diff --git a/.github/workflows/fastapi-test.yml b/.github/workflows/fastapi-test.yml
index e3242152..417d90b4 100644
--- a/.github/workflows/fastapi-test.yml
+++ b/.github/workflows/fastapi-test.yml
@@ -49,7 +49,7 @@ jobs:
         run: hatch run lint:format-check
 
       - name: Install pnpm
-        uses: pnpm/action-setup@008330803749db0355799c700092d9a85fd074e9
+        uses: pnpm/action-setup@008330803749db0355799c700092d9a85fd074e9  # v4.0.0
 
       - name: Install Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
@@ -76,7 +76,7 @@ jobs:
         run: yamllint --config-file .yamllint .github/ infra/ docker-compose*.yml
 
       - name: Run ShellCheck
-        run: shellcheck --severity=warning scripts/*.sh entrypoint.sh migrate.sh
+        run: shellcheck --severity=warning scripts/*.sh entrypoint.sh migrate.sh worker/entrypoint-worker.sh
 
   # ============================================
   # TYPE CHECK - Static type analysis
@@ -164,7 +164,7 @@ jobs:
         image: postgres:15
         env:
           POSTGRES_USER: test_user
-          POSTGRES_PASSWORD: test_pass
+          POSTGRES_PASSWORD: test_pw
           POSTGRES_DB: test_db
         options: >-
           --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
@@ -200,20 +200,24 @@ jobs:
 
       - name: Create test environment
         run: |
+          SK="$(openssl rand -hex 32)"
           cp .env.example .env
-          sed -i 's|^DB_PASSWORD=.*|DB_PASSWORD=test_pass|' .env
-          sed -i 's|^SECRET_KEY=$|SECRET_KEY=test-secret-key-for-ci-at-least-32-chars-long|' .env
+          sed -i "s|^DB_PASSWORD=.*|DB_PASSWORD=test_pw|" .env
+          sed -i "s|^SECRET_KEY=$|SECRET_KEY=${SK}|" .env
+          echo "PGPASSWORD=test_pw" >> "$GITHUB_ENV"
 
       - name: Create database schema
         run: |
           uv run python -c "
           import asyncio
+          import os
           from sqlalchemy.ext.asyncio import create_async_engine
           from core.database import Base
           from core.models import User, DownloadJob
 
           async def init_db():
-              engine = create_async_engine('postgresql+asyncpg://test_user:test_pass@localhost:5432/test_db')
+              db_pass = os.environ['PGPASSWORD']
+              engine = create_async_engine(f'postgresql+asyncpg://test_user:{db_pass}@localhost:5432/test_db')
               async with engine.begin() as conn:
                   await conn.run_sync(Base.metadata.create_all)
               await engine.dispose()
diff --git a/.gitignore b/.gitignore
index 024244e7..7428ed0e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -180,3 +180,15 @@ docs/CRITIQUE-ISSUES.md
 .agents/
 .kilocode/skills/*
 .agents/.story-automator-active
+
+# Local scan and audit artifacts (not checked in)
+.betterleaks.toml
+.betterleaksignore
+betterleaks-setup.md
+betterleaks.sarif
+SOTA-AUDIT-REPORT.md
+fail-console.md
+fail-result.md
+fail.har
+# HAR files and local exports that are ephemeral
+notegpt-clone/
diff --git a/.secrets.baseline b/.secrets.baseline
index 127212f7..2e712109 100644
--- a/.secrets.baseline
+++ b/.secrets.baseline
@@ -146,14 +146,14 @@
       {
         "type": "Secret Keyword",
         "filename": ".github/workflows/fastapi-test.yml",
-        "hashed_secret": "c94d65f02a652d11c2e5c2e1ccf38dce5a076e1e",
+        "hashed_secret": "d986d7729a3ca93e8fb8d9c0f1962564aed9f829",
         "is_verified": false,
         "line_number": 167
       },
       {
         "type": "Secret Keyword",
         "filename": ".github/workflows/fastapi-test.yml",
-        "hashed_secret": "89edba72d4aef5098771cee787b40b81af666eb3",
+        "hashed_secret": "fac0e4eec4d11a3bbad583ff2d750d900a70bf72",
         "is_verified": false,
         "line_number": 202
       }
diff --git a/Dockerfile b/Dockerfile
index 858f673b..e87213f1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -7,7 +7,7 @@
 # ============================================
 # Stage 1: Python Dependency Builder
 # ============================================
-FROM python:3.12-slim AS python-builder
+FROM python@sha256:6c4dd321d176d61ea848dc8c73a4f7dbae8f70e0ee48bb411ea2f045b599fa8e AS python-builder
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1
 
@@ -29,7 +29,7 @@ ENV PATH="/opt/venv/bin:$PATH" \
     UV_COMPILE_BYTECODE=1
 
 # Install uv binary (single static binary, ~25MB, not copied to final image)
-COPY --from=ghcr.io/astral-sh/uv:0.6 /uv /bin/uv
+COPY --from=ghcr.io/astral-sh/uv@sha256:4a6c9444b126bd325fba904bff796bf91fb777bf6148d60109c4cb1de2ffc497 /uv /bin/uv
 
 # Copy manifest and lockfile first → cacheable dependency layer
 COPY pyproject.toml uv.lock ./
@@ -41,7 +41,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
 # ============================================
 # Stage 2: Frontend Builder
 # ============================================
-FROM node:20-alpine AS frontend-builder
+FROM node@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS frontend-builder
 WORKDIR /app
 
 # Install pnpm for package management (version pinned in frontend/package.json packageManager field)
@@ -102,7 +102,7 @@ RUN mkdir -p /app/app/static/swagger && \
 # ============================================
 # Stage 4: Runtime Base
 # ============================================
-FROM python:3.12-slim AS runtime-base
+FROM python@sha256:6c4dd321d176d61ea848dc8c73a4f7dbae8f70e0ee48bb411ea2f045b599fa8e AS runtime-base
 ENV PYTHONDONTWRITEBYTECODE=1
 
 # Install runtime dependencies with apt cache mounts
@@ -115,7 +115,10 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     curl \
     gnupg \
     && mkdir -p /etc/apt/keyrings \
-    && curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg \
+    && curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key -o /tmp/nodesource-repo.gpg.key \
+    && echo "b42e0321dabdc24e892115da705cf061167eac12a317f23d329862d0aa0a271d  /tmp/nodesource-repo.gpg.key" | sha256sum -c - \
+    && gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg /tmp/nodesource-repo.gpg.key \
+    && rm /tmp/nodesource-repo.gpg.key \
     && echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_20.x nodistro main" > /etc/apt/sources.list.d/nodesource.list \
     && apt-get update \
     && apt-get install -y --no-install-recommends nodejs \
diff --git a/app/api/dependencies/__init__.py b/app/api/dependencies/__init__.py
index e5746d24..d0328e37 100644
--- a/app/api/dependencies/__init__.py
+++ b/app/api/dependencies/__init__.py
@@ -77,7 +77,7 @@ async def get_current_user_from_cookie(
     if credentials is not None:
         token = credentials.credentials
     else:
-        token = request.cookies.get("access_token")
+        token = request.cookies.get("__Host-access_token")
     return await _resolve_user_from_token(db, token, expected_type=ACCESS_TOKEN_TYPE)
 
 
diff --git a/app/api/docs.py b/app/api/docs.py
index 9dea1de8..580d6661 100644
--- a/app/api/docs.py
+++ b/app/api/docs.py
@@ -30,7 +30,7 @@ def register_docs_routes(app: FastAPI) -> None:
     """Register custom Swagger UI and ReDoc routes."""
 
     @app.get("/docs", include_in_schema=False)
-    async def custom_docs(request: Request):
+    async def custom_docs(request: Request) -> HTMLResponse:
         nonce = request.state.nonce
         swagger_dir = APP_DIR / "static" / "swagger"
         if swagger_dir.exists():
@@ -69,7 +69,7 @@ async def custom_docs(request: Request):
         return docs_response
 
     @app.get("/redoc", include_in_schema=False)
-    async def custom_redoc(request: Request):
+    async def custom_redoc(request: Request) -> HTMLResponse:
         nonce = request.state.nonce
         redoc_dir = APP_DIR / "static" / "redoc"
         if redoc_dir.exists():
@@ -97,7 +97,7 @@ async def custom_redoc(request: Request):
 def _inject_inline_script_nonce(html: str, nonce: str) -> str:
     """Add the request nonce to FastAPI's generated inline docs script."""
     return html.replace(
-        "<script>\n    const ui =", f'<script nonce="{nonce}">\n    const ui ='
+        "<script>\n    const ui =", f'<script nonce="{nonce}">\n    const ui =',
     ).replace("<script>\nconst ui =", f'<script nonce="{nonce}">\nconst ui =')
 
 
diff --git a/app/api/exceptions.py b/app/api/exceptions.py
index 9e523e10..d3891647 100644
--- a/app/api/exceptions.py
+++ b/app/api/exceptions.py
@@ -56,7 +56,7 @@ async def http_exception_handler(request: Request, exc: StarletteHTTPException)
 
 
 async def validation_exception_handler(
-    request: Request, exc: RequestValidationError
+    request: Request, exc: RequestValidationError,
 ) -> JSONResponse:
     """Handle validation errors with standardized error response."""
     request_id = getattr(request.state, "request_id", "unknown")
@@ -107,10 +107,10 @@ def register_exception_handlers(app: FastAPI) -> None:
     """Register rate-limit and global exception handlers."""
     app.add_exception_handler(RateLimitExceeded, rate_limit_exceeded_handler)
     app.add_exception_handler(
-        StarletteHTTPException, cast(ExceptionHandler, http_exception_handler)
+        StarletteHTTPException, cast("ExceptionHandler", http_exception_handler),
     )
     app.add_exception_handler(
         RequestValidationError,
-        cast(ExceptionHandler, validation_exception_handler),
+        cast("ExceptionHandler", validation_exception_handler),
     )
-    app.add_exception_handler(Exception, cast(ExceptionHandler, general_exception_handler))
+    app.add_exception_handler(Exception, cast("ExceptionHandler", general_exception_handler))
diff --git a/app/api/middleware/prometheus.py b/app/api/middleware/prometheus.py
index 600ff456..67cdcd50 100644
--- a/app/api/middleware/prometheus.py
+++ b/app/api/middleware/prometheus.py
@@ -1,9 +1,11 @@
 """Prometheus metrics collection middleware."""
 
 import time
+from collections.abc import Awaitable, Callable
 
 from starlette.middleware.base import BaseHTTPMiddleware
 from starlette.requests import Request
+from starlette.responses import Response
 from starlette.routing import BaseRoute
 
 from core.metrics import HTTP_REQUEST_DURATION, HTTP_REQUESTS
@@ -12,7 +14,9 @@
 class PrometheusMiddleware(BaseHTTPMiddleware):
     """Middleware to collect HTTP metrics."""
 
-    async def dispatch(self, request: Request, call_next):
+    async def dispatch(
+        self, request: Request, call_next: Callable[[Request], Awaitable[Response]],
+    ) -> Response:
         if request.url.path == "/metrics":
             return await call_next(request)
 
diff --git a/app/api/middleware/request_body_size.py b/app/api/middleware/request_body_size.py
index 2b6f0fd5..d05ec70e 100644
--- a/app/api/middleware/request_body_size.py
+++ b/app/api/middleware/request_body_size.py
@@ -1,8 +1,11 @@
 """Request body size limiting middleware."""
 
+from collections.abc import Awaitable, Callable
+
 from fastapi import Request
 from fastapi.responses import JSONResponse
 from starlette.middleware.base import BaseHTTPMiddleware
+from starlette.responses import Response
 
 from app.schemas.error import ErrorCode, error_response_dict
 
@@ -12,7 +15,9 @@ class RequestBodySizeMiddleware(BaseHTTPMiddleware):
 
     MAX_BODY_SIZE = 1024 * 1024
 
-    async def dispatch(self, request: Request, call_next):
+    async def dispatch(
+        self, request: Request, call_next: Callable[[Request], Awaitable[Response]],
+    ) -> Response:
         if request.method in ("GET", "HEAD", "OPTIONS"):
             return await call_next(request)
 
diff --git a/app/api/middleware/security_headers.py b/app/api/middleware/security_headers.py
index 529fab9a..28ab3061 100644
--- a/app/api/middleware/security_headers.py
+++ b/app/api/middleware/security_headers.py
@@ -20,13 +20,14 @@ async def add_security_headers(request: Request, call_next: Any) -> Any:
             f"default-src 'self'; "
             f"script-src 'self' 'nonce-{nonce}' 'unsafe-hashes' "
             f"{FONT_ONLOAD_HANDLER_HASH}; "
-            f"style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; "
+            f"style-src 'self' 'nonce-{nonce}' https://fonts.googleapis.com; "
             f"font-src 'self' https://fonts.gstatic.com; "
             f"img-src 'self' data: blob:; "
             f"connect-src 'self'; "
             f"frame-ancestors 'none'; "
             f"base-uri 'self'; "
-            f"form-action 'self'"
+            f"form-action 'self'; "
+            f"object-src 'none'"
         )
     response.headers["X-Content-Type-Options"] = "nosniff"
     response.headers["X-Frame-Options"] = "DENY"
diff --git a/app/api/rate_limit_config.py b/app/api/rate_limit_config.py
index d403990d..6e7db8cc 100644
--- a/app/api/rate_limit_config.py
+++ b/app/api/rate_limit_config.py
@@ -2,6 +2,8 @@
 
 import os
 import re
+from collections.abc import Callable
+from typing import Any
 
 from slowapi import Limiter
 from slowapi.errors import RateLimitExceeded
@@ -19,15 +21,19 @@
 class NoOpLimiter:
     """A no-op limiter that doesn't enforce rate limits."""
 
-    def limit(self, *args, **kwargs):
+    def limit(
+        self,
+        *args: Any,
+        **kwargs: Any,
+    ) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
         """Return a no-op decorator."""
 
-        def noop_decorator(func):
+        def noop_decorator(func: Callable[..., Any]) -> Callable[..., Any]:
             return func
 
         return noop_decorator
 
-    async def __call__(self, request, *args, **kwargs):
+    async def __call__(self, request: Request, *args: Any, **kwargs: Any) -> None:
         """Allow all requests."""
 
 
@@ -44,11 +50,11 @@ def _parse_retry_after(detail: str) -> int:
     match = re.match(r"(\d+)\s+per\s+(\d+)\s+(\w+)", detail)
     if not match:
         return 60  # Default to 60 seconds if parsing fails
-    limit, _window, unit = match.groups()
-    limit = int(limit)
+    _limit, window, unit = match.groups()
+    _limit = int(_limit)
+    window = int(window)
     unit = unit.lower()
-    if unit.endswith("s"):
-        unit = unit[:-1]  # "minutes" → "minute", "secs" → "sec"
+    unit = unit.removesuffix("s")  # "minutes" → "minute", "secs" → "sec"
     # Handle "sec" variant
     if unit == "sec":
         unit = "second"
@@ -59,11 +65,12 @@ def _parse_retry_after(detail: str) -> int:
         "day": 86400,
     }
     multiplier = multipliers.get(unit, 60)  # Default to minute (60s)
-    return limit * multiplier
+    return window * multiplier
 
 
 async def rate_limit_exceeded_handler(
-    request: Request, exc: Exception
+    request: Request,
+    exc: Exception,
 ) -> JSONResponse | HTMLResponse:
     """Handle rate limit exceeded errors with standardized error response.
 
@@ -83,7 +90,9 @@ async def rate_limit_exceeded_handler(
     # even if the JS error handler swaps the response into the DOM target.
     if request.headers.get("HX-Request") == "true":
         return HTMLResponse(
-            status_code=429, content=_rate_limit_error_html(detail), headers=headers
+            status_code=429,
+            content=_rate_limit_error_html(detail),
+            headers=headers,
         )
 
     return JSONResponse(
diff --git a/app/api/routes/auth.py b/app/api/routes/auth.py
index 3bab2b63..9dc3d75d 100644
--- a/app/api/routes/auth.py
+++ b/app/api/routes/auth.py
@@ -1,6 +1,7 @@
 """Authentication endpoints (REST API)."""
 
 from datetime import UTC, datetime
+from typing import Any
 from uuid import UUID
 
 from fastapi import APIRouter, HTTPException, Request, Response, status
@@ -40,7 +41,7 @@
             {"id": "f47ac10b-58cc-4372-a567-0e02b2c3d479", "email": "user@example.com"},
         ),
         409: error_response_doc(
-            "Email already registered", ErrorCode.RESOURCE_CONFLICT, "Email already registered"
+            "Email already registered", ErrorCode.RESOURCE_CONFLICT, "Email already registered",
         ),
         422: error_response_doc(
             "Validation error",
@@ -144,7 +145,7 @@ async def login(
             headers={"WWW-Authenticate": "Bearer"},
         )
 
-    access_token = create_access_token(user.id, email=user.email, token_version=user.token_version)
+    access_token = create_access_token(user.id, token_version=user.token_version)
     refresh_token = create_refresh_token(user.id, token_version=user.token_version)
 
     set_token_cookies(response, access_token, refresh_token, secure=settings.cookie_secure)
@@ -152,7 +153,7 @@ async def login(
     return Token(
         access_token=access_token,
         refresh_token=refresh_token,
-        token_type="bearer",
+        token_type="bearer",  # noqa: S106
     )
 
 
@@ -203,7 +204,7 @@ async def refresh(
     # This allows JS-free refresh via credentials: 'include' sending the cookie
     refresh_token_str = token_refresh.refresh_token if token_refresh else None
     if not refresh_token_str:
-        refresh_token_str = request.cookies.get("refresh_token")
+        refresh_token_str = request.cookies.get("__Host-refresh_token")
 
     if not refresh_token_str:
         raise HTTPException(
@@ -256,16 +257,24 @@ async def refresh(
             headers={"WWW-Authenticate": "Bearer"},
         )
 
-    access_token = create_access_token(user.id, email=user.email, token_version=user.token_version)
+    access_token = create_access_token(user.id, token_version=user.token_version)
     new_refresh_token = create_refresh_token(user.id, token_version=user.token_version)
 
+    # Blacklist the consumed refresh token's jti to prevent reuse
+    from app.services.token_blacklist import blacklist_token
+
+    old_jti = payload.get("jti")
+    if old_jti:
+        remaining = max(int(payload.get("exp", 0)) - int(datetime.now(UTC).timestamp()), 60)
+        await blacklist_token(old_jti, ttl_seconds=remaining)
+
     # Set JWT tokens as HttpOnly cookies for HTMX/browser auth
     set_token_cookies(response, access_token, new_refresh_token, secure=settings.cookie_secure)
 
     return Token(
         access_token=access_token,
         refresh_token=new_refresh_token,
-        token_type="bearer",
+        token_type="bearer",  # noqa: S106
     )
 
 
@@ -280,7 +289,7 @@ async def refresh(
             {"id": "f47ac10b-58cc-4372-a567-0e02b2c3d479", "email": "user@example.com"},
         ),
         401: error_response_doc(
-            "Unauthorized", ErrorCode.UNAUTHORIZED, "Could not validate credentials"
+            "Unauthorized", ErrorCode.UNAUTHORIZED, "Could not validate credentials",
         ),
     },
 )
@@ -290,8 +299,8 @@ async def me(current_user: CurrentUser) -> UserResponse:
 
 async def _blacklist_token_cookie(
     token_str: str | None,
-    verify_fn,
-    blacklist_fn,
+    verify_fn: Any,
+    blacklist_fn: Any,
 ) -> None:
     """Extract jti from a token cookie and blacklist it if valid."""
     if not token_str:
@@ -307,7 +316,7 @@ async def _blacklist_token_cookie(
 
 
 @router.post("/logout")
-async def logout(request: Request):
+async def logout(request: Request) -> RedirectResponse:
     """Clear auth cookies and redirect to login.
 
     Logout is a POST action to prevent CSRF from logout links.
@@ -317,12 +326,12 @@ async def logout(request: Request):
     from app.services.token_blacklist import blacklist_token
 
     await _blacklist_token_cookie(
-        request.cookies.get("access_token"),
+        request.cookies.get("__Host-access_token"),
         verify_token,
         blacklist_token,
     )
     await _blacklist_token_cookie(
-        request.cookies.get("refresh_token"),
+        request.cookies.get("__Host-refresh_token"),
         verify_token,
         blacklist_token,
     )
diff --git a/app/api/routes/chaos.py b/app/api/routes/chaos.py
index 94f4d282..a379e0cc 100644
--- a/app/api/routes/chaos.py
+++ b/app/api/routes/chaos.py
@@ -1,3 +1,5 @@
+from typing import Any
+
 from fastapi import APIRouter, Form, HTTPException, Request
 from fastapi.responses import JSONResponse
 from pydantic import BaseModel, Field
@@ -17,7 +19,7 @@
 router = APIRouter(prefix="/api/v1/chaos", tags=["chaos"])
 
 
-def _require_feature_flag():
+def _require_feature_flag() -> None:
     """Raise 404 if chaos API is disabled."""
     if not settings.feature_chaos_api_enabled:
         raise HTTPException(status_code=404, detail="Not Found")
@@ -44,13 +46,13 @@ def _scenario_key(scenario: str) -> str:
     return SCENARIO_KEY_MAP.get(scenario, f"chaos:{scenario}")
 
 
-@router.post("/inject")
+@router.post("/inject", response_model=None)
 async def inject_chaos(
     request: Request,
     _user: CurrentUserFromCookie,
     scenario: str = Form(...),
     duration_seconds: int = Form(30),
-):
+) -> dict[str, Any] | JSONResponse:
     _require_feature_flag()
     if not await validate_csrf_token(request):
         return JSONResponse(
@@ -72,7 +74,7 @@ async def inject_chaos(
         spike_data: dict[str, float] = {}
         for i in range(15):
             spike_data[str(now - i * 2)] = now - i * 2
-        await r.zadd("throttle:window:youtube", spike_data)
+        await r.zadd("throttle:window:youtube", spike_data)  # type: ignore[arg-type]
         await r.expire("throttle:window:youtube", settings.throttle_window_seconds * 2)
         THROTTLE_RISK_SCORE.labels(service="youtube", provider="yt-dlp").set(1.0)
 
@@ -93,11 +95,11 @@ async def inject_chaos(
     }
 
 
-@router.post("/reset")
+@router.post("/reset", response_model=None)
 async def reset_chaos(
     request: Request,
     _user: CurrentUserFromCookie,
-):
+) -> dict[str, Any] | JSONResponse:
     _require_feature_flag()
     if not await validate_csrf_token(request):
         return JSONResponse(
@@ -119,7 +121,7 @@ async def reset_chaos(
 async def chaos_status(
     request: Request,
     _user: CurrentUserFromCookie,
-):
+) -> dict[str, Any]:
     _require_feature_flag()
 
     from core.redis_client import KEY_TO_SCENARIO_FIELD
@@ -133,13 +135,13 @@ async def chaos_status(
     return {"data": status.model_dump()}
 
 
-@router.post("/submit-videos")
+@router.post("/submit-videos", response_model=None)
 async def chaos_submit_videos(
     request: Request,
     _user: CurrentUserFromCookie,
     db: DbSession,
     count: int = Form(default=10),
-):
+) -> dict[str, Any] | JSONResponse:
     """Bulk submit demo video URLs for chaos lab.
 
     Creates N random download jobs from the demo URL pool.
diff --git a/app/api/routes/downloads.py b/app/api/routes/downloads.py
index 5e61ac0c..7569efdc 100644
--- a/app/api/routes/downloads.py
+++ b/app/api/routes/downloads.py
@@ -80,7 +80,9 @@ def _map_download_service_error(exc: Exception) -> HTTPException:
             },
         ),
         401: error_response_doc(
-            "Unauthorized", ErrorCode.UNAUTHORIZED, "Could not validate credentials"
+            "Unauthorized",
+            ErrorCode.UNAUTHORIZED,
+            "Could not validate credentials",
         ),
         422: {
             "description": "Validation error",
@@ -113,7 +115,9 @@ async def create_download(
     db: DbSession,
 ) -> DownloadResponse:
     """Create a new download job for the authenticated user."""
-    job = await DownloadService(db, current_user.id).create(data.url)
+    service = DownloadService(db, current_user.id)
+    job = await service.create(data.url)
+    await service.best_effort_enqueue(job.id)
     return _job_to_response(job)
 
 
@@ -142,7 +146,9 @@ async def create_download(
             },
         ),
         401: error_response_doc(
-            "Unauthorized", ErrorCode.UNAUTHORIZED, "Could not validate credentials"
+            "Unauthorized",
+            ErrorCode.UNAUTHORIZED,
+            "Could not validate credentials",
         ),
         422: {
             "description": "Validation error",
@@ -201,7 +207,9 @@ async def list_downloads(
             },
         ),
         401: error_response_doc(
-            "Unauthorized", ErrorCode.UNAUTHORIZED, "Could not validate credentials"
+            "Unauthorized",
+            ErrorCode.UNAUTHORIZED,
+            "Could not validate credentials",
         ),
         404: error_response_doc(
             "Download job not found",
@@ -236,10 +244,14 @@ async def get_download(
             "Job is not completed. Current status: processing",
         ),
         401: error_response_doc(
-            "Unauthorized", ErrorCode.UNAUTHORIZED, "Could not validate credentials"
+            "Unauthorized",
+            ErrorCode.UNAUTHORIZED,
+            "Could not validate credentials",
         ),
         403: error_response_doc(
-            "Invalid file path", ErrorCode.FORBIDDEN, "Access denied: invalid file path"
+            "Invalid file path",
+            ErrorCode.FORBIDDEN,
+            "Access denied: invalid file path",
         ),
         404: error_response_doc(
             "Job or file not found",
@@ -248,7 +260,9 @@ async def get_download(
             details={"job_id": "550e8400-e29b-41d4-a716-446655440000"},
         ),
         410: error_response_doc(
-            "Download link expired", ErrorCode.VALIDATION_ERROR, "Download link has expired"
+            "Download link expired",
+            ErrorCode.VALIDATION_ERROR,
+            "Download link has expired",
         ),
     },
 )
@@ -293,7 +307,9 @@ async def retry_download(
     responses={
         204: {"description": "Download job deleted"},
         401: error_response_doc(
-            "Unauthorized", ErrorCode.UNAUTHORIZED, "Could not validate credentials"
+            "Unauthorized",
+            ErrorCode.UNAUTHORIZED,
+            "Could not validate credentials",
         ),
         404: error_response_doc(
             "Download job not found",
diff --git a/app/api/routes/health.py b/app/api/routes/health.py
index 064e8ed5..99efa250 100644
--- a/app/api/routes/health.py
+++ b/app/api/routes/health.py
@@ -74,13 +74,12 @@ async def _check_redis(redis_url: str) -> str:
     responses={
         200: success_response_doc("Service is healthy", {"status": "healthy"}),
         503: error_response_doc(
-            "Service unavailable", ErrorCode.INTERNAL_ERROR, "Dependency check failed"
+            "Service unavailable", ErrorCode.INTERNAL_ERROR, "Dependency check failed",
         ),
     },
 )
 async def health_check() -> HealthStatus:
-    """
-    Returns the health status using independent, direct connections.
+    """Returns the health status using independent, direct connections.
     """
     health_status: HealthStatus = {
         "status": "healthy",
@@ -123,8 +122,7 @@ async def health_check() -> HealthStatus:
     },
 )
 async def readiness_check() -> ReadinessResponse | Response:
-    """
-    Readiness probe that checks all dependencies.
+    """Readiness probe that checks all dependencies.
 
     Returns 503 if any dependency is unhealthy, allowing
     Kubernetes to remove this pod from service endpoints.
diff --git a/app/api/routes/sse.py b/app/api/routes/sse.py
index 3850006f..5247a73e 100644
--- a/app/api/routes/sse.py
+++ b/app/api/routes/sse.py
@@ -12,10 +12,12 @@
 
 from fastapi import APIRouter, Request
 from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker
 from sse_starlette import EventSourceResponse, ServerSentEvent
 
 from app.api.dependencies import CurrentUserFromCookie
-from app.services.pubsub_service import get_pubsub_service
+from app.api.rate_limit_config import limiter
+from app.services.pubsub_service import PubSubService, get_pubsub_service
 from core.database import get_async_session_factory
 from core.logging_config import get_logger
 from core.models.download_job import DownloadJob
@@ -25,7 +27,7 @@
 logger = get_logger(__name__)
 
 MAX_SEEN_JOBS = 100
-POLL_INTERVAL_SECONDS = 15
+POLL_INTERVAL_SECONDS = 10
 MAX_PUBSUB_RECONNECT_ATTEMPTS = 3
 PUBSUB_RECONNECT_DELAY_SECONDS = 1
 # Cap on buffered pub/sub events during the initial subscription window.
@@ -53,7 +55,7 @@ async def _job_to_sse_data(job: DownloadJob) -> dict:
 
 
 async def _emit_initial_snapshot(
-    session_factory,
+    session_factory: async_sessionmaker[AsyncSession],
     user_id: uuid.UUID,
     seen_initial: OrderedDict[str, str],
 ) -> list[ServerSentEvent]:
@@ -79,7 +81,7 @@ async def _emit_initial_snapshot(
                     ServerSentEvent(
                         event="job_update",
                         data=json.dumps(await _job_to_sse_data(job)),
-                    )
+                    ),
                 )
     except Exception as e:
         logger.warning("sse_initial_state_failed", user_id=str(user_id), error=str(e))
@@ -106,7 +108,7 @@ async def _replay_buffered_events(
 
 
 async def _subscribe_to_pubsub(
-    pubsub,
+    pubsub: PubSubService,
     user_id: uuid.UUID,
     last_seen_job_ids: OrderedDict[str, str],
 ) -> AsyncGenerator[ServerSentEvent, None]:
@@ -131,7 +133,7 @@ async def _subscribe_to_pubsub(
 
 
 async def _subscribe_to_progress_pubsub(
-    pubsub,
+    pubsub: PubSubService,
     user_id: uuid.UUID,
 ) -> AsyncGenerator[ServerSentEvent, None]:
     """Inner generator that yields progress events from pubsub subscription."""
@@ -223,7 +225,10 @@ async def _merge_generators(
     """Merge two SSE generators with backpressure via bounded queue + coalescing."""
     queue: asyncio.Queue[ServerSentEvent | None] = asyncio.Queue(maxsize=128)
 
-    async def _drain(source, src_name):
+    async def _drain(
+        source: AsyncGenerator[ServerSentEvent, None],
+        src_name: str,
+    ) -> None:
         try:
             async for event in source:
                 # Status events (job_update) are never dropped — they
@@ -268,7 +273,7 @@ async def _drain(source, src_name):
 
 async def fallback_polling_generator(
     request: Request,
-    session_factory,
+    session_factory: async_sessionmaker[AsyncSession],
     user_id: uuid.UUID,
     seen_jobs: OrderedDict[str, str] | None = None,
 ) -> AsyncGenerator[ServerSentEvent, None]:
@@ -348,7 +353,7 @@ async def _disconnect_monitor(
 
 async def event_generator(
     request: Request,
-    session_factory,
+    session_factory: async_sessionmaker[AsyncSession],
     user_id: uuid.UUID,
 ) -> AsyncGenerator[ServerSentEvent, None]:
     """SSE event generator that prioritizes Pub/Sub with polling fallback."""
@@ -360,7 +365,7 @@ async def event_generator(
     reconnect_attempts = 0
     buffer_task: asyncio.Task | None = None
 
-    async def _buffer_pubsub_events():
+    async def _buffer_pubsub_events() -> None:
         """Buffer pub/sub events before DB snapshot."""
         nonlocal reconnect_attempts
         while reconnect_attempts < MAX_PUBSUB_RECONNECT_ATTEMPTS:
@@ -427,7 +432,7 @@ async def _buffer_pubsub_events():
 
         # Fall back to polling
         async for event in fallback_polling_generator(
-            request, session_factory, user_id, seen_initial
+            request, session_factory, user_id, seen_initial,
         ):
             yield event
     except GeneratorExit:
@@ -445,10 +450,11 @@ async def _buffer_pubsub_events():
 
 
 @router.get("/downloads/stream")
+@limiter.limit("5/minute")
 async def download_status_stream(
     request: Request,
     current_user: CurrentUserFromCookie,
-):
+) -> EventSourceResponse:
     """Server-Sent Events endpoint for real-time download status and progress updates."""
     return EventSourceResponse(
         event_generator(request, get_async_session_factory(), current_user.id),
diff --git a/app/api/routes/web/web_auth.py b/app/api/routes/web/web_auth.py
index 9eb2f327..f7b08728 100644
--- a/app/api/routes/web/web_auth.py
+++ b/app/api/routes/web/web_auth.py
@@ -4,8 +4,9 @@
 from typing import Annotated
 
 from fastapi import APIRouter, Form, Query, Request, Response
-from fastapi.responses import RedirectResponse
+from fastapi.responses import HTMLResponse, RedirectResponse
 from sqlalchemy import select
+from starlette.templating import _TemplateResponse as TemplateResponse
 
 from app.api.dependencies import CurrentUserFromCookie, DbSession
 from app.api.rate_limit_config import limiter
@@ -68,7 +69,7 @@ async def login_page(
     request: Request,
     return_url: str = "/web/downloads",
     error: Annotated[str | None, Query(max_length=100)] = None,
-):
+) -> TemplateResponse:
     """Render login page."""
     token = get_csrf_token(request)
     error_message, field_errors = _resolve_login_errors(error)
@@ -87,7 +88,7 @@ async def login_page(
     return response
 
 
-@router.post("/login")
+@router.post("/login", response_model=None)
 @limiter.limit("5/minute")
 async def login_form(
     request: Request,
@@ -96,21 +97,21 @@ async def login_form(
     email: Annotated[str, Form(max_length=255)],
     password: Annotated[str, Form(max_length=255)],
     return_url: Annotated[str | None, Form(max_length=500)] = None,
-):
+) -> HTMLResponse | RedirectResponse:
     """Handle login form submission via HTMX or regular POST."""
     if not await validate_csrf_token(request):
         return _htmx_or_redirect(
-            request, 403, _error_html("Invalid CSRF token"), "/web/login?error=csrf"
+            request, 403, _error_html("Invalid CSRF token"), "/web/login?error=csrf",
         )
     result = await db.execute(select(User).where(User.email == email, not_deleted()))
     user = result.scalar_one_or_none()
     if user is None or not await verify_password(password, user.password_hash):
         return _htmx_or_redirect(
-            request, 401, _error_html("Invalid email or password"), "/web/login?error=1"
+            request, 401, _error_html("Invalid email or password"), "/web/login?error=1",
         )
     if not user.is_active:
         return _htmx_or_redirect(
-            request, 401, _error_html("Account is inactive"), "/web/login?error=inactive"
+            request, 401, _error_html("Invalid email or password"), "/web/login?error=1",
         )
     access_token = create_access_token(user.id, token_version=user.token_version)
     refresh_token = create_refresh_token(user.id, token_version=user.token_version)
@@ -122,7 +123,7 @@ async def login_form(
 async def register_page(
     request: Request,
     error: Annotated[str | None, Query(max_length=100)] = None,
-):
+) -> TemplateResponse:
     """Render register page."""
     token = get_csrf_token(request)
     error_message, field_errors = _resolve_register_errors(error)
@@ -130,14 +131,14 @@ async def register_page(
         request,
         "register.html",
         get_template_context(
-            request, csrf_token=token, error=error_message, field_errors=field_errors
+            request, csrf_token=token, error=error_message, field_errors=field_errors,
         ),
     )
     set_csrf_token_cookie(response, token)
     return response
 
 
-@router.post("/register")
+@router.post("/register", response_model=None)
 @limiter.limit("5/minute")
 async def register_form(
     request: Request,
@@ -145,29 +146,29 @@ async def register_form(
     password: Annotated[str, Form(max_length=255)],
     password_confirm: Annotated[str, Form(max_length=255)],
     db: DbSession,
-):
+) -> HTMLResponse | RedirectResponse:
     """Handle registration form submission via HTMX or regular POST."""
     user, error_response = await _register_user_or_error_response(
-        request, email, password, password_confirm, db
+        request, email, password, password_confirm, db,
     )
     if error_response is not None:
         return error_response
-    assert user is not None
+    assert user is not None  # noqa: S101
     access_token = create_access_token(user.id, token_version=user.token_version)
     refresh_token = create_refresh_token(user.id, token_version=user.token_version)
     return _register_success_response(request, access_token, refresh_token)
 
 
-@router.post("/demo-login")
+@router.post("/demo-login", response_model=None)
 @limiter.limit("3/minute")
-async def demo_login(request: Request, db: DbSession):
+async def demo_login(request: Request, db: DbSession) -> HTMLResponse | RedirectResponse:
     """Authenticate as the pre-seeded demo user and redirect to downloads."""
     if not await validate_csrf_token(request):
         return _htmx_or_redirect(
-            request, 403, _error_html("Invalid CSRF token"), "/web/login?error=csrf"
+            request, 403, _error_html("Invalid CSRF token"), "/web/login?error=csrf",
         )
     user = await _demo_user_or_raise(db, DEMO_EMAIL)
-    access_token = create_access_token(user.id, email=user.email, token_version=user.token_version)
+    access_token = create_access_token(user.id, token_version=user.token_version)
     refresh_token = create_refresh_token(user.id, token_version=user.token_version)
     try:
         await _prime_demo_jobs(user.id, db)
@@ -179,21 +180,21 @@ async def demo_login(request: Request, db: DbSession):
     return redirect
 
 
-@router.post("/logout")
-async def logout(request: Request):
+@router.post("/logout", response_model=None)
+async def logout(request: Request) -> HTMLResponse | RedirectResponse:
     """Clear auth cookies and redirect to login."""
     if not await validate_csrf_token(request):
         return _htmx_or_redirect(
-            request, 403, _error_html("Invalid CSRF token"), "/web/downloads?error=csrf"
+            request, 403, _error_html("Invalid CSRF token"), "/web/downloads?error=csrf",
         )
-    await _blacklist_token_cookie(request.cookies.get("access_token"))
-    await _blacklist_token_cookie(request.cookies.get("refresh_token"))
+    await _blacklist_token_cookie(request.cookies.get("__Host-access_token"))
+    await _blacklist_token_cookie(request.cookies.get("__Host-refresh_token"))
     redirect = RedirectResponse(url="/web/login?logged_out=1", status_code=303)
     clear_token_cookies(redirect)
     return redirect
 
 
-@router.post("/settings/password")
+@router.post("/settings/password", response_model=None)
 @limiter.limit("10/minute")
 async def change_password(
     request: Request,
@@ -202,7 +203,7 @@ async def change_password(
     new_password_confirm: Annotated[str, Form(max_length=255)],
     current_user: CurrentUserFromCookie,
     db: DbSession,
-):
+) -> HTMLResponse | RedirectResponse:
     """Change current user's password and rotate CSRF after success."""
     return await _change_password_response(
         request,
diff --git a/app/api/routes/web/web_auth_helpers.py b/app/api/routes/web/web_auth_helpers.py
index dc74210a..facef6f9 100644
--- a/app/api/routes/web/web_auth_helpers.py
+++ b/app/api/routes/web/web_auth_helpers.py
@@ -34,7 +34,7 @@
 async def _prime_demo_jobs(user_id: uuid.UUID, db: DbSession) -> None:
     """Prime pending demo jobs for processing."""
     pending_result = await db.execute(
-        select(DownloadJob).where(DownloadJob.user_id == user_id, DownloadJob.status == "pending")
+        select(DownloadJob).where(DownloadJob.user_id == user_id, DownloadJob.status == "pending"),
     )
     pending_jobs = pending_result.scalars().all()
     if not pending_jobs:
@@ -80,7 +80,7 @@ async def _change_password_response(
     if error is not None:
         status_code, error_message, error_code = error
         return _error_response(
-            request, status_code, error_message, f"/web/settings?error={error_code}"
+            request, status_code, error_message, f"/web/settings?error={error_code}",
         )
 
     try:
@@ -137,14 +137,14 @@ async def _register_user_or_error_response(
     if error is not None:
         status_code, error_message, error_code = error
         return None, _error_response(
-            request, status_code, error_message, f"/web/register?error={error_code}"
+            request, status_code, error_message, f"/web/register?error={error_code}",
         )
 
     try:
         user = await UserService(db=db).register(email, password)
     except DuplicateEmailError:
         return None, _error_response(
-            request, 409, "Email already registered", "/web/register?error=email_exists"
+            request, 409, "Email already registered", "/web/register?error=email_exists",
         )
     except InvalidPasswordError as exc:
         resolved_message, _ = _resolve_register_errors(exc.code)
diff --git a/app/api/routes/web/web_dashboard.py b/app/api/routes/web/web_dashboard.py
index 10d285f4..d748cc7e 100644
--- a/app/api/routes/web/web_dashboard.py
+++ b/app/api/routes/web/web_dashboard.py
@@ -1,6 +1,7 @@
 """Dashboard and demo web page routes."""
 
 from fastapi import APIRouter, HTTPException, Request
+from starlette.templating import _TemplateResponse as TemplateResponse
 
 from app.api.routes.web.web_helpers import (
     get_csrf_token,
@@ -15,7 +16,7 @@
 
 
 @router.get("/chaos-lab")
-async def chaos_lab_page(request: Request):
+async def chaos_lab_page(request: Request) -> TemplateResponse:
     """Render the chaos engineering lab page for live demo."""
     if not settings.feature_chaos_api_enabled:
         raise HTTPException(status_code=404, detail="Not Found")
@@ -31,7 +32,7 @@ async def chaos_lab_page(request: Request):
 
 
 @router.get("/chaos-lab/status")
-async def chaos_lab_status(request: Request):
+async def chaos_lab_status(request: Request) -> TemplateResponse:
     """HTMX partial: return current chaos flag status for polling."""
     if not settings.feature_chaos_api_enabled:
         raise HTTPException(status_code=404, detail="Not Found")
@@ -46,10 +47,10 @@ async def chaos_lab_status(request: Request):
 
 
 @router.get("/slides")
-async def presentation_slides(request: Request):
+async def presentation_slides(request: Request) -> TemplateResponse:
     """Render the TOP1 demo presentation slides."""
     return templates.TemplateResponse(
         request,
         "slides/presentation.html",
-        {},
+        {"nonce": getattr(request.state, "nonce", "")},
     )
diff --git a/app/api/routes/web/web_downloads.py b/app/api/routes/web/web_downloads.py
index fb5d8387..84bc8a61 100644
--- a/app/api/routes/web/web_downloads.py
+++ b/app/api/routes/web/web_downloads.py
@@ -5,6 +5,7 @@
 
 from fastapi import APIRouter, Form, HTTPException, Request, status
 from fastapi.responses import FileResponse, HTMLResponse, RedirectResponse
+from starlette.templating import _TemplateResponse as TemplateResponse
 
 from app.api.dependencies import CurrentUserFromCookie, DbSession
 from app.api.rate_limit_config import limiter
@@ -13,7 +14,6 @@
     get_csrf_token,
     get_template_context,
     logger,
-    rotate_csrf_token,
     set_csrf_token_cookie,
     templates,
     validate_csrf_token,
@@ -64,7 +64,7 @@ async def dashboard_page(
     request: Request,
     current_user: CurrentUserFromCookie,
     db: DbSession,
-):
+) -> TemplateResponse:
     """Render main dashboard page with download list."""
     result = await DownloadService(db, current_user.id).list(page=1, per_page=50)
     token = get_csrf_token(request)
@@ -82,14 +82,14 @@ async def dashboard_page(
     return response
 
 
-@router.post("/downloads")
+@router.post("/downloads", response_model=None)
 @limiter.limit("10/minute")
 async def create_download_form(
     request: Request,
     url: Annotated[str, Form(max_length=2000)],
     current_user: CurrentUserFromCookie,
     db: DbSession,
-):
+) -> HTMLResponse | TemplateResponse:
     """HTMX endpoint for form submissions. Returns HTML fragment."""
     if not await validate_csrf_token(request):
         return HTMLResponse(status_code=403, content=_error_html("Invalid CSRF token"))
@@ -107,29 +107,37 @@ async def create_download_form(
     await service.best_effort_enqueue(job.id)
 
     resp = templates.TemplateResponse(
-        request, "partials/_download_item.html", get_template_context(request, job=job)
+        request,
+        "partials/_download_item.html",
+        get_template_context(request, job=job),
     )
-    rotate_csrf_token(resp)
+    set_csrf_token_cookie(resp, get_csrf_token(request))
     return resp
 
 
-@router.post("/downloads/full")
+@router.post("/downloads/full", response_model=None)
 @limiter.limit("10/minute")
 async def create_download_full_page(
     request: Request,
     url: Annotated[str, Form(max_length=2000)],
     current_user: CurrentUserFromCookie,
     db: DbSession,
-):
+) -> HTMLResponse | RedirectResponse:
     """Full-page handler for form submissions (non-HTMX fallback)."""
     if not await validate_csrf_token(request):
         return _htmx_or_redirect(
-            request, 403, _error_html("Invalid CSRF token"), "/web/downloads?error=csrf"
+            request,
+            403,
+            _error_html("Invalid CSRF token"),
+            "/web/downloads?error=csrf",
         )
 
     if not is_supported_url(url):
         return _htmx_or_redirect(
-            request, 422, _error_html("Invalid supported URL"), "/web/downloads?error=invalid_url"
+            request,
+            422,
+            _error_html("Invalid supported URL"),
+            "/web/downloads?error=invalid_url",
         )
 
     service = DownloadService(db, current_user.id)
@@ -156,7 +164,7 @@ async def delete_download_form(
     job_id: str,
     current_user: CurrentUserFromCookie,
     db: DbSession,
-):
+) -> HTMLResponse:
     """HTMX endpoint for deleting a download."""
     if not await validate_csrf_token(request):
         return HTMLResponse(status_code=403, content=_error_html("Invalid CSRF token"))
@@ -183,7 +191,6 @@ async def delete_download_form(
         )
 
     resp = HTMLResponse(content="")
-    rotate_csrf_token(resp)
     return resp
 
 
@@ -193,7 +200,7 @@ async def download_file(
     job_id: str,
     current_user: CurrentUserFromCookie,
     db: DbSession,
-):
+) -> FileResponse:
     """Download the file for a completed job using cookie authentication."""
     try:
         file_result = await DownloadService(db, current_user.id).get_file_path(job_id)
diff --git a/app/api/routes/web/web_helpers.py b/app/api/routes/web/web_helpers.py
index e10584f2..689ccd70 100644
--- a/app/api/routes/web/web_helpers.py
+++ b/app/api/routes/web/web_helpers.py
@@ -3,6 +3,7 @@
 import os
 import posixpath
 import re
+import secrets
 import uuid
 from datetime import UTC, datetime
 from pathlib import Path
@@ -45,14 +46,14 @@ def _field_error(message: str, *fields: str) -> tuple[str, dict[str, str]]:
     "bad_current_password": _field_error("Current password is incorrect", "current_password"),
     "password_mismatch": _field_error("New passwords do not match", "new_password_confirm"),
     "password_too_short": _field_error(
-        "New password must be at least 8 characters", "new_password"
+        "New password must be at least 8 characters", "new_password",
     ),
     "password_too_long": _field_error(
-        "New password must be at most 128 characters", "new_password"
+        "New password must be at most 128 characters", "new_password",
     ),
     "bad_password": _field_error("Password is incorrect", "delete_password"),
     "delete_confirmation": _field_error(
-        "Please type DELETE to confirm account deletion", "confirm_text"
+        "Please type DELETE to confirm account deletion", "confirm_text",
     ),
     "file_cleanup": ("Unable to remove all downloaded files. Account was not deleted.", {}),
     "csrf": ("Invalid CSRF token", {}),
@@ -135,7 +136,7 @@ def rotate_csrf_token(response: Response) -> str:
 
 
 def get_template_context(
-    request: Request, csrf_token: str | None = None, **extra_context
+    request: Request, csrf_token: str | None = None, **extra_context: object,
 ) -> dict[str, object]:
     context: dict[str, object] = {
         "request": request,
@@ -158,7 +159,7 @@ async def validate_csrf_token(request: Request) -> bool:
     if not cookie_token:
         return False
     header_token = request.headers.get("X-CSRF-Token")
-    if header_token == cookie_token:
+    if header_token and secrets.compare_digest(header_token, cookie_token):
         return True
     if header_token:
         return False
@@ -166,7 +167,7 @@ async def validate_csrf_token(request: Request) -> bool:
         form_token = (await request.form()).get("csrf_token")
     except Exception:
         return False
-    return bool(form_token and str(form_token) == cookie_token)
+    return bool(form_token and secrets.compare_digest(str(form_token), cookie_token))
 
 
 def _resolve_error(error_code: str | None, mapping: _ErrorMap) -> tuple[str | None, dict[str, str]]:
@@ -198,7 +199,7 @@ def _htmx_or_redirect(
 
 
 def _error_response(
-    request: Request, status_code: int, message: str, redirect_url: str
+    request: Request, status_code: int, message: str, redirect_url: str,
 ) -> HTMLResponse | RedirectResponse:
     return _htmx_or_redirect(request, status_code, _error_html(message), redirect_url)
 
@@ -231,7 +232,7 @@ def _login_success_response(
 
 
 def _register_success_response(
-    request: Request, access_token: str, refresh_token: str
+    request: Request, access_token: str, refresh_token: str,
 ) -> HTMLResponse | RedirectResponse:
     return _auth_success_response(request, access_token, refresh_token, "/web/downloads")
 
diff --git a/app/api/routes/web/web_settings.py b/app/api/routes/web/web_settings.py
index cf8ea325..e59b15bc 100644
--- a/app/api/routes/web/web_settings.py
+++ b/app/api/routes/web/web_settings.py
@@ -4,6 +4,7 @@
 
 from fastapi import APIRouter, Form, Query, Request
 from fastapi.responses import HTMLResponse, RedirectResponse
+from starlette.templating import _TemplateResponse as TemplateResponse
 
 from app.api.dependencies import CurrentUserFromCookie, DbSession
 from app.api.rate_limit_config import limiter
@@ -38,7 +39,7 @@ async def settings_page(
     request: Request,
     current_user: CurrentUserFromCookie,
     error: Annotated[str | None, Query(max_length=100)] = None,
-):
+) -> TemplateResponse:
     """Render settings page for the current user."""
     token = get_csrf_token(request)
     username = current_user.username or _default_username_from_email(current_user.email)
@@ -59,18 +60,18 @@ async def settings_page(
     return response
 
 
-@router.post("/settings/username")
+@router.post("/settings/username", response_model=None)
 @limiter.limit("10/minute")
 async def update_username(
     request: Request,
     username: Annotated[str, Form(max_length=64)],
     current_user: CurrentUserFromCookie,
     db: DbSession,
-):
+) -> HTMLResponse | RedirectResponse:
     """Update current user's username."""
     if not await validate_csrf_token(request):
         return _htmx_or_redirect(
-            request, 403, _error_html("Invalid CSRF token"), "/web/settings?error=csrf"
+            request, 403, _error_html("Invalid CSRF token"), "/web/settings?error=csrf",
         )
 
     try:
@@ -91,7 +92,7 @@ async def update_username(
     )
 
 
-@router.post("/settings/delete-account")
+@router.post("/settings/delete-account", response_model=None)
 @limiter.limit("3/minute")
 async def delete_account(
     request: Request,
@@ -99,11 +100,11 @@ async def delete_account(
     confirm_text: Annotated[str, Form(max_length=16)],
     current_user: CurrentUserFromCookie,
     db: DbSession,
-):
+) -> HTMLResponse | RedirectResponse:
     """Delete current user's account and associated downloads."""
     if not await validate_csrf_token(request):
         return _htmx_or_redirect(
-            request, 403, _error_html("Invalid CSRF token"), "/web/settings?error=csrf"
+            request, 403, _error_html("Invalid CSRF token"), "/web/settings?error=csrf",
         )
 
     try:
@@ -131,7 +132,7 @@ async def delete_account(
             500,
             _error_html(
                 "Could not remove all downloaded files. Your account was not deleted. "
-                "Please try again or contact support."
+                "Please try again or contact support.",
             ),
             "/web/settings?error=file_cleanup",
         )
diff --git a/app/api/startup.py b/app/api/startup.py
index 47c717bc..1a94c906 100644
--- a/app/api/startup.py
+++ b/app/api/startup.py
@@ -178,7 +178,7 @@ async def close_api_resources() -> None:
 
 
 def create_lifespan(
-    app_version: str, uvloop_available: bool
+    app_version: str, uvloop_available: bool,
 ) -> Callable[[FastAPI], AbstractAsyncContextManager[None, bool | None]]:
     """Create the FastAPI lifespan context manager for app assembly."""
 
diff --git a/app/auth.py b/app/auth.py
index 06e8d2de..d0db6000 100644
--- a/app/auth.py
+++ b/app/auth.py
@@ -37,12 +37,9 @@ def _make_token(
 
 def create_access_token(
     subject: UUID | str,
-    email: str | None = None,
     token_version: int = 1,
 ) -> str:
     extra: dict[str, Any] = {"user_id": str(subject)}
-    if email:
-        extra["email"] = email
     if token_version > 1:
         extra["ver"] = token_version
     return _make_token(
@@ -125,22 +122,28 @@ def verify_token(token: str, expected_type: str | None = None) -> dict[str, Any]
 
 
 def set_token_cookies(
-    response: "Response", access_token: str, refresh_token: str, secure: bool = True
+    response: "Response",
+    access_token: str,
+    refresh_token: str,
+    secure: bool = True,
 ) -> None:
+    # __Host- prefixed cookies MUST have Secure=True in all browsers.
+    # Ignore the caller's secure parameter for __Host- cookies.
+    _host_secure = True
     response.set_cookie(
-        key="access_token",
+        key="__Host-access_token",
         value=access_token,
         httponly=True,
-        secure=secure,
+        secure=_host_secure,
         samesite="lax",
         path="/",
         max_age=settings.access_token_expire_minutes * 60,
     )
     response.set_cookie(
-        key="refresh_token",
+        key="__Host-refresh_token",
         value=refresh_token,
         httponly=True,
-        secure=secure,
+        secure=_host_secure,
         samesite="lax",
         path="/",
         max_age=settings.refresh_token_expire_days * 24 * 60 * 60,
@@ -148,5 +151,5 @@ def set_token_cookies(
 
 
 def clear_token_cookies(response: "Response") -> None:
-    response.delete_cookie(key="access_token", path="/")
-    response.delete_cookie(key="refresh_token", path="/")
+    response.delete_cookie(key="__Host-access_token", path="/")
+    response.delete_cookie(key="__Host-refresh_token", path="/")
diff --git a/app/main.py b/app/main.py
index f7298898..002ce4b9 100644
--- a/app/main.py
+++ b/app/main.py
@@ -133,7 +133,7 @@ async def get_response(self, path: str, scope: Scope) -> Response:
 @app.get("/")
 async def root(request: Request) -> RedirectResponse:
     """Redirect root to login or dashboard based on auth status."""
-    token = request.cookies.get("access_token")
+    token = request.cookies.get("__Host-access_token")
     if token and verify_token(token) is not None:
         return RedirectResponse(url="/web/downloads", status_code=303)
     return RedirectResponse(url="/web/login", status_code=303)
diff --git a/app/schemas/download.py b/app/schemas/download.py
index 541e5c0e..6153e5d7 100644
--- a/app/schemas/download.py
+++ b/app/schemas/download.py
@@ -2,12 +2,14 @@
 from typing import Annotated
 from uuid import UUID
 
-from pydantic import BaseModel, Field, field_validator
+from pydantic import BaseModel, ConfigDict, Field, field_validator
 
 from app.utils.validators import is_supported_url
 
 
 class DownloadCreate(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
     url: Annotated[str, Field(min_length=1, max_length=2000)]
 
     @field_validator("url")
diff --git a/app/schemas/token.py b/app/schemas/token.py
index b9bc9164..422bf3de 100644
--- a/app/schemas/token.py
+++ b/app/schemas/token.py
@@ -1,6 +1,6 @@
 """Token schemas."""
 
-from pydantic import BaseModel
+from pydantic import BaseModel, ConfigDict
 
 
 class Token(BaseModel):
@@ -10,4 +10,6 @@ class Token(BaseModel):
 
 
 class TokenRefresh(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
     refresh_token: str
diff --git a/app/schemas/user.py b/app/schemas/user.py
index a3ab4905..ccbc2496 100644
--- a/app/schemas/user.py
+++ b/app/schemas/user.py
@@ -1,11 +1,13 @@
 from uuid import UUID
 
-from pydantic import BaseModel, EmailStr, field_validator
+from pydantic import BaseModel, ConfigDict, EmailStr, field_validator
 
 from app.utils.validators import validate_password
 
 
 class UserCreate(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
     email: EmailStr
     password: str
 
diff --git a/app/services/auth_service.py b/app/services/auth_service.py
index fab4899e..624b56f5 100644
--- a/app/services/auth_service.py
+++ b/app/services/auth_service.py
@@ -20,5 +20,5 @@ async def hash_password(password: str) -> str:
 async def verify_password(plain_password: str, hashed_password: str) -> bool:
     loop = asyncio.get_running_loop()
     return bool(
-        await loop.run_in_executor(None, pwd_context.verify, plain_password, hashed_password)
+        await loop.run_in_executor(None, pwd_context.verify, plain_password, hashed_password),
     )
diff --git a/app/services/circuit_breaker.py b/app/services/circuit_breaker.py
index a39875d7..77ff495d 100644
--- a/app/services/circuit_breaker.py
+++ b/app/services/circuit_breaker.py
@@ -1,5 +1,4 @@
-"""
-Circuit Breaker pattern for external API calls.
+"""Circuit Breaker pattern for external API calls.
 
 Based on 2026 industry best practices for resilience engineering.
 Prevents thundering herd problem when external services (like YouTube) are down.
@@ -46,13 +45,12 @@ def __init__(self, service_name: str, reset_timeout: float):
         self.reset_timeout = reset_timeout
         super().__init__(
             f"Circuit breaker is OPEN for {service_name}. "
-            f"Service will be retried after {reset_timeout}s cooldown."
+            f"Service will be retried after {reset_timeout}s cooldown.",
         )
 
 
 class CircuitBreaker:
-    """
-    Circuit breaker implementation for external service calls.
+    """Circuit breaker implementation for external service calls.
 
     Tracks failures and opens the circuit when threshold is exceeded,
     preventing cascading failures and thundering herd problems.
@@ -69,8 +67,7 @@ def __init__(
         half_open_max_calls: int = 3,
         use_redis_distributed: bool = False,
     ):
-        """
-        Initialize circuit breaker.
+        """Initialize circuit breaker.
 
         Args:
             name: Service name for logging
@@ -81,6 +78,7 @@ def __init__(
             use_redis_distributed: If True, share failure count and half-open
                 slot state across all worker processes via Redis. Requires that
                 the redis_client imported at the top of this module is connected.
+
         """
         self.name = name
         self.failure_threshold = failure_threshold
@@ -427,9 +425,8 @@ async def record_failure(self, error: Exception | None = None) -> None:
                     self._state = CircuitState.OPEN
                     CIRCUIT_BREAKER_STATE.labels(service=self.name).set(1)
 
-    async def execute(self, func, *args, **kwargs) -> Any:
-        """
-        Execute a function with circuit breaker protection.
+    async def execute(self, func: Callable[..., Awaitable[Any]], *args: Any, **kwargs: Any) -> Any:
+        """Execute a function with circuit breaker protection.
 
         Cancellation is treated as a slot release, NOT a failure — this
         prevents asyncio.CancelledError from falsely reopening the circuit
@@ -446,6 +443,7 @@ async def execute(self, func, *args, **kwargs) -> Any:
         Raises:
             CircuitBreakerOpenError: If circuit is open
             Exception: Re-raises any exception from func
+
         """
         if not await self.can_execute():
             raise CircuitBreakerOpenError(self.name, self.reset_timeout)
@@ -507,8 +505,7 @@ async def extract_media_with_circuit_breaker(
     storage_path: str,
     progress_callback: Callable[[dict], Awaitable[None]] | None = None,
 ) -> tuple[str, str, str | None]:
-    """
-    Extract media URL with circuit breaker protection.
+    """Extract media URL with circuit breaker protection.
 
     Wraps extract_media_url with circuit breaker to prevent
     hammering YouTube during outages.
@@ -522,6 +519,7 @@ async def extract_media_with_circuit_breaker(
 
     Returns:
         tuple of (file_path, file_name, title).
+
     """
     cb = get_youtube_circuit_breaker()
 
diff --git a/app/services/download_service.py b/app/services/download_service.py
index 46e2ce06..d9f55a70 100644
--- a/app/services/download_service.py
+++ b/app/services/download_service.py
@@ -5,7 +5,6 @@
 from dataclasses import dataclass
 from datetime import UTC, datetime
 
-from sqlalchemy import delete as sqlalchemy_delete
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -158,7 +157,7 @@ async def create(self, url: str, *, resolve_title: bool = True) -> DownloadJob:
     async def list(self, page: int, per_page: int) -> DownloadPage:
         """Return user-owned downloads ordered newest first."""
         count_result = await self.db.execute(
-            select(func.count()).where(DownloadJob.user_id == self.user_id)
+            select(func.count()).where(DownloadJob.user_id == self.user_id),
         )
         total = count_result.scalar_one()
         result = await self.db.execute(
@@ -166,7 +165,7 @@ async def list(self, page: int, per_page: int) -> DownloadPage:
             .where(DownloadJob.user_id == self.user_id)
             .order_by(DownloadJob.created_at.desc())
             .offset((page - 1) * per_page)
-            .limit(per_page)
+            .limit(per_page),
         )
         return DownloadPage(
             jobs=list(result.scalars().all()),
@@ -182,11 +181,11 @@ async def get(self, job_id: str | uuid.UUID) -> DownloadJob:
             select(DownloadJob).where(
                 DownloadJob.id == job_uuid,
                 DownloadJob.user_id == self.user_id,
-            )
+            ),
         )
         job: DownloadJob | None = result.scalars().one_or_none()
         if job is None:
-            raise DownloadNotFoundError()
+            raise DownloadNotFoundError
         return job
 
     async def retry(self, job_id: str | uuid.UUID) -> DownloadJob:
@@ -215,10 +214,9 @@ async def get_file_path(self, job_id: str | uuid.UUID) -> DownloadFilePath:
         if not job.file_path:
             raise DownloadFileMissingError("File not found", code="missing_file_path")
 
-        if job.expires_at and self._as_utc(job.expires_at) < datetime.now(UTC):
-            raise DownloadFileExpiredError()
-
         safe_path = self._validate_download_path(job.file_path)
+        if job.expires_at and self._as_utc(job.expires_at) < datetime.now(UTC):
+            raise DownloadFileExpiredError
         if not os.path.isfile(safe_path):
             safe_job_id = str(job_id).replace("\r", "").replace("\n", "")
             logger.error("file_missing_from_disk", job_id=safe_job_id, file_path=safe_path)
@@ -255,14 +253,17 @@ async def delete(
                 except OSError as exc:
                     logger.warning("failed_to_delete_file", file_path=job.file_path, error=str(exc))
                     if fail_on_file_delete:
-                        raise DownloadFileDeleteFailedError() from exc
+                        raise DownloadFileDeleteFailedError from exc
 
         await self.db.delete(job)
         await self.db.commit()
         return DeleteOutcome(file_deleted=file_deleted)
 
     async def resolve_errors(
-        self, page: int, per_page: int, category: str | None = None
+        self,
+        page: int,
+        per_page: int,
+        category: str | None = None,
     ) -> FailedJobPage:
         """Return paginated user-owned failed jobs."""
         query = select(FailedJob).where(FailedJob.user_id == self.user_id)
@@ -274,7 +275,9 @@ async def resolve_errors(
         count_result = await self.db.execute(count_query)
         total = count_result.scalar_one()
         result = await self.db.execute(
-            query.order_by(FailedJob.failed_at.desc()).offset((page - 1) * per_page).limit(per_page)
+            query.order_by(FailedJob.failed_at.desc())
+            .offset((page - 1) * per_page)
+            .limit(per_page),
         )
         return FailedJobPage(
             failed_jobs=list(result.scalars().all()),
@@ -284,7 +287,10 @@ async def resolve_errors(
         )
 
     async def list_failed(
-        self, page: int, per_page: int, category: str | None = None
+        self,
+        page: int,
+        per_page: int,
+        category: str | None = None,
     ) -> FailedJobPage:
         """Alias for failed-job listing."""
         return await self.resolve_errors(page, per_page, category)
@@ -339,7 +345,7 @@ async def replay_all_failed(
                 select(DownloadJob).where(
                     DownloadJob.id.in_(original_ids),
                     DownloadJob.user_id == self.user_id,
-                )
+                ),
             )
             for original in original_result.scalars().all():
                 originals_by_id[original.id] = original
@@ -371,16 +377,26 @@ async def replay_all_failed(
         return ReplayAllResult(replayed=replayed, total=len(failed_jobs))
 
     async def best_effort_enqueue(self, job_id: uuid.UUID) -> None:
-        """Try immediate queueing and leave outbox recovery intact on failure."""
+        """Try immediate queueing and leave outbox recovery intact on failure.
+
+        On Redis success, the matching pending outbox row is transitioned to
+        status='processed' (with processed_at) instead of being deleted, so
+        operators retain an audit trail. The row is reaped by
+        ``cleanup_stale_outbox_entries`` after the retention window.
+        """
         cleanup_started = False
         try:
             await enqueue_job(job_id)
             cleanup_started = True
+            from sqlalchemy import update as sqlalchemy_update
+
             await self.db.execute(
-                sqlalchemy_delete(Outbox).where(
+                sqlalchemy_update(Outbox)
+                .where(
                     Outbox.job_id == job_id,
                     Outbox.status == "pending",
                 )
+                .values(status="processed", processed_at=datetime.now(UTC)),
             )
             await self.db.commit()
         except Exception:
@@ -394,11 +410,11 @@ async def _get_failed_job(self, failed_job_id: str | uuid.UUID) -> FailedJob:
             select(FailedJob).where(
                 FailedJob.id == failed_uuid,
                 FailedJob.user_id == self.user_id,
-            )
+            ),
         )
         failed_job: FailedJob | None = result.scalars().one_or_none()
         if failed_job is None:
-            raise FailedJobNotFoundError()
+            raise FailedJobNotFoundError
         return failed_job
 
     async def _get_original_for_failed_job(self, original_job_id: uuid.UUID) -> DownloadJob | None:
@@ -406,7 +422,7 @@ async def _get_original_for_failed_job(self, original_job_id: uuid.UUID) -> Down
             select(DownloadJob).where(
                 DownloadJob.id == original_job_id,
                 DownloadJob.user_id == self.user_id,
-            )
+            ),
         )
         original_job: DownloadJob | None = result.scalars().one_or_none()
         return original_job
@@ -416,7 +432,7 @@ async def _update_user_dlq_depth(self) -> None:
             from core.metrics import DLQ_DEPTH
 
             count_result = await self.db.execute(
-                select(func.count()).where(FailedJob.user_id == self.user_id)
+                select(func.count()).where(FailedJob.user_id == self.user_id),
             )
             DLQ_DEPTH.set(float(count_result.scalar() or 0))
         except Exception:
@@ -426,7 +442,7 @@ def _validate_download_path(self, file_path: str) -> str:
         try:
             return validate_path(self._downloads_base_path(), file_path)
         except (ValueError, PermissionError) as exc:
-            raise UnsafeDownloadPathError() from exc
+            raise UnsafeDownloadPathError from exc
 
     @staticmethod
     def _downloads_base_path() -> str:
diff --git a/app/services/error_classifier.py b/app/services/error_classifier.py
index bcdf3c43..d0221edd 100644
--- a/app/services/error_classifier.py
+++ b/app/services/error_classifier.py
@@ -15,12 +15,18 @@
 - UNKNOWN:               2 retries, 30s-10m, full jitter
 """
 
-import random
 import re
+import secrets
 from dataclasses import dataclass
 from datetime import UTC, datetime
 from enum import Enum
 
+from redis.asyncio import Redis
+
+# Use a SystemRandom instance for uniform() while still exposing the name
+# `random` so tests can patch `app.services.error_classifier.random.uniform`.
+random = secrets.SystemRandom()
+
 
 class ErrorCategory(Enum):
     RATE_LIMITED = "rate_limited"
@@ -124,78 +130,78 @@ class ClassificationResult:
 
 
 _RATE_LIMITED_PATTERNS = [
-    re.compile(r"HTTP Error 429", re.I),
+    re.compile(r"HTTP Error 429", re.IGNORECASE),
     re.compile(r"\b429\b"),
-    re.compile(r"Too Many Requests", re.I),
-    re.compile(r"rate.?limit", re.I),
-    re.compile(r"Retry.?After", re.I),
+    re.compile(r"Too Many Requests", re.IGNORECASE),
+    re.compile(r"rate.?limit", re.IGNORECASE),
+    re.compile(r"Retry.?After", re.IGNORECASE),
 ]
 
 _TRANSIENT_PATTERNS = [
-    re.compile(r"HTTP Error 50[0-9]", re.I),
+    re.compile(r"HTTP Error 50[0-9]", re.IGNORECASE),
     re.compile(r"\b50[2-3]\b"),
-    re.compile(r"connection.*(?:refused|reset|abort|timeout)", re.I),
-    re.compile(r"temporary.*(?:failure|error|unavailable)", re.I),
-    re.compile(r"try again later", re.I),
-    re.compile(r"(?:DNS|name resolution).*error", re.I),
-    re.compile(r"network.*(?:error|unreachable)", re.I),
-    re.compile(r"Empty response", re.I),
-    re.compile(r"Read timed out", re.I),
-    re.compile(r"ConnectionError", re.I),
-    re.compile(r"timeout.*occurred", re.I),
-    re.compile(r"remote.*disconnected", re.I),
-    re.compile(r"reset by peer", re.I),
-    re.compile(r"broken pipe", re.I),
+    re.compile(r"connection.*(?:refused|reset|abort|timeout)", re.IGNORECASE),
+    re.compile(r"temporary.*(?:failure|error|unavailable)", re.IGNORECASE),
+    re.compile(r"try again later", re.IGNORECASE),
+    re.compile(r"(?:DNS|name resolution).*error", re.IGNORECASE),
+    re.compile(r"network.*(?:error|unreachable)", re.IGNORECASE),
+    re.compile(r"Empty response", re.IGNORECASE),
+    re.compile(r"Read timed out", re.IGNORECASE),
+    re.compile(r"ConnectionError", re.IGNORECASE),
+    re.compile(r"timeout.*occurred", re.IGNORECASE),
+    re.compile(r"remote.*disconnected", re.IGNORECASE),
+    re.compile(r"reset by peer", re.IGNORECASE),
+    re.compile(r"broken pipe", re.IGNORECASE),
 ]
 
 _BLOCKED_PATTERNS = [
-    re.compile(r"HTTP Error 403", re.I),
+    re.compile(r"HTTP Error 403", re.IGNORECASE),
     re.compile(r"\b403\b"),
-    re.compile(r"blocked", re.I),
-    re.compile(r"age.?restrict", re.I),
-    re.compile(r"copyright", re.I),
-    re.compile(r"terms of service", re.I),
-    re.compile(r"sign in to confirm", re.I),
-    re.compile(r"login required", re.I),
-    re.compile(r"GEO", re.I),
-    re.compile(r"unavailable in your", re.I),
-    re.compile(r"removed by", re.I),
-    re.compile(r"copyright claim", re.I),
-    re.compile(r"DMCA", re.I),
-    re.compile(r"restricted", re.I),
+    re.compile(r"blocked", re.IGNORECASE),
+    re.compile(r"age.?restrict", re.IGNORECASE),
+    re.compile(r"copyright", re.IGNORECASE),
+    re.compile(r"terms of service", re.IGNORECASE),
+    re.compile(r"sign in to confirm", re.IGNORECASE),
+    re.compile(r"login required", re.IGNORECASE),
+    re.compile(r"GEO", re.IGNORECASE),
+    re.compile(r"unavailable in your", re.IGNORECASE),
+    re.compile(r"removed by", re.IGNORECASE),
+    re.compile(r"copyright claim", re.IGNORECASE),
+    re.compile(r"DMCA", re.IGNORECASE),
+    re.compile(r"restricted", re.IGNORECASE),
 ]
 
 _NOT_FOUND_PATTERNS = [
-    re.compile(r"HTTP Error 404", re.I),
+    re.compile(r"HTTP Error 404", re.IGNORECASE),
     re.compile(r"\b404\b"),
-    re.compile(r"(?:video|page|content).*not found", re.I),
-    re.compile(r"(?:video|page).*unavailable", re.I),
-    re.compile(r"private video", re.I),
-    re.compile(r"deleted video", re.I),
-    re.compile(r"no longer available", re.I),
-    re.compile(r"removed video", re.I),
+    re.compile(r"(?:video|page|content).*not found", re.IGNORECASE),
+    re.compile(r"(?:video|page).*unavailable", re.IGNORECASE),
+    re.compile(r"private video", re.IGNORECASE),
+    re.compile(r"deleted video", re.IGNORECASE),
+    re.compile(r"no longer available", re.IGNORECASE),
+    re.compile(r"removed video", re.IGNORECASE),
 ]
 
 _FORMAT_PATTERNS = [
-    re.compile(r"format is not available", re.I),
-    re.compile(r"Requested format.*not available", re.I),
-    re.compile(r"All formats failed", re.I),
+    re.compile(r"format is not available", re.IGNORECASE),
+    re.compile(r"Requested format.*not available", re.IGNORECASE),
+    re.compile(r"All formats failed", re.IGNORECASE),
 ]
 
 _TIMEOUT_PATTERNS = [
-    re.compile(r"(?:timed? ?out)", re.I),
-    re.compile(r"Timeout", re.I),
-    re.compile(r"timed out", re.I),
+    re.compile(r"(?:timed? ?out)", re.IGNORECASE),
+    re.compile(r"Timeout", re.IGNORECASE),
+    re.compile(r"timed out", re.IGNORECASE),
 ]
 
 _STORAGE_PATTERNS = [
-    re.compile(r"no space left", re.I),
-    re.compile(r"disk full", re.I),
-    re.compile(r"permission denied", re.I),
-    re.compile(r"StorageError", re.I),
+    re.compile(r"no space left", re.IGNORECASE),
+    re.compile(r"disk full", re.IGNORECASE),
+    re.compile(r"permission denied", re.IGNORECASE),
+    re.compile(r"StorageError", re.IGNORECASE),
 ]
 
-RETRY_AFTER_PATTERN = re.compile(r"Retry-After:\s*(\d+)", re.I)
+RETRY_AFTER_PATTERN = re.compile(r"Retry-After:\s*(\d+)", re.IGNORECASE)
 
 _PATTERN_CATEGORIES: list[tuple[str, list[re.Pattern]]] = [
     ("format_unavailable", _FORMAT_PATTERNS),
@@ -300,7 +306,7 @@ def _max_ratio() -> float:
     return _MAX_RETRY_RATIO
 
 
-async def check_retry_budget(redis_client) -> bool:
+async def check_retry_budget(redis_client: Redis) -> bool:
     """Check if retry budget allows another retry.
 
     Returns True if budget OK, False if retries should be shed.
@@ -323,7 +329,7 @@ async def check_retry_budget(redis_client) -> bool:
     return bool((retries / total) < max_ratio)
 
 
-async def record_retry_budget_request(redis_client, is_retry: bool = False) -> None:
+async def record_retry_budget_request(redis_client: Redis, is_retry: bool = False) -> None:
     retry_key, total_key = _retry_budget_keys()
     window = _budget_window()
     now = datetime.now(UTC).timestamp()
diff --git a/app/services/job_factory.py b/app/services/job_factory.py
index 99a1b9b1..1d4592c1 100644
--- a/app/services/job_factory.py
+++ b/app/services/job_factory.py
@@ -36,6 +36,7 @@ async def create_demo_job(
 
     Returns:
         The created DownloadJob, or None on failure
+
     """
     import asyncio
 
@@ -89,8 +90,8 @@ async def create_demo_jobs_bulk(
 
     Returns:
         List of successfully created DownloadJob objects
-    """
 
+    """
     created: list[DownloadJob] = []
 
     for i, url in enumerate(urls):
diff --git a/app/services/outbox_service.py b/app/services/outbox_service.py
index b8887371..5435c3f9 100644
--- a/app/services/outbox_service.py
+++ b/app/services/outbox_service.py
@@ -2,10 +2,13 @@
 from uuid import UUID
 
 from sqlalchemy import select
+from sqlalchemy.exc import IntegrityError
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from core.models.outbox import Outbox
 
+_PENDING_STATUS = "pending"
+
 
 async def write_job_to_outbox(
     db: AsyncSession,
@@ -18,18 +21,23 @@ async def write_job_to_outbox(
     This ensures atomicity - if the transaction commits, the outbox entry exists.
     The worker will process this entry and mark it as processed.
 
-    Idempotent: checks for existing pending outbox record for job_id before inserting.
+    Idempotent under concurrency:
+
+    1. Application-layer pre-check: SELECT for existing pending entry.
+    2. Database-layer guarantee: partial unique index
+       ``uq_outbox_pending_job_id`` (job_id) WHERE status='pending' rejects
+       duplicate inserts at commit time. If the SELECT misses a race, the
+       IntegrityError on flush is treated as "already pending" and returns
+       ``None`` without re-raising, so the outer transaction can commit.
     """
-    # Check for existing pending outbox entry for this job to avoid duplicates
     result = await db.execute(
         select(Outbox).where(
             Outbox.job_id == job_id,
-            Outbox.status == "pending",
-        )
+            Outbox.status == _PENDING_STATUS,
+        ),
     )
     existing = result.scalars().one_or_none()
     if existing is not None:
-        # Already has a pending outbox entry for this job, skip duplicate
         return None
 
     outbox_entry = Outbox(
@@ -37,7 +45,16 @@ async def write_job_to_outbox(
         job_id=job_id,
         event_type=event_type,
         payload=payload,
-        status="pending",
+        status=_PENDING_STATUS,
     )
     db.add(outbox_entry)
+    try:
+        await db.flush()
+    except IntegrityError:
+        # Concurrent writer beat us to the insert via the partial unique
+        # index. Roll back the just-flushed attempt only; the outer
+        # transaction (which may include a DownloadJob insert) must still
+        # commit. Detach our object so subsequent add/commit is clean.
+        db.expunge(outbox_entry)
+        return None
     return outbox_entry
diff --git a/app/services/pubsub_service.py b/app/services/pubsub_service.py
index 07b291b2..40c2a674 100644
--- a/app/services/pubsub_service.py
+++ b/app/services/pubsub_service.py
@@ -37,6 +37,7 @@ async def get_client(self) -> Any:
 
         Returns:
             Redis client instance.
+
         """
         return get_redis_client()
 
@@ -51,6 +52,7 @@ def get_channel_for_user(self, user_id: uuid.UUID) -> str:
 
         Returns:
             Channel name in format 'job_status:{user_id}'.
+
         """
         return f"{CHANNEL_PREFIX}:{user_id}"
 
@@ -62,6 +64,7 @@ def get_progress_channel_for_user(self, user_id: uuid.UUID) -> str:
 
         Returns:
             Channel name in format 'job_progress:{user_id}'.
+
         """
         return f"{PROGRESS_CHANNEL_PREFIX}:{user_id}"
 
@@ -74,6 +77,7 @@ async def publish_job_status(self, user_id: uuid.UUID, job_data: dict) -> int:
 
         Returns:
             Number of subscribers that received the message.
+
         """
         client = await self.get_client()
         channel = self.get_channel_for_user(user_id)
@@ -99,6 +103,7 @@ async def publish_job_progress(self, user_id: uuid.UUID, job_data: dict) -> int:
 
         Returns:
             Number of subscribers that received the message.
+
         """
         client = await self.get_client()
         channel = self.get_progress_channel_for_user(user_id)
@@ -157,6 +162,7 @@ async def _listen(
 
         Yields:
             Parsed JSON dict from each pub/sub message.
+
         """
         client = await self.get_client()
         if not await self._check_pool_health():
@@ -213,7 +219,7 @@ async def _listen(
                 await pubsub.unsubscribe(channel)
             except Exception as e:
                 logger.exception(
-                    "pubsub_unsubscribe_failed", channel=channel, name=log_name, error=str(e)
+                    "pubsub_unsubscribe_failed", channel=channel, name=log_name, error=str(e),
                 )
             await pubsub.close()
             logger.debug("pubsub_subscription_ended", channel=channel, name=log_name)
@@ -233,6 +239,7 @@ async def health_check(self) -> bool:
 
         Returns:
             True if Redis is reachable, False otherwise.
+
         """
         try:
             client = await self.get_client()
@@ -251,6 +258,7 @@ def get_pubsub_service() -> PubSubService:
 
     Returns:
         The global PubSubService instance.
+
     """
     global _pubsub_service
     if _pubsub_service is None:
diff --git a/app/services/user_service.py b/app/services/user_service.py
index b93d3342..9cf56871 100644
--- a/app/services/user_service.py
+++ b/app/services/user_service.py
@@ -7,6 +7,7 @@
 from sqlalchemy import select
 from sqlalchemy.exc import IntegrityError
 from sqlalchemy.ext.asyncio import AsyncSession
+from structlog.stdlib import BoundLogger
 
 from app.services.auth_service import hash_password, verify_password
 from app.utils.username import default_username_from_email
@@ -93,7 +94,9 @@ def _downloads_base_path() -> str:
     return os.path.join(settings.storage_path, "downloads")
 
 
-def _cleanup_job_files(jobs: list[DownloadJob], service_logger=logger) -> tuple[bool, list[str]]:
+def _cleanup_job_files(
+    jobs: list[DownloadJob], service_logger: BoundLogger = logger,
+) -> tuple[bool, list[str]]:
     """Clean download files for account deletion before database rows are removed."""
     file_cleanup_failures: list[str] = []
     for job in jobs:
@@ -140,7 +143,7 @@ async def register(self, email: str, password: str) -> User:
         self._validate_new_password(password)
         result = await self.db.execute(select(User).where(User.email == email, not_deleted()))
         if result.scalar_one_or_none() is not None:
-            raise DuplicateEmailError()
+            raise DuplicateEmailError
 
         user = User(
             id=uuid.uuid4(),
@@ -153,7 +156,7 @@ async def register(self, email: str, password: str) -> User:
             await self.db.commit()
         except IntegrityError as exc:
             await self.db.rollback()
-            raise DuplicateEmailError() from exc
+            raise DuplicateEmailError from exc
         except Exception:
             await self.db.rollback()
             raise
@@ -169,7 +172,7 @@ async def change_password(
         """Change the current user's password and invalidate existing tokens."""
         user = self._current_user()
         if not await verify_password(current_password, user.password_hash):
-            raise InvalidCurrentPasswordError()
+            raise InvalidCurrentPasswordError
         if new_password_confirm is not None and new_password != new_password_confirm:
             raise PasswordMismatchError("New passwords do not match")
         self._validate_new_password(new_password)
@@ -189,7 +192,7 @@ async def update_username(self, username: str) -> User:
         user = self._current_user()
         clean_username = username.strip()
         if len(clean_username) < 3:
-            raise InvalidUsernameError()
+            raise InvalidUsernameError
 
         user.username = clean_username
         try:
@@ -208,7 +211,7 @@ async def delete_account(
         """Delete the current user account after password and file-cleanup checks."""
         user = self._current_user()
         if confirm_text is not None and confirm_text.strip().upper() != "DELETE":
-            raise DeleteConfirmationError()
+            raise DeleteConfirmationError
         if not await verify_password(password, user.password_hash):
             raise InvalidCurrentPasswordError("Password is incorrect")
 
@@ -230,7 +233,7 @@ async def delete_account(
 
     def _current_user(self) -> User:
         if self.user is None or not self.user.is_active or self.user.deleted_at is not None:
-            raise UserNotAvailableError()
+            raise UserNotAvailableError
         return self.user
 
     @staticmethod
diff --git a/app/services/yt_dlp_service.py b/app/services/yt_dlp_service.py
index 124c859b..41a5a0ee 100644
--- a/app/services/yt_dlp_service.py
+++ b/app/services/yt_dlp_service.py
@@ -87,11 +87,26 @@ async def resolve_video_title(url: str) -> str | None:
         return None
 
     url_json = json.dumps(url)
+    platform = _get_platform(url)
+    cookies_opts = _build_cookies_opts()
+    cookies_opts_json = json.dumps(cookies_opts)
+
+    if platform in _COOKIE_REQUIRED_PLATFORMS and not cookies_opts:
+        logger.info(
+            "metadata_without_cookies",
+            platform=platform,
+            url=url[:80],
+            hint="Set YT_DLP_COOKIES_FILE or YT_DLP_COOKIES_BROWSER to enable cookies for this platform",
+        )
+
     script = f"""
 import sys
 import json
 import yt_dlp
 url = {url_json}
+cookies_opts = {cookies_opts_json}
+if "cookiesfrombrowser" in cookies_opts and isinstance(cookies_opts["cookiesfrombrowser"], list):
+    cookies_opts["cookiesfrombrowser"] = tuple(cookies_opts["cookiesfrombrowser"])
 try:
     ydl_opts = {{
         "quiet": True,
@@ -100,6 +115,7 @@ async def resolve_video_title(url: str) -> str | None:
         "socket_timeout": 10,
         "retries": 1,
     }}
+    ydl_opts.update(cookies_opts)
     with yt_dlp.YoutubeDL(ydl_opts) as ydl:
         info = ydl.extract_info(url, download=False)
         sanitized = ydl.sanitize_info(info)
@@ -126,7 +142,8 @@ async def resolve_video_title(url: str) -> str | None:
             )
 
             stdout_bytes, _ = await asyncio.wait_for(
-                process.communicate(), timeout=YT_DLP_METADATA_TIMEOUT
+                process.communicate(),
+                timeout=YT_DLP_METADATA_TIMEOUT,
             )
 
         if process.returncode != 0:
@@ -160,6 +177,7 @@ async def _kill_process_group(process: asyncio.subprocess.Process, graceful: boo
         graceful: If True, sends SIGTERM first and waits 5s for clean shutdown.
                   If False, skips straight to SIGKILL (for use when SIGTERM
                   was already sent by the caller, e.g. the timeout handler).
+
     """
     if process.returncode is not None:
         return
@@ -196,7 +214,8 @@ async def _walk_and_kill_orphaned_children(process: asyncio.subprocess.Process)
         children_text: str | None = None
         try:
             children_text = await asyncio.get_running_loop().run_in_executor(
-                None, lambda: open(children_path).read()
+                None,
+                lambda: open(children_path).read(),
             )
         except (FileNotFoundError, PermissionError, ProcessLookupError, OSError):
             return
@@ -220,7 +239,7 @@ def _extract_error_message(error_msg: str, fallback: str) -> str:
         stripped = error_line.strip()
         if "ERROR" in stripped or "error" in stripped.lower():
             return stripped
-    return fallback if fallback else error_msg
+    return fallback or error_msg
 
 
 def _sanitize_title(title: str) -> str:
@@ -234,29 +253,129 @@ def _sanitize_title(title: str) -> str:
     return sanitized or "download"
 
 
-def _service_from_url(url: str) -> str:
-    """Derive throttle-tracking service name from a URL.
+_YOUTUBE_DOMAINS = frozenset(
+    {"youtube.com", "www.youtube.com", "m.youtube.com", "music.youtube.com"},
+)
+_YOUTUBE_SHORT_DOMAINS = frozenset({"youtu.be"})
+_YOUTUBE_NOCOOKIE = frozenset({"youtube-nocookie.com", "www.youtube-nocookie.com"})
+_VIMEO_HOSTS = frozenset({"vimeo.com", "www.vimeo.com"})
+_DAILYMOTION_HOSTS = frozenset({"dailymotion.com", "www.dailymotion.com"})
+_TWITCH_HOSTS = frozenset({"twitch.tv", "www.twitch.tv", "m.twitch.tv", "clips.twitch.tv"})
+_TIKTOK_HOSTS = frozenset(
+    {"tiktok.com", "www.tiktok.com", "m.tiktok.com", "vm.tiktok.com", "tiktokv.com"},
+)
+_INSTAGRAM_HOSTS = frozenset({"instagram.com", "www.instagram.com", "instagr.am"})
+
+
+def _get_platform(url: str) -> str:
+    """Detect the media platform from a URL hostname using exact domain matching.
 
-    This is a best-effort extraction for metric labels only (not security-critical).
-    Defaults to 'youtube' for backward compatibility.
+    Returns a string key used for throttling metrics, extractor args,
+    format chains, and cookie requirements. Unknown/unrecognizable hosts
+    default to 'youtube' while subdomain-bypass attempts return 'unknown'.
     """
-    hostname = urlparse(url).hostname or ""
-    hostname = hostname.lower()
-    if "youtube" in hostname or "youtu.be" in hostname:
+    hostname = (urlparse(url).hostname or "").lower()
+    if not hostname:
+        return "youtube"
+
+    youtube_all = _YOUTUBE_DOMAINS | _YOUTUBE_SHORT_DOMAINS | _YOUTUBE_NOCOOKIE
+
+    def _host_matches(domains: frozenset[str]) -> bool:
+        return hostname in domains or any(hostname.endswith("." + d) for d in domains)
+
+    if _host_matches(youtube_all):
         return "youtube"
-    if "vimeo" in hostname:
+    if _host_matches(_VIMEO_HOSTS):
         return "vimeo"
-    if "dailymotion" in hostname:
+    if _host_matches(_DAILYMOTION_HOSTS):
         return "dailymotion"
-    if "twitch" in hostname:
+    if _host_matches(_TWITCH_HOSTS):
         return "twitch"
-    if "tiktok" in hostname:
+    if _host_matches(_TIKTOK_HOSTS):
         return "tiktok"
-    if "instagram" in hostname:
+    if _host_matches(_INSTAGRAM_HOSTS):
         return "instagram"
+    # Subdomain-bypass detection: a hostname like youtube.com.evil.com
+    # contains a platform domain but doesn't end with a valid suffix.
+    # Truly unknown domains (e.g. example.com) default to "youtube"
+    # since yt-dlp handles most URLs.
+    all_platform_domains = (
+        youtube_all
+        | _VIMEO_HOSTS
+        | _DAILYMOTION_HOSTS
+        | _TWITCH_HOSTS
+        | _TIKTOK_HOSTS
+        | _INSTAGRAM_HOSTS
+    )
+    for domain in all_platform_domains:
+        if hostname.startswith(domain + ".") or hostname.endswith("." + domain):
+            return "unknown"
     return "youtube"
 
 
+# Alias for backward compatibility — throttle-tracking uses the same platform key.
+_service_from_url = _get_platform
+
+
+def _build_cookies_opts() -> dict:
+    """Build cookies-related yt-dlp options from environment configuration.
+
+    Supports two modes (checked in order):
+    1. YT_DLP_COOKIES_FILE — path to a Netscape-format cookies file
+    2. YT_DLP_COOKIES_BROWSER — browser name for cookiesfrombrowser (e.g. chrome, firefox)
+
+    Returns an empty dict if neither is configured or the cookie file doesn't exist.
+    Logs a warning when the configured cookie file path is absent from disk.
+    """
+    opts: dict = {}
+    cookies_file = os.environ.get("YT_DLP_COOKIES_FILE", "").strip()
+    cookies_browser = os.environ.get("YT_DLP_COOKIES_BROWSER", "").strip()
+
+    if cookies_file:
+        resolved = os.path.abspath(cookies_file)
+        if os.path.isfile(resolved):
+            opts["cookiefile"] = resolved
+        else:
+            logger.warning(
+                "cookies_file_not_found",
+                configured=cookies_file,
+                resolved=resolved,
+                hint="Set YT_DLP_COOKIES_FILE to an existing Netscape-format cookies file",
+            )
+    elif cookies_browser:
+        opts["cookiesfrombrowser"] = (cookies_browser,)
+
+    return opts
+
+
+# Non-YouTube platforms use single-stream formats with no merging semantics.
+_GENERIC_FORMAT_CHAIN: list[dict] = [
+    {"format": "best", "format_sort": ["quality"]},
+]
+
+_PLATFORM_FORMAT_CHAINS: dict[str, list[dict]] = {
+    "youtube": FORMAT_FALLBACK_CHAIN,
+    "tiktok": _GENERIC_FORMAT_CHAIN,
+    "instagram": _GENERIC_FORMAT_CHAIN,
+    "vimeo": _GENERIC_FORMAT_CHAIN,
+    "dailymotion": _GENERIC_FORMAT_CHAIN,
+    "twitch": _GENERIC_FORMAT_CHAIN,
+}
+
+# Extractor args per platform. Only YouTube benefits from player-client hints.
+_PLATFORM_EXTRACTOR_ARGS: dict[str, dict] = {
+    "youtube": {
+        "youtube": {
+            "player_client": ["tv", "web", "default", "mobile"],
+        },
+    },
+}
+
+# Platforms that require cookies for reliable extraction. Cookies are included
+# automatically when configured via YT_DLP_COOKIES_FILE or YT_DLP_COOKIES_BROWSER.
+_COOKIE_REQUIRED_PLATFORMS = frozenset({"tiktok", "instagram"})
+
+
 async def _check_throttle(stderr_text: str, service: str = "youtube") -> None:
     """Parse stderr for HTTP 429 pattern and record response if found.
 
@@ -276,14 +395,15 @@ async def _extract_via_subprocess(
     output_template: str,
     progress_callback: Callable[[dict], Awaitable[None]] | None = None,
 ) -> dict:
-    """
-    Extract media info via subprocess that can be forcibly killed on timeout.
+    """Extract media info via subprocess that can be forcibly killed on timeout.
 
     This runs yt-dlp as a separate OS process so that on TimeoutError,
     process.kill() can terminate it immediately rather than leaving a thread running.
 
-    Uses a format fallback chain to handle "Requested format is not available" errors
-    that occur when YouTube doesn't have the exact formats needed for merging.
+    Uses a platform-specific format fallback chain. For YouTube this handles
+    "Requested format is not available" errors when the platform lacks the
+    exact formats needed for merging. Non-YouTube platforms use simple
+    single-stream format selection.
 
     When progress_callback is provided, the subprocess emits download progress JSON
     lines via stdout, which are parsed and forwarded to the callback in real time.
@@ -292,10 +412,35 @@ async def _extract_via_subprocess(
 
     url_json = json.dumps(url)
     output_template_json = json.dumps(output_template)
-    fallback_chain_json = json.dumps(FORMAT_FALLBACK_CHAIN)
+    platform = _get_platform(url)
+    platform_json = json.dumps(platform)
+    cookies_opts = _build_cookies_opts()
+    cookies_opts_json = json.dumps(cookies_opts)
+    fallback_chain = _PLATFORM_FORMAT_CHAINS.get(platform, FORMAT_FALLBACK_CHAIN)
+    fallback_chain_json = json.dumps(fallback_chain)
+    extractor_args = _PLATFORM_EXTRACTOR_ARGS.get(platform, {})
+    extractor_args_json = json.dumps(extractor_args)
+
+    if platform in _COOKIE_REQUIRED_PLATFORMS and not cookies_opts:
+        logger.info(
+            "extraction_without_cookies",
+            platform=platform,
+            url=url[:80],
+            hint="Set YT_DLP_COOKIES_FILE or YT_DLP_COOKIES_BROWSER to enable cookies for this platform",
+        )
 
     output_fields_json = json.dumps(list(_OUTPUT_FIELDS))
 
+    # Only inject youtube-specific options when building the script for YouTube.
+    # Tests assert that non-YouTube platform scripts do not contain YouTube-only keys.
+    # Embedding them as dict entries keeps the options inside the ydl_opts dict definition.
+    if platform == "youtube":
+        youtube_opts = (
+            '            "prefer_free_formats": True,\n            "check_formats": "missable",\n'
+        )
+    else:
+        youtube_opts = ""
+
     extract_script = f"""
 import sys
 import json
@@ -303,9 +448,15 @@ async def _extract_via_subprocess(
 
 url = {url_json}
 output_template = {output_template_json}
+platform = {platform_json}
 fallback_chain = {fallback_chain_json}
+extractor_args = {extractor_args_json}
+cookies_opts = {cookies_opts_json}
 output_fields = {output_fields_json}
 
+if "cookiesfrombrowser" in cookies_opts and isinstance(cookies_opts["cookiesfrombrowser"], list):
+    cookies_opts["cookiesfrombrowser"] = tuple(cookies_opts["cookiesfrombrowser"])
+
 last_error = None
 _last_progress_pct = -1.0
 
@@ -328,7 +479,7 @@ def _progress_hook(d):
         }}), flush=True)
 
 for i, format_spec in enumerate(fallback_chain):
-    _last_progress_pct = -1.0  # reset so each fallback attempt reports fresh progress
+    _last_progress_pct = -1.0
     ydl_opts = {{
         "format": format_spec["format"],
         "format_sort": format_spec.get("format_sort", []),
@@ -338,15 +489,11 @@ def _progress_hook(d):
         "noprogress": True,
         "socket_timeout": 60,
         "retries": 3,
-        "prefer_free_formats": True,
-        "check_formats": "missable",
         "progress_hooks": [_progress_hook],
-        "extractor_args": {{
-            "youtube": {{
-                "player_client": ["tv", "web", "default", "mobile"],
-            }},
-        }},
-    }}
+{youtube_opts}    }}
+    ydl_opts.update(cookies_opts)
+    if extractor_args:
+        ydl_opts["extractor_args"] = extractor_args
 
     try:
         with yt_dlp.YoutubeDL(ydl_opts) as ydl:
@@ -368,7 +515,7 @@ def _progress_hook(d):
 
 attempted_formats = [spec["format"] for spec in fallback_chain]
 print(json.dumps({{
-    "error": f"All formats failed. Last error: {{last_error}}. Attempted formats: {{attempted_formats}}"
+    "error": f"[{{platform}}] All formats failed. Last error: {{last_error}}. Attempted formats: {{attempted_formats}}"
 }}))
 sys.exit(1)
 """
@@ -388,8 +535,10 @@ def _progress_hook(d):
             limit=_STREAM_READER_LIMIT,
         )
 
-        async def _read_stdout():
+        async def _read_stdout() -> None:
             nonlocal result, error_result
+            if process.stdout is None:
+                return
             async for line_bytes in process.stdout:
                 line = line_bytes.decode().strip()
                 if not line:
@@ -405,7 +554,9 @@ async def _read_stdout():
                 except json.JSONDecodeError:
                     logger.warning("stdout_non_json_line", line=line[:200])
 
-        async def _read_stderr():
+        async def _read_stderr() -> None:
+            if process.stderr is None:
+                return
             async for line_bytes in process.stderr:
                 stderr_lines.append(line_bytes.decode().strip())
 
@@ -456,7 +607,7 @@ async def _read_stderr():
             return result
 
         if process.returncode != 0:
-            error_msg = stderr_text if stderr_text else "Unknown error"
+            error_msg = stderr_text or "Unknown error"
             error_msg = _extract_error_message(error_msg, "")
             if not error_msg:
                 error_msg = "Unknown error"
@@ -474,8 +625,11 @@ async def extract_media_url(
     storage_path: str,
     progress_callback: Callable[[dict], Awaitable[None]] | None = None,
 ) -> tuple[str, str, str | None]:
-    """
-    Extract media URL from a YouTube URL using yt-dlp.
+    """Extract media from a video URL using yt-dlp.
+
+    Supports YouTube, Vimeo, Dailymotion, Twitch, TikTok, and Instagram.
+    Non-YouTube platforms (especially TikTok and Instagram) may require
+    cookies configured via YT_DLP_COOKIES_FILE or YT_DLP_COOKIES_BROWSER.
 
     Args:
         url: The video URL to extract.
@@ -490,6 +644,7 @@ async def extract_media_url(
         StorageError: If the download directory cannot be created or path is invalid.
         SSRFError: If the URL resolves to a private/internal IP address.
         asyncio.TimeoutError: If the extraction takes longer than YT_DLP_TIMEOUT.
+
     """
     download_dir = os.path.join(storage_path, "downloads")
     try:
@@ -506,13 +661,15 @@ async def extract_media_url(
     # Extraction semaphore prevents OOM from N concurrent ~50-100MB processes.
     async with _EXTRACTION_SEMAPHORE:
         info = await _extract_via_subprocess(
-            url, output_template, progress_callback=progress_callback
+            url,
+            output_template,
+            progress_callback=progress_callback,
         )
 
     title: str | None = info.get("title") or None
     ext = info.get("ext") or "mp4"
     # Sanitize title for display only — never used in filesystem path
-    safe_title = _sanitize_title(str(title if title else file_id))
+    safe_title = _sanitize_title(str(title or file_id))
     file_name = f"{safe_title}.{ext}"
     file_path = os.path.join(download_dir, f"{file_id}.{ext}")
 
diff --git a/app/templates/dashboard.html b/app/templates/dashboard.html
index 1258af24..1843f0c8 100644
--- a/app/templates/dashboard.html
+++ b/app/templates/dashboard.html
@@ -51,8 +51,6 @@ <h2 class="text-lg font-display font-semibold text-white mb-1 leading-tight">New
       hx-swap="afterbegin"
       hx-indicator="#submit-spinner"
       hx-sync="this:drop"
-      hx-on:htmx:after-request="if(event.detail.successful) { document.querySelector('#download-error').innerHTML = ''; document.getElementById('new-download-url').value = ''; }"
-      hx-on:htmx:response-error="document.querySelector('#download-error').innerHTML = ''; document.querySelector('#download-error').insertAdjacentHTML('beforeend', event.detail.xhr.response)"
       class="flex flex-col sm:flex-row gap-3"
     >
       <input type="hidden" name="csrf_token" value="{{ csrf_token }}" />
@@ -165,5 +163,28 @@ <h2 class="text-lg font-display font-semibold text-white leading-tight">Download
 
 {% block extra_scripts %}
 <script id="status-badge-templates" type="application/json">{{ status_badge_templates_json() | safe }}</script>
+<script nonce="{{ nonce }}">
+  (function () {
+    var form = document.getElementById('download-form');
+    if (!form) return;
+
+    form.addEventListener('htmx:afterRequest', function (event) {
+      if (event.detail.successful) {
+        var errorEl = document.getElementById('download-error');
+        if (errorEl) errorEl.innerHTML = '';
+        var urlInput = document.getElementById('new-download-url');
+        if (urlInput) urlInput.value = '';
+      }
+    });
+
+    form.addEventListener('htmx:responseError', function (event) {
+      var errorEl = document.getElementById('download-error');
+      if (errorEl) {
+        errorEl.innerHTML = '';
+        errorEl.insertAdjacentHTML('beforeend', event.detail.xhr.response);
+      }
+    });
+  })();
+</script>
 <script src="/static/js/dashboard.js" defer></script>
 {% endblock %}
diff --git a/app/templates/slides/presentation.html b/app/templates/slides/presentation.html
index 13a6ed45..1bf37e0c 100644
--- a/app/templates/slides/presentation.html
+++ b/app/templates/slides/presentation.html
@@ -9,7 +9,7 @@
 <link rel="preconnect" href="https://fonts.googleapis.com"/>
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin/>
 <link href="https://fonts.googleapis.com/css2?family=DM+Sans:opsz,wght@9..40,300;9..40,400;9..40,500;9..40,600&family=JetBrains+Mono:wght@400;500;700&family=Outfit:wght@400;500;600;700;800;900&display=swap" rel="stylesheet"/>
-<style>
+<style nonce="{{ nonce }}">
 *,*::before,*::after{box-sizing:border-box;margin:0;padding:0}
 
 :root {
@@ -250,6 +250,11 @@
 svg text.f-title{font-family:var(--font-display);font-weight:700;font-size:clamp(10px,1.2vw,15px)}
 svg text.f-label{font-family:var(--font-mono);font-size:clamp(9px,1vw,13px);fill:var(--text-tertiary);letter-spacing:.05em}
 svg text.f-detail{font-family:var(--font-mono);font-size:clamp(8px,.9vw,12px);fill:var(--text-tertiary)}
+
+/* Inline styles extracted for CSP strict-dynamic — was inline style= attributes */
+.slide-1 .orb-a{opacity:.03}
+.slide-2 .orb-a{opacity:.02;top:-10%;right:-25%}
+#spotlight{left:1%;top:3%;width:84%;height:25%}
 </style>
 </head>
 <body>
@@ -281,7 +286,7 @@
 <!-- ═══════════════════════════════════════ -->
 <div class="slide slide-1 active" data-index="0">
   <div class="orb orb-r"></div>
-  <div class="orb orb-a" style="opacity:.03"></div>
+  <div class="orb orb-a"></div>
 
   <h1 class="hero-title">
     <span class="dim">Every downloader</span><br>
@@ -323,7 +328,7 @@ <h3>No Observability</h3>
 <!-- ═══════════════════════════════════════ -->
 <div class="slide slide-2" data-index="1">
   <div class="orb orb-t"></div>
-  <div class="orb orb-a" style="opacity:.02;top:-10%;right:-25%"></div>
+  <div class="orb orb-a"></div>
 
   <div class="arch-header">Resilience Architecture — Recovery Flow</div>
 
@@ -331,7 +336,7 @@ <h3>No Observability</h3>
     <!-- Focus label positioned above spotlight -->
     <div class="focus-label visible" id="focus-label">Happy Path — Normal Operation</div>
     <!-- Spotlight window -->
-    <div class="spotlight" id="spotlight" style="left:1%;top:3%;width:84%;height:25%"></div>
+    <div class="spotlight" id="spotlight"></div>
 
     <svg viewBox="0 0 980 540" xmlns="http://www.w3.org/2000/svg">
       <defs>
@@ -524,7 +529,7 @@ <h3>No Observability</h3>
 <!-- ========================================== -->
 <!-- CONTROLLER SCRIPT                          -->
 <!-- ========================================== -->
-<script>
+<script nonce="{{ nonce }}">
 (function(){
   /* ── STATE ── */
   const slides = document.querySelectorAll('.slide');
diff --git a/app/utils/demo_urls.py b/app/utils/demo_urls.py
index 6659ae7c..8cd34097 100644
--- a/app/utils/demo_urls.py
+++ b/app/utils/demo_urls.py
@@ -1,5 +1,4 @@
-"""
-Pool of demo video URLs for live demo auto-submission.
+"""Pool of demo video URLs for live demo auto-submission.
 
 These are well-known, stable URLs used to demonstrate the download pipeline
 during live presentations. URLs are sourced from publicly available content.
diff --git a/app/utils/validators.py b/app/utils/validators.py
index 8a051215..900c9559 100644
--- a/app/utils/validators.py
+++ b/app/utils/validators.py
@@ -3,6 +3,7 @@
 import socket
 import urllib.error
 import urllib.request
+from typing import Any
 from urllib.parse import urlparse
 
 from core.logging_config import get_logger
@@ -147,11 +148,19 @@ async def _check_redirect_target(url: str) -> bool:
     """
 
     class _NoFollowRedirects(urllib.request.HTTPRedirectHandler):
-        def redirect_request(self, req, fp, code, msg, headers, newurl):
-            req._redirect_target = newurl  # stash for inspection
+        def redirect_request(
+            self,
+            req: urllib.request.Request,
+            fp: Any,
+            code: int,
+            msg: str,
+            headers: Any,
+            newurl: str,
+        ) -> urllib.request.Request | None:
+            req._redirect_target = newurl  # type: ignore[attr-defined]
             raise urllib.error.HTTPError(url, code, "SSRF redirect check", headers, fp)
 
-    def _check():
+    def _check() -> bool:
         opener = urllib.request.build_opener(_NoFollowRedirects)
         req = urllib.request.Request(url, method="HEAD")
         req.add_header("User-Agent", "Mozilla/5.0")
@@ -167,7 +176,7 @@ def _check():
                     if target:
                         addrs = socket.getaddrinfo(target, None, type=socket.SOCK_STREAM)
                         for _family, _type, _proto, _cname, sockaddr in addrs:
-                            if _is_private_ip(sockaddr[0]):
+                            if _is_private_ip(str(sockaddr[0])):
                                 return False
             # Non-redirect HTTP errors are fine — doesn't affect SSRF check
         except (urllib.error.URLError, TimeoutError, OSError):
@@ -228,7 +237,7 @@ async def validate_url_not_ssrf(url: str) -> bool:
         "admin123",
         "test1234",
         "changeme",
-    }
+    },
 )
 
 
diff --git a/core/config.py b/core/config.py
index 18377529..e35ccd6c 100644
--- a/core/config.py
+++ b/core/config.py
@@ -72,6 +72,15 @@ class Settings(BaseSettings):
     throttle_risk_threshold_scale: int = 10
     throttle_risk_threshold: float = 0.7
 
+    # Browser downloader microservice (Phase 2 worker integration).
+    # When disabled (default), the worker routes all jobs to yt-dlp,
+    # matching pre-Phase-2 behavior. P4 will expand the rest of the
+    # surface (image, sandbox_runtime, recording fallback).
+    browser_downloader_enabled: bool = False
+    browser_downloader_endpoint: str = "http://browser-downloader:3000"
+    browser_downloader_timeout: int = 300
+    browser_downloader_cb_use_redis: bool = False
+
     # Used to construct DATABASE_URL if not set directly
     db_user: str = "postgres"
     db_password: str = ""
@@ -104,6 +113,7 @@ def validate_and_construct(self) -> "Settings":
         self._build_database_url()
         self._validate_secret_key()
         self._validate_cors()
+        self._validate_browser_downloader()
         self._resolve_storage()
         self._build_redis_url()
         return self
@@ -172,7 +182,7 @@ def _build_database_url(self) -> None:
             raise ValueError(
                 "Either DATABASE_URL or DB_PASSWORD must be set. "
                 "For Docker: set DB_PASSWORD in .env. "
-                "For local dev: set DATABASE_URL in .env."
+                "For local dev: set DATABASE_URL in .env.",
             )
         encoded_password = quote_plus(self.db_password)
         self.database_url = (
@@ -184,7 +194,7 @@ def _validate_secret_key(self) -> None:
         if not self.secret_key:
             raise ValueError(
                 "SECRET_KEY is required. "
-                'Generate one with: python -c "import secrets; print(secrets.token_hex(32))"'
+                'Generate one with: python -c "import secrets; print(secrets.token_hex(32))"',
             )
 
         if len(self.secret_key) < 32:
@@ -195,7 +205,7 @@ def _validate_secret_key(self) -> None:
             raise ValueError(
                 "SECRET_KEY has insufficient entropy "
                 f"(~{entropy_per_char:.1f} bits/char, need >= 2.9). "
-                'Generate a secure key with: python -c "import secrets; print(secrets.token_hex(32))"'
+                'Generate a secure key with: python -c "import secrets; print(secrets.token_hex(32))"',
             )
 
     def _validate_cors(self) -> None:
@@ -252,5 +262,24 @@ def _build_redis_url(self) -> None:
         else:
             self.redis_url = f"redis://{self.redis_host}:{self.redis_port}"
 
+    def _validate_browser_downloader(self) -> None:
+        if self.browser_downloader_timeout < 1:
+            raise ValueError(
+                f"Invalid BROWSER_DOWNLOADER_TIMEOUT: {self.browser_downloader_timeout!r} must be >= 1",
+            )
+        if not self.browser_downloader_endpoint:
+            raise ValueError("BROWSER_DOWNLOADER_ENDPOINT must be a non-empty URL")
+        try:
+            parsed = urlparse(self.browser_downloader_endpoint)
+        except ValueError as exc:
+            raise ValueError(
+                f"Invalid BROWSER_DOWNLOADER_ENDPOINT: {self.browser_downloader_endpoint!r}",
+            ) from exc
+        if parsed.scheme not in {"http", "https"} or not parsed.netloc:
+            raise ValueError(
+                f"Invalid BROWSER_DOWNLOADER_ENDPOINT: {self.browser_downloader_endpoint!r} "
+                "must be an http(s) URL with a host",
+            )
+
 
 settings = Settings()
diff --git a/core/database.py b/core/database.py
index 41e662e9..5adf3cf0 100644
--- a/core/database.py
+++ b/core/database.py
@@ -5,8 +5,15 @@
 the engine is created with the correct configuration.
 """
 
+from collections.abc import AsyncGenerator
+
 from sqlalchemy.engine import make_url
-from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
+from sqlalchemy.ext.asyncio import (
+    AsyncEngine,
+    AsyncSession,
+    async_sessionmaker,
+    create_async_engine,
+)
 
 from core.config import settings
 from core.models.base import Base as CoreBase
@@ -21,10 +28,10 @@ class _EngineFactory:
     """
 
     def __init__(self) -> None:
-        self._engine = None
-        self._async_session_factory = None
+        self._engine: AsyncEngine | None = None
+        self._async_session_factory: async_sessionmaker[AsyncSession] | None = None
 
-    def get_engine(self):
+    def get_engine(self) -> AsyncEngine:
         """Get or create the async engine (lazy initialization)."""
         if self._engine is None:
             self._engine = create_async_engine(
@@ -48,11 +55,11 @@ def _pool_kwargs(self) -> dict[str, int]:
             "pool_timeout": settings.db_pool_timeout,
         }
 
-    def get_async_session_factory(self):
+    def get_async_session_factory(self) -> async_sessionmaker[AsyncSession]:
         """Get or create the async session factory (lazy initialization)."""
         if self._async_session_factory is None:
             self._async_session_factory = async_sessionmaker(
-                self.get_engine(), class_=AsyncSession, expire_on_commit=False
+                self.get_engine(), class_=AsyncSession, expire_on_commit=False,
             )
         return self._async_session_factory
 
@@ -60,17 +67,17 @@ def get_async_session_factory(self):
 _factory = _EngineFactory()
 
 
-def get_engine():
+def get_engine() -> AsyncEngine:
     """Get or create the async engine (lazy initialization)."""
     return _factory.get_engine()
 
 
-def get_async_session_factory():
+def get_async_session_factory() -> async_sessionmaker[AsyncSession]:
     """Get or create the async session factory (lazy initialization)."""
     return _factory.get_async_session_factory()
 
 
-async def get_async_session():
+async def get_async_session() -> AsyncGenerator[AsyncSession, None]:
     """FastAPI dependency that yields an async database session."""
     async with _factory.get_async_session_factory()() as session:
         yield session
diff --git a/core/logging_config.py b/core/logging_config.py
index 1d26abf9..b84046bc 100644
--- a/core/logging_config.py
+++ b/core/logging_config.py
@@ -76,6 +76,7 @@ def configure_logging(log_level: str = "INFO") -> None:
 
     Args:
         log_level: Minimum log level to output (default: INFO)
+
     """
     is_production = os.environ.get("ENVIRONMENT", "development") == "production"
 
@@ -172,6 +173,7 @@ def get_logger(name: str | None = None, **kwargs: Any) -> "BoundLogger":
         from structlog.contextvars import bind_contextvars
         with bind_contextvars(user_id=123, request_id="abc"):
             logger.info("within_context")  # Includes both user_id and request_id
+
     """
     logger = structlog.get_logger(name)
     if kwargs:
diff --git a/core/metrics.py b/core/metrics.py
index 45f967f5..493ad54c 100644
--- a/core/metrics.py
+++ b/core/metrics.py
@@ -32,6 +32,12 @@
     "Number of pending outbox entries",
 )
 
+OUTBOX_OLDEST_PENDING_SECONDS = Gauge(
+    "ytprocessor_outbox_oldest_pending_seconds",
+    "Age in seconds of the oldest pending outbox entry. "
+    "Saturation above the worker outbox_sync_interval indicates relay stall.",
+)
+
 HTTP_REQUESTS = Counter(
     "ytprocessor_http_requests_total",
     "Total HTTP requests",
@@ -164,6 +170,7 @@ def init_metrics() -> None:
     "JOBS_COMPLETED",
     "JOBS_CREATED",
     "JOB_DURATION_SECONDS",
+    "OUTBOX_OLDEST_PENDING_SECONDS",
     "OUTBOX_PENDING",
     "QUEUE_DEPTH",
     "RECOVERIES",
diff --git a/core/models/download_job.py b/core/models/download_job.py
index 5f8e8b0a..30ee8139 100644
--- a/core/models/download_job.py
+++ b/core/models/download_job.py
@@ -22,14 +22,14 @@ class DownloadJob(Base):
 
     id: Mapped[uuid.UUID] = mapped_column(UUID(as_uuid=True), primary_key=True)
     user_id: Mapped[uuid.UUID] = mapped_column(
-        UUID(as_uuid=True), ForeignKey("users.id", ondelete="CASCADE"), nullable=False
+        UUID(as_uuid=True), ForeignKey("users.id", ondelete="CASCADE"), nullable=False,
     )
     user: Mapped[User] = relationship("User", back_populates="download_jobs")
     failed_job: Mapped[FailedJob | None] = relationship(
-        "FailedJob", back_populates="original_job", uselist=False
+        "FailedJob", back_populates="original_job", uselist=False,
     )
     outbox_entries: Mapped[list[Outbox]] = relationship(
-        "Outbox", back_populates="job", cascade="all, delete-orphan"
+        "Outbox", back_populates="job", cascade="all, delete-orphan",
     )
     url: Mapped[str] = mapped_column(Text, nullable=False)
     status: Mapped[str] = mapped_column(String(20), default="pending")
@@ -50,5 +50,5 @@ class DownloadJob(Base):
     )
     completed_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
     expires_at: Mapped[datetime | None] = mapped_column(
-        DateTime(timezone=True), nullable=True, index=True
+        DateTime(timezone=True), nullable=True, index=True,
     )
diff --git a/core/models/failed_job.py b/core/models/failed_job.py
index d1880d2d..b5d78c33 100644
--- a/core/models/failed_job.py
+++ b/core/models/failed_job.py
@@ -47,5 +47,5 @@ class FailedJob(Base):
     created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), server_default=func.now())
     failed_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), server_default=func.now())
     expires_at: Mapped[datetime | None] = mapped_column(
-        DateTime(timezone=True), nullable=True, index=True
+        DateTime(timezone=True), nullable=True, index=True,
     )
diff --git a/core/models/outbox.py b/core/models/outbox.py
index 751fcbd4..a29758a5 100644
--- a/core/models/outbox.py
+++ b/core/models/outbox.py
@@ -15,26 +15,54 @@
     from core.models.download_job import DownloadJob
 
 
+_PENDING_STATUS = "pending"
+
+
 class Outbox(Base):
     """Transactional outbox for reliable job enqueueing.
 
-    Jobs are written here in the same transaction as the DownloadJob,
-    then the worker processes them and marks them as processed.
-    This guarantees atomicity - if DB commits, the job is in the outbox.
+    Lifecycle:
+
+    - ``pending``   - written in the same DB transaction as the entity change
+                      it represents. The relay picks it up and pushes the
+                      corresponding Redis message.
+    - ``processed`` - the relay successfully delivered the message. ``processed_at``
+                      is set; the row is retained for observability and audit,
+                      then reaped by ``cleanup_stale_outbox_entries`` after the
+                      retention window expires.
+    - ``failed``    - the relay could not deliver the message after exhausting
+                      retries. The row is retained so operators can inspect.
+
+    The partial unique index ``uq_outbox_pending_job_id`` ensures that at most
+    one *pending* row exists per ``job_id`` at any time. This prevents the
+    duplicate-processing window that the previous SELECT-then-INSERT
+    idempotency check had under concurrent writers.
     """
 
     __tablename__ = "outbox"
 
     id: Mapped[uuid.UUID] = mapped_column(UUID(as_uuid=True), primary_key=True)
     job_id: Mapped[uuid.UUID] = mapped_column(
-        UUID(as_uuid=True), ForeignKey("download_jobs.id"), nullable=False, index=True
+        UUID(as_uuid=True),
+        ForeignKey("download_jobs.id"),
+        nullable=False,
+        index=True,
     )
     event_type: Mapped[str] = mapped_column(String(50), nullable=False)
     payload: Mapped[str | None] = mapped_column(Text, nullable=True)
-    status: Mapped[str] = mapped_column(String(20), default="pending", index=True)
+    status: Mapped[str] = mapped_column(String(20), default=_PENDING_STATUS, index=True)
     created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), server_default=func.now())
     processed_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
 
     job: Mapped[DownloadJob] = relationship("DownloadJob", back_populates="outbox_entries")
 
-    __table_args__ = (Index("ix_outbox_status_created_at", "status", "created_at"),)
+    __table_args__ = (
+        Index("ix_outbox_status_created_at", "status", "created_at"),
+        Index(
+            "uq_outbox_pending_job_id",
+            "job_id",
+            unique=True,
+            postgresql_where=(status == _PENDING_STATUS),
+            sqlite_where=(status == _PENDING_STATUS),
+        ),
+    )
diff --git a/core/models/user.py b/core/models/user.py
index e0c4b295..067b6e3e 100644
--- a/core/models/user.py
+++ b/core/models/user.py
@@ -4,7 +4,7 @@
 import uuid
 from typing import TYPE_CHECKING
 
-from sqlalchemy import Boolean, DateTime, Index, Integer, String, and_, text
+from sqlalchemy import Boolean, ColumnElement, DateTime, Index, Integer, String, and_, text
 from sqlalchemy.dialects.postgresql import UUID
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 from sqlalchemy.sql import column, func
@@ -15,7 +15,7 @@
     from core.models.download_job import DownloadJob
 
 
-def not_deleted():
+def not_deleted() -> ColumnElement[bool]:
     """Return a filter condition for non-deleted users."""
     return and_(User.deleted_at.is_(None))
 
@@ -37,12 +37,18 @@ class User(Base):
     password_hash: Mapped[str] = mapped_column(String(255), nullable=False)
     is_active: Mapped[bool] = mapped_column(Boolean, default=True)
     deleted_at: Mapped[datetime.datetime | None] = mapped_column(
-        DateTime(timezone=True), nullable=True, index=True
+        DateTime(timezone=True),
+        nullable=True,
+        index=True,
     )
     token_version: Mapped[int] = mapped_column(Integer, server_default=text("1"), default=1)
-    created_at: Mapped[DateTime] = mapped_column(DateTime(timezone=True), server_default=func.now())
-    updated_at: Mapped[DateTime] = mapped_column(
-        DateTime(timezone=True), server_default=func.now(), onupdate=func.now()
+    created_at: Mapped[datetime.datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now()
+    )
+    updated_at: Mapped[datetime.datetime] = mapped_column(
+        DateTime(timezone=True),
+        server_default=func.now(),
+        onupdate=func.now(),
     )
 
     download_jobs: Mapped[list[DownloadJob]] = relationship("DownloadJob", back_populates="user")
diff --git a/core/queue.py b/core/queue.py
index 89424b55..d66ff517 100644
--- a/core/queue.py
+++ b/core/queue.py
@@ -5,10 +5,16 @@
 deduplication to prevent duplicate job entries.
 """
 
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any
 from uuid import UUID
 
 from core.logging_config import get_logger
-from core.redis_client import get_redis_client
+from core.redis_client import close_redis_client, get_redis_client
+
+if TYPE_CHECKING:
+    import redis.asyncio as aioredis
 
 logger = get_logger(__name__)
 
@@ -21,19 +27,20 @@ class _LazyRedisClient:
     """
 
     def __init__(self) -> None:
-        self._client = None
+        self._client: aioredis.Redis | None = None
 
-    def _ensure(self):
+    def _ensure(self) -> aioredis.Redis:
         if self._client is None:
             self._client = get_redis_client()
+        assert self._client is not None
         return self._client
 
-    async def close(self):
+    async def close(self) -> None:
         if self._client is not None:
-            await self._client.close()
+            await close_redis_client()
             self._client = None
 
-    def __getattr__(self, name):
+    def __getattr__(self, name: str) -> Any:
         return getattr(self._ensure(), name)
 
 
diff --git a/core/redis_client.py b/core/redis_client.py
index f52ed2ff..61f8d932 100644
--- a/core/redis_client.py
+++ b/core/redis_client.py
@@ -8,6 +8,12 @@
 so connections are reused rather than created per call.
 """
 
+from __future__ import annotations
+
+from typing import cast
+
+import redis.asyncio as aioredis
+
 from core.logging_config import get_logger
 
 logger = get_logger(__name__)
@@ -40,7 +46,7 @@
 }
 
 
-def get_redis_client():
+def get_redis_client() -> aioredis.Redis:
     """Get or create the shared Redis client singleton.
 
     Returns the same client instance on every call. The client manages
@@ -51,9 +57,7 @@ def get_redis_client():
     redis-py's connection pool is not fork/process-safe.
     """
     if _redis_state["client"] is not None:
-        return _redis_state["client"]
-
-    import redis.asyncio as aioredis
+        return cast("aioredis.Redis", _redis_state["client"])
 
     from core.config import settings
 
@@ -64,18 +68,18 @@ def get_redis_client():
         socket_timeout=5,
         retry_on_timeout=False,
     )
-    return _redis_state["client"]
+    return cast("aioredis.Redis", _redis_state["client"])
 
 
-def reset_redis_client():
+def reset_redis_client() -> None:
     """Reset the singleton (for testing only)."""
     _redis_state["client"] = None
 
 
-async def close_redis_client():
+async def close_redis_client() -> None:
     """Close the shared Redis client connection pool."""
     if _redis_state["client"] is not None:
-        await _redis_state["client"].close()
+        await cast("aioredis.Redis", _redis_state["client"]).close()
         _redis_state["client"] = None
 
 
@@ -90,6 +94,7 @@ async def check_worker_health() -> bool:
     Returns:
         True if at least one worker health key exists (worker is alive).
         False if no health keys found or Redis is unreachable.
+
     """
     try:
         client = get_redis_client()
diff --git a/core/utils/security.py b/core/utils/security.py
index b3aa63fb..318ac374 100644
--- a/core/utils/security.py
+++ b/core/utils/security.py
@@ -13,13 +13,13 @@ def validate_path(base_path: str, target_path: str, check_writable: bool = False
     except ValueError as exc:
         raise ValueError(
             f"Path traversal detected: resolved path {resolved_target} "
-            f"is outside allowed directory {resolved_base}"
+            f"is outside allowed directory {resolved_base}",
         ) from exc
 
     if not contained:
         raise ValueError(
             f"Path traversal detected: resolved path {resolved_target} "
-            f"is outside allowed directory {resolved_base}"
+            f"is outside allowed directory {resolved_base}",
         )
 
     if check_writable:
diff --git a/entrypoint.sh b/entrypoint.sh
index 8c2ff2fb..6e8c1cd6 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-set -e
+set -euo pipefail
 
 error_exit() {
   echo "ERROR: $1" >&2
diff --git a/infra/nginx/nginx.production.conf b/infra/nginx/nginx.production.conf
index 82efb013..e346fd7f 100644
--- a/infra/nginx/nginx.production.conf
+++ b/infra/nginx/nginx.production.conf
@@ -34,7 +34,6 @@ server {
     add_header X-Frame-Options "DENY" always;
     add_header X-Content-Type-Options "nosniff" always;
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
-    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';" always;
 
     ssl_stapling on;
     ssl_stapling_verify on;
diff --git a/infra/nginx/nginx.ssl.local.conf b/infra/nginx/nginx.ssl.local.conf
index 7b9fa71c..71cd671d 100644
--- a/infra/nginx/nginx.ssl.local.conf
+++ b/infra/nginx/nginx.ssl.local.conf
@@ -105,7 +105,6 @@ server {
     add_header X-Frame-Options "DENY" always;
     add_header X-Content-Type-Options "nosniff" always;
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
-    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';" always;
 
     proxy_connect_timeout 60s;
     proxy_send_timeout 300s;
diff --git a/packages/browser-downloader/Dockerfile b/packages/browser-downloader/Dockerfile
new file mode 100644
index 00000000..43117e02
--- /dev/null
+++ b/packages/browser-downloader/Dockerfile
@@ -0,0 +1,48 @@
+# Browser downloader microservice — Phase 0.
+# Based on the Playwright glibc image (real Chromium + real fonts), with system
+# ffmpeg and streamlink for HLS/DASH. Runs as non-root UID 1000.
+FROM mcr.microsoft.com/playwright:v1.49.1-focal
+
+ENV DEBIAN_FRONTEND=noninteractive \
+    PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 \
+    PNPM_HOME=/tmp/pnpm \
+    PATH=/tmp/pnpm:$PATH \
+    NODE_ENV=production
+
+# System ffmpeg + streamlink + curl (for HEALTHCHECK).
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        ffmpeg \
+        curl \
+        ca-certificates \
+        python3 \
+        python3-pip \
+    && rm -rf /var/lib/apt/lists/* \
+    && pip3 install --no-cache-dir streamlink \
+    && npm install -g pnpm@10.33.2
+
+WORKDIR /app
+
+# Install production deps only. Skip scripts so the `playwright` package does
+# not re-download browsers that the base image already ships.
+COPY package.json ./
+RUN pnpm install --prod --ignore-scripts \
+    && rm -rf /root/.local/share/pnpm/store /tmp/pnpm/store
+
+COPY src ./src
+
+# Output bind-mount target + non-root ownership (UID/GID 1000).
+RUN mkdir -p /output \
+    && chown -R 1000:1000 /app /output
+
+USER 1000:1000
+
+ENV BD_OUTPUT_BASE=/output \
+    HOME=/home/pwuser
+
+EXPOSE 3000
+
+HEALTHCHECK --interval=30s --timeout=10s --start-period=20s --retries=3 \
+  CMD curl -fsS http://localhost:3000/health || exit 1
+
+CMD ["node", "src/server.js"]
diff --git a/packages/browser-downloader/package.json b/packages/browser-downloader/package.json
new file mode 100644
index 00000000..f6081034
--- /dev/null
+++ b/packages/browser-downloader/package.json
@@ -0,0 +1,25 @@
+{
+  "dependencies": {
+    "express": "^4.21.2",
+    "playwright": "1.49.1",
+    "playwright-extra": "^4.3.6",
+    "puppeteer-extra-plugin-stealth": "^2.11.2"
+  },
+  "description": "Standalone Node.js microservice that downloads non-YouTube media via Playwright stealth + CDP/DOM interception + streamlink.",
+  "devDependencies": {
+    "vitest": "^2.1.9"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "name": "browser-downloader",
+  "packageManager": "pnpm@10.33.2",
+  "private": true,
+  "scripts": {
+    "dev": "node --watch src/server.js",
+    "start": "node src/server.js",
+    "test": "vitest run"
+  },
+  "type": "module",
+  "version": "0.1.0"
+}
diff --git a/packages/browser-downloader/src/concurrency.js b/packages/browser-downloader/src/concurrency.js
new file mode 100644
index 00000000..d3f89566
--- /dev/null
+++ b/packages/browser-downloader/src/concurrency.js
@@ -0,0 +1,43 @@
+// Concurrency limiter. Each download request launches a full Chromium, so
+// unbounded concurrency causes OOM. This semaphore caps in-flight downloads at
+// `max` (default 2, matching YT_DLP_EXTRACTION_CONCURRENCY=2). Requests beyond
+// the limit are rejected synchronously so the HTTP layer can return 503
+// instead of queueing.
+
+export class ConcurrencyLimitError extends Error {
+  constructor(message = 'concurrency limit reached') {
+    super(message);
+    this.name = 'ConcurrencyLimitError';
+    this.statusCode = 503;
+    this.code = 'CONCURRENCY_LIMIT';
+  }
+}
+
+export function createSemaphore(max = 2) {
+  if (!Number.isInteger(max) || max <= 0) {
+    throw new TypeError('semaphore max must be a positive integer');
+  }
+  let active = 0;
+  return {
+    acquire() {
+      if (active >= max) {
+        throw new ConcurrencyLimitError();
+      }
+      active += 1;
+      let released = false;
+      return function release() {
+        if (released) {
+          return;
+        }
+        released = true;
+        active = Math.max(0, active - 1);
+      };
+    },
+    get active() {
+      return active;
+    },
+    get max() {
+      return max;
+    },
+  };
+}
diff --git a/packages/browser-downloader/src/downloader.js b/packages/browser-downloader/src/downloader.js
new file mode 100644
index 00000000..7500066c
--- /dev/null
+++ b/packages/browser-downloader/src/downloader.js
@@ -0,0 +1,114 @@
+// Orchestrator: validate inputs, launch stealth Chromium, try Tier 1 (CDP),
+// fall through to Tier 2 (DOM) only if Tier 1 resolves `null`, then write the
+// file with a whitelisted extension.
+//
+// Tier ordering (KEEP): Tier 1 → Tier 2 fallthrough. Tier 1's internal timer
+// resolves `null` (fallthrough) and is NEVER a terminal rejection, so the
+// orchestrator does NOT race Tier 1 against a terminal-timeout promise.
+//
+// Lazy Playwright import (KEEP): `playwright-extra` + stealth are imported
+// inside `download()` so the HTTP layer is unit-testable without a browser.
+
+import { randomUUID } from 'node:crypto';
+import { rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+
+import { DownloaderError, classifyError } from './errors.js';
+import { downloadStream } from './streamlink-backend.js';
+import { interceptMedia } from './tier1-cdp.js';
+import { detectBlob } from './tier2-dom.js';
+import { VIDEO_EXTS, parseTimeout, safeExt, validateOutputDir, validateUrl } from './validate.js';
+
+const DEFAULT_TIER1_TIMEOUT_MS = 30_000;
+const DEFAULT_TIER2_TIMEOUT_MS = 30_000;
+// The streamlink/ffmpeg download may take much longer than Tier 1 interception.
+const DEFAULT_DOWNLOAD_TIMEOUT_MS = 120_000;
+const DEFAULT_BODY_CAP = 500 * 1024 * 1024;
+
+let stealthReady = null;
+
+async function launchStealthBrowser() {
+  const { chromium } = await import('playwright-extra');
+  stealthReady ??= (async () => {
+    const StealthPlugin = (await import('puppeteer-extra-plugin-stealth')).default;
+    chromium.use(StealthPlugin());
+  })();
+  await stealthReady;
+  return chromium.launch({ headless: true });
+}
+
+export async function download(rawUrl, rawOutputDir, opts = {}) {
+  const tier1Timeout = parseTimeout(opts.tier1Timeout, DEFAULT_TIER1_TIMEOUT_MS);
+  const tier2Timeout = parseTimeout(opts.tier2Timeout, DEFAULT_TIER2_TIMEOUT_MS);
+  // Separate download timeout for the streamlink/ffmpeg subprocess (Tier 1
+  // interception uses tier1Timeout; the download itself may take much longer).
+  const downloadTimeout = parseTimeout(
+    opts.downloadTimeout ?? process.env.BD_DOWNLOAD_TIMEOUT_MS,
+    DEFAULT_DOWNLOAD_TIMEOUT_MS,
+  );
+  const bodyCap = opts.bodyCap ?? DEFAULT_BODY_CAP;
+
+  // Validate inputs first (SSRF + path traversal).
+  await validateUrl(rawUrl);
+  const outputDir = await validateOutputDir(rawOutputDir);
+  const url = rawUrl;
+
+  const browser = await launchStealthBrowser();
+  // newContext/newPage happen INSIDE the try so that if they throw, the
+  // finally still closes the browser (no leak on a failed context/page setup).
+  let context;
+  let page;
+  const uuid = randomUUID();
+
+  let tierUsed = 1;
+  let outPath;
+  try {
+    context = await browser.newContext();
+    page = await context.newPage();
+
+    // Tier 1: internal timer resolves null → fallthrough (never terminal).
+    let result = await interceptMedia(page, url, { timeout: tier1Timeout, bodyCap });
+
+    if (!result) {
+      result = await detectBlob(page, { timeout: tier2Timeout, bodyCap });
+      tierUsed = 2;
+    }
+
+    const ext = safeExt(result.ext);
+    if (!VIDEO_EXTS.includes(ext)) {
+      // Defensive: safeExt guarantees whitelist, but never trust the path.
+      throw new DownloaderError('network_error', `unwhitelisted extension: ${result.ext}`);
+    }
+    outPath = join(outputDir, `${uuid}.${ext}`);
+
+    if (result.kind === 'bytes') {
+      await writeFile(outPath, result.buffer);
+    } else if (result.kind === 'manifest') {
+      await downloadStream(result.streamUrl, outPath, {
+        timeout: downloadTimeout,
+        bodyCap,
+        authHeaders: result.authHeaders,
+      });
+    } else {
+      throw new DownloaderError('network_error', `unknown result kind: ${result.kind}`);
+    }
+
+    return { status: 'success', file_path: outPath, tier_used: tierUsed };
+  } catch (err) {
+    if (outPath) {
+      await rm(outPath, { force: true }).catch(() => {});
+    }
+    if (err instanceof DownloaderError) {
+      return { status: 'failed', error: err.code, tier_used: null };
+    }
+    // classifyError rethrows genuine code bugs (TypeError/ReferenceError/...)
+    // so the server logs the real stack instead of masking it.
+    const code = classifyError(err);
+    return { status: 'failed', error: code, tier_used: null };
+  } finally {
+    if (context) {
+      await context.close().catch(() => {});
+    }
+    await browser.close().catch(() => {});
+  }
+}
diff --git a/packages/browser-downloader/src/errors.js b/packages/browser-downloader/src/errors.js
new file mode 100644
index 00000000..c78f0074
--- /dev/null
+++ b/packages/browser-downloader/src/errors.js
@@ -0,0 +1,137 @@
+// Shared error vocabulary for the browser-downloader microservice.
+//
+// The frozen spec defines five public error codes:
+//   drm_detected | anti_bot_block | network_error | timeout | no_media_found
+//
+// `classifyError` maps arbitrary thrown values to one of those codes, but it
+// MUST NOT mask genuine code bugs (TypeError / ReferenceError / SyntaxError /
+// RangeError) as `network_error`. Such bugs are rethrown so the server logs
+// the real stack instead of silently reporting a generic downloader failure.
+
+export const ERROR_CODES = {
+  DRM_DETECTED: 'drm_detected',
+  ANTI_BOT_BLOCK: 'anti_bot_block',
+  NETWORK_ERROR: 'network_error',
+  TIMEOUT: 'timeout',
+  NO_MEDIA_FOUND: 'no_media_found',
+};
+
+// Node errno codes that represent a transport-level failure (not a bug).
+const NETWORK_ERRNOS = new Set([
+  'ENOTFOUND',
+  'ECONNREFUSED',
+  'ECONNRESET',
+  'ECONNABORTED',
+  'EPIPE',
+  'EHOSTUNREACH',
+  'ENETUNREACH',
+  'EAI_AGAIN',
+  'ERR_NETWORK',
+  'ERR_HTTP2_STREAM_ERROR',
+]);
+
+const TIMEOUT_ERRNOS = new Set(['ETIMEDOUT', 'ERR_SOCKET_CONNECTION_TIMEOUT']);
+
+// Genuine JS engine bugs. classifyError must rethrow these rather than
+// flatten them into `network_error`.
+const BUG_CTORS = [TypeError, ReferenceError, SyntaxError, RangeError];
+
+export class DownloaderError extends Error {
+  constructor(code, message, { cause } = {}) {
+    super(message || code);
+    this.name = 'DownloaderError';
+    this.code = code;
+    if (cause !== undefined) {
+      this.cause = cause;
+    }
+  }
+}
+
+// Hints in an error's name/message that point to a transport-level failure
+// rather than a genuine code bug (used when the cause has no errno `code`).
+const NETWORK_HINT_RE = /network|fetch|socket|connect|timeout|abort|dns|resolve|econn|getaddrinfo/i;
+
+// Walk an error's `cause` chain looking for evidence of a network/transport
+// failure (errno code, AbortError, DownloaderError network/timeout code, or a
+// name/message hint). `seen` breaks self-referential cause chains to prevent
+// unbounded recursion.
+function causeIsNetwork(err, seen) {
+  let cur = err?.cause;
+  while (cur) {
+    if (cur && typeof cur === 'object') {
+      if (seen.has(cur)) {
+        break;
+      }
+      seen.add(cur);
+    }
+    if (cur && typeof cur.code === 'string') {
+      if (NETWORK_ERRNOS.has(cur.code) || TIMEOUT_ERRNOS.has(cur.code)) {
+        return true;
+      }
+    }
+    if (cur instanceof DownloaderError) {
+      if (cur.code === 'network_error' || cur.code === 'timeout') {
+        return true;
+      }
+    }
+    if (cur && cur.name === 'AbortError') {
+      return true;
+    }
+    const hint = `${cur?.name || ''} ${cur?.message || ''}`;
+    if (NETWORK_HINT_RE.test(hint)) {
+      return true;
+    }
+    cur = cur?.cause;
+  }
+  return false;
+}
+
+// A genuine code bug (TypeError/ReferenceError/SyntaxError/RangeError) is
+// rethrown — UNLESS its cause chain is itself a network failure (e.g. undici's
+// `TypeError: fetch failed` whose `cause` carries the real network errno).
+function isBug(err, seen = new WeakSet()) {
+  if (!BUG_CTORS.some((Ctor) => err instanceof Ctor)) {
+    return false;
+  }
+  return !causeIsNetwork(err, seen);
+}
+
+export function classifyError(err) {
+  if (!err) {
+    return ERROR_CODES.NETWORK_ERROR;
+  }
+  if (err instanceof DownloaderError) {
+    return err.code;
+  }
+
+  // Surface genuine code bugs instead of masking them as network errors.
+  if (isBug(err)) {
+    throw err;
+  }
+
+  const code = err.code;
+  if (typeof code === 'string') {
+    if (TIMEOUT_ERRNOS.has(code)) {
+      return ERROR_CODES.TIMEOUT;
+    }
+    if (NETWORK_ERRNOS.has(code)) {
+      return ERROR_CODES.NETWORK_ERROR;
+    }
+  }
+
+  // fetch() network failures surface as TypeError("fetch failed") with a
+  // network `cause`; recurse into the cause for the real errno.
+  if (err instanceof TypeError && err.cause) {
+    try {
+      return classifyError(err.cause);
+    } catch {
+      // cause was itself a bug — fall through to the default below
+    }
+  }
+
+  if (err.name === 'AbortError') {
+    return ERROR_CODES.TIMEOUT;
+  }
+
+  return ERROR_CODES.NETWORK_ERROR;
+}
diff --git a/packages/browser-downloader/src/server.js b/packages/browser-downloader/src/server.js
new file mode 100644
index 00000000..379c4bf8
--- /dev/null
+++ b/packages/browser-downloader/src/server.js
@@ -0,0 +1,165 @@
+// HTTP API.
+//
+// Contract (KEEP): `POST /download { url, output_dir }` →
+// `{ status, file_path?, error?, tier_used? }`; `GET /health` → `{ status }`.
+//
+// Error handling (mandatory): client errors (malformed JSON, missing fields,
+// 413 payload-too-large, validation failures) → HTTP 400; downloader failures
+// → HTTP 502; concurrency overflow → HTTP 503. Every error is logged with its
+// stack. The server `error` event (e.g. EADDRINUSE) is handled to avoid an
+// unhandled crash.
+
+import { pathToFileURL } from 'node:url';
+
+import express from 'express';
+
+import { ConcurrencyLimitError, createSemaphore } from './concurrency.js';
+import { download } from './downloader.js';
+import { DownloaderError, classifyError } from './errors.js';
+import { parseTimeout, validateOutputDir, validateUrl } from './validate.js';
+
+const PORT = Number(process.env.BD_PORT) || 3000;
+const MAX_CONCURRENCY = 2;
+const BODY_LIMIT = '1mb';
+// Per-request overall timeout. With max concurrency=2, two slow targets could
+// otherwise block the service indefinitely. The timeout races the download and
+// releases the semaphore slot when it fires (env BD_REQUEST_TIMEOUT_MS).
+const DEFAULT_REQUEST_TIMEOUT_MS = 300_000;
+
+const limiter = createSemaphore(MAX_CONCURRENCY);
+
+function safeClassify(err) {
+  try {
+    return classifyError(err);
+  } catch {
+    return 'network_error';
+  }
+}
+
+export function createApp() {
+  const app = express();
+  app.use(express.json({ limit: BODY_LIMIT }));
+
+  app.get('/health', (_req, res) => {
+    res.json({ status: 'ok' });
+  });
+
+  app.post('/download', async (req, res) => {
+    const body = req.body;
+    if (!body || typeof body !== 'object') {
+      return res.status(400).json({
+        status: 'failed',
+        error: 'invalid_request',
+        message: 'request body must be JSON object',
+      });
+    }
+    const { url, output_dir } = body;
+    if (typeof url !== 'string' || typeof output_dir !== 'string') {
+      return res.status(400).json({
+        status: 'failed',
+        error: 'invalid_request',
+        message: 'url and output_dir are required strings',
+      });
+    }
+
+    try {
+      await validateUrl(url);
+      await validateOutputDir(output_dir);
+    } catch (err) {
+      return res
+        .status(400)
+        .json({ status: 'failed', error: 'invalid_request', message: err.message });
+    }
+
+    const tier1Timeout = parseTimeout(process.env.BD_TIER1_TIMEOUT_MS, 30_000);
+    const tier2Timeout = parseTimeout(process.env.BD_TIER2_TIMEOUT_MS, 30_000);
+
+    let release;
+    try {
+      release = limiter.acquire();
+    } catch (err) {
+      if (err instanceof ConcurrencyLimitError) {
+        return res.status(503).json({ status: 'failed', error: 'concurrency_limit' });
+      }
+      console.error('[download] concurrency acquire error:', err);
+      return res.status(503).json({ status: 'failed', error: 'concurrency_limit' });
+    }
+
+    let requestTimer = null;
+    try {
+      // Race the download against an overall request timeout. If the download
+      // hangs (e.g. a hung browser/streamlink), the timeout rejects so the
+      // finally block releases the semaphore slot instead of holding it
+      // forever. Read per-request so tests can override via env.
+      const requestTimeout = parseTimeout(
+        process.env.BD_REQUEST_TIMEOUT_MS,
+        DEFAULT_REQUEST_TIMEOUT_MS,
+      );
+      const result = await Promise.race([
+        download(url, output_dir, { tier1Timeout, tier2Timeout }),
+        new Promise((_, reject) => {
+          requestTimer = setTimeout(
+            () => reject(new DownloaderError('timeout', 'request timeout exceeded')),
+            requestTimeout,
+          );
+        }),
+      ]);
+      if (result.status === 'success') {
+        return res.status(200).json(result);
+      }
+      return res.status(502).json(result);
+    } catch (err) {
+      console.error('[download] unexpected error:', err);
+      return res.status(502).json({ status: 'failed', error: safeClassify(err), tier_used: null });
+    } finally {
+      if (requestTimer) {
+        clearTimeout(requestTimer);
+      }
+      release();
+    }
+  });
+
+  // Body-parser / JSON errors → 400 (malformed JSON, 413 too large).
+  app.use((err, _req, res, next) => {
+    if (
+      err &&
+      (err.type === 'entity.parse.failed' ||
+        err.type === 'entity.too.large' ||
+        err.status === 400 ||
+        err.status === 413)
+    ) {
+      return res
+        .status(400)
+        .json({ status: 'failed', error: 'invalid_request', message: err.message });
+    }
+    return next(err);
+  });
+
+  // Final error handler → 502, logged with stack.
+  app.use((err, _req, res, _next) => {
+    console.error('[server] unhandled error:', err);
+    return res.status(502).json({ status: 'failed', error: safeClassify(err) });
+  });
+
+  return app;
+}
+
+export function startServer(app, port = PORT) {
+  const server = app.listen(port, () => {
+    console.log(`browser-downloader listening on :${port}`);
+  });
+  server.on('error', (err) => {
+    // Any listen-time error is fatal — EADDRINUSE, EACCES (permission denied),
+    // or any other bind failure. Log and exit rather than crashing unhandled.
+    console.error(`[server] listen error: ${err.code || ''} ${err.message}`, err.stack);
+    process.exit(1);
+  });
+  return server;
+}
+
+// Use pathToFileURL so paths with spaces or non-ASCII compare correctly.
+const mainHref = process.argv[1] ? pathToFileURL(process.argv[1]).href : '';
+const isMain = import.meta.url === mainHref;
+if (isMain) {
+  startServer(createApp(), PORT);
+}
diff --git a/packages/browser-downloader/src/streamlink-backend.js b/packages/browser-downloader/src/streamlink-backend.js
new file mode 100644
index 00000000..fb3cfc3f
--- /dev/null
+++ b/packages/browser-downloader/src/streamlink-backend.js
@@ -0,0 +1,548 @@
+// HLS / DASH backend.
+//
+// Primary path: `streamlink` CLI via child_process.spawn (handles key
+// decryption, adaptive bitrate, segment retry, live streams — no custom
+// parsers). Fallback path: manual segment download + ffmpeg concat, used only
+// when streamlink fails on an HLS (.m3u8) playlist.
+//
+// Resource lifecycle (mandatory):
+//   - subprocess stderr is DRAINED (a `data` listener is attached even when
+//     the content is unused) to avoid pipe-buffer deadlock;
+//   - every subprocess has a timeout/AbortSignal and is `kill()`ed on
+//     cancellation or timeout (SIGTERM, then SIGKILL after a grace window);
+//   - manifest/segment fetches use an AbortController with a timeout.
+//
+// HLS correctness (mandatory):
+//   - `#EXT-X-KEY` (encrypted HLS) is detected and fails with `network_error`
+//     — ciphertext is never fetched and concatenated into a "success" file;
+//   - variant (master) playlist URLs with query strings are resolved with
+//     `new URL(variant, baseUrl)` so the query string survives recursion.
+//
+// Segment fetch improvements (Phase 2.3):
+//   - per-resource-kind size caps: manifest=8MiB, key=64KiB, segment=256MiB
+//   - exponential backoff retry with jitter (max 3 retries per segment)
+//   - context fallback: try same-origin CORS → include CORS credentials
+//   - auth header forwarding: captured CDP/page headers replayed on sub-fetches
+
+import { spawn } from 'node:child_process';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { DownloaderError } from './errors.js';
+import { parseTimeout, validateUrl } from './validate.js';
+
+// Separate download timeout for the streamlink/ffmpeg subprocess (env
+// BD_DOWNLOAD_TIMEOUT_MS). The Tier 1 interception timeout (30s) is for
+// detecting media via CDP; the actual download may take much longer.
+const DEFAULT_DOWNLOAD_TIMEOUT = parseTimeout(process.env.BD_DOWNLOAD_TIMEOUT_MS, 120_000);
+const DEFAULT_STREAMLINK_TIMEOUT = DEFAULT_DOWNLOAD_TIMEOUT;
+const DEFAULT_FFMPEG_TIMEOUT = DEFAULT_DOWNLOAD_TIMEOUT;
+const DEFAULT_FETCH_TIMEOUT = DEFAULT_DOWNLOAD_TIMEOUT;
+const MAX_DEPTH = 5; // master-playlist recursion guard
+const MAX_REDIRECTS = 5;
+const MAX_RETRIES = 3; // max segment-level retries
+const BASE_RETRY_MS = 500; // base delay for exponential backoff
+
+// -- Per-resource-kind size caps (Phase 2.3) --------------------------------
+// Mirrors FlowPick's PageFetchClient resource classification.
+
+function maxBodyBytes(resourceKind) {
+  if (resourceKind === 'manifest') return 8 * 1024 * 1024; // 8 MiB
+  if (resourceKind === 'key') return 64 * 1024; // 64 KiB
+  return 256 * 1024 * 1024; // 256 MiB (segments, init, generic)
+}
+
+function classifyResource(url) {
+  if (/\.(m3u8|mpd)(\?|$)/i.test(url)) return 'manifest';
+  if (/\.key(\?|$)/i.test(url)) return 'key';
+  return 'segment';
+}
+
+// -- Retry delay with exponential backoff + jitter (Phase 2.3) --------------
+// Mirrors FlowPick's retryDelay: min(500 * 2^attempt, 8000) + rand(0, 250)ms.
+
+function retryDelayMs(attempt) {
+  const base = Math.min(BASE_RETRY_MS * 2 ** attempt, 8_000);
+  const jitter = Math.random() * 250;
+  return base + jitter;
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// -- Context fallback strategy (Phase 2.3) ----------------------------------
+// Tries multiple fetch() credential modes, deduplicating equivalents. Mirrors
+// FlowPick's contextCandidates(): hinted → same-origin CORS → include CORS.
+
+function contextCandidates(authHeaders) {
+  const candidates = [];
+  // If we have auth headers from CDP/page capture, use them with include
+  // credentials so cookies + authorization are sent to the CDN.
+  if (authHeaders && Object.keys(authHeaders).length > 0) {
+    candidates.push({ credentials: 'include', mode: 'cors', headers: authHeaders });
+    // Also try same-origin as fallback (some CDNs reject cross-origin creds).
+    candidates.push({ credentials: 'same-origin', mode: 'cors', headers: authHeaders });
+  }
+  // Standard no-auth fallbacks.
+  candidates.push({ credentials: 'same-origin', mode: 'cors' });
+  candidates.push({ credentials: 'include', mode: 'cors' });
+  // Deduplicate by serialized key.
+  const seen = new Set();
+  return candidates.filter((c) => {
+    const key = `${c.credentials}::${c.mode}::${Object.keys(c.headers || {})
+      .sort()
+      .join(',')}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+
+// -- HTTP helpers ------------------------------------------------------------
+
+// Single fetch with a per-call timeout, parent AbortSignal forwarding, and
+// optional auth headers.
+async function fetchOnce(url, { signal, timeout, headers: extraHeaders }) {
+  const ac = new AbortController();
+  const timer = setTimeout(() => ac.abort(), timeout);
+  const onParentAbort = () => ac.abort();
+  if (signal) {
+    if (signal.aborted) {
+      ac.abort();
+    } else {
+      signal.addEventListener('abort', onParentAbort, { once: true });
+    }
+  }
+  try {
+    const init = { signal: ac.signal, redirect: 'manual' };
+    if (extraHeaders) {
+      init.headers = extraHeaders;
+    }
+    return await fetch(url, init);
+  } finally {
+    clearTimeout(timer);
+    if (signal) {
+      signal.removeEventListener('abort', onParentAbort);
+    }
+  }
+}
+
+// Retry a fetch across multiple credential contexts with exponential backoff.
+async function fetchResWithRetry(url, opts = {}) {
+  const { signal, timeout = DEFAULT_FETCH_TIMEOUT, lookup, authHeaders } = opts;
+  const contexts = contextCandidates(authHeaders);
+  let lastError = null;
+
+  for (const context of contexts) {
+    for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
+      try {
+        return await fetchResOne(url, { ...opts, signal, timeout, lookup, ...context });
+      } catch (err) {
+        lastError = err;
+        // Non-retryable errors (403, 401, 410, DownloaderError with terminal codes).
+        if (err instanceof DownloaderError) {
+          if (['drm_detected', 'anti_bot_block'].includes(err.code)) {
+            throw err;
+          }
+          // network_error is retryable; others fall through to retry
+        }
+        if (err && typeof err.status === 'number') {
+          if (err.status === 403) throw err; // forbidden — don't retry
+          if (err.status === 401 || err.status === 410) throw err; // expired
+        }
+        if (attempt < MAX_RETRIES) {
+          await sleep(retryDelayMs(attempt));
+        }
+      }
+    }
+  }
+  throw lastError;
+}
+
+// Follow redirects manually, validating every Location via `validateUrl`.
+// Checks Content-Length against the resource-kind cap before materializing.
+async function fetchResOne(url, opts = {}) {
+  const {
+    signal,
+    timeout = DEFAULT_FETCH_TIMEOUT,
+    lookup,
+    credentials,
+    mode,
+    headers: extraHeaders,
+  } = opts;
+  const resourceKind = classifyResource(url);
+  const bodyCap = opts.bodyCap ?? maxBodyBytes(resourceKind);
+  let next = url;
+  for (let hops = 0; hops <= MAX_REDIRECTS; hops += 1) {
+    const init = { signal };
+    if (credentials) init.credentials = credentials;
+    if (mode) init.mode = mode;
+    if (extraHeaders) init.headers = extraHeaders;
+    const res = await fetchOnce(next, { signal, timeout, headers: extraHeaders });
+    if (res.status >= 300 && res.status < 400) {
+      const loc = res.headers?.get?.('location');
+      if (!loc) {
+        throw new DownloaderError('network_error', 'redirect response missing Location');
+      }
+      let resolved;
+      try {
+        resolved = new URL(loc, next).href;
+      } catch {
+        throw new DownloaderError('network_error', 'invalid redirect Location');
+      }
+      await validateUrl(resolved, { lookup });
+      next = resolved;
+      continue;
+    }
+    if (!res.ok) {
+      const err = new DownloaderError('network_error', `fetch failed: HTTP ${res.status}`);
+      err.status = res.status;
+      throw err;
+    }
+    const cl = contentLength(res.headers);
+    if (cl != null && bodyCap != null && cl > bodyCap) {
+      throw new DownloaderError('network_error', `response exceeds size cap (${cl} > ${bodyCap})`);
+    }
+    return res;
+  }
+  throw new DownloaderError('network_error', 'too many redirects');
+}
+
+// -- Subprocess runner -------------------------------------------------------
+
+// Run a subprocess with drained stdio, a timeout, and an optional AbortSignal.
+// Resolves to { code, stderr, killed }. Never rejects — callers inspect code.
+export function runSpawn(cmd, args, opts = {}) {
+  return new Promise((resolve) => {
+    const timeout = opts.timeout ?? DEFAULT_STREAMLINK_TIMEOUT;
+    const signal = opts.signal;
+    let stderr = '';
+    let killed = false;
+    let child;
+    try {
+      // detached: true places the child in a new process group/session so we
+      // can signal the whole group (streamlink spawns ffmpeg as a child).
+      child = spawn(cmd, args, { stdio: ['ignore', 'pipe', 'pipe'], detached: true });
+    } catch (err) {
+      resolve({ code: -1, stderr: String(err), killed: false });
+      return;
+    }
+
+    // Drain stderr + stdout to prevent pipe-buffer deadlock.
+    child.stderr.on('data', (chunk) => {
+      stderr += chunk.toString();
+    });
+    child.stdout.on('data', () => {});
+
+    let termTimer = null;
+    let killTimer = null;
+
+    const cleanup = () => {
+      if (termTimer) {
+        clearTimeout(termTimer);
+      }
+      if (killTimer) {
+        clearTimeout(killTimer);
+      }
+      if (signal) {
+        signal.removeEventListener('abort', onAbort);
+      }
+    };
+
+    const killGroup = (sig) => {
+      if (child.pid) {
+        try {
+          process.kill(-child.pid, sig);
+        } catch {
+          // group already dead
+        }
+      }
+      try {
+        child.kill(sig);
+      } catch {
+        // direct child already dead
+      }
+    };
+
+    const killNow = () => killGroup('SIGKILL');
+
+    const onAbort = () => {
+      if (!killed) {
+        killed = true;
+        killGroup('SIGTERM');
+        killTimer = setTimeout(killNow, 2000);
+      }
+    };
+
+    if (signal) {
+      if (signal.aborted) {
+        onAbort();
+      } else {
+        signal.addEventListener('abort', onAbort, { once: true });
+      }
+    }
+
+    termTimer = setTimeout(() => {
+      if (!killed) {
+        killed = true;
+        killGroup('SIGTERM');
+        killTimer = setTimeout(killNow, 2000);
+      }
+    }, timeout);
+
+    child.on('error', (err) => {
+      cleanup();
+      resolve({ code: -1, stderr: stderr + String(err), killed });
+    });
+    child.on('close', (code) => {
+      cleanup();
+      resolve({ code, stderr, killed });
+    });
+  });
+}
+
+// -- Fetch helpers -----------------------------------------------------------
+
+function contentLength(headers) {
+  const v = headers?.get?.('content-length');
+  if (v == null) {
+    return null;
+  }
+  const n = Number(v);
+  return Number.isFinite(n) ? n : null;
+}
+
+async function fetchText(url, opts = {}) {
+  const resourceKind = classifyResource(url);
+  const cap = opts.bodyCap ?? maxBodyBytes(resourceKind);
+  const res = await fetchResWithRetry(url, opts);
+  const text = await res.text();
+  if (cap != null && Buffer.byteLength(text) > cap) {
+    throw new DownloaderError('network_error', `${resourceKind} body exceeds size cap`);
+  }
+  return text;
+}
+
+async function fetchToFile(url, destPath, opts = {}) {
+  const resourceKind = classifyResource(url);
+  const cap = opts.bodyCap ?? maxBodyBytes(resourceKind);
+  const res = await fetchResWithRetry(url, opts);
+  const buf = Buffer.from(await res.arrayBuffer());
+  if (cap != null && buf.length > cap) {
+    throw new DownloaderError('network_error', `${resourceKind} body exceeds size cap`);
+  }
+  await writeFile(destPath, buf);
+}
+
+// -- HLS manifest parsing ----------------------------------------------------
+
+// Extract the first variant URL from a master playlist, preserving query
+// strings. Parse failures and validation failures (e.g. SSRF to a private IP)
+// `continue` to the next candidate rather than `return null` (which would skip
+// all remaining valid variants).
+async function pickVariantUrl(manifestText, baseUrl, { lookup } = {}) {
+  const lines = manifestText.split('\n').map((l) => l.trim());
+  for (let i = 0; i < lines.length; i += 1) {
+    if (lines[i].startsWith('#EXT-X-STREAM-INF')) {
+      for (let j = i + 1; j < lines.length; j += 1) {
+        const line = lines[j];
+        if (!line || line.startsWith('#')) {
+          continue;
+        }
+        let href;
+        try {
+          href = new URL(line, baseUrl).href;
+        } catch {
+          continue;
+        }
+        try {
+          await validateUrl(href, { lookup });
+        } catch {
+          continue;
+        }
+        return href;
+      }
+    }
+  }
+  return null;
+}
+
+// -- HLS encrypted-stream detection (kept for streamlink fallback path) ------
+
+// Matches any #EXT-X-KEY or #EXT-X-SESSION-KEY tag that indicates DRM (not
+// plain AES-128 with identity keyformat).
+const HLS_DRM_RE =
+  /#EXT-X-(?:KEY|SESSION-KEY):.*METHOD=(?:SAMPLE-AES|SAMPLE-AES-CTR|SAMPLE-AES-CENC)/i;
+const HLS_DRM_KEYFORMAT_RE = /#EXT-X-KEY:.*KEYFORMAT="(?!identity).+"/i;
+
+function isDrmEncrypted(manifestText) {
+  return HLS_DRM_RE.test(manifestText) || HLS_DRM_KEYFORMAT_RE.test(manifestText);
+}
+
+// -- Main exports ------------------------------------------------------------
+
+export async function downloadManifestFallback(url, outPath, opts = {}) {
+  const dlTimeout = opts.timeout ?? DEFAULT_DOWNLOAD_TIMEOUT;
+  const bodyCap = opts.bodyCap ?? maxBodyBytes('manifest');
+  const lookup = opts.lookup;
+  const authHeaders = opts.authHeaders;
+  const depth = opts.__depth ?? 0;
+  if (depth > MAX_DEPTH) {
+    throw new DownloaderError('network_error', 'manifest recursion depth exceeded');
+  }
+
+  let aggregate = opts.__aggregate;
+  let aggregateTimer = null;
+  let ownsAggregate = false;
+  if (!aggregate) {
+    const ac = new AbortController();
+    aggregateTimer = setTimeout(() => ac.abort(), dlTimeout);
+    ownsAggregate = true;
+    if (opts.signal) {
+      if (opts.signal.aborted) {
+        ac.abort();
+      } else {
+        opts.signal.addEventListener('abort', () => ac.abort(), { once: true });
+      }
+    }
+    aggregate = ac.signal;
+  }
+
+  try {
+    const text = await fetchText(url, {
+      signal: aggregate,
+      timeout: dlTimeout,
+      lookup,
+      bodyCap,
+      authHeaders,
+    });
+
+    // Encrypted HLS: DRM methods or non-identity KEYFORMAT.
+    if (/#EXT-X-(?:KEY|SESSION-KEY)/.test(text)) {
+      if (isDrmEncrypted(text)) {
+        throw new DownloaderError(
+          'drm_detected',
+          'HLS manifest contains DRM encryption (#EXT-X-KEY with SAMPLE-AES / non-identity KEYFORMAT)',
+        );
+      }
+      // Plain AES-128 with identity keyformat is allowed.
+    }
+
+    // Master/variant playlist → recurse into the chosen variant.
+    if (/#EXT-X-STREAM-INF/.test(text)) {
+      const variantUrl = await pickVariantUrl(text, url, { lookup });
+      if (!variantUrl) {
+        throw new DownloaderError('network_error', 'master playlist has no variant url');
+      }
+      return downloadManifestFallback(variantUrl, outPath, {
+        ...opts,
+        __depth: depth + 1,
+        __aggregate: aggregate,
+      });
+    }
+
+    const segLines = text
+      .split('\n')
+      .map((l) => l.trim())
+      .filter((l) => l.length > 0 && !l.startsWith('#'));
+    if (segLines.length === 0) {
+      throw new DownloaderError('network_error', 'playlist contains no segments');
+    }
+
+    // Re-validate every derived segment URL (SSRF) before fetching.
+    const segUrls = [];
+    for (const s of segLines) {
+      let href;
+      try {
+        href = new URL(s, url).href;
+      } catch {
+        href = s;
+      }
+      await validateUrl(href, { lookup });
+      segUrls.push(href);
+    }
+
+    const dir = await mkdtemp(join(tmpdir(), 'bd-hls-'));
+    const listFile = join(dir, 'concat.txt');
+    const segFiles = [];
+    const segCap = maxBodyBytes('segment');
+    try {
+      for (let i = 0; i < segUrls.length; i += 1) {
+        const segPath = join(dir, `seg-${String(i).padStart(5, '0')}.ts`);
+        await fetchToFile(segUrls[i], segPath, {
+          signal: aggregate,
+          timeout: dlTimeout,
+          lookup,
+          bodyCap: segCap,
+          authHeaders,
+        });
+        segFiles.push(segPath);
+      }
+      const listBody = segFiles.map((p) => `file '${p.replace(/'/g, "'\\''")}'`).join('\n');
+      await writeFile(listFile, listBody, 'utf8');
+
+      const ff = await runSpawn(
+        'ffmpeg',
+        ['-y', '-f', 'concat', '-safe', '0', '-i', listFile, '-c', 'copy', outPath],
+        { timeout: opts.ffmpegTimeout ?? DEFAULT_FFMPEG_TIMEOUT, signal: aggregate },
+      );
+
+      if (ff.code !== 0) {
+        throw new DownloaderError(
+          'network_error',
+          `ffmpeg concat failed (code ${ff.code}): ${ff.stderr.slice(-512)}`,
+        );
+      }
+      return outPath;
+    } finally {
+      await rm(dir, { recursive: true, force: true }).catch(() => {});
+    }
+  } finally {
+    if (ownsAggregate && aggregateTimer) {
+      clearTimeout(aggregateTimer);
+    }
+  }
+}
+
+export async function downloadStream(url, outPath, opts = {}) {
+  const timeout = opts.timeout ?? DEFAULT_DOWNLOAD_TIMEOUT;
+  const lookup = opts.lookup;
+
+  // Re-validate the derived stream URL (it may come from CDP interception and
+  // has not been validated upstream) — SSRF defence before spawning/fetching.
+  await validateUrl(url, { lookup });
+
+  const isHls = HLS_RE.test(url);
+  const isDash = DASH_RE.test(url);
+
+  const args = ['--no-progress', '--url', url, '--default-stream', 'best', '-o', outPath];
+
+  // Forward auth headers via streamlink's --http-header if we have them.
+  if (opts.authHeaders && Object.keys(opts.authHeaders).length > 0) {
+    for (const [name, value] of Object.entries(opts.authHeaders)) {
+      args.push('--http-header', `${name}=${value}`);
+    }
+  }
+
+  const result = await runSpawn('streamlink', args, { timeout, signal: opts.signal });
+
+  if (result.code === 0) {
+    return outPath;
+  }
+
+  // DASH has no manual fallback (no custom parser). HLS falls back to manual
+  // segment fetch + ffmpeg concat.
+  if (isHls) {
+    return downloadManifestFallback(url, outPath, { ...opts, authHeaders: opts.authHeaders });
+  }
+  throw new DownloaderError(
+    'network_error',
+    `streamlink failed${isDash ? ' (DASH, no manual fallback)' : ''} (code ${result.code}): ${result.stderr.slice(-512)}`,
+  );
+}
+
+// Match `.m3u8`/`.mpd` followed by `?`, `#`, or end-of-string.
+const HLS_RE = /\.m3u8([?#]|$)/i;
+const DASH_RE = /\.mpd([?#]|$)/i;
diff --git a/packages/browser-downloader/src/tier1-cdp.js b/packages/browser-downloader/src/tier1-cdp.js
new file mode 100644
index 00000000..48f5b72e
--- /dev/null
+++ b/packages/browser-downloader/src/tier1-cdp.js
@@ -0,0 +1,393 @@
+// Tier 1 — CDP network interception (primary path).
+//
+// Matches video/* content-types plus .m3u8/.mpd/.mp4/.webm/.ts URLs, fetches
+// the response body via `Network.getResponseBody` (with a size cap), and routes
+// HLS/DASH manifests to the streamlink backend.
+//
+// Terminal-condition propagation (mandatory): DRM (EME
+// `requestMediaKeySystemAccess` / `encrypted` event) and anti-bot (HTTP 403 or
+// block-page indicators) are detected here and throw immediately — they NEVER
+// fall through to Tier 2. The internal fallthrough timer resolves `null`
+// (fallthrough to Tier 2) and is NEVER a terminal `timeout` rejection.
+//
+// Structured DRM manifest heuristics (Phase 2.1): before routing an
+// intercepted HLS/DASH manifest to streamlink, the manifest body is fetched
+// and scanned for DRM markers:
+//   - HLS: #EXT-X-KEY:METHOD=SAMPLE-AES*, KEYFORMAT=com.apple/playready/widevine
+//   - DASH: <ContentProtection schemeIdUri="urn:uuid:...">
+// DRM is detected at manifest-parse time (milliseconds) instead of waiting for
+// the EME API to fire. Only AES-128 with identity keyformat passes through.
+//
+// Auth header capture (Phase 2.2): CDP `Network.requestWillBeSent` events
+// capture the page's Referer and Origin headers so the streamlink backend can
+// replay them on segment fetches (sites that validate headers at the CDN edge).
+//
+// Resource lifecycle (mandatory): the CDP session is `detach()`ed in cleanup
+// (not just `off()`), and the fallthrough timer is cleared when media is found
+// or a terminal condition throws before the timer fires.
+
+import { DownloaderError } from './errors.js';
+import { pickExtension } from './validate.js';
+
+const DEFAULT_BODY_CAP = 500 * 1024 * 1024; // 500MB
+const MANIFEST_CAP = 8 * 1024 * 1024; // 8MiB — manifests are small
+
+const VIDEO_CT_RE = /^video\//i;
+const VIDEO_URL_RE = /\.(mp4|webm|ts|m4v|m4s)(\?|$)/i;
+const MANIFEST_RE = /\.(m3u8|mpd)(\?|$)/i;
+const BLOCK_RE =
+  /just a moment|access denied|are you a robot|captcha|verify you are human|blocked|forbidden|unauthorized/i;
+
+// -- DRM manifest heuristics (Phase 2.1) -----------------------------------
+
+// HLS: any #EXT-X-KEY with a DRM METHOD or a non-identity KEYFORMAT.
+const HLS_DRM_METHOD_RE = /#EXT-X-KEY:.*METHOD=(SAMPLE-AES|SAMPLE-AES-CTR|SAMPLE-AES-CENC)/i;
+const HLS_DRM_KEYFORMAT_RE = /#EXT-X-KEY:.*KEYFORMAT="(?!identity).+"/i;
+// DASH: any <ContentProtection> element with a DRM schemeIdUri.
+const DASH_DRM_RE = /<ContentProtection[\s/>]/i;
+
+// Key headers captured for auth replay on downstream segment fetches.
+const AUTH_HEADER_NAMES = ['referer', 'origin', 'cookie', 'authorization'];
+
+function scanManifestForDrm(body, url) {
+  const isDash = /\.mpd(\?|$)/i.test(url);
+  if (isDash) {
+    if (DASH_DRM_RE.test(body)) {
+      return 'DASH <ContentProtection> DRM';
+    }
+  } else {
+    // HLS: check for DRM methods first, then KEYFORMAT
+    if (HLS_DRM_METHOD_RE.test(body)) {
+      return 'HLS #EXT-X-KEY DRM method (SAMPLE-AES*)';
+    }
+    if (HLS_DRM_KEYFORMAT_RE.test(body)) {
+      return 'HLS #EXT-X-KEY non-identity KEYFORMAT (DRM)';
+    }
+  }
+  return null;
+}
+
+// -- Init script (DRM + auth header hooks) ----------------------------------
+
+// Injected before navigation so EME usage is flagged on the page and
+// auth headers are captured from the page's own fetch/XHR calls.
+const DRM_INIT_SCRIPT = () => {
+  window.__bd_drm = false;
+  window.__bd_auth_headers = {};
+  if (navigator && typeof navigator.requestMediaKeySystemAccess === 'function') {
+    const orig = navigator.requestMediaKeySystemAccess.bind(navigator);
+    navigator.requestMediaKeySystemAccess = (...args) => {
+      window.__bd_drm = true;
+      return orig(...args);
+    };
+  }
+  document.addEventListener(
+    'encrypted',
+    () => {
+      window.__bd_drm = true;
+    },
+    true,
+  );
+  // Capture auth headers from the page's own fetch calls so they can be
+  // replayed on downstream segment fetches in the streamlink backend.
+  if (typeof window.fetch === 'function') {
+    const nativeFetch = window.fetch.bind(window);
+    window.fetch = (input, init) => {
+      try {
+        if (init?.headers) {
+          const raw =
+            init.headers instanceof Headers
+              ? Object.fromEntries(init.headers.entries())
+              : Array.isArray(init.headers)
+                ? Object.fromEntries(init.headers)
+                : { ...init.headers };
+          // Normalise to lowercase — Headers.entries() does this already,
+          // but array and object forms preserve caller casing.
+          const h = {};
+          for (const [k, v] of Object.entries(raw)) {
+            h[String(k).toLowerCase()] = v;
+          }
+          const auth = {};
+          if (h.referer) auth.referer = h.referer;
+          if (h.origin) auth.origin = h.origin;
+          if (h.cookie) auth.cookie = h.cookie;
+          if (h.authorization) auth.authorization = h.authorization;
+          if (Object.keys(auth).length > 0) {
+            window.__bd_auth_headers = { ...window.__bd_auth_headers, ...auth };
+          }
+        }
+      } catch {
+        /* best-effort */
+      }
+      return nativeFetch(input, init);
+    };
+  }
+  // Also capture from XHR calls.
+  if (typeof XMLHttpRequest !== 'undefined' && XMLHttpRequest.prototype.setRequestHeader) {
+    const origSetHeader = XMLHttpRequest.prototype.setRequestHeader;
+    XMLHttpRequest.prototype.setRequestHeader = function (name, value) {
+      try {
+        const lower = name.toLowerCase();
+        if (['referer', 'origin', 'cookie', 'authorization'].includes(lower)) {
+          window.__bd_auth_headers[lower] = value;
+        }
+      } catch {
+        /* best-effort */
+      }
+      return origSetHeader.call(this, name, value);
+    };
+  }
+};
+
+// -- Helpers -----------------------------------------------------------------
+
+async function safeDetach(client) {
+  try {
+    await client.detach();
+  } catch {
+    // already detached
+  }
+}
+
+// -- Main export -------------------------------------------------------------
+
+export async function interceptMedia(page, url, opts = {}) {
+  const timeout = opts.timeout ?? 30_000;
+  const bodyCap = opts.bodyCap ?? DEFAULT_BODY_CAP;
+
+  const client = await page.context().newCDPSession(page);
+  // If CDP setup fails (Network.enable / addInitScript), detach the session
+  // before rethrowing so we never leak a CDP session on an early throw.
+  try {
+    await client.send('Network.enable');
+    await page.addInitScript(DRM_INIT_SCRIPT);
+  } catch (err) {
+    await safeDetach(client);
+    throw err;
+  }
+
+  const candidates = new Map();
+  // Per-requestId storage of captured request headers (from CDP).
+  const requestHeaders = new Map();
+
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    let fallthroughTimer = null;
+    let drmTimer = null;
+
+    const stopTimers = () => {
+      if (fallthroughTimer) {
+        clearTimeout(fallthroughTimer);
+        fallthroughTimer = null;
+      }
+      if (drmTimer) {
+        clearInterval(drmTimer);
+        drmTimer = null;
+      }
+    };
+
+    const settle = (fn) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      stopTimers();
+      fn();
+    };
+    const onFound = (result) => settle(() => resolve(result));
+    const onTerminal = (err) => settle(() => reject(err));
+
+    // Internal fallthrough timer — resolves null (NEVER a terminal rejection).
+    fallthroughTimer = setTimeout(() => onFound(null), timeout);
+
+    // -- CDP: capture request headers before response -----------------------
+    const onRequestWillBeSent = (params) => {
+      const headers = params.request?.headers || {};
+      const captured = {};
+      for (const name of AUTH_HEADER_NAMES) {
+        if (headers[name] && typeof headers[name] === 'string') {
+          captured[name] = headers[name];
+        }
+      }
+      if (Object.keys(captured).length > 0) {
+        requestHeaders.set(params.requestId, captured);
+      }
+    };
+
+    // -- CDP: handle completed responses ------------------------------------
+    const onLoadingFinished = async (params) => {
+      const candidate = candidates.get(params.requestId);
+      if (!candidate) {
+        return;
+      }
+      candidates.delete(params.requestId);
+      try {
+        const isManifest = MANIFEST_RE.test(candidate.url);
+
+        if (isManifest) {
+          // Phase 2.1: fetch manifest body and scan for DRM before routing
+          // to streamlink.
+          const resp = await client.send('Network.getResponseBody', {
+            requestId: params.requestId,
+          });
+          const body = resp.base64Encoded
+            ? Buffer.from(resp.body, 'base64').toString('utf8')
+            : resp.body;
+          if (!body || body.length === 0) {
+            return; // empty manifest — keep waiting
+          }
+          if (body.length > MANIFEST_CAP) {
+            onTerminal(new DownloaderError('network_error', 'manifest body exceeds size cap'));
+            return;
+          }
+          const drmReason = scanManifestForDrm(body, candidate.url);
+          if (drmReason) {
+            onTerminal(new DownloaderError('drm_detected', drmReason));
+            return;
+          }
+          // Collect auth headers from CDP + page init script for replay.
+          let authHeaders = null;
+          try {
+            const pageHeaders = await page.evaluate(() => {
+              const h = window.__bd_auth_headers;
+              return h && Object.keys(h).length > 0 ? h : null;
+            });
+            if (pageHeaders) {
+              authHeaders = pageHeaders;
+            }
+          } catch {
+            /* best-effort */
+          }
+          // CDP-level headers override page-level (more reliable).
+          const cdpHeaders = requestHeaders.get(params.requestId);
+          if (cdpHeaders) {
+            authHeaders = { ...authHeaders, ...cdpHeaders };
+          }
+          onFound({
+            kind: 'manifest',
+            streamUrl: candidate.url,
+            ext: 'mp4',
+            authHeaders:
+              authHeaders && Object.keys(authHeaders).length > 0 ? authHeaders : undefined,
+          });
+          return;
+        }
+
+        // Non-manifest: fetch bytes directly.
+        const resp = await client.send('Network.getResponseBody', {
+          requestId: params.requestId,
+        });
+        const buf = Buffer.from(resp.body, resp.base64Encoded ? 'base64' : 'utf8');
+        if (buf.length > bodyCap) {
+          onTerminal(new DownloaderError('network_error', 'response body exceeds size cap'));
+          return;
+        }
+        if (buf.length === 0) {
+          return; // not real media; keep waiting for the timer/other responses
+        }
+        const ext = pickExtension(candidate.url, candidate.ct);
+        onFound({ kind: 'bytes', buffer: buf, ext });
+      } catch {
+        // body not available yet / transient — ignore, timer still guards us
+      }
+    };
+
+    const onResponseReceived = (params) => {
+      const { response } = params;
+      const respUrl = response.url || '';
+      const ct = response.mimeType || '';
+      // Anti-bot: a 403 on the MAIN document response (the page navigation) is
+      // terminal. A 403 on a subresource (ad, pixel, asset) is NOT — it must
+      // not trigger the terminal anti-bot error. The main document is the
+      // response whose URL matches the navigation URL or whose CDP resource
+      // type is 'Document'.
+      if (response.status === 403) {
+        const isMain = respUrl === url || params.type === 'Document';
+        if (isMain) {
+          onTerminal(new DownloaderError('anti_bot_block', `403 on ${respUrl}`));
+          return;
+        }
+        // subresource 403 — not terminal; just don't treat as a media candidate
+        return;
+      }
+      const isCandidate =
+        VIDEO_CT_RE.test(ct) || VIDEO_URL_RE.test(respUrl) || MANIFEST_RE.test(respUrl);
+      if (isCandidate) {
+        candidates.set(params.requestId, { url: respUrl, ct });
+      }
+    };
+
+    const checkDrm = async () => {
+      try {
+        const drm = await page.evaluate(() => !!window.__bd_drm);
+        if (drm) {
+          onTerminal(new DownloaderError('drm_detected'));
+        }
+      } catch {
+        // page not ready yet — keep polling
+      }
+    };
+
+    const onMainResponse = (resp) => {
+      // Only a 403 on the MAIN document (navigation) is anti-bot. A 403 on a
+      // subresource must NOT trigger the terminal error.
+      if (resp.status() === 403) {
+        let respUrl = '';
+        try {
+          respUrl = typeof resp.url === 'function' ? resp.url() : '';
+        } catch {
+          respUrl = '';
+        }
+        let isNav = false;
+        try {
+          isNav = !!resp.request?.()?.isNavigationRequest?.();
+        } catch {
+          isNav = false;
+        }
+        if (respUrl === url || isNav) {
+          onTerminal(new DownloaderError('anti_bot_block', '403 on main document'));
+        }
+      }
+    };
+
+    const onDomReady = async () => {
+      try {
+        const blocked = await page.evaluate(
+          ({ source, flags }) => {
+            const text = `${document.title || ''} ${document.body?.innerText || ''}`;
+            return new RegExp(source, flags).test(text);
+          },
+          { source: BLOCK_RE.source, flags: BLOCK_RE.flags },
+        );
+        if (blocked) {
+          onTerminal(new DownloaderError('anti_bot_block'));
+        }
+      } catch {
+        // ignore
+      }
+    };
+
+    client.on('Network.requestWillBeSent', onRequestWillBeSent);
+    client.on('Network.responseReceived', onResponseReceived);
+    client.on('Network.loadingFinished', onLoadingFinished);
+    page.on('response', onMainResponse);
+    page
+      .waitForLoadState('domcontentloaded')
+      .then(onDomReady)
+      .catch(() => {});
+    drmTimer = setInterval(checkDrm, 500);
+
+    // Start navigation after interception is armed. Swallow goto rejections —
+    // CDP events + the fallthrough timer drive resolution.
+    void page.goto(url, { waitUntil: 'domcontentloaded', timeout }).catch(() => {});
+  }).then(
+    async (result) => {
+      await safeDetach(client);
+      return result;
+    },
+    async (err) => {
+      await safeDetach(client);
+      throw err;
+    },
+  );
+}
diff --git a/packages/browser-downloader/src/tier2-dom.js b/packages/browser-downloader/src/tier2-dom.js
new file mode 100644
index 00000000..1b2bc374
--- /dev/null
+++ b/packages/browser-downloader/src/tier2-dom.js
@@ -0,0 +1,229 @@
+// Tier 2 — DOM blob detection (fallthrough for blob-based platforms).
+//
+// Terminal-condition propagation (mandatory): DRM (EME) and anti-bot are
+// checked BEFORE polling for blobs. If detected, the terminal error is thrown
+// (NEVER masked as `no_media_found`). Only exhausting the timeout without a
+// blob is terminal as `no_media_found`.
+//
+// Resource lifecycle (mandatory): the `__bd_blobs` hook array is capped (oldest
+// evicted beyond a limit) and `createObjectURL` guards against non-Blob inputs
+// (e.g. `MediaSource`) — only real Blobs are recorded, and the original call's
+// return value is always preserved (no swallowed throws that silently miss
+// URLs).
+
+import { DownloaderError } from './errors.js';
+import { pickExtension } from './validate.js';
+
+const DEFAULT_BODY_CAP = 500 * 1024 * 1024; // 500MB
+const BLOB_CAP = 64;
+const POLL_INTERVAL = 250;
+const BLOCK_RE =
+  /just a moment|access denied|are you a robot|captcha|verify you are human|blocked|forbidden|unauthorized/i;
+
+// Pure helper mirroring the in-page cap+evict logic. Exported for unit testing
+// without a browser. `obj instanceof Blob` is the non-Blob guard.
+export function pushBlobUrl(arr, obj, url, cap = BLOB_CAP) {
+  if (!(obj instanceof Blob)) {
+    return arr; // guard non-Blob (e.g. MediaSource) — do not record
+  }
+  if (arr.length >= cap) {
+    arr.shift(); // evict oldest
+  }
+  arr.push(url);
+  return arr;
+}
+
+// Live-patches URL.createObjectURL on the loaded page so blobs created after
+// injection (e.g. on play) are captured. Must always return the real URL so
+// non-Blob (MediaSource) callers still work.
+const HOOK_SRC = () => {
+  window.__bd_blobs = [];
+  window.__bd_drm ||= false;
+  const CAP = 64;
+  const record = (u) => {
+    if (window.__bd_blobs.length >= CAP) {
+      window.__bd_blobs.shift();
+    }
+    window.__bd_blobs.push(u);
+  };
+  if (window.URL && typeof URL.createObjectURL === 'function') {
+    const orig = URL.createObjectURL;
+    URL.createObjectURL = (obj) => {
+      const u = orig.call(URL, obj);
+      try {
+        if (obj instanceof Blob) {
+          record(u);
+        }
+      } catch {
+        // recording failure must never lose the URL — `u` is already returned
+      }
+      return u;
+    };
+  }
+  if (navigator && typeof navigator.requestMediaKeySystemAccess === 'function') {
+    const origRsa = navigator.requestMediaKeySystemAccess.bind(navigator);
+    navigator.requestMediaKeySystemAccess = (...a) => {
+      window.__bd_drm = true;
+      return origRsa(...a);
+    };
+  }
+  document.addEventListener(
+    'encrypted',
+    () => {
+      window.__bd_drm = true;
+    },
+    true,
+  );
+};
+
+async function tryClickPlay(page) {
+  const selectors = ['[aria-label="Play"]', '[data-testid="play"]', 'video', 'button'];
+  for (const sel of selectors) {
+    try {
+      const handle = await page.$(sel);
+      if (handle) {
+        await handle.click({ timeout: 1000 }).catch(() => {});
+        return;
+      }
+    } catch {
+      // continue to next selector
+    }
+  }
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+export async function detectBlob(page, opts = {}) {
+  const timeout = opts.timeout ?? 30_000;
+  const bodyCap = opts.bodyCap ?? DEFAULT_BODY_CAP;
+
+  // Live-patch createObjectURL + EME on the already-loaded page.
+  await page.evaluate(HOOK_SRC).catch(() => {});
+
+  // BEFORE polling: detect terminal conditions (DRM + anti-bot). These throw
+  // and NEVER fall through to `no_media_found`.
+  let drm = false;
+  try {
+    drm = await page.evaluate(() => !!window.__bd_drm);
+  } catch {
+    drm = false;
+  }
+  if (drm) {
+    throw new DownloaderError('drm_detected');
+  }
+
+  let blocked = false;
+  try {
+    blocked = await page.evaluate(
+      ({ source, flags }) => {
+        const text = `${document.title || ''} ${document.body?.innerText || ''}`;
+        return new RegExp(source, flags).test(text);
+      },
+      { source: BLOCK_RE.source, flags: BLOCK_RE.flags },
+    );
+  } catch {
+    blocked = false;
+  }
+  if (blocked) {
+    throw new DownloaderError('anti_bot_block');
+  }
+
+  await tryClickPlay(page);
+
+  const deadline = Date.now() + timeout;
+  while (Date.now() < deadline) {
+    let blobUrl = null;
+    try {
+      blobUrl = await page.evaluate(() => {
+        const v = document.querySelector('video');
+        if (v && typeof v.src === 'string' && v.src.startsWith('blob:')) {
+          return v.src;
+        }
+        if (window.__bd_blobs && window.__bd_blobs.length > 0) {
+          return window.__bd_blobs[window.__bd_blobs.length - 1];
+        }
+        return null;
+      });
+    } catch {
+      blobUrl = null;
+    }
+
+    if (blobUrl) {
+      let payload = null;
+      try {
+        // Check the blob size BEFORE materializing the body as a JS array of
+        // numbers across CDP (avoids loading a huge blob into V8 + CDP JSON).
+        // An AbortController bounds each in-page fetch so a hung blob URL
+        // cannot block the polling loop forever.
+        payload = await page.evaluate(
+          async ({ u, cap, timeoutMs }) => {
+            const ac = new AbortController();
+            const timer = setTimeout(() => ac.abort(), timeoutMs);
+            try {
+              const r = await fetch(u, { signal: ac.signal });
+              const type = r.headers.get('content-type') || '';
+              const cl = Number(r.headers.get('content-length'));
+              if (Number.isFinite(cl) && cl > cap) {
+                return { tooLarge: true, type, size: cl };
+              }
+              const ab = await r.arrayBuffer();
+              if (ab.byteLength > cap) {
+                return { tooLarge: true, type, size: ab.byteLength };
+              }
+              const bytes = Array.from(new Uint8Array(ab));
+              return { bytes, type, size: bytes.length };
+            } finally {
+              clearTimeout(timer);
+            }
+          },
+          { u: blobUrl, cap: bodyCap, timeoutMs: timeout },
+        );
+      } catch {
+        payload = null;
+      }
+
+      if (payload) {
+        if (payload.tooLarge || (typeof payload.size === 'number' && payload.size > bodyCap)) {
+          throw new DownloaderError('network_error', 'blob body exceeds size cap');
+        }
+        if (typeof payload.size === 'number' && payload.size > 0 && Array.isArray(payload.bytes)) {
+          const buf = Buffer.from(payload.bytes);
+          const ext = pickExtension(blobUrl, payload.type);
+          return { kind: 'bytes', buffer: buf, ext };
+        }
+      }
+    }
+
+    // Re-check terminal conditions during polling (page may engage DRM or an
+    // anti-bot challenge late — e.g. after a JS-driven redirect or after
+    // clicking play triggers a challenge). Mirrors tier1-cdp.js's continuous
+    // DRM monitoring so neither terminal condition is masked as no_media_found.
+    try {
+      const drmNow = await page.evaluate(() => !!window.__bd_drm);
+      if (drmNow) {
+        throw new DownloaderError('drm_detected');
+      }
+      const blockedNow = await page.evaluate(
+        ({ source, flags }) => {
+          const text = `${document.title || ''} ${document.body?.innerText || ''}`;
+          return new RegExp(source, flags).test(text);
+        },
+        { source: BLOCK_RE.source, flags: BLOCK_RE.flags },
+      );
+      if (blockedNow) {
+        throw new DownloaderError('anti_bot_block');
+      }
+    } catch (err) {
+      if (err instanceof DownloaderError) {
+        throw err;
+      }
+      // evaluate failed — ignore
+    }
+
+    await sleep(POLL_INTERVAL);
+  }
+
+  throw new DownloaderError('no_media_found');
+}
diff --git a/packages/browser-downloader/src/validate.js b/packages/browser-downloader/src/validate.js
new file mode 100644
index 00000000..17dfe510
--- /dev/null
+++ b/packages/browser-downloader/src/validate.js
@@ -0,0 +1,234 @@
+// Input validation for the HTTP endpoint.
+//
+// Guards against:
+//   (a) SSRF — only http/https schemes, reject file/data/javascript, and block
+//       private/link-local IPs (127.x, 10.x, 192.168.x, 172.16-31.x, 169.254.x,
+//       ::1, link-local, ULA) including hostnames that resolve to them.
+//   (b) path traversal — output_dir must realpath under the configured base.
+//   (c) malformed env timeouts — Number() must be a finite positive int, else
+//       fall back to the default.
+//   (d) extension whitelisting — only VIDEO_EXTS may ever be written to disk.
+
+import { lookup as defaultLookup } from 'node:dns/promises';
+import { realpath as defaultRealpath } from 'node:fs/promises';
+
+export const VIDEO_EXTS = ['mp4', 'webm', 'ts', 'm4v', 'm4s'];
+
+const CONTENT_TYPE_EXT = {
+  'video/mp4': 'mp4',
+  'video/webm': 'webm',
+  'video/mp2t': 'ts',
+  'video/x-m4v': 'm4v',
+  'video/x-mpegurl': 'm3u8',
+  'application/vnd.apple.mpegurl': 'm3u8',
+  'application/x-mpegurl': 'm3u8',
+  'application/dash+xml': 'mpd',
+};
+
+// Convert an IPv4-mapped IPv6 address (`::ffff:a.b.c.d` dotted-decimal or
+// `::ffff:xxxx:yyyy` hex form) to its dotted-decimal IPv4 string, or null if
+// `h` is not an IPv4-mapped address. Used to defeat SSRF via IPv4-mapped IPv6
+// (e.g. `http://[::ffff:169.254.169.254]/` reaching the cloud metadata IP).
+function ipv4FromMapped(h) {
+  const prefix = '::ffff:';
+  if (!h.startsWith(prefix)) {
+    return null;
+  }
+  const rest = h.slice(prefix.length);
+  if (rest.includes('.')) {
+    return rest; // dotted-decimal form: ::ffff:169.254.169.254
+  }
+  const groups = rest.split(':');
+  if (groups.length === 2) {
+    // hex form: ::ffff:a9fe:a9fe  →  169.254.169.254
+    const g1 = Number.parseInt(groups[0], 16);
+    const g2 = Number.parseInt(groups[1], 16);
+    if (Number.isNaN(g1) || Number.isNaN(g2)) {
+      return null;
+    }
+    return `${(g1 >> 8) & 0xff}.${g1 & 0xff}.${(g2 >> 8) & 0xff}.${g2 & 0xff}`;
+  }
+  return null;
+}
+
+// Returns true for IPv4/IPv6 strings that are private, loopback, link-local,
+// ULA, or the unspecified address. Hostnames (non-IP) return false and are
+// resolved separately.
+export function isPrivateIp(value) {
+  if (!value || typeof value !== 'string') {
+    return false;
+  }
+  // WHATWG URL serializes IPv6 hostnames bracketed (e.g. "[::1]").
+  let v = value;
+  if (v.startsWith('[') && v.endsWith(']')) {
+    v = v.slice(1, -1);
+  }
+  if (v.includes(':')) {
+    const h = v.toLowerCase();
+    if (h === '::1' || h === '::') {
+      return true;
+    }
+    if (h.startsWith('fe80:')) {
+      return true; // link-local
+    }
+    if (h.startsWith('fc') || h.startsWith('fd')) {
+      return true; // unique local fc00::/7
+    }
+    // IPv4-mapped IPv6 (::ffff:x.x.x.x / ::ffff:xxxx:yyyy) — strip and re-check
+    // the embedded IPv4 against the private-IP rules (SSRF bypass defence).
+    if (h.startsWith('::ffff:')) {
+      const ipv4 = ipv4FromMapped(h);
+      if (ipv4) {
+        return isPrivateIp(ipv4);
+      }
+    }
+    return false;
+  }
+  const parts = value.split('.');
+  if (parts.length !== 4) {
+    return false;
+  }
+  const a = Number(parts[0]);
+  const b = Number(parts[1]);
+  if (Number.isNaN(a) || Number.isNaN(b)) {
+    return false;
+  }
+  if (a === 127 || a === 10 || a === 0) {
+    return true;
+  }
+  if (a === 192 && b === 168) {
+    return true;
+  }
+  if (a === 169 && b === 254) {
+    return true;
+  }
+  if (a === 172 && b >= 16 && b <= 31) {
+    return true;
+  }
+  if (a === 100 && b >= 64 && b <= 127) {
+    return true; // CGNAT 100.64.0.0/10
+  }
+  if (a === 192 && b === 0) {
+    return true; // 192.0.0.0/24 IETF protocol assignments
+  }
+  if (a === 198 && (b === 18 || b === 19)) {
+    return true; // 198.18.0.0/15 benchmarking
+  }
+  if (a >= 224) {
+    return true; // multicast + reserved + 255.255.255.255
+  }
+  return false;
+}
+
+export async function validateUrl(raw, { lookup = defaultLookup } = {}) {
+  if (typeof raw !== 'string' || raw.length === 0) {
+    throw new Error('url must be a non-empty string');
+  }
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    throw new Error('url is not a valid URL');
+  }
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+    throw new Error(`url scheme not allowed: ${parsed.protocol}`);
+  }
+  const host = parsed.hostname;
+  if (isPrivateIp(host)) {
+    throw new Error(`private/link-local host blocked: ${host}`);
+  }
+  let addrs;
+  try {
+    addrs = await lookup(host, { all: true });
+  } catch {
+    throw new Error(`host could not be resolved: ${host}`);
+  }
+  const list = Array.isArray(addrs) ? addrs : [addrs];
+  for (const entry of list) {
+    const addr = typeof entry === 'string' ? entry : entry.address;
+    if (isPrivateIp(addr)) {
+      throw new Error(`host resolves to private/link-local address: ${addr}`);
+    }
+  }
+  return parsed;
+}
+
+export async function validateOutputDir(dir, { base, realpath = defaultRealpath } = {}) {
+  if (typeof dir !== 'string' || dir.length === 0) {
+    throw new Error('output_dir must be a non-empty string');
+  }
+  const baseDir = base || process.env.BD_OUTPUT_BASE || '/output';
+  // The base MUST exist — never fall back to the raw string (which would let a
+  // non-existent base silently disable the path-traversal guard).
+  let resolvedBase;
+  try {
+    resolvedBase = await realpath(baseDir);
+  } catch {
+    throw new Error(`output base does not exist or is not accessible: ${baseDir}`);
+  }
+  let resolved;
+  try {
+    resolved = await realpath(dir);
+  } catch {
+    throw new Error('output_dir does not exist or is not accessible');
+  }
+  // Exact match OR a real child: `resolved.startsWith(resolvedBase + '/')`.
+  // A bare `startsWith(resolvedBase)` would let `/output-evil` match `/output`.
+  if (resolved !== resolvedBase && !resolved.startsWith(`${resolvedBase}/`)) {
+    throw new Error(`output_dir must be under ${resolvedBase}`);
+  }
+  return resolved;
+}
+
+export function parseTimeout(value, defaultMs) {
+  const n = Number(value);
+  if (!(Number.isInteger(n) && n > 0)) {
+    return defaultMs;
+  }
+  return n;
+}
+
+// Derive a whitelisted extension from a response URL and/or content-type.
+// Never returns an unwhitelisted extension; falls back to 'mp4'.
+export function pickExtension(urlOrPath, contentType) {
+  if (typeof contentType === 'string') {
+    const ct = contentType.toLowerCase().split(';')[0].trim();
+    if (CONTENT_TYPE_EXT[ct]) {
+      const mapped = CONTENT_TYPE_EXT[ct];
+      if (mapped === 'm3u8' || mapped === 'mpd') {
+        return 'mp4'; // manifests are re-muxed to mp4 by streamlink/ffmpeg
+      }
+      return mapped;
+    }
+  }
+  if (typeof urlOrPath === 'string') {
+    try {
+      const u = new URL(urlOrPath);
+      const ext = u.pathname.split('.').pop();
+      if (ext && ext !== u.pathname) {
+        const lower = ext.toLowerCase();
+        if (VIDEO_EXTS.includes(lower)) {
+          return lower;
+        }
+      }
+    } catch {
+      // not a URL — try plain path extension
+      const ext = urlOrPath.split('.').pop();
+      if (ext && ext !== urlOrPath) {
+        const lower = ext.toLowerCase();
+        if (VIDEO_EXTS.includes(lower)) {
+          return lower;
+        }
+      }
+    }
+  }
+  return 'mp4';
+}
+
+// Ensure an extension is whitelisted, else default to 'mp4'.
+export function safeExt(ext) {
+  if (typeof ext === 'string' && VIDEO_EXTS.includes(ext.toLowerCase())) {
+    return ext.toLowerCase();
+  }
+  return 'mp4';
+}
diff --git a/packages/browser-downloader/tests/concurrency.test.js b/packages/browser-downloader/tests/concurrency.test.js
new file mode 100644
index 00000000..8af9ff54
--- /dev/null
+++ b/packages/browser-downloader/tests/concurrency.test.js
@@ -0,0 +1,52 @@
+import { describe, expect, it } from 'vitest';
+
+import { ConcurrencyLimitError, createSemaphore } from '../src/concurrency.js';
+
+describe('concurrency — semaphore max=2', () => {
+  it('allows up to max concurrent acquires', () => {
+    const sem = createSemaphore(2);
+    const r1 = sem.acquire();
+    const r2 = sem.acquire();
+    expect(sem.active).toBe(2);
+    expect(typeof r1).toBe('function');
+    expect(typeof r2).toBe('function');
+    r1();
+    expect(sem.active).toBe(1);
+    r2();
+    expect(sem.active).toBe(0);
+  });
+
+  it('rejects with ConcurrencyLimitError (503) when at capacity', () => {
+    const sem = createSemaphore(2);
+    sem.acquire();
+    sem.acquire();
+    expect(() => sem.acquire()).toThrow(ConcurrencyLimitError);
+    const err = (() => {
+      try {
+        sem.acquire();
+      } catch (e) {
+        return e;
+      }
+      return null;
+    })();
+    expect(err.statusCode).toBe(503);
+  });
+
+  it('allows a new acquire after a release', () => {
+    const sem = createSemaphore(2);
+    const r1 = sem.acquire();
+    sem.acquire();
+    expect(() => sem.acquire()).toThrow();
+    r1();
+    expect(() => sem.acquire()).not.toThrow();
+  });
+
+  it('release is idempotent', () => {
+    const sem = createSemaphore(1);
+    const r = sem.acquire();
+    r();
+    r();
+    expect(sem.active).toBe(0);
+    sem.acquire();
+  });
+});
diff --git a/packages/browser-downloader/tests/downloader.test.js b/packages/browser-downloader/tests/downloader.test.js
new file mode 100644
index 00000000..0e9acbb4
--- /dev/null
+++ b/packages/browser-downloader/tests/downloader.test.js
@@ -0,0 +1,214 @@
+import { mkdtemp, readFile, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => ({
+  interceptMedia: vi.fn(),
+  detectBlob: vi.fn(),
+  downloadStream: vi.fn(),
+  launch: vi.fn(),
+  newContext: vi.fn(),
+  newPage: vi.fn(),
+  contextClose: vi.fn(),
+  browserClose: vi.fn(),
+}));
+
+vi.mock('../src/tier1-cdp.js', () => ({
+  interceptMedia: (...a) => mocks.interceptMedia(...a),
+}));
+vi.mock('../src/tier2-dom.js', () => ({
+  detectBlob: (...a) => mocks.detectBlob(...a),
+}));
+vi.mock('../src/streamlink-backend.js', () => ({
+  downloadStream: (...a) => mocks.downloadStream(...a),
+}));
+// Keep the pure helpers (parseTimeout/safeExt/VIDEO_EXTS) real; stub only the
+// async validators so no real DNS / filesystem resolution runs in these tests.
+vi.mock('../src/validate.js', async (importOriginal) => {
+  const actual = await importOriginal();
+  return {
+    ...actual,
+    validateUrl: vi.fn(async (u) => new URL(u)),
+    validateOutputDir: vi.fn(async (d) => d),
+  };
+});
+vi.mock('playwright-extra', () => ({
+  chromium: { use: vi.fn(), launch: (...a) => mocks.launch(...a) },
+}));
+vi.mock('puppeteer-extra-plugin-stealth', () => ({
+  default: vi.fn(() => ({})),
+}));
+
+import { download } from '../src/downloader.js';
+import { DownloaderError } from '../src/errors.js';
+
+describe('downloader — orchestration', () => {
+  let base;
+
+  beforeEach(async () => {
+    base = await mkdtemp(join(tmpdir(), 'bd-dl-'));
+    for (const m of Object.values(mocks)) {
+      m.mockReset();
+    }
+    mocks.newPage.mockResolvedValue({});
+    mocks.newContext.mockResolvedValue({
+      newPage: (...a) => mocks.newPage(...a),
+      close: (...a) => mocks.contextClose(...a),
+    });
+    mocks.launch.mockResolvedValue({
+      newContext: (...a) => mocks.newContext(...a),
+      close: (...a) => mocks.browserClose(...a),
+    });
+    mocks.contextClose.mockResolvedValue();
+    mocks.browserClose.mockResolvedValue();
+  });
+
+  it('Tier 1 bytes success writes a UUID-named mp4 and reports tier_used:1', async () => {
+    mocks.interceptMedia.mockResolvedValue({
+      kind: 'bytes',
+      buffer: Buffer.from('hello'),
+      ext: 'mp4',
+    });
+    const result = await download('https://example.com/v.mp4', base, {
+      tier1Timeout: 1000,
+      tier2Timeout: 1000,
+    });
+    expect(result.status).toBe('success');
+    expect(result.tier_used).toBe(1);
+    expect(result.file_path).toMatch(/\.mp4$/);
+    expect(await readFile(result.file_path, 'utf8')).toBe('hello');
+    expect(mocks.detectBlob).not.toHaveBeenCalled();
+    expect(mocks.browserClose).toHaveBeenCalledTimes(1);
+  });
+
+  it('Tier 1 null falls through to Tier 2 (KEEP ordering)', async () => {
+    mocks.interceptMedia.mockResolvedValue(null);
+    mocks.detectBlob.mockResolvedValue({
+      kind: 'bytes',
+      buffer: Buffer.from('blob'),
+      ext: 'webm',
+    });
+    const result = await download('https://example.com/v', base, {
+      tier1Timeout: 1000,
+      tier2Timeout: 1000,
+    });
+    expect(result.tier_used).toBe(2);
+    expect(result.file_path).toMatch(/\.webm$/);
+    expect(await readFile(result.file_path, 'utf8')).toBe('blob');
+  });
+
+  it('Tier 1 manifest routes to streamlink (writes via downloadStream)', async () => {
+    mocks.interceptMedia.mockResolvedValue({
+      kind: 'manifest',
+      streamUrl: 'https://x/v.m3u8?token=1',
+      ext: 'mp4',
+    });
+    mocks.downloadStream.mockImplementation(async (_url, outPath) => {
+      await writeFile(outPath, 'stream');
+      return outPath;
+    });
+    const result = await download('https://example.com/v.m3u8', base, {
+      tier1Timeout: 1000,
+    });
+    expect(result.tier_used).toBe(1);
+    expect(mocks.downloadStream).toHaveBeenCalledTimes(1);
+    expect(mocks.downloadStream.mock.calls[0][0]).toBe('https://x/v.m3u8?token=1');
+    // Fix #24: a separate (longer) download timeout is passed to streamlink,
+    // NOT the Tier 1 interception timeout (tier1Timeout=1000 here).
+    expect(mocks.downloadStream.mock.calls[0][2].timeout).toBe(120_000);
+    expect(result.file_path).toMatch(/\.mp4$/);
+    expect(await readFile(result.file_path, 'utf8')).toBe('stream');
+  });
+
+  it('Tier 1 terminal DRM does NOT fall through to Tier 2', async () => {
+    mocks.interceptMedia.mockRejectedValue(new DownloaderError('drm_detected'));
+    const result = await download('https://example.com/v', base, {});
+    expect(result).toMatchObject({
+      status: 'failed',
+      error: 'drm_detected',
+      tier_used: null,
+    });
+    expect(mocks.detectBlob).not.toHaveBeenCalled();
+    expect(mocks.browserClose).toHaveBeenCalledTimes(1);
+  });
+
+  it('Tier 2 no_media_found is reported (terminal after fallthrough)', async () => {
+    mocks.interceptMedia.mockResolvedValue(null);
+    mocks.detectBlob.mockRejectedValue(new DownloaderError('no_media_found'));
+    const result = await download('https://example.com/v', base, {});
+    expect(result).toMatchObject({ status: 'failed', error: 'no_media_found' });
+  });
+
+  it('never writes an unwhitelisted extension (falls back to mp4)', async () => {
+    mocks.interceptMedia.mockResolvedValue({
+      kind: 'bytes',
+      buffer: Buffer.from('x'),
+      ext: 'html',
+    });
+    const result = await download('https://example.com/v', base, {});
+    expect(result.file_path).toMatch(/\.mp4$/);
+  });
+
+  it('launches Chromium lazily inside download() (one launch per call)', async () => {
+    mocks.interceptMedia.mockResolvedValue({
+      kind: 'bytes',
+      buffer: Buffer.from('x'),
+      ext: 'mp4',
+    });
+    await download('https://example.com/v.mp4', base, {});
+    expect(mocks.launch).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe('downloader — code-review fixes (iteration 2)', () => {
+  let base;
+  let env;
+
+  beforeEach(async () => {
+    base = await mkdtemp(join(tmpdir(), 'bd-dl-'));
+    env = { ...process.env };
+    for (const m of Object.values(mocks)) {
+      m.mockReset();
+    }
+    mocks.newPage.mockResolvedValue({});
+    mocks.newContext.mockResolvedValue({
+      newPage: (...a) => mocks.newPage(...a),
+      close: (...a) => mocks.contextClose(...a),
+    });
+    mocks.launch.mockResolvedValue({
+      newContext: (...a) => mocks.newContext(...a),
+      close: (...a) => mocks.browserClose(...a),
+    });
+    mocks.contextClose.mockResolvedValue();
+    mocks.browserClose.mockResolvedValue();
+  });
+
+  afterEach(() => {
+    process.env = env;
+  });
+
+  it('closes the browser if newContext throws (no browser leak)', async () => {
+    mocks.newContext.mockRejectedValue(new Error('cannot create context'));
+    const result = await download('https://example.com/v', base, {});
+    expect(result.status).toBe('failed');
+    expect(mocks.browserClose).toHaveBeenCalledTimes(1);
+    expect(mocks.contextClose).not.toHaveBeenCalled();
+  });
+
+  it('respects BD_DOWNLOAD_TIMEOUT_MS for the streamlink download timeout', async () => {
+    process.env.BD_DOWNLOAD_TIMEOUT_MS = '60000';
+    mocks.interceptMedia.mockResolvedValue({
+      kind: 'manifest',
+      streamUrl: 'https://x/v.m3u8',
+      ext: 'mp4',
+    });
+    mocks.downloadStream.mockImplementation(async (_u, outPath) => {
+      await writeFile(outPath, 's');
+      return outPath;
+    });
+    const result = await download('https://example.com/v.m3u8', base, { tier1Timeout: 1000 });
+    expect(result.status).toBe('success');
+    expect(mocks.downloadStream.mock.calls[0][2].timeout).toBe(60_000);
+  });
+});
diff --git a/packages/browser-downloader/tests/errors.test.js b/packages/browser-downloader/tests/errors.test.js
new file mode 100644
index 00000000..0019fd81
--- /dev/null
+++ b/packages/browser-downloader/tests/errors.test.js
@@ -0,0 +1,86 @@
+import { describe, expect, it } from 'vitest';
+
+import { DownloaderError, ERROR_CODES, classifyError } from '../src/errors.js';
+
+describe('errors — classifyError', () => {
+  it('returns the code of a DownloaderError unchanged', () => {
+    expect(classifyError(new DownloaderError('drm_detected'))).toBe(ERROR_CODES.DRM_DETECTED);
+    expect(classifyError(new DownloaderError('anti_bot_block'))).toBe(ERROR_CODES.ANTI_BOT_BLOCK);
+    expect(classifyError(new DownloaderError('no_media_found'))).toBe(ERROR_CODES.NO_MEDIA_FOUND);
+  });
+
+  it('maps network errno codes to network_error', () => {
+    const e = new Error('connect refused');
+    e.code = 'ECONNREFUSED';
+    expect(classifyError(e)).toBe(ERROR_CODES.NETWORK_ERROR);
+  });
+
+  it('maps ENOTFOUND to network_error', () => {
+    const e = new Error('not found');
+    e.code = 'ENOTFOUND';
+    expect(classifyError(e)).toBe(ERROR_CODES.NETWORK_ERROR);
+  });
+
+  it('maps ETIMEDOUT to timeout', () => {
+    const e = new Error('timed out');
+    e.code = 'ETIMEDOUT';
+    expect(classifyError(e)).toBe(ERROR_CODES.TIMEOUT);
+  });
+
+  it('maps AbortError to timeout', () => {
+    const e = new Error('aborted');
+    e.name = 'AbortError';
+    expect(classifyError(e)).toBe(ERROR_CODES.TIMEOUT);
+  });
+
+  it('maps a fetch() TypeError with a network cause to network_error', () => {
+    const cause = new Error('ECONNREFUSED');
+    cause.code = 'ECONNREFUSED';
+    const e = new TypeError('fetch failed');
+    e.cause = cause;
+    expect(classifyError(e)).toBe(ERROR_CODES.NETWORK_ERROR);
+  });
+
+  it('does NOT map a bare TypeError to network_error (surfaces the bug)', () => {
+    expect(() => classifyError(new TypeError('boom'))).toThrow(TypeError);
+  });
+
+  it('does NOT map a ReferenceError to network_error (surfaces the bug)', () => {
+    expect(() => classifyError(new ReferenceError('x is not defined'))).toThrow(ReferenceError);
+  });
+
+  it('does NOT map a SyntaxError to network_error (surfaces the bug)', () => {
+    expect(() => classifyError(new SyntaxError('oops'))).toThrow(SyntaxError);
+  });
+
+  it('does NOT map a RangeError to network_error (surfaces the bug)', () => {
+    expect(() => classifyError(new RangeError('out of range'))).toThrow(RangeError);
+  });
+
+  it('rethrows a TypeError whose cause is an unrelated Error (real bug, not network)', () => {
+    const e = new TypeError('boom', { cause: new Error('whatever unrelated') });
+    expect(() => classifyError(e)).toThrow(TypeError);
+  });
+
+  it('rethrows a TypeError whose cause is a TypeError (bug in the cause, not network)', () => {
+    const e = new TypeError('boom', { cause: new TypeError('inner bug') });
+    expect(() => classifyError(e)).toThrow(TypeError);
+  });
+
+  it('classifies a TypeError whose cause carries a network errno as network_error', () => {
+    const cause = new Error('connect refused');
+    cause.code = 'ECONNRESET';
+    const e = new TypeError('fetch failed', { cause });
+    expect(classifyError(e)).toBe(ERROR_CODES.NETWORK_ERROR);
+  });
+
+  it('does not infinite-loop on a self-referential cause chain', () => {
+    const e = new TypeError('loop');
+    e.cause = e; // self-reference
+    expect(() => classifyError(e)).toThrow(TypeError);
+  });
+
+  it('defaults to network_error for unknown generic errors', () => {
+    expect(classifyError(new Error('something broke'))).toBe(ERROR_CODES.NETWORK_ERROR);
+  });
+});
diff --git a/packages/browser-downloader/tests/server.test.js b/packages/browser-downloader/tests/server.test.js
new file mode 100644
index 00000000..962368cb
--- /dev/null
+++ b/packages/browser-downloader/tests/server.test.js
@@ -0,0 +1,254 @@
+import { once } from 'node:events';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => ({
+  download: vi.fn(),
+  validateUrl: vi.fn(),
+  validateOutputDir: vi.fn(),
+}));
+
+vi.mock('../src/downloader.js', () => ({ download: (...a) => mocks.download(...a) }));
+vi.mock('../src/validate.js', async (importOriginal) => {
+  const actual = await importOriginal();
+  return {
+    ...actual,
+    validateUrl: (...a) => mocks.validateUrl(...a),
+    validateOutputDir: (...a) => mocks.validateOutputDir(...a),
+  };
+});
+
+import { createApp, startServer } from '../src/server.js';
+
+async function start() {
+  const server = createApp().listen(0);
+  await once(server, 'listening');
+  return { server, port: server.address().port };
+}
+
+function stop(server) {
+  return new Promise((resolve) => server.close(() => resolve()));
+}
+
+function post(port, body, init = {}) {
+  return fetch(`http://127.0.0.1:${port}/download`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', ...(init.headers || {}) },
+    body: typeof body === 'string' ? body : JSON.stringify(body),
+  });
+}
+
+describe('server — GET /health', () => {
+  it('returns { status: "ok" }', async () => {
+    const { server, port } = await start();
+    const res = await fetch(`http://127.0.0.1:${port}/health`);
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ status: 'ok' });
+    await stop(server);
+  });
+});
+
+describe('server — POST /download client errors (400)', () => {
+  let env;
+  beforeEach(() => {
+    env = { ...process.env };
+    mocks.validateUrl.mockReset();
+    mocks.validateOutputDir.mockReset();
+    mocks.download.mockReset();
+    mocks.validateUrl.mockResolvedValue(new URL('https://example.com'));
+    mocks.validateOutputDir.mockResolvedValue('/output');
+  });
+  afterEach(() => {
+    process.env = env;
+  });
+
+  it('rejects missing url/output_dir with 400', async () => {
+    const { server, port } = await start();
+    const res = await post(port, { url: 'https://x' });
+    expect(res.status).toBe(400);
+    const json = await res.json();
+    expect(json.error).toBe('invalid_request');
+    await stop(server);
+  });
+
+  it('rejects a non-string body object with 400', async () => {
+    const { server, port } = await start();
+    const res = await post(port, { url: 123, output_dir: '/output' });
+    expect(res.status).toBe(400);
+    await stop(server);
+  });
+
+  it('rejects an invalid url (validation failure) with 400', async () => {
+    mocks.validateUrl.mockRejectedValue(new Error('private host blocked'));
+    const { server, port } = await start();
+    const res = await post(port, { url: 'http://127.0.0.1/', output_dir: '/output' });
+    expect(res.status).toBe(400);
+    const json = await res.json();
+    expect(json.error).toBe('invalid_request');
+    expect(json.message).toMatch(/private/);
+    await stop(server);
+  });
+
+  it('rejects malformed JSON with 400', async () => {
+    const { server, port } = await start();
+    const res = await post(port, '{ not json', {
+      headers: { 'content-type': 'application/json' },
+    });
+    expect(res.status).toBe(400);
+    const json = await res.json();
+    expect(json.error).toBe('invalid_request');
+    await stop(server);
+  });
+
+  it('rejects an oversized body (413) as 400', async () => {
+    const { server, port } = await start();
+    const big = 'x'.repeat(1_100_000);
+    const res = await post(port, { url: 'https://x', output_dir: '/output', pad: big });
+    expect(res.status).toBe(400);
+    await stop(server);
+  });
+});
+
+describe('server — POST /download gateway errors (502) and success (200)', () => {
+  beforeEach(() => {
+    mocks.validateUrl.mockReset();
+    mocks.validateOutputDir.mockReset();
+    mocks.download.mockReset();
+    mocks.validateUrl.mockResolvedValue(new URL('https://example.com'));
+    mocks.validateOutputDir.mockResolvedValue('/output');
+  });
+
+  it('returns 502 when the downloader reports a failed status', async () => {
+    mocks.download.mockResolvedValue({ status: 'failed', error: 'drm_detected', tier_used: null });
+    const { server, port } = await start();
+    const res = await post(port, { url: 'https://example.com/v', output_dir: '/output' });
+    expect(res.status).toBe(502);
+    expect(await res.json()).toMatchObject({ status: 'failed', error: 'drm_detected' });
+    await stop(server);
+  });
+
+  it('returns 502 and logs when the downloader throws unexpectedly', async () => {
+    const errSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+    mocks.download.mockRejectedValue(new TypeError('boom'));
+    const { server, port } = await start();
+    const res = await post(port, { url: 'https://example.com/v', output_dir: '/output' });
+    expect(res.status).toBe(502);
+    const json = await res.json();
+    expect(json.status).toBe('failed');
+    expect(errSpy).toHaveBeenCalled(); // stack logged
+    errSpy.mockRestore();
+    await stop(server);
+  });
+
+  it('returns 200 on success', async () => {
+    mocks.download.mockResolvedValue({
+      status: 'success',
+      file_path: '/output/abc.mp4',
+      tier_used: 1,
+    });
+    const { server, port } = await start();
+    const res = await post(port, { url: 'https://example.com/v.mp4', output_dir: '/output' });
+    expect(res.status).toBe(200);
+    expect(await res.json()).toMatchObject({
+      status: 'success',
+      file_path: '/output/abc.mp4',
+      tier_used: 1,
+    });
+    await stop(server);
+  });
+});
+
+describe('server — concurrency overflow (503)', () => {
+  beforeEach(() => {
+    mocks.validateUrl.mockReset();
+    mocks.validateOutputDir.mockReset();
+    mocks.download.mockReset();
+    mocks.validateUrl.mockResolvedValue(new URL('https://example.com'));
+    mocks.validateOutputDir.mockResolvedValue('/output');
+  });
+
+  it('returns 503 when 2 downloads are in flight (semaphore max=2)', async () => {
+    const gate = [];
+    mocks.download.mockImplementation(() => new Promise((resolve) => gate.push(resolve)));
+    const { server, port } = await start();
+    const body = { url: 'https://example.com/v', output_dir: '/output' };
+    const r1 = post(port, body);
+    const r2 = post(port, body);
+    await new Promise((r) => setTimeout(r, 30)); // let both acquire
+    const r3 = await post(port, body);
+    expect(r3.status).toBe(503);
+    expect((await r3.json()).error).toBe('concurrency_limit');
+    for (const resolve of gate) {
+      resolve({ status: 'success', file_path: '/output/x.mp4', tier_used: 1 });
+    }
+    await r1;
+    await r2;
+    await stop(server);
+  });
+});
+
+describe('server — error event handling (EADDRINUSE)', () => {
+  it('handles the server error event without an unhandled crash', async () => {
+    const exitSpy = vi.spyOn(process, 'exit').mockImplementation(() => undefined);
+    const errSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+    const first = createApp().listen(0);
+    await once(first, 'listening');
+    const port = first.address().port;
+
+    const second = startServer(createApp(), port); // EADDRINUSE
+    await new Promise((r) => setTimeout(r, 50));
+    expect(exitSpy).toHaveBeenCalledWith(1);
+    expect(errSpy).toHaveBeenCalled();
+
+    second.close?.(() => {});
+    await stop(first);
+    exitSpy.mockRestore();
+    errSpy.mockRestore();
+  });
+
+  it('handles an EACCES listen error (and any fatal listen error) without crashing', async () => {
+    const exitSpy = vi.spyOn(process, 'exit').mockImplementation(() => undefined);
+    const errSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+    const server = startServer(createApp(), 0);
+    await once(server, 'listening');
+    server.emit('error', Object.assign(new Error('permission denied'), { code: 'EACCES' }));
+    await new Promise((r) => setTimeout(r, 30));
+    expect(exitSpy).toHaveBeenCalledWith(1);
+    expect(errSpy).toHaveBeenCalled();
+    await stop(server);
+    exitSpy.mockRestore();
+    errSpy.mockRestore();
+  });
+});
+
+describe('server — per-request timeout releases the semaphore slot', () => {
+  let env;
+  beforeEach(() => {
+    env = { ...process.env };
+    mocks.validateUrl.mockReset();
+    mocks.validateOutputDir.mockReset();
+    mocks.download.mockReset();
+    mocks.validateUrl.mockResolvedValue(new URL('https://example.com'));
+    mocks.validateOutputDir.mockResolvedValue('/output');
+  });
+  afterEach(() => {
+    process.env = env;
+  });
+
+  it('returns 502 and frees the slot when a download hangs past the request timeout', async () => {
+    process.env.BD_REQUEST_TIMEOUT_MS = '80';
+    // First download never resolves → the request-timeout race must reject.
+    mocks.download.mockImplementationOnce(() => new Promise(() => {}));
+    mocks.download.mockResolvedValue({
+      status: 'success',
+      file_path: '/output/x.mp4',
+      tier_used: 1,
+    });
+    const { server, port } = await start();
+    const res1 = await post(port, { url: 'https://example.com/v', output_dir: '/output' });
+    expect(res1.status).toBe(502); // timed out
+    // The slot was released by the timeout: a follow-up request is NOT 503.
+    const res2 = await post(port, { url: 'https://example.com/v', output_dir: '/output' });
+    expect(res2.status).toBe(200);
+    await stop(server);
+  });
+});
diff --git a/packages/browser-downloader/tests/streamlink-backend.test.js b/packages/browser-downloader/tests/streamlink-backend.test.js
new file mode 100644
index 00000000..afec1ae9
--- /dev/null
+++ b/packages/browser-downloader/tests/streamlink-backend.test.js
@@ -0,0 +1,330 @@
+import { EventEmitter } from 'node:events';
+import { describe, expect, it, vi } from 'vitest';
+
+const hoisted = vi.hoisted(() => ({ spawn: vi.fn() }));
+
+vi.mock('node:child_process', () => ({
+  spawn: (...args) => hoisted.spawn(...args),
+}));
+
+import { downloadManifestFallback, downloadStream, runSpawn } from '../src/streamlink-backend.js';
+
+function fakeChild({ autoClose = true, code = 0 } = {}) {
+  const child = new EventEmitter();
+  child.stderr = new EventEmitter();
+  child.stdout = new EventEmitter();
+  child.kill = vi.fn((sig) => {
+    if (autoClose && (sig === 'SIGTERM' || sig === 'SIGKILL')) {
+      child.emit('close', code);
+    }
+  });
+  return child;
+}
+
+// DNS lookup stub returning a public address so validateUrl passes in tests
+// (no real DNS resolution). Pass as `lookup` to downloadStream/downloadManifestFallback.
+const publicLookup = async () => [{ address: '203.0.113.10' }];
+
+// Build a fetch Response-like object with real Headers (so res.headers.get
+// works for the redirect + content-length checks in fetchRes).
+function okRes({ text, arrayBuffer, status = 200, headers = {} } = {}) {
+  return {
+    ok: status >= 200 && status < 300,
+    status,
+    headers: new Headers(headers),
+    ...(text !== undefined ? { text: async () => text } : {}),
+    ...(arrayBuffer !== undefined ? { arrayBuffer: async () => arrayBuffer } : {}),
+  };
+}
+
+describe('streamlink backend — downloadStream', () => {
+  it('spawns streamlink and drains stderr on success', async () => {
+    const child = fakeChild();
+    hoisted.spawn.mockImplementation(() => {
+      process.nextTick(() => child.emit('close', 0));
+      return child;
+    });
+    const out = await downloadStream('https://x/v.m3u8', '/tmp/out.mp4', {
+      timeout: 5000,
+      lookup: publicLookup,
+    });
+    expect(out).toBe('/tmp/out.mp4');
+    expect(hoisted.spawn).toHaveBeenCalled();
+    expect(hoisted.spawn.mock.calls[0][0]).toBe('streamlink');
+    // stderr 'data' listener attached → pipe drained
+    expect(child.stderr.listenerCount('data')).toBeGreaterThanOrEqual(1);
+  });
+
+  it('throws network_error when streamlink fails on DASH (no manual fallback)', async () => {
+    const child = fakeChild();
+    hoisted.spawn.mockImplementation(() => {
+      process.nextTick(() => child.emit('close', 1));
+      return child;
+    });
+    await expect(
+      downloadStream('https://x/v.mpd', '/tmp/out.mp4', { timeout: 5000, lookup: publicLookup }),
+    ).rejects.toThrow(/streamlink failed/);
+  });
+});
+
+describe('streamlink backend — runSpawn resource lifecycle', () => {
+  it('kills the subprocess on timeout', async () => {
+    const child = fakeChild({ autoClose: true });
+    hoisted.spawn.mockImplementation(() => child); // never emits close on its own
+    await runSpawn('sleep', ['99'], { timeout: 50 });
+    expect(child.kill).toHaveBeenCalledWith('SIGTERM');
+  });
+
+  it('kills the subprocess when the AbortSignal fires', async () => {
+    const child = fakeChild({ autoClose: true });
+    hoisted.spawn.mockImplementation(() => child);
+    const ac = new AbortController();
+    const p = runSpawn('sleep', ['99'], { timeout: 60_000, signal: ac.signal });
+    ac.abort();
+    await p;
+    expect(child.kill).toHaveBeenCalledWith('SIGTERM');
+  });
+});
+
+describe('streamlink backend — HLS fallback correctness', () => {
+  it('fails with drm_detected on encrypted HLS (#EXT-X-KEY with SAMPLE-AES) without fetching segments', async () => {
+    let calls = 0;
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async () => {
+        calls += 1;
+        return okRes({
+          text: '#EXTM3U\n#EXT-X-KEY:METHOD=SAMPLE-AES,URI="skd://key"\nseg0.ts\n',
+        });
+      }),
+    );
+    await expect(
+      downloadManifestFallback('https://x/master.m3u8', '/tmp/out.mp4', { timeout: 1000 }),
+    ).rejects.toMatchObject({ code: 'drm_detected' });
+    expect(calls).toBe(1); // manifest only — no segment fetch
+    vi.unstubAllGlobals();
+  });
+
+  it('allows AES-128 with identity keyformat (plain encryption, not DRM)', async () => {
+    let calls = 0;
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async (_url) => {
+        calls += 1;
+        if (calls === 1) {
+          return okRes({
+            text: '#EXTM3U\n#EXT-X-KEY:METHOD=AES-128,URI="https://k/key",KEYFORMAT="identity",IV=0x1234\nseg0.ts\n',
+          });
+        }
+        // segment fetch
+        return okRes({ arrayBuffer: new ArrayBuffer(8) });
+      }),
+    );
+    const child = fakeChild();
+    hoisted.spawn.mockImplementation(() => {
+      process.nextTick(() => child.emit('close', 0));
+      return child;
+    });
+    const out = await downloadManifestFallback('https://x/m.m3u8', '/tmp/out.mp4', {
+      timeout: 5000,
+      lookup: publicLookup,
+    });
+    expect(out).toBe('/tmp/out.mp4');
+    expect(calls).toBeGreaterThan(1); // manifest + segment fetches
+    vi.unstubAllGlobals();
+  });
+
+  it('recurses into variant playlists preserving query strings', async () => {
+    const seen = [];
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async (url) => {
+        seen.push(url);
+        if (url.includes('master')) {
+          return okRes({
+            text: '#EXTM3U\n#EXT-X-STREAM-INF:BANDWIDTH=1000000\nvariant.m3u8?token=abc\n',
+          });
+        }
+        if (url.includes('variant.m3u8')) {
+          return okRes({ text: '#EXTM3U\nseg0.ts?sig=z\n' });
+        }
+        return okRes({ arrayBuffer: new ArrayBuffer(8) });
+      }),
+    );
+    const child = fakeChild();
+    hoisted.spawn.mockImplementation(() => {
+      process.nextTick(() => child.emit('close', 0));
+      return child;
+    });
+
+    const out = await downloadManifestFallback('https://x/master.m3u8', '/tmp/out.mp4', {
+      timeout: 5000,
+      lookup: publicLookup,
+    });
+    expect(out).toBe('/tmp/out.mp4');
+    expect(seen.some((u) => u.includes('variant.m3u8?token=abc'))).toBe(true);
+    expect(seen.some((u) => u.includes('seg0.ts?sig=z'))).toBe(true);
+    // ffmpeg was invoked for concat
+    expect(hoisted.spawn.mock.calls.some((c) => c[0] === 'ffmpeg')).toBe(true);
+    vi.unstubAllGlobals();
+  });
+
+  it('propagates a fetch timeout (AbortController)', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async (_url, init) => {
+        const e = new Error('aborted');
+        e.name = 'AbortError';
+        if (init?.signal) {
+          throw e;
+        }
+        throw new Error('no signal');
+      }),
+    );
+    await expect(
+      downloadManifestFallback('https://x/m.m3u8', '/tmp/o.mp4', { timeout: 500 }),
+    ).rejects.toThrow();
+    vi.unstubAllGlobals();
+  });
+});
+
+describe('streamlink backend — code-review fixes (iteration 2)', () => {
+  it('fails with drm_detected on #EXT-X-SESSION-KEY with SAMPLE-AES without fetching segments', async () => {
+    let calls = 0;
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async () => {
+        calls += 1;
+        return okRes({
+          text: '#EXTM3U\n#EXT-X-SESSION-KEY:METHOD=SAMPLE-AES,URI="skd://key"\nseg0.ts\n',
+        });
+      }),
+    );
+    await expect(
+      downloadManifestFallback('https://x/master.m3u8', '/tmp/out.mp4', { timeout: 1000 }),
+    ).rejects.toMatchObject({ code: 'drm_detected' });
+    expect(calls).toBe(1); // manifest only — no segment fetch
+    vi.unstubAllGlobals();
+  });
+
+  it('pickVariantUrl continues past a bad variant line to a valid one', async () => {
+    const seen = [];
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async (url) => {
+        seen.push(url);
+        if (url.includes('master')) {
+          // First variant line is unparseable (new URL throws); second is valid.
+          return okRes({
+            text: '#EXTM3U\n#EXT-X-STREAM-INF:BANDWIDTH=1\nhttp://[::1\n#EXT-X-STREAM-INF:BANDWIDTH=2\nok.m3u8\n',
+          });
+        }
+        if (url.includes('ok.m3u8')) {
+          return okRes({ text: '#EXTM3U\nseg0.ts\n' });
+        }
+        return okRes({ arrayBuffer: new ArrayBuffer(8) });
+      }),
+    );
+    const child = fakeChild();
+    hoisted.spawn.mockImplementation(() => {
+      process.nextTick(() => child.emit('close', 0));
+      return child;
+    });
+    const out = await downloadManifestFallback('https://x/master.m3u8', '/tmp/out.mp4', {
+      timeout: 5000,
+      lookup: publicLookup,
+    });
+    expect(out).toBe('/tmp/out.mp4');
+    // The valid variant (ok.m3u8) was fetched, proving the bad line was skipped.
+    expect(seen.some((u) => u.includes('ok.m3u8'))).toBe(true);
+    vi.unstubAllGlobals();
+  });
+
+  it('rejects a variant that resolves to a private IP (SSRF) and skips it', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async (url) => {
+        if (url.includes('master')) {
+          return okRes({
+            text: '#EXTM3U\n#EXT-X-STREAM-INF:BANDWIDTH=1\nhttp://169.254.169.254/x.m3u8\n',
+          });
+        }
+        return okRes({ text: '#EXTM3U\nseg0.ts\n' });
+      }),
+    );
+    // Only a private-IP variant → none valid → network_error (never fetched).
+    await expect(
+      downloadManifestFallback('https://x/master.m3u8', '/tmp/out.mp4', {
+        timeout: 5000,
+        lookup: publicLookup,
+      }),
+    ).rejects.toThrow(/variant url/);
+    vi.unstubAllGlobals();
+  });
+
+  it('bounds master-playlist recursion (depth > 5 → network_error)', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async () =>
+        okRes({
+          // self-referencing master: variant URL is the same master URL
+          text: '#EXTM3U\n#EXT-X-STREAM-INF:BANDWIDTH=1\nmaster.m3u8\n',
+        }),
+      ),
+    );
+    await expect(
+      downloadManifestFallback('https://x/master.m3u8', '/tmp/out.mp4', {
+        timeout: 60_000,
+        lookup: publicLookup,
+      }),
+    ).rejects.toThrow(/depth exceeded/);
+    vi.unstubAllGlobals();
+  });
+
+  it('rejects a redirect to a private IP (redirect-SSRF defence)', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async () =>
+        okRes({ status: 302, headers: { location: 'http://169.254.169.254/seg.ts' } }),
+      ),
+    );
+    await expect(
+      downloadManifestFallback('https://x/m.m3u8', '/tmp/o.mp4', {
+        timeout: 5000,
+        lookup: publicLookup,
+      }),
+    ).rejects.toThrow(/private|link-local|resolves/i);
+    vi.unstubAllGlobals();
+  });
+
+  it('rejects a manifest whose Content-Length exceeds the body cap', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async () =>
+        okRes({ text: 'x'.repeat(100), headers: { 'content-length': '999999999' } }),
+      ),
+    );
+    await expect(
+      downloadManifestFallback('https://x/m.m3u8', '/tmp/o.mp4', {
+        timeout: 5000,
+        lookup: publicLookup,
+        bodyCap: 1024,
+      }),
+    ).rejects.toThrow(/size cap/);
+    vi.unstubAllGlobals();
+  });
+
+  it('detects HLS/DASH URLs with fragments (#) and query strings (?)', async () => {
+    hoisted.spawn.mockImplementation(() => {
+      const c = fakeChild();
+      process.nextTick(() => c.emit('close', 0));
+      return c;
+    });
+    // `.m3u8#t=0` and `.m3u8?token=` must be detected as HLS (else DASH
+    // "no manual fallback" path would throw on a streamlink failure).
+    for (const u of ['https://x/stream.m3u8?token=abc', 'https://x/v.m3u8#t=0']) {
+      await downloadStream(u, '/tmp/out.mp4', { timeout: 5000, lookup: publicLookup });
+    }
+    expect(hoisted.spawn).toHaveBeenCalled();
+  });
+});
diff --git a/packages/browser-downloader/tests/tier1-cdp.test.js b/packages/browser-downloader/tests/tier1-cdp.test.js
new file mode 100644
index 00000000..0bcc892c
--- /dev/null
+++ b/packages/browser-downloader/tests/tier1-cdp.test.js
@@ -0,0 +1,350 @@
+import { describe, expect, it, vi } from 'vitest';
+
+import { interceptMedia } from '../src/tier1-cdp.js';
+
+function makePage({ drm = false, block = false, getResponseBody, authHeaders = null } = {}) {
+  const handlers = {};
+  const pageHandlers = {};
+  const client = {
+    send: vi.fn(async (cmd, args) => {
+      if (cmd === 'Network.getResponseBody') {
+        return getResponseBody ? getResponseBody(args) : { body: '', base64Encoded: false };
+      }
+      return {};
+    }),
+    on: vi.fn((event, cb) => {
+      if (!handlers[event]) {
+        handlers[event] = [];
+      }
+      handlers[event].push(cb);
+    }),
+    detach: vi.fn(async () => {}),
+  };
+  const page = {
+    context: () => ({ newCDPSession: async () => client }),
+    addInitScript: vi.fn(async () => {}),
+    on: vi.fn((event, cb) => {
+      if (!pageHandlers[event]) {
+        pageHandlers[event] = [];
+      }
+      pageHandlers[event].push(cb);
+    }),
+    waitForLoadState: vi.fn(async () => {}),
+    goto: vi.fn(async () => {}),
+    evaluate: vi.fn(async (fn) => {
+      const src = fn.toString();
+      if (src.includes('__bd_drm')) {
+        return drm;
+      }
+      if (src.includes('__bd_auth_headers')) {
+        return authHeaders;
+      }
+      if (src.includes('document.title')) {
+        return block;
+      }
+      return undefined;
+    }),
+  };
+  const emit = (event, payload) => {
+    for (const cb of handlers[event] || []) {
+      cb(payload);
+    }
+  };
+  const emitPage = (event, payload) => {
+    for (const cb of pageHandlers[event] || []) {
+      cb(payload);
+    }
+  };
+  return { page, client, emit, emitPage };
+}
+
+const flush = () => new Promise((r) => setTimeout(r, 0));
+
+describe('tier1-cdp — interception', () => {
+  it('returns bytes for a direct video response', async () => {
+    const body = Buffer.from('video-bytes');
+    const { page, client, emit } = makePage({
+      getResponseBody: () => ({ body: body.toString('base64'), base64Encoded: true }),
+    });
+    const p = interceptMedia(page, 'https://x/v.mp4', { timeout: 1000 });
+    await flush();
+    emit('Network.responseReceived', {
+      requestId: 'r1',
+      response: { url: 'https://x/v.mp4', mimeType: 'video/mp4', status: 200 },
+    });
+    emit('Network.loadingFinished', { requestId: 'r1' });
+    const result = await p;
+    expect(result).toMatchObject({ kind: 'bytes', ext: 'mp4' });
+    expect(result.buffer.toString()).toBe('video-bytes');
+    expect(client.detach).toHaveBeenCalledTimes(1);
+  });
+
+  it('returns a manifest descriptor for HLS/DASH URLs (routes to streamlink, DRM-free)', async () => {
+    const { page, emit } = makePage({
+      getResponseBody: () => ({
+        body: '#EXTM3U\n#EXTINF:10,\nseg0.ts\n',
+        base64Encoded: false,
+      }),
+    });
+    const p = interceptMedia(page, 'https://x/v.m3u8', { timeout: 1000 });
+    await flush();
+    emit('Network.responseReceived', {
+      requestId: 'r1',
+      response: {
+        url: 'https://x/v.m3u8?token=1',
+        mimeType: 'application/vnd.apple.mpegurl',
+        status: 200,
+      },
+    });
+    emit('Network.loadingFinished', { requestId: 'r1' });
+    const result = await p;
+    expect(result).toMatchObject({ kind: 'manifest', ext: 'mp4' });
+    expect(result.streamUrl).toBe('https://x/v.m3u8?token=1');
+  });
+
+  it('detects DRM in an HLS manifest (#EXT-X-KEY with SAMPLE-AES) and throws drm_detected', async () => {
+    const { page, client, emit } = makePage({
+      getResponseBody: () => ({
+        body: '#EXTM3U\n#EXT-X-KEY:METHOD=SAMPLE-AES,URI="skd://key"\nseg0.ts\n',
+        base64Encoded: false,
+      }),
+    });
+    const p = interceptMedia(page, 'https://x/v.m3u8', { timeout: 1000 });
+    await flush();
+    emit('Network.responseReceived', {
+      requestId: 'r1',
+      response: { url: 'https://x/v.m3u8', mimeType: 'application/vnd.apple.mpegurl', status: 200 },
+    });
+    emit('Network.loadingFinished', { requestId: 'r1' });
+    await expect(p).rejects.toMatchObject({ code: 'drm_detected' });
+    expect(client.detach).toHaveBeenCalledTimes(1);
+  });
+
+  it('detects DRM in an HLS manifest (non-identity KEYFORMAT) and throws drm_detected', async () => {
+    const { page, client, emit } = makePage({
+      getResponseBody: () => ({
+        body: '#EXTM3U\n#EXT-X-KEY:METHOD=AES-128,URI="k",KEYFORMAT="com.apple.streamingkeydelivery"\nseg0.ts\n',
+        base64Encoded: false,
+      }),
+    });
+    const p = interceptMedia(page, 'https://x/v.m3u8', { timeout: 1000 });
+    await flush();
+    emit('Network.responseReceived', {
+      requestId: 'r1',
+      response: { url: 'https://x/v.m3u8', mimeType: 'application/vnd.apple.mpegurl', status: 200 },
+    });
+    emit('Network.loadingFinished', { requestId: 'r1' });
+    await expect(p).rejects.toMatchObject({ code: 'drm_detected' });
+    expect(client.detach).toHaveBeenCalledTimes(1);
+  });
+
+  it('detects DRM in a DASH manifest (ContentProtection) and throws drm_detected', async () => {
+    const { page, client, emit } = makePage({
+      getResponseBody: () => ({
+        body: '<MPD><Period><AdaptationSet><ContentProtection schemeIdUri="urn:uuid:edef8ba9-79d6-4ace-a3c8-27dcd51d21ed"/></AdaptationSet></Period></MPD>',
+        base64Encoded: false,
+      }),
+    });
+    const p = interceptMedia(page, 'https://x/v.mpd', { timeout: 1000 });
+    await flush();
+    emit('Network.responseReceived', {
+      requestId: 'r1',
+      response: { url: 'https://x/v.mpd', mimeType: 'application/dash+xml', status: 200 },
+    });
+    emit('Network.loadingFinished', { requestId: 'r1' });
+    await expect(p).rejects.toMatchObject({ code: 'drm_detected' });
+    expect(client.detach).toHaveBeenCalledTimes(1);
+  });
+
+  it('attaches authHeaders to manifest result when captured via CDP', async () => {
+    const { page, emit } = makePage({
+      getResponseBody: () => ({
+        body: '#EXTM3U\n#EXTINF:10,\nseg0.ts\n',
+        base64Encoded: false,
+      }),
+    });
+    const p = interceptMedia(page, 'https://x/v.m3u8', { timeout: 1000 });
+    await flush();
+    // CDP normalizes header names to lowercase.
+    emit('Network.requestWillBeSent', {
+      requestId: 'r1',
+      request: { headers: { referer: 'https://x/page', origin: 'https://x' } },
+    });
+    emit('Network.responseReceived', {
+      requestId: 'r1',
+      response: { url: 'https://x/v.m3u8', mimeType: 'application/vnd.apple.mpegurl', status: 200 },
+    });
+    emit('Network.loadingFinished', { requestId: 'r1' });
+    const result = await p;
+    expect(result.kind).toBe('manifest');
+    expect(result.authHeaders).toEqual({ referer: 'https://x/page', origin: 'https://x' });
+  });
+
+  it('allows AES-128 with identity keyformat (not DRM)', async () => {
+    const { page, emit } = makePage({
+      getResponseBody: () => ({
+        body: '#EXTM3U\n#EXT-X-KEY:METHOD=AES-128,URI="k",KEYFORMAT="identity",IV=0x1234\nseg0.ts\n',
+        base64Encoded: false,
+      }),
+    });
+    const p = interceptMedia(page, 'https://x/v.m3u8', { timeout: 1000 });
+    await flush();
+    emit('Network.responseReceived', {
+      requestId: 'r1',
+      response: { url: 'https://x/v.m3u8', mimeType: 'application/vnd.apple.mpegurl', status: 200 },
+    });
+    emit('Network.loadingFinished', { requestId: 'r1' });
+    const result = await p;
+    expect(result).toMatchObject({ kind: 'manifest' }); // allowed through
+  });
+
+  it('rejects a manifest body that exceeds the manifest cap (8 MiB)', async () => {
+    const big = 'x'.repeat(9 * 1024 * 1024); // 9 MiB
+    const { page, client, emit } = makePage({
+      getResponseBody: () => ({ body: big, base64Encoded: false }),
+    });
+    const p = interceptMedia(page, 'https://x/v.m3u8', { timeout: 1000 });
+    await flush();
+    emit('Network.responseReceived', {
+      requestId: 'r1',
+      response: { url: 'https://x/v.m3u8', mimeType: 'application/vnd.apple.mpegurl', status: 200 },
+    });
+    emit('Network.loadingFinished', { requestId: 'r1' });
+    await expect(p).rejects.toMatchObject({ code: 'network_error' });
+    expect(client.detach).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe('tier1-cdp — terminal conditions (no fallthrough)', () => {
+  it('throws anti_bot_block on HTTP 403', async () => {
+    const { page, client, emit } = makePage();
+    const p = interceptMedia(page, 'https://x/v', { timeout: 1000 });
+    await flush();
+    emit('Network.responseReceived', {
+      requestId: 'r1',
+      response: { url: 'https://x/v', mimeType: 'text/html', status: 403 },
+    });
+    await expect(p).rejects.toMatchObject({ code: 'anti_bot_block' });
+    expect(client.detach).toHaveBeenCalledTimes(1);
+  });
+
+  it('throws anti_bot_block on a block-page (main document)', async () => {
+    const { page, client, emitPage } = makePage();
+    const p = interceptMedia(page, 'https://x/v', { timeout: 1000 });
+    await flush();
+    emitPage('response', { status: () => 403, url: () => 'https://x/v' });
+    await expect(p).rejects.toMatchObject({ code: 'anti_bot_block' });
+    expect(client.detach).toHaveBeenCalledTimes(1);
+  });
+
+  it('throws drm_detected when EME is engaged', async () => {
+    const { page, client } = makePage({ drm: true });
+    const p = interceptMedia(page, 'https://x/v', { timeout: 2000 });
+    await expect(p).rejects.toMatchObject({ code: 'drm_detected' });
+    expect(client.detach).toHaveBeenCalledTimes(1);
+  });
+
+  it('throws anti_bot_block on block-page text indicators', async () => {
+    const { page, client } = makePage({ block: true });
+    const p = interceptMedia(page, 'https://x/v', { timeout: 2000 });
+    await expect(p).rejects.toMatchObject({ code: 'anti_bot_block' });
+    expect(client.detach).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe('tier1-cdp — fallthrough + lifecycle', () => {
+  it('resolves null on timeout (fallthrough to Tier 2, never terminal)', async () => {
+    const { page, client } = makePage();
+    const p = interceptMedia(page, 'https://x/v', { timeout: 200 });
+    await expect(p).resolves.toBeNull();
+    expect(client.detach).toHaveBeenCalledTimes(1);
+  });
+
+  it('clears the fallthrough timer when media resolves early', async () => {
+    const body = Buffer.from('abc');
+    const { page, client, emit } = makePage({
+      getResponseBody: () => ({ body: body.toString('base64'), base64Encoded: true }),
+    });
+    const clearSpy = vi.spyOn(globalThis, 'clearTimeout');
+    const p = interceptMedia(page, 'https://x/v.mp4', { timeout: 1000 });
+    await flush();
+    emit('Network.responseReceived', {
+      requestId: 'r1',
+      response: { url: 'https://x/v.mp4', mimeType: 'video/mp4', status: 200 },
+    });
+    emit('Network.loadingFinished', { requestId: 'r1' });
+    const result = await p;
+    expect(result.kind).toBe('bytes');
+    expect(clearSpy).toHaveBeenCalled(); // fallthrough timer cleared
+    expect(client.detach).toHaveBeenCalledTimes(1);
+    clearSpy.mockRestore();
+  });
+
+  it('rejects oversized response bodies (size cap)', async () => {
+    const big = Buffer.alloc(10);
+    const { page, client, emit } = makePage({
+      getResponseBody: () => ({ body: big.toString('base64'), base64Encoded: true }),
+    });
+    const p = interceptMedia(page, 'https://x/v.mp4', { timeout: 1000, bodyCap: 5 });
+    await flush();
+    emit('Network.responseReceived', {
+      requestId: 'r1',
+      response: { url: 'https://x/v.mp4', mimeType: 'video/mp4', status: 200 },
+    });
+    emit('Network.loadingFinished', { requestId: 'r1' });
+    await expect(p).rejects.toMatchObject({ code: 'network_error' });
+    expect(client.detach).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe('tier1-cdp — code-review fixes (iteration 2)', () => {
+  it('does NOT treat a subresource 403 as anti_bot_block (false positive)', async () => {
+    const { page, client, emit } = makePage();
+    const p = interceptMedia(page, 'https://x/v', { timeout: 300 });
+    await flush();
+    emit('Network.responseReceived', {
+      requestId: 'r1',
+      response: { url: 'https://ads.example.com/pixel', mimeType: 'image/png', status: 403 },
+    });
+    await expect(p).resolves.toBeNull();
+    expect(client.detach).toHaveBeenCalledTimes(1);
+  });
+
+  it('treats a 403 on the main document (CDP type Document) as anti_bot_block', async () => {
+    const { page, client, emit } = makePage();
+    const p = interceptMedia(page, 'https://x/v', { timeout: 1000 });
+    await flush();
+    emit('Network.responseReceived', {
+      requestId: 'r1',
+      type: 'Document',
+      response: { url: 'https://other.example/v', mimeType: 'text/html', status: 403 },
+    });
+    await expect(p).rejects.toMatchObject({ code: 'anti_bot_block' });
+    expect(client.detach).toHaveBeenCalledTimes(1);
+  });
+
+  it('detaches the CDP session if Network.enable throws (no leak on early throw)', async () => {
+    const client = {
+      send: vi.fn(async (cmd) => {
+        if (cmd === 'Network.enable') {
+          throw new Error('cdp enable failed');
+        }
+        return {};
+      }),
+      on: vi.fn(),
+      detach: vi.fn(async () => {}),
+    };
+    const page = {
+      context: () => ({ newCDPSession: async () => client }),
+      addInitScript: vi.fn(async () => {}),
+      on: vi.fn(),
+      waitForLoadState: vi.fn(async () => {}),
+      goto: vi.fn(async () => {}),
+      evaluate: vi.fn(async () => false),
+    };
+    await expect(interceptMedia(page, 'https://x/v', { timeout: 1000 })).rejects.toThrow(
+      /cdp enable/,
+    );
+    expect(client.detach).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/packages/browser-downloader/tests/tier2-dom.test.js b/packages/browser-downloader/tests/tier2-dom.test.js
new file mode 100644
index 00000000..e2207bcd
--- /dev/null
+++ b/packages/browser-downloader/tests/tier2-dom.test.js
@@ -0,0 +1,129 @@
+import { describe, expect, it, vi } from 'vitest';
+
+import { detectBlob, pushBlobUrl } from '../src/tier2-dom.js';
+
+function makeTier2Page({ drmSequence = [false], block = false, blobUrl = null, payload = null }) {
+  let drmIdx = 0;
+  const evaluate = vi.fn(async (fn) => {
+    const src = fn.toString();
+    if (src.includes('createObjectURL')) {
+      return undefined; // HOOK_SRC patch
+    }
+    if (src.includes('__bd_drm')) {
+      const v =
+        drmIdx < drmSequence.length ? drmSequence[drmIdx] : drmSequence[drmSequence.length - 1];
+      drmIdx += 1;
+      return v;
+    }
+    if (src.includes('document.title')) {
+      return block;
+    }
+    if (src.includes('querySelector')) {
+      return blobUrl;
+    }
+    if (src.includes('arrayBuffer')) {
+      return payload;
+    }
+    return undefined;
+  });
+  const page = { evaluate, $: vi.fn(async () => null) };
+  return { page, evaluate };
+}
+
+const calledSelector = (evaluate) =>
+  evaluate.mock.calls.some(([fn]) => fn.toString().includes('querySelector'));
+
+describe('tier2-dom — pushBlobUrl helper (cap + non-Blob guard)', () => {
+  it('records Blob inputs only (non-Blob / MediaSource guard)', () => {
+    const arr = [];
+    pushBlobUrl(arr, new Blob(['x']), 'blob:a');
+    expect(arr).toEqual(['blob:a']);
+    // a plain object (MediaSource-like) must NOT be recorded
+    pushBlobUrl(arr, { sourceBuffers: [] }, 'blob:b');
+    expect(arr).toEqual(['blob:a']);
+  });
+
+  it('evicts the oldest entry beyond the cap', () => {
+    const arr = [];
+    for (let i = 0; i < 5; i += 1) {
+      pushBlobUrl(arr, new Blob(['x']), `blob:${i}`, 3);
+    }
+    expect(arr).toEqual(['blob:2', 'blob:3', 'blob:4']);
+  });
+});
+
+describe('tier2-dom — terminal conditions BEFORE polling (no no_media_found masking)', () => {
+  it('throws drm_detected when EME is engaged before polling', async () => {
+    const { page, evaluate } = makeTier2Page({ drmSequence: [true] });
+    await expect(detectBlob(page, { timeout: 1000 })).rejects.toMatchObject({
+      code: 'drm_detected',
+    });
+    expect(calledSelector(evaluate)).toBe(false); // never polled for blobs
+  });
+
+  it('throws anti_bot_block on block-page indicators before polling', async () => {
+    const { page, evaluate } = makeTier2Page({ block: true, drmSequence: [false] });
+    await expect(detectBlob(page, { timeout: 1000 })).rejects.toMatchObject({
+      code: 'anti_bot_block',
+    });
+    expect(calledSelector(evaluate)).toBe(false);
+  });
+});
+
+describe('tier2-dom — blob detection + lifecycle', () => {
+  it('returns bytes when a blob URL is found', async () => {
+    const { page } = makeTier2Page({
+      blobUrl: 'blob:https://x/abc',
+      payload: { bytes: [65, 66, 67], type: 'video/mp4', size: 3 },
+      drmSequence: [false],
+    });
+    const result = await detectBlob(page, { timeout: 1000 });
+    expect(result).toMatchObject({ kind: 'bytes', ext: 'mp4' });
+    expect(result.buffer.toString()).toBe('ABC');
+  });
+
+  it('rejects oversized blob bodies (size cap backstop)', async () => {
+    const { page } = makeTier2Page({
+      blobUrl: 'blob:https://x/big',
+      payload: { bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], type: 'video/mp4', size: 10 },
+      drmSequence: [false],
+    });
+    await expect(detectBlob(page, { timeout: 1000, bodyCap: 5 })).rejects.toMatchObject({
+      code: 'network_error',
+    });
+  });
+
+  it('rejects a blob whose content-length exceeds the cap BEFORE materializing (tooLarge)', async () => {
+    // `tooLarge: true` with no `bytes` simulates the in-page content-length
+    // check rejecting before Array.from(new Uint8Array(ab)) runs.
+    const { page } = makeTier2Page({
+      blobUrl: 'blob:https://x/big',
+      payload: { tooLarge: true, type: 'video/mp4', size: 999_999_999 },
+      drmSequence: [false],
+    });
+    await expect(detectBlob(page, { timeout: 1000, bodyCap: 1024 })).rejects.toMatchObject({
+      code: 'network_error',
+    });
+  });
+
+  it('throws drm_detected when EME engages DURING polling (late DRM)', async () => {
+    const { page, evaluate } = makeTier2Page({
+      blobUrl: null,
+      drmSequence: [false, true], // before-poll false, then true during poll
+    });
+    await expect(detectBlob(page, { timeout: 1000 })).rejects.toMatchObject({
+      code: 'drm_detected',
+    });
+    expect(calledSelector(evaluate)).toBe(true); // it did poll before DRM engaged
+  });
+
+  it('throws no_media_found when the timeout expires with no blob', async () => {
+    const { page } = makeTier2Page({
+      blobUrl: null,
+      payload: null,
+      drmSequence: [false, false, false],
+    });
+    const p = detectBlob(page, { timeout: 200 });
+    await expect(p).rejects.toMatchObject({ code: 'no_media_found' });
+  });
+});
diff --git a/packages/browser-downloader/tests/validate.test.js b/packages/browser-downloader/tests/validate.test.js
new file mode 100644
index 00000000..c0277054
--- /dev/null
+++ b/packages/browser-downloader/tests/validate.test.js
@@ -0,0 +1,204 @@
+import { mkdir, mkdtemp } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { describe, expect, it } from 'vitest';
+
+import {
+  VIDEO_EXTS,
+  isPrivateIp,
+  parseTimeout,
+  pickExtension,
+  safeExt,
+  validateOutputDir,
+  validateUrl,
+} from '../src/validate.js';
+
+describe('validate — isPrivateIp', () => {
+  it('blocks loopback, private, and link-local IPv4', () => {
+    expect(isPrivateIp('127.0.0.1')).toBe(true);
+    expect(isPrivateIp('10.0.0.1')).toBe(true);
+    expect(isPrivateIp('192.168.1.1')).toBe(true);
+    expect(isPrivateIp('172.16.0.1')).toBe(true);
+    expect(isPrivateIp('172.31.0.1')).toBe(true);
+    expect(isPrivateIp('169.254.169.254')).toBe(true);
+    expect(isPrivateIp('0.0.0.0')).toBe(true);
+  });
+
+  it('allows public IPv4', () => {
+    expect(isPrivateIp('8.8.8.8')).toBe(false);
+    expect(isPrivateIp('172.32.0.1')).toBe(false);
+  });
+
+  it('blocks ::1 and link-local / ULA IPv6', () => {
+    expect(isPrivateIp('::1')).toBe(true);
+    expect(isPrivateIp('fe80::1')).toBe(true);
+    expect(isPrivateIp('fd12::1')).toBe(true);
+    expect(isPrivateIp('fc00::1')).toBe(true);
+  });
+
+  it('returns false for hostnames and malformed values', () => {
+    expect(isPrivateIp('example.com')).toBe(false);
+    expect(isPrivateIp('')).toBe(false);
+  });
+
+  it('blocks IPv4-mapped IPv6 (dotted-decimal + hex forms) — SSRF bypass', () => {
+    // dotted-decimal form
+    expect(isPrivateIp('::ffff:169.254.169.254')).toBe(true);
+    expect(isPrivateIp('::ffff:127.0.0.1')).toBe(true);
+    expect(isPrivateIp('::ffff:10.1.2.3')).toBe(true);
+    // hex form (::ffff:a9fe:a9fe  ==  169.254.169.254)
+    expect(isPrivateIp('::ffff:a9fe:a9fe')).toBe(true);
+    expect(isPrivateIp('::ffff:a9fe:a90a')).toBe(true); // 169.254.169.10
+    // a public mapped address is allowed
+    expect(isPrivateIp('::ffff:8.8.8.8')).toBe(false);
+    expect(isPrivateIp('::ffff:0808:0808')).toBe(false); // 8.8.8.8 in hex
+    // uppercase prefix is handled
+    expect(isPrivateIp('::FFFF:169.254.169.254')).toBe(true);
+  });
+});
+
+describe('validate — validateUrl', () => {
+  it('accepts http and https public URLs', async () => {
+    const lookup = async () => [{ address: '93.184.216.34' }];
+    const u = await validateUrl('https://example.com/video.mp4', { lookup });
+    expect(u.protocol).toBe('https:');
+  });
+
+  it('rejects non-http(s) schemes (file/data/javascript)', async () => {
+    const lookup = async () => [{ address: '1.1.1.1' }];
+    await expect(validateUrl('file:///etc/passwd', { lookup })).rejects.toThrow();
+    await expect(validateUrl('data:text/html,<x>', { lookup })).rejects.toThrow();
+    await expect(validateUrl('javascript:alert(1)', { lookup })).rejects.toThrow();
+  });
+
+  it('rejects private/link-local IP literals (SSRF)', async () => {
+    const lookup = async () => [{ address: '1.1.1.1' }];
+    await expect(validateUrl('http://127.0.0.1/', { lookup })).rejects.toThrow();
+    await expect(validateUrl('http://169.254.169.254/latest', { lookup })).rejects.toThrow();
+    await expect(validateUrl('http://10.0.0.1/', { lookup })).rejects.toThrow();
+    await expect(validateUrl('http://[::1]/', { lookup })).rejects.toThrow();
+  });
+
+  it('rejects IPv4-mapped IPv6 reaching a private IP (SSRF bypass)', async () => {
+    // No DNS lookup needed — the literal is rejected before resolution.
+    const lookup = async () => [{ address: '1.1.1.1' }];
+    await expect(validateUrl('http://[::ffff:169.254.169.254]/', { lookup })).rejects.toThrow(
+      /private|link-local/,
+    );
+    await expect(validateUrl('http://[::ffff:a9fe:a9fe]/', { lookup })).rejects.toThrow(
+      /private|link-local/,
+    );
+    // A mapped public address is allowed (resolves fine).
+    const pub = await validateUrl('http://[::ffff:8.8.8.8]/', { lookup });
+    expect(pub.protocol).toBe('http:');
+  });
+
+  it('rejects a hostname that resolves to a private IP (DNS-rebinding SSRF)', async () => {
+    const lookup = async () => [{ address: '127.0.0.1' }];
+    await expect(validateUrl('https://internal.evil/', { lookup })).rejects.toThrow();
+  });
+
+  it('rejects a hostname that cannot be resolved', async () => {
+    const lookup = async () => {
+      throw new Error('ENOTFOUND');
+    };
+    await expect(validateUrl('https://nope.invalid/', { lookup })).rejects.toThrow();
+  });
+
+  it('rejects non-string / empty input', async () => {
+    await expect(
+      validateUrl('', { lookup: async () => [{ address: '1.1.1.1' }] }),
+    ).rejects.toThrow();
+    await expect(
+      validateUrl(null, { lookup: async () => [{ address: '1.1.1.1' }] }),
+    ).rejects.toThrow();
+  });
+});
+
+describe('validate — validateOutputDir', () => {
+  it('accepts a directory under the base', async () => {
+    const base = await mkdtemp(join(tmpdir(), 'bd-out-'));
+    const sub = join(base, 'sub');
+    await mkdir(sub);
+    const realpath = async (p) => p; // identity for test
+    const resolved = await validateOutputDir(sub, { base, realpath });
+    expect(resolved.startsWith(base)).toBe(true);
+  });
+
+  it('rejects a path outside the base (path traversal)', async () => {
+    const base = await mkdtemp(join(tmpdir(), 'bd-out-'));
+    const realpath = async (p) => p.replace(`${base}/../`, '/etc/');
+    await expect(validateOutputDir('/etc/passwd', { base, realpath })).rejects.toThrow();
+  });
+
+  it('rejects a non-existent directory', async () => {
+    const base = await mkdtemp(join(tmpdir(), 'bd-out-'));
+    await expect(validateOutputDir(join(base, 'does-not-exist'))).rejects.toThrow();
+  });
+
+  it('rejects a sibling path that shares the base prefix (e.g. /output-evil vs /output)', async () => {
+    const base = '/tmp/bd-out-sibling';
+    const sibling = `${base}-evil`; // shares the prefix but is NOT a child
+    const realpath = async (p) => p; // identity
+    await expect(validateOutputDir(sibling, { base, realpath })).rejects.toThrow(/under/);
+  });
+
+  it('rejects when the output base itself does not exist (no realpath fallback)', async () => {
+    const realpath = async () => {
+      throw new Error('ENOENT');
+    };
+    await expect(
+      validateOutputDir('/output/sub', { base: '/nonexistent-base', realpath }),
+    ).rejects.toThrow(/output base/);
+  });
+});
+
+describe('validate — parseTimeout', () => {
+  it('accepts finite positive integers', () => {
+    expect(parseTimeout('5000', 30_000)).toBe(5000);
+    expect(parseTimeout(7000, 30_000)).toBe(7000);
+  });
+
+  it('falls back to default on NaN / non-numeric', () => {
+    expect(parseTimeout('abc', 30_000)).toBe(30_000);
+    expect(parseTimeout(undefined, 30_000)).toBe(30_000);
+    expect(parseTimeout(null, 30_000)).toBe(30_000);
+  });
+
+  it('falls back to default on non-positive or non-integer', () => {
+    expect(parseTimeout(0, 30_000)).toBe(30_000);
+    expect(parseTimeout(-5, 30_000)).toBe(30_000);
+    expect(parseTimeout(5.5, 30_000)).toBe(30_000);
+    expect(parseTimeout('5.5', 30_000)).toBe(30_000);
+  });
+});
+
+describe('validate — extension whitelist', () => {
+  it('VIDEO_EXTS contains the allowed set only', () => {
+    expect(VIDEO_EXTS).toEqual(['mp4', 'webm', 'ts', 'm4v', 'm4s']);
+  });
+
+  it('pickExtension maps content-types', () => {
+    expect(pickExtension('https://x/v', 'video/mp4')).toBe('mp4');
+    expect(pickExtension('https://x/v', 'video/webm')).toBe('webm');
+    expect(pickExtension('https://x/v', 'video/mp2t')).toBe('ts');
+  });
+
+  it('pickExtension maps HLS/DASH content-types to mp4 (re-muxed)', () => {
+    expect(pickExtension('https://x/v', 'application/vnd.apple.mpegurl')).toBe('mp4');
+    expect(pickExtension('https://x/v', 'application/dash+xml')).toBe('mp4');
+  });
+
+  it('pickExtension never returns an unwhitelisted extension (defaults mp4)', () => {
+    expect(pickExtension('https://x/page.html', 'text/html')).toBe('mp4');
+    expect(pickExtension('https://x/clip.mov', '')).toBe('mp4');
+    expect(pickExtension('https://x/clip.mp4?token=1', '')).toBe('mp4');
+  });
+
+  it('safeExt whitelists and lowercases, else mp4', () => {
+    expect(safeExt('MP4')).toBe('mp4');
+    expect(safeExt('webm')).toBe('webm');
+    expect(safeExt('html')).toBe('mp4');
+    expect(safeExt('')).toBe('mp4');
+  });
+});
diff --git a/packages/browser-downloader/vitest.config.js b/packages/browser-downloader/vitest.config.js
new file mode 100644
index 00000000..541979b4
--- /dev/null
+++ b/packages/browser-downloader/vitest.config.js
@@ -0,0 +1,10 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    environment: 'node',
+    include: ['tests/**/*.test.js'],
+    testTimeout: 10_000,
+    hookTimeout: 10_000,
+  },
+});
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 507a99a8..9f87927a 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -1,3 +1,6 @@
+packages:
+  - 'packages/*'
+
 allowBuilds:
   sharp: true
   '@biomejs/biome': true
diff --git a/pyproject.toml b/pyproject.toml
index c49c1972..9de82739 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -17,7 +17,7 @@ dependencies = [
     "redis",
     "python-jose[cryptography]",
     "passlib[bcrypt]",
-    "bcrypt<4.1",
+    "bcrypt>=4.0",
     "pydantic",
     "pydantic-settings>=2.14.2",
     "email-validator>=2.3.0",
@@ -27,6 +27,7 @@ dependencies = [
     "prometheus-client>=0.19.0",
     "slowapi>=0.1.9",
     "yt-dlp>=2025.3.0",
+    "httpx>=0.27.0",
 
     # HIGH PRIORITY - Observability & Performance Enhancements
     # Structured logging with structlog
@@ -72,7 +73,7 @@ worker = [
 ]
 test = [
     "pytest",
-    "pytest-cov",
+    "pytest-cov>=4.1.0",
     "pytest-asyncio",
     "pytest-xdist",
     "httpx",
@@ -104,7 +105,7 @@ test = [
     "pytest-xdist>=3.0.0",
     "httpx>=0.24.0",
     "aiosqlite>=0.19.0",
-    "bcrypt==4.0.1",
+    "bcrypt>=4.0",
 ]
 lint = [
     "ruff>=0.1.0",
@@ -484,6 +485,8 @@ select = [
     "RUF",  # Ruff-specific rules
     "C90",  # mccabe complexity
     "PGH",  # pygrep-hooks
+    "S",    # flake8-bandit (security)
+    "ASYNC", # flake8-async (async-safety)
 ]
 ignore = [
     "E501",  # line too long (handled by formatter)
@@ -500,10 +503,66 @@ ignore = [
     "PLW0406",  # module imports itself (required for test mocking)
 ]
 
+[tool.ruff.lint.per-file-ignores]
+"tests/**" = [
+    "S101",   # assert is standard in pytest
+    "S104",   # binding to all interfaces in test servers
+    "S105",   # test secrets are expected
+    "S106",   # test credentials are expected  
+    "S107",   # test defaults are expected
+    "S108",   # /tmp usage in tests is acceptable
+    "S110",   # try-except-pass in tests is intentional
+    "S506",   # yaml.load with compose loader in test files
+    "S603",   # subprocess in test_env_contract is for env detection
+    "S607",   # partial executable paths in tests
+    "ASYNC109", # timeout parameter in test helpers
+    "ASYNC240", # os.path in test async functions
+]
+"app/services/error_classifier.py" = [
+    "S311",   # random used for jitter, not cryptographic purposes
+    "S110",   # try-except-pass for retry budget is intentional
+]
+"app/utils/validators.py" = [
+    "S310",   # URL open is intentional for redirect validation
+]
+"core/queue.py" = [
+    "S101",   # assert for lazy redis client initialization
+    "S110",   # try-except-pass for lazy client is intentional
+]
+"app/schemas/error.py" = [
+    "S105",   # error code enum string values are not passwords
+]
+"app/schemas/token.py" = [
+    "S105",   # token_type string default is not a password
+]
+"app/auth.py" = [
+    "S105",   # token type constants are not passwords
+]
+"app/services/circuit_breaker.py" = [
+    "S110",   # try-except-pass for Redis transient failures
+]
+"app/services/download_service.py" = [
+    "S110",   # try-except-pass for file cleanup
+    "ASYNC240", # os.path.exists is used for synchronous file checks
+]
+"app/services/yt_dlp_service.py" = [
+    "ASYNC240", # os.path.getsize for file info after subprocess
+]
+"app/services/job_factory.py" = [
+    "S110",   # try-except-pass for cleanup
+]
+"app/api/startup.py" = [
+    "S110",   # try-except-pass for seed data / trigger registration
+]
+"app/api/routes/sse.py" = [
+    "S110",   # try-except-pass in SSE buffer drain / reconnect
+    "ASYNC109", # timeout parameter is a float for task management, not asyncio.timeout
+]
+
 [tool.ruff.format]
 quote-style = "double"
 indent-style = "space"
-line-ending = "auto"
+line-ending = "lf"
 skip-magic-trailing-comma = false
 
 [tool.ruff.lint.isort]
@@ -514,19 +573,29 @@ known-first-party = ["app", "core", "worker", "tests"]
 # ============================================
 [tool.mypy]
 python_version = "3.12"
-warn_return_any = true
-warn_unused_ignores = true
-warn_redundant_casts = true
-warn_unused_configs = true
-disallow_untyped_defs = false
-ignore_missing_imports = true
-no_implicit_optional = true
+strict = true
 pretty = true
 show_error_codes = true
 show_error_context = true
 plugins = ["pydantic.mypy"]
+# Strict checks not yet passing — explicitly disabled
+disallow_any_generics = false
+disallow_subclassing_any = false
+disallow_untyped_decorators = false
+implicit_reexport = true
 
-# Module-specific overrides
+# Third-party packages without type stubs
+[[tool.mypy.overrides]]
+module = [
+    "passlib.*",
+    "httptools.*",
+    "uvloop.*",
+    "watchfiles.*",
+    "redis.asyncio",
+]
+ignore_missing_imports = true
+
+# Enable checking for all project modules
 [[tool.mypy.overrides]]
 module = "app.*"
 ignore_errors = false
@@ -535,14 +604,15 @@ ignore_errors = false
 module = "core.*"
 ignore_errors = false
 
-[[tool.mypy.overrides]]
-module = "tests.*"
-ignore_errors = true
-
 [[tool.mypy.overrides]]
 module = "worker.*"
 ignore_errors = false
 
+# Tests are excluded from strict type checking
+[[tool.mypy.overrides]]
+module = "tests.*"
+ignore_errors = true
+
 # ============================================
 # BANDIT CONFIGURATION
 # ============================================
diff --git a/tests/test_api/test_auth.py b/tests/test_api/test_auth.py
index c9337383..cd8c0af1 100644
--- a/tests/test_api/test_auth.py
+++ b/tests/test_api/test_auth.py
@@ -378,7 +378,7 @@ async def test_cookie_auth_rejects_refresh_token(db_session):
 
     result = await db_session.execute(select(User).where(User.email == email))
     user = result.scalar_one()
-    request = SimpleNamespace(cookies={"access_token": auth.create_refresh_token(user.id)})
+    request = SimpleNamespace(cookies={"__Host-access_token": auth.create_refresh_token(user.id)})
 
     with pytest.raises(HTTPException) as exc_info:
         await get_current_user_from_cookie(db_session, request, None)
diff --git a/tests/test_api/test_demo_login.py b/tests/test_api/test_demo_login.py
index 28a44834..a7f39902 100644
--- a/tests/test_api/test_demo_login.py
+++ b/tests/test_api/test_demo_login.py
@@ -85,9 +85,9 @@ async def test_demo_login_redirects_and_sets_cookies(self):
 
         assert response.status_code == 303
         assert response.headers["location"] == "/web/downloads"
-        assert "access_token" in response.cookies
-        assert "refresh_token" in response.cookies
-        assert response.cookies.get("access_token") != ""
+        assert "__Host-access_token" in response.cookies
+        assert "__Host-refresh_token" in response.cookies
+        assert response.cookies.get("__Host-access_token") != ""
 
     @pytest.mark.asyncio
     async def test_demo_login_inactive_user_returns_500(self):
@@ -160,11 +160,11 @@ async def test_demo_user_can_access_dashboard_after_login(self):
             login_response = await _demo_login(client)
             assert login_response.status_code == 303
 
-            access_token = login_response.cookies.get("access_token", "")
+            access_token = login_response.cookies.get("__Host-access_token", "")
 
             dashboard_response = await client.get(
                 "/web/downloads",
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
         assert dashboard_response.status_code == 200
diff --git a/tests/test_api/test_web_routes.py b/tests/test_api/test_web_routes.py
index 52aa0304..ae408fa0 100644
--- a/tests/test_api/test_web_routes.py
+++ b/tests/test_api/test_web_routes.py
@@ -495,8 +495,8 @@ async def test_login_success_sets_cookies(self):
             )
 
         assert login_response.status_code == 303
-        assert "access_token" in login_response.cookies
-        assert "refresh_token" in login_response.cookies
+        assert "__Host-access_token" in login_response.cookies
+        assert "__Host-refresh_token" in login_response.cookies
 
     @pytest.mark.asyncio
     async def test_login_invalid_csrf(self):
@@ -629,8 +629,8 @@ async def test_register_success_sets_cookies(self):
             )
 
         assert reg_response.status_code == 303
-        assert "access_token" in reg_response.cookies
-        assert "refresh_token" in reg_response.cookies
+        assert "__Host-access_token" in reg_response.cookies
+        assert "__Host-refresh_token" in reg_response.cookies
 
     @pytest.mark.asyncio
     async def test_register_success_persists_default_username_and_hashed_password(self):
@@ -870,7 +870,7 @@ async def test_dashboard_with_auth(self):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -879,7 +879,7 @@ async def test_dashboard_with_auth(self):
 
             dashboard_response = await client.get(
                 "/web/downloads",
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
         assert dashboard_response.status_code == 200
@@ -902,7 +902,7 @@ async def test_dashboard_renders_initial_download_skeleton_state(self):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -911,7 +911,7 @@ async def test_dashboard_renders_initial_download_skeleton_state(self):
 
             dashboard_response = await client.get(
                 "/web/downloads",
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
         assert dashboard_response.status_code == 200
@@ -949,7 +949,7 @@ async def test_dashboard_renders_representative_status_badges_and_row_controls(s
                 data={"email": email, "password": password},
                 headers={"X-CSRF-Token": csrf_token},
             )
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
 
             async with TestingSessionLocal() as session:
                 user_result = await session.execute(select(User).where(User.email == email))
@@ -971,7 +971,7 @@ async def test_dashboard_renders_representative_status_badges_and_row_controls(s
 
             dashboard_response = await client.get(
                 "/web/downloads",
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
         assert dashboard_response.status_code == 200
@@ -1036,7 +1036,7 @@ async def test_create_download_htmx(self, sample_url):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -1062,7 +1062,7 @@ async def test_create_download_htmx(self, sample_url):
                     "/web/downloads",
                     data={"url": sample_url},
                     headers=headers,
-                    cookies={"access_token": access_token},
+                    cookies={"__Host-access_token": access_token},
                 )
 
         assert create_response.status_code == 200
@@ -1087,7 +1087,7 @@ async def test_create_download_htmx_keeps_outbox_when_core_queue_enqueue_fails(
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -1113,7 +1113,7 @@ async def test_create_download_htmx_keeps_outbox_when_core_queue_enqueue_fails(
                     "/web/downloads",
                     data={"url": sample_url},
                     headers=headers,
-                    cookies={"access_token": access_token},
+                    cookies={"__Host-access_token": access_token},
                 )
 
         assert create_response.status_code == 200
@@ -1172,7 +1172,7 @@ async def test_create_download_invalid_url(self):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -1187,7 +1187,7 @@ async def test_create_download_invalid_url(self):
                 "/web/downloads",
                 data={"url": "https://not-youtube.com/video"},
                 headers=headers,
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
         assert create_response.status_code == 422
@@ -1210,7 +1210,7 @@ async def test_create_download_htmx_returns_canonical_row_and_rotates_csrf(self,
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -1236,7 +1236,7 @@ async def test_create_download_htmx_returns_canonical_row_and_rotates_csrf(self,
                     "/web/downloads",
                     data={"url": sample_url},
                     headers=headers,
-                    cookies={"access_token": access_token},
+                    cookies={"__Host-access_token": access_token},
                 )
 
         assert create_response.status_code == 200
@@ -1264,7 +1264,7 @@ async def test_create_download_htmx_validation_error_returns_inline_error_fragme
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -1279,7 +1279,7 @@ async def test_create_download_htmx_validation_error_returns_inline_error_fragme
                 "/web/downloads",
                 data={"url": "https://not-youtube.com/video"},
                 headers=headers,
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
         assert create_response.status_code == 422
@@ -1308,13 +1308,13 @@ async def test_create_download_htmx_invalid_csrf_returns_inline_error_fragment(
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
 
             create_response = await client.post(
                 "/web/downloads",
                 data={"url": sample_url},
                 headers={"HX-Request": "true", "X-CSRF-Token": "invalid_token"},
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
         assert create_response.status_code == 403
@@ -1341,7 +1341,7 @@ async def test_create_download_htmx_exception_during_creation_returns_error_frag
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -1361,7 +1361,7 @@ async def test_create_download_htmx_exception_during_creation_returns_error_frag
                     "/web/downloads",
                     data={"url": sample_url},
                     headers=headers,
-                    cookies={"access_token": access_token},
+                    cookies={"__Host-access_token": access_token},
                 )
 
         assert create_response.status_code == 500
@@ -1390,7 +1390,7 @@ async def test_create_download_full_page(self, sample_url):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -1406,7 +1406,7 @@ async def test_create_download_full_page(self, sample_url):
                     "/web/downloads/full",
                     data={"url": sample_url},
                     headers={"X-CSRF-Token": csrf_token} if csrf_token else {},
-                    cookies={"access_token": access_token},
+                    cookies={"__Host-access_token": access_token},
                 )
 
         assert create_response.status_code == 303
@@ -1431,7 +1431,7 @@ async def test_create_download_full_page_keeps_outbox_when_core_queue_enqueue_fa
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -1447,7 +1447,7 @@ async def test_create_download_full_page_keeps_outbox_when_core_queue_enqueue_fa
                     "/web/downloads/full",
                     data={"url": sample_url},
                     headers={"X-CSRF-Token": csrf_token} if csrf_token else {},
-                    cookies={"access_token": access_token},
+                    cookies={"__Host-access_token": access_token},
                 )
 
         assert create_response.status_code == 303
@@ -1507,7 +1507,7 @@ async def test_delete_download_not_found(self):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -1523,7 +1523,7 @@ async def test_delete_download_not_found(self):
             delete_response = await client.delete(
                 f"/web/downloads/{fake_uuid}",
                 headers=headers,
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
         assert delete_response.status_code == 404
@@ -1546,7 +1546,7 @@ async def test_delete_download_invalid_uuid(self):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -1560,7 +1560,7 @@ async def test_delete_download_invalid_uuid(self):
             delete_response = await client.delete(
                 "/web/downloads/not-a-uuid",
                 headers=headers,
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
         assert delete_response.status_code == 400
@@ -1598,7 +1598,7 @@ async def test_download_file_not_found(self):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -1608,7 +1608,7 @@ async def test_download_file_not_found(self):
             fake_uuid = str(uuid.uuid4())
             download_response = await client.get(
                 f"/web/downloads/{fake_uuid}/file",
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
         assert download_response.status_code == 404
@@ -1631,7 +1631,7 @@ async def test_download_file_invalid_uuid(self):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -1640,7 +1640,7 @@ async def test_download_file_invalid_uuid(self):
 
             download_response = await client.get(
                 "/web/downloads/not-a-uuid/file",
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
         assert download_response.status_code == 400
@@ -1817,7 +1817,7 @@ async def test_settings_page_renders(self):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -1826,7 +1826,7 @@ async def test_settings_page_renders(self):
 
             response = await client.get(
                 "/web/settings",
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
         assert response.status_code == 200
@@ -1848,7 +1848,7 @@ async def test_settings_page_maps_password_error_to_field_level_accessibility(se
                 data={"email": email, "password": password},
                 headers={"X-CSRF-Token": csrf_token},
             )
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -1857,7 +1857,7 @@ async def test_settings_page_maps_password_error_to_field_level_accessibility(se
 
             response = await client.get(
                 "/web/settings?error=bad_current_password",
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
         assert response.status_code == 200
@@ -1888,7 +1888,7 @@ async def test_update_username_success(self):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -1897,7 +1897,7 @@ async def test_update_username_success(self):
 
             # Get fresh CSRF token
             csrf_response = await client.get(
-                "/web/settings", cookies={"access_token": access_token}
+                "/web/settings", cookies={"__Host-access_token": access_token}
             )
             csrf_token = get_csrf_from_response(csrf_response)
 
@@ -1905,7 +1905,7 @@ async def test_update_username_success(self):
                 "/web/settings/username",
                 data={"username": "  newname  "},
                 headers={"X-CSRF-Token": csrf_token} if csrf_token else {},
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
         async with TestingSessionLocal() as session:
@@ -1934,7 +1934,7 @@ async def test_update_username_too_short(self):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -1942,7 +1942,7 @@ async def test_update_username_too_short(self):
             )
 
             csrf_response = await client.get(
-                "/web/settings", cookies={"access_token": access_token}
+                "/web/settings", cookies={"__Host-access_token": access_token}
             )
             csrf_token = get_csrf_from_response(csrf_response)
 
@@ -1950,7 +1950,7 @@ async def test_update_username_too_short(self):
                 "/web/settings/username",
                 data={"username": "ab"},
                 headers={"X-CSRF-Token": csrf_token} if csrf_token else {},
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
         async with TestingSessionLocal() as session:
@@ -1979,7 +1979,7 @@ async def test_update_username_invalid_csrf(self):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -1990,7 +1990,7 @@ async def test_update_username_invalid_csrf(self):
                 "/web/settings/username",
                 data={"username": "validname"},
                 headers={"X-CSRF-Token": "invalid_token"},
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
         assert response.status_code == 303
@@ -2018,7 +2018,7 @@ async def test_change_password_success(self):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -2026,7 +2026,7 @@ async def test_change_password_success(self):
             )
 
             csrf_response = await client.get(
-                "/web/settings", cookies={"access_token": access_token}
+                "/web/settings", cookies={"__Host-access_token": access_token}
             )
             csrf_token = get_csrf_from_response(csrf_response)
 
@@ -2038,12 +2038,12 @@ async def test_change_password_success(self):
                     "new_password_confirm": "newpassword123",
                 },
                 headers={"X-CSRF-Token": csrf_token} if csrf_token else {},
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
             old_token_response = await client.get(
                 "/web/settings",
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
             fresh_csrf_response = await client.get("/web/login")
@@ -2088,7 +2088,7 @@ async def test_change_password_wrong_current(self):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -2096,7 +2096,7 @@ async def test_change_password_wrong_current(self):
             )
 
             csrf_response = await client.get(
-                "/web/settings", cookies={"access_token": access_token}
+                "/web/settings", cookies={"__Host-access_token": access_token}
             )
             csrf_token = get_csrf_from_response(csrf_response)
 
@@ -2108,7 +2108,7 @@ async def test_change_password_wrong_current(self):
                     "new_password_confirm": "newpassword123",
                 },
                 headers={"X-CSRF-Token": csrf_token} if csrf_token else {},
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
         assert response.status_code == 303
@@ -2132,7 +2132,7 @@ async def test_change_password_mismatch(self):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -2140,7 +2140,7 @@ async def test_change_password_mismatch(self):
             )
 
             csrf_response = await client.get(
-                "/web/settings", cookies={"access_token": access_token}
+                "/web/settings", cookies={"__Host-access_token": access_token}
             )
             csrf_token = get_csrf_from_response(csrf_response)
 
@@ -2152,7 +2152,7 @@ async def test_change_password_mismatch(self):
                     "new_password_confirm": "differentpass",
                 },
                 headers={"X-CSRF-Token": csrf_token} if csrf_token else {},
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
         assert response.status_code == 303
@@ -2176,7 +2176,7 @@ async def test_change_password_too_short(self):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -2184,7 +2184,7 @@ async def test_change_password_too_short(self):
             )
 
             csrf_response = await client.get(
-                "/web/settings", cookies={"access_token": access_token}
+                "/web/settings", cookies={"__Host-access_token": access_token}
             )
             csrf_token = get_csrf_from_response(csrf_response)
 
@@ -2196,7 +2196,7 @@ async def test_change_password_too_short(self):
                     "new_password_confirm": "short",
                 },
                 headers={"X-CSRF-Token": csrf_token} if csrf_token else {},
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
         assert response.status_code == 303
@@ -2224,7 +2224,7 @@ async def test_delete_download_invalid_csrf(self):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -2236,7 +2236,7 @@ async def test_delete_download_invalid_csrf(self):
             response = await client.delete(
                 f"/web/downloads/{fake_uuid}",
                 headers={"X-CSRF-Token": "invalid_token"},
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
         assert response.status_code == 403
@@ -2636,7 +2636,7 @@ async def test_create_download_full_page_invalid_csrf(self, sample_url):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -2647,7 +2647,7 @@ async def test_create_download_full_page_invalid_csrf(self, sample_url):
                 "/web/downloads/full",
                 data={"url": sample_url},
                 headers={"X-CSRF-Token": "invalid_token"},
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
         assert create_response.status_code == 303
@@ -2671,7 +2671,7 @@ async def test_create_download_full_page_invalid_url(self):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -2679,7 +2679,7 @@ async def test_create_download_full_page_invalid_url(self):
             )
 
             csrf_response = await client.get(
-                "/web/downloads", cookies={"access_token": access_token}
+                "/web/downloads", cookies={"__Host-access_token": access_token}
             )
             csrf_token = get_csrf_from_response(csrf_response)
 
@@ -2687,7 +2687,7 @@ async def test_create_download_full_page_invalid_url(self):
                 "/web/downloads/full",
                 data={"url": "https://not-youtube.com/video"},
                 headers={"X-CSRF-Token": csrf_token} if csrf_token else {},
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
         assert create_response.status_code == 303
@@ -2711,7 +2711,7 @@ async def test_create_download_full_page_exception_during_creation(self, sample_
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -2719,7 +2719,7 @@ async def test_create_download_full_page_exception_during_creation(self, sample_
             )
 
             csrf_response = await client.get(
-                "/web/downloads", cookies={"access_token": access_token}
+                "/web/downloads", cookies={"__Host-access_token": access_token}
             )
             csrf_token = get_csrf_from_response(csrf_response)
 
@@ -2732,7 +2732,7 @@ async def test_create_download_full_page_exception_during_creation(self, sample_
                     "/web/downloads/full",
                     data={"url": sample_url},
                     headers={"X-CSRF-Token": csrf_token} if csrf_token else {},
-                    cookies={"access_token": access_token},
+                    cookies={"__Host-access_token": access_token},
                 )
 
         assert create_response.status_code == 303
@@ -2760,7 +2760,7 @@ async def test_delete_account_invalid_csrf(self):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -2771,7 +2771,7 @@ async def test_delete_account_invalid_csrf(self):
                 "/web/settings/delete-account",
                 data={"password": password, "confirm_text": "DELETE"},
                 headers={"X-CSRF-Token": "invalid_token"},
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
         assert response.status_code == 303
@@ -2795,7 +2795,7 @@ async def test_delete_account_wrong_confirm_text(self):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -2803,7 +2803,7 @@ async def test_delete_account_wrong_confirm_text(self):
             )
 
             csrf_response = await client.get(
-                "/web/settings", cookies={"access_token": access_token}
+                "/web/settings", cookies={"__Host-access_token": access_token}
             )
             csrf_token = get_csrf_from_response(csrf_response)
 
@@ -2811,7 +2811,7 @@ async def test_delete_account_wrong_confirm_text(self):
                 "/web/settings/delete-account",
                 data={"password": password, "confirm_text": "WRONG"},
                 headers={"X-CSRF-Token": csrf_token} if csrf_token else {},
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
         assert response.status_code == 303
@@ -2835,7 +2835,7 @@ async def test_delete_account_wrong_password(self):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -2843,7 +2843,7 @@ async def test_delete_account_wrong_password(self):
             )
 
             csrf_response = await client.get(
-                "/web/settings", cookies={"access_token": access_token}
+                "/web/settings", cookies={"__Host-access_token": access_token}
             )
             csrf_token = get_csrf_from_response(csrf_response)
 
@@ -2851,7 +2851,7 @@ async def test_delete_account_wrong_password(self):
                 "/web/settings/delete-account",
                 data={"password": "wrongpassword", "confirm_text": "DELETE"},
                 headers={"X-CSRF-Token": csrf_token} if csrf_token else {},
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
         assert response.status_code == 303
@@ -2879,7 +2879,7 @@ async def test_delete_account_success(self, tmp_path):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -2902,7 +2902,7 @@ async def test_delete_account_success(self, tmp_path):
                 job_id = job.id
 
             csrf_response = await client.get(
-                "/web/settings", cookies={"access_token": access_token}
+                "/web/settings", cookies={"__Host-access_token": access_token}
             )
             csrf_token = get_csrf_from_response(csrf_response)
 
@@ -2912,7 +2912,7 @@ async def test_delete_account_success(self, tmp_path):
                     "/web/settings/delete-account",
                     data={"password": password, "confirm_text": "DELETE"},
                     headers={"X-CSRF-Token": csrf_token} if csrf_token else {},
-                    cookies={"access_token": access_token},
+                    cookies={"__Host-access_token": access_token},
                 )
 
         async with TestingSessionLocal() as session:
@@ -2921,7 +2921,10 @@ async def test_delete_account_success(self, tmp_path):
 
         assert response.status_code == 303
         assert response.headers["location"] == "/web/login?account_deleted=1"
-        assert "access_token" not in response.cookies or response.cookies.get("access_token") == ""
+        assert (
+            "__Host-access_token" not in response.cookies
+            or response.cookies.get("__Host-access_token") == ""
+        )
         assert downloaded_file.exists() is False
         assert deleted_user is None
         assert deleted_job is None
@@ -2944,7 +2947,7 @@ async def test_delete_account_htmx_success(self):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -2952,7 +2955,7 @@ async def test_delete_account_htmx_success(self):
             )
 
             csrf_response = await client.get(
-                "/web/settings", cookies={"access_token": access_token}
+                "/web/settings", cookies={"__Host-access_token": access_token}
             )
             csrf_token = get_csrf_from_response(csrf_response)
 
@@ -2963,7 +2966,7 @@ async def test_delete_account_htmx_success(self):
                     "X-CSRF-Token": csrf_token if csrf_token else "",
                     "HX-Request": "true",
                 },
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
         assert response.status_code == 200
@@ -2987,7 +2990,7 @@ async def test_delete_account_file_cleanup_failure(self, tmp_path):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -3017,7 +3020,7 @@ async def test_delete_account_file_cleanup_failure(self, tmp_path):
                 await session.commit()
 
             csrf_response = await client.get(
-                "/web/settings", cookies={"access_token": access_token}
+                "/web/settings", cookies={"__Host-access_token": access_token}
             )
             csrf_token = get_csrf_from_response(csrf_response)
 
@@ -3028,7 +3031,7 @@ async def test_delete_account_file_cleanup_failure(self, tmp_path):
                     "/web/settings/delete-account",
                     data={"password": password, "confirm_text": "DELETE"},
                     headers={"X-CSRF-Token": csrf_token} if csrf_token else {},
-                    cookies={"access_token": access_token},
+                    cookies={"__Host-access_token": access_token},
                 )
 
         assert response.status_code == 303
@@ -3056,7 +3059,7 @@ async def test_delete_download_processing_status(self):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -3090,7 +3093,7 @@ async def test_delete_download_processing_status(self):
             delete_response = await client.delete(
                 f"/web/downloads/{job_id}",
                 headers=headers,
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
         assert delete_response.status_code == 409
@@ -3114,7 +3117,7 @@ async def test_delete_download_with_file_path_traversal(self, tmp_path):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -3151,7 +3154,7 @@ async def test_delete_download_with_file_path_traversal(self, tmp_path):
                 delete_response = await client.delete(
                     f"/web/downloads/{job_id}",
                     headers=headers,
-                    cookies={"access_token": access_token},
+                    cookies={"__Host-access_token": access_token},
                 )
 
         assert delete_response.status_code == 403
@@ -3179,7 +3182,7 @@ async def test_delete_download_with_os_error_on_file_delete(self, tmp_path):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -3219,7 +3222,7 @@ async def test_delete_download_with_os_error_on_file_delete(self, tmp_path):
                     delete_response = await client.delete(
                         f"/web/downloads/{job_id}",
                         headers=headers,
-                        cookies={"access_token": access_token},
+                        cookies={"__Host-access_token": access_token},
                     )
 
         assert delete_response.status_code == 200
@@ -3254,7 +3257,7 @@ async def test_download_file_job_not_completed(self):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -3282,7 +3285,7 @@ async def test_download_file_job_not_completed(self):
 
             download_response = await client.get(
                 f"/web/downloads/{job_id}/file",
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
         assert download_response.status_code == 400
@@ -3306,7 +3309,7 @@ async def test_download_file_no_file_path(self):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -3335,7 +3338,7 @@ async def test_download_file_no_file_path(self):
 
             download_response = await client.get(
                 f"/web/downloads/{job_id}/file",
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
         assert download_response.status_code == 404
@@ -3361,7 +3364,7 @@ async def test_download_file_expired(self):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -3391,7 +3394,7 @@ async def test_download_file_expired(self):
 
             download_response = await client.get(
                 f"/web/downloads/{job_id}/file",
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
         assert download_response.status_code == 410
@@ -3418,7 +3421,7 @@ async def test_download_file_missing_from_disk(self, tmp_path):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -3451,7 +3454,7 @@ async def test_download_file_missing_from_disk(self, tmp_path):
 
                 download_response = await client.get(
                     f"/web/downloads/{job_id}/file",
-                    cookies={"access_token": access_token},
+                    cookies={"__Host-access_token": access_token},
                 )
 
         assert download_response.status_code == 404
@@ -3475,7 +3478,7 @@ async def test_download_file_path_traversal_returns_403(self, tmp_path):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
 
             from core.models.user import User
 
@@ -3500,7 +3503,7 @@ async def test_download_file_path_traversal_returns_403(self, tmp_path):
 
                 download_response = await client.get(
                     f"/web/downloads/{job_id}/file",
-                    cookies={"access_token": access_token},
+                    cookies={"__Host-access_token": access_token},
                 )
 
         assert download_response.status_code == 403
@@ -3529,7 +3532,7 @@ async def test_download_file_success(self, tmp_path):
                 headers={"X-CSRF-Token": csrf_token},
             )
 
-            access_token = login_resp.cookies.get("access_token", "")
+            access_token = login_resp.cookies.get("__Host-access_token", "")
             csrf_token = (
                 login_resp.cookies.get("csrf_token")
                 or client.cookies.get("csrf_token")
@@ -3562,7 +3565,7 @@ async def test_download_file_success(self, tmp_path):
 
                 download_response = await client.get(
                     f"/web/downloads/{job_id}/file",
-                    cookies={"access_token": access_token},
+                    cookies={"__Host-access_token": access_token},
                 )
 
         assert download_response.status_code == 200
diff --git a/tests/test_auth_module.py b/tests/test_auth_module.py
index 25b14ac8..3546c8e4 100644
--- a/tests/test_auth_module.py
+++ b/tests/test_auth_module.py
@@ -88,7 +88,7 @@ def test_set_token_cookies_sets_access_token(self):
 
         access_token_call = None
         for call in response.set_cookie.call_args_list:
-            if call.kwargs.get("key") == "access_token":
+            if call.kwargs.get("key") == "__Host-access_token":
                 access_token_call = call
                 break
 
@@ -108,7 +108,7 @@ def test_set_token_cookies_sets_refresh_token(self):
 
         refresh_token_call = None
         for call in response.set_cookie.call_args_list:
-            if call.kwargs.get("key") == "refresh_token":
+            if call.kwargs.get("key") == "__Host-refresh_token":
                 refresh_token_call = call
                 break
 
@@ -129,7 +129,7 @@ def test_clear_token_cookies_deletes_access_token(self):
 
         delete_call = None
         for call in response.delete_cookie.call_args_list:
-            if call.kwargs.get("key") == "access_token":
+            if call.kwargs.get("key") == "__Host-access_token":
                 delete_call = call
                 break
 
@@ -143,7 +143,7 @@ def test_clear_token_cookies_deletes_refresh_token(self):
 
         delete_call = None
         for call in response.delete_cookie.call_args_list:
-            if call.kwargs.get("key") == "refresh_token":
+            if call.kwargs.get("key") == "__Host-refresh_token":
                 delete_call = call
                 break
 
diff --git a/tests/test_browser_downloader_config.py b/tests/test_browser_downloader_config.py
new file mode 100644
index 00000000..47215a87
--- /dev/null
+++ b/tests/test_browser_downloader_config.py
@@ -0,0 +1,78 @@
+"""Unit tests for browser-downloader settings in core.config."""
+
+from __future__ import annotations
+
+import pytest
+
+
+class TestBrowserDownloaderSettingsDefaults:
+    """Verify the four new settings exist with documented defaults.
+
+    Phase 2 wires these via env vars; defaults must keep the system
+    pre-Phase-2-safe (browser_downloader_enabled=False means the worker
+    routes everything to yt-dlp, matching prior behavior).
+    """
+
+    @pytest.mark.unit
+    def test_browser_downloader_enabled_defaults_to_false(self) -> None:
+        from core.config import Settings
+
+        s = Settings(_env_file=None)  # type: ignore[call-arg]
+        assert s.browser_downloader_enabled is False
+
+    @pytest.mark.unit
+    def test_browser_downloader_endpoint_default(self) -> None:
+        from core.config import Settings
+
+        s = Settings(_env_file=None)  # type: ignore[call-arg]
+        assert s.browser_downloader_endpoint == "http://browser-downloader:3000"
+
+    @pytest.mark.unit
+    def test_browser_downloader_timeout_default_is_300(self) -> None:
+        from core.config import Settings
+
+        s = Settings(_env_file=None)  # type: ignore[call-arg]
+        assert s.browser_downloader_timeout == 300
+
+    @pytest.mark.unit
+    def test_browser_downloader_cb_use_redis_defaults_to_false(self) -> None:
+        from core.config import Settings
+
+        s = Settings(_env_file=None)  # type: ignore[call-arg]
+        assert s.browser_downloader_cb_use_redis is False
+
+
+class TestBrowserDownloaderSettingsValidation:
+    """Failure modes for the new validators.
+
+    The project's `Settings.validate_and_construct` skips validators in
+    `TESTING=1` mode (see `_is_testing_enabled` in core/config.py), so we
+    exercise `_validate_browser_downloader` directly to assert the rules.
+    """
+
+    @pytest.mark.unit
+    def test_invalid_endpoint_url_raises(self) -> None:
+        from core.config import Settings
+
+        s = Settings(_env_file=None)  # type: ignore[call-arg]
+        s.browser_downloader_endpoint = "not-a-url"
+        with pytest.raises(ValueError, match="BROWSER_DOWNLOADER_ENDPOINT"):
+            s._validate_browser_downloader()
+
+    @pytest.mark.unit
+    def test_timeout_zero_is_rejected(self) -> None:
+        from core.config import Settings
+
+        s = Settings(_env_file=None)  # type: ignore[call-arg]
+        s.browser_downloader_timeout = 0
+        with pytest.raises(ValueError, match="BROWSER_DOWNLOADER_TIMEOUT"):
+            s._validate_browser_downloader()
+
+    @pytest.mark.unit
+    def test_empty_endpoint_is_rejected(self) -> None:
+        from core.config import Settings
+
+        s = Settings(_env_file=None)  # type: ignore[call-arg]
+        s.browser_downloader_endpoint = ""
+        with pytest.raises(ValueError, match="BROWSER_DOWNLOADER_ENDPOINT"):
+            s._validate_browser_downloader()
diff --git a/tests/test_env_contract.py b/tests/test_env_contract.py
index 7fca36b0..aff02c19 100644
--- a/tests/test_env_contract.py
+++ b/tests/test_env_contract.py
@@ -124,12 +124,11 @@ def test_rotated_runtime_values_preserve_auth_and_service_url_contracts(monkeypa
 
     monkeypatch.setattr(auth, "settings", rotated_settings)
 
-    token = auth.create_access_token("story-6-1-user", email="operator@example.com")
+    token = auth.create_access_token("story-6-1-user")
     payload = auth.verify_token(token, expected_type=auth.ACCESS_TOKEN_TYPE)
 
     assert payload is not None
     assert payload["sub"] == "story-6-1-user"
-    assert payload["email"] == "operator@example.com"
 
 
 @pytest.mark.unit
diff --git a/tests/test_services/test_download_service.py b/tests/test_services/test_download_service.py
index da5cd638..066f7c3b 100644
--- a/tests/test_services/test_download_service.py
+++ b/tests/test_services/test_download_service.py
@@ -76,8 +76,8 @@ async def test_create_writes_job_and_pending_outbox(db_session, sample_url):
 
 
 @pytest.mark.asyncio
-async def test_best_effort_enqueue_deletes_pending_outbox_on_success(db_session):
-    """Best-effort enqueue removes pending outbox recovery rows after queue success."""
+async def test_best_effort_enqueue_marks_pending_outbox_processed_on_success(db_session):
+    """Best-effort enqueue transitions the pending outbox row to 'processed' after queue success."""
     from app.services.download_service import DownloadService
 
     user = await _user(db_session)
@@ -97,7 +97,9 @@ async def test_best_effort_enqueue_deletes_pending_outbox_on_success(db_session)
 
     enqueue.assert_awaited_once_with(job.id)
     outbox_result = await db_session.execute(select(Outbox).where(Outbox.job_id == job.id))
-    assert outbox_result.scalar_one_or_none() is None
+    processed = outbox_result.scalar_one()
+    assert processed.status == "processed"
+    assert processed.processed_at is not None
 
 
 @pytest.mark.asyncio
@@ -139,7 +141,7 @@ def __init__(self) -> None:
             self.rolled_back = False
 
         async def execute(self, _statement):
-            raise RuntimeError("delete failed")
+            raise RuntimeError("update failed")
 
         async def commit(self):
             raise AssertionError("commit should not run when cleanup fails")
diff --git a/tests/test_services/test_yt_dlp.py b/tests/test_services/test_yt_dlp.py
index e13b75fc..faad6f0d 100644
--- a/tests/test_services/test_yt_dlp.py
+++ b/tests/test_services/test_yt_dlp.py
@@ -11,7 +11,7 @@
 
 import pytest
 
-from app.services.yt_dlp_service import extract_media_url
+from app.services.yt_dlp_service import _get_platform, extract_media_url
 from app.utils.exceptions import StorageError
 from app.utils.validators import is_youtube_url
 
@@ -661,3 +661,135 @@ async def test_format_unavailable_continues_to_next(self, captured_script: str)
         """Verify the script contains error handling that continues to next format on 'not available'."""
         assert '"Requested format" in err_str and "not available" in err_str' in captured_script
         assert "continue" in captured_script
+
+
+class TestGetPlatform:
+    """Tests for _get_platform platform detection function."""
+
+    def test_youtube_watch_url(self) -> None:
+        assert _get_platform("https://www.youtube.com/watch?v=dQw4w9WgXcQ") == "youtube"
+
+    def test_youtube_short_url(self) -> None:
+        assert _get_platform("https://youtu.be/dQw4w9WgXcQ") == "youtube"
+
+    def test_youtube_music_url(self) -> None:
+        assert _get_platform("https://music.youtube.com/watch?v=abc") == "youtube"
+
+    def test_youtube_nocookie_url(self) -> None:
+        assert _get_platform("https://www.youtube-nocookie.com/watch?v=abc") == "youtube"
+
+    def test_youtube_mobile_url(self) -> None:
+        assert _get_platform("https://m.youtube.com/watch?v=abc") == "youtube"
+
+    def test_vimeo_url(self) -> None:
+        assert _get_platform("https://vimeo.com/76979871") == "vimeo"
+
+    def test_dailymotion_url(self) -> None:
+        assert _get_platform("https://www.dailymotion.com/video/x84sh87") == "dailymotion"
+
+    def test_twitch_url(self) -> None:
+        assert _get_platform("https://clips.twitch.tv/SmilingPluckySashimiBibleThump") == "twitch"
+
+    def test_tiktok_url(self) -> None:
+        assert (
+            _get_platform("https://www.tiktok.com/@khaby.lame/video/7008477449723292934")
+            == "tiktok"
+        )
+
+    def test_instagram_url(self) -> None:
+        assert _get_platform("https://www.instagram.com/reel/DGcoPAktJAT/") == "instagram"
+
+    def test_unknown_domain_defaults_to_youtube(self) -> None:
+        assert _get_platform("https://example.com/video") == "youtube"
+
+    def test_subdomain_bypass_rejected_for_youtube(self) -> None:
+        """Exact domain matching prevents fake subdomains from matching."""
+        assert _get_platform("https://youtube.com.evil.com/watch?v=abc") != "youtube"
+
+    def test_subdomain_bypass_rejected_for_tiktok(self) -> None:
+        assert _get_platform("https://tiktok.com.evil.com/video/123") != "tiktok"
+
+    def test_empty_url_returns_youtube(self) -> None:
+        assert _get_platform("not-a-url") == "youtube"
+
+
+class TestPlatformFormatChains:
+    """Tests verifying platform-specific format chains are routed correctly."""
+
+    @pytest.fixture
+    async def captured_script_tiktok(self) -> str:
+        """Capture the generated script for a TikTok URL."""
+        from app.services.yt_dlp_service import _extract_via_subprocess
+
+        captured_scripts: list[str] = []
+
+        async def capturing_subprocess_exec(*args, **kwargs):
+            captured_scripts.append(args[2])
+            return _make_process(pid=12346)
+
+        with (
+            patch(
+                "app.services.yt_dlp_service.asyncio.create_subprocess_exec",
+                capturing_subprocess_exec,
+            ),
+            patch("app.services.yt_dlp_service._check_ssrf", new_callable=AsyncMock),
+        ):
+            await _extract_via_subprocess("https://www.tiktok.com/@test/video/123", "/tmp/out")
+
+        return captured_scripts[0]
+
+    @pytest.fixture
+    async def captured_script_instagram(self) -> str:
+        """Capture the generated script for an Instagram URL."""
+        from app.services.yt_dlp_service import _extract_via_subprocess
+
+        captured_scripts: list[str] = []
+
+        async def capturing_subprocess_exec(*args, **kwargs):
+            captured_scripts.append(args[2])
+            return _make_process(pid=12347)
+
+        with (
+            patch(
+                "app.services.yt_dlp_service.asyncio.create_subprocess_exec",
+                capturing_subprocess_exec,
+            ),
+            patch("app.services.yt_dlp_service._check_ssrf", new_callable=AsyncMock),
+        ):
+            await _extract_via_subprocess("https://www.instagram.com/reel/test/", "/tmp/out")
+
+        return captured_scripts[0]
+
+    @pytest.mark.asyncio
+    async def test_tiktok_excludes_youtube_specific_opts(self, captured_script_tiktok: str) -> None:
+        """TikTok extraction must NOT include YouTube-only format options."""
+        assert '"prefer_free_formats"' not in captured_script_tiktok
+        assert '"check_formats"' not in captured_script_tiktok
+
+    @pytest.mark.asyncio
+    async def test_tiktok_excludes_youtube_player_clients(
+        self, captured_script_tiktok: str
+    ) -> None:
+        """TikTok extraction must NOT include YouTube player_client extractor args."""
+        assert '"player_client"' not in captured_script_tiktok
+
+    @pytest.mark.asyncio
+    async def test_tiktok_uses_simple_format_chain(self, captured_script_tiktok: str) -> None:
+        """TikTok extraction uses simple best format, not the 5-entry YouTube chain."""
+        assert '"bestvideo*+bestaudio/best"' not in captured_script_tiktok
+        assert '"bestvideo+bestaudio/best"' not in captured_script_tiktok
+        assert '"res:1080"' not in captured_script_tiktok
+        assert '"best"' in captured_script_tiktok
+
+    @pytest.mark.asyncio
+    async def test_platform_in_error_message(self, captured_script_tiktok: str) -> None:
+        """Failure message includes platform prefix like [tiktok]."""
+        assert "[{platform}]" in captured_script_tiktok or "[tiktok]" in captured_script_tiktok
+
+    @pytest.mark.asyncio
+    async def test_instagram_excludes_youtube_specific_opts(
+        self, captured_script_instagram: str
+    ) -> None:
+        """Instagram extraction must NOT include YouTube-only format options."""
+        assert '"prefer_free_formats"' not in captured_script_instagram
+        assert '"check_formats"' not in captured_script_instagram
diff --git a/tests/test_story_1_2_config_extraction.py b/tests/test_story_1_2_config_extraction.py
index 66a13ed0..dcc75e15 100644
--- a/tests/test_story_1_2_config_extraction.py
+++ b/tests/test_story_1_2_config_extraction.py
@@ -20,6 +20,7 @@
     "006_add_failed_job_original_job_id_index.py",
     "007_add_check_constraints_and_fk.py",
     "008_add_last_error_to_download_jobs.py",
+    "009_add_outbox_pending_unique_index.py",
 }
 
 
diff --git a/tests/test_story_1_3_database_metrics_extraction.py b/tests/test_story_1_3_database_metrics_extraction.py
index 53a5a99d..870563d5 100644
--- a/tests/test_story_1_3_database_metrics_extraction.py
+++ b/tests/test_story_1_3_database_metrics_extraction.py
@@ -21,6 +21,7 @@
     "006_add_failed_job_original_job_id_index.py",
     "007_add_check_constraints_and_fk.py",
     "008_add_last_error_to_download_jobs.py",
+    "009_add_outbox_pending_unique_index.py",
 }
 _LEGACY_MODULES = {_DATABASE_SHIM_MODULE, _METRICS_SHIM_MODULE}
 
diff --git a/tests/test_story_1_4_redis_logging_queue_extraction.py b/tests/test_story_1_4_redis_logging_queue_extraction.py
index ea8edf36..8150b7f4 100644
--- a/tests/test_story_1_4_redis_logging_queue_extraction.py
+++ b/tests/test_story_1_4_redis_logging_queue_extraction.py
@@ -19,6 +19,7 @@
     "006_add_failed_job_original_job_id_index.py",
     "007_add_check_constraints_and_fk.py",
     "008_add_last_error_to_download_jobs.py",
+    "009_add_outbox_pending_unique_index.py",
 }
 _OLD_IMPORT_PATTERNS = (
     "from app.services.redis_client",
diff --git a/tests/test_story_2_4_web_html_consolidation.py b/tests/test_story_2_4_web_html_consolidation.py
index 5af211b4..2acb9fc4 100644
--- a/tests/test_story_2_4_web_html_consolidation.py
+++ b/tests/test_story_2_4_web_html_consolidation.py
@@ -146,6 +146,6 @@ async def test_htmx_rate_limit_response_uses_centralized_html_fragment():
     response = await rate_limit_exceeded_handler(mock_request, mock_exc)
 
     assert response.status_code == 429
-    assert response.headers["Retry-After"] == "300"
+    assert response.headers["Retry-After"] == "60"
     assert b'class="error-box"' in response.body
     assert b"Rate limit exceeded" in response.body
diff --git a/tests/test_story_3_1_web_auth_extraction.py b/tests/test_story_3_1_web_auth_extraction.py
index d68badf4..d6ca40a9 100644
--- a/tests/test_story_3_1_web_auth_extraction.py
+++ b/tests/test_story_3_1_web_auth_extraction.py
@@ -79,7 +79,7 @@ async def test_web_auth_smoke_flow_register_login_validate_csrf_and_logout():
     password = "securepassword123"
 
     async with AsyncClient(
-        transport=ASGITransport(app=app), base_url="http://test", follow_redirects=False
+        transport=ASGITransport(app=app), base_url="https://test", follow_redirects=False
     ) as client:
         register_page = await client.get("/web/register")
         register_csrf = _csrf_cookie(register_page)
@@ -114,13 +114,13 @@ async def test_web_auth_smoke_flow_register_login_validate_csrf_and_logout():
 
     assert register_response.status_code == 303
     assert register_response.headers["location"] == "/web/downloads"
-    assert "access_token" in register_response.cookies
-    assert "refresh_token" in register_response.cookies
+    assert "__Host-access_token" in register_response.cookies
+    assert "__Host-refresh_token" in register_response.cookies
 
     assert login_response.status_code == 303
     assert login_response.headers["location"] == "/web/downloads"
-    assert "access_token" in login_response.cookies
-    assert "refresh_token" in login_response.cookies
+    assert "__Host-access_token" in login_response.cookies
+    assert "__Host-refresh_token" in login_response.cookies
     assert active_csrf != login_csrf
 
     assert dashboard_response.status_code == 200
diff --git a/tests/test_story_3_2_web_downloads_extraction.py b/tests/test_story_3_2_web_downloads_extraction.py
index b3d9e870..ea87028f 100644
--- a/tests/test_story_3_2_web_downloads_extraction.py
+++ b/tests/test_story_3_2_web_downloads_extraction.py
@@ -125,7 +125,7 @@ async def test_web_downloads_smoke_flow_create_list_sse_and_delete(sample_url):
             data={"email": email, "password": password},
             headers={"X-CSRF-Token": csrf_token},
         )
-        access_token = login_response.cookies.get("access_token", "")
+        access_token = login_response.cookies.get("__Host-access_token", "")
         csrf_token = (
             login_response.cookies.get("csrf_token")
             or client.cookies.get("csrf_token")
@@ -145,7 +145,7 @@ async def test_web_downloads_smoke_flow_create_list_sse_and_delete(sample_url):
                 "/web/downloads",
                 data={"url": sample_url},
                 headers={"HX-Request": "true", "X-CSRF-Token": csrf_token},
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
         assert create_response.status_code == 200
@@ -163,7 +163,7 @@ async def test_web_downloads_smoke_flow_create_list_sse_and_delete(sample_url):
 
         list_response = await client.get(
             "/web/downloads",
-            cookies={"access_token": access_token},
+            cookies={"__Host-access_token": access_token},
         )
         csrf_token = get_csrf_from_response(list_response) or csrf_token
         sse_events = await _emit_initial_snapshot(TestingSessionLocal, user_id, OrderedDict())
@@ -174,7 +174,7 @@ async def test_web_downloads_smoke_flow_create_list_sse_and_delete(sample_url):
         delete_response = await client.delete(
             f"/web/downloads/{job_id}",
             headers={"HX-Request": "true", "X-CSRF-Token": csrf_token},
-            cookies={"access_token": access_token},
+            cookies={"__Host-access_token": access_token},
         )
 
     assert list_response.status_code == 200
diff --git a/tests/test_story_3_3_web_remaining_extraction.py b/tests/test_story_3_3_web_remaining_extraction.py
index 1356343d..40e2b5ba 100644
--- a/tests/test_story_3_3_web_remaining_extraction.py
+++ b/tests/test_story_3_3_web_remaining_extraction.py
@@ -157,10 +157,10 @@ async def test_settings_page_username_update_and_delete_account_smoke_flow():
     ) as client:
         await do_register(client, email, password)
         csrf_token = await do_login(client, email, password)
-        access_token = client.cookies.get("access_token", "")
+        access_token = client.cookies.get("__Host-access_token", "")
 
         settings_response = await client.get(
-            "/web/settings", cookies={"access_token": access_token}
+            "/web/settings", cookies={"__Host-access_token": access_token}
         )
         csrf_token = get_csrf_from_response(settings_response) or csrf_token
 
@@ -168,11 +168,11 @@ async def test_settings_page_username_update_and_delete_account_smoke_flow():
             "/web/settings/username",
             data={"username": "  story33-user  "},
             headers={"X-CSRF-Token": csrf_token},
-            cookies={"access_token": access_token},
+            cookies={"__Host-access_token": access_token},
         )
 
         settings_after_update = await client.get(
-            "/web/settings", cookies={"access_token": access_token}
+            "/web/settings", cookies={"__Host-access_token": access_token}
         )
         csrf_token = get_csrf_from_response(settings_after_update) or csrf_token
 
@@ -180,7 +180,7 @@ async def test_settings_page_username_update_and_delete_account_smoke_flow():
             "/web/settings/delete-account",
             data={"password": password, "confirm_text": "DELETE"},
             headers={"X-CSRF-Token": csrf_token},
-            cookies={"access_token": access_token},
+            cookies={"__Host-access_token": access_token},
         )
 
     assert settings_response.status_code == 200
@@ -202,10 +202,10 @@ async def test_settings_username_htmx_error_returns_fragment():
     ) as client:
         await do_register(client, email, password)
         csrf_token = await do_login(client, email, password)
-        access_token = client.cookies.get("access_token", "")
+        access_token = client.cookies.get("__Host-access_token", "")
 
         settings_response = await client.get(
-            "/web/settings", cookies={"access_token": access_token}
+            "/web/settings", cookies={"__Host-access_token": access_token}
         )
         csrf_token = get_csrf_from_response(settings_response) or csrf_token
 
@@ -213,7 +213,7 @@ async def test_settings_username_htmx_error_returns_fragment():
             "/web/settings/username",
             data={"username": "ab"},
             headers={"HX-Request": "true", "X-CSRF-Token": csrf_token},
-            cookies={"access_token": access_token},
+            cookies={"__Host-access_token": access_token},
         )
 
     assert username_response.status_code == 400
@@ -232,7 +232,7 @@ async def test_delete_account_cleanup_failure_preserves_user_and_jobs(tmp_path):
     ) as client:
         await do_register(client, email, password)
         csrf_token = await do_login(client, email, password)
-        access_token = client.cookies.get("access_token", "")
+        access_token = client.cookies.get("__Host-access_token", "")
 
         async with TestingSessionLocal() as session:
             user_result = await session.execute(select(User).where(User.email == email))
@@ -250,7 +250,7 @@ async def test_delete_account_cleanup_failure_preserves_user_and_jobs(tmp_path):
             job_id = job.id
 
         settings_response = await client.get(
-            "/web/settings", cookies={"access_token": access_token}
+            "/web/settings", cookies={"__Host-access_token": access_token}
         )
         csrf_token = get_csrf_from_response(settings_response) or csrf_token
 
@@ -260,7 +260,7 @@ async def test_delete_account_cleanup_failure_preserves_user_and_jobs(tmp_path):
                 "/web/settings/delete-account",
                 data={"password": password, "confirm_text": "DELETE"},
                 headers={"X-CSRF-Token": csrf_token},
-                cookies={"access_token": access_token},
+                cookies={"__Host-access_token": access_token},
             )
 
     async with TestingSessionLocal() as session:
diff --git a/tests/test_story_3_5_processor_retry_dlq_extraction.py b/tests/test_story_3_5_processor_retry_dlq_extraction.py
index 58cbadca..77d3caca 100644
--- a/tests/test_story_3_5_processor_retry_dlq_extraction.py
+++ b/tests/test_story_3_5_processor_retry_dlq_extraction.py
@@ -146,7 +146,10 @@ async def record_retry(job_id_arg, retry_timestamp: float) -> bool:
     assert queued[0][1] == pytest.approx(_as_utc(retried.next_retry_at).timestamp(), abs=0.01)
 
     outbox_result = await db_session.execute(select(Outbox).where(Outbox.job_id == job_id))
-    assert outbox_result.scalars().all() == []
+    rows = outbox_result.scalars().all()
+    assert len(rows) == 1
+    assert rows[0].status == "processed"
+    assert rows[0].processed_at is not None
 
 
 @pytest.mark.unit
@@ -291,7 +294,7 @@ def test_replay_all_retains_batch_original_job_lookup() -> None:
 @pytest.mark.unit
 @pytest.mark.asyncio
 async def test_outbox_relay_handles_retry_payload_success_and_failure(db_session) -> None:
-    """Outbox relay deletes successful retry rows and retains failed retry rows as pending."""
+    """Outbox relay marks successful retry rows 'processed' and retains failed ones as pending."""
     from worker.outbox_relay import sync_outbox_to_queue
 
     user_id = uuid4()
@@ -335,15 +338,16 @@ async def test_outbox_relay_handles_retry_payload_success_and_failure(db_session
     assert synced == 1
     result = await db_session.execute(select(Outbox))
     remaining = result.scalars().all()
-    assert len(remaining) == 1
-    assert remaining[0].job_id == failed_job_id
-    assert remaining[0].status == "pending"
+    assert len(remaining) == 2
+    statuses = {r.job_id: r.status for r in remaining}
+    assert statuses[successful_job_id] == "processed"
+    assert statuses[failed_job_id] == "pending"
 
 
 @pytest.mark.unit
 @pytest.mark.asyncio
 async def test_outbox_relay_clears_duplicate_retry_rows_after_verifying_redis(db_session) -> None:
-    """Outbox relay should delete retry rows already recovered to Redis before a crash."""
+    """Outbox relay marks retry rows already recovered to Redis as 'processed'."""
     from worker.outbox_relay import sync_outbox_to_queue
 
     user_id = uuid4()
@@ -382,7 +386,9 @@ async def test_outbox_relay_clears_duplicate_retry_rows_after_verifying_redis(db
 
     assert synced == 1
     result = await db_session.execute(select(Outbox).where(Outbox.job_id == job_id))
-    assert result.scalars().all() == []
+    rows = result.scalars().all()
+    assert len(rows) == 1
+    assert rows[0].status == "processed"
 
 
 @pytest.mark.unit
@@ -394,4 +400,5 @@ def test_outbox_relay_static_contracts_are_preserved() -> None:
     assert ".with_for_update(skip_locked=True)" in source
     assert 'entry.event_type == "retry_scheduled"' in source
     assert "push_to_download_queue" in source
-    assert 'Outbox.status == "pending"' in source
+    # The relay still filters on the pending status; we keep it as a constant.
+    assert 'Outbox.status == "pending"' in source or '_PENDING_STATUS = "pending"' in source
diff --git a/tests/test_story_3_6_main_decomposition.py b/tests/test_story_3_6_main_decomposition.py
index 11af6ffc..d88c59f1 100644
--- a/tests/test_story_3_6_main_decomposition.py
+++ b/tests/test_story_3_6_main_decomposition.py
@@ -308,8 +308,8 @@ async def test_root_redirects_missing_invalid_and_valid_tokens_unchanged() -> No
 
     async with AsyncClient(transport=ASGITransport(app=app), base_url="http://test") as client:
         missing_response = await client.get("/")
-        invalid_response = await client.get("/", cookies={"access_token": "invalid-token"})
-        valid_response = await client.get("/", cookies={"access_token": valid_token})
+        invalid_response = await client.get("/", cookies={"__Host-access_token": "invalid-token"})
+        valid_response = await client.get("/", cookies={"__Host-access_token": valid_token})
 
     assert missing_response.status_code == 303
     assert missing_response.headers["location"] == "/web/login"
diff --git a/tests/test_story_5_6_model_index_consistency.py b/tests/test_story_5_6_model_index_consistency.py
index bb43f94e..7b590f63 100644
--- a/tests/test_story_5_6_model_index_consistency.py
+++ b/tests/test_story_5_6_model_index_consistency.py
@@ -46,6 +46,7 @@
         "ix_outbox_job_id",
         "ix_outbox_status",
         "ix_outbox_status_created_at",
+        "uq_outbox_pending_job_id",
     },
 }
 
@@ -108,12 +109,13 @@ def test_download_job_metadata_keeps_only_single_column_model_index() -> None:
 
 
 def test_outbox_metadata_matches_database_indexes() -> None:
-    """Outbox metadata should represent its single-column and composite indexes."""
+    """Outbox metadata should represent its single-column, composite, and partial unique indexes."""
     outbox_indexes = _index_names("outbox")
 
     assert "ix_outbox_job_id" in outbox_indexes
     assert "ix_outbox_status" in outbox_indexes
     assert "ix_outbox_status_created_at" in outbox_indexes
+    assert "uq_outbox_pending_job_id" in outbox_indexes
 
 
 def test_story_5_1_composites_are_documented_as_migration_only() -> None:
diff --git a/tests/test_story_8_3_javascript_bugs_performance.py b/tests/test_story_8_3_javascript_bugs_performance.py
index 4ee2de60..4699fd99 100644
--- a/tests/test_story_8_3_javascript_bugs_performance.py
+++ b/tests/test_story_8_3_javascript_bugs_performance.py
@@ -165,7 +165,7 @@ async def test_dashboard_route_still_loads_dashboard_assets():
     """The rendered dashboard keeps dashboard JS and owns the SSE extension."""
     async with AsyncClient(transport=ASGITransport(app=app), base_url="http://test") as client:
         access_token = await create_test_user_and_login(client)
-        response = await client.get("/web/downloads", cookies={"access_token": access_token})
+        response = await client.get("/web/downloads", cookies={"__Host-access_token": access_token})
 
     assert response.status_code == 200
     assert '<script src="/static/js/sse.js"></script>' in response.text
@@ -178,7 +178,7 @@ async def test_dashboard_route_renders_scoped_download_form_contract():
     """The rendered dashboard exposes the scoped HTMX download form contract."""
     async with AsyncClient(transport=ASGITransport(app=app), base_url="http://test") as client:
         access_token = await create_test_user_and_login(client)
-        response = await client.get("/web/downloads", cookies={"access_token": access_token})
+        response = await client.get("/web/downloads", cookies={"__Host-access_token": access_token})
 
     assert response.status_code == 200
     assert 'id="download-form"' in response.text
@@ -198,7 +198,7 @@ async def test_non_dashboard_pages_do_not_render_sse_extension():
         register_response = await client.get("/web/register")
         access_token = await create_test_user_and_login(client)
         settings_response = await client.get(
-            "/web/settings", cookies={"access_token": access_token}
+            "/web/settings", cookies={"__Host-access_token": access_token}
         )
 
     for response in (login_response, register_response, settings_response):
diff --git a/tests/test_story_8_5_missing_ui_states.py b/tests/test_story_8_5_missing_ui_states.py
index 5047bd2b..05629d17 100644
--- a/tests/test_story_8_5_missing_ui_states.py
+++ b/tests/test_story_8_5_missing_ui_states.py
@@ -64,7 +64,7 @@ async def test_settings_username_save_button_has_scoped_loading_contract():
 
     async with AsyncClient(transport=ASGITransport(app=app), base_url="http://test") as client:
         access_token = await create_test_user_and_login(client)
-        response = await client.get("/web/settings", cookies={"access_token": access_token})
+        response = await client.get("/web/settings", cookies={"__Host-access_token": access_token})
 
     assert response.status_code == 200
     assert 'id="username-settings-form"' in response.text
@@ -93,7 +93,7 @@ async def test_settings_username_htmx_fragments_cover_success_and_error_states()
     """The username save endpoint returns HTMX fragments for success and critical errors."""
     async with AsyncClient(transport=ASGITransport(app=app), base_url="http://test") as client:
         access_token = await create_test_user_and_login(client)
-        client.cookies.set("access_token", access_token)
+        client.cookies.set("__Host-access_token", access_token)
 
         settings_response = await client.get("/web/settings")
         csrf_token = _csrf_token(client, settings_response)
diff --git a/tests/test_story_8_6_accessibility_audit.py b/tests/test_story_8_6_accessibility_audit.py
index f064a8b1..0500c742 100644
--- a/tests/test_story_8_6_accessibility_audit.py
+++ b/tests/test_story_8_6_accessibility_audit.py
@@ -254,7 +254,7 @@ async def test_authenticated_dashboard_and_settings_render_accessible_controls()
     """Authenticated pages render keyboard-reachable controls without gray-500 text."""
     async with AsyncClient(transport=ASGITransport(app=app), base_url="http://test") as client:
         access_token = await create_test_user_and_login(client)
-        cookies = {"access_token": access_token}
+        cookies = {"__Host-access_token": access_token}
         dashboard_response = await client.get("/web/downloads", cookies=cookies)
         settings_response = await client.get("/web/settings", cookies=cookies)
 
@@ -297,7 +297,7 @@ async def test_settings_error_state_renders_accessible_error_contract():
         access_token = await create_test_user_and_login(client)
         response = await client.get(
             "/web/settings?error=bad_current_password",
-            cookies={"access_token": access_token},
+            cookies={"__Host-access_token": access_token},
         )
 
     assert response.status_code == 200
diff --git a/tests/test_worker/test_browser_executor.py b/tests/test_worker/test_browser_executor.py
new file mode 100644
index 00000000..5e9a271c
--- /dev/null
+++ b/tests/test_worker/test_browser_executor.py
@@ -0,0 +1,341 @@
+"""Tests for worker.browser_executor module.
+
+Covers the I/O matrix from spec-gh-140-p2-worker-integration.md:
+- success path returns (file_path, file_name, None)
+- error code → ErrorCategory mapping for every documented microservice code
+- HTTP transport failures map to TRANSIENT/TIMEOUT
+- circuit breaker integration (open circuit → TRANSIENT, no HTTP call)
+- no httpx exception leaks past extract_media
+"""
+
+from __future__ import annotations
+
+import httpx
+import pytest
+
+from app.services.circuit_breaker import CircuitState
+from app.services.error_classifier import ErrorCategory
+from worker.browser_executor import (
+    BrowserExecutorError,
+    _map_response_to_category,
+    extract_media,
+    get_browser_downloader_circuit_breaker,
+    select_executor,
+)
+
+
+@pytest.fixture(autouse=True)
+def _reset_breaker_state():
+    """Reset the module-level circuit breaker between tests.
+
+    The breaker is a singleton; without this fixture a test that opens the
+    breaker (e.g. via `record_failure` loops) leaks state into subsequent
+    tests and triggers spurious `circuit_open` errors.
+    """
+    breaker = get_browser_downloader_circuit_breaker()
+    breaker._state = CircuitState.CLOSED
+    breaker._failure_count = 0
+    breaker._success_count = 0
+    breaker._last_failure_time = None
+    breaker._half_open_calls = 0
+    yield
+    breaker._state = CircuitState.CLOSED
+    breaker._failure_count = 0
+    breaker._success_count = 0
+    breaker._last_failure_time = None
+    breaker._half_open_calls = 0
+
+
+# -- select_executor: hostname routing -----------------------------------
+
+
+class TestSelectExecutor:
+    """Hostname-based dispatch — pure function, no settings touch."""
+
+    @pytest.mark.unit
+    @pytest.mark.parametrize(
+        "url",
+        [
+            "https://www.tiktok.com/@user/video/123",
+            "https://tiktok.com/@u/v/1",
+            "https://m.tiktok.com/v/1.html",
+            "https://tiktokv.com/share/video/1",
+            "https://vm.tiktok.com/abcdef",
+            "https://www.instagram.com/reel/abc",
+            "https://instagram.com/p/xyz",
+            "https://instagr.am/p/abc",
+            "https://twitter.com/user/status/1",
+            "https://x.com/user/status/1",
+            "https://t.co/abc",
+        ],
+    )
+    def test_browser_platforms_route_to_browser(self, url: str) -> None:
+        assert select_executor(url) == "browser"
+
+    @pytest.mark.unit
+    def test_fqdn_trailing_dot_routes_to_browser(self) -> None:
+        # Some DNS resolvers return FQDN form (with trailing dot).
+        # We must still match.
+        assert select_executor("https://www.tiktok.com./@u/v/1") == "browser"
+        assert select_executor("https://instagram.com./p/x") == "browser"
+
+    @pytest.mark.unit
+    @pytest.mark.parametrize(
+        "url",
+        [
+            "https://www.youtube.com/watch?v=abc",
+            "https://youtu.be/abc",
+            "https://example.com/foo",
+            "https://vimeo.com/123",
+            "",
+        ],
+    )
+    def test_non_browser_platforms_route_to_youtube(self, url: str) -> None:
+        assert select_executor(url) == "youtube"
+
+    @pytest.mark.unit
+    def test_unparseable_url_falls_through_to_youtube(self) -> None:
+        # Malformed URL is treated as unknown → yt-dlp (current behavior)
+        assert select_executor("not a url at all") == "youtube"
+
+
+# -- _map_response_to_category: error code → ErrorCategory ---------------
+
+
+class TestMapResponseToCategory:
+    """Single source of truth for microservice error codes."""
+
+    @pytest.mark.unit
+    def test_drm_detected_is_blocked(self) -> None:
+        assert _map_response_to_category("drm_detected") == ErrorCategory.BLOCKED
+
+    @pytest.mark.unit
+    def test_anti_bot_block_is_blocked(self) -> None:
+        assert _map_response_to_category("anti_bot_block") == ErrorCategory.BLOCKED
+
+    @pytest.mark.unit
+    def test_no_media_found_is_not_found(self) -> None:
+        assert _map_response_to_category("no_media_found") == ErrorCategory.NOT_FOUND
+
+    @pytest.mark.unit
+    def test_network_error_is_transient(self) -> None:
+        assert _map_response_to_category("network_error") == ErrorCategory.TRANSIENT
+
+    @pytest.mark.unit
+    def test_timeout_is_timeout(self) -> None:
+        assert _map_response_to_category("request_timeout") == ErrorCategory.TIMEOUT
+
+    @pytest.mark.unit
+    def test_http_5xx_is_transient(self) -> None:
+        assert _map_response_to_category("http_503") == ErrorCategory.TRANSIENT
+
+    @pytest.mark.unit
+    def test_http_4xx_unknown_is_blocked(self) -> None:
+        assert _map_response_to_category("http_400") == ErrorCategory.BLOCKED
+
+    @pytest.mark.unit
+    def test_invalid_request_is_blocked(self) -> None:
+        assert _map_response_to_category("invalid_request") == ErrorCategory.BLOCKED
+
+    @pytest.mark.unit
+    def test_http_429_rate_limit_is_transient(self) -> None:
+        # 429 from the microservice (in the error code) is rate limiting,
+        # not a platform-level block. Retries should kick in.
+        assert _map_response_to_category("http_429") == ErrorCategory.TRANSIENT
+
+    @pytest.mark.unit
+    def test_unknown_code_defaults_to_transient(self) -> None:
+        assert _map_response_to_category("something_new") == ErrorCategory.TRANSIENT
+
+
+# -- extract_media: HTTP path --------------------------------------------
+
+
+def _make_mock_client(response_status: int, body: dict | str) -> httpx.AsyncClient:
+    """Build an httpx.AsyncClient whose single POST returns the given response.
+
+    Uses httpx.MockTransport (httpx's built-in test utility — no external
+    mocking library required).
+    """
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        if isinstance(body, str):
+            return httpx.Response(response_status, text=body)
+        return httpx.Response(response_status, json=body)
+
+    return httpx.AsyncClient(transport=httpx.MockTransport(handler))
+
+
+class TestExtractMediaSuccess:
+    @pytest.mark.asyncio
+    @pytest.mark.unit
+    async def test_success_returns_tuple_with_filename_derived_from_path(self) -> None:
+        client = _make_mock_client(
+            200,
+            {"status": "success", "file_path": "/storage/abc-123.mp4", "tier_used": 1},
+        )
+        result = await extract_media(
+            "https://tiktok.com/@u/v/1",
+            "/storage",
+            client=client,
+        )
+        assert result == ("/storage/abc-123.mp4", "abc-123.mp4", None)
+
+
+class TestExtractMediaErrorCodes:
+    @pytest.mark.asyncio
+    @pytest.mark.unit
+    async def test_drm_detected_maps_to_blocked(self) -> None:
+        client = _make_mock_client(
+            502,
+            {"status": "failed", "error": "drm_detected"},
+        )
+        with pytest.raises(BrowserExecutorError) as exc:
+            await extract_media("https://tiktok.com/@u/v/1", "/storage", client=client)
+        assert exc.value.category == ErrorCategory.BLOCKED
+        assert exc.value.signal == "drm_detected"
+
+    @pytest.mark.asyncio
+    @pytest.mark.unit
+    async def test_anti_bot_block_maps_to_blocked(self) -> None:
+        client = _make_mock_client(
+            502,
+            {"status": "failed", "error": "anti_bot_block"},
+        )
+        with pytest.raises(BrowserExecutorError) as exc:
+            await extract_media("https://instagram.com/p/x", "/storage", client=client)
+        assert exc.value.category == ErrorCategory.BLOCKED
+
+    @pytest.mark.asyncio
+    @pytest.mark.unit
+    async def test_no_media_found_maps_to_not_found(self) -> None:
+        client = _make_mock_client(
+            502,
+            {"status": "failed", "error": "no_media_found"},
+        )
+        with pytest.raises(BrowserExecutorError) as exc:
+            await extract_media("https://tiktok.com/@u/v/1", "/storage", client=client)
+        assert exc.value.category == ErrorCategory.NOT_FOUND
+
+    @pytest.mark.asyncio
+    @pytest.mark.unit
+    async def test_http_5xx_with_json_error_maps_to_transient(self) -> None:
+        client = _make_mock_client(
+            503,
+            {"status": "failed", "error": "concurrency_limit"},
+        )
+        with pytest.raises(BrowserExecutorError) as exc:
+            await extract_media("https://tiktok.com/@u/v/1", "/storage", client=client)
+        # 'concurrency_limit' is not a known code → falls through to TRANSIENT
+        assert exc.value.category == ErrorCategory.TRANSIENT
+        assert exc.value.signal == "concurrency_limit"
+
+    @pytest.mark.asyncio
+    @pytest.mark.unit
+    async def test_http_503_empty_body_maps_to_transient_with_status_signal(self) -> None:
+        """AC4: 503 with an empty body should still classify as TRANSIENT
+        with the synthetic http_<status> signal — covers the case where
+        the microservice is overloaded and closes the response without
+        writing JSON.
+        """
+        client = _make_mock_client(503, "")
+        with pytest.raises(BrowserExecutorError) as exc:
+            await extract_media("https://tiktok.com/@u/v/1", "/storage", client=client)
+        assert exc.value.category == ErrorCategory.TRANSIENT
+        assert exc.value.signal == "http_503"
+
+    @pytest.mark.asyncio
+    @pytest.mark.unit
+    async def test_non_json_error_body_maps_to_transient(self) -> None:
+        client = _make_mock_client(502, "internal server error")
+        with pytest.raises(BrowserExecutorError) as exc:
+            await extract_media("https://tiktok.com/@u/v/1", "/storage", client=client)
+        assert exc.value.category == ErrorCategory.TRANSIENT
+        assert exc.value.signal == "http_502"
+
+    @pytest.mark.asyncio
+    @pytest.mark.unit
+    async def test_http_400_maps_to_blocked(self) -> None:
+        client = _make_mock_client(
+            400,
+            {"status": "failed", "error": "invalid_request", "message": "bad url"},
+        )
+        with pytest.raises(BrowserExecutorError) as exc:
+            await extract_media("https://tiktok.com/@u/v/1", "/storage", client=client)
+        assert exc.value.category == ErrorCategory.BLOCKED
+
+    @pytest.mark.asyncio
+    @pytest.mark.unit
+    async def test_200_with_missing_file_path_maps_to_transient(self) -> None:
+        client = _make_mock_client(200, {"status": "success"})
+        with pytest.raises(BrowserExecutorError) as exc:
+            await extract_media("https://tiktok.com/@u/v/1", "/storage", client=client)
+        assert exc.value.category == ErrorCategory.TRANSIENT
+        assert exc.value.signal == "missing_file_path"
+
+    @pytest.mark.asyncio
+    @pytest.mark.unit
+    async def test_200_with_non_dict_json_body_maps_to_transient(self) -> None:
+        """Microservice contract violation: 200 OK with a JSON list/null/scalar body."""
+        client = _make_mock_client(200, [1, 2, 3])
+        with pytest.raises(BrowserExecutorError) as exc:
+            await extract_media("https://tiktok.com/@u/v/1", "/storage", client=client)
+        assert exc.value.category == ErrorCategory.TRANSIENT
+        assert exc.value.signal == "invalid_response_shape"
+
+
+class TestExtractMediaCircuitBreaker:
+    @pytest.mark.asyncio
+    @pytest.mark.unit
+    async def test_open_circuit_raises_transient_without_http_call(self) -> None:
+        # When the breaker is OPEN, no HTTP call should be made. We use a
+        # transport that would raise if invoked, proving the call was skipped.
+        # Phase 2 fix: CircuitBreakerOpenError propagates raw so the processor's
+        # deferred-job path handles it (worker/processor.py:_handle_circuit_open).
+        from app.services.circuit_breaker import CircuitBreakerOpenError
+
+        called = False
+
+        def handler(request: httpx.Request) -> httpx.Response:
+            nonlocal called
+            called = True
+            return httpx.Response(200, json={"status": "success", "file_path": "/x.mp4"})
+
+        client = httpx.AsyncClient(transport=httpx.MockTransport(handler))
+
+        # Force the breaker open by recording 5 consecutive failures
+        breaker = get_browser_downloader_circuit_breaker()
+        for _ in range(breaker.failure_threshold):
+            await breaker.record_failure(RuntimeError("boom"))
+
+        with pytest.raises(CircuitBreakerOpenError):
+            await extract_media(
+                "https://tiktok.com/@u/v/1",
+                "/storage",
+                client=client,
+            )
+        assert called is False, "HTTP transport was called despite open breaker"
+
+    @pytest.mark.asyncio
+    @pytest.mark.unit
+    async def test_no_httpx_exception_leaks_past_extract_media(self) -> None:
+        def handler(request: httpx.Request) -> httpx.Response:
+            raise httpx.ReadError("stream broke")
+
+        client = httpx.AsyncClient(transport=httpx.MockTransport(handler))
+        with pytest.raises(BrowserExecutorError):
+            await extract_media("https://tiktok.com/@u/v/1", "/storage", client=client)
+        # The exception must be BrowserExecutorError, not httpx.HTTPError
+        # (defensive — the type annotation in extract_media's docstring).
+
+
+# -- Circuit breaker singleton -------------------------------------------
+
+
+class TestBreakerSingleton:
+    @pytest.mark.unit
+    def test_get_breaker_returns_same_instance(self) -> None:
+        a = get_browser_downloader_circuit_breaker()
+        b = get_browser_downloader_circuit_breaker()
+        assert a is b
+        assert a.name == "browser_downloader"
diff --git a/tests/test_worker/test_job_executor_routing.py b/tests/test_worker/test_job_executor_routing.py
new file mode 100644
index 00000000..a02be382
--- /dev/null
+++ b/tests/test_worker/test_job_executor_routing.py
@@ -0,0 +1,203 @@
+"""Tests for the Phase 2 routing decision in worker.job_executor.
+
+The I/O matrix in spec-gh-140-p2-worker-integration.md:
+- tiktok/instagram/twitter/x URL + feature on → browser executor
+- youtube URL → yt-dlp
+- unknown host → yt-dlp (fallthrough, current behavior)
+- feature off forces yt-dlp even for TikTok
+"""
+
+from __future__ import annotations
+
+from unittest.mock import AsyncMock, patch
+
+import pytest
+
+from worker import job_executor
+from worker.job_executor import _resolve_executor_kind, select_executor
+
+
+class TestSelectExecutor:
+    """select_executor is the pure routing function. It does not touch settings."""
+
+    @pytest.mark.unit
+    @pytest.mark.parametrize(
+        "url",
+        [
+            "https://www.tiktok.com/@user/video/123",
+            "https://vm.tiktok.com/x",
+            "https://www.instagram.com/reel/abc",
+            "https://instagr.am/p/x",
+            "https://twitter.com/u/status/1",
+            "https://x.com/u/status/1",
+            "https://t.co/abc",
+        ],
+    )
+    def test_browser_platforms(self, url: str) -> None:
+        assert select_executor(url) == "browser"
+
+    @pytest.mark.unit
+    @pytest.mark.parametrize(
+        "url",
+        [
+            "https://www.youtube.com/watch?v=abc",
+            "https://youtu.be/abc",
+            "https://example.com/foo",
+            "https://vimeo.com/123",
+        ],
+    )
+    def test_youtube_or_unknown(self, url: str) -> None:
+        assert select_executor(url) == "youtube"
+
+
+class TestResolveExecutorKind:
+    """_resolve_executor_kind respects the browser_downloader_enabled flag."""
+
+    @pytest.mark.unit
+    def test_tiktok_url_with_feature_off_returns_youtube(self) -> None:
+        with patch.object(job_executor.settings, "browser_downloader_enabled", False):
+            assert _resolve_executor_kind("https://tiktok.com/@u/v/1") == "youtube"
+
+    @pytest.mark.unit
+    def test_tiktok_url_with_feature_on_returns_browser(self) -> None:
+        with patch.object(job_executor.settings, "browser_downloader_enabled", True):
+            assert _resolve_executor_kind("https://tiktok.com/@u/v/1") == "browser"
+
+    @pytest.mark.unit
+    def test_youtube_url_with_feature_on_returns_youtube(self) -> None:
+        with patch.object(job_executor.settings, "browser_downloader_enabled", True):
+            assert _resolve_executor_kind("https://youtu.be/abc") == "youtube"
+
+    @pytest.mark.unit
+    def test_unknown_host_with_feature_on_returns_youtube(self) -> None:
+        with patch.object(job_executor.settings, "browser_downloader_enabled", True):
+            assert _resolve_executor_kind("https://example.com/foo") == "youtube"
+
+    @pytest.mark.unit
+    def test_instagram_url_with_feature_off_returns_youtube(self) -> None:
+        with patch.object(job_executor.settings, "browser_downloader_enabled", False):
+            assert _resolve_executor_kind("https://instagram.com/p/x") == "youtube"
+
+
+class TestExecuteRoutesToBrowserExecutor:
+    """End-to-end: `execute()` invokes the browser path for TikTok + feature on."""
+
+    @pytest.mark.asyncio
+    @pytest.mark.unit
+    async def test_browser_path_invokes_browser_executor_for_tiktok(self) -> None:
+        from core.models.download_job import DownloadJob
+        from worker.job_executor import execute
+
+        job = DownloadJob(
+            id="550e8400-e29b-41d4-a716-446655440000",
+            user_id="550e8400-e29b-41d4-a716-446655440005",
+            url="https://tiktok.com/@u/v/1",
+            status="processing",
+            retry_count=0,
+        )
+
+        mock_browser = AsyncMock(
+            return_value=("/storage/abc.mp4", "abc.mp4", None),
+        )
+        with (
+            patch.object(job_executor.settings, "browser_downloader_enabled", True),
+            patch.object(job_executor.settings, "feature_throttle_preemptive_enabled", False),
+            patch.object(job_executor, "extract_media_browser", mock_browser),
+            patch.object(
+                job_executor,
+                "extract_media_with_circuit_breaker",
+                AsyncMock(),
+            ) as mock_ytdlp,
+        ):
+            db = AsyncMock()
+            db.execute = AsyncMock()
+            db.commit = AsyncMock()
+            # First db.execute call updates the row to completed; subsequent
+            # calls re-select. We return a fake result with rowcount=1.
+            update_result = AsyncMock()
+            update_result.rowcount = 1
+            update_result.scalar_one_or_none = AsyncMock(return_value=job)
+            db.execute.return_value = update_result
+
+            await execute(db, job, start_time=0.0)
+
+        mock_browser.assert_awaited_once()
+        mock_ytdlp.assert_not_awaited()
+
+    @pytest.mark.asyncio
+    @pytest.mark.unit
+    async def test_youtube_path_skips_browser_executor(self) -> None:
+        from core.models.download_job import DownloadJob
+        from worker.job_executor import execute
+
+        job = DownloadJob(
+            id="550e8400-e29b-41d4-a716-446655440000",
+            user_id="550e8400-e29b-41d4-a716-446655440005",
+            url="https://youtu.be/abc",
+            status="processing",
+            retry_count=0,
+        )
+
+        mock_ytdlp = AsyncMock(
+            return_value=("/storage/yt.mp4", "yt.mp4", "Title"),
+        )
+        with (
+            patch.object(job_executor.settings, "browser_downloader_enabled", True),
+            patch.object(job_executor.settings, "feature_throttle_preemptive_enabled", False),
+            patch.object(job_executor, "extract_media_browser", AsyncMock()) as mock_browser,
+            patch.object(
+                job_executor,
+                "extract_media_with_circuit_breaker",
+                mock_ytdlp,
+            ),
+        ):
+            db = AsyncMock()
+            update_result = AsyncMock()
+            update_result.rowcount = 1
+            update_result.scalar_one_or_none = AsyncMock(return_value=job)
+            db.execute = AsyncMock(return_value=update_result)
+            db.commit = AsyncMock()
+
+            await execute(db, job, start_time=0.0)
+
+        mock_ytdlp.assert_awaited_once()
+        mock_browser.assert_not_awaited()
+
+    @pytest.mark.asyncio
+    @pytest.mark.unit
+    async def test_feature_off_routes_tiktok_to_ytdlp(self) -> None:
+        from core.models.download_job import DownloadJob
+        from worker.job_executor import execute
+
+        job = DownloadJob(
+            id="550e8400-e29b-41d4-a716-446655440000",
+            user_id="550e8400-e29b-41d4-a716-446655440005",
+            url="https://tiktok.com/@u/v/1",
+            status="processing",
+            retry_count=0,
+        )
+
+        mock_ytdlp = AsyncMock(
+            return_value=("/storage/yt.mp4", "yt.mp4", None),
+        )
+        with (
+            patch.object(job_executor.settings, "browser_downloader_enabled", False),
+            patch.object(job_executor.settings, "feature_throttle_preemptive_enabled", False),
+            patch.object(job_executor, "extract_media_browser", AsyncMock()) as mock_browser,
+            patch.object(
+                job_executor,
+                "extract_media_with_circuit_breaker",
+                mock_ytdlp,
+            ),
+        ):
+            db = AsyncMock()
+            update_result = AsyncMock()
+            update_result.rowcount = 1
+            update_result.scalar_one_or_none = AsyncMock(return_value=job)
+            db.execute = AsyncMock(return_value=update_result)
+            db.commit = AsyncMock()
+
+            await execute(db, job, start_time=0.0)
+
+        mock_ytdlp.assert_awaited_once()
+        mock_browser.assert_not_awaited()
diff --git a/tests/test_worker/test_outbox_recovery.py b/tests/test_worker/test_outbox_recovery.py
index 1685f334..906f5039 100644
--- a/tests/test_worker/test_outbox_recovery.py
+++ b/tests/test_worker/test_outbox_recovery.py
@@ -92,13 +92,18 @@ async def test_sync_outbox_recovers_pending_entries(self, db_session, job_id, us
             synced = await sync_outbox_to_queue(batch_size=10)
             assert synced == 1
 
-        # Outbox entry is DELETED after successful sync (not updated to enqueued)
+        # Outbox entry is marked 'processed' (not deleted) after successful sync.
+        # Expire the test session so the commit from the relay's separate session
+        # is visible through the same async engine.
+        await db_session.commit()
+        db_session.expire_all()
         from sqlalchemy import select
 
-        await db_session.commit()
         result = await db_session.execute(select(Outbox).where(Outbox.id == outbox_id))
-        deleted_entry = result.scalar_one_or_none()
-        assert deleted_entry is None
+        processed_entry = result.scalar_one_or_none()
+        assert processed_entry is not None
+        assert processed_entry.status == "processed"
+        assert processed_entry.processed_at is not None
 
     @pytest.mark.unit
     async def test_sync_outbox_with_retry_scheduled(self, db_session, job_id, user_id):
@@ -247,8 +252,16 @@ async def test_sync_outbox_with_for_update_skip_locked(self, db_session):
 
 class TestOutboxIdempotency:
     @pytest.mark.unit
-    async def test_duplicate_outbox_entry_prevented(self, db_session, job_id, user_id):
-        """Test that duplicate outbox entries are prevented by idempotent check."""
+    async def test_duplicate_pending_outbox_entry_rejected_by_db(self, db_session, job_id, user_id):
+        """Test that a second 'pending' outbox row for the same job_id is rejected
+        by the partial unique index ``uq_outbox_pending_job_id``.
+
+        The DB-enforced constraint is the primary guard; the application-layer
+        SELECT-then-INSERT check inside ``write_job_to_outbox`` provides a
+        cheaper fast-path for the common case.
+        """
+        from sqlalchemy.exc import IntegrityError
+
         job = DownloadJob(
             id=job_id,
             user_id=user_id,
@@ -285,11 +298,9 @@ async def test_duplicate_outbox_entry_prevented(self, db_session, job_id, user_i
             status="pending",
         )
         db_session.add(outbox2)
-        await db_session.commit()
-
-        result = await db_session.execute(select(Outbox).where(Outbox.job_id == job_id))
-        all_entries = result.scalars().all()
-        assert len(all_entries) == 2
+        with pytest.raises(IntegrityError):
+            await db_session.commit()
+        await db_session.rollback()
 
 
 class TestOutboxBatchProcessing:
@@ -327,11 +338,15 @@ async def test_sync_respects_batch_size(self, db_session):
             synced = await sync_outbox_to_queue(batch_size=2)
             assert synced == 2
 
-        # Entries are DELETED after successful sync (batch_size=2 means 2 deleted)
+        # Entries are marked 'processed' after successful sync (batch_size=2 means 2 processed)
         await db_session.commit()
         result = await db_session.execute(select(Outbox))
         remaining = result.scalars().all()
-        assert len(remaining) == 3  # 5 - 2 = 3 remain
+        assert len(remaining) == 5
+        processed = [r for r in remaining if r.status == "processed"]
+        pending = [r for r in remaining if r.status == "pending"]
+        assert len(processed) == 2
+        assert len(pending) == 3
 
 
 class TestOutboxCrashRecoveryScenarios:
@@ -367,13 +382,16 @@ async def test_job_created_but_not_enqueued(self, db_session, job_id, user_id):
             synced = await sync_outbox_to_queue(batch_size=10)
             assert synced == 1
 
-        # Entry is DELETED after successful sync
+        # Entry is marked 'processed' after successful sync, retained for audit.
         await db_session.commit()
+        db_session.expire_all()
         from sqlalchemy import select
 
         result = await db_session.execute(select(Outbox).where(Outbox.id == outbox_id))
-        deleted = result.scalar_one_or_none()
-        assert deleted is None
+        processed = result.scalar_one_or_none()
+        assert processed is not None
+        assert processed.status == "processed"
+        assert processed.processed_at is not None
 
     @pytest.mark.unit
     async def test_job_enqueued_twice_prevented(self, db_session, job_id, user_id):
diff --git a/worker/browser_executor.py b/worker/browser_executor.py
new file mode 100644
index 00000000..60e47656
--- /dev/null
+++ b/worker/browser_executor.py
@@ -0,0 +1,373 @@
+"""Browser downloader microservice HTTP client.
+
+Phase 2 worker integration: the worker calls the standalone Node.js
+microservice at `packages/browser-downloader/` (Phase 0) over HTTP for
+platforms that yt-dlp cannot handle (TikTok, Instagram, Twitter/X).
+
+This module owns three concerns:
+1. Translate `POST :3000/download` responses into the worker's existing
+   `(file_path, file_name, title)` tuple shape.
+2. Map the microservice's structured error codes into the existing
+   `app.services.error_classifier.ErrorCategory` values so the existing
+   retry/DLQ pipeline handles them.
+3. Wrap every call in a named circuit breaker so a flaky downstream
+   cannot stall the worker.
+
+Design notes (KEEP):
+- Single `BrowserExecutorError` exception type carries `category` and
+  `signal`. The job executor passes these to the existing retry machinery
+  unchanged.
+- The error-code → category mapping is centralized in
+  `_map_response_to_category` — every failure path goes through it.
+- The circuit breaker is a named singleton alongside
+  `get_youtube_circuit_breaker` in `app.services.circuit_breaker`.
+- No progress streaming (microservice is single-shot HTTP); the worker
+  passes `progress_callback=None` from the caller.
+"""
+
+from __future__ import annotations
+
+import json
+from collections.abc import Awaitable, Callable
+from dataclasses import dataclass
+from typing import Any, ClassVar
+from urllib.parse import urlparse
+
+import httpx
+
+from app.services.circuit_breaker import (
+    CircuitBreaker,
+    CircuitBreakerOpenError,
+)
+from app.services.error_classifier import ErrorCategory
+from core.config import settings
+from core.logging_config import get_logger
+
+logger = get_logger(__name__)
+
+
+class BrowserExecutorError(Exception):
+    """Failure with a classified retry category and a stable signal.
+
+    The `category` value is consumed by the existing retry/DLQ pipeline in
+    `worker/job_executor.py`; the `signal` value is the original microservice
+    error code (or a synthetic marker for transport failures) preserved for
+    observability and tests.
+
+    The `str(...)` representation embeds a marker that the existing
+    `app.services.error_classifier.classify_error` regex patterns can match,
+    so the typed `category` is corroborated by the string-based classifier
+    used in `worker/retry_scheduler.evaluate`.
+    """
+
+    _CATEGORY_MARKERS: ClassVar[dict[ErrorCategory, str]] = {
+        ErrorCategory.BLOCKED: "blocked (anti-bot or DRM)",
+        ErrorCategory.NOT_FOUND: "404 not found",
+        ErrorCategory.TIMEOUT: "Request timeout",
+        ErrorCategory.TRANSIENT: "network error (transient)",
+        ErrorCategory.UNKNOWN: "unknown error",
+    }
+
+    def __init__(self, category: ErrorCategory, signal: str) -> None:
+        self.category = category
+        self.signal = signal
+        marker = self._CATEGORY_MARKERS.get(category, "transient error")
+        super().__init__(f"{marker}: {signal}")
+
+
+@dataclass(slots=True)
+class _HttpResponse:
+    """Minimal shape for httpx responses we read here.
+
+    Allows tests to inject a fake without standing up an httpx transport.
+    The real path passes through `httpx.Response` (duck-typed).
+    """
+
+    status_code: int
+    body: bytes
+
+
+ProgressCallback = Callable[[dict], Awaitable[None]]
+
+
+# -- Singleton client & breaker -------------------------------------------
+
+_client: httpx.AsyncClient | None = None
+_breaker: CircuitBreaker | None = None
+
+
+def _get_client() -> httpx.AsyncClient:
+    """Lazy singleton httpx client.
+
+    `trust_env=False` so the worker does not pick up a stray HTTP_PROXY
+    from the environment and route internal service-to-service traffic
+    through an unrelated proxy. Operators who DO need proxy support can
+    add a `browser_downloader_proxy` setting in P4.
+
+    Timeout model: 30s connect (matches the spec's "existing 30s connect"
+    pattern; httpx's default of 5s is too tight for a slow microservice
+    cold start) plus the configurable `browser_downloader_timeout` for
+    read/write/pool (default 300s — covers the full Tier 1 + Tier 2
+    window in the microservice).
+    """
+    global _client
+    if _client is None:
+        _client = httpx.AsyncClient(
+            timeout=httpx.Timeout(
+                connect=30.0,
+                read=settings.browser_downloader_timeout,
+                write=settings.browser_downloader_timeout,
+                pool=settings.browser_downloader_timeout,
+            ),
+            trust_env=False,
+        )
+    return _client
+
+
+def get_browser_downloader_circuit_breaker() -> CircuitBreaker:
+    """Lazy singleton circuit breaker for the browser-downloader service."""
+    global _breaker
+    if _breaker is None:
+        _breaker = CircuitBreaker(
+            name="browser_downloader",
+            failure_threshold=5,
+            success_threshold=3,
+            reset_timeout=30.0,
+            half_open_max_calls=3,
+            use_redis_distributed=settings.browser_downloader_cb_use_redis,
+        )
+    return _breaker
+
+
+# -- Public API ------------------------------------------------------------
+
+
+def select_executor(url: str) -> str:
+    """Pick the executor kind for a job URL.
+
+    Returns the literal string `"browser"` for known browser-only platforms
+    (TikTok, Instagram, Twitter/X) and `"youtube"` for everything else. The
+    feature flag (`browser_downloader_enabled`) is enforced by the caller in
+    `worker/job_executor.py` — this function is a pure hostname lookup so it
+    can be unit-tested without touching settings.
+
+    Hostname matching uses suffix equality (e.g. `www.tiktok.com`,
+    `m.tiktok.com`, `vm.tiktok.com` all match `tiktok.com`). This keeps the
+    set small while still catching mobile subdomains that platforms
+    frequently serve on.
+
+    Unknown hosts fall through to `"youtube"` to preserve pre-Phase-2
+    behavior (yt-dlp attempts and fails as today).
+    """
+    try:
+        hostname = (urlparse(url).hostname or "").lower()
+    except (ValueError, TypeError):
+        return "youtube"
+    # Strip a leading "www." so www.tiktok.com → tiktok.com.
+    if hostname.startswith("www."):
+        hostname = hostname[4:]
+    # FQDN form (trailing dot) — "tiktok.com." → "tiktok.com" before matching.
+    if hostname.endswith("."):
+        hostname = hostname[:-1]
+    browser_suffixes = (
+        "tiktok.com",
+        "tiktokv.com",
+        "instagram.com",
+        "instagr.am",
+        "twitter.com",
+        "x.com",
+        "t.co",
+    )
+    for suffix in browser_suffixes:
+        if hostname == suffix or hostname.endswith("." + suffix):
+            return "browser"
+    return "youtube"
+
+
+async def extract_media(
+    url: str,
+    storage_path: str,
+    *,
+    progress_callback: ProgressCallback | None = None,
+    client: httpx.AsyncClient | None = None,
+) -> tuple[str, str, str | None]:
+    """Call the browser-downloader microservice and return `(file_path, file_name, title)`.
+
+    `title` is always `None` for browser-platform downloads in Phase 2 (the
+    microservice does not extract titles). The DB column is nullable so this
+    is safe to insert directly.
+
+    Raises:
+        BrowserExecutorError: every failure mode is wrapped in this with a
+            classified `ErrorCategory`. No raw `httpx` exception leaks.
+    """
+    _ = progress_callback  # Microservice is single-shot; no progress stream.
+    http_client = client or _get_client()
+    breaker = get_browser_downloader_circuit_breaker()
+
+    request_body = {"url": url, "output_dir": storage_path}
+    endpoint = settings.browser_downloader_endpoint.rstrip("/") + "/download"
+
+    try:
+        return await breaker.execute(_call_service, http_client, endpoint, request_body)
+    except CircuitBreakerOpenError:
+        # Let CircuitBreakerOpenError propagate so the processor's dedicated
+        # deferred-job path can handle it (worker/processor.py:_handle_circuit_open).
+        raise
+    except BrowserExecutorError:
+        raise
+    except Exception as exc:
+        logger.error("browser_downloader_unexpected_error", error=str(exc), exc_info=True)
+        raise BrowserExecutorError(
+            category=ErrorCategory.UNKNOWN, signal="unexpected_error"
+        ) from exc
+
+
+# -- Internal helpers ------------------------------------------------------
+
+
+async def _call_service(
+    http_client: httpx.AsyncClient, endpoint: str, body: dict[str, Any]
+) -> tuple[str, str, str | None]:
+    """Single HTTP attempt. Returns the success tuple or raises BrowserExecutorError.
+
+    Split out from `extract_media` so the circuit breaker can wrap exactly
+    one HTTP round-trip per recorded success/failure.
+    """
+    try:
+        response = await http_client.post(endpoint, json=body)
+    except httpx.TimeoutException as exc:
+        logger.warning("browser_downloader_timeout", error=str(exc))
+        raise BrowserExecutorError(
+            category=ErrorCategory.TIMEOUT, signal="request_timeout"
+        ) from exc
+    except httpx.ConnectError as exc:
+        logger.warning("browser_downloader_connect_error", error=str(exc))
+        raise BrowserExecutorError(
+            category=ErrorCategory.TRANSIENT, signal="connect_error"
+        ) from exc
+    except httpx.HTTPError as exc:
+        logger.warning("browser_downloader_http_error", error=str(exc))
+        raise BrowserExecutorError(category=ErrorCategory.TRANSIENT, signal="http_error") from exc
+
+    if response.status_code == 200:
+        return _parse_success(response)
+    return _parse_failure_response(response)
+
+
+def _parse_success(response: httpx.Response) -> tuple[str, str, str | None]:
+    """Parse a 200 OK response into the worker's tuple shape."""
+    try:
+        payload = response.json()
+    except (json.JSONDecodeError, ValueError) as exc:
+        logger.warning("browser_downloader_non_json_success", status=response.status_code)
+        raise BrowserExecutorError(
+            category=ErrorCategory.TRANSIENT, signal="non_json_response"
+        ) from exc
+
+    if not isinstance(payload, dict):
+        logger.warning(
+            "browser_downloader_invalid_response_shape",
+            payload_type=type(payload).__name__,
+        )
+        raise BrowserExecutorError(
+            category=ErrorCategory.TRANSIENT, signal="invalid_response_shape"
+        )
+
+    if payload.get("status") != "success":
+        # 200 OK with a failed status is a microservice-side failure
+        # (e.g. a graceful degraded path). Reuse the failure parser.
+        return _parse_failure_payload(payload)
+
+    file_path = payload.get("file_path")
+    if not isinstance(file_path, str) or not file_path:
+        logger.warning(
+            "browser_downloader_missing_file_path",
+            payload_keys=list(payload.keys()),
+        )
+        raise BrowserExecutorError(category=ErrorCategory.TRANSIENT, signal="missing_file_path")
+    file_name = file_path.rsplit("/", 1)[-1] or file_path
+    return file_path, file_name, None
+
+
+def _parse_failure_response(response: httpx.Response) -> tuple[str, str, str | None]:
+    """Parse a non-200 response, mapping HTTP status + JSON error code to a category."""
+    signal = f"http_{response.status_code}"
+    try:
+        payload = response.json()
+    except (json.JSONDecodeError, ValueError) as err:
+        # Non-JSON error body — use the synthesized HTTP status signal so 404/403/429
+        # are categorized correctly even when the body is empty or non-JSON.
+        logger.warning(
+            "browser_downloader_non_json_error",
+            status=response.status_code,
+        )
+        raise BrowserExecutorError(
+            category=_map_response_to_category(signal),
+            signal=signal,
+        ) from err
+
+    if not isinstance(payload, dict):
+        logger.warning(
+            "browser_downloader_invalid_response_shape",
+            payload_type=type(payload).__name__,
+        )
+        raise BrowserExecutorError(
+            category=_map_response_to_category(signal),
+            signal=signal,
+        )
+
+    return _parse_failure_payload(payload, fallback_code=signal)
+
+
+def _parse_failure_payload(
+    payload: dict[str, Any],
+    *,
+    fallback_code: str = "unknown_error",
+) -> tuple[str, str, str | None]:
+    """Map a structured failure payload to an error category.
+
+    Accepts both 200-with-failed-status and non-200 responses.
+    Raises BrowserExecutorError so the circuit breaker records a failure.
+
+    When the JSON body lacks an explicit ``error`` field, ``fallback_code``
+    (typically the synthesized ``http_<status>`` signal) is used so HTTP
+    404/403/429 still map to their correct categories.
+    """
+    code: str = payload.get("error")  # type: ignore[assignment]
+    if not isinstance(code, str) or not code:
+        code = fallback_code
+    category = _map_response_to_category(code, payload)
+    raise BrowserExecutorError(category=category, signal=code)
+
+
+def _map_response_to_category(code: str, payload: dict[str, Any] | None = None) -> ErrorCategory:
+    """Single source of truth for microservice error code → ErrorCategory.
+
+    Mapping is intentionally narrow: anything not explicitly recognized is
+    TRANSIENT (retries are safe; the worker can reclassify later if needed).
+    """
+    # Terminal categories first — these never retry
+    if code in {"drm_detected", "anti_bot_block"}:
+        return ErrorCategory.BLOCKED
+    if code in {"no_media_found", "not_found", "private_content", "http_404"}:
+        return ErrorCategory.NOT_FOUND
+    # 429 rate-limit (microservice body) — TRANSIENT so the existing
+    # backoff machinery applies; falling through to BLOCKED here would
+    # send rate-limited jobs straight to the DLQ.
+    if code in {"http_429", "http_503"}:
+        return ErrorCategory.TRANSIENT
+    if code in {"network_error", "http_error", "connect_error", "non_json_response"}:
+        return ErrorCategory.TRANSIENT
+    if code in {"timeout", "request_timeout"}:
+        return ErrorCategory.TIMEOUT
+    # Generic 4xx (other than the BLOCKED/NOT_FOUND codes above) → BLOCKED
+    if code.startswith("http_4"):
+        return ErrorCategory.BLOCKED
+    if code.startswith("http_5"):
+        return ErrorCategory.TRANSIENT
+    if code == "circuit_open":
+        return ErrorCategory.TRANSIENT
+    if code == "invalid_request":
+        return ErrorCategory.BLOCKED
+    return ErrorCategory.TRANSIENT
diff --git a/worker/dlq_manager.py b/worker/dlq_manager.py
index 5b66b753..f78b0c04 100644
--- a/worker/dlq_manager.py
+++ b/worker/dlq_manager.py
@@ -87,7 +87,7 @@ async def mark_failed_and_move_to_dlq(
             last_error=accumulated,
             error_category=decision.category.value,
             completed_at=datetime.now(UTC),
-        )
+        ),
     )
     if int(getattr(failed_result, "rowcount", 0) or 0) == 0:
         logger.warning(
@@ -139,7 +139,7 @@ async def reset_stuck_jobs(timeout_minutes: int = 10) -> int:
                 updated_at=datetime.now(UTC),
             )
             .returning(DownloadJob.id, DownloadJob.user_id)
-            .execution_options(synchronize_session=False)
+            .execution_options(synchronize_session=False),
         )
         affected = result.fetchall()
         if not affected:
diff --git a/worker/health.py b/worker/health.py
index 2d652958..b0303698 100644
--- a/worker/health.py
+++ b/worker/health.py
@@ -233,6 +233,8 @@ def start_health_server(port: int | None = None) -> uvicorn.Server | None:
     if port is None:
         port = int(env_port)
 
+    health_host = os.environ.get("WORKER_HEALTH_HOST", "0.0.0.0")
+
     if port == 0:
         logger.info("worker_health_http_disabled")
         return None
@@ -244,7 +246,7 @@ def start_health_server(port: int | None = None) -> uvicorn.Server | None:
 
     config = uvicorn.Config(
         health_app,
-        host="0.0.0.0",
+        host=health_host,
         port=port,
         log_level=os.environ.get("LOG_LEVEL", "info").lower(),
         access_log=False,
diff --git a/worker/job_claimer.py b/worker/job_claimer.py
index d4c01b76..0581d5ef 100644
--- a/worker/job_claimer.py
+++ b/worker/job_claimer.py
@@ -54,7 +54,7 @@ async def claim_next(db: AsyncSession, job_id: UUID | str | bytes) -> DownloadJo
         .where(DownloadJob.id == normalized_job_id, DownloadJob.status == "pending")
         .values(status="processing", updated_at=datetime.now(UTC))
         .returning(DownloadJob)
-        .execution_options(synchronize_session=False)
+        .execution_options(synchronize_session=False),
     )
     job = result.scalar_one_or_none()
     await db.commit()
@@ -64,7 +64,7 @@ async def claim_next(db: AsyncSession, job_id: UUID | str | bytes) -> DownloadJo
 async def heartbeat(db: AsyncSession, job_id: UUID) -> None:
     """Update a processing job heartbeat timestamp."""
     await db.execute(
-        update(DownloadJob).where(DownloadJob.id == job_id).values(updated_at=datetime.now(UTC))
+        update(DownloadJob).where(DownloadJob.id == job_id).values(updated_at=datetime.now(UTC)),
     )
     await db.commit()
 
@@ -89,7 +89,7 @@ async def periodic_heartbeat(
                     await hb_db.execute(
                         update(DownloadJob)
                         .where(DownloadJob.id == job_id)
-                        .values(updated_at=datetime.now(UTC))
+                        .values(updated_at=datetime.now(UTC)),
                     )
                     await hb_db.commit()
     except asyncio.CancelledError:
diff --git a/worker/job_executor.py b/worker/job_executor.py
index 6b8538c4..f8e97991 100644
--- a/worker/job_executor.py
+++ b/worker/job_executor.py
@@ -27,6 +27,12 @@
 from core.models.download_job import DownloadJob
 from core.models.outbox import Outbox
 from core.queue import redis_client
+from worker.browser_executor import (
+    extract_media as extract_media_browser,
+)
+from worker.browser_executor import (
+    select_executor,
+)
 from worker.health import update_worker_state
 from worker.job_claimer import heartbeat, periodic_heartbeat
 
@@ -53,6 +59,20 @@ class ExecutionResult:
     completed: bool = False
 
 
+def _resolve_executor_kind(url: str) -> str:
+    """Phase 2: pick the executor kind, respecting the browser feature flag.
+
+    `select_executor` does the pure hostname-based routing. The feature
+    flag forces a fallback to the existing yt-dlp path when the microservice
+    is disabled, preserving pre-Phase-2 behavior. Tests for the routing
+    decision should patch `select_executor` directly to avoid touching
+    settings; this wrapper is the integration point in `execute()`.
+    """
+    if not settings.browser_downloader_enabled:
+        return "youtube"
+    return select_executor(url)
+
+
 async def publish_job_status(job: DownloadJob) -> None:
     """Publish the current job status to the user's pub/sub channel."""
     try:
@@ -85,7 +105,7 @@ async def requeue_job(job_id: UUID, db) -> bool:
             {
                 "retry_count": 0,
                 "next_retry_at": datetime.now(UTC).isoformat(),
-            }
+            },
         ),
         status="pending",
     )
@@ -100,7 +120,7 @@ async def requeue_job(job_id: UUID, db) -> bool:
         .values(
             status="pending",
             updated_at=datetime.now(UTC),
-        )
+        ),
     )
     await db.commit()
     if result.rowcount == 0:
@@ -138,7 +158,7 @@ async def check_chaos_injection(db, job_id: UUID, start_time: float) -> bool:
             await db.execute(
                 update(DownloadJob)
                 .where(DownloadJob.id == job_id)
-                .values(status="pending", updated_at=datetime.now(UTC))
+                .values(status="pending", updated_at=datetime.now(UTC)),
             )
             await db.commit()
             RECOVERIES.labels(reason="zombie_sweep_recovery").inc()
@@ -148,7 +168,7 @@ async def check_chaos_injection(db, job_id: UUID, start_time: float) -> bool:
             JOB_DURATION_SECONDS.observe(time.time() - start_time)
             return True
     except Exception:
-        pass
+        logger.debug("zombie_sweep_recovery skipped (non-critical)", exc_info=True)
 
     try:
         if await redis_client.exists("chaos:db_failover"):
@@ -161,15 +181,15 @@ async def check_chaos_injection(db, job_id: UUID, start_time: float) -> bool:
     except OperationalError:
         raise
     except Exception:
-        pass
+        logger.debug("chaos_db_failover check skipped (non-critical)", exc_info=True)
 
     try:
         if await redis_client.exists("chaos:slow_processing"):
-            delay = random.uniform(5.0, 20.0)
+            delay = random.uniform(5.0, 20.0)  # noqa: S311 — chaos testing, not crypto
             logger.info("chaos_slow_processing", job_id=str(job_id), delay_seconds=round(delay, 1))
             await asyncio.sleep(delay)
     except Exception:
-        pass
+        logger.debug("chaos_slow_processing skipped (non-critical)", exc_info=True)
 
     if shutdown_event.is_set():
         logger.info("Shutdown requested, requeueing job %s", job_id)
@@ -201,11 +221,19 @@ async def execute(
         if await check_chaos_injection(db, job_id, start_time):
             return ExecutionResult(ExecutionStatus.CONSUMED, job_id, job=job)
 
-        if settings.feature_throttle_preemptive_enabled:
+        # Phase 2: route the job to the right executor. Browser-platform
+        # jobs skip the throttle predictor (yt-dlp-specific signal) and the
+        # progress callback (microservice is single-shot HTTP). The feature
+        # flag forces a fallback to yt-dlp when the microservice is disabled.
+        executor_kind = _resolve_executor_kind(job.url)
+
+        if executor_kind == "youtube" and settings.feature_throttle_preemptive_enabled:
             throttle_risk = await get_risk_score("youtube")
             if throttle_risk >= 1.0:
                 logger.warning(
-                    "preemptive_throttle_block", job_id=str(job_id), risk_score=throttle_risk
+                    "preemptive_throttle_block",
+                    job_id=str(job_id),
+                    risk_score=throttle_risk,
                 )
                 await requeue_job(job_id, db)
                 JOBS_COMPLETED.labels(status="deferred").inc()
@@ -274,28 +302,43 @@ async def progress_callback(progress_data: dict) -> None:
 
         stop_hb = asyncio.Event()
         hb_task = asyncio.create_task(
-            periodic_heartbeat(get_async_session_factory(), job_id, stop_hb)
+            periodic_heartbeat(get_async_session_factory(), job_id, stop_hb),
         )
 
         loop = asyncio.get_running_loop()
-        extract_task = loop.create_task(
-            extract_media_with_circuit_breaker(
-                job.url,
-                settings.storage_path,
-                progress_callback=progress_callback,
+        if executor_kind == "browser":
+            logger.info(
+                "job_routed_to_browser_executor",
+                job_id=str(job_id),
+                url=job.url,
+            )
+            extract_task = loop.create_task(
+                extract_media_browser(
+                    job.url,
+                    settings.storage_path,
+                    progress_callback=None,
+                ),
+            )
+        else:
+            extract_task = loop.create_task(
+                extract_media_with_circuit_breaker(
+                    job.url,
+                    settings.storage_path,
+                    progress_callback=progress_callback,
+                ),
             )
-        )
 
         try:
             file_path, file_name, title = await asyncio.wait_for(
-                extract_task, timeout=attempt_timeout
+                extract_task,
+                timeout=attempt_timeout,
             )
         except TimeoutError:
             extract_task.cancel()
             try:
                 await extract_task
             except (asyncio.CancelledError, Exception):
-                pass
+                logger.debug("extract_task cancel cleanup (non-critical)", exc_info=True)
 
             if getattr(worker_main_module, "shutdown_requested_at", None) is not None:
                 await requeue_job(job_id, db)
@@ -306,7 +349,7 @@ async def progress_callback(progress_data: dict) -> None:
                 return ExecutionResult(ExecutionStatus.REQUEUED, job_id, job=job)
 
             raise TimeoutError(
-                f"Extraction timed out after {attempt_timeout}s (attempt {job.retry_count + 1})"
+                f"Extraction timed out after {attempt_timeout}s (attempt {job.retry_count + 1})",
             ) from None
 
         if shutdown_event.is_set():
@@ -331,7 +374,7 @@ async def progress_callback(progress_data: dict) -> None:
                 title=title,
                 completed_at=datetime.now(UTC),
                 expires_at=datetime.now(UTC) + timedelta(hours=settings.file_expire_hours),
-            )
+            ),
         )
         await db.commit()
         if result.rowcount == 0:
diff --git a/worker/main.py b/worker/main.py
index 96819482..93699e6a 100644
--- a/worker/main.py
+++ b/worker/main.py
@@ -80,7 +80,7 @@ async def _update_circuit_deferred_depth() -> None:
         depth = await redis_client.zcard("circuit_deferred_queue")
         CIRCUIT_DEFERRED_DEPTH.set(depth)
     except Exception:
-        pass
+        logger.debug("circuit_deferred_depth update skipped (non-critical)", exc_info=True)
 
 
 async def cleanup_expired_jobs() -> int:
@@ -93,8 +93,9 @@ async def cleanup_expired_jobs() -> int:
 
         result = await db.execute(
             select(DownloadJob).where(
-                DownloadJob.expires_at < now, DownloadJob.status == "completed"
-            )
+                DownloadJob.expires_at < now,
+                DownloadJob.status == "completed",
+            ),
         )
         expired_jobs = result.scalars().all()
 
@@ -111,17 +112,21 @@ async def cleanup_expired_jobs() -> int:
                     )
                     continue
 
-                if os.path.exists(safe_path):
+                if os.path.exists(safe_path):  # noqa: ASYNC240 — local filesystem, negligible latency
                     try:
                         os.remove(safe_path)
                         logger.info(
-                            "cleaned_up_expired_file", file_path=safe_path, job_id=str(job.id)
+                            "cleaned_up_expired_file",
+                            file_path=safe_path,
+                            job_id=str(job.id),
                         )
                         await db.delete(job)
                         cleanup_count += 1
                     except OSError as e:
                         logger.warning(
-                            "failed_to_delete_expired_file", file_path=job.file_path, error=str(e)
+                            "failed_to_delete_expired_file",
+                            file_path=job.file_path,
+                            error=str(e),
                         )
                 else:
                     logger.info("file_already_deleted", job_id=str(job.id), file_path=job.file_path)
@@ -133,7 +138,10 @@ async def cleanup_expired_jobs() -> int:
                     cleanup_count += 1
                 except Exception as db_err:
                     logger.warning(
-                        "failed_to_delete_db_row", job_id=job.id, error=str(db_err), exc_info=True
+                        "failed_to_delete_db_row",
+                        job_id=job.id,
+                        error=str(db_err),
+                        exc_info=True,
                     )
 
         try:
@@ -156,7 +164,11 @@ async def _update_queue_depth() -> None:
         return dl + rt + cd
         """
         total = await redis_client.eval(
-            lua_script, 3, "download_queue", "retry_queue", "circuit_deferred_queue"
+            lua_script,
+            3,
+            "download_queue",
+            "retry_queue",
+            "circuit_deferred_queue",
         )
         QUEUE_DEPTH.set(int(total))
     except Exception as e:
@@ -256,9 +268,9 @@ async def main() -> None:
     last_cleanup = datetime.now(UTC) - cleanup_interval
 
     try:
-        outbox_sync_interval_seconds = int(os.environ.get("OUTBOX_SYNC_INTERVAL_SECONDS", "30"))
+        outbox_sync_interval_seconds = int(os.environ.get("OUTBOX_SYNC_INTERVAL_SECONDS", "2"))
     except (ValueError, TypeError):
-        outbox_sync_interval_seconds = 30
+        outbox_sync_interval_seconds = 2
     outbox_sync_interval_seconds = max(1, min(outbox_sync_interval_seconds, 3600))
     outbox_sync_interval = timedelta(seconds=outbox_sync_interval_seconds)
     last_outbox_sync = datetime.now(UTC) - outbox_sync_interval
@@ -300,7 +312,12 @@ async def main() -> None:
             return #due_jobs
             """
             moved_count = await redis_client.eval(
-                lua_script, 2, "retry_queue", "download_queue", now_ts, MAX_RETRY_BATCH
+                lua_script,
+                2,
+                "retry_queue",
+                "download_queue",
+                now_ts,
+                MAX_RETRY_BATCH,
             )
             if moved_count and moved_count > 0:
                 logger.info("retry_jobs_moved", moved_count=moved_count)
diff --git a/worker/outbox_relay.py b/worker/outbox_relay.py
index 9572742d..b41a62df 100644
--- a/worker/outbox_relay.py
+++ b/worker/outbox_relay.py
@@ -1,17 +1,33 @@
-"""Transactional outbox relay for Redis queue recovery."""
+"""Transactional outbox relay for Redis queue recovery.
+
+Lifecycle: outbox rows are written with status='pending' inside the same DB
+transaction that mutates the domain entity (DownloadJob). The relay claims
+pending rows, pushes the corresponding Redis message, and transitions the row
+to status='processed' (with processed_at). Rows are retained for observability
+and reaped by ``cleanup_stale_outbox_entries`` after the retention window.
+
+This module is also the single source of truth for the
+``OUTBOX_OLDEST_PENDING_SECONDS`` and ``OUTBOX_PENDING`` gauges so the
+metrics reflect relay reality even if the relay is the only thing running.
+"""
 
 import json
 from datetime import UTC, datetime, timedelta
 
-from sqlalchemy import delete, select
+from sqlalchemy import delete, func, select, update
 
 from core.database import get_async_session_factory
 from core.logging_config import get_logger
+from core.metrics import OUTBOX_OLDEST_PENDING_SECONDS, OUTBOX_PENDING
 from core.models.outbox import Outbox
 from core.queue import push_to_download_queue, push_to_retry_queue
 
 logger = get_logger(__name__)
 
+_PROCESSED_STATUS = "processed"
+_FAILED_STATUS = "failed"
+_PENDING_STATUS = "pending"
+
 
 async def _retry_job_is_already_enqueued(job_id) -> bool:
     """Return whether a retry job already exists in Redis after a deduplicated push."""
@@ -24,22 +40,55 @@ async def _retry_job_is_already_enqueued(job_id) -> bool:
         return False
 
 
+async def _update_staleness_metrics(db) -> None:
+    """Refresh OUTBOX_PENDING and OUTBOX_OLDEST_PENDING_SECONDS for observability.
+
+    Reads are best-effort. A failure here must not abort the relay cycle.
+    """
+    try:
+        pending_count = await db.scalar(
+            select(func.count()).where(Outbox.status == _PENDING_STATUS)
+        )
+        OUTBOX_PENDING.set(float(pending_count or 0))
+
+        oldest = await db.scalar(
+            select(func.extract("epoch", func.now() - func.min(Outbox.created_at))).where(
+                Outbox.status == _PENDING_STATUS,
+            ),
+        )
+        OUTBOX_OLDEST_PENDING_SECONDS.set(float(oldest or 0))
+    except Exception as exc:
+        logger.warning("outbox_staleness_metric_update_failed", error=str(exc))
+
+
 async def sync_outbox_to_queue(batch_size: int = 100) -> int:
-    """Sync pending outbox entries to Redis queue."""
+    """Sync pending outbox entries to Redis queue and mark them processed.
+
+    Returns the number of outbox entries successfully delivered to Redis.
+
+    Crash-safety: the row's status transitions from 'pending' to 'processed'
+    in a single SQL UPDATE that runs only after the Redis push has been
+    confirmed by the queue helper (push_to_download_queue / push_to_retry_queue
+    return True only after Redis acknowledged the write). If the process dies
+    between the Redis push and the UPDATE commit, the next sync will re-deliver
+    the message — duplicates are prevented at the queue side by LREM+LPUSH
+    for download_queue and ZSCORE-based dedup for retry_queue.
+    """
     session_factory = get_async_session_factory()
     synced = 0
 
     async with session_factory() as db:
         claim_result = await db.execute(
             select(Outbox)
-            .where(Outbox.status == "pending")
+            .where(Outbox.status == _PENDING_STATUS)
             .order_by(Outbox.created_at)
             .limit(batch_size)
-            .with_for_update(skip_locked=True)
+            .with_for_update(skip_locked=True),
         )
         entries = claim_result.scalars().all()
 
         if not entries:
+            await _update_staleness_metrics(db)
             return 0
 
         processed_entry_ids = []
@@ -68,15 +117,28 @@ async def sync_outbox_to_queue(batch_size: int = 100) -> int:
                     synced += 1
             except Exception as e:
                 logger.error(
-                    "failed_to_enqueue_job_from_outbox", job_id=str(entry.job_id), error=str(e)
+                    "failed_to_enqueue_job_from_outbox",
+                    job_id=str(entry.job_id),
+                    error=str(e),
                 )
 
         if processed_entry_ids:
+            now = datetime.now(UTC)
+            await db.execute(
+                update(Outbox)
+                .where(Outbox.id.in_(processed_entry_ids))
+                .values(status=_PROCESSED_STATUS, processed_at=now),
+            )
             try:
-                await db.execute(delete(Outbox).where(Outbox.id.in_(processed_entry_ids)))
                 await db.commit()
             except Exception:
                 await db.rollback()
+                logger.error(
+                    "outbox_processed_status_update_failed",
+                    count=len(processed_entry_ids),
+                )
+
+        await _update_staleness_metrics(db)
 
     if synced > 0:
         logger.info("synced_outbox_entries_to_queue", count=synced)
@@ -85,15 +147,22 @@ async def sync_outbox_to_queue(batch_size: int = 100) -> int:
 
 
 async def cleanup_stale_outbox_entries(hours: int = 24) -> int:
-    """Delete old terminal outbox entries while retaining pending crash-recovery rows."""
+    """Delete terminal outbox rows older than ``hours`` (default 24).
+
+    Terminal rows are those whose status is ``processed`` or ``failed`` (the
+    latter is reserved for relay-level delivery failures). ``pending`` rows
+    are never reaped here — they are the crash-recovery set and must survive
+    until the relay delivers them.
+    """
     session_factory = get_async_session_factory()
     cutoff = datetime.now(UTC) - timedelta(hours=hours)
     async with session_factory() as db:
         result = await db.execute(
             delete(Outbox).where(
-                Outbox.created_at < cutoff,
-                Outbox.status.in_(["completed", "failed"]),
-            )
+                Outbox.processed_at.is_not(None),
+                Outbox.processed_at < cutoff,
+                Outbox.status.in_([_PROCESSED_STATUS, _FAILED_STATUS]),
+            ),
         )
         await db.commit()
         count = int(result.rowcount or 0)
diff --git a/worker/processor.py b/worker/processor.py
index 7e2067ed..b857e949 100644
--- a/worker/processor.py
+++ b/worker/processor.py
@@ -76,7 +76,7 @@ async def _drain_circuit_deferred(max_batch: int = 10) -> int:
                     result = await db.execute(
                         update(DownloadJob)
                         .where(DownloadJob.id == job_id_str, DownloadJob.status == "deferred")
-                        .values(status="pending", updated_at=datetime.now(UTC))
+                        .values(status="pending", updated_at=datetime.now(UTC)),
                     )
                     if result.rowcount != 1:
                         await db.rollback()
@@ -196,7 +196,7 @@ async def _handle_circuit_open(db, active_job_id: UUID, cb_error: CircuitBreaker
             f"deferred until recovery (cooldown: {cb_error.reset_timeout}s)",
             error_category="transient",
             updated_at=datetime.now(UTC),
-        )
+        ),
     )
     await db.commit()
     if result.rowcount == 0:
diff --git a/worker/retry_scheduler.py b/worker/retry_scheduler.py
index d94dd832..248e3766 100644
--- a/worker/retry_scheduler.py
+++ b/worker/retry_scheduler.py
@@ -5,7 +5,7 @@
 from dataclasses import dataclass
 from datetime import UTC, datetime, timedelta
 
-from sqlalchemy import delete, select, update
+from sqlalchemy import select, update
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.services.error_classifier import (
@@ -55,7 +55,7 @@ def evaluate(job: DownloadJob, error: BaseException) -> RetryDecision:
     error_str = str(error)
     classification = classify_error(error_str)
     category = classification.category
-    job_max_retries = job.max_retries if job.max_retries else 3
+    job_max_retries = job.max_retries if job.max_retries is not None else 3
     effective_max = min(CATEGORY_POLICIES[category].max_retries, job_max_retries)
 
     ERROR_CLASSIFICATION.labels(category=category.value).inc()
@@ -139,7 +139,7 @@ async def schedule_retry(db: AsyncSession, job: DownloadJob, decision: RetryDeci
             last_error=decision.accumulated_error,
             error_category=decision.category.value,
             updated_at=datetime.now(UTC),
-        )
+        ),
     )
     if int(getattr(retry_result, "rowcount", 0) or 0) == 0:
         await db.rollback()
@@ -158,7 +158,7 @@ async def schedule_retry(db: AsyncSession, job: DownloadJob, decision: RetryDeci
                 "retry_count": job.retry_count + 1,
                 "category": decision.category.value,
                 "next_retry_at": decision.next_retry_at.isoformat(),
-            }
+            },
         ),
         status="pending",
     )
@@ -169,12 +169,19 @@ async def schedule_retry(db: AsyncSession, job: DownloadJob, decision: RetryDeci
     try:
         enqueued = await push_to_retry_queue(active_job_id, decision.next_retry_at.timestamp())
         if enqueued:
-            await db.execute(delete(Outbox).where(Outbox.id == outbox_entry.id))
+            from sqlalchemy import update as sqlalchemy_update
+
+            await db.execute(
+                sqlalchemy_update(Outbox)
+                .where(Outbox.id == outbox_entry.id)
+                .values(status="processed", processed_at=datetime.now(UTC)),
+            )
             await db.commit()
             RETRIES_TOTAL.labels(category=decision.category.value).inc()
         else:
             logger.error("job_failed_to_enqueue_for_retry", job_id=str(active_job_id))
     except Exception as enqueue_error:
+        await db.rollback()
         logger.error(
             "job_failed_to_enqueue_for_retry",
             job_id=str(active_job_id),
diff --git a/worker/zombie_sweeper.py b/worker/zombie_sweeper.py
index e428a80d..96eea63a 100644
--- a/worker/zombie_sweeper.py
+++ b/worker/zombie_sweeper.py
@@ -53,6 +53,7 @@ async def requeue_stuck_jobs(timeout_minutes: int = 15) -> int:
 
     Returns:
         Number of jobs requeued.
+
     """
     # Chaos-aware: if the chaos zombie key is active, clamp to 1 minute max
     # so the demo doesn't wait 15 minutes for recovery visualization
@@ -86,7 +87,7 @@ async def requeue_stuck_jobs(timeout_minutes: int = 15) -> int:
                 status="pending",
                 updated_at=datetime.now(UTC),
             )
-            .returning(DownloadJob.id)
+            .returning(DownloadJob.id),
         )
         requeued_ids = result.scalars().all()
 
@@ -104,7 +105,7 @@ async def requeue_stuck_jobs(timeout_minutes: int = 15) -> int:
                     event_type="zombie_recovery",
                     payload=json.dumps({"recovered_at": now.isoformat()}),
                     status="pending",
-                )
+                ),
             )
 
         try: