fix: lock meta RMW and harden concurrent remix paths

Prevent worker/web clobbering of meta variants via flock and merge-by-id,
make filter timeouts thread-local, harden job-id/stem sanitization, migrate
TemplateResponse API, and remove the compare-bg experiment.

Co-authored-by: Cursor <cursoragent@cursor.com>

CLEANUP_REPORT.md

@@ -31,19 +31,21 @@ behavior changes** to the photo pipeline, worker loop, or web UX.
 | Item | Reason |
 |------|--------|
 | `pipeline.py` module split | Medium risk without broader integration tests; deferred |
-| Meta file locking | Behavior change; documented in `ARCHITECTURE.md` |
 | Dependency major bumps | Per plan — list only, no auto-bump |
-| `compare-bg/` | Separate experiment; left untouched |
 | Deploy CI | Manual deploy on boka stays; STANDARDS says ask first |
-| FastAPI `TemplateResponse` API migration | Deprecation warning only; no functional change |
-| `_validate_job_id` always sanitizes to valid ID | Pre-existing; documented in tests |
 
-## Bugs noticed (not fixed)
+## Follow-ups (later branch)
 
-1. **Meta JSON race** — worker and web concurrent RMW without locking.
-2. **`_filter_timeout_override` global** — thread-unsafe under concurrent remix (uvicorn workers).
-3. **`sanitize_stem("a/b")` → `"b"`** — `Path.stem` drops path prefix before slash replacement.
-4. **`_validate_job_id`** — sanitization makes rejection path effectively unreachable.
+Meta locking, timeout thread-local, TemplateResponse migration, stem/validate
+hardening, and removal of `compare-bg/` were done on a subsequent branch
+(`fix/concurrency-and-cleanup`).
+
+## Bugs noticed (historical — fixed later)
+
+1. **Meta JSON race** — fixed with `fcntl.flock` + variant merge-by-id.
+2. **`_filter_timeout_override` global** — fixed with `threading.local`.
+3. **`sanitize_stem("a/b")` → `"b"`** — fixed (separators replaced before `Path.stem`).
+4. **`_validate_job_id`** — rejection path restored for path-like raw IDs.
 
 ## Dependency notes (suggestions only)
 
@@ -84,6 +86,5 @@ docs: update README and add ARCHITECTURE
 
 ## External references
 
-- `compare-bg/` — local venv `.venv-compare/` and 1.5GB model cache (gitignored)
 - `make_random.py` — external reference script, not vendored
 - Submodule/symlink: none