Split video encoding from audio muxing

docs/module-internals.md

@@ -158,10 +158,15 @@ tail when diagnostics are unusually large. Aborts release it even when ffmpeg
 has already exited. A real subprocess regression writes diagnostics beyond pipe
 capacity while streaming frames, checks bounded failure reporting, and the Linux
 full-clip CI job guards the complete path.
-The finite source file is opened before the frame pipe, so ffmpeg can initialize
-the copied audio stream before producer backpressure is possible. Stream and
-metadata mappings are source-indexed accordingly; regressions assert the input
-order and both map targets.
+Frame encoding and source-audio copying run as two ffmpeg processes in sequence.
+The streaming encoder has only the frame pipe as input, so input probing or
+demux queues cannot deadlock the producer against a second input. After that
+pipe reaches EOF, a finite stream-copy mux combines the encoded video with the
+source audio and applies the requested metadata/chapter policy. Both stages use
+sibling temporary files, and only the completed mux is published atomically.
+The mux also redirects diagnostics to disk and reports only a bounded head and
+tail. Command regressions assert the single-input encoder and final map targets;
+failure regressions cover bounded mux diagnostics and atomic cleanup.
 `probe_video_encode_profile` reads the first source video stream with ffprobe
 and preserves the supported properties that survive the 8-bit BGR boundary:
 `yuv420p`/`yuv422p`/`yuv444p` chroma sampling, recognized color tags, encoder
@@ -196,9 +201,10 @@ space, applies one seeded spatial-noise field across the entire sequence, and
 decodes fresh pixels. Reusing a single noise field avoids independent
 frame-to-frame noise. The shipped path retains only one configured frame batch,
 updates PSNR and temporal residuals incrementally, and streams BGR frames
-directly to ffmpeg. ffmpeg encodes H.264 video, maps optional source audio, and
-drops all source metadata. The result is written through a same-directory
-temporary file and atomically replaced only after a successful encode.
+directly to the video-only ffmpeg encoder. A separate stream-copy mux then adds
+optional source audio and drops all source metadata. The result is written
+through same-directory temporary files and atomically replaced only after both
+stages succeed.
 
 The engine returns PSNR and a motion-compensated temporal-residual ratio as
 quality measurements. Neither is a watermark detector. The high-level result