CreateDirectory(_dir);
+
+    public void Dispose()
+    {
+        try { Directory.Delete(_dir, recursive: true); } catch { }
+    }
+
+    /// <summary>Writes a sequence numbered from 1001 with a plate-derived timecode.</summary>
+    private void WriteSequence(int count, string startTimecode, int firstFrame = 1001, int fps = 24)
+    {
+        var start = Timecode.Parse(startTimecode)!.Value.ToFrames(fps);
+        for (var i = 0; i < count; i++)
+        {
+            var tc = Timecode.FromFrames(start + i, fps);
+            var path = Path.Combine(_dir, $"UNG_107_051_010_cmp_TT_v004.{firstFrame + i:D5}.exr");
+            File.Move(ExrFixture.Write(tc.ToString(), 3840, 2160, new[] { ("B", 1), ("G", 1), ("R", 1) }, fps, 4), path);
+        }
+    }
+
+    private static RenderManifest Manifest(string dir, string? apiTimecode, int? outputFrameStart) => new()
+    {
+        ShotCode = "UNG_107_051_010",
+        OutputDir = dir,
+        OutputPattern = "UNG_107_051_010_cmp_TT_v004.[#####].exr",
+        // The comp is anchored to the plate timecode, so its frames are absolute.
+        FrameStart = 1247792,
+        FrameEnd = 1247896,
+        OutputFrameStart = outputFrameStart,
+        Fps = 24,
+        Width = 3840,
+        Height = 2160,
+        Expected = apiTimecode is null ? null : new ManifestExpected { TimecodeStart = apiTimecode },
+    };
+
+    private ValidationStage NewStage() =>
+        new(new WorkerOptions { ServerUrl = "n/a", ApiKey = "n/a" }, NullLogger<ValidationStage>.Instance);
+
+    private static ValidationCheck Check(ValidationOutcome o, string name) =>
+        o.Checks.Single(c => c.CheckName == name);
+
+    [Fact]
+    public void FileNumberingIsCheckedAgainstOutputStartNotCompFrames()
+    {
+        WriteSequence(105, "14:26:31:08");
+        var outcome = NewStage().Run(Manifest(_dir, "14:26:31:16", 1001), _dir, new ServerConfig());
+
+        Assert.Equal("PASS", Check(outcome, "file_count").Status);
+        Assert.Equal("PASS", Check(outcome, "first_frame").Status);
+        Assert.Equal("PASS", Check(outcome, "last_frame").Status);
+        Assert.Equal("PASS", Check(outcome, "missing_frames").Status);
+        Assert.Equal("1105", Check(outcome, "last_frame").Actual);
+    }
+
+    [Fact]
+    public void ApiTimecodeIsAnchoredOnTheRenderNotTheCompRange()
+    {
+        // Shot.timecodeStart is the edit in-point; the plate carries 8 frames of
+        // head handle, so the first rendered frame is 8 frames earlier.
+        WriteSequence(105, "14:26:31:08");
+        var outcome = NewStage().Run(Manifest(_dir, "14:26:31:16", 1001), _dir, new ServerConfig());
+
+        var tc = Check(outcome, "timecode_plate_match");
+        // WARN, never PASS: the API is a fallback reference (§8.1a).
+        Assert.Equal("WARN", tc.Status);
+        Assert.Equal("14:26:31:08", tc.Expected);
+        Assert.Equal("14:26:31:08", tc.Actual);
+        Assert.DoesNotContain("frames)", tc.Message ?? "");
+    }
+
+    [Fact]
+    public void RealTimecodeDefectStillFailsAgainstAPlate()
+    {
+        // Same shot, but rendered 8 frames late — the handle-offset defect.
+        WriteSequence(105, "14:26:31:16");
+        var plate = Path.Combine(_dir, "plate", "UNG_107_051_010_BG01_TT_v001.01001.exr");
+        Directory.CreateDirectory(Path.GetDirectoryName(plate)!);
+        File.Move(ExrFixture.Write("14:26:31:08", 3840, 2160, new[] { ("B", 1), ("G", 1), ("R", 1) }, 24, 4), plate);
+
+        var manifest = Manifest(_dir, "14:26:31:16", 1001);
+        manifest.Source = new ManifestSource
+        {
+            TimingPlate = new PlateRef { Path = plate, FrameStart = 1001 },
+            HandleFrames = 8,
+        };
+
+        var tc = Check(NewStage().Run(manifest, _dir, new ServerConfig()), "timecode_plate_match");
+        Assert.Equal("FAIL", tc.Status);
+        Assert.Contains("+8 frames", tc.Message);
+        Assert.Contains("8-frame handle", tc.Message);
+    }
+
+    /// <summary>Writes a one-frame plate into a footage-style element folder.</summary>
+    private string WritePlate(string element, string timecode, int fps = 24)
+    {
+        var plate = Path.Combine(_dir, "footage", $"UNG_107_051_010_{element}_TT_v001", $"UNG_107_051_010_{element}_TT_v001.01001.exr");
+        Directory.CreateDirectory(Path.GetDirectoryName(plate)!);
+        File.Move(ExrFixture.Write(timecode, 3840, 2160, new[] { ("B", 1), ("G", 1), ("R", 1) }, fps, 4), plate);
+        return plate;
+    }
+
+    private static ManifestSource Source(string timingPlate, params string[] plates) => new()
+    {
+        TimingPlate = new PlateRef { Path = timingPlate, FrameStart = 1001 },
+        Plates = plates.Select(p => new PlateRef { Path = p, FrameStart = 1001 }).ToList(),
+        HandleFrames = 8,
+    };
+
+    [Fact]
+    public void AnotherDeliveredPlatePassesWhenTheTimingPlateDoesNot()
+    {
+        // The comp was anchored to FG01, but the panel named BG01 (longest) as
+        // the timing plate — the two carry unrelated camera timecodes.
+        WriteSequence(105, "09:12:00:00");
+        var bg = WritePlate("BG01", "14:26:31:08");
+        var fg = WritePlate("FG01", "09:12:00:00");
+
+        var manifest = Manifest(_dir, null, 1001);
+        manifest.Source = Source(bg, bg, fg);
+
+        var tc = Check(NewStage().Run(manifest, _dir, new ServerConfig()), "timecode_plate_match");
+        Assert.Equal("PASS", tc.Status);
+        Assert.Contains("UNG_107_051_010_FG01_TT_v001.01001.exr", tc.Message);
+        Assert.Contains("BG01", tc.Message);
+    }
+
+    [Fact]
+    public void NoMatchingPlateStillFailsAgainstTheTimingPlate()
+    {
+        WriteSequence(105, "14:26:31:16");
+        var bg = WritePlate("BG01", "14:26:31:08");
+        var fg = WritePlate("FG01", "09:12:00:00");
+
+        var manifest = Manifest(_dir, null, 1001);
+        manifest.Source = Source(bg, bg, fg);
+
+        var tc = Check(NewStage().Run(manifest, _dir, new ServerConfig()), "timecode_plate_match");
+        Assert.Equal("FAIL", tc.Status);
+        Assert.Equal("14:26:31:08", tc.Expected);
+        Assert.Contains("8-frame handle", tc.Message);
+        Assert.Contains("1 other delivered plate", tc.Message);
+    }
+
+    [Fact]
+    public void APreRenderIsNeverUsedAsTheFallbackPlate()
+    {
+        // plates[] is every file in the comp. A pre-render was rendered from
+        // this comp, so it agrees with the render whether or not either is right.
+        WriteSequence(105, "14:26:31:16");
+        var bg = WritePlate("BG01", "14:26:31:08");
+        var preRender = Path.Combine(_dir, "renders", "prerender", "UNG_107_051_010_PRERENDER_01001.exr");
+        Directory.CreateDirectory(Path.GetDirectoryName(preRender)!);
+        File.Move(ExrFixture.Write("14:26:31:16", 3840, 2160, new[] { ("B", 1), ("G", 1), ("R", 1) }, 24, 4), preRender);
+
+        var manifest = Manifest(_dir, null, 1001);
+        manifest.Source = Source(bg, bg, preRender);
+
+        Assert.Equal("FAIL", Check(NewStage().Run(manifest, _dir, new ServerConfig()), "timecode_plate_match").Status);
+    }
+
+    [Fact]
+    public void APlateAtADifferentRateFailsPlateFps()
+    {
+        // The DH2 case: a 25 fps show whose shot records defaulted to 24, so
+        // every comp was built at 24. The render agrees with its own manifest,
+        // so only the plate can reveal it.
+        WriteSequence(105, "14:26:31:08");
+        var plate = Path.Combine(_dir, "plate", "UNG_107_051_010_BG01_TT_v001.01001.exr");
+        Directory.CreateDirectory(Path.GetDirectoryName(plate)!);
+        File.Move(ExrFixture.Write("14:26:31:08", 3840, 2160, new[] { ("B", 1), ("G", 1), ("R", 1) }, 25, 4), plate);
+
+        var manifest = Manifest(_dir, "14:26:31:16", 1001);
+        manifest.Source = new ManifestSource { TimingPlate = new PlateRef { Path = plate, FrameStart = 1001 } };
+
+        var outcome = NewStage().Run(manifest, _dir, new ServerConfig());
+        var fpsCheck = Check(outcome, "plate_fps");
+        Assert.Equal("WARN", fpsCheck.Status);
+        Assert.Equal("25", fpsCheck.Expected);
+        Assert.Equal("24", fpsCheck.Actual);
+        Assert.Contains("wrong rate", fpsCheck.Message);
+
+        // timecode_fps alone would not have caught it: the render and the
+        // manifest agree with each other at 24.
+        Assert.Equal("PASS", Check(outcome, "timecode_fps").Status);
+    }
+
+    [Fact]
+    public void AnOverCrankedPlateIsRecognisedRatherThanReportedAsAMistake()
+    {
+        // A 50 fps plate on a 25 fps show is deliberate slow motion, conformed
+        // on purpose — real on DH2, and it must not read as a rate error.
+        WriteSequence(105, "14:26:31:08", fps: 25);
+        var plate = Path.Combine(_dir, "plate", "DH2_PL01.01001.exr");
+        Directory.CreateDirectory(Path.GetDirectoryName(plate)!);
+        File.Move(ExrFixture.Write("14:26:31:08", 3840, 2160, new[] { ("B", 1), ("G", 1), ("R", 1) }, 50, 4), plate);
+
+        var manifest = Manifest(_dir, null, 1001);
+        manifest.Fps = 25;
+        manifest.Source = new ManifestSource { TimingPlate = new PlateRef { Path = plate, FrameStart = 1001 } };
+
+        var check = Check(NewStage().Run(manifest, _dir, new ServerConfig()), "plate_fps");
+        Assert.Equal("WARN", check.Status);
+        Assert.Contains("over-crank", check.Message);
+        Assert.DoesNotContain("wrong rate", check.Message);
+    }
+
+    [Fact]
+    public void MatchingRatesPassPlateFps()
+    {
+        WriteSequence(105, "14:26:31:08");
+        var plate = Path.Combine(_dir, "plate", "UNG_107_051_010_BG01_TT_v001.01001.exr");
+        Directory.CreateDirectory(Path.GetDirectoryName(plate)!);
+        File.Move(ExrFixture.Write("14:26:31:08", 3840, 2160, new[] { ("B", 1), ("G", 1), ("R", 1) }, 24, 4), plate);
+
+        var manifest = Manifest(_dir, "14:26:31:16", 1001);
+        manifest.Source = new ManifestSource { TimingPlate = new PlateRef { Path = plate, FrameStart = 1001 } };
+
+        Assert.Equal("PASS", Check(NewStage().Run(manifest, _dir, new ServerConfig()), "plate_fps").Status);
+    }
+
+    [Fact]
+    public void GapsAreStillCaughtWithinTheRun()
+    {
+        WriteSequence(105, "14:26:31:08");
+        File.Delete(Path.Combine(_dir, "UNG_107_051_010_cmp_TT_v004.01050.exr"));
+
+        var outcome = NewStage().Run(Manifest(_dir, "14:26:31:16", 1001), _dir, new ServerConfig());
+        Assert.Equal("FAIL", Check(outcome, "file_count").Status);
+        Assert.Equal("FAIL", Check(outcome, "missing_frames").Status);
+        Assert.Contains("1050", Check(outcome, "missing_frames").Message);
+    }
+
+    [Fact]
+    public void OldManifestsWithoutOutputNumberingSkipRatherThanFail()
+    {
+        WriteSequence(105, "14:26:31:08");
+        var outcome = NewStage().Run(Manifest(_dir, "14:26:31:16", null), _dir, new ServerConfig());
+
+        Assert.Equal("SKIPPED", Check(outcome, "first_frame").Status);
+        Assert.Equal("PASS", Check(outcome, "missing_frames").Status);
+        Assert.Contains("1001-1105", Check(outcome, "first_frame").Message);
+    }
+}

RenderWorker/VFXReviewWorker.Tests/XxHash64Tests.cs

@@ -0,0 +1,61 @@
+using System.Text;
+using VFXReviewWorker;
+using Xunit;
+
+namespace VFXReviewWorker.Tests;
+
+/// <summary>
+/// Reference vectors from the xxHash specification. The delivery builder
+/// verifies packaged files against digests recorded here at validation time, so
+/// a wrong implementation would not be caught by round-tripping our own code —
+/// only by pinning the published values.
+/// </summary>
+public class XxHash64Tests
+{
+    [Theory]
+    [InlineData("", 0xEF46DB3751D8E999UL)]
+    [InlineData("a", 0xD24EC4F1A98C6E5BUL)]
+    [InlineData("abc", 0x44BC2CF5AD770999UL)]
+    public void MatchesReferenceVectors(string input, ulong expected)
+    {
+        Assert.Equal(expected, XxHash64.Hash(Encoding.ASCII.GetBytes(input)));
+    }
+
+    [Fact]
+    public void StreamingInChunksMatchesSingleShot()
+    {
+        var data = new byte[1000];
+        new Random(42).NextBytes(data);
+        var oneShot = XxHash64.Hash(data);
+
+        // Chunk sizes deliberately straddle the 32-byte stripe boundary.
+        foreach (var chunk in new[] { 1, 7, 31, 32, 33, 64, 999 })
+        {
+            var state = new XxHash64.State(0);
+            for (var i = 0; i < data.Length; i += chunk)
+            {
+                state.Update(new ReadOnlySpan<byte>(data, i, Math.Min(chunk, data.Length - i)));
+            }
+            Assert.Equal(oneShot, state.Digest());
+        }
+    }
+
+    [Fact]
+    public void HashFileIsStableAndContentSensitive()
+    {
+        var path = Path.GetTempFileName();
+        try
+        {
+            File.WriteAllText(path, "frame data");
+            var first = XxHash64.HashFile(path);
+            Assert.Equal(first, XxHash64.HashFile(path));
+
+            File.WriteAllText(path, "frame datb");
+            Assert.NotEqual(first, XxHash64.HashFile(path));
+        }
+        finally
+        {
+            File.Delete(path);
+        }
+    }
+}

RenderWorker/VFXReviewWorker/AerenderRunner.cs

@@ -234,26 +234,30 @@ public sealed class AerenderRunner
     }
 
     /// <summary>
-    /// §7.3: outputDir is created before launch; a pre-existing non-empty dir
+    /// §7.3: outputDir is created before launch; a pre-existing dir can hold
-    /// can only hold output from a previous crashed attempt of this same
+    /// frames from a previous crashed attempt, which aerender would otherwise
-    /// immutable version. Safety guard: only files matching the job's own
+    /// leave interleaved with this attempt's. Safety guard: only files matching
-    /// output pattern prefix are ever deleted.
+    /// the job's own output pattern — its prefix *and* its extension — are ever
+    /// deleted.
+    ///
+    /// The extension is not optional. The version folder is shared with the
+    /// preview stage, whose MOV and MP4 are built from the same basename
+    /// (preview.ts: `{outputDir}/{base}.mov`), so prefix alone also matches
+    /// them. A version folder can legitimately be rendered into twice — the
+    /// output path is keyed on the shot's manually-set version, not on the
+    /// export — and on a no-preview re-render (Export.skipPreview) the media
+    /// that gets inherited is precisely the MOV sitting in this folder.
+    /// Deleting it left the export pointing at a file that no longer existed,
+    /// and delivery silently packaged the EXRs without their viewing copy.
     /// </summary>
-    /// <summary>Filename prefix of an output pattern ("X.[####].exr" → "X").</summary>
-    internal static string OutputPatternPrefix(string outputPattern)
-    {
-        var bracket = outputPattern.IndexOf('[');
-        return bracket > 0 ? outputPattern[..bracket].TrimEnd('.') : Path.GetFileNameWithoutExtension(outputPattern);
-    }
-
     internal static void PrepareOutputDir(string outputDirLocal, string outputPattern)
     {
         Directory.CreateDirectory(outputDirLocal);
-        var prefix = OutputPatternPrefix(outputPattern);
+        var pattern = SequencePattern.FromOutputPattern(outputPattern);
-        if (string.IsNullOrEmpty(prefix)) return;
+        if (string.IsNullOrEmpty(pattern.Prefix)) return;
         foreach (var file in Directory.EnumerateFiles(outputDirLocal))
         {
-            if (Path.GetFileName(file).StartsWith(prefix, StringComparison.OrdinalIgnoreCase))
+            if (pattern.MatchesOutputFile(Path.GetFileName(file)))
             {
                 try { File.Delete(file); } catch { /* locked leftovers surface as an aerender error */ }
             }
@@ -276,11 +280,19 @@ public sealed class AerenderRunner
     }
 }
 
-/// <summary>Ring buffer of the last N output lines (§5.3 logTail).</summary>
+/// <summary>
+/// Ring buffer of the last N output lines (§5.3 logTail).
+///
+/// Thread-safe: output readers add lines while the progress loop reads the
+/// tail for its report. Unsynchronised, ToString enumerates the queue while a
+/// reader enqueues and throws "Collection was modified" — Blender, which
+/// writes a status line many times a second, hit this on every job.
+/// </summary>
 public sealed class LogTail
 {
     private readonly Queue<string> _lines;
     private readonly int _capacity;
+    private readonly object _gate = new();
 
     public LogTail(int capacity)
     {
@@ -289,10 +301,16 @@ public sealed class LogTail
     }
 
     public void Add(string line)
+    {
+        lock (_gate)
         {
             _lines.Enqueue(line);
             while (_lines.Count > _capacity) _lines.Dequeue();
         }
-
+    }
-    public override string ToString() => string.Join('\n', _lines);
+
+    public override string ToString()
+    {
+        lock (_gate) return string.Join('\n', _lines);
+    }
 }

RenderWorker/VFXReviewWorker/ApiClient.cs

@@ -13,10 +13,16 @@ namespace VFXReviewWorker;
 public sealed class ApiClient
 {
     private readonly HttpClient _http;
+    private readonly WorkerOptions _options;
     private readonly ILogger<ApiClient> _log;
 
+    // Presigned uploads: a separate client so the URL is not sent with our
+    // Authorization header, and a generous per-request timeout for media.
+    private static readonly HttpClient _upload = new() { Timeout = TimeSpan.FromMinutes(30) };
+
     public ApiClient(WorkerOptions options, ILogger<ApiClient> log)
     {
+        _options = options;
         _log = log;
         _http = new HttpClient
         {
@@ -37,7 +43,20 @@ public sealed class ApiClient
             hostname = Dns.GetHostName(),
             workerVersion = o.WorkerVersion,
             aeVersion = o.AeVersion,
-            capabilities = new { maxConcurrentJobs = 1, tools = new { ffmpeg = o.FfmpegPath != null, oiiotool = o.OiiotoolPath != null } },
+            // The server hands out BLENDER_RENDER work on the strength of the
+            // blender entry, so it reports the resolved path rather than a bare
+            // flag: a machine claiming Blender jobs it cannot run is worse than
+            // one that never claims them.
+            capabilities = new
+            {
+                maxConcurrentJobs = 1,
+                tools = new
+                {
+                    ffmpeg = o.FfmpegPath != null,
+                    oiiotool = o.OiiotoolPath != null,
+                    blender = !string.IsNullOrWhiteSpace(o.BlenderPath) && File.Exists(o.BlenderPath) ? o.BlenderPath : null,
+                },
+            },
         }, Json, ct);
         res.EnsureSuccessStatusCode();
         return (await res.Content.ReadFromJsonAsync<RegisterResponse>(Json, ct))!;
@@ -71,9 +90,14 @@ public sealed class ApiClient
         return body?.Job;
     }
 
-    // E9 — best-effort; failures are swallowed by the caller (lease/reaper covers us)
+    // E9 — best-effort by contract: a progress report is a nicety, and losing
+    // one must never abort work in flight. Transport failures return null here
+    // rather than throwing at the call site; the lease and the reaper are what
+    // actually protect the job.
     public async Task<ProgressResponse?> ProgressAsync(string jobId, string machineId, double progress,
         int? currentFrame, int? totalFrames, int? etaSeconds, string? logTail, CancellationToken ct)
+    {
+        try
         {
             using var req = new HttpRequestMessage(HttpMethod.Patch, $"api/ext/render/jobs/{jobId}/progress")
             {
@@ -83,6 +107,16 @@ public sealed class ApiClient
             if (!res.IsSuccessStatusCode) return null;
             return await res.Content.ReadFromJsonAsync<ProgressResponse>(Json, ct);
         }
+        catch (OperationCanceledException) when (ct.IsCancellationRequested)
+        {
+            throw; // a real shutdown still stops us
+        }
+        catch (Exception ex)
+        {
+            _log.LogDebug(ex, "Progress report failed for job {JobId} (non-fatal)", jobId);
+            return null;
+        }
+    }
 
     // E10 / E11 — lifecycle reports, sent via the spooler for durability.
     // Returns true when the server accepted (2xx) OR permanently rejected (409
@@ -93,24 +127,33 @@ public sealed class ApiClient
         {
             "fail" => $"api/ext/render/jobs/{jobId}/fail",
             "complete-render" => $"api/ext/render/jobs/{jobId}/complete-render",
+            "validation" => $"api/ext/render/jobs/{jobId}/validation",
+            "delivery" => $"api/ext/render/jobs/{jobId}/delivery",
             "finalize" => $"api/ext/render/jobs/{jobId}/finalize",
+            "attach-highres" => $"api/ext/render/jobs/{jobId}/attach-highres",
             _ => throw new ArgumentOutOfRangeException(nameof(kind), kind, "unknown lifecycle report kind"),
         };
         var res = await _http.PostAsJsonAsync(path, payload, Json, ct);
         if (res.IsSuccessStatusCode) return true;
-        if (res.StatusCode is HttpStatusCode.Conflict or HttpStatusCode.NotFound)
+        if (res.StatusCode is HttpStatusCode.Conflict or HttpStatusCode.NotFound or HttpStatusCode.UnprocessableEntity)
         {
+            // Conflict/NotFound: contradictory or vanished report — nothing to retry.
+            // UnprocessableEntity: the server rejected the payload shape itself, so
+            // resending the same bytes can only ever produce the same 422 — retrying
+            // just spams the log forever instead of surfacing the real problem.
             _log.LogWarning("Server permanently rejected {Kind} for job {JobId}: {Status} {Body}",
                 kind, jobId, (int)res.StatusCode, await res.Content.ReadAsStringAsync(ct));
-            return true; // don't retry contradictory/vanished reports
+            return true;
         }
         _log.LogWarning("Lifecycle report {Kind} for {JobId} failed with {Status}; will retry", kind, jobId, (int)res.StatusCode);
         return false;
     }
 
     // E20 + PUT upload. Returns the storage key, or null when the upload failed.
+    // onProgress receives the bytes sent so far, for status lines in the app.
     public async Task<string?> UploadArtifactAsync(
-        string jobId, string machineId, string kind, string filePath, string contentType, CancellationToken ct)
+        string jobId, string machineId, string kind, string filePath, string contentType, CancellationToken ct,
+        Action<long>? onProgress = null)
     {
         try
         {
@@ -119,6 +162,13 @@ public sealed class ApiClient
                 _log.LogWarning("Artifact {Kind} not found at {Path}", kind, filePath);
                 return null;
             }
+            var size = new FileInfo(filePath).Length;
+            var sw = System.Diagnostics.Stopwatch.StartNew();
+            // Uploads can run for many minutes on a slow uplink; without these two
+            // lines the log goes silent and a busy worker looks hung.
+            if (kind != "log")
+                _log.LogInformation("Uploading {Kind} for job {JobId}: {File} ({MB:F1} MB)",
+                    kind, jobId, Path.GetFileName(filePath), size / 1048576.0);
 
             var presignRes = await _http.PostAsJsonAsync($"api/ext/render/jobs/{jobId}/artifact-presign", new
             {
@@ -126,6 +176,8 @@ public sealed class ApiClient
                 kind,
                 fileName = Path.GetFileName(filePath),
                 contentType,
+                multipart = size >= MultipartThreshold,
+                size,
             }, Json, ct);
             if (!presignRes.IsSuccessStatusCode)
             {
@@ -135,18 +187,27 @@ public sealed class ApiClient
             var presign = await presignRes.Content.ReadFromJsonAsync<PresignResponse>(Json, ct);
             if (presign is null) return null;
 
-            // Media files can be large — generous timeout, separate client so the
+            if (presign.UploadId is not null && presign.PartUrls is { Count: > 0 } && presign.PartSize > 0)
-            // presigned URL is not sent with our Authorization header.
-            using var upload = new HttpClient { Timeout = TimeSpan.FromMinutes(30) };
-            await using var stream = File.OpenRead(filePath);
-            var content = new StreamContent(stream);
-            content.Headers.ContentType = new MediaTypeHeaderValue(contentType);
-            var putRes = await upload.PutAsync(presign.PresignedUrl, content, ct);
-            if (!putRes.IsSuccessStatusCode)
             {
-                _log.LogWarning("Upload of {Kind} failed: {Status}", kind, (int)putRes.StatusCode);
+                if (!await UploadMultipartAsync(jobId, machineId, kind, filePath, size, presign, onProgress, ct))
                     return null;
             }
+            else
+            {
+                // Single PUT: small files, or a server that predates multipart.
+                await using var stream = File.OpenRead(filePath);
+                var content = new ProgressStreamContent(stream, onProgress);
+                content.Headers.ContentType = new MediaTypeHeaderValue(contentType);
+                var putRes = await _upload.PutAsync(presign.PresignedUrl, content, ct);
+                if (!putRes.IsSuccessStatusCode)
+                {
+                    _log.LogWarning("Upload of {Kind} failed after {Sec:F0}s: {Status}", kind, sw.Elapsed.TotalSeconds, (int)putRes.StatusCode);
+                    return null;
+                }
+            }
+            if (kind != "log")
+                _log.LogInformation("Uploaded {Kind} for job {JobId} in {Sec:F0}s ({Speed:F1} MB/s)",
+                    kind, jobId, sw.Elapsed.TotalSeconds, size / 1048576.0 / Math.Max(0.001, sw.Elapsed.TotalSeconds));
             return presign.Key;
         }
         catch (Exception ex)
@@ -156,9 +217,150 @@ public sealed class ApiClient
         }
     }
 
+    // Files at least this big go up as parallel multipart parts (E20b).
+    private const long MultipartThreshold = 16L * 1024 * 1024;
+    private const int PartAttempts = 4;
+
+    /// <summary>
+    /// Uploads the parts concurrently (UploadConcurrency connections), each
+    /// retried on its own so a dropped connection costs one part, not the
+    /// file; then asks the server to stitch them. Aborts on failure so the
+    /// stored parts don't linger in the bucket.
+    /// </summary>
+    private async Task<bool> UploadMultipartAsync(string jobId, string machineId, string kind, string filePath,
+        long size, PresignResponse presign, Action<long>? onProgress, CancellationToken ct)
+    {
+        var partUrls = presign.PartUrls!;
+        var partSize = presign.PartSize;
+        var etags = new string?[partUrls.Count];
+        var sentPerPart = new long[partUrls.Count];
+        long sentTotal = 0;
+        var next = -1;
+
+        using var handle = File.OpenHandle(filePath, FileMode.Open, FileAccess.Read, FileShare.Read, FileOptions.Asynchronous);
+        using var failed = CancellationTokenSource.CreateLinkedTokenSource(ct);
+
+        async Task Worker()
+        {
+            int i;
+            while ((i = Interlocked.Increment(ref next)) < partUrls.Count && !failed.IsCancellationRequested)
+            {
+                var offset = i * partSize;
+                var len = (int)Math.Min(partSize, size - offset);
+                var buffer = new byte[len];
+                var read = 0;
+                while (read < len) read += await RandomAccess.ReadAsync(handle, buffer.AsMemory(read), offset + read, failed.Token);
+
+                for (var attempt = 1; ; attempt++)
+                {
+                    var part = i;
+                    // Progress restarts from zero for a retried part.
+                    Interlocked.Add(ref sentTotal, -Interlocked.Exchange(ref sentPerPart[part], 0));
+                    var content = new ProgressStreamContent(new MemoryStream(buffer, writable: false), sent =>
+                    {
+                        var delta = sent - Interlocked.Exchange(ref sentPerPart[part], sent);
+                        onProgress?.Invoke(Interlocked.Add(ref sentTotal, delta));
+                    });
+                    try
+                    {
+                        var res = await _upload.PutAsync(partUrls[i], content, failed.Token);
+                        var etag = res.Headers.ETag?.Tag
+                                   ?? (res.Headers.TryGetValues("ETag", out var v) ? v.FirstOrDefault() : null);
+                        if (res.IsSuccessStatusCode && etag is not null)
+                        {
+                            etags[i] = etag;
+                            break;
+                        }
+                        _log.LogWarning("Part {Part}/{Count} of {Kind} for job {JobId} failed: {Status} (attempt {N}/{Max})",
+                            i + 1, partUrls.Count, kind, jobId, (int)res.StatusCode, attempt, PartAttempts);
+                    }
+                    catch (Exception ex) when (!failed.IsCancellationRequested)
+                    {
+                        _log.LogWarning("Part {Part}/{Count} of {Kind} for job {JobId} failed: {Error} (attempt {N}/{Max})",
+                            i + 1, partUrls.Count, kind, jobId, ex.Message, attempt, PartAttempts);
+                    }
+                    if (attempt >= PartAttempts)
+                    {
+                        failed.Cancel(); // no point finishing the other parts
+                        return;
+                    }
+                    await Task.Delay(TimeSpan.FromSeconds(5 * attempt), failed.Token);
+                }
+            }
+        }
+
+        var concurrency = Math.Clamp(_options.UploadConcurrency, 1, 64);
+        try
+        {
+            await Task.WhenAll(Enumerable.Range(0, Math.Min(concurrency, partUrls.Count)).Select(_ => Task.Run(Worker)));
+        }
+        catch (OperationCanceledException)
+        {
+            // a part gave up, or shutdown — either way the upload is aborted below
+        }
+
+        var complete = !failed.IsCancellationRequested && etags.All(e => e is not null);
+        if (complete)
+        {
+            var res = await _http.PostAsJsonAsync($"api/ext/render/jobs/{jobId}/artifact-complete", new
+            {
+                machineId,
+                key = presign.Key,
+                uploadId = presign.UploadId,
+                parts = etags.Select((etag, i) => new { partNumber = i + 1, etag }),
+            }, Json, ct);
+            if (res.IsSuccessStatusCode) return true;
+            _log.LogWarning("Completing multipart {Kind} for job {JobId} failed: {Status} {Body}",
+                kind, jobId, (int)res.StatusCode, await res.Content.ReadAsStringAsync(ct));
+        }
+
+        try
+        {
+            await _http.PostAsJsonAsync($"api/ext/render/jobs/{jobId}/artifact-complete", new
+            {
+                machineId,
+                key = presign.Key,
+                uploadId = presign.UploadId,
+                abort = true,
+            }, Json, CancellationToken.None);
+        }
+        catch { /* parts expire on their own */ }
+        return false;
+    }
+
     public Task<string?> UploadLogAsync(string jobId, string machineId, string logFilePath, CancellationToken ct) =>
         UploadArtifactAsync(jobId, machineId, "log", logFilePath, "text/plain", ct);
 
+    /// <summary>
+    /// Reports the deployed worker version so the web UI can show what is
+    /// running where. Fire-and-forget — never worth failing a startup over.
+    /// </summary>
+    public async Task ReportVersionAsync(WorkerOptions o, CancellationToken ct)
+    {
+        try
+        {
+            await _http.PostAsJsonAsync("api/ext/tools/ping", new
+            {
+                tool = "RENDER_WORKER",
+                machineName = o.MachineName,
+                version = o.WorkerVersion,
+                hostUser = Environment.UserName,
+                hostApp = $"{Environment.OSVersion.VersionString} ({Dns.GetHostName()})",
+                details = new
+                {
+                    aeVersion = o.AeVersion,
+                    aerenderPath = o.AerenderPath,
+                    ffmpeg = o.FfmpegPath is not null,
+                    plateSearchRoots = o.PlateSearchRoots,
+                },
+            }, Json, ct);
+        }
+        catch (Exception ex)
+        {
+            _log.LogDebug(ex, "Version ping failed (non-fatal)");
+        }
+    }
+
     // E3 — used by crash-recovery reconcile (§7.5)
     public async Task<ExportDetail?> GetExportAsync(string exportId, CancellationToken ct)
     {

RenderWorker/VFXReviewWorker/BlenderProgressParser.cs

@@ -0,0 +1,88 @@
+using System.Text.RegularExpressions;
+
+namespace VFXReviewWorker;
+
+/// <summary>
+/// Parses `blender -b` stdout. Blender reports the frame it is working on in
+/// its status lines ("Fra:1042 Mem:512.00M ...") and confirms each written file
+/// with "Saved: '...'". The saved lines are the reliable signal — a frame can
+/// be reported for a long time while it renders — so progress counts those and
+/// falls back to Fra: for a first sign of life.
+///
+/// Blender 5.x logs through CLOG, which prefixes every line with an elapsed
+/// time and a category ("00:02.954  render           | Saved: '...'") and
+/// reports errors as "ERROR ..." rather than "Error: ...". The prefix is
+/// stripped before matching, so both formats parse the same way.
+/// </summary>
+public static partial class BlenderProgressParser
+{
+    [GeneratedRegex(@"^(?:\d+:)?\d{2}:\d{2}\.\d{3}\s+\S+\s*\| ?", RegexOptions.Compiled)]
+    private static partial Regex LogPrefix();
+
+    [GeneratedRegex(@"^Fra:\s*(\d+)", RegexOptions.Compiled)]
+    private static partial Regex FrameLine();
+
+    [GeneratedRegex(@"^Saved:\s*'(.+)'", RegexOptions.Compiled)]
+    private static partial Regex SavedLine();
+
+    // Errors only. Warnings are not failures, and add-ons print them on every
+    // launch ("Warning: add-on missing 'bl_info'"), so counting them made an
+    // add-on's complaint the reported reason for a failed render.
+    [GeneratedRegex(@"(?i:^Error: )|^(ERROR|FATAL) ", RegexOptions.Compiled)]
+    private static partial Regex ErrorLine();
+
+    /// <summary>The line without Blender 5.x's "elapsed  category | " prefix.</summary>
+    private static string Message(string line)
+    {
+        var m = LogPrefix().Match(line);
+        return m.Success ? line[m.Length..] : line;
+    }
+
+    /// <summary>
+    /// Failures that will repeat identically on another machine — a missing
+    /// file, an unknown scene, an unwritable output. Retrying these burns the
+    /// queue for nothing; a human has to fix the .blend or the path.
+    /// </summary>
+    private static readonly string[] NonRetryablePatterns =
+    {
+        "cannot read file",
+        "file not found",
+        "unable to open",
+        "is not a blend file",
+        "failed to read blend file",
+        "unknown scene",
+        "scene not found",
+        "unable to create directory",
+        "couldn't create directory",
+        "cannot write file",
+        "cannot save:",
+        "no camera",
+        "python script fail",
+        "unknown argument",
+    };
+
+    /// <summary>The frame Blender is currently working on, or null.</summary>
+    public static int? ParseFrame(string line)
+    {
+        var m = FrameLine().Match(Message(line));
+        return m.Success && int.TryParse(m.Groups[1].Value, out var f) ? f : null;
+    }
+
+    /// <summary>The path of a frame Blender has just written, or null.</summary>
+    public static string? ParseSaved(string line)
+    {
+        var m = SavedLine().Match(Message(line));
+        return m.Success ? m.Groups[1].Value : null;
+    }
+
+    public static bool IsErrorLine(string line) => ErrorLine().IsMatch(Message(line));
+
+    public static bool IsNonRetryableError(string line)
+    {
+        foreach (var p in NonRetryablePatterns)
+        {
+            if (line.Contains(p, StringComparison.OrdinalIgnoreCase)) return true;
+        }
+        return false;
+    }
+}

RenderWorker/VFXReviewWorker/BlenderRunner.cs

@@ -0,0 +1,331 @@
+using System.Diagnostics;
+using System.Text;
+using Microsoft.Extensions.Logging;
+
+namespace VFXReviewWorker;
+
+/// <summary>
+/// Standalone Blender renders: `blender -b file.blend -s N -e M -a`.
+///
+/// The .blend is expected to be ready to render — output path, format and
+/// frame range already set by whoever built it. Overrides are only applied
+/// when the submission asked for them, so this stays "Ctrl+F12 on the farm"
+/// rather than a second place where render settings can drift.
+/// </summary>
+public sealed class BlenderRunner
+{
+    private readonly WorkerOptions _options;
+    private readonly ApiClient _api;
+    private readonly ILogger<BlenderRunner> _log;
+
+    public BlenderRunner(WorkerOptions options, ApiClient api, ILogger<BlenderRunner> log)
+    {
+        _options = options;
+        _api = api;
+        _log = log;
+    }
+
+    public async Task<RenderResult> RunAsync(
+        ClaimedJob job,
+        BlenderManifest m,
+        string machineId,
+        ServerConfig config,
+        CancellationToken cancelJob,
+        CancellationToken shutdown)
+    {
+        var mapper = new PathMapper(_options.PathMappings);
+        var blendLocal = mapper.Map(m.BlendFile);
+        var totalFrames = m.TotalFrames;
+
+        if (!File.Exists(blendLocal))
+        {
+            return new RenderResult(false, -1, Retryable: false,
+                $"Blend file not found on this machine: {blendLocal}", "", "", 0);
+        }
+
+        // Argument order matters to Blender: everything before -a configures the
+        // render, and -a must come last or it renders with the old settings.
+        // -noaudio: a render node has no sound device, and initialising audio
+        // under a session-less service account is a known way to hang at startup.
+        var args = new List<string> { "-b", blendLocal, "-noaudio" };
+        if (!string.IsNullOrWhiteSpace(m.Scene)) { args.Add("-S"); args.Add(m.Scene!); }
+        if (!string.IsNullOrWhiteSpace(m.OutputPath))
+        {
+            args.Add("-o");
+            args.Add(mapper.Map(m.OutputPath!));
+        }
+        if (!string.IsNullOrWhiteSpace(m.Engine)) { args.Add("-E"); args.Add(m.Engine!); }
+
+        var pythonOverrides = BuildOverrideExpression(m);
+        if (pythonOverrides is not null) { args.Add("--python-expr"); args.Add(pythonOverrides); }
+
+        args.Add("-s"); args.Add(m.FrameStart.ToString());
+        args.Add("-e"); args.Add(m.FrameEnd.ToString());
+        args.Add("-a");
+
+        _log.LogInformation("Rendering {Label}: {Blend} frames {Start}-{End}",
+            job.Label ?? job.Id, blendLocal, m.FrameStart, m.FrameEnd);
+
+        return await ExecuteAsync(job.Id, machineId, args, totalFrames, m.FrameStart, config,
+            $"blender_{job.Id}.log", cancelJob, shutdown);
+    }
+
+    /// <summary>
+    /// Settings Blender has no command-line flag for. Returns null when the
+    /// submission asked for no overrides, so the file renders exactly as saved.
+    /// </summary>
+    private static string? BuildOverrideExpression(BlenderManifest m)
+    {
+        var parts = new List<string>();
+        if (m.Samples is int samples)
+        {
+            parts.Add($"getattr(S.cycles, 'samples', None) and setattr(S.cycles, 'samples', {samples})");
+        }
+        if (m.ResolutionPercent is int pct)
+        {
+            parts.Add($"setattr(S.render, 'resolution_percentage', {pct})");
+        }
+        if (!string.IsNullOrWhiteSpace(m.Device))
+        {
+            var deviceValue = m.Device!.Equals("GPU", StringComparison.OrdinalIgnoreCase) ? "GPU" : "CPU";
+            parts.Add($"hasattr(S, 'cycles') and setattr(S.cycles, 'device', '{deviceValue}')");
+        }
+        if (parts.Count == 0) return null;
+
+        return "import bpy; S = bpy.context.scene; " + string.Join("; ", parts);
+    }
+
+    private async Task<RenderResult> ExecuteAsync(
+        string jobId,
+        string machineId,
+        List<string> args,
+        int totalFrames,
+        int frameStart,
+        ServerConfig config,
+        string logFileName,
+        CancellationToken cancelJob,
+        CancellationToken shutdown)
+    {
+        var fullLogPath = Path.Combine(WorkerOptions.LogsDir, logFileName);
+        Directory.CreateDirectory(WorkerOptions.LogsDir);
+
+        var psi = new ProcessStartInfo
+        {
+            FileName = _options.BlenderPath,
+            RedirectStandardOutput = true,
+            RedirectStandardError = true,
+            UseShellExecute = false,
+            CreateNoWindow = true,
+            StandardOutputEncoding = Encoding.UTF8,
+            StandardErrorEncoding = Encoding.UTF8,
+        };
+        foreach (var a in args) psi.ArgumentList.Add(a);
+
+        var tail = new LogTail(200);
+        var eta = new EtaCalculator();
+        var sw = Stopwatch.StartNew();
+        var lastProgressAt = DateTimeOffset.UtcNow;
+        var lastReportAt = DateTimeOffset.MinValue;
+        var framesSaved = 0;
+        var currentFrame = frameStart;
+        string? firstError = null;
+        var nonRetryable = false;
+        var cancelledByServer = false;
+
+        using var process = new Process { StartInfo = psi };
+        await using var fullLog = new StreamWriter(fullLogPath, append: false, Encoding.UTF8);
+        var logLock = new object();
+
+        void HandleLine(string? line, bool isStderr)
+        {
+            if (line is null) return;
+            lock (logLock)
+            {
+                fullLog.WriteLine(line);
+                tail.Add(line);
+            }
+
+            // Any output at all means Blender is alive, which is what the stall
+            // watchdog is actually asking. Requiring a recognised progress line
+            // made the watchdog stricter than its own error message and killed
+            // healthy renders whose output we simply were not parsing.
+            lastProgressAt = DateTimeOffset.UtcNow;
+
+            var frame = BlenderProgressParser.ParseFrame(line);
+            if (frame is not null) currentFrame = frame.Value;
+
+            if (BlenderProgressParser.ParseSaved(line) is not null)
+            {
+                // Progress counts finished frames only: a frame emits hundreds
+                // of status updates while it renders.
+                framesSaved++;
+                eta.RecordFrame(DateTimeOffset.UtcNow);
+            }
+            if ((isStderr || BlenderProgressParser.IsErrorLine(line)) && !string.IsNullOrWhiteSpace(line))
+            {
+                if (BlenderProgressParser.IsErrorLine(line)) firstError ??= line.Trim();
+                if (BlenderProgressParser.IsNonRetryableError(line)) nonRetryable = true;
+            }
+        }
+
+        try
+        {
+            process.Start();
+        }
+        catch (Exception ex)
+        {
+            return new RenderResult(false, -1, Retryable: false,
+                $"Failed to launch Blender at {_options.BlenderPath}: {ex.Message}",
+                tail.ToString(), fullLogPath, 0);
+        }
+
+        // Deliberately not BeginOutputReadLine: that raises an event per
+        // newline, and Blender's render status is written with a carriage
+        // return so it overwrites one line in place. A frame that takes longer
+        // than the stall timeout would emit no newline for its whole duration
+        // and be killed as stalled while rendering perfectly well.
+        var pumps = new[]
+        {
+            PumpAsync(process.StandardOutput, line => HandleLine(line, isStderr: false)),
+            PumpAsync(process.StandardError, line => HandleLine(line, isStderr: true)),
+        };
+
+        try
+        {
+            return await MonitorAsync();
+        }
+        catch
+        {
+            // Disposing a Process does not end it: without this, any exception
+            // in the monitor loop leaves Blender rendering on the node,
+            // unsupervised, while the job is retried alongside it.
+            KillTree(process);
+            throw;
+        }
+
+        async Task<RenderResult> MonitorAsync()
+        {
+            while (!process.HasExited)
+            {
+                await Task.Delay(TimeSpan.FromSeconds(2), CancellationToken.None);
+
+                if (cancelJob.IsCancellationRequested || shutdown.IsCancellationRequested)
+                {
+                    _log.LogWarning("Cancellation requested — killing Blender tree for job {JobId}", jobId);
+                    KillTree(process);
+                    cancelledByServer = cancelJob.IsCancellationRequested;
+                    break;
+                }
+
+                if ((DateTimeOffset.UtcNow - lastProgressAt).TotalSeconds > config.StallTimeoutSeconds)
+                {
+                    _log.LogError("Blender stalled ({Sec}s without output) — killing job {JobId}", config.StallTimeoutSeconds, jobId);
+                    KillTree(process);
+                    await WaitForExitSafe(process);
+                    return new RenderResult(false, -2, Retryable: true,
+                        $"Blender produced no output for {config.StallTimeoutSeconds}s (stall timeout)",
+                        tail.ToString(), fullLogPath, sw.Elapsed.TotalSeconds);
+                }
+
+                if ((DateTimeOffset.UtcNow - lastReportAt).TotalSeconds >= 10)
+                {
+                    lastReportAt = DateTimeOffset.UtcNow;
+                    var progress = totalFrames > 0 ? Math.Min(1.0, (double)framesSaved / totalFrames) : 0;
+                    var resp = await _api.ProgressAsync(jobId, machineId, progress, currentFrame, totalFrames,
+                        eta.EstimateSeconds(totalFrames - framesSaved), tail.ToString(), shutdown);
+                    if (resp?.CancelRequested == true)
+                    {
+                        _log.LogWarning("Server requested cancel for job {JobId}", jobId);
+                        KillTree(process);
+                        cancelledByServer = true;
+                        break;
+                    }
+                }
+            }
+
+            await WaitForExitSafe(process);
+            // Let the readers drain what is still buffered before judging the run —
+            // the last frame's "Saved:" often arrives after the process exits.
+            try { await Task.WhenAll(pumps).WaitAsync(TimeSpan.FromSeconds(10)); } catch { }
+            sw.Stop();
+            lock (logLock) { fullLog.Flush(); }
+
+            if (cancelledByServer)
+            {
+                return new RenderResult(false, -3, Retryable: false, "Cancelled", tail.ToString(), fullLogPath, sw.Elapsed.TotalSeconds);
+            }
+
+            var exitCode = process.ExitCode;
+            if (exitCode != 0)
+            {
+                return new RenderResult(false, exitCode, Retryable: !nonRetryable,
+                    firstError ?? $"Blender exited with code {exitCode}",
+                    tail.ToString(), fullLogPath, sw.Elapsed.TotalSeconds);
+            }
+
+            // Blender exits 0 having rendered nothing if the range is empty or the
+            // output path is unwritable, so a silent success is treated as failure.
+            if (framesSaved == 0)
+            {
+                return new RenderResult(false, 0, Retryable: false,
+                    firstError is not null
+                        ? $"Blender exited cleanly but saved no frames: {firstError}"
+                        : "Blender exited cleanly but saved no frames — check the output path and frame range in the .blend",
+                    tail.ToString(), fullLogPath, sw.Elapsed.TotalSeconds);
+            }
+
+            _log.LogInformation("Job {JobId}: {Saved}/{Total} frames in {Sec:F0}s", jobId, framesSaved, totalFrames, sw.Elapsed.TotalSeconds);
+            return new RenderResult(true, 0, true, null, tail.ToString(), fullLogPath, sw.Elapsed.TotalSeconds);
+        }
+    }
+
+    /// <summary>
+    /// Reads a stream treating both CR and LF as line terminators, so
+    /// Blender's carriage-return progress updates are seen as they happen
+    /// rather than only when a newline eventually arrives.
+    /// </summary>
+    private static async Task PumpAsync(StreamReader reader, Action<string> onLine)
+    {
+        var buffer = new char[4096];
+        var current = new StringBuilder(256);
+        int read;
+
+        try
+        {
+            while ((read = await reader.ReadAsync(buffer, 0, buffer.Length)) > 0)
+            {
+                for (var i = 0; i < read; i++)
+                {
+                    var c = buffer[i];
+                    if (c == '\r' || c == '\n')
+                    {
+                        if (current.Length > 0)
+                        {
+                            onLine(current.ToString());
+                            current.Clear();
+                        }
+                    }
+                    else
+                    {
+                        current.Append(c);
+                    }
+                }
+            }
+            if (current.Length > 0) onLine(current.ToString());
+        }
+        catch (Exception)
+        {
+            // The process died mid-read; the exit path reports what happened.
+        }
+    }
+
+    private static void KillTree(Process process)
+    {
+        try { if (!process.HasExited) process.Kill(entireProcessTree: true); } catch { }
+    }
+
+    private static async Task WaitForExitSafe(Process process)
+    {
+        try { await process.WaitForExitAsync(); } catch { }
+    }
+}

RenderWorker/VFXReviewWorker/DeliveryStage.cs

@@ -0,0 +1,515 @@
+using System.Globalization;
+using System.Runtime.InteropServices;
+using System.Text;
+using System.Text.Json;
+using Microsoft.Extensions.Logging;
+
+namespace VFXReviewWorker;
+
+/// <summary>
+/// Delivery builder (RenderPipeline2 §11). Creates the dated package folder,
+/// hard-links (or copies) each shot's EXRs and delivery MOV into it, verifies
+/// what it wrote, and leaves a manifest + CSV report beside the shots.
+///
+/// A MOV_REVIEW package (§11.6) runs the same path for a different shape: one
+/// flat folder, one preview MOV per shot, and nothing written into it but the
+/// MOVs themselves — it is shared with a producer, not filed as a delivery.
+///
+/// Hard links make an 18-shot EXR package near-instant and cost no extra disk.
+/// They are safe here because rendered versions are immutable by pipeline
+/// design — a new version is a new directory, nothing ever rewrites an EXR in
+/// place. Cross-volume targets fall back to copying automatically.
+/// </summary>
+public sealed class DeliveryStage
+{
+    private readonly WorkerOptions _options;
+    private readonly ApiClient _api;
+    private readonly ILogger<DeliveryStage> _log;
+
+    public DeliveryStage(WorkerOptions options, ApiClient api, ILogger<DeliveryStage> log)
+    {
+        _options = options;
+        _api = api;
+        _log = log;
+    }
+
+    public async Task<DeliveryResult> RunAsync(
+        ClaimedJob job, DeliveryManifest manifest, string machineId, CancellationToken cancelJob, CancellationToken shutdown)
+    {
+        var mapper = new PathMapper(_options.PathMappings);
+        var packageDir = mapper.Map(manifest.PackageDir);
+        var results = new List<DeliveryItemResult>();
+        var manifestFiles = new List<object>();
+        var alwaysCopy = string.Equals(manifest.CopyMode, "always-copy", StringComparison.OrdinalIgnoreCase);
+        var alwaysHash = string.Equals(manifest.VerifyMode, "always-hash", StringComparison.OrdinalIgnoreCase);
+        var isReview = string.Equals(manifest.Kind, "MOV_REVIEW", StringComparison.OrdinalIgnoreCase);
+
+        _log.LogInformation("Building {What} {Name} ({Count} shots) at {Dir}",
+            isReview ? "MOV review" : "delivery package", manifest.PackageName, manifest.Items.Count, packageDir);
+        Directory.CreateDirectory(packageDir);
+
+        for (var i = 0; i < manifest.Items.Count; i++)
+        {
+            if (cancelJob.IsCancellationRequested) break;
+            var item = manifest.Items[i];
+
+            await _api.ProgressAsync(job.Id, machineId, (double)i / manifest.Items.Count, i, manifest.Items.Count, null,
+                $"Packaging {item.ShotCode} {item.VersionString} ({i + 1}/{manifest.Items.Count})", shutdown);
+
+            var result = isReview
+                ? BuildReviewItem(item, mapper, alwaysCopy, alwaysHash, manifestFiles)
+                : BuildItem(item, mapper, alwaysCopy, alwaysHash, manifestFiles);
+            results.Add(result);
+            if (result.Status == "FAILED")
+            {
+                _log.LogError("Delivery item {Shot} failed: {Error}", item.ShotCode, result.ErrorMessage);
+            }
+        }
+
+        var ok = results.Count == manifest.Items.Count && results.All(r => r.Status == "VERIFIED");
+
+        // The report is the client-facing document, so it is written even for a
+        // partial build — it is the fastest way to see what did and did not land.
+        //
+        // A review folder gets neither: it is opened by a producer who wants the
+        // MOVs and nothing else. The manifest still travels back to the server,
+        // so the record of what was shared is kept without cluttering the share.
+        string? reportPath = null;
+        if (!isReview)
+        {
+            try
+            {
+                reportPath = WriteReport(manifest, results, mapper);
+                WriteManifestJson(manifest, results, manifestFiles, packageDir);
+            }
+            catch (Exception ex)
+            {
+                _log.LogWarning(ex, "Could not write delivery report/manifest for {Name}", manifest.PackageName);
+            }
+        }
+
+        return new DeliveryResult(ok, results, packageDir, reportPath, manifestFiles);
+    }
+
+    private DeliveryItemResult BuildItem(
+        DeliveryManifestItem item, PathMapper mapper, bool alwaysCopy, bool alwaysHash, List<object> manifestFiles)
+    {
+        var sourceDir = mapper.Map(item.SourceDir);
+        var shotDir = mapper.Map(item.ShotDir);
+
+        try
+        {
+            if (!Directory.Exists(sourceDir))
+            {
+                return DeliveryItemResult.Failed(item, $"Source folder not found: {sourceDir}");
+            }
+
+            var pattern = SequencePattern.FromOutputPattern(item.OutputPattern);
+            var sources = Directory.EnumerateFiles(sourceDir)
+                .Where(f => Path.GetFileName(f).StartsWith(pattern.Prefix, StringComparison.OrdinalIgnoreCase)
+                            && Path.GetFileName(f).EndsWith(pattern.Extension, StringComparison.OrdinalIgnoreCase))
+                .OrderBy(f => f, StringComparer.Ordinal)
+                .ToList();
+
+            if (sources.Count == 0)
+            {
+                return DeliveryItemResult.Failed(item, $"No {pattern.Extension} files matching {pattern.Prefix}* in {sourceDir}");
+            }
+            if (item.FileCount is int expected && sources.Count != expected)
+            {
+                return DeliveryItemResult.Failed(item,
+                    $"Source has {sources.Count} frames but the export recorded {expected} — the render changed since QC");
+            }
+
+            Directory.CreateDirectory(shotDir);
+
+            // Delivered names carry the client-facing base (or the studio's own
+            // convention when no client code is set), not the internal render
+            // filename — only the frame number and extension survive from the
+            // source. A frame whose number can't be parsed falls back to the
+            // source filename verbatim rather than failing the whole delivery.
+            var destNames = sources.ToDictionary(s => s, s => DeliveredFrameName(s, item, pattern));
+
+            long totalBytes = 0;
+            var usedCopy = false;
+            foreach (var src in sources)
+            {
+                var dest = Path.Combine(shotDir, destNames[src]);
+                if (Place(src, dest, alwaysCopy, out var copied) is string placeError)
+                {
+                    return DeliveryItemResult.Failed(item, placeError);
+                }
+                usedCopy |= copied;
+                totalBytes += new FileInfo(dest).Length;
+            }
+
+            // Verification is proportional to what was actually done.
+            //
+            // A hard link is a second name for the same data, so hashing it
+            // re-reads the exact bytes validation already hashed — it cannot
+            // disagree, and at ~100 MB/s over SMB it costs half an hour for an
+            // episode to prove nothing. A copy is different: it can be
+            // truncated or corrupted, so it is read back in full.
+            string? digest;
+            string verifiedBy;
+
+            if (usedCopy || alwaysHash)
+            {
+                digest = SequenceChecksum(sources.Select(s => Path.Combine(shotDir, destNames[s])));
+                if (item.Checksum is { Length: > 0 } && !string.Equals(digest, item.Checksum, StringComparison.OrdinalIgnoreCase))
+                {
+                    return DeliveryItemResult.Failed(item,
+                        $"Checksum mismatch after packaging: expected {item.Checksum}, got {digest}");
+                }
+                verifiedBy = "hash";
+            }
+            else
+            {
+                // The one thing linking cannot rule out is the source having
+                // changed since it passed QC — the link would faithfully carry
+                // the new bytes. Timestamps answer that for the price of a stat.
+                if (item.ValidatedAt is DateTimeOffset validatedAt)
+                {
+                    var touched = sources
+                        .Select(s => new FileInfo(s))
+                        .Where(f => f.LastWriteTimeUtc > validatedAt.UtcDateTime.AddSeconds(1))
+                        .ToList();
+                    if (touched.Count > 0)
+                    {
+                        return DeliveryItemResult.Failed(item,
+                            $"{touched.Count} source file(s) were modified after validation " +
+                            $"({touched[0].Name} at {touched[0].LastWriteTimeUtc:u}, validated {validatedAt.UtcDateTime:u}) — " +
+                            "the render changed after it passed QC");
+                    }
+                }
+                // Same data as the source, so the validation-time digest describes
+                // the delivered files exactly.
+                digest = item.Checksum;
+                verifiedBy = "link identity";
+            }
+            _log.LogDebug("{Shot}: verified by {How}", item.ShotCode, verifiedBy);
+
+            string? movDest = null;
+            if (!string.IsNullOrWhiteSpace(item.DeliveryMovPath))
+            {
+                var movSrc = mapper.Map(item.DeliveryMovPath!);
+                if (File.Exists(movSrc))
+                {
+                    var movName = string.IsNullOrWhiteSpace(item.DeliveredBaseName)
+                        ? Path.GetFileName(movSrc)
+                        : item.DeliveredBaseName + Path.GetExtension(movSrc);
+                    movDest = Path.Combine(shotDir, movName);
+                    if (Place(movSrc, movDest, alwaysCopy, out var movCopied) is string movError)
+                    {
+                        return DeliveryItemResult.Failed(item, movError);
+                    }
+                    usedCopy |= movCopied;
+                    totalBytes += new FileInfo(movDest).Length;
+                }
+                else
+                {
+                    // Not fatal: the EXRs are the deliverable, the MOV is a
+                    // viewing copy. It is recorded so it is not silently absent.
+                    _log.LogWarning("Delivery MOV missing for {Shot}: {Path}", item.ShotCode, movSrc);
+                }
+            }
+
+            foreach (var src in sources)
+            {
+                var name = destNames[src];
+                manifestFiles.Add(new
+                {
+                    shotCode = item.ShotCode,
+                    relativePath = Path.Combine(Path.GetFileName(shotDir), name).Replace('\\', '/'),
+                    bytes = new FileInfo(Path.Combine(shotDir, name)).Length,
+                    exportId = item.ExportId,
+                });
+            }
+
+            return new DeliveryItemResult
+            {
+                ItemId = item.ItemId,
+                ShotCode = item.ShotCode,
+                VersionString = item.VersionString,
+                Status = "VERIFIED",
+                ExrPath = shotDir,
+                MovPath = movDest,
+                FileCount = sources.Count,
+                TotalBytes = totalBytes,
+                Checksum = digest,
+                LinkMode = usedCopy ? "copy" : "hardlink",
+                FrameStart = item.FrameStart,
+                FrameEnd = item.FrameEnd,
+            };
+        }
+        catch (Exception ex)
+        {
+            return DeliveryItemResult.Failed(item, $"{ex.GetType().Name}: {ex.Message}");
+        }
+    }
+
+    /// <summary>
+    /// One shot of a MOV review package: place its preview MOV straight into
+    /// the (flat) review folder under the client-facing name.
+    ///
+    /// A missing MOV is fatal here, unlike in an EXR delivery where the MOV is
+    /// a viewing copy beside the real deliverable — in a review it *is* the
+    /// deliverable, and a review folder quietly one shot short is worse than
+    /// one that says so.
+    /// </summary>
+    private DeliveryItemResult BuildReviewItem(
+        DeliveryManifestItem item, PathMapper mapper, bool alwaysCopy, bool alwaysHash, List<object> manifestFiles)
+    {
+        try
+        {
+            if (string.IsNullOrWhiteSpace(item.DeliveryMovPath))
+            {
+                return DeliveryItemResult.Failed(item, "No preview MOV is recorded for this version");
+            }
+
+            var movSrc = mapper.Map(item.DeliveryMovPath!);
+            if (!File.Exists(movSrc))
+            {
+                return DeliveryItemResult.Failed(item, $"Preview MOV not found: {movSrc}");
+            }
+
+            // ShotDir is the package folder itself for a review — the MOVs sit
+            // beside each other so a producer can scrub through them in order.
+            var reviewDir = mapper.Map(item.ShotDir);
+            Directory.CreateDirectory(reviewDir);
+
+            var name = string.IsNullOrWhiteSpace(item.DeliveredBaseName)
+                ? Path.GetFileName(movSrc)
+                : item.DeliveredBaseName + Path.GetExtension(movSrc);
+            var dest = Path.Combine(reviewDir, name);
+
+            if (Place(movSrc, dest, alwaysCopy, out var copied) is string error)
+            {
+                return DeliveryItemResult.Failed(item, error);
+            }
+
+            var sourceLength = new FileInfo(movSrc).Length;
+            var destLength = new FileInfo(dest).Length;
+
+            // There is no validation-time digest for a MOV to check against, so
+            // a copy is proved against the source it came from: length always
+            // (it catches the truncation a full disk causes, for free), and the
+            // full hash when the config asks for it. A hard link is the source.
+            string? digest = null;
+            if (copied)
+            {
+                if (destLength != sourceLength)
+                {
+                    return DeliveryItemResult.Failed(item,
+                        $"Copied MOV is {destLength} bytes but the source is {sourceLength} — the copy is incomplete");
+                }
+                if (alwaysHash)
+                {
+                    digest = XxHash64.HashFile(dest);
+                    var sourceDigest = XxHash64.HashFile(movSrc);
+                    if (!string.Equals(digest, sourceDigest, StringComparison.OrdinalIgnoreCase))
+                    {
+                        return DeliveryItemResult.Failed(item,
+                            $"Copied MOV does not match its source: expected {sourceDigest}, got {digest}");
+                    }
+                }
+            }
+            else if (alwaysHash)
+            {
+                digest = XxHash64.HashFile(dest);
+            }
+
+            manifestFiles.Add(new
+            {
+                shotCode = item.ShotCode,
+                relativePath = name,
+                bytes = destLength,
+                exportId = item.ExportId,
+            });
+
+            return new DeliveryItemResult
+            {
+                ItemId = item.ItemId,
+                ShotCode = item.ShotCode,
+                VersionString = item.VersionString,
+                Status = "VERIFIED",
+                // No EXR sequence is involved, so there is no shot folder to record.
+                ExrPath = null,
+                MovPath = dest,
+                FileCount = 1,
+                TotalBytes = destLength,
+                Checksum = digest,
+                LinkMode = copied ? "copy" : "hardlink",
+                FrameStart = item.FrameStart,
+                FrameEnd = item.FrameEnd,
+            };
+        }
+        catch (Exception ex)
+        {
+            return DeliveryItemResult.Failed(item, $"{ex.GetType().Name}: {ex.Message}");
+        }
+    }
+
+    /// <summary>
+    /// Hard-link when possible, copy when not. Returns null on success or the
+    /// error message. `copied` reports which happened, so the package records
+    /// what it actually did rather than what it intended.
+    /// </summary>
+    private string? Place(string source, string dest, bool alwaysCopy, out bool copied)
+    {
+        copied = false;
+        try
+        {
+            if (File.Exists(dest)) File.Delete(dest);
+
+            if (!alwaysCopy && CreateHardLink(dest, source, IntPtr.Zero))
+            {
+                return null;
+            }
+
+            // Cross-volume, a filesystem without link support, or always-copy.
+            File.Copy(source, dest, overwrite: true);
+            copied = true;
+            return null;
+        }
+        catch (Exception ex)
+        {
+            return $"Could not place {Path.GetFileName(source)}: {ex.Message}";
+        }
+    }
+
+    /// <summary>
+    /// The delivered filename for one source frame: DeliveredBaseName with the
+    /// frame number (re-padded to the render's own convention) and extension —
+    /// never the internal render filename it was copied from. Falls back to
+    /// the source filename verbatim (never fatal) when there's no client-facing
+    /// base to use, or the frame number can't be parsed out of the source name.
+    /// </summary>
+    internal string DeliveredFrameName(string src, DeliveryManifestItem item, SequencePattern pattern)
+    {
+        var sourceName = Path.GetFileName(src);
+        if (string.IsNullOrWhiteSpace(item.DeliveredBaseName))
+        {
+            return sourceName;
+        }
+        var frame = pattern.FrameNumberOf(sourceName);
+        if (frame is null)
+        {
+            _log.LogWarning("Could not parse a frame number out of {Name} for {Shot} — delivering under its original name",
+                sourceName, item.ShotCode);
+            return sourceName;
+        }
+        var padding = Math.Max(1, pattern.Padding);
+        return $"{item.DeliveredBaseName}.{frame.Value.ToString().PadLeft(padding, '0')}{pattern.Extension}";
+    }
+
+    private static string SequenceChecksum(IEnumerable<string> files)
+    {
+        var state = new XxHash64.State(0);
+        foreach (var f in files)
+        {
+            state.Update(Encoding.ASCII.GetBytes(XxHash64.HashFile(f)));
+        }
+        return state.Digest().ToString("x16");
+    }
+
+    /// <summary>
+    /// The client-facing delivery report (§11.4): one row per shot. Columns are
+    /// confirmed against the production's delivery spec before the first real
+    /// delivery (18.2-C2), which is why this is a plain, easily-edited writer.
+    /// </summary>
+    private string WriteReport(DeliveryManifest manifest, List<DeliveryItemResult> results, PathMapper mapper)
+    {
+        var path = mapper.Map(manifest.ReportFile);
+        var dir = Path.GetDirectoryName(path);
+        if (dir is not null) Directory.CreateDirectory(dir);
+
+        var sb = new StringBuilder();
+        sb.AppendLine("Shot,Version,FrameStart,FrameEnd,FrameCount,Files,Bytes,Checksum,MOV,Status");
+        foreach (var r in results)
+        {
+            sb.AppendLine(string.Join(",", new[]
+            {
+                Csv(r.ShotCode),
+                Csv(r.VersionString),
+                r.FrameStart.ToString(CultureInfo.InvariantCulture),
+                r.FrameEnd.ToString(CultureInfo.InvariantCulture),
+                (r.FrameEnd - r.FrameStart + 1).ToString(CultureInfo.InvariantCulture),
+                (r.FileCount ?? 0).ToString(CultureInfo.InvariantCulture),
+                (r.TotalBytes ?? 0).ToString(CultureInfo.InvariantCulture),
+                Csv(r.Checksum ?? ""),
+                Csv(r.MovPath is null ? "" : Path.GetFileName(r.MovPath)),
+                Csv(r.Status),
+            }));
+        }
+        File.WriteAllText(path, sb.ToString(), new UTF8Encoding(false));
+        _log.LogInformation("Wrote delivery report {Path}", path);
+        return path;
+    }
+
+    private void WriteManifestJson(
+        DeliveryManifest manifest, List<DeliveryItemResult> results, List<object> files, string packageDir)
+    {
+        var payload = new
+        {
+            package = manifest.PackageName,
+            packageNumber = manifest.PackageNumber,
+            episode = manifest.Episode,
+            builtAt = DateTimeOffset.UtcNow,
+            builtBy = Environment.MachineName,
+            checksumAlgo = manifest.ChecksumAlgo,
+            shots = results.Select(r => new
+            {
+                r.ShotCode,
+                r.VersionString,
+                r.FileCount,
+                r.TotalBytes,
+                r.Checksum,
+                r.LinkMode,
+                r.Status,
+                r.ErrorMessage,
+            }),
+            files,
+        };
+        var path = Path.Combine(packageDir, "manifest.json");
+        File.WriteAllText(path, JsonSerializer.Serialize(payload, WorkerOptions.JsonOpts), new UTF8Encoding(false));
+    }
+
+    private static string Csv(string value) =>
+        value.Contains(',') || value.Contains('"') ? "\"" + value.Replace("\"", "\"\"") + "\"" : value;
+
+    [DllImport("Kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool CreateHardLink(string lpFileName, string lpExistingFileName, IntPtr lpSecurityAttributes);
+}
+
+public sealed record DeliveryResult(
+    bool Ok, List<DeliveryItemResult> Items, string PackageDir, string? ReportPath, List<object> Files);
+
+public sealed class DeliveryItemResult
+{
+    public string ItemId { get; set; } = "";
+    public string ShotCode { get; set; } = "";
+    public string VersionString { get; set; } = "";
+    public string Status { get; set; } = "PENDING";
+    public string? ExrPath { get; set; }
+    public string? MovPath { get; set; }
+    public int? FileCount { get; set; }
+    public long? TotalBytes { get; set; }
+    public string? Checksum { get; set; }
+    public string? LinkMode { get; set; }
+    public string? ErrorMessage { get; set; }
+    public int FrameStart { get; set; }
+    public int FrameEnd { get; set; }
+
+    public static DeliveryItemResult Failed(DeliveryManifestItem item, string error) => new()
+    {
+        ItemId = item.ItemId,
+        ShotCode = item.ShotCode,
+        VersionString = item.VersionString,
+        Status = "FAILED",
+        ErrorMessage = error,
+        FrameStart = item.FrameStart,
+        FrameEnd = item.FrameEnd,
+    };
+}

RenderWorker/VFXReviewWorker/Dtos.cs

@@ -26,6 +26,15 @@ public sealed class ServerConfig
     public int LeaseSeconds { get; set; } = 300;
     public int MaxAttempts { get; set; } = 3;
     public int StallTimeoutSeconds { get; set; } = 600;
+
+    /// <summary>
+    /// Validation stage (§8). The server decides whether it runs, so turning it
+    /// off is a config change there rather than a redeploy of every worker.
+    /// </summary>
+    public bool ValidationEnabled { get; set; } = true;
+    public int ValidationSampleEvery { get; set; } = 25;
+    /// <summary>Head handles the plates carry; only used for the API timecode fallback (§8.1a).</summary>
+    public int ValidationHandleFrames { get; set; } = 8;
 }
 
 public sealed class ClaimResponse
@@ -40,6 +49,9 @@ public sealed class ClaimedJob
     public int Attempt { get; set; }
     public int MaxAttempts { get; set; }
     public string? ExportId { get; set; }
+    public string? DeliveryId { get; set; }
+    /// <summary>Set for jobs with no shot behind them; shown instead of a shot code.</summary>
+    public string? Label { get; set; }
     public DateTimeOffset? LeaseExpiresAt { get; set; }
 
     /// <summary>Manifest shape depends on the job type — deserialize per stage.</summary>
@@ -52,6 +64,93 @@ public sealed class ClaimedJob
     public PreviewManifest AsPreviewManifest() =>
         Manifest.Deserialize<PreviewManifest>(WorkerOptions.JsonOpts)
         ?? throw new InvalidOperationException("Job manifest is not a preview manifest");
+
+    public DeliveryManifest AsDeliveryManifest() =>
+        Manifest.Deserialize<DeliveryManifest>(WorkerOptions.JsonOpts)
+        ?? throw new InvalidOperationException("Job manifest is not a delivery manifest");
+
+    public BlenderManifest AsBlenderManifest() =>
+        Manifest.Deserialize<BlenderManifest>(WorkerOptions.JsonOpts)
+        ?? throw new InvalidOperationException("Job manifest is not a Blender manifest");
+}
+
+/// <summary>
+/// A standalone Blender render. Overrides are all optional: an unset value
+/// leaves whatever the .blend was saved with, which is the point — the file is
+/// expected to be ready to render.
+/// </summary>
+public sealed class BlenderManifest
+{
+    public string Stage { get; set; } = "BLENDER";
+    public string BlendFile { get; set; } = "";
+    public string? Scene { get; set; }
+    public int FrameStart { get; set; }
+    public int FrameEnd { get; set; }
+    public string? OutputPath { get; set; }
+    public string? Engine { get; set; }
+    public string? Device { get; set; }
+    public int? Samples { get; set; }
+    public int? ResolutionPercent { get; set; }
+    public string? BlenderVersion { get; set; }
+
+    public int TotalFrames => FrameEnd - FrameStart + 1;
+}
+
+/// <summary>DELIVERY_BUILD manifest (server-built, RenderPipeline2 §11).</summary>
+public sealed class DeliveryManifest
+{
+    public string Stage { get; set; } = "DELIVERY";
+    /// <summary>
+    /// "EXR_DELIVERY" builds the per-shot folders of EXRs + MOVs; "MOV_REVIEW"
+    /// builds a flat folder of preview MOVs for a formal review (§11.6). One
+    /// job type and one claim path either way — only what lands on disk differs.
+    /// </summary>
+    public string Kind { get; set; } = "EXR_DELIVERY";
+    public string PackageId { get; set; } = "";
+    public string PackageName { get; set; } = "";
+    public int PackageNumber { get; set; }
+    public string Episode { get; set; } = "";
+    public string PackageDir { get; set; } = "";
+    public string ReportFile { get; set; } = "";
+    public bool IncludeMovs { get; set; } = true;
+    public string CopyMode { get; set; } = "auto";
+    /// <summary>"auto" verifies copies by hash and links by identity; "always-hash" reads everything back.</summary>
+    public string VerifyMode { get; set; } = "auto";
+    public string ChecksumAlgo { get; set; } = "xxh64";
+    public List<string> ReportFormats { get; set; } = new();
+    public List<DeliveryManifestItem> Items { get; set; } = new();
+}
+
+public sealed class DeliveryManifestItem
+{
+    public string ItemId { get; set; } = "";
+    public string ExportId { get; set; } = "";
+    public string ShotCode { get; set; } = "";
+    public string VersionString { get; set; } = "";
+    public string SourceDir { get; set; } = "";
+    public string OutputPattern { get; set; } = "";
+    public int FrameStart { get; set; }
+    public int FrameEnd { get; set; }
+    public int? FileCount { get; set; }
+    public string? Checksum { get; set; }
+    public string? DeliveryMovPath { get; set; }
+    public string ShotDir { get; set; } = "";
+    /// <summary>
+    /// Server-computed: "{clientCode}_{versionString}" when the shot has a
+    /// client naming code, else the studio's own "{shotCode}_cmp_TT_{versionString}".
+    /// The delivered EXR sequence and MOV are named from this, not the
+    /// internal render filename they're copied from.
+    /// </summary>
+    public string DeliveredBaseName { get; set; } = "";
+    /// <summary>When this export's validation ran — lets a linked package detect a source changed since QC.</summary>
+    public DateTimeOffset? ValidatedAt { get; set; }
+
+    /// <summary>
+    /// True on a MOV_REVIEW item: there is no EXR sequence, so SourceDir,
+    /// OutputPattern, FileCount and Checksum are empty and DeliveryMovPath is
+    /// the whole deliverable.
+    /// </summary>
+    public bool IsMovOnly => string.IsNullOrWhiteSpace(SourceDir);
 }
 
 /// <summary>PREVIEW_ONLY manifest (server-built, RenderPipeline2 §9).</summary>
@@ -76,6 +175,11 @@ public sealed class PreviewManifest
     public string Mp4Output { get; set; } = "";
     public string? SlateScopeProp { get; set; }
     public string? SlateSubmissionProp { get; set; }
+    /// <summary>
+    /// Also encode the High quality MP4 from the MOV and upload the MOV itself
+    /// as the version's High Res file (server "preview.highQuality").
+    /// </summary>
+    public bool HighQuality { get; set; }
     public SlateInfo Slate { get; set; } = new();
 
     public int TotalFrames => FrameEnd - FrameStart + 1;
@@ -88,6 +192,8 @@ public sealed class SlateInfo
     public string? Description { get; set; }
     public string? Notes { get; set; }
     public string ShotCode { get; set; } = "";
+    /// <summary>Production name, burned into the slate and the overlay.</summary>
+    public string? Show { get; set; }
     public string? Episode { get; set; }
     public string? Scene { get; set; }
     public string? VfxScope { get; set; }
@@ -105,19 +211,39 @@ public sealed class PreviewBuildResult
     public int? FrameCount { get; set; }
     public int? Width { get; set; }
     public int? Height { get; set; }
+    /// <summary>
+    /// Seconds of slate ahead of picture in the preview comp (the SHOT layer's
+    /// in-point). Null on builds predating this field, or when the template has
+    /// no SHOT layer — the thumbnail then falls back to scanning from frame 0.
+    /// </summary>
+    public double? PictureStartSeconds { get; set; }
 }
 
-/// <summary>The Render Manifest (§6.2) — only the fields the Phase 2 render stage needs; the rest is preserved raw.</summary>
+/// <summary>The Render Manifest (§6.2) — the fields the render and validation stages need; the rest is preserved raw.</summary>
 public sealed class RenderManifest
 {
+    public string ShotCode { get; set; } = "";
     public string AepPath { get; set; } = "";
     public string CompName { get; set; } = "";
     public string OutputDir { get; set; } = "";
     public string OutputPattern { get; set; } = "";
     public string? OutputModuleTemplate { get; set; }
     public string? RenderSettingsTemplate { get; set; }
+    /// <summary>Comp timeline range handed to aerender (-s/-e).</summary>
     public int FrameStart { get; set; }
     public int FrameEnd { get; set; }
+    /// <summary>
+    /// The number the *first output file* carries — the output module's
+    /// starting number (house convention 1001), which is deliberately not the
+    /// comp's frame range: a comp anchored to the plate's timecode starts in
+    /// the millions. Null on manifests predating this field.
+    /// </summary>
+    public int? OutputFrameStart { get; set; }
+    public double Fps { get; set; } = 24;
+    public int Width { get; set; }
+    public int Height { get; set; }
+    public ManifestExpected? Expected { get; set; }
+    public ManifestSource? Source { get; set; }
 
     [JsonExtensionData]
     public Dictionary<string, JsonElement>? Extra { get; set; }
@@ -125,6 +251,35 @@ public sealed class RenderManifest
     public int TotalFrames => FrameEnd - FrameStart + 1;
 }
 
+/// <summary>Per-project expectations the validation engine checks against (§8.1).</summary>
+public sealed class ManifestExpected
+{
+    public string? Colorspace { get; set; }
+    public string? BitDepth { get; set; }
+    public string? ExrCompression { get; set; }
+    public bool? Alpha { get; set; }
+    /// <summary>The API's editorial in-point — the rank 3 timecode fallback only (§8.1a).</summary>
+    public string? TimecodeStart { get; set; }
+}
+
+/// <summary>Plate provenance resolved by the panel from the comp's footage layers (§6.2).</summary>
+public sealed class ManifestSource
+{
+    public PlateRef? TimingPlate { get; set; }
+    public List<PlateRef> Plates { get; set; } = new();
+    public string? StartSource { get; set; }
+    public int? StartFrames { get; set; }
+    public int? HandleFrames { get; set; }
+}
+
+public sealed class PlateRef
+{
+    public string? Element { get; set; }
+    public string Path { get; set; } = "";
+    public int? FrameStart { get; set; }
+    public int? FrameEnd { get; set; }
+}
+
 public sealed class ProgressResponse
 {
     public bool Ok { get; set; }
@@ -149,6 +304,11 @@ public sealed class PresignResponse
     public string PresignedUrl { get; set; } = "";
     public string Key { get; set; } = "";
     public string Url { get; set; } = "";
+    // Multipart (server ≥ 1.7.2 contract) — absent from older servers, which
+    // only ever return PresignedUrl.
+    public string? UploadId { get; set; }
+    public long PartSize { get; set; }
+    public List<string>? PartUrls { get; set; }
 }
 
 public sealed class ExportDetailResponse

RenderWorker/VFXReviewWorker/ExrHeader.cs

@@ -0,0 +1,234 @@
+using System.Text;
+
+namespace VFXReviewWorker;
+
+/// <summary>
+/// Minimal OpenEXR header reader (RenderPipeline2 §8.1a).
+///
+/// Everything validation needs — timecode, fps, resolution, channel types,
+/// compression — lives in the header, so a check costs one 64 KB read and no
+/// pixel decode. That is why the engine needs no oiiotool/OpenImageIO
+/// dependency and can run on a bare workstation.
+///
+/// Header layout: magic(4) version(4) then attributes as
+/// `name\0 type\0 int32 size data`, terminated by an empty name.
+/// </summary>
+public sealed class ExrHeader
+{
+    public const uint Magic = 20000630;
+    private const int MaxHeaderBytes = 1 << 18; // 256 KB — far beyond any sane header
+
+    public int DataWidth { get; private init; }
+    public int DataHeight { get; private init; }
+    public int DisplayWidth { get; private init; }
+    public int DisplayHeight { get; private init; }
+    public IReadOnlyList<ExrChannel> Channels { get; private init; } = Array.Empty<ExrChannel>();
+    public byte? CompressionCode { get; private init; }
+    public Timecode? Timecode { get; private init; }
+    public string? TimecodeString { get; private init; }
+    public double? FramesPerSecond { get; private init; }
+    public bool HasChromaticities { get; private init; }
+    public bool IsTiled { get; private init; }
+    public IReadOnlyList<string> AttributeNames { get; private init; } = Array.Empty<string>();
+
+    public bool HasAlpha => Channels.Any(c => c.Name.Equals("A", StringComparison.Ordinal));
+
+    /// <summary>half / float / uint — the deepest channel type present.</summary>
+    public string? BitDepth
+    {
+        get
+        {
+            if (Channels.Count == 0) return null;
+            if (Channels.Any(c => c.PixelType == 2)) return "float";
+            if (Channels.Any(c => c.PixelType == 1)) return "half";
+            return "uint";
+        }
+    }
+
+    public string CompressionName => CompressionCode switch
+    {
+        0 => "none", 1 => "RLE", 2 => "ZIPS", 3 => "ZIP", 4 => "PIZ",
+        5 => "PXR24", 6 => "B44", 7 => "B44A", 8 => "DWAA", 9 => "DWAB",
+        null => "unknown",
+        _ => $"code {CompressionCode}",
+    };
+
+    /// <summary>Reads the header, or throws <see cref="InvalidDataException"/> when the file is not a readable EXR.</summary>
+    public static ExrHeader Read(string path)
+    {
+        using var fs = new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.ReadWrite);
+        var buf = new byte[Math.Min(MaxHeaderBytes, Math.Max(1024, (int)Math.Min(fs.Length, MaxHeaderBytes)))];
+        var read = fs.Read(buf, 0, buf.Length);
+        if (read < 16) throw new InvalidDataException("File is too small to be an EXR");
+
+        var span = new ReadOnlySpan<byte>(buf, 0, read);
+        if (BitConverter.ToUInt32(span[..4]) != Magic) throw new InvalidDataException("Not an EXR (bad magic number)");
+        var version = BitConverter.ToInt32(span.Slice(4, 4));
+
+        int pos = 8;
+        var names = new List<string>();
+        var channels = new List<ExrChannel>();
+        int dataW = 0, dataH = 0, dispW = 0, dispH = 0;
+        byte? compression = null;
+        Timecode? tc = null;
+        string? tcString = null;
+        double? fps = null;
+        bool chroma = false;
+
+        while (pos < read)
+        {
+            var name = ReadCString(span, ref pos);
+            if (name.Length == 0) break; // end of header
+            var type = ReadCString(span, ref pos);
+            if (pos + 4 > read) throw new InvalidDataException("Truncated EXR header (attribute size)");
+            var size = BitConverter.ToInt32(span.Slice(pos, 4));
+            pos += 4;
+            if (size < 0 || pos + size > read) throw new InvalidDataException($"Truncated EXR header (attribute \"{name}\")");
+            var data = span.Slice(pos, size);
+            names.Add(name);
+
+            switch (name)
+            {
+                case "dataWindow" when size >= 16:
+                    dataW = BitConverter.ToInt32(data.Slice(8, 4)) - BitConverter.ToInt32(data[..4]) + 1;
+                    dataH = BitConverter.ToInt32(data.Slice(12, 4)) - BitConverter.ToInt32(data.Slice(4, 4)) + 1;
+                    break;
+                case "displayWindow" when size >= 16:
+                    dispW = BitConverter.ToInt32(data.Slice(8, 4)) - BitConverter.ToInt32(data[..4]) + 1;
+                    dispH = BitConverter.ToInt32(data.Slice(12, 4)) - BitConverter.ToInt32(data.Slice(4, 4)) + 1;
+                    break;
+                case "compression" when size >= 1:
+                    compression = data[0];
+                    break;
+                case "timeCode" when size >= 8:
+                    tc = VFXReviewWorker.Timecode.FromPacked(
+                        BitConverter.ToUInt32(data[..4]), BitConverter.ToUInt32(data.Slice(4, 4)));
+                    break;
+                case "timeCodeString":
+                    tcString = Encoding.ASCII.GetString(data).TrimEnd('\0');
+                    break;
+                case "framesPerSecond" when size >= 8:
+                    {
+                        var num = BitConverter.ToInt32(data[..4]);
+                        var den = BitConverter.ToUInt32(data.Slice(4, 4));
+                        if (den != 0) fps = num / (double)den;
+                        break;
+                    }
+                case "chromaticities":
+                    chroma = true;
+                    break;
+                case "channels":
+                    channels.AddRange(ReadChannels(data));
+                    break;
+            }
+
+            pos += size;
+        }
+
+        return new ExrHeader
+        {
+            DataWidth = dataW,
+            DataHeight = dataH,
+            DisplayWidth = dispW,
+            DisplayHeight = dispH,
+            Channels = channels,
+            CompressionCode = compression,
+            Timecode = tc,
+            TimecodeString = tcString,
+            FramesPerSecond = fps,
+            HasChromaticities = chroma,
+            IsTiled = (version & 0x200) != 0,
+            AttributeNames = names,
+        };
+    }
+
+    /// <summary>Header read that returns null instead of throwing — for "is this file readable at all" checks.</summary>
+    public static ExrHeader? TryRead(string path)
+    {
+        try { return Read(path); }
+        catch { return null; }
+    }
+
+    private static IEnumerable<ExrChannel> ReadChannels(ReadOnlySpan<byte> data)
+    {
+        var result = new List<ExrChannel>();
+        int p = 0;
+        while (p < data.Length)
+        {
+            var name = ReadCString(data, ref p);
+            if (name.Length == 0) break; // null terminator ends the channel list
+            if (p + 16 > data.Length) break;
+            var pixelType = BitConverter.ToInt32(data.Slice(p, 4));
+            p += 16; // pixelType(4) + pLinear(1) + reserved(3) + xSampling(4) + ySampling(4)
+            result.Add(new ExrChannel(name, pixelType));
+        }
+        return result;
+    }
+
+    private static string ReadCString(ReadOnlySpan<byte> span, ref int pos)
+    {
+        int start = pos;
+        while (pos < span.Length && span[pos] != 0) pos++;
+        var s = Encoding.ASCII.GetString(span[start..pos]);
+        pos++; // skip the terminator
+        return s;
+    }
+}
+
+public readonly record struct ExrChannel(string Name, int PixelType)
+{
+    public string TypeName => PixelType switch { 0 => "uint", 1 => "half", 2 => "float", _ => $"type {PixelType}" };
+}
+
+/// <summary>
+/// SMPTE 12M timecode as stored in the EXR `timeCode` attribute: BCD-packed,
+/// which is why the raw value reads back as its own hex digits
+/// (0x18585712 → 18:58:57:12).
+/// </summary>
+public readonly record struct Timecode(int Hours, int Minutes, int Seconds, int Frames, bool DropFrame)
+{
+    public static Timecode FromPacked(uint timeAndFlags, uint _userData = 0)
+    {
+        int Bits(int shift, int mask) => (int)((timeAndFlags >> shift) & (uint)mask);
+        return new Timecode(
+            Bits(24, 0xF) + Bits(28, 0x3) * 10,
+            Bits(16, 0xF) + Bits(20, 0x7) * 10,
+            Bits(8, 0xF) + Bits(12, 0x7) * 10,
+            Bits(0, 0xF) + Bits(4, 0x3) * 10,
+            Bits(6, 0x1) == 1);
+    }
+
+    public static Timecode? Parse(string? text, bool dropFrame = false)
+    {
+        if (string.IsNullOrWhiteSpace(text)) return null;
+        var parts = text.Trim().Split(':', ';');
+        if (parts.Length < 4) return null;
+        if (!int.TryParse(parts[0], out var hh) || !int.TryParse(parts[1], out var mm) ||
+            !int.TryParse(parts[2], out var ss) || !int.TryParse(parts[3], out var ff)) return null;
+        return new Timecode(hh, mm, ss, ff, dropFrame || text.Contains(';'));
+    }
+
+    /// <summary>
+    /// Non-drop frame count. The studio shoots 24 fps, so drop-frame never
+    /// applies; a drop-frame flag mismatch is reported as its own check rather
+    /// than silently changing this arithmetic.
+    /// </summary>
+    public long ToFrames(double fps)
+    {
+        var rate = (long)Math.Round(fps <= 0 ? 24 : fps);
+        return ((Hours * 60L + Minutes) * 60L + Seconds) * rate + Frames;
+    }
+
+    public static Timecode FromFrames(long frames, double fps)
+    {
+        var rate = (long)Math.Round(fps <= 0 ? 24 : fps);
+        if (rate <= 0) rate = 24;
+        var f = Math.Max(0, frames);
+        var ff = (int)(f % rate);
+        var totalSeconds = f / rate;
+        return new Timecode((int)(totalSeconds / 3600), (int)(totalSeconds / 60 % 60), (int)(totalSeconds % 60), ff, false);
+    }
+
+    public override string ToString() =>
+        $"{Hours:D2}:{Minutes:D2}:{Seconds:D2}{(DropFrame ? ';' : ':')}{Frames:D2}";
+}

RenderWorker/VFXReviewWorker/HighResUploader.cs

@@ -0,0 +1,143 @@
+using System.Text.Json;
+using Microsoft.Extensions.Logging;
+
+namespace VFXReviewWorker;
+
+/// <summary>
+/// Uploads each preview's ProRes MOV (the version's High Res download) in the
+/// background, after the job has already been finalized.
+///
+/// The MOV is by far the largest upload — hundreds of MB — and on a slow or
+/// flaky uplink it held every preview job open for 10+ minutes, during which
+/// the job looked stuck in the app and a worker restart threw the whole
+/// preview away. Now the job completes as soon as the review MP4s are up, the
+/// worker moves on to the next job, and the MOV follows; an "attach-highres"
+/// report (through the ordered spooler, so always after its finalize) attaches
+/// it to the version.
+///
+/// Pending uploads are files in highres-queue/, so a restart resumes them. The
+/// MOV itself lives on the SAN beside the EXRs, never in scratch.
+/// </summary>
+public sealed class HighResUploader
+{
+    private const int MaxAttempts = 5;
+
+    private readonly ApiClient _api;
+    private readonly ReportSpooler _spooler;
+    private readonly ILogger<HighResUploader> _log;
+    private readonly string _dir;
+    private readonly SemaphoreSlim _wake = new(0);
+
+    public HighResUploader(ApiClient api, ReportSpooler spooler, ILogger<HighResUploader> log)
+    {
+        _api = api;
+        _spooler = spooler;
+        _log = log;
+        _dir = Path.Combine(WorkerOptions.DataDir, "highres-queue");
+        Directory.CreateDirectory(_dir);
+    }
+
+    private sealed class Pending
+    {
+        public string JobId { get; set; } = "";
+        public string MachineId { get; set; } = "";
+        public string MovPath { get; set; } = "";
+        public int Attempts { get; set; }
+    }
+
+    public void Enqueue(string jobId, string machineId, string movPath)
+    {
+        var item = new Pending { JobId = jobId, MachineId = machineId, MovPath = movPath };
+        var name = $"{DateTimeOffset.UtcNow.UtcTicks:D20}_{jobId}.json";
+        var tmp = Path.Combine(_dir, name + ".tmp");
+        File.WriteAllText(tmp, JsonSerializer.Serialize(item, WorkerOptions.JsonOpts));
+        File.Move(tmp, Path.Combine(_dir, name));
+        _log.LogInformation("ProRes for job {JobId} queued for background upload ({MB:F0} MB)",
+            jobId, File.Exists(movPath) ? new FileInfo(movPath).Length / 1048576.0 : 0);
+        _wake.Release();
+    }
+
+    /// <summary>Long-running loop; started once by the worker service.</summary>
+    public async Task RunAsync(CancellationToken ct)
+    {
+        var backoff = TimeSpan.FromSeconds(30);
+        while (!ct.IsCancellationRequested)
+        {
+            var next = Directory.EnumerateFiles(_dir, "*.json").OrderBy(f => f, StringComparer.Ordinal).FirstOrDefault();
+            if (next is null)
+            {
+                try { await _wake.WaitAsync(TimeSpan.FromSeconds(30), ct); } catch (OperationCanceledException) { break; }
+                continue;
+            }
+
+            Pending? item;
+            try { item = JsonSerializer.Deserialize<Pending>(File.ReadAllText(next), WorkerOptions.JsonOpts); }
+            catch { item = null; }
+            if (item is null || string.IsNullOrEmpty(item.JobId))
+            {
+                _log.LogWarning("Discarding unreadable ProRes queue file {File}", next);
+                TryDelete(next);
+                continue;
+            }
+
+            if (!File.Exists(item.MovPath))
+            {
+                _log.LogWarning("ProRes for job {JobId} is gone ({Path}) — not uploading", item.JobId, item.MovPath);
+                Report(item, null, $"MOV not found at {item.MovPath}");
+                TryDelete(next);
+                continue;
+            }
+
+            string? key;
+            try
+            {
+                key = await _api.UploadArtifactAsync(item.JobId, item.MachineId, "highres", item.MovPath, "video/quicktime", ct);
+            }
+            catch (OperationCanceledException) when (ct.IsCancellationRequested)
+            {
+                _log.LogInformation("Worker stopping — ProRes upload for job {JobId} resumes on next start", item.JobId);
+                break;
+            }
+
+            if (key is not null)
+            {
+                Report(item, key, null);
+                TryDelete(next);
+                backoff = TimeSpan.FromSeconds(30);
+                continue;
+            }
+
+            item.Attempts++;
+            if (item.Attempts >= MaxAttempts)
+            {
+                _log.LogWarning("ProRes upload for job {JobId} failed {N} times — giving up", item.JobId, item.Attempts);
+                Report(item, null, $"upload failed {item.Attempts} times (see the worker log)");
+                TryDelete(next);
+                continue;
+            }
+
+            _log.LogWarning("ProRes upload for job {JobId} failed (attempt {N}/{Max}); retrying in {Sec}s",
+                item.JobId, item.Attempts, MaxAttempts, backoff.TotalSeconds);
+            try { File.WriteAllText(next, JsonSerializer.Serialize(item, WorkerOptions.JsonOpts)); } catch { /* retried anyway */ }
+            try { await Task.Delay(backoff, ct); } catch (OperationCanceledException) { break; }
+            backoff = TimeSpan.FromSeconds(Math.Min(backoff.TotalSeconds * 2, 600));
+        }
+    }
+
+    private void Report(Pending item, string? key, string? error)
+    {
+        _spooler.Enqueue("attach-highres", item.JobId, new Dictionary<string, object?>
+        {
+            ["machineId"] = item.MachineId,
+            ["highResKey"] = key,
+            ["highResFileName"] = key is null ? null : Path.GetFileName(item.MovPath),
+            ["highResSize"] = key is null ? null : new FileInfo(item.MovPath).Length,
+            ["error"] = error,
+        });
+    }
+
+    private static void TryDelete(string path)
+    {
+        try { File.Delete(path); } catch { /* next pass */ }
+    }
+}

RenderWorker/VFXReviewWorker/JobExecutor.cs

@@ -14,15 +14,25 @@ public sealed class JobExecutor
     private readonly ApiClient _api;
     private readonly AerenderRunner _runner;
     private readonly PreviewStage _preview;
+    private readonly ValidationStage _validation;
+    private readonly DeliveryStage _delivery;
+    private readonly BlenderRunner _blender;
     private readonly ReportSpooler _spooler;
+    private readonly HighResUploader _highRes;
     private readonly ILogger<JobExecutor> _log;
 
-    public JobExecutor(WorkerOptions options, ApiClient api, AerenderRunner runner, PreviewStage preview, ReportSpooler spooler, ILogger<JobExecutor> log)
+    public JobExecutor(WorkerOptions options, ApiClient api, AerenderRunner runner, PreviewStage preview,
+        ValidationStage validation, DeliveryStage delivery, BlenderRunner blender, ReportSpooler spooler,
+        HighResUploader highRes, ILogger<JobExecutor> log)
     {
+        _highRes = highRes;
         _options = options;
         _api = api;
         _runner = runner;
         _preview = preview;
+        _validation = validation;
+        _delivery = delivery;
+        _blender = blender;
         _spooler = spooler;
         _log = log;
     }
@@ -35,6 +45,18 @@ public sealed class JobExecutor
             return;
         }
 
+        if (job.Type == "DELIVERY_BUILD")
+        {
+            await RunDeliveryAsync(job, machineId, cancelJob, shutdown);
+            return;
+        }
+
+        if (job.Type == "BLENDER_RENDER")
+        {
+            await RunBlenderAsync(job, machineId, config, cancelJob, shutdown);
+            return;
+        }
+
         var manifest = job.AsRenderManifest();
         var mapper = new PathMapper(_options.PathMappings);
         var outputDirLocal = mapper.Map(manifest.OutputDir);
@@ -57,12 +79,15 @@ public sealed class JobExecutor
             {
                 long totalBytes = 0;
                 int fileCount = 0;
-                var prefix = AerenderRunner.OutputPatternPrefix(manifest.OutputPattern);
+                // Prefix and extension both: the preview MOV/MP4 for this
+                // version share the basename and live in this same folder, and
+                // counting them as frames would inflate the EXR stats.
+                var pattern = SequencePattern.FromOutputPattern(manifest.OutputPattern);
                 try
                 {
                     foreach (var f in Directory.EnumerateFiles(outputDirLocal))
                     {
-                        if (!Path.GetFileName(f).StartsWith(prefix, StringComparison.OrdinalIgnoreCase)) continue;
+                        if (!pattern.MatchesOutputFile(Path.GetFileName(f))) continue;
                         fileCount++;
                         totalBytes += new FileInfo(f).Length;
                     }
@@ -75,8 +100,8 @@ public sealed class JobExecutor
                     // range, template mismatch, silently swallowed error).
                     // Until Phase 3 validation exists, an empty output dir must
                     // never become READY_FOR_QC.
-                    _log.LogError("Job {JobId}: aerender exited 0 but no \"{Prefix}*\" files exist in {Dir} — reporting failure",
+                    _log.LogError("Job {JobId}: aerender exited 0 but no \"{Prefix}*{Ext}\" files exist in {Dir} — reporting failure",
-                        job.Id, prefix, outputDirLocal);
+                        job.Id, pattern.Prefix, pattern.Extension, outputDirLocal);
                     _spooler.Enqueue("fail", job.Id, new Dictionary<string, object?>
                     {
                         ["machineId"] = machineId,
@@ -101,6 +126,15 @@ public sealed class JobExecutor
                     ["exrFileCount"] = fileCount,
                     ["exrTotalBytes"] = totalBytes,
                 });
+
+                // Validation runs here, while we still hold the job and the
+                // files are local. It is queued behind complete-render, and the
+                // spooler's in-order replay is what guarantees the server has
+                // moved the Export to VALIDATING before this lands (§8).
+                if (config.ValidationEnabled)
+                {
+                    await RunValidationAsync(job, manifest, machineId, outputDirLocal, config, shutdown);
+                }
             }
             else if (result.ErrorMessage == "Cancelled")
             {
@@ -149,6 +183,208 @@ public sealed class JobExecutor
         }
     }
 
+    /// <summary>
+    /// BLENDER_RENDER job: a standalone render with no Export behind it, so
+    /// there is nothing to validate, preview or QC — it finishes at
+    /// complete-render and that is the whole lifecycle.
+    /// </summary>
+    private async Task RunBlenderAsync(ClaimedJob job, string machineId, ServerConfig config,
+        CancellationToken cancelJob, CancellationToken shutdown)
+    {
+        var manifest = job.AsBlenderManifest();
+
+        WriteState(new CurrentJobState
+        {
+            JobId = job.Id,
+            ExportId = null,
+            MachineId = machineId,
+            OutputDirLocal = manifest.OutputPath ?? "",
+            ClaimedAt = DateTimeOffset.UtcNow,
+        });
+
+        try
+        {
+            var result = await _blender.RunAsync(job, manifest, machineId, config, cancelJob, shutdown);
+            var logKey = string.IsNullOrEmpty(result.FullLogPath)
+                ? null
+                : await _api.UploadLogAsync(job.Id, machineId, result.FullLogPath, shutdown);
+
+            if (result.Success)
+            {
+                _log.LogInformation("Blender job {JobId} complete: {Frames} frames in {Sec:F0}s",
+                    job.Id, manifest.TotalFrames, result.RenderSeconds);
+                _spooler.Enqueue("complete-render", job.Id, new Dictionary<string, object?>
+                {
+                    ["machineId"] = machineId,
+                    ["renderSeconds"] = (int)result.RenderSeconds,
+                    ["logFileKey"] = logKey,
+                    ["logTail"] = result.LogTail,
+                });
+                return;
+            }
+
+            _spooler.Enqueue("fail", job.Id, new Dictionary<string, object?>
+            {
+                ["machineId"] = machineId,
+                ["stage"] = "BLENDER",
+                ["exitCode"] = result.ExitCode,
+                ["errorMessage"] = result.ErrorMessage,
+                ["logTail"] = result.LogTail,
+                ["logFileKey"] = logKey,
+                ["retryable"] = result.ErrorMessage == "Cancelled" ? false : result.Retryable,
+            });
+        }
+        catch (Exception ex)
+        {
+            _log.LogError(ex, "Unexpected Blender error for job {JobId}", job.Id);
+            _spooler.Enqueue("fail", job.Id, new Dictionary<string, object?>
+            {
+                ["machineId"] = machineId,
+                ["stage"] = "BLENDER",
+                ["errorMessage"] = $"Worker exception: {ex.Message}",
+                ["retryable"] = true,
+            });
+        }
+        finally
+        {
+            ClearState();
+        }
+    }
+
+    /// <summary>
+    /// DELIVERY_BUILD job: build the dated package folder from already-QC'd
+    /// exports. No AE involved — folders, links and verification only.
+    /// </summary>
+    private async Task RunDeliveryAsync(ClaimedJob job, string machineId, CancellationToken cancelJob, CancellationToken shutdown)
+    {
+        var manifest = job.AsDeliveryManifest();
+
+        WriteState(new CurrentJobState
+        {
+            JobId = job.Id,
+            ExportId = null,
+            MachineId = machineId,
+            OutputDirLocal = new PathMapper(_options.PathMappings).Map(manifest.PackageDir),
+            ClaimedAt = DateTimeOffset.UtcNow,
+        });
+
+        try
+        {
+            var result = await _delivery.RunAsync(job, manifest, machineId, cancelJob, shutdown);
+
+            _log.LogInformation("Delivery {Name}: {Ok} ({Verified}/{Total} shots verified)",
+                manifest.PackageName, result.Ok ? "READY" : "FAILED",
+                result.Items.Count(i => i.Status == "VERIFIED"), manifest.Items.Count);
+
+            string? reportKey = null;
+            if (result.ReportPath is not null)
+            {
+                reportKey = await _api.UploadArtifactAsync(job.Id, machineId, "report", result.ReportPath, "text/csv", shutdown);
+            }
+
+            _spooler.Enqueue("delivery", job.Id, new Dictionary<string, object?>
+            {
+                ["machineId"] = machineId,
+                ["ok"] = result.Ok,
+                ["rootPath"] = result.PackageDir,
+                ["reportKey"] = reportKey,
+                ["items"] = result.Items.Select(i => new Dictionary<string, object?>
+                {
+                    ["itemId"] = i.ItemId,
+                    ["status"] = i.Status,
+                    ["exrPath"] = i.ExrPath,
+                    ["movPath"] = i.MovPath,
+                    ["fileCount"] = i.FileCount,
+                    ["totalBytes"] = i.TotalBytes,
+                    ["checksum"] = i.Checksum,
+                    ["linkMode"] = i.LinkMode,
+                    ["errorMessage"] = i.ErrorMessage,
+                }).ToList(),
+                ["manifest"] = new Dictionary<string, object?>
+                {
+                    ["packageDir"] = result.PackageDir,
+                    ["reportPath"] = result.ReportPath,
+                    ["files"] = result.Files,
+                },
+                ["errorMessage"] = result.Ok
+                    ? null
+                    : string.Join("; ", result.Items.Where(i => i.Status == "FAILED").Select(i => $"{i.ShotCode}: {i.ErrorMessage}").Take(5)),
+            });
+        }
+        catch (Exception ex)
+        {
+            _log.LogError(ex, "Unexpected delivery error for job {JobId}", job.Id);
+            _spooler.Enqueue("delivery", job.Id, new Dictionary<string, object?>
+            {
+                ["machineId"] = machineId,
+                ["ok"] = false,
+                ["items"] = new List<object>(),
+                ["errorMessage"] = $"Worker exception: {ex.Message}",
+            });
+        }
+        finally
+        {
+            ClearState();
+        }
+    }
+
+    /// <summary>
+    /// Runs the validation engine and spools the E12 report. Deliberately
+    /// non-fatal on its own errors: a crash in the checks must not lose a
+    /// finished render, so it is reported as a failed validation run rather
+    /// than being allowed to escape.
+    /// </summary>
+    private async Task RunValidationAsync(
+        ClaimedJob job, RenderManifest manifest, string machineId, string outputDirLocal,
+        ServerConfig config, CancellationToken shutdown)
+    {
+        var started = DateTimeOffset.UtcNow;
+        try
+        {
+            // Keep the lease alive: the job stays open through validation.
+            await _api.ProgressAsync(job.Id, machineId, 1.0, manifest.FrameEnd, manifest.TotalFrames, 0,
+                "Validating rendered sequence…", shutdown);
+
+            var outcome = await Task.Run(() => _validation.Run(manifest, outputDirLocal, config), shutdown);
+            var seconds = (DateTimeOffset.UtcNow - started).TotalSeconds;
+
+            var failed = outcome.Checks.Where(c => c.Status == "FAIL").Select(c => c.CheckName).ToList();
+            if (failed.Count > 0)
+            {
+                _log.LogWarning("Job {JobId} validation FAILED in {Sec:F1}s: {Checks}", job.Id, seconds, string.Join(", ", failed));
+            }
+            else
+            {
+                _log.LogInformation("Job {JobId} validation passed in {Sec:F1}s ({Count} checks, {Files} files)",
+                    job.Id, seconds, outcome.Checks.Count, outcome.FileCount);
+            }
+
+            _spooler.Enqueue("validation", job.Id, new Dictionary<string, object?>
+            {
+                ["machineId"] = machineId,
+                ["checks"] = outcome.Checks,
+                ["checksum"] = outcome.Checksum,
+                ["checksumAlgo"] = "xxh64",
+                ["exrFileCount"] = outcome.FileCount,
+                ["exrTotalBytes"] = outcome.TotalBytes,
+                ["validationSeconds"] = (int)seconds,
+            });
+        }
+        catch (Exception ex)
+        {
+            _log.LogError(ex, "Validation engine error for job {JobId}", job.Id);
+            _spooler.Enqueue("validation", job.Id, new Dictionary<string, object?>
+            {
+                ["machineId"] = machineId,
+                ["checks"] = new[]
+                {
+                    ValidationCheck.Fail("engine_error", "validation completes", "worker exception",
+                        $"The validation engine threw: {ex.Message}"),
+                },
+            });
+        }
+    }
+
     /// <summary>
     /// PREVIEW_ONLY job: rebuild the shot around the rendered EXRs with slate
     /// and burn-ins, render the delivery MOV + review MP4, upload the review
@@ -185,8 +421,15 @@ public sealed class JobExecutor
                 return; // temp AEP is deliberately kept for debugging
             }
 
+            // From here on aerender is done and the app would keep showing its
+            // last frame line; this reports what the worker is doing instead,
+            // and renews the lease through the encode and uploads.
+            await using var status = new LeaseKeepAlive(_api, job.Id, machineId, TimeSpan.FromSeconds(10), shutdown);
+            status.Line($"Preview rendered in {result.Seconds:F0}s — uploading review media");
+
             var previewKey = await _api.UploadArtifactAsync(
-                job.Id, machineId, "preview", result.Mp4Path!, "video/mp4", shutdown);
+                job.Id, machineId, "preview", result.Mp4Path!, "video/mp4", shutdown,
+                status.Track("preview MP4", result.Mp4Path!));
             if (previewKey is null)
             {
                 // The renders are on the SAN and fine — only the upload failed,
@@ -200,6 +443,7 @@ public sealed class JobExecutor
                 });
                 return;
             }
+            status.Line("Preview MP4 uploaded");
 
             string? thumbKey = null;
             if (result.ThumbnailPath is not null)
@@ -208,6 +452,30 @@ public sealed class JobExecutor
                     job.Id, machineId, "thumbnail", result.ThumbnailPath, "image/jpeg", shutdown);
             }
 
+            // High quality MP4 + the MOV as the version's High Res download
+            // (§9.6). Both optional: a failure here costs the extras, never the
+            // preview, which is already safely uploaded. The MOV is uploaded in
+            // the background after finalize (HighResUploader) — it is the big
+            // one and used to hold the job open for many minutes.
+            string? hqKey = null;
+            var highResPending = false;
+            if (manifest.HighQuality)
+            {
+                status.Line("Encoding High quality MP4");
+                var hqPath = await _preview.TryMakeHighQualityAsync(job.Id, result.MovPath!, result.Mp4Path!, shutdown);
+                if (hqPath is not null)
+                {
+                    hqKey = await _api.UploadArtifactAsync(job.Id, machineId, "preview", hqPath, "video/mp4", shutdown,
+                        status.Track("High quality MP4", hqPath));
+                    if (hqKey is null) _log.LogWarning("High quality MP4 upload failed for job {JobId}", job.Id);
+                    status.Line(hqKey is null ? "High quality MP4 upload FAILED (see worker log)" : "High quality MP4 uploaded");
+                }
+
+                highResPending = result.MovPath is not null && File.Exists(result.MovPath);
+                if (highResPending)
+                    status.Line("ProRes MOV queued for background upload — completing the job now");
+            }
+
             _spooler.Enqueue("finalize", job.Id, new Dictionary<string, object?>
             {
                 ["machineId"] = machineId,
@@ -216,6 +484,8 @@ public sealed class JobExecutor
                     ["deliveryMovPath"] = manifest.MovOutput,
                     ["previewMovKey"] = previewKey,
                     ["thumbnailKey"] = thumbKey,
+                    ["hqPreviewKey"] = hqKey,
+                    ["highResPending"] = highResPending,
                 },
                 ["renderStats"] = new Dictionary<string, object?>
                 {
@@ -228,9 +498,16 @@ public sealed class JobExecutor
                     ["frameCount"] = result.Build?.FrameCount,
                     ["fps"] = manifest.Fps,
                     ["fileName"] = Path.GetFileName(result.Mp4Path!),
+                    // Slate length, so the review player can place the handle
+                    // markers exactly instead of inferring it (server ≥ 2026-09-22).
+                    ["pictureStartSeconds"] = result.Build?.PictureStartSeconds,
                 },
             });
 
+            // Enqueued after finalize: its attach report must reach the spooler
+            // behind finalize, which creates the version it attaches to.
+            if (highResPending) _highRes.Enqueue(job.Id, machineId, result.MovPath!);
+
             // Only clean up once the outputs are safely reported.
             CleanScratch(job.Id, result.TempAep);
         }
@@ -258,6 +535,12 @@ public sealed class JobExecutor
         PreviewStage.TryDelete(Path.Combine(WorkerOptions.ScratchDir, $"job_{jobId}_run.jsx"));
         PreviewStage.TryDelete(Path.Combine(WorkerOptions.ScratchDir, $"job_{jobId}_thumb.jpg"));
         if (tempAep is not null) PreviewStage.TryDelete(tempAep);
+        try
+        {
+            var hqDir = PreviewStage.HighQualityDir(jobId);
+            if (Directory.Exists(hqDir)) Directory.Delete(hqDir, recursive: true);
+        }
+        catch { /* scratch only */ }
     }
 
     /// <summary>

RenderWorker/VFXReviewWorker/LeaseKeepAlive.cs

@@ -0,0 +1,103 @@
+using System.Diagnostics;
+using System.Text;
+
+namespace VFXReviewWorker;
+
+/// <summary>
+/// Renews a job's lease with progress reports while the worker does something
+/// long that reports nothing on its own — the High quality encode and the
+/// uploads can each outlast a 300 s lease, and an expired lease lets the
+/// reaper hand the job to another machine mid-upload.
+///
+/// Each report also replaces the job's log tail with what the worker is doing
+/// now ("Uploading High quality MP4: 12.0 / 34.0 MB…"). Without it the app
+/// keeps showing aerender's last frame line and a busy job looks hung.
+/// </summary>
+internal sealed class LeaseKeepAlive : IAsyncDisposable
+{
+    private readonly ApiClient _api;
+    private readonly string _jobId;
+    private readonly string _machineId;
+    private readonly CancellationTokenSource _cts;
+    private readonly SemaphoreSlim _wake = new(0);
+    private readonly Task _loop;
+    private readonly object _lock = new();
+    private readonly List<string> _lines = new();
+    private string? _current;
+
+    public LeaseKeepAlive(ApiClient api, string jobId, string machineId, TimeSpan interval, CancellationToken shutdown)
+    {
+        _api = api;
+        _jobId = jobId;
+        _machineId = machineId;
+        _cts = CancellationTokenSource.CreateLinkedTokenSource(shutdown);
+        var token = _cts.Token;
+        _loop = Task.Run(async () =>
+        {
+            try
+            {
+                while (!token.IsCancellationRequested)
+                {
+                    // Best-effort by contract (ApiClient.ProgressAsync never throws
+                    // on transport errors); progress stays at 1.0 — the render is done.
+                    await _api.ProgressAsync(_jobId, _machineId, 1.0, null, null, null, Render(), token);
+                    await _wake.WaitAsync(interval, token);
+                }
+            }
+            catch (OperationCanceledException)
+            {
+                // stopped
+            }
+        });
+    }
+
+    /// <summary>Adds a finished step to the status shown in the app.</summary>
+    public void Line(string text)
+    {
+        lock (_lock)
+        {
+            _current = null;
+            _lines.Add($"{DateTime.Now:HH:mm:ss} {text}");
+        }
+        _wake.Release();
+    }
+
+    /// <summary>
+    /// Progress callback for <see cref="ApiClient.UploadArtifactAsync"/>: keeps
+    /// one live line ("Uploading X: 12.0 / 34.0 MB (35%, 2.1 MB/s)") up to date.
+    /// </summary>
+    public Action<long> Track(string label, string filePath)
+    {
+        long total = File.Exists(filePath) ? new FileInfo(filePath).Length : 0;
+        var sw = Stopwatch.StartNew();
+        lock (_lock) _current = $"Uploading {label}: 0.0 / {Mb(total)} MB";
+        _wake.Release();
+        return sent =>
+        {
+            var pct = total > 0 ? 100.0 * sent / total : 0;
+            var speed = sent / 1048576.0 / Math.Max(0.001, sw.Elapsed.TotalSeconds);
+            lock (_lock) _current = $"Uploading {label}: {Mb(sent)} / {Mb(total)} MB ({pct:F0}%, {speed:F1} MB/s)";
+        };
+    }
+
+    private static string Mb(long bytes) => (bytes / 1048576.0).ToString("F1");
+
+    private string Render()
+    {
+        lock (_lock)
+        {
+            var sb = new StringBuilder();
+            foreach (var l in _lines) sb.AppendLine(l);
+            if (_current is not null) sb.AppendLine($"{DateTime.Now:HH:mm:ss} {_current}");
+            return sb.ToString();
+        }
+    }
+
+    public async ValueTask DisposeAsync()
+    {
+        _cts.Cancel();
+        try { await _loop; } catch { /* already reported */ }
+        _cts.Dispose();
+        _wake.Dispose();
+    }
+}

RenderWorker/VFXReviewWorker/Preflight.cs

@@ -31,12 +31,18 @@ public static class Preflight
             return 1;
         }
 
+        Console.WriteLine($"  worker version : {options.WorkerVersion}");
         Console.WriteLine($"  machine name   : {options.MachineName}");
         Console.WriteLine($"  server         : {options.ServerUrl}");
         Console.WriteLine($"  api key        : {(string.IsNullOrWhiteSpace(options.ApiKey) ? "(missing)" : "set")}");
         Console.WriteLine();
 
         ok &= Report("aerender.exe", options.AerenderPath, File.Exists(options.AerenderPath));
+        // Not required: a machine without Blender simply never claims Blender
+        // jobs, so this reports rather than fails.
+        Report("blender.exe", options.BlenderPath ?? "(not configured)",
+            !string.IsNullOrWhiteSpace(options.BlenderPath) && File.Exists(options.BlenderPath),
+            "needed only for Blender render jobs");
         var afterFx = options.ResolveAfterFxPath();
         ok &= Report("AfterFX.com", afterFx, File.Exists(afterFx),
             "needed for preview builds only");

RenderWorker/VFXReviewWorker/PreviewStage.cs

@@ -179,7 +179,7 @@ public sealed class PreviewStage
                 null, null, null, build.TempAep, build, sw.Elapsed.TotalSeconds);
         }
 
-        var thumbnail = await TryMakeThumbnailAsync(job.Id, mp4Local, shutdown);
+        var thumbnail = await TryMakeThumbnailAsync(job.Id, mp4Local, build, manifest.Fps, shutdown);
 
         sw.Stop();
         _log.LogInformation("Preview complete for job {JobId} in {Sec:F0}s (mov + mp4{Thumb})",
@@ -231,14 +231,197 @@ public sealed class PreviewStage
         return process.ExitCode;
     }
 
-    /// <summary>Optional 960-wide poster frame at 25% duration (§9.1). Never fatal.</summary>
+    /// <summary>
-    private async Task<string?> TryMakeThumbnailAsync(string jobId, string mp4Path, CancellationToken ct)
+    /// Optional 960-wide poster frame at 25% of <em>picture</em> duration
+    /// (§9.1). Never fatal.
+    /// </summary>
+    /// <remarks>
+    /// The preview MP4 opens on the Netflix slate, so the frame has to be taken
+    /// relative to picture rather than to the file. This previously used
+    /// ffmpeg's <c>thumbnail</c> filter, which considers only the first 100
+    /// frames — on a slated preview that is the slate card, which is what every
+    /// thumbnail in the system was until now. Seeking to
+    /// <c>pictureStart + 25%</c> matches what §9.1 always documented and is what
+    /// makes these frames usable as shot thumbnails.
+    ///
+    /// A build that reports no picture start (older worker, or a template with
+    /// no SHOT layer) keeps the old whole-file behaviour rather than guessing.
+    /// </remarks>
+    private async Task<string?> TryMakeThumbnailAsync(
+        string jobId, string mp4Path, PreviewBuildResult? build, double fps, CancellationToken ct)
+    {
+        if (string.IsNullOrWhiteSpace(_options.FfmpegPath))
+        {
+            _log.LogWarning(
+                "No thumbnail for job {JobId}: ffmpegPath is not set in config.json. " +
+                "Thumbnails are skipped, and shots cannot take a frame from this render.",
+                jobId);
+            return null;
+        }
+        if (!File.Exists(_options.FfmpegPath))
+        {
+            _log.LogWarning(
+                "No thumbnail for job {JobId}: ffmpegPath points at {Path}, which does not exist.",
+                jobId, _options.FfmpegPath);
+            return null;
+        }
+
+        var outPath = Path.Combine(WorkerOptions.ScratchDir, $"job_{jobId}_thumb.jpg");
+        var seek = ThumbnailSeekSeconds(build, fps);
+
+        if (seek is { } t)
+        {
+            _log.LogInformation(
+                "Thumbnail for job {JobId}: seeking to {Seek:F2}s (slate {Start:F2}s + 25% of {Frames} frames @ {Fps}fps)",
+                jobId, t, build!.PictureStartSeconds, build.FrameCount, fps);
+
+            var attempt = await RunFfmpegThumbnailAsync(jobId, mp4Path, outPath, t, ct);
+            if (attempt == ThumbAttempt.Wrote) return outPath;
+            // A hung or unstartable ffmpeg will hang the same way a second
+            // time, and each attempt costs the full two-minute cap.
+            if (attempt == ThumbAttempt.Broken) return null;
+
+            // The seek is derived from what the AE build reported; if those
+            // numbers disagree with the rendered file, ffmpeg lands past the
+            // end and writes nothing. Falling back to the whole-file scan means
+            // a wrong seek costs picture content, never the thumbnail itself.
+            _log.LogWarning(
+                "Thumbnail seek to {Seek:F2}s produced nothing for job {JobId} — retrying across the whole file. " +
+                "The frame will likely be the slate.", t, jobId);
+        }
+        else
+        {
+            _log.LogInformation(
+                "Thumbnail for job {JobId}: build reported no picture start, scanning the whole file " +
+                "(the frame will likely be the slate).", jobId);
+        }
+
+        if (await RunFfmpegThumbnailAsync(jobId, mp4Path, outPath, null, ct) == ThumbAttempt.Wrote) return outPath;
+
+        _log.LogWarning("No thumbnail produced for job {JobId} — see the ffmpeg output above.", jobId);
+        return null;
+    }
+
+    /// <summary>Scratch folder for a job's High quality encode.</summary>
+    internal static string HighQualityDir(string jobId) =>
+        Path.Combine(WorkerOptions.ScratchDir, $"job_{jobId}_hq");
+
+    /// <summary>
+    /// High quality review MP4 (§9.6): the delivery MOV re-encoded as
+    /// full-resolution, high-bitrate H.264 High — the player's "High" quality.
+    /// ProRes itself only plays in Safari on a Mac, so the MOV is offered as a
+    /// download and this is what streams. Never fatal: without it the version
+    /// simply has Standard quality only.
+    /// </summary>
+    public async Task<string?> TryMakeHighQualityAsync(
+        string jobId, string movPath, string mp4Path, CancellationToken ct)
     {
         if (string.IsNullOrWhiteSpace(_options.FfmpegPath) || !File.Exists(_options.FfmpegPath))
         {
+            _log.LogWarning("No High quality MP4 for job {JobId}: ffmpegPath is not set or missing.", jobId);
             return null;
         }
-        var outPath = Path.Combine(WorkerOptions.ScratchDir, $"job_{jobId}_thumb.jpg");
+        if (!File.Exists(movPath))
+        {
+            _log.LogWarning("No High quality MP4 for job {JobId}: MOV not found at {Path}.", jobId, movPath);
+            return null;
+        }
+
+        var dir = HighQualityDir(jobId);
+        Directory.CreateDirectory(dir);
+        // Named after the review MP4 so the stored object reads as its sibling.
+        var outPath = Path.Combine(dir, Path.GetFileNameWithoutExtension(mp4Path) + "_HQ.mp4");
+        TryDelete(outPath);
+
+        var args = new List<string>
+        {
+            "-y", "-i", movPath,
+            "-map", "0:v:0", "-map", "0:a?",
+            // Visually lossless for review, capped so a busy shot can't balloon
+            // past what a good connection streams. yuv420p 8-bit High profile
+            // is the combination every browser decodes.
+            "-c:v", "libx264", "-profile:v", "high", "-preset", "medium", "-crf", "14",
+            "-maxrate", "100M", "-bufsize", "200M", "-pix_fmt", "yuv420p",
+            "-c:a", "aac", "-b:a", "256k",
+            // Index at the front so the player can start before it's all loaded
+            "-movflags", "+faststart",
+            outPath,
+        };
+        var psi = new ProcessStartInfo
+        {
+            FileName = _options.FfmpegPath,
+            RedirectStandardOutput = true,
+            RedirectStandardError = true,
+            UseShellExecute = false,
+            CreateNoWindow = true,
+        };
+        foreach (var a in args) psi.ArgumentList.Add(a);
+
+        var sw = Stopwatch.StartNew();
+        try
+        {
+            using var process = Process.Start(psi);
+            if (process is null)
+            {
+                _log.LogWarning("Could not start ffmpeg for the High quality MP4 (job {JobId})", jobId);
+                return null;
+            }
+            // Drain both pipes (see RunFfmpegThumbnailAsync — an unread pipe deadlocks ffmpeg).
+            var stderrTask = process.StandardError.ReadToEndAsync();
+            var stdoutTask = process.StandardOutput.ReadToEndAsync();
+            using var timeout = CancellationTokenSource.CreateLinkedTokenSource(ct);
+            timeout.CancelAfter(TimeSpan.FromMinutes(30));
+            try
+            {
+                await process.WaitForExitAsync(timeout.Token);
+            }
+            catch (OperationCanceledException)
+            {
+                _log.LogWarning("High quality encode for job {JobId} timed out or was cancelled — killing ffmpeg", jobId);
+                try { process.Kill(entireProcessTree: true); } catch { }
+                TryDelete(outPath);
+                return null;
+            }
+            var stderr = await stderrTask;
+            await stdoutTask;
+
+            if (process.ExitCode == 0 && File.Exists(outPath) && new FileInfo(outPath).Length > 0)
+            {
+                _log.LogInformation("High quality MP4 for job {JobId} encoded in {Sec:F0}s ({MB:F0} MB)",
+                    jobId, sw.Elapsed.TotalSeconds, new FileInfo(outPath).Length / 1e6);
+                return outPath;
+            }
+            _log.LogWarning("High quality encode failed for job {JobId} (exit {Exit}): {Stderr}",
+                jobId, process.ExitCode, Tail(stderr, 1200));
+            TryDelete(outPath);
+            return null;
+        }
+        catch (Exception ex)
+        {
+            _log.LogWarning(ex, "High quality encode failed for job {JobId} (non-fatal)", jobId);
+            return null;
+        }
+    }
+
+    /// <summary>How one ffmpeg attempt ended.</summary>
+    private enum ThumbAttempt
+    {
+        /// <summary>A thumbnail was written.</summary>
+        Wrote,
+        /// <summary>ffmpeg ran and wrote nothing — a different attempt may work.</summary>
+        NoOutput,
+        /// <summary>ffmpeg hung or could not start — retrying costs minutes and fixes nothing.</summary>
+        Broken,
+    }
+
+    /// <summary>
+    /// One ffmpeg invocation. <paramref name="seekSeconds"/> null means the old
+    /// whole-file <c>thumbnail</c> filter. Logs ffmpeg's own diagnosis when no
+    /// file is produced.
+    /// </summary>
+    private async Task<ThumbAttempt> RunFfmpegThumbnailAsync(
+        string jobId, string mp4Path, string outPath, double? seekSeconds, CancellationToken ct)
+    {
         TryDelete(outPath);
 
         var psi = new ProcessStartInfo
@@ -249,27 +432,102 @@ public sealed class PreviewStage
             UseShellExecute = false,
             CreateNoWindow = true,
         };
-        foreach (var a in new[] { "-y", "-i", mp4Path, "-vf", "thumbnail,scale=960:-1", "-frames:v", "1", outPath })
+
+        var args = new List<string> { "-y" };
+        if (seekSeconds is { } t)
         {
-            psi.ArgumentList.Add(a);
+            // Before -i: ffmpeg seeks by keyframe, which is fast and accurate
+            // enough for a poster frame.
+            args.Add("-ss");
+            args.Add(t.ToString("0.###", System.Globalization.CultureInfo.InvariantCulture));
+            args.Add("-i");
+            args.Add(mp4Path);
+            args.Add("-vf");
+            args.Add("scale=960:-1");
         }
+        else
+        {
+            args.Add("-i");
+            args.Add(mp4Path);
+            args.Add("-vf");
+            args.Add("thumbnail,scale=960:-1");
+        }
+        args.Add("-frames:v");
+        args.Add("1");
+        args.Add(outPath);
+
+        foreach (var a in args) psi.ArgumentList.Add(a);
 
         try
         {
             using var process = Process.Start(psi);
-            if (process is null) return null;
+            if (process is null)
+            {
+                _log.LogWarning("Could not start ffmpeg at {Path} for job {JobId}", _options.FfmpegPath, jobId);
+                return ThumbAttempt.Broken;
+            }
+
+            // Drain BOTH pipes while the process runs. Windows gives an
+            // anonymous pipe a ~4 KB buffer; ffmpeg's banner and stream summary
+            // exceed that on their own, so a redirected-but-unread pipe fills,
+            // ffmpeg blocks forever on the write, and the wait below times out
+            // with the process still alive. That is a deadlock, not a slow
+            // encode, and it is why this step failed with nothing but a
+            // cancellation to show for it.
+            var stderrTask = process.StandardError.ReadToEndAsync();
+            var stdoutTask = process.StandardOutput.ReadToEndAsync();
             using var timeout = CancellationTokenSource.CreateLinkedTokenSource(ct);
             timeout.CancelAfter(TimeSpan.FromMinutes(2));
+            try
+            {
                 await process.WaitForExitAsync(timeout.Token);
-            return File.Exists(outPath) ? outPath : null;
+            }
+            catch (OperationCanceledException) when (!ct.IsCancellationRequested)
+            {
+                // Our own 2-minute cap, not a shutdown: leaving ffmpeg running
+                // would hold the scratch file open and leak a process per job.
+                _log.LogWarning(
+                    "ffmpeg timed out after 2 minutes for job {JobId} — killing it. Command: {Args}",
+                    jobId, string.Join(" ", args));
+                try { process.Kill(entireProcessTree: true); } catch { }
+                return ThumbAttempt.Broken;
+            }
+            var stderr = await stderrTask;
+            await stdoutTask;
+
+            if (File.Exists(outPath) && new FileInfo(outPath).Length > 0) return ThumbAttempt.Wrote;
+
+            _log.LogWarning(
+                "ffmpeg wrote no thumbnail for job {JobId} (exit {Exit}). Command: {Args} -- ffmpeg said: {Stderr}",
+                jobId, process.ExitCode, string.Join(" ", args), Tail(stderr, 1200));
+            return ThumbAttempt.NoOutput;
         }
         catch (Exception ex)
         {
-            _log.LogWarning(ex, "Thumbnail generation failed (non-fatal)");
+            _log.LogWarning(ex, "Thumbnail generation failed for job {JobId} (non-fatal)", jobId);
-            return null;
+            return ThumbAttempt.Broken;
         }
     }
 
+    /// <summary>Last <paramref name="max"/> characters — ffmpeg puts the error at the end.</summary>
+    private static string Tail(string? text, int max) =>
+        string.IsNullOrEmpty(text) ? "(no output)"
+        : text.Length <= max ? text
+        : text[^max..];
+
+    /// <summary>
+    /// Timestamp for the poster frame: a quarter of the way into picture,
+    /// skipping the slate. Null when the build did not report where picture
+    /// starts, or when the numbers do not describe a real clip.
+    /// </summary>
+    internal static double? ThumbnailSeekSeconds(PreviewBuildResult? build, double fps)
+    {
+        if (build?.PictureStartSeconds is not { } start || start < 0) return null;
+        if (build.FrameCount is not { } frames || frames <= 0) return null;
+        if (fps <= 0) return null;
+        return start + (frames / fps) * 0.25;
+    }
+
     private static PreviewStageResult Fail(string message, bool retryable, Stopwatch sw, PreviewBuildResult? build = null)
     {
         sw.Stop();

RenderWorker/VFXReviewWorker/Program.cs

@@ -10,6 +10,13 @@ using VFXReviewWorker;
 // Run interactively for debugging:  VFXReviewWorker.exe [path\to\config.json]
 // Install as a service:             see RenderWorker/README.md
 
+// Dry-run the validation engine over an existing render folder. No server, no
+// config, no queue — useful for checking work that predates the pipeline.
+if (args.Any(a => a.Equals("--validate", StringComparison.OrdinalIgnoreCase)))
+{
+    return ValidateCommand.Run(args);
+}
+
 var configPath = args.FirstOrDefault(a => !a.StartsWith('-'));
 
 // Install verification on a new machine — resolves paths, checks tools and
@@ -30,8 +37,12 @@ builder.Logging.AddProvider(new FileLoggerProvider());
 builder.Services.AddSingleton(options);
 builder.Services.AddSingleton<ApiClient>();
 builder.Services.AddSingleton<ReportSpooler>();
+builder.Services.AddSingleton<HighResUploader>();
 builder.Services.AddSingleton<AerenderRunner>();
 builder.Services.AddSingleton<PreviewStage>();
+builder.Services.AddSingleton<ValidationStage>();
+builder.Services.AddSingleton<DeliveryStage>();
+builder.Services.AddSingleton<BlenderRunner>();
 builder.Services.AddSingleton<JobExecutor>();
 builder.Services.AddHostedService<WorkerService>();
 

RenderWorker/VFXReviewWorker/ProgressStreamContent.cs

@@ -0,0 +1,42 @@
+using System.Net;
+
+namespace VFXReviewWorker;
+
+/// <summary>
+/// StreamContent that reports bytes sent, so a long upload can show progress.
+/// Length is computed from the stream, so the PUT still carries Content-Length
+/// (presigned S3 uploads reject chunked bodies).
+/// </summary>
+internal sealed class ProgressStreamContent : HttpContent
+{
+    private readonly Stream _source;
+    private readonly Action<long>? _onProgress;
+
+    public ProgressStreamContent(Stream source, Action<long>? onProgress)
+    {
+        _source = source;
+        _onProgress = onProgress;
+    }
+
+    protected override Task SerializeToStreamAsync(Stream stream, TransportContext? context) =>
+        SerializeToStreamAsync(stream, context, CancellationToken.None);
+
+    protected override async Task SerializeToStreamAsync(Stream stream, TransportContext? context, CancellationToken ct)
+    {
+        var buffer = new byte[81920];
+        long sent = 0;
+        int read;
+        while ((read = await _source.ReadAsync(buffer, ct)) > 0)
+        {
+            await stream.WriteAsync(buffer.AsMemory(0, read), ct);
+            sent += read;
+            _onProgress?.Invoke(sent);
+        }
+    }
+
+    protected override bool TryComputeLength(out long length)
+    {
+        length = _source.Length;
+        return true;
+    }
+}

RenderWorker/VFXReviewWorker/ReportSpooler.cs

@@ -9,6 +9,11 @@ namespace VFXReviewWorker;
 /// order with exponential backoff (1 s → 60 s). Rendering continues during
 /// server downtime; a report is deleted only once the server accepts it (or
 /// permanently rejects it as contradictory).
+///
+/// Strict ordering is load-bearing beyond durability: the validation report
+/// (E12) is only legal once complete-render (E11) has moved the Export to
+/// VALIDATING, and in-order replay is what guarantees that, with no need for
+/// the worker to wait on an ACK.
 /// </summary>
 public sealed class ReportSpooler
 {

RenderWorker/VFXReviewWorker/VFXReviewWorker.csproj

@@ -8,6 +8,14 @@
     <AssemblyName>VFXReviewWorker</AssemblyName>
     <!-- Single self-contained exe for render nodes: dotnet publish -r win-x64 (see README) -->
     <InvariantGlobalization>true</InvariantGlobalization>
+    <!--
+      The version is a property of the build, not of the machine it lands on:
+      it is stamped here and read back from the assembly at runtime, so a
+      workstation cannot report a version it is not actually running. Bump on
+      every change that gets published. publish.ps1 appends the git SHA via
+      SourceRevisionId, giving "1.1.0+feb1c7b".
+    -->
+    <Version>1.7.2</Version>
   </PropertyGroup>
 
   <ItemGroup>
@@ -20,9 +28,16 @@
   </ItemGroup>
 
   <ItemGroup>
-    <!-- Headless AE build script ships beside the exe -->
+    <!--
+      Headless AE build script ships beside the exe. CopyToPublishDirectory is
+      set explicitly: CopyToOutputDirectory alone governs the build folder, and
+      an incremental publish then leaves the script out of a freshly-cleaned
+      publish directory. publish.ps1 copies it again and verifies, because the
+      exe cannot run a preview job without it.
+    -->
     <Content Include="..\scripts\vfxr_build_preview.jsx" Link="scripts\vfxr_build_preview.jsx">
       <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
+      <CopyToPublishDirectory>Always</CopyToPublishDirectory>
     </Content>
   </ItemGroup>
 

RenderWorker/VFXReviewWorker/ValidateCommand.cs

@@ -0,0 +1,98 @@
+using Microsoft.Extensions.Logging.Abstractions;
+
+namespace VFXReviewWorker;
+
+/// <summary>
+/// `VFXReviewWorker.exe --validate &lt;renderDir&gt; [--plate &lt;plateFile&gt;] [--fps 24]`
+///
+/// Runs the validation engine (§8) over a folder of already-rendered EXRs and
+/// prints the report, without a server, a job or a queue. Two uses: proving the
+/// checks against real work before the stage goes live, and answering "is this
+/// delivery good?" for a sequence that predates the pipeline.
+/// </summary>
+public static class ValidateCommand
+{
+    public static int Run(string[] args)
+    {
+        var dir = args.SkipWhile(a => !a.Equals("--validate", StringComparison.OrdinalIgnoreCase)).Skip(1).FirstOrDefault();
+        if (string.IsNullOrWhiteSpace(dir) || dir.StartsWith('-'))
+        {
+            Console.Error.WriteLine("Usage: VFXReviewWorker.exe --validate <renderDir> [--plate <plateFirstFrame.exr>] [--fps 24] [--sample 25]");
+            return 2;
+        }
+        if (!Directory.Exists(dir))
+        {
+            Console.Error.WriteLine($"Not a directory: {dir}");
+            return 2;
+        }
+
+        var plate = ArgValue(args, "--plate");
+        var fps = double.TryParse(ArgValue(args, "--fps"), out var f) ? f : 24;
+        var sample = int.TryParse(ArgValue(args, "--sample"), out var s) ? s : 25;
+
+        var files = Directory.EnumerateFiles(dir, "*.exr").OrderBy(x => x, StringComparer.Ordinal).ToList();
+        if (files.Count == 0)
+        {
+            Console.Error.WriteLine($"No .exr files in {dir}");
+            return 2;
+        }
+
+        // Infer what the manifest would have said from the files themselves.
+        var firstName = Path.GetFileName(files[0]);
+        var frames = files.Select(x => SequencePattern.FrameFromName(Path.GetFileName(x))).Where(x => x is not null).Select(x => x!.Value).ToList();
+        var prefix = firstName.Contains('.') ? firstName[..firstName.IndexOf('.')] : Path.GetFileNameWithoutExtension(firstName);
+        var header = ExrHeader.TryRead(files[0]);
+
+        var manifest = new RenderManifest
+        {
+            ShotCode = prefix.Split("_cmp_")[0],
+            OutputDir = dir,
+            OutputPattern = $"{prefix}.[#####].exr",
+            FrameStart = frames.Count > 0 ? frames.Min() : 1,
+            FrameEnd = frames.Count > 0 ? frames.Max() : files.Count,
+            Fps = fps,
+            Width = header?.DataWidth ?? 0,
+            Height = header?.DataHeight ?? 0,
+            Source = plate is null ? null : new ManifestSource
+            {
+                TimingPlate = new PlateRef { Path = plate, FrameStart = SequencePattern.FrameFromName(Path.GetFileName(plate)) },
+                StartSource = "supplied on the command line",
+            },
+        };
+
+        var options = new WorkerOptions { ServerUrl = "n/a", ApiKey = "n/a" };
+        var stage = new ValidationStage(options, NullLogger<ValidationStage>.Instance);
+        var outcome = stage.Run(manifest, dir, new ServerConfig { ValidationSampleEvery = sample });
+
+        Console.WriteLine();
+        Console.WriteLine($"{files.Count} files in {dir}");
+        Console.WriteLine($"inferred range {manifest.FrameStart}-{manifest.FrameEnd} at {fps} fps, pattern {manifest.OutputPattern}");
+        if (plate is not null) Console.WriteLine($"timing plate {plate}");
+        Console.WriteLine();
+
+        foreach (var c in outcome.Checks)
+        {
+            var mark = c.Status switch { "PASS" => "  ok  ", "FAIL" => " FAIL ", "WARN" => " warn ", _ => " skip " };
+            Console.WriteLine($"[{mark}] {c.CheckName,-24} {Describe(c)}");
+        }
+
+        Console.WriteLine();
+        Console.WriteLine($"checksum (xxh64): {outcome.Checksum ?? "(not computed)"}");
+        var failed = outcome.Checks.Count(c => c.Status == "FAIL");
+        Console.WriteLine(failed == 0 ? "PASSED" : $"FAILED — {failed} check(s)");
+        return failed == 0 ? 0 : 1;
+    }
+
+    private static string Describe(ValidationCheck c)
+    {
+        if (!string.IsNullOrWhiteSpace(c.Message)) return c.Message!;
+        if (c.Expected is null && c.Actual is null) return "";
+        return c.Expected == c.Actual ? c.Actual ?? "" : $"expected {c.Expected}, got {c.Actual}";
+    }
+
+    private static string? ArgValue(string[] args, string name)
+    {
+        var i = Array.FindIndex(args, a => a.Equals(name, StringComparison.OrdinalIgnoreCase));
+        return i >= 0 && i + 1 < args.Length ? args[i + 1] : null;
+    }
+}

RenderWorker/VFXReviewWorker/ValidationStage.cs

@@ -0,0 +1,751 @@
+using System.Text.RegularExpressions;
+using Microsoft.Extensions.Logging;
+
+namespace VFXReviewWorker;
+
+/// <summary>
+/// Validation engine (RenderPipeline2 §8). Runs on the worker straight after a
+/// successful render, while it still holds the job and the files are local.
+/// It only ever *reports* — the server decides what the results mean.
+///
+/// Full-sequence checks (count, gaps, names, sizes) touch every file; header
+/// checks sample first/middle/last plus every Nth frame.
+/// </summary>
+public sealed class ValidationStage
+{
+    private readonly WorkerOptions _options;
+    private readonly ILogger<ValidationStage> _log;
+
+    public ValidationStage(WorkerOptions options, ILogger<ValidationStage> log)
+    {
+        _options = options;
+        _log = log;
+    }
+
+    public ValidationOutcome Run(RenderManifest manifest, string outputDirLocal, ServerConfig config)
+    {
+        var checks = new List<ValidationCheck>();
+        var files = EnumerateSequence(manifest, outputDirLocal, checks, out var frameNumbers, out var totalBytes);
+
+        if (files.Count == 0)
+        {
+            // Nothing to inspect: the sequence checks already recorded the FAIL.
+            return new ValidationOutcome(checks, 0, 0, null);
+        }
+
+        var sampleEvery = Math.Max(1, config.ValidationSampleEvery);
+        var sampled = PickSamples(files, sampleEvery);
+        var headers = ReadHeaders(sampled, checks);
+
+        if (headers.Count > 0)
+        {
+            CheckResolution(manifest, headers, checks);
+            CheckBitDepthAndChannels(manifest, headers, checks);
+            CheckCompression(manifest, headers, checks);
+            CheckTimecode(manifest, headers, frameNumbers, config, checks);
+        }
+
+        var checksum = ComputeSequenceChecksum(files);
+        return new ValidationOutcome(checks, files.Count, totalBytes, checksum);
+    }
+
+    // ── Sequence-level checks ────────────────────────────────────────────────
+
+    private List<string> EnumerateSequence(
+        RenderManifest manifest, string outputDirLocal, List<ValidationCheck> checks,
+        out List<int> frameNumbers, out long totalBytes)
+    {
+        frameNumbers = new List<int>();
+        totalBytes = 0;
+        var expectedCount = manifest.TotalFrames;
+
+        if (!Directory.Exists(outputDirLocal))
+        {
+            checks.Add(ValidationCheck.Fail("file_count", expectedCount.ToString(), "0",
+                $"Output directory does not exist on this machine: {outputDirLocal}"));
+            return new List<string>();
+        }
+
+        var pattern = SequencePattern.FromOutputPattern(manifest.OutputPattern);
+        var matched = new List<(int Frame, string Path)>();
+        var nonConforming = new List<string>();
+
+        foreach (var path in Directory.EnumerateFiles(outputDirLocal))
+        {
+            var name = Path.GetFileName(path);
+            if (!name.EndsWith(pattern.Extension, StringComparison.OrdinalIgnoreCase)) continue;
+            // Only files belonging to this render: a version folder can also hold
+            // the preview MOV/MP4, which are not part of the EXR sequence.
+            if (!name.StartsWith(pattern.Prefix, StringComparison.OrdinalIgnoreCase)) continue;
+
+            var frame = pattern.FrameNumberOf(name);
+            if (frame is null) { nonConforming.Add(name); continue; }
+            matched.Add((frame.Value, path));
+        }
+
+        matched.Sort((a, b) => a.Frame.CompareTo(b.Frame));
+        var files = matched.Select(m => m.Path).ToList();
+        frameNumbers = matched.Select(m => m.Frame).ToList();
+
+        // file_count
+        checks.Add(files.Count == expectedCount
+            ? ValidationCheck.Pass("file_count", expectedCount.ToString(), files.Count.ToString())
+            : ValidationCheck.Fail("file_count", expectedCount.ToString(), files.Count.ToString(),
+                $"Expected {expectedCount} frames ({manifest.FrameStart}-{manifest.FrameEnd}), found {files.Count} in {outputDirLocal}"));
+
+        // filename_consistency
+        checks.Add(nonConforming.Count == 0
+            ? ValidationCheck.Pass("filename_consistency", pattern.Describe(), "all files match")
+            : ValidationCheck.Fail("filename_consistency", pattern.Describe(), $"{nonConforming.Count} nonconforming",
+                "Files not matching the output pattern: " + string.Join(", ", nonConforming.Take(10)),
+                new { files = nonConforming.Take(50) }));
+
+        if (files.Count == 0) return files;
+
+        // Output files are numbered by the output module's starting number
+        // (house convention: every sequence starts at 1001), which is a
+        // different coordinate system from the comp's frame range — a comp
+        // anchored to the plate's timecode starts at 1247792. Checking file
+        // numbers against comp frames compares the two and fails every render,
+        // so the sequence is checked for the right *count* and *contiguity*,
+        // and its absolute start only where the manifest states it.
+        var expectedFirst = manifest.OutputFrameStart;
+
+        var seen = new HashSet<int>();
+        var duplicates = new List<int>();
+        foreach (var f in frameNumbers)
+        {
+            if (!seen.Add(f)) duplicates.Add(f);
+        }
+
+        // Gaps are found relative to the run the render actually produced: a
+        // hole in the middle is a real defect regardless of where it starts.
+        var runStart = expectedFirst ?? frameNumbers[0];
+        var runEnd = runStart + expectedCount - 1;
+        var missing = new List<int>();
+        for (var f = runStart; f <= runEnd; f++)
+        {
+            if (!seen.Contains(f)) missing.Add(f);
+        }
+
+        checks.Add(missing.Count == 0
+            ? ValidationCheck.Pass("missing_frames", "none", "none")
+            : ValidationCheck.Fail("missing_frames", "none", $"{missing.Count} missing",
+                $"Missing frames in {runStart}-{runEnd}: " + Summarise(missing),
+                new { missing = missing.Take(500), runStart, runEnd }));
+
+        checks.Add(duplicates.Count == 0
+            ? ValidationCheck.Pass("duplicate_frames", "none", "none")
+            : ValidationCheck.Fail("duplicate_frames", "none", $"{duplicates.Count} duplicated",
+                "Duplicate frame numbers (differing padding?): " + Summarise(duplicates),
+                new { duplicates = duplicates.Take(100) }));
+
+        if (expectedFirst is int first)
+        {
+            checks.Add(frameNumbers[0] == first
+                ? ValidationCheck.Pass("first_frame", first.ToString(), frameNumbers[0].ToString())
+                : ValidationCheck.Fail("first_frame", first.ToString(), frameNumbers[0].ToString(),
+                    $"Sequence starts at {frameNumbers[0]}, expected {first}"));
+
+            var expectedLast = first + expectedCount - 1;
+            checks.Add(frameNumbers[^1] == expectedLast
+                ? ValidationCheck.Pass("last_frame", expectedLast.ToString(), frameNumbers[^1].ToString())
+                : ValidationCheck.Fail("last_frame", expectedLast.ToString(), frameNumbers[^1].ToString(),
+                    $"Sequence ends at {frameNumbers[^1]}, expected {expectedLast}"));
+        }
+        else
+        {
+            // Old manifests carry no output numbering; the count and contiguity
+            // checks above still hold, so the run is reported rather than
+            // measured against a number that was never sent.
+            checks.Add(ValidationCheck.Skipped("first_frame",
+                $"manifest carries no output frame numbering — sequence runs {frameNumbers[0]}-{frameNumbers[^1]}"));
+        }
+
+        // zero_byte — every file, it is only a directory stat
+        var zeroByte = new List<string>();
+        foreach (var path in files)
+        {
+            var len = new FileInfo(path).Length;
+            totalBytes += len;
+            if (len == 0) zeroByte.Add(Path.GetFileName(path));
+        }
+        checks.Add(zeroByte.Count == 0
+            ? ValidationCheck.Pass("zero_byte", "none", "none")
+            : ValidationCheck.Fail("zero_byte", "none", $"{zeroByte.Count} empty",
+                "Zero-byte files: " + string.Join(", ", zeroByte.Take(10)), new { files = zeroByte.Take(50) }));
+
+        return files;
+    }
+
+    // ── Header checks (sampled) ──────────────────────────────────────────────
+
+    private static List<string> PickSamples(List<string> files, int sampleEvery)
+    {
+        var picks = new SortedSet<int> { 0, files.Count / 2, files.Count - 1 };
+        for (var i = 0; i < files.Count; i += sampleEvery) picks.Add(i);
+        return picks.Where(i => i >= 0 && i < files.Count).Select(i => files[i]).ToList();
+    }
+
+    private List<(string Path, ExrHeader Header)> ReadHeaders(List<string> sampled, List<ValidationCheck> checks)
+    {
+        var headers = new List<(string, ExrHeader)>();
+        var unreadable = new List<string>();
+
+        foreach (var path in sampled)
+        {
+            try
+            {
+                headers.Add((path, ExrHeader.Read(path)));
+            }
+            catch (Exception ex)
+            {
+                unreadable.Add($"{Path.GetFileName(path)}: {ex.Message}");
+                _log.LogWarning("Unreadable EXR header: {Path} ({Error})", path, ex.Message);
+            }
+        }
+
+        checks.Add(unreadable.Count == 0
+            ? ValidationCheck.Pass("corrupt", "all sampled frames readable", $"{headers.Count} sampled")
+            : ValidationCheck.Fail("corrupt", "all sampled frames readable", $"{unreadable.Count} unreadable",
+                "Unreadable EXR headers: " + string.Join("; ", unreadable.Take(5)), new { files = unreadable.Take(50) }));
+
+        return headers;
+    }
+
+    private static void CheckResolution(RenderManifest m, List<(string Path, ExrHeader H)> headers, List<ValidationCheck> checks)
+    {
+        if (m.Width <= 0 || m.Height <= 0)
+        {
+            checks.Add(ValidationCheck.Skipped("resolution", "manifest carries no expected resolution"));
+            return;
+        }
+        var expected = $"{m.Width}x{m.Height}";
+        var bad = headers.Where(h => h.H.DataWidth != m.Width || h.H.DataHeight != m.Height).ToList();
+        checks.Add(bad.Count == 0
+            ? ValidationCheck.Pass("resolution", expected, expected)
+            : ValidationCheck.Fail("resolution", expected, $"{bad[0].H.DataWidth}x{bad[0].H.DataHeight}",
+                $"{bad.Count} of {headers.Count} sampled frames are not {expected} (first: {Path.GetFileName(bad[0].Path)})"));
+    }
+
+    private static void CheckBitDepthAndChannels(RenderManifest m, List<(string Path, ExrHeader H)> headers, List<ValidationCheck> checks)
+    {
+        var expectedDepth = m.Expected?.BitDepth;
+        var actualDepth = headers[0].H.BitDepth ?? "unknown";
+        if (string.IsNullOrWhiteSpace(expectedDepth))
+        {
+            checks.Add(ValidationCheck.Skipped("bit_depth", $"no expected bit depth configured (rendered {actualDepth})"));
+        }
+        else
+        {
+            var mismatched = headers.Where(h => !string.Equals(h.H.BitDepth, expectedDepth, StringComparison.OrdinalIgnoreCase)).ToList();
+            checks.Add(mismatched.Count == 0
+                ? ValidationCheck.Pass("bit_depth", expectedDepth, actualDepth)
+                : ValidationCheck.Fail("bit_depth", expectedDepth, mismatched[0].H.BitDepth ?? "unknown",
+                    $"{mismatched.Count} of {headers.Count} sampled frames are not {expectedDepth}"));
+        }
+
+        var hasAlpha = headers[0].H.HasAlpha;
+        var channelList = string.Join(",", headers[0].H.Channels.Select(c => c.Name));
+        if (m.Expected?.Alpha is null)
+        {
+            checks.Add(ValidationCheck.Skipped("alpha_channel", $"no expectation configured (channels: {channelList})"));
+        }
+        else
+        {
+            checks.Add(hasAlpha == m.Expected.Alpha.Value
+                ? ValidationCheck.Pass("alpha_channel", m.Expected.Alpha.Value ? "alpha present" : "no alpha", channelList)
+                : ValidationCheck.Fail("alpha_channel",
+                    m.Expected.Alpha.Value ? "alpha present" : "no alpha",
+                    hasAlpha ? "alpha present" : "no alpha",
+                    $"Channel list is {channelList}"));
+        }
+    }
+
+    private static void CheckCompression(RenderManifest m, List<(string Path, ExrHeader H)> headers, List<ValidationCheck> checks)
+    {
+        var actual = headers[0].H.CompressionName;
+        if (headers[0].H.CompressionCode is null)
+        {
+            checks.Add(ValidationCheck.Fail("exr_type", "readable EXR", "no compression attribute",
+                "Sampled frame has no compression attribute — not a valid EXR header"));
+            return;
+        }
+        var expected = m.Expected?.ExrCompression;
+        if (string.IsNullOrWhiteSpace(expected))
+        {
+            checks.Add(ValidationCheck.Pass("exr_type", "valid EXR", $"{actual}{(headers[0].H.IsTiled ? ", tiled" : ", scanline")}"));
+            return;
+        }
+        // Compression differing but readable is a WARN, never a stop (§8.1).
+        checks.Add(string.Equals(actual, expected, StringComparison.OrdinalIgnoreCase)
+            ? ValidationCheck.Pass("exr_type", expected, actual)
+            : ValidationCheck.Warn("exr_type", expected, actual,
+                $"Compression is {actual}, expected {expected} — readable, so not blocking"));
+    }
+
+    // ── Timecode: the primary check (§8.1a) ──────────────────────────────────
+
+    private void CheckTimecode(
+        RenderManifest m, List<(string Path, ExrHeader H)> headers, List<int> frameNumbers,
+        ServerConfig config, List<ValidationCheck> checks)
+    {
+        var fps = m.Fps > 0 ? m.Fps : 24;
+        var first = headers[0];
+
+        if (first.H.Timecode is null)
+        {
+            // AE's EXR output module writes timeCode; its absence means the
+            // output module changed, so this is a stop rather than a skip.
+            checks.Add(ValidationCheck.Fail("timecode_plate_match", "timecode present", "absent",
+                $"No timeCode attribute in {Path.GetFileName(first.Path)} — the EXR output module no longer writes timecode",
+                new { attributes = first.H.AttributeNames.Take(40) }));
+            return;
+        }
+
+        var renderTc = first.H.Timecode.Value;
+        var renderFirstFrame = frameNumbers.Count > 0 ? frameNumbers[0] : m.FrameStart;
+
+        // timecode_consistency — sampled frames must advance exactly one frame
+        // each. A constant value is the frame-derived-timecode defect.
+        var drift = new List<string>();
+        for (var i = 0; i < headers.Count; i++)
+        {
+            var h = headers[i].H;
+            if (h.Timecode is null) { drift.Add($"{Path.GetFileName(headers[i].Path)}: no timecode"); continue; }
+            var frameNo = SequencePattern.FrameFromName(Path.GetFileName(headers[i].Path)) ?? (renderFirstFrame + i);
+            var expectedTc = Timecode.FromFrames(renderTc.ToFrames(fps) + (frameNo - renderFirstFrame), fps);
+            if (h.Timecode.Value.ToFrames(fps) != expectedTc.ToFrames(fps))
+            {
+                drift.Add($"frame {frameNo}: {h.Timecode.Value} (expected {expectedTc})");
+            }
+        }
+        checks.Add(drift.Count == 0
+            ? ValidationCheck.Pass("timecode_consistency", "monotonic, 1 frame per frame", $"{headers.Count} frames sampled")
+            : ValidationCheck.Fail("timecode_consistency", "monotonic, 1 frame per frame", $"{drift.Count} sampled frames off",
+                "Timecode does not advance with the frames: " + string.Join("; ", drift.Take(5)),
+                new { drift = drift.Take(50) }));
+
+        // timecode_fps
+        if (first.H.FramesPerSecond is double headerFps)
+        {
+            checks.Add(Math.Abs(headerFps - fps) < 0.01
+                ? ValidationCheck.Pass("timecode_fps", fps.ToString("0.###"), headerFps.ToString("0.###"))
+                : ValidationCheck.Fail("timecode_fps", fps.ToString("0.###"), headerFps.ToString("0.###"),
+                    $"EXR framesPerSecond is {headerFps:0.###} but the comp rendered at {fps:0.###}"));
+        }
+        else
+        {
+            checks.Add(ValidationCheck.Skipped("timecode_fps", "no framesPerSecond attribute in the rendered EXRs"));
+        }
+
+        // timecode_plate_match — reference precedence, rank 1 → 3.
+        var reference = ResolveTimecodeReference(m, config, renderFirstFrame);
+        if (reference is null)
+        {
+            checks.Add(ValidationCheck.Warn("timecode_plate_match", "plate timecode", renderTc.ToString(),
+                "No plate reference available: the manifest carries no timing plate, none was found on disk, " +
+                "and no API timecode was supplied. Render timecode is unverified.",
+                new { renderTimecode = renderTc.ToString() }));
+            return;
+        }
+
+        var deltaOf = (TimecodeReference r) =>
+            renderTc.ToFrames(fps) - (r.PlateTimecode.ToFrames(fps) + (renderFirstFrame - r.PlateFirstFrame));
+
+        // A shot with several delivered elements: the panel names the longest
+        // as the timing plate, but the comp may have been anchored to another
+        // (BG01 and FG01 carry unrelated camera timecodes). When the timing
+        // plate disagrees, the manifest's other delivered plates are tried
+        // before failing. The comparison is unchanged — it is still a plate, so
+        // a match is a real PASS and no match still FAILs against the timing plate.
+        var timingPlate = reference;
+        var alternatesTried = new List<object>();
+        if (reference.Kind == "manifest" && deltaOf(reference) != 0)
+        {
+            foreach (var alternate in ResolveAlternatePlates(m, renderFirstFrame, reference))
+            {
+                var altDelta = deltaOf(alternate);
+                alternatesTried.Add(new { platePath = alternate.PlatePath, plateTimecode = alternate.PlateTimecode.ToString(), deltaFrames = altDelta });
+                if (altDelta == 0)
+                {
+                    reference = alternate;
+                    break;
+                }
+            }
+        }
+
+        // plate_fps — the render's rate against the plate's own.
+        //
+        // timecode_fps only compares the render to the manifest, and both come
+        // from the comp: a shot built at the wrong rate agrees with itself and
+        // passes. The plate is the independent witness. A 25 fps show whose
+        // shot records defaulted to 24 renders every shot at 24, and this is
+        // what names that rather than leaving it to surface as an off-by-N
+        // timecode error.
+        if (reference.PlateFps is double plateFps && first.H.FramesPerSecond is double renderFps)
+        {
+            var ratio = renderFps > 0 ? plateFps / renderFps : 0;
+            var overcrank = ratio > 1.5 && Math.Abs(ratio - Math.Round(ratio)) < 0.01;
+
+            checks.Add(Math.Abs(plateFps - renderFps) < 0.01
+                ? ValidationCheck.Pass("plate_fps", plateFps.ToString("0.###"), renderFps.ToString("0.###"))
+                // Never a FAIL: a plate deliberately shot at a multiple of the
+                // show rate is a legitimate over-crank, conformed on purpose.
+                // Anything else is a rate mistake, and the wording says which.
+                : ValidationCheck.Warn("plate_fps", plateFps.ToString("0.###"), renderFps.ToString("0.###"),
+                    overcrank
+                        ? $"The plate is {plateFps:0.###} fps against a {renderFps:0.###} fps render — a {Math.Round(ratio)}x over-crank, conformed as expected."
+                        : $"The plate is {plateFps:0.###} fps but this rendered at {renderFps:0.###} — not a whole-number over-crank, so the comp was probably built at the wrong rate (check the shot's fps in the database).",
+                    new { platePath = reference.PlatePath, reference = reference.Kind, ratio }));
+        }
+
+        var expectedFrames = reference.PlateTimecode.ToFrames(fps) + (renderFirstFrame - reference.PlateFirstFrame);
+        var expected = Timecode.FromFrames(expectedFrames, fps);
+        var deltaFrames = deltaOf(reference);
+        var matchedAlternate = !ReferenceEquals(reference, timingPlate);
+        var details = new
+        {
+            reference = reference.Kind,
+            platePath = reference.PlatePath,
+            plateTimecode = reference.PlateTimecode.ToString(),
+            plateFirstFrame = reference.PlateFirstFrame,
+            renderFirstFrame,
+            deltaFrames,
+            timingPlatePath = timingPlate.PlatePath,
+            matchedAlternate,
+            alternatesTried,
+        };
+
+        if (deltaFrames == 0)
+        {
+            var timingDelta = deltaOf(timingPlate);
+            // The API fallback proves nothing on its own (§8.1a): it is the
+            // editorial in-point minus a handle count that may not be this
+            // plate's, so a match is reported as a WARN, never a PASS.
+            checks.Add(reference.Kind == "api"
+                ? ValidationCheck.Warn("timecode_plate_match", expected.ToString(), renderTc.ToString(),
+                    "Matches the API timecode less handles, but the plate itself could not be read — unverified.", details)
+                : ValidationCheck.Pass("timecode_plate_match", expected.ToString(), renderTc.ToString(),
+                    $"Matches {reference.Kind} plate {Path.GetFileName(reference.PlatePath ?? "")}" +
+                    (matchedAlternate
+                        ? $" (the timing plate {Path.GetFileName(timingPlate.PlatePath ?? "")} is {(timingDelta > 0 ? "+" : "")}{timingDelta} frames off — the comp was anchored to this element instead)"
+                        : ""),
+                    details));
+            return;
+        }
+
+        var message =
+            $"Render starts at {renderTc} but the {reference.Kind} plate says it should be {expected} " +
+            $"({(deltaFrames > 0 ? "+" : "")}{deltaFrames} frames). " +
+            (Math.Abs(deltaFrames) == reference.HandleFrames && reference.HandleFrames > 0
+                ? $"That is exactly the {reference.HandleFrames}-frame handle: the comp was anchored to the editorial in-point instead of the plate's first frame."
+                : renderTc.Hours == 0 && renderTc.Minutes == 0
+                    ? "A near-zero timecode means the comp had no source timecode at all and AE derived it from the frame number."
+                    : "") +
+            (alternatesTried.Count > 0
+                ? $" Also checked {alternatesTried.Count} other delivered plate{(alternatesTried.Count == 1 ? "" : "s")} in the manifest: none match."
+                : "");
+
+        checks.Add(reference.Kind == "api"
+            ? ValidationCheck.Warn("timecode_plate_match", expected.ToString(), renderTc.ToString(),
+                message + " (checked against the API value, not the plate — treat as advisory)", details)
+            : ValidationCheck.Fail("timecode_plate_match", expected.ToString(), renderTc.ToString(), message, details));
+    }
+
+    /// <summary>
+    /// Reference precedence (§8.1a): manifest timing plate → plate found under a
+    /// configured search root → API timecode minus handles (advisory only).
+    /// </summary>
+    private TimecodeReference? ResolveTimecodeReference(RenderManifest m, ServerConfig config, int renderFirstFrame)
+    {
+        var mapper = new PathMapper(_options.PathMappings);
+        var handleFrames = m.Source?.HandleFrames ?? config.ValidationHandleFrames;
+
+        // Rank 1 — the plate the comp was actually built from.
+        var timing = m.Source?.TimingPlate;
+        if (timing is not null && !string.IsNullOrWhiteSpace(timing.Path))
+        {
+            var manifestPlate = ReadManifestPlate(timing, mapper, handleFrames, renderFirstFrame);
+            if (manifestPlate is not null) return manifestPlate;
+            _log.LogWarning("Timing plate from manifest is unreadable: {Path}", mapper.Map(timing.Path));
+        }
+
+        // Rank 2 — derive the plate from a configured search root.
+        var derived = FindPlateOnDisk(m, mapper);
+        if (derived is not null) return derived with { HandleFrames = handleFrames };
+
+        // Rank 3 — the API's editorial in-point, less handles. Advisory only.
+        //
+        // Shot.timecodeStart is the *edit* in-point; the plate is delivered with
+        // handleFrames of head handle, so the first delivered frame sits that
+        // much earlier. The anchor is the render's own first frame, which is in
+        // the same numbering as the files on disk — not the manifest's frame
+        // range, which is the comp's timeline and a different coordinate system
+        // entirely (mixing the two produced a nonsense million-frame offset).
+        var apiTc = Timecode.Parse(m.Expected?.TimecodeStart);
+        if (apiTc is not null)
+        {
+            var fps = m.Fps > 0 ? m.Fps : 24;
+            var plateStart = Timecode.FromFrames(apiTc.Value.ToFrames(fps) - handleFrames, fps);
+            return new TimecodeReference("api", null, plateStart, renderFirstFrame, handleFrames);
+        }
+
+        return null;
+    }
+
+    private static TimecodeReference? ReadManifestPlate(PlateRef plate, PathMapper mapper, int handleFrames, int renderFirstFrame)
+    {
+        var local = mapper.Map(plate.Path);
+        var header = File.Exists(local) ? ExrHeader.TryRead(local) : null;
+        if (header?.Timecode is null) return null;
+
+        // The plate's own file numbering, never the comp's frame range: the
+        // render's first frame is in output numbering, so anchoring on a comp
+        // frame skews the comparison by the gap between them.
+        var frame = SequencePattern.FrameFromName(Path.GetFileName(local))
+                    ?? plate.FrameStart
+                    ?? renderFirstFrame;
+        return new TimecodeReference("manifest", local, header.Timecode.Value, frame, handleFrames,
+            header.FramesPerSecond);
+    }
+
+    /// <summary>
+    /// The manifest's other delivered plates, tried when the timing plate does
+    /// not match. Only real footage qualifies — under a configured plate search
+    /// root or, with none configured, alongside the timing plate in its footage
+    /// folder — because plates[] is every file in the comp, and a pre-render
+    /// agrees with the render whether or not either is right.
+    /// </summary>
+    private IEnumerable<TimecodeReference> ResolveAlternatePlates(RenderManifest m, int renderFirstFrame, TimecodeReference timingPlate)
+    {
+        var plates = m.Source?.Plates;
+        if (plates is null || plates.Count == 0 || timingPlate.PlatePath is null) yield break;
+
+        var mapper = new PathMapper(_options.PathMappings);
+        static string AsFolder(string dir) => Path.TrimEndingDirectorySeparator(Path.GetFullPath(dir)) + Path.DirectorySeparatorChar;
+
+        var deliveredRoots = _options.PlateSearchRoots.Count > 0
+            ? _options.PlateSearchRoots.Select(r => AsFolder(mapper.Map(r))).ToList()
+            // {footage}/{shot}_{element}/file.exr or {footage}/{shot}/{element}/file.exr:
+            // two levels up from the timing plate is the folder its siblings share.
+            : Path.GetDirectoryName(Path.GetDirectoryName(Path.GetFullPath(timingPlate.PlatePath))) is { } footage
+                ? new List<string> { AsFolder(footage) }
+                : new List<string>();
+
+        var seen = new HashSet<string>(StringComparer.OrdinalIgnoreCase) { Path.GetFullPath(timingPlate.PlatePath) };
+        foreach (var plate in plates)
+        {
+            if (string.IsNullOrWhiteSpace(plate.Path)) continue;
+            var local = Path.GetFullPath(mapper.Map(plate.Path));
+            if (!seen.Add(local)) continue;
+            if (!deliveredRoots.Any(root => local.StartsWith(root, StringComparison.OrdinalIgnoreCase))) continue;
+
+            var reference = ReadManifestPlate(plate, mapper, timingPlate.HandleFrames, renderFirstFrame);
+            if (reference is null)
+            {
+                _log.LogWarning("Alternate plate from manifest is unreadable: {Path}", local);
+                continue;
+            }
+            yield return reference;
+        }
+    }
+
+    /// <summary>
+    /// Rank 2: look for the shot's plate folders under the configured roots,
+    /// mirroring the panel's two on-disk layouts ({shotCode}/{element}/ and
+    /// {shotCode}_{element}/). Ambiguity is resolved by frame count; still
+    /// ambiguous means no reference rather than a guess.
+    /// </summary>
+    private TimecodeReference? FindPlateOnDisk(RenderManifest m, PathMapper mapper)
+    {
+        if (_options.PlateSearchRoots.Count == 0 || string.IsNullOrWhiteSpace(m.ShotCode)) return null;
+
+        var candidates = new List<(string Dir, int Count)>();
+        foreach (var rootRaw in _options.PlateSearchRoots)
+        {
+            var root = mapper.Map(rootRaw);
+            if (!Directory.Exists(root)) continue;
+            // The show/episode level is unknown here, so scan the root and one
+            // level below it — bounded, and enough for both layouts.
+            var levels = new List<string> { root };
+            try { levels.AddRange(Directory.EnumerateDirectories(root)); } catch { }
+
+            foreach (var level in levels)
+            {
+                try
+                {
+                    var grouped = Path.Combine(level, m.ShotCode);
+                    if (Directory.Exists(grouped))
+                    {
+                        foreach (var element in Directory.EnumerateDirectories(grouped))
+                        {
+                            AddCandidate(candidates, element);
+                        }
+                    }
+                    foreach (var element in Directory.EnumerateDirectories(level, m.ShotCode + "_*"))
+                    {
+                        AddCandidate(candidates, element);
+                    }
+                }
+                catch { /* unreadable branch — keep scanning the rest */ }
+            }
+        }
+
+        if (candidates.Count == 0) return null;
+
+        // Prefer the element whose frame count matches the render: that is the
+        // one the comp's timing came from.
+        var exact = candidates.Where(c => c.Count == m.TotalFrames).ToList();
+        (string Dir, int Count)? chosen =
+            exact.Count == 1 ? exact[0]
+            : exact.Count == 0 && candidates.Count == 1 ? candidates[0]
+            : null;
+
+        if (chosen is null)
+        {
+            _log.LogWarning("Plate reference ambiguous for {Shot}: {Candidates}",
+                m.ShotCode, string.Join(", ", candidates.Select(c => Path.GetFileName(c.Dir))));
+            return null;
+        }
+
+        var firstFile = Directory.EnumerateFiles(chosen.Value.Dir, "*.exr").OrderBy(f => f, StringComparer.Ordinal).FirstOrDefault();
+        if (firstFile is null) return null;
+        var header = ExrHeader.TryRead(firstFile);
+        if (header?.Timecode is null) return null;
+
+        var frame = SequencePattern.FrameFromName(Path.GetFileName(firstFile)) ?? m.FrameStart;
+        return new TimecodeReference("derived", firstFile, header.Timecode.Value, frame, 0, header.FramesPerSecond);
+    }
+
+    private static void AddCandidate(List<(string Dir, int Count)> candidates, string dir)
+    {
+        try
+        {
+            var count = Directory.EnumerateFiles(dir, "*.exr").Count();
+            if (count > 0) candidates.Add((dir, count));
+        }
+        catch { }
+    }
+
+    // ── Checksums ────────────────────────────────────────────────────────────
+
+    /// <summary>
+    /// Sequence digest = xxHash64 over the per-file digests in frame order
+    /// (§8.2). Reused by the delivery builder to verify what it linked/copied.
+    /// </summary>
+    private string? ComputeSequenceChecksum(List<string> files)
+    {
+        try
+        {
+            var state = new XxHash64.State(0);
+            foreach (var f in files)
+            {
+                var digest = XxHash64.HashFile(f);
+                state.Update(System.Text.Encoding.ASCII.GetBytes(digest));
+            }
+            return state.Digest().ToString("x16");
+        }
+        catch (Exception ex)
+        {
+            _log.LogWarning(ex, "Sequence checksum failed");
+            return null;
+        }
+    }
+
+    private static string Summarise(IEnumerable<int> numbers)
+    {
+        var list = numbers.Take(12).ToList();
+        var text = string.Join(", ", list);
+        return numbers.Count() > 12 ? text + ", …" : text;
+    }
+}
+
+public sealed record TimecodeReference(
+    string Kind, string? PlatePath, Timecode PlateTimecode, int PlateFirstFrame, int HandleFrames,
+    double? PlateFps = null);
+
+public sealed record ValidationOutcome(
+    List<ValidationCheck> Checks, int FileCount, long TotalBytes, string? Checksum)
+{
+    public bool HasFailure => Checks.Any(c => c.Status == "FAIL");
+}
+
+/// <summary>One row of the E12 report.</summary>
+public sealed class ValidationCheck
+{
+    public string CheckName { get; set; } = "";
+    public string Status { get; set; } = "PASS";
+    public string? Expected { get; set; }
+    public string? Actual { get; set; }
+    public string? Message { get; set; }
+    public object? Details { get; set; }
+
+    public static ValidationCheck Pass(string name, string? expected = null, string? actual = null, string? message = null, object? details = null) =>
+        new() { CheckName = name, Status = "PASS", Expected = expected, Actual = actual, Message = message, Details = details };
+
+    public static ValidationCheck Fail(string name, string? expected, string? actual, string message, object? details = null) =>
+        new() { CheckName = name, Status = "FAIL", Expected = expected, Actual = actual, Message = message, Details = details };
+
+    public static ValidationCheck Warn(string name, string? expected, string? actual, string message, object? details = null) =>
+        new() { CheckName = name, Status = "WARN", Expected = expected, Actual = actual, Message = message, Details = details };
+
+    public static ValidationCheck Skipped(string name, string message) =>
+        new() { CheckName = name, Status = "SKIPPED", Message = message };
+}
+
+/// <summary>
+/// Parses `{base}.[#####].exr` output patterns and the filenames they produce.
+/// </summary>
+public sealed class SequencePattern
+{
+    public string Prefix { get; private init; } = "";
+    public string Extension { get; private init; } = ".exr";
+    public int Padding { get; private init; }
+
+    // Delivered plates separate the frame number with a dot
+    // ("..._BG01_TT_v001.01001.exr"); AE-written renders use an underscore
+    // ("..._PRERENDER_01001.exr"). Both appear as layers in a shot comp, so
+    // both have to parse — a plate whose number cannot be read gets anchored on
+    // a fallback, and a wrong anchor silently skews the timecode check.
+    private static readonly Regex FrameInName = new(@"[._](\d{2,9})\.[A-Za-z0-9]+$", RegexOptions.Compiled);
+
+    public static SequencePattern FromOutputPattern(string outputPattern)
+    {
+        var pattern = outputPattern ?? "";
+        var ext = Path.GetExtension(pattern);
+        if (string.IsNullOrEmpty(ext)) ext = ".exr";
+
+        var hashStart = pattern.IndexOf('[');
+        var prefix = hashStart > 0 ? pattern[..hashStart].TrimEnd('.') : Path.GetFileNameWithoutExtension(pattern);
+        var padding = 0;
+        foreach (var ch in pattern)
+        {
+            if (ch == '#') padding++;
+        }
+
+        return new SequencePattern { Prefix = prefix, Extension = ext, Padding = padding };
+    }
+
+    /// <summary>
+    /// Whether a filename belongs to *this* render's output: the pattern's own
+    /// prefix and extension. A version folder also holds the preview MOV and
+    /// MP4, which are built from the same basename and so share the prefix —
+    /// only the extension separates them from the frames.
+    /// </summary>
+    public bool MatchesOutputFile(string fileName) =>
+        fileName.StartsWith(Prefix, StringComparison.OrdinalIgnoreCase)
+        && fileName.EndsWith(Extension, StringComparison.OrdinalIgnoreCase);
+
+    public int? FrameNumberOf(string fileName) => FrameFromName(fileName);
+
+    /// <summary>`UNG_102_019_010_cmp_TT_v005.01001.exr` → 1001.</summary>
+    public static int? FrameFromName(string fileName)
+    {
+        var m = FrameInName.Match(fileName);
+        if (!m.Success) return null;
+        return int.TryParse(m.Groups[1].Value, out var n) ? n : null;
+    }
+
+    public string Describe() => $"{Prefix}.[{new string('#', Math.Max(1, Padding))}]{Extension}";
+}

RenderWorker/VFXReviewWorker/WorkerOptions.cs

@@ -1,3 +1,4 @@
+using System.Reflection;
 using System.Text.Json;
 using System.Text.Json.Serialization;
 
@@ -19,9 +20,38 @@ public sealed class WorkerOptions
     /// <summary>vfxr_build_preview.jsx — defaults to scripts\ beside the worker exe.</summary>
     public string? PreviewScriptPath { get; set; }
     public string? FfmpegPath { get; set; }
+    /// <summary>
+    /// blender.exe. Its presence is what makes this machine eligible for
+    /// Blender jobs: the version is reported at registration and the server
+    /// only hands BLENDER_RENDER work to machines that have it.
+    /// </summary>
+    public string? BlenderPath { get; set; }
     public string? OiiotoolPath { get; set; }
     public List<PathMapping> PathMappings { get; set; } = new();
-    public string WorkerVersion { get; set; } = "1.0.0";
+    /// <summary>
+    /// Optional footage roots searched for a shot's plates when a manifest
+    /// carries no timing plate (rank 2 of §8.1a) — e.g. ["V:/_FOOTAGE/UNG"].
+    /// Leave empty and old manifests simply fall through to the API fallback.
+    /// </summary>
+    public List<string> PlateSearchRoots { get; set; } = new();
+    /// <summary>
+    /// Parallel connections per large upload. From the studio each connection
+    /// to object storage is capped near 0.1 MB/s, so throughput scales with
+    /// this (measured: 1 → 0.13 MB/s, 8 → 0.64, 24 → 1.69).
+    /// </summary>
+    public int UploadConcurrency { get; set; } = 16;
+    /// <summary>
+    /// Read from the assembly, not from config.json: a hand-maintained version
+    /// string is exactly the thing that goes stale, and a machine reporting a
+    /// version it is not running is worse than no version at all.
+    /// Includes the git SHA when publish.ps1 stamped one ("1.1.0+feb1c7b").
+    /// </summary>
+    public string WorkerVersion =>
+        typeof(WorkerOptions).Assembly
+            .GetCustomAttribute<System.Reflection.AssemblyInformationalVersionAttribute>()?.InformationalVersion
+        ?? typeof(WorkerOptions).Assembly.GetName().Version?.ToString()
+        ?? "unknown";
+
     public string? AeVersion { get; set; }
 
     public static string DataDir =>

RenderWorker/VFXReviewWorker/WorkerService.cs

@@ -15,6 +15,7 @@ public sealed class WorkerService : BackgroundService
     private readonly ApiClient _api;
     private readonly JobExecutor _executor;
     private readonly ReportSpooler _spooler;
+    private readonly HighResUploader _highRes;
     private readonly ILogger<WorkerService> _log;
 
     private string? _machineId;
@@ -23,8 +24,10 @@ public sealed class WorkerService : BackgroundService
     private CancellationTokenSource? _cancelCurrentJob;
     private bool? _lastAeOpen;
 
-    public WorkerService(WorkerOptions options, ApiClient api, JobExecutor executor, ReportSpooler spooler, ILogger<WorkerService> log)
+    public WorkerService(WorkerOptions options, ApiClient api, JobExecutor executor, ReportSpooler spooler,
+        HighResUploader highRes, ILogger<WorkerService> log)
     {
+        _highRes = highRes;
         _options = options;
         _api = api;
         _executor = executor;
@@ -40,6 +43,8 @@ public sealed class WorkerService : BackgroundService
         _ = Task.Run(() => _spooler.RunAsync(stoppingToken), stoppingToken);
 
         await RegisterWithRetryAsync(stoppingToken);
+        _ = Task.Run(() => _highRes.RunAsync(stoppingToken), stoppingToken);
+        await _api.ReportVersionAsync(_options, stoppingToken);
         await _executor.ReconcileAsync(_machineId!, stoppingToken);
 
         _ = Task.Run(() => HeartbeatLoopAsync(stoppingToken), stoppingToken);
@@ -61,9 +66,13 @@ public sealed class WorkerService : BackgroundService
                         : "No interactive After Effects — preview jobs enabled");
                     _lastAeOpen = aeOpen;
                 }
+                // Delivery builds are file work with no AE involvement, so they
+                // are always claimable — someone is usually waiting on the folder.
+                // Blender is asked for unconditionally; the server refuses it to
+                // machines whose capabilities do not include Blender.
                 var types = aeOpen
-                    ? new[] { "AE_RENDER" }
+                    ? new[] { "AE_RENDER", "DELIVERY_BUILD", "BLENDER_RENDER" }
-                    : new[] { "AE_RENDER", "PREVIEW_ONLY" };
+                    : new[] { "AE_RENDER", "PREVIEW_ONLY", "DELIVERY_BUILD", "BLENDER_RENDER" };
 
                 var job = await _api.ClaimAsync(_machineId!, types, stoppingToken);
                 if (job is not null)

RenderWorker/VFXReviewWorker/XxHash64.cs

@@ -0,0 +1,158 @@
+namespace VFXReviewWorker;
+
+/// <summary>
+/// xxHash64 (§8.2 `checksumAlgo: "xxh64"`). Implemented here rather than taken
+/// from System.IO.Hashing so the worker stays a dependency-free single-file
+/// publish for offline workstation installs. Verified against the reference
+/// test vectors in XxHash64Tests.
+/// </summary>
+public static class XxHash64
+{
+    private const ulong Prime1 = 11400714785074694791UL;
+    private const ulong Prime2 = 14029467366897019727UL;
+    private const ulong Prime3 = 1609587929392839161UL;
+    private const ulong Prime4 = 9650029242287828579UL;
+    private const ulong Prime5 = 2870177450012600261UL;
+
+    public static ulong Hash(ReadOnlySpan<byte> data, ulong seed = 0)
+    {
+        var state = new State(seed);
+        state.Update(data);
+        return state.Digest();
+    }
+
+    public static string HashFile(string path, int bufferSize = 1 << 20)
+    {
+        var state = new State(0);
+        using var fs = new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.ReadWrite, bufferSize, FileOptions.SequentialScan);
+        var buffer = new byte[bufferSize];
+        int read;
+        while ((read = fs.Read(buffer, 0, buffer.Length)) > 0)
+        {
+            state.Update(new ReadOnlySpan<byte>(buffer, 0, read));
+        }
+        return state.Digest().ToString("x16");
+    }
+
+    /// <summary>Streaming state so multi-GB sequences hash without being held in memory.</summary>
+    public struct State
+    {
+        private ulong _v1, _v2, _v3, _v4;
+        private readonly ulong _seed;
+        private ulong _length;
+        private readonly byte[] _buffer;
+        private int _bufferLen;
+
+        public State(ulong seed)
+        {
+            _seed = seed;
+            _v1 = seed + Prime1 + Prime2;
+            _v2 = seed + Prime2;
+            _v3 = seed;
+            _v4 = seed - Prime1;
+            _length = 0;
+            _buffer = new byte[32];
+            _bufferLen = 0;
+        }
+
+        public void Update(ReadOnlySpan<byte> data)
+        {
+            _length += (ulong)data.Length;
+
+            if (_bufferLen > 0)
+            {
+                var need = Math.Min(32 - _bufferLen, data.Length);
+                data[..need].CopyTo(_buffer.AsSpan(_bufferLen));
+                _bufferLen += need;
+                data = data[need..];
+                if (_bufferLen < 32) return;
+                ProcessStripe(_buffer);
+                _bufferLen = 0;
+            }
+
+            while (data.Length >= 32)
+            {
+                ProcessStripe(data[..32]);
+                data = data[32..];
+            }
+
+            if (data.Length > 0)
+            {
+                data.CopyTo(_buffer.AsSpan(0));
+                _bufferLen = data.Length;
+            }
+        }
+
+        private void ProcessStripe(ReadOnlySpan<byte> stripe)
+        {
+            _v1 = Round(_v1, BitConverter.ToUInt64(stripe[..8]));
+            _v2 = Round(_v2, BitConverter.ToUInt64(stripe.Slice(8, 8)));
+            _v3 = Round(_v3, BitConverter.ToUInt64(stripe.Slice(16, 8)));
+            _v4 = Round(_v4, BitConverter.ToUInt64(stripe.Slice(24, 8)));
+        }
+
+        public ulong Digest()
+        {
+            ulong h;
+            if (_length >= 32)
+            {
+                h = RotateLeft(_v1, 1) + RotateLeft(_v2, 7) + RotateLeft(_v3, 12) + RotateLeft(_v4, 18);
+                h = MergeRound(h, _v1);
+                h = MergeRound(h, _v2);
+                h = MergeRound(h, _v3);
+                h = MergeRound(h, _v4);
+            }
+            else
+            {
+                h = _seed + Prime5;
+            }
+
+            h += _length;
+
+            var tail = new ReadOnlySpan<byte>(_buffer, 0, _bufferLen);
+            int i = 0;
+            while (i + 8 <= tail.Length)
+            {
+                h ^= Round(0, BitConverter.ToUInt64(tail.Slice(i, 8)));
+                h = RotateLeft(h, 27) * Prime1 + Prime4;
+                i += 8;
+            }
+            if (i + 4 <= tail.Length)
+            {
+                h ^= BitConverter.ToUInt32(tail.Slice(i, 4)) * Prime1;
+                h = RotateLeft(h, 23) * Prime2 + Prime3;
+                i += 4;
+            }
+            while (i < tail.Length)
+            {
+                h ^= tail[i] * Prime5;
+                h = RotateLeft(h, 11) * Prime1;
+                i++;
+            }
+
+            h ^= h >> 33;
+            h *= Prime2;
+            h ^= h >> 29;
+            h *= Prime3;
+            h ^= h >> 32;
+            return h;
+        }
+
+        private static ulong Round(ulong acc, ulong input)
+        {
+            acc += input * Prime2;
+            acc = RotateLeft(acc, 31);
+            acc *= Prime1;
+            return acc;
+        }
+
+        private static ulong MergeRound(ulong acc, ulong val)
+        {
+            acc ^= Round(0, val);
+            acc = acc * Prime1 + Prime4;
+            return acc;
+        }
+
+        private static ulong RotateLeft(ulong value, int bits) => (value << bits) | (value >> (64 - bits));
+    }
+}

RenderWorker/scripts/publish.ps1

@@ -20,13 +20,34 @@ $ErrorActionPreference = "Stop"
 $root = Split-Path $PSScriptRoot -Parent
 if (-not $OutDir) { $OutDir = Join-Path $root "publish\win-x64" }
 
+# Stamp the commit into the version so a deployed exe can be traced back to
+# source ("1.1.0+feb1c7b"). Absent git, the plain version still publishes.
+$sha = ""
+try { $sha = (& git -C $root rev-parse --short HEAD 2>$null) } catch { }
+if ($LASTEXITCODE -ne 0) { $sha = "" }
+
 Write-Host "Publishing self-contained worker..." -ForegroundColor Cyan
-& dotnet publish (Join-Path $root "VFXReviewWorker\VFXReviewWorker.csproj") `
+$publishArgs = @(
-    -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true -o $OutDir
+    (Join-Path $root "VFXReviewWorker\VFXReviewWorker.csproj")
+    "-c"; "Release"; "-r"; "win-x64"
+    "--self-contained"; "true"
+    "-p:PublishSingleFile=true"
+    "-o"; $OutDir
+)
+if ($sha) { $publishArgs += "-p:SourceRevisionId=$sha" }
+& dotnet publish @publishArgs
 if ($LASTEXITCODE -ne 0) { throw "dotnet publish failed" }
 
-# The exe reads scripts\vfxr_build_preview.jsx from its own folder at runtime.
+# The exe reads scripts\vfxr_build_preview.jsx from its own folder at runtime,
+# so it is copied here unconditionally rather than trusted to the SDK: an
+# incremental publish into a cleaned output directory silently skips content
+# copying, which produced a package that looked fine and could not build a
+# preview. Copy, then verify.
+$scriptSrc = Join-Path $PSScriptRoot "vfxr_build_preview.jsx"
 $scriptOut = Join-Path $OutDir "scripts\vfxr_build_preview.jsx"
+if (-not (Test-Path $scriptSrc)) { throw "Preview build script not found in source: $scriptSrc" }
+New-Item -ItemType Directory -Force (Split-Path $scriptOut) | Out-Null
+Copy-Item $scriptSrc $scriptOut -Force
 if (-not (Test-Path $scriptOut)) { throw "Preview build script missing from output: $scriptOut" }
 
 Remove-Item (Join-Path $OutDir "*.pdb") -ErrorAction SilentlyContinue

RenderWorker/scripts/test-preview-build.ps1

@@ -15,7 +15,7 @@
     and then quit it.
 
 .EXAMPLE
-    .\test-preview-build.ps1 -ExrDir "V:\_EXPORTS\UNG\renders\UNG_S1\111\UNG_111_001_030\v002" `
+    .\test-preview-build.ps1 -ExrDir "V:\_EXPORTS\UNG_S1\111\UNG_111_001_030\v002" `
                              -ShotCode "UNG_111_001_030" -Version "v002"
 
 .EXAMPLE

RenderWorker/scripts/vfxr_build_preview.jsx

@@ -30,7 +30,11 @@
         queued: [],
         frameCount: null,
         width: null,
-        height: null
+        height: null,
+        // Seconds of slate ahead of picture in the preview comp — the SHOT
+        // layer's in-point. The worker needs it to grab a thumbnail from
+        // picture rather than from the slate card.
+        pictureStartSeconds: null
     };
     var resultPath = null;
 
@@ -230,6 +234,26 @@
         return names;
     }
 
+    // Slate identity fields (version name, shot name). Current templates expose
+    // these under a stable name, older ones only positionally, and the two do
+    // not always line up — so write both. Setting the same property twice is
+    // harmless; the panel uses the same name-with-index-fallback pattern.
+    function setSlateIdentity(layer, propName, index, value, label) {
+        var byName;
+        var byIndex;
+
+        if (value === null || value === undefined || value === "") {
+            return; // leave the template's own default
+        }
+        byName = setEssentialProperty(layer, propName, value);
+        byIndex = setEssentialPropertyByIndex(layer, index, value);
+        if (!byName && !byIndex) {
+            warn(label + ": neither Essential Property \"" + propName + "\" nor index " +
+                index + " could be set. Available: " +
+                listEssentialPropertyNames(layer).join(", "));
+        }
+    }
+
     // Per-submission fields (VFX Scope / Submission Note). The property names
     // come from config; if one does not exist, report the template's actual
     // property names so it can be corrected without another build.
@@ -246,6 +270,27 @@
         }
     }
 
+    // The production name, burned into both the slate and the overlay. The
+    // slate's other fields are title case ("Date", "Scene") while the overlay's
+    // are upper ("DATE", "SHOT NAME"), so both spellings are attempted rather
+    // than assuming which template uses which — and a template that exposes
+    // neither reports its actual property names instead of failing silently.
+    function setShowField(layer, value, label) {
+        var candidates = ["SHOW", "Show"];
+        var i;
+
+        if (value === null || value === undefined || value === "") {
+            return;
+        }
+        for (i = 0; i < candidates.length; i += 1) {
+            if (setEssentialProperty(layer, candidates[i], value)) {
+                return;
+            }
+        }
+        warn(label + ": no Essential Property named " + candidates.join(" or ") +
+            ". Available: " + listEssentialPropertyNames(layer).join(", "));
+    }
+
     function setCompStartFrame(comp, frameNumber) {
         try {
             comp.displayStartFrame = frameNumber;
@@ -417,6 +462,7 @@
                 overlayLayer.enabled = true;
                 setEssentialProperty(overlayLayer, "DATE", ctx.slate.date);
                 setEssentialProperty(overlayLayer, "SHOT NAME", ctx.slate.versionName);
+                setShowField(overlayLayer, ctx.slate.show, "Overlay SHOW");
             } else {
                 warn("Overlay comp \"" + ctx.overlayComp + "\" not found — rendering without burn-ins");
             }
@@ -439,15 +485,19 @@
 
         var slateLayer = previewComp.layer("NETFLIX_SLATE");
         if (slateLayer) {
-            // Index-addressed properties match the panel exactly (3 = version
+            // Identity fields match the panel's indices (3 = version name,
-            // name, 10 = shot code); the rest are addressed by name.
+            // 10 = shot name) and are also written by name; the rest are
-            setEssentialPropertyByIndex(slateLayer, 3, ctx.slate.versionName);
+            // addressed by name only.
+            // VersionName carries the full "{shotCode}_cmp_TT_{version}";
+            // ShotName is the bare shot code, with no version suffix.
+            setSlateIdentity(slateLayer, "VersionName", 3, ctx.slate.versionName, "Version Name");
+            setSlateIdentity(slateLayer, "ShotName", 10, ctx.slate.shotCode, "Shot Name");
             setEssentialProperty(slateLayer, "Date", ctx.slate.date);
             setEssentialProperty(slateLayer, "Desc", ctx.slate.description);
-            setEssentialPropertyByIndex(slateLayer, 10, ctx.slate.shotCode);
             setEssentialProperty(slateLayer, "Episode", ctx.slate.episode);
             setEssentialProperty(slateLayer, "Scene", ctx.slate.scene);
             setEssentialProperty(slateLayer, "Frames", result.frameCount);
+            setShowField(slateLayer, ctx.slate.show, "Slate SHOW");
 
             setSlateField(slateLayer, ctx.slateScopeProp, ctx.slate.vfxScope, "VFX Scope");
             // The slate's Notes field carries this submission's note; when the
@@ -466,6 +516,8 @@
 
         var shotLayer = previewComp.layer("SHOT");
         var targetOutPoint = shotLayer.inPoint + shotComp.duration;
+        // Everything before this is slate; the thumbnail has to start after it.
+        result.pictureStartSeconds = shotLayer.inPoint;
         if (targetOutPoint > previewComp.duration) {
             previewComp.duration = targetOutPoint;
         }

VFXReviewConnector.md

@@ -6,7 +6,161 @@ A dockable ScriptUI panel for Adobe After Effects 2024+ that integrates with the
 
 ## Configuration
 
-At the top of the script, four global variables control how the panel connects to your project:
+Settings are stored per-machine via the **⚙ Settings** button in the panel (persisted in After Effects' built-in preferences — no need to edit the JSX file).
+
+| Setting | Purpose |
+|---|---|
+| **Server URL** | Base URL of the VFXReview server (e.g. `https://review.twotalesvfx.com`) |
+| **API Token** | Bearer token matching `API_SECRET_KEY` in the server `.env` |
+| **Export Root** | Local path where renders and deliverables are written |
+| **Footage Root** | Local path where EXR plate folders are read from |
+| **Banner Path** | Path to the panel banner image |
+| **Artist Email** | Used for render attribution in the pipeline |
+| **Handle Frames** | Plate handle frames prepended before the shot's source TC in-point (default: 8) |
+| **Path Mappings** | *Optional.* Rewrites paths the **server** supplies — see below |
+
+### Server paths vs. this machine
+
+The server addresses render folders from its own root (`render.outputRoot`,
+e.g. `//SAN`), which a workstation may not resolve — the render worker
+translates them with its own `pathMappings` because it runs as a service
+account. The panel needs the same translation to open a render for QC.
+
+It resolves this itself in most cases, trying in order:
+
+1. **Path Mappings**, if configured — format `//SAN/=V:/_EXPORTS/`, several
+   separated by `;`.
+2. **The server path as given** — correct when `render.outputRoot` is already
+   a path this machine can reach.
+3. **Re-based on Export Root** — the server's export layout mirrors the panel's
+   from the show folder down (`{root}/{showId}/{episode}/{shot}/{version}`), so
+   the tail is simply re-attached to Export Root.
+
+Step 3 is why this usually needs no configuration. **Diagnostics** checks the
+whole thing against a real render folder from the QC queue and names every path
+it tried when it fails.
+
+### More than one on-disk convention
+
+Every candidate is tested for existence and the first that resolves wins, so a
+studio whose output root changed at some point can map the **same prefix more
+than once** and let the panel work out which applies per export:
+
+```
+//SAN/=V:/_EXPORTS/;//SAN/=V:/_EXPORTS/UNG/
+```
+
+Older exports keep whatever path was stored on them when they were queued —
+changing `render.outputRoot` on the server only affects new ones — so mixed
+conventions in one database are normal and permanent. Add a mapping per
+convention rather than trying to make one rewrite cover them all.
+
+---
+
+## Pipeline Folder Structure
+
+### Export Root
+
+All outputs from the connector are written under **`<Export Root>/{SHOW_ID}/`** (e.g. `V:/_EXPORTS`). The show ID is appended automatically from the selected project — configure `exportRoot` as the bare root without a show ID.
+
+```
+<Export Root>/
+└── {SHOW_ID}/                                     # e.g. UNG/
+    ├── {SHOT_CODE}/                                # e.g. UNG_108_001_010/
+    │   ├── {shot}_cmp_TT_{ver}.[#####].exr         # Queue EXR / Queue EXR (Review)
+    │   └── {shot}_cmp_TT_{ver}.mp4 / .mov          # Queue MP4 / Queue MOV
+    │
+    ├── DELIVERY/
+    │   └── {EPISODE_OR_SCENE}/                     # e.g. UNG_108/
+    │       └── {YYYYMMDD}_Delivery/
+    │           └── {SHOT_CODE}/
+    │               └── {shot}_cmp_TT_{ver}.[#####].exr
+    │
+    └── (render farm outputs — managed by the server)
+        └── {PROJECT_CODE}/{EPISODE}/{SHOT_CODE}/{ver}/
+            └── {shot}_cmp_TT_{ver}.[#####].exr
+```
+
+**Version naming:** `{SHOT_CODE}_cmp_TT_{version}` — e.g. `UNG_108_001_010_cmp_TT_v003.[01001].exr`
+
+Versions are set manually via **Increment Shot Version** or the shot detail page. Queuing a render does **not** auto-increment the version.
+
+---
+
+### Footage Root
+
+Source EXR plates are read from **`<Footage Root>/{SHOW_ID}/`**. Configure `footageRoot` as the bare root (e.g. `V:/_FOOTAGE`).
+
+```
+<Footage Root>/
+└── {SHOW_ID}/                      # e.g. UNG/ or DH2_VFX/
+    ├── {EPISODE_CODE}/             # episodic only: e.g. UNG_108/
+    │   └── {SHOT_CODE}/            # standard layout: plates grouped per shot
+    │       └── {SHOT_CODE}_{ELEM}_{VER}/
+    │           └── *.exr
+    │
+    └── _PICLOCKS/
+        └── {EPISODE_CODE}_*.mov    # matched by episode prefix
+```
+
+### Frame rate
+
+Comps are built at the **shot record's `fps`**, and plates are conformed to it.
+That value is the show's delivery rate and the authority; a plate's own rate is
+whatever happens to be on disk.
+
+`fps` defaults to 24 when a shot is created, so **check it after importing a
+show that is not 24** — every shot carries its own value, and a wrong one
+produces comps at the wrong rate, plates conformed to the wrong speed, and
+timecode-to-frame sums that are quietly off.
+
+A plate at a whole-number multiple of the show rate (50 fps on a 25 fps show) is
+a deliberate over-crank and is conformed as intended. Validation reports the
+difference either way, saying which of the two it looks like.
+
+**Scenes are not folders.** Standard projects have no level between the show
+folder and the shot folder — the scene picker filters the shot list only.
+
+**Two layouts are supported, and neither is migrated.** The connector prefers the
+grouped layout above; where a `{SHOT_CODE}/` folder does not exist it falls back
+to scanning the parent for folders named `{SHOT_CODE}_*` (the original UNG
+layout, where plates sit directly in the episode folder). All matching folders
+are imported as separate footage layers. If a `{SHOT_CODE}/` folder exists but
+holds no plate subfolders, that is reported as no footage — the fallback scan is
+not attempted, so stray plate folders sitting beside the shot cannot be picked up
+as its footage. Underscore-prefixed folders (`_ARCHIVE`, `_GFX`, `_PULLS`, …) are
+never treated as shots or plates.
+
+---
+
+### Episodic vs. Standard productions
+
+| | Episodic | Standard |
+|---|---|---|
+| Shot code format | `{SHOW}_{EP}_{SCENE}_{NUM}` | `{SHOW}_{SCENE}_{NUM}` |
+| Shot Builder | Episode dropdown → Shot dropdown | Scene dropdown → Shot dropdown |
+| Footage path | `{footageRoot}/{showId}/{EPISODE}/` | `{footageRoot}/{showId}/{SCENE}/` |
+| Export path | `{exportRoot}/{showId}/{SHOT_CODE}/` | same |
+| Delivery subfolder | `DELIVERY/{EPISODE}/…` | `DELIVERY/{SCENE}/…` |
+
+---
+
+## Migrating an existing project (e.g. UNG)
+
+If you previously set `exportRoot = V:/_EXPORTS/UNG`, update it to `V:/_EXPORTS`. The code now appends `/{showId}/` automatically, so `V:/_EXPORTS/UNG/…` is still produced — no files need to move.
+
+Same applies to `footageRoot`: change `V:/_FOOTAGE/UNG` → `V:/_FOOTAGE`.
+
+---
+
+## New production checklist
+
+1. Create `<Footage Root>/{SHOW_ID}/[{EPISODE_CODE}/]{SHOT_CODE}/` — episode level for episodic shows only, never a scene level — and place each plate in its own `{SHOT_CODE}_{ELEM}_{VER}/` folder inside it.
+2. `<Export Root>/{SHOW_ID}/` is created automatically on first render.
+3. Add the project to the VFXReview server with the correct **Show ID** set.
+4. Open the panel in After Effects, click **⚙**, enter the Server URL, API Token, bare `exportRoot`, and bare `footageRoot`, then click **Save**.
+5. The **Project** dropdown will populate automatically. Select the production and the episode/scene list will load.
+
 
 | Variable | Default | Description |
 |---|---|---|
@@ -21,13 +175,15 @@ At the top of the script, four global variables control how the panel connects t
 
 ## Panel Layout
 
-The panel is divided into five sections:
+The panel is divided into seven sections:
 
 1. **Shot Builder** — Episode/shot selection and comp creation
-2. **Actions** — Per-shot and batch operations
+2. **Render Pipeline** — Queue Export, status polling, retry, regenerate previews, increment shot version
-3. **Workspace** — One-time project initialisation
+3. **QC** — Technical QC queue for rendered exports
-4. **Color Space** — OCIO effect management
+4. **Actions** — Per-shot and batch operations
-5. **Status** — Live feedback on selected comps and last action
+5. **Workspace** — One-time project initialisation
+6. **Color Space** — OCIO effect management
+7. **Status** — Live feedback, plus Diagnostics and the last report
 
 ---
 
@@ -45,12 +201,163 @@ Constructs a full shot composite in the open AE project from the episode and sho
 **Process:**
 1. Calls the shot lookup API to retrieve metadata (description, notes, episode, scene, etc.).
 2. If a comp with the shot code already exists, updates its overlay instead of rebuilding.
-3. Scans `FOOTAGE_ROOT/{episodeCode}/` for subfolders matching `{shotCode}_*` and imports each as an EXR image sequence at 24 fps.
+3. Scans `FOOTAGE_ROOT/{episodeCode}/` for subfolders matching `{shotCode}_*` and imports each as an EXR image sequence, conformed to the shot's frame rate.
 4. Creates a `{shotCode}_FOOTAGE` precomp containing all imported sequences, each with an OCIO Color Space Transform effect added (disabled by default).
 5. Creates the main `{shotCode}` comp and places the footage precomp inside it.
-6. If a `_SHOW LUT` comp exists in the project, adds it as a collapsed layer on top.
+6. Anchors both comps on the plate's start timecode — see [Start timecode](#start-timecode).
-7. Calls **Add Overlay** logic to attach the `UNG_VFX_OVERLAY` comp.
+7. If a `_SHOW LUT` comp exists in the project, adds it as a collapsed layer on top.
-8. Organises items into `__SHOTS/{episodeCode}`, `_FOOTAGE_4K`, and `_PRECOMPS` project folders.
+8. Calls **Add Overlay** logic to attach the `UNG_VFX_OVERLAY` comp.
+9. Organises items into `__SHOTS/{episodeCode}`, `_FOOTAGE_4K`, and `_PRECOMPS` project folders.
+
+If any step fails, the status line names the stage and a copyable report opens —
+see [Diagnostics and logging](#diagnostics-and-logging).
+
+#### Start timecode
+
+Neither comp starts at `00:00:00:00`. Both are anchored on the plate's own start
+timecode, taken from the first source that has one:
+
+| Rank | Source | Notes |
+|---|---|---|
+| 1 | The first EXR's header | The `timeCode` attribute, or `timeCodeString` where the packed one is absent. Read straight off disk — no pixel decode, and no dependency on what AE chose to expose. |
+| 2 | AE's footage metadata | What "New Comp from Selection" would have inherited. |
+| 3 | API `timecodeStart` less `handleFrames` | The convention **Set Start Timecode** uses. Last resort: the API stores the *editorial* in-point, which is a handle-length ahead of the plate by design. |
+
+This is the same ranking the render worker's validation uses (RenderPipeline2
+§8.1a), so a comp is anchored on exactly the value its EXRs are later checked
+against — a shot built from rank 3 and validated against rank 1 is how a
+timecode desync gets into a delivery.
+
+The status line and the diagnostics log both name the rank that was used, e.g.
+`start frame 864108 from EXR timecode 10:00:04:12`. A plate carrying no timecode
+in any rank leaves the comp at `00:00:00:00` and says so.
+
+---
+
+## Render Pipeline
+
+### Queue Export
+
+Saves the project, builds the render manifest from the selected comp and the
+shot record, and submits it to the farm.
+
+| Option | Effect |
+|---|---|
+| **Urgent** | Priority 20 — claimable outside the render window, ahead of normal jobs |
+| **No preview** | Renders the EXRs but builds no preview, inheriting the previous export's MOV, review MP4 and thumbnail |
+| **Keep AEP** | Saves a reduced copy of the project in the export's version folder (see below) |
+
+**No preview** exists for deliverables framed differently from the review —
+unscaled or un-punched-in EXRs. A preview rebuilt from those frames would be
+the wrong picture, while the earlier export's MOV is already correct, so it
+carries over instead. The export still goes through QC, and the delivery
+package still gets a MOV.
+
+Leave it unticked for an ordinary submission: the preview is what QC and the
+client review see.
+
+#### Export AEP (Keep AEP)
+
+With **Keep AEP** ticked (the default, remembered per machine), every export
+keeps a copy of the project it was queued from, so the exact comp behind a
+render can be reopened later:
+
+```
+{version folder}/{shotCode}_cmp_TT_{version}.aep    e.g. .../UNG_102_019_010/v005/UNG_102_019_010_cmp_TT_v005.aep
+```
+
+- The copy is **reduced** to the exported comp and everything it uses (nested
+  comps, footage, solids). Everything else in the project is dropped.
+- Nothing is collected. Plates and EXRs stay where they are and the copy links
+  to them by path, so it stays a few MB.
+- It is saved after the export is submitted, into the same version folder the
+  farm renders into. The worker only reads and clears `*.exr` files there, so
+  the `.aep` is never touched. Re-queuing the same version overwrites it, just
+  as the render overwrites the EXRs.
+- AE can only reduce the open project, so the panel does Save As, Reduce Project,
+  Save, and then **reopens your project**. Your project was saved first and is
+  never changed, but the reopen clears undo. Untick **Keep AEP** to skip it.
+- The copy is the project as it was when you queued. The farm still renders
+  your working AEP, so a save made before the job starts goes into the render
+  but not into the copy.
+- Reduce Project keeps only comps that are used as layers. An expression that
+  points at a comp with `comp("Name")`, where that comp isn't nested anywhere,
+  will break in the copy.
+
+If the copy can't be saved, the export is still queued and the status line says
+`AEP not saved: …` with the reason.
+
+---
+
+## QC
+
+Technical QC on the **rendered EXRs**, not the H.264 preview — the point is
+catching mask slips, export glitches and metadata faults at full resolution.
+QC is per-export: a new export always needs new QC.
+
+| Control | Behaviour |
+|---|---|
+| **Load QC Queue** | Lists every export in `READY_FOR_QC` for the selected project, oldest first. Entries flagged with a warning count had a non-blocking validation warning worth a closer look. |
+| **Open Render** (or double-click) | Imports that export's actual EXR sequence into a `QC_{shot}_{version}` comp at full res and opens it. Re-selecting an already-imported shot just reopens the comp. |
+| **Compare Versions** | Opens the QC comp and stacks earlier versions of the shot under the export, one layer each (`v003`, `v002`…), lined up by EXR timecode (or frame number). Solo a layer to see that version, or set the top layer to **Difference** to see exactly what changed. With more than one earlier version, a dialog lets you untick the ones you don't need. Versions already in the comp are skipped. |
+| **Build QC Review Session** | Lays out the whole project's QC pass in one go. Every shot in the queue gets its `QC_{shot}_{version}` comp, and each scene gets an edit and a contact sheet. See *QC review session* below. |
+| **Notes** | Sent with the decision. Optional on pass; a fail with no notes asks for confirmation, because the artist only sees what you write here. |
+| **QC Pass** | Marks the version **ready for delivery** and nothing else — nothing is shared to the client, no approval state changes, no task moves. |
+| **QC Fail** | Sets the export to `QC_FAILED` and the comp task to **CHANGES**. The artist fixes and queues a new version; the old export is superseded. |
+
+**Where Compare Versions looks:** next to the export's own render folder (resolved
+as for Open Render), in both on-disk layouts. That means farm version folders
+(`{shot}/v002/`, `{shot}/v003/`…) and the older flat folder with
+`{shot}_cmp_TT_{ver}.#####.exr` side by side. Only versions numbered below the
+export's are used. If earlier exports were written under a different root (see
+*More than one on-disk convention*), they won't be found.
+
+### QC review session
+
+**Build QC Review Session** loads the queue for the selected project. A dialog
+lists its scenes. Ctrl-click a scene to leave it out, or untick *Also import
+earlier versions*. Everything is built in one undo step, under
+`QC_SESSION_{project}` in the Project panel:
+
+| Item | What it is |
+|---|---|
+| `{scene}/shots/QC_{shot}_{version}` | One comp per shot, reusing the comp from Open Render if there is one. The export sits on top, earlier versions under it (`v003`, `v002`…), and the shot's plates at the bottom, found as Build Shot finds them. **Only the export and the main plate (the longest) are switched on.** |
+| `{scene}/QC_EDIT_{scene}` | The scene's shot comps as one continuous edit. Each shot is cut to the edit, with the handles the render carries trimmed off, and has a layer marker with its name. |
+| `{scene}/QC_CONTACT_{scene}` | Every shot of the scene in a grid, each starting at its cut in, with its name under it. |
+| `_footage` | The EXR sequences it imported. Plates already in the project are reused, not imported again. |
+
+A scene is the shot record's scene, which is not always the scene in the shot
+code. Episodic shows group by episode too (`UNG_109_SC013`), and standard ones
+by show (`DH2_VFX_SC033`). Shots run in sequence-timecode order when every shot
+in the scene has one, and in shot-code order otherwise. Only the newest queued
+version of a shot gets a comp; older queued versions appear as earlier versions
+in it.
+
+Plates and earlier versions are lined up with the export by EXR timecode. A
+timecode more than a shot's length away is ignored, because a shot's elements
+can carry unrelated camera timecodes. The file frame number is used next, then
+the export's first frame. Exports from before handles were recorded have no
+handle count, so they play in full in the edit, and the status line counts them.
+
+Running the button again adds anything new to the shot comps and rebuilds the
+scene edits and contact sheets from scratch. Don't do your own work in those
+two comps.
+
+**Approving from the session.** QC Pass and QC Fail act on the shot in front of
+you, without finding it in the list:
+
+- the `QC_{shot}_{version}` comp in the viewer, or
+- the shot layer (or its label) selected in a scene edit or contact sheet, or
+- with nothing selected in a scene edit, the shot under the playhead.
+
+The confirmation names the shot, and a fail with notes is confirmed too when it
+came from the viewer. If a scene comp is active and no shot is picked, nothing
+is sent. Pick a shot, or switch to another comp to use the list selection. After
+a decision, that shot's comp and its layers in the scene comps are labelled
+**green** (pass) or **red** (fail).
+
+Passing an export is what makes it eligible for a delivery package on the web
+app's **Pipeline → Deliveries** page.
 
 ---
 
@@ -64,7 +371,7 @@ Updates the **Status** panel to show the current count of selected `CompItem`s.
 ### Fix Comp Names
 Renames selected comps so their names match the shot code extracted from their current name.
 
-- Shot codes follow the pattern `XXX_000_000_000` (e.g. `UNG_106_010_020`).
+- Shot codes are read by anchoring on the selected project's showId — see [Shot Code Convention](#shot-code-convention).
 - If a comp name contains a valid shot code but has extra text, it is trimmed to the code only.
 - Wrapped in an undo group.
 
@@ -160,7 +467,7 @@ Imports a picture-lock (offline cut) video file and trims it to the correct sequ
 
 **Process:**
 1. Calls the API to retrieve `seqTimecodeStart` and `seqTimecodeEnd` for the shot.
-2. Searches the `_PICLOCKS` project folder for already-imported footage matching the episode prefix (first 7 characters of the shot code, e.g. `UNG_106`).
+2. Searches the `_PICLOCKS` project folder for already-imported footage matching the episode prefix — `{showId}_{episode}` on episodic shows (e.g. `UNG_106`), plain `{showId}` on standard ones.
 3. If not found, scans `FOOTAGE_ROOT/_PICLOCKS/` for a file matching `{episodePrefix}_*` and imports it.
 4. Calculates the in/out offsets from the sequence timecodes relative to the piclock's start (assumed `01:00:00:00` / 3590 s unless embedded timecode is available), with **±8 frame handles**.
 5. Adds the piclock footage as a layer at the top of the comp, scales it to fill the frame, and sets `startTime`, `inPoint`, and `outPoint` to isolate the correct range.
@@ -172,17 +479,37 @@ Imports a picture-lock (offline cut) video file and trims it to the correct sequ
 
 ## Workspace
 
+### Per-project templates
+
+Each show has its own template AEP — its overlay, slate/export template and,
+most importantly, its **show LUT**. These are configured per project on the web
+app under **Project → Settings → Pipeline**, not in the panel, because the
+render farm's headless preview build reads the same values: if the two
+disagreed, a farm preview would be quietly the wrong colour.
+
+| Setting | Purpose |
+|---|---|
+| **Template project (.aep)** | Imported by Initialise Workspace and by every headless preview build |
+| **Renders root** | Where per-shot pre-renders live; the panel appends the shot code (Import Renders) |
+| **Overlay / Slate / LUT comp** | Only needed when a template departs from the naming convention |
+
+Comp names default to a convention derived from the show ID:
+`{showId}_VFX_OVERLAY`, `{showId}_EXPORT_TEMPLATE`, `_SHOW LUT`. A show whose
+template follows the pattern needs no comp configuration at all — leave the
+fields blank and they follow the convention, including any later change to it.
+
 ### Initialise Workspace
 One-time setup that creates the standard project folder hierarchy, imports the slate/overlay template AEP, and configures color settings.
 
+Works for any project: the episode folders and the template both come from the
+selected project rather than being fixed to one show.
+
 **Folder structure created:**
 
 ```
 __SHOTS/
-  UNG_101/
+  {EPISODE_CODE}/     ← one per episode, from the project's episode list
-  UNG_102/
+  …                     (episodic shows only; standard shows get none)
-  …
-  UNG_117/
 _PREVIEWS/
 _PRECOMPS/
 _PICLOCKS/
@@ -192,8 +519,15 @@ _RENDERS/
 _UTILITIES/
 ```
 
+Episodes come from `GET /api/ext/projects/{code}/episodes`. If a show has none
+entered yet, the folders found under its footage root are used instead, so the
+button still does something useful on day one.
+
 **Template import:**
-Imports `X:/shared_projects_2026/UNGO_VFX/production/working_files/UNG_VFXOVERLAY_SLATE_TEMPLATE.aep` as a project merge.
+Imports the project's **Template project (.aep)** as a project merge — see
+[Per-project templates](#per-project-templates). If none is configured the
+folders and colour settings are still applied, and the status line says the
+template was not set.
 
 **Color settings (applied outside the undo group):**
 - Sets project bit depth to **32-bit**.
@@ -246,15 +580,19 @@ Accept: application/json
 
 ## Shot Code Convention
 
-Shot codes follow the pattern `AAA_NNN_NNN_NNN` where:
+Shot codes are the project's **showId** followed by three-digit tokens:
-- `AAA` = three-letter show prefix (e.g. `UNG`)
-- First `NNN` = episode number (e.g. `106`)
-- Second `NNN` = sequence number (e.g. `010`)
-- Third `NNN` = shot number (e.g. `020`)
 
-Example: `UNG_106_010_020`
+| Project type | Pattern | Example |
+|---|---|---|
+| Episodic | `{showId}_{episode}_{scene}_{shot}` | `UNG_106_010_020` (showId `UNG`) |
+| Standard | `{showId}_{scene}_{shot}` | `DH2_VFX_027_010` (showId `DH2_VFX`) |
 
-Episode codes follow the pattern `AAA_NNN` (e.g. `UNG_106`).
+The showId is **not** always three letters and may itself contain underscores, so
+codes are parsed by stripping the known showId prefix — never by counting
+underscores or matching a fixed `AAA_` pattern. Everything after the showId is
+three digits per token.
+
+Episode codes follow `{showId}_{episode}` (e.g. `UNG_106`).
 
 ---
 
@@ -296,3 +634,83 @@ The **Status** panel at the bottom of the UI shows two lines:
 - **Line 2** — Result or progress message from the last operation.
 
 Both lines are updated throughout batch operations so progress is visible in real time.
+
+Below them are two buttons:
+
+- **Diagnostics** — runs the environment self-test described below.
+- **Show Last Report** — re-opens the trace from the last button pressed.
+
+---
+
+## Versions
+
+The panel's version is the `PANEL_VERSION` constant at the top of
+`VFXReviewConnector.jsx`. It appears in the panel title, in every diagnostics
+report, and is sent to the server when the panel loads.
+
+**Pipeline → Machines → Deployed tool versions** then shows which version each
+workstation is running, alongside the render workers. Anything behind the newest
+version seen for that tool is flagged `→ rebuild to vX` — so updating one
+machine is what surfaces the ones still to do. No expected-version list to keep
+in sync; the newest thing reporting in is the benchmark.
+
+**Bump `PANEL_VERSION` whenever you copy the .jsx to a workstation.** If two
+machines report the same version but behave differently, one of them was copied
+without the bump.
+
+---
+
+## Diagnostics and logging
+
+Every button press is traced: what it tried, in what order, with the paths and
+HTTP codes it was working with. The trace goes to an in-memory buffer and to a
+log file, and it is shown automatically when something fails.
+
+**Log file:** `%APPDATA%/VFXReviewConnector/connector.log` (next to `config.json`).
+It is truncated once it passes 1 MB, so it can always be pasted into a message.
+The API token is never written to it — only whether one is set.
+
+### When Build Shot fails
+
+The status line now names the stage it failed at, and a scrollable report opens
+with the whole trace. The stages, and what each one means:
+
+| Stage | Meaning | Usual fix |
+|---|---|---|
+| `project` | No project selected in the panel | The project dropdown is empty because the server URL or token is wrong |
+| `shot lookup` | The server returned no shot record | Report shows the HTTP code: `0` = server unreachable, `401/403` = bad token, `404` = shot not in that project |
+| `configuration` | Footage Root is blank in Settings | Settings are **per-machine**; a fresh workstation starts blank |
+| `footage folder` | The show/episode folder does not exist here | Report names the deepest folder that *does* exist — usually an unmapped drive or a different drive letter/UNC on that machine |
+| `plate folders` | Folder exists, no plates for that shot code | Report lists the folders that *are* there, so a naming mismatch is visible |
+| `plate import` | Plate folders matched but held no importable EXRs | Report lists each folder's contents (`n .exr, n other files`) |
+| `comp creation` | After Effects threw while building the comps | Not a path or server problem — the AE error text is in the report |
+| `unexpected error` | Anything thrown that was not anticipated | Report carries the error text, line number and stack |
+
+Non-fatal conditions are traced too rather than passing silently: a missing
+`_SHOW LUT`, an overlay that could not be applied, a missing `__SHOTS/{group}`
+folder.
+
+### Diagnostics button
+
+Checks everything Build Shot depends on **without building anything**, so a
+workstation can be cleared before an artist is blocked. It verifies:
+
+1. `curl.exe` is present and runnable (every server call goes through it).
+2. Server URL and API token are set, and `GET /api/ext/projects` succeeds.
+3. Footage Root resolves to a folder that exists, and lists the plate folders
+   found for the currently selected shot.
+4. Export Root resolves to a folder that exists.
+5. The shot lookup succeeds for the currently selected shot.
+6. The open AE project has `UNG_VFX_OVERLAY`, `UNG_EXPORT_TEMPLATE`,
+   `_SHOW LUT`, and the `__SHOTS` / `_FOOTAGE_4K` / `_PRECOMPS` / `_PREVIEWS`
+   folders.
+
+Each failure is reported as a `PROBLEM` line with the offending path or HTTP
+response, and the report ends with a problem count.
+
+### Errors that used to be invisible
+
+ScriptUI silently swallows exceptions thrown inside a button handler, so a hard
+failure looked like a button that did nothing at all. Every handler is now
+wrapped: anything thrown is caught, logged with its line number and stack, shown
+in the status line, and surfaced in the report dialog.

actions/annotations.ts

@@ -14,7 +14,7 @@ const saveAnnotationSchema = z.object({
     shapes: z.array(z.any()),
     canvasWidth: z.number(),
     canvasHeight: z.number(),
-    version: z.literal("1.0"),
+    version: z.enum(["1.0", "2.0"]),
   }),
   color: z.string().default("#ef4444"),
 });

actions/approvals.ts

@@ -5,7 +5,7 @@ import { db } from "@/lib/db";
 import { revalidatePath } from "next/cache";
 import { z } from "zod";
 import { ApprovalStatus } from "@prisma/client";
-import { recalcShotStatus } from "@/lib/shot-status";
+import { recalcShotStatus, clearStaleShotApproval } from "@/lib/shot-status";
 import { notifyApprovalChange } from "@/lib/notifications";
 import { slackNotifyApproval } from "@/lib/slack";
 import { versionLabel } from "@/lib/utils";
@@ -29,8 +29,11 @@ export async function submitApproval(data: z.infer<typeof approvalSchema>) {
     throw new Error("Insufficient permissions to review versions");
   }
 
-  // Create the approval record
+  // The verdict, the version, the task and the derived shot status are one
-  const approval = await db.approval.create({
+  // decision and are written as one: a failure partway through used to leave the
+  // three layers disagreeing, with no way to tell which one was right.
+  const { approval, version } = await db.$transaction(async (tx) => {
+    const approval = await tx.approval.create({
       data: {
         versionId: parsed.versionId,
         userId: session.user.id,
@@ -39,14 +42,13 @@ export async function submitApproval(data: z.infer<typeof approvalSchema>) {
       },
     });
 
-  // Update version approval status
+    await tx.version.update({
-  await db.version.update({
       where: { id: parsed.versionId },
       data: { approvalStatus: parsed.status },
     });
 
     // Load version + task + shot + project for downstream effects
-  const version = await db.version.findUnique({
+    const version = await tx.version.findUnique({
       where: { id: parsed.versionId },
       include: {
         task: {
@@ -63,12 +65,12 @@ export async function submitApproval(data: z.infer<typeof approvalSchema>) {
     // Update task status based on approval result
     if (version.task && parsed.status !== "PENDING_REVIEW") {
       if (parsed.status === "APPROVED") {
-      await db.task.update({
+        await tx.task.update({
           where: { id: version.task.id },
           data: { status: "DONE" },
         });
       } else if (parsed.status === "REJECTED" || parsed.status === "NEEDS_CHANGES") {
-      await db.task.update({
+        await tx.task.update({
           where: { id: version.task.id },
           data: { status: "CHANGES" },
         });
@@ -76,10 +78,13 @@ export async function submitApproval(data: z.infer<typeof approvalSchema>) {
 
       // Recalculate shot status from updated task states
       if (version.task.shot) {
-      await recalcShotStatus(version.task.shot.id).catch(() => {});
+        await recalcShotStatus(version.task.shot.id, tx);
       }
     }
 
+    return { approval, version };
+  });
+
   // Notifications
   const reviewer = await db.user.findUnique({ where: { id: session.user.id } });
   const reviewerName = reviewer?.name ?? "Reviewer";
@@ -166,8 +171,10 @@ export async function unapproveVersion(versionId: string) {
     throw new Error("Only approved versions can be unapproved");
   }
 
+  // One decision, one write — same reasoning as submitApproval.
+  await db.$transaction(async (tx) => {
     // Create an audit record for the unapproval
-  await db.approval.create({
+    await tx.approval.create({
       data: {
         versionId,
         userId: session.user.id,
@@ -177,23 +184,26 @@ export async function unapproveVersion(versionId: string) {
     });
 
     // Reset version approval status
-  await db.version.update({
+    await tx.version.update({
       where: { id: versionId },
       data: { approvalStatus: "PENDING_REVIEW" },
     });
 
     // Reset task back to INTERNAL_REVIEW if it was moved to DONE
     if (version.task && version.task.status === "DONE") {
-    await db.task.update({
+      await tx.task.update({
         where: { id: version.task.id },
         data: { status: "INTERNAL_REVIEW" },
       });
     }
 
-  // Recalculate shot status
+    // Undoing a version approval also invalidates any shot-level sign-off that
+    // rested on it, otherwise the shot keeps reading COMPLETE / READY_FOR_CLIENT.
     if (version.task?.shot) {
-    await recalcShotStatus(version.task.shot.id).catch(() => {});
+      await clearStaleShotApproval(tx, version.task.shot.id);
+      await recalcShotStatus(version.task.shot.id, tx);
     }
+  });
 
   revalidatePath(`/review/${versionId}`);
   if (version.task) {

actions/board.ts

@@ -0,0 +1,196 @@
+"use server";
+
+import { auth } from "@/auth";
+import { db } from "@/lib/db";
+import { revalidatePath } from "next/cache";
+import { z } from "zod";
+import { findShot, parseBoardText } from "@/lib/board-parse";
+
+// The board is studio-internal. Anyone on staff can add and tick off lines;
+// it is a shared to-do list, not an approval surface.
+async function requireStaff() {
+  const session = await auth();
+  if (!session?.user) throw new Error("Unauthorized");
+  if (session.user.role === "CLIENT") throw new Error("Insufficient permissions");
+  return session.user;
+}
+
+async function boardContext(projectId: string) {
+  const [shots, users] = await Promise.all([
+    db.shot.findMany({
+      where: { projectId },
+      select: { id: true, shotCode: true, clientCode: true },
+    }),
+    db.user.findMany({
+      where: { isActive: true, role: { not: "CLIENT" } },
+      select: { id: true, name: true, email: true },
+    }),
+  ]);
+  return { shots, users };
+}
+
+const addSchema = z.object({
+  projectId: z.string().cuid(),
+  input: z.string().min(1).max(20000),
+  group: z.string().max(100).optional(),
+});
+
+/** Adds one line, or a pasted block of lines, to a project's board. */
+export async function addBoardItems(data: z.infer<typeof addSchema>) {
+  const user = await requireStaff();
+  const parsed = addSchema.parse(data);
+
+  const items = parseBoardText(parsed.input, {
+    ...(await boardContext(parsed.projectId)),
+    group: parsed.group,
+  });
+  if (items.length === 0) return { success: true, added: 0, unmatched: [] as string[] };
+
+  const last = await db.boardItem.findFirst({
+    where: { projectId: parsed.projectId },
+    orderBy: { sortOrder: "desc" },
+    select: { sortOrder: true },
+  });
+  const base = (last?.sortOrder ?? -1) + 1;
+
+  await db.boardItem.createMany({
+    data: items.map((item, i) => ({
+      projectId: parsed.projectId,
+      shotId: item.shotId,
+      code: item.code,
+      text: item.text,
+      group: item.group,
+      assigneeId: item.assigneeId,
+      waitingOn: item.waitingOn,
+      sortOrder: base + i,
+      createdById: user.id,
+    })),
+  });
+
+  revalidatePath("/board");
+  return {
+    success: true,
+    added: items.length,
+    unmatched: items.filter((i) => i.code && !i.shotId).map((i) => i.code as string),
+  };
+}
+
+const updateSchema = z.object({
+  text: z.string().max(5000).optional(),
+  code: z.string().max(100).nullable().optional(),
+  group: z.string().max(100).optional(),
+  assigneeId: z.string().cuid().nullable().optional(),
+  waitingOn: z.string().max(500).nullable().optional(),
+});
+
+export async function updateBoardItem(id: string, data: z.infer<typeof updateSchema>) {
+  await requireStaff();
+  const parsed = updateSchema.parse(data);
+  const item = await db.boardItem.findUnique({ where: { id }, select: { projectId: true } });
+  if (!item) throw new Error("Board item not found");
+
+  // Changing the code re-links the line; a code that matches nothing is kept
+  // as a flag, exactly as when it was first typed.
+  let link: { code: string | null; shotId: string | null } | undefined;
+  if (parsed.code !== undefined) {
+    const code = parsed.code?.trim() || null;
+    const shot = code ? findShot(code, (await boardContext(item.projectId)).shots) : null;
+    link = { code: shot?.shotCode ?? code?.toUpperCase() ?? null, shotId: shot?.id ?? null };
+  }
+
+  await db.boardItem.update({
+    where: { id },
+    data: {
+      ...(parsed.text !== undefined && { text: parsed.text.trim() }),
+      ...(parsed.group !== undefined && { group: parsed.group.trim() }),
+      ...(parsed.assigneeId !== undefined && { assigneeId: parsed.assigneeId }),
+      ...(parsed.waitingOn !== undefined && { waitingOn: parsed.waitingOn?.trim() || null }),
+      ...link,
+    },
+  });
+
+  revalidatePath("/board");
+  return { success: true };
+}
+
+export async function setBoardItemDone(id: string, done: boolean) {
+  const user = await requireStaff();
+  const item = await db.boardItem.update({
+    where: { id },
+    data: done ? { doneAt: new Date(), doneById: user.id } : { doneAt: null, doneById: null },
+    select: { commentId: true },
+  });
+  // A line from pasted feedback is that client note: ticking it off resolves
+  // the comment in the player too. (The comment may have been deleted there.)
+  if (item.commentId) {
+    const comment = await db.comment.updateMany({
+      where: { id: item.commentId },
+      data: { isResolved: done },
+    });
+    if (comment.count) {
+      const c = await db.comment.findUnique({ where: { id: item.commentId }, select: { versionId: true } });
+      if (c) revalidatePath(`/review/${c.versionId}`);
+    }
+  }
+  revalidatePath("/board");
+  return { success: true };
+}
+
+export async function deleteBoardItem(id: string) {
+  await requireStaff();
+  await db.boardItem.delete({ where: { id } });
+  revalidatePath("/board");
+  return { success: true };
+}
+
+const statusSchema = z.object({
+  projectId: z.string().cuid(),
+  status: z.string().max(2000),
+});
+
+export async function setProjectBoardStatus(data: z.infer<typeof statusSchema>) {
+  await requireStaff();
+  const parsed = statusSchema.parse(data);
+  const status = parsed.status.trim() || null;
+  await db.project.update({
+    where: { id: parsed.projectId },
+    data: { boardStatus: status, boardStatusAt: status ? new Date() : null },
+  });
+  revalidatePath("/board");
+  return { success: true };
+}
+
+const milestoneSchema = z.object({
+  projectId: z.string().cuid(),
+  label: z.string().min(1).max(200),
+  date: z.string().min(1),
+});
+
+export async function addMilestone(data: z.infer<typeof milestoneSchema>) {
+  await requireStaff();
+  const parsed = milestoneSchema.parse(data);
+  const date = new Date(parsed.date);
+  if (isNaN(date.getTime())) throw new Error("Invalid date");
+  await db.projectMilestone.create({
+    data: { projectId: parsed.projectId, label: parsed.label.trim(), date },
+  });
+  revalidatePath("/board");
+  return { success: true };
+}
+
+export async function setMilestoneDone(id: string, done: boolean) {
+  await requireStaff();
+  await db.projectMilestone.update({
+    where: { id },
+    data: { doneAt: done ? new Date() : null },
+  });
+  revalidatePath("/board");
+  return { success: true };
+}
+
+export async function deleteMilestone(id: string) {
+  await requireStaff();
+  await db.projectMilestone.delete({ where: { id } });
+  revalidatePath("/board");
+  return { success: true };
+}

actions/deliveries.ts

@@ -0,0 +1,43 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+import { requirePipelineAdmin } from "@/lib/render-pipeline/session-auth";
+import { PipelineError } from "@/lib/render-pipeline/errors";
+import {
+  createMovReviewPackage,
+  previewMovReviewPackage,
+} from "@/lib/render-pipeline/reviews";
+
+/**
+ * Server actions behind "Build MOV Review Package" on the shot-status page
+ * (RenderPipeline2 §11.6). The heavy lifting lives in lib/render-pipeline;
+ * these only carry the session and turn service errors into messages a toast
+ * can show.
+ */
+
+function message(err: unknown): string {
+  if (err instanceof PipelineError) return err.message;
+  return err instanceof Error ? err.message : "Unknown error";
+}
+
+/** What the confirm dialog shows: the folder, the resolved versions, the gaps. */
+export async function previewMovReview(shotIds: string[]) {
+  try {
+    await requirePipelineAdmin();
+    const preview = await previewMovReviewPackage(shotIds);
+    return { ok: true as const, ...preview };
+  } catch (err) {
+    return { ok: false as const, error: message(err) };
+  }
+}
+
+export async function buildMovReview(shotIds: string[]) {
+  try {
+    const user = await requirePipelineAdmin();
+    const result = await createMovReviewPackage({ shotIds }, user.id);
+    revalidatePath("/pipeline/deliveries");
+    return { ok: true as const, ...result };
+  } catch (err) {
+    return { ok: false as const, error: message(err) };
+  }
+}

actions/feedback.ts

@@ -0,0 +1,253 @@
+"use server";
+
+import { auth } from "@/auth";
+import { db } from "@/lib/db";
+import { revalidatePath } from "next/cache";
+import { z } from "zod";
+import { findShot, suggestShot, type BoardShot } from "@/lib/board-parse";
+import { parseFeedback, slateFrames, toPlayerFrame } from "@/lib/feedback-parse";
+import { updateTaskStatus } from "@/actions/tasks";
+
+/** Comment.source for notes pasted from a client message */
+const SOURCE = "WHATSAPP";
+
+async function requireStaff() {
+  const session = await auth();
+  if (!session?.user) throw new Error("Unauthorized");
+  if (session.user.role === "CLIENT") throw new Error("Insufficient permissions");
+  return session.user;
+}
+
+/**
+ * The shot a pasted code means: exact code or client alias first, then a code
+ * the client shortened by dropping the show prefix ("113_018_040" for
+ * "UNG_113_018_040") when exactly one shot ends with it.
+ */
+function resolveShot<T extends BoardShot>(code: string, shots: T[]): T | null {
+  const exact = findShot(code, shots) as T | null;
+  if (exact) return exact;
+  const tail = `_${code.toUpperCase()}`;
+  const hits = shots.filter((s) => s.shotCode.toUpperCase().endsWith(tail));
+  return hits.length === 1 ? hits[0] : null;
+}
+
+export interface FeedbackVersionOption {
+  id: string;
+  label: string;
+  sent: boolean;
+  sharedAt: string | null;
+  taskId: string | null;
+  taskStatus: string | null;
+  /** The note's quoted frame converted for this version's media; null = no frame quoted */
+  playerFrame: number | null;
+  fromComp: boolean;
+}
+
+export interface FeedbackPreviewNote {
+  key: string;
+  code: string;
+  text: string;
+  quotedFrame: number | null;
+  shot: { id: string; shotCode: string } | null;
+  suggestion: string | null;
+  versions: FeedbackVersionOption[];
+  defaultVersionId: string | null;
+}
+
+export interface FeedbackPreview {
+  rounds: { title: string; dueText: string | null; notes: FeedbackPreviewNote[] }[];
+  ignored: string[];
+}
+
+export async function previewFeedback(projectId: string, input: string): Promise<FeedbackPreview> {
+  await requireStaff();
+  z.string().cuid().parse(projectId);
+  const parsed = parseFeedback(z.string().max(50000).parse(input));
+
+  const shots = await db.shot.findMany({
+    where: { projectId },
+    select: { id: true, shotCode: true, clientCode: true, frameStart: true },
+  });
+
+  const matched = new Map<string, (typeof shots)[number] | null>();
+  for (const r of parsed.rounds) for (const n of r.notes) {
+    const code = n.codes[0];
+    if (!matched.has(code)) matched.set(code, resolveShot(code, shots));
+  }
+  const shotIds = [...new Set([...matched.values()].filter(Boolean).map((s) => s!.id))];
+
+  // Recent versions per shot, whether hung off the shot or its task
+  const versions = shotIds.length
+    ? await db.version.findMany({
+        where: { OR: [{ shotId: { in: shotIds } }, { task: { shotId: { in: shotIds } } }] },
+        orderBy: { createdAt: "desc" },
+        select: {
+          id: true,
+          versionNumber: true,
+          shotId: true,
+          isClientVisible: true,
+          sharedAt: true,
+          frameCount: true,
+          pictureStartFrame: true,
+          task: { select: { id: true, status: true, shotId: true } },
+        },
+      })
+    : [];
+  const byShot = new Map<string, typeof versions>();
+  for (const v of versions) {
+    const sid = v.shotId ?? v.task?.shotId;
+    if (!sid) continue;
+    const list = byShot.get(sid) ?? [];
+    if (list.length < 6) list.push(v);
+    byShot.set(sid, list);
+  }
+
+  let k = 0;
+  return {
+    ignored: parsed.ignored,
+    rounds: parsed.rounds.map((r) => ({
+      title: r.title,
+      dueText: r.dueText,
+      notes: r.notes.map((n) => {
+        const code = n.codes[0];
+        const shot = matched.get(code) ?? null;
+        const options: FeedbackVersionOption[] = (shot ? byShot.get(shot.id) ?? [] : []).map((v) => {
+          const conv = n.frame != null
+            ? toPlayerFrame(n.frame, {
+                shotFrameStart: shot!.frameStart,
+                pictureStart: slateFrames(v),
+                frameCount: v.frameCount,
+              })
+            : null;
+          return {
+            id: v.id,
+            label: `v${String(v.versionNumber).padStart(3, "0")}`,
+            sent: v.isClientVisible,
+            sharedAt: v.sharedAt?.toISOString() ?? null,
+            taskId: v.task?.id ?? null,
+            taskStatus: v.task?.status ?? null,
+            playerFrame: conv?.frame ?? null,
+            fromComp: conv?.fromComp ?? false,
+          };
+        });
+        // The client is commenting on what they were sent
+        const def = options.find((o) => o.sent) ?? options[0] ?? null;
+        return {
+          key: `n${k++}`,
+          code: shot?.shotCode ?? code,
+          text: n.text,
+          quotedFrame: n.frame,
+          shot: shot ? { id: shot.id, shotCode: shot.shotCode } : null,
+          suggestion: shot ? null : suggestShot(code, shots)?.shotCode ?? null,
+          versions: options,
+          defaultVersionId: def?.id ?? null,
+        };
+      }),
+    })),
+  };
+}
+
+const commitSchema = z.object({
+  projectId: z.string().cuid(),
+  rounds: z.array(z.object({
+    title: z.string().max(200),
+    dueAt: z.string().datetime().nullable(),
+    notes: z.array(z.object({
+      code: z.string().min(1).max(100),
+      shotId: z.string().cuid().nullable(),
+      text: z.string().min(1).max(5000),
+      versionId: z.string().cuid().nullable(),
+      frame: z.number().int().min(0).nullable(),
+      setChanges: z.boolean(),
+    })).min(1),
+  })).min(1),
+});
+
+/**
+ * Saves pasted client feedback: one FeedbackRound per round, each note as a
+ * player comment (tagged as client feedback) and a board line, and — where
+ * ticked — the version's task moved to Changes.
+ */
+export async function commitFeedback(data: z.infer<typeof commitSchema>) {
+  const user = await requireStaff();
+  const parsed = commitSchema.parse(data);
+
+  const notes = parsed.rounds.flatMap((r) => r.notes);
+  const versionIds = [...new Set(notes.map((n) => n.versionId).filter(Boolean) as string[])];
+  const versions = await db.version.findMany({
+    where: { id: { in: versionIds } },
+    select: { id: true, fps: true, shotId: true, task: { select: { id: true, shotId: true, status: true, projectId: true } }, shot: { select: { projectId: true } } },
+  });
+  const vById = new Map(versions.map((v) => [v.id, v]));
+  for (const n of notes) {
+    if (!n.versionId) continue;
+    const v = vById.get(n.versionId);
+    const projectOk = v && (v.shot?.projectId ?? v.task?.projectId) === parsed.projectId;
+    const shotOk = v && (v.shotId ?? v.task?.shotId) === n.shotId;
+    if (!projectOk || !shotOk) throw new Error(`Version does not belong to ${n.code}`);
+  }
+
+  const last = await db.boardItem.findFirst({
+    where: { projectId: parsed.projectId },
+    orderBy: { sortOrder: "desc" },
+    select: { sortOrder: true },
+  });
+  let sort = (last?.sortOrder ?? -1) + 1;
+
+  let comments = 0;
+  await db.$transaction(async (tx) => {
+    for (const r of parsed.rounds) {
+      const round = await tx.feedbackRound.create({
+        data: {
+          projectId: parsed.projectId,
+          title: r.title.trim() || "Client feedback",
+          dueAt: r.dueAt ? new Date(r.dueAt) : null,
+          createdById: user.id,
+        },
+      });
+      for (const n of r.notes) {
+        const v = n.versionId ? vById.get(n.versionId)! : null;
+        const frame = n.frame ?? 0;
+        const comment = v
+          ? await tx.comment.create({
+              data: {
+                versionId: v.id,
+                authorId: user.id,
+                frameNumber: frame,
+                timestamp: frame / v.fps,
+                text: n.text.trim(),
+                source: SOURCE,
+              },
+              select: { id: true },
+            })
+          : null;
+        if (comment) comments++;
+        await tx.boardItem.create({
+          data: {
+            projectId: parsed.projectId,
+            shotId: n.shotId,
+            code: n.code.toUpperCase(),
+            text: n.text.trim(),
+            roundId: round.id,
+            commentId: comment?.id ?? null,
+            sortOrder: sort++,
+            createdById: user.id,
+          },
+        });
+      }
+    }
+  });
+
+  // Outside the transaction: updateTaskStatus notifies the artist and
+  // recalculates shot status, exactly as moving the task by hand does.
+  const tasks = new Set<string>();
+  for (const n of notes) {
+    const task = n.versionId ? vById.get(n.versionId)?.task : null;
+    if (n.setChanges && task && task.status !== "CHANGES") tasks.add(task.id);
+  }
+  for (const taskId of tasks) await updateTaskStatus(taskId, "CHANGES");
+
+  for (const id of versionIds) revalidatePath(`/review/${id}`);
+  revalidatePath("/board");
+  return { success: true, notes: notes.length, comments, tasksChanged: tasks.size };
+}

actions/projects.ts

@@ -4,7 +4,8 @@ import { auth } from "@/auth";
 import { db } from "@/lib/db";
 import { revalidatePath } from "next/cache";
 import { z } from "zod";
-import { ProjectStatus } from "@prisma/client";
+import { Prisma, ProjectStatus } from "@prisma/client";
+import { pipelineConfigSchema } from "@/lib/render-pipeline/project-templates";
 
 const createProjectSchema = z.object({
   name: z.string().min(1).max(100),
@@ -76,6 +77,8 @@ const updateProjectSchema = z.object({
   startDate: z.string().optional().nullable(),
   slackWebhook: z.string().url().optional().or(z.literal("")).nullable(),
   slackChannel: z.string().optional().nullable(),
+  /** Per-production AE workspace: template AEP, renders root, comp overrides. */
+  pipelineConfig: pipelineConfigSchema.optional().nullable(),
 });
 
 export async function updateProject(data: z.infer<typeof updateProjectSchema>) {
@@ -103,6 +106,19 @@ export async function updateProject(data: z.infer<typeof updateProjectSchema>) {
       ...(rest.startDate !== undefined && { startDate: rest.startDate ? new Date(rest.startDate) : null }),
       ...(rest.slackWebhook !== undefined && { slackWebhook: rest.slackWebhook || null }),
       ...(rest.slackChannel !== undefined && { slackChannel: rest.slackChannel || null }),
+      // Blank fields are dropped rather than stored as empty strings, so a comp
+      // name left blank keeps following the convention instead of pinning "".
+      // Booleans are kept as-is: `false` is a meaningful stored value, and the
+      // blank-string test would otherwise discard every non-string setting.
+      ...(rest.pipelineConfig !== undefined && {
+        pipelineConfig: rest.pipelineConfig
+          ? (Object.fromEntries(
+              Object.entries(rest.pipelineConfig).filter(([, v]) =>
+                typeof v === "boolean" ? true : typeof v === "string" && !!v.trim()
+              )
+            ) as Prisma.InputJsonValue)
+          : Prisma.DbNull,
+      }),
     },
   });
 

actions/shots.ts

@@ -4,8 +4,9 @@ import { auth } from "@/auth";
 import { db } from "@/lib/db";
 import { revalidatePath } from "next/cache";
 import { z } from "zod";
-import { ShotStatus, ShotPriority, ShotApprovalStatus } from "@prisma/client";
+import { ShotStatus, ShotPriority, ShotApprovalStatus, Prisma } from "@prisma/client";
-import { recalcShotStatus } from "@/lib/shot-status";
+import { recalcShotStatus, markShotForRevisions } from "@/lib/shot-status";
+import { countShotsOnOpenRequests } from "@/lib/render-pipeline/delivery-requests";
 
 const createShotSchema = z.object({
   scene: z.string().min(1).max(50).regex(/^[A-Z0-9_]+$/i, "Alphanumeric and underscore only"),
@@ -341,6 +342,15 @@ export async function importShotsFromCsv(
   return { success: true, created, errors };
 }
 
+/**
+ * Manual override of the shot's status.
+ *
+ * Deliberately the one place that writes Shot.status without deriving it — but
+ * note the override is transient: Shot.status is a derived field, so the next
+ * recalc (any task move, approval, upload or render) recomputes it from the
+ * tasks and approval flags and discards whatever was set here. Change the
+ * underlying task states if the new status needs to stick.
+ */
 export async function updateShotStatus(
   shotId: string,
   status: ShotStatus
@@ -489,6 +499,42 @@ export async function updateShotNotes(shotId: string, notes: string) {
   return { success: true };
 }
 
+// ── Update Shot Slate Fields ──────────────────────────────────────────────────
+
+export async function updateShotSlate(
+  shotId: string,
+  data: {
+    slateType?: string | null;
+    slateDescription?: string | null;
+    slateVfxScope?: string | null;
+    slateSubmissionNote?: string | null;
+    clientCode?: string | null;
+  }
+) {
+  const session = await auth();
+  if (!session?.user) throw new Error("Unauthorized");
+  if (!["ADMIN", "PRODUCER", "SUPERVISOR"].includes(session.user.role)) {
+    throw new Error("Insufficient permissions");
+  }
+
+  const shot = await db.shot.findUnique({ where: { id: shotId }, select: { projectId: true } });
+  if (!shot) throw new Error("Shot not found");
+
+  await db.shot.update({
+    where: { id: shotId },
+    data: {
+      slateType:           data.slateType           !== undefined ? (data.slateType?.trim()           || null) : undefined,
+      slateDescription:    data.slateDescription    !== undefined ? (data.slateDescription?.trim()    || null) : undefined,
+      slateVfxScope:       data.slateVfxScope       !== undefined ? (data.slateVfxScope?.trim()       || null) : undefined,
+      slateSubmissionNote: data.slateSubmissionNote !== undefined ? (data.slateSubmissionNote?.trim() || null) : undefined,
+      clientCode:          data.clientCode          !== undefined ? (data.clientCode?.trim()          || null) : undefined,
+    },
+  });
+
+  revalidatePath(`/projects/${shot.projectId}`);
+  return { success: true };
+}
+
 // ── Toggle Key Shot ───────────────────────────────────────────────────────────
 
 export async function toggleKeyShot(shotId: string, isKeyShot: boolean) {
@@ -514,6 +560,34 @@ export async function toggleKeyShot(shotId: string, isKeyShot: boolean) {
   return { success: true };
 }
 
+/**
+ * Scaled in the edit: the plate is not used at its native size, which changes
+ * how the shot is comped and reviewed. Same shape as toggleKeyShot — a standing
+ * property of the shot, flipped from the shot-status board.
+ */
+export async function toggleScaledShot(shotId: string, isScaled: boolean) {
+  const session = await auth();
+  if (!session?.user) throw new Error("Unauthorized");
+  if (!["ADMIN", "PRODUCER", "SUPERVISOR"].includes(session.user.role)) {
+    throw new Error("Insufficient permissions");
+  }
+
+  const shot = await db.shot.findUnique({
+    where: { id: shotId },
+    select: { projectId: true },
+  });
+  if (!shot) throw new Error("Shot not found");
+
+  await db.shot.update({
+    where: { id: shotId },
+    data: { isScaled },
+  });
+
+  revalidatePath(`/projects/${shot.projectId}`);
+  revalidatePath(`/shot-status`);
+  return { success: true };
+}
+
 export async function deleteShot(shotId: string) {
   const session = await auth();
   if (!session?.user) throw new Error("Unauthorized");
@@ -579,6 +653,203 @@ export async function bulkUpdateDueDates(
   return { success: true, updated: shots.length };
 }
 
+// ── Bulk Assign Artist ────────────────────────────────────────────────────────
+
+/**
+ * Point a selection of shots at one artist, or clear the assignment when
+ * `artistId` is null. Mirrors the single-shot artist field in updateShot —
+ * the assignment is a plain column write with no notification, so reassigning
+ * a batch during planning stays quiet.
+ */
+export async function bulkAssignArtist(shotIds: string[], artistId: string | null) {
+  const session = await auth();
+  if (!session?.user) throw new Error("Unauthorized");
+  if (!["ADMIN", "PRODUCER", "SUPERVISOR"].includes(session.user.role)) {
+    throw new Error("Insufficient permissions");
+  }
+
+  const ids = z.array(z.string().cuid()).parse(shotIds);
+  if (!ids.length) return { success: true, updated: 0, artistName: null as string | null };
+
+  let artistName: string | null = null;
+  if (artistId) {
+    const artist = await db.user.findUnique({
+      where: { id: z.string().cuid().parse(artistId) },
+      select: { id: true, name: true, email: true, role: true, isActive: true },
+    });
+    // A deactivated user or a client account must never end up owning a shot,
+    // so this is checked here rather than trusting whatever the picker sent.
+    if (!artist || !artist.isActive || artist.role === "CLIENT") {
+      throw new Error("That user cannot be assigned shots");
+    }
+    artistName = artist.name ?? artist.email;
+  }
+
+  const shots = await db.shot.findMany({
+    where: { id: { in: ids } },
+    select: { id: true, projectId: true },
+  });
+  if (shots.length !== ids.length) throw new Error("Some shots not found");
+
+  await db.shot.updateMany({
+    where: { id: { in: ids } },
+    data: { artistId },
+  });
+
+  for (const pid of [...new Set(shots.map((s) => s.projectId))]) {
+    revalidatePath(`/projects/${pid}`);
+  }
+  revalidatePath(`/shot-status`);
+
+  return { success: true, updated: shots.length, artistName };
+}
+
+// ── Bulk Manual Delivery ──────────────────────────────────────────────────────
+
+/**
+ * Record that a selection of shots was delivered outside the render pipeline
+ * (by hand, before packages existed), or clear that record when
+ * `deliveredOn` is null. The delivery countdown counts these alongside
+ * DELIVERED EXR packages (lib/dashboard/ops.ts).
+ *
+ * `deliveredOn` is the day the frames went out ("yyyy-MM-dd"), stored at
+ * noon UTC so the calendar day survives any timezone it is shown in.
+ */
+export async function bulkSetManualDelivery(
+  shotIds: string[],
+  deliveredOn: string | null,
+  note?: string,
+  /** Where it was uploaded and who was sent the link. */
+  evidence?: { uploadUrl?: string; sharedWith?: string },
+) {
+  const session = await auth();
+  if (!session?.user) throw new Error("Unauthorized");
+  if (!["ADMIN", "PRODUCER", "SUPERVISOR"].includes(session.user.role)) {
+    throw new Error("Insufficient permissions");
+  }
+
+  const ids = z.array(z.string().cuid()).parse(shotIds);
+  if (!ids.length) return { success: true as const, updated: 0 };
+
+  let deliveredAt: Date | null = null;
+  if (deliveredOn) {
+    const day = z.string().regex(/^\d{4}-\d{2}-\d{2}$/).parse(deliveredOn);
+    deliveredAt = new Date(`${day}T12:00:00.000Z`);
+    if (Number.isNaN(deliveredAt.getTime())) throw new Error("Invalid delivery date");
+    if (deliveredAt.getTime() > Date.now() + 24 * 60 * 60 * 1000) {
+      throw new Error("A delivery date can't be in the future");
+    }
+  }
+
+  const shots = await db.shot.findMany({
+    where: { id: { in: ids } },
+    select: { id: true, projectId: true },
+  });
+  if (shots.length !== ids.length) throw new Error("Some shots not found");
+
+  const trimmedNote = note?.trim() || null;
+  const uploadUrl = evidence?.uploadUrl?.trim() || null;
+  const sharedWith = evidence?.sharedWith?.trim() || null;
+  if (uploadUrl && !/^https?:\/\/\S+$/i.test(uploadUrl)) {
+    return { success: false as const, error: "The upload link must be a full http(s) link" };
+  }
+
+  // A backfill of old deliveries may have no link to give. A shot a client is
+  // waiting on is different: without the link and recipient the request it
+  // answers would stay open, so say so now rather than leave it unexplained.
+  if (deliveredAt && (!uploadUrl || !sharedWith)) {
+    const owed = await countShotsOnOpenRequests(ids);
+    if (owed > 0) {
+      // Returned, not thrown: a production build replaces a thrown action
+      // error with a generic message, and this one has to reach the person.
+      return {
+        success: false as const,
+        error: `${owed} of these shots ${owed === 1 ? "is" : "are"} on an open delivery request — add the upload link and who it was sent to`,
+      };
+    }
+  }
+
+  await db.shot.updateMany({
+    where: { id: { in: ids } },
+    data: deliveredAt
+      ? {
+          manualDeliveredAt: deliveredAt,
+          manualDeliveredById: session.user.id,
+          manualDeliveryNote: trimmedNote,
+          manualDeliveryUrl: uploadUrl,
+          manualDeliverySharedWith: sharedWith,
+        }
+      : {
+          manualDeliveredAt: null,
+          manualDeliveredById: null,
+          manualDeliveryNote: null,
+          manualDeliveryUrl: null,
+          manualDeliverySharedWith: null,
+        },
+  });
+
+  for (const pid of [...new Set(shots.map((s) => s.projectId))]) {
+    revalidatePath(`/projects/${pid}`);
+  }
+  revalidatePath(`/shot-status`);
+  revalidatePath(`/dashboard`);
+
+  return { success: true as const, updated: shots.length };
+}
+
+// ── Bulk Delete Shots ─────────────────────────────────────────────────────────
+
+export async function bulkDeleteShots(shotIds: string[]) {
+  const session = await auth();
+  if (!session?.user) throw new Error("Unauthorized");
+  if (!["ADMIN", "PRODUCER", "SUPERVISOR"].includes(session.user.role)) {
+    throw new Error("Insufficient permissions");
+  }
+
+  if (!shotIds.length) return { success: true, deleted: 0, failed: [] as { shotId: string; shotCode: string; reason: string }[] };
+
+  const shots = await db.shot.findMany({
+    where: { id: { in: shotIds } },
+    select: { id: true, shotCode: true, projectId: true },
+  });
+
+  const projectIds = [...new Set(shots.map((s) => s.projectId))];
+  const failed: { shotId: string; shotCode: string; reason: string }[] = [];
+  let deleted = 0;
+
+  // One at a time, not deleteMany: a shot with renders or deliveries is
+  // protected at the database level (exports_shotId_fkey is ON DELETE
+  // RESTRICT, deliberately — delivery history must never be destroyable by
+  // deleting the shot underneath it). A single bulk statement would abort
+  // entirely on the first shot it hits; deleting individually means every
+  // shot that *can* go still does, and the ones that can't are reported by
+  // name instead of failing the whole selection.
+  for (const shot of shots) {
+    try {
+      await db.shot.delete({ where: { id: shot.id } });
+      deleted += 1;
+    } catch (e) {
+      failed.push({
+        shotId: shot.id,
+        shotCode: shot.shotCode,
+        reason:
+          e instanceof Prisma.PrismaClientKnownRequestError && e.code === "P2003"
+            ? "has renders or deliveries — delete those first"
+            : e instanceof Error
+              ? e.message
+              : "unknown error",
+      });
+    }
+  }
+
+  for (const pid of projectIds) {
+    revalidatePath(`/projects/${pid}`);
+  }
+  revalidatePath(`/shot-status`);
+
+  return { success: true, deleted, failed };
+}
+
 export async function renameFootagePlate(plateId: string, label: string) {
   const session = await auth();
   if (!session?.user) throw new Error("Unauthorized");
@@ -620,14 +891,20 @@ export async function internallyApproveShot(shotId: string) {
   });
   if (!shot) throw new Error("Shot not found");
 
-  await db.shot.update({
+  // Set the approval inputs and let the derivation pick the status. Writing
+  // READY_FOR_CLIENT directly skipped the rule that an outstanding CHANGES task
+  // outranks any approval, so a shot could be pushed past open rework and then
+  // snap back to REVISIONS on the next unrelated recalc.
+  await db.$transaction(async (tx) => {
+    await tx.shot.update({
       where: { id: shotId },
       data: {
         shotApprovalStatus: "INTERNALLY_APPROVED",
         sharedWithClient: false,
-      status: "READY_FOR_CLIENT",
       },
     });
+    await recalcShotStatus(shotId, tx);
+  });
 
   revalidatePath(`/projects/${shot.projectId}`);
   revalidatePath(`/projects/${shot.projectId}/shots/${shotId}`);
@@ -669,7 +946,7 @@ export async function shareWithClient(shotId: string) {
     // Mark shot as shared
     await tx.shot.update({
       where: { id: shotId },
-      data: { sharedWithClient: true, status: "CLIENT_REVIEW" },
+      data: { sharedWithClient: true },
     });
 
     // For each task, make the latest version client-visible
@@ -689,6 +966,8 @@ export async function shareWithClient(shotId: string) {
         });
       }
     }
+
+    await recalcShotStatus(shotId, tx);
   });
 
   revalidatePath(`/projects/${shot.projectId}`);
@@ -721,7 +1000,7 @@ export async function unshareFromClient(shotId: string) {
   await db.$transaction(async (tx) => {
     await tx.shot.update({
       where: { id: shotId },
-      data: { sharedWithClient: false, status: "READY_FOR_CLIENT" },
+      data: { sharedWithClient: false },
     });
 
     // Hide all client-visible versions on this shot's tasks
@@ -732,6 +1011,8 @@ export async function unshareFromClient(shotId: string) {
         data: { isClientVisible: false },
       });
     }
+
+    await recalcShotStatus(shotId, tx);
   });
 
   revalidatePath(`/projects/${shot.projectId}`);
@@ -760,9 +1041,12 @@ export async function clientApproveShot(shotId: string) {
   if (!shot) throw new Error("Shot not found");
   if (!shot.sharedWithClient) throw new Error("Shot is not shared with client");
 
-  await db.shot.update({
+  await db.$transaction(async (tx) => {
+    await tx.shot.update({
       where: { id: shotId },
-    data: { shotApprovalStatus: "CLIENT_APPROVED", status: "COMPLETE" },
+      data: { shotApprovalStatus: "CLIENT_APPROVED" },
+    });
+    await recalcShotStatus(shotId, tx);
   });
 
   revalidatePath(`/projects/${shot.projectId}`);
@@ -792,14 +1076,15 @@ export async function unapproveShot(shotId: string) {
     throw new Error("Shot is not client-approved");
   }
 
-  const newStatus = shot.sharedWithClient ? "CLIENT_REVIEW" : "READY_FOR_CLIENT";
+  // The derivation already encodes "CLIENT_REVIEW if still shared, else
-
+  // READY_FOR_CLIENT" for an INTERNALLY_APPROVED shot, and additionally honours
-  await db.shot.update({
+  // any open CHANGES task.
+  await db.$transaction(async (tx) => {
+    await tx.shot.update({
       where: { id: shotId },
-    data: {
+      data: { shotApprovalStatus: "INTERNALLY_APPROVED" },
-      shotApprovalStatus: "INTERNALLY_APPROVED",
+    });
-      status: newStatus,
+    await recalcShotStatus(shotId, tx);
-    },
   });
 
   revalidatePath(`/projects/${shot.projectId}`);
@@ -1100,9 +1385,12 @@ export async function assignShotGroups(
 }
 
 /**
- * Internal: handle client requesting changes on a shot.
+ * Session-authenticated wrapper for requesting changes on a shot — a supervisor
- * Resets shotApprovalStatus = PENDING, sharedWithClient = false.
+ * or producer relaying a client note from inside the app.
- * Recalculates shot status (will become REVISIONS if tasks set to CHANGES).
+ *
+ * The client portal cannot use this: it runs on a review token, not a session,
+ * so it calls markShotForRevisions directly from its route. Both go through that
+ * one helper so the two entry points cannot drift apart again.
  */
 export async function clientRequestShotChanges(shotId: string, taskId?: string) {
   const session = await auth();
@@ -1117,28 +1405,7 @@ export async function clientRequestShotChanges(shotId: string, taskId?: string)
   });
   if (!shot) throw new Error("Shot not found");
 
-  await db.$transaction(async (tx) => {
+  await db.$transaction((tx) => markShotForRevisions(tx, shotId, taskId));
-    // Reset shot approval
-    await tx.shot.update({
-      where: { id: shotId },
-      data: { shotApprovalStatus: "PENDING", sharedWithClient: false },
-    });
-
-    // If a specific task is called out, mark it CHANGES; otherwise mark all non-DONE tasks
-    if (taskId) {
-      await tx.task.update({
-        where: { id: taskId },
-        data: { status: "CHANGES" },
-      });
-    } else {
-      await tx.task.updateMany({
-        where: { shotId, status: { not: "DONE" } },
-        data: { status: "CHANGES" },
-      });
-    }
-
-    await recalcShotStatus(shotId, tx);
-  });
 
   revalidatePath(`/projects/${shot.projectId}`);
   revalidatePath(`/projects/${shot.projectId}/shots/${shotId}`);
@@ -1177,3 +1444,91 @@ export async function updateShotVersion(shotId: string, version: string) {
   revalidatePath(`/projects/${shot.projectId}/shots/${shotId}`);
   return { success: true, shotVersion: version };
 }
+
+// ── Generated (render-derived) shot thumbnails ───────────────────────────────
+//
+// A shot can carry two stills: `thumbnailUrl`, the reference frame that came
+// with the brief, and `generatedThumbnailUrl`, a frame promoted from a render
+// export. The reference always wins on display (lib/shot-thumbnail.ts), so
+// these actions can only ever fill a gap — a promotion never overwrites the
+// brief, and clearing one always falls back to it.
+//
+// Shows with `pipelineConfig.autoShotThumbnail` promote on every finished
+// export automatically (lib/render-pipeline/preview.ts). These actions are the
+// manual equivalent, and work regardless of that flag: a supervisor can pull a
+// frame onto one shot on a project that is otherwise hands-off.
+
+/**
+ * Promote a render export's thumbnail onto its shot.
+ *
+ * With no `exportId`, uses the newest export of that shot which actually has a
+ * thumbnail — "use the latest render frame".
+ */
+export async function promoteExportThumbnail(shotId: string, exportId?: string) {
+  const session = await auth();
+  if (!session?.user) throw new Error("Unauthorized");
+  if (!["ADMIN", "PRODUCER", "SUPERVISOR"].includes(session.user.role)) {
+    throw new Error("Insufficient permissions");
+  }
+
+  const shot = await db.shot.findUnique({
+    where: { id: shotId },
+    select: { id: true, projectId: true },
+  });
+  if (!shot) throw new Error("Shot not found");
+
+  const exportRow = await db.export.findFirst({
+    where: {
+      shotId,
+      thumbnailKey: { not: null },
+      ...(exportId ? { id: exportId } : {}),
+    },
+    orderBy: { versionNumber: "desc" },
+    select: { id: true, thumbnailKey: true, versionString: true },
+  });
+  if (!exportRow?.thumbnailKey) {
+    throw new Error(
+      exportId
+        ? "That export has no thumbnail — its preview may have been skipped, or the worker had no ffmpeg configured"
+        : "No render of this shot has produced a thumbnail yet"
+    );
+  }
+
+  const generatedThumbnailUrl = `/api/files/${exportRow.thumbnailKey}`;
+  await db.shot.update({
+    where: { id: shotId },
+    data: { generatedThumbnailUrl, generatedThumbnailFrom: exportRow.versionString },
+  });
+
+  revalidatePath(`/projects/${shot.projectId}`);
+  revalidatePath(`/projects/${shot.projectId}/shots/${shotId}`);
+  return {
+    success: true,
+    generatedThumbnailUrl,
+    generatedThumbnailFrom: exportRow.versionString,
+  };
+}
+
+/** Drop the render-derived still. The reference frame, if any, comes back. */
+export async function clearGeneratedThumbnail(shotId: string) {
+  const session = await auth();
+  if (!session?.user) throw new Error("Unauthorized");
+  if (!["ADMIN", "PRODUCER", "SUPERVISOR"].includes(session.user.role)) {
+    throw new Error("Insufficient permissions");
+  }
+
+  const shot = await db.shot.findUnique({
+    where: { id: shotId },
+    select: { id: true, projectId: true },
+  });
+  if (!shot) throw new Error("Shot not found");
+
+  await db.shot.update({
+    where: { id: shotId },
+    data: { generatedThumbnailUrl: null, generatedThumbnailFrom: null },
+  });
+
+  revalidatePath(`/projects/${shot.projectId}`);
+  revalidatePath(`/projects/${shot.projectId}/shots/${shotId}`);
+  return { success: true };
+}

actions/versions.ts

@@ -4,9 +4,10 @@ import { auth } from "@/auth";
 import { db } from "@/lib/db";
 import { revalidatePath } from "next/cache";
 import { z } from "zod";
-import { recalcShotStatus } from "@/lib/shot-status";
+import { recalcShotStatus, clearStaleShotApproval } from "@/lib/shot-status";
 import { notifyNewVersionUploaded } from "@/lib/notifications";
 import { slackNotifyVersionUploaded } from "@/lib/slack";
+import { deleteStorageKeys, highResStorageKeys } from "@/lib/render-pipeline/high-res";
 
 const createVersionSchema = z.object({
   taskId: z.string().cuid(),
@@ -50,9 +51,16 @@ export async function createVersion(data: z.infer<typeof createVersionSchema>) {
     data: { status: "INTERNAL_REVIEW" },
   });
 
-  // Recalculate shot status
+  // Recalculate shot status — clearing any stale sign-off first, so a new
+  // version does not land under a shot still reading COMPLETE.
   if (task.shot) {
-    await recalcShotStatus(task.shot.id).catch(() => {});
+    const shotId = task.shot.id;
+    await db
+      .$transaction(async (tx) => {
+        await clearStaleShotApproval(tx, shotId);
+        await recalcShotStatus(shotId, tx);
+      })
+      .catch(() => {});
   }
 
   // Get the next version number for this task
@@ -178,6 +186,8 @@ export async function deleteVersion(versionId: string) {
       id: true,
       isLatest: true,
       taskId: true,
+      hqFileUrl: true,
+      highResKey: true,
       task: { select: { projectId: true, shotId: true } },
     },
   });
@@ -196,6 +206,8 @@ export async function deleteVersion(versionId: string) {
   }
 
   await db.version.delete({ where: { id: versionId } });
+  // Its High quality MP4 and ProRes are large and referenced by nothing else.
+  await deleteStorageKeys(highResStorageKeys(version));
 
   const projectId = version.task?.projectId;
   const shotId = version.task?.shotId;
@@ -252,3 +264,35 @@ export async function getVersionComments(versionId: string) {
     orderBy: { frameNumber: "asc" },
   });
 }
+
+const updateVersionHandlesSchema = z.object({
+  versionId: z.string().cuid(),
+  /** 0/0 = no handles (every frame is in the edit). */
+  handleHead: z.number().int().min(0).max(1000),
+  handleTail: z.number().int().min(0).max(1000),
+  /** Slate frames before the picture; null = infer from the media. */
+  pictureStartFrame: z.number().int().min(0).max(1000).nullable(),
+});
+
+/**
+ * Marks which frames of a version are handles (past the cut at each end), so
+ * the review player can flag them. Review metadata only — the media and any
+ * delivered files are untouched. Staff only: a client can't redefine the cut.
+ */
+export async function updateVersionHandles(data: z.infer<typeof updateVersionHandlesSchema>) {
+  const session = await auth();
+  if (!session?.user) throw new Error("Unauthorized");
+  if (session.user.role === "CLIENT") throw new Error("Forbidden");
+
+  const parsed = updateVersionHandlesSchema.parse(data);
+  const none = parsed.handleHead === 0 && parsed.handleTail === 0;
+  await db.version.update({
+    where: { id: parsed.versionId },
+    data: {
+      handleHead: none ? null : parsed.handleHead,
+      handleTail: none ? null : parsed.handleTail,
+      pictureStartFrame: parsed.pictureStartFrame,
+    },
+  });
+  revalidatePath(`/review/${parsed.versionId}`);
+}

app/(dashboard)/board/BoardClient.tsx

@@ -0,0 +1,689 @@
+"use client";
+
+import { useEffect, useRef, useState, useTransition } from "react";
+import { useRouter } from "next/navigation";
+import Link from "next/link";
+import { differenceInCalendarDays, format, formatDistanceToNowStrict } from "date-fns";
+import {
+  AlertTriangle,
+  Check,
+  ChevronDown,
+  ChevronRight,
+  Clock,
+  Flag,
+  Link2,
+  MessageSquareText,
+  Pencil,
+  Plus,
+  Trash2,
+  X,
+} from "lucide-react";
+import { Button } from "@/components/ui/button";
+import { Avatar, AvatarFallback, AvatarImage } from "@/components/ui/avatar";
+import { useToast } from "@/components/ui/use-toast";
+import { cn, getInitials } from "@/lib/utils";
+import {
+  addBoardItems,
+  addMilestone,
+  deleteBoardItem,
+  deleteMilestone,
+  setBoardItemDone,
+  setMilestoneDone,
+  setProjectBoardStatus,
+  updateBoardItem,
+} from "@/actions/board";
+import { FeedbackPasteDialog } from "./FeedbackPasteDialog";
+
+type User = { id: string; name: string | null; email: string; image: string | null };
+
+type BoardItem = {
+  id: string;
+  text: string;
+  code: string | null;
+  group: string;
+  waitingOn: string | null;
+  round: { id: string; title: string; dueAt: string | null } | null;
+  /** The player comment a pasted-feedback line was saved as */
+  comment: { versionId: string; frame: number } | null;
+  doneAt: string | null;
+  assignee: { id: string; name: string | null; image: string | null } | null;
+  shot: {
+    id: string;
+    shotCode: string;
+    status: string;
+    latest: { id: string; versionNumber: number; approvalStatus: string; isClientVisible: boolean } | null;
+  } | null;
+  relinkTo: string | null;
+  relinkIsExact: boolean;
+};
+
+export type BoardProject = {
+  id: string;
+  name: string;
+  code: string;
+  status: string;
+  boardStatus: string | null;
+  boardStatusAt: string | null;
+  shotTotal: number;
+  shotComplete: number;
+  milestones: { id: string; label: string; date: string; doneAt: string | null }[];
+  items: BoardItem[];
+};
+
+const SHOT_STATUS: Record<string, { label: string; color: string }> = {
+  WAITING:          { label: "Waiting",          color: "bg-zinc-500/10 text-zinc-400 border-zinc-500/20" },
+  IN_PROGRESS:      { label: "In Progress",      color: "bg-blue-500/10 text-blue-400 border-blue-500/20" },
+  INTERNAL_REVIEW:  { label: "Internal Review",  color: "bg-purple-500/10 text-purple-400 border-purple-500/20" },
+  READY_FOR_CLIENT: { label: "Ready for Client", color: "bg-cyan-500/10 text-cyan-400 border-cyan-500/20" },
+  CLIENT_REVIEW:    { label: "Client Review",    color: "bg-indigo-500/10 text-indigo-400 border-indigo-500/20" },
+  REVISIONS:        { label: "Revisions",        color: "bg-orange-500/10 text-orange-400 border-orange-500/20" },
+  COMPLETE:         { label: "Complete",         color: "bg-green-500/10 text-green-400 border-green-500/20" },
+};
+
+const APPROVAL: Record<string, { label: string; color: string }> = {
+  PENDING_REVIEW: { label: "pending",  color: "text-zinc-500" },
+  APPROVED:       { label: "approved", color: "text-green-400" },
+  REJECTED:       { label: "rejected", color: "text-red-400" },
+  NEEDS_CHANGES:  { label: "changes",  color: "text-orange-400" },
+};
+
+export function BoardClient({
+  projects,
+  users,
+  who,
+}: {
+  projects: BoardProject[];
+  users: User[];
+  who: string | null;
+}) {
+  const router = useRouter();
+
+  const filters = [
+    { key: null, label: "Everyone" },
+    ...users.map((u) => ({ key: u.id, label: u.name?.split(" ")[0] ?? u.email })),
+    { key: "none", label: "Unassigned" },
+  ];
+
+  return (
+    <div className="p-4 md:p-8 max-w-5xl">
+      <div className="mb-6 flex flex-wrap items-end justify-between gap-4">
+        <div>
+          <h1 className="text-3xl font-bold text-white">Board</h1>
+          <p className="text-zinc-400 mt-1">{format(new Date(), "EEEE, d MMMM yyyy")}</p>
+        </div>
+        <div className="flex flex-wrap gap-1 rounded-lg border border-zinc-800 bg-zinc-900 p-1">
+          {filters.map((f) => (
+            <button
+              key={f.key ?? "all"}
+              type="button"
+              onClick={() => router.push(f.key ? `/board?who=${f.key}` : "/board")}
+              className={cn(
+                "rounded-md px-3 py-1 text-xs font-medium transition-colors",
+                who === f.key ? "bg-amber-500/10 text-amber-400" : "text-zinc-400 hover:text-white",
+              )}
+            >
+              {f.label}
+            </button>
+          ))}
+        </div>
+      </div>
+
+      {projects.length === 0 && (
+        <p className="text-sm text-zinc-500">No active or on-hold projects.</p>
+      )}
+
+      <div className="space-y-6">
+        {projects.map((p) => (
+          <ProjectSection key={p.id} project={p} users={users} who={who} />
+        ))}
+      </div>
+    </div>
+  );
+}
+
+function ProjectSection({ project, users, who }: { project: BoardProject; users: User[]; who: string | null }) {
+  const [showDone, setShowDone] = useState(false);
+  const [pasting, setPasting] = useState(false);
+
+  const visible = project.items.filter((i) =>
+    who === null ? true : who === "none" ? !i.assignee : i.assignee?.id === who,
+  );
+  const open = visible.filter((i) => !i.doneAt);
+  const done = visible.filter((i) => i.doneAt);
+  // Pasted feedback stays together under its round, flags and all
+  const rounds: { round: NonNullable<BoardItem["round"]>; items: BoardItem[] }[] = [];
+  for (const item of open) {
+    if (!item.round) continue;
+    let r = rounds.find((x) => x.round.id === item.round!.id);
+    if (!r) rounds.push((r = { round: item.round, items: [] }));
+    r.items.push(item);
+  }
+  rounds.sort((a, b) => (a.round.dueAt ?? "9").localeCompare(b.round.dueAt ?? "9"));
+  const loose = open.filter((i) => !i.round);
+  const flagged = loose.filter((i) => i.code && !i.shot);
+  const waiting = loose.filter((i) => i.waitingOn && !(i.code && !i.shot));
+  const rest = loose.filter((i) => !flagged.includes(i) && !waiting.includes(i));
+
+  // Groups keep the order they were first typed in
+  const groups: { name: string; items: BoardItem[] }[] = [];
+  for (const item of rest) {
+    let g = groups.find((x) => x.name === item.group);
+    if (!g) groups.push((g = { name: item.group, items: [] }));
+    g.items.push(item);
+  }
+  groups.sort((a, b) => (a.name === "" ? -1 : b.name === "" ? 1 : 0));
+
+  const pct = project.shotTotal ? Math.round((project.shotComplete / project.shotTotal) * 100) : 0;
+
+  return (
+    <section className="rounded-xl border border-zinc-800 bg-zinc-900">
+      <header className="flex flex-wrap items-center gap-x-3 gap-y-1 border-b border-zinc-800 px-4 py-3">
+        <Link href={`/projects/${project.id}`} className="text-lg font-semibold text-white hover:text-amber-400">
+          {project.name}
+        </Link>
+        <span className="text-xs text-zinc-500">{project.code}</span>
+        {project.status === "ON_HOLD" && (
+          <span className="rounded border border-yellow-500/20 bg-yellow-500/10 px-1.5 py-0.5 text-[10px] font-medium text-yellow-400">
+            On hold
+          </span>
+        )}
+        <Button
+          size="sm"
+          variant="outline"
+          className="ml-auto h-7"
+          onClick={() => setPasting(true)}
+          title="Paste a client's feedback message"
+        >
+          <MessageSquareText /> Paste feedback
+        </Button>
+        {project.shotTotal > 0 && (
+          <div className="flex items-center gap-2 text-xs text-zinc-400">
+            <div className="h-1.5 w-24 overflow-hidden rounded-full bg-zinc-800">
+              <div className="h-full bg-green-500/70" style={{ width: `${pct}%` }} />
+            </div>
+            {project.shotComplete}/{project.shotTotal} shots complete
+          </div>
+        )}
+      </header>
+
+      <div className="space-y-4 px-4 py-3">
+        <StatusLine project={project} />
+        <Milestones project={project} />
+
+        {rounds.map(({ round, items }) => (
+          <RoundBlock key={round.id} round={round} count={items.length}>
+            {items.map((i) => <ItemRow key={i.id} item={i} users={users} projectId={project.id} />)}
+          </RoundBlock>
+        ))}
+        {flagged.length > 0 && (
+          <ItemBlock title="Flags" icon={<Flag className="h-3.5 w-3.5 text-red-400" />}>
+            {flagged.map((i) => <ItemRow key={i.id} item={i} users={users} projectId={project.id} />)}
+          </ItemBlock>
+        )}
+        {waiting.length > 0 && (
+          <ItemBlock title="Waiting on" icon={<Clock className="h-3.5 w-3.5 text-amber-400" />}>
+            {waiting.map((i) => <ItemRow key={i.id} item={i} users={users} projectId={project.id} />)}
+          </ItemBlock>
+        )}
+        {groups.map((g) => (
+          <ItemBlock key={g.name || "_"} title={g.name}>
+            {g.items.map((i) => <ItemRow key={i.id} item={i} users={users} projectId={project.id} />)}
+          </ItemBlock>
+        ))}
+
+        <QuickAdd projectId={project.id} />
+
+        {done.length > 0 && (
+          <div>
+            <button
+              type="button"
+              onClick={() => setShowDone(!showDone)}
+              className="flex items-center gap-1 text-xs text-zinc-500 hover:text-zinc-300"
+            >
+              {showDone ? <ChevronDown className="h-3.5 w-3.5" /> : <ChevronRight className="h-3.5 w-3.5" />}
+              Done this week ({done.length})
+            </button>
+            {showDone && (
+              <div className="mt-1">
+                {done.map((i) => <ItemRow key={i.id} item={i} users={users} projectId={project.id} />)}
+              </div>
+            )}
+          </div>
+        )}
+      </div>
+      <FeedbackPasteDialog
+        projectId={project.id}
+        projectName={project.name}
+        open={pasting}
+        onOpenChange={setPasting}
+      />
+    </section>
+  );
+}
+
+function RoundBlock({
+  round,
+  count,
+  children,
+}: {
+  round: NonNullable<BoardItem["round"]>;
+  count: number;
+  children: React.ReactNode;
+}) {
+  const due = round.dueAt ? new Date(round.dueAt) : null;
+  const late = due && due.getTime() < Date.now();
+  const days = due ? differenceInCalendarDays(due, new Date()) : null;
+  const when = due
+    ? days === 0 ? `today ${format(due, "HH:mm")}` : days === 1 ? `tomorrow ${format(due, "HH:mm")}` : format(due, "d MMM HH:mm")
+    : null;
+
+  return (
+    <div>
+      <div className="mb-1 flex flex-wrap items-center gap-1.5 text-xs uppercase tracking-wider text-zinc-500">
+        <MessageSquareText className="h-3.5 w-3.5 text-indigo-400" />
+        {round.title}
+        {when && (
+          <span
+            className={cn(
+              "rounded px-1.5 py-px normal-case tracking-normal",
+              late ? "bg-red-500/10 text-red-300" : days !== null && days <= 1 ? "bg-amber-500/10 text-amber-300" : "text-zinc-400",
+            )}
+          >
+            {late ? "overdue · " : "due "}{when}
+          </span>
+        )}
+        <span className="normal-case tracking-normal text-zinc-600">{count} open</span>
+      </div>
+      <div className="divide-y divide-zinc-800/60">{children}</div>
+    </div>
+  );
+}
+
+function ItemBlock({ title, icon, children }: { title: string; icon?: React.ReactNode; children: React.ReactNode }) {
+  return (
+    <div>
+      {title && (
+        <div className="mb-1 flex items-center gap-1.5 text-xs uppercase tracking-wider text-zinc-500">
+          {icon}
+          {title}
+        </div>
+      )}
+      <div className="divide-y divide-zinc-800/60">{children}</div>
+    </div>
+  );
+}
+
+function useAction() {
+  const router = useRouter();
+  const { toast } = useToast();
+  const [isPending, startTransition] = useTransition();
+  const run = (fn: () => Promise<unknown>, after?: () => void) =>
+    startTransition(async () => {
+      try {
+        await fn();
+        after?.();
+        router.refresh();
+      } catch (e) {
+        toast({ title: "Couldn't save", description: (e as Error).message, variant: "destructive" });
+      }
+    });
+  return { run, isPending };
+}
+
+// ── Status line ──────────────────────────────────────────────────────────────
+
+function StatusLine({ project }: { project: BoardProject }) {
+  const [editing, setEditing] = useState(false);
+  const [value, setValue] = useState(project.boardStatus ?? "");
+  const { run, isPending } = useAction();
+
+  const save = () =>
+    run(() => setProjectBoardStatus({ projectId: project.id, status: value }), () => setEditing(false));
+
+  if (editing) {
+    return (
+      <div className="space-y-1.5">
+        <textarea
+          autoFocus
+          value={value}
+          onChange={(e) => setValue(e.target.value)}
+          onKeyDown={(e) => {
+            if (e.key === "Enter" && !e.shiftKey) { e.preventDefault(); save(); }
+            if (e.key === "Escape") { setValue(project.boardStatus ?? ""); setEditing(false); }
+          }}
+          rows={2}
+          placeholder="Where things stand — e.g. Awaiting feedback on pick-ups"
+          className="w-full resize-y rounded-lg border border-zinc-700 bg-zinc-950 px-3 py-2 text-sm text-white placeholder:text-zinc-600 focus:border-amber-500/50 focus:outline-none"
+        />
+        <div className="flex gap-2">
+          <Button size="sm" onClick={save} disabled={isPending}>Save</Button>
+          <Button size="sm" variant="ghost" onClick={() => { setValue(project.boardStatus ?? ""); setEditing(false); }}>
+            Cancel
+          </Button>
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <button
+      type="button"
+      onClick={() => setEditing(true)}
+      className="group block w-full text-left"
+    >
+      {project.boardStatus ? (
+        <p className="whitespace-pre-wrap text-sm text-zinc-200">
+          {project.boardStatus}
+          {project.boardStatusAt && (
+            <span className="ml-2 text-xs text-zinc-600">
+              {formatDistanceToNowStrict(new Date(project.boardStatusAt), { addSuffix: true })}
+            </span>
+          )}
+          <Pencil className="ml-2 inline h-3 w-3 text-zinc-600 opacity-0 group-hover:opacity-100" />
+        </p>
+      ) : (
+        <p className="text-sm text-zinc-600 group-hover:text-zinc-400">+ Add a status line</p>
+      )}
+    </button>
+  );
+}
+
+// ── Milestones ───────────────────────────────────────────────────────────────
+
+function Milestones({ project }: { project: BoardProject }) {
+  const [adding, setAdding] = useState(false);
+  const [label, setLabel] = useState("");
+  const [date, setDate] = useState("");
+  const { run, isPending } = useAction();
+
+  const add = () => {
+    if (!label.trim() || !date) return;
+    // Noon keeps the calendar day stable across the studio/server time zones
+    run(() => addMilestone({ projectId: project.id, label, date: `${date}T12:00:00` }), () => {
+      setLabel("");
+      setDate("");
+      setAdding(false);
+    });
+  };
+
+  return (
+    <div className="flex flex-wrap items-center gap-1.5">
+      {project.milestones.map((m) => <MilestoneChip key={m.id} m={m} />)}
+      {adding ? (
+        <div className="flex flex-wrap items-center gap-1.5">
+          <input
+            autoFocus
+            value={label}
+            onChange={(e) => setLabel(e.target.value)}
+            onKeyDown={(e) => e.key === "Enter" && add()}
+            placeholder="e.g. Final delivery"
+            className="h-7 w-40 rounded-md border border-zinc-700 bg-zinc-950 px-2 text-xs text-white placeholder:text-zinc-600 focus:outline-none"
+          />
+          <input
+            type="date"
+            value={date}
+            onChange={(e) => setDate(e.target.value)}
+            onKeyDown={(e) => e.key === "Enter" && add()}
+            className="h-7 rounded-md border border-zinc-700 bg-zinc-950 px-2 text-xs text-white [color-scheme:dark] focus:outline-none"
+          />
+          <Button size="sm" className="h-7" onClick={add} disabled={isPending || !label.trim() || !date}>Add</Button>
+          <Button size="sm" variant="ghost" className="h-7" onClick={() => setAdding(false)}>Cancel</Button>
+        </div>
+      ) : (
+        <button
+          type="button"
+          onClick={() => setAdding(true)}
+          className="flex h-7 items-center gap-1 rounded-md px-2 text-xs text-zinc-600 hover:bg-zinc-800 hover:text-zinc-300"
+        >
+          <Plus className="h-3 w-3" /> Date
+        </button>
+      )}
+    </div>
+  );
+}
+
+function MilestoneChip({ m }: { m: BoardProject["milestones"][number] }) {
+  const { run } = useAction();
+  const days = differenceInCalendarDays(new Date(m.date), new Date());
+  const done = !!m.doneAt;
+  const late = !done && days < 0;
+  const soon = !done && days >= 0 && days <= 7;
+  const when = done ? "done" : days === 0 ? "today" : days === 1 ? "tomorrow" : days > 0 ? `in ${days}d` : `${-days}d late`;
+
+  return (
+    <div
+      className={cn(
+        "group flex h-7 items-center gap-1.5 rounded-md border px-2 text-xs",
+        done ? "border-zinc-800 text-zinc-600" :
+        late ? "border-red-500/30 bg-red-500/10 text-red-300" :
+        soon ? "border-amber-500/30 bg-amber-500/10 text-amber-300" :
+        "border-zinc-700 text-zinc-300",
+      )}
+    >
+      <button
+        type="button"
+        title={done ? "Mark not done" : "Mark done"}
+        onClick={() => run(() => setMilestoneDone(m.id, !done))}
+        className={cn(
+          "flex h-3.5 w-3.5 items-center justify-center rounded-sm border",
+          done ? "border-green-500/50 bg-green-500/20 text-green-400" : "border-current opacity-60 hover:opacity-100",
+        )}
+      >
+        {done && <Check className="h-2.5 w-2.5" />}
+      </button>
+      <span className={cn(done && "line-through")}>{m.label}</span>
+      <span className="opacity-70">{format(new Date(m.date), "d MMM")}</span>
+      <span className="font-medium">· {when}</span>
+      <button
+        type="button"
+        title="Remove"
+        onClick={() => { if (confirm(`Remove "${m.label}"?`)) run(() => deleteMilestone(m.id)); }}
+        className="hidden text-zinc-500 hover:text-red-400 group-hover:block"
+      >
+        <X className="h-3 w-3" />
+      </button>
+    </div>
+  );
+}
+
+// ── Items ────────────────────────────────────────────────────────────────────
+
+function ItemRow({ item, users, projectId }: { item: BoardItem; users: User[]; projectId: string }) {
+  const [editing, setEditing] = useState(false);
+  const { run, isPending } = useAction();
+  const done = !!item.doneAt;
+  const flagged = !!item.code && !item.shot;
+
+  if (editing) return <ItemEditor item={item} users={users} onClose={() => setEditing(false)} />;
+
+  const st = item.shot ? SHOT_STATUS[item.shot.status] : null;
+  const v = item.shot?.latest;
+
+  return (
+    <div className={cn("group flex items-start gap-2.5 py-1.5", isPending && "opacity-50")}>
+      <button
+        type="button"
+        title={done ? "Mark not done" : "Mark done"}
+        onClick={() => run(() => setBoardItemDone(item.id, !done))}
+        className={cn(
+          "mt-0.5 flex h-4 w-4 shrink-0 items-center justify-center rounded border",
+          done ? "border-green-500/50 bg-green-500/20 text-green-400" : "border-zinc-600 hover:border-zinc-400",
+        )}
+      >
+        {done && <Check className="h-3 w-3" />}
+      </button>
+
+      <div className="min-w-0 flex-1">
+        <div className="flex flex-wrap items-center gap-x-2 gap-y-1 text-sm">
+          {item.shot && (
+            <Link
+              href={`/projects/${projectId}/shots/${item.shot.id}`}
+              className="font-mono text-xs text-amber-400 hover:underline"
+            >
+              {item.shot.shotCode}
+            </Link>
+          )}
+          {flagged && (
+            <span className="flex items-center gap-1 font-mono text-xs text-red-400" title="Not a shot in this project">
+              <AlertTriangle className="h-3 w-3" />
+              {item.code}
+            </span>
+          )}
+          {st && !done && (
+            <span className={cn("rounded border px-1.5 py-px text-[10px] font-medium", st.color)}>{st.label}</span>
+          )}
+          {v && !done && (
+            <Link href={`/review/${v.id}`} className="text-[11px] text-zinc-500 hover:text-zinc-300">
+              v{String(v.versionNumber).padStart(3, "0")}{" "}
+              <span className={APPROVAL[v.approvalStatus]?.color}>{APPROVAL[v.approvalStatus]?.label}</span>
+              {v.isClientVisible && <span className="text-indigo-400"> · sent</span>}
+            </Link>
+          )}
+          <span className={cn("text-zinc-200", done && "text-zinc-600 line-through")}>{item.text}</span>
+          {item.comment && (
+            <Link
+              href={`/review/${item.comment.versionId}`}
+              className="text-[11px] text-indigo-400/80 hover:text-indigo-300"
+              title="Open the note in the player"
+            >
+              note @ F{item.comment.frame}
+            </Link>
+          )}
+        </div>
+
+        {(item.waitingOn || (flagged && !done)) && (
+          <div className="mt-1 flex flex-wrap items-center gap-2 text-xs">
+            {item.waitingOn && (
+              <span className="flex items-center gap-1 rounded bg-amber-500/10 px-1.5 py-0.5 text-amber-300">
+                <Clock className="h-3 w-3" /> Waiting on {item.waitingOn}
+              </span>
+            )}
+            {flagged && !done && (
+              item.relinkTo ? (
+                <button
+                  type="button"
+                  onClick={() => run(() => updateBoardItem(item.id, { code: item.relinkTo }))}
+                  className="flex items-center gap-1 text-zinc-400 hover:text-amber-400"
+                >
+                  <Link2 className="h-3 w-3" />
+                  {item.relinkIsExact ? `${item.relinkTo} exists now. Link it` : `Did you mean ${item.relinkTo}?`}
+                </button>
+              ) : (
+                <span className="text-zinc-500">Not a shot in this project</span>
+              )
+            )}
+          </div>
+        )}
+      </div>
+
+      {item.assignee && (
+        <span className="flex shrink-0 items-center gap-1.5 text-xs text-zinc-400" title={item.assignee.name ?? ""}>
+          <Avatar className="h-5 w-5">
+            {item.assignee.image && <AvatarImage src={item.assignee.image} />}
+            <AvatarFallback className="text-[9px]">{getInitials(item.assignee.name)}</AvatarFallback>
+          </Avatar>
+          <span className="hidden sm:inline">{item.assignee.name?.split(" ")[0]}</span>
+        </span>
+      )}
+
+      <div className="flex shrink-0 gap-0.5 opacity-100 md:opacity-0 md:group-hover:opacity-100">
+        <button type="button" title="Edit" onClick={() => setEditing(true)} className="rounded p-1 text-zinc-500 hover:bg-zinc-800 hover:text-white">
+          <Pencil className="h-3.5 w-3.5" />
+        </button>
+        <button
+          type="button"
+          title="Delete"
+          onClick={() => { if (confirm("Delete this line?")) run(() => deleteBoardItem(item.id)); }}
+          className="rounded p-1 text-zinc-500 hover:bg-zinc-800 hover:text-red-400"
+        >
+          <Trash2 className="h-3.5 w-3.5" />
+        </button>
+      </div>
+    </div>
+  );
+}
+
+function ItemEditor({ item, users, onClose }: { item: BoardItem; users: User[]; onClose: () => void }) {
+  const [code, setCode] = useState(item.shot?.shotCode ?? item.code ?? "");
+  const [text, setText] = useState(item.text);
+  const [assigneeId, setAssigneeId] = useState(item.assignee?.id ?? "");
+  const [waitingOn, setWaitingOn] = useState(item.waitingOn ?? "");
+  const [group, setGroup] = useState(item.group);
+  const { run, isPending } = useAction();
+
+  const save = () =>
+    run(
+      () => updateBoardItem(item.id, { code, text, assigneeId: assigneeId || null, waitingOn, group }),
+      onClose,
+    );
+
+  const field = "h-8 rounded-md border border-zinc-700 bg-zinc-950 px-2 text-xs text-white placeholder:text-zinc-600 focus:border-amber-500/50 focus:outline-none";
+
+  return (
+    <div
+      className="my-1 grid grid-cols-1 gap-2 rounded-lg border border-zinc-700 bg-zinc-950/50 p-2 sm:grid-cols-[10rem_1fr]"
+      onKeyDown={(e) => {
+        if (e.key === "Enter") { e.preventDefault(); save(); }
+        if (e.key === "Escape") onClose();
+      }}
+    >
+      <input value={code} onChange={(e) => setCode(e.target.value)} placeholder="Shot code" className={cn(field, "font-mono")} />
+      <input autoFocus value={text} onChange={(e) => setText(e.target.value)} placeholder="Note" className={field} />
+      <select value={assigneeId} onChange={(e) => setAssigneeId(e.target.value)} className={field}>
+        <option value="">Unassigned</option>
+        {users.map((u) => <option key={u.id} value={u.id}>{u.name ?? u.email}</option>)}
+      </select>
+      <input value={waitingOn} onChange={(e) => setWaitingOn(e.target.value)} placeholder="Waiting on (blank = not blocked)" className={field} />
+      <input value={group} onChange={(e) => setGroup(e.target.value)} placeholder="Heading (optional)" className={field} />
+      <div className="flex justify-end gap-2">
+        <Button size="sm" variant="ghost" onClick={onClose}>Cancel</Button>
+        <Button size="sm" onClick={save} disabled={isPending}>Save</Button>
+      </div>
+    </div>
+  );
+}
+
+function QuickAdd({ projectId }: { projectId: string }) {
+  const [value, setValue] = useState("");
+  const ref = useRef<HTMLTextAreaElement>(null);
+  const { toast } = useToast();
+  const { run, isPending } = useAction();
+
+  // Grow with pasted blocks
+  useEffect(() => {
+    const el = ref.current;
+    if (!el) return;
+    el.style.height = "auto";
+    el.style.height = `${Math.min(el.scrollHeight, 320)}px`;
+  }, [value]);
+
+  const submit = () => {
+    if (!value.trim()) return;
+    run(async () => {
+      const res = await addBoardItems({ projectId, input: value });
+      if (res.unmatched.length) {
+        toast({
+          title: `${res.unmatched.length} code${res.unmatched.length === 1 ? "" : "s"} not in this project`,
+          description: `${res.unmatched.join(", ")}: flagged on the board.`,
+        });
+      }
+    }, () => setValue(""));
+  };
+
+  return (
+    <div>
+      <textarea
+        ref={ref}
+        value={value}
+        onChange={(e) => setValue(e.target.value)}
+        onKeyDown={(e) => {
+          if (e.key === "Enter" && !e.shiftKey) { e.preventDefault(); submit(); }
+        }}
+        rows={1}
+        disabled={isPending}
+        placeholder="Add a line, e.g. SHOT_CODE finalise (Chris) wait: client GFX, or paste a list"
+        className="w-full resize-none rounded-lg border border-dashed border-zinc-700 bg-transparent px-3 py-2 text-sm text-white placeholder:text-zinc-600 focus:border-solid focus:border-amber-500/50 focus:outline-none"
+      />
+    </div>
+  );
+}

app/(dashboard)/board/FeedbackPasteDialog.tsx

@@ -0,0 +1,342 @@
+"use client";
+
+import { useState, useTransition } from "react";
+import { useRouter } from "next/navigation";
+import { format } from "date-fns";
+import { AlertTriangle, ArrowLeft, Link2, MessageSquareText } from "lucide-react";
+import { Button } from "@/components/ui/button";
+import { Dialog, DialogContent, DialogDescription, DialogHeader, DialogTitle } from "@/components/ui/dialog";
+import { useToast } from "@/components/ui/use-toast";
+import { cn } from "@/lib/utils";
+import { parseDue } from "@/lib/feedback-parse";
+import { commitFeedback, previewFeedback, type FeedbackPreview, type FeedbackPreviewNote } from "@/actions/feedback";
+
+type NoteState = {
+  include: boolean;
+  text: string;
+  versionId: string | null;
+  /** Typed frame; null = use the selected version's converted frame */
+  frame: string | null;
+  setChanges: boolean;
+};
+type RoundState = { title: string; due: string; notes: Record<string, NoteState> };
+
+const LOCAL_DT = "yyyy-MM-dd'T'HH:mm";
+
+function initialState(preview: FeedbackPreview): RoundState[] {
+  return preview.rounds.map((r) => {
+    const due = parseDue(r.dueText);
+    return {
+      title: r.title || `Feedback ${format(new Date(), "d MMM")}`,
+      due: due ? format(due, LOCAL_DT) : "",
+      notes: Object.fromEntries(
+        r.notes.map((n) => [
+          n.key,
+          { include: true, text: n.text, versionId: n.defaultVersionId, frame: null, setChanges: true },
+        ]),
+      ),
+    };
+  });
+}
+
+export function FeedbackPasteDialog({
+  projectId,
+  projectName,
+  open,
+  onOpenChange,
+}: {
+  projectId: string;
+  projectName: string;
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+}) {
+  const router = useRouter();
+  const { toast } = useToast();
+  const [input, setInput] = useState("");
+  const [preview, setPreview] = useState<FeedbackPreview | null>(null);
+  const [rounds, setRounds] = useState<RoundState[]>([]);
+  const [isPending, startTransition] = useTransition();
+
+  const reset = () => {
+    setInput("");
+    setPreview(null);
+    setRounds([]);
+  };
+
+  const read = (text: string) =>
+    startTransition(async () => {
+      try {
+        const p = await previewFeedback(projectId, text);
+        if (p.rounds.length === 0) {
+          toast({ title: "No shot notes found", description: "Each note needs to start with a shot code.", variant: "destructive" });
+          return;
+        }
+        setPreview(p);
+        setRounds(initialState(p));
+      } catch (e) {
+        toast({ title: "Couldn't read feedback", description: (e as Error).message, variant: "destructive" });
+      }
+    });
+
+  // Accepting a suggested code rewrites the paste and reads it again, so
+  // everything downstream (versions, frames) comes from the real shot.
+  const applySuggestion = (code: string, suggestion: string) => {
+    const next = input.split(code).join(suggestion);
+    setInput(next);
+    read(next);
+  };
+
+  const updateNote = (ri: number, key: string, patch: Partial<NoteState>) =>
+    setRounds((rs) => rs.map((r, i) => (i === ri ? { ...r, notes: { ...r.notes, [key]: { ...r.notes[key], ...patch } } } : r)));
+
+  const frameFor = (n: FeedbackPreviewNote, s: NoteState): number | null => {
+    if (s.frame !== null) return s.frame.trim() === "" ? null : Number(s.frame);
+    return n.versions.find((v) => v.id === s.versionId)?.playerFrame ?? null;
+  };
+
+  const included = preview
+    ? preview.rounds.flatMap((r, ri) => r.notes.filter((n) => rounds[ri]?.notes[n.key]?.include && rounds[ri].notes[n.key].text.trim()))
+    : [];
+
+  const save = () => {
+    if (!preview) return;
+    const payload = preview.rounds
+      .map((r, ri) => {
+        const rs = rounds[ri];
+        return {
+          title: rs.title,
+          dueAt: rs.due ? new Date(rs.due).toISOString() : null,
+          notes: r.notes
+            .filter((n) => rs.notes[n.key].include && rs.notes[n.key].text.trim())
+            .map((n) => {
+              const s = rs.notes[n.key];
+              const frame = frameFor(n, s);
+              return {
+                code: n.code,
+                shotId: n.shot?.id ?? null,
+                text: s.text.trim(),
+                versionId: n.shot ? s.versionId : null,
+                frame: frame != null && Number.isFinite(frame) && frame >= 0 ? Math.floor(frame) : null,
+                setChanges: !!s.versionId && s.setChanges,
+              };
+            }),
+        };
+      })
+      .filter((r) => r.notes.length > 0);
+    if (payload.length === 0) return;
+
+    startTransition(async () => {
+      try {
+        const res = await commitFeedback({ projectId, rounds: payload });
+        toast({
+          title: `${res.notes} note${res.notes === 1 ? "" : "s"} logged`,
+          description: `${res.comments} in the player · ${res.tasksChanged} task${res.tasksChanged === 1 ? "" : "s"} moved to Changes`,
+        });
+        reset();
+        onOpenChange(false);
+        router.refresh();
+      } catch (e) {
+        toast({ title: "Couldn't save feedback", description: (e as Error).message, variant: "destructive" });
+      }
+    });
+  };
+
+  const field = "rounded-md border border-zinc-700 bg-zinc-950 px-2 text-xs text-white placeholder:text-zinc-600 focus:border-amber-500/50 focus:outline-none";
+
+  return (
+    <Dialog open={open} onOpenChange={(o) => { if (!o) reset(); onOpenChange(o); }}>
+      <DialogContent className="max-h-[90vh] max-w-4xl overflow-y-auto">
+        <DialogHeader>
+          <DialogTitle className="flex items-center gap-2">
+            <MessageSquareText className="h-4 w-4 text-amber-400" />
+            Paste client feedback · {projectName}
+          </DialogTitle>
+          <DialogDescription>
+            {preview
+              ? "Check where each note will go. Notes are saved in the player as client feedback and added to the board."
+              : "Paste the message as it arrived. Each note should start with a shot code; a line like “FEEDBACK 113 DUE Oct 7 12:00 PM” starts a round."}
+          </DialogDescription>
+        </DialogHeader>
+
+        {!preview ? (
+          <div className="space-y-3">
+            <textarea
+              autoFocus
+              value={input}
+              onChange={(e) => setInput(e.target.value)}
+              rows={12}
+              placeholder={"FEEDBACK 113 DUE Oct 7, 2026 12:00 PM\nUNG_113_008_040 The screen is partially peeking under the mask\nUNG_113_018_050 At frame 1018, the mask is still slipping"}
+              className={cn(field, "w-full resize-y py-2 font-mono text-[13px] leading-relaxed")}
+            />
+            <div className="flex justify-end">
+              <Button onClick={() => read(input)} disabled={isPending || !input.trim()}>
+                {isPending ? "Reading…" : "Read feedback"}
+              </Button>
+            </div>
+          </div>
+        ) : (
+          <div className="space-y-5">
+            {preview.ignored.length > 0 && (
+              <p className="text-xs text-zinc-500">
+                Skipped (no shot code): {preview.ignored.map((l) => `“${l}”`).join(", ")}
+              </p>
+            )}
+
+            {preview.rounds.map((r, ri) => {
+              const rs = rounds[ri];
+              if (!rs) return null;
+              return (
+                <div key={ri} className="space-y-2">
+                  <div className="flex flex-wrap items-center gap-2">
+                    <input
+                      value={rs.title}
+                      onChange={(e) => setRounds((all) => all.map((x, i) => (i === ri ? { ...x, title: e.target.value } : x)))}
+                      className={cn(field, "h-8 w-56 text-sm font-medium")}
+                    />
+                    <span className="text-xs text-zinc-500">due</span>
+                    <input
+                      type="datetime-local"
+                      value={rs.due}
+                      onChange={(e) => setRounds((all) => all.map((x, i) => (i === ri ? { ...x, due: e.target.value } : x)))}
+                      className={cn(field, "h-8 [color-scheme:dark]")}
+                    />
+                    {r.dueText && !rs.due && (
+                      <span className="text-xs text-amber-400">Couldn’t read “{r.dueText}”, set it by hand</span>
+                    )}
+                  </div>
+
+                  <div className="overflow-x-auto rounded-lg border border-zinc-800">
+                    <table className="w-full text-xs">
+                      <thead className="bg-zinc-950 text-left uppercase tracking-wider text-zinc-500">
+                        <tr>
+                          <th className="w-8 px-2 py-2" />
+                          <th className="px-2 py-2">Shot</th>
+                          <th className="px-2 py-2">Note</th>
+                          <th className="px-2 py-2">Version</th>
+                          <th className="px-2 py-2">Frame</th>
+                          <th className="px-2 py-2" title="Move the task to Changes">Changes</th>
+                        </tr>
+                      </thead>
+                      <tbody className="divide-y divide-zinc-800">
+                        {r.notes.map((n) => {
+                          const s = rs.notes[n.key];
+                          const v = n.versions.find((x) => x.id === s.versionId) ?? null;
+                          const frame = frameFor(n, s);
+                          return (
+                            <tr key={n.key} className={cn("align-top", !s.include && "opacity-40")}>
+                              <td className="px-2 py-2">
+                                <input
+                                  type="checkbox"
+                                  checked={s.include}
+                                  onChange={(e) => updateNote(ri, n.key, { include: e.target.checked })}
+                                  className="mt-1 accent-amber-500"
+                                />
+                              </td>
+                              <td className="whitespace-nowrap px-2 py-2 font-mono">
+                                {n.shot ? (
+                                  <span className="text-amber-400">{n.shot.shotCode}</span>
+                                ) : (
+                                  <div className="space-y-1">
+                                    <span className="flex items-center gap-1 text-red-400">
+                                      <AlertTriangle className="h-3 w-3" /> {n.code}
+                                    </span>
+                                    {n.suggestion ? (
+                                      <button
+                                        type="button"
+                                        onClick={() => applySuggestion(n.code, n.suggestion!)}
+                                        className="flex items-center gap-1 font-sans text-zinc-400 hover:text-amber-400"
+                                      >
+                                        <Link2 className="h-3 w-3" /> Use {n.suggestion}
+                                      </button>
+                                    ) : (
+                                      <span className="block font-sans text-zinc-500">Not in project; flag only</span>
+                                    )}
+                                  </div>
+                                )}
+                              </td>
+                              <td className="min-w-[16rem] px-2 py-2">
+                                <textarea
+                                  value={s.text}
+                                  onChange={(e) => updateNote(ri, n.key, { text: e.target.value })}
+                                  rows={Math.min(5, Math.max(1, Math.ceil(s.text.length / 60)))}
+                                  className={cn(field, "w-full resize-y py-1 leading-snug")}
+                                />
+                              </td>
+                              <td className="px-2 py-2">
+                                {n.versions.length > 0 ? (
+                                  <select
+                                    value={s.versionId ?? ""}
+                                    onChange={(e) => updateNote(ri, n.key, { versionId: e.target.value || null, frame: null })}
+                                    className={cn(field, "h-7")}
+                                  >
+                                    {n.versions.map((o) => (
+                                      <option key={o.id} value={o.id}>
+                                        {o.label}
+                                        {o.sent ? ` · sent${o.sharedAt ? " " + format(new Date(o.sharedAt), "d MMM") : ""}` : " · not sent"}
+                                      </option>
+                                    ))}
+                                    <option value="">Board only</option>
+                                  </select>
+                                ) : (
+                                  <span className="text-zinc-500">{n.shot ? "No versions; board only" : "—"}</span>
+                                )}
+                                {v && !v.sent && <span className="mt-1 block text-amber-400/80">Not sent to client</span>}
+                              </td>
+                              <td className="px-2 py-2">
+                                {s.versionId ? (
+                                  <>
+                                    <input
+                                      inputMode="numeric"
+                                      value={s.frame ?? (frame != null ? String(frame) : "")}
+                                      onChange={(e) => updateNote(ri, n.key, { frame: e.target.value.replace(/\D/g, "") })}
+                                      placeholder="0"
+                                      className={cn(field, "h-7 w-16 font-mono")}
+                                    />
+                                    {n.quotedFrame != null && s.frame === null && v && (
+                                      <span className="mt-1 block whitespace-nowrap text-zinc-500">
+                                        {v.fromComp ? `comp ${n.quotedFrame}` : `as quoted`}
+                                      </span>
+                                    )}
+                                  </>
+                                ) : (
+                                  <span className="text-zinc-600">—</span>
+                                )}
+                              </td>
+                              <td className="px-2 py-2 text-center">
+                                {v?.taskId ? (
+                                  <input
+                                    type="checkbox"
+                                    checked={s.setChanges}
+                                    disabled={v.taskStatus === "CHANGES"}
+                                    title={v.taskStatus === "CHANGES" ? "Already in Changes" : "Move the task to Changes"}
+                                    onChange={(e) => updateNote(ri, n.key, { setChanges: e.target.checked })}
+                                    className="mt-1 accent-amber-500"
+                                  />
+                                ) : (
+                                  <span className="text-zinc-600">—</span>
+                                )}
+                              </td>
+                            </tr>
+                          );
+                        })}
+                      </tbody>
+                    </table>
+                  </div>
+                </div>
+              );
+            })}
+
+            <div className="flex flex-wrap items-center justify-between gap-2">
+              <Button variant="ghost" onClick={() => setPreview(null)} disabled={isPending}>
+                <ArrowLeft /> Edit paste
+              </Button>
+              <Button onClick={save} disabled={isPending || included.length === 0}>
+                {isPending ? "Saving…" : `Save ${included.length} note${included.length === 1 ? "" : "s"}`}
+              </Button>
+            </div>
+          </div>
+        )}
+      </DialogContent>
+    </Dialog>
+  );
+}

app/(dashboard)/board/page.tsx

@@ -0,0 +1,169 @@
+import { auth } from "@/auth";
+import { db } from "@/lib/db";
+import { redirect } from "next/navigation";
+import { suggestShot } from "@/lib/board-parse";
+import { BoardClient, type BoardProject } from "./BoardClient";
+
+export const metadata = { title: "Board" };
+
+// Done lines stay visible this long so "what did we get through" is answerable
+const DONE_WINDOW_MS = 7 * 86400000;
+
+export default async function BoardPage({
+  searchParams,
+}: {
+  searchParams: Promise<{ who?: string }>;
+}) {
+  const session = await auth();
+  if (!session?.user) redirect("/login");
+  if (session.user.role === "CLIENT") redirect("/dashboard");
+
+  const { who } = await searchParams;
+  const doneSince = new Date(Date.now() - DONE_WINDOW_MS);
+
+  const [projects, users] = await Promise.all([
+    db.project.findMany({
+      where: { status: { in: ["ACTIVE", "ON_HOLD"] } },
+      orderBy: [{ status: "asc" }, { name: "asc" }],
+      select: {
+        id: true,
+        name: true,
+        code: true,
+        status: true,
+        boardStatus: true,
+        boardStatusAt: true,
+        milestones: { orderBy: { date: "asc" } },
+        boardItems: {
+          where: { OR: [{ doneAt: null }, { doneAt: { gte: doneSince } }] },
+          orderBy: { sortOrder: "asc" },
+          include: {
+            assignee: { select: { id: true, name: true, image: true } },
+            round: { select: { id: true, title: true, dueAt: true } },
+            shot: {
+              select: {
+                id: true,
+                shotCode: true,
+                status: true,
+              },
+            },
+          },
+        },
+      },
+    }),
+    db.user.findMany({
+      where: { isActive: true, role: { not: "CLIENT" } },
+      select: { id: true, name: true, email: true, image: true },
+      orderBy: { name: "asc" },
+    }),
+  ]);
+
+  const projectIds = projects.map((p) => p.id);
+
+  // Latest version per linked shot — versions hang off the shot or its task
+  const linkedShotIds = [...new Set(projects.flatMap((p) => p.boardItems.map((i) => i.shotId).filter(Boolean) as string[]))];
+  const latestByShot = new Map<string, { id: string; versionNumber: number; approvalStatus: string; isClientVisible: boolean }>();
+  if (linkedShotIds.length) {
+    const versions = await db.version.findMany({
+      where: { OR: [{ shotId: { in: linkedShotIds } }, { task: { shotId: { in: linkedShotIds } } }] },
+      orderBy: { createdAt: "desc" },
+      select: {
+        id: true, versionNumber: true, approvalStatus: true, isClientVisible: true,
+        shotId: true, task: { select: { shotId: true } },
+      },
+    });
+    for (const v of versions) {
+      const sid = v.shotId ?? v.task?.shotId;
+      if (sid && !latestByShot.has(sid)) latestByShot.set(sid, v);
+    }
+  }
+
+  // Pasted-feedback lines link to the comment they were saved as
+  const commentIds = projects.flatMap((p) => p.boardItems.map((i) => i.commentId).filter(Boolean) as string[]);
+  const commentVersion = new Map(
+    (commentIds.length
+      ? await db.comment.findMany({ where: { id: { in: commentIds } }, select: { id: true, versionId: true, frameNumber: true } })
+      : []
+    ).map((c) => [c.id, c]),
+  );
+  const shotCounts = await db.shot.groupBy({
+    by: ["projectId", "status"],
+    where: { projectId: { in: projectIds } },
+    _count: { _all: true },
+  });
+
+  // Lines whose code did not match a shot when typed: the shot may exist now,
+  // or there may be an obvious near-miss (DH2_004_100 → DH2_VFX_004_100).
+  const flaggedProjects = projects.filter((p) => p.boardItems.some((i) => i.code && !i.shotId));
+  const shotsByProject = new Map(
+    await Promise.all(
+      flaggedProjects.map(async (p) => [
+        p.id,
+        await db.shot.findMany({
+          where: { projectId: p.id },
+          select: { id: true, shotCode: true, clientCode: true },
+        }),
+      ] as const),
+    ),
+  );
+
+  const data: BoardProject[] = projects.map((p) => {
+    const counts = shotCounts.filter((c) => c.projectId === p.id);
+    const shots = shotsByProject.get(p.id) ?? [];
+    return {
+      id: p.id,
+      name: p.name,
+      code: p.code,
+      status: p.status,
+      boardStatus: p.boardStatus,
+      boardStatusAt: p.boardStatusAt?.toISOString() ?? null,
+      shotTotal: counts.reduce((n, c) => n + c._count._all, 0),
+      shotComplete: counts.find((c) => c.status === "COMPLETE")?._count._all ?? 0,
+      milestones: p.milestones.map((m) => ({
+        id: m.id,
+        label: m.label,
+        date: m.date.toISOString(),
+        doneAt: m.doneAt?.toISOString() ?? null,
+      })),
+      items: p.boardItems.map((i) => {
+        const v = i.shot ? latestByShot.get(i.shot.id) : undefined;
+        const nowMatches = !i.shotId && i.code
+          ? shots.find((s) => s.shotCode.toUpperCase() === i.code!.toUpperCase())
+          : undefined;
+        const suggestion = !i.shotId && i.code && !nowMatches ? suggestShot(i.code, shots) : null;
+        return {
+          id: i.id,
+          text: i.text,
+          code: i.code,
+          group: i.group,
+          waitingOn: i.waitingOn,
+          round: i.round ? { id: i.round.id, title: i.round.title, dueAt: i.round.dueAt?.toISOString() ?? null } : null,
+          comment: i.commentId && commentVersion.has(i.commentId)
+            ? { versionId: commentVersion.get(i.commentId)!.versionId, frame: commentVersion.get(i.commentId)!.frameNumber }
+            : null,
+          doneAt: i.doneAt?.toISOString() ?? null,
+          assignee: i.assignee,
+          shot: i.shot
+            ? {
+                id: i.shot.id,
+                shotCode: i.shot.shotCode,
+                status: i.shot.status,
+                latest: v
+                  ? {
+                      id: v.id,
+                      versionNumber: v.versionNumber,
+                      approvalStatus: v.approvalStatus,
+                      isClientVisible: v.isClientVisible,
+                    }
+                  : null,
+              }
+            : null,
+          // Shot created since the line was typed: offer to link it
+          relinkTo: nowMatches?.shotCode ?? suggestion?.shotCode ?? null,
+          relinkIsExact: !!nowMatches,
+        };
+      }),
+    };
+  });
+
+  return <BoardClient projects={data} users={users} who={who ?? null} />;
+}

app/(dashboard)/clients/[clientId]/page.tsx

@@ -59,7 +59,7 @@ export default async function ClientDetailPage({
   };
 
   return (
-    <div className="p-6 max-w-5xl mx-auto space-y-6">
+    <div className="p-4 md:p-6 max-w-5xl mx-auto space-y-6">
       {/* Back */}
       <Link
         href="/clients"

app/(dashboard)/clients/page.tsx

@@ -26,7 +26,7 @@ export default async function ClientsPage() {
   const clients = await getClients();
 
   return (
-    <div className="p-6 max-w-5xl mx-auto space-y-6">
+    <div className="p-4 md:p-6 max-w-5xl mx-auto space-y-6">
       {/* Header */}
       <div className="flex items-center justify-between">
         <div>

app/(dashboard)/dashboard/page.tsx

@@ -1,58 +1,69 @@
 import { auth } from "@/auth";
 import { db } from "@/lib/db";
 import { StatsCards } from "@/components/dashboard/StatsCards";
+import { BlockedQueue } from "@/components/dashboard/BlockedQueue";
+import { FarmStrip } from "@/components/dashboard/FarmStrip";
+import { DeliveryCountdown } from "@/components/dashboard/DeliveryCountdown";
+import { QcQueue } from "@/components/dashboard/QcQueue";
+import { AwaitingDelivery } from "@/components/dashboard/AwaitingDelivery";
+import { LogRequestButton } from "@/components/dashboard/LogRequestButton";
+import { RecentDeliveries } from "@/components/dashboard/RecentDeliveries";
+import { WhoseCourt } from "@/components/dashboard/WhoseCourt";
 import { ShotQueue } from "@/components/dashboard/ShotQueue";
-import { RecentActivity } from "@/components/dashboard/RecentActivity";
 import { TaskWidgets } from "@/components/dashboard/TaskWidgets";
 import { ScheduleWidgets } from "@/components/dashboard/ScheduleWidgets";
+import {
+  getAwaitingDelivery,
+  getBlockedExports,
+  getDeliveryCountdown,
+  getFarmStatus,
+  getOpsCounts,
+  getQcQueue,
+  getQcStaleHours,
+  getRecentDeliveries,
+  getWhoseCourt,
+} from "@/lib/dashboard/ops";
+import { listDeliveryRequests } from "@/lib/render-pipeline/delivery-requests";
 import type { DashboardStats } from "@/types";
 
 export const metadata = { title: "Dashboard" };
 
+// Queue depth and machine state are stale the moment they are cached.
+export const dynamic = "force-dynamic";
+
+/**
+ * The dashboard answers one question: can we ship what is due, and what is
+ * stopping us? Everything on it is pipeline state — exports, QC, deliveries,
+ * worker heartbeats — rather than anything a person has to maintain by hand.
+ */
 async function getDashboardData(userId: string, role: string) {
   const isArtist = role === "ARTIST";
   const isClient = role === "CLIENT";
-  const now = new Date();
-  const todayStart = new Date(now.getFullYear(), now.getMonth(), now.getDate());
-  const todayEnd = new Date(todayStart.getTime() + 86400000);
 
-  const [awaitingReview, needsRevisions, approved, activeProjects,
+  // Producers see the floor; an artist sees the failures that are theirs.
-    tasksDueToday, tasksInReview, tasksOverdue, myTasksCount] =
+  const [counts, blocked, farm, episodes, qcQueue, qcStaleHours, deliveries, awaitingDelivery, openRequests, court] =
     await Promise.all([
-      db.version.count({ where: { approvalStatus: "PENDING_REVIEW" } }),
+      getOpsCounts(isArtist ? userId : undefined),
-      db.version.count({ where: { approvalStatus: "NEEDS_CHANGES" } }),
+      getBlockedExports(isArtist ? { artistId: userId } : {}),
-      db.version.count({ where: { approvalStatus: "APPROVED" } }),
+      getFarmStatus(),
-      db.project.count({ where: { status: "ACTIVE" } }),
+      getDeliveryCountdown(),
-      db.task.count({
+      isArtist || isClient ? [] : getQcQueue(),
-        where: {
+      getQcStaleHours(),
-          dueDate: { gte: todayStart, lt: todayEnd },
+      isArtist || isClient ? [] : getRecentDeliveries(),
-          status: { not: "DONE" },
+      isArtist || isClient ? [] : getAwaitingDelivery(),
-          ...(isArtist ? { assignedArtistId: userId } : {}),
+      isArtist || isClient ? [] : listDeliveryRequests({ openOnly: true }),
-        },
+      isArtist || isClient ? null : getWhoseCourt(),
-      }),
-      db.task.count({
-        where: {
-          status: { in: ["INTERNAL_REVIEW", "CLIENT_REVIEW"] },
-          ...(isArtist ? { assignedArtistId: userId } : {}),
-        },
-      }),
-      db.task.count({
-        where: {
-          dueDate: { lt: todayStart },
-          status: { not: "DONE" },
-          ...(isArtist ? { assignedArtistId: userId } : {}),
-        },
-      }),
-      db.task.count({
-        where: { assignedArtistId: userId, status: { not: "DONE" } },
-      }),
     ]);
 
-  const shotsWhere = isArtist ? { artistId: userId } : {};
+  // An artist's own shots come first; everyone else sees the floor.
   const shots = await db.shot.findMany({
-    where: { ...shotsWhere, status: { not: "COMPLETE" } },
+    where: {
+      ...(isArtist ? { artistId: userId } : {}),
+      status: { not: "COMPLETE" },
+      project: { status: { in: ["ACTIVE", "ON_HOLD"] } },
+    },
     take: 15,
-    orderBy: { updatedAt: "desc" },
+    orderBy: [{ dueDate: { sort: "asc", nulls: "last" } }, { updatedAt: "desc" }],
     include: {
       artist: { select: { id: true, name: true, image: true, email: true } },
       versions: {
@@ -63,12 +74,8 @@ async function getDashboardData(userId: string, role: string) {
     },
   });
 
-  // My tasks (for widget)
   const myTasks = await db.task.findMany({
-    where: {
+    where: { assignedArtistId: userId, status: { not: "DONE" } },
-      assignedArtistId: userId,
-      status: { not: "DONE" },
-    },
     take: 8,
     orderBy: [{ dueDate: "asc" }, { priority: "desc" }],
     include: {
@@ -78,7 +85,6 @@ async function getDashboardData(userId: string, role: string) {
     },
   });
 
-  // Tasks in review (for supervisors/producers)
   const reviewTasks = isArtist || isClient ? [] : await db.task.findMany({
     where: { status: { in: ["INTERNAL_REVIEW", "CLIENT_REVIEW"] } },
     take: 8,
@@ -91,14 +97,8 @@ async function getDashboardData(userId: string, role: string) {
     },
   });
 
-  const activity = await db.notification.findMany({
+  // Schedule overview (producers/supervisors/admins) — unchanged; it reads the
-    where: isClient ? { userId } : {},
+  // schedule page's own data rather than anything the pipeline owns.
-    take: 20,
-    orderBy: { createdAt: "desc" },
-    include: { user: { select: { name: true, image: true } } },
-  });
-
-  // Schedule data (for producers/supervisors/admins)
   const scheduledTasks =
     !isArtist && !isClient
       ? await db.task.findMany({
@@ -119,46 +119,59 @@ async function getDashboardData(userId: string, role: string) {
     !isArtist && !isClient
       ? await db.user.findMany({
           where: { isActive: true, role: { not: "CLIENT" } },
-          select: {
+          select: { id: true, name: true, email: true, image: true, role: true },
-            id: true,
-            name: true,
-            email: true,
-            image: true,
-            role: true,
-          },
           orderBy: { name: "asc" },
         })
       : [];
 
-  const stats: DashboardStats = {
+  const stats: DashboardStats = counts;
-    awaitingReview,
-    needsRevisions,
-    approved,
-    overdue: tasksOverdue,
-    activeProjects,
-    tasksDueToday,
-    tasksInReview,
-    tasksOverdue,
-    myTasksCount,
-  };
 
-  return { stats, shots, activity, myTasks, reviewTasks, scheduledTasks, scheduleArtists };
+  return {
+    stats,
+    blocked,
+    farm,
+    episodes,
+    qcQueue,
+    qcStaleHours,
+    deliveries,
+    awaitingDelivery,
+    openRequests,
+    court,
+    shots,
+    myTasks,
+    reviewTasks,
+    scheduledTasks,
+    scheduleArtists,
+  };
 }
 
 export default async function DashboardPage() {
   const session = await auth();
   if (!session?.user) return null;
 
-  const { stats, shots, activity, myTasks, reviewTasks, scheduledTasks, scheduleArtists } =
-    await getDashboardData(session.user.id, session.user.role);
-
   const isClient = session.user.role === "CLIENT";
-  const canSeeSchedule = ["ADMIN", "PRODUCER", "SUPERVISOR"].includes(
+  const isArtistRole = session.user.role === "ARTIST";
-    session.user.role
+  const canSeeSchedule = ["ADMIN", "PRODUCER", "SUPERVISOR"].includes(session.user.role);
-  );
+  const {
+    stats,
+    blocked,
+    farm,
+    episodes,
+    qcQueue,
+    qcStaleHours,
+    deliveries,
+    awaitingDelivery,
+    openRequests,
+    court,
+    shots,
+    myTasks,
+    reviewTasks,
+    scheduledTasks,
+    scheduleArtists,
+  } = await getDashboardData(session.user.id, session.user.role);
 
   return (
-    <div className="p-8 space-y-6 max-w-[1600px] mx-auto">
+    <div className="p-4 md:p-8 space-y-6 max-w-[1600px] mx-auto">
       <div className="mb-4">
         <h1 className="text-3xl font-bold text-white">Dashboard</h1>
         <p className="text-zinc-400 mt-1">
@@ -166,7 +179,82 @@ export default async function DashboardPage() {
         </p>
       </div>
 
-      <StatsCards stats={stats} />
+      {!isClient && <StatsCards stats={stats} />}
+
+      {/* Rows only clear by being dealt with; the heading stays so there is
+          always somewhere to log what a client just asked for. */}
+      {!isClient && !isArtistRole && (
+        <div className="space-y-3">
+          <div className="flex items-center justify-between gap-3">
+            <h2
+              className={
+                openRequests.length + awaitingDelivery.length > 0
+                  ? "text-sm font-semibold text-amber-400 uppercase tracking-wide"
+                  : "text-sm font-semibold text-muted-foreground uppercase tracking-wide"
+              }
+            >
+              Awaiting delivery
+            </h2>
+            {canSeeSchedule && <LogRequestButton />}
+          </div>
+          <AwaitingDelivery requests={openRequests} packages={awaitingDelivery} />
+        </div>
+      )}
+
+      {!isClient && (
+        <div className="space-y-3">
+          <h2 className="text-sm font-semibold text-muted-foreground uppercase tracking-wide">
+            Delivery countdown
+          </h2>
+          <DeliveryCountdown episodes={episodes} />
+        </div>
+      )}
+
+      {!isClient && (
+        <div id="blocked" className="grid grid-cols-1 xl:grid-cols-3 gap-6 items-start scroll-mt-6">
+          <div className="xl:col-span-2 space-y-3">
+            <h2 className="text-sm font-semibold text-muted-foreground uppercase tracking-wide">
+              {isArtistRole ? "Your blocked shots" : "Blocked — needs a human"}
+            </h2>
+            <BlockedQueue blocked={blocked} />
+          </div>
+
+          <div className="space-y-3">
+            <h2 className="text-sm font-semibold text-muted-foreground uppercase tracking-wide">
+              Render farm
+            </h2>
+            <FarmStrip farm={farm} />
+          </div>
+        </div>
+      )}
+
+      {!isClient && !isArtistRole && (
+        <div className="grid grid-cols-1 xl:grid-cols-3 gap-6 items-start">
+          <div className="xl:col-span-2 space-y-3">
+            <h2 className="text-sm font-semibold text-muted-foreground uppercase tracking-wide">
+              QC queue
+            </h2>
+            <QcQueue entries={qcQueue} staleHours={qcStaleHours} />
+          </div>
+
+          <div className="space-y-6">
+            <div className="space-y-3">
+              <h2 className="text-sm font-semibold text-muted-foreground uppercase tracking-wide">
+                Deliveries
+              </h2>
+              <RecentDeliveries deliveries={deliveries} />
+            </div>
+            {court && (
+              <div className="space-y-3">
+                <h2 className="text-sm font-semibold text-muted-foreground uppercase tracking-wide">
+                  Whose court
+                </h2>
+                <WhoseCourt court={court} />
+              </div>
+            )}
+          </div>
+        </div>
+      )}
 
       {!isClient && (
         <TaskWidgets
@@ -181,32 +269,18 @@ export default async function DashboardPage() {
           <h2 className="text-sm font-semibold text-muted-foreground uppercase tracking-wide">
             Schedule Overview
           </h2>
-          <ScheduleWidgets
+          <ScheduleWidgets scheduledTasks={scheduledTasks as any} artists={scheduleArtists} />
-            scheduledTasks={scheduledTasks as any}
-            artists={scheduleArtists}
-          />
         </div>
       )}
 
-      <div className="grid grid-cols-1 xl:grid-cols-3 gap-6">
+      <div className="space-y-3">
-        <div className="xl:col-span-2 space-y-3">
         <h2 className="text-sm font-semibold text-muted-foreground uppercase tracking-wide">
-            Shot Queue
+          {session.user.role === "ARTIST" ? "My shots" : "Shots in flight"}
         </h2>
         <div className="rounded-lg border border-border bg-card p-1">
           <ShotQueue shots={shots as any} />
         </div>
       </div>
-
-        <div className="space-y-3">
-          <h2 className="text-sm font-semibold text-muted-foreground uppercase tracking-wide">
-            Recent Activity
-          </h2>
-          <div className="rounded-lg border border-border bg-card h-[400px] overflow-hidden">
-            <RecentActivity activities={activity as any} />
-          </div>
-        </div>
-      </div>
     </div>
   );
 }

app/(dashboard)/layout.tsx

@@ -2,6 +2,7 @@ import { auth } from "@/auth";
 import { redirect } from "next/navigation";
 import { Sidebar } from "@/components/layout/Sidebar";
 import { Header } from "@/components/layout/Header";
+import { MobileNavProvider } from "@/components/layout/MobileNav";
 
 export default async function DashboardLayout({
   children,
@@ -12,6 +13,7 @@ export default async function DashboardLayout({
   if (!session?.user) redirect("/login");
 
   return (
+    <MobileNavProvider>
       <div className="flex h-screen bg-zinc-950 overflow-hidden print:block print:h-auto print:overflow-visible">
         <div className="print:hidden">
           <Sidebar />
@@ -25,5 +27,6 @@ export default async function DashboardLayout({
           </main>
         </div>
       </div>
+    </MobileNavProvider>
   );
 }

app/(dashboard)/pipeline/PipelineQueueClient.tsx

@@ -1,12 +1,14 @@
 "use client";
 
-import { useState } from "react";
+import { useEffect, useState } from "react";
 import Link from "next/link";
 import { useQuery, useQueryClient } from "@tanstack/react-query";
 import { useSession } from "next-auth/react";
-import { RefreshCw, RotateCcw, XCircle, CheckCircle2, Server } from "lucide-react";
+import { RefreshCw, RotateCcw, XCircle, CheckCircle2, Server, Package, ChevronLeft, ChevronRight, Search, X } from "lucide-react";
 import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
 import { Progress } from "@/components/ui/progress";
+import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
 import {
   Select,
   SelectContent,
@@ -51,37 +53,79 @@ interface QueueExport {
 
 interface Props {
   projects: { id: string; name: string; code: string }[];
+  /** Status to open filtered to, from `?status=` (see page.tsx). */
+  initialStatus?: string;
 }
 
-export function PipelineQueueClient({ projects }: Props) {
+const PAGE_SIZE = 25;
+
+const BLENDER_ACTIVE = ["QUEUED", "CLAIMED", "RUNNING"];
+
+export function PipelineQueueClient({ projects, initialStatus = "all" }: Props) {
   const { data: session } = useSession();
   const { toast } = useToast();
   const queryClient = useQueryClient();
   const [projectId, setProjectId] = useState<string>("all");
-  const [statusFilter, setStatusFilter] = useState<string>("all");
+  const [statusFilter, setStatusFilter] = useState<string>(initialStatus);
+  const [page, setPage] = useState(1);
+  const [searchInput, setSearchInput] = useState("");
+  const [search, setSearch] = useState("");
   const isAdmin = ["ADMIN", "PRODUCER", "SUPERVISOR"].includes(session?.user?.role ?? "");
 
+  // Searched on the server (the table is paged there), so typing is debounced
+  // rather than firing a request per keystroke.
+  useEffect(() => {
+    const next = searchInput.trim();
+    if (next === search) return;
+    const t = setTimeout(() => {
+      setSearch(next);
+      setPage(1);
+    }, 300);
+    return () => clearTimeout(t);
+  }, [searchInput, search]);
+
   const { data, isLoading, refetch, isFetching } = useQuery({
-    queryKey: ["pipeline-queue", projectId, statusFilter],
+    queryKey: ["pipeline-queue", projectId, statusFilter, search, page],
     queryFn: async () => {
-      const params = new URLSearchParams({ limit: "200" });
+      const params = new URLSearchParams({ limit: String(PAGE_SIZE), page: String(page) });
       if (projectId !== "all") params.set("projectId", projectId);
       if (statusFilter !== "all") params.set("status", statusFilter);
+      if (search) params.set("q", search);
       const res = await fetch(`/api/render/queue?${params}`);
       if (!res.ok) throw new Error("Failed to load queue");
-      return res.json() as Promise<{ exports: QueueExport[]; pagination: { total: number } }>;
+      return res.json() as Promise<{
+        exports: QueueExport[];
+        pagination: { page: number; total: number; pages: number };
+        statusCounts: Record<string, number>;
+      }>;
+    },
+    refetchInterval: 5000,
+    // Keep the current page on screen while the next one loads, instead of
+    // flashing "Loading…" on every page turn.
+    placeholderData: (previous) => previous,
+  });
+
+  // Fetched here rather than in the tab so the tab label can say how many are
+  // running: a Blender render must not become invisible by sitting in a tab.
+  const { data: blenderData } = useQuery({
+    queryKey: ["blender-jobs", projectId],
+    queryFn: async () => {
+      const qs = projectId !== "all" ? `?projectId=${encodeURIComponent(projectId)}` : "";
+      const res = await fetch(`/api/render/blender${qs}`);
+      if (!res.ok) throw new Error("Failed to load Blender jobs");
+      return res.json() as Promise<{ jobs: BlenderJobRow[] }>;
     },
     refetchInterval: 5000,
   });
 
   const exports = data?.exports ?? [];
-  const counts = {
+  const pagination = data?.pagination;
-    queued: exports.filter((e) => e.status === "QUEUED").length,
+  const statusCounts = data?.statusCounts ?? {};
-    rendering: exports.filter((e) => e.status === "RENDERING").length,
+  const countOf = (statuses: string[]) => statuses.reduce((n, s) => n + (statusCounts[s] ?? 0), 0);
-    failed: exports.filter((e) => FAILED_STATUSES.includes(e.status)).length,
+  const totalExports = Object.values(statusCounts).reduce((n, c) => n + c, 0);
-    readyForQc: exports.filter((e) => e.status === "READY_FOR_QC").length,
+  const blenderJobs = blenderData?.jobs ?? [];
-    readyForDelivery: exports.filter((e) => e.status === "READY_FOR_DELIVERY").length,
+  const blenderActive = blenderJobs.filter((j) => BLENDER_ACTIVE.includes(j.status)).length;
-  };
+  const blenderFailed = blenderJobs.filter((j) => ["FAILED", "EXPIRED"].includes(j.status)).length;
 
   async function action(exportId: string, verb: "retry" | "cancel" | "mark-done") {
     const res = await fetch(`/api/render/exports/${exportId}/${verb}`, { method: "POST" });
@@ -94,49 +138,44 @@ export function PipelineQueueClient({ projects }: Props) {
     queryClient.invalidateQueries({ queryKey: ["pipeline-queue"] });
   }
 
-  const cards: { label: string; value: number; className?: string }[] = [
+  const cards: { label: string; value: number; status?: string; className?: string }[] = [
-    { label: "Queued", value: counts.queued },
+    { label: "Queued", value: countOf(["QUEUED"]), status: "QUEUED" },
-    { label: "Rendering", value: counts.rendering, className: "text-blue-400" },
+    { label: "Rendering", value: countOf(["RENDERING"]), status: "RENDERING", className: "text-blue-400" },
-    { label: "Failed", value: counts.failed, className: "text-red-400" },
+    // Several statuses count as failed and the filter takes one, so this card
-    { label: "Ready for QC", value: counts.readyForQc, className: "text-amber-400" },
+    // is a figure only.
-    { label: "Ready for Delivery", value: counts.readyForDelivery, className: "text-green-400" },
+    { label: "Failed", value: countOf(FAILED_STATUSES), className: "text-red-400" },
+    { label: "Ready for QC", value: countOf(["READY_FOR_QC"]), status: "READY_FOR_QC", className: "text-amber-400" },
+    {
+      label: "Ready for Delivery",
+      value: countOf(["READY_FOR_DELIVERY"]),
+      status: "READY_FOR_DELIVERY",
+      className: "text-green-400",
+    },
   ];
 
+  const changeProject = (id: string) => {
+    setProjectId(id);
+    setPage(1);
+  };
+  const changeStatus = (status: string) => {
+    setStatusFilter(status);
+    setPage(1);
+  };
+
+  const firstRow = pagination && pagination.total > 0 ? (pagination.page - 1) * PAGE_SIZE + 1 : 0;
+  const lastRow = pagination ? Math.min(pagination.page * PAGE_SIZE, pagination.total) : 0;
+
   return (
-    <div className="p-6 space-y-6">
+    <div className="p-4 md:p-6 space-y-6">
       <div className="flex items-center justify-between gap-4 flex-wrap">
         <div>
           <h1 className="text-2xl font-semibold text-white">Render Queue</h1>
           <p className="text-sm text-zinc-400 mt-1">
-            Exports queued from the AE panel — live status, retries and history
+            After Effects exports and Blender renders — live status, retries and history
           </p>
         </div>
-        <div className="flex items-center gap-2">
+        <div className="flex items-center gap-2 flex-wrap">
-          <Link href="/pipeline/machines">
+          <Select value={projectId} onValueChange={changeProject}>
-            <Button variant="outline" size="sm">
-              <Server className="h-4 w-4 mr-2" />
-              Machines
-            </Button>
-          </Link>
-          <Button variant="outline" size="sm" onClick={() => refetch()} disabled={isFetching}>
-            <RefreshCw className={cn("h-4 w-4", isFetching && "animate-spin")} />
-          </Button>
-        </div>
-      </div>
-
-      {/* Summary cards */}
-      <div className="grid grid-cols-2 sm:grid-cols-5 gap-3">
-        {cards.map((c) => (
-          <div key={c.label} className="rounded-lg border border-zinc-800 bg-zinc-900 px-4 py-3">
-            <div className={cn("text-2xl font-semibold text-white", c.className)}>{c.value}</div>
-            <div className="text-xs text-zinc-400 mt-0.5">{c.label}</div>
-          </div>
-        ))}
-      </div>
-
-      {/* Filters */}
-      <div className="flex items-center gap-3 flex-wrap">
-        <Select value={projectId} onValueChange={setProjectId}>
             <SelectTrigger className="w-56">
               <SelectValue placeholder="All projects" />
             </SelectTrigger>
@@ -149,7 +188,100 @@ export function PipelineQueueClient({ projects }: Props) {
               ))}
             </SelectContent>
           </Select>
-        <Select value={statusFilter} onValueChange={setStatusFilter}>
+          <Link href="/pipeline/deliveries">
+            <Button variant="outline" size="sm">
+              <Package className="h-4 w-4 mr-2" />
+              Deliveries
+            </Button>
+          </Link>
+          <Link href="/pipeline/machines">
+            <Button variant="outline" size="sm">
+              <Server className="h-4 w-4 mr-2" />
+              Machines
+            </Button>
+          </Link>
+          <Button variant="outline" size="sm" onClick={() => refetch()} disabled={isFetching}>
+            <RefreshCw className={cn("h-4 w-4", isFetching && "animate-spin")} />
+          </Button>
+        </div>
+      </div>
+
+      <Tabs defaultValue="exports" className="space-y-4">
+        <TabsList className="bg-zinc-900 border border-zinc-800">
+          <TabsTrigger value="exports">
+            After Effects exports
+            <span className="ml-2 text-xs text-zinc-500">{totalExports}</span>
+          </TabsTrigger>
+          <TabsTrigger value="blender">
+            Blender renders
+            {blenderActive > 0 ? (
+              <span className="ml-2 rounded-full bg-blue-500/20 px-1.5 text-xs text-blue-400">
+                {blenderActive} active
+              </span>
+            ) : blenderFailed > 0 ? (
+              <span className="ml-2 rounded-full bg-red-500/20 px-1.5 text-xs text-red-400">
+                {blenderFailed} failed
+              </span>
+            ) : (
+              <span className="ml-2 text-xs text-zinc-500">{blenderJobs.length}</span>
+            )}
+          </TabsTrigger>
+        </TabsList>
+
+        <TabsContent value="exports" className="space-y-4 mt-0">
+          {/* Summary cards — each one with a status filters the table to what it counts */}
+          <div className="grid grid-cols-2 sm:grid-cols-5 gap-3">
+            {cards.map((c) => {
+              const selected = c.status !== undefined && statusFilter === c.status;
+              const body = (
+                <>
+                  <div className={cn("text-2xl font-semibold text-white", c.className)}>{c.value}</div>
+                  <div className="text-xs text-zinc-400 mt-0.5">{c.label}</div>
+                </>
+              );
+              return c.status ? (
+                <button
+                  key={c.label}
+                  type="button"
+                  onClick={() => changeStatus(selected ? "all" : c.status!)}
+                  className={cn(
+                    "rounded-lg border bg-zinc-900 px-4 py-3 text-left transition-colors hover:border-zinc-600",
+                    selected ? "border-zinc-500" : "border-zinc-800"
+                  )}
+                >
+                  {body}
+                </button>
+              ) : (
+                <div key={c.label} className="rounded-lg border border-zinc-800 bg-zinc-900 px-4 py-3">
+                  {body}
+                </div>
+              );
+            })}
+          </div>
+
+          <div className="flex items-center gap-2 flex-wrap">
+            <div className="relative w-full sm:w-72">
+              <Search className="pointer-events-none absolute left-2.5 top-1/2 h-4 w-4 -translate-y-1/2 text-zinc-500" />
+              <Input
+                value={searchInput}
+                onChange={(e) => setSearchInput(e.target.value)}
+                onKeyDown={(e) => e.key === "Escape" && setSearchInput("")}
+                placeholder="Search shots, e.g. UNG_114"
+                aria-label="Search exports by shot code"
+                className="pl-8 pr-8"
+              />
+              {searchInput && (
+                <button
+                  type="button"
+                  onClick={() => setSearchInput("")}
+                  className="absolute right-2 top-1/2 -translate-y-1/2 text-zinc-500 hover:text-zinc-300"
+                  aria-label="Clear search"
+                >
+                  <X className="h-4 w-4" />
+                </button>
+              )}
+            </div>
+            <Select value={statusFilter} onValueChange={changeStatus}>
               <SelectTrigger className="w-56">
                 <SelectValue placeholder="All statuses" />
               </SelectTrigger>
@@ -164,7 +296,6 @@ export function PipelineQueueClient({ projects }: Props) {
             </Select>
           </div>
 
-      {/* Table */}
           <div className="rounded-lg border border-zinc-800 overflow-x-auto">
             <table className="w-full text-sm">
               <thead>
@@ -189,7 +320,11 @@ export function PipelineQueueClient({ projects }: Props) {
                 ) : exports.length === 0 ? (
                   <tr>
                     <td colSpan={8} className="px-4 py-10 text-center text-zinc-500">
-                  No exports yet — queue one from the After Effects panel
+                      {search
+                        ? `No exports match “${search}”`
+                        : statusFilter === "all"
+                          ? "No exports yet — queue one from the After Effects panel"
+                          : `No exports are ${statusLabel(statusFilter).toLowerCase()}`}
                     </td>
                   </tr>
                 ) : (
@@ -232,9 +367,7 @@ export function PipelineQueueClient({ projects }: Props) {
                         )}
                       </td>
                       <td className="px-4 py-2.5 text-zinc-400">{e.job?.machineName ?? "—"}</td>
-                  <td className="px-4 py-2.5 text-zinc-400">
+                      <td className="px-4 py-2.5 text-zinc-400">{e.job ? `${e.job.attempt}` : "—"}</td>
-                    {e.job ? `${e.job.attempt}` : "—"}
-                  </td>
                       <td className="px-4 py-2.5 text-zinc-500 text-xs whitespace-nowrap">
                         {new Date(e.createdAt).toLocaleString()}
                       </td>
@@ -268,6 +401,143 @@ export function PipelineQueueClient({ projects }: Props) {
               </tbody>
             </table>
           </div>
+
+          {pagination && pagination.pages > 1 && (
+            <div className="flex items-center justify-between text-sm text-zinc-400">
+              <span>
+                {firstRow}–{lastRow} of {pagination.total}
+              </span>
+              <div className="flex items-center gap-2">
+                <Button variant="outline" size="sm" disabled={page <= 1} onClick={() => setPage((p) => p - 1)}>
+                  <ChevronLeft className="h-4 w-4" />
+                </Button>
+                <span className="text-xs">
+                  Page {pagination.page} of {pagination.pages}
+                </span>
+                <Button
+                  variant="outline"
+                  size="sm"
+                  disabled={page >= pagination.pages}
+                  onClick={() => setPage((p) => p + 1)}
+                >
+                  <ChevronRight className="h-4 w-4" />
+                </Button>
+              </div>
+            </div>
+          )}
+        </TabsContent>
+
+        <TabsContent value="blender" className="mt-0">
+          <BlenderQueue jobs={blenderJobs} loaded={blenderData !== undefined} />
+        </TabsContent>
+      </Tabs>
+    </div>
+  );
+}
+
+interface BlenderJobRow {
+  id: string;
+  label: string | null;
+  status: string;
+  attempt: number;
+  maxAttempts: number;
+  progress: number;
+  currentFrame: number | null;
+  totalFrames: number | null;
+  etaSeconds: number | null;
+  errorMessage: string | null;
+  machineName: string | null;
+  submittedBy: string | null;
+  projectCode: string | null;
+  blendFile: string | null;
+  frameStart: number | null;
+  frameEnd: number | null;
+  createdAt: string;
+}
+
+const BLENDER_STATUS_STYLES: Record<string, string> = {
+  QUEUED: "bg-zinc-500/15 text-zinc-300 border-zinc-500/30",
+  CLAIMED: "bg-blue-500/15 text-blue-400 border-blue-500/30",
+  RUNNING: "bg-blue-500/15 text-blue-400 border-blue-500/30",
+  COMPLETED: "bg-emerald-500/15 text-emerald-400 border-emerald-500/30",
+  FAILED: "bg-red-500/15 text-red-400 border-red-500/30",
+  CANCELLED: "bg-zinc-500/10 text-zinc-500 border-zinc-600/30",
+  EXPIRED: "bg-red-500/15 text-red-400 border-red-500/30",
+};
+
+/**
+ * Standalone Blender renders. They have no Export behind them, so they cannot
+ * appear in the exports table — but they share the queue, and a render nobody
+ * can see is a render nobody can retry.
+ */
+function BlenderQueue({ jobs, loaded }: { jobs: BlenderJobRow[]; loaded: boolean }) {
+  const { toast } = useToast();
+  const queryClient = useQueryClient();
+
+  async function jobAction(id: string, verb: "cancel" | "retry") {
+    const res = await fetch(`/api/render/blender/${id}?action=${verb}`, { method: "POST" });
+    if (!res.ok) {
+      const body = await res.json().catch(() => ({}));
+      toast({ title: `${verb} failed`, description: body.error ?? res.statusText, variant: "destructive" });
+    }
+    queryClient.invalidateQueries({ queryKey: ["blender-jobs"] });
+  }
+
+  if (jobs.length === 0) {
+    return (
+      <div className="rounded-lg border border-zinc-800 px-4 py-10 text-center text-sm text-zinc-500">
+        {loaded ? "No Blender renders yet — submit one from the Blender panel" : "Loading…"}
+      </div>
+    );
+  }
+
+  return (
+    <div className="rounded-lg border border-zinc-800 bg-zinc-900/40">
+      <div className="divide-y divide-zinc-800/60">
+        {jobs.map((j) => (
+          <div key={j.id} className="px-4 py-3 text-sm">
+            <div className="flex items-center gap-3 flex-wrap">
+              <span className="text-zinc-200">{j.label ?? "(untitled)"}</span>
+              <span className={cn("rounded-full border px-2 py-0.5 text-xs", BLENDER_STATUS_STYLES[j.status] ?? "")}>
+                {j.status.toLowerCase()}
+              </span>
+              {j.projectCode && <span className="text-xs text-zinc-500">{j.projectCode}</span>}
+              {j.frameStart != null && (
+                <span className="text-xs text-zinc-500">
+                  frames {j.frameStart}–{j.frameEnd}
+                </span>
+              )}
+              {j.status === "RUNNING" && (
+                <span className="text-xs text-blue-400">
+                  {Math.round(j.progress * 100)}%
+                  {j.currentFrame != null ? ` · frame ${j.currentFrame}` : ""}
+                  {j.etaSeconds ? ` · ETA ${formatEta(j.etaSeconds)}` : ""}
+                </span>
+              )}
+              {j.machineName && <span className="text-xs text-zinc-500">{j.machineName}</span>}
+              {j.attempt > 1 && (
+                <span className="text-xs text-zinc-500">
+                  attempt {j.attempt}/{j.maxAttempts}
+                </span>
+              )}
+              <span className="ml-auto flex items-center gap-1">
+                {["QUEUED", "CLAIMED", "RUNNING"].includes(j.status) && (
+                  <Button variant="ghost" size="icon-sm" title="Cancel" onClick={() => jobAction(j.id, "cancel")}>
+                    <XCircle className="h-4 w-4 text-red-400" />
+                  </Button>
+                )}
+                {["FAILED", "CANCELLED", "EXPIRED"].includes(j.status) && (
+                  <Button variant="ghost" size="icon-sm" title="Requeue" onClick={() => jobAction(j.id, "retry")}>
+                    <RotateCcw className="h-4 w-4 text-amber-400" />
+                  </Button>
+                )}
+              </span>
+            </div>
+            {j.blendFile && <div className="mt-1 text-xs text-zinc-600 break-all">{j.blendFile}</div>}
+            {j.errorMessage && <div className="mt-1 text-xs text-red-400">{j.errorMessage}</div>}
+          </div>
+        ))}
+      </div>
     </div>
   );
 }

app/(dashboard)/pipeline/deliveries/DeliveriesClient.tsx

@@ -0,0 +1,415 @@
+"use client";
+
+import { useState } from "react";
+import Link from "next/link";
+import { useQuery, useQueryClient } from "@tanstack/react-query";
+import { ArrowLeft, Package, CheckCircle2, XCircle, RefreshCw, Upload } from "lucide-react";
+import { Button } from "@/components/ui/button";
+import { useToast } from "@/components/ui/use-toast";
+import { cn } from "@/lib/utils";
+import { handoffStage } from "@/lib/render-pipeline/delivery-handoff";
+import { DELIVERY_STATUS_STYLES, statusLabel } from "../status-colors";
+import { RecordShareDialog, RecordUploadDialog } from "./HandoffDialogs";
+import { RequestsPanel } from "./RequestsPanel";
+
+interface ReadyExport {
+  exportId: string;
+  shotCode: string;
+  episode: string;
+  versionString: string;
+  fileCount: number | null;
+  totalBytes: number | null;
+  deliveryMovPath: string | null;
+  hasChecksum: boolean;
+  qc: { result: string; reviewer: string | null; at: string } | null;
+}
+
+interface ReadyResponse {
+  episodes: { episode: string; count: number; exports: ReadyExport[] }[];
+}
+
+interface PackageRow {
+  id: string;
+  packageNumber: number;
+  name: string;
+  kind: "EXR_DELIVERY" | "MOV_REVIEW";
+  episode: string;
+  status: string;
+  rootPath: string | null;
+  errorMessage: string | null;
+  projectName: string;
+  projectCode: string;
+  createdAt: string;
+  builtAt: string | null;
+  uploadUrl: string | null;
+  uploadedAt: string | null;
+  uploadedByName: string | null;
+  sharedWith: string | null;
+  sharedNote: string | null;
+  deliveredAt: string | null;
+  deliveredByName: string | null;
+  itemCount: number;
+  verifiedCount: number;
+  exrFileCount: number;
+  movCount: number;
+  totalBytes: number;
+  items: {
+    id: string;
+    shotCode: string;
+    clientCode: string | null;
+    versionString: string;
+    status: string;
+    fileCount: number | null;
+    linkMode: string | null;
+    errorMessage: string | null;
+  }[];
+}
+
+interface ProjectOption {
+  id: string;
+  name: string;
+  code: string;
+}
+
+function formatBytes(bytes: number | null): string {
+  if (bytes == null) return "—";
+  const gb = bytes / 1_073_741_824;
+  return gb >= 1 ? `${gb.toFixed(1)} GB` : `${(bytes / 1_048_576).toFixed(0)} MB`;
+}
+
+export function DeliveriesClient({ canBuild }: { canBuild: boolean }) {
+  const { toast } = useToast();
+  const queryClient = useQueryClient();
+  const [projectId, setProjectId] = useState<string>("");
+  const [episode, setEpisode] = useState<string>("");
+  const [building, setBuilding] = useState(false);
+  const [handoff, setHandoff] = useState<{ step: "upload" | "share"; packageId: string } | null>(null);
+
+  const { data: projects } = useQuery({
+    queryKey: ["pipeline-projects"],
+    queryFn: async () => {
+      const res = await fetch("/api/projects");
+      if (!res.ok) throw new Error("Failed to load projects");
+      const body = await res.json();
+      return (body.projects ?? body) as ProjectOption[];
+    },
+  });
+
+  const { data: ready, isLoading: readyLoading } = useQuery({
+    queryKey: ["delivery-ready", projectId],
+    queryFn: async () => {
+      const res = await fetch(`/api/deliveries/ready?projectId=${encodeURIComponent(projectId)}`);
+      if (!res.ok) throw new Error((await res.json().catch(() => ({})))?.error ?? "Failed to load ready exports");
+      return res.json() as Promise<ReadyResponse>;
+    },
+    enabled: Boolean(projectId),
+  });
+
+  const { data: packages } = useQuery({
+    queryKey: ["delivery-packages", projectId],
+    queryFn: async () => {
+      const res = await fetch(`/api/deliveries${projectId ? `?projectId=${encodeURIComponent(projectId)}` : ""}`);
+      if (!res.ok) throw new Error("Failed to load packages");
+      return res.json() as Promise<{ packages: PackageRow[] }>;
+    },
+    // A build is a queued job like any other — poll while one is in flight.
+    refetchInterval: 5000,
+  });
+
+  async function build(ep: string) {
+    if (!projectId) return;
+    setBuilding(true);
+    try {
+      const res = await fetch("/api/deliveries", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ projectId, episode: ep || null }),
+      });
+      const body = await res.json().catch(() => ({}));
+      if (!res.ok) {
+        toast({ title: "Build failed", description: body.error ?? res.statusText, variant: "destructive" });
+      } else {
+        toast({
+          title: `Package #${body.package.packageNumber} queued`,
+          description: `${body.package.itemCount} shots → ${body.package.rootPath}`,
+        });
+        queryClient.invalidateQueries({ queryKey: ["delivery-packages"] });
+        queryClient.invalidateQueries({ queryKey: ["delivery-ready"] });
+      }
+    } finally {
+      setBuilding(false);
+    }
+  }
+
+  function refreshPackages() {
+    queryClient.invalidateQueries({ queryKey: ["delivery-packages"] });
+    queryClient.invalidateQueries({ queryKey: ["delivery-ready"] });
+  }
+
+  async function cancelPackage(id: string) {
+    const res = await fetch(`/api/deliveries/${id}/cancel`, { method: "POST" });
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      toast({ title: "Cancel failed", description: body.error ?? res.statusText, variant: "destructive" });
+    }
+    refreshPackages();
+  }
+
+  // Looked up from the live list so the dialog never acts on a stale row.
+  const handoffPackage = handoff ? packages?.packages.find((p) => p.id === handoff.packageId) : undefined;
+
+  const episodes = ready?.episodes ?? [];
+  const shown = episode ? episodes.filter((e) => e.episode === episode) : episodes;
+
+  return (
+    <div className="p-4 md:p-6 space-y-6 max-w-6xl">
+      <div className="flex items-center gap-3">
+        <Link href="/pipeline">
+          <Button variant="ghost" size="icon-sm">
+            <ArrowLeft className="h-4 w-4" />
+          </Button>
+        </Link>
+        <h1 className="text-xl font-semibold text-white">Delivery packages</h1>
+      </div>
+
+      {/* Picker */}
+      <div className="flex items-center gap-3 flex-wrap">
+        <select
+          value={projectId}
+          onChange={(e) => {
+            setProjectId(e.target.value);
+            setEpisode("");
+          }}
+          className="rounded-md border border-zinc-800 bg-zinc-900 px-3 py-1.5 text-sm text-zinc-200"
+        >
+          <option value="">Select a project…</option>
+          {(projects ?? []).map((p) => (
+            <option key={p.id} value={p.id}>
+              {p.name} ({p.code})
+            </option>
+          ))}
+        </select>
+        {episodes.length > 0 && (
+          <select
+            value={episode}
+            onChange={(e) => setEpisode(e.target.value)}
+            className="rounded-md border border-zinc-800 bg-zinc-900 px-3 py-1.5 text-sm text-zinc-200"
+          >
+            <option value="">All episodes</option>
+            {episodes.map((e) => (
+              <option key={e.episode} value={e.episode}>
+                {e.episode || "(no episode)"} — {e.count} ready
+              </option>
+            ))}
+          </select>
+        )}
+      </div>
+
+      <RequestsPanel projectId={projectId} canBuild={canBuild} />
+
+      {/* Ready to build */}
+      {projectId && (
+        <div className="rounded-lg border border-zinc-800 bg-zinc-900/40">
+          <div className="px-4 py-2.5 border-b border-zinc-800 text-sm font-medium text-white">
+            Ready for delivery
+          </div>
+          {readyLoading && <div className="p-4 text-sm text-zinc-500">Loading…</div>}
+          {!readyLoading && shown.length === 0 && (
+            <div className="p-4 text-sm text-zinc-500">
+              Nothing has passed QC yet. Exports appear here once QC passes them.
+            </div>
+          )}
+          {shown.map((ep) => (
+            <div key={ep.episode} className="border-b border-zinc-800/60 last:border-0">
+              <div className="flex items-center justify-between gap-4 px-4 py-3 flex-wrap">
+                <div>
+                  <span className="text-white text-sm font-medium">
+                    {ep.episode ? `Episode ${ep.episode}` : "No episode"}
+                  </span>
+                  <span className="ml-3 text-sm text-zinc-400">Ready: {ep.count} shots</span>
+                  {ep.exports.some((x) => !x.hasChecksum) && (
+                    <span className="ml-3 text-xs text-amber-400">
+                      {ep.exports.filter((x) => !x.hasChecksum).length} without a validation checksum
+                    </span>
+                  )}
+                </div>
+                {canBuild && (
+                  <Button size="sm" onClick={() => build(ep.episode)} disabled={building}>
+                    <Package className="h-4 w-4 mr-2" />
+                    Build delivery
+                  </Button>
+                )}
+              </div>
+              <div className="px-4 pb-3 grid sm:grid-cols-2 lg:grid-cols-3 gap-x-6 gap-y-1">
+                {ep.exports.map((x) => (
+                  <div key={x.exportId} className="flex items-center gap-2 text-xs">
+                    <Link href={`/pipeline/exports/${x.exportId}`} className="text-zinc-300 hover:text-white">
+                      {x.shotCode}
+                    </Link>
+                    <span className="text-zinc-500">{x.versionString}</span>
+                    <span className="text-zinc-600">{x.fileCount ?? "?"} frames</span>
+                    <span className="text-zinc-600">{formatBytes(x.totalBytes)}</span>
+                    {!x.deliveryMovPath && <span className="text-amber-500/80">no MOV</span>}
+                  </div>
+                ))}
+              </div>
+            </div>
+          ))}
+        </div>
+      )}
+
+      {/* History — packages are permanent (§11.5) */}
+      <div className="rounded-lg border border-zinc-800 bg-zinc-900/40">
+        <div className="px-4 py-2.5 border-b border-zinc-800 text-sm font-medium text-white">Packages</div>
+        <div className="divide-y divide-zinc-800/60">
+          {(packages?.packages ?? []).map((p) => {
+            const stage = handoffStage(p);
+            return (
+            <details key={p.id} className="group">
+              <summary className="flex items-center gap-3 px-4 py-3 cursor-pointer hover:bg-zinc-900/60 flex-wrap">
+                <span className="text-sm text-white font-medium">#{p.packageNumber}</span>
+                <span className="text-sm text-zinc-300">{p.name}</span>
+                {p.kind === "MOV_REVIEW" && (
+                  <span className="rounded-full border border-violet-500/30 bg-violet-500/10 px-2 py-0.5 text-xs text-violet-300">
+                    MOV review
+                  </span>
+                )}
+                <span
+                  className={cn(
+                    "rounded-full border px-2 py-0.5 text-xs",
+                    // Built is not delivered: a package still owed to the
+                    // client must not read as a green "READY".
+                    stage ? "bg-amber-500/15 text-amber-400 border-amber-500/30" : (DELIVERY_STATUS_STYLES[p.status] ?? "")
+                  )}
+                >
+                  {stage === "AWAITING_UPLOAD"
+                    ? "BUILT — NOT UPLOADED"
+                    : stage === "AWAITING_SHARE"
+                      ? "UPLOADED — LINK NOT SHARED"
+                      : statusLabel(p.status)}
+                </span>
+                <span className="text-xs text-zinc-500">
+                  {p.episode ? `episode ${p.episode} · ` : ""}
+                  {p.verifiedCount}/{p.itemCount} shots
+                </span>
+                <span className="text-xs text-zinc-600">{new Date(p.createdAt).toLocaleDateString()}</span>
+                {p.status === "BUILDING" && <RefreshCw className="h-3.5 w-3.5 text-blue-400 animate-spin" />}
+                <span className="ml-auto flex items-center gap-2">
+                  {canBuild && stage === "AWAITING_UPLOAD" && (
+                    <Button
+                      size="sm"
+                      variant="outline"
+                      onClick={(e) => {
+                        e.preventDefault();
+                        setHandoff({ step: "upload", packageId: p.id });
+                      }}
+                    >
+                      <Upload className="h-4 w-4 mr-2 text-amber-400" />
+                      Record upload
+                    </Button>
+                  )}
+                  {canBuild && stage === "AWAITING_SHARE" && (
+                    <Button
+                      size="sm"
+                      variant="outline"
+                      onClick={(e) => {
+                        e.preventDefault();
+                        setHandoff({ step: "share", packageId: p.id });
+                      }}
+                    >
+                      <CheckCircle2 className="h-4 w-4 mr-2 text-emerald-400" />
+                      Share link
+                    </Button>
+                  )}
+                  {canBuild && ["QUEUED", "FAILED", "DRAFT"].includes(p.status) && (
+                    <Button
+                      size="sm"
+                      variant="outline"
+                      onClick={(e) => {
+                        e.preventDefault();
+                        cancelPackage(p.id);
+                      }}
+                    >
+                      <XCircle className="h-4 w-4 mr-2 text-red-400" />
+                      Cancel
+                    </Button>
+                  )}
+                </span>
+              </summary>
+              <div className="px-4 pb-4 space-y-2">
+                {p.rootPath && <div className="text-xs text-zinc-500 break-all">{p.rootPath}</div>}
+                {p.errorMessage && <div className="text-xs text-red-400">{p.errorMessage}</div>}
+                {p.uploadedAt && p.uploadUrl && (
+                  <div className="text-xs text-zinc-400 break-all">
+                    Uploaded {new Date(p.uploadedAt).toLocaleString()}
+                    {p.uploadedByName ? ` by ${p.uploadedByName}` : ""} —{" "}
+                    <a href={p.uploadUrl} target="_blank" rel="noreferrer" className="text-sky-400 hover:underline">
+                      {p.uploadUrl}
+                    </a>
+                    {canBuild && stage === "AWAITING_SHARE" && (
+                      <button
+                        type="button"
+                        className="ml-2 text-zinc-500 hover:text-white underline"
+                        onClick={() => setHandoff({ step: "upload", packageId: p.id })}
+                      >
+                        change
+                      </button>
+                    )}
+                  </div>
+                )}
+                {p.deliveredAt && (
+                  <div className="text-xs text-emerald-400">
+                    {p.sharedWith
+                      ? `Link shared with ${p.sharedWith} ${new Date(p.deliveredAt).toLocaleString()}`
+                      : `Delivered ${new Date(p.deliveredAt).toLocaleString()} — before uploads and shares were recorded`}
+                    {p.deliveredByName ? ` by ${p.deliveredByName}` : ""}
+                    {p.sharedNote ? ` — ${p.sharedNote}` : ""}
+                  </div>
+                )}
+                <div className="grid sm:grid-cols-2 lg:grid-cols-3 gap-x-6 gap-y-1">
+                  {p.items.map((item) => (
+                    <div key={item.id} className="flex items-center gap-2 text-xs">
+                      <span
+                        className={cn(
+                          item.status === "VERIFIED"
+                            ? "text-emerald-400"
+                            : item.status === "FAILED"
+                              ? "text-red-400"
+                              : "text-zinc-500"
+                        )}
+                      >
+                        {item.status === "VERIFIED" ? "✓" : item.status === "FAILED" ? "✕" : "·"}
+                      </span>
+                      <span className="text-zinc-300">{item.shotCode}</span>
+                      <span className="text-zinc-500">{item.versionString}</span>
+                      {p.kind === "EXR_DELIVERY" && item.fileCount != null && (
+                        <span className="text-zinc-600">{item.fileCount}f</span>
+                      )}
+                      {item.linkMode && <span className="text-zinc-600">{item.linkMode}</span>}
+                      {item.errorMessage && <span className="text-red-400">{item.errorMessage}</span>}
+                    </div>
+                  ))}
+                </div>
+              </div>
+            </details>
+            );
+          })}
+          {(packages?.packages ?? []).length === 0 && (
+            <div className="p-4 text-sm text-zinc-500">No packages built yet</div>
+          )}
+        </div>
+      </div>
+
+      {handoff?.step === "upload" && handoffPackage && (
+        <RecordUploadDialog pkg={handoffPackage} onClose={() => setHandoff(null)} onSaved={refreshPackages} />
+      )}
+      {handoff?.step === "share" && handoffPackage?.uploadUrl && (
+        <RecordShareDialog
+          pkg={{ ...handoffPackage, uploadUrl: handoffPackage.uploadUrl }}
+          onClose={() => setHandoff(null)}
+          onSaved={refreshPackages}
+        />
+      )}
+    </div>
+  );
+}

app/(dashboard)/pipeline/deliveries/HandoffDialogs.tsx

@@ -0,0 +1,218 @@
+"use client";
+
+import { useState } from "react";
+import { Copy } from "lucide-react";
+import { Button } from "@/components/ui/button";
+import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from "@/components/ui/dialog";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import { Textarea } from "@/components/ui/textarea";
+import { useToast } from "@/components/ui/use-toast";
+import { buildShareMessage } from "@/lib/render-pipeline/delivery-handoff";
+
+export interface HandoffPackage {
+  id: string;
+  packageNumber: number;
+  name: string;
+  projectCode: string;
+  episode: string;
+  rootPath: string | null;
+  uploadUrl: string | null;
+  itemCount: number;
+  exrFileCount: number;
+  movCount: number;
+  totalBytes: number;
+  items: { shotCode: string; clientCode: string | null; versionString: string }[];
+}
+
+function formatSize(bytes: number): string {
+  if (!bytes) return "size unknown";
+  const gb = bytes / 1_073_741_824;
+  return gb >= 1 ? `${gb.toFixed(1)} GB` : `${(bytes / 1_048_576).toFixed(0)} MB`;
+}
+
+async function post(path: string, body: unknown): Promise<string | null> {
+  const res = await fetch(path, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+  if (res.ok) return null;
+  const data = await res.json().catch(() => ({}));
+  return data.error ?? res.statusText;
+}
+
+/** Step one: where the folder now lives on the client's side. */
+export function RecordUploadDialog({
+  pkg,
+  onClose,
+  onSaved,
+}: {
+  pkg: HandoffPackage;
+  onClose: () => void;
+  onSaved: () => void;
+}) {
+  const { toast } = useToast();
+  const [uploadUrl, setUploadUrl] = useState(pkg.uploadUrl ?? "");
+  const [confirmed, setConfirmed] = useState(false);
+  const [saving, setSaving] = useState(false);
+
+  async function save() {
+    setSaving(true);
+    const error = await post(`/api/deliveries/${pkg.id}/uploaded`, { uploadUrl, contentsConfirmed: confirmed });
+    setSaving(false);
+    if (error) {
+      toast({ title: "Upload not recorded", description: error, variant: "destructive" });
+      return;
+    }
+    onSaved();
+    onClose();
+  }
+
+  return (
+    <Dialog open onOpenChange={(open) => !open && onClose()}>
+      <DialogContent>
+        <DialogHeader>
+          <DialogTitle>
+            Record upload — #{pkg.packageNumber} {pkg.name}
+          </DialogTitle>
+          <DialogDescription>
+            Paste the link to the folder on the client&apos;s portal. The package stays on the dashboard as
+            awaiting delivery until the link has also been shared.
+          </DialogDescription>
+        </DialogHeader>
+
+        <div className="space-y-4">
+          <div className="rounded-md border border-zinc-800 bg-zinc-900/60 p-3 text-xs text-zinc-400 space-y-1">
+            <div className="text-zinc-200">
+              The upload should contain {pkg.itemCount} shot{pkg.itemCount === 1 ? "" : "s"} · {pkg.exrFileCount} EXR
+              frames · {pkg.movCount} MOV{pkg.movCount === 1 ? "" : "s"} · {formatSize(pkg.totalBytes)}
+            </div>
+            {pkg.rootPath && <div className="break-all">Source: {pkg.rootPath}</div>}
+          </div>
+
+          <div className="space-y-1.5">
+            <Label htmlFor="upload-url">Upload link</Label>
+            <Input
+              id="upload-url"
+              type="url"
+              placeholder="https://…"
+              value={uploadUrl}
+              onChange={(e) => setUploadUrl(e.target.value)}
+              autoFocus
+            />
+          </div>
+
+          <label className="flex items-start gap-2 text-sm text-zinc-300">
+            <input
+              type="checkbox"
+              className="mt-1"
+              checked={confirmed}
+              onChange={(e) => setConfirmed(e.target.checked)}
+            />
+            <span>I opened this link and the upload has finished and matches the counts above.</span>
+          </label>
+        </div>
+
+        <DialogFooter>
+          <Button variant="outline" onClick={onClose}>
+            Cancel
+          </Button>
+          <Button onClick={save} disabled={saving || !uploadUrl.trim() || !confirmed}>
+            Record upload
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+}
+
+/** Step two: the link went to a person. This is what makes it delivered. */
+export function RecordShareDialog({
+  pkg,
+  onClose,
+  onSaved,
+}: {
+  pkg: HandoffPackage & { uploadUrl: string };
+  onClose: () => void;
+  onSaved: () => void;
+}) {
+  const { toast } = useToast();
+  const [sharedWith, setSharedWith] = useState("");
+  const [note, setNote] = useState("");
+  const [saving, setSaving] = useState(false);
+  const message = buildShareMessage(pkg);
+
+  async function copy() {
+    try {
+      await navigator.clipboard.writeText(message);
+      toast({ title: "Message copied" });
+    } catch {
+      toast({ title: "Could not copy", description: "Select the text and copy it by hand.", variant: "destructive" });
+    }
+  }
+
+  async function save() {
+    setSaving(true);
+    const error = await post(`/api/deliveries/${pkg.id}/delivered`, { sharedWith, note: note || null });
+    setSaving(false);
+    if (error) {
+      toast({ title: "Not marked delivered", description: error, variant: "destructive" });
+      return;
+    }
+    onSaved();
+    onClose();
+  }
+
+  return (
+    <Dialog open onOpenChange={(open) => !open && onClose()}>
+      <DialogContent>
+        <DialogHeader>
+          <DialogTitle>
+            Share link — #{pkg.packageNumber} {pkg.name}
+          </DialogTitle>
+          <DialogDescription>
+            Send this message to the client, then record who it went to. That marks the package delivered.
+          </DialogDescription>
+        </DialogHeader>
+
+        <div className="space-y-4">
+          <div className="space-y-1.5">
+            <div className="flex items-center justify-between">
+              <Label htmlFor="share-message">Message</Label>
+              <Button size="sm" variant="outline" onClick={copy}>
+                <Copy className="h-3.5 w-3.5 mr-2" />
+                Copy message
+              </Button>
+            </div>
+            <Textarea id="share-message" readOnly value={message} rows={8} className="font-mono text-xs" />
+          </div>
+
+          <div className="space-y-1.5">
+            <Label htmlFor="shared-with">Sent to</Label>
+            <Input
+              id="shared-with"
+              placeholder="Name, and where — e.g. Sam, production WhatsApp group"
+              value={sharedWith}
+              onChange={(e) => setSharedWith(e.target.value)}
+            />
+          </div>
+
+          <div className="space-y-1.5">
+            <Label htmlFor="share-note">Note (optional)</Label>
+            <Input id="share-note" value={note} onChange={(e) => setNote(e.target.value)} />
+          </div>
+        </div>
+
+        <DialogFooter>
+          <Button variant="outline" onClick={onClose}>
+            Cancel
+          </Button>
+          <Button onClick={save} disabled={saving || !sharedWith.trim()}>
+            Link sent — mark delivered
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+}

app/(dashboard)/pipeline/deliveries/RequestsPanel.tsx

@@ -0,0 +1,273 @@
+"use client";
+
+import { useState } from "react";
+import { useQuery, useQueryClient } from "@tanstack/react-query";
+import { Package, Plus, XCircle } from "lucide-react";
+import { Button } from "@/components/ui/button";
+import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from "@/components/ui/dialog";
+import { Input } from "@/components/ui/input";
+import { useToast } from "@/components/ui/use-toast";
+import { cn } from "@/lib/utils";
+import { LogRequestDialog } from "@/components/delivery/LogRequestDialog";
+import {
+  DELIVERABLE_LABEL,
+  LINE_STAGE_LABEL,
+  type Deliverable,
+  type RequestLineStage,
+} from "@/lib/render-pipeline/delivery-request-state";
+
+interface RequestRow {
+  id: string;
+  requestNumber: number;
+  projectId: string;
+  projectCode: string;
+  episode: string;
+  deliverable: string;
+  requestedBy: string;
+  note: string | null;
+  dueDate: string | null;
+  createdAt: string;
+  cancelReason: string | null;
+  state: "OPEN" | "CLOSED" | "CANCELLED";
+  lineCount: number;
+  deliveredCount: number;
+  severity: "normal" | "warning" | "critical";
+  lines: {
+    id: string;
+    shotCode: string;
+    clientCode: string | null;
+    stage: RequestLineStage;
+    readyExportId: string | null;
+  }[];
+}
+
+const SEVERITY_STYLES: Record<RequestRow["severity"], string> = {
+  normal: "bg-zinc-500/15 text-zinc-300 border-zinc-500/30",
+  warning: "bg-amber-500/15 text-amber-400 border-amber-500/30",
+  critical: "bg-red-500/15 text-red-400 border-red-500/30",
+};
+
+const STAGE_STYLES: Record<RequestLineStage, string> = {
+  DELIVERED: "text-emerald-400",
+  UPLOADED: "text-amber-400",
+  BUILT: "text-amber-400",
+  BUILDING: "text-blue-400",
+  READY: "text-green-400",
+  IN_QC: "text-zinc-400",
+  NOT_READY: "text-zinc-500",
+};
+
+function requestTitle(r: RequestRow): string {
+  const what = DELIVERABLE_LABEL[r.deliverable as Deliverable] ?? r.deliverable;
+  return r.episode ? `${what} for ${r.episode}` : `${what} · ${r.lineCount} shot${r.lineCount === 1 ? "" : "s"}`;
+}
+
+/**
+ * What clients have asked for. An open request lists every shot with where it
+ * stands, so "did 116 go out?" is answered by the page rather than by memory.
+ */
+export function RequestsPanel({ projectId, canBuild }: { projectId: string; canBuild: boolean }) {
+  const { toast } = useToast();
+  const queryClient = useQueryClient();
+  const [logging, setLogging] = useState(false);
+  const [cancelling, setCancelling] = useState<RequestRow | null>(null);
+  const [reason, setReason] = useState("");
+  const [busy, setBusy] = useState(false);
+
+  const { data } = useQuery({
+    queryKey: ["delivery-requests", projectId],
+    queryFn: async () => {
+      const res = await fetch(`/api/delivery-requests${projectId ? `?projectId=${encodeURIComponent(projectId)}` : ""}`);
+      if (!res.ok) throw new Error("Failed to load delivery requests");
+      return res.json() as Promise<{ requests: RequestRow[] }>;
+    },
+    // Lines move as packages build and get shared on this same page.
+    refetchInterval: 5000,
+  });
+
+  const refresh = () => {
+    queryClient.invalidateQueries({ queryKey: ["delivery-requests"] });
+    queryClient.invalidateQueries({ queryKey: ["delivery-packages"] });
+    queryClient.invalidateQueries({ queryKey: ["delivery-ready"] });
+  };
+
+  async function build(request: RequestRow) {
+    const exportIds = request.lines.flatMap((l) => (l.readyExportId ? [l.readyExportId] : []));
+    if (!exportIds.length) return;
+    setBusy(true);
+    const res = await fetch("/api/deliveries", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ projectId: request.projectId, episode: request.episode || null, exportIds }),
+    });
+    const body = await res.json().catch(() => ({}));
+    setBusy(false);
+    if (!res.ok) {
+      toast({ title: "Build failed", description: body.error ?? res.statusText, variant: "destructive" });
+    } else {
+      toast({
+        title: `Package #${body.package.packageNumber} queued`,
+        description: `${body.package.itemCount} shots for request #${request.requestNumber}`,
+      });
+    }
+    refresh();
+  }
+
+  async function cancel() {
+    if (!cancelling) return;
+    setBusy(true);
+    const res = await fetch(`/api/delivery-requests/${cancelling.id}/cancel`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ reason }),
+    });
+    const body = await res.json().catch(() => ({}));
+    setBusy(false);
+    if (!res.ok) {
+      toast({ title: "Not cancelled", description: body.error ?? res.statusText, variant: "destructive" });
+      return;
+    }
+    setCancelling(null);
+    refresh();
+  }
+
+  const requests = data?.requests ?? [];
+  const open = requests.filter((r) => r.state === "OPEN");
+  const past = requests.filter((r) => r.state !== "OPEN");
+
+  return (
+    <div className="rounded-lg border border-zinc-800 bg-zinc-900/40">
+      <div className="flex items-center justify-between gap-3 px-4 py-2.5 border-b border-zinc-800">
+        <span className="text-sm font-medium text-white">Delivery requests</span>
+        {canBuild && (
+          <Button size="sm" variant="outline" onClick={() => setLogging(true)}>
+            <Plus className="h-3.5 w-3.5 mr-1.5" />
+            Log request
+          </Button>
+        )}
+      </div>
+
+      {open.length === 0 && <div className="p-4 text-sm text-zinc-500">No open requests.</div>}
+
+      <div className="divide-y divide-zinc-800/60">
+        {open.map((r) => {
+          const readyCount = r.lines.filter((l) => l.readyExportId).length;
+          return (
+            <details key={r.id} open className="group">
+              <summary className="flex items-center gap-3 px-4 py-3 cursor-pointer hover:bg-zinc-900/60 flex-wrap">
+                <span className="text-sm text-white font-medium">Request #{r.requestNumber}</span>
+                <span className="text-sm text-zinc-300">{requestTitle(r)}</span>
+                <span className={cn("rounded-full border px-2 py-0.5 text-xs", SEVERITY_STYLES[r.severity])}>
+                  {r.deliveredCount} of {r.lineCount} delivered
+                </span>
+                <span className="text-xs text-zinc-500">
+                  {r.projectCode} · asked by {r.requestedBy} · {new Date(r.createdAt).toLocaleDateString()}
+                  {r.dueDate ? ` · due ${new Date(r.dueDate).toLocaleDateString()}` : ""}
+                </span>
+                <span className="ml-auto flex items-center gap-2">
+                  {canBuild && readyCount > 0 && (
+                    <Button
+                      size="sm"
+                      disabled={busy}
+                      onClick={(e) => {
+                        e.preventDefault();
+                        build(r);
+                      }}
+                    >
+                      <Package className="h-4 w-4 mr-2" />
+                      Build {readyCount} ready
+                    </Button>
+                  )}
+                  {canBuild && (
+                    <Button
+                      size="sm"
+                      variant="outline"
+                      onClick={(e) => {
+                        e.preventDefault();
+                        setReason("");
+                        setCancelling(r);
+                      }}
+                    >
+                      <XCircle className="h-4 w-4 mr-2 text-red-400" />
+                      Cancel request
+                    </Button>
+                  )}
+                </span>
+              </summary>
+              <div className="px-4 pb-4 space-y-2">
+                {r.note && <div className="text-xs text-zinc-400">{r.note}</div>}
+                <div className="grid sm:grid-cols-2 lg:grid-cols-3 gap-x-6 gap-y-1">
+                  {r.lines.map((line) => (
+                    <div key={line.id} className="flex items-center gap-2 text-xs">
+                      <span className="text-zinc-300">{line.shotCode}</span>
+                      {line.clientCode && <span className="text-zinc-600">{line.clientCode}</span>}
+                      <span className={STAGE_STYLES[line.stage]}>{LINE_STAGE_LABEL[line.stage]}</span>
+                    </div>
+                  ))}
+                </div>
+              </div>
+            </details>
+          );
+        })}
+      </div>
+
+      {past.length > 0 && (
+        <details className="border-t border-zinc-800">
+          <summary className="px-4 py-2.5 cursor-pointer text-xs text-zinc-500 hover:text-zinc-300">
+            Closed and cancelled ({past.length})
+          </summary>
+          <div className="px-4 pb-3 space-y-1">
+            {past.map((r) => (
+              <div key={r.id} className="text-xs text-zinc-500">
+                <span className="text-zinc-300">Request #{r.requestNumber}</span> {requestTitle(r)} · {r.projectCode} ·
+                asked by {r.requestedBy} ·{" "}
+                {r.state === "CANCELLED" ? (
+                  <span className="text-zinc-400">cancelled — {r.cancelReason}</span>
+                ) : (
+                  <span className="text-emerald-400">all {r.lineCount} delivered</span>
+                )}
+              </div>
+            ))}
+          </div>
+        </details>
+      )}
+
+      <LogRequestDialog
+        open={logging}
+        onClose={() => setLogging(false)}
+        onLogged={refresh}
+        defaultProjectId={projectId || undefined}
+      />
+
+      {cancelling && (
+        <Dialog open onOpenChange={(o) => !o && !busy && setCancelling(null)}>
+          <DialogContent>
+            <DialogHeader>
+              <DialogTitle>Cancel request #{cancelling.requestNumber}</DialogTitle>
+              <DialogDescription>
+                {cancelling.lineCount - cancelling.deliveredCount} of {cancelling.lineCount} shots have not been
+                delivered. Cancelling removes the request from Awaiting delivery; it stays in the history with the
+                reason.
+              </DialogDescription>
+            </DialogHeader>
+            <Input
+              aria-label="Reason"
+              placeholder="Why — e.g. client no longer needs 116"
+              value={reason}
+              onChange={(e) => setReason(e.target.value)}
+              autoFocus
+            />
+            <DialogFooter>
+              <Button variant="outline" onClick={() => setCancelling(null)} disabled={busy}>
+                Keep request
+              </Button>
+              <Button variant="destructive" onClick={cancel} disabled={busy || !reason.trim()}>
+                Cancel request
+              </Button>
+            </DialogFooter>
+          </DialogContent>
+        </Dialog>
+      )}
+    </div>
+  );
+}

app/(dashboard)/pipeline/deliveries/page.tsx

@@ -0,0 +1,12 @@
+import { auth } from "@/auth";
+import { redirect } from "next/navigation";
+import { DeliveriesClient } from "./DeliveriesClient";
+
+export const dynamic = "force-dynamic";
+
+export default async function DeliveriesPage() {
+  const session = await auth();
+  if (!session?.user) redirect("/login");
+  if (session.user.role === "CLIENT") redirect("/dashboard");
+  return <DeliveriesClient canBuild={["ADMIN", "PRODUCER", "SUPERVISOR"].includes(session.user.role as string)} />;
+}

app/(dashboard)/pipeline/exports/[exportId]/ExportDetailClient.tsx

@@ -1,8 +1,9 @@
 "use client";
 
+import { useState } from "react";
 import Link from "next/link";
 import { useQuery, useQueryClient } from "@tanstack/react-query";
-import { ArrowLeft, RotateCcw, XCircle } from "lucide-react";
+import { ArrowLeft, RotateCcw, XCircle, ShieldAlert } from "lucide-react";
 import { Button } from "@/components/ui/button";
 import { useToast } from "@/components/ui/use-toast";
 import { cn } from "@/lib/utils";
@@ -66,12 +67,49 @@ interface ExportDetail {
       note: string | null;
       createdAt: string;
     }[];
+    validations: {
+      id: string;
+      renderJobId: string;
+      checkName: string;
+      status: string;
+      expected: string | null;
+      actual: string | null;
+      message: string | null;
+      details: unknown;
+      createdAt: string;
+    }[];
+    qcReviews: {
+      id: string;
+      result: string;
+      notes: string | null;
+      reviewerName: string | null;
+      source: string;
+      createdAt: string;
+    }[];
+    deliveryItems: {
+      id: string;
+      status: string;
+      exrPath: string | null;
+      linkMode: string | null;
+      package: { id: string; name: string; episode: string; status: string; packageNumber: number };
+    }[];
   };
 }
 
+const CHECK_STYLES: Record<string, string> = {
+  PASS: "text-emerald-400",
+  FAIL: "text-red-400",
+  WARN: "text-amber-400",
+  SKIPPED: "text-zinc-500",
+};
+
 export function ExportDetailClient({ exportId }: { exportId: string }) {
   const { toast } = useToast();
   const queryClient = useQueryClient();
+  const [overrideOpen, setOverrideOpen] = useState(false);
+  const [overrideReason, setOverrideReason] = useState("");
+  const [overrideSkipPreview, setOverrideSkipPreview] = useState(false);
+  const [overriding, setOverriding] = useState(false);
 
   const { data, isLoading, error } = useQuery({
     queryKey: ["pipeline-export", exportId],
@@ -92,10 +130,35 @@ export function ExportDetailClient({ exportId }: { exportId: string }) {
     queryClient.invalidateQueries({ queryKey: ["pipeline-export", exportId] });
   }
 
-  if (isLoading) return <div className="p-6 text-zinc-500">Loading…</div>;
+  async function overrideValidation() {
+    setOverriding(true);
+    try {
+      const res = await fetch(`/api/render/exports/${exportId}/override-validation`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ reason: overrideReason, skipPreview: overrideSkipPreview }),
+      });
+      const body = await res.json().catch(() => ({}));
+      if (!res.ok) {
+        toast({ title: "Override failed", description: body.error ?? res.statusText, variant: "destructive" });
+        return;
+      }
+      toast({
+        title: "Validation overridden",
+        description: `${(body.overridden ?? []).join(", ") || "No failed checks recorded"} — continuing to preview and QC`,
+      });
+      setOverrideOpen(false);
+      setOverrideReason("");
+      queryClient.invalidateQueries({ queryKey: ["pipeline-export", exportId] });
+    } finally {
+      setOverriding(false);
+    }
+  }
+
+  if (isLoading) return <div className="p-4 md:p-6 text-zinc-500">Loading…</div>;
   if (error || !data) {
     return (
-      <div className="p-6 text-red-400">
+      <div className="p-4 md:p-6 text-red-400">
         {(error as Error)?.message ?? "Export not found"}
       </div>
     );
@@ -117,7 +180,7 @@ export function ExportDetailClient({ exportId }: { exportId: string }) {
   ];
 
   return (
-    <div className="p-6 space-y-6 max-w-5xl">
+    <div className="p-4 md:p-6 space-y-6 max-w-5xl">
       <div className="flex items-center justify-between gap-4 flex-wrap">
         <div className="flex items-center gap-3">
           <Link href="/pipeline">
@@ -145,6 +208,11 @@ export function ExportDetailClient({ exportId }: { exportId: string }) {
               <RotateCcw className="h-4 w-4 mr-2 text-amber-400" /> Retry
             </Button>
           )}
+          {e.status === "VALIDATION_FAILED" && !overrideOpen && (
+            <Button variant="outline" size="sm" onClick={() => setOverrideOpen(true)}>
+              <ShieldAlert className="h-4 w-4 mr-2 text-amber-400" /> Override validation
+            </Button>
+          )}
           {ACTIVE_STATUSES.includes(e.status) && (
             <Button variant="outline" size="sm" onClick={() => action("cancel")}>
               <XCircle className="h-4 w-4 mr-2 text-red-400" /> Cancel
@@ -153,6 +221,64 @@ export function ExportDetailClient({ exportId }: { exportId: string }) {
         </div>
       </div>
 
+      {/* Override — a human overruling the checks, so the reason is required
+          and kept on the export's timeline. */}
+      {overrideOpen && (
+        <div className="rounded-lg border border-amber-500/30 bg-amber-500/5 p-4 space-y-3">
+          <div className="text-sm text-amber-200">
+            Override the failed validation for {e.shot.shotCode} {e.versionString}?
+          </div>
+          <p className="text-xs text-zinc-400">
+            The render continues to preview and then QC — it is not delivered directly, and the failed
+            checks stay on record and still show up in the QC queue. Say why, so the next person
+            reading this export knows what was waved through.
+          </p>
+          <textarea
+            value={overrideReason}
+            onChange={(ev) => setOverrideReason(ev.target.value)}
+            rows={2}
+            autoFocus
+            placeholder="e.g. plate unreachable from the render node; timecode checked by hand against the EDL"
+            className="w-full rounded-md border border-zinc-800 bg-zinc-950 px-3 py-2 text-sm text-zinc-200 placeholder:text-zinc-600"
+          />
+          <label className="flex items-start gap-2 text-xs text-zinc-300">
+            <input
+              type="checkbox"
+              checked={overrideSkipPreview}
+              onChange={(ev) => setOverrideSkipPreview(ev.target.checked)}
+              className="mt-0.5"
+            />
+            <span>
+              Skip the preview build and reuse the previous export&apos;s review media.
+              <span className="block text-zinc-500">
+                For EXRs framed differently from the review — unscaled or un-punched-in — where a
+                preview rebuilt from these frames would be the wrong picture.
+              </span>
+            </span>
+          </label>
+          <div className="flex items-center gap-2">
+            <Button
+              size="sm"
+              onClick={overrideValidation}
+              disabled={overrideReason.trim().length < 3 || overriding}
+            >
+              {overriding ? "Overriding…" : "Override and continue"}
+            </Button>
+            <Button
+              variant="ghost"
+              size="sm"
+              onClick={() => {
+                setOverrideOpen(false);
+                setOverrideReason("");
+                setOverrideSkipPreview(false);
+              }}
+            >
+              Cancel
+            </Button>
+          </div>
+        </div>
+      )}
+
       {/* Manifest */}
       <div className="rounded-lg border border-zinc-800 bg-zinc-900/40">
         <div className="px-4 py-2.5 border-b border-zinc-800 text-sm font-medium text-white">Manifest</div>
@@ -189,6 +315,100 @@ export function ExportDetailClient({ exportId }: { exportId: string }) {
         </div>
       )}
 
+      {/* Validation results — newest run first */}
+      {e.validations.length > 0 && (
+        <div className="rounded-lg border border-zinc-800 bg-zinc-900/40">
+          <div className="px-4 py-2.5 border-b border-zinc-800 text-sm font-medium text-white flex items-center gap-3">
+            Validation
+            {/* A waved-through failure must stay visible long after the event
+                scrolls down the timeline. */}
+            {e.events.some((ev) => ev.note?.startsWith("Validation overridden")) && (
+              <span className="rounded-full border border-amber-500/30 bg-amber-500/15 px-2 py-0.5 text-xs text-amber-400">
+                overridden
+              </span>
+            )}
+            {(() => {
+              const latestRun = e.validations[e.validations.length - 1].renderJobId;
+              const rows = e.validations.filter((v) => v.renderJobId === latestRun);
+              const failed = rows.filter((v) => v.status === "FAIL").length;
+              const warned = rows.filter((v) => v.status === "WARN").length;
+              return (
+                <span className={cn("text-xs", failed ? "text-red-400" : warned ? "text-amber-400" : "text-emerald-400")}>
+                  {failed ? `${failed} failed` : warned ? `${warned} warning${warned > 1 ? "s" : ""}` : "all checks passed"}
+                </span>
+              );
+            })()}
+          </div>
+          <div className="divide-y divide-zinc-800/60">
+            {(() => {
+              const latestRun = e.validations[e.validations.length - 1].renderJobId;
+              // Failures first: the reason the export stopped should not need scrolling for.
+              const order = { FAIL: 0, WARN: 1, PASS: 2, SKIPPED: 3 } as Record<string, number>;
+              return e.validations
+                .filter((v) => v.renderJobId === latestRun)
+                .slice()
+                .sort((a, b) => (order[a.status] ?? 9) - (order[b.status] ?? 9))
+                .map((v) => (
+                  <div key={v.id} className="px-4 py-2 text-sm flex items-start gap-3">
+                    <span className={cn("w-16 shrink-0 text-xs font-medium", CHECK_STYLES[v.status] ?? "")}>
+                      {v.status}
+                    </span>
+                    <span className="w-48 shrink-0 text-zinc-300 font-mono text-xs pt-0.5">{v.checkName}</span>
+                    <span className="text-zinc-400 text-xs pt-0.5">
+                      {v.message ??
+                        (v.expected === v.actual ? v.actual : `expected ${v.expected ?? "—"}, got ${v.actual ?? "—"}`)}
+                    </span>
+                  </div>
+                ));
+            })()}
+          </div>
+        </div>
+      )}
+
+      {/* QC history — latest decision is the authoritative one */}
+      {e.qcReviews.length > 0 && (
+        <div className="rounded-lg border border-zinc-800 bg-zinc-900/40">
+          <div className="px-4 py-2.5 border-b border-zinc-800 text-sm font-medium text-white">QC</div>
+          <div className="divide-y divide-zinc-800/60">
+            {e.qcReviews.map((q) => (
+              <div key={q.id} className="px-4 py-2.5 text-sm">
+                <div className="flex items-center gap-3 flex-wrap">
+                  <span className={cn("text-xs font-medium", q.result === "PASS" ? "text-emerald-400" : "text-red-400")}>
+                    QC {q.result}
+                  </span>
+                  <span className="text-xs text-zinc-400">{q.reviewerName ?? "unknown reviewer"}</span>
+                  <span className="text-xs text-zinc-500">{q.source === "AE_PANEL" ? "AE panel" : "web"}</span>
+                  <span className="text-xs text-zinc-500">{new Date(q.createdAt).toLocaleString()}</span>
+                </div>
+                {q.notes && <div className="mt-1 text-xs text-zinc-400 whitespace-pre-wrap">{q.notes}</div>}
+              </div>
+            ))}
+          </div>
+        </div>
+      )}
+
+      {/* Delivery membership */}
+      {e.deliveryItems.length > 0 && (
+        <div className="rounded-lg border border-zinc-800 bg-zinc-900/40">
+          <div className="px-4 py-2.5 border-b border-zinc-800 text-sm font-medium text-white">Deliveries</div>
+          <div className="divide-y divide-zinc-800/60">
+            {e.deliveryItems.map((d) => (
+              <div key={d.id} className="px-4 py-2.5 text-sm flex items-center gap-3 flex-wrap">
+                <Link href="/pipeline/deliveries" className="text-zinc-200 hover:text-white">
+                  #{d.package.packageNumber} · {d.package.name}
+                </Link>
+                <span className="text-xs text-zinc-500">episode {d.package.episode || "—"}</span>
+                <span className="text-xs text-zinc-400">{d.package.status}</span>
+                <span className="text-xs text-zinc-500">
+                  item {d.status.toLowerCase()}
+                  {d.linkMode ? ` · ${d.linkMode}` : ""}
+                </span>
+              </div>
+            ))}
+          </div>
+        </div>
+      )}
+
       {/* Render attempts */}
       <div className="rounded-lg border border-zinc-800 bg-zinc-900/40">
         <div className="px-4 py-2.5 border-b border-zinc-800 text-sm font-medium text-white">

app/(dashboard)/pipeline/machines/MachinesClient.tsx

@@ -76,7 +76,7 @@ export function MachinesClient() {
   const machines = data?.machines ?? [];
 
   return (
-    <div className="p-6 space-y-6">
+    <div className="p-4 md:p-6 space-y-6">
       <div className="flex items-center gap-3">
         <Link href="/pipeline">
           <Button variant="ghost" size="icon-sm">
@@ -201,6 +201,77 @@ export function MachinesClient() {
           })}
         </div>
       )}
+
+      <ToolVersions />
+    </div>
+  );
+}
+
+interface ToolRow {
+  id: string;
+  tool: string;
+  toolLabel: string;
+  machineName: string;
+  version: string;
+  buildRef: string | null;
+  hostUser: string | null;
+  hostApp: string | null;
+  lastSeenAt: string;
+  newestVersion: string;
+  outdated: boolean;
+}
+
+/**
+ * What is deployed where. Each tool reports its own version on startup, and
+ * anything behind the newest version seen for that tool is flagged — so
+ * updating one machine is what surfaces the ones still to do.
+ */
+function ToolVersions() {
+  const { data } = useQuery({
+    queryKey: ["tool-versions"],
+    queryFn: async () => {
+      const res = await fetch("/api/tools");
+      if (!res.ok) throw new Error("Failed to load tool versions");
+      return res.json() as Promise<{ tools: ToolRow[] }>;
+    },
+    refetchInterval: 30000,
+  });
+
+  const tools = data?.tools ?? [];
+  const stale = tools.filter((t) => t.outdated).length;
+
+  return (
+    <div className="rounded-lg border border-zinc-800 bg-zinc-900/40">
+      <div className="px-4 py-2.5 border-b border-zinc-800 text-sm font-medium text-white flex items-center gap-3">
+        Deployed tool versions
+        {stale > 0 && (
+          <span className="text-xs text-amber-400">
+            {stale} machine{stale > 1 ? "s" : ""} behind
+          </span>
+        )}
+      </div>
+      <div className="divide-y divide-zinc-800/60">
+        {tools.map((t) => (
+          <div key={t.id} className="px-4 py-2.5 text-sm flex items-center gap-3 flex-wrap">
+            <span className="w-44 shrink-0 text-zinc-300">{t.toolLabel}</span>
+            <span className="w-40 shrink-0 text-zinc-400 text-xs font-mono">{t.machineName}</span>
+            <span className={cn("text-xs font-mono", t.outdated ? "text-amber-400" : "text-emerald-400")}>
+              v{t.version}
+            </span>
+            {t.outdated && <span className="text-xs text-amber-400/80">→ rebuild to v{t.newestVersion}</span>}
+            {t.buildRef && <span className="text-xs text-zinc-600 font-mono">{t.buildRef}</span>}
+            {t.hostUser && <span className="text-xs text-zinc-600">{t.hostUser}</span>}
+            <span className="ml-auto text-xs text-zinc-600">
+              seen {new Date(t.lastSeenAt).toLocaleString()}
+            </span>
+          </div>
+        ))}
+        {tools.length === 0 && (
+          <div className="p-4 text-sm text-zinc-500">
+            Nothing has reported yet. Versions appear as each panel and worker starts up.
+          </div>
+        )}
+      </div>
     </div>
   );
 }

app/(dashboard)/pipeline/page.tsx

@@ -1,20 +1,32 @@
 import { auth } from "@/auth";
 import { redirect } from "next/navigation";
+import { ExportStatus } from "@prisma/client";
 import { db } from "@/lib/db";
 import { PipelineQueueClient } from "./PipelineQueueClient";
 
 export const dynamic = "force-dynamic";
 
-export default async function PipelinePage() {
+export default async function PipelinePage({
+  searchParams,
+}: {
+  searchParams: Promise<{ status?: string }>;
+}) {
   const session = await auth();
   if (!session?.user) redirect("/login");
   if (session.user.role === "CLIENT") redirect("/dashboard");
 
+  // Lets other pages link straight to a filtered queue — the dashboard's "In
+  // QC" figure is only useful if it leads to the rows it counted. Anything
+  // that is not a real status falls back to the unfiltered queue.
+  const requested = (await searchParams).status;
+  const initialStatus =
+    requested && (Object.values(ExportStatus) as string[]).includes(requested) ? requested : "all";
+
   const projects = await db.project.findMany({
     where: { status: { in: ["ACTIVE", "ON_HOLD"] } },
     select: { id: true, name: true, code: true },
     orderBy: { name: "asc" },
   });
 
-  return <PipelineQueueClient projects={projects} />;
+  return <PipelineQueueClient projects={projects} initialStatus={initialStatus} />;
 }

app/(dashboard)/pipeline/status-colors.ts

@@ -18,6 +18,16 @@ export const EXPORT_STATUS_STYLES: Record<string, string> = {
   CANCELLED: "bg-zinc-500/10 text-zinc-500 border-zinc-600/30",
 };
 
+export const DELIVERY_STATUS_STYLES: Record<string, string> = {
+  DRAFT: "bg-zinc-500/15 text-zinc-300 border-zinc-500/30",
+  QUEUED: "bg-zinc-500/15 text-zinc-300 border-zinc-500/30",
+  BUILDING: "bg-blue-500/15 text-blue-400 border-blue-500/30",
+  READY: "bg-green-500/15 text-green-400 border-green-500/30",
+  DELIVERED: "bg-emerald-500/15 text-emerald-300 border-emerald-500/30",
+  FAILED: "bg-red-500/15 text-red-400 border-red-500/30",
+  CANCELLED: "bg-zinc-500/10 text-zinc-500 border-zinc-600/30",
+};
+
 export const FAILED_STATUSES = ["RENDER_FAILED", "VALIDATION_FAILED", "PREVIEW_FAILED", "QC_FAILED"];
 export const ACTIVE_STATUSES = ["QUEUED", "RENDERING", "VALIDATING", "GENERATING_PREVIEW"];
 

app/(dashboard)/playlist/PlaylistClient.tsx

@@ -1,9 +1,10 @@
 "use client";
 
-import { useState, useEffect, useRef, useCallback } from "react";
+import { useState, useEffect, useRef, useCallback, useMemo, startTransition } from "react";
 import Image from "next/image";
 import Link from "next/link";
 import { ReviewPlayer, type ReviewPlayerRef } from "@/components/player/ReviewPlayer";
+import { SequencePlayer, type SequenceClip } from "@/components/player/SequencePlayer";
 import { useReviewStore } from "@/hooks/use-review-player";
 import {
   Select,
@@ -26,6 +27,8 @@ import {
   ExternalLink,
   ShieldCheck,
   Send,
+  ListVideo,
+  X,
 } from "lucide-react";
 
 interface Project {
@@ -42,6 +45,12 @@ interface PlaylistVersion {
   thumbnailUrl: string | null;
   posterUrl: string | null;
   fps: number;
+  duration?: number | null;
+  frameCount?: number | null;
+  hqFileUrl?: string | null;
+  handleHead?: number | null;
+  handleTail?: number | null;
+  pictureStartFrame?: number | null;
   approvalStatus: string;
   taskTitle: string;
 }
@@ -86,6 +95,10 @@ export function PlaylistClient({ projects, userRole }: PlaylistClientProps) {
   const [activeShot, setActiveShot] = useState<PlaylistShot | null>(null);
   const [isLoading, setIsLoading] = useState(false);
   const [isActioning, setIsActioning] = useState(false);
+  /** Shots checked for the seamless playlist, by shot id. */
+  const [selected, setSelected] = useState<Set<string>>(new Set());
+  const [sequenceMode, setSequenceMode] = useState(false);
+  const lastChecked = useRef<string | null>(null);
 
   const canApprove = ["ADMIN", "PRODUCER", "SUPERVISOR"].includes(userRole);
 
@@ -112,6 +125,9 @@ export function PlaylistClient({ projects, userRole }: PlaylistClientProps) {
         if (cancelled) return;
         const list: PlaylistShot[] = data.shots ?? [];
         setShots(list);
+        setSelected(loadSelection(projectId, list));
+        lastChecked.current = null;
+        setSequenceMode(false);
         // Auto-select the first shot, or keep the current one if it still exists
         setActiveShot((prev) => {
           const stillExists = prev && list.some((s) => s.id === prev.id);
@@ -134,9 +150,78 @@ export function PlaylistClient({ projects, userRole }: PlaylistClientProps) {
 
   const handleSelectShot = useCallback((shot: PlaylistShot) => {
     reset();
+    setSequenceMode(false);
     setActiveShot(shot);
   }, [reset]);
 
+  const updateSelection = useCallback(
+    (next: Set<string>) => {
+      setSelected(next);
+      if (projectId) saveSelection(projectId, next);
+      if (next.size === 0) setSequenceMode(false);
+    },
+    [projectId]
+  );
+
+  /** Toggle one shot; shift-click sets every shot between it and the last one checked. */
+  const toggleChecked = (shot: PlaylistShot, shift: boolean) => {
+    const next = new Set(selected);
+    const on = !selected.has(shot.id);
+    const from = lastChecked.current ? shots.findIndex((s) => s.id === lastChecked.current) : -1;
+    const to = shots.findIndex((s) => s.id === shot.id);
+    const range = shift && from >= 0 ? shots.slice(Math.min(from, to), Math.max(from, to) + 1) : [shot];
+    for (const s of range) {
+      if (on) next.add(s.id);
+      else next.delete(s.id);
+    }
+    lastChecked.current = shot.id;
+    updateSelection(next);
+  };
+
+  const setGroupChecked = (group: PlaylistShot[], on: boolean) => {
+    const next = new Set(selected);
+    for (const s of group) {
+      if (on) next.add(s.id);
+      else next.delete(s.id);
+    }
+    updateSelection(next);
+  };
+
+  // The playlist, in edit order. Keyed on the versions it plays so a refresh
+  // (e.g. after approving a shot) doesn't restart playback.
+  const clipKey = shots
+    .filter((s) => selected.has(s.id))
+    .map((s) => s.latestVersion.id)
+    .join(",");
+  const clips = useMemo<SequenceClip[]>(
+    () =>
+      shots
+        .filter((s) => selected.has(s.id))
+        .map((s) => ({
+          id: s.latestVersion.id,
+          label: s.shotCode,
+          sublabel: `v${String(s.latestVersion.versionNumber).padStart(3, "0")}`,
+          url: s.latestVersion.fileUrl,
+          hqUrl: s.latestVersion.hqFileUrl,
+          fps: s.latestVersion.fps,
+          duration: s.latestVersion.duration,
+          handles: s.latestVersion,
+        })),
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    [clipKey]
+  );
+
+  const handleClipChange = useCallback(
+    (clip: SequenceClip) => {
+      // A transition, so re-rendering the page (shot list and all) yields to
+      // the video: rendered in one go, it dropped the frame after every cut.
+      startTransition(() => {
+        setActiveShot(shots.find((s) => s.latestVersion.id === clip.id) ?? null);
+      });
+    },
+    [shots]
+  );
+
   const refreshShots = useCallback(() => {
     if (!projectId) return;
     fetch(`/api/playlist?projectId=${projectId}`)
@@ -215,6 +300,33 @@ export function PlaylistClient({ projects, userRole }: PlaylistClientProps) {
           </Select>
         </div>
 
+        {selected.size > 0 && (
+          sequenceMode ? (
+            <Button
+              size="sm"
+              variant="outline"
+              onClick={() => setSequenceMode(false)}
+              className="h-7 text-xs gap-1"
+            >
+              <X className="h-3 w-3" />
+              Exit playlist
+            </Button>
+          ) : (
+            <Button
+              size="sm"
+              onClick={() => {
+                reset();
+                setSequenceMode(true);
+              }}
+              className="h-7 text-xs gap-1"
+              title="Play the checked shots back to back: cut only, no slate or handles"
+            >
+              <ListVideo className="h-3.5 w-3.5" />
+              Play selection ({selected.size})
+            </Button>
+          )
+        )}
+
         {activeShot && (
           <div className="flex items-center gap-2 ml-auto">
             <span className="font-mono text-sm text-white">{activeShot.shotCode}</span>
@@ -267,7 +379,9 @@ export function PlaylistClient({ projects, userRole }: PlaylistClientProps) {
       <div className="flex flex-1 min-h-0 overflow-hidden">
         {/* Player */}
         <div className="flex-1 min-w-0 bg-black flex flex-col">
-          {activeShot ? (
+          {sequenceMode && clips.length > 0 ? (
+            <SequencePlayer clips={clips} onClipChange={handleClipChange} />
+          ) : activeShot ? (
             <ReviewPlayer
               key={activeShot.latestVersion.id}
               ref={playerRef}
@@ -276,6 +390,8 @@ export function PlaylistClient({ projects, userRole }: PlaylistClientProps) {
               fps={activeShot.latestVersion.fps}
               comments={[]}
               annotations={[]}
+              handles={activeShot.latestVersion}
+              hqVideoUrl={activeShot.latestVersion.hqFileUrl}
             />
           ) : (
             <div className="flex-1 flex flex-col items-center justify-center gap-3 text-zinc-600">
@@ -297,7 +413,26 @@ export function PlaylistClient({ projects, userRole }: PlaylistClientProps) {
           <div className="px-3 py-2.5 border-b border-border shrink-0 flex items-center justify-between">
             <span className="text-xs font-medium text-zinc-400 uppercase tracking-wider">Shots</span>
             {shots.length > 0 && (
-              <span className="text-xs text-zinc-600">{shots.length}</span>
+              <div className="flex items-center gap-2 text-xs">
+                {selected.size > 0 ? (
+                  <button
+                    onClick={() => updateSelection(new Set())}
+                    className="text-zinc-500 hover:text-zinc-200"
+                  >
+                    Clear
+                  </button>
+                ) : (
+                  <button
+                    onClick={() => setGroupChecked(shots, true)}
+                    className="text-zinc-500 hover:text-zinc-200"
+                  >
+                    Select all
+                  </button>
+                )}
+                <span className="text-zinc-600">
+                  {selected.size > 0 ? `${selected.size}/${shots.length}` : shots.length}
+                </span>
+              </div>
             )}
           </div>
 
@@ -320,16 +455,25 @@ export function PlaylistClient({ projects, userRole }: PlaylistClientProps) {
               <div>
                 {episodeGroups.map(([episode, episodeShots]) => (
                   <div key={episode}>
-                    <div className="px-3 py-1.5 bg-zinc-900/80 sticky top-0 z-10 border-b border-zinc-800">
+                    <label className="px-3 py-1.5 bg-zinc-900/80 sticky top-0 z-10 border-b border-zinc-800 flex items-center gap-2 cursor-pointer">
+                      <input
+                        type="checkbox"
+                        className="h-3 w-3 accent-blue-500 cursor-pointer"
+                        checked={episodeShots.every((s) => selected.has(s.id))}
+                        onChange={(e) => setGroupChecked(episodeShots, e.target.checked)}
+                        title="Select this episode"
+                      />
                       <span className="text-[10px] font-semibold text-zinc-500 uppercase tracking-wider">
                         Ep {episode}
                       </span>
-                    </div>
+                    </label>
                     {episodeShots.map((shot) => (
                       <ShotThumbnail
                         key={shot.id}
                         shot={shot}
                         isActive={activeShot?.id === shot.id}
+                        isChecked={selected.has(shot.id)}
+                        onToggle={(shift) => toggleChecked(shot, shift)}
                         onClick={() => handleSelectShot(shot)}
                       />
                     ))}
@@ -343,6 +487,8 @@ export function PlaylistClient({ projects, userRole }: PlaylistClientProps) {
                     key={shot.id}
                     shot={shot}
                     isActive={activeShot?.id === shot.id}
+                    isChecked={selected.has(shot.id)}
+                    onToggle={(shift) => toggleChecked(shot, shift)}
                     onClick={() => handleSelectShot(shot)}
                   />
                 ))}
@@ -358,25 +504,45 @@ export function PlaylistClient({ projects, userRole }: PlaylistClientProps) {
 function ShotThumbnail({
   shot,
   isActive,
+  isChecked,
+  onToggle,
   onClick,
 }: {
   shot: PlaylistShot;
   isActive: boolean;
+  isChecked: boolean;
+  onToggle: (shift: boolean) => void;
   onClick: () => void;
 }) {
   const thumb = shot.latestVersion.thumbnailUrl ?? shot.latestVersion.posterUrl ?? shot.thumbnailUrl;
   const ApprovalIcon = APPROVAL_ICONS[shot.latestVersion.approvalStatus] ?? Clock;
 
   return (
-    <button
+    <div
+      role="button"
+      tabIndex={0}
       onClick={onClick}
+      onKeyDown={(e) => {
+        if (e.key === "Enter") onClick();
+      }}
       className={cn(
-        "w-full flex items-start gap-2.5 px-3 py-2.5 text-left transition-colors border-b border-zinc-800/60 group",
+        "w-full flex items-start gap-2.5 px-3 py-2.5 text-left transition-colors border-b border-zinc-800/60 group cursor-pointer",
         isActive
           ? "bg-blue-500/10 border-l-2 border-l-blue-500"
           : "hover:bg-zinc-800/40 border-l-2 border-l-transparent"
       )}
     >
+      <input
+        type="checkbox"
+        checked={isChecked}
+        onChange={() => {}}
+        onClick={(e) => {
+          e.stopPropagation();
+          onToggle(e.shiftKey);
+        }}
+        className="mt-3 h-3.5 w-3.5 shrink-0 accent-blue-500 cursor-pointer"
+        title="Add to playlist (shift-click for a range)"
+      />
       {/* Thumbnail */}
       <div className="w-20 aspect-[2.39/1] rounded overflow-hidden bg-zinc-800 shrink-0 flex items-center justify-center">
         {thumb ? (
@@ -408,6 +574,28 @@ function ShotThumbnail({
           </span>
         </div>
       </div>
-    </button>
+    </div>
   );
 }
+
+const selectionKey = (projectId: string) => `playlist:selection:${projectId}`;
+
+/** The checked shots remembered for this project, minus any no longer listed. */
+function loadSelection(projectId: string, shots: PlaylistShot[]): Set<string> {
+  try {
+    const ids: unknown = JSON.parse(localStorage.getItem(selectionKey(projectId)) ?? "[]");
+    if (!Array.isArray(ids)) return new Set();
+    const listed = new Set(shots.map((s) => s.id));
+    return new Set(ids.filter((id): id is string => typeof id === "string" && listed.has(id)));
+  } catch {
+    return new Set();
+  }
+}
+
+function saveSelection(projectId: string, selected: Set<string>) {
+  try {
+    localStorage.setItem(selectionKey(projectId), JSON.stringify([...selected]));
+  } catch {
+    // Storage unavailable: the selection just isn't remembered.
+  }
+}

app/(dashboard)/projects/[id]/ProjectTabsClient.tsx

@@ -58,6 +58,14 @@ interface ProjectTabsClientProps {
     startDate: Date | null;
     slackWebhook: string | null;
     slackChannel: string | null;
+    pipelineConfig: {
+      templateAep?: string | null;
+      rendersRoot?: string | null;
+      overlayComp?: string | null;
+      previewComp?: string | null;
+      lutComp?: string | null;
+      autoShotThumbnail?: boolean | null;
+    } | null;
   };
   clients: Client[];
   teamMembers: TeamMember[];

app/(dashboard)/projects/[id]/kanban/page.tsx

@@ -41,7 +41,7 @@ export default async function KanbanPage({
       where: { projectId: id },
       orderBy: [{ status: "asc" }, { sortOrder: "asc" }],
       include: {
-        shot: { select: { id: true, shotCode: true, thumbnailUrl: true } },
+        shot: { select: { id: true, shotCode: true, thumbnailUrl: true, generatedThumbnailUrl: true } },
         asset: { select: { id: true, assetCode: true, name: true } },
         assignedArtist: {
           select: { id: true, name: true, email: true, image: true },
@@ -69,7 +69,7 @@ export default async function KanbanPage({
   ]);
 
   return (
-    <div className="p-6 space-y-6 max-w-[1800px] mx-auto">
+    <div className="p-4 md:p-6 space-y-6 max-w-[1800px] mx-auto">
       {/* Breadcrumb */}
       <div className="flex items-center gap-2 text-sm text-muted-foreground">
         <Link href="/projects" className="hover:text-foreground transition-colors">

app/(dashboard)/projects/[id]/page.tsx

@@ -60,7 +60,7 @@ async function getProject(id: string) {
       tasks: {
         orderBy: [{ status: "asc" }, { sortOrder: "asc" }],
         include: {
-          shot: { select: { id: true, shotCode: true, thumbnailUrl: true } },
+          shot: { select: { id: true, shotCode: true, thumbnailUrl: true, generatedThumbnailUrl: true } },
           asset: { select: { id: true, assetCode: true, name: true } },
           assignedArtist: { select: { id: true, name: true, email: true, image: true } },
           _count: { select: { versions: true } },
@@ -123,7 +123,7 @@ export default async function ProjectPage({ params }: { params: Promise<{ id: st
   const doneTasks = project.tasks.filter((t) => t.status === "DONE").length;
 
   return (
-    <div className="p-8 space-y-6 max-w-[1600px] mx-auto">
+    <div className="p-4 md:p-8 space-y-6 max-w-[1600px] mx-auto">
       {/* Breadcrumb */}
       <div className="flex items-center gap-2 text-sm text-zinc-500">
         <Link href="/projects" className="hover:text-white transition-colors">
@@ -201,6 +201,14 @@ export default async function ProjectPage({ params }: { params: Promise<{ id: st
           startDate: project.startDate,
           slackWebhook: project.slackWebhook,
           slackChannel: project.slackChannel,
+          pipelineConfig: project.pipelineConfig as {
+            templateAep?: string | null;
+            rendersRoot?: string | null;
+            overlayComp?: string | null;
+            previewComp?: string | null;
+            lutComp?: string | null;
+            autoShotThumbnail?: boolean | null;
+          } | null,
         }}
         clients={clients}
         teamMembers={teamMembers}

app/(dashboard)/projects/[id]/shots/[shotId]/page.tsx

@@ -30,11 +30,13 @@ import {
   FileVideo,
   Pencil,
   Check,
+  LayoutList,
 } from "lucide-react";
 import { Input } from "@/components/ui/input";
 import type { ShotWithDetails } from "@/types";
 import { ShotSettingsTab } from "@/components/shots/ShotSettingsTab";
 import { ShotExportsTab } from "@/components/shots/ShotExportsTab";
+import { ShotSlateTab } from "@/components/shots/ShotSlateTab";
 import { FootageViewer } from "@/components/shots/FootageViewer";
 import { HighResUploadDialog } from "@/components/shots/HighResUploadDialog";
 import { duplicateShot, internallyApproveShot, shareWithClient, unshareFromClient, unapproveShot, updateShotVersion } from "@/actions/shots";
@@ -74,6 +76,7 @@ const PRIORITY_CONFIG: Record<string, { label: string; dot: string }> = {
 };
 
 import { useToast } from "@/components/ui/use-toast";
+import { shotThumbnail } from "@/lib/shot-thumbnail";
 
 export default function ShotDetailPage() {
   const params = useParams<{ id: string; shotId: string }>();
@@ -90,7 +93,7 @@ export default function ShotDetailPage() {
   const [isDuplicating, setIsDuplicating] = useState(false);
   const [isActioning, setIsActioning] = useState(false);
   const [highResDialogOpen, setHighResDialogOpen] = useState(false);
-  const [activeTab, setActiveTab] = useState<"tasks" | "reviews" | "footage" | "exports" | "settings">("tasks");
+  const [activeTab, setActiveTab] = useState<"tasks" | "slate" | "reviews" | "footage" | "exports" | "settings">("tasks");
   const [editingVersion, setEditingVersion] = useState(false);
   const [versionInput, setVersionInput] = useState("");
   const [savingVersion, setSavingVersion] = useState(false);
@@ -227,7 +230,7 @@ export default function ShotDetailPage() {
   const { Icon: StatusIcon } = statusCfg;
 
   return (
-    <div className="p-6 space-y-6 max-w-[1400px] mx-auto">
+    <div className="p-4 md:p-6 space-y-6 max-w-[1400px] mx-auto">
       {/* Breadcrumb */}
       <div className="flex items-center gap-2 text-sm text-muted-foreground">
         <Link href="/projects" className="hover:text-foreground transition-colors">
@@ -242,28 +245,30 @@ export default function ShotDetailPage() {
       </div>
 
       {/* Header */}
-      <div className="flex items-start  gap-6">
+      {/* Phones: back button, then a full-width thumbnail, then the details
+          below it. From md: one row, as on desktop. */}
+      <div className="flex flex-wrap md:flex-nowrap items-start gap-4 md:gap-6">
         {/* Thumbnail – cinema scope 2.39:1 */}
         <Button variant="ghost" size="icon" asChild className="-ml-2 h-8 w-8">
               <Link href={`/projects/${params.id}`}>
                 <ArrowLeft className="h-4 w-4" />
               </Link>
             </Button>
-        {shot.thumbnailUrl && (
+        {shotThumbnail(shot) && (
-          <div className="relative flex-shrink-0 w-72 aspect-[2.39] rounded-lg overflow-hidden border border-border">
+          <div className="relative flex-shrink-0 w-full md:w-72 aspect-[2.39] rounded-lg overflow-hidden border border-border">
             
             <Image
-              src={shot.thumbnailUrl}
+              src={shotThumbnail(shot)!}
               alt={shot.shotCode}
               fill
               className="object-cover"
             />
           </div>
         )}
-        <div className="space-y-2">
+        <div className="space-y-2 min-w-0 w-full md:w-auto md:min-w-min">
-          <div className="flex items-center gap-3">
+          <div className="flex flex-wrap items-center gap-3">
 
-            <h1 className="text-2xl font-bold font-mono">{shot.shotCode}</h1>
+            <h1 className="text-2xl font-bold font-mono break-all md:break-normal">{shot.shotCode}</h1>
 
             {/* Shot version badge — click to edit for managers */}
             {canManage ? (
@@ -421,7 +426,7 @@ export default function ShotDetailPage() {
         )}
 
         {canManage && (
-          <div className="ml-auto shrink-0 flex items-center gap-2">
+          <div className="ml-auto shrink-0 flex flex-wrap md:flex-nowrap items-center gap-2 w-full md:w-auto">
             {/* Internal approval action */}
             {canInternallyApprove && shot.shotApprovalStatus === "PENDING" && (
               <Button
@@ -507,7 +512,8 @@ export default function ShotDetailPage() {
 
       {/* Tabs */}
       <div>
-        <div className="flex border-b border-border mb-5">
+        {/* Phones: five tabs are wider than the screen, so the bar scrolls sideways. */}
+        <div className="flex border-b border-border mb-5 overflow-x-auto overflow-y-hidden md:overflow-visible [&>button]:shrink-0 [&>button]:whitespace-nowrap">
           <button
             onClick={() => setActiveTab("tasks")}
             className={cn(
@@ -520,6 +526,18 @@ export default function ShotDetailPage() {
             <ListTodo className="h-4 w-4" />
             Tasks
           </button>
+          <button
+            onClick={() => setActiveTab("slate")}
+            className={cn(
+              "flex items-center gap-2 px-4 py-2.5 text-sm font-medium border-b-2 transition-colors -mb-px",
+              activeTab === "slate"
+                ? "border-amber-500 text-amber-400"
+                : "border-transparent text-zinc-500 hover:text-zinc-300"
+            )}
+          >
+            <LayoutList className="h-4 w-4" />
+            Slate
+          </button>
           <button
             onClick={() => setActiveTab("reviews")}
             className={cn(
@@ -583,6 +601,10 @@ export default function ShotDetailPage() {
           />
         )}
 
+        {activeTab === "slate" && (
+          <ShotSlateTab shot={shot} projectName={projectName} onSaved={fetchShot} />
+        )}
+
         {activeTab === "reviews" && (
           <div className="space-y-3">
             {tasks.length === 0 ? (

app/(dashboard)/projects/page.tsx

@@ -1,6 +1,6 @@
 "use client";
 
-import { useState, useEffect } from "react";
+import { useState, useEffect, useRef } from "react";
 import { useQuery } from "@tanstack/react-query";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
@@ -8,6 +8,7 @@ import { ProjectCard } from "@/components/projects/ProjectCard";
 import { NewProjectDialog } from "@/components/projects/NewProjectDialog";
 import { Plus, Search, Loader2 } from "lucide-react";
 import { HIDE_ARCHIVED_KEY } from "@/components/settings/HideArchivedToggle";
+import { useScrollMemory } from "@/hooks/use-scroll-memory";
 
 export default function ProjectsPage() {
   const [search, setSearch] = useState("");
@@ -43,22 +44,11 @@ export default function ProjectsPage() {
 
   const visibleProjects = hideArchived ? projects.filter((p: any) => p.status !== "ARCHIVED") : projects;
 
-  const SCROLL_KEY = 'projects-scroll';
+  const pageRef = useRef<HTMLDivElement>(null);
-
+  useScrollMemory("projects", pageRef, !isLoading);
-  useEffect(() => {
-    if (!isLoading) {
-      const saved = sessionStorage.getItem(SCROLL_KEY);
-      if (saved) {
-        sessionStorage.removeItem(SCROLL_KEY);
-        requestAnimationFrame(() => window.scrollTo(0, parseInt(saved, 10)));
-      }
-    }
-  }, [isLoading]);
-
-  const saveScroll = () => sessionStorage.setItem(SCROLL_KEY, String(window.scrollY));
 
   return (
-    <div className="p-8 space-y-6 max-w-[1600px] mx-auto">
+    <div ref={pageRef} className="p-4 md:p-8 space-y-6 max-w-[1600px] mx-auto">
       <div className="flex items-center justify-between gap-4 mb-8">
         <div>
           <h1 className="text-3xl font-bold text-white">Projects</h1>
@@ -104,9 +94,11 @@ export default function ProjectsPage() {
           </Button>
         </div>
       ) : (
-        <div className="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 xl:grid-cols-4 gap-4">
+        // auto-rows-fr keeps every row the same height, so a project with a
+        // long description does not make its whole row taller than the rest.
+        <div className="grid auto-rows-fr grid-cols-1 gap-4 sm:grid-cols-2 lg:grid-cols-3 xl:grid-cols-4">
           {visibleProjects.map((project: any) => (
-            <div key={project.id} onClick={saveScroll}>
+            <div key={project.id} className="h-full">
               <ProjectCard project={project} />
             </div>
           ))}

app/(dashboard)/schedule/SchedulePageClient.tsx

@@ -53,7 +53,12 @@ export interface ScheduleTask {
     email: string;
     image: string | null;
   } | null;
-  shot: { id: string; shotCode: string; thumbnailUrl: string | null } | null;
+  shot: {
+    id: string;
+    shotCode: string;
+    thumbnailUrl: string | null;
+    generatedThumbnailUrl: string | null;
+  } | null;
   asset: { id: string; assetCode: string; name: string } | null;
   project: { id: string; name: string; code: string };
 }

app/(dashboard)/schedule/page.tsx

@@ -31,7 +31,7 @@ export default async function SchedulePage({
         ...(artist ? { assignedArtistId: artist } : {}),
       },
       include: {
-        shot: { select: { id: true, shotCode: true, thumbnailUrl: true } },
+        shot: { select: { id: true, shotCode: true, thumbnailUrl: true, generatedThumbnailUrl: true } },
         asset: { select: { id: true, assetCode: true, name: true } },
         project: { select: { id: true, name: true, code: true } },
         assignedArtist: {
@@ -49,7 +49,7 @@ export default async function SchedulePage({
         ...(artist ? { assignedArtistId: artist } : {}),
       },
       include: {
-        shot: { select: { id: true, shotCode: true, thumbnailUrl: true } },
+        shot: { select: { id: true, shotCode: true, thumbnailUrl: true, generatedThumbnailUrl: true } },
         asset: { select: { id: true, assetCode: true, name: true } },
         project: { select: { id: true, name: true, code: true } },
         assignedArtist: {

app/(dashboard)/settings/migration/page.tsx

@@ -186,7 +186,7 @@ export default function MigrationPage() {
 
   if (fetchError) {
     return (
-      <div className="p-6 max-w-2xl">
+      <div className="p-4 md:p-6 max-w-2xl">
         <div className="flex items-center gap-2 text-sm text-red-400 rounded-md border border-red-500/20 bg-red-500/10 px-3 py-2">
           <AlertCircle className="h-4 w-4 shrink-0" />
           {fetchError}
@@ -200,7 +200,7 @@ export default function MigrationPage() {
 
   if (!hetznerConfigured) {
     return (
-      <div className="p-6 max-w-2xl">
+      <div className="p-4 md:p-6 max-w-2xl">
         <div className="flex items-center gap-2 text-sm text-amber-400 rounded-md border border-amber-500/20 bg-amber-500/10 px-3 py-2">
           <AlertCircle className="h-4 w-4 shrink-0" />
           Hetzner object storage is not configured. Set{" "}
@@ -217,7 +217,7 @@ export default function MigrationPage() {
   const allFilteredSelected = filtered.length > 0 && filtered.every((f) => selected.has(f.key));
 
   return (
-    <div className="p-6 space-y-4 max-w-5xl">
+    <div className="p-4 md:p-6 space-y-4 max-w-5xl">
       {/* Header */}
       <div className="flex items-start justify-between gap-4">
         <div>

app/(dashboard)/settings/page.tsx

@@ -19,7 +19,7 @@ export default async function SettingsPage() {
   const hetznerConfig = isAdmin ? await getHetznerConfig() : null;
 
   return (
-    <div className="p-6 space-y-6 max-w-2xl mx-auto">
+    <div className="p-4 md:p-6 space-y-6 max-w-2xl mx-auto">
       <h1 className="text-2xl font-bold">Account Settings</h1>
 
       <Card>

app/(dashboard)/settings/storage-test/page.tsx

@@ -72,7 +72,7 @@ export default function StorageTestPage() {
   };
 
   return (
-    <div className="p-6 max-w-3xl space-y-6">
+    <div className="p-4 md:p-6 max-w-3xl space-y-6">
       <div>
         <h1 className="text-xl font-semibold">Object Storage Playback Test</h1>
         <p className="text-sm text-muted-foreground mt-1">

app/(dashboard)/shot-status/page.tsx

@@ -2,6 +2,7 @@ import { db } from "@/lib/db";
 import { auth } from "@/auth";
 import { redirect } from "next/navigation";
 import { ShotStatusClient } from "./ShotStatusClient";
+import { summariseShotDelivery } from "@/lib/render-pipeline/shot-delivery-summary";
 
 async function getProjects() {
   return db.project.findMany({
@@ -19,8 +20,17 @@ async function getEpisodeDueDatesForProject(projectId: string) {
   });
 }
 
+/** Everyone a shot can be handed to — clients and deactivated accounts excluded. */
+async function getAssignableArtists() {
+  return db.user.findMany({
+    where: { isActive: true, role: { not: "CLIENT" } },
+    select: { id: true, name: true, email: true, image: true },
+    orderBy: { name: "asc" },
+  });
+}
+
 async function getShotsForProject(projectId: string) {
-  return db.shot.findMany({
+  const shots = await db.shot.findMany({
     where: { projectId },
     orderBy: [
       { episode: { sort: "asc", nulls: "last" } },
@@ -37,13 +47,62 @@ async function getShotsForProject(projectId: string) {
       priority: true,
       dueDate: true,
       thumbnailUrl: true,
+      generatedThumbnailUrl: true,
       notes: true,
       description: true,
       isKeyShot: true,
+      isScaled: true,
+      manualDeliveredAt: true,
+      manualDeliveryNote: true,
+      manualDeliverySharedWith: true,
+      // The shot-level version the panel burns into overlays and queueExport
+      // renders under — not the count of review Versions uploaded.
+      shotVersion: true,
       artist: { select: { id: true, name: true, image: true, email: true } },
       shotGroup: { select: { id: true, name: true } },
+      // Every export, for the packages each went into; the newest live one
+      // is what is on its way.
+      exports: {
+        orderBy: [{ versionNumber: "desc" }, { createdAt: "desc" }],
+        select: {
+          versionString: true,
+          status: true,
+          deliveryItems: {
+            select: {
+              versionString: true,
+              package: {
+                select: {
+                  kind: true,
+                  status: true,
+                  packageNumber: true,
+                  createdAt: true,
+                  builtAt: true,
+                  uploadedAt: true,
+                  deliveredAt: true,
+                  sharedWith: true,
+                },
+              },
+            },
+          },
+        },
+      },
     },
   });
+
+  return shots.map(({ exports, ...shot }) => ({
+    ...shot,
+    delivery: summariseShotDelivery({
+      packages: exports.flatMap((e) =>
+        e.deliveryItems.map((item) => ({ ...item.package, versionString: item.versionString }))
+      ),
+      manual: {
+        deliveredAt: shot.manualDeliveredAt,
+        sharedWith: shot.manualDeliverySharedWith,
+        note: shot.manualDeliveryNote,
+      },
+      latestExport: exports.find((e) => e.status !== "CANCELLED" && e.status !== "ARCHIVED") ?? null,
+    }),
+  }));
 }
 
 export default async function ShotStatusPage({
@@ -57,10 +116,11 @@ export default async function ShotStatusPage({
   const { projectId } = await searchParams;
   const canManage = ["ADMIN", "PRODUCER", "SUPERVISOR"].includes(session.user.role);
 
-  const [projects, shots, episodeDueDates] = await Promise.all([
+  const [projects, shots, episodeDueDates, artists] = await Promise.all([
     getProjects(),
     projectId ? getShotsForProject(projectId) : Promise.resolve([]),
     projectId ? getEpisodeDueDatesForProject(projectId) : Promise.resolve([]),
+    canManage ? getAssignableArtists() : Promise.resolve([]),
   ]);
 
   const selectedProject = projects.find((p) => p.id === projectId) ?? null;
@@ -72,6 +132,7 @@ export default async function ShotStatusPage({
       selectedProject={selectedProject}
       shots={shots as any}
       episodeDueDates={episodeDueDates}
+      artists={artists}
       canManage={canManage}
     />
   );

app/(dashboard)/tasks/TasksPageClient.tsx

@@ -110,7 +110,7 @@ export function TasksPageClient({
   };
 
   return (
-    <div className="p-6 max-w-5xl mx-auto space-y-6">
+    <div className="p-4 md:p-6 max-w-5xl mx-auto space-y-6">
       {/* Header */}
       <div className="flex items-center justify-between">
         <div>

app/(dashboard)/users/page.tsx

@@ -32,7 +32,7 @@ export default async function UsersPage() {
   }));
 
   return (
-    <div className="p-6 max-w-5xl mx-auto space-y-6">
+    <div className="p-4 md:p-6 max-w-5xl mx-auto space-y-6">
       <div className="flex items-center gap-3">
         <div className="w-10 h-10 rounded-lg bg-amber-500/10 border border-amber-500/20 flex items-center justify-center shrink-0">
           <Users className="h-5 w-5 text-amber-400" />

app/api/batch-upload/plates/route.ts

@@ -0,0 +1,124 @@
+import { NextRequest, NextResponse } from "next/server";
+import { auth } from "@/auth";
+import { db } from "@/lib/db";
+import { PLATE_EXTS, parsePlateFilename } from "@/lib/batch-upload-parser";
+
+export type PlatePreviewItemStatus =
+  | "match"       // shot found → a new footage plate will be added
+  | "duplicate"   // the shot already has a plate with this exact filename
+  | "no-match"    // no shot in this project matches the filename
+  | "unsupported"; // extension is not an accepted video format
+
+export interface PlatePreviewItem {
+  fileName: string;
+  shotCode: string | null;
+  shotId: string | null;
+  /** Label the new plate will be created with */
+  label: string;
+  status: PlatePreviewItemStatus;
+  /** Number of plates the matched shot already has */
+  existingPlateCount: number;
+}
+
+/**
+ * POST /api/batch-upload/plates
+ * Body: { projectId: string; fileNames: string[] }
+ *
+ * Previews which shot each footage plate file will be attached to, derived
+ * from the filename. e.g. "DH2_VFX_058_120_REF.mov" → shot "DH2_VFX_058_120"
+ * with the label "REF". Nothing is uploaded.
+ */
+export async function POST(req: NextRequest) {
+  const session = await auth();
+  if (!session?.user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+
+  let body: unknown;
+  try {
+    body = await req.json();
+  } catch {
+    return NextResponse.json({ error: "Invalid JSON" }, { status: 400 });
+  }
+
+  const { projectId, fileNames } = body as { projectId?: unknown; fileNames?: unknown };
+
+  if (!projectId || typeof projectId !== "string" || !Array.isArray(fileNames)) {
+    return NextResponse.json(
+      { error: "projectId and fileNames[] are required" },
+      { status: 400 }
+    );
+  }
+
+  const shots = await db.shot.findMany({
+    where: { projectId },
+    select: {
+      id: true,
+      shotCode: true,
+      footagePlates: { select: { fileName: true } },
+    },
+  });
+
+  const shotCodes = shots.map((s) => s.shotCode);
+  const shotByCode = new Map(shots.map((s) => [s.shotCode, s]));
+
+  // Several files in one batch can land on the same shot, so keep a running
+  // count per shot to number the "Plate N" fallback labels correctly.
+  const allocated = new Map<string, number>();
+
+  const items: PlatePreviewItem[] = fileNames.map((fileName: string) => {
+    const parsed = parsePlateFilename(fileName, shotCodes);
+
+    if (!PLATE_EXTS.has(parsed.ext)) {
+      return {
+        fileName,
+        shotCode: null,
+        shotId: null,
+        label: "",
+        status: "unsupported" as const,
+        existingPlateCount: 0,
+      };
+    }
+
+    const shot = parsed.shotCode ? shotByCode.get(parsed.shotCode) ?? null : null;
+    if (!shot) {
+      return {
+        fileName,
+        shotCode: null,
+        shotId: null,
+        label: "",
+        status: "no-match" as const,
+        existingPlateCount: 0,
+      };
+    }
+
+    const existingPlateCount = shot.footagePlates.length;
+
+    // Re-running a batch shouldn't silently pile up identical plates.
+    const isDuplicate = shot.footagePlates.some(
+      (p) => p.fileName.toLowerCase() === fileName.toLowerCase()
+    );
+    if (isDuplicate) {
+      return {
+        fileName,
+        shotCode: shot.shotCode,
+        shotId: shot.id,
+        label: parsed.label,
+        status: "duplicate" as const,
+        existingPlateCount,
+      };
+    }
+
+    const takenSoFar = allocated.get(shot.id) ?? 0;
+    allocated.set(shot.id, takenSoFar + 1);
+
+    return {
+      fileName,
+      shotCode: shot.shotCode,
+      shotId: shot.id,
+      label: parsed.label || `Plate ${existingPlateCount + takenSoFar + 1}`,
+      status: "match" as const,
+      existingPlateCount,
+    };
+  });
+
+  return NextResponse.json({ items });
+}

app/api/batch-upload/plates/upload/route.ts

@@ -0,0 +1,96 @@
+import { NextRequest, NextResponse } from "next/server";
+import { auth } from "@/auth";
+import { db } from "@/lib/db";
+import { revalidatePath } from "next/cache";
+
+export const maxDuration = 30;
+
+/**
+ * POST /api/batch-upload/plates/upload
+ * Body: { projectId, shotId, key, fileName, fileSize?, label? }
+ *
+ * Commits a footage plate whose bytes were already uploaded straight to
+ * Hetzner via POST /api/upload/presign, so large .mov plates never pass
+ * through this server or the reverse proxy.
+ */
+export async function POST(req: NextRequest) {
+  const session = await auth();
+  if (!session?.user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  if (!["ADMIN", "PRODUCER", "SUPERVISOR"].includes(session.user.role)) {
+    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+  }
+
+  let body: unknown;
+  try {
+    body = await req.json();
+  } catch {
+    return NextResponse.json({ error: "Invalid JSON" }, { status: 400 });
+  }
+
+  const { projectId, shotId, key, fileName, fileSize, label } = body as {
+    projectId?: unknown;
+    shotId?: unknown;
+    key?: unknown;
+    fileName?: unknown;
+    fileSize?: unknown;
+    label?: unknown;
+  };
+
+  if (
+    typeof projectId !== "string" ||
+    typeof shotId !== "string" ||
+    typeof key !== "string" ||
+    typeof fileName !== "string" ||
+    !projectId ||
+    !shotId ||
+    !key ||
+    !fileName
+  ) {
+    return NextResponse.json(
+      { error: "projectId, shotId, key and fileName are required" },
+      { status: 400 }
+    );
+  }
+
+  // The key must be one this app handed out via /api/upload/presign.
+  if (!key.startsWith("videos/")) {
+    return NextResponse.json({ error: "Invalid storage key" }, { status: 400 });
+  }
+
+  const shot = await db.shot.findFirst({
+    where: { id: shotId, projectId },
+    select: { id: true },
+  });
+  if (!shot) return NextResponse.json({ error: "Shot not found" }, { status: 404 });
+
+  const last = await db.footagePlate.findFirst({
+    where: { shotId },
+    orderBy: { sortOrder: "desc" },
+    select: { sortOrder: true },
+  });
+
+  const size = typeof fileSize === "number" && Number.isFinite(fileSize) && fileSize > 0
+    ? BigInt(Math.round(fileSize))
+    : null;
+
+  const plate = await db.footagePlate.create({
+    data: {
+      shotId,
+      fileUrl: `/api/files/${key}`,
+      fileKey: key,
+      fileName,
+      fileSize: size,
+      label: typeof label === "string" ? label.trim().slice(0, 100) : "",
+      sortOrder: (last?.sortOrder ?? -1) + 1,
+    },
+  });
+
+  revalidatePath(`/projects/${projectId}`);
+  revalidatePath(`/projects/${projectId}/shots/${shotId}`);
+
+  return NextResponse.json({
+    success: true,
+    plateId: plate.id,
+    label: plate.label,
+  });
+}

app/api/batch-upload/upload/route.ts

@@ -2,7 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { auth } from "@/auth";
 import { db } from "@/lib/db";
 import { uploadToHetzner, deleteFromHetzner } from "@/lib/storage";
-import { recalcShotStatus } from "@/lib/shot-status";
+import { recalcShotStatus, clearStaleShotApproval } from "@/lib/shot-status";
 
 export const maxDuration = 300; // 5 min — large .mov high-res files
 
@@ -194,8 +194,14 @@ export async function POST(
     data: { status: "INTERNAL_REVIEW" },
   });
 
-  // Recalculate the parent shot's status
+  // Recalculate the parent shot's status, clearing any stale sign-off first so
-  await recalcShotStatus(shotId).catch(() => {});
+  // the new version does not land under a shot still reading COMPLETE.
+  await db
+    .$transaction(async (tx) => {
+      await clearStaleShotApproval(tx, shotId);
+      await recalcShotStatus(shotId, tx);
+    })
+    .catch(() => {});
 
   return NextResponse.json({
     success: true,

app/api/client/[token]/approve/route.ts

@@ -1,21 +1,8 @@
 import { NextRequest, NextResponse } from "next/server";
 import { db } from "@/lib/db";
 import { ApprovalStatus } from "@prisma/client";
-import { recalcShotStatus } from "@/lib/shot-status";
+import { recalcShotStatus, markShotForRevisions } from "@/lib/shot-status";
-import { validateReviewToken } from "@/lib/review-auth";
+import { validateReviewToken, getOrCreateReviewUser } from "@/lib/review-auth";
-
-async function getOrCreateClientUser(email: string, label?: string | null) {
-  const existing = await db.user.findUnique({ where: { email } });
-  if (existing) return existing;
-  return db.user.create({
-    data: {
-      email,
-      name: label ?? email.split("@")[0],
-      role: "CLIENT",
-      isActive: true,
-    },
-  });
-}
 
 export async function POST(
   req: NextRequest,
@@ -48,9 +35,12 @@ export async function POST(
     }
 
     if (action === "APPROVE") {
-      await db.shot.update({
+      await db.$transaction(async (tx) => {
+        await tx.shot.update({
           where: { id: shotId },
-        data: { shotApprovalStatus: "CLIENT_APPROVED", status: "COMPLETE" },
+          data: { shotApprovalStatus: "CLIENT_APPROVED" },
+        });
+        await recalcShotStatus(shotId, tx);
       });
     } else if (action === "NEEDS_CHANGES") {
       // Increment shotVersion: v001 → v002, v009 → v010, etc.
@@ -59,17 +49,41 @@ export async function POST(
       const nextNum = verMatch ? parseInt(verMatch[1], 10) + 1 : 2;
       const nextVersion = "v" + String(nextNum).padStart(3, "0");
 
+      const user = await getOrCreateReviewUser(session, token);
+
       await db.$transaction(async (tx) => {
         await tx.shot.update({
           where: { id: shotId },
-          data: { shotApprovalStatus: "PENDING", sharedWithClient: false, shotVersion: nextVersion },
+          data: { shotVersion: nextVersion },
         });
-        // Mark all non-DONE tasks as CHANGES
+
-        await tx.task.updateMany({
+        // Clears the approval, unshares, marks the tasks needing rework and
-          where: { shotId, status: { not: "DONE" } },
+        // recalculates — including the case where every task was already DONE,
-          data: { status: "CHANGES" },
+        // which used to match nothing and leave the request with no effect.
+        await markShotForRevisions(tx, shotId);
+
+        // The shot-level verdict has to land on the versions too: the dashboard
+        // counters, the version badges and the client portal's own filters all
+        // read Version.approvalStatus, so a shot-level change request was
+        // invisible everywhere those look.
+        const shown = await tx.version.findMany({
+          where: { task: { shotId }, isClientVisible: true, isLatest: true },
+          select: { id: true },
         });
-        await recalcShotStatus(shotId, tx);
+        for (const v of shown) {
+          await tx.approval.create({
+            data: {
+              versionId: v.id,
+              userId: user.id,
+              status: "NEEDS_CHANGES",
+              notes: notes ?? "Changes requested on the shot",
+            },
+          });
+          await tx.version.update({
+            where: { id: v.id },
+            data: { approvalStatus: "NEEDS_CHANGES" },
+          });
+        }
       });
     } else {
       return NextResponse.json({ error: "Invalid action" }, { status: 400 });
@@ -99,8 +113,7 @@ export async function POST(
     return NextResponse.json({ error: "Version not found" }, { status: 404 });
   }
 
-  const email = session.email ?? `client+${token.slice(0, 8)}@review.external`;
+  const user = await getOrCreateReviewUser(session, token);
-  const user = await getOrCreateClientUser(email, session.label);
 
   // Record approval
   await db.approval.create({
@@ -126,9 +139,12 @@ export async function POST(
           select: { sharedWithClient: true, shotApprovalStatus: true },
         });
         if (shot?.sharedWithClient && shot.shotApprovalStatus !== "CLIENT_APPROVED") {
+          // status is left to the recalc below — writing COMPLETE here was
+          // overwritten by it anyway, and disagreed with it whenever another
+          // task on the shot was still on CHANGES.
           await db.shot.update({
             where: { id: version.task.shot.id },
-            data: { shotApprovalStatus: "CLIENT_APPROVED", status: "COMPLETE" },
+            data: { shotApprovalStatus: "CLIENT_APPROVED" },
           });
         }
       }

app/api/client/[token]/comment/[commentId]/route.ts

@@ -0,0 +1,127 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db } from "@/lib/db";
+import { validateReviewToken, findReviewUser, ownsComment } from "@/lib/review-auth";
+
+/**
+ * Edit and delete for notes left through a client review link.
+ *
+ * A reviewer may only touch their own notes: the studio's comments and those of
+ * any other review session are read-only here, whatever the link holder sends.
+ * Ownership is the review session's guest User (lib/review-auth.ts) — the link
+ * is the credential, so everyone holding it shares that identity.
+ */
+
+/** Matches the internal addComment/editComment limits (actions/comments.ts). */
+const MAX_LENGTH = 5000;
+
+/** The annotation companion comments written by the drawing tools. */
+const ANNOTATION_PREFIX = "✏️ Annotation at frame";
+
+type Ctx = { params: Promise<{ token: string; commentId: string }> };
+
+/**
+ * Resolves the request to a comment the caller is allowed to change, or the
+ * response explaining why not.
+ *
+ * "Not yours" is deliberately answered with 404 rather than 403: a link holder
+ * has no business learning which comment ids exist outside their own notes.
+ */
+async function authorizeCommentEdit(req: NextRequest, ctx: Ctx) {
+  const { token, commentId } = await ctx.params;
+
+  const result = await validateReviewToken(token, req);
+  if (result.type === "requiresPassword") {
+    return { error: NextResponse.json({ requiresPassword: true }, { status: 401 }) };
+  }
+  if (result.type === "invalid") {
+    return {
+      error: NextResponse.json({ error: "Invalid or expired review link" }, { status: 403 }),
+    };
+  }
+  const session = result.session;
+
+  const notFound = NextResponse.json({ error: "Comment not found" }, { status: 404 });
+
+  const comment = await db.comment.findUnique({
+    where: { id: commentId },
+    select: {
+      id: true,
+      authorId: true,
+      versionId: true,
+      frameNumber: true,
+      text: true,
+      version: {
+        select: {
+          shot: { select: { projectId: true } },
+          task: { select: { projectId: true } },
+        },
+      },
+    },
+  });
+  if (!comment) return { error: notFound };
+
+  // Same project scoping the rest of the portal applies.
+  const projectId = comment.version.shot?.projectId ?? comment.version.task?.projectId;
+  if (projectId !== session.projectId) return { error: notFound };
+
+  const user = await findReviewUser(session, token);
+  if (!ownsComment(comment, user?.id)) return { error: notFound };
+
+  return { comment };
+}
+
+/** PATCH — change the text of one's own note. */
+export async function PATCH(req: NextRequest, ctx: Ctx) {
+  const authorized = await authorizeCommentEdit(req, ctx);
+  if (authorized.error) return authorized.error;
+  const { comment } = authorized;
+
+  const body = await req.json().catch(() => null);
+  const text = typeof body?.text === "string" ? body.text.trim() : "";
+  if (!text) {
+    return NextResponse.json({ error: "Note text is required" }, { status: 400 });
+  }
+  if (text.length > MAX_LENGTH) {
+    return NextResponse.json(
+      { error: `Note must be ${MAX_LENGTH} characters or fewer` },
+      { status: 400 }
+    );
+  }
+
+  // Only the text is editable. The frame a note is pinned to is what the studio
+  // works from, so moving it would silently repoint feedback someone may have
+  // already actioned; a note about a different frame is a new note.
+  const updated = await db.comment.update({
+    where: { id: comment.id },
+    data: { text },
+    include: {
+      author: { select: { id: true, name: true, image: true, email: true } },
+      replies: {
+        orderBy: { createdAt: "asc" },
+        include: { author: { select: { id: true, name: true, image: true, email: true } } },
+      },
+    },
+  });
+
+  return NextResponse.json({ comment: { ...updated, canEdit: true } });
+}
+
+/** DELETE — remove one's own note. */
+export async function DELETE(req: NextRequest, ctx: Ctx) {
+  const authorized = await authorizeCommentEdit(req, ctx);
+  if (authorized.error) return authorized.error;
+  const { comment } = authorized;
+
+  await db.comment.delete({ where: { id: comment.id } });
+
+  // A drawing leaves a companion comment; deleting the note without the strokes
+  // would leave marks on the frame that nothing explains. Mirrors deleteComment
+  // in actions/comments.ts.
+  if (comment.text.startsWith(ANNOTATION_PREFIX)) {
+    await db.annotation.deleteMany({
+      where: { versionId: comment.versionId, frameNumber: comment.frameNumber },
+    });
+  }
+
+  return NextResponse.json({ success: true });
+}

app/api/client/[token]/comment/route.ts

@@ -1,21 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { db } from "@/lib/db";
 import { slackNotifyNewFeedback } from "@/lib/slack";
-import { validateReviewToken } from "@/lib/review-auth";
+import { validateReviewToken, getOrCreateReviewUser } from "@/lib/review-auth";
-
-/** Find or create a guest user for the client reviewer based on the session email */
-async function getOrCreateClientUser(email: string, label?: string | null) {
-  const existing = await db.user.findUnique({ where: { email } });
-  if (existing) return existing;
-  return db.user.create({
-    data: {
-      email,
-      name: label ?? email.split("@")[0],
-      role: "CLIENT",
-      isActive: true,
-    },
-  });
-}
 
 export async function POST(
   req: NextRequest,
@@ -52,8 +38,7 @@ export async function POST(
   }
 
   // Resolve commenter identity
-  const email = session.email ?? `client+${token.slice(0, 8)}@review.external`;
+  const user = await getOrCreateReviewUser(session, token);
-  const user = await getOrCreateClientUser(email, session.label);
 
   const comment = await db.comment.create({
     data: {
@@ -85,5 +70,6 @@ export async function POST(
     });
   }
 
-  return NextResponse.json({ comment }, { status: 201 });
+  // canEdit mirrors the GET shape — a note you just wrote is always your own.
+  return NextResponse.json({ comment: { ...comment, canEdit: true } }, { status: 201 });
 }

app/api/client/[token]/project/route.ts

@@ -1,6 +1,8 @@
 import { NextRequest, NextResponse } from "next/server";
 import { db } from "@/lib/db";
 import { validateReviewToken } from "@/lib/review-auth";
+import { shotThumbnail } from "@/lib/shot-thumbnail";
+import { clientShotCode, clientTaskTitle } from "@/lib/shot-code";
 
 /** GET /api/client/[token]/project — returns project + shots with tasks that have client-visible versions */
 export async function GET(
@@ -43,12 +45,15 @@ export async function GET(
     select: {
       id: true,
       shotCode: true,
+      clientCode: true,
       episode: true,
       sequence: true,
+      scene: true,
       description: true,
       status: true,
       shotApprovalStatus: true,
       thumbnailUrl: true,
+      generatedThumbnailUrl: true,
       tasks: {
         where: {
           versions: { some: { isClientVisible: true } },
@@ -68,7 +73,6 @@ export async function GET(
               fps: true,
               duration: true,
               thumbnailUrl: true,
-              notes: true,
               createdAt: true,
             },
           },
@@ -100,7 +104,6 @@ export async function GET(
           fps: true,
           duration: true,
           thumbnailUrl: true,
-          notes: true,
           createdAt: true,
         },
       },
@@ -115,7 +118,26 @@ export async function GET(
 
   return NextResponse.json({
     project,
-    shots,
+    // Shots the client sees resolve the same way as internally: the reference
+    // still first, a render-derived one only where the show supplied none.
+    // Everything the client reads is in their own naming: the alias replaces
+    // our shot code, and the same swap runs over task titles, which carry the
+    // code by convention ("UNG_106_010_020_cmp_TT_v004"). The internal code is
+    // not sent at all — there is nothing here for it to be useful for, and
+    // leaking it invites the client to quote it back at us.
+    // The scene is our numbering too, and an alias does not have to share it
+    // (SNV's "SNV_101_0463_CP_VFX" is our scene 001), so an aliased shot goes
+    // out without one rather than with a number the client never used.
+    shots: shots.map(({ generatedThumbnailUrl, clientCode, scene, ...shot }) => ({
+      ...shot,
+      shotCode: clientShotCode({ ...shot, clientCode }),
+      scene: clientShotCode({ ...shot, clientCode }) === shot.shotCode ? scene || null : null,
+      thumbnailUrl: shotThumbnail({ ...shot, generatedThumbnailUrl }),
+      tasks: shot.tasks.map((task) => ({
+        ...task,
+        title: clientTaskTitle(task.title, { ...shot, clientCode }),
+      })),
+    })),
     assetTasks,
     sessionLabel: session.label,
   });

app/api/client/[token]/versions/[versionId]/highres/download/route.ts

@@ -0,0 +1,57 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db } from "@/lib/db";
+import { validateReviewToken } from "@/lib/review-auth";
+import { generateHetznerDownloadUrl } from "@/lib/storage";
+import { clientHighResFilename } from "@/lib/shot-code";
+
+/**
+ * GET /api/client/[token]/versions/[versionId]/highres/download
+ * The version's ProRes, for a client reviewer: same visibility rule as the
+ * version itself (GET ../route.ts), and named with the client's shot code.
+ */
+export async function GET(
+  req: NextRequest,
+  { params }: { params: Promise<{ token: string; versionId: string }> }
+) {
+  const { token, versionId } = await params;
+
+  const result = await validateReviewToken(token, req);
+  if (result.type !== "ok") {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const version = await db.version.findUnique({
+    where: { id: versionId },
+    select: {
+      highResKey: true,
+      highResFilename: true,
+      isClientVisible: true,
+      shot: { select: { projectId: true, shotCode: true, clientCode: true } },
+      task: {
+        select: {
+          projectId: true,
+          shot: { select: { shotCode: true, clientCode: true } },
+        },
+      },
+    },
+  });
+
+  const projectId = version?.shot?.projectId ?? version?.task?.projectId;
+  if (!version || projectId !== result.session.projectId) {
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
+  }
+  // Task-only versions need explicit sharing, as in the version route
+  if (!version.shot && !version.isClientVisible) {
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
+  }
+  if (!version.highResKey) {
+    return NextResponse.json({ error: "No high-res file available" }, { status: 404 });
+  }
+
+  const shot = version.shot ?? version.task?.shot ?? null;
+  const url = await generateHetznerDownloadUrl(
+    version.highResKey,
+    clientHighResFilename(version.highResFilename ?? "high-res.mov", shot)
+  );
+  return NextResponse.json({ url });
+}

app/api/client/[token]/versions/[versionId]/route.ts

@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { db } from "@/lib/db";
-import { validateReviewToken } from "@/lib/review-auth";
+import { validateReviewToken, findReviewUser, ownsComment } from "@/lib/review-auth";
+import { clientHighResFilename, clientShotCode, clientTaskTitle } from "@/lib/shot-code";
 
 /** GET /api/client/[token]/versions/[versionId] — returns version + comments for client portal */
 export async function GET(
@@ -40,7 +41,7 @@ export async function GET(
       task: {
         include: {
           project: { select: { id: true, name: true, code: true } },
-          shot: { select: { id: true, shotCode: true, highResKey: true, highResFilename: true } },
+          shot: { select: { id: true, shotCode: true, clientCode: true, highResKey: true, highResFilename: true } },
           asset: { select: { assetCode: true, name: true } },
         },
       },
@@ -64,7 +65,7 @@ export async function GET(
     return NextResponse.json({ error: "Version not found" }, { status: 404 });
   }
 
-  const comments = await db.comment.findMany({
+  const commentRows = await db.comment.findMany({
     where: { versionId },
     orderBy: { frameNumber: "asc" },
     include: {
@@ -78,31 +79,59 @@ export async function GET(
     },
   });
 
+  // Which notes this reviewer may edit or delete. Read-only: opening a review
+  // link should not create the guest User, so a session that has never posted
+  // simply owns nothing. The edit/delete route re-checks this — the flag drives
+  // the UI, it does not grant anything.
+  const reviewUser = await findReviewUser(session, token);
+  const comments = commentRows.map((c) => ({
+    ...c,
+    canEdit: ownsComment(c, reviewUser?.id),
+  }));
+
   // Resolve the shot that has the high-res file (comes from version.shot OR version.task.shot)
   const highResShot = version.shot ?? (version.task as any)?.shot ?? null;
 
+  // The shot the title and breadcrumb are drawn from — either relation.
+  const namingShot = version.shot ?? ((version.task as any)?.shot ?? null);
+
+  // High Res: this version's own ProRes (uploaded by the render worker) wins;
+  // the shot's manually uploaded file is the fallback for older versions.
+  const versionHighRes = !!version.highResKey;
   const serializedVersion = {
     ...version,
     fileSize: version.fileSize?.toString() ?? null,
+    highResKey: undefined, // never expose a storage key
+    highResSize: version.highResSize?.toString() ?? null,
     // Top-level high-res fields so the client works for both shot and task versions
-    hasHighRes: !!(highResShot?.highResKey),
+    hasHighRes: versionHighRes || !!(highResShot?.highResKey),
-    highResShotId: highResShot?.highResKey ? (highResShot.id ?? null) : null,
+    highResSource: versionHighRes ? "version" : highResShot?.highResKey ? "shot" : null,
-    highResFilename: highResShot?.highResFilename ?? null,
+    highResShotId: !versionHighRes && highResShot?.highResKey ? (highResShot.id ?? null) : null,
+    highResFilename: versionHighRes
+      ? clientHighResFilename(version.highResFilename ?? "high-res.mov", namingShot)
+      : highResShot?.highResFilename ?? null,
     // Expose only whether a high-res file exists on the shot relation, never the storage key
     shot: version.shot
       ? {
           ...version.shot,
+          shotCode: clientShotCode(version.shot),
+          clientCode: undefined,
           hasHighRes: !!version.shot.highResKey,
           highResFilename: version.shot.highResFilename ?? null,
           highResKey: undefined,
         }
       : null,
+    // Task titles carry the shot code by convention, so the player header gets
+    // the same swap as the shot list (lib/shot-code.ts).
     task: version.task
       ? {
           ...version.task,
+          title: namingShot ? clientTaskTitle(version.task.title, namingShot) : version.task.title,
           shot: (version.task as any)?.shot
             ? {
                 ...((version.task as any).shot),
+                shotCode: clientShotCode((version.task as any).shot),
+                clientCode: undefined,
                 highResKey: undefined, // strip storage key
               }
             : null,

app/api/deliveries/[packageId]/cancel/route.ts

@@ -0,0 +1,23 @@
+import { NextRequest, NextResponse } from "next/server";
+import { toErrorResponse } from "@/lib/render-pipeline/errors";
+import { requirePipelineAdmin } from "@/lib/render-pipeline/session-auth";
+import { cancelDeliveryPackage } from "@/lib/render-pipeline/deliveries";
+
+// ── POST /api/deliveries/{id}/cancel ─────────────────────────────────────────
+//
+// Packages are never deleted (§11.5); a mistaken one is cancelled.
+
+export async function POST(
+  _req: NextRequest,
+  { params }: { params: Promise<{ packageId: string }> }
+) {
+  try {
+    const user = await requirePipelineAdmin();
+    const { packageId } = await params;
+    const result = await cancelDeliveryPackage(packageId, user.id);
+    return NextResponse.json(result);
+  } catch (err) {
+    const { body, status } = toErrorResponse(err);
+    return NextResponse.json(body, { status });
+  }
+}

app/api/deliveries/[packageId]/delivered/route.ts

@@ -0,0 +1,34 @@
+import { NextRequest, NextResponse } from "next/server";
+import { toErrorResponse } from "@/lib/render-pipeline/errors";
+import { requirePipelineAdmin } from "@/lib/render-pipeline/session-auth";
+import { markDelivered } from "@/lib/render-pipeline/deliveries";
+import { recordShareSchema } from "@/lib/render-pipeline/delivery-handoff";
+
+// ── POST /api/deliveries/{id}/delivered (E19) ────────────────────────────────
+//
+// The upload link has been sent to the client. Takes who it was sent to, and
+// moves every packaged export to DELIVERED — the end of the pipeline.
+
+export async function POST(
+  req: NextRequest,
+  { params }: { params: Promise<{ packageId: string }> }
+) {
+  try {
+    const user = await requirePipelineAdmin();
+    const { packageId } = await params;
+
+    const parsed = recordShareSchema.safeParse(await req.json().catch(() => null));
+    if (!parsed.success) {
+      return NextResponse.json(
+        { error: parsed.error.issues[0]?.message ?? "Invalid request", details: parsed.error.issues },
+        { status: 422 }
+      );
+    }
+
+    const result = await markDelivered(packageId, parsed.data, user.id);
+    return NextResponse.json(result);
+  } catch (err) {
+    const { body, status } = toErrorResponse(err);
+    return NextResponse.json(body, { status });
+  }
+}

app/api/deliveries/[packageId]/uploaded/route.ts

@@ -0,0 +1,34 @@
+import { NextRequest, NextResponse } from "next/server";
+import { toErrorResponse } from "@/lib/render-pipeline/errors";
+import { requirePipelineAdmin } from "@/lib/render-pipeline/session-auth";
+import { markUploaded } from "@/lib/render-pipeline/deliveries";
+import { recordUploadSchema } from "@/lib/render-pipeline/delivery-handoff";
+
+// ── POST /api/deliveries/{id}/uploaded ───────────────────────────────────────
+//
+// The folder is on the client's portal. Records where, so the package shows as
+// waiting to be shared rather than waiting to be uploaded.
+
+export async function POST(
+  req: NextRequest,
+  { params }: { params: Promise<{ packageId: string }> }
+) {
+  try {
+    const user = await requirePipelineAdmin();
+    const { packageId } = await params;
+
+    const parsed = recordUploadSchema.safeParse(await req.json().catch(() => null));
+    if (!parsed.success) {
+      return NextResponse.json(
+        { error: parsed.error.issues[0]?.message ?? "Invalid request", details: parsed.error.issues },
+        { status: 422 }
+      );
+    }
+
+    const result = await markUploaded(packageId, parsed.data, user.id);
+    return NextResponse.json(result);
+  } catch (err) {
+    const { body, status } = toErrorResponse(err);
+    return NextResponse.json(body, { status });
+  }
+}

app/api/deliveries/ready/route.ts

@@ -0,0 +1,24 @@
+import { NextRequest, NextResponse } from "next/server";
+import { toErrorResponse } from "@/lib/render-pipeline/errors";
+import { requirePipelineUser } from "@/lib/render-pipeline/session-auth";
+import { getReadyForDelivery } from "@/lib/render-pipeline/deliveries";
+
+// ── GET /api/deliveries/ready?projectId=&episode= (E18) ──────────────────────
+//
+// READY_FOR_DELIVERY exports grouped by episode — "Episode 101 — Ready: 18 shots".
+
+export async function GET(req: NextRequest) {
+  try {
+    await requirePipelineUser();
+    const { searchParams } = new URL(req.url);
+    const projectId = searchParams.get("projectId");
+    if (!projectId) {
+      return NextResponse.json({ error: "projectId is required" }, { status: 400 });
+    }
+    const result = await getReadyForDelivery(projectId, searchParams.get("episode"));
+    return NextResponse.json(result);
+  } catch (err) {
+    const { body, status } = toErrorResponse(err);
+    return NextResponse.json(body, { status });
+  }
+}

app/api/deliveries/route.ts

@@ -0,0 +1,56 @@
+import { NextRequest, NextResponse } from "next/server";
+import { DeliveryKind, DeliveryStatus } from "@prisma/client";
+import { toErrorResponse } from "@/lib/render-pipeline/errors";
+import { requirePipelineUser, requirePipelineAdmin } from "@/lib/render-pipeline/session-auth";
+import {
+  createDeliveryPackage,
+  createDeliverySchema,
+  listDeliveryPackages,
+} from "@/lib/render-pipeline/deliveries";
+
+// ── GET /api/deliveries (E17) · POST /api/deliveries (E16) ───────────────────
+
+export async function GET(req: NextRequest) {
+  try {
+    await requirePipelineUser();
+    const { searchParams } = new URL(req.url);
+    const status = searchParams.get("status");
+    const kind = searchParams.get("kind");
+    const result = await listDeliveryPackages({
+      projectId: searchParams.get("projectId") ?? undefined,
+      episode: searchParams.get("episode") ?? undefined,
+      status: status ? (status as DeliveryStatus) : undefined,
+      kind: kind ? (kind as DeliveryKind) : undefined,
+    });
+    return NextResponse.json(result);
+  } catch (err) {
+    const { body, status } = toErrorResponse(err);
+    return NextResponse.json(body, { status });
+  }
+}
+
+export async function POST(req: NextRequest) {
+  try {
+    // Building a package writes to the delivery volume and locks versions —
+    // producer/supervisor territory, not any signed-in user.
+    const user = await requirePipelineAdmin();
+
+    let raw: unknown;
+    try {
+      raw = await req.json();
+    } catch {
+      return NextResponse.json({ error: "Invalid JSON" }, { status: 400 });
+    }
+
+    const parsed = createDeliverySchema.safeParse(raw);
+    if (!parsed.success) {
+      return NextResponse.json({ error: "Invalid delivery request", details: parsed.error.issues }, { status: 422 });
+    }
+
+    const result = await createDeliveryPackage(parsed.data, user.id);
+    return NextResponse.json(result, { status: 201 });
+  } catch (err) {
+    const { body, status } = toErrorResponse(err);
+    return NextResponse.json(body, { status });
+  }
+}

app/api/delivery-requests/[requestId]/cancel/route.ts

@@ -0,0 +1,34 @@
+import { NextRequest, NextResponse } from "next/server";
+import { toErrorResponse } from "@/lib/render-pipeline/errors";
+import { requirePipelineAdmin } from "@/lib/render-pipeline/session-auth";
+import { cancelDeliveryRequest } from "@/lib/render-pipeline/delivery-requests";
+import { cancelRequestSchema } from "@/lib/render-pipeline/delivery-request-state";
+
+// ── POST /api/delivery-requests/{id}/cancel ──────────────────────────────────
+//
+// The only way a request leaves the awaiting list without being delivered, and
+// it has to say why.
+
+export async function POST(
+  req: NextRequest,
+  { params }: { params: Promise<{ requestId: string }> }
+) {
+  try {
+    const user = await requirePipelineAdmin();
+    const { requestId } = await params;
+
+    const parsed = cancelRequestSchema.safeParse(await req.json().catch(() => null));
+    if (!parsed.success) {
+      return NextResponse.json(
+        { error: parsed.error.issues[0]?.message ?? "Invalid request", details: parsed.error.issues },
+        { status: 422 }
+      );
+    }
+
+    const result = await cancelDeliveryRequest(requestId, parsed.data.reason, user.id);
+    return NextResponse.json(result);
+  } catch (err) {
+    const { body, status } = toErrorResponse(err);
+    return NextResponse.json(body, { status });
+  }
+}