mixdog 0.9.147 → 0.9.148

package/src/runtime/channels/lib/event-queue.mjs

@@ -36,6 +36,29 @@ function finiteInt(value, { min, max, def }) {
   if (i > max) return max;
   return i;
 }
+// Belt-and-suspenders ownership guard shared by both tick paths: if this
+// process is not the active owner, do nothing. The runtime should only have
+// started this queue on the owner path, but an ownership hand-off can briefly
+// leave two processes both ticking — this short-circuits that window. This is
+// multi-process active-owner gating, not HTTP authentication.
+// Fail closed: a probe exception must NOT be treated as ownership.
+// Duplicate-owner queue ticks are exactly what this guard prevents.
+// Module-scope on purpose: both tick paths run this exact guard, never a
+// dispatched override.
+function ownerTickAllowed(queue, what) {
+  if (!queue.ownerGetter) return true;
+  let isOwner = false;
+  try { isOwner = !!queue.ownerGetter(); } catch { isOwner = false; }
+  if (!isOwner) {
+    if (!queue.ownerSkipLogged) {
+      logEvent(`queue: skipping ${what} — not owner`);
+      queue.ownerSkipLogged = true;
+    }
+    return false;
+  }
+  queue.ownerSkipLogged = false;
+  return true;
+}
 class EventQueue {
   config;
   channelId;
@@ -127,25 +150,7 @@ class EventQueue {
     if (this._processQueueRunning) return;
     this._processQueueRunning = true;
     try {
-      // Belt-and-suspenders ownership guard: if this process is not the
-      // active owner, do nothing. The runtime should only have started this
-      // queue on the owner path, but an ownership hand-off can briefly leave
-      // two processes both ticking — this short-circuits that window.
-      // This is multi-process active-owner gating, not HTTP authentication.
-      if (this.ownerGetter) {
-        // Fail closed: a probe exception must NOT be treated as ownership.
-        // Duplicate-owner queue ticks are exactly what this guard prevents.
-        let isOwner = false;
-        try { isOwner = !!this.ownerGetter(); } catch { isOwner = false; }
-        if (!isOwner) {
-          if (!this.ownerSkipLogged) {
-            logEvent("queue: skipping tick — not owner");
-            this.ownerSkipLogged = true;
-          }
-          return;
-        }
-        this.ownerSkipLogged = false;
-      }
+      if (!ownerTickAllowed(this, "tick")) return;
       const files = this.readQueueFiles();
       if (files.length === 0) return;
       for (const file of files) {
@@ -167,24 +172,7 @@ class EventQueue {
     }
   }
   processBatch() {
-    // Belt-and-suspenders ownership guard: if this process is not the
-    // active owner, do nothing. The runtime should only have started this
-    // queue on the owner path, but an ownership hand-off can briefly leave
-    // two processes both ticking — this short-circuits that window.
-    // This is multi-process active-owner gating, not HTTP authentication.
-    if (this.ownerGetter) {
-      // Fail closed: a probe exception must NOT be treated as ownership.
-      let isOwner = false;
-      try { isOwner = !!this.ownerGetter(); } catch { isOwner = false; }
-      if (!isOwner) {
-        if (!this.ownerSkipLogged) {
-          logEvent("queue: skipping batch tick — not owner");
-          this.ownerSkipLogged = true;
-        }
-        return;
-      }
-      this.ownerSkipLogged = false;
-    }
+    if (!ownerTickAllowed(this, "batch tick")) return;
     const files = this.readQueueFiles();
     const lowFiles = files.filter((f) => {
       const item = this.readItem(f);
@@ -312,14 +300,36 @@ ${p.item.prompt}`).join("\n\n")}`;
     }
   }
   readItem(file) {
+    let raw;
     try {
-      return JSON.parse(readFileSync(join(QUEUE_DIR, file), "utf8"));
+      raw = readFileSync(join(QUEUE_DIR, file), "utf8");
     } catch (err) {
-      if (err.code !== "ENOENT") {
-        logEvent(`queue: corrupt file ${file}`);
-      }
+      if (err?.code === "ENOENT") return null;
+      // An IO fault (EACCES/EBUSY/EMFILE/EIO…) says nothing about the record
+      // itself — the bytes may be perfectly valid. Leave it queued for the next
+      // tick instead of dead-lettering a live event.
+      logEvent(`queue: read failed for ${file}: ${err?.message ?? err}`);
+      return null;
+    }
+    let item;
+    try {
+      item = JSON.parse(raw);
+    } catch (err) {
+      // Corrupt bytes can never execute, and leaving them in queue/ made every
+      // tick re-read the same poison file forever. Quarantine under processed/
+      // so the payload stays inspectable and the queue moves on.
+      logEvent(`queue: corrupt file ${file} — quarantined: ${err?.message ?? err}`);
+      this.moveToProcessed(file, "corrupt");
+      return null;
+    }
+    if (!item || typeof item !== "object" || Array.isArray(item)) {
+      // Parses, but is not an event record (null / scalar / array): the same
+      // dead end as corrupt bytes, so it is quarantined rather than retried.
+      logEvent(`queue: invalid record ${file} — quarantined`);
+      this.moveToProcessed(file, "corrupt");
       return null;
     }
+    return item;
   }
   // Atomically rename from queue/ to in-progress/. Returns the new
   // filename on success, or null if another worker already claimed it /

package/src/runtime/channels/lib/scheduler.mjs

@@ -87,6 +87,27 @@ function validateCronExpression(time) {
   }
   if (!valid) throw new Error(`invalid cron expression "${time}": failed node-cron validation. Legacy formats (HH:MM, everyNm, hourly, daily) are no longer supported — use a cron expression instead.`);
 }
+// Scheduler teardown: stop ticking, destroy the cron jobs and release the
+// scheduler lock so a subsequent start() in the same process can re-acquire it.
+// Without the release, the wx-create in start() hits its own live lock
+// (matching INSTANCE_UUID + recent mtime) and refuses to register cron jobs,
+// leaving the scheduler silently idle after a reload/restart cycle.
+// Read-verify-then-unlink so we don't delete another live owner's lock file
+// (mirrors memory releaseLock and the exit handler). Module-scope on purpose:
+// stop() and restart() both run this exact teardown, never a dispatched
+// override.
+function releaseSchedulerRuntime(scheduler) {
+  if (scheduler.tickTimer) {
+    clearInterval(scheduler.tickTimer);
+    scheduler.tickTimer = null;
+  }
+  scheduler.destroyCronJobs();
+  try {
+    const content = readFileSync(Scheduler.SCHEDULER_LOCK, "utf8");
+    const lockedPid = parseInt(content.split("\n")[0]);
+    if (lockedPid === process.pid) unlinkSync(Scheduler.SCHEDULER_LOCK);
+  } catch {}
+}
 class Scheduler {
   nonInteractive;
   interactive;
@@ -417,22 +438,7 @@ ${Scheduler.INSTANCE_UUID}`;
     }
   }
   stop() {
-    if (this.tickTimer) {
-      clearInterval(this.tickTimer);
-      this.tickTimer = null;
-    }
-    this.destroyCronJobs();
-    // Release the scheduler lock so a subsequent start() in the same
-    // process can re-acquire it. Without this, the wx-create in start()
-    // hits its own live lock (matching INSTANCE_UUID + recent mtime) and
-    // refuses to register cron jobs, leaving the scheduler silently idle
-    // after a reload/restart cycle. Read-verify-then-unlink so we don't
-    // delete another live owner's lock file (mirrors memory releaseLock).
-    try {
-      const content = readFileSync(Scheduler.SCHEDULER_LOCK, "utf8");
-      const lockedPid = parseInt(content.split("\n")[0]);
-      if (lockedPid === process.pid) unlinkSync(Scheduler.SCHEDULER_LOCK);
-    } catch {}
+    releaseSchedulerRuntime(this);
   }
   destroyCronJobs() {
     for (const [, task] of this.cronJobs) {
@@ -542,18 +548,7 @@ ${Scheduler.INSTANCE_UUID}`;
     }
   }
   restart() {
-    if (this.tickTimer) {
-      clearInterval(this.tickTimer);
-      this.tickTimer = null;
-    }
-    this.destroyCronJobs();
-    // Read-verify-then-unlink so a non-owner reload can't delete the
-    // live owner's lock file (mirrors stop() and the exit handler).
-    try {
-      const content = readFileSync(Scheduler.SCHEDULER_LOCK, "utf8");
-      const lockedPid = parseInt(content.split("\n")[0]);
-      if (lockedPid === process.pid) unlinkSync(Scheduler.SCHEDULER_LOCK);
-    } catch {}
+    releaseSchedulerRuntime(this);
     this.start();
   }
   reloadConfig(nonInteractive, interactive, channelId, options = {}) {

package/src/runtime/channels/lib/voice-runtime-fetcher.mjs

@@ -40,22 +40,10 @@ import { createGunzip } from 'zlib'
 import { renameWithRetrySync, writeFileAtomicSync } from '../../shared/atomic-file.mjs'
 import { streamResponseToFile } from '../../shared/bounded-download.mjs'
 import { windowsProgramRoots, windowsSystemRoot } from '../../agent/orchestrator/tools/builtin/windows-roots.mjs'
-import { detectDeviceLanguage, normalizeWhisperLanguage } from './whisper-language.mjs'
-
-// Model catalog: `models.standard` / `models.korean` in the manifest, with the
-// legacy single `model` section as the standard fallback for older manifests.
-// Selection: explicit voice.model config wins; 'auto' picks the Korean
-// fine-tune only when the device language resolves to Korean.
-export function selectVoiceModelId(voiceConfig = null) {
-  const pref = String(voiceConfig?.model || 'auto').trim().toLowerCase()
-  if (pref === 'standard' || pref === 'korean') return pref
-  // voice.language is the strongest auto signal: Node's ICU default locale
-  // often resolves to en-US even on a Korean Windows install, so an explicit
-  // transcription language wins over device-locale detection.
-  const configured = normalizeWhisperLanguage(voiceConfig?.language)
-  if (configured === 'ko') return 'korean'
-  if (configured) return 'standard'
-  return detectDeviceLanguage() === 'ko' ? 'korean' : 'standard'
+// The standard multilingual model is the only managed model. Legacy
+// voice.model values are accepted by callers but converge here.
+export function selectVoiceModelId() {
+  return 'standard'
 }
 
 function manifestModelEntry(manifest, modelId = 'standard') {
@@ -624,7 +612,8 @@ function resolveManagedWhisperModelForId(manifest, dataDir, modelId) {
 }
 
 // Clean-install policy: the models dir holds ONLY filenames declared by the
-// current manifest (standard/korean). Anything else — the pre-Q8 F16 weight,
+// current manifest. Anything else — the pre-Q8 F16 weight or retired
+// fine-tunes,
 // interrupted renames, hand-copied experiments — is deleted so a model swap
 // never leaves a 1.6GB orphan behind and resolution never silently falls back
 // to a stale weight.

package/src/runtime/channels/lib/voice-runtime-fetcher.test.mjs

@@ -0,0 +1,17 @@
+import assert from 'node:assert/strict'
+import { readFile } from 'node:fs/promises'
+import test from 'node:test'
+
+import { selectVoiceModelId } from './voice-runtime-fetcher.mjs'
+
+test('managed voice always uses the standard multilingual model', () => {
+  assert.equal(selectVoiceModelId(), 'standard')
+  assert.equal(selectVoiceModelId({ model: 'korean', language: 'ko' }), 'standard')
+})
+
+test('voice manifest contains no language-specific model', async () => {
+  const manifestPath = new URL('../data/voice-runtime-manifest.json', import.meta.url)
+  const manifest = JSON.parse(await readFile(manifestPath, 'utf8'))
+  assert.deepEqual(Object.keys(manifest.models), ['standard'])
+  assert.equal(manifest.models.standard.id, 'large-v3-turbo-q8_0')
+})

package/src/runtime/channels/lib/webhook.mjs

@@ -9,6 +9,7 @@ import {
 } from "../../shared/webhooks-db.mjs";
 import {
   contentDeliveryId,
+  extractDeliveryId,
   buildHeadersSummary,
 } from "./webhook/deliveries.mjs";
 import { resolveHookRelayUrl, startHookTunnel } from "./webhook/relay-tunnel.mjs";
@@ -170,10 +171,17 @@ class WebhookServer {
       // Signature has accepted the raw bytes; decode to a UTF-8 string for
       // content-type / JSON / preview handling below.
       const body = rawBody.length === 0 ? "" : rawBody.toString("utf8");
-      // Signature schemes authenticate the body, not delivery-id headers.
-      // Claim by body digest so a captured valid body/signature cannot bypass
-      // dedup merely by changing x-request-id or x-github-delivery.
-      deliveryId = contentDeliveryId(rawBody);
+      // Claim identity = the sender's own delivery id BOUND to the digest of
+      // the authenticated body. Keying on the digest alone made dedup permanent
+      // per content: two legitimately distinct deliveries with an identical
+      // payload (a repeated ping, a re-run of the same job) were suppressed
+      // forever. Binding the id to the body still makes a replay of a captured
+      // body under its original delivery id a duplicate.
+      const bodyDigestId = contentDeliveryId(rawBody);
+      const sourceDeliveryId = extractDeliveryId(headers);
+      deliveryId = sourceDeliveryId
+        ? `${String(sourceDeliveryId).slice(0, 120)}:${bodyDigestId}`
+        : bodyDigestId;
       // Atomic claim + dedup in one step: INSERT ... ON CONFLICT DO NOTHING.
       // A concurrent duplicate POST of the same id loses the race
       // (claimed:false) and is rejected flat, so the first run is never
@@ -418,10 +426,16 @@ ${payload}
     // for the lifetime of the process and dedup keeps re-running
     // forever. 10 minutes covers the slowest handler run we ship.
     const DISPATCH_TIMEOUT_MS = 10 * 60 * 1000;
-    let timeoutHandle = null;
+    // Racing a bare timer against the dispatch promise reported failure while
+    // the run itself kept going: the delivery row was already `failed` when the
+    // late result arrived and flipped it again. The timeout now aborts the
+    // dispatch through a signal the dispatcher receives, and the first outcome
+    // to land is the only one that writes a terminal status.
+    const controller = new AbortController();
     const dispatchP = Promise.resolve(this.bridgeDispatch({
       model: model || null,
       prompt: fullPrompt,
+      signal: controller.signal,
       // Endpoint-scoped project/workflow (New-task parity): the webhook row's
       // cwd/workflow define the created session, not the worker's global cwd.
       cwd: extra.cwd || this.config?.cwd || null,
@@ -435,21 +449,26 @@ ${payload}
         event: headers["x-github-event"] || null,
       },
     }));
-    const timeoutP = new Promise((_, reject) => {
-      timeoutHandle = setTimeout(
-        () => reject(new Error(`bridge dispatch timed out after ${DISPATCH_TIMEOUT_MS}ms`)),
-        DISPATCH_TIMEOUT_MS,
-      );
-    });
-    Promise.race([dispatchP, timeoutP]).then(() => {
-      if (timeoutHandle) clearTimeout(timeoutHandle);
-      void updateDeliveryStatus(name, deliveryId, "done").catch((e) => logWebhook(`${name}: delivery status update failed: ${e?.message || e}`));
-      logWebhook(`${name}: webhook session run dispatched (id=${deliveryId})`);
-    }).catch((err) => {
-      if (timeoutHandle) clearTimeout(timeoutHandle);
-      void updateDeliveryStatus(name, deliveryId, "failed", { error: String(err?.message || err) }).catch(() => {});
-      logWebhook(`${name}: webhook session run failed: ${err?.message || err}`);
-    });
+    let settled = false;
+    const timeoutHandle = setTimeout(
+      () => controller.abort(new Error(`bridge dispatch timed out after ${DISPATCH_TIMEOUT_MS}ms`)),
+      DISPATCH_TIMEOUT_MS,
+    );
+    const finish = (status, fields, message) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timeoutHandle);
+      void updateDeliveryStatus(name, deliveryId, status, fields).catch((e) => logWebhook(`${name}: delivery status update failed: ${e?.message || e}`));
+      logWebhook(message);
+    };
+    controller.signal.addEventListener("abort", () => {
+      const reason = controller.signal.reason;
+      finish("failed", { error: String(reason?.message || reason) }, `${name}: webhook session run aborted: ${reason?.message || reason}`);
+    }, { once: true });
+    dispatchP.then(
+      () => finish("done", {}, `${name}: webhook session run dispatched (id=${deliveryId})`),
+      (err) => finish("failed", { error: String(err?.message || err) }, `${name}: webhook session run failed: ${err?.message || err}`),
+    );
     res.writeHead(202, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ status: "accepted", handler: "session", id: deliveryId }));
   }

package/src/runtime/channels/lib/whisper-server.mjs

@@ -53,6 +53,16 @@ const READY_POLL_MS = 250;          // TCP probe cadence
 const PROBE_CONNECT_MS = 1_000;     // per TCP-connect attempt
 const STOP_GRACE_MS = 5_000;        // SIGTERM → SIGKILL escalation window
 const INFERENCE_PATH = '/inference'; // whisper-server default --inference-path
+// Idle release. Without it ONE transcription pins the loaded model for the whole
+// host-process lifetime (measured: ~325 MB working set, ~2.1 GB commit with the
+// CUDA build) even when voice is never used again. Reclaim after an idle window;
+// the next ensureReady() rebuilds the SAME contract, so the only cost is one
+// model load. Mirrors the embedding worker's 5-minute window.
+// MIXDOG_WHISPER_IDLE_TIMEOUT_MS overrides; 0 disables the release entirely.
+const IDLE_TIMEOUT_MS = (() => {
+  const raw = Number(process.env.MIXDOG_WHISPER_IDLE_TIMEOUT_MS);
+  return Number.isFinite(raw) && raw >= 0 ? raw : 300_000;
+})();
 
 const STATE = Object.freeze({
   STOPPED: 'STOPPED',
@@ -73,6 +83,7 @@ const mgr = {
   startPromise: null,   // in-flight ensureReady() start
   inflight: new Set(),  // active transcribe AbortControllers
   logTail: '',          // recent stdout/stderr for diagnostics
+  idleTimer: null,      // armed only while READY with nothing in flight
 };
 
 function runtimeKeyOf({ serverCmd, modelPath, threadCount, host }) {
@@ -244,9 +255,35 @@ function detachChildHandlers() {
   try { mgr.child.stderr?.removeAllListeners(); } catch {}
 }
 
+function clearIdleTimer() {
+  if (!mgr.idleTimer) return;
+  clearTimeout(mgr.idleTimer);
+  mgr.idleTimer = null;
+}
+
+// Arm ONLY from a resting READY state with nothing in flight, and re-check that
+// same condition when the timer fires: a transcription accepted in between must
+// never have the model pulled out from under it. The timer is unref'd — an idle
+// whisper-server can never keep its host process alive.
+function armIdleTimer() {
+  clearIdleTimer();
+  if (!IDLE_TIMEOUT_MS) return;
+  if (mgr.state !== STATE.READY || !mgr.child || mgr.inflight.size > 0) return;
+  mgr.idleTimer = setTimeout(() => {
+    mgr.idleTimer = null;
+    if (mgr.state !== STATE.READY || !mgr.child || mgr.inflight.size > 0) return;
+    mgr.state = STATE.STOPPING;
+    void teardown('idle-timeout')
+      .catch(() => {})
+      .finally(() => { mgr.state = STATE.STOPPED; });
+  }, IDLE_TIMEOUT_MS);
+  mgr.idleTimer.unref?.();
+}
+
 // Deterministic teardown of the current child. Used both for STOPPING and for a
 // contract change. Escalates SIGTERM → SIGKILL after a grace window.
 async function teardown(reason) {
+  clearIdleTimer();
   const child = mgr.child;
   const pid = child?.pid;
   // Abort all in-flight transcribe requests first.
@@ -386,9 +423,11 @@ export async function ensureReady({ serverCmd, modelPath, threadCount, host = '1
   }
   const contract = { serverCmd, modelPath, threadCount, host };
   const key = runtimeKeyOf(contract);
+  clearIdleTimer();
 
   // Already READY on the same contract with a live child → done.
   if (mgr.state === STATE.READY && mgr.runtimeKey === key && mgr.child) {
+    armIdleTimer();
     return;
   }
   // A start is already in flight for the SAME contract → await it.
@@ -402,7 +441,11 @@ export async function ensureReady({ serverCmd, modelPath, threadCount, host = '1
     mgr.state = STATE.STOPPED;
   }
 
-  mgr.startPromise = startServer(contract).finally(() => { mgr.startPromise = null; });
+  mgr.startPromise = startServer(contract).finally(() => {
+    mgr.startPromise = null;
+    // A start that no transcription ever follows must not pin the model either.
+    armIdleTimer();
+  });
   return mgr.startPromise;
 }
 
@@ -418,6 +461,7 @@ export async function transcribe(wavPath, { language } = {}) {
   const host = mgr.host;
   const port = mgr.port;
   const ctrl = new AbortController();
+  clearIdleTimer();
   mgr.inflight.add(ctrl);
   try {
     const data = await fs.promises.readFile(wavPath);
@@ -463,6 +507,7 @@ export async function transcribe(wavPath, { language } = {}) {
     throw err;
   } finally {
     mgr.inflight.delete(ctrl);
+    armIdleTimer();
   }
 }
 

package/src/runtime/channels/lib/worker-main.mjs

@@ -264,7 +264,7 @@ function wireWebhookHandlers() {
   webhookServer.setEventPipeline(eventPipeline);
   // Webhook fires run as sessions (schedules parity); the Automations
   // session row is the only surface (channel relay retired).
-  webhookServer.setBridgeDispatch(async ({ prompt, model, cwd, workflow, attachments, delivery, context }) => {
+  webhookServer.setBridgeDispatch(async ({ prompt, model, cwd, workflow, attachments, delivery, context, signal }) => {
     const { runWebhookSession } = await import("../../shared/webhook-session-run.mjs");
     const run = await runWebhookSession({
       name: context?.endpoint || "webhook",
@@ -273,6 +273,8 @@ function wireWebhookHandlers() {
       workflow: workflow || null,
       attachments: attachments || null,
       delivery: delivery || null,
+      // Dispatch-timeout cancellation only works if the signal reaches the run.
+      signal: signal || null,
       prompt,
     });
     return run;

package/src/runtime/media/adapters/gemini-video.mjs

@@ -16,6 +16,14 @@ const BASE_URL = 'https://generativelanguage.googleapis.com/v1beta';
 const OMNI_TIMEOUT_MS = 600_000;
 const POLL_INTERVAL_MS = 8_000;
 const TOTAL_TIMEOUT_MS = 900_000;
+// Submission and each poll need their own ceiling: an unbounded request keeps
+// the 15-minute budget from ever starting (or ever ending).
+const REQUEST_TIMEOUT_MS = 60_000;
+
+function boundedSignal(signal, deadline, capMs = REQUEST_TIMEOUT_MS) {
+  const remaining = Math.max(1, deadline - Date.now());
+  return AbortSignal.any([signal, AbortSignal.timeout(Math.min(capMs, remaining))].filter(Boolean));
+}
 
 function isOmniModel(model) {
   return /omni/i.test(String(model || ''));
@@ -75,22 +83,27 @@ async function generateViaVeo({ model, prompt, options, references = [], signal,
   const duration = Math.trunc(Number(options?.duration) || 0);
   if ([4, 6, 8].includes(duration)) parameters.durationSeconds = duration;
 
+  // The budget starts at submission, not after it: a hung predictLongRunning
+  // POST used to run without any ceiling of its own.
+  const deadline = Date.now() + TOTAL_TIMEOUT_MS;
   const started = await fetch(`${BASE_URL}/models/${encodeURIComponent(model)}:predictLongRunning`, {
     method: 'POST',
     headers,
     body: JSON.stringify({ instances: [instance], parameters }),
-    signal,
+    signal: boundedSignal(signal, deadline),
   });
   if (!started.ok) throw upstreamError('Veo video', started.status, await started.text().catch(() => ''));
   const operation = await started.json();
   if (!operation?.name) throw mediaError('Veo returned no operation name', 'MEDIA_UPSTREAM_FAILED', 502);
 
-  const deadline = Date.now() + TOTAL_TIMEOUT_MS;
   for (;;) {
     if (signal?.aborted) throw mediaError('canceled', 'MEDIA_CANCELED', 499);
     if (Date.now() > deadline) throw mediaError('Veo poll budget exceeded', 'MEDIA_TIMEOUT', 504);
     await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
-    const poll = await fetch(`${BASE_URL}/${operation.name}`, { headers, signal });
+    const poll = await fetch(`${BASE_URL}/${operation.name}`, {
+      headers,
+      signal: boundedSignal(signal, deadline),
+    });
     if (!poll.ok) throw upstreamError('Veo poll', poll.status, await poll.text().catch(() => ''));
     const data = await poll.json();
     if (!data?.done) {
@@ -107,7 +120,10 @@ async function generateViaVeo({ model, prompt, options, references = [], signal,
     const uri = sample?.video?.uri || sample?.video?.fileUri;
     if (!uri) throw mediaError('Veo finished without a video URI', 'MEDIA_EMPTY_RESULT', 502);
     return {
-      bytes: await downloadGeminiMedia(uri, { key, signal }),
+      // The download is part of the generation budget: unbounded, it held an
+      // active job slot (and the upstream connection) open indefinitely after
+      // the poll loop finished.
+      bytes: await downloadGeminiMedia(uri, { key, signal: boundedSignal(signal, deadline, TOTAL_TIMEOUT_MS) }),
       mime: 'video/mp4',
     };
   }

package/src/runtime/media/jobs.mjs

@@ -16,6 +16,10 @@ const JOBS = new Map();
 // terminal state, then drop out to bound memory.
 const TERMINAL_TTL_MS = 10 * 60_000;
 const MAX_PROMPT_CHARS = 8_000;
+// Video lanes hold an upstream slot for minutes each. Without a ceiling a
+// caller can start unbounded concurrent generations, each pinning provider
+// quota and a poll loop for its whole budget.
+const MAX_ACTIVE_JOBS = Math.max(1, Number(process.env.MIXDOG_MEDIA_MAX_ACTIVE_JOBS) || 4);
 
 function snapshot(job) {
   return {
@@ -84,6 +88,15 @@ export function startMediaJob({ lane: laneId, kind, model, prompt, options = {},
     .slice(0, maxRefs)
     .map((ref) => ({ base64: ref.base64, mime: String(ref.mime || 'image/png') }));
   sweep();
+  let active = 0;
+  for (const entry of JOBS.values()) if (entry.status === 'running') active += 1;
+  if (active >= MAX_ACTIVE_JOBS) {
+    throw mediaError(
+      `too many media generations are already running (${active}/${MAX_ACTIVE_JOBS})`,
+      'MEDIA_TOO_MANY_JOBS',
+      429,
+    );
+  }
 
   const controller = new AbortController();
   const job = {

package/src/runtime/media/renditions.mjs

@@ -90,7 +90,13 @@ function renditionPath(cacheDir, variant, id, extension) {
 function cachedRendition(cacheDir, variant, id) {
   for (const [extension, mime] of Object.entries(EXTENSION_MIME)) {
     const path = renditionPath(cacheDir, variant, id, extension);
-    if (existsSync(path)) return { path, mime, bytes: statSync(path).size };
+    // stat IS the existence check: a separate existsSync leaves a window in
+    // which concurrent pruning unlinks the file between the two calls, turning
+    // a plain cache miss into a thrown media request.
+    try {
+      const info = statSync(path);
+      if (info.isFile()) return { path, mime, bytes: info.size };
+    } catch { /* absent or evicted mid-lookup */ }
   }
   return null;
 }