fix: bound processing transfers and bypass the Drive media proxy

[richiemcilroy]

Repeated recording processing can download the same Google Drive media through Vercel several times and continue across many attempts. Workers now receive authenticated descriptors for pinned Drive revisions, resume interrupted reads, reuse verified files, and reserve durable per-recording and daily transfer allowances before dispatch. New uploads retain normal concurrency while recovery work uses fewer slots. Size, identity, checksum, full decode, audio, and source timing checks remain enabled.

Production inventory analysis found that the initial daily default was too small. The final default is 512 GiB of conservative reservations; replaying 546 real recording sizes admitted all of them and produced the expected 103.12 GiB database counter. Six separate worker processes also stayed within shared limits under contention.

Validation: Linux AMD64 and ARM64 production container checks passed at the current head, including recording integrity and bounded-memory transfers over 2 GiB. The CI type check passed. A deployed preview route rejected bad credentials and changed identities, then served an authorized descriptor whose real Drive bytes matched the expected checksum. The isolated preview fixture, database credential and environment override were cleaned up. Earlier real-data tests covered three MP4s and a 71-part recording, including a cached replay with zero additional media downloads.

The additive media_processing_budgets table must reach production before the updated web workflow, and the web descriptor route must reach production before the updated worker. Coordinate the main-branch deployments in that order. Full rollout, no cohorting. Production has not been updated; post-release usage and billing verification remain.

Migration provenance: 0043_flimsy_caretaker.sql is checked-in Drizzle generator output from the schema change, not hand-edited SQL. The repository requires pnpm db:generate for schema changes while prohibiting direct edits to generated files. Re-running that command reports no schema changes. Independently regenerating from the base branch migration snapshots with Drizzle Kit 0.31.0 produces byte-identical SQL (SHA-256 9967ffb1a9ccaee6bfcbe2ed666965de29bbd07cdb1902bfe37a363f9e37d2f8). Migration-journal validation and the current CI typecheck pass.

Greptile Summary

This PR bounds recording-processing transfers, lets media workers download authenticated pinned Google Drive revisions directly, resumes interrupted downloads, reuses verified local files, introduces durable per-recording and daily transfer reservations, and reduces concurrency for recovery work.

• Adds authenticated Drive revision descriptors with identity, size, and checksum validation.
• Adds resumable, deduplicated, bounded-memory media transfers and local cache cleanup.
• Adds durable processing-budget accounting, expiry cleanup, and retry deferral when the daily allowance is exhausted.
• Adds recovery-specific worker admission limits and transfer-specific error handling.
• Adds the generated database migration and broad unit, integration, container, and workflow coverage.
• Clarifies that generated migration artifacts must be committed while hand-editing them remains prohibited.

Confidence Score: 5/5

The PR appears safe to merge, with no outstanding or newly introduced actionable findings identified in this re-review.

The latest change only clarifies the generated-file policy and introduces no code regression or rule violation. All four previous findings were manually resolved without explanatory replies and therefore are not outstanding.

Important Files Changed

Filename	Overview
apps/media-server/src/lib/media-transfer.ts	Implements authenticated, resumable, checksum-verified Drive transfers with per-job accounting, cross-job deduplication, cache retention, and cleanup.
apps/media-server/src/routes/video.ts	Integrates transfer limits and recovery priority into recording verification and segment muxing job lifecycles.
apps/web/lib/media-processing-budget.ts	Implements durable per-recording and daily transfer reservations with bounded cleanup.
apps/web/workflows/finalize-desktop-recording.ts	Reserves processing allowances before dispatch and leaves daily-budget exhaustion retryable.
apps/web/app/api/storage/object/route.ts	Returns authenticated descriptors for immutable Google Drive revision downloads.
packages/web-backend/src/Storage/GoogleDrive.ts	Adds pinned Drive revision metadata and authorization needed for direct worker downloads.
packages/database/schema.ts	Defines the durable media-processing budget table used for distributed transfer admission.
packages/database/migrations/0043_flimsy_caretaker.sql	Adds the generated media-processing budget migration artifact.
AGENTS.md	Clarifies that generated database migration artifacts must be committed but never hand-edited.

_{Reviews (4): Last reviewed commit: "docs: clarify required generated migrati..." | Re-trigger Greptile}

Context used (3)

• Knowledge Base — Media server and web-cluster runtime services
• Knowledge Base — Database schema and migrations
• Knowledge Base — Roll Back paid SAML SSO before enabling the Drive verification rollout

[richiemcilroy]

hey @greptileai, please re-review the PR

[richiemcilroy]

hey @greptileai, please re-review the PR

[richiemcilroy]

hey @greptileai, please re-review the PR