Release v1.7.190

importBackup wendete die Settings fuer beide Pfade ueber setSettings an, das bei
nicht-"never"-CleanupPolicy applyRetroactiveCleanupPolicy ausloest. Beim reinen
Settings-Restore purgte das die LIVE-Queue (fertige Items), obwohl der Vertrag
"running queue stays untouched" lautet (Dateien blieben auf Platte). Zudem rollte
der Import die laufenden Usage-/Status-Zaehler auf den (aelteren) Backup-Stand
zurueck (anders als updateSettings).

- setSettings bekommt optionales { suppressRetroactiveCleanup }; der Settings-only
  Import setzt es. Die importierte Policy gilt weiter fuer KUENFTIGE Completions
  ueber den normalen Vorwaertspfad (immediate/package_done) — nur der retroaktive
  Sweep wird hier unterdrueckt.
- overlayLiveUsageCounters aus updateSettings extrahiert und im Settings-only Import
  wiederverwendet (inkl. Key-Filter der Debrid-Link-Per-Key-Usage auf existierende
  Keys). Nicht ueber updateSettings geroutet (vermeidet dessen resetHistoryForRetention).

package.json

@@ -1,6 +1,6 @@
 {
   "name": "real-debrid-downloader",
-  "version": "1.7.188",
+  "version": "1.7.190",
   "description": "Desktop downloader",
   "main": "build/main/main/main.js",
   "author": "Sucukdeluxe",

src/main/app-controller.ts

@@ -303,6 +303,27 @@ export class AppController {
     return next;
   }
 
+  // Carry the live, runtime-maintained usage/status counters onto a settings
+  // object about to be applied, so they are never rolled back to a stale snapshot.
+  // All-time totals take the max; daily/total usage and account statuses are taken
+  // live; per-key Debrid-Link usage is filtered to keys that still exist.
+  private overlayLiveUsageCounters(target: AppSettings): void {
+    const liveSettings = this.manager.getSettings();
+    target.totalDownloadedAllTime = Math.max(target.totalDownloadedAllTime || 0, liveSettings.totalDownloadedAllTime || 0);
+    target.totalCompletedFilesAllTime = Math.max(target.totalCompletedFilesAllTime || 0, liveSettings.totalCompletedFilesAllTime || 0);
+    target.totalRuntimeAllTimeMs = Math.max(target.totalRuntimeAllTimeMs || 0, this.manager.getLiveTotalRuntimeMs());
+    target.providerDailyUsageDay = liveSettings.providerDailyUsageDay;
+    target.providerDailyUsageBytes = { ...(liveSettings.providerDailyUsageBytes || {}) };
+    target.providerTotalUsageBytes = { ...(liveSettings.providerTotalUsageBytes || {}) };
+    target.debridLinkApiKeyDailyUsageBytes = Object.fromEntries(
+      Object.entries(liveSettings.debridLinkApiKeyDailyUsageBytes || {}).filter(([keyId]) => getDebridLinkApiKeyIds(target.debridLinkApiKeys).includes(keyId))
+    );
+    target.debridLinkApiKeyTotalUsageBytes = Object.fromEntries(
+      Object.entries(liveSettings.debridLinkApiKeyTotalUsageBytes || {}).filter(([keyId]) => getDebridLinkApiKeyIds(target.debridLinkApiKeys).includes(keyId))
+    );
+    target.debridAccountStatuses = { ...(liveSettings.debridAccountStatuses || {}) };
+  }
+
   public updateSettings(partial: Partial<AppSettings>): AppSettings {
     const sanitizedPatch = sanitizeSettingsPatch(partial);
     const previousSettings = this.settings;
@@ -315,20 +336,7 @@ export class AppController {
       return previousSettings;
     }
 
-    const liveSettings = this.manager.getSettings();
-    nextSettings.totalDownloadedAllTime = Math.max(nextSettings.totalDownloadedAllTime || 0, liveSettings.totalDownloadedAllTime || 0);
-    nextSettings.totalCompletedFilesAllTime = Math.max(nextSettings.totalCompletedFilesAllTime || 0, liveSettings.totalCompletedFilesAllTime || 0);
-    nextSettings.totalRuntimeAllTimeMs = Math.max(nextSettings.totalRuntimeAllTimeMs || 0, this.manager.getLiveTotalRuntimeMs());
-    nextSettings.providerDailyUsageDay = liveSettings.providerDailyUsageDay;
-    nextSettings.providerDailyUsageBytes = { ...(liveSettings.providerDailyUsageBytes || {}) };
-    nextSettings.providerTotalUsageBytes = { ...(liveSettings.providerTotalUsageBytes || {}) };
-    nextSettings.debridLinkApiKeyDailyUsageBytes = Object.fromEntries(
-      Object.entries(liveSettings.debridLinkApiKeyDailyUsageBytes || {}).filter(([keyId]) => getDebridLinkApiKeyIds(nextSettings.debridLinkApiKeys).includes(keyId))
-    );
-    nextSettings.debridLinkApiKeyTotalUsageBytes = Object.fromEntries(
-      Object.entries(liveSettings.debridLinkApiKeyTotalUsageBytes || {}).filter(([keyId]) => getDebridLinkApiKeyIds(nextSettings.debridLinkApiKeys).includes(keyId))
-    );
-    nextSettings.debridAccountStatuses = { ...(liveSettings.debridAccountStatuses || {}) };
+    this.overlayLiveUsageCounters(nextSettings);
     const retentionChanged = previousSettings.historyRetentionMode !== nextSettings.historyRetentionMode;
     this.settings = nextSettings;
     if (retentionChanged) {
@@ -697,14 +705,18 @@ public async checkDebridAccounts(): Promise<DebridAccountStatus[]> {
       }
     }
     const restoredSettings = normalizeSettings(importedSettings);
+
+    // Settings-only backup: keep the running queue AND the live counters untouched.
+    // Overlay the live usage/status counters so they don't roll back to the backup's
+    // (older) snapshot (BUG I), and suppress the retroactive cleanup sweep so the
+    // backup's cleanup policy can't purge the live completed queue here (BUG B) — the
+    // policy still governs FUTURE completions through the normal path. Do NOT stop the
+    // manager, wipe the session, block persistence or relaunch.
+    if (!hasSession) {
+      this.overlayLiveUsageCounters(restoredSettings);
       this.settings = restoredSettings;
       saveSettings(this.storagePaths, this.settings);
-    this.manager.setSettings(this.settings);
-
-    // Settings-only backup: settings are already applied live (same path as the
-    // normal updateSettings flow). Do NOT stop the manager, wipe the session,
-    // block persistence or relaunch — the running queue stays untouched.
-    if (!hasSession) {
+      this.manager.setSettings(this.settings, { suppressRetroactiveCleanup: true });
       this.audit("INFO", "Backup importiert (nur Einstellungen)", {
         accountSummary: buildAccountSummary(this.settings)
       });
@@ -715,6 +727,10 @@ public async checkDebridAccounts(): Promise<DebridAccountStatus[]> {
       };
     }
 
+    this.settings = restoredSettings;
+    saveSettings(this.storagePaths, this.settings);
+    this.manager.setSettings(this.settings);
+
     this.manager.stop();
     this.manager.abortAllPostProcessing();
     this.manager.clearPersistTimer();

src/main/download-manager.ts

@@ -2081,7 +2081,7 @@ export class DownloadManager extends EventEmitter {
     this.emitState();
   }
 
-  public setSettings(next: AppSettings): void {
+  public setSettings(next: AppSettings, opts?: { suppressRetroactiveCleanup?: boolean }): void {
     const previous = this.settings;
     next.totalDownloadedAllTime = Math.max(next.totalDownloadedAllTime || 0, this.settings.totalDownloadedAllTime || 0);
     next.totalCompletedFilesAllTime = Math.max(next.totalCompletedFilesAllTime || 0, this.settings.totalCompletedFilesAllTime || 0);
@@ -2145,7 +2145,7 @@ export class DownloadManager extends EventEmitter {
 
     this.resolveExistingQueuedOpaqueFilenames();
     void this.cleanupExistingExtractedArchives().catch((err) => logger.warn(`cleanupExistingExtractedArchives Fehler (setSettings): ${compactErrorText(err)}`));
-    if (next.completedCleanupPolicy !== "never") {
+    if (!opts?.suppressRetroactiveCleanup && next.completedCleanupPolicy !== "never") {
       this.applyRetroactiveCleanupPolicy();
     }
     this.emitState();
@@ -3546,6 +3546,11 @@ export class DownloadManager extends EventEmitter {
         if (!entry.isFile()) {
           continue;
         }
+        // Never collect our own remux temp/orphan sidecars (~rd<token>.<ext>): a
+        // partial file left by a crash mid-remux must not be swept into the library.
+        if (entry.name.startsWith("~rd")) {
+          continue;
+        }
         const extension = path.extname(entry.name).toLowerCase();
         if (!normalizedExtensions.has(extension)) {
           continue;
@@ -6107,6 +6112,11 @@ export class DownloadManager extends EventEmitter {
   }
 
   private dropItemContribution(itemId: string): void {
+    // NOTE: deliberately does NOT subtract from session.totalDownloadedBytes /
+    // sessionDownloadedBytes. Those are cumulative-session counters and must stay
+    // put when a completed item is removed from the queue (see the test "keeps
+    // cumulative session totals when completed items are removed from the queue").
+    // The retry path subtracts on its own because those bytes get re-downloaded.
     this.itemContributedBytes.delete(itemId);
     this.invalidateStatsCache();
   }
@@ -7151,6 +7161,9 @@ export class DownloadManager extends EventEmitter {
     const abortController = new AbortController();
     this.packagePostProcessAbortControllers.set(packageId, abortController);
 
+    // Holder so the task's own finally can identity-check itself (the task Promise
+    // cannot reference its own const inside its initializer). Assigned right after.
+    const handle: { task?: Promise<void> } = {};
     const task = (async () => {
       const slotWaitStart = nowMs();
       await this.acquirePostProcessSlot(packageId);
@@ -7197,8 +7210,16 @@ export class DownloadManager extends EventEmitter {
         } while (this.hybridExtractRequeue.has(packageId));
       } finally {
         this.releasePostProcessSlot();
+        // Identity guard: only clear the map entries if they still point to THIS
+        // task/controller. After an abort deletes our handle a new run can install
+        // a fresh task+controller for the same packageId; a blind delete here would
+        // orphan that newer task (uncancellable) and allow a duplicate concurrent run.
+        if (this.packagePostProcessTasks.get(packageId) === handle.task) {
           this.packagePostProcessTasks.delete(packageId);
+        }
+        if (this.packagePostProcessAbortControllers.get(packageId) === abortController) {
           this.packagePostProcessAbortControllers.delete(packageId);
+        }
         this.persistSoon();
         this.emitState();
         if (this.hybridExtractRequeue.delete(packageId)) {
@@ -7209,6 +7230,7 @@ export class DownloadManager extends EventEmitter {
       }
     })();
 
+    handle.task = task;
     this.packagePostProcessTasks.set(packageId, task);
     return task;
   }

src/main/extractor.ts

@@ -2883,6 +2883,13 @@ export async function extractPackageArchives(options: ExtractOptions): Promise<{
   const resumeCompletedAtStart = resumeCompleted.size;
   const allCandidateNames = new Set(allCandidates.map((archivePath) => archiveNameKey(path.basename(archivePath))));
   for (const archiveName of Array.from(resumeCompleted.values())) {
+    // Nested-archive progress (keyed "nested:<name>") has no top-level candidate on
+    // disk to validate against, so it must NOT be pruned here — otherwise every
+    // extractPackageArchives call wiped it and nested archives were re-extracted on
+    // resume. It is cleared together with the rest once the package fully completes.
+    if (archiveName.startsWith("nested:")) {
+      continue;
+    }
     if (!allCandidateNames.has(archiveName)) {
       resumeCompleted.delete(archiveName);
     }

src/main/logger.ts

@@ -183,7 +183,14 @@ async function flushAsync(): Promise<void> {
   }
 
   flushInFlight = true;
-  const linesSnapshot = pendingLines.slice();
+  // Move (not copy) the pending lines out and take ownership. A concurrent write()
+  // during the await below pushes new lines AND can trim the 1MB cap from the FRONT
+  // of pendingLines; the old count-based removal (pendingLines.slice(snapshot.length))
+  // then sliced off the wrong lines and dropped unwritten ones. Resetting the buffer
+  // here means await-time writes queue independently and nothing desyncs.
+  const linesSnapshot = pendingLines;
+  pendingLines = [];
+  pendingChars = 0;
   const chunk = linesSnapshot.join("");
 
   try {
@@ -200,9 +207,19 @@ async function flushAsync(): Promise<void> {
     } else if (!primary.ok) {
       writeStderr(`LOGGER write failed: ${primary.errorText}\n`);
     }
-    if (wroteAny) {
-      pendingLines = pendingLines.slice(linesSnapshot.length);
-      pendingChars = Math.max(0, pendingChars - chunk.length);
+    if (!wroteAny) {
+      // Write failed: requeue the unwritten lines AHEAD of anything that arrived
+      // during the await (preserve order), then re-apply the buffer cap so a
+      // persistent write failure cannot grow the buffer without bound.
+      pendingLines = linesSnapshot.concat(pendingLines);
+      pendingChars += chunk.length;
+      while (pendingChars > LOG_BUFFER_LIMIT_CHARS && pendingLines.length > 1) {
+        const removed = pendingLines.shift();
+        if (!removed) {
+          break;
+        }
+        pendingChars = Math.max(0, pendingChars - removed.length);
+      }
     }
   } finally {
     flushInFlight = false;

src/main/video-processor.ts

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import crypto from "node:crypto";
 import { spawn } from "node:child_process";
 
 // Removes only-German audio handling for "Dual Language" (.DL.) scene releases.
@@ -55,6 +56,9 @@ export interface ProcessVideoOptions {
 export interface ProcessVideoDeps {
   resolveTooling?: () => Promise<{ ffmpeg: string; ffprobe: string } | null>;
   runProcess?: typeof runVideoProcess;
+  // Seam for the atomic-replace rename so its failure/recovery path is testable
+  // without provoking a real OS file lock. Production uses renameWithRetry.
+  rename?: (from: string, to: string) => Promise<void>;
 }
 
 const VIDEO_REMUX_EXTENSIONS = new Set([".mkv", ".mp4"]);
@@ -85,10 +89,11 @@ export function isRemuxableVideoFile(fileName: string): boolean {
 // True when the release name explicitly marks it as a German release. Used in
 // tag mode to fall back to the first audio track (German-first scene convention)
 // when the audio language tags are wrong (a German dub mislabeled "eng"), instead
-// of skipping. Deliberately requires an explicit german/deutsch/dubbed token —
-// the ".DL." marker alone (present on every processed file) is not enough.
+// of skipping. Deliberately requires an explicit german/deutsch token — the
+// ".DL." marker alone (present on every processed file) is not enough, and a bare
+// "dubbed" can mean an Italian/French dub, so it must NOT flag a German release.
 export function looksLikeGermanRelease(fileName: string): boolean {
-  return /(^|[._\s-])(german|deutsch|dubbed)([._\s-]|$)/i.test(fileName);
+  return /(^|[._\s-])(german|deutsch)([._\s-]|$)/i.test(fileName);
 }
 
 function isGermanStream(stream: ProbedAudioStream): boolean {
@@ -96,8 +101,11 @@ function isGermanStream(stream: ProbedAudioStream): boolean {
   if (["ger", "deu", "de", "german", "deutsch"].includes(lang)) {
     return true;
   }
+  // Free-text title fallback (used when the language tag is missing). Full words
+  // only — the 2-3 letter codes ger/deu are too ambiguous in a title and would
+  // pick the wrong track to keep (which then deletes the real German one).
   const title = (stream.title || "").toLowerCase();
-  return /\b(german|deutsch|ger|deu)\b/.test(title);
+  return /\b(german|deutsch)\b/.test(title);
 }
 
 // Decide which audio track to keep. Safety invariant: only ever choose to remux
@@ -378,6 +386,41 @@ async function getFreeSpaceBytes(dir: string): Promise<number | null> {
   }
 }
 
+const RENAME_RETRY_DELAYS_MS = [200, 500, 1000];
+const RENAME_RETRYABLE_CODES = new Set(["EBUSY", "EACCES", "EPERM", "EEXIST"]);
+
+function delayMs(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// Windows file locks from antivirus, the search indexer, or a media scanner are
+// transient: a rename that hits EBUSY/EACCES/EPERM/EEXIST often succeeds a moment
+// later. Retry with backoff before giving up so a momentary lock doesn't abort
+// the atomic replace and leave the file unprocessed.
+export async function renameWithRetry(from: string, to: string): Promise<void> {
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      await fs.promises.rename(from, to);
+      return;
+    } catch (error) {
+      const code = (error as NodeJS.ErrnoException)?.code;
+      if (!code || !RENAME_RETRYABLE_CODES.has(code) || attempt >= RENAME_RETRY_DELAYS_MS.length) {
+        throw error;
+      }
+      await delayMs(RENAME_RETRY_DELAYS_MS[attempt]);
+    }
+  }
+}
+
+// Short, unique, same-directory sidecar name (never longer than the original file
+// name) so concurrent packages / retries never collide on a fixed temp name and a
+// long scene filename + suffix cannot push the path past Windows MAX_PATH.
+function uniqueTempPath(filePath: string): string {
+  const ext = path.extname(filePath);
+  const token = `${process.pid.toString(36)}${crypto.randomBytes(3).toString("hex")}`;
+  return path.join(path.dirname(filePath), `~rd${token}${ext}`);
+}
+
 export async function processVideoFile(filePath: string, opts: ProcessVideoOptions, deps: ProcessVideoDeps = {}): Promise<VideoProcessResult> {
   const resolveTool = deps.resolveTooling || resolveVideoTooling;
   const run = deps.runProcess || runVideoProcess;
@@ -424,11 +467,7 @@ export async function processVideoFile(filePath: string, opts: ProcessVideoOptio
     return { action: "skipped-no-space", reason: "zu wenig freier Speicher fuer Remux", totalAudioTracks: streams.length, audioLanguages };
   }
 
-  const ext = path.extname(filePath);
-  // Short, same-directory temp name (never longer than the original file name) so
-  // a long scene filename + temp suffix cannot push the temp path past Windows
-  // MAX_PATH and make ffmpeg fail (which would leave the file unprocessed).
-  const tempPath = path.join(path.dirname(filePath), `~rdtmp${ext}`);
+  const tempPath = uniqueTempPath(filePath);
   await fs.promises.rm(tempPath, { force: true }).catch(() => {});
 
   const remux = await run(
@@ -451,15 +490,18 @@ export async function processVideoFile(filePath: string, opts: ProcessVideoOptio
     return { action: "error", reason: "Remux ergab leere Datei", totalAudioTracks: streams.length, audioLanguages };
   }
 
+  const renameOp = deps.rename || renameWithRetry;
   try {
-    // libuv rename replaces an existing destination on Windows; fall back if not.
-    await fs.promises.rename(tempPath, filePath).catch(async () => {
-      await fs.promises.rm(filePath, { force: true });
-      await fs.promises.rename(tempPath, filePath);
-    });
+    // Atomic replace-over: libuv maps fs.rename to MoveFileEx(REPLACE_EXISTING) on
+    // Windows and rename(2) on POSIX, both atomic on the same volume, so filePath
+    // holds either the full original or the full remux at every instant. Retried
+    // for transient locks. We must NEVER rm the original first (the old fallback
+    // did): an rm-then-failed-rename left zero copies of the file on disk.
+    await renameOp(tempPath, filePath);
     // Preserve original mtime so freshness gates (hybrid collect) don't skip it.
     await fs.promises.utimes(filePath, originalStat.atime, originalStat.mtime).catch(() => {});
   } catch (error) {
+    // Replace failed -> the original is untouched at filePath. Drop the temp only.
     await fs.promises.rm(tempPath, { force: true }).catch(() => {});
     return { action: "error", reason: "Ersetzen der Datei fehlgeschlagen", error: String(error), totalAudioTracks: streams.length, audioLanguages };
   }

tasks/todo.md

@@ -1,8 +1,72 @@
-# Real-Debrid-Downloader — Tasks (Stand 2026-06-07)
+# Real-Debrid-Downloader — Tasks (Stand 2026-06-08)
 
-**Status:** Alle zugesagten Features erledigt+released (Archiv unten). EIN Bug analysiert
-+ geparkt (Mega-Web Account-3-Rotation, siehe direkt unten — wartet auf 1 Log-Zahl vom User).
-Rest ist freiwilliger Backlog.
+**Status:** Alle zugesagten Features erledigt+released (Archiv unten). Aktuell läuft ein
+**intensiver Bug-Audit** (User-Goal 2026-06-08, "schaue intensiv nach weiteren Bugs") —
+Fortschritt direkt unten.
+
+---
+
+## 🔴 LAUFEND — Bug-Audit 2026-06-08 (Multi-Agent find→verify, 18 bestätigt)
+
+Advisor-Triage: **A = einzige echte Daten-Verlust-Notlage** (zerstört echte Datei auf Platte)
+→ zuerst, ALLEINE Release. **B verifiziert demoted:** applyRetroactiveCleanupPolicy/
+removePackageFromSession löschen KEINE Platten-Dateien (nur Session/Queue-Einträge + ggf.
+History-Eintrag) → Queue-Integrität, nicht Daten-Verlust → in v1.7.190-Batch.
+Sequenz: Release 1 (v1.7.189) = **A allein**; Release 2 (v1.7.190) = B/I,C,D/E,F,G,H,J,L,M,N,O,P,Q.
+Ein Commit pro Fix, jeder einzeln verifiziert. **K übersprungen** (auto-rename-Reorder,
+schlechtestes Risiko/Nutzen, kann für diesen User gar nicht feuern).
+
+### Release 1 — Daten-Verlust-Stopper (v1.7.189, A ALLEIN)
+- [x] **A** `video-processor.ts` atomic-replace zerstörte bei Windows-Lock BEIDE Kopien
+  (rm(original) VOR bestätigtem Replace + outer-catch rm(temp) → 0 Kopien). **GEFIXT:**
+  atomic replace-over + `renameWithRetry` (EBUSY/EACCES/EPERM/EEXIST, Backoff 200/500/1000ms),
+  rm-first-Fallback entfernt, **unique** Temp-Name (`~rd<pid><rand>`, löst auch C-Kollision).
+  Advisor bestätigt Ansatz besser als bak-dance (kein Missing-File-Window). 3 neue Tests
+  (Recovery + Retry-Pfad), 41 video-processor-Tests grün, tsc=6 (Baseline). Commit 189af22.
+
+### Release 2 — v1.7.190 (GEFIXT + verifiziert, ein Commit pro Fix)
+- [x] **L+M** video-processor.ts zu weite Deutsch-Erkennung. isGermanStream Titel-Fallback nur
+  ganze Wörter (ger/deu raus → konnten falsche Spur picken + echte dt. löschen); looksLikeGerman
+  Release 'dubbed' raus (ital./franz. Dub triggerte German-first). 2 Negativtests. Commit 272a41a.
+- [x] **H** logger.ts flushAsync slice-snapshot korrumpiert bei 1MB-Cap-Trim während await →
+  ungeschriebene Zeilen verloren. Move-snapshot (Buffer auf [] übernehmen) + Requeue bei
+  Schreibfehler. Commit 4432fa2.
+- [x] **J+Q** download-manager. J: runPackagePostProcessing finally löschte Map-Eintrag ohne
+  Identity-Guard → Abort+Neustart-Race riss neuen Task raus (Waise + Doppel-Lauf); jetzt nur
+  löschen wenn Map noch auf DIESEN Task/Controller zeigt (handle-Objekt wegen TS2454). Q:
+  collectFilesByExtensions filtert `~rd`-Temp-Präfix (crash-verwaiste Teil-Remuxe nie ins
+  Library). Commit 3c33b98.
+- [x] **P** extractor.ts nested-Resume-Keys (`nested:<name>`) bei jedem extractPackageArchives
+  gepurged → verschachtelte Archive beim Resume neu entpackt; `startsWith("nested:")` im Prune
+  übersprungen. Commit 61a8304.
+- [x] **B/I** app-controller.ts importBackup settings-only purgte LIVE-Queue (Dateien blieben auf
+  Platte) + rollte Usage-Zähler zurück. Fix: setSettings({suppressRetroactiveCleanup}) +
+  overlayLiveUsageCounters (extrahiert+wiederverwendet, inkl. Key-Filter). Commit dc05b51.
+
+### Verifiziert KEINE Bugs / bewusst NICHT angefasst (Advisor-Disziplin: erst belegen, dann ändern)
+- **G** dropItemContribution "subtrahiert Session-Totals nicht" → **KEIN Bug**: Test "keeps
+  cumulative session totals when completed items are removed" kodifiziert die Absicht (Session-
+  Zähler kumulativ, divergieren bewusst von der Item-Map; Retry-Pfad zieht ab, weil neu geladen
+  wird). Fix-Versuch ließ den Test failen → revertiert, Klarstellungs-Kommentar gesetzt.
+- **N** stripDualLangFromFileName "Kollision" → **bereits geguarded**: existsAsync-Skip verhindert
+  Überschreiben; Remux machte Inhalt eh deutsch-only; collect strippt `.DL.` downstream. Residual
+  = generischer Rename-TOCTOU (in JEDEM Rename-Pfad), kein spezifischer Bug hier.
+- **D/E** abort-Klassifizierung über signal.reason statt Text → **deferred (Robustheit, kein
+  Live-Bug auf User-Pfad)**. BELEGT: mega-web-fallback normalisiert JEDEN Abort (Timeout UND
+  Cancel) zu `new Error("aborted:mega-web")` → aktueller Guard `/aborted/i && !/timeout/i` FEUERT
+  → v1.7.187-Cooldown LÄUFT auf dem Web-Pfad (User-Pfad). Einzige Imperfektion: Cancel >8s wird
+  fälschlich gecooled (minor). Empirisch bestätigt: `AbortSignal.any([ac,timeout]).reason?.name===
+  'TimeoutError'` (timeout) vs string/AbortError (cancel) — falls je gebaut: signal.aborted-gaten,
+  reason.name nutzen, Text-Fallback behalten, reason-Test. Hoch-Risiko (kritischer Unrestrict-Pfad
+  JEDES Downloads) → nicht für Robustheit anfassen. API-Pfad-Abort-Text nicht erschöpfend geprüft.
+- **E** "API 'cancel'-Pfad umgeht" → **nicht real**: kein `'cancel'`-throw im Code gefunden.
+- **O** classifyAccountFailure abort-Branch tot → **stehen lassen**: tot NUR wegen aktueller
+  Text-Interception; ein signal.aborted-gated D/E würde ihn wiederbeleben. Kein Kosmetik-Churn.
+- **F** Mega-Web empty-streak Concurrency → **N-shaped, deferred**: Streak wird bei Erfolg (1956)
+  + Nicht-Limit-Fehler (2005) gecleart; "bis Neustart gesperrt" ist bewusste Tageslimit-Logik,
+  Restart-cleared; Mega-Web single-flight → Concurrency greift nicht. Keine fühlbare Schädigung
+  konstruierbar → keine Park-State-Maschinerie.
+- **C** → in A subsumiert (unique Temp-Name). **K** übersprungen (auto-rename-Reorder, Risiko≫Nutzen).
 
 ---
 

tests/video-processor.test.ts

@@ -1,7 +1,7 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { afterEach, describe, expect, it } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
 import {
   stripDualLangMarker,
   hasDualLangMarker,
@@ -13,6 +13,7 @@ import {
   buildFfmpegRemuxArgs,
   computeRemuxTimeoutMs,
   processVideoFile,
+  renameWithRetry,
   type VideoSpawnResult
 } from "../src/main/video-processor";
 
@@ -84,6 +85,13 @@ describe("pickAudioTrack", () => {
     expect(d).toMatchObject({ action: "remux", audioRelIndex: 1 });
   });
 
+  it("tag mode does NOT treat an ambiguous 3-letter title code as German (no false-positive pick)", () => {
+    // Two untagged tracks whose titles are only "Ger"/"Deu" must not be mistaken
+    // for a German track; with no real German signal this falls back to first.
+    const d = pickAudioTrack([{ language: "", title: "Ger" }, { language: "", title: "Deu" }], "tag");
+    expect(d).toMatchObject({ action: "remux", audioRelIndex: 0, reason: "fallback-first-untagged" });
+  });
+
   it("tag mode with single German -> single (no remux)", () => {
     expect(pickAudioTrack([ger], "tag")).toMatchObject({ action: "single" });
   });
@@ -124,6 +132,10 @@ describe("looksLikeGermanRelease", () => {
     expect(looksLikeGermanRelease("Show.S01E01.DL.720p.x264.mkv")).toBe(false);
     expect(looksLikeGermanRelease("Show.S01E01.MULTi.1080p.mkv")).toBe(false);
   });
+  it("does not flag a non-German dub as a German release (bare 'Dubbed' is ambiguous)", () => {
+    expect(looksLikeGermanRelease("Movie.2020.ITALIAN.Dubbed.DL.1080p.mkv")).toBe(false);
+    expect(looksLikeGermanRelease("Movie.2020.FRENCH.DUBBED.DL.720p.mkv")).toBe(false);
+  });
 });
 
 describe("parseFfprobeAudioStreams", () => {
@@ -208,6 +220,11 @@ describe("processVideoFile (real fs body, fake runner)", () => {
     };
   }
 
+  // Any sidecar the replace machinery may leave behind (unique "~rd…" temp names).
+  function leftoverTemps(file: string): string[] {
+    return fs.readdirSync(path.dirname(file)).filter((n) => n.startsWith("~rd"));
+  }
+
   const tooling = async (): Promise<{ ffmpeg: string; ffprobe: string }> => ({ ffmpeg: "ffmpeg", ffprobe: "ffprobe" });
   const twoTracksGerSecond = JSON.stringify({ streams: [{ tags: { language: "eng" } }, { tags: { language: "ger" } }] });
 
@@ -226,7 +243,7 @@ describe("processVideoFile (real fs body, fake runner)", () => {
     expect(result.keptTrackIndex).toBe(1); // German was second
     expect(fs.readFileSync(file, "utf8")).toBe("REMUXED-GERMAN-ONLY"); // original overwritten
     expect(Math.abs(fs.statSync(file).mtimeMs - beforeMtime)).toBeLessThan(1500); // mtime preserved
-    expect(fs.existsSync(`${file}.gertmp.mkv`)).toBe(false); // temp cleaned up
+    expect(leftoverTemps(file)).toEqual([]); // unique temp cleaned up
   });
 
   it("leaves the original intact and removes temp when ffmpeg fails", async () => {
@@ -238,7 +255,23 @@ describe("processVideoFile (real fs body, fake runner)", () => {
 
     expect(result.action).toBe("error");
     expect(fs.readFileSync(file, "utf8")).toBe("ORIGINAL"); // never lost
-    expect(fs.existsSync(`${file}.gertmp.mkv`)).toBe(false);
+    expect(leftoverTemps(file)).toEqual([]);
+  });
+
+  it("keeps the original intact and cleans the temp when the atomic replace rename fails (no zero-copy window)", async () => {
+    // Simulate a Windows file lock that defeats the replace even after retries.
+    // The original must survive: the old rm-then-rename fallback could leave the
+    // file with NEITHER the original nor the remux on disk.
+    const file = makeFile("ORIGINAL");
+    const result = await processVideoFile(file, { mode: "tag" }, {
+      resolveTooling: tooling,
+      runProcess: fakeRunner({ probeJson: twoTracksGerSecond }),
+      rename: async () => { throw Object.assign(new Error("locked"), { code: "EBUSY" }); }
+    });
+
+    expect(result.action).toBe("error");
+    expect(fs.readFileSync(file, "utf8")).toBe("ORIGINAL"); // original never destroyed
+    expect(leftoverTemps(file)).toEqual([]); // remux temp removed
   });
 
   it("does not touch a single-audio file (no remux)", async () => {
@@ -281,3 +314,35 @@ describe("processVideoFile (real fs body, fake runner)", () => {
     expect(fs.readFileSync(file, "utf8")).toBe("ORIGINAL");
   });
 });
+
+describe("renameWithRetry", () => {
+  afterEach(() => { vi.restoreAllMocks(); });
+  const busy = (): NodeJS.ErrnoException => Object.assign(new Error("locked"), { code: "EBUSY" });
+
+  it("retries a transient EBUSY and then succeeds", async () => {
+    let calls = 0;
+    vi.spyOn(fs.promises, "rename").mockImplementation(async () => {
+      calls += 1;
+      if (calls <= 2) { throw busy(); }
+    });
+    await expect(renameWithRetry("a", "b")).resolves.toBeUndefined();
+    expect(calls).toBe(3); // failed twice, succeeded on the third attempt
+  });
+
+  it("gives up after exhausting retries on a persistent lock", async () => {
+    let calls = 0;
+    vi.spyOn(fs.promises, "rename").mockImplementation(async () => { calls += 1; throw busy(); });
+    await expect(renameWithRetry("a", "b")).rejects.toThrow("locked");
+    expect(calls).toBe(4); // initial attempt + 3 backoff retries
+  });
+
+  it("does not retry a non-retryable error (e.g. EXDEV) — fails fast", async () => {
+    let calls = 0;
+    vi.spyOn(fs.promises, "rename").mockImplementation(async () => {
+      calls += 1;
+      throw Object.assign(new Error("cross-device"), { code: "EXDEV" });
+    });
+    await expect(renameWithRetry("a", "b")).rejects.toThrow("cross-device");
+    expect(calls).toBe(1);
+  });
+});