fix: harden utility export recovery

controller/downloads.py

@@ -305,13 +305,29 @@ class DownloadManager:
         future.add_done_callback(self._forget_future)
         return reservation
 
+    def schedule_export_reconciliation(self) -> bool:
+        """Queue crash-artifact recovery without delaying core service startup."""
+
+        with self._lock:
+            if self._stopping:
+                return False
+        try:
+            future = self._export_executor.submit(self.reconcile_export_artifacts)
+        except BaseException:
+            LOG.exception("could not schedule utility export reconciliation")
+            return False
+        with self._lock:
+            self._futures.add(future)
+        future.add_done_callback(self._forget_future)
+        return True
+
     def _forget_future(self, future: Future[Any]) -> None:
         with self._lock:
             self._futures.discard(future)
         try:
             future.result()
         except BaseException:
-            LOG.exception("download worker escaped its failure boundary")
+            LOG.exception("media worker escaped its failure boundary")
 
     def _emit(self, event: DownloadEvent) -> None:
         try:
@@ -839,7 +855,14 @@ class DownloadManager:
             and source_info.pixel_format in {"yuv420p", "yuvj420p"}
         )
         audio_compatible = source_info.audio_codec == "aac"
-        container_compatible = "mp4" in source_info.format_names
+        # ffprobe reports the same comma-separated demuxer aliases for MOV and
+        # MP4. A .mov source therefore needs at least a stream-copy remux; it
+        # must never be renamed to .mp4 solely because the alias list includes
+        # "mp4".
+        container_compatible = (
+            source.suffix.lower() == ".mp4"
+            and "mp4" in source_info.format_names
+        )
         if video_compatible and audio_compatible and container_compatible:
             os.replace(source, output)
         else: