fix: reduce recording verification work and repeated transfers - #2232

Large recordings currently decode both the source and the remuxed output, and can repeat transfers after transient failures. This adds a preservation proof over encoded packet bytes, codec configuration and timing so compatible recordings need one complete output decode. The existing decoded-source verification remains the fallback for unsupported container timing. Actual packet changes and corrupt output still fail closed. The remux now explicitly preserves the stored final audio packet duration, avoiding FFmpeg nominal-duration substitution that otherwise forces the slow fallback. Audio metadata inspection runs in a bounded, cancellable subprocess; real blocked-file tests verify cancellation and deadline cleanup.

Pinned Drive downloads and remote output checksum reads resume from the last verified byte within a bounded attempt budget. Decode progress advances from real frames, stalled decoders are terminated, and worker logs record verification duration and method. Upload identity checks, ownership fences and publication receipts remain in place.

Validation:

• Scoped macOS tests: 163 passed, one opt-in performance test skipped; final affected-scope rerun: 121 passed, one skipped.
• Final scoped production-image Linux tests with networking disabled, two CPUs and 2 GB memory: 181 verification, route and media utility tests passed, including a real remux of the two-minute 1080p performance case (6.5 seconds for packet proof plus complete decode).
• Six complete cached production recordings passed remux, complete output decode and source-preservation checks in that Linux container; the 26.5-minute case completed in 44 seconds. Originals were mounted read-only. Separately, bounded beginning/end audio fragments from the large blocked recordings were downloaded directly from Drive to check final-packet preservation without retransferring their full videos.
• Scoped Biome, production-source TypeScript check and git diff check passed. The full media-server TypeScript configuration has four existing errors in untouched test files.

This changes only the media server; no PlanetScale migration or Vercel function changes are required. It does not add durable checkpoints across worker restarts. Production deployment and recovery of the remaining large recordings still need live verification after CI and review.

Greptile Summary

This PR reduces recording verification work by proving preservation of encoded packet content, codec configuration, and timing before performing one complete output decode. It also preserves terminal audio duration during remuxing, resumes interrupted transfers and checksum reads, bounds retries and decoder stalls, and improves verification progress and logging.

• Moves potentially stalled audio-tail inspection into a cancellable Bun subprocess.
• Preserves the final source audio packet duration during FFmpeg remuxing.
• Adds packet-level source-preservation verification with decoded-source fallback.
• Resumes Drive downloads and remote verification reads from verified offsets.
• Adds coverage for cancellation, malformed audio, transfer resumption, packet preservation, and error classification.

Confidence Score: 5/5

The PR appears safe to merge with no actionable new defects identified.

The latest changes replace potentially uninterruptible in-process audio inspection with a managed subprocess that is killed and joined on cancellation, while the supported Bun deployments retain and can execute the helper TypeScript file. The three previous findings were manually resolved without explanatory replies and therefore are not outstanding.

Important Files Changed

_{Reviews (5): Last reviewed commit: "fix: terminate stalled audio timing insp..." | Re-trigger Greptile}