@agent-native/core 0.122.3 → 0.123.0

package/corpus/templates/clips/server/lib/upload-lease.ts

@@ -0,0 +1,241 @@
+/**
+ * The upload lease.
+ *
+ * One authoritative expiry, `recordings.upload_lease_expires_at`, renewed by
+ * the client's own chunk POSTs. Liveness is a fact the writer asserts, not
+ * something a GC infers by joining `recordings` against `application_state`
+ * and comparing timestamps stored in two different encodings.
+ *
+ * Everything below reads from `recordings`, so the reaper sees every
+ * in-progress upload — including buffered uploads that never opened a
+ * resumable session, which the old session-keyed sweep could not select.
+ */
+
+import { getDbExec, isPostgres } from "@agent-native/core/db";
+import { and, eq, inArray, sql } from "drizzle-orm";
+
+import { getDb, schema } from "../db/index.js";
+
+/**
+ * ponytail: one horizon for both in-progress statuses. A paused recorder emits
+ * no chunks and finalize/verification can run for a while, so a shorter lease
+ * would reap live uploads; a longer one leaves a dead upload spinning. Shorten
+ * it only once every client sends an explicit heartbeat.
+ */
+export const UPLOAD_LEASE_MS = 60 * 60 * 1000;
+
+export const UPLOAD_LEASE_EXPIRED_REASON =
+  "Upload stopped sending data before the recording finished saving.";
+
+const IN_PROGRESS_STATUSES = ["uploading", "processing"] as const;
+
+export function uploadLeaseExpiry(nowMs: number = Date.now()): string {
+  return new Date(nowMs + UPLOAD_LEASE_MS).toISOString();
+}
+
+export type UploadLeaseResult =
+  | { held: true }
+  | {
+      held: false;
+      status: string | null;
+      failureReason: string | null;
+      videoUrl: string | null;
+      videoSizeBytes: number | null;
+      durationMs: number | null;
+    };
+
+/**
+ * Take or renew the lease for one recording.
+ *
+ * This is a compare-and-set: `WHERE status IN (...)` is what makes racing a
+ * concurrent abort or finalize structurally impossible. A terminal row updates
+ * zero rows, so a caller never needs to re-check after each write.
+ */
+export async function renewUploadLease(
+  recordingId: string,
+  options: { now?: number; uploadProgress?: number } = {},
+): Promise<UploadLeaseResult> {
+  const now = options.now ?? Date.now();
+  const held = await getDb()
+    .update(schema.recordings)
+    .set({
+      uploadLeaseExpiresAt: uploadLeaseExpiry(now),
+      updatedAt: new Date(now).toISOString(),
+      // Chunks can land out of order, so progress only ever moves forward.
+      ...(options.uploadProgress === undefined
+        ? {}
+        : {
+            uploadProgress: sql`CASE WHEN ${schema.recordings.uploadProgress} > ${options.uploadProgress} THEN ${schema.recordings.uploadProgress} ELSE ${options.uploadProgress} END`,
+          }),
+    })
+    .where(
+      and(
+        eq(schema.recordings.id, recordingId),
+        inArray(schema.recordings.status, [...IN_PROGRESS_STATUSES]),
+      ),
+    )
+    .returning({ id: schema.recordings.id });
+
+  if (held.length > 0) return { held: true };
+
+  // guard:allow-unscoped — by primary key, and every caller resolves the
+  // recording through an owner-scoped read before asking for the lease.
+  const [row] = await getDb()
+    .select({
+      status: schema.recordings.status,
+      failureReason: schema.recordings.failureReason,
+      videoUrl: schema.recordings.videoUrl,
+      videoSizeBytes: schema.recordings.videoSizeBytes,
+      durationMs: schema.recordings.durationMs,
+    })
+    .from(schema.recordings)
+    .where(eq(schema.recordings.id, recordingId));
+
+  return {
+    held: false,
+    status: row?.status ?? null,
+    failureReason: row?.failureReason ?? null,
+    videoUrl: row?.videoUrl ?? null,
+    videoSizeBytes: row?.videoSizeBytes ?? null,
+    durationMs: row?.durationMs ?? null,
+  };
+}
+
+export interface ReapedUpload {
+  id: string;
+  ownerEmail: string;
+  status: string;
+  leaseExpiresAt: string;
+}
+
+export interface ReapResult {
+  dryRun: boolean;
+  expired: ReapedUpload[];
+  failed: number;
+  scratchKeysDeleted: number;
+}
+
+/**
+ * Terminate uploads whose lease expired, then reclaim chunk scratch that no
+ * live upload claims.
+ *
+ * The only liveness input is the lease the writer last wrote, and the only
+ * thing protecting scratch is the existence of an in-progress `recordings`
+ * row. There is no "the recording row was not visible to this probe" branch:
+ * in-progress rows are selected from `recordings` itself, and the scratch
+ * anti-join runs inside the database rather than across two round trips.
+ */
+export async function reapExpiredUploads(
+  options: { now?: number; limit?: number; dryRun?: boolean } = {},
+): Promise<ReapResult> {
+  const exec = getDbExec();
+  const pg = isPostgres();
+  const nowIso = new Date(options.now ?? Date.now()).toISOString();
+  const limit = Math.max(1, Math.min(options.limit ?? 200, 1000));
+  const dryRun = options.dryRun === true;
+  const p = (i: number) => (pg ? `$${i}` : "?");
+
+  // guard:allow-unscoped — system upload reaper, owner-agnostic by design.
+  const probe = await exec.execute({
+    sql: `SELECT id, owner_email, status, upload_lease_expires_at
+          FROM recordings
+          WHERE status IN ('uploading', 'processing')
+            AND upload_lease_expires_at IS NOT NULL
+            AND upload_lease_expires_at < ${p(1)}
+          ORDER BY upload_lease_expires_at ASC
+          LIMIT ${limit}`,
+    args: [nowIso],
+  });
+
+  let expired: ReapedUpload[] = (
+    (probe.rows as Array<Record<string, unknown>>) ?? []
+  ).map((row) => ({
+    id: String(row.id),
+    ownerEmail: String(row.owner_email ?? ""),
+    status: String(row.status ?? ""),
+    leaseExpiresAt: String(row.upload_lease_expires_at ?? ""),
+  }));
+
+  let failed = 0;
+  if (expired.length > 0 && !dryRun) {
+    const ids = expired.map((row) => row.id);
+    const result = await exec.execute({
+      sql: `UPDATE recordings
+            SET status = 'failed',
+                failure_reason = ${p(1)},
+                updated_at = ${p(2)}
+            WHERE status IN ('uploading', 'processing')
+              AND upload_lease_expires_at < ${p(3)}
+              AND id IN (${ids.map((_, i) => p(i + 4)).join(", ")})
+            RETURNING id`,
+      args: [UPLOAD_LEASE_EXPIRED_REASON, nowIso, nowIso, ...ids],
+    });
+
+    // The probe is a snapshot. A lease renewed between it and this
+    // compare-and-set keeps its row, so only what the UPDATE actually claimed
+    // may be reported or have its session state swept — reading the probe
+    // list here would tear down a live streaming upload's session.
+    const terminated = new Set(
+      ((result.rows as Array<{ id?: unknown }>) ?? []).map((row) =>
+        String(row.id),
+      ),
+    );
+    expired = expired.filter((row) => terminated.has(row.id));
+    failed = terminated.size;
+
+    for (const id of terminated) {
+      await exec.execute({
+        sql: `DELETE FROM application_state WHERE key = ${p(1)}`,
+        args: [`resumable-session-${id}`],
+      });
+    }
+  }
+
+  const scratchKeysDeleted = dryRun
+    ? (await selectUnclaimedChunkKeys(limit)).length
+    : await deleteUnclaimedChunkScratch(limit);
+
+  return { dryRun, expired, failed, scratchKeysDeleted };
+}
+
+/**
+ * Chunk scratch is claimed by exactly one thing: an in-progress `recordings`
+ * row. Anything else — finalized, failed, or hard-deleted recordings — is
+ * reclaimable, with no age grace needed, because a stuck upload can only leave
+ * the in-progress set through the reaper above.
+ */
+async function selectUnclaimedChunkKeys(limit: number): Promise<string[]> {
+  // guard:allow-unscoped — system scratch GC, owner-agnostic by design.
+  const { rows } = await getDbExec().execute({
+    sql: `SELECT a.key AS key
+          FROM application_state a
+          WHERE a.key LIKE 'recording-chunks-%'
+            AND NOT EXISTS (
+              SELECT 1 FROM recordings r
+              WHERE r.status IN ('uploading', 'processing')
+                AND a.key LIKE 'recording-chunks-' || r.id || '-%'
+            )
+          LIMIT ${limit}`,
+    args: [],
+  });
+  return ((rows as Array<{ key?: unknown }>) ?? []).map((row) =>
+    String(row.key),
+  );
+}
+
+async function deleteUnclaimedChunkScratch(limit: number): Promise<number> {
+  const keys = await selectUnclaimedChunkKeys(limit);
+  if (keys.length === 0) return 0;
+  const pg = isPostgres();
+  const placeholders = keys.map((_, i) => (pg ? `$${i + 1}` : "?")).join(", ");
+  const result = await getDbExec().execute({
+    sql: `DELETE FROM application_state WHERE key IN (${placeholders})`,
+    args: keys,
+  });
+  if (typeof result.rowsAffected !== "number") {
+    throw new Error(
+      "Upload scratch cleanup did not report rowsAffected; refusing to claim deletion succeeded",
+    );
+  }
+  return result.rowsAffected;
+}

package/corpus/templates/clips/server/plugins/agent-chat.ts

@@ -41,6 +41,10 @@ export default createAgentChatPlugin({
   appId: "clips",
   actions: loadActionsFromStaticRegistry(actionsRegistry),
   initialToolNames: INITIAL_TOOL_NAMES,
+  // Declared in source rather than left to AGENT_CHAT_DURABLE_BACKGROUND alone:
+  // a site-level env var silently overrides netlify.toml, which is how plan and
+  // brain each spent their whole lifetime pinned to the ~58s synchronous wall.
+  durableBackgroundRuns: true,
   extraContext: async () =>
     `<clips-transcript-guidance>
 The transcript in view-screen and get-recording-player-data are bounded previews when called by the agent. When previewTruncated is true, the text is expected to end mid-sentence and is never evidence that transcription stopped early. Use the bounded payload for a concise summary and do not request or reconstruct the omitted transcript by searching other recordings. For a failed or pending transcript, use request-transcript with force=true. For an explicit fresh retry of an existing ready transcript, also pass regenerate=true. Agent-triggered retries are queued for the durable worker and return pending while processing.

package/corpus/templates/clips/server/plugins/db.ts

@@ -14,6 +14,7 @@ import { z } from "zod";
 // the registration eagerly from the always-loaded db plugin.
 import "../db/index.js";
 import * as schema from "../db/schema.js";
+import { uploadLeaseExpiry } from "../lib/upload-lease.js";
 
 /**
  * Every Drizzle table exported from schema.ts. Filters out type-only and
@@ -881,6 +882,23 @@ const migrations = runMigrations(
         `ALTER TABLE recordings ADD COLUMN IF NOT EXISTS loom_import_claimed_at TEXT`,
       ].join("; "),
     },
+    {
+      version: 53,
+      name: "recording-upload-lease",
+      // Grant every pre-lease in-progress recording one full lease horizon so
+      // the reaper can reach rows the old session-keyed sweeps could never
+      // select. Backfilling `updated_at` instead would hand a live upload an
+      // already-expired lease and reap it before its next chunk lands, so
+      // pre-lease rows get the same horizon any other row gets. Long-stranded
+      // rows are terminated one horizon after this runs.
+      // Idempotent: the UPDATE only touches NULL leases.
+      // guard:allow-unscoped — startup migration backfills every owner's rows.
+      sql: [
+        `ALTER TABLE recordings ADD COLUMN IF NOT EXISTS upload_lease_expires_at TEXT`,
+        `CREATE INDEX IF NOT EXISTS recordings_upload_lease_idx ON recordings (status, upload_lease_expires_at)`,
+        `UPDATE recordings SET upload_lease_expires_at = '${uploadLeaseExpiry()}' WHERE upload_lease_expires_at IS NULL AND status IN ('uploading', 'processing')`,
+      ].join("; "),
+    },
   ],
   { table: "clips_migrations" },
 );
@@ -1165,342 +1183,6 @@ async function syncWorkspacesToOrganizations(): Promise<void> {
   }
 }
 
-/**
- * Sweep orphaned recording-chunk scratch rows out of `application_state`.
- *
- * Why: `/api/uploads/:id/chunk` base64-encodes each MediaRecorder chunk and
- * stores it in `application_state` keyed `recording-chunks-<recordingId>-<idx>`.
- * `finalize-recording` is responsible for deleting those rows after assembling
- * the final blob — but before this sweep existed, a finalize that threw
- * mid-way (uploadFile failure, DB hiccup, dev-server restart between chunk
- * arrival and finalize) left every chunk in place forever. Each chunk is ~1 MB
- * of base64; a 30-minute recording is ~1.5 GB of orphaned scratch space, and
- * those rows are resident in memory as soon as the server fetches them. This
- * was the server-side half of the 70 GB memory leak Steve reported.
- *
- * Safe rules: we only delete chunks whose matching `recordings` row is either
- * (a) absent (the recording was deleted but chunks remained), or
- * (b) in status=`ready` or `failed` (finalize ran and should have cleaned, or
- *     bailed), AND last updated more than 1 hour ago (don't race a finalize
- *     that's CURRENTLY running).
- *
- * Runs once on server startup. Best-effort — any individual delete or probe
- * failure is logged and ignored; the rest of the sweep continues.
- */
-async function sweepOrphanedRecordingChunks(): Promise<void> {
-  const exec = getDbExec();
-  const pg = isPostgres();
-
-  let chunkRows: Array<{ key: string }> = [];
-  try {
-    const probe = await exec.execute({
-      sql: `SELECT key FROM application_state WHERE key LIKE 'recording-chunks-%'`,
-      args: [],
-    });
-    chunkRows = (probe.rows as Array<{ key: string }>) ?? [];
-  } catch (err) {
-    // application_state may not exist on a fresh dev DB — bail quietly.
-    const message = (err as Error)?.message ?? String(err);
-    if (
-      /no such table:\s*application_state/i.test(message) ||
-      /relation ["']?application_state["']? does not exist/i.test(message)
-    ) {
-      return;
-    }
-    console.warn("[db] chunk sweep: application_state probe failed", message);
-    return;
-  }
-
-  if (chunkRows.length === 0) return;
-
-  // Group by recordingId so one probe per recording, not per chunk.
-  const keysByRecording = new Map<string, string[]>();
-  for (const row of chunkRows) {
-    // Key shape: recording-chunks-<recordingId>-<paddedIdx>. `recordingId` may
-    // contain hyphens, so we peel off the trailing `-<idx>` first and then
-    // the `recording-chunks-` prefix.
-    const stripped = row.key.replace(/^recording-chunks-/, "");
-    const lastDash = stripped.lastIndexOf("-");
-    if (lastDash < 0) continue;
-    const recordingId = stripped.slice(0, lastDash);
-    const list = keysByRecording.get(recordingId) ?? [];
-    list.push(row.key);
-    keysByRecording.set(recordingId, list);
-  }
-
-  const oneHourAgoIso = new Date(Date.now() - 60 * 60 * 1000).toISOString();
-  let totalDeleted = 0;
-  let recordingsCleaned = 0;
-
-  for (const [recordingId, keys] of keysByRecording) {
-    let shouldSweep = false;
-    // guard:allow-unscoped — orphaned-chunk GC sweep — system-level by design
-    try {
-      const probe = await exec.execute({
-        sql: pg
-          ? `SELECT status, updated_at FROM recordings WHERE id = $1 LIMIT 1`
-          : `SELECT status, updated_at FROM recordings WHERE id = ? LIMIT 1`,
-        args: [recordingId],
-      });
-      const row = (
-        probe.rows as Array<{ status?: string; updated_at?: string }>
-      )[0];
-      if (!row) {
-        // Recording row gone — chunks are orphaned.
-        shouldSweep = true;
-      } else if (
-        (row.status === "ready" || row.status === "failed") &&
-        (row.updated_at ?? "") < oneHourAgoIso
-      ) {
-        // Finalize ran (ready) or bailed (failed) and it's been >1h — safe.
-        shouldSweep = true;
-      }
-    } catch (err) {
-      console.warn("[db] chunk sweep: recording probe failed", {
-        recordingId,
-        err: (err as Error)?.message ?? err,
-      });
-      continue;
-    }
-
-    if (!shouldSweep) continue;
-
-    for (const key of keys) {
-      try {
-        await exec.execute({
-          sql: pg
-            ? `DELETE FROM application_state WHERE key = $1`
-            : `DELETE FROM application_state WHERE key = ?`,
-          args: [key],
-        });
-        totalDeleted += 1;
-      } catch (err) {
-        console.warn("[db] chunk sweep: delete failed", {
-          key,
-          err: (err as Error)?.message ?? err,
-        });
-      }
-    }
-    recordingsCleaned += 1;
-  }
-
-  if (totalDeleted > 0) {
-    console.log("[db] swept orphaned recording chunks", {
-      totalDeleted,
-      recordingsCleaned,
-    });
-  }
-}
-
-/**
- * Sweep orphaned resumable upload sessions out of `application_state`.
- *
- * The streaming upload path stores provider session handles under
- * `resumable-session-<recordingId>` and deletes them after finalize commits a
- * ready recording. Crashes between those two steps can strand small session
- * rows forever. We only delete sessions whose recording row is gone, or whose
- * recording reached a terminal status more than an hour ago. Abandoned browser
- * uploads can leave the recording stuck in `uploading`, so those are swept only
- * after a much longer grace window. Resumable session activity is the heartbeat
- * for in-progress uploads because streaming chunks do not update the recording
- * row on every provider relay.
- */
-async function sweepOrphanedResumableSessions(): Promise<void> {
-  const exec = getDbExec();
-  const pg = isPostgres();
-  const SWEEP_BATCH = 500;
-  const IN_CHUNK = 200;
-
-  let sessionRows: Array<{
-    session_id?: unknown;
-    key?: unknown;
-    updated_at?: unknown;
-  }> = [];
-  try {
-    const probe = await exec.execute({
-      sql: `SELECT session_id, key, updated_at FROM application_state WHERE key LIKE 'resumable-session-%' ORDER BY updated_at ASC LIMIT ${SWEEP_BATCH}`,
-      args: [],
-    });
-    sessionRows =
-      (probe.rows as Array<{
-        session_id?: unknown;
-        key?: unknown;
-        updated_at?: unknown;
-      }>) ?? [];
-  } catch (err) {
-    const message = (err as Error)?.message ?? String(err);
-    if (
-      /no such table:\s*application_state/i.test(message) ||
-      /relation ["']?application_state["']? does not exist/i.test(message)
-    ) {
-      return;
-    }
-    console.warn(
-      "[db] resumable-session sweep: application_state probe failed",
-      message,
-    );
-    return;
-  }
-
-  if (sessionRows.length === 0) return;
-
-  const prefix = "resumable-session-";
-  const oneHourAgoIso = new Date(Date.now() - 60 * 60 * 1000).toISOString();
-  const staleInProgressIso = new Date(
-    Date.now() - 24 * 60 * 60 * 1000,
-  ).toISOString();
-
-  // Parse candidate rows and collect the referenced recording ids so they can
-  // be resolved in a few batched lookups instead of one query per session.
-  const candidates: Array<{
-    key: string;
-    recordingId: string;
-    sessionUpdatedAt: string;
-  }> = [];
-  const recordingIds = new Set<string>();
-  for (const row of sessionRows) {
-    const key = typeof row.key === "string" ? row.key : "";
-    if (!key.startsWith(prefix)) continue;
-    const recordingId = key.slice(prefix.length);
-    if (!recordingId) continue;
-    // `application_state.updated_at` is epoch-ms (a JS number on SQLite, a
-    // BIGINT string on Postgres), but the staleness cutoffs below are ISO-8601.
-    // Normalize to ISO before comparing — a raw epoch-ms value ("1753…") always
-    // sorts lexically below any "2…" ISO date, which would flag every live
-    // upload as stale and force-fail it.
-    const sessionUpdatedAtMs = Number(row.updated_at);
-    const sessionUpdatedAt =
-      Number.isFinite(sessionUpdatedAtMs) && sessionUpdatedAtMs > 0
-        ? new Date(sessionUpdatedAtMs).toISOString()
-        : "";
-    candidates.push({ key, recordingId, sessionUpdatedAt });
-    recordingIds.add(recordingId);
-  }
-  if (candidates.length === 0) return;
-
-  // Resolve every referenced recording in chunked `IN (...)` lookups.
-  const recordingById = new Map<
-    string,
-    { status?: string; updatedAt?: string }
-  >();
-  const idList = [...recordingIds];
-  for (let i = 0; i < idList.length; i += IN_CHUNK) {
-    const chunk = idList.slice(i, i + IN_CHUNK);
-    const placeholders = chunk
-      .map((_, j) => (pg ? `$${j + 1}` : "?"))
-      .join(", ");
-    try {
-      const probe = await exec.execute({
-        sql: `SELECT id, status, updated_at FROM recordings WHERE id IN (${placeholders})`,
-        args: chunk,
-      });
-      for (const rec of probe.rows as Array<{
-        id?: string;
-        status?: string;
-        updated_at?: string;
-      }>) {
-        if (typeof rec.id === "string") {
-          recordingById.set(rec.id, {
-            status: rec.status,
-            updatedAt: rec.updated_at,
-          });
-        }
-      }
-    } catch (err) {
-      console.warn(
-        "[db] resumable-session sweep: recordings batch probe failed",
-        (err as Error)?.message ?? err,
-      );
-      return;
-    }
-  }
-
-  // Decide sweeps in memory, then mark stale uploads failed and batch-delete.
-  const keysToDelete = new Set<string>();
-  const staleIdsByStatus = new Map<string, Set<string>>();
-  for (const candidate of candidates) {
-    const recording = recordingById.get(candidate.recordingId);
-    if (!recording) {
-      keysToDelete.add(candidate.key);
-      continue;
-    }
-    const status = recording.status;
-    if (
-      (status === "ready" || status === "failed") &&
-      (recording.updatedAt ?? "") < oneHourAgoIso
-    ) {
-      keysToDelete.add(candidate.key);
-    } else if (
-      (status === "uploading" || status === "processing") &&
-      (candidate.sessionUpdatedAt || recording.updatedAt || "") <
-        staleInProgressIso
-    ) {
-      const bucket = staleIdsByStatus.get(status) ?? new Set<string>();
-      bucket.add(candidate.recordingId);
-      staleIdsByStatus.set(status, bucket);
-      keysToDelete.add(candidate.key);
-    }
-  }
-
-  // Mark stale in-progress uploads failed, one chunked `IN (...)` update per
-  // status. The `status = ?` guard keeps a recording that concurrently
-  // advanced out of that status from being clobbered back to failed.
-  const staleReason =
-    "Upload did not finish before the resumable upload cleanup window.";
-  for (const [status, idSet] of staleIdsByStatus) {
-    const ids = [...idSet];
-    for (let i = 0; i < ids.length; i += IN_CHUNK) {
-      const chunk = ids.slice(i, i + IN_CHUNK);
-      const idPlaceholders = chunk
-        .map((_, j) => (pg ? `$${j + 3}` : "?"))
-        .join(", ");
-      const statusPlaceholder = pg ? `$${chunk.length + 3}` : "?";
-      try {
-        await exec.execute({
-          sql: `UPDATE recordings SET status = 'failed', failure_reason = ${pg ? "$1" : "?"}, updated_at = ${pg ? "$2" : "?"} WHERE id IN (${idPlaceholders}) AND status = ${statusPlaceholder}`,
-          args: [staleReason, new Date().toISOString(), ...chunk, status],
-        });
-      } catch (err) {
-        console.warn(
-          "[db] resumable-session sweep: stale upload mark-failed failed",
-          {
-            status,
-            recordingIds: chunk,
-            err: (err as Error)?.message ?? err,
-          },
-        );
-      }
-    }
-  }
-
-  let totalDeleted = 0;
-  const deleteKeys = [...keysToDelete];
-  for (let i = 0; i < deleteKeys.length; i += IN_CHUNK) {
-    const chunk = deleteKeys.slice(i, i + IN_CHUNK);
-    const placeholders = chunk
-      .map((_, j) => (pg ? `$${j + 1}` : "?"))
-      .join(", ");
-    try {
-      await exec.execute({
-        sql: `DELETE FROM application_state WHERE key IN (${placeholders})`,
-        args: chunk,
-      });
-      totalDeleted += chunk.length;
-    } catch (err) {
-      console.warn(
-        "[db] resumable-session sweep: batch delete failed",
-        (err as Error)?.message ?? err,
-      );
-    }
-  }
-
-  if (totalDeleted > 0) {
-    console.log("[db] swept orphaned resumable upload sessions", {
-      totalDeleted,
-    });
-  }
-}
-
 async function backfillRecordingOrgId(): Promise<void> {
   const exec = getDbExec();
   try {
@@ -1758,17 +1440,6 @@ export default async (nitroApp: any): Promise<void> => {
   await backfillLegacyClipsTables();
   await syncWorkspacesToOrganizations();
   await backfillRecordingOrgId();
-  // Best-effort chunk sweep — don't block startup on failures.
-  sweepOrphanedRecordingChunks().catch((err) => {
-    console.warn("[db] chunk sweep failed:", (err as Error)?.message ?? err);
-  });
-  sweepOrphanedResumableSessions().catch((err) => {
-    console.warn(
-      "[db] resumable-session sweep failed:",
-      (err as Error)?.message ?? err,
-    );
-  });
-
   try {
     const summary = await ensureAdditiveColumns({
       db: getDbExec(),

package/corpus/templates/clips/server/routes/api/clips/brain-export/run.post.ts

@@ -3,6 +3,7 @@ import { timingSafeEqual } from "node:crypto";
 import { createError, defineEventHandler, getHeader } from "h3";
 
 import { runBrainExportSweepOnce } from "../../../../jobs/brain-export.js";
+import { reapExpiredUploads } from "../../../../lib/upload-lease.js";
 
 declare global {
   var __AGENT_NATIVE_CLIPS_BRAIN_EXPORT_SCHEDULED_RUNTIME__:
@@ -40,6 +41,11 @@ export default defineEventHandler(async (event) => {
     !headerMatchesSecret(getHeader(event, "authorization"), secret)
   )
     throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
+  // Same per-minute schedule, different unit of maintenance: expired upload
+  // leases. Netlify only runs scheduled functions, so this is the one durable
+  // clock Clips has. Run it first so Brain discovery/export failures cannot
+  // starve cleanup or strand SQL scratch payloads.
+  const uploads = await reapExpiredUploads();
   await runBrainExportSweepOnce();
-  return { ok: true };
+  return { ok: true, uploads };
 });