Update app.py

app.py

@@ -1,22 +1,56 @@
 #!/usr/bin/env python3
-# app.py - Background Remover v32.3.0
+# app.py - Background Remover v32.5.0
 #
-# Changes vs v32.2.6:
-#   • Router rewritten. Priority order is now:
-#       flat image → human → small → complex non-human → fallback
-#     Fixes the "Japanese flag took 25s" bug (was misclassified as
-#     product_white_bg → vehicle_like → birefnet).
-#   • _skin_score vectorized. Router samples 50x50 instead of 10x10,
-#     so partially-occluded faces register correctly.
-#   • /api/process/frames-batch cap raised from 4 to 12.
-#   • _process_frames_sync honors `transparent` — returns RGBA PNG for
-#     client-side compositing instead of black-composited JPEG.
+# Changes in this version:
+#   • All 4 models preloaded and pre-warmed at inference resolution.
+#     No cold-start for birefnet; first request is as fast as the 100th.
+#   • Memory rejection uses process RSS, not cgroup. Cgroup includes
+#     page cache from model downloads (~2-3 GB) which triggered false
+#     503s. RSS is the actual process RAM.
+#   • All 4 preloaded models are protected from eviction. No LRU churn.
+#   • Bulk endpoint builds zip entirely in memory. No /tmp/bulk_* tempdir.
+#   • Alpha cache TTL reduced to 60s with a background purge thread.
+#     Orphaned sessions are cleaned every 15s even if the client never
+#     calls /api/frames/session/reset.
+#   • SpooledTemporaryFile monkey-patched to keep uploads up to 200 MB
+#     in RAM. No >1 MB uploads touching /tmp during parsing.
+#   • Router: flat → u2netp, human → isnet, small → u2netp,
+#     complex → birefnet. Priority order correct.
+#   • /api/debug/tmp endpoint lists any files in /tmp for privacy audit.
+#
+# Privacy contract:
+#   Image uploads: bytes → PIL → result → zip buffer → HTTP response.
+#                  Never touches disk.
+#   Video frames:  same. base64-encoded results streamed back.
+#   Bulk images:   same. In-memory zip, no tempdir.
+#   Alpha cache:   numpy arrays of alpha values, not the image itself.
+#                  TTL 60s, purged every 15s by background thread.
+#   Model weights: /tmp/u2net_models/*.onnx — AI models, not user data.
+
+# ============================================================
+# FORCE IN-MEMORY UPLOAD PARSING (must run before fastapi import)
+# ============================================================
+# Starlette's default UploadFile uses SpooledTemporaryFile with a 1 MB
+# threshold. Uploads over 1 MB spool to /tmp, then are deleted when the
+# request closes. To eliminate that brief disk write, we raise the
+# in-memory ceiling to 200 MB. Uploads are capped at 30 MB (image) and
+# 100 MB (video), so 200 MB is a safe upper bound.
+import starlette.formparsers as _sfp
+_orig_spooled = _sfp.SpooledTemporaryFile
+
+def _in_memory_spool(*args, **kwargs):
+    kwargs['max_size'] = 200 * 1024 * 1024
+    return _orig_spooled(*args, **kwargs)
+
+_sfp.SpooledTemporaryFile = _in_memory_spool
 
+# ============================================================
+# IMPORTS
+# ============================================================
 import io
 import time
 import logging
 import os
-import tempfile
 import asyncio
 import functools
 import sys
@@ -28,6 +62,8 @@ import json
 import uuid
 import base64
 import urllib.parse
+import ctypes
+import resource
 from collections import defaultdict, Counter, deque, OrderedDict
 from datetime import datetime
 from pathlib import Path
@@ -82,54 +118,92 @@ logger = logging.getLogger(__name__)
 
 
 # ============================================================
-# MEMORY
+# MEMORY UTILITIES
 # ============================================================
-def get_container_memory() -> Dict:
+def trim_memory():
+    """Force glibc + PyTorch to release memory back to the OS."""
+    try:
+        import torch
+        if hasattr(torch, 'cuda') and torch.cuda.is_available():
+            torch.cuda.empty_cache()
+    except Exception:
+        pass
+    try:
+        libc = ctypes.CDLL("libc.so.6")
+        libc.malloc_trim(0)
+    except Exception:
+        pass
+
+
+def get_process_rss_mb() -> float:
+    """Real physical RAM used by this Python process (excludes page cache)."""
+    try:
+        return round(resource.getrusage(resource.RUSAGE_SELF).ru_maxrss / 1024, 1)
+    except Exception:
+        return 0.0
+
+
+def get_container_limit_mb() -> int:
+    """Container memory limit in MB. 0 if unknown."""
     try:
         if os.path.exists('/sys/fs/cgroup/memory.max'):
             with open('/sys/fs/cgroup/memory.max') as f:
                 limit_str = f.read().strip()
-            with open('/sys/fs/cgroup/memory.current') as f:
-                current = int(f.read().strip())
             if limit_str != 'max':
-                limit = int(limit_str)
-                if limit > 0:
-                    return {
-                        'total_mb': limit // 1024 // 1024,
-                        'used_mb': current // 1024 // 1024,
-                        'available_mb': (limit - current) // 1024 // 1024,
-                        'percent': (current / limit) * 100,
-                        'source': 'cgroup-v2',
-                    }
-    except Exception:
-        pass
-    try:
+                return int(limit_str) // 1024 // 1024
         if os.path.exists('/sys/fs/cgroup/memory/memory.limit_in_bytes'):
             with open('/sys/fs/cgroup/memory/memory.limit_in_bytes') as f:
                 limit = int(f.read().strip())
-            with open('/sys/fs/cgroup/memory/memory.usage_in_bytes') as f:
-                current = int(f.read().strip())
             if 0 < limit < (1 << 60):
-                return {
-                    'total_mb': limit // 1024 // 1024,
-                    'used_mb': current // 1024 // 1024,
-                    'available_mb': (limit - current) // 1024 // 1024,
-                    'percent': (current / limit) * 100,
-                    'source': 'cgroup-v1',
-                }
+                return limit // 1024 // 1024
     except Exception:
         pass
     try:
-        m = psutil.virtual_memory()
-        return {'total_mb': m.total // 1024 // 1024,
-                'used_mb': m.used // 1024 // 1024,
-                'available_mb': m.available // 1024 // 1024,
-                'percent': m.percent, 'source': 'psutil-host'}
+        return psutil.virtual_memory().total // 1024 // 1024
     except Exception:
-        return {'total_mb': 0, 'used_mb': 0, 'available_mb': 0,
-                'percent': 0, 'source': 'unknown'}
+        return 0
 
 
+def get_container_memory() -> Dict:
+    """Full memory report: cgroup + RSS + limit."""
+    limit_mb = get_container_limit_mb()
+    rss_mb = get_process_rss_mb()
+
+    cgroup_used = 0
+    cgroup_source = 'unknown'
+    try:
+        if os.path.exists('/sys/fs/cgroup/memory.current'):
+            with open('/sys/fs/cgroup/memory.current') as f:
+                cgroup_used = int(f.read().strip()) // 1024 // 1024
+            cgroup_source = 'cgroup-v2'
+        elif os.path.exists('/sys/fs/cgroup/memory/memory.usage_in_bytes'):
+            with open('/sys/fs/cgroup/memory/memory.usage_in_bytes') as f:
+                cgroup_used = int(f.read().strip()) // 1024 // 1024
+            cgroup_source = 'cgroup-v1'
+        else:
+            m = psutil.virtual_memory()
+            cgroup_used = m.used // 1024 // 1024
+            cgroup_source = 'psutil-host'
+    except Exception:
+        pass
+
+    rss_percent = (rss_mb / limit_mb * 100) if limit_mb > 0 else 0
+    cgroup_percent = (cgroup_used / limit_mb * 100) if limit_mb > 0 else 0
+
+    return {
+        'total_mb': limit_mb,
+        'used_mb': cgroup_used,
+        'available_mb': max(0, limit_mb - cgroup_used),
+        'percent': cgroup_percent,
+        'process_rss_mb': rss_mb,
+        'rss_percent': rss_percent,
+        'source': cgroup_source,
+    }
+
+
+# ============================================================
+# CORE CLASSES
+# ============================================================
 class ResolutionManager:
     RECOMMENDED = {
         'simple_graphic': 600, 'human_hair': 1024, 'human': 1024,
@@ -144,62 +218,73 @@ class ResolutionManager:
 
 
 class ModelManager:
-    def __init__(self, max_models: int = 3, memory_limit_mb: int = 8000):
+    def __init__(self, max_models: int = 4):
         self.models: Dict[str, Any] = {}
         self.load_times: Dict[str, float] = {}
+        self.warmed: Dict[str, bool] = {}
         self.use_counts: Dict[str, int] = {}
         self.max_models = max_models
-        self.memory_limit_mb = memory_limit_mb
+        self.protected = {'silueta', 'u2netp', 'isnet-general-use', 'birefnet-general-lite'}
 
     def get_model(self, name, loader_func):
         if name in self.models:
             self.use_counts[name] = self.use_counts.get(name, 0) + 1
             return self.models[name]
-        try:
-            mem = get_container_memory()
-            if 'cgroup' in mem.get('source', '') and mem['percent'] > 82:
-                logger.warning(f"Container RAM {mem['percent']:.1f}%. Evicting.")
-                self._evict_models()
-                gc.collect()
-        except Exception:
-            pass
+
+        if len(self.models) >= self.max_models:
+            self._evict_one()
+
         start = time.time()
         try:
             session = loader_func(name)
             if session is None:
                 return None
             self.models[name] = session
+            self.warmed[name] = False
             self.load_times[name] = time.time() - start
             self.use_counts[name] = 1
             gc.collect()
-            try:
-                mem = get_container_memory()
-                logger.info(f"After {name}: {mem['used_mb']}MB "
-                            f"({mem['percent']:.1f}% of {mem['total_mb']}MB)")
-            except Exception:
-                pass
-            if len(self.models) > self.max_models:
-                self._evict_models()
+            trim_memory()
+            mem = get_container_memory()
+            logger.info(
+                f"Loaded {name} in {self.load_times[name]:.1f}s. "
+                f"RSS {mem['process_rss_mb']}MB ({mem['rss_percent']:.1f}%)"
+            )
             return session
         except Exception as e:
             logger.warning(f"Loader failed for {name}: {e}")
             gc.collect()
             return None
 
-    def _evict_models(self):
-        if len(self.models) <= 1:
+    def _evict_one(self):
+        """Evict LRU non-protected model. Falls back to protected if needed."""
+        candidates = [k for k in self.models.keys() if k not in self.protected]
+        if not candidates:
+            candidates = [k for k in self.models.keys() if k != 'silueta']
+            logger.warning(f"No non-protected models. Evicting from protected: {candidates}")
+        if not candidates:
+            logger.warning("Cannot evict — silueta is the only model left")
             return
-        to_remove = min(self.models.keys(), key=lambda x: self.use_counts.get(x, 0))
-        logger.info(f"Evicting LRU: {to_remove}")
+        to_remove = min(candidates, key=lambda x: self.use_counts.get(x, 0))
+        logger.info(f"Evicting {to_remove} (use_count={self.use_counts.get(to_remove, 0)})")
         del self.models[to_remove]
         self.use_counts.pop(to_remove, None)
+        self.warmed.pop(to_remove, None)
         gc.collect()
+        trim_memory()
+
+    def mark_warmed(self, name):
+        self.warmed[name] = True
 
     def get_stats(self):
-        return {'loaded_models': list(self.models.keys()),
-                'model_count': len(self.models),
-                'use_counts': self.use_counts,
-                'load_times': self.load_times}
+        return {
+            'loaded_models': list(self.models.keys()),
+            'model_count': len(self.models),
+            'use_counts': self.use_counts,
+            'load_times': self.load_times,
+            'warmed': dict(self.warmed),
+            'protected': list(self.protected),
+        }
 
 
 class MaskQualityChecker:
@@ -424,8 +509,9 @@ class ContentClassifier:
         return 'complex'
 
 
-logger.info("RLIMIT_AS not set — relying on cgroup memory.max")
-
+# ============================================================
+# ENVIRONMENT
+# ============================================================
 os.environ["U2NET_HOME"] = "/tmp/u2net_models"
 os.environ["OMP_NUM_THREADS"] = "2"
 os.environ["CUDA_VISIBLE_DEVICES"] = ""
@@ -433,26 +519,27 @@ os.environ["TF_CPP_MIN_LOG_LEVEL"] = "2"
 os.environ["PYTHONUNBUFFERED"] = "1"
 socket.setdefaulttimeout(60)
 
-for d in ["/tmp/u2net_models", "/tmp/uploads", "/tmp/outputs", "/tmp/frames"]:
+for d in ["/tmp/u2net_models"]:
     os.makedirs(d, exist_ok=True)
 
 cpu_executor = ThreadPoolExecutor(max_workers=2)
 
 content_classifier = ContentClassifier()
 resolution_manager = ResolutionManager()
-model_manager = ModelManager(max_models=3, memory_limit_mb=8000)
+model_manager = ModelManager(max_models=4)
 mask_checker = MaskQualityChecker()
 hair_refiner = HairRefiner()
 graphic_processor = GraphicProcessor()
 
 
 # ============================================================
-# TEMPORAL ALPHA SMOOTHING
+# ALPHA CACHE — video temporal smoothing
 # ============================================================
 ALPHA_SMOOTH_WEIGHT = 0.35
 ALPHA_CACHE_MAX_SESSIONS = 8
-ALPHA_CACHE_TTL_SECONDS = 300
+ALPHA_CACHE_TTL_SECONDS = 60          # was 300. 60s covers batch gaps.
 ALPHA_CACHE_MAX_DIM = 1280
+ALPHA_PURGE_INTERVAL = 15
 
 _alpha_cache: "OrderedDict[str, tuple]" = OrderedDict()
 _alpha_cache_lock = threading.Lock()
@@ -509,34 +596,73 @@ def _alpha_cache_stats() -> Dict:
         }
 
 
+def _purge_expired_sessions() -> int:
+    """Remove cache entries past their TTL. Called by background thread."""
+    now = time.time()
+    with _alpha_cache_lock:
+        expired = [
+            sid for sid, (_, ts) in _alpha_cache.items()
+            if now - ts > ALPHA_CACHE_TTL_SECONDS
+        ]
+        for sid in expired:
+            _alpha_cache.pop(sid, None)
+    return len(expired)
+
+
+def _start_cache_purge_thread():
+    """Background thread: even if the client crashes without calling
+    /api/frames/session/reset, expired entries get cleaned."""
+    def _loop():
+        while True:
+            time.sleep(ALPHA_PURGE_INTERVAL)
+            try:
+                purged = _purge_expired_sessions()
+                if purged:
+                    logger.info(f"[alpha-cache] purged {purged} expired sessions")
+            except Exception as e:
+                logger.warning(f"[alpha-cache] purge failed: {e}")
+
+    t = threading.Thread(target=_loop, daemon=True, name="alpha-cache-purge")
+    t.start()
+    return t
+
+
 # ============================================================
-# VIDEO FRAME SERIALIZATION
+# VIDEO CONFIG
 # ============================================================
 _video_semaphore = threading.Semaphore(1)
-VIDEO_RAM_REJECT_PERCENT = 75.0
+VIDEO_RAM_REJECT_PERCENT = 90.0   # uses process RSS, not cgroup
 VIDEO_MAX_BATCH = 12
-
 VIDEO_FORCE_MODEL = os.environ.get('VIDEO_FORCE_MODEL', 'silueta')
 BIREFNET_MAX_DIM = 512
 
 
 # ============================================================
-# MODEL CONFIG
+# MODEL CONFIG — 4 models, all preloaded
 # ============================================================
 PRELOAD_MODELS = [
-    ("u2netp",                "~4.7 MB disk / ~180 MB RAM"),
-    ("silueta",               "~43 MB disk / ~200 MB RAM"),
-    ("birefnet-general-lite", "~12 MB disk / ~250 MB RAM"),
+    ("silueta",               "~400 MB — video only"),
+    ("u2netp",                "~300 MB — easy/flat"),
+    ("isnet-general-use",     "~800 MB — human subjects"),
+    ("birefnet-general-lite", "~2 GB — complex non-human"),
 ]
 
+# Warmup resolution per model. Matches inference res so buffers are
+# correctly sized on first real request.
+WARMUP_RESOLUTIONS = {
+    'silueta':               (640, 640),
+    'u2netp':                (512, 512),
+    'isnet-general-use':     (640, 640),
+    'birefnet-general-lite': (512, 512),
+}
+
 LAZY_MODELS = {
-    "isnet-general-use": "~176 MB disk / ~800 MB RAM",
-    "u2net":             "~176 MB disk / ~800 MB RAM",
-    "u2net_human_seg":   "~176 MB disk / ~800 MB RAM",
-    "isnet-anime":       "~176 MB disk / ~800 MB RAM",
-    "birefnet-general":  "~900 MB disk / ~2.5 GB RAM",
-    "u2net_cloth_seg":   "~176 MB disk / ~800 MB RAM",
-    "sam":               "~375 MB disk / ~1 GB RAM",
+    "u2net":            "~176 MB disk / ~800 MB RAM",
+    "u2net_human_seg":  "~176 MB disk / ~800 MB RAM",
+    "isnet-anime":      "~176 MB disk / ~800 MB RAM",
+    "birefnet-general": "~900 MB disk / ~2.5 GB RAM",
+    "u2net_cloth_seg":  "~176 MB disk / ~800 MB RAM",
+    "sam":              "~375 MB disk / ~1 GB RAM",
 }
 
 VALID_REMBG_MODELS = {
@@ -591,7 +717,7 @@ VEHICLE_RES_CAP = BIREFNET_MAX_DIM
 FRAME_MAX_DIM = 640
 
 CLASSICAL_PROCESSORS = {'flood_fill', 'graphic_classical'}
-DEFAULT_MODEL_NAME = 'isnet-general-use'
+DEFAULT_MODEL_NAME = 'u2netp'
 DEFAULT_VIDEO_MODEL = VIDEO_FORCE_MODEL
 
 DISPLAY_NAMES = {
@@ -614,10 +740,8 @@ def _load_session(name: str):
     from rembg import new_session
     resolved = MODEL_ALIASES.get(name, name)
     if resolved not in VALID_REMBG_MODELS:
-        logger.warning(f"'{resolved}' not valid. Using isnet-general-use.")
-        resolved = 'isnet-general-use'
-    if resolved != name:
-        logger.info(f"Alias: {name} -> {resolved}")
+        logger.warning(f"'{resolved}' not valid. Using u2netp.")
+        resolved = 'u2netp'
     logger.info(f"Loading {resolved}...")
     return new_session(resolved)
 
@@ -815,17 +939,24 @@ except ImportError as e:
     logger.warning(f"pymatting not available: {e}")
 
 
-def pre_download_models():
+def preload_all_models():
     logger.info(f"Preloading {len(PRELOAD_MODELS)} models...")
-    for name, size in PRELOAD_MODELS:
+    for name, desc in PRELOAD_MODELS:
         try:
-            logger.info(f"  Downloading {name} ({size})...")
+            logger.info(f"  {name} ({desc})")
+            t0 = time.time()
             session = model_manager.get_model(name, _load_session)
             if session is not None:
-                logger.info(f"  {name} ready")
+                logger.info(f"  {name} ready in {time.time() - t0:.1f}s")
+            else:
+                logger.warning(f"  {name} failed")
         except Exception as e:
             logger.warning(f"  {name}: {e}")
-    logger.info("Preload complete")
+    mem = get_container_memory()
+    logger.info(
+        f"Preload done. {len(model_manager.models)} models. "
+        f"RSS {mem['process_rss_mb']}MB ({mem['rss_percent']:.1f}%)"
+    )
 
 
 def initialize_models():
@@ -835,70 +966,97 @@ def initialize_models():
             from rembg import remove
             remove_func = remove
             loaded = model_manager.get_stats().get("loaded_models", [])
-            if DEFAULT_MODEL_NAME in loaded:
-                default_model_name = DEFAULT_MODEL_NAME
-            else:
-                for m in ('isnet-general-use', 'silueta', 'birefnet-general-lite', 'u2netp'):
-                    if m in loaded:
-                        default_model_name = m
-                        break
-                else:
-                    default_model_name = loaded[0] if loaded else 'u2netp'
+            if 'u2netp' in loaded:
+                default_model_name = 'u2netp'
+            elif loaded:
+                default_model_name = loaded[0]
             AI_AVAILABLE = len(loaded) > 0
             if AI_AVAILABLE:
-                logger.info(f"AI ready with {len(loaded)} models")
+                logger.info(f"AI ready with {len(loaded)} models: {loaded}")
         except Exception as e:
             logger.error(f"AI setup failed: {e}")
             AI_AVAILABLE = False
 
 
 def _prewarm_models():
+    """Warm each loaded model with a dummy inference at inference res.
+    This sizes ONNX Runtime's internal buffers so the first real request
+    doesn't pay cold-start penalty. Especially important for birefnet."""
     global remove_func
     if remove_func is None:
+        logger.warning("Cannot pre-warm: remove_func not available")
         return
-    logger.info("Pre-warming sessions...")
-    try:
-        test_img = Image.new('RGB', (64, 64), (255, 255, 255))
-        ImageDraw.Draw(test_img).rectangle([20, 20, 44, 44], fill=(220, 40, 40))
-        WARMUP_SKIP = {'birefnet-general-lite'}
-        for name, _ in PRELOAD_MODELS:
-            if name in WARMUP_SKIP:
-                logger.info(f"  {name} skipped (heavy warmup)")
-                continue
-            session = model_manager.models.get(name)
-            if session is None:
+
+    logger.info("Pre-warming all models...")
+
+    for name, _desc in PRELOAD_MODELS:
+        session = model_manager.models.get(name)
+        if session is None:
+            logger.warning(f"  {name}: not loaded, skip warmup")
+            continue
+
+        size = WARMUP_RESOLUTIONS.get(name, (512, 512))
+
+        try:
+            img = Image.new('RGB', size, (245, 245, 245))
+            draw = ImageDraw.Draw(img)
+            mx, my = size[0] // 4, size[1] // 4
+            draw.ellipse([mx, my, size[0] - mx, size[1] - my], fill=(180, 60, 60))
+
+            t0 = time.time()
+            result = remove_func(img, session=session, alpha_matting=False)
+            elapsed = time.time() - t0
+
+            if result is None:
+                logger.warning(f"  {name}: warmup returned None")
                 continue
-            try:
-                t0 = time.time()
-                result = remove_func(test_img, session=session, alpha_matting=False)
-                dt = time.time() - t0
-                if result.mode != 'RGBA':
-                    result = result.convert('RGBA')
-                arr = np.array(result)
-                cy, cx = arr.shape[0] // 2, arr.shape[1] // 2
-                ca = int(arr[cy, cx, 3]); corner = int(arr[2, 2, 3])
-                if ca > 200 and corner < 50:
-                    logger.info(f"  {name} OK ({dt:.2f}s)")
-                else:
-                    logger.warning(f"  {name} WRONG (center={ca} corner={corner})")
-            except Exception as e:
-                logger.warning(f"  {name}: {type(e).__name__}: {e}")
+            if result.mode != 'RGBA':
+                result = result.convert('RGBA')
+
+            arr = np.array(result)
+            alpha = arr[:, :, 3]
+            min_a, max_a = int(alpha.min()), int(alpha.max())
+
+            if min_a < 100 and max_a > 150:
+                model_manager.mark_warmed(name)
+                logger.info(f"  {name}: warm ({elapsed:.2f}s @ {size[0]}×{size[1]})")
+            else:
+                logger.warning(f"  {name}: warm but odd (alpha {min_a}-{max_a})")
+
+            del result, arr, alpha
+        except Exception as e:
+            logger.warning(f"  {name}: warmup failed — {type(e).__name__}: {e}")
+
         gc.collect()
-    except Exception as e:
-        logger.warning(f"Pre-warm skipped: {e}")
+        trim_memory()
+
+    mem = get_container_memory()
+    warmed = sum(1 for w in model_manager.warmed.values() if w)
+    logger.info(
+        f"Warmup done: {warmed}/{len(PRELOAD_MODELS)} warm. "
+        f"RSS {mem['process_rss_mb']}MB ({mem['rss_percent']:.1f}%)"
+    )
 
 
 logger.info("=" * 60)
-logger.info("Background Remover v32.3.0")
+logger.info("Background Remover v32.5.0")
+logger.info("4 models preloaded and pre-warmed")
 logger.info("=" * 60)
-pre_download_models()
+
+preload_all_models()
 initialize_models()
 _prewarm_models()
+_start_cache_purge_thread()
+
 mem = get_container_memory()
 logger.info(f"AI: {AI_AVAILABLE} | Default: {default_model_name}")
-logger.info(f"RAM: {mem['used_mb']}MB / {mem['total_mb']}MB ({mem['percent']:.1f}%)")
-logger.info(f"Video: FORCE_MODEL={VIDEO_FORCE_MODEL}, MAX_BATCH={VIDEO_MAX_BATCH}")
-logger.info(f"Video: serialized (1 concurrent), RAM reject at {VIDEO_RAM_REJECT_PERCENT}%")
+logger.info(
+    f"RSS: {mem['process_rss_mb']}MB / {mem['total_mb']}MB "
+    f"({mem['rss_percent']:.1f}%)"
+)
+logger.info(f"Video: FORCE={VIDEO_FORCE_MODEL}, MAX_BATCH={VIDEO_MAX_BATCH}")
+logger.info(f"Video RAM reject: {VIDEO_RAM_REJECT_PERCENT}% (process RSS)")
+logger.info(f"Alpha cache: TTL {ALPHA_CACHE_TTL_SECONDS}s, purge every {ALPHA_PURGE_INTERVAL}s")
 logger.info("=" * 60)
 
 
@@ -912,10 +1070,11 @@ def get_session_for_model(model_name):
         if session is None:
             return None
         model_manager.models[resolved] = session
+        model_manager.warmed[resolved] = False
         model_manager.use_counts[resolved] = 1
         model_manager.load_times[resolved] = 0.0
         if len(model_manager.models) > model_manager.max_models:
-            model_manager._evict_models()
+            model_manager._evict_one()
         return session
     except Exception as e:
         logger.error(f"Lazy-load failed for {resolved}: {e}")
@@ -923,16 +1082,9 @@ def get_session_for_model(model_name):
 
 
 # ============================================================
-# ROUTER — CLEAN PRIORITY ORDER
+# ROUTER — flat → u2netp, human → isnet, small → u2netp,
+#          complex → birefnet
 # ============================================================
-def _preferred_quality_model():
-    loaded = model_manager.get_stats().get('loaded_models', [])
-    for m in ('isnet-general-use', 'silueta', 'birefnet-general-lite', 'u2netp'):
-        if m in loaded:
-            return m
-    return 'u2netp'
-
-
 def detect_hair_complexity(image):
     try:
         gray = image.convert('L').resize((100, 100), Image.Resampling.LANCZOS)
@@ -953,7 +1105,6 @@ def detect_hair_complexity(image):
 
 
 def _skin_score(rgb):
-    """Fraction of pixels that look like skin. Vectorized."""
     if rgb is None or rgb.size == 0:
         return 0.0
     r = rgb[:, :, 0].astype(np.int32)
@@ -969,110 +1120,83 @@ def _skin_score(rgb):
 
 
 def analyze_image_complexity(image):
-    """Route an image to the best processor for its content type.
-
-    Priority order is strict and unambiguous:
-      1. FLAT IMAGE (flag, logo, product on white, screenshot)
-         → flood_fill (classical, ~50ms, no model needed)
-      2. HUMAN → quality model (isnet for hair detail)
-      3. SMALL IMAGE (<400px) → u2netp (quality gains nothing)
-      4. COMPLEX NON-HUMAN → birefnet-general-lite (detail preservation)
-      5. FALLBACK → u2netp
-
-    The bug this fixes: a Japanese flag was being classified as
-    product_white_bg, then matched the 'vehicle_like' tuple, then
-    routed to birefnet (25s). It should be flood_fill (50ms).
-    The fix is: check for flat images FIRST, before anything else.
+    """Priority router.
+    TIER 0 flat    → u2netp
+    TIER 1 human   → isnet-general-use
+    TIER 2 small   → u2netp
+    TIER 3 complex → birefnet-general-lite
+    TIER 4 fallback → u2netp
     """
     try:
         cc = content_classifier.classify(image)
-        cc_cat = cc.get('category', 'general_photo')
         sig = cc.get('signals', {}) or {}
+        cc_cat = cc.get('category', 'general_photo')
         cc_color = float(sig.get('color_complexity', 0.5))
         cc_border = float(sig.get('border_uniformity', 0))
         cc_edge = float(sig.get('edge_density', 0))
         cc_skin = float(sig.get('skin_score', 0))
         cc_texture = float(sig.get('texture', 0))
 
-        loaded = model_manager.get_stats().get('loaded_models', [])
-        has_birefnet = 'birefnet-general-lite' in loaded
-        has_silueta = 'silueta' in loaded
-        has_isnet = 'isnet-general-use' in loaded
-
-        quality = ('isnet-general-use' if has_isnet else
-                   'silueta' if has_silueta else
-                   'birefnet-general-lite' if has_birefnet else
-                   'u2netp')
-
         def _route(proc, cat, strat, reason, extra=None):
             r = {
-                'processor': proc,
-                'model': proc,
-                'model_id': proc,
-                'category': cat,
-                'strategy': strat,
-                'reason': reason,
-                'score': 0,
-                'is_human': False,
-                'is_graphic': cat in ('simple_graphic', 'logo_icon', 'product_white_bg'),
+                'processor': proc, 'model': proc, 'model_id': proc,
+                'category': cat, 'strategy': strat, 'reason': reason,
+                'score': 0, 'is_human': False,
+                'is_graphic': cat in ('flat', 'simple_graphic', 'logo_icon'),
                 'hair_complexity': {'route': 'simple_hair'},
-                'cc_category': cc_cat,
-                'cc_confidence': 0.7,
+                'cc_category': cc_cat, 'cc_confidence': 0.7,
             }
             if extra:
                 r.update(extra)
             return r
 
-        # ── TIER 0: FLAT IMAGE → flood_fill ──
-        # The tell is a uniform border + low color complexity + no skin.
-        # A flag has all three. A product on white has all three. A logo
-        # has all three. None of them need a neural network.
+        # TIER 0: flat → u2netp
         is_flat = (
             cc_skin < 0.05
-            and cc_color < 0.4
             and (
-                cc_border > 0.7
+                cc_color < 0.15
                 or cc_cat in ('simple_graphic', 'logo_icon')
-                or (cc_color < 0.15 and cc_edge < 0.25)
+                or (cc_color < 0.3 and cc_border > 0.7)
             )
         )
         if is_flat:
-            cat = cc_cat if cc_cat in ('simple_graphic', 'logo_icon', 'product_white_bg') else 'simple_graphic'
-            return _route('flood_fill', cat, 'classical',
-                          f'flat (color={cc_color:.2f}, border={cc_border:.2f}, '
-                          f'edge={cc_edge:.2f}, cat={cc_cat})')
-
-        # ── TIER 1: HUMAN → quality model ──
-        is_human = cc_skin > 0.05 or cc_cat in ('human', 'human_hair')
-        if is_human:
+            return _route(
+                'u2netp', 'flat', 'neural',
+                f'flat (color={cc_color:.2f}, border={cc_border:.2f}, cat={cc_cat})'
+            )
+
+        # TIER 1: human → isnet
+        if cc_skin > 0.05 or cc_cat in ('human', 'human_hair'):
             hc = detect_hair_complexity(image)
-            if hc['route'] in ('wispy_hair', 'complex_hair'):
-                return _route(quality, 'human_hair', 'neural',
-                              f'human + {hc["route"]}',
-                              {'is_human': True, 'hair_complexity': hc})
-            return _route(quality, 'human', 'neural', 'human',
-                          {'is_human': True, 'hair_complexity': hc})
-
-        # ── TIER 2: SMALL IMAGE → u2netp ──
+            return _route(
+                'isnet-general-use',
+                'human_hair' if hc['route'] != 'simple_hair' else 'human',
+                'neural',
+                f'human (skin={cc_skin:.2f}, hair={hc["route"]})',
+                {'is_human': True, 'hair_complexity': hc}
+            )
+
+        # TIER 2: small → u2netp
         if max(image.size) < 400:
-            return _route('u2netp', 'small', 'neural',
-                          f'small image ({max(image.size)}px)')
+            return _route(
+                'u2netp', 'small', 'neural',
+                f'small ({max(image.size)}px)'
+            )
 
-        # ── TIER 3: COMPLEX NON-HUMAN → birefnet ──
-        is_complex = cc_edge > 0.05 or cc_color > 0.35 or cc_texture > 0.5
-        if is_complex and has_birefnet:
-            return _route('birefnet-general-lite', 'complex', 'neural',
-                          f'complex non-human (edge={cc_edge:.2f}, '
-                          f'color={cc_color:.2f}, texture={cc_texture:.2f})')
+        # TIER 3: complex non-human → birefnet
+        if cc_edge > 0.05 or cc_color > 0.35 or cc_texture > 0.5:
+            return _route(
+                'birefnet-general-lite', 'complex', 'neural',
+                f'complex (edge={cc_edge:.2f}, color={cc_color:.2f}, texture={cc_texture:.2f})'
+            )
 
-        # ── TIER 4: FALLBACK → u2netp ──
+        # TIER 4: fallback
         return _route('u2netp', 'general', 'neural', 'fallback to u2netp')
 
     except Exception as e:
         logger.warning(f"Router failed: {e}")
-        m = _preferred_quality_model()
         return {
-            'processor': m, 'model': m, 'model_id': m,
+            'processor': 'u2netp', 'model': 'u2netp', 'model_id': 'u2netp',
             'category': 'error', 'strategy': 'neural',
             'reason': f'router-error: {e}', 'score': 0,
             'is_human': False, 'is_graphic': False,
@@ -1083,7 +1207,7 @@ def analyze_image_complexity(image):
 
 def get_default_model():
     loaded = model_manager.get_stats().get('loaded_models', [])
-    for m in ('isnet-general-use', 'silueta', 'birefnet-general-lite', 'u2netp'):
+    for m in ('u2netp', 'isnet-general-use', 'silueta'):
         if m in loaded:
             return m
     return loaded[0] if loaded else 'u2netp'
@@ -1183,7 +1307,7 @@ def process_image_sync(image_data, model_name=None, transparent=True,
 
         if result is None:
             tried = set()
-            for candidate in [selected, 'birefnet-general-lite', 'silueta', 'isnet-general-use', 'u2netp']:
+            for candidate in [selected, 'u2netp', 'isnet-general-use', 'birefnet-general-lite', 'silueta']:
                 if candidate in tried or candidate in CLASSICAL_PROCESSORS:
                     continue
                 tried.add(candidate)
@@ -1266,13 +1390,13 @@ def process_image_sync(image_data, model_name=None, transparent=True,
 
 
 # ============================================================
-# VIDEO FRAME PIPELINE — honors `transparent`
+# VIDEO FRAMES
 # ============================================================
 def _process_frames_sync(raw_frames, resolved_model, transparent,
                          session_id: Optional[str] = None,
                          smooth: bool = True):
     fallback_chain = [resolved_model]
-    for candidate in ('silueta', 'isnet-general-use', 'u2netp'):
+    for candidate in ('silueta', 'u2netp', 'isnet-general-use'):
         if candidate not in fallback_chain:
             fallback_chain.append(candidate)
 
@@ -1312,12 +1436,10 @@ def _process_frames_sync(raw_frames, resolved_model, transparent,
                 max_a = int(alpha.max())
 
                 if max_a < 10:
-                    logger.warning(f"[frames-batch] {candidate} blank "
-                                   f"(max_a={max_a}); frame {idx} trying next")
+                    logger.warning(f"[frames-batch] {candidate} blank (frame {idx})")
                     continue
                 if min_a > 245:
-                    logger.warning(f"[frames-batch] {candidate} no-op "
-                                   f"(min_a={min_a}); frame {idx} trying next")
+                    logger.warning(f"[frames-batch] {candidate} no-op (frame {idx})")
                     continue
 
                 result = res
@@ -1351,11 +1473,9 @@ def _process_frames_sync(raw_frames, resolved_model, transparent,
 
             buf = io.BytesIO()
             if transparent:
-                # RGBA PNG. Client composites alpha onto high-res original.
                 result.save(buf, format="PNG", compress_level=3)
                 fmt = "png"
             else:
-                # Legacy flat black composite for old clients.
                 if result.mode == "RGBA":
                     bg = Image.new("RGBA", result.size, (0, 0, 0, 255))
                     result = Image.alpha_composite(bg, result).convert("RGB")
@@ -1383,7 +1503,7 @@ def _process_frames_sync(raw_frames, resolved_model, transparent,
 # ============================================================
 # FASTAPI
 # ============================================================
-app = FastAPI(title="Background Remover", version="32.3.0")
+app = FastAPI(title="Background Remover", version="32.5.0")
 app.add_middleware(CORSMiddleware, allow_origins=["*"], allow_credentials=True,
                    allow_methods=["*"], allow_headers=["*"])
 
@@ -1402,7 +1522,8 @@ def _get_client_ip(request):
 @app.middleware("http")
 async def rate_limit_middleware(request, call_next):
     if request.url.path in ("/api/health", "/", "/docs", "/redoc", "/openapi.json",
-                            "/api/warmup", "/api/debug/env",
+                            "/api/warmup", "/api/debug/env", "/api/debug/memory",
+                            "/api/debug/tmp",
                             "/api/process/frames-batch",
                             "/api/frames/session/reset",
                             "/api/frames/session/stats"):
@@ -1519,55 +1640,47 @@ async def process_bulk_images(
             if resolved in VALID_REMBG_MODELS or resolved in CLASSICAL_PROCESSORS:
                 user_model = resolved
 
-        temp_dir = tempfile.mkdtemp(prefix='bulk_')
-        processed = []
-        scores = []
+        # Build zip entirely in memory. No tempdir. No disk write.
+        zb = io.BytesIO()
         used_names = set()
+        scores = []
+        count = 0
 
-        for f in files:
-            try:
-                c = await f.read()
-                if not c: continue
-                d = process_image_sync(
-                    c, model_name=user_model, transparent=transparent,
-                    max_size=max_size, quality=95,
-                    preserve_hair=preserve_hair,
-                    use_alpha_matting=use_alpha_matting,
-                    border_pixels=border_pixels, sharpen=sharpen,
-                )
-                scores.append(d['quality_score'])
-                stem = Path(f.filename).stem or "image"
-                out_stem = f"{stem}_remova"
-                if out_stem in used_names:
-                    n = 2
-                    while f"{out_stem}_{n}" in used_names: n += 1
-                    out_stem = f"{out_stem}_{n}"
-                used_names.add(out_stem)
-                out_name = f"{out_stem}.{d['extension']}"
-                p = os.path.join(temp_dir, out_name)
-                with open(p, 'wb') as fh:
-                    fh.write(d['data'])
-                processed.append(p)
-            except Exception as e:
-                logger.error(f"Failed {f.filename}: {e}")
-
-        if not processed: raise HTTPException(500, "No images processed")
-
-        zb = io.BytesIO()
         with zipfile.ZipFile(zb, 'w', zipfile.ZIP_DEFLATED) as zf:
-            for p in processed:
-                zf.write(p, os.path.basename(p))
-        zb.seek(0)
-
-        try: shutil.rmtree(temp_dir)
-        except Exception: pass
+            for f in files:
+                try:
+                    c = await f.read()
+                    if not c: continue
+                    d = process_image_sync(
+                        c, model_name=user_model, transparent=transparent,
+                        max_size=max_size, quality=95,
+                        preserve_hair=preserve_hair,
+                        use_alpha_matting=use_alpha_matting,
+                        border_pixels=border_pixels, sharpen=sharpen,
+                    )
+                    scores.append(d['quality_score'])
+                    stem = Path(f.filename).stem or "image"
+                    out_stem = f"{stem}_remova"
+                    if out_stem in used_names:
+                        n = 2
+                        while f"{out_stem}_{n}" in used_names: n += 1
+                        out_stem = f"{out_stem}_{n}"
+                    used_names.add(out_stem)
+                    out_name = f"{out_stem}.{d['extension']}"
+                    zf.writestr(out_name, d['data'])
+                    count += 1
+                except Exception as e:
+                    logger.error(f"Failed {f.filename}: {e}")
+
+        if count == 0: raise HTTPException(500, "No images processed")
 
+        zb.seek(0)
         pt = time.time() - t0
         avg = sum(scores) / len(scores) if scores else 0
         headers = {
             'X-Processing-Time': f'{pt:.3f}',
             'X-Model-Used': 'smart_routing',
-            'X-Image-Count': str(len(processed)),
+            'X-Image-Count': str(count),
             'X-Avg-Quality-Score': f'{avg:.1f}',
             'Content-Disposition': f'attachment; filename=processed_images_{int(time.time())}.zip',
         }
@@ -1579,9 +1692,6 @@ async def process_bulk_images(
         raise HTTPException(500, str(e)[:200])
 
 
-# ============================================================
-# FRAMES BATCH — cap raised to 12, transparent honored
-# ============================================================
 @app.post("/api/process/frames-batch")
 async def process_frames_batch(
     files: List[UploadFile] = File(...),
@@ -1593,21 +1703,20 @@ async def process_frames_batch(
     if len(files) > VIDEO_MAX_BATCH:
         raise HTTPException(400, f"Max {VIDEO_MAX_BATCH} frames per batch")
 
-    resolved = VIDEO_FORCE_MODEL
-
+    # RSS-based check — cgroup includes page cache
     mem = get_container_memory()
-    if 'cgroup' in mem.get('source', '') and mem['percent'] > VIDEO_RAM_REJECT_PERCENT:
+    if mem['rss_percent'] > VIDEO_RAM_REJECT_PERCENT:
         logger.warning(
-            f"[frames-batch] RAM {mem['percent']:.1f}% > "
-            f"{VIDEO_RAM_REJECT_PERCENT}%, rejecting batch"
+            f"[frames-batch] RSS {mem['rss_percent']:.1f}% > "
+            f"{VIDEO_RAM_REJECT_PERCENT}%"
         )
         return JSONResponse(
             status_code=503,
             content={
                 'error': 'Server memory high. Retry shortly.',
-                'ram_percent': round(mem['percent'], 1),
-                'ram_used_mb': mem['used_mb'],
-                'ram_total_mb': mem['total_mb'],
+                'rss_percent': round(mem['rss_percent'], 1),
+                'rss_mb': mem['process_rss_mb'],
+                'container_percent': round(mem['percent'], 1),
                 'retry_in': 10,
                 'cold': True,
             },
@@ -1627,7 +1736,7 @@ async def process_frames_batch(
     def _worker():
         with _video_semaphore:
             return _process_frames_sync(
-                raw_frames, resolved, transparent, session_id, smooth,
+                raw_frames, VIDEO_FORCE_MODEL, transparent, session_id, smooth,
             )
 
     try:
@@ -1637,8 +1746,9 @@ async def process_frames_batch(
         raise HTTPException(500, f"Frame processing failed: {str(e)[:200]}")
     finally:
         gc.collect()
+        trim_memory()
 
-    used = next((r.get("model") for r in results if r.get("model")), resolved)
+    used = next((r.get("model") for r in results if r.get("model")), VIDEO_FORCE_MODEL)
     smoothed_count = sum(1 for r in results if r.get("smoothed"))
     return {
         "frames": results,
@@ -1733,38 +1843,85 @@ async def warmup():
     return {"status": "warm", "ts": datetime.now().isoformat()}
 
 
+@app.get("/api/debug/memory")
+async def debug_memory():
+    mem = get_container_memory()
+    stats = model_manager.get_stats()
+    return {
+        'container': mem,
+        'process_rss_mb': mem['process_rss_mb'],
+        'rss_percent': round(mem['rss_percent'], 1),
+        'models_loaded': stats['loaded_models'],
+        'models_count': stats['model_count'],
+        'models_warmed': stats['warmed'],
+        'use_counts': stats['use_counts'],
+        'protected': stats['protected'],
+        'alpha_cache': _alpha_cache_stats(),
+        'video_reject_pct': VIDEO_RAM_REJECT_PERCENT,
+        'torch_imported': 'torch' in sys.modules,
+    }
+
+
+@app.get("/api/debug/tmp")
+async def debug_tmp():
+    """List files in /tmp for privacy audit. Shows what's on disk.
+    Should show only /tmp/u2net_models/*.onnx after normal use.
+    Remove in production."""
+    items = []
+    try:
+        for root, dirs, files in os.walk('/tmp'):
+            for f in files:
+                p = os.path.join(root, f)
+                try:
+                    items.append({
+                        'path': p,
+                        'size_mb': round(os.path.getsize(p) / 1048576, 2),
+                        'mtime': os.path.getmtime(p),
+                    })
+                except Exception:
+                    pass
+    except Exception:
+        pass
+    return {
+        'count': len(items),
+        'total_mb': round(sum(i['size_mb'] for i in items), 2),
+        'items': sorted(items, key=lambda x: -x['size_mb'])[:50],
+    }
+
+
 @app.get("/api/debug/env")
 async def debug_env():
-    m = get_container_memory()
-    return {'total_mb': m['total_mb'], 'used_mb': m['used_mb'],
-            'available_mb': m['available_mb'],
-            'percent_used': round(m['percent'], 1),
-            'memory_source': m['source'],
-            'models_loaded': list(model_manager.models.keys()),
-            'model_count': len(model_manager.models),
-            'remove_func_ready': remove_func is not None,
-            'ai_available': AI_AVAILABLE,
-            'default_model': default_model_name,
-            'default_video_model': DEFAULT_VIDEO_MODEL,
-            'video_force_model': VIDEO_FORCE_MODEL,
-            'video_ram_reject_percent': VIDEO_RAM_REJECT_PERCENT,
-            'video_max_batch': VIDEO_MAX_BATCH,
-            'preload_models': [n for n, _ in PRELOAD_MODELS],
-            'pad_models': sorted(PAD_MULTIPLE_32_MODELS),
-            'matting_models': sorted(MATTING_MODELS),
-            'vehicle_res_cap': VEHICLE_RES_CAP,
-            'birefnet_max_dim': BIREFNET_MAX_DIM,
-            'frame_max_dim': FRAME_MAX_DIM,
-            'alpha_smoothing': _alpha_cache_stats()}
+    mem = get_container_memory()
+    return {
+        'total_mb': mem['total_mb'],
+        'used_mb': mem['used_mb'],
+        'available_mb': mem['available_mb'],
+        'container_percent': round(mem['percent'], 1),
+        'process_rss_mb': mem['process_rss_mb'],
+        'rss_percent': round(mem['rss_percent'], 1),
+        'memory_source': mem['source'],
+        'models_loaded': list(model_manager.models.keys()),
+        'models_warmed': dict(model_manager.warmed),
+        'remove_func_ready': remove_func is not None,
+        'ai_available': AI_AVAILABLE,
+        'default_model': default_model_name,
+        'video_force_model': VIDEO_FORCE_MODEL,
+        'video_ram_reject_percent': VIDEO_RAM_REJECT_PERCENT,
+        'video_max_batch': VIDEO_MAX_BATCH,
+        'preload_models': [n for n, _ in PRELOAD_MODELS],
+        'lazy_models': sorted(LAZY_MODELS.keys()),
+        'upload_parser': 'in-memory (SpooledTemporaryFile patched to 200MB)',
+    }
 
 
 @app.get("/")
 async def home():
     stats = model_manager.get_stats()
     mem = get_container_memory()
+    warmed = sum(1 for w in stats['warmed'].values() if w)
     return HTMLResponse(f"""
     <!DOCTYPE html><html><head><meta charset="UTF-8">
-    <title>Background Remover v32.3.0</title>
+    <title>Background Remover v32.5.0</title>
     <style>body{{font-family:system-ui;background:#0A0A0A;
     color:#fff;min-height:100vh;display:flex;align-items:center;justify-content:center;
     margin:0;padding:20px}}.c{{max-width:900px;background:#111;
@@ -1772,12 +1929,14 @@ async def home():
     border:1px solid #222}}.s{{padding:15px;border-radius:12px;
     margin:20px 0;background:#1a1a1a}}a{{color:#7ED957}}</style>
     </head><body><div class="c">
-    <h1>Background Remover v32.3.0</h1>
-    <div class="s">AI online. {len(stats['loaded_models'])} models.
-    RAM {mem['percent']:.0f}% ({mem['used_mb']}/{mem['total_mb']}MB)</div>
-    <p>Router: flat→flood_fill · human→isnet · complex→birefnet</p>
-    <p>Video: <strong>{VIDEO_FORCE_MODEL}</strong> · max {VIDEO_MAX_BATCH} frames/batch</p>
-    <p><a href="/docs">API Docs</a></p>
+    <h1>Background Remover v32.5.0</h1>
+    <div class="s">AI online. {len(stats['loaded_models'])} models ({warmed} warmed).
+    RSS {mem['rss_percent']:.0f}% ({mem['process_rss_mb']}/{mem['total_mb']}MB)</div>
+    <p>Router: flat→u2netp · human→isnet · small→u2netp · complex→birefnet</p>
+    <p>Video: silueta · max {VIDEO_MAX_BATCH} frames/batch · reject at {VIDEO_RAM_REJECT_PERCENT}%</p>
+    <p>Cache: alpha TTL {ALPHA_CACHE_TTL_SECONDS}s · purge every {ALPHA_PURGE_INTERVAL}s</p>
+    <p>Privacy: no user data on disk. Bulk in-memory zip. Uploads never touch /tmp.</p>
+    <p><a href="/docs">API Docs</a> · <a href="/api/debug/memory">Memory</a> · <a href="/api/debug/tmp">Disk Audit</a></p>
     </div></body></html>
     """)
 
@@ -1786,32 +1945,46 @@ async def home():
 async def health_check():
     stats = model_manager.get_stats()
     mem = get_container_memory()
+
+    preload_names = [n for n, _ in PRELOAD_MODELS]
+    all_loaded = all(n in stats['loaded_models'] for n in preload_names)
+    all_warmed = all(stats['warmed'].get(n, False) for n in preload_names)
+
+    ram_ok = mem['rss_percent'] < (VIDEO_RAM_REJECT_PERCENT - 5)
+
+    if not AI_AVAILABLE:
+        status = 'error'
+    elif not all_loaded:
+        status = 'degraded'
+    elif not all_warmed:
+        status = 'warming'
+    elif not ram_ok:
+        status = 'degraded'
+    else:
+        status = 'healthy'
+
     return {
-        'status': 'healthy' if AI_AVAILABLE else 'degraded',
+        'status': status,
         'ai_available': AI_AVAILABLE,
         'models_loaded': stats['loaded_models'],
         'models_count': stats['model_count'],
-        'memory_percent': round(mem['percent'], 1),
-        'memory_used_mb': mem['used_mb'],
-        'memory_available_mb': mem['available_mb'],
+        'models_warmed': stats['warmed'],
+        'all_loaded': all_loaded,
+        'all_warmed': all_warmed,
+        'protected_models': stats['protected'],
+        'rss_percent': round(mem['rss_percent'], 1),
+        'rss_mb': mem['process_rss_mb'],
+        'container_percent': round(mem['percent'], 1),
         'memory_total_mb': mem['total_mb'],
         'memory_source': mem['source'],
-        'pymatting_available': PYMATTING_AVAILABLE,
-        'version': '32.3.0',
-        'default_model': get_default_model(),
-        'default_video_model': DEFAULT_VIDEO_MODEL,
-        'video_force_model': VIDEO_FORCE_MODEL,
         'video_ram_reject_percent': VIDEO_RAM_REJECT_PERCENT,
         'video_max_batch': VIDEO_MAX_BATCH,
-        'video_serialized': True,
-        'preload_models': [n for n, _ in PRELOAD_MODELS],
+        'video_force_model': VIDEO_FORCE_MODEL,
+        'version': '32.5.0',
+        'preload_models': preload_names,
         'lazy_models': sorted(LAZY_MODELS.keys()),
-        'matting_models': sorted(MATTING_MODELS),
-        'pad_models': sorted(PAD_MULTIPLE_32_MODELS),
-        'frame_max_dim': FRAME_MAX_DIM,
-        'birefnet_max_dim': BIREFNET_MAX_DIM,
-        'onnx_arena': False,
-        'rlimit_as': None,
+        'alpha_cache_ttl': ALPHA_CACHE_TTL_SECONDS,
+        'alpha_purge_interval': ALPHA_PURGE_INTERVAL,
         'alpha_smoothing': _alpha_cache_stats(),
     }
 
@@ -1832,23 +2005,22 @@ async def gen_exc(request, exc):
 @app.on_event("startup")
 async def startup():
     logger.info("=" * 60)
-    logger.info("v32.3.0 ready")
-    logger.info("Router: flat→flood_fill · human→isnet · complex→birefnet")
-    logger.info(f"Video: FORCE_MODEL={VIDEO_FORCE_MODEL}, MAX_BATCH={VIDEO_MAX_BATCH}")
+    logger.info("v32.5.0 ready")
+    logger.info("Preload: silueta + u2netp + isnet + birefnet (all 4, all warm)")
+    logger.info(f"Video: RSS reject at {VIDEO_RAM_REJECT_PERCENT}%")
+    logger.info(f"Alpha cache: {ALPHA_CACHE_TTL_SECONDS}s TTL, {ALPHA_PURGE_INTERVAL}s purge")
+    logger.info("Privacy: bulk in-memory, uploads in-memory, no disk writes")
     logger.info("=" * 60)
 
 
 @app.on_event("shutdown")
 async def shutdown():
     cpu_executor.shutdown(wait=True)
-    for d in ['/tmp/uploads', '/tmp/outputs', '/tmp/frames']:
-        try:
-            if os.path.exists(d): shutil.rmtree(d)
-        except Exception: pass
 
 
 if __name__ == '__main__':
     import uvicorn
     uvicorn.run('app:app', host='0.0.0.0',
                 port=int(os.environ.get('PORT', 7860)),
-                timeout_keep_alive=300, log_level='info', reload=False)
+                timeout_keep_alive=300, log_level='info', reload=False)
+