Isolate DNS pins per concurrent download

app/services/downloader.py

@@ -23,12 +23,14 @@ class _PinnedNetworkBackend:
     preserving SNI and certificate hostname verification.
     """
 
-    def __init__(self, downloader: "Downloader", fallback: object) -> None:
-        self.downloader = downloader
+    def __init__(self, pinned: dict[tuple[str, int], tuple[str, ...]], fallback: object) -> None:
+        # Per-download mapping prevents concurrent requests from overwriting one
+        # another's validated DNS results for the same hostname.
+        self.pinned = pinned
         self.fallback = fallback
 
     async def connect_tcp(self, host: str, port: int, timeout: float | None = None, local_address: str | None = None, socket_options=None):
-        pinned = self.downloader._pinned.get((host.lower().rstrip("."), port))
+        pinned = self.pinned.get((host.lower().rstrip("."), port))
         targets = pinned if pinned is not None else (host,)
         last_error: Exception | None = None
         for target in targets:
@@ -59,7 +61,6 @@ class Downloader:
     def __init__(self, settings: Settings, validator: MediaValidator) -> None:
         self.settings = settings
         self.validator = validator
-        self._pinned: dict[tuple[str, int], tuple[str, ...]] = {}
 
     async def download(self, url: str, destination_dir: Path, filename: str | None = None) -> tuple[Path, str]:
         current_url = url
@@ -69,9 +70,10 @@ class Downloader:
         # HTTPX 0.28 uses httpcore's network backend for socket creation. The
         # wrapper pins the TCP destination while httpcore retains the URL host
         # for TLS SNI, certificate checks, and the HTTP Host header.
+        pinned: dict[tuple[str, int], tuple[str, ...]] = {}
         try:
             from httpcore._backends.auto import AutoBackend
-            transport._pool._network_backend = _PinnedNetworkBackend(self, AutoBackend())
+            transport._pool._network_backend = _PinnedNetworkBackend(pinned, AutoBackend())
         except (AttributeError, ImportError) as exc:
             raise DownloadError("Secure connection-pinned downloads are unavailable in this runtime") from exc
 
@@ -80,7 +82,7 @@ class Downloader:
             trust_env=False, transport=transport,
         ) as client:
             for _ in range(6):
-                await self.validate_url(current_url)
+                await self.validate_url(current_url, pinned=pinned)
                 destination: Path | None = None
                 try:
                     async with client.stream("GET", current_url, follow_redirects=False) as response: