memorix 1.3.3 → 1.3.4

package/src/cli/commands/serve-shared.ts

@@ -1,3 +1,5 @@
+import path from 'node:path';
+
 import type { ProjectInfo } from '../../types.js';
 
 export interface ResolveServeProjectOptions {
@@ -6,7 +8,6 @@ export interface ResolveServeProjectOptions {
   initCwd?: string;
   processCwd: string;
   homeDir: string;
-  lastKnownProjectRoot?: string;
 }
 
 export interface ResolveServeProjectDeps {
@@ -18,7 +19,7 @@ export interface ResolveServeProjectDeps {
 export interface ServeProjectResolution {
   projectRoot: string;
   detectedProject: ProjectInfo | null;
-  source: 'direct' | 'subdir' | 'last-known' | 'home' | 'home-subdir' | 'unresolved';
+  source: 'direct' | 'subdir' | 'unresolved';
   messages: string[];
   error?: string;
 }
@@ -45,6 +46,21 @@ export function resolveServeProject(
     };
   }
 
+  const hasExplicitRoot = Boolean(options.cwdArg || options.envProjectRoot || options.initCwd);
+  const startsAtHome = path.resolve(projectRoot) === path.resolve(options.homeDir);
+  if (deps.isSystemDirectory(projectRoot) || (!hasExplicitRoot && startsAtHome)) {
+    messages.push(`[memorix] Unreliable launch directory detected: ${projectRoot}`);
+    messages.push('[memorix] Memorix will wait for MCP Roots or an explicit memorix_session_start projectRoot.');
+    messages.push('[memorix] It will not restore a previous project automatically, to prevent cross-project memory access.');
+    return {
+      projectRoot,
+      detectedProject: null,
+      source: 'unresolved',
+      messages,
+      error: 'No reliable git project was provided by the launcher.',
+    };
+  }
+
   const subGit = deps.findGitInSubdirs(projectRoot);
   if (subGit) {
     projectRoot = subGit;
@@ -60,50 +76,6 @@ export function resolveServeProject(
     }
   }
 
-  if (deps.isSystemDirectory(projectRoot)) {
-    messages.push(`[memorix] System directory detected: ${projectRoot}`);
-    messages.push('[memorix] Your IDE launched memorix from a non-workspace directory.');
-    messages.push('[memorix] Fix: add --cwd to your MCP config, or use an IDE/client that exposes workspace roots.');
-
-    if (options.lastKnownProjectRoot) {
-      detected = deps.detectProject(options.lastKnownProjectRoot);
-      if (detected) {
-        messages.push(`[memorix] Restored last known project: ${options.lastKnownProjectRoot}`);
-        return {
-          projectRoot: options.lastKnownProjectRoot,
-          detectedProject: detected,
-          source: 'last-known',
-          messages,
-        };
-      }
-    }
-
-    detected = deps.detectProject(options.homeDir);
-    if (detected) {
-      messages.push(`[memorix] Restored project from home directory: ${options.homeDir}`);
-      return {
-        projectRoot: options.homeDir,
-        detectedProject: detected,
-        source: 'home',
-        messages,
-      };
-    }
-
-    const homeSubGit = deps.findGitInSubdirs(options.homeDir);
-    if (homeSubGit) {
-      detected = deps.detectProject(homeSubGit);
-      if (detected) {
-        messages.push(`[memorix] Found .git in home subdirectory: ${homeSubGit}`);
-        return {
-          projectRoot: homeSubGit,
-          detectedProject: detected,
-          source: 'home-subdir',
-          messages,
-        };
-      }
-    }
-  }
-
   messages.push('[memorix] Unable to establish a reliable git-backed project context.');
   messages.push('[memorix] Memorix now refuses to silently fall back to untracked/* in stdio mode.');
 

package/src/cli/commands/serve.ts

@@ -4,6 +4,7 @@
 
 import { defineCommand } from 'citty';
 import { resolveToolProfile } from '../../server/tool-profile.js';
+import { mcpFileUriToPath } from '../mcp-root-path.js';
 
 export default defineCommand({
   meta: {
@@ -45,18 +46,6 @@ export default defineCommand({
     // Priority: explicit --cwd arg > MEMORIX_PROJECT_ROOT env > INIT_CWD (npm lifecycle) > process.cwd()
     let safeCwd: string;
     try { safeCwd = process.cwd(); } catch { safeCwd = homedir(); }
-    const { existsSync, readFileSync } = await import('node:fs');
-    const path = await import('node:path');
-    const lastRootFile = path.join(homedir(), '.memorix', 'last-project-root');
-    let lastKnownProjectRoot: string | undefined;
-    if (existsSync(lastRootFile)) {
-      try {
-        const lastRoot = readFileSync(lastRootFile, 'utf-8').trim();
-        if (lastRoot && existsSync(lastRoot)) {
-          lastKnownProjectRoot = lastRoot;
-        }
-      } catch { /* ignore read errors */ }
-    }
 
     const resolution = resolveServeProject(
       {
@@ -65,7 +54,6 @@ export default defineCommand({
         initCwd: process.env.INIT_CWD,
         processCwd: safeCwd,
         homeDir: homedir(),
-        lastKnownProjectRoot,
       },
       { detectProject, findGitInSubdirs, isSystemDirectory },
     );
@@ -84,16 +72,6 @@ export default defineCommand({
     const detected = resolution.detectedProject;
     const projectRoot = resolution.projectRoot;
 
-    // Persist successful project root for future system-directory fallback
-    if (detected) {
-      try {
-        const { writeFileSync, mkdirSync } = await import('node:fs');
-        const memorixDir = path.join(homedir(), '.memorix');
-        mkdirSync(memorixDir, { recursive: true });
-        writeFileSync(path.join(memorixDir, 'last-project-root'), detected.rootPath, 'utf-8');
-      } catch { /* non-critical */ }
-    }
-
     // Always register ALL tools BEFORE connecting transport.
     // This ensures tools/list returns the full tool set immediately on connect.
     // When no project detected, use deferred binding (allowUntrackedFallback=false, deferProjectInitUntilBound=true)
@@ -113,16 +91,6 @@ export default defineCommand({
     // After connect, request workspace roots from the client (IDE).
     // This is the proper way to discover the user's workspace —
     // no --cwd needed if the IDE supports roots capability.
-    const persistRoot = async (rootPath: string) => {
-      try {
-        const { writeFileSync, mkdirSync } = await import('node:fs');
-        const pathMod = await import('node:path');
-        const memorixDir = pathMod.join(homedir(), '.memorix');
-        mkdirSync(memorixDir, { recursive: true });
-        writeFileSync(pathMod.join(memorixDir, 'last-project-root'), rootPath, 'utf-8');
-      } catch { /* non-critical */ }
-    };
-
     const tryRootsSwitch = async () => {
       try {
         const { roots } = await server.server.listRoots();
@@ -130,18 +98,14 @@ export default defineCommand({
 
         for (const root of roots) {
           if (!root.uri.startsWith('file://')) continue;
-          // Convert file:// URI to filesystem path
-          let rootPath = decodeURIComponent(root.uri.replace('file://', ''));
-          // Windows: file:///E:/... → E:/...
-          if (/^\/[A-Za-z]:/.test(rootPath)) rootPath = rootPath.slice(1);
-          rootPath = rootPath.replace(/\//g, '\\'); // normalize to Windows backslashes
+          const rootPath = mcpFileUriToPath(root.uri);
+          if (!rootPath) continue;
 
           const rootDetected = detectProject(rootPath);
           if (rootDetected) {
             const switched = await switchProject(rootPath);
             if (switched) {
               console.error(`[memorix] [UPDATED] Project updated via MCP roots: ${rootDetected.id}`);
-              await persistRoot(rootDetected.rootPath);
             }
             return; // use first valid root
           }
@@ -151,8 +115,6 @@ export default defineCommand({
             const switched = await switchProject(subGit);
             if (switched) {
               console.error(`[memorix] [UPDATED] Project updated via MCP roots (subdir): ${subGit}`);
-              const subDetected = detectProject(subGit);
-              if (subDetected) await persistRoot(subDetected.rootPath);
             }
             return;
           }

package/src/cli/commands/setup.ts

@@ -560,30 +560,33 @@ export async function removeLegacyCodexMemorixMcpConfig(
   return { configPath, removed: true };
 }
 
-function collectHookCommands(value: unknown, commands: string[]): void {
-  if (Array.isArray(value)) {
-    for (const item of value) collectHookCommands(item, commands);
-    return;
-  }
-  if (!value || typeof value !== 'object') return;
-
-  for (const [key, child] of Object.entries(value as Record<string, unknown>)) {
-    if ((key === 'command' || key === 'commandWindows') && typeof child === 'string') {
-      commands.push(child);
-    } else {
-      collectHookCommands(child, commands);
-    }
-  }
-}
-
 function isOwnedLegacyCodexHooks(content: string): boolean {
   try {
     const parsed = JSON.parse(content) as { hooks?: unknown };
-    if (!parsed.hooks || typeof parsed.hooks !== 'object') return false;
-    const commands: string[] = [];
-    collectHookCommands(parsed.hooks, commands);
-    return commands.length > 0
-      && commands.every((command) => /^memorix(?:\.cmd)?\s+hook(?:\s|$)/i.test(command.trim()));
+    if (!parsed.hooks || typeof parsed.hooks !== 'object' || Array.isArray(parsed.hooks)) return false;
+    // There was no ownership marker in the old project-local file. Treat any
+    // timeout, matcher, extra field, or extra top-level metadata as user-owned
+    // rather than guessing from a command prefix and deleting their config.
+    if (Object.keys(parsed).some((key) => key !== 'hooks')) return false;
+    const hooks = parsed.hooks as Record<string, unknown>;
+    const allowedEntryKeys = new Set(['type', 'command', 'commandWindows']);
+    let entryCount = 0;
+    for (const entries of Object.values(hooks)) {
+      if (!Array.isArray(entries) || entries.length === 0) return false;
+      for (const entry of entries) {
+        if (!entry || typeof entry !== 'object' || Array.isArray(entry)) return false;
+        const record = entry as Record<string, unknown>;
+        if (Object.keys(record).some((key) => !allowedEntryKeys.has(key))) return false;
+        if (record.type !== 'command') return false;
+        const commands = [record.command, record.commandWindows]
+          .filter((command): command is string => typeof command === 'string');
+        if (commands.length === 0 || !commands.every((command) => /^memorix(?:\.cmd)?\s+hook(?:\s|$)/i.test(command.trim()))) {
+          return false;
+        }
+        entryCount += 1;
+      }
+    }
+    return entryCount > 0;
   } catch {
     return false;
   }

package/src/cli/mcp-root-path.ts

@@ -0,0 +1,36 @@
+import path from 'node:path';
+
+/**
+ * Convert an MCP file URI to a path for the host platform. MCP Roots always
+ * use file URIs; replacing slashes unconditionally corrupts POSIX roots.
+ */
+export function mcpFileUriToPath(uri: string, platform: NodeJS.Platform = process.platform): string | null {
+  let parsed: URL;
+  try {
+    parsed = new URL(uri);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== 'file:') return null;
+
+  let pathname: string;
+  try {
+    pathname = decodeURIComponent(parsed.pathname);
+  } catch {
+    return null;
+  }
+
+  const hostname = parsed.hostname;
+  if (platform === 'win32') {
+    if (hostname && hostname !== 'localhost') {
+      return path.win32.normalize(`\\\\${hostname}${pathname.replace(/\//g, '\\')}`);
+    }
+    if (/^\/[A-Za-z]:/.test(pathname)) pathname = pathname.slice(1);
+    return path.win32.normalize(pathname.replace(/\//g, '\\'));
+  }
+
+  if (hostname && hostname !== 'localhost') {
+    return path.posix.normalize(`//${hostname}${pathname}`);
+  }
+  return path.posix.normalize(pathname);
+}

package/src/index.ts

@@ -1,68 +1,50 @@
 #!/usr/bin/env node
 
 /**
- * Memorix — Cross-Agent Memory Bridge
+ * Package entry point.
  *
- * Entry point for the MCP Server.
- * Connects via stdio transport for compatibility with all MCP-supporting agents.
- *
- * Usage:
- *   node dist/index.js          # Start as MCP server (stdio)
- *   memorix init                # CLI: Initialize project (P1)
- *   memorix sync                # CLI: Sync rules across agents (P2)
+ * `memorix serve` is the documented MCP command. Keep the historical
+ * `node dist/index.js` route working by delegating to that exact runtime,
+ * while making a normal package import side-effect free.
  */
 
-import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { createMemorixServer } from './server.js';
-
-async function main(): Promise<void> {
-  const { homedir } = await import('node:os');
-  const { existsSync, readFileSync } = await import('node:fs');
-  const path = await import('node:path');
-  const { detectProject, findGitInSubdirs, isSystemDirectory } = await import('./project/detector.js');
-  const { resolveServeProject } = await import('./cli/commands/serve-shared.js');
-
-  let safeCwd: string;
-  try { safeCwd = process.cwd(); } catch { safeCwd = homedir(); }
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
 
-  const lastRootFile = path.join(homedir(), '.memorix', 'last-project-root');
-  let lastKnownProjectRoot: string | undefined;
-  if (existsSync(lastRootFile)) {
-    try {
-      const lastRoot = readFileSync(lastRootFile, 'utf-8').trim();
-      if (lastRoot && existsSync(lastRoot)) {
-        lastKnownProjectRoot = lastRoot;
-      }
-    } catch { /* ignore */ }
-  }
-
-  const resolution = resolveServeProject(
-    {
-      processCwd: safeCwd,
-      homeDir: homedir(),
-      lastKnownProjectRoot,
-    },
-    { detectProject, findGitInSubdirs, isSystemDirectory },
-  );
+export { createMemorixServer } from './server.js';
+export type { CreateMemorixServerOptions } from './server.js';
 
-  for (const message of resolution.messages) {
-    console.error(message);
-  }
+function isDirectEntrypoint(): boolean {
+  const entry = process.argv[1];
+  return Boolean(entry && import.meta.url === pathToFileURL(path.resolve(entry)).href);
+}
 
-  if (!resolution.detectedProject) {
-    throw new Error(resolution.error);
+function directServeArgs(argv: string[]): { cwd?: string; mode?: string; 'allow-untracked': boolean } {
+  const args: { cwd?: string; mode?: string; 'allow-untracked': boolean } = { 'allow-untracked': false };
+  for (let index = 0; index < argv.length; index += 1) {
+    const value = argv[index];
+    if (value === '--allow-untracked') {
+      args['allow-untracked'] = true;
+      continue;
+    }
+    if ((value === '--cwd' || value === '--mode') && argv[index + 1]) {
+      args[value.slice(2) as 'cwd' | 'mode'] = argv[index + 1];
+      index += 1;
+    }
   }
+  return args;
+}
 
-  const { server, projectId, deferredInit } = await createMemorixServer(resolution.projectRoot);
-
-  const transport = new StdioServerTransport();
-  await server.connect(transport);
-
-  console.error(`[memorix] MCP Server running on stdio (project: ${projectId})`);
-  deferredInit().catch(e => console.error(`[memorix] Deferred init error:`, e));
+async function runDirectStdioServer(): Promise<void> {
+  const { default: serveCommand } = await import('./cli/commands/serve.js');
+  const run = serveCommand.run as ((input: { args: ReturnType<typeof directServeArgs> }) => Promise<void>) | undefined;
+  if (!run) throw new Error('Memorix stdio server command is unavailable');
+  await run({ args: directServeArgs(process.argv.slice(2)) });
 }
 
-main().catch((error) => {
-  console.error('[memorix] Fatal error:', error);
-  process.exit(1);
-});
+if (isDirectEntrypoint()) {
+  runDirectStdioServer().catch((error) => {
+    console.error('[memorix] Fatal error:', error);
+    process.exitCode = 1;
+  });
+}

package/src/media/asset-store.ts

@@ -1,5 +1,5 @@
 import { createHash, randomUUID } from 'node:crypto';
-import { copyFile, lstat, mkdir, open, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { copyFile, lstat, mkdir, open, readFile, readdir, rename, rm, stat, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 
 import { sanitizeCredentials } from '../memory/secret-filter.js';
@@ -273,7 +273,7 @@ export async function removeMediaAsset(input: {
   projectId: string;
   assetId: string;
   force?: boolean;
-}): Promise<{ asset: MediaAsset; detachedLinks: number }> {
+}): Promise<{ asset: MediaAsset; detachedLinks: number; pendingDelete: boolean }> {
   const store = new MediaStore(input.dataDir);
   const asset = store.getAsset(input.projectId, input.assetId);
   if (!asset) throw new Error(`Media asset not found: ${input.assetId}`);
@@ -305,21 +305,81 @@ export async function removeMediaAsset(input: {
   // A locked file can be retried by a later cleanup; it is already outside the
   // active asset tree and no database row refers to it anymore.
   await rm(stagedPath, { force: true }).catch(() => {});
-  return { asset, detachedLinks };
+  return { asset, detachedLinks, pendingDelete: await destinationExists(stagedPath) };
+}
+
+export interface MediaTrashCleanupResult {
+  reclaimedBytes: number;
+  pendingBytes: number;
+  pendingFiles: number;
+}
+
+/** Retry files that were atomically staged after a metadata deletion but were
+ * locked by Windows or another process. Only Memorix's own staging suffix is
+ * considered, so cleanup never sweeps arbitrary files from the data directory.
+ */
+export async function cleanupMediaTrash(dataDir: string): Promise<MediaTrashCleanupResult> {
+  const root = mediaRoot(dataDir);
+  const trashDir = validateUnderRoot(root, path.join(root, '.trash'));
+  let entries: string[];
+  try {
+    entries = await readdir(trashDir);
+  } catch (error: any) {
+    if (error?.code === 'ENOENT') return { reclaimedBytes: 0, pendingBytes: 0, pendingFiles: 0 };
+    throw error;
+  }
+
+  let reclaimedBytes = 0;
+  let pendingBytes = 0;
+  let pendingFiles = 0;
+  for (const name of entries) {
+    if (!name.endsWith('.pending-delete')) continue;
+    const candidate = validateUnderRoot(trashDir, path.join(trashDir, name));
+    try {
+      const metadata = await lstat(candidate);
+      if (!metadata.isFile()) continue;
+      await rm(candidate, { force: true });
+      reclaimedBytes += metadata.size;
+    } catch (error: any) {
+      if (error?.code === 'ENOENT') continue;
+      try {
+        pendingBytes += (await stat(candidate)).size;
+      } catch { /* The file disappeared or cannot be measured; keep its count. */ }
+      pendingFiles += 1;
+    }
+  }
+  return { reclaimedBytes, pendingBytes, pendingFiles };
 }
 
 export async function cleanupMediaQuota(input: {
   dataDir: string;
   projectId: string;
   maxBytes?: number;
-}): Promise<{ beforeBytes: number; afterBytes: number; removed: MediaAsset[] }> {
+}): Promise<{
+  beforeBytes: number;
+  afterBytes: number;
+  removed: MediaAsset[];
+  reclaimedTrashBytes: number;
+  pendingTrashBytes: number;
+  pendingTrashFiles: number;
+}> {
   const store = new MediaStore(input.dataDir);
   const maxBytes = input.maxBytes ?? DEFAULT_MEDIA_QUOTA_BYTES;
   if (!Number.isSafeInteger(maxBytes) || maxBytes < 0) throw new Error('maxBytes must be a non-negative integer');
+  const initialTrash = await cleanupMediaTrash(input.dataDir);
   const beforeBytes = store.activeByteSize(input.projectId);
   let currentBytes = beforeBytes;
   const removed: MediaAsset[] = [];
-  if (currentBytes <= maxBytes) return { beforeBytes, afterBytes: currentBytes, removed };
+  if (currentBytes <= maxBytes) {
+    return {
+      beforeBytes,
+      afterBytes: currentBytes,
+      removed,
+      reclaimedTrashBytes: initialTrash.reclaimedBytes,
+      pendingTrashBytes: initialTrash.pendingBytes,
+      pendingTrashFiles: initialTrash.pendingFiles,
+    };
+  }
 
   // Fail closed: all candidates come from the link-aware query. A query error leaves all assets intact.
   const candidates = store.listUnlinkedAssets(input.projectId);
@@ -334,5 +394,13 @@ export async function cleanupMediaQuota(input: {
     currentBytes -= asset.byteSize;
     removed.push(asset);
   }
-  return { beforeBytes, afterBytes: Math.max(0, currentBytes), removed };
+  const finalTrash = await cleanupMediaTrash(input.dataDir);
+  return {
+    beforeBytes,
+    afterBytes: Math.max(0, currentBytes),
+    removed,
+    reclaimedTrashBytes: initialTrash.reclaimedBytes + finalTrash.reclaimedBytes,
+    pendingTrashBytes: finalTrash.pendingBytes,
+    pendingTrashFiles: finalTrash.pendingFiles,
+  };
 }

package/src/media/attachment.ts

@@ -19,9 +19,9 @@ export interface AttachMediaAssetInput {
 }
 
 /**
- * Create normal text retrieval evidence first, then add an explicit asset link.
- * The media row remains the binary source of truth; the Observation is only a
- * small, auditable retrieval projection.
+ * Create normal text retrieval evidence and its explicit asset link in the
+ * same SQLite transaction. The media row remains the binary source of truth;
+ * the Observation is only a small, auditable retrieval projection.
  */
 export async function attachMediaAssetToObservation(input: AttachMediaAssetInput): Promise<Observation> {
   const asset = input.asset;
@@ -34,6 +34,7 @@ export async function attachMediaAssetToObservation(input: AttachMediaAssetInput
     `MIME type: ${asset.mimeType}`,
     ...(input.facts ?? []),
   ];
+  const store = new MediaStore(input.dataDir);
   const result = await storeObservation({
     entityName: input.entityName?.trim() || sourceLabel.replace(/\.[^.]+$/, '') || 'media-asset',
     type: 'discovery',
@@ -47,12 +48,14 @@ export async function attachMediaAssetToObservation(input: AttachMediaAssetInput
     ...(input.visibility ? { visibility: input.visibility } : {}),
     ...(input.createdByAgentId ? { createdByAgentId: input.createdByAgentId } : {}),
     ...(input.visibilityReader ? { visibilityReader: input.visibilityReader } : {}),
-  });
-  new MediaStore(input.dataDir).linkAsset({
-    projectId: input.projectId,
-    assetId: asset.id,
-    observationId: result.observation.id,
-    role: input.role ?? 'attachment',
+    onPersisted: (observation) => {
+      store.linkAsset({
+        projectId: input.projectId,
+        assetId: asset.id,
+        observationId: observation.id,
+        role: input.role ?? 'attachment',
+      });
+    },
   });
   return result.observation;
 }

package/src/media/media-store.ts

@@ -242,6 +242,13 @@ export class MediaStore {
       `).run(projectId, assetId).changes ?? 0);
       this.db.prepare('DELETE FROM media_derivations WHERE project_id = ? AND asset_id = ?').run(projectId, assetId);
       this.db.prepare('DELETE FROM media_embeddings WHERE project_id = ? AND asset_id = ?').run(projectId, assetId);
+      // Assets are soft-deleted so SQLite's ON DELETE SET NULL does not fire.
+      // Do not leave completed jobs advertising an asset that `media show` can
+      // no longer retrieve.
+      this.db.prepare(`
+        UPDATE media_jobs SET asset_id = NULL, updated_at = ?
+        WHERE project_id = ? AND asset_id = ?
+      `).run(Date.now(), projectId, assetId);
       const result = this.db.prepare(`
         UPDATE media_assets SET deleted_at = ?, updated_at = ?
         WHERE project_id = ? AND id = ? AND deleted_at IS NULL
@@ -431,16 +438,42 @@ export class MediaStore {
     lastError?: string;
     incrementAttempts?: boolean;
   }): MediaJob {
+    const updated = this.updateJobInternal(projectId, id, input, false);
+    if (!updated) throw new Error(`Media job not found: ${id}`);
+    return updated;
+  }
+
+  /**
+   * Atomically preserve a user cancellation against a worker that was already
+   * downloading or attaching media when the cancellation arrived.
+   */
+  updateJobIfNotCancelled(projectId: string, id: string, input: {
+    status: MediaJobStatus;
+    providerTaskId?: string;
+    assetId?: string;
+    lastError?: string;
+    incrementAttempts?: boolean;
+  }): MediaJob | undefined {
+    return this.updateJobInternal(projectId, id, input, true);
+  }
+
+  private updateJobInternal(projectId: string, id: string, input: {
+    status: MediaJobStatus;
+    providerTaskId?: string;
+    assetId?: string;
+    lastError?: string;
+    incrementAttempts?: boolean;
+  }, rejectCancelled: boolean): MediaJob | undefined {
     const existing = this.getJob(projectId, id);
-    if (!existing) throw new Error(`Media job not found: ${id}`);
+    if (!existing) return undefined;
     const now = Date.now();
     const attempts = existing.attempts + (input.incrementAttempts ? 1 : 0);
     const completedAt = input.status === 'completed' ? now : null;
-    this.db.prepare(`
+    const result = this.db.prepare(`
       UPDATE media_jobs
       SET status = ?, provider_task_id = COALESCE(?, provider_task_id), asset_id = COALESCE(?, asset_id),
           last_error = ?, attempts = ?, updated_at = ?, completed_at = ?
-      WHERE project_id = ? AND id = ?
+      WHERE project_id = ? AND id = ? ${rejectCancelled ? "AND status <> 'cancelled'" : ''}
     `).run(
       input.status,
       input.providerTaskId ?? null,
@@ -452,7 +485,8 @@ export class MediaStore {
       projectId,
       id,
     );
-    return this.getJob(projectId, id)!;
+    if (Number(result.changes ?? 0) !== 1) return undefined;
+    return this.getJob(projectId, id);
   }
 
   cancelJob(projectId: string, id: string): MediaJob {