fix!: project review fixes and owner decisions for 0.3.0

[Systerr]

Fixes from the 2026-10-05 project review, plus the decisions made after it, for release 0.3.0. Two commits:

1. fix: findings of the 2026-10-05 project review
2. feat!: SVG rendered in a separate process, the original never served, one preview row per identity, one task queue per backend

Docs-site counterpart: adaptivestone/framework-documentation#23 (stacked on #22 there).

What changes for a host

• Pipelines: an unregistered pipeline name is refused everywhere (RESIZE_PIPELINE_UNKNOWN). Register a new or renamed pipeline in the worker before the API requests it.
• Formats: per-call formats, and formats added by a beforeEnqueue hook, must be keys of encode.formats (RESIZE_FORMAT_NOT_CONFIGURED).
• The original is never served: resolve() returns only stored previews. ReadyEntry.isOriginal and ResizeStorage.canServeOriginalPublicly are removed. A raster original no larger than a requested WxH box gets a preview at its own size with metadata removed; a pipeline with variantSteps keeps the full box.
• SVG: rendered once per task into a PNG in a child Node process, killed at limits.processingTimeoutSeconds; beforeSteps receive the PNG. New codes RESIZE_SVG_RENDER_TIMEOUT (dead-lettered at once), RESIZE_SVG_RENDER_FAILED, RESIZE_SVG_RENDER_UNAVAILABLE.
• Media model: preview rows have an identity field (in resizeMediaSchemaFragment); the database stores one row per identity. verify() reports a model without it (RESIZE_MONGO_MEDIA_MODEL_OUTDATED).
• ResizeTask collection: new field availableAt; index { queue, status, availableAt } replaces { queue, status, createdAt }. Create the new index with the deploy, then drop the old one. An ejected model must add the field and the index.
• Queue: one task queue per backend in the framework adapter, so several Resizers run one worker loop; different timing in config files that share a queue is RESIZE_CONFIG_QUEUE_TIMING_CONFLICT. After a dead-letter, the task's previews are not queued again for lockTtlMs.failed (default 10 minutes). A task stopped by a worker shutdown goes back to the queue without a failed attempt (new optional TaskQueue.release()).
• Worker: npm run cli ResizeWorker -- --config=<name>; worker.concurrency in a framework config file is an error.
• Scaffold: the model shim imports from the new export …/framework/ResizeTaskModel.js, so npm run gen types getModel('ResizeTask'); --check reports an old shim and an outdated ejected model.
• Images: animated: true works (WebP and GIF, pipelines without variantSteps); width-only and height-only sizes respect limits.resultDimension; EXIF-rotated originals are not re-encoded before resizing; default JPEG quality is 88.
• Public surface: internal runtime exports are removed from the main entry and from …/framework.js (list in the CHANGELOG).

Everything is listed in CHANGELOG.md under # 0.3.0; host steps are in docs/host-adoption.md.

Checks

• types:check, check, build, smoke: pass
• npm test: 797 tests, 795 pass, 0 fail, 2 skipped (611 before this branch)
• The same on Node 24.18 with the minimum peers (framework 5.1.0, mongoose 9.0.0, AWS SDK 3.572.0): pass. A new CI job min-versions repeats this.
• End to end from the built package, run from another directory: SVG in 3 sizes × 3 formats with one render; a heavy SVG stopped at the 2 s limit with nothing stored; a 100×80 JPEG with EXIF requested at 300×300 gives 100×80 previews without EXIF.
• Each round was reviewed independently (Opus and Codex) and the findings fixed.

Known limits

• During the dead-letter cooldown prewarm() reports RESIZE_ENQUEUE_LOCK_CONTENDED (retryable), not a dedicated issue; a re-uploaded original under the same media id waits for the cooldown unless the host uses eager generate().
• A handler that finishes long after a task timeout can end that cooldown early.
• processTask is no longer exported, so there is no public way to process one externally delivered task (for example a Lambda SQS trigger); runWorker is the entry.
• On SQS a task given back at shutdown still counts the delivery.
• Preview rows written before this change have no identity and are not migrated.

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/node-test

The overall line coverage in commit 13d8a74 in the fix/review-2026-10-0... branch remains at 97%, unchanged from commit 0335e0a in the main branch.

Show a line coverage summary of the most impacted files.

File	main 0335e0a	fix/review-2026-10-0... 13d8a74	+/-
src/framework/database.ts	100%	99%	-1%
src/worker.ts	95%	94%	-1%
src/resizeTask.ts	96%	96%	0%
src/drivers/mongo/database.ts	99%	99%	0%
src/engine.ts	98%	99%	+1%
src/testHelpers/fakes.ts	93%	94%	+1%
src/queue.ts	96%	98%	+2%
src/helpers/imageFormat.ts	75%	89%	+14%
src/helpers/svgRaster.ts	0%	98%	+98%
src/helpers/svgRasterChild.ts	0%	100%	+100%