Stabilizing Worker Resilience and API Consistency

Worker Resilience and Concurrency

We've identified a critical race condition in the voice worker startup sequence. Currently, new workers unconditionally reset all 'processing' media files to 'pending' upon startup. When the autoscaler spins up new workers while others are still active, it causes in-flight files to be re-queued and processed multiple times. To fix this, I am introducing a lease-aware system. We will add claimed_by and lease_expires_at columns to the media_files table, ensuring that only expired leases are eligible for re-queuing.

Additionally, we need to address a major concurrency issue in image generation. The current implementation relies on module-level globals to store per-request state like init_img and face_restore. This causes cross-request contamination when multiple users hit the endpoint simultaneously. I will be refactoring this to use a GenContext dataclass bound to a ContextVar, following the pattern already established in the _dispatch_tier_var logic.

API Integrity and Fixes

On the API side, we are cleaning up several discrepancies between our documentation and actual behavior. The /v1/transcribe endpoint was returning empty segments and null languages because it was requesting the wrong format from the whisper server. I am updating the request to verbose_json and mapping the results to the documented schema.

We are also fixing a few routing and security issues:

• Route Shadowing: Moved literal paths for timeline and co-occurrences above the parameterized person_id route to prevent 422 errors.

• Shell Injection: Converting create_subprocess_shell to create_subprocess_exec in the image generation routes to prevent prompt-based command injection.\n- Timeout Management: Wrapping Forge transcription calls in per-item timeouts and reducing the batch size from 10 to 3 to prevent job timeouts.\n

Finally, I'm addressing the fact that streamed cloud calls were silently excluding provider and cost data from the request logs due to ContextVar propagation issues in anyio child tasks. We will move this metadata into the ASGI scope to ensure accurate usage tracking.