What's temporary, what's forever.

What it does

An rm step on the success path of four workers. Every Stage-1 artifact gets removed seconds after the next pipeline step starts. No future code ever reads those files; Postgres holds whatever data downstream readers actually need. This is live in transcribe_audio.ts, analyze_visual.ts, fuse.ts, and analyze_intelligence.ts.

What gets deleted, when

Implementation

// workers/kinds/transcribe_audio.ts (tail, after success)
if (process.env.KEEP_PIPELINE_ARTIFACTS !== '1') {
  await rm(audioPath, { force: true });
  await rm(diarizationPath, { force: true });
}

// workers/kinds/analyze_visual.ts (tail)
if (process.env.KEEP_PIPELINE_ARTIFACTS !== '1') {
  await Promise.all([
    rm(framesOcrDir, { recursive: true, force: true }),
    rm(framesVlmDir, { recursive: true, force: true }),
    rm(ocrPath, { force: true }),
    rm(descriptionsPath, { force: true }),
    rm(ocrManifestPath, { force: true }),
    rm(vlmManifestPath, { force: true }),
  ]);
}

Same pattern in fuse.ts and analyze_intelligence.ts. KEEP_PIPELINE_ARTIFACTS=1 is the debugging escape hatch — set it when you want to ls frames_vlm/ to inspect what the VLM saw.

What it does

The worker kind archive_package (workers/kinds/archive_package.ts) runs on a schedule. For each package whose latest successful dispatch happened more than ARCHIVE_AFTER_DAYS ago AND that hasn't been archived yet, it sets packages.archived_at. The physical file move (original.mp4 + clips/ from MEDIA_ROOT to ARCHIVE_ROOT) only fires when this is the last unarchived package on its source — then it records the new location in sources.archive_path so any future re-render still resolves. The copy is cross-filesystem-safe: copy → verify size → delete, never a bare rename.

Trigger model

• Cadence: scripts/enqueue-recurring.ts runs daily (cron / launchd). It fans out one archive_package job per eligible package.
• Eligibility (the actual query): at least one dispatch with success = true, AND MAX(dispatched_at) < now() - interval '1 day' × ARCHIVE_AFTER_DAYS, AND packages.archived_at IS NULL.
• Idempotency: each archive job is keyed archive_package:{packageId}; reruns are no-ops (and the worker itself early-returns when archived_at is already set).
• External drive offline? The worker mkdirs the destination first; if that fails it throws, the queue backs off, and the next cycle retries. The source files stay on local until the copy verifies — no data-loss path.
• ARCHIVE_ROOT unset? The enqueuer skips archive entirely (feature disabled), and the worker defends against manual enqueues by early-returning.

Settings (live on the /settings page)

Two DB columns — migration 0007_archive_lifecycle.sql (applied)

ALTER TABLE sources  ADD COLUMN archive_path text;
ALTER TABLE packages ADD COLUMN archived_at timestamptz;
-- archive_path: clip_render's fallback for re-renders after the source moves
-- archived_at:  the audit timestamp + the eligibility gate (IS NULL)

Last-package-wins: which package triggers the move?

What it does

A 📼 Delete video button (behind a confirm) on the package page. deleteSourceVideo(packageId) removes original.mp4 (the whole local media dir) from MEDIA_ROOT — guarded — AND the archived copy from ARCHIVE_ROOT if Option B already moved it. It then nulls sources.local_media_path + sources.archive_path so re-renders refuse with a friendly "media deleted" error instead of an ENOENT crash.

It pairs naturally with Option B: archive after 14 days, then hard-delete operator-triggered when "I genuinely don't need this anymore." This is the on-demand escape hatch for purging a specific package's source for storage or sensitivity reasons.

What stays

• Every Postgres row (audit trail intact)
• Rendered clips (already published; live URL is the canonical artifact anyway)
• Transcript + scene_log + analysis (mirrored in Postgres)
• Thumbnails (already used at publish time)

What's lost forever

• The ability to re-render a Short with different settings (timeline trim, subtitle styling, etc.)
• The ability to re-run the visual pipeline (better VLM, different OCR settings)
• The audio for any future re-transcription

UX guards

A confirm step before the irreversible delete. After deletion, any future clip_render or Backlog-Revival re-run on the source fails cleanly with a "media deleted" error rather than crashing.