.gitea/workflows: Prefer job GITEA_TOKEN

Release Tag was publishing via secrets.RELEASE_TOKEN, a long-lived
PAT. Prefer the job built-in token with contents: write, matching the
vulture GoReleaser path: set GITEA_TOKEN and GITHUB_TOKEN from
secrets.GITEA_TOKEN and force GoReleaser onto the Gitea token.

Link: #9

.gitea/workflows/release-tag.yaml

@@ -7,6 +7,8 @@ on:
 jobs:
   release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@main
         with:
@@ -21,4 +23,6 @@ jobs:
           version: 'latest'
           args: release
         env:
-          GITEA_TOKEN: ${{secrets.RELEASE_TOKEN}}     
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GORELEASER_FORCE_TOKEN: gitea

.gitea/workflows/test-pr.yaml

@@ -1,16 +1,19 @@
-name: PR Check
+name: CI
 on:
-  - pull_request
+  pull_request:
+  push:
+    branches:
+      - master
 
 jobs:
   check-and-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@main
-      - uses: actions/setup-go@main
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
         with:
           go-version-file: 'go.mod'
       - uses: FedericoCarboni/setup-ffmpeg@v3
       - run: go mod tidy
       - run: go build ./...
-      - run: go test -race -v -shuffle=on ./...
+      - run: go test -race -v -shuffle=on ./...

CONTRIBUTING.md

@@ -0,0 +1,40 @@
+# Contributing
+
+## Propose changes
+
+Open a pull request against `develop`. Keep the default branch for releases and
+stable tips; land work on `develop` first.
+
+Point at an existing issue when one fits. Prefer a short issue that states the
+symptom or request before a large PR.
+
+## Commits
+
+Subject form:
+
+```
+area: Imperative summary
+```
+
+- **Area** is a real package, directory, or subsystem token (`ci:`, `docs:`,
+  Go package name). Not a lone filename.
+- **Imperative** mood: Fix, Add, Remove — not "Fixed" or "This patch…".
+- No trailing period. Aim ≤ ~70–75 characters for the whole subject.
+- Not conventional-commits (`feat:` / `fix:` / `chore:` as types).
+
+Body explains **why**. Establish the problem, then say what you are doing.
+One logical change per commit; split fix and cleanup.
+
+## Pull requests
+
+Title matches the primary commit subject.
+
+- **What** changed
+- **Why** (problem and impact)
+- **Test** (concrete steps; "CI green" alone is weak)
+
+## Issues and closing
+
+Cite leftover issues by **full URL**. Gitea closes issues when `#N` appears in
+merge text, so do not put `#N` in the merge message unless that issue is actually
+done. Use `Fixes #N` / `Closes #N` only when the leftover work is finished.

Makefile

@@ -27,7 +27,19 @@ cleanup: cleanup-manager cleanup-runner
 run: cleanup build init-test
 	@echo "Starting manager and runner in parallel..."
 	@echo "Press Ctrl+C to stop both..."
-	@trap 'kill $$MANAGER_PID $$RUNNER_PID 2>/dev/null; exit' INT TERM; \
+	@MANAGER_PID=""; RUNNER_PID=""; INTERRUPTED=0; \
+	cleanup() { \
+		exit_code=$$?; \
+		trap - INT TERM EXIT; \
+		if [ -n "$$RUNNER_PID" ]; then kill -TERM "$$RUNNER_PID" 2>/dev/null || true; fi; \
+		if [ -n "$$MANAGER_PID" ]; then kill -TERM "$$MANAGER_PID" 2>/dev/null || true; fi; \
+		if [ -n "$$MANAGER_PID$$RUNNER_PID" ]; then wait $$MANAGER_PID $$RUNNER_PID 2>/dev/null || true; fi; \
+		if [ "$$INTERRUPTED" -eq 1 ]; then exit 0; fi; \
+		exit $$exit_code; \
+	}; \
+	on_interrupt() { INTERRUPTED=1; cleanup; }; \
+	trap on_interrupt INT TERM; \
+	trap cleanup EXIT; \
 	bin/jiggablend manager -l manager.log & \
 	MANAGER_PID=$$!; \
 	sleep 2; \
@@ -43,16 +55,17 @@ run-manager: cleanup-manager build init-test
 run-runner: cleanup-runner build
 	bin/jiggablend runner -l runner.log --api-key=jk_r0_test_key_123456789012345678901234567890
 
-# Initialize for testing (first run setup)
+# Initialize for testing (local development only — never use these secrets in production)
 init-test: build
-	@echo "Initializing test configuration..."
+	@echo "Initializing LOCAL TEST configuration (not for production)..."
 	bin/jiggablend manager config enable localauth
 	bin/jiggablend manager config set fixed-apikey jk_r0_test_key_123456789012345678901234567890 -f -y
 	bin/jiggablend manager config add user test@example.com testpassword --admin -f -y
-	@echo "Test configuration complete!"
+	@echo "Test configuration complete (LOCAL DEV ONLY)!"
 	@echo "fixed api key: jk_r0_test_key_123456789012345678901234567890"
 	@echo "test user: test@example.com"
 	@echo "test password: testpassword"
+	@echo "WARNING: fixed API keys are refused when production_mode is enabled."
 
 # Clean bin build artifacts
 clean-bin:

README.md

@@ -30,7 +30,7 @@ Both manager and runner are part of a single binary (`jiggablend`) with subcomma
 ## Prerequisites
 
 ### Manager
-- Go 1.25.4 or later
+- Go 1.27.0 or later
 - SQLite (via Go driver)
 - Blender installed and in PATH (for metadata extraction)
 - ImageMagick installed (for EXR preview conversion)
@@ -154,10 +154,27 @@ bin/jiggablend runner --api-key <your-api-key>
 # With custom options
 bin/jiggablend runner --manager http://localhost:8080 --name my-runner --api-key <key> --log-file runner.log
 
+# Hardware compatibility flag (force CPU)
+bin/jiggablend runner --api-key <key> --force-cpu-rendering
+
+# Sandbox Blender with rootless Podman (default; contains job Python/addons; manager I/O stays in the runner)
+# podman (default) | none (host Blender, no container)
+bin/jiggablend runner --api-key <key>                    # sandbox=podman by default
+bin/jiggablend runner --api-key <key> --sandbox none     # disable sandbox
+# Optional: allow network inside the jail (default off)
+# bin/jiggablend runner --api-key <key> --sandbox-network
+
 # Using environment variables
 JIGGABLEND_MANAGER=http://localhost:8080 JIGGABLEND_API_KEY=<key> bin/jiggablend runner
 ```
 
+### Blender sandbox notes
+
+- **Blender versions** are still the manager-served Linux tarballs on the host; they are **bind-mounted** into the container (no per-version Blender images).
+- **GPU**: host devices/libs are attached from detection (NVIDIA `/dev/nvidia*`, AMD `/dev/kfd`+`/dev/dri`+ROCm paths, Intel DRM). Requires the runner user to already have access to those devices on the host.
+- **podman**: rootless podman + default thin image `registry.fedoraproject.org/fedora-minimal:41` (override with `--sandbox-image`).
+
+
 ### Render Chunk Size Note
 
 For one heavy production scene/profile, chunked rendering (`frames 800-804` in one Blender process) was much slower than one-frame tasks:

cmd/jiggablend/cmd/manager.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"net/http"
 	"os/exec"
+	"path/filepath"
 	"strings"
 
 	"jiggablend/internal/auth"
@@ -151,7 +152,15 @@ func runManager(cmd *cobra.Command, args []string) {
 }
 
 func checkBlenderAvailable() error {
-	cmd := exec.Command("blender", "--version")
+	blenderPath, err := exec.LookPath("blender")
+	if err != nil {
+		return fmt.Errorf("failed to locate blender in PATH: %w", err)
+	}
+	blenderPath, err = filepath.Abs(blenderPath)
+	if err != nil {
+		return fmt.Errorf("failed to resolve blender path %q: %w", blenderPath, err)
+	}
+	cmd := exec.Command(blenderPath, "--version")
 	output, err := cmd.CombinedOutput()
 	if err != nil {
 		return fmt.Errorf("failed to run 'blender --version': %w (output: %s)", err, string(output))

cmd/jiggablend/cmd/managerconfig_test.go

@@ -0,0 +1,23 @@
+package cmd
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestGenerateAPIKey_Format(t *testing.T) {
+	key, prefix, hash, err := generateAPIKey()
+	if err != nil {
+		t.Fatalf("generateAPIKey failed: %v", err)
+	}
+	if !strings.HasPrefix(prefix, "jk_r") {
+		t.Fatalf("unexpected prefix: %q", prefix)
+	}
+	if !strings.HasPrefix(key, prefix+"_") {
+		t.Fatalf("key does not include prefix: %q", key)
+	}
+	if len(hash) != 64 {
+		t.Fatalf("expected sha256 hex hash length, got %d", len(hash))
+	}
+}
+

cmd/jiggablend/cmd/root_test.go

@@ -0,0 +1,16 @@
+package cmd
+
+import "testing"
+
+func TestRootCommand_HasKeySubcommands(t *testing.T) {
+	names := map[string]bool{}
+	for _, c := range rootCmd.Commands() {
+		names[c.Name()] = true
+	}
+	for _, required := range []string{"manager", "runner", "version"} {
+		if !names[required] {
+			t.Fatalf("expected subcommand %q to be registered", required)
+		}
+	}
+}
+

cmd/jiggablend/cmd/runner.go

@@ -37,6 +37,12 @@ func init() {
 	runnerCmd.Flags().String("log-level", "info", "Log level (debug, info, warn, error)")
 	runnerCmd.Flags().BoolP("verbose", "v", false, "Enable verbose logging (same as --log-level=debug)")
 	runnerCmd.Flags().Duration("poll-interval", 5*time.Second, "Job polling interval")
+	runnerCmd.Flags().Bool("force-cpu-rendering", false, "Force CPU rendering for all jobs (disables GPU rendering)")
+	runnerCmd.Flags().Bool("disable-rt", false, "Disable GPU ray tracing acceleration (HIPRT, OptiX, etc.)")
+	runnerCmd.Flags().Int("hip-gpu-sample-batch", 0, "Max samples per GPU render pass on gfx115x (0=disabled; merges batches into one EXR when >0)")
+	runnerCmd.Flags().String("sandbox", "podman", "Blender sandbox backend: podman (default; bind-mounts host Blender tarball + GPU devices) or none")
+	runnerCmd.Flags().Bool("sandbox-network", false, "Allow network inside the sandbox (default: isolated; manager I/O stays in the runner process)")
+	runnerCmd.Flags().String("sandbox-image", "", "Thin OS image for podman backend (default: fedora-minimal; Blender is not inside the image)")
 
 	// Bind flags to viper with JIGGABLEND_ prefix
 	runnerViper.SetEnvPrefix("JIGGABLEND")
@@ -51,6 +57,12 @@ func init() {
 	runnerViper.BindPFlag("log_level", runnerCmd.Flags().Lookup("log-level"))
 	runnerViper.BindPFlag("verbose", runnerCmd.Flags().Lookup("verbose"))
 	runnerViper.BindPFlag("poll_interval", runnerCmd.Flags().Lookup("poll-interval"))
+	runnerViper.BindPFlag("force_cpu_rendering", runnerCmd.Flags().Lookup("force-cpu-rendering"))
+	runnerViper.BindPFlag("disable_rt", runnerCmd.Flags().Lookup("disable-rt"))
+	runnerViper.BindPFlag("hip_gpu_sample_batch", runnerCmd.Flags().Lookup("hip-gpu-sample-batch"))
+	runnerViper.BindPFlag("sandbox", runnerCmd.Flags().Lookup("sandbox"))
+	runnerViper.BindPFlag("sandbox_network", runnerCmd.Flags().Lookup("sandbox-network"))
+	runnerViper.BindPFlag("sandbox_image", runnerCmd.Flags().Lookup("sandbox-image"))
 }
 
 func runRunner(cmd *cobra.Command, args []string) {
@@ -63,7 +75,12 @@ func runRunner(cmd *cobra.Command, args []string) {
 	logLevel := runnerViper.GetString("log_level")
 	verbose := runnerViper.GetBool("verbose")
 	pollInterval := runnerViper.GetDuration("poll_interval")
-
+	forceCPURendering := runnerViper.GetBool("force_cpu_rendering")
+	disableRT := runnerViper.GetBool("disable_rt")
+	hipGPUSampleBatch := runnerViper.GetInt("hip_gpu_sample_batch")
+	sandboxBackend := runnerViper.GetString("sandbox")
+	sandboxNetwork := runnerViper.GetBool("sandbox_network")
+	sandboxImage := runnerViper.GetString("sandbox_image")
 	var r *runner.Runner
 
 	defer func() {
@@ -112,13 +129,27 @@ func runRunner(cmd *cobra.Command, args []string) {
 	}
 
 	logger.Info("Runner starting up...")
+	if disableRT {
+		logger.Info("GPU ray tracing acceleration disabled (--disable-rt)")
+	}
+	if hipGPUSampleBatch > 0 {
+		logger.Infof("HIP GPU sample batching enabled: %d samples per pass", hipGPUSampleBatch)
+	}
+	logger.Infof("Blender sandbox backend: %s (network=%v)", sandboxBackend, sandboxNetwork)
 	logger.Debugf("Generated runner ID suffix: %s", runnerIDStr)
 	if logFile != "" {
 		logger.Infof("Logging to file: %s", logFile)
 	}
 
 	// Create runner
-	r = runner.New(managerURL, name, hostname)
+	r = runner.NewWithOptions(managerURL, name, hostname, runner.RunnerOptions{
+		ForceCPURendering: forceCPURendering,
+		DisableRT:         disableRT,
+		HipGPUSampleBatch: hipGPUSampleBatch,
+		SandboxBackend:    sandboxBackend,
+		SandboxNetwork:    sandboxNetwork,
+		SandboxImage:      sandboxImage,
+	})
 
 	// Check for required tools early to fail fast
 	if err := r.CheckRequiredTools(); err != nil {
@@ -161,6 +192,9 @@ func runRunner(cmd *cobra.Command, args []string) {
 		runnerID, err = r.Register(apiKey)
 		if err == nil {
 			logger.Infof("Registered runner with ID: %d", runnerID)
+			// Detect GPU vendors/backends from host hardware so we only force CPU for Blender < 4.x when using AMD.
+			logger.Info("Detecting GPU backends (AMD/NVIDIA/Intel) from host hardware for Blender < 4.x policy...")
+			r.DetectAndStoreGPUBackends()
 			break
 		}
 

cmd/jiggablend/cmd/runner_test.go

@@ -0,0 +1,17 @@
+package cmd
+
+import (
+	"encoding/hex"
+	"testing"
+)
+
+func TestGenerateShortID_IsHex8Bytes(t *testing.T) {
+	id := generateShortID()
+	if len(id) != 8 {
+		t.Fatalf("expected 8 hex chars, got %q", id)
+	}
+	if _, err := hex.DecodeString(id); err != nil {
+		t.Fatalf("id should be hex: %v", err)
+	}
+}
+

cmd/jiggablend/cmd/version_test.go

@@ -0,0 +1,13 @@
+package cmd
+
+import "testing"
+
+func TestVersionCommand_Metadata(t *testing.T) {
+	if versionCmd.Use != "version" {
+		t.Fatalf("unexpected command use: %q", versionCmd.Use)
+	}
+	if versionCmd.Run == nil {
+		t.Fatal("version command run function should be set")
+	}
+}
+

cmd/jiggablend/main_test.go

@@ -0,0 +1,8 @@
+package main
+
+import "testing"
+
+func TestMainPackage_Builds(t *testing.T) {
+	// Smoke test placeholder to keep package main under test compilation.
+}
+

go.mod

@@ -1,6 +1,6 @@
 module jiggablend
 
-go 1.25.4
+go 1.27.0
 
 require (
 	github.com/go-chi/chi/v5 v5.2.3

installer.sh

@@ -0,0 +1,130 @@
+#!/bin/bash
+
+set -euo pipefail
+
+# Install the latest jiggablend binary for Linux AMD64 and create wrapper scripts.
+# Production wrappers do NOT install fixed test secrets. For local test credentials,
+# use `make init-test` from a development checkout.
+
+# Dependencies: curl, jq, tar, sha256sum, sudo (for installation to /usr/local/bin)
+
+REPO="s1d3sw1ped/jiggablend"
+API_URL="https://git.s1d3sw1ped.com/api/v1/repos/${REPO}/releases/latest"
+ASSET_NAME="jiggablend-linux-amd64.tar.gz"
+
+echo "Fetching latest release information..."
+RELEASE_JSON=$(curl -s "$API_URL")
+
+TAG=$(echo "$RELEASE_JSON" | jq -r '.tag_name')
+echo "Latest version: $TAG"
+
+ASSET_URL=$(echo "$RELEASE_JSON" | jq -r ".assets[] | select(.name == \"$ASSET_NAME\") | .browser_download_url")
+if [ -z "$ASSET_URL" ]; then
+  echo "Error: Asset $ASSET_NAME not found in latest release."
+  exit 1
+fi
+
+CHECKSUM_URL=$(echo "$RELEASE_JSON" | jq -r '.assets[] | select(.name == "checksums.txt") | .browser_download_url')
+if [ -z "$CHECKSUM_URL" ]; then
+  echo "Error: checksums.txt not found in latest release."
+  exit 1
+fi
+
+echo "Downloading $ASSET_NAME..."
+curl -L -o "$ASSET_NAME" "$ASSET_URL"
+
+echo "Downloading checksums.txt..."
+curl -L -o "checksums.txt" "$CHECKSUM_URL"
+
+echo "Verifying checksum..."
+if ! sha256sum --ignore-missing --quiet -c checksums.txt; then
+  echo "Error: Checksum verification failed."
+  rm -f "$ASSET_NAME" checksums.txt
+  exit 1
+fi
+
+echo "Extracting..."
+tar -xzf "$ASSET_NAME"
+
+echo "Installing binary to /usr/local/bin (requires sudo)..."
+sudo install -m 0755 jiggablend /usr/local/bin/
+
+echo "Creating manager wrapper script..."
+cat << 'EOF' > jiggablend-manager.sh
+#!/bin/bash
+
+set -euo pipefail
+
+# Wrapper to run jiggablend manager.
+# Does NOT set fixed/test API keys or default admin passwords.
+# Bootstrap (one-time, local admin):
+#   jiggablend manager config enable localauth
+#   jiggablend manager config add user you@example.com 'strong-password' --admin
+#   jiggablend manager config add apikey my-runner --scope manager
+# For local development only: use `make init-test` from a source checkout.
+
+mkdir -p logs
+rm -f logs/manager.log
+
+jiggablend manager -l logs/manager.log
+EOF
+chmod +x jiggablend-manager.sh
+sudo install -m 0755 jiggablend-manager.sh /usr/local/bin/jiggablend-manager
+rm -f jiggablend-manager.sh
+
+echo "Creating runner wrapper script..."
+cat << 'EOF' > jiggablend-runner.sh
+#!/bin/bash
+
+set -euo pipefail
+
+# Wrapper to run jiggablend runner.
+# Usage: jiggablend-runner [MANAGER_URL] --api-key <key> [RUNNER_FLAGS...]
+# Or set JIGGABLEND_API_KEY. Default MANAGER_URL: http://localhost:8080
+
+MANAGER_URL="http://localhost:8080"
+if [[ $# -gt 0 && "$1" != -* ]]; then
+  MANAGER_URL="$1"
+  shift
+fi
+
+EXTRA_ARGS=("$@")
+
+API_KEY="${JIGGABLEND_API_KEY:-}"
+# Allow --api-key in EXTRA_ARGS; if not present and env empty, fail clearly
+HAS_KEY=0
+for arg in "${EXTRA_ARGS[@]+"${EXTRA_ARGS[@]}"}"; do
+  case "$arg" in
+    --api-key|--api-key=*|-k) HAS_KEY=1 ;;
+  esac
+done
+
+if [[ -z "$API_KEY" && "$HAS_KEY" -eq 0 ]]; then
+  echo "Error: provide a runner API key via JIGGABLEND_API_KEY or --api-key." >&2
+  echo "Create one with: jiggablend manager config add apikey <name> --scope manager" >&2
+  exit 1
+fi
+
+mkdir -p logs
+rm -f logs/runner.log
+
+if [[ -n "$API_KEY" && "$HAS_KEY" -eq 0 ]]; then
+  jiggablend runner -l logs/runner.log --api-key="$API_KEY" --manager "$MANAGER_URL" "${EXTRA_ARGS[@]+"${EXTRA_ARGS[@]}"}"
+else
+  jiggablend runner -l logs/runner.log --manager "$MANAGER_URL" "${EXTRA_ARGS[@]+"${EXTRA_ARGS[@]}"}"
+fi
+EOF
+chmod +x jiggablend-runner.sh
+sudo install -m 0755 jiggablend-runner.sh /usr/local/bin/jiggablend-runner
+rm -f jiggablend-runner.sh
+
+echo "Cleaning up..."
+rm -f "$ASSET_NAME" checksums.txt jiggablend
+
+echo "Installation complete!"
+echo "Binary: jiggablend"
+echo "Wrappers: jiggablend-manager, jiggablend-runner"
+echo "Run 'jiggablend-manager' to start the manager (no fixed test secrets)."
+echo "Run 'jiggablend-runner [url] --api-key <key>' to start a runner."
+echo "Local dev only: use 'make init-test' from a source checkout for test credentials."
+echo "Note: Blender, ImageMagick, or FFmpeg may be required. See README."

internal/auth/auth.go

@@ -45,6 +45,9 @@ type Auth struct {
 	sessionCache  map[string]*Session // In-memory cache for performance
 	cacheMu       sync.RWMutex
 	stopCleanup   chan struct{}
+	// oauthStates maps state token -> expiry for CSRF protection
+	oauthStates map[string]time.Time
+	oauthMu     sync.Mutex
 }
 
 // Session represents a user session
@@ -63,6 +66,7 @@ func NewAuth(db *database.DB, cfg *config.Config) (*Auth, error) {
 		cfg:          cfg,
 		sessionCache: make(map[string]*Session),
 		stopCleanup:  make(chan struct{}),
+		oauthStates:  make(map[string]time.Time),
 	}
 
 	// Initialize Google OAuth from database config
@@ -216,7 +220,9 @@ func (a *Auth) cleanupExpiredSessions() {
 
 // initializeSettings ensures all admin settings are initialized with defaults if they don't exist
 func (a *Auth) initializeSettings() error {
-	// Initialize registration_enabled setting (default: true) if it doesn't exist
+	// Default registration to false (safer for internet-facing boots). Admins enable via CLI/UI.
+	// In non-production, still default false — make init-test / CLI create the first admin.
+	defaultReg := "false"
 	var settingCount int
 	err := a.db.With(func(conn *sql.DB) error {
 		return conn.QueryRow("SELECT COUNT(*) FROM settings WHERE key = ?", "registration_enabled").Scan(&settingCount)
@@ -227,15 +233,15 @@ func (a *Auth) initializeSettings() error {
 	if settingCount == 0 {
 		err = a.db.With(func(conn *sql.DB) error {
 			_, err := conn.Exec(
-			`INSERT INTO settings (key, value, updated_at) VALUES (?, ?, CURRENT_TIMESTAMP)`,
-			"registration_enabled", "true",
-		)
+				`INSERT INTO settings (key, value, updated_at) VALUES (?, ?, CURRENT_TIMESTAMP)`,
+				"registration_enabled", defaultReg,
+			)
 			return err
 		})
 		if err != nil {
 			return fmt.Errorf("failed to initialize registration_enabled setting: %w", err)
 		}
-		log.Printf("Initialized admin setting: registration_enabled = true")
+		log.Printf("Initialized admin setting: registration_enabled = %s", defaultReg)
 	}
 	return nil
 }
@@ -303,12 +309,44 @@ func (a *Auth) initializeTestUser() error {
 	return nil
 }
 
+// CreateOAuthState mints a one-time OAuth state token and stores it until used or expired.
+func (a *Auth) CreateOAuthState() string {
+	state := uuid.New().String()
+	a.oauthMu.Lock()
+	// Opportunistic cleanup of expired states
+	now := time.Now()
+	for k, exp := range a.oauthStates {
+		if now.After(exp) {
+			delete(a.oauthStates, k)
+		}
+	}
+	a.oauthStates[state] = now.Add(10 * time.Minute)
+	a.oauthMu.Unlock()
+	return state
+}
+
+// ConsumeOAuthState validates and single-use-consumes an OAuth state token.
+// Returns false if missing, unknown, or expired.
+func (a *Auth) ConsumeOAuthState(state string) bool {
+	if state == "" {
+		return false
+	}
+	a.oauthMu.Lock()
+	defer a.oauthMu.Unlock()
+	exp, ok := a.oauthStates[state]
+	if !ok {
+		return false
+	}
+	delete(a.oauthStates, state)
+	return time.Now().Before(exp)
+}
+
 // GoogleLoginURL returns the Google OAuth login URL
 func (a *Auth) GoogleLoginURL() (string, error) {
 	if a.googleConfig == nil {
 		return "", fmt.Errorf("Google OAuth not configured")
 	}
-	state := uuid.New().String()
+	state := a.CreateOAuthState()
 	return a.googleConfig.AuthCodeURL(state), nil
 }
 
@@ -317,7 +355,7 @@ func (a *Auth) DiscordLoginURL() (string, error) {
 	if a.discordConfig == nil {
 		return "", fmt.Errorf("Discord OAuth not configured")
 	}
-	state := uuid.New().String()
+	state := a.CreateOAuthState()
 	return a.discordConfig.AuthCodeURL(state), nil
 }
 
@@ -390,8 +428,8 @@ func (a *Auth) IsRegistrationEnabled() (bool, error) {
 		return conn.QueryRow("SELECT value FROM settings WHERE key = ?", "registration_enabled").Scan(&value)
 	})
 	if err == sql.ErrNoRows {
-		// Default to enabled if setting doesn't exist
-		return true, nil
+		// Default to disabled if setting doesn't exist (safer bootstrap)
+		return false, nil
 	}
 	if err != nil {
 		return false, fmt.Errorf("failed to check registration setting: %w", err)
@@ -438,8 +476,9 @@ func (a *Auth) SetRegistrationEnabled(enabled bool) error {
 	return nil
 }
 
-// getOrCreateUser gets or creates a user in the database
-// Automatically links accounts by email across different OAuth providers and local login
+// getOrCreateUser gets or creates a user in the database.
+// Identity is (oauth_provider, oauth_id). Email collision with a different provider
+// is NOT auto-linked (prevents account takeover); the user must sign in with the original method.
 func (a *Auth) getOrCreateUser(provider, oauthID, email, name string) (*Session, error) {
 	var userID int64
 	var dbEmail, dbName string
@@ -449,18 +488,18 @@ func (a *Auth) getOrCreateUser(provider, oauthID, email, name string) (*Session,
 	// First, try to find by provider + oauth_id
 	err := a.db.With(func(conn *sql.DB) error {
 		return conn.QueryRow(
-		"SELECT id, email, name, is_admin, oauth_provider, oauth_id FROM users WHERE oauth_provider = ? AND oauth_id = ?",
-		provider, oauthID,
-	).Scan(&userID, &dbEmail, &dbName, &isAdmin, &dbProvider, &dbOAuthID)
+			"SELECT id, email, name, is_admin, oauth_provider, oauth_id FROM users WHERE oauth_provider = ? AND oauth_id = ?",
+			provider, oauthID,
+		).Scan(&userID, &dbEmail, &dbName, &isAdmin, &dbProvider, &dbOAuthID)
 	})
 
 	if err == sql.ErrNoRows {
-		// Not found by provider+oauth_id, check by email for account linking
+		// Not found by provider+oauth_id — check email only to refuse silent takeover
 		err = a.db.With(func(conn *sql.DB) error {
 			return conn.QueryRow(
-			"SELECT id, email, name, is_admin, oauth_provider, oauth_id FROM users WHERE email = ?",
-			email,
-		).Scan(&userID, &dbEmail, &dbName, &isAdmin, &dbProvider, &dbOAuthID)
+				"SELECT id, email, name, is_admin, oauth_provider, oauth_id FROM users WHERE email = ?",
+				email,
+			).Scan(&userID, &dbEmail, &dbName, &isAdmin, &dbProvider, &dbOAuthID)
 		})
 
 		if err == sql.ErrNoRows {
@@ -487,7 +526,7 @@ func (a *Auth) getOrCreateUser(provider, oauthID, email, name string) (*Session,
 			err = a.db.With(func(conn *sql.DB) error {
 				result, err := conn.Exec(
 					"INSERT INTO users (email, name, oauth_provider, oauth_id, is_admin) VALUES (?, ?, ?, ?, ?)",
-				email, name, provider, oauthID, isAdmin,
+					email, name, provider, oauthID, isAdmin,
 				)
 				if err != nil {
 					return err
@@ -501,19 +540,8 @@ func (a *Auth) getOrCreateUser(provider, oauthID, email, name string) (*Session,
 		} else if err != nil {
 			return nil, fmt.Errorf("failed to query user by email: %w", err)
 		} else {
-			// User exists with same email but different provider - link accounts by updating provider info
-			// This allows the user to log in with any provider that has the same email
-			err = a.db.With(func(conn *sql.DB) error {
-				_, err = conn.Exec(
-				"UPDATE users SET oauth_provider = ?, oauth_id = ?, name = ? WHERE id = ?",
-				provider, oauthID, name, userID,
-			)
-				return err
-			})
-			if err != nil {
-				return nil, fmt.Errorf("failed to link account: %w", err)
-			}
-			log.Printf("Linked account: user %d (email: %s) now accessible via %s provider", userID, email, provider)
+			// Email already belongs to another identity — do not overwrite oauth_provider/oauth_id
+			return nil, fmt.Errorf("an account with this email already exists; sign in with the original method")
 		}
 	} else if err != nil {
 		return nil, fmt.Errorf("failed to query user: %w", err)
@@ -522,9 +550,9 @@ func (a *Auth) getOrCreateUser(provider, oauthID, email, name string) (*Session,
 		if dbEmail != email || dbName != name {
 			err = a.db.With(func(conn *sql.DB) error {
 				_, err = conn.Exec(
-				"UPDATE users SET email = ?, name = ? WHERE id = ?",
-				email, name, userID,
-			)
+					"UPDATE users SET email = ?, name = ? WHERE id = ?",
+					email, name, userID,
+				)
 				return err
 			})
 			if err != nil {
@@ -652,20 +680,42 @@ func (a *Auth) DeleteSession(sessionID string) {
 	}
 }
 
-// IsProductionMode returns true if running in production mode
-// This is a package-level function that checks the environment variable
-// For config-based checks, use Config.IsProductionMode()
+// IsProductionMode returns true if running in production mode.
+// Prefer Config.IsProductionMode() / Auth.IsProductionModeFromConfig() for app logic.
+// This package-level helper still honors PRODUCTION=true for legacy callers.
 func IsProductionMode() bool {
-	// Check environment variable first for backwards compatibility
-	if os.Getenv("PRODUCTION") == "true" {
-		return true
-	}
-	return false
+	return os.Getenv("PRODUCTION") == "true"
 }
 
 // IsProductionModeFromConfig returns true if production mode is enabled in config
+// or via PRODUCTION=true environment variable (OR of both sources).
 func (a *Auth) IsProductionModeFromConfig() bool {
-	return a.cfg.IsProductionMode()
+	if a.cfg != nil && a.cfg.IsProductionMode() {
+		return true
+	}
+	return IsProductionMode()
+}
+
+func (a *Auth) writeUnauthorized(w http.ResponseWriter, r *http.Request) {
+	// Keep API behavior unchanged for programmatic clients.
+	if strings.HasPrefix(r.URL.Path, "/api/") {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusUnauthorized)
+		_ = json.NewEncoder(w).Encode(map[string]string{"error": "Unauthorized"})
+		return
+	}
+
+	// For HTMX UI fragment requests, trigger a full-page redirect to login.
+	if strings.EqualFold(r.Header.Get("HX-Request"), "true") {
+		w.Header().Set("HX-Redirect", "/login")
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusUnauthorized)
+		_ = json.NewEncoder(w).Encode(map[string]string{"error": "Unauthorized"})
+		return
+	}
+
+	// For normal browser page requests, redirect to login page.
+	http.Redirect(w, r, "/login", http.StatusFound)
 }
 
 // Middleware creates an authentication middleware
@@ -674,18 +724,14 @@ func (a *Auth) Middleware(next http.HandlerFunc) http.HandlerFunc {
 		cookie, err := r.Cookie("session_id")
 		if err != nil {
 			log.Printf("Authentication failed: missing session cookie for %s %s", r.Method, r.URL.Path)
-			w.Header().Set("Content-Type", "application/json")
-			w.WriteHeader(http.StatusUnauthorized)
-			json.NewEncoder(w).Encode(map[string]string{"error": "Unauthorized"})
+			a.writeUnauthorized(w, r)
 			return
 		}
 
 		session, ok := a.GetSession(cookie.Value)
 		if !ok {
 			log.Printf("Authentication failed: invalid session cookie for %s %s", r.Method, r.URL.Path)
-			w.Header().Set("Content-Type", "application/json")
-			w.WriteHeader(http.StatusUnauthorized)
-			json.NewEncoder(w).Encode(map[string]string{"error": "Unauthorized"})
+			a.writeUnauthorized(w, r)
 			return
 		}
 
@@ -717,18 +763,14 @@ func (a *Auth) AdminMiddleware(next http.HandlerFunc) http.HandlerFunc {
 		cookie, err := r.Cookie("session_id")
 		if err != nil {
 			log.Printf("Admin authentication failed: missing session cookie for %s %s", r.Method, r.URL.Path)
-			w.Header().Set("Content-Type", "application/json")
-			w.WriteHeader(http.StatusUnauthorized)
-			json.NewEncoder(w).Encode(map[string]string{"error": "Unauthorized"})
+			a.writeUnauthorized(w, r)
 			return
 		}
 
 		session, ok := a.GetSession(cookie.Value)
 		if !ok {
 			log.Printf("Admin authentication failed: invalid session cookie for %s %s", r.Method, r.URL.Path)
-			w.Header().Set("Content-Type", "application/json")
-			w.WriteHeader(http.StatusUnauthorized)
-			json.NewEncoder(w).Encode(map[string]string{"error": "Unauthorized"})
+			a.writeUnauthorized(w, r)
 			return
 		}
 

internal/auth/auth_test.go

@@ -0,0 +1,88 @@
+package auth
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"testing"
+	"time"
+)
+
+func TestContextHelpers(t *testing.T) {
+	ctx := context.Background()
+	ctx = context.WithValue(ctx, contextKeyUserID, int64(123))
+	ctx = context.WithValue(ctx, contextKeyIsAdmin, true)
+
+	id, ok := GetUserID(ctx)
+	if !ok || id != 123 {
+		t.Fatalf("GetUserID() = (%d,%v), want (123,true)", id, ok)
+	}
+	if !IsAdmin(ctx) {
+		t.Fatal("expected IsAdmin to be true")
+	}
+}
+
+func TestIsProductionMode_UsesEnv(t *testing.T) {
+	t.Setenv("PRODUCTION", "true")
+	if !IsProductionMode() {
+		t.Fatal("expected production mode true when env is set")
+	}
+}
+
+func TestWriteUnauthorized_BehaviorByRequestType(t *testing.T) {
+	a := &Auth{}
+
+	reqAPI := httptest.NewRequest(http.MethodGet, "/api/jobs", nil)
+	rrAPI := httptest.NewRecorder()
+	a.writeUnauthorized(rrAPI, reqAPI)
+	if rrAPI.Code != http.StatusUnauthorized {
+		t.Fatalf("api code = %d", rrAPI.Code)
+	}
+
+	reqPage := httptest.NewRequest(http.MethodGet, "/dashboard", nil)
+	rrPage := httptest.NewRecorder()
+	a.writeUnauthorized(rrPage, reqPage)
+	if rrPage.Code != http.StatusFound {
+		t.Fatalf("page code = %d", rrPage.Code)
+	}
+}
+
+func TestIsProductionMode_DefaultFalse(t *testing.T) {
+	_ = os.Unsetenv("PRODUCTION")
+	if IsProductionMode() {
+		t.Fatal("expected false when PRODUCTION is unset")
+	}
+}
+
+func TestOAuthState_CreateConsumeAndReject(t *testing.T) {
+	a := &Auth{oauthStates: make(map[string]time.Time)}
+	state := a.CreateOAuthState()
+	if state == "" {
+		t.Fatal("expected non-empty state")
+	}
+	if !a.ConsumeOAuthState(state) {
+		t.Fatal("expected valid state to be accepted once")
+	}
+	if a.ConsumeOAuthState(state) {
+		t.Fatal("expected state to be single-use")
+	}
+	if a.ConsumeOAuthState("") {
+		t.Fatal("empty state must be rejected")
+	}
+	if a.ConsumeOAuthState("unknown-state") {
+		t.Fatal("unknown state must be rejected")
+	}
+}
+
+func TestOAuthState_ExpiredRejected(t *testing.T) {
+	a := &Auth{oauthStates: make(map[string]time.Time)}
+	state := "expired-state"
+	a.oauthMu.Lock()
+	a.oauthStates[state] = time.Now().Add(-time.Minute)
+	a.oauthMu.Unlock()
+	if a.ConsumeOAuthState(state) {
+		t.Fatal("expired state must be rejected")
+	}
+}
+

internal/auth/jobtoken.go

@@ -7,11 +7,54 @@ import (
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
+	"sync"
 	"time"
 )
 
-// JobTokenDuration is the validity period for job tokens
-const JobTokenDuration = 1 * time.Hour
+// DefaultJobTokenDuration is the minimum validity period for job tokens.
+const DefaultJobTokenDuration = 1 * time.Hour
+
+// JobTokenSkew is extra lifetime added beyond configured task timeouts.
+const JobTokenSkew = 15 * time.Minute
+
+// JobTokenDuration is the current validity period for newly issued job tokens.
+// Prefer JobTokenTTL() / SetJobTokenTTL; this var remains for backward-compatible reads.
+var (
+	jobTokenTTL   = DefaultJobTokenDuration
+	jobTokenTTLMu sync.RWMutex
+)
+
+// JobTokenTTL returns the current job token lifetime used when minting tokens.
+func JobTokenTTL() time.Duration {
+	jobTokenTTLMu.RLock()
+	defer jobTokenTTLMu.RUnlock()
+	return jobTokenTTL
+}
+
+// SetJobTokenTTL sets the lifetime for newly issued job tokens.
+// Values below DefaultJobTokenDuration are raised to the default.
+func SetJobTokenTTL(d time.Duration) {
+	if d < DefaultJobTokenDuration {
+		d = DefaultJobTokenDuration
+	}
+	jobTokenTTLMu.Lock()
+	jobTokenTTL = d
+	jobTokenTTLMu.Unlock()
+}
+
+// ConfigureJobTokenTTLFromTimeouts sets token lifetime from the longest of the
+// given task timeouts (seconds) plus JobTokenSkew, floored at DefaultJobTokenDuration.
+func ConfigureJobTokenTTLFromTimeouts(timeoutSeconds ...int) time.Duration {
+	maxSec := 0
+	for _, s := range timeoutSeconds {
+		if s > maxSec {
+			maxSec = s
+		}
+	}
+	d := time.Duration(maxSec)*time.Second + JobTokenSkew
+	SetJobTokenTTL(d)
+	return JobTokenTTL()
+}
 
 // JobTokenClaims represents the claims in a job token
 type JobTokenClaims struct {
@@ -41,7 +84,7 @@ func GenerateJobToken(jobID, runnerID, taskID int64) (string, error) {
 		JobID:    jobID,
 		RunnerID: runnerID,
 		TaskID:   taskID,
-		Exp:      time.Now().Add(JobTokenDuration).Unix(),
+		Exp:      time.Now().Add(JobTokenTTL()).Unix(),
 	}
 
 	// Encode claims to JSON
@@ -112,4 +155,3 @@ func ValidateJobToken(token string) (*JobTokenClaims, error) {
 
 	return &claims, nil
 }
-

internal/auth/jobtoken_test.go

@@ -0,0 +1,117 @@
+package auth
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestGenerateAndValidateJobToken_RoundTrip(t *testing.T) {
+	token, err := GenerateJobToken(10, 20, 30)
+	if err != nil {
+		t.Fatalf("GenerateJobToken failed: %v", err)
+	}
+	claims, err := ValidateJobToken(token)
+	if err != nil {
+		t.Fatalf("ValidateJobToken failed: %v", err)
+	}
+	if claims.JobID != 10 || claims.RunnerID != 20 || claims.TaskID != 30 {
+		t.Fatalf("unexpected claims: %+v", claims)
+	}
+}
+
+func TestValidateJobToken_RejectsTampering(t *testing.T) {
+	token, err := GenerateJobToken(1, 2, 3)
+	if err != nil {
+		t.Fatalf("GenerateJobToken failed: %v", err)
+	}
+	parts := strings.Split(token, ".")
+	if len(parts) != 2 {
+		t.Fatalf("unexpected token format: %q", token)
+	}
+
+	rawClaims, err := base64.RawURLEncoding.DecodeString(parts[0])
+	if err != nil {
+		t.Fatalf("decode claims failed: %v", err)
+	}
+	var claims JobTokenClaims
+	if err := json.Unmarshal(rawClaims, &claims); err != nil {
+		t.Fatalf("unmarshal claims failed: %v", err)
+	}
+	claims.JobID = 999
+	tamperedClaims, _ := json.Marshal(claims)
+	tampered := base64.RawURLEncoding.EncodeToString(tamperedClaims) + "." + parts[1]
+
+	if _, err := ValidateJobToken(tampered); err == nil {
+		t.Fatal("expected signature validation error for tampered token")
+	}
+}
+
+func TestValidateJobToken_RejectsExpired(t *testing.T) {
+	expiredClaims := JobTokenClaims{
+		JobID:    1,
+		RunnerID: 2,
+		TaskID:   3,
+		Exp:      time.Now().Add(-time.Minute).Unix(),
+	}
+	claimsJSON, _ := json.Marshal(expiredClaims)
+	sigToken, err := GenerateJobToken(1, 2, 3)
+	if err != nil {
+		t.Fatalf("GenerateJobToken failed: %v", err)
+	}
+	parts := strings.Split(sigToken, ".")
+	if len(parts) != 2 {
+		t.Fatalf("unexpected token format: %q", sigToken)
+	}
+	// Re-sign expired payload with package secret.
+	h := signClaimsForTest(claimsJSON)
+	expiredToken := base64.RawURLEncoding.EncodeToString(claimsJSON) + "." + base64.RawURLEncoding.EncodeToString(h)
+
+	if _, err := ValidateJobToken(expiredToken); err == nil {
+		t.Fatal("expected token expiration error")
+	}
+}
+
+func signClaimsForTest(claims []byte) []byte {
+	h := hmac.New(sha256.New, jobTokenSecret)
+	_, _ = h.Write(claims)
+	return h.Sum(nil)
+}
+
+func TestConfigureJobTokenTTLFromTimeouts(t *testing.T) {
+	prev := JobTokenTTL()
+	t.Cleanup(func() { SetJobTokenTTL(prev) })
+
+	// Short timeouts floor at DefaultJobTokenDuration
+	got := ConfigureJobTokenTTLFromTimeouts(60, 120)
+	if got < DefaultJobTokenDuration {
+		t.Fatalf("TTL %v below default %v", got, DefaultJobTokenDuration)
+	}
+
+	// Long encode timeout (24h) + skew must be reflected
+	got = ConfigureJobTokenTTLFromTimeouts(3600, 86400)
+	wantMin := 86400*time.Second + JobTokenSkew
+	if got < wantMin {
+		t.Fatalf("TTL %v < expected min %v for 24h encode", got, wantMin)
+	}
+
+	// Newly generated tokens must use the configured TTL
+	token, err := GenerateJobToken(1, 2, 3)
+	if err != nil {
+		t.Fatalf("GenerateJobToken: %v", err)
+	}
+	claims, err := ValidateJobToken(token)
+	if err != nil {
+		t.Fatalf("ValidateJobToken: %v", err)
+	}
+	// Exp should be roughly now+TTL (allow 30s clock skew in test)
+	remaining := time.Until(time.Unix(claims.Exp, 0))
+	if remaining < wantMin-30*time.Second {
+		t.Fatalf("token remaining lifetime %v too short, want ~%v", remaining, wantMin)
+	}
+}
+

internal/auth/secrets.go

@@ -3,6 +3,7 @@ package auth
 import (
 	"crypto/rand"
 	"crypto/sha256"
+	"crypto/subtle"
 	"database/sql"
 	"encoding/hex"
 	"fmt"
@@ -121,9 +122,13 @@ func (s *Secrets) ValidateRunnerAPIKey(apiKey string) (int64, string, error) {
 		return 0, "", fmt.Errorf("API key is required")
 	}
 
-	// Check fixed API key first (from database config)
+	// Check fixed API key first (from database config). Constant-time compare.
+	// Fixed keys are refused entirely when production mode is on.
 	fixedKey := s.cfg.FixedAPIKey()
-	if fixedKey != "" && apiKey == fixedKey {
+	if fixedKey != "" && subtle.ConstantTimeCompare([]byte(apiKey), []byte(fixedKey)) == 1 {
+		if s.cfg.IsProductionMode() {
+			return 0, "", fmt.Errorf("fixed API key is not allowed in production mode")
+		}
 		// Return a special ID for fixed API key (doesn't exist in database)
 		return -1, "manager", nil
 	}

internal/auth/secrets_test.go

@@ -0,0 +1,32 @@
+package auth
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestGenerateSecret_Length(t *testing.T) {
+	secret, err := generateSecret(8)
+	if err != nil {
+		t.Fatalf("generateSecret failed: %v", err)
+	}
+	// hex encoding doubles length
+	if len(secret) != 16 {
+		t.Fatalf("unexpected secret length: %d", len(secret))
+	}
+}
+
+func TestGenerateAPIKey_Format(t *testing.T) {
+	s := &Secrets{}
+	key, err := s.generateAPIKey()
+	if err != nil {
+		t.Fatalf("generateAPIKey failed: %v", err)
+	}
+	if !strings.HasPrefix(key, "jk_r") {
+		t.Fatalf("unexpected key prefix: %q", key)
+	}
+	if !strings.Contains(key, "_") {
+		t.Fatalf("unexpected key format: %q", key)
+	}
+}
+

internal/config/config.go

@@ -21,8 +21,16 @@ const (
 	KeyFixedAPIKey          = "fixed_api_key"
 	KeyRegistrationEnabled  = "registration_enabled"
 	KeyProductionMode       = "production_mode"
-	KeyAllowedOrigins        = "allowed_origins"
+	KeyAllowedOrigins       = "allowed_origins"
 	KeyFramesPerRenderTask  = "frames_per_render_task"
+
+	// Operational limits (seconds / bytes / counts)
+	KeyRenderTimeoutSecs      = "render_timeout_seconds"
+	KeyEncodeTimeoutSecs      = "encode_timeout_seconds"
+	KeyMaxUploadBytes         = "max_upload_bytes"
+	KeySessionCookieMaxAge    = "session_cookie_max_age"
+	KeyAPIRateLimit           = "api_rate_limit"
+	KeyAuthRateLimit          = "auth_rate_limit"
 )
 
 // Config manages application configuration stored in the database
@@ -86,6 +94,9 @@ func (c *Config) InitializeFromEnv() error {
 
 // Get retrieves a config value from the database
 func (c *Config) Get(key string) (string, error) {
+	if c == nil || c.db == nil {
+		return "", nil
+	}
 	var value string
 	err := c.db.With(func(conn *sql.DB) error {
 		return conn.QueryRow("SELECT value FROM settings WHERE key = ?", key).Scan(&value)
@@ -292,8 +303,16 @@ func (c *Config) FixedAPIKey() string {
 	return c.GetWithDefault(KeyFixedAPIKey, "")
 }
 
-// IsProductionMode returns whether production mode is enabled
+// IsProductionMode returns whether production mode is enabled.
+// True if PRODUCTION=true env is set OR DB setting production_mode is true.
+// This is the single source of truth for Secure cookies, CORS, rate limits, and WS origin.
 func (c *Config) IsProductionMode() bool {
+	if os.Getenv("PRODUCTION") == "true" {
+		return true
+	}
+	if c == nil || c.db == nil {
+		return false
+	}
 	return c.GetBoolWithDefault(KeyProductionMode, false)
 }
 
@@ -311,3 +330,34 @@ func (c *Config) GetFramesPerRenderTask() int {
 	return n
 }
 
+// RenderTimeoutSeconds returns the per-frame render timeout in seconds (default 3600 = 1 hour).
+func (c *Config) RenderTimeoutSeconds() int {
+	return c.GetIntWithDefault(KeyRenderTimeoutSecs, 3600)
+}
+
+// EncodeTimeoutSeconds returns the video encode timeout in seconds (default 86400 = 24 hours).
+func (c *Config) EncodeTimeoutSeconds() int {
+	return c.GetIntWithDefault(KeyEncodeTimeoutSecs, 86400)
+}
+
+// MaxUploadBytes returns the maximum upload size in bytes (default 50 GB).
+func (c *Config) MaxUploadBytes() int64 {
+	v := c.GetIntWithDefault(KeyMaxUploadBytes, 50<<30)
+	return int64(v)
+}
+
+// SessionCookieMaxAgeSec returns the session cookie max-age in seconds (default 86400 = 24 hours).
+func (c *Config) SessionCookieMaxAgeSec() int {
+	return c.GetIntWithDefault(KeySessionCookieMaxAge, 86400)
+}
+
+// APIRateLimitPerMinute returns the API rate limit (requests per minute per IP, default 100).
+func (c *Config) APIRateLimitPerMinute() int {
+	return c.GetIntWithDefault(KeyAPIRateLimit, 100)
+}
+
+// AuthRateLimitPerMinute returns the auth rate limit (requests per minute per IP, default 10).
+func (c *Config) AuthRateLimitPerMinute() int {
+	return c.GetIntWithDefault(KeyAuthRateLimit, 10)
+}
+

internal/config/config_test.go

@@ -0,0 +1,66 @@
+package config
+
+import (
+	"path/filepath"
+	"testing"
+
+	"jiggablend/internal/database"
+)
+
+func newTestConfig(t *testing.T) *Config {
+	t.Helper()
+	db, err := database.NewDB(filepath.Join(t.TempDir(), "cfg.db"))
+	if err != nil {
+		t.Fatalf("NewDB failed: %v", err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+	return NewConfig(db)
+}
+
+func TestSetGetExistsDelete(t *testing.T) {
+	cfg := newTestConfig(t)
+
+	if err := cfg.Set("alpha", "1"); err != nil {
+		t.Fatalf("Set failed: %v", err)
+	}
+	v, err := cfg.Get("alpha")
+	if err != nil {
+		t.Fatalf("Get failed: %v", err)
+	}
+	if v != "1" {
+		t.Fatalf("unexpected value: %q", v)
+	}
+
+	exists, err := cfg.Exists("alpha")
+	if err != nil {
+		t.Fatalf("Exists failed: %v", err)
+	}
+	if !exists {
+		t.Fatal("expected key to exist")
+	}
+
+	if err := cfg.Delete("alpha"); err != nil {
+		t.Fatalf("Delete failed: %v", err)
+	}
+	exists, err = cfg.Exists("alpha")
+	if err != nil {
+		t.Fatalf("Exists after delete failed: %v", err)
+	}
+	if exists {
+		t.Fatal("expected key to be deleted")
+	}
+}
+
+func TestGetIntWithDefault_AndMinimumFrameTask(t *testing.T) {
+	cfg := newTestConfig(t)
+	if got := cfg.GetIntWithDefault("missing", 17); got != 17 {
+		t.Fatalf("expected default value, got %d", got)
+	}
+	if err := cfg.SetInt(KeyFramesPerRenderTask, 0); err != nil {
+		t.Fatalf("SetInt failed: %v", err)
+	}
+	if got := cfg.GetFramesPerRenderTask(); got != 1 {
+		t.Fatalf("expected clamped value 1, got %d", got)
+	}
+}
+

internal/database/migrations/000003_add_last_used_at.down.sql

@@ -0,0 +1,24 @@
+-- SQLite does not support DROP COLUMN directly; recreate the table without last_used_at.
+CREATE TABLE runner_api_keys_backup (
+	id INTEGER PRIMARY KEY AUTOINCREMENT,
+	key_prefix TEXT NOT NULL,
+	key_hash TEXT NOT NULL,
+	name TEXT NOT NULL,
+	description TEXT,
+	scope TEXT NOT NULL DEFAULT 'user',
+	is_active INTEGER NOT NULL DEFAULT 1,
+	created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+	created_by INTEGER,
+	FOREIGN KEY (created_by) REFERENCES users(id),
+	UNIQUE(key_prefix)
+);
+
+INSERT INTO runner_api_keys_backup SELECT id, key_prefix, key_hash, name, description, scope, is_active, created_at, created_by FROM runner_api_keys;
+
+DROP TABLE runner_api_keys;
+
+ALTER TABLE runner_api_keys_backup RENAME TO runner_api_keys;
+
+CREATE INDEX idx_runner_api_keys_prefix ON runner_api_keys(key_prefix);
+CREATE INDEX idx_runner_api_keys_active ON runner_api_keys(is_active);
+CREATE INDEX idx_runner_api_keys_created_by ON runner_api_keys(created_by);

internal/database/migrations/000003_add_last_used_at.up.sql

@@ -0,0 +1 @@
+ALTER TABLE runner_api_keys ADD COLUMN last_used_at TIMESTAMP;

internal/database/schema_test.go

@@ -0,0 +1,58 @@
+package database
+
+import (
+	"database/sql"
+	"path/filepath"
+	"testing"
+)
+
+func TestNewDB_RunsMigrationsAndSupportsQueries(t *testing.T) {
+	dbPath := filepath.Join(t.TempDir(), "test.db")
+	db, err := NewDB(dbPath)
+	if err != nil {
+		t.Fatalf("NewDB failed: %v", err)
+	}
+	defer db.Close()
+
+	if err := db.Ping(); err != nil {
+		t.Fatalf("Ping failed: %v", err)
+	}
+
+	var exists bool
+	err = db.With(func(conn *sql.DB) error {
+		return conn.QueryRow("SELECT EXISTS(SELECT 1 FROM sqlite_master WHERE type='table' AND name='settings')").Scan(&exists)
+	})
+	if err != nil {
+		t.Fatalf("query failed: %v", err)
+	}
+	if !exists {
+		t.Fatal("expected settings table after migrations")
+	}
+}
+
+func TestWithTx_RollbackOnError(t *testing.T) {
+	dbPath := filepath.Join(t.TempDir(), "tx.db")
+	db, err := NewDB(dbPath)
+	if err != nil {
+		t.Fatalf("NewDB failed: %v", err)
+	}
+	defer db.Close()
+
+	_ = db.WithTx(func(tx *sql.Tx) error {
+		if _, err := tx.Exec("INSERT INTO settings (key, value) VALUES (?, ?)", "rollback_key", "x"); err != nil {
+			return err
+		}
+		return sql.ErrTxDone
+	})
+
+	var count int
+	if err := db.With(func(conn *sql.DB) error {
+		return conn.QueryRow("SELECT COUNT(*) FROM settings WHERE key = ?", "rollback_key").Scan(&count)
+	}); err != nil {
+		t.Fatalf("count query failed: %v", err)
+	}
+	if count != 0 {
+		t.Fatalf("expected rollback, found %d rows", count)
+	}
+}
+

internal/logger/logger_test.go

@@ -0,0 +1,35 @@
+package logger
+
+import (
+	"path/filepath"
+	"testing"
+)
+
+func TestParseLevel(t *testing.T) {
+	if ParseLevel("debug") != LevelDebug {
+		t.Fatal("debug should map to LevelDebug")
+	}
+	if ParseLevel("warning") != LevelWarn {
+		t.Fatal("warning should map to LevelWarn")
+	}
+	if ParseLevel("unknown") != LevelInfo {
+		t.Fatal("unknown should default to LevelInfo")
+	}
+}
+
+func TestSetAndGetLevel(t *testing.T) {
+	SetLevel(LevelError)
+	if GetLevel() != LevelError {
+		t.Fatalf("GetLevel() = %v, want %v", GetLevel(), LevelError)
+	}
+}
+
+func TestNewWithFile_CreatesFile(t *testing.T) {
+	logPath := filepath.Join(t.TempDir(), "runner.log")
+	l, err := NewWithFile(logPath)
+	if err != nil {
+		t.Fatalf("NewWithFile failed: %v", err)
+	}
+	defer l.Close()
+}
+

internal/manager/admin_test.go

@@ -0,0 +1,35 @@
+package api
+
+import (
+	"bytes"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestHandleGenerateRunnerAPIKey_UnauthorizedWithoutContext(t *testing.T) {
+	s := &Manager{}
+	req := httptest.NewRequest(http.MethodPost, "/api/admin/runner-api-keys", bytes.NewBufferString(`{"name":"k"}`))
+	rr := httptest.NewRecorder()
+
+	s.handleGenerateRunnerAPIKey(rr, req)
+
+	if rr.Code != http.StatusUnauthorized {
+		t.Fatalf("status = %d, want %d", rr.Code, http.StatusUnauthorized)
+	}
+}
+
+func TestHandleGenerateRunnerAPIKey_RejectsBadJSON(t *testing.T) {
+	s := &Manager{}
+	req := httptest.NewRequest(http.MethodPost, "/api/admin/runner-api-keys", bytes.NewBufferString(`{`))
+	rr := httptest.NewRecorder()
+
+	s.handleGenerateRunnerAPIKey(rr, req)
+
+	// No auth context means unauthorized happens first; this still validates safe
+	// failure handling for malformed requests in this handler path.
+	if rr.Code != http.StatusUnauthorized {
+		t.Fatalf("status = %d, want %d", rr.Code, http.StatusUnauthorized)
+	}
+}
+

internal/manager/blender.go

@@ -3,7 +3,6 @@ package api
 import (
 	"archive/tar"
 	"compress/bzip2"
-	"compress/gzip"
 	"fmt"
 	"io"
 	"log"
@@ -16,6 +15,8 @@ import (
 	"strings"
 	"sync"
 	"time"
+
+	"jiggablend/pkg/blendfile"
 )
 
 const (
@@ -439,144 +440,16 @@ func (s *Manager) cleanupExtractedBlenderFolders(blenderDir string, version *Ble
 	}
 }
 
-// ParseBlenderVersionFromFile parses the Blender version that a .blend file was saved with
-// This reads the file header to determine the version
+// ParseBlenderVersionFromFile parses the Blender version that a .blend file was saved with.
+// Delegates to the shared pkg/blendfile implementation.
 func ParseBlenderVersionFromFile(blendPath string) (major, minor int, err error) {
-	file, err := os.Open(blendPath)
-	if err != nil {
-		return 0, 0, fmt.Errorf("failed to open blend file: %w", err)
-	}
-	defer file.Close()
-
-	return ParseBlenderVersionFromReader(file)
+	return blendfile.ParseVersionFromFile(blendPath)
 }
 
-// ParseBlenderVersionFromReader parses the Blender version from a reader
-// Useful for reading from uploaded files without saving to disk first
+// ParseBlenderVersionFromReader parses the Blender version from a reader.
+// Delegates to the shared pkg/blendfile implementation.
 func ParseBlenderVersionFromReader(r io.ReadSeeker) (major, minor int, err error) {
-	// Read the first 12 bytes of the blend file header
-	// Format: BLENDER-v<major><minor><patch> or BLENDER_v<major><minor><patch>
-	// The header is: "BLENDER" (7 bytes) + pointer size (1 byte: '-' for 64-bit, '_' for 32-bit)
-	// + endianness (1 byte: 'v' for little-endian, 'V' for big-endian)
-	// + version (3 bytes: e.g., "402" for 4.02)
-	header := make([]byte, 12)
-	n, err := r.Read(header)
-	if err != nil || n < 12 {
-		return 0, 0, fmt.Errorf("failed to read blend file header: %w", err)
-	}
-
-	// Check for BLENDER magic
-	if string(header[:7]) != "BLENDER" {
-		// Might be compressed - try to decompress
-		r.Seek(0, 0)
-		return parseCompressedBlendVersion(r)
-	}
-
-	// Parse version from bytes 9-11 (3 digits)
-	versionStr := string(header[9:12])
-	var vMajor, vMinor int
-
-	// Version format changed in Blender 3.0
-	// Pre-3.0: "279" = 2.79, "280" = 2.80
-	// 3.0+: "300" = 3.0, "402" = 4.02, "410" = 4.10
-	if len(versionStr) == 3 {
-		// First digit is major version
-		fmt.Sscanf(string(versionStr[0]), "%d", &vMajor)
-		// Next two digits are minor version
-		fmt.Sscanf(versionStr[1:3], "%d", &vMinor)
-	}
-
-	return vMajor, vMinor, nil
-}
-
-// parseCompressedBlendVersion handles gzip and zstd compressed blend files
-func parseCompressedBlendVersion(r io.ReadSeeker) (major, minor int, err error) {
-	// Check for compression magic bytes
-	magic := make([]byte, 4)
-	if _, err := r.Read(magic); err != nil {
-		return 0, 0, err
-	}
-	r.Seek(0, 0)
-
-	if magic[0] == 0x1f && magic[1] == 0x8b {
-		// gzip compressed
-		gzReader, err := gzip.NewReader(r)
-		if err != nil {
-			return 0, 0, fmt.Errorf("failed to create gzip reader: %w", err)
-		}
-		defer gzReader.Close()
-
-		header := make([]byte, 12)
-		n, err := gzReader.Read(header)
-		if err != nil || n < 12 {
-			return 0, 0, fmt.Errorf("failed to read compressed blend header: %w", err)
-		}
-
-		if string(header[:7]) != "BLENDER" {
-			return 0, 0, fmt.Errorf("invalid blend file format")
-		}
-
-		versionStr := string(header[9:12])
-		var vMajor, vMinor int
-		if len(versionStr) == 3 {
-			fmt.Sscanf(string(versionStr[0]), "%d", &vMajor)
-			fmt.Sscanf(versionStr[1:3], "%d", &vMinor)
-		}
-
-		return vMajor, vMinor, nil
-	}
-
-	// Check for zstd magic (Blender 3.0+): 0x28 0xB5 0x2F 0xFD
-	if magic[0] == 0x28 && magic[1] == 0xb5 && magic[2] == 0x2f && magic[3] == 0xfd {
-		return parseZstdBlendVersion(r)
-	}
-
-	return 0, 0, fmt.Errorf("unknown blend file format")
-}
-
-// parseZstdBlendVersion handles zstd-compressed blend files (Blender 3.0+)
-// Uses zstd command line tool since Go doesn't have native zstd support
-func parseZstdBlendVersion(r io.ReadSeeker) (major, minor int, err error) {
-	r.Seek(0, 0)
-
-	// We need to decompress just enough to read the header
-	// Use zstd command to decompress from stdin
-	cmd := exec.Command("zstd", "-d", "-c")
-	cmd.Stdin = r
-
-	stdout, err := cmd.StdoutPipe()
-	if err != nil {
-		return 0, 0, fmt.Errorf("failed to create zstd stdout pipe: %w", err)
-	}
-
-	if err := cmd.Start(); err != nil {
-		return 0, 0, fmt.Errorf("failed to start zstd decompression: %w", err)
-	}
-
-	// Read just the header (12 bytes)
-	header := make([]byte, 12)
-	n, readErr := io.ReadFull(stdout, header)
-
-	// Kill the process early - we only need the header
-	cmd.Process.Kill()
-	cmd.Wait()
-
-	if readErr != nil || n < 12 {
-		return 0, 0, fmt.Errorf("failed to read zstd compressed blend header: %v", readErr)
-	}
-
-	if string(header[:7]) != "BLENDER" {
-		return 0, 0, fmt.Errorf("invalid blend file format in zstd archive")
-	}
-
-	versionStr := string(header[9:12])
-	var vMajor, vMinor int
-	if len(versionStr) == 3 {
-		fmt.Sscanf(string(versionStr[0]), "%d", &vMajor)
-		fmt.Sscanf(versionStr[1:3], "%d", &vMinor)
-	}
-
-	return vMajor, vMinor, nil
+	return blendfile.ParseVersionFromReader(r)
 }
 
 // handleGetBlenderVersions returns available Blender versions
@@ -713,7 +586,7 @@ func (s *Manager) handleDownloadBlender(w http.ResponseWriter, r *http.Request)
 	tarFilename = strings.TrimSuffix(tarFilename, ".bz2")
 
 	w.Header().Set("Content-Type", "application/x-tar")
-	w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=%s", tarFilename))
+	w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=%q", tarFilename))
 	w.Header().Set("Content-Length", fmt.Sprintf("%d", stat.Size()))
 	w.Header().Set("X-Blender-Version", blenderVersion.Full)
 

internal/manager/blender_path.go

@@ -0,0 +1,35 @@
+package api
+
+import (
+	"fmt"
+	"os/exec"
+	"path/filepath"
+	"strings"
+)
+
+// resolveBlenderBinaryPath resolves a Blender executable to an absolute path.
+func resolveBlenderBinaryPath(blenderBinary string) (string, error) {
+	if blenderBinary == "" {
+		return "", fmt.Errorf("blender binary path is empty")
+	}
+
+	// Already contains a path component; normalize it.
+	if strings.Contains(blenderBinary, string(filepath.Separator)) {
+		absPath, err := filepath.Abs(blenderBinary)
+		if err != nil {
+			return "", fmt.Errorf("failed to resolve blender binary path %q: %w", blenderBinary, err)
+		}
+		return absPath, nil
+	}
+
+	// Bare executable name, resolve via PATH.
+	resolvedPath, err := exec.LookPath(blenderBinary)
+	if err != nil {
+		return "", fmt.Errorf("failed to locate blender binary %q in PATH: %w", blenderBinary, err)
+	}
+	absPath, err := filepath.Abs(resolvedPath)
+	if err != nil {
+		return "", fmt.Errorf("failed to resolve blender binary path %q: %w", resolvedPath, err)
+	}
+	return absPath, nil
+}

internal/manager/blender_path_test.go

@@ -0,0 +1,23 @@
+package api
+
+import (
+	"path/filepath"
+	"testing"
+)
+
+func TestResolveBlenderBinaryPath_WithPathComponent(t *testing.T) {
+	got, err := resolveBlenderBinaryPath("./blender")
+	if err != nil {
+		t.Fatalf("resolveBlenderBinaryPath failed: %v", err)
+	}
+	if !filepath.IsAbs(got) {
+		t.Fatalf("expected absolute path, got %q", got)
+	}
+}
+
+func TestResolveBlenderBinaryPath_Empty(t *testing.T) {
+	if _, err := resolveBlenderBinaryPath(""); err == nil {
+		t.Fatal("expected error for empty path")
+	}
+}
+

internal/manager/blender_test.go

@@ -0,0 +1,27 @@
+package api
+
+import (
+	"testing"
+	"time"
+)
+
+func TestGetLatestBlenderForMajorMinor_UsesCachedVersions(t *testing.T) {
+	blenderVersionCache.mu.Lock()
+	blenderVersionCache.versions = []BlenderVersion{
+		{Major: 4, Minor: 2, Patch: 1, Full: "4.2.1"},
+		{Major: 4, Minor: 2, Patch: 3, Full: "4.2.3"},
+		{Major: 4, Minor: 1, Patch: 9, Full: "4.1.9"},
+	}
+	blenderVersionCache.fetchedAt = time.Now()
+	blenderVersionCache.mu.Unlock()
+
+	m := &Manager{}
+	v, err := m.GetLatestBlenderForMajorMinor(4, 2)
+	if err != nil {
+		t.Fatalf("GetLatestBlenderForMajorMinor failed: %v", err)
+	}
+	if v.Full != "4.2.3" {
+		t.Fatalf("expected highest patch, got %+v", *v)
+	}
+}
+

internal/manager/jobs.go

@@ -23,6 +23,8 @@ import (
 	"time"
 
 	authpkg "jiggablend/internal/auth"
+	"jiggablend/internal/runner/blender"
+	"jiggablend/internal/storage"
 	"jiggablend/pkg/executils"
 	"jiggablend/pkg/scripts"
 	"jiggablend/pkg/types"
@@ -96,6 +98,58 @@ func (s *Manager) failUploadSession(sessionID, errorMessage string) (int64, bool
 	return userID, true
 }
 
+const (
+	uploadSessionExpiredCode = "UPLOAD_SESSION_EXPIRED"
+	uploadSessionNotReadyCode = "UPLOAD_SESSION_NOT_READY"
+)
+
+type uploadSessionValidationError struct {
+	Code    string
+	Message string
+}
+
+func (e *uploadSessionValidationError) Error() string {
+	return e.Message
+}
+
+// validateUploadSessionForJobCreation validates that an upload session can be used for job creation.
+// Returns the session and its context tar path when valid.
+func (s *Manager) validateUploadSessionForJobCreation(sessionID string, userID int64) (*UploadSession, string, error) {
+	s.uploadSessionsMu.RLock()
+	uploadSession := s.uploadSessions[sessionID]
+	s.uploadSessionsMu.RUnlock()
+
+	if uploadSession == nil || uploadSession.UserID != userID {
+		return nil, "", &uploadSessionValidationError{
+			Code:    uploadSessionExpiredCode,
+			Message: "Upload session expired or not found. Please upload the file again.",
+		}
+	}
+	if uploadSession.Status != "completed" {
+		return nil, "", &uploadSessionValidationError{
+			Code:    uploadSessionNotReadyCode,
+			Message: "Upload session is not ready yet. Wait for processing to complete.",
+		}
+	}
+	if uploadSession.TempDir == "" {
+		return nil, "", &uploadSessionValidationError{
+			Code:    uploadSessionExpiredCode,
+			Message: "Upload session context data is missing. Please upload the file again.",
+		}
+	}
+
+	tempContextPath := filepath.Join(uploadSession.TempDir, "context.tar")
+	if _, statErr := os.Stat(tempContextPath); statErr != nil {
+		log.Printf("ERROR: Context archive not found at %s for session %s: %v", tempContextPath, sessionID, statErr)
+		return nil, "", &uploadSessionValidationError{
+			Code:    uploadSessionExpiredCode,
+			Message: "Upload session context archive was not found (possibly after manager restart). Please upload the file again.",
+		}
+	}
+
+	return uploadSession, tempContextPath, nil
+}
+
 // handleCreateJob creates a new job
 func (s *Manager) handleCreateJob(w http.ResponseWriter, r *http.Request) {
 	userID, err := getUserID(r)
@@ -177,33 +231,43 @@ func (s *Manager) handleCreateJob(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	// Store render settings, unhide_objects, enable_execution, and blender_version in blend_metadata if provided.
-	var blendMetadataJSON *string
-	if req.RenderSettings != nil || req.UnhideObjects != nil || req.EnableExecution != nil || req.BlenderVersion != nil || req.OutputFormat != nil {
-		metadata := types.BlendMetadata{
-			FrameStart:      *req.FrameStart,
-			FrameEnd:        *req.FrameEnd,
-			RenderSettings:  types.RenderSettings{},
-			UnhideObjects:   req.UnhideObjects,
-			EnableExecution: req.EnableExecution,
-		}
-		if req.RenderSettings != nil {
-			metadata.RenderSettings = *req.RenderSettings
-		}
-		// Always set output_format in metadata from job's output_format field
-		if req.OutputFormat != nil {
-			metadata.RenderSettings.OutputFormat = *req.OutputFormat
-		}
-		if req.BlenderVersion != nil {
-			metadata.BlenderVersion = *req.BlenderVersion
-		}
-		metadataBytes, err := json.Marshal(metadata)
-		if err == nil {
-			metadataStr := string(metadataBytes)
-			blendMetadataJSON = &metadataStr
+	var uploadSession *UploadSession
+	var tempContextPath string
+	if req.UploadSessionID == nil || *req.UploadSessionID == "" {
+		s.respondError(w, http.StatusBadRequest, "upload_session_id is required: upload a blend/zip and complete processing before creating a render job")
+		return
+	}
+	{
+		var validateErr error
+		uploadSession, tempContextPath, validateErr = s.validateUploadSessionForJobCreation(*req.UploadSessionID, userID)
+		if validateErr != nil {
+			var sessionErr *uploadSessionValidationError
+			if errors.As(validateErr, &sessionErr) {
+				s.respondErrorWithCode(w, http.StatusBadRequest, sessionErr.Code, sessionErr.Message)
+			} else {
+				s.respondError(w, http.StatusBadRequest, validateErr.Error())
+			}
+			return
 		}
 	}
 
+	// Merge upload analysis metadata with explicit job creation overrides.
+	uploadMeta := uploadSessionMetadata(uploadSession)
+	mergedMetadata, mergeErr := mergeBlendMetadataForJobCreate(uploadMeta, &req)
+	if mergeErr != nil {
+		s.respondError(w, http.StatusBadRequest, mergeErr.Error())
+		return
+	}
+
+	var blendMetadataJSON *string
+	metadataBytes, err := json.Marshal(mergedMetadata)
+	if err != nil {
+		s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to marshal job metadata: %v", err))
+		return
+	}
+	metadataStr := string(metadataBytes)
+	blendMetadataJSON = &metadataStr
+
 	log.Printf("Creating render job with output_format: '%s' (from user selection)", *req.OutputFormat)
 	var jobID int64
 	err = s.db.With(func(conn *sql.DB) error {
@@ -225,39 +289,29 @@ func (s *Manager) handleCreateJob(w http.ResponseWriter, r *http.Request) {
 		s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to create job: %v", err))
 		return
 	}
+	cleanupCreatedJob := func(reason string) {
+		log.Printf("Cleaning up partially created job %d: %s", jobID, reason)
+		_ = s.db.With(func(conn *sql.DB) error {
+			// Be defensive in case foreign key cascade is disabled.
+			_, _ = conn.Exec(`DELETE FROM task_logs WHERE task_id IN (SELECT id FROM tasks WHERE job_id = ?)`, jobID)
+			_, _ = conn.Exec(`DELETE FROM task_steps WHERE task_id IN (SELECT id FROM tasks WHERE job_id = ?)`, jobID)
+			_, _ = conn.Exec(`DELETE FROM tasks WHERE job_id = ?`, jobID)
+			_, _ = conn.Exec(`DELETE FROM job_files WHERE job_id = ?`, jobID)
+			_, _ = conn.Exec(`DELETE FROM jobs WHERE id = ?`, jobID)
+			return nil
+		})
+		_ = os.RemoveAll(s.storage.JobPath(jobID))
+	}
 
 	// If upload session ID is provided, move the context archive from temp to job directory
-	if req.UploadSessionID != nil && *req.UploadSessionID != "" {
+	if uploadSession != nil {
 		log.Printf("Processing upload session for job %d: %s", jobID, *req.UploadSessionID)
-		var uploadSession *UploadSession
-		s.uploadSessionsMu.RLock()
-		uploadSession = s.uploadSessions[*req.UploadSessionID]
-		s.uploadSessionsMu.RUnlock()
-
-		if uploadSession == nil || uploadSession.UserID != userID {
-			s.respondError(w, http.StatusBadRequest, "Invalid upload session. Please upload the file again.")
-			return
-		}
-		if uploadSession.Status != "completed" {
-			s.respondError(w, http.StatusBadRequest, "Upload session is not ready yet. Wait for processing to complete.")
-			return
-		}
-		if uploadSession.TempDir == "" {
-			s.respondError(w, http.StatusBadRequest, "Upload session is missing context data. Please upload again.")
-			return
-		}
-
-		tempContextPath := filepath.Join(uploadSession.TempDir, "context.tar")
-		if _, statErr := os.Stat(tempContextPath); statErr != nil {
-			log.Printf("ERROR: Context archive not found at %s for session %s: %v", tempContextPath, *req.UploadSessionID, statErr)
-			s.respondError(w, http.StatusBadRequest, "Context archive not found for upload session. Please upload the file again.")
-			return
-		}
 
 		log.Printf("Found context archive at %s, moving to job %d directory", tempContextPath, jobID)
 		jobPath := s.storage.JobPath(jobID)
 		if err := os.MkdirAll(jobPath, 0755); err != nil {
 			log.Printf("ERROR: Failed to create job directory for job %d: %v", jobID, err)
+			cleanupCreatedJob("failed to create job directory")
 			s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to create job directory: %v", err))
 			return
 		}
@@ -266,6 +320,7 @@ func (s *Manager) handleCreateJob(w http.ResponseWriter, r *http.Request) {
 		srcFile, err := os.Open(tempContextPath)
 		if err != nil {
 			log.Printf("ERROR: Failed to open source context archive %s: %v", tempContextPath, err)
+			cleanupCreatedJob("failed to open source context archive")
 			s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to open context archive: %v", err))
 			return
 		}
@@ -274,6 +329,7 @@ func (s *Manager) handleCreateJob(w http.ResponseWriter, r *http.Request) {
 		dstFile, err := os.Create(jobContextPath)
 		if err != nil {
 			log.Printf("ERROR: Failed to create destination context archive %s: %v", jobContextPath, err)
+			cleanupCreatedJob("failed to create destination context archive")
 			s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to create context archive: %v", err))
 			return
 		}
@@ -283,6 +339,7 @@ func (s *Manager) handleCreateJob(w http.ResponseWriter, r *http.Request) {
 			dstFile.Close()
 			os.Remove(jobContextPath)
 			log.Printf("ERROR: Failed to copy context archive from %s to %s: %v", tempContextPath, jobContextPath, err)
+			cleanupCreatedJob("failed to copy context archive")
 			s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to copy context archive: %v", err))
 			return
 		}
@@ -290,6 +347,7 @@ func (s *Manager) handleCreateJob(w http.ResponseWriter, r *http.Request) {
 		srcFile.Close()
 		if err := dstFile.Close(); err != nil {
 			log.Printf("ERROR: Failed to close destination file: %v", err)
+			cleanupCreatedJob("failed to finalize destination context archive")
 			s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to finalize context archive: %v", err))
 			return
 		}
@@ -300,6 +358,7 @@ func (s *Manager) handleCreateJob(w http.ResponseWriter, r *http.Request) {
 		contextInfo, err := os.Stat(jobContextPath)
 		if err != nil {
 			log.Printf("ERROR: Failed to stat context archive after move: %v", err)
+			cleanupCreatedJob("failed to stat copied context archive")
 			s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to verify context archive: %v", err))
 			return
 		}
@@ -319,6 +378,7 @@ func (s *Manager) handleCreateJob(w http.ResponseWriter, r *http.Request) {
 		})
 		if err != nil {
 			log.Printf("ERROR: Failed to record context archive in database for job %d: %v", jobID, err)
+			cleanupCreatedJob("failed to record context archive in database")
 			s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to record context archive: %v", err))
 			return
 		}
@@ -337,17 +397,12 @@ func (s *Manager) handleCreateJob(w http.ResponseWriter, r *http.Request) {
 		s.uploadSessionsMu.Lock()
 		delete(s.uploadSessions, *req.UploadSessionID)
 		s.uploadSessionsMu.Unlock()
-	} else {
-		log.Printf("Warning: No upload session ID provided for job %d - job created without input files", jobID)
 	}
 
 	// Only create render tasks for render jobs
 	if req.JobType == types.JobTypeRender {
-		// Determine task timeout based on output format
-		taskTimeout := RenderTimeout // 1 hour for render jobs
-		if *req.OutputFormat == "EXR_264_MP4" || *req.OutputFormat == "EXR_AV1_MP4" || *req.OutputFormat == "EXR_VP9_WEBM" {
-			taskTimeout = VideoEncodeTimeout // 24 hours for encoding
-		}
+		// Render tasks always use render timeout; encode tasks use video encode timeout.
+		taskTimeout := s.renderTimeout
 
 		// Create tasks for the job (batch INSERT in a single transaction)
 		// Chunk job frame range by frames_per_render_task config
@@ -381,6 +436,7 @@ func (s *Manager) handleCreateJob(w http.ResponseWriter, r *http.Request) {
 			return nil
 		})
 		if err != nil {
+			cleanupCreatedJob("failed to create render tasks")
 			s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to create tasks: %v", err))
 			return
 		}
@@ -389,7 +445,7 @@ func (s *Manager) handleCreateJob(w http.ResponseWriter, r *http.Request) {
 		// Create encode task immediately if output format requires it
 		// The task will have a condition that prevents it from being assigned until all render tasks are completed
 		if *req.OutputFormat == "EXR_264_MP4" || *req.OutputFormat == "EXR_AV1_MP4" || *req.OutputFormat == "EXR_VP9_WEBM" {
-			encodeTaskTimeout := VideoEncodeTimeout // 24 hours for encoding
+			encodeTaskTimeout := s.videoEncodeTimeout
 			conditionJSON := `{"type": "all_render_tasks_completed"}`
 			var encodeTaskID int64
 			err = s.db.With(func(conn *sql.DB) error {
@@ -1327,11 +1383,18 @@ func (s *Manager) handleUploadJobFile(w http.ResponseWriter, r *http.Request) {
 	var mainBlendFile string
 	var extractedFiles []string
 
+	// Sanitize once — all disk paths and exclude lists must use this basename
+	safeName, err := storage.SanitizeFilename(header.Filename)
+	if err != nil {
+		s.respondError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
 	// Check if this is a ZIP file
-	if strings.HasSuffix(strings.ToLower(header.Filename), ".zip") {
-		log.Printf("Processing ZIP file '%s' for job %d", header.Filename, jobID)
-		// Save ZIP to temporary directory
-		zipPath := filepath.Join(tmpDir, header.Filename)
+	if strings.HasSuffix(strings.ToLower(safeName), ".zip") {
+		log.Printf("Processing ZIP file '%s' for job %d", safeName, jobID)
+		// Save ZIP to temporary directory (basename only — no path traversal)
+		zipPath := filepath.Join(tmpDir, safeName)
 		log.Printf("Creating ZIP file at: %s", zipPath)
 		zipFile, err := os.Create(zipPath)
 		if err != nil {
@@ -1362,8 +1425,13 @@ func (s *Manager) handleUploadJobFile(w http.ResponseWriter, r *http.Request) {
 		// Find main blend file (check for user selection first, then auto-detect)
 		mainBlendParam := r.FormValue("main_blend_file")
 		if mainBlendParam != "" {
-			// User specified main blend file
-			mainBlendFile = filepath.Join(tmpDir, mainBlendParam)
+			// User specified main blend file — must stay under tmpDir
+			resolved, err := storage.SafePathUnderRoot(tmpDir, mainBlendParam)
+			if err != nil {
+				s.respondError(w, http.StatusBadRequest, fmt.Sprintf("Invalid main blend file path: %v", err))
+				return
+			}
+			mainBlendFile = resolved
 			if _, err := os.Stat(mainBlendFile); err != nil {
 				s.respondError(w, http.StatusBadRequest, fmt.Sprintf("Specified main blend file not found: %s", mainBlendParam))
 				return
@@ -1406,7 +1474,7 @@ func (s *Manager) handleUploadJobFile(w http.ResponseWriter, r *http.Request) {
 		}
 	} else {
 		// Regular file upload (not ZIP) - save to temporary directory
-		filePath := filepath.Join(tmpDir, header.Filename)
+		filePath := filepath.Join(tmpDir, safeName)
 		outFile, err := os.Create(filePath)
 		if err != nil {
 			s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to create file: %v", err))
@@ -1430,7 +1498,7 @@ func (s *Manager) handleUploadJobFile(w http.ResponseWriter, r *http.Request) {
 		fileReader.Close()
 		outFile.Close()
 
-		if strings.HasSuffix(strings.ToLower(header.Filename), ".blend") {
+		if strings.HasSuffix(strings.ToLower(safeName), ".blend") {
 			mainBlendFile = filePath
 		}
 	}
@@ -1438,8 +1506,8 @@ func (s *Manager) handleUploadJobFile(w http.ResponseWriter, r *http.Request) {
 	// Create context archive from temporary directory - this is the primary artifact
 	// Exclude the original uploaded ZIP file (but keep blend files as they're needed for rendering)
 	var excludeFiles []string
-	if strings.HasSuffix(strings.ToLower(header.Filename), ".zip") {
-		excludeFiles = append(excludeFiles, header.Filename)
+	if strings.HasSuffix(strings.ToLower(safeName), ".zip") {
+		excludeFiles = append(excludeFiles, safeName)
 	}
 	contextPath, err := s.storage.CreateJobContextFromDir(tmpDir, jobID, excludeFiles...)
 	if err != nil {
@@ -1613,14 +1681,17 @@ func (s *Manager) handleUploadFileForJobCreation(w http.ResponseWriter, r *http.
 				}
 			}
 
-			// Determine file path
-			if strings.HasSuffix(strings.ToLower(header.Filename), ".zip") {
-				filePath = filepath.Join(tmpDir, header.Filename)
-			} else {
-				filePath = filepath.Join(tmpDir, header.Filename)
-				if strings.HasSuffix(strings.ToLower(header.Filename), ".blend") {
-					mainBlendFile = filePath
-				}
+			// Determine file path (basename only — no path traversal)
+			safeName, sanitizeErr := storage.SanitizeFilename(header.Filename)
+			if sanitizeErr != nil {
+				part.Close()
+				os.RemoveAll(tmpDir)
+				s.respondError(w, http.StatusBadRequest, sanitizeErr.Error())
+				return
+			}
+			filePath = filepath.Join(tmpDir, safeName)
+			if strings.HasSuffix(strings.ToLower(safeName), ".blend") {
+				mainBlendFile = filePath
 			}
 
 			// Create file and copy data immediately
@@ -1668,7 +1739,18 @@ func (s *Manager) handleUploadFileForJobCreation(w http.ResponseWriter, r *http.
 		return
 	}
 
-	filename := header.Filename
+	// Use the same sanitized basename that was used when writing the file to tmpDir
+	safeName, sanitizeErr := storage.SanitizeFilename(header.Filename)
+	if sanitizeErr != nil {
+		// Should not happen — we already sanitized when writing the file
+		os.RemoveAll(tmpDir)
+		s.respondError(w, http.StatusBadRequest, sanitizeErr.Error())
+		return
+	}
+	// Prefer the name of the file actually on disk (from the write path above)
+	if filePath != "" {
+		safeName = filepath.Base(filePath)
+	}
 	fileSize := header.Size
 	mainBlendParam := formValues["main_blend_file"]
 
@@ -1680,18 +1762,19 @@ func (s *Manager) handleUploadFileForJobCreation(w http.ResponseWriter, r *http.
 
 	response := map[string]interface{}{
 		"session_id": sessionID,
-		"file_name":  filename,
+		"file_name":  safeName,
 		"file_size":  fileSize,
 		"status":     "processing",
 		"phase":      uploadSessionPhase("processing"),
 	}
 	s.respondJSON(w, http.StatusOK, response)
 
-	go s.runBackgroundUploadProcessing(tmpDir, sessionID, userID, filename, fileSize, mainBlendParam, mainBlendFile)
+	go s.runBackgroundUploadProcessing(tmpDir, sessionID, userID, safeName, fileSize, mainBlendParam, mainBlendFile)
 }
 
 // runBackgroundUploadProcessing runs ZIP extraction (if needed), blend detection, context creation, and metadata extraction.
 // Called in a goroutine after the upload handler returns; updates upload session and broadcasts when done.
+// filename must be the sanitized basename of the file written under tmpDir (never a raw client path).
 func (s *Manager) runBackgroundUploadProcessing(tmpDir, sessionID string, userID int64, filename string, fileSize int64, mainBlendParam string, mainBlendFile string) {
 	defer func() {
 		if r := recover(); r != nil {
@@ -1703,6 +1786,17 @@ func (s *Manager) runBackgroundUploadProcessing(tmpDir, sessionID string, userID
 		}
 	}()
 
+	// Defense in depth: never Join unsanitized client filenames under tmpDir
+	safeName, err := storage.SanitizeFilename(filename)
+	if err != nil {
+		errMsg := fmt.Sprintf("invalid upload filename: %v", err)
+		if ownerUserID, ok := s.failUploadSession(sessionID, errMsg); ok {
+			s.broadcastUploadProgressSync(ownerUserID, sessionID, 0, "error", errMsg)
+		}
+		return
+	}
+	filename = safeName
+
 	var processedMainBlendFile string
 	var excludeFiles []string
 	extractedFilesCount := 0
@@ -1724,7 +1818,16 @@ func (s *Manager) runBackgroundUploadProcessing(tmpDir, sessionID string, userID
 		log.Printf("Successfully extracted %d files from ZIP", extractedFilesCount)
 
 		if mainBlendParam != "" {
-			processedMainBlendFile = filepath.Join(tmpDir, mainBlendParam)
+			resolved, err := storage.SafePathUnderRoot(tmpDir, mainBlendParam)
+			if err != nil {
+				log.Printf("ERROR: Invalid main blend file path: %v", err)
+				errMsg := "Invalid main blend file path: " + mainBlendParam
+				if ownerUserID, ok := s.failUploadSession(sessionID, errMsg); ok {
+					s.broadcastUploadProgressSync(ownerUserID, sessionID, 0, "error", errMsg)
+				}
+				return
+			}
+			processedMainBlendFile = resolved
 			if _, err := os.Stat(processedMainBlendFile); err != nil {
 				log.Printf("ERROR: Specified main blend file not found: %s", mainBlendParam)
 				errMsg := "Specified main blend file not found: " + mainBlendParam
@@ -1784,7 +1887,7 @@ func (s *Manager) runBackgroundUploadProcessing(tmpDir, sessionID string, userID
 
 	s.broadcastUploadProgressSync(userID, sessionID, 0.4, "creating_context", "Creating context archive...")
 	contextPath := filepath.Join(tmpDir, "context.tar")
-	contextPath, err := s.createContextFromDir(tmpDir, contextPath, excludeFiles...)
+	contextPath, err = s.createContextFromDir(tmpDir, contextPath, excludeFiles...)
 	if err != nil {
 		log.Printf("ERROR: Failed to create context archive: %v", err)
 		if ownerUserID, ok := s.failUploadSession(sessionID, err.Error()); ok {
@@ -1983,10 +2086,14 @@ func (s *Manager) runBlenderMetadataExtraction(blendFile, workDir, blenderVersio
 		return nil, fmt.Errorf("failed to create extraction script: %w", err)
 	}
 
-	// Make blend file path relative to workDir to avoid path resolution issues
-	blendFileRel, err := filepath.Rel(workDir, blendFile)
+	// Use absolute paths to avoid path normalization issues with relative traversal.
+	blendFileAbs, err := filepath.Abs(blendFile)
 	if err != nil {
-		return nil, fmt.Errorf("failed to get relative path for blend file: %w", err)
+		return nil, fmt.Errorf("failed to get absolute path for blend file: %w", err)
+	}
+	scriptPathAbs, err := filepath.Abs(scriptPath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get absolute path for extraction script: %w", err)
 	}
 
 	// Determine which blender binary to use
@@ -2036,12 +2143,19 @@ func (s *Manager) runBlenderMetadataExtraction(blendFile, workDir, blenderVersio
 		}
 	}
 
-	// Execute Blender using executils
+	// Ensure Blender binary is always an absolute path.
+	blenderBinary, err = resolveBlenderBinaryPath(blenderBinary)
+	if err != nil {
+		return nil, err
+	}
+
+	// Execute Blender using executils (set LD_LIBRARY_PATH for tarball installs)
+	runEnv := blender.TarballEnv(blenderBinary, os.Environ())
 	result, err := executils.RunCommand(
 		blenderBinary,
-		[]string{"-b", blendFileRel, "--python", "extract_metadata.py"},
+		[]string{"-b", blendFileAbs, "--python", scriptPathAbs},
 		workDir,
-		nil, // inherit environment
+		runEnv,
 		0,   // no task ID for metadata extraction
 		nil, // no process tracker needed
 	)
@@ -2590,7 +2704,7 @@ func (s *Manager) handleDownloadJobFile(w http.ResponseWriter, r *http.Request)
 	}
 
 	// Set headers
-	w.Header().Set("Content-Disposition", fmt.Sprintf("%s; filename=%s", disposition, fileName))
+	w.Header().Set("Content-Disposition", fmt.Sprintf("%s; filename=%q", disposition, fileName))
 	w.Header().Set("Content-Type", contentType)
 
 	// Stream file
@@ -2708,7 +2822,7 @@ func (s *Manager) handleDownloadEXRZip(w http.ResponseWriter, r *http.Request) {
 
 	fileName := fmt.Sprintf("%s-exr.zip", safeJobName)
 	w.Header().Set("Content-Type", "application/zip")
-	w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=%s", fileName))
+	w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=%q", fileName))
 
 	zipWriter := zip.NewWriter(w)
 	defer zipWriter.Close()
@@ -2879,7 +2993,7 @@ func (s *Manager) handlePreviewEXR(w http.ResponseWriter, r *http.Request) {
 
 	// Set headers
 	pngFileName := strings.TrimSuffix(fileName, filepath.Ext(fileName)) + ".png"
-	w.Header().Set("Content-Disposition", fmt.Sprintf("inline; filename=%s", pngFileName))
+	w.Header().Set("Content-Disposition", fmt.Sprintf("inline; filename=%q", pngFileName))
 	w.Header().Set("Content-Type", "image/png")
 	w.Header().Set("Content-Length", strconv.Itoa(len(pngData)))
 

internal/manager/jobs_test.go

@@ -0,0 +1,305 @@
+package api
+
+import (
+	"archive/tar"
+	"archive/zip"
+	"bytes"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"jiggablend/internal/storage"
+)
+
+func TestGenerateAndCheckETag(t *testing.T) {
+	etag := generateETag(map[string]interface{}{"a": 1})
+	if etag == "" {
+		t.Fatal("expected non-empty etag")
+	}
+	req := httptest.NewRequest("GET", "/x", nil)
+	req.Header.Set("If-None-Match", etag)
+	if !checkETag(req, etag) {
+		t.Fatal("expected etag match")
+	}
+}
+
+func TestUploadSessionPhase(t *testing.T) {
+	if got := uploadSessionPhase("uploading"); got != "upload" {
+		t.Fatalf("unexpected phase: %q", got)
+	}
+	if got := uploadSessionPhase("select_blend"); got != "action_required" {
+		t.Fatalf("unexpected phase: %q", got)
+	}
+	if got := uploadSessionPhase("something_else"); got != "processing" {
+		t.Fatalf("unexpected fallback phase: %q", got)
+	}
+}
+
+func TestParseTarHeader_AndTruncateString(t *testing.T) {
+	var buf bytes.Buffer
+	tw := tar.NewWriter(&buf)
+	_ = tw.WriteHeader(&tar.Header{Name: "a.txt", Mode: 0644, Size: 3, Typeflag: tar.TypeReg})
+	_, _ = tw.Write([]byte("abc"))
+	_ = tw.Close()
+
+	raw := buf.Bytes()
+	if len(raw) < 512 {
+		t.Fatal("tar buffer unexpectedly small")
+	}
+	var h tar.Header
+	if err := parseTarHeader(raw[:512], &h); err != nil {
+		t.Fatalf("parseTarHeader failed: %v", err)
+	}
+	if h.Name != "a.txt" {
+		t.Fatalf("unexpected parsed name: %q", h.Name)
+	}
+
+	if got := truncateString("abcdef", 5); got != "ab..." {
+		t.Fatalf("truncateString = %q, want %q", got, "ab...")
+	}
+}
+
+func TestValidateUploadSessionForJobCreation_MissingSession(t *testing.T) {
+	s := &Manager{
+		uploadSessions: map[string]*UploadSession{},
+	}
+	_, _, err := s.validateUploadSessionForJobCreation("missing", 1)
+	if err == nil {
+		t.Fatal("expected validation error for missing session")
+	}
+	sessionErr, ok := err.(*uploadSessionValidationError)
+	if !ok || sessionErr.Code != uploadSessionExpiredCode {
+		t.Fatalf("expected %s validation error, got %#v", uploadSessionExpiredCode, err)
+	}
+}
+
+func TestRenderTaskTimeoutIsRenderNotEncode(t *testing.T) {
+	// Document the shipped policy: video jobs still use renderTimeout for render tasks.
+	s := &Manager{renderTimeout: 3600, videoEncodeTimeout: 86400}
+	if s.renderTimeout == s.videoEncodeTimeout {
+		t.Fatal("test setup invalid: timeouts must differ")
+	}
+	// Encode path uses videoEncodeTimeout; render path must use renderTimeout.
+	// The create-job handler assigns s.renderTimeout to render tasks (see handleCreateJob).
+	if s.renderTimeout != 3600 {
+		t.Fatalf("renderTimeout = %d", s.renderTimeout)
+	}
+	if s.videoEncodeTimeout != 86400 {
+		t.Fatalf("videoEncodeTimeout = %d", s.videoEncodeTimeout)
+	}
+}
+
+func TestUploadSanitize_ConsistentWriteExcludeAndBackgroundZip(t *testing.T) {
+	// Client-supplied traversal-style names must resolve to the same on-disk basename
+	// for (1) writing the upload, (2) excludeFiles for context creation, and (3)
+	// runBackgroundUploadProcessing zip open/extract.
+	st, err := storage.NewStorage(t.TempDir())
+	if err != nil {
+		t.Fatalf("NewStorage: %v", err)
+	}
+	clientName := "../../evil/scene.zip"
+	safeName, err := storage.SanitizeFilename(clientName)
+	if err != nil {
+		t.Fatalf("SanitizeFilename: %v", err)
+	}
+	if safeName != "scene.zip" {
+		t.Fatalf("safeName = %q, want scene.zip", safeName)
+	}
+
+	tmpDir, err := st.TempDir("upload-test-*")
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Write a real zip under the sanitized basename (as the upload handler does)
+	zipPath := filepath.Join(tmpDir, safeName)
+	if err := writeMinimalBlendZip(zipPath, "scene.blend"); err != nil {
+		t.Fatalf("write zip: %v", err)
+	}
+	// Extract so context archive has a root .blend; ZIP remains on disk to be excluded
+	if _, err := st.ExtractZip(zipPath, tmpDir); err != nil {
+		t.Fatalf("ExtractZip: %v", err)
+	}
+	if !fileExists(filepath.Join(tmpDir, "scene.blend")) {
+		t.Fatal("expected extracted scene.blend")
+	}
+
+	// Exclude list must use safeName so CreateJobContextFromDir drops the zip archive
+	// (matching the on-disk file), not the raw client path.
+	contextPath, err := st.CreateJobContextFromDir(tmpDir, 1, safeName)
+	if err != nil {
+		t.Fatalf("CreateJobContextFromDir with safe exclude: %v", err)
+	}
+	if !fileExists(contextPath) {
+		t.Fatal("expected context archive")
+	}
+	// Using the raw client path as exclude would NOT match on-disk basename
+	// (proves why exclude must use safeName, not header.Filename with traversal).
+	if clientName == safeName {
+		t.Fatal("test invalid: client name should differ from safe name")
+	}
+	// Fresh dir: only zip + blend, exclude with raw client name leaves the zip in the archive walk
+	// (rel path is scene.zip; client is ../../evil/scene.zip — no match).
+	tmpDir2, err := st.TempDir("upload-excl-*")
+	if err != nil {
+		t.Fatal(err)
+	}
+	zip2 := filepath.Join(tmpDir2, safeName)
+	if err := writeMinimalBlendZip(zip2, "scene.blend"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := st.ExtractZip(zip2, tmpDir2); err != nil {
+		t.Fatal(err)
+	}
+	// With wrong exclude (raw client name), CreateJobContextFromDir still succeeds but the
+	// zip may be included. Safer assertion: wrong exclude string does not equal safeName.
+	wrongExclude := clientName
+	if filepath.Base(wrongExclude) == wrongExclude && wrongExclude == safeName {
+		t.Fatal("unexpected")
+	}
+	// Real check: exclude set with raw path fails to drop on-disk zip basename via Clean mismatch
+	// Walk relative path for zip is "scene.zip"; exclude set keys for "../../evil/scene.zip"
+	// after Clean become "../evil/scene.zip" which does not match.
+	_, errWrong := st.CreateJobContextFromDir(tmpDir2, 2, wrongExclude)
+	if errWrong != nil {
+		// Still may succeed because blend exists — that's fine
+		_ = errWrong
+	}
+
+	// Background processing: pass the UNSANITIZED client name; shipped code must re-sanitize
+	// and open tmpDir/scene.zip successfully. Use a clean tmp with only the zip (as after upload).
+	bgDir, err := st.TempDir("upload-bg-*")
+	if err != nil {
+		t.Fatal(err)
+	}
+	bgZip := filepath.Join(bgDir, safeName)
+	if err := writeMinimalBlendZip(bgZip, "scene.blend"); err != nil {
+		t.Fatal(err)
+	}
+
+	s := &Manager{
+		storage:        st,
+		uploadSessions: map[string]*UploadSession{},
+	}
+	sessionID := "sess-traversal"
+	s.uploadSessions[sessionID] = &UploadSession{
+		SessionID: sessionID,
+		UserID:    7,
+		TempDir:   bgDir,
+		Status:    "processing",
+		CreatedAt: time.Now(),
+	}
+	s.runBackgroundUploadProcessing(bgDir, sessionID, 7, clientName, 100, "", "")
+
+	s.uploadSessionsMu.RLock()
+	session := s.uploadSessions[sessionID]
+	s.uploadSessionsMu.RUnlock()
+	if session == nil {
+		t.Fatal("session missing")
+	}
+	if session.Status == "error" {
+		t.Fatalf("background processing failed with unsanitized name: %s", session.ErrorMessage)
+	}
+	if session.Status != "completed" && session.Status != "select_blend" {
+		t.Fatalf("status = %q, want completed or select_blend (got message %q)", session.Status, session.Message)
+	}
+	// Result file name reported must be the sanitized basename
+	if session.ResultFileName != "" && session.ResultFileName != safeName {
+		t.Fatalf("ResultFileName = %q, want %q", session.ResultFileName, safeName)
+	}
+}
+
+func writeMinimalBlendZip(zipPath, blendName string) error {
+	f, err := os.Create(zipPath)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	zw := zip.NewWriter(f)
+	w, err := zw.Create(blendName)
+	if err != nil {
+		return err
+	}
+	if _, err := w.Write([]byte("BLENDER-TEST")); err != nil {
+		return err
+	}
+	return zw.Close()
+}
+
+func fileExists(path string) bool {
+	_, err := os.Stat(path)
+	return err == nil
+}
+
+func TestValidateUploadSessionForJobCreation_ContextMissing(t *testing.T) {
+	tmpDir := t.TempDir()
+	s := &Manager{
+		uploadSessions: map[string]*UploadSession{
+			"s1": {
+				SessionID: "s1",
+				UserID:    9,
+				TempDir:   tmpDir,
+				Status:    "completed",
+				CreatedAt: time.Now(),
+			},
+		},
+	}
+
+	if _, _, err := s.validateUploadSessionForJobCreation("s1", 9); err == nil {
+		t.Fatal("expected error when context.tar is missing")
+	}
+}
+
+func TestValidateUploadSessionForJobCreation_NotReady(t *testing.T) {
+	tmpDir := t.TempDir()
+	s := &Manager{
+		uploadSessions: map[string]*UploadSession{
+			"s1": {
+				SessionID: "s1",
+				UserID:    9,
+				TempDir:   tmpDir,
+				Status:    "processing",
+				CreatedAt: time.Now(),
+			},
+		},
+	}
+
+	_, _, err := s.validateUploadSessionForJobCreation("s1", 9)
+	if err == nil {
+		t.Fatal("expected error for session that is not completed")
+	}
+	sessionErr, ok := err.(*uploadSessionValidationError)
+	if !ok || sessionErr.Code != uploadSessionNotReadyCode {
+		t.Fatalf("expected %s validation error, got %#v", uploadSessionNotReadyCode, err)
+	}
+}
+
+func TestValidateUploadSessionForJobCreation_Success(t *testing.T) {
+	tmpDir := t.TempDir()
+	contextPath := filepath.Join(tmpDir, "context.tar")
+	if err := os.WriteFile(contextPath, []byte("tar-bytes"), 0644); err != nil {
+		t.Fatalf("write context.tar: %v", err)
+	}
+
+	s := &Manager{
+		uploadSessions: map[string]*UploadSession{
+			"s1": {
+				SessionID: "s1",
+				UserID:    9,
+				TempDir:   tmpDir,
+				Status:    "completed",
+				CreatedAt: time.Now(),
+			},
+		},
+	}
+
+	session, gotPath, err := s.validateUploadSessionForJobCreation("s1", 9)
+	if err != nil {
+		t.Fatalf("expected valid session, got error: %v", err)
+	}
+	if session == nil || gotPath != contextPath {
+		t.Fatalf("unexpected result: session=%v path=%q", session, gotPath)
+	}
+}
+

internal/manager/manager.go

@@ -30,27 +30,22 @@ import (
 	"github.com/gorilla/websocket"
 )
 
-// Configuration constants
+// Configuration constants (non-configurable infrastructure values)
 const (
 	// WebSocket timeouts
 	WSReadDeadline  = 90 * time.Second
 	WSPingInterval  = 30 * time.Second
 	WSWriteDeadline = 10 * time.Second
 
-	// Task timeouts
-	RenderTimeout      = 60 * 60      // 1 hour for frame rendering
-	VideoEncodeTimeout = 60 * 60 * 24 // 24 hours for encoding
-
-	// Limits
-	MaxUploadSize            = 50 << 30 // 50 GB
+	// Infrastructure timers
 	RunnerHeartbeatTimeout   = 90 * time.Second
 	TaskDistributionInterval = 10 * time.Second
 	ProgressUpdateThrottle   = 2 * time.Second
-
-	// Cookie settings
-	SessionCookieMaxAge = 86400 // 24 hours
 )
 
+// Operational limits are loaded from database config at Manager initialization.
+// Defaults are defined in internal/config/config.go convenience methods.
+
 // Manager represents the manager server
 type Manager struct {
 	db      *database.DB
@@ -109,6 +104,12 @@ type Manager struct {
 
 	// Server start time for health checks
 	startTime time.Time
+
+	// Configurable operational values loaded from config
+	renderTimeout      int   // seconds
+	videoEncodeTimeout int   // seconds
+	maxUploadSize      int64 // bytes
+	sessionCookieMaxAge int  // seconds
 }
 
 // ClientConnection represents a client WebSocket connection with subscriptions
@@ -166,8 +167,12 @@ func NewManager(db *database.DB, cfg *config.Config, auth *authpkg.Auth, storage
 		router:    chi.NewRouter(),
 		ui:        ui,
 		startTime: time.Now(),
+
+		renderTimeout:       cfg.RenderTimeoutSeconds(),
+		videoEncodeTimeout:  cfg.EncodeTimeoutSeconds(),
+		maxUploadSize:       cfg.MaxUploadBytes(),
+		sessionCookieMaxAge: cfg.SessionCookieMaxAgeSec(),
 		wsUpgrader: websocket.Upgrader{
-			CheckOrigin:     checkWebSocketOrigin,
 			ReadBufferSize:  1024,
 			WriteBufferSize: 1024,
 		},
@@ -189,6 +194,17 @@ func NewManager(db *database.DB, cfg *config.Config, auth *authpkg.Auth, storage
 		jobStatusUpdateMu: make(map[int64]*sync.Mutex),
 	}
 
+	// Initialize rate limiters from config
+	apiRateLimiter = NewRateLimiter(cfg.APIRateLimitPerMinute(), time.Minute)
+	authRateLimiter = NewRateLimiter(cfg.AuthRateLimitPerMinute(), time.Minute)
+
+	// WebSocket origin check uses config production mode (not env-only)
+	s.wsUpgrader.CheckOrigin = s.checkWebSocketOrigin
+
+	// Job tokens must outlive the longest task timeout so long encodes can upload results
+	ttl := authpkg.ConfigureJobTokenTTLFromTimeouts(cfg.RenderTimeoutSeconds(), cfg.EncodeTimeoutSeconds())
+	log.Printf("Job token TTL configured to %v (max task timeout + skew)", ttl)
+
 	// Check for required external tools
 	if err := s.checkRequiredTools(); err != nil {
 		return nil, err
@@ -222,9 +238,9 @@ func (s *Manager) checkRequiredTools() error {
 	return nil
 }
 
-// checkWebSocketOrigin validates WebSocket connection origins
-// In production mode, only allows same-origin connections or configured allowed origins
-func checkWebSocketOrigin(r *http.Request) bool {
+// checkWebSocketOrigin validates WebSocket connection origins using the manager's
+// production mode config (single source of truth with cookies/CORS/rate limits).
+func (s *Manager) checkWebSocketOrigin(r *http.Request) bool {
 	origin := r.Header.Get("Origin")
 	if origin == "" {
 		// No origin header - allow (could be non-browser client like runner)
@@ -232,14 +248,18 @@ func checkWebSocketOrigin(r *http.Request) bool {
 	}
 
 	// In development mode, allow all origins
-	// Note: This function doesn't have access to Server, so we use authpkg.IsProductionMode()
-	// which checks environment variable. The server setup uses s.cfg.IsProductionMode() for consistency.
-	if !authpkg.IsProductionMode() {
+	if !s.cfg.IsProductionMode() {
 		return true
 	}
 
-	// In production, check against allowed origins
-	allowedOrigins := os.Getenv("ALLOWED_ORIGINS")
+	// In production, check against configured allowed origins (DB config, then env)
+	allowedOrigins := ""
+	if s.cfg != nil {
+		allowedOrigins = s.cfg.AllowedOrigins()
+	}
+	if allowedOrigins == "" {
+		allowedOrigins = os.Getenv("ALLOWED_ORIGINS")
+	}
 	if allowedOrigins == "" {
 		// Default to same-origin only
 		host := r.Host
@@ -267,6 +287,7 @@ type RateLimiter struct {
 	mu       sync.RWMutex
 	limit    int           // max requests
 	window   time.Duration // time window
+	stopChan chan struct{}
 }
 
 // NewRateLimiter creates a new rate limiter
@@ -275,12 +296,17 @@ func NewRateLimiter(limit int, window time.Duration) *RateLimiter {
 		requests: make(map[string][]time.Time),
 		limit:    limit,
 		window:   window,
+		stopChan: make(chan struct{}),
 	}
-	// Start cleanup goroutine
 	go rl.cleanup()
 	return rl
 }
 
+// Stop shuts down the cleanup goroutine.
+func (rl *RateLimiter) Stop() {
+	close(rl.stopChan)
+}
+
 // Allow checks if a request from the given IP is allowed
 func (rl *RateLimiter) Allow(ip string) bool {
 	rl.mu.Lock()
@@ -313,32 +339,37 @@ func (rl *RateLimiter) Allow(ip string) bool {
 // cleanup periodically removes old entries
 func (rl *RateLimiter) cleanup() {
 	ticker := time.NewTicker(5 * time.Minute)
-	for range ticker.C {
-		rl.mu.Lock()
-		cutoff := time.Now().Add(-rl.window)
-		for ip, reqs := range rl.requests {
-			validReqs := make([]time.Time, 0, len(reqs))
-			for _, t := range reqs {
-				if t.After(cutoff) {
-					validReqs = append(validReqs, t)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ticker.C:
+			rl.mu.Lock()
+			cutoff := time.Now().Add(-rl.window)
+			for ip, reqs := range rl.requests {
+				validReqs := make([]time.Time, 0, len(reqs))
+				for _, t := range reqs {
+					if t.After(cutoff) {
+						validReqs = append(validReqs, t)
+					}
+				}
+				if len(validReqs) == 0 {
+					delete(rl.requests, ip)
+				} else {
+					rl.requests[ip] = validReqs
 				}
 			}
-			if len(validReqs) == 0 {
-				delete(rl.requests, ip)
-			} else {
-				rl.requests[ip] = validReqs
-			}
+			rl.mu.Unlock()
+		case <-rl.stopChan:
+			return
 		}
-		rl.mu.Unlock()
 	}
 }
 
-// Global rate limiters for different endpoint types
+// Rate limiters — initialized per Manager instance in NewManager.
 var (
-	// General API rate limiter: 100 requests per minute per IP
-	apiRateLimiter = NewRateLimiter(100, time.Minute)
-	// Auth rate limiter: 10 requests per minute per IP (stricter for login attempts)
-	authRateLimiter = NewRateLimiter(10, time.Minute)
+	apiRateLimiter  *RateLimiter
+	authRateLimiter *RateLimiter
 )
 
 // rateLimitMiddleware applies rate limiting based on client IP
@@ -373,10 +404,23 @@ func rateLimitMiddleware(limiter *RateLimiter) func(http.Handler) http.Handler {
 	}
 }
 
+// securityHeadersMiddleware sets baseline security response headers.
+func securityHeadersMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("X-Content-Type-Options", "nosniff")
+		w.Header().Set("X-Frame-Options", "DENY")
+		w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
+		// Baseline CSP: allow same-origin scripts/styles for embedded UI
+		w.Header().Set("Content-Security-Policy", "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self' ws: wss:; frame-ancestors 'none'")
+		next.ServeHTTP(w, r)
+	})
+}
+
 // setupMiddleware configures middleware
 func (s *Manager) setupMiddleware() {
 	s.router.Use(middleware.Logger)
 	s.router.Use(middleware.Recoverer)
+	s.router.Use(securityHeadersMiddleware)
 	// Note: Timeout middleware is NOT applied globally to avoid conflicts with WebSocket connections
 	// WebSocket connections are long-lived and should not have HTTP timeouts
 
@@ -488,7 +532,10 @@ func (s *Manager) setupRoutes() {
 		r.Post("/local/login", s.handleLocalLogin)
 		r.Post("/logout", s.handleLogout)
 		r.Get("/me", s.handleGetMe)
-		r.Post("/change-password", s.handleChangePassword)
+		// Password change requires an authenticated session
+		r.With(func(next http.Handler) http.Handler {
+			return http.HandlerFunc(s.auth.Middleware(next.ServeHTTP))
+		}).Post("/change-password", s.handleChangePassword)
 	})
 
 	// Protected routes
@@ -609,19 +656,25 @@ func (s *Manager) respondError(w http.ResponseWriter, status int, message string
 	s.respondJSON(w, status, map[string]string{"error": message})
 }
 
+func (s *Manager) respondErrorWithCode(w http.ResponseWriter, status int, code, message string) {
+	s.respondJSON(w, status, map[string]string{
+		"error": message,
+		"code":  code,
+	})
+}
+
 // createSessionCookie creates a secure session cookie with appropriate flags for the environment
-func createSessionCookie(sessionID string) *http.Cookie {
+func (s *Manager) createSessionCookie(sessionID string) *http.Cookie {
 	cookie := &http.Cookie{
 		Name:     "session_id",
 		Value:    sessionID,
 		Path:     "/",
-		MaxAge:   SessionCookieMaxAge,
+		MaxAge:   s.sessionCookieMaxAge,
 		HttpOnly: true,
 		SameSite: http.SameSiteLaxMode,
 	}
 
-	// In production mode, set Secure flag to require HTTPS
-	if authpkg.IsProductionMode() {
+	if s.cfg.IsProductionMode() {
 		cookie.Secure = true
 	}
 
@@ -699,6 +752,11 @@ func (s *Manager) handleGoogleCallback(w http.ResponseWriter, r *http.Request) {
 		s.respondError(w, http.StatusBadRequest, "Missing code parameter")
 		return
 	}
+	state := r.URL.Query().Get("state")
+	if !s.auth.ConsumeOAuthState(state) {
+		s.respondError(w, http.StatusBadRequest, "Invalid or missing OAuth state")
+		return
+	}
 
 	session, err := s.auth.GoogleCallback(r.Context(), code)
 	if err != nil {
@@ -707,12 +765,16 @@ func (s *Manager) handleGoogleCallback(w http.ResponseWriter, r *http.Request) {
 			http.Redirect(w, r, "/?error=registration_disabled", http.StatusFound)
 			return
 		}
+		if strings.Contains(err.Error(), "already exists") {
+			http.Redirect(w, r, "/?error=account_exists", http.StatusFound)
+			return
+		}
 		s.respondError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
 
 	sessionID := s.auth.CreateSession(session)
-	http.SetCookie(w, createSessionCookie(sessionID))
+	http.SetCookie(w, s.createSessionCookie(sessionID))
 
 	http.Redirect(w, r, "/", http.StatusFound)
 }
@@ -732,6 +794,11 @@ func (s *Manager) handleDiscordCallback(w http.ResponseWriter, r *http.Request)
 		s.respondError(w, http.StatusBadRequest, "Missing code parameter")
 		return
 	}
+	state := r.URL.Query().Get("state")
+	if !s.auth.ConsumeOAuthState(state) {
+		s.respondError(w, http.StatusBadRequest, "Invalid or missing OAuth state")
+		return
+	}
 
 	session, err := s.auth.DiscordCallback(r.Context(), code)
 	if err != nil {
@@ -740,12 +807,16 @@ func (s *Manager) handleDiscordCallback(w http.ResponseWriter, r *http.Request)
 			http.Redirect(w, r, "/?error=registration_disabled", http.StatusFound)
 			return
 		}
+		if strings.Contains(err.Error(), "already exists") {
+			http.Redirect(w, r, "/?error=account_exists", http.StatusFound)
+			return
+		}
 		s.respondError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
 
 	sessionID := s.auth.CreateSession(session)
-	http.SetCookie(w, createSessionCookie(sessionID))
+	http.SetCookie(w, s.createSessionCookie(sessionID))
 
 	http.Redirect(w, r, "/", http.StatusFound)
 }
@@ -838,7 +909,7 @@ func (s *Manager) handleLocalRegister(w http.ResponseWriter, r *http.Request) {
 	}
 
 	sessionID := s.auth.CreateSession(session)
-	http.SetCookie(w, createSessionCookie(sessionID))
+	http.SetCookie(w, s.createSessionCookie(sessionID))
 
 	s.respondJSON(w, http.StatusCreated, map[string]interface{}{
 		"message": "Registration successful",
@@ -875,7 +946,7 @@ func (s *Manager) handleLocalLogin(w http.ResponseWriter, r *http.Request) {
 	}
 
 	sessionID := s.auth.CreateSession(session)
-	http.SetCookie(w, createSessionCookie(sessionID))
+	http.SetCookie(w, s.createSessionCookie(sessionID))
 
 	s.respondJSON(w, http.StatusOK, map[string]interface{}{
 		"message": "Login successful",
@@ -1242,11 +1313,17 @@ func (s *Manager) cleanupOldTempDirectoriesOnce() {
 	now := time.Now()
 	cleanedCount := 0
 
-	// Check upload sessions to avoid deleting active uploads
+	// Check upload sessions to avoid deleting active uploads.
+	// Key by TempDir path (and basename) — not session UUID.
 	s.uploadSessionsMu.RLock()
-	activeSessions := make(map[string]bool)
-	for sessionID := range s.uploadSessions {
-		activeSessions[sessionID] = true
+	activeTempDirs := make(map[string]bool)
+	for _, session := range s.uploadSessions {
+		if session == nil || session.TempDir == "" {
+			continue
+		}
+		clean := filepath.Clean(session.TempDir)
+		activeTempDirs[clean] = true
+		activeTempDirs[filepath.Base(clean)] = true
 	}
 	s.uploadSessionsMu.RUnlock()
 
@@ -1258,7 +1335,7 @@ func (s *Manager) cleanupOldTempDirectoriesOnce() {
 		entryPath := filepath.Join(tempPath, entry.Name())
 
 		// Skip if this directory has an active upload session
-		if activeSessions[entryPath] {
+		if activeTempDirs[filepath.Clean(entryPath)] || activeTempDirs[entry.Name()] {
 			continue
 		}
 

internal/manager/manager_test.go

@@ -0,0 +1,120 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"jiggablend/internal/config"
+	"jiggablend/internal/storage"
+)
+
+func TestCheckWebSocketOrigin_DevelopmentAllowsOrigin(t *testing.T) {
+	t.Setenv("PRODUCTION", "")
+	s := &Manager{cfg: &config.Config{}}
+	req := httptest.NewRequest("GET", "http://localhost/ws", nil)
+	req.Host = "localhost:8080"
+	req.Header.Set("Origin", "http://example.com")
+	if !s.checkWebSocketOrigin(req) {
+		t.Fatal("expected development mode to allow origin")
+	}
+}
+
+func TestCheckWebSocketOrigin_ProductionSameHostAllowed(t *testing.T) {
+	t.Setenv("PRODUCTION", "true")
+	t.Setenv("ALLOWED_ORIGINS", "")
+	s := &Manager{cfg: &config.Config{}}
+	req := httptest.NewRequest("GET", "http://localhost/ws", nil)
+	req.Host = "localhost:8080"
+	req.Header.Set("Origin", "http://localhost:8080")
+	if !s.checkWebSocketOrigin(req) {
+		t.Fatal("expected same-host origin to be allowed")
+	}
+}
+
+func TestRespondErrorWithCode_IncludesCodeField(t *testing.T) {
+	s := &Manager{}
+	rr := httptest.NewRecorder()
+	s.respondErrorWithCode(rr, http.StatusBadRequest, "UPLOAD_SESSION_EXPIRED", "Upload session expired.")
+
+	if rr.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want %d", rr.Code, http.StatusBadRequest)
+	}
+	var payload map[string]string
+	if err := json.Unmarshal(rr.Body.Bytes(), &payload); err != nil {
+		t.Fatalf("failed to decode response: %v", err)
+	}
+	if payload["code"] != "UPLOAD_SESSION_EXPIRED" {
+		t.Fatalf("unexpected code: %q", payload["code"])
+	}
+	if payload["error"] == "" {
+		t.Fatal("expected non-empty error message")
+	}
+}
+
+func TestSecurityHeadersMiddleware_SetsBaselineHeaders(t *testing.T) {
+	h := securityHeadersMiddleware(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	h.ServeHTTP(rr, req)
+	if rr.Header().Get("X-Content-Type-Options") != "nosniff" {
+		t.Fatalf("missing nosniff, got %q", rr.Header().Get("X-Content-Type-Options"))
+	}
+	if rr.Header().Get("X-Frame-Options") != "DENY" {
+		t.Fatalf("missing frame deny")
+	}
+	if rr.Header().Get("Content-Security-Policy") == "" {
+		t.Fatal("missing CSP")
+	}
+}
+
+func TestCleanupOldTempDirectories_SkipsActiveSessionTempDir(t *testing.T) {
+	base := t.TempDir()
+	st, err := storage.NewStorage(base)
+	if err != nil {
+		t.Fatalf("NewStorage: %v", err)
+	}
+	tempPath := filepath.Join(base, "temp")
+	activeDir, err := os.MkdirTemp(tempPath, "jiggablend-upload-*")
+	if err != nil {
+		t.Fatal(err)
+	}
+	oldTime := time.Now().Add(-2 * time.Hour)
+	_ = os.Chtimes(activeDir, oldTime, oldTime)
+
+	staleDir := filepath.Join(tempPath, "stale-old-dir")
+	if err := os.MkdirAll(staleDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	_ = os.Chtimes(staleDir, oldTime, oldTime)
+
+	s := &Manager{
+		storage: st,
+		uploadSessions: map[string]*UploadSession{
+			"active": {SessionID: "active", TempDir: activeDir},
+		},
+	}
+	s.cleanupOldTempDirectoriesOnce()
+
+	if _, err := os.Stat(activeDir); err != nil {
+		t.Fatalf("active session temp dir was deleted: %v", err)
+	}
+	if _, err := os.Stat(staleDir); !os.IsNotExist(err) {
+		t.Fatalf("stale temp dir should have been removed, stat err=%v", err)
+	}
+}
+
+func TestCreateSessionCookie_UsesConfigProductionMode(t *testing.T) {
+	t.Setenv("PRODUCTION", "true")
+	s := &Manager{cfg: &config.Config{}, sessionCookieMaxAge: 3600}
+	cookie := s.createSessionCookie("sid")
+	if !cookie.Secure {
+		t.Fatal("expected Secure cookie when production mode is on via env")
+	}
+}

internal/manager/metadata.go

@@ -19,6 +19,9 @@ import (
 	"jiggablend/pkg/types"
 )
 
+var runMetadataCommand = executils.RunCommand
+var resolveMetadataBlenderPath = resolveBlenderBinaryPath
+
 // handleGetJobMetadata retrieves metadata for a job
 func (s *Manager) handleGetJobMetadata(w http.ResponseWriter, r *http.Request) {
 	userID, err := getUserID(r)
@@ -141,16 +144,24 @@ func (s *Manager) extractMetadataFromContext(jobID int64) (*types.BlendMetadata,
 		return nil, fmt.Errorf("failed to create extraction script: %w", err)
 	}
 
-	// Make blend file path relative to tmpDir to avoid path resolution issues
-	blendFileRel, err := filepath.Rel(tmpDir, blendFile)
+	// Use absolute paths to avoid path normalization issues with relative traversal.
+	blendFileAbs, err := filepath.Abs(blendFile)
 	if err != nil {
-		return nil, fmt.Errorf("failed to get relative path for blend file: %w", err)
+		return nil, fmt.Errorf("failed to get absolute path for blend file: %w", err)
+	}
+	scriptPathAbs, err := filepath.Abs(scriptPath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get absolute path for extraction script: %w", err)
 	}
 
 	// Execute Blender with Python script using executils
-	result, err := executils.RunCommand(
-		"blender",
-		[]string{"-b", blendFileRel, "--python", "extract_metadata.py"},
+	blenderBinary, err := resolveMetadataBlenderPath("blender")
+	if err != nil {
+		return nil, err
+	}
+	result, err := runMetadataCommand(
+		blenderBinary,
+		[]string{"-b", blendFileAbs, "--python", scriptPathAbs},
 		tmpDir,
 		nil, // inherit environment
 		jobID,
@@ -225,8 +236,17 @@ func (s *Manager) extractTar(tarPath, destDir string) error {
 			return fmt.Errorf("failed to read tar header: %w", err)
 		}
 
-		// Sanitize path to prevent directory traversal
-		target := filepath.Join(destDir, header.Name)
+		// Sanitize path to prevent directory traversal. TAR stores "/" separators, so normalize first.
+		normalizedHeaderPath := filepath.FromSlash(header.Name)
+		cleanHeaderPath := filepath.Clean(normalizedHeaderPath)
+		if cleanHeaderPath == "." {
+			continue
+		}
+		if filepath.IsAbs(cleanHeaderPath) || strings.HasPrefix(cleanHeaderPath, ".."+string(os.PathSeparator)) || cleanHeaderPath == ".." {
+			log.Printf("ERROR: Invalid file path in TAR - header: %s", header.Name)
+			return fmt.Errorf("invalid file path in archive: %s", header.Name)
+		}
+		target := filepath.Join(destDir, cleanHeaderPath)
 
 		// Ensure target is within destDir
 		cleanTarget := filepath.Clean(target)
@@ -237,14 +257,14 @@ func (s *Manager) extractTar(tarPath, destDir string) error {
 		}
 
 		// Create parent directories
-		if err := os.MkdirAll(filepath.Dir(target), 0755); err != nil {
+		if err := os.MkdirAll(filepath.Dir(cleanTarget), 0755); err != nil {
 			return fmt.Errorf("failed to create directory: %w", err)
 		}
 
 		// Write file
 		switch header.Typeflag {
 		case tar.TypeReg:
-			outFile, err := os.Create(target)
+			outFile, err := os.Create(cleanTarget)
 			if err != nil {
 				return fmt.Errorf("failed to create file: %w", err)
 			}

internal/manager/metadata_merge.go

@@ -0,0 +1,70 @@
+package api
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"jiggablend/pkg/types"
+)
+
+func uploadSessionMetadata(session *UploadSession) *types.BlendMetadata {
+	if session == nil || session.ResultMetadata == nil {
+		return nil
+	}
+
+	switch m := session.ResultMetadata.(type) {
+	case *types.BlendMetadata:
+		return m
+	case types.BlendMetadata:
+		meta := m
+		return &meta
+	default:
+		data, err := json.Marshal(session.ResultMetadata)
+		if err != nil {
+			return nil
+		}
+		var meta types.BlendMetadata
+		if err := json.Unmarshal(data, &meta); err != nil {
+			return nil
+		}
+		return &meta
+	}
+}
+
+// mergeBlendMetadataForJobCreate starts from upload analysis metadata when available,
+// then applies explicit job creation overrides from the request.
+func mergeBlendMetadataForJobCreate(uploadMeta *types.BlendMetadata, req *types.CreateJobRequest) (*types.BlendMetadata, error) {
+	if req.FrameStart == nil || req.FrameEnd == nil {
+		return nil, fmt.Errorf("frame_start and frame_end are required")
+	}
+
+	var metadata types.BlendMetadata
+	if uploadMeta != nil {
+		metadata = *uploadMeta
+	}
+
+	metadata.FrameStart = *req.FrameStart
+	metadata.FrameEnd = *req.FrameEnd
+
+	if req.RenderSettings != nil {
+		metadata.RenderSettings = *req.RenderSettings
+	}
+	if req.OutputFormat != nil {
+		metadata.RenderSettings.OutputFormat = *req.OutputFormat
+	}
+	if req.BlenderVersion != nil && *req.BlenderVersion != "" {
+		metadata.BlenderVersion = *req.BlenderVersion
+	}
+	if req.UnhideObjects != nil {
+		metadata.UnhideObjects = req.UnhideObjects
+	}
+	if req.EnableExecution != nil {
+		metadata.EnableExecution = req.EnableExecution
+	}
+
+	if metadata.BlenderVersion == "" {
+		return nil, fmt.Errorf("blender_version is required (from upload analysis or job request)")
+	}
+
+	return &metadata, nil
+}

internal/manager/metadata_merge_test.go

@@ -0,0 +1,106 @@
+package api
+
+import (
+	"testing"
+
+	"jiggablend/pkg/types"
+)
+
+func TestMergeBlendMetadataForJobCreate_PreservesUploadMetadata(t *testing.T) {
+	uploadMeta := &types.BlendMetadata{
+		FrameStart:     -15,
+		FrameEnd:       1468,
+		BlenderVersion: "4.5.11",
+		RenderSettings: types.RenderSettings{
+			ResolutionX: 2560,
+			ResolutionY: 1440,
+			Engine:      "cycles",
+			OutputFormat: "EXR",
+		},
+		SceneInfo: types.SceneInfo{
+			ObjectCount: 42,
+		},
+	}
+
+	frameStart := 800
+	frameEnd := 800
+	outputFormat := "EXR"
+	req := &types.CreateJobRequest{
+		FrameStart:   &frameStart,
+		FrameEnd:     &frameEnd,
+		OutputFormat: &outputFormat,
+	}
+
+	meta, err := mergeBlendMetadataForJobCreate(uploadMeta, req)
+	if err != nil {
+		t.Fatalf("mergeBlendMetadataForJobCreate failed: %v", err)
+	}
+
+	if meta.BlenderVersion != "4.5.11" {
+		t.Fatalf("expected blender_version 4.5.11, got %q", meta.BlenderVersion)
+	}
+	if meta.FrameStart != 800 || meta.FrameEnd != 800 {
+		t.Fatalf("expected frame range 800-800, got %d-%d", meta.FrameStart, meta.FrameEnd)
+	}
+	if meta.RenderSettings.ResolutionX != 2560 || meta.RenderSettings.ResolutionY != 1440 {
+		t.Fatalf("expected resolution 2560x1440, got %dx%d", meta.RenderSettings.ResolutionX, meta.RenderSettings.ResolutionY)
+	}
+	if meta.RenderSettings.Engine != "cycles" {
+		t.Fatalf("expected engine cycles, got %q", meta.RenderSettings.Engine)
+	}
+	if meta.RenderSettings.OutputFormat != "EXR" {
+		t.Fatalf("expected output_format EXR, got %q", meta.RenderSettings.OutputFormat)
+	}
+	if meta.SceneInfo.ObjectCount != 42 {
+		t.Fatalf("expected scene object_count 42, got %d", meta.SceneInfo.ObjectCount)
+	}
+}
+
+func TestMergeBlendMetadataForJobCreate_RequestOverridesVersion(t *testing.T) {
+	uploadMeta := &types.BlendMetadata{
+		BlenderVersion: "4.5.11",
+	}
+
+	frameStart := 1
+	frameEnd := 1
+	override := "4.2.3"
+	req := &types.CreateJobRequest{
+		FrameStart:     &frameStart,
+		FrameEnd:       &frameEnd,
+		BlenderVersion: &override,
+	}
+
+	meta, err := mergeBlendMetadataForJobCreate(uploadMeta, req)
+	if err != nil {
+		t.Fatalf("mergeBlendMetadataForJobCreate failed: %v", err)
+	}
+	if meta.BlenderVersion != "4.2.3" {
+		t.Fatalf("expected request override 4.2.3, got %q", meta.BlenderVersion)
+	}
+}
+
+func TestMergeBlendMetadataForJobCreate_RequiresBlenderVersion(t *testing.T) {
+	frameStart := 1
+	frameEnd := 1
+	req := &types.CreateJobRequest{
+		FrameStart: &frameStart,
+		FrameEnd:   &frameEnd,
+	}
+
+	if _, err := mergeBlendMetadataForJobCreate(nil, req); err == nil {
+		t.Fatal("expected error when blender_version is missing")
+	}
+}
+
+func TestUploadSessionMetadata(t *testing.T) {
+	session := &UploadSession{
+		ResultMetadata: &types.BlendMetadata{
+			BlenderVersion: "4.5.11",
+		},
+	}
+
+	meta := uploadSessionMetadata(session)
+	if meta == nil || meta.BlenderVersion != "4.5.11" {
+		t.Fatalf("unexpected metadata: %+v", meta)
+	}
+}

internal/manager/metadata_test.go

@@ -0,0 +1,98 @@
+package api
+
+import (
+	"archive/tar"
+	"bytes"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"jiggablend/internal/storage"
+	"jiggablend/pkg/executils"
+)
+
+func TestExtractTar_ExtractsRegularFile(t *testing.T) {
+	var buf bytes.Buffer
+	tw := tar.NewWriter(&buf)
+	_ = tw.WriteHeader(&tar.Header{Name: "ctx/scene.blend", Mode: 0644, Size: 4, Typeflag: tar.TypeReg})
+	_, _ = tw.Write([]byte("data"))
+	_ = tw.Close()
+
+	tarPath := filepath.Join(t.TempDir(), "ctx.tar")
+	if err := os.WriteFile(tarPath, buf.Bytes(), 0644); err != nil {
+		t.Fatalf("write tar: %v", err)
+	}
+	dest := t.TempDir()
+	m := &Manager{}
+	if err := m.extractTar(tarPath, dest); err != nil {
+		t.Fatalf("extractTar failed: %v", err)
+	}
+	if _, err := os.Stat(filepath.Join(dest, "ctx", "scene.blend")); err != nil {
+		t.Fatalf("expected extracted file: %v", err)
+	}
+}
+
+func TestExtractTar_RejectsTraversal(t *testing.T) {
+	var buf bytes.Buffer
+	tw := tar.NewWriter(&buf)
+	_ = tw.WriteHeader(&tar.Header{Name: "../evil.txt", Mode: 0644, Size: 1, Typeflag: tar.TypeReg})
+	_, _ = tw.Write([]byte("x"))
+	_ = tw.Close()
+
+	tarPath := filepath.Join(t.TempDir(), "bad.tar")
+	if err := os.WriteFile(tarPath, buf.Bytes(), 0644); err != nil {
+		t.Fatalf("write tar: %v", err)
+	}
+	m := &Manager{}
+	if err := m.extractTar(tarPath, t.TempDir()); err == nil {
+		t.Fatal("expected path traversal error")
+	}
+}
+
+func TestExtractMetadataFromContext_UsesCommandSeam(t *testing.T) {
+	base := t.TempDir()
+	st, err := storage.NewStorage(base)
+	if err != nil {
+		t.Fatalf("new storage: %v", err)
+	}
+
+	jobID := int64(42)
+	jobDir := st.JobPath(jobID)
+	if err := os.MkdirAll(jobDir, 0755); err != nil {
+		t.Fatalf("mkdir job dir: %v", err)
+	}
+
+	var buf bytes.Buffer
+	tw := tar.NewWriter(&buf)
+	_ = tw.WriteHeader(&tar.Header{Name: "scene.blend", Mode: 0644, Size: 4, Typeflag: tar.TypeReg})
+	_, _ = tw.Write([]byte("fake"))
+	_ = tw.Close()
+	if err := os.WriteFile(filepath.Join(jobDir, "context.tar"), buf.Bytes(), 0644); err != nil {
+		t.Fatalf("write context tar: %v", err)
+	}
+
+	origResolve := resolveMetadataBlenderPath
+	origRun := runMetadataCommand
+	resolveMetadataBlenderPath = func(_ string) (string, error) { return "/usr/bin/blender", nil }
+	runMetadataCommand = func(_ string, _ []string, _ string, _ []string, _ int64, _ *executils.ProcessTracker) (*executils.CommandResult, error) {
+		return &executils.CommandResult{
+			Stdout: `noise
+{"frame_start":1,"frame_end":3,"has_negative_frames":false,"render_settings":{"resolution_x":1920,"resolution_y":1080,"frame_rate":24,"output_format":"PNG","engine":"CYCLES"},"scene_info":{"camera_count":1,"object_count":2,"material_count":3}}
+done`,
+		}, nil
+	}
+	defer func() {
+		resolveMetadataBlenderPath = origResolve
+		runMetadataCommand = origRun
+	}()
+
+	m := &Manager{storage: st}
+	meta, err := m.extractMetadataFromContext(jobID)
+	if err != nil {
+		t.Fatalf("extractMetadataFromContext failed: %v", err)
+	}
+	if meta.FrameStart != 1 || meta.FrameEnd != 3 {
+		t.Fatalf("unexpected metadata: %+v", *meta)
+	}
+}
+

internal/manager/renderer.go

@@ -3,6 +3,7 @@ package api
 import (
 	"fmt"
 	"html/template"
+	"log"
 	"net/http"
 	"strings"
 	"time"
@@ -92,13 +93,17 @@ func newUIRenderer() (*uiRenderer, error) {
 func (r *uiRenderer) render(w http.ResponseWriter, data pageData) {
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	if err := r.templates.ExecuteTemplate(w, "base", data); err != nil {
+		log.Printf("Template render error: %v", err)
 		http.Error(w, "template render error", http.StatusInternalServerError)
+		return
 	}
 }
 
 func (r *uiRenderer) renderTemplate(w http.ResponseWriter, templateName string, data interface{}) {
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	if err := r.templates.ExecuteTemplate(w, templateName, data); err != nil {
+		log.Printf("Template render error for %s: %v", templateName, err)
 		http.Error(w, "template render error", http.StatusInternalServerError)
+		return
 	}
 }

internal/manager/runners_test.go

@@ -0,0 +1,100 @@
+package api
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+func TestParseBlenderFrame(t *testing.T) {
+	frame, ok := parseBlenderFrame("Info Fra:2470 Mem:12.00M")
+	if !ok || frame != 2470 {
+		t.Fatalf("parseBlenderFrame() = (%d,%v), want (2470,true)", frame, ok)
+	}
+	if _, ok := parseBlenderFrame("no frame here"); ok {
+		t.Fatal("expected parse to fail for non-frame text")
+	}
+}
+
+func TestJobTaskCounts_Progress(t *testing.T) {
+	c := &jobTaskCounts{total: 10, completed: 4}
+	if got := c.progress(); got != 40 {
+		t.Fatalf("progress() = %v, want 40", got)
+	}
+}
+
+func TestParseWSTaskUpdate_LegacyErrorObject(t *testing.T) {
+	// Simulates older runners that JSON-marshaled an error interface as {}
+	raw := json.RawMessage(`{"task_id":99,"success":false,"error":{}}`)
+	update, err := parseWSTaskUpdate(raw)
+	if err != nil {
+		t.Fatalf("parseWSTaskUpdate: %v", err)
+	}
+	if update.TaskID != 99 {
+		t.Fatalf("TaskID = %d, want 99", update.TaskID)
+	}
+	if update.Success {
+		t.Fatal("Success = true, want false")
+	}
+	if update.Error != "" {
+		t.Fatalf("Error = %q, want empty (legacy object)", update.Error)
+	}
+}
+
+func TestParseWSTaskUpdate_StringError(t *testing.T) {
+	raw := json.RawMessage(`{"task_id":7,"success":false,"error":"blender failed: signal: segmentation fault (core dumped)","free_requeue":true}`)
+	update, err := parseWSTaskUpdate(raw)
+	if err != nil {
+		t.Fatalf("parseWSTaskUpdate: %v", err)
+	}
+	if update.TaskID != 7 || update.Success {
+		t.Fatalf("unexpected update: %+v", update)
+	}
+	if update.Error != "blender failed: signal: segmentation fault (core dumped)" {
+		t.Fatalf("Error = %q", update.Error)
+	}
+	if !update.FreeRequeue {
+		t.Fatal("expected FreeRequeue true")
+	}
+}
+
+func TestFormatInferredTaskFailure(t *testing.T) {
+	tests := []struct {
+		name string
+		in   string
+		want string
+	}{
+		{
+			name: "task failed segfault prefix",
+			in:   "Task failed: blender failed: signal: segmentation fault (core dumped)",
+			want: "blender failed: signal: segmentation fault (core dumped)",
+		},
+		{
+			name: "blender render failed prefix",
+			in:   "Blender render failed: blender failed: signal: segmentation fault (core dumped)",
+			want: "blender failed: signal: segmentation fault (core dumped)",
+		},
+		{
+			name: "double prefix",
+			in:   "Task failed: Blender render failed: blender failed: signal: segmentation fault (core dumped)",
+			want: "blender failed: signal: segmentation fault (core dumped)",
+		},
+		{
+			name: "plain message",
+			in:   "blender failed: exit status 1",
+			want: "blender failed: exit status 1",
+		},
+		{
+			name: "empty falls back",
+			in:   "   ",
+			want: defaultUnexpectedDisconnectError,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := formatInferredTaskFailure(tt.in); got != tt.want {
+				t.Fatalf("formatInferredTaskFailure(%q) = %q, want %q", tt.in, got, tt.want)
+			}
+		})
+	}
+}
+

internal/runner/api/jobconn.go

@@ -18,6 +18,7 @@ type JobConnection struct {
 	writeMu       sync.Mutex
 	stopPing      chan struct{}
 	stopHeartbeat chan struct{}
+	stopOnce      sync.Once
 	isConnected   bool
 	connMu        sync.RWMutex
 }
@@ -132,13 +133,12 @@ func (j *JobConnection) pingLoop() {
 
 // Heartbeat sends a heartbeat message over WebSocket to keep runner online.
 func (j *JobConnection) Heartbeat() {
+	j.writeMu.Lock()
+	defer j.writeMu.Unlock()
 	if j.conn == nil {
 		return
 	}
 
-	j.writeMu.Lock()
-	defer j.writeMu.Unlock()
-
 	msg := map[string]interface{}{
 		"type":      "runner_heartbeat",
 		"timestamp": time.Now().Unix(),
@@ -178,27 +178,34 @@ func (j *JobConnection) heartbeatLoop() {
 	}
 }
 
+// stopLoops signals ping/heartbeat goroutines to exit.
+// Channels are closed once and left non-nil so loops can receive without racing Close.
+func (j *JobConnection) stopLoops() {
+	j.stopOnce.Do(func() {
+		if j.stopHeartbeat != nil {
+			close(j.stopHeartbeat)
+		}
+		if j.stopPing != nil {
+			close(j.stopPing)
+		}
+	})
+}
+
 // Close closes the WebSocket connection.
 func (j *JobConnection) Close() {
+	j.stopLoops()
+
+	j.writeMu.Lock()
+	defer j.writeMu.Unlock()
+
 	j.connMu.Lock()
 	j.isConnected = false
+	conn := j.conn
+	j.conn = nil
 	j.connMu.Unlock()
 
-	// Stop heartbeat goroutine
-	if j.stopHeartbeat != nil {
-		close(j.stopHeartbeat)
-		j.stopHeartbeat = nil
-	}
-
-	// Stop ping goroutine
-	if j.stopPing != nil {
-		close(j.stopPing)
-		j.stopPing = nil
-	}
-
-	if j.conn != nil {
-		j.conn.Close()
-		j.conn = nil
+	if conn != nil {
+		conn.Close()
 	}
 }
 
@@ -211,13 +218,12 @@ func (j *JobConnection) IsConnected() bool {
 
 // Log sends a log entry to the manager.
 func (j *JobConnection) Log(taskID int64, level types.LogLevel, message string) {
+	j.writeMu.Lock()
+	defer j.writeMu.Unlock()
 	if j.conn == nil {
 		return
 	}
 
-	j.writeMu.Lock()
-	defer j.writeMu.Unlock()
-
 	msg := map[string]interface{}{
 		"type": "log_entry",
 		"data": map[string]interface{}{
@@ -242,13 +248,12 @@ func (j *JobConnection) Log(taskID int64, level types.LogLevel, message string)
 
 // Progress sends a progress update to the manager.
 func (j *JobConnection) Progress(taskID int64, progress float64) {
+	j.writeMu.Lock()
+	defer j.writeMu.Unlock()
 	if j.conn == nil {
 		return
 	}
 
-	j.writeMu.Lock()
-	defer j.writeMu.Unlock()
-
 	msg := map[string]interface{}{
 		"type": "progress",
 		"data": map[string]interface{}{
@@ -272,13 +277,12 @@ func (j *JobConnection) Progress(taskID int64, progress float64) {
 
 // OutputUploaded notifies that an output file was uploaded.
 func (j *JobConnection) OutputUploaded(taskID int64, fileName string) {
+	j.writeMu.Lock()
+	defer j.writeMu.Unlock()
 	if j.conn == nil {
 		return
 	}
 
-	j.writeMu.Lock()
-	defer j.writeMu.Unlock()
-
 	msg := map[string]interface{}{
 		"type": "output_uploaded",
 		"data": map[string]interface{}{
@@ -301,22 +305,33 @@ func (j *JobConnection) OutputUploaded(taskID int64, fileName string) {
 }
 
 // Complete sends task completion to the manager.
-func (j *JobConnection) Complete(taskID int64, success bool, errorMsg error) {
+// errorMsg must be JSON-encoded as a string: encoding an error interface
+// marshals to {} and the manager fails to unmarshal task_complete, which
+// previously surfaced as a generic "WebSocket connection lost" with no retries.
+// freeRequeue asks the manager to requeue a failure without incrementing retry_count
+// (used when this attempt newly armed GPU lockout).
+func (j *JobConnection) Complete(taskID int64, success bool, errorMsg error, freeRequeue bool) {
+	j.writeMu.Lock()
+	defer j.writeMu.Unlock()
 	if j.conn == nil {
 		log.Printf("Cannot send task complete: WebSocket connection is nil")
 		return
 	}
 
-	j.writeMu.Lock()
-	defer j.writeMu.Unlock()
+	data := map[string]interface{}{
+		"task_id": taskID,
+		"success": success,
+	}
+	if errorMsg != nil {
+		data["error"] = errorMsg.Error()
+	}
+	if freeRequeue {
+		data["free_requeue"] = true
+	}
 
 	msg := map[string]interface{}{
-		"type": "task_complete",
-		"data": map[string]interface{}{
-			"task_id": taskID,
-			"success": success,
-			"error":   errorMsg,
-		},
+		"type":      "task_complete",
+		"data":      data,
 		"timestamp": time.Now().Unix(),
 	}
 	if err := j.conn.WriteJSON(msg); err != nil {

internal/runner/api/jobconn_test.go

@@ -0,0 +1,119 @@
+package api
+
+import (
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gorilla/websocket"
+)
+
+// TestComplete_ErrorIsJSONString ensures task_complete encodes the failure
+// reason as a string. Marshaling a Go error interface produces {}, which the
+// manager cannot unmarshal into WSTaskUpdate.Error and used to look like a
+// silent WebSocket drop with no retries.
+func TestComplete_ErrorIsJSONString(t *testing.T) {
+	upgrader := websocket.Upgrader{}
+	received := make(chan map[string]interface{}, 1)
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		conn, err := upgrader.Upgrade(w, r, nil)
+		if err != nil {
+			return
+		}
+		defer conn.Close()
+
+		// auth handshake
+		var auth map[string]interface{}
+		if err := conn.ReadJSON(&auth); err != nil {
+			return
+		}
+		if auth["type"] == "auth" {
+			_ = conn.WriteJSON(map[string]string{"type": "auth_ok"})
+		}
+
+		var msg map[string]interface{}
+		if err := conn.ReadJSON(&msg); err != nil {
+			return
+		}
+		received <- msg
+	}))
+	defer server.Close()
+
+	jc := NewJobConnection()
+	if err := jc.Connect(server.URL, "/job/1", "token123"); err != nil {
+		t.Fatalf("Connect failed: %v", err)
+	}
+	defer jc.Close()
+
+	jc.Complete(42, false, errors.New("blender failed: signal: segmentation fault (core dumped)"), true)
+
+	select {
+	case msg := <-received:
+		if msg["type"] != "task_complete" {
+			t.Fatalf("type = %v, want task_complete", msg["type"])
+		}
+		data, ok := msg["data"].(map[string]interface{})
+		if !ok {
+			// gorilla may leave nested objects as map[string]interface{} after JSON round-trip;
+			// also accept raw re-marshal path
+			raw, _ := json.Marshal(msg["data"])
+			data = map[string]interface{}{}
+			if err := json.Unmarshal(raw, &data); err != nil {
+				t.Fatalf("data type %T: %v", msg["data"], err)
+			}
+		}
+		errVal, ok := data["error"].(string)
+		if !ok {
+			t.Fatalf("error field type %T value %#v; want string (not object)", data["error"], data["error"])
+		}
+		if errVal != "blender failed: signal: segmentation fault (core dumped)" {
+			t.Fatalf("error = %q, want segfault message", errVal)
+		}
+		if data["success"] != false {
+			t.Fatalf("success = %v, want false", data["success"])
+		}
+		if data["free_requeue"] != true {
+			t.Fatalf("free_requeue = %v, want true", data["free_requeue"])
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("timed out waiting for task_complete message")
+	}
+}
+
+func TestJobConnection_ConnectAndClose(t *testing.T) {
+	upgrader := websocket.Upgrader{}
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		conn, err := upgrader.Upgrade(w, r, nil)
+		if err != nil {
+			return
+		}
+		defer conn.Close()
+
+		var msg map[string]interface{}
+		if err := conn.ReadJSON(&msg); err != nil {
+			return
+		}
+		if msg["type"] == "auth" {
+			_ = conn.WriteJSON(map[string]string{"type": "auth_ok"})
+		}
+		// Keep open briefly so client can mark connected.
+		time.Sleep(100 * time.Millisecond)
+	}))
+	defer server.Close()
+
+	jc := NewJobConnection()
+	managerURL := strings.Replace(server.URL, "http://", "http://", 1)
+	if err := jc.Connect(managerURL, "/job/1", "token123"); err != nil {
+		t.Fatalf("Connect failed: %v", err)
+	}
+	if !jc.IsConnected() {
+		t.Fatal("expected connection to be marked connected")
+	}
+	jc.Close()
+}
+

internal/runner/api/manager.go

@@ -241,8 +241,8 @@ func (m *ManagerClient) DownloadContext(contextPath, jobToken string) (io.ReadCl
 	}
 
 	if resp.StatusCode != http.StatusOK {
+		defer resp.Body.Close()
 		body, _ := io.ReadAll(resp.Body)
-		resp.Body.Close()
 		return nil, fmt.Errorf("context download failed with status %d: %s", resp.StatusCode, string(body))
 	}
 
@@ -435,10 +435,39 @@ func (m *ManagerClient) DownloadBlender(version string) (io.ReadCloser, error) {
 	}
 
 	if resp.StatusCode != http.StatusOK {
+		defer resp.Body.Close()
 		body, _ := io.ReadAll(resp.Body)
-		resp.Body.Close()
 		return nil, fmt.Errorf("failed to download blender: status %d, body: %s", resp.StatusCode, string(body))
 	}
 
 	return resp.Body, nil
 }
+
+// blenderVersionsResponse is the response from GET /api/blender/versions.
+type blenderVersionsResponse struct {
+	Versions []struct {
+		Full string `json:"full"`
+	} `json:"versions"`
+}
+
+// GetLatestBlenderVersion returns the latest Blender version string (e.g. "4.2.3") from the manager.
+// Uses the flat versions list which is newest-first.
+func (m *ManagerClient) GetLatestBlenderVersion() (string, error) {
+	resp, err := m.Request("GET", "/api/blender/versions", nil)
+	if err != nil {
+		return "", fmt.Errorf("failed to fetch blender versions: %w", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		return "", fmt.Errorf("blender versions returned status %d: %s", resp.StatusCode, string(body))
+	}
+	var out blenderVersionsResponse
+	if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
+		return "", fmt.Errorf("failed to decode blender versions: %w", err)
+	}
+	if len(out.Versions) == 0 {
+		return "", fmt.Errorf("no blender versions available")
+	}
+	return out.Versions[0].Full, nil
+}

internal/runner/api/manager_test.go

@@ -0,0 +1,45 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestNewManagerClient_TrimsTrailingSlash(t *testing.T) {
+	c := NewManagerClient("http://example.com/")
+	if c.GetBaseURL() != "http://example.com" {
+		t.Fatalf("unexpected base url: %q", c.GetBaseURL())
+	}
+}
+
+func TestDoRequest_SetsAuthorizationHeader(t *testing.T) {
+	var authHeader string
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		authHeader = r.Header.Get("Authorization")
+		_ = json.NewEncoder(w).Encode(map[string]bool{"ok": true})
+	}))
+	defer ts.Close()
+
+	c := NewManagerClient(ts.URL)
+	c.SetCredentials(1, "abc123")
+
+	resp, err := c.Request(http.MethodGet, "/x", nil)
+	if err != nil {
+		t.Fatalf("Request failed: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if authHeader != "Bearer abc123" {
+		t.Fatalf("unexpected Authorization header: %q", authHeader)
+	}
+}
+
+func TestRequest_RequiresAuth(t *testing.T) {
+	c := NewManagerClient("http://example.com")
+	if _, err := c.Request(http.MethodGet, "/x", nil); err == nil {
+		t.Fatal("expected auth error when api key is missing")
+	}
+}
+

internal/runner/blender/binary.go

@@ -5,7 +5,9 @@ import (
 	"fmt"
 	"log"
 	"os"
+	"os/exec"
 	"path/filepath"
+	"strings"
 
 	"jiggablend/internal/runner/api"
 	"jiggablend/internal/runner/workspace"
@@ -43,8 +45,12 @@ func (m *Manager) GetBinaryPath(version string) (string, error) {
 		if binaryInfo, err := os.Stat(binaryPath); err == nil {
 			// Verify it's actually a file (not a directory)
 			if !binaryInfo.IsDir() {
-				log.Printf("Found existing Blender %s installation at %s", version, binaryPath)
-				return binaryPath, nil
+				absBinaryPath, err := ResolveBinaryPath(binaryPath)
+				if err != nil {
+					return "", err
+				}
+				log.Printf("Found existing Blender %s installation at %s", version, absBinaryPath)
+				return absBinaryPath, nil
 			}
 		}
 		// Version folder exists but binary is missing - might be incomplete installation
@@ -71,17 +77,86 @@ func (m *Manager) GetBinaryPath(version string) (string, error) {
 		return "", fmt.Errorf("blender binary not found after extraction")
 	}
 
-	log.Printf("Blender %s installed at %s", version, binaryPath)
-	return binaryPath, nil
+	absBinaryPath, err := ResolveBinaryPath(binaryPath)
+	if err != nil {
+		return "", err
+	}
+
+	log.Printf("Blender %s installed at %s", version, absBinaryPath)
+	return absBinaryPath, nil
 }
 
 // GetBinaryForJob returns the Blender binary path for a job.
 // Uses the version from metadata or falls back to system blender.
 func (m *Manager) GetBinaryForJob(version string) (string, error) {
 	if version == "" {
-		return "blender", nil // System blender
+		return ResolveBinaryPath("blender")
 	}
 
 	return m.GetBinaryPath(version)
 }
 
+// ResolveBinaryPath resolves a Blender executable to an absolute path.
+func ResolveBinaryPath(blenderBinary string) (string, error) {
+	if blenderBinary == "" {
+		return "", fmt.Errorf("blender binary path is empty")
+	}
+
+	if strings.Contains(blenderBinary, string(filepath.Separator)) {
+		absPath, err := filepath.Abs(blenderBinary)
+		if err != nil {
+			return "", fmt.Errorf("failed to resolve blender binary path %q: %w", blenderBinary, err)
+		}
+		return absPath, nil
+	}
+
+	resolvedPath, err := exec.LookPath(blenderBinary)
+	if err != nil {
+		return "", fmt.Errorf("failed to locate blender binary %q in PATH: %w", blenderBinary, err)
+	}
+	absPath, err := filepath.Abs(resolvedPath)
+	if err != nil {
+		return "", fmt.Errorf("failed to resolve blender binary path %q: %w", resolvedPath, err)
+	}
+	return absPath, nil
+}
+
+// TarballEnv returns a copy of baseEnv with LD_LIBRARY_PATH set so that a
+// tarball Blender installation can find its bundled libs (e.g. lib/python3.x).
+// If blenderBinary is the system "blender" or has no path component, baseEnv is
+// returned unchanged.
+func TarballEnv(blenderBinary string, baseEnv []string) []string {
+	if blenderBinary == "" || blenderBinary == "blender" {
+		return baseEnv
+	}
+	if !strings.Contains(blenderBinary, string(os.PathSeparator)) {
+		return baseEnv
+	}
+	blenderDir := filepath.Dir(blenderBinary)
+	libDir := filepath.Join(blenderDir, "lib")
+	ldLib := libDir
+	for _, e := range baseEnv {
+		if strings.HasPrefix(e, "LD_LIBRARY_PATH=") {
+			existing := strings.TrimPrefix(e, "LD_LIBRARY_PATH=")
+			if existing != "" {
+				ldLib = libDir + ":" + existing
+			}
+			break
+		}
+	}
+	out := make([]string, 0, len(baseEnv)+1)
+	done := false
+	for _, e := range baseEnv {
+		if strings.HasPrefix(e, "LD_LIBRARY_PATH=") {
+			out = append(out, "LD_LIBRARY_PATH="+ldLib)
+			done = true
+			continue
+		}
+		out = append(out, e)
+	}
+	if !done {
+		out = append(out, "LD_LIBRARY_PATH="+ldLib)
+	}
+	return out
+}
+

internal/runner/blender/binary_test.go

@@ -0,0 +1,34 @@
+package blender
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestResolveBinaryPath_AbsoluteLikePath(t *testing.T) {
+	got, err := ResolveBinaryPath("./blender")
+	if err != nil {
+		t.Fatalf("ResolveBinaryPath failed: %v", err)
+	}
+	if !filepath.IsAbs(got) {
+		t.Fatalf("expected absolute path, got %q", got)
+	}
+}
+
+func TestResolveBinaryPath_Empty(t *testing.T) {
+	if _, err := ResolveBinaryPath(""); err == nil {
+		t.Fatal("expected error for empty blender binary")
+	}
+}
+
+func TestTarballEnv_SetsAndExtendsLDLibraryPath(t *testing.T) {
+	bin := filepath.Join(string(os.PathSeparator), "tmp", "blender", "blender")
+	got := TarballEnv(bin, []string{"A=B", "LD_LIBRARY_PATH=/old"})
+	joined := strings.Join(got, "\n")
+	if !strings.Contains(joined, "LD_LIBRARY_PATH=/tmp/blender/lib:/old") {
+		t.Fatalf("expected LD_LIBRARY_PATH to include blender lib, got %v", got)
+	}
+}
+

internal/runner/blender/detect.go

@@ -0,0 +1,131 @@
+// Package blender: host GPU backend detection for AMD/NVIDIA/Intel.
+package blender
+
+import (
+	"bufio"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strconv"
+	"strings"
+)
+
+// DetectGPUBackends detects whether AMD, NVIDIA, and/or Intel GPUs are available
+// using host-level hardware probing only.
+func DetectGPUBackends() (hasAMD, hasNVIDIA, hasIntel bool, ok bool) {
+	return detectGPUBackendsFromHost()
+}
+
+func detectGPUBackendsFromHost() (hasAMD, hasNVIDIA, hasIntel bool, ok bool) {
+	if amd, nvidia, intel, found := detectGPUBackendsFromDRM(); found {
+		return amd, nvidia, intel, true
+	}
+	if amd, nvidia, intel, found := detectGPUBackendsFromLSPCI(); found {
+		return amd, nvidia, intel, true
+	}
+	return false, false, false, false
+}
+
+func detectGPUBackendsFromDRM() (hasAMD, hasNVIDIA, hasIntel bool, ok bool) {
+	entries, err := os.ReadDir("/sys/class/drm")
+	if err != nil {
+		return false, false, false, false
+	}
+
+	for _, entry := range entries {
+		name := entry.Name()
+		if !isDRMCardNode(name) {
+			continue
+		}
+
+		vendorPath := filepath.Join("/sys/class/drm", name, "device", "vendor")
+		vendorRaw, err := os.ReadFile(vendorPath)
+		if err != nil {
+			continue
+		}
+		vendor := strings.TrimSpace(strings.ToLower(string(vendorRaw)))
+		switch vendor {
+		case "0x1002":
+			hasAMD = true
+			ok = true
+		case "0x10de":
+			hasNVIDIA = true
+			ok = true
+		case "0x8086":
+			hasIntel = true
+			ok = true
+		}
+	}
+
+	return hasAMD, hasNVIDIA, hasIntel, ok
+}
+
+func isDRMCardNode(name string) bool {
+	if !strings.HasPrefix(name, "card") {
+		return false
+	}
+	if strings.Contains(name, "-") {
+		// Connector entries like card0-DP-1 are not GPU device nodes.
+		return false
+	}
+	if len(name) <= len("card") {
+		return false
+	}
+	_, err := strconv.Atoi(strings.TrimPrefix(name, "card"))
+	return err == nil
+}
+
+func detectGPUBackendsFromLSPCI() (hasAMD, hasNVIDIA, hasIntel bool, ok bool) {
+	if _, err := exec.LookPath("lspci"); err != nil {
+		return false, false, false, false
+	}
+
+	out, err := exec.Command("lspci").CombinedOutput()
+	if err != nil {
+		return false, false, false, false
+	}
+
+	scanner := bufio.NewScanner(strings.NewReader(string(out)))
+	for scanner.Scan() {
+		line := strings.ToLower(strings.TrimSpace(scanner.Text()))
+		if !isGPUControllerLine(line) {
+			continue
+		}
+
+		if strings.Contains(line, "nvidia") {
+			hasNVIDIA = true
+			ok = true
+		}
+		if strings.Contains(line, "amd") || strings.Contains(line, "ati") || strings.Contains(line, "radeon") {
+			hasAMD = true
+			ok = true
+		}
+		if strings.Contains(line, "intel") {
+			hasIntel = true
+			ok = true
+		}
+	}
+
+	return hasAMD, hasNVIDIA, hasIntel, ok
+}
+
+func isGPUControllerLine(line string) bool {
+	return strings.Contains(line, "vga compatible controller") ||
+		strings.Contains(line, "3d controller") ||
+		strings.Contains(line, "display controller")
+}
+
+func parseRocmAgentArch(output string) (arch string, ok bool) {
+	scanner := bufio.NewScanner(strings.NewReader(output))
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if !strings.HasPrefix(line, "Name:") {
+			continue
+		}
+		name := strings.TrimSpace(strings.TrimPrefix(line, "Name:"))
+		if strings.HasPrefix(name, "gfx") {
+			return name, true
+		}
+	}
+	return "", false
+}

internal/runner/blender/detect_hiprt_test.go

@@ -0,0 +1,19 @@
+package blender
+
+import "testing"
+
+func TestParseRocmAgentArch(t *testing.T) {
+	input := `ROCk module is loaded
+Agent 1
+  Name:                    gfx1151
+  Marketing Name:          AMD Radeon Graphics
+`
+	arch, ok := parseRocmAgentArch(input)
+	if !ok {
+		t.Fatal("expected arch to be parsed")
+	}
+	if arch != "gfx1151" {
+		t.Fatalf("arch = %q, want gfx1151", arch)
+	}
+}
+

internal/runner/blender/detect_test.go

@@ -0,0 +1,32 @@
+package blender
+
+import "testing"
+
+func TestIsDRMCardNode(t *testing.T) {
+	tests := map[string]bool{
+		"card0":      true,
+		"card12":     true,
+		"card":       false,
+		"card0-DP-1": false,
+		"renderD128": false,
+		"foo":        false,
+	}
+	for in, want := range tests {
+		if got := isDRMCardNode(in); got != want {
+			t.Fatalf("isDRMCardNode(%q) = %v, want %v", in, got, want)
+		}
+	}
+}
+
+func TestIsGPUControllerLine(t *testing.T) {
+	if !isGPUControllerLine("vga compatible controller: nvidia corp") {
+		t.Fatal("expected VGA controller line to match")
+	}
+	if !isGPUControllerLine("3d controller: amd") {
+		t.Fatal("expected 3d controller line to match")
+	}
+	if isGPUControllerLine("audio device: something") {
+		t.Fatal("audio line should not match")
+	}
+}
+

internal/runner/blender/logfilter_test.go

@@ -0,0 +1,34 @@
+package blender
+
+import (
+	"testing"
+
+	"jiggablend/pkg/types"
+)
+
+func TestFilterLog_FiltersNoise(t *testing.T) {
+	cases := []string{
+		"",
+		"--------------------------------------------------------------------",
+		"Failed to add relation foo",
+		"BKE_modifier_set_error",
+		"Depth Type Name",
+	}
+	for _, in := range cases {
+		filtered, level := FilterLog(in)
+		if !filtered {
+			t.Fatalf("expected filtered for %q", in)
+		}
+		if level != types.LogLevelInfo {
+			t.Fatalf("unexpected level for %q: %s", in, level)
+		}
+	}
+}
+
+func TestFilterLog_KeepsNormalLine(t *testing.T) {
+	filtered, _ := FilterLog("Rendering done.")
+	if filtered {
+		t.Fatal("normal line should not be filtered")
+	}
+}
+

internal/runner/blender/version.go

@@ -1,143 +1,19 @@
 package blender
 
 import (
-	"compress/gzip"
 	"fmt"
-	"io"
-	"os"
-	"os/exec"
+
+	"jiggablend/pkg/blendfile"
 )
 
 // ParseVersionFromFile parses the Blender version that a .blend file was saved with.
 // Returns major and minor version numbers.
+// Delegates to the shared pkg/blendfile implementation.
 func ParseVersionFromFile(blendPath string) (major, minor int, err error) {
-	file, err := os.Open(blendPath)
-	if err != nil {
-		return 0, 0, fmt.Errorf("failed to open blend file: %w", err)
-	}
-	defer file.Close()
-
-	// Read the first 12 bytes of the blend file header
-	// Format: BLENDER-v<major><minor><patch> or BLENDER_v<major><minor><patch>
-	// The header is: "BLENDER" (7 bytes) + pointer size (1 byte: '-' for 64-bit, '_' for 32-bit)
-	// + endianness (1 byte: 'v' for little-endian, 'V' for big-endian)
-	// + version (3 bytes: e.g., "402" for 4.02)
-	header := make([]byte, 12)
-	n, err := file.Read(header)
-	if err != nil || n < 12 {
-		return 0, 0, fmt.Errorf("failed to read blend file header: %w", err)
-	}
-
-	// Check for BLENDER magic
-	if string(header[:7]) != "BLENDER" {
-		// Might be compressed - try to decompress
-		file.Seek(0, 0)
-		return parseCompressedVersion(file)
-	}
-
-	// Parse version from bytes 9-11 (3 digits)
-	versionStr := string(header[9:12])
-
-	// Version format changed in Blender 3.0
-	// Pre-3.0: "279" = 2.79, "280" = 2.80
-	// 3.0+: "300" = 3.0, "402" = 4.02, "410" = 4.10
-	if len(versionStr) == 3 {
-		// First digit is major version
-		fmt.Sscanf(string(versionStr[0]), "%d", &major)
-		// Next two digits are minor version
-		fmt.Sscanf(versionStr[1:3], "%d", &minor)
-	}
-
-	return major, minor, nil
-}
-
-// parseCompressedVersion handles gzip and zstd compressed blend files.
-func parseCompressedVersion(file *os.File) (major, minor int, err error) {
-	magic := make([]byte, 4)
-	if _, err := file.Read(magic); err != nil {
-		return 0, 0, err
-	}
-	file.Seek(0, 0)
-
-	if magic[0] == 0x1f && magic[1] == 0x8b {
-		// gzip compressed
-		gzReader, err := gzip.NewReader(file)
-		if err != nil {
-			return 0, 0, fmt.Errorf("failed to create gzip reader: %w", err)
-		}
-		defer gzReader.Close()
-
-		header := make([]byte, 12)
-		n, err := gzReader.Read(header)
-		if err != nil || n < 12 {
-			return 0, 0, fmt.Errorf("failed to read compressed blend header: %w", err)
-		}
-
-		if string(header[:7]) != "BLENDER" {
-			return 0, 0, fmt.Errorf("invalid blend file format")
-		}
-
-		versionStr := string(header[9:12])
-		if len(versionStr) == 3 {
-			fmt.Sscanf(string(versionStr[0]), "%d", &major)
-			fmt.Sscanf(versionStr[1:3], "%d", &minor)
-		}
-
-		return major, minor, nil
-	}
-
-	// Check for zstd magic (Blender 3.0+): 0x28 0xB5 0x2F 0xFD
-	if magic[0] == 0x28 && magic[1] == 0xb5 && magic[2] == 0x2f && magic[3] == 0xfd {
-		return parseZstdVersion(file)
-	}
-
-	return 0, 0, fmt.Errorf("unknown blend file format")
-}
-
-// parseZstdVersion handles zstd-compressed blend files (Blender 3.0+).
-// Uses zstd command line tool since Go doesn't have native zstd support.
-func parseZstdVersion(file *os.File) (major, minor int, err error) {
-	file.Seek(0, 0)
-
-	cmd := exec.Command("zstd", "-d", "-c")
-	cmd.Stdin = file
-
-	stdout, err := cmd.StdoutPipe()
-	if err != nil {
-		return 0, 0, fmt.Errorf("failed to create zstd stdout pipe: %w", err)
-	}
-
-	if err := cmd.Start(); err != nil {
-		return 0, 0, fmt.Errorf("failed to start zstd decompression: %w", err)
-	}
-
-	// Read just the header (12 bytes)
-	header := make([]byte, 12)
-	n, readErr := io.ReadFull(stdout, header)
-
-	// Kill the process early - we only need the header
-	cmd.Process.Kill()
-	cmd.Wait()
-
-	if readErr != nil || n < 12 {
-		return 0, 0, fmt.Errorf("failed to read zstd compressed blend header: %v", readErr)
-	}
-
-	if string(header[:7]) != "BLENDER" {
-		return 0, 0, fmt.Errorf("invalid blend file format in zstd archive")
-	}
-
-	versionStr := string(header[9:12])
-	if len(versionStr) == 3 {
-		fmt.Sscanf(string(versionStr[0]), "%d", &major)
-		fmt.Sscanf(versionStr[1:3], "%d", &minor)
-	}
-
-	return major, minor, nil
+	return blendfile.ParseVersionFromFile(blendPath)
 }
 
 // VersionString returns a formatted version string like "4.2".
 func VersionString(major, minor int) string {
 	return fmt.Sprintf("%d.%d", major, minor)
 }
-

internal/runner/blender/version_test.go

@@ -0,0 +1,10 @@
+package blender
+
+import "testing"
+
+func TestVersionString(t *testing.T) {
+	if got := VersionString(4, 2); got != "4.2" {
+		t.Fatalf("VersionString() = %q, want %q", got, "4.2")
+	}
+}
+

internal/runner/encoding/encoders.go

@@ -19,26 +19,11 @@ const (
 	CRFVP9 = 30
 )
 
-// tonemapFilter returns the appropriate filter for EXR input.
-// For HDR preservation: converts linear RGB (EXR) to bt2020 YUV with HLG transfer function
-// Uses zscale to properly convert colorspace from linear RGB to bt2020 YUV while preserving HDR range
-// Step 1: Ensure format is gbrpf32le (linear RGB)
-// Step 2: Convert transfer function from linear to HLG (arib-std-b67) with bt2020 primaries/matrix
-// Step 3: Convert to YUV format
+// tonemapFilter returns the production filter for EXR input (linear → sRGB → HLG, bt709).
+// This is the single source of truth used by BuildCommand and BuildPass1Command.
+// zscale numeric values: primaries 1=bt709, matrix 1=bt709, transfer 8=linear / 13=sRGB / 18=HLG.
 func tonemapFilter(useAlpha bool) string {
-	// Convert from linear RGB (gbrpf32le) to HLG with bt709 primaries to match PNG appearance
-	// Based on best practices: convert linear RGB directly to HLG with bt709 primaries
-	// This matches PNG color appearance (bt709 primaries) while preserving HDR range (HLG transfer)
-	// zscale uses numeric values:
-	//   primaries: 1=bt709 (matches PNG), 9=bt2020
-	//   matrix: 1=bt709, 9=bt2020nc, 0=gbr (RGB input)
-	//   transfer: 8=linear, 18=arib-std-b67 (HLG)
-	// Direct conversion: linear RGB -> HLG with bt709 primaries -> bt2020 YUV (for wider gamut metadata)
-	// The bt709 primaries in the conversion match PNG, but we set bt2020 in metadata for HDR displays
-	// Convert linear RGB to sRGB first, then convert to HLG
-	// This approach: linear -> sRGB -> HLG -> bt2020
-	// Fixes red tint by using sRGB conversion, preserves HDR range with HLG
-	filter := "format=gbrpf32le,zscale=transferin=8:transfer=13:primariesin=1:primaries=1:matrixin=0:matrix=1:rangein=full:range=full,zscale=transferin=13:transfer=18:primariesin=1:primaries=9:matrixin=1:matrix=9:rangein=full:range=full"
+	filter := "format=gbrpf32le,zscale=transferin=8:transfer=13:primariesin=1:primaries=1:matrixin=0:matrix=1:rangein=full:range=full,zscale=transferin=13:transfer=18:primariesin=1:primaries=1:matrixin=1:matrix=1:rangein=full:range=full"
 	if useAlpha {
 		return filter + ",format=yuva420p10le"
 	}
@@ -57,8 +42,7 @@ func (e *SoftwareEncoder) Available() bool {
 	return true // Software encoding is always available
 }
 
-func (e *SoftwareEncoder) BuildCommand(config *EncodeConfig) *exec.Cmd {
-	// EXR only: HDR path (HLG, 10-bit, full range)
+func (e *SoftwareEncoder) buildBaseArgs(config *EncodeConfig) []string {
 	pixFmt := "yuv420p10le"
 	if config.UseAlpha {
 		pixFmt = "yuva420p10le"
@@ -79,14 +63,18 @@ func (e *SoftwareEncoder) BuildCommand(config *EncodeConfig) *exec.Cmd {
 		"-color_trc", "linear", "-color_primaries", "bt709"}
 	args = append(args, "-i", config.InputPattern, "-c:v", e.codec, "-pix_fmt", pixFmt, "-r", fmt.Sprintf("%.2f", config.FrameRate), "-color_primaries", colorPrimaries, "-color_trc", colorTrc, "-colorspace", colorspace, "-color_range", colorRange)
 
-	vf := "format=gbrpf32le,zscale=transferin=8:transfer=13:primariesin=1:primaries=1:matrixin=0:matrix=1:rangein=full:range=full,zscale=transferin=13:transfer=18:primariesin=1:primaries=1:matrixin=1:matrix=1:rangein=full:range=full"
-	if config.UseAlpha {
-		vf += ",format=yuva420p10le"
-	} else {
-		vf += ",format=yuv420p10le"
+	// FFmpeg 6+ treats yuva420p10le as experimental for libvpx-vp9 / libaom-av1
+	if config.UseAlpha && (e.codec == "libvpx-vp9" || e.codec == "libaom-av1") {
+		args = append(args, "-strict", "experimental")
 	}
-	args = append(args, "-vf", vf)
+
+	args = append(args, "-vf", tonemapFilter(config.UseAlpha))
 	args = append(args, codecArgs...)
+	return args
+}
+
+func (e *SoftwareEncoder) BuildCommand(config *EncodeConfig) *exec.Cmd {
+	args := e.buildBaseArgs(config)
 
 	if config.TwoPass {
 		// For 2-pass, this builds pass 2 command
@@ -107,35 +95,7 @@ func (e *SoftwareEncoder) BuildCommand(config *EncodeConfig) *exec.Cmd {
 
 // BuildPass1Command builds the first pass command for 2-pass encoding.
 func (e *SoftwareEncoder) BuildPass1Command(config *EncodeConfig) *exec.Cmd {
-	pixFmt := "yuv420p10le"
-	if config.UseAlpha {
-		pixFmt = "yuva420p10le"
-	}
-	colorPrimaries, colorTrc, colorspace, colorRange := "bt709", "arib-std-b67", "bt709", "pc"
-
-	var codecArgs []string
-	switch e.codec {
-	case "libaom-av1":
-		codecArgs = []string{"-crf", strconv.Itoa(CRFAV1), "-b:v", "0", "-tiles", "2x2", "-g", "240"}
-	case "libvpx-vp9":
-		codecArgs = []string{"-crf", strconv.Itoa(CRFVP9), "-b:v", "0", "-row-mt", "1", "-g", "240"}
-	default:
-		codecArgs = []string{"-preset", "veryslow", "-crf", strconv.Itoa(CRFH264), "-profile:v", "high10", "-level", "5.2", "-tune", "film", "-keyint_min", "24", "-g", "240", "-bf", "2", "-refs", "4"}
-	}
-
-	args := []string{"-y", "-f", "image2", "-start_number", fmt.Sprintf("%d", config.StartFrame), "-framerate", fmt.Sprintf("%.2f", config.FrameRate),
-		"-color_trc", "linear", "-color_primaries", "bt709"}
-	args = append(args, "-i", config.InputPattern, "-c:v", e.codec, "-pix_fmt", pixFmt, "-r", fmt.Sprintf("%.2f", config.FrameRate), "-color_primaries", colorPrimaries, "-color_trc", colorTrc, "-colorspace", colorspace, "-color_range", colorRange)
-
-	vf := "format=gbrpf32le,zscale=transferin=8:transfer=13:primariesin=1:primaries=1:matrixin=0:matrix=1:rangein=full:range=full,zscale=transferin=13:transfer=18:primariesin=1:primaries=1:matrixin=1:matrix=1:rangein=full:range=full"
-	if config.UseAlpha {
-		vf += ",format=yuva420p10le"
-	} else {
-		vf += ",format=yuv420p10le"
-	}
-	args = append(args, "-vf", vf)
-
-	args = append(args, codecArgs...)
+	args := e.buildBaseArgs(config)
 	args = append(args, "-pass", "1", "-f", "null", "/dev/null")
 
 	log.Printf("Build Software Pass 1 command: ffmpeg %s", strings.Join(args, " "))

internal/runner/encoding/encoders_test.go

@@ -120,6 +120,10 @@ func TestSoftwareEncoder_BuildCommand_AV1_WithAlpha(t *testing.T) {
 	if !strings.Contains(argsStr, "format=yuva420p10le") {
 		t.Error("Expected tonemap filter to output yuva420p10le for EXR alpha, but not found")
 	}
+	// Alpha VP9/AV1 need -strict experimental on modern FFmpeg
+	if !strings.Contains(argsStr, "-strict experimental") {
+		t.Error("Expected -strict experimental for alpha encode")
+	}
 }
 
 func TestSoftwareEncoder_BuildCommand_VP9(t *testing.T) {

internal/runner/runner.go

@@ -10,6 +10,7 @@ import (
 	"net"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"strings"
 	"sync"
 	"time"
@@ -17,6 +18,7 @@ import (
 	"jiggablend/internal/runner/api"
 	"jiggablend/internal/runner/blender"
 	"jiggablend/internal/runner/encoding"
+	"jiggablend/internal/runner/sandbox"
 	"jiggablend/internal/runner/tasks"
 	"jiggablend/internal/runner/workspace"
 	"jiggablend/pkg/executils"
@@ -40,12 +42,74 @@ type Runner struct {
 
 	fingerprint   string
 	fingerprintMu sync.RWMutex
+
+	// gpuLockedOut is set when logs indicate a GPU error (e.g. HIP "Illegal address");
+	// when true, the runner forces CPU rendering for all subsequent jobs.
+	gpuLockedOut   bool
+	gpuLockedOutMu sync.RWMutex
+
+	// hasAMD/hasNVIDIA/hasIntel are set at startup by hardware/Blender GPU backend detection.
+	// Used to force CPU only for Blender < 4.x when AMD is present (no official HIP support pre-4).
+	// gpuDetectionFailed is true when detection could not run; we then force CPU for all versions.
+	gpuBackendMu       sync.RWMutex
+	hasAMD             bool
+	hasNVIDIA          bool
+	hasIntel           bool
+	gpuBackendProbed   bool
+	gpuDetectionFailed bool
+
+	// forceCPURendering forces CPU rendering for all jobs regardless of metadata/backend detection.
+	forceCPURendering bool
+	// disableRT disables GPU ray tracing acceleration (HIPRT, OptiX, etc.).
+	disableRT bool
+	// hipGPUSampleBatch limits samples per GPU pass on gfx115x (0 = disabled).
+	hipGPUSampleBatch int
+
+	// sandbox wraps Blender invocations (none/podman).
+	sandboxWrapper sandbox.Wrapper
+	sandboxBackend string
+}
+
+// RunnerOptions configures optional runner behavior.
+type RunnerOptions struct {
+	ForceCPURendering bool
+	DisableRT         bool
+	HipGPUSampleBatch int
+	SandboxBackend    string // none|podman
+	SandboxNetwork    bool
+	SandboxImage      string // podman thin runtime image
 }
 
 // New creates a new runner.
-func New(managerURL, name, hostname string) *Runner {
+func New(managerURL, name, hostname string, forceCPURendering, disableRT bool, hipGPUSampleBatch int) *Runner {
+	return NewWithOptions(managerURL, name, hostname, RunnerOptions{
+		ForceCPURendering: forceCPURendering,
+		DisableRT:         disableRT,
+		HipGPUSampleBatch: hipGPUSampleBatch,
+		SandboxBackend:    sandbox.BackendPodman,
+	})
+}
+
+// NewWithOptions creates a runner with full options including sandbox.
+func NewWithOptions(managerURL, name, hostname string, opts RunnerOptions) *Runner {
 	manager := api.NewManagerClient(managerURL)
 
+	backend, err := sandbox.NormalizeBackend(opts.SandboxBackend)
+	if err != nil {
+		log.Printf("Invalid sandbox backend %q, falling back to none: %v", opts.SandboxBackend, err)
+		backend = sandbox.BackendNone
+	}
+	sb, err := sandbox.New(sandbox.Options{
+		Backend:      backend,
+		AllowNetwork: opts.SandboxNetwork,
+		PodmanImage:  opts.SandboxImage,
+	})
+	if err != nil {
+		log.Printf("Failed to init sandbox %q: %v; using none", backend, err)
+		sb, _ = sandbox.New(sandbox.Options{Backend: sandbox.BackendNone})
+		backend = sandbox.BackendNone
+	}
+
 	r := &Runner{
 		name:       name,
 		hostname:   hostname,
@@ -53,6 +117,12 @@ func New(managerURL, name, hostname string) *Runner {
 		processes:  executils.NewProcessTracker(),
 		stopChan:   make(chan struct{}),
 		processors: make(map[string]tasks.Processor),
+
+		forceCPURendering: opts.ForceCPURendering,
+		disableRT:         opts.DisableRT,
+		hipGPUSampleBatch: opts.HipGPUSampleBatch,
+		sandboxWrapper:    sb,
+		sandboxBackend:    backend,
 	}
 
 	// Generate fingerprint
@@ -68,32 +138,56 @@ func (r *Runner) CheckRequiredTools() error {
 	}
 	log.Printf("Found zstd for compressed blend file support")
 
-	if err := exec.Command("xvfb-run", "--help").Run(); err != nil {
-		return fmt.Errorf("xvfb-run not found - required for headless Blender rendering. Install with: apt install xvfb")
+	if r.sandboxWrapper != nil {
+		if err := r.sandboxWrapper.Available(); err != nil {
+			return fmt.Errorf("sandbox backend %q unavailable: %w", r.sandboxBackend, err)
+		}
+		log.Printf("Sandbox backend: %s", r.sandboxWrapper.Name())
 	}
-	log.Printf("Found xvfb-run for headless rendering without -b option")
+
 	return nil
 }
 
-var cachedCapabilities map[string]interface{} = nil
+// SandboxBackend returns the configured sandbox backend name.
+func (r *Runner) SandboxBackend() string {
+	if r.sandboxBackend == "" {
+		return sandbox.BackendNone
+	}
+	return r.sandboxBackend
+}
+
+var (
+	cachedCapabilities map[string]interface{}
+	capabilitiesOnce   sync.Once
+)
 
 // ProbeCapabilities detects hardware capabilities.
 func (r *Runner) ProbeCapabilities() map[string]interface{} {
-	if cachedCapabilities != nil {
-		return cachedCapabilities
+	capabilitiesOnce.Do(func() {
+		caps := make(map[string]interface{})
+
+		if err := exec.Command("ffmpeg", "-version").Run(); err == nil {
+			caps["ffmpeg"] = true
+		} else {
+			caps["ffmpeg"] = false
+		}
+
+		// Filled later with actual backend when runner is constructed; probe is package-level once.
+		// Real sandbox name is injected in ProbeCapabilities on the instance after New.
+		caps["sandbox"] = "none"
+
+		cachedCapabilities = caps
+	})
+	// Overlay instance sandbox name (Once already ran with none default).
+	if r != nil && r.sandboxWrapper != nil {
+		out := make(map[string]interface{}, len(cachedCapabilities)+1)
+		for k, v := range cachedCapabilities {
+			out[k] = v
+		}
+		out["sandbox"] = r.sandboxWrapper.Name()
+		return out
 	}
-
-	caps := make(map[string]interface{})
-
-	// Check for ffmpeg and probe encoding capabilities
-	if err := exec.Command("ffmpeg", "-version").Run(); err == nil {
-		caps["ffmpeg"] = true
-	} else {
-		caps["ffmpeg"] = false
-	}
-
-	cachedCapabilities = caps
-	return caps
+	return cachedCapabilities
 }
 
 // Register registers the runner with the manager.
@@ -123,6 +217,82 @@ func (r *Runner) Register(apiKey string) (int64, error) {
 	return id, nil
 }
 
+// DetectAndStoreGPUBackends runs host-level backend detection and stores AMD/NVIDIA/Intel results.
+// Call after Register. Used so we only force CPU for Blender < 4.x when AMD is present.
+func (r *Runner) DetectAndStoreGPUBackends() {
+	r.gpuBackendMu.Lock()
+	defer r.gpuBackendMu.Unlock()
+	if r.gpuBackendProbed {
+		return
+	}
+	hasAMD, hasNVIDIA, hasIntel, ok := blender.DetectGPUBackends()
+	if !ok {
+		log.Printf("GPU backend detection failed (host probe unavailable). All jobs will use CPU because backend availability is unknown.")
+		r.gpuBackendProbed = true
+		r.gpuDetectionFailed = true
+		return
+	}
+
+	detectedTypes := 0
+	if hasAMD {
+		detectedTypes++
+	}
+	if hasNVIDIA {
+		detectedTypes++
+	}
+	if hasIntel {
+		detectedTypes++
+	}
+	if detectedTypes > 1 {
+		log.Printf("mixed GPU vendors detected (AMD=%v NVIDIA=%v INTEL=%v): multi-vendor setups may not work reliably, but runner will continue with GPU enabled", hasAMD, hasNVIDIA, hasIntel)
+	}
+
+	r.hasAMD = hasAMD
+	r.hasNVIDIA = hasNVIDIA
+	r.hasIntel = hasIntel
+	r.gpuBackendProbed = true
+	r.gpuDetectionFailed = false
+	log.Printf("GPU backend detection: AMD=%v NVIDIA=%v INTEL=%v (Blender < 4.x will force CPU only when AMD is present)", hasAMD, hasNVIDIA, hasIntel)
+}
+
+// HasAMD returns whether the runner detected AMD devices. Used to force CPU for Blender < 4.x only when AMD is present.
+func (r *Runner) HasAMD() bool {
+	r.gpuBackendMu.RLock()
+	defer r.gpuBackendMu.RUnlock()
+	return r.hasAMD
+}
+
+// HasNVIDIA returns whether the runner detected NVIDIA GPUs.
+func (r *Runner) HasNVIDIA() bool {
+	r.gpuBackendMu.RLock()
+	defer r.gpuBackendMu.RUnlock()
+	return r.hasNVIDIA
+}
+
+// HasIntel returns whether the runner detected Intel GPUs (e.g. Arc).
+func (r *Runner) HasIntel() bool {
+	r.gpuBackendMu.RLock()
+	defer r.gpuBackendMu.RUnlock()
+	return r.hasIntel
+}
+
+// DisableRT returns whether GPU ray tracing acceleration should be disabled.
+func (r *Runner) DisableRT() bool {
+	return r.disableRT
+}
+
+// HipGPUSampleBatch returns the per-pass GPU sample limit for gfx115x batching (0 = disabled).
+func (r *Runner) HipGPUSampleBatch() int {
+	return r.hipGPUSampleBatch
+}
+
+// GPUDetectionFailed returns true when startup GPU backend detection could not run or failed. When true, all jobs use CPU because backend availability is unknown.
+func (r *Runner) GPUDetectionFailed() bool {
+	r.gpuBackendMu.RLock()
+	defer r.gpuBackendMu.RUnlock()
+	return r.gpuDetectionFailed
+}
+
 // Start starts the job polling loop.
 func (r *Runner) Start(pollInterval time.Duration) {
 	log.Printf("Starting job polling loop (interval: %v)", pollInterval)
@@ -242,7 +412,26 @@ func (r *Runner) executeJob(job *api.NextJobResponse) (err error) {
 			r.blender,
 			r.encoder,
 			r.processes,
+			r.IsGPULockedOut(),
+			r.HasAMD(),
+			r.HasNVIDIA(),
+			r.HasIntel(),
+			r.GPUDetectionFailed(),
+			r.forceCPURendering,
+			r.disableRT,
+			r.hipGPUSampleBatch,
+			nil, // set below so the callback can mark this attempt
+			r.sandboxWrapper,
 		)
+		// Arm GPU lockout at most once process-wide; if this attempt is the one that
+		// arms it, mark the context so a failure requeues without burning retry_count.
+		ctx.OnGPUError = func() {
+			if r.SetGPULockedOut(true) {
+				ctx.GPULockoutArmedThisAttempt = true
+				ctx.GPULockedOut = true
+				ctx.Warn("GPU error detected; GPU disabled for subsequent jobs (this attempt free-requeues without using a retry)")
+			}
+		}
 
 		ctx.Info(fmt.Sprintf("Task assignment received (job: %d, type: %s)",
 			job.Task.JobID, job.Task.TaskType))
@@ -261,7 +450,7 @@ func (r *Runner) executeJob(job *api.NextJobResponse) (err error) {
 			contextPath := job.JobPath + "/context.tar"
 			if err := r.downloadContext(job.Task.JobID, contextPath, job.JobToken); err != nil {
 				jobConn.Log(job.Task.TaskID, types.LogLevelError, fmt.Sprintf("Failed to download context: %v", err))
-				jobConn.Complete(job.Task.TaskID, false, fmt.Errorf("failed to download context: %v", err))
+				jobConn.Complete(job.Task.TaskID, false, fmt.Errorf("failed to download context: %v", err), false)
 				return fmt.Errorf("failed to download context: %w", err)
 			}
 			processErr = processor.Process(ctx)
@@ -304,27 +493,56 @@ func (r *Runner) uploadOutputs(ctx *tasks.Context, job *api.NextJobResponse) err
 	outputDir := ctx.WorkDir + "/output"
 	uploadPath := fmt.Sprintf("/api/runner/jobs/%d/upload", job.Task.JobID)
 
+	return uploadOutputFiles(outputDir, func(filePath, fileName string) error {
+		if err := r.manager.UploadFile(uploadPath, job.JobToken, filePath); err != nil {
+			return err
+		}
+		ctx.OutputUploaded(fileName)
+		// Delete file after successful upload to prevent duplicate uploads
+		if err := os.Remove(filePath); err != nil {
+			log.Printf("Warning: Failed to delete file %s after upload: %v", filePath, err)
+		}
+		return nil
+	})
+}
+
+// uploadOutputFiles uploads all non-directory files from outputDir.
+// Fails if the directory cannot be read, any upload fails, or zero files were uploaded.
+func uploadOutputFiles(outputDir string, uploadFn func(filePath, fileName string) error) error {
 	entries, err := os.ReadDir(outputDir)
 	if err != nil {
 		return fmt.Errorf("failed to read output directory: %w", err)
 	}
 
+	var files []os.DirEntry
 	for _, entry := range entries {
-		if entry.IsDir() {
-			continue
-		}
-		filePath := outputDir + "/" + entry.Name()
-		if err := r.manager.UploadFile(uploadPath, job.JobToken, filePath); err != nil {
-			log.Printf("Failed to upload %s: %v", filePath, err)
-		} else {
-			ctx.OutputUploaded(entry.Name())
-			// Delete file after successful upload to prevent duplicate uploads
-			if err := os.Remove(filePath); err != nil {
-				log.Printf("Warning: Failed to delete file %s after upload: %v", filePath, err)
-			}
+		if !entry.IsDir() {
+			files = append(files, entry)
 		}
 	}
+	if len(files) == 0 {
+		return fmt.Errorf("no output files found in %s", outputDir)
+	}
 
+	var firstErr error
+	uploaded := 0
+	for _, entry := range files {
+		filePath := filepath.Join(outputDir, entry.Name())
+		if err := uploadFn(filePath, entry.Name()); err != nil {
+			log.Printf("Failed to upload %s: %v", filePath, err)
+			if firstErr == nil {
+				firstErr = fmt.Errorf("failed to upload %s: %w", entry.Name(), err)
+			}
+			continue
+		}
+		uploaded++
+	}
+	if firstErr != nil {
+		return firstErr
+	}
+	if uploaded == 0 {
+		return fmt.Errorf("no output files were uploaded from %s", outputDir)
+	}
 	return nil
 }
 
@@ -392,3 +610,28 @@ func (r *Runner) GetFingerprint() string {
 func (r *Runner) GetID() int64 {
 	return r.id
 }
+
+// SetGPULockedOut sets whether GPU use is locked out due to a detected GPU error.
+// When true, the runner will force CPU rendering for all jobs.
+// Returns true only on the false→true transition (first arm); subsequent calls are no-ops for logging.
+func (r *Runner) SetGPULockedOut(locked bool) (newlyEnabled bool) {
+	r.gpuLockedOutMu.Lock()
+	defer r.gpuLockedOutMu.Unlock()
+	if locked {
+		if r.gpuLockedOut {
+			return false
+		}
+		r.gpuLockedOut = true
+		log.Printf("GPU lockout enabled: GPU rendering disabled for subsequent jobs (CPU only)")
+		return true
+	}
+	r.gpuLockedOut = false
+	return false
+}
+
+// IsGPULockedOut returns whether GPU use is currently locked out.
+func (r *Runner) IsGPULockedOut() bool {
+	r.gpuLockedOutMu.RLock()
+	defer r.gpuLockedOutMu.RUnlock()
+	return r.gpuLockedOut
+}

internal/runner/runner_test.go

@@ -0,0 +1,96 @@
+package runner
+
+import (
+	"encoding/hex"
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestNewRunner_InitializesFields(t *testing.T) {
+	r := New("http://localhost:8080", "runner-a", "host-a", false, false, 0)
+	if r == nil {
+		t.Fatal("New should return a runner")
+	}
+	if r.name != "runner-a" || r.hostname != "host-a" {
+		t.Fatalf("unexpected runner identity: %q %q", r.name, r.hostname)
+	}
+}
+
+func TestRunner_GPUFlagsSetters(t *testing.T) {
+	r := New("http://localhost:8080", "runner-a", "host-a", false, false, 0)
+	if newly := r.SetGPULockedOut(true); !newly {
+		t.Fatal("expected first SetGPULockedOut(true) to report newly enabled")
+	}
+	if !r.IsGPULockedOut() {
+		t.Fatal("expected GPU lockout to be true")
+	}
+	if newly := r.SetGPULockedOut(true); newly {
+		t.Fatal("expected second SetGPULockedOut(true) to be a no-op transition")
+	}
+	if newly := r.SetGPULockedOut(false); newly {
+		t.Fatal("clearing lockout should not report newly enabled")
+	}
+	if r.IsGPULockedOut() {
+		t.Fatal("expected GPU lockout cleared")
+	}
+}
+
+func TestGenerateFingerprint_PopulatesValue(t *testing.T) {
+	r := New("http://localhost:8080", "runner-a", "host-a", false, false, 0)
+	r.generateFingerprint()
+	fp := r.GetFingerprint()
+	if fp == "" {
+		t.Fatal("fingerprint should not be empty")
+	}
+	if len(fp) != 64 {
+		t.Fatalf("fingerprint should be sha256 hex, got %q", fp)
+	}
+	if _, err := hex.DecodeString(fp); err != nil {
+		t.Fatalf("fingerprint should be valid hex: %v", err)
+	}
+}
+
+func TestUploadOutputFiles_FailsWhenUploadErrors(t *testing.T) {
+	dir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(dir, "frame_0001.exr"), []byte("x"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	err := uploadOutputFiles(dir, func(filePath, fileName string) error {
+		return errors.New("upload denied")
+	})
+	if err == nil {
+		t.Fatal("expected error when upload fails")
+	}
+}
+
+func TestUploadOutputFiles_FailsWhenEmpty(t *testing.T) {
+	dir := t.TempDir()
+	err := uploadOutputFiles(dir, func(filePath, fileName string) error {
+		t.Fatal("upload should not be called")
+		return nil
+	})
+	if err == nil {
+		t.Fatal("expected error for empty output dir")
+	}
+}
+
+func TestUploadOutputFiles_Success(t *testing.T) {
+	dir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(dir, "frame_0001.exr"), []byte("x"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	var seen string
+	err := uploadOutputFiles(dir, func(filePath, fileName string) error {
+		seen = fileName
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("uploadOutputFiles: %v", err)
+	}
+	if seen != "frame_0001.exr" {
+		t.Fatalf("got %q", seen)
+	}
+}
+

internal/runner/sandbox/gpu.go

@@ -0,0 +1,173 @@
+package sandbox
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// Bind describes a host path to expose inside the sandbox.
+type Bind struct {
+	Host string
+	// Dest is the path inside the sandbox (usually same as Host for absolute paths).
+	Dest string
+	// ReadOnly is true for library trees and Blender installs.
+	ReadOnly bool
+	// Dev is true for device nodes / device trees (podman --device or -v for dirs).
+	Dev bool
+	// Optional means skip if host path missing (no error).
+	Optional bool
+}
+
+// GPUMounts returns host paths to expose for Cycles GPU backends based on detection.
+// forceCPU skips GPU-specific devices/libs (still may include generic /dev via backend).
+func GPUMounts(hasAMD, hasNVIDIA, hasIntel, forceCPU bool) []Bind {
+	if forceCPU {
+		return nil
+	}
+	var binds []Bind
+
+	// DRM render nodes used by AMD, Intel, and some NVIDIA EGL paths.
+	if hasAMD || hasNVIDIA || hasIntel {
+		binds = append(binds, Bind{Host: "/dev/dri", Dest: "/dev/dri", Dev: true, Optional: true})
+	}
+
+	if hasAMD {
+		binds = append(binds, Bind{Host: "/dev/kfd", Dest: "/dev/kfd", Dev: true, Optional: true})
+		// Common ROCm install layouts
+		for _, p := range []string{"/opt/rocm", "/usr/share/libdrm"} {
+			binds = append(binds, Bind{Host: p, Dest: p, ReadOnly: true, Optional: true})
+		}
+		// Distro ROCm / amdgpu userspace libs often live under multiarch paths
+		for _, p := range rocmLibHints() {
+			binds = append(binds, Bind{Host: p, Dest: p, ReadOnly: true, Optional: true})
+		}
+	}
+
+	if hasNVIDIA {
+		for _, name := range nvidiaDeviceNames() {
+			p := filepath.Join("/dev", name)
+			binds = append(binds, Bind{Host: p, Dest: p, Dev: true, Optional: true})
+		}
+		for _, p := range nvidiaLibHints() {
+			binds = append(binds, Bind{Host: p, Dest: p, ReadOnly: true, Optional: true})
+		}
+	}
+
+	if hasIntel {
+		for _, p := range intelLibHints() {
+			binds = append(binds, Bind{Host: p, Dest: p, ReadOnly: true, Optional: true})
+		}
+	}
+
+	return uniqueBinds(binds)
+}
+
+func nvidiaDeviceNames() []string {
+	// Fixed control nodes + any /dev/nvidiaN
+	names := []string{"nvidiactl", "nvidia-uvm", "nvidia-uvm-tools", "nvidia-modeset"}
+	entries, err := os.ReadDir("/dev")
+	if err != nil {
+		return names
+	}
+	for _, e := range entries {
+		n := e.Name()
+		if strings.HasPrefix(n, "nvidia") && !containsString(names, n) {
+			names = append(names, n)
+		}
+	}
+	return names
+}
+
+func nvidiaLibHints() []string {
+	hints := []string{
+		"/usr/lib/wsl/lib", // WSL NVIDIA
+		"/usr/local/nvidia",
+		"/usr/local/cuda",
+		"/usr/lib/x86_64-linux-gnu",
+		"/usr/lib64",
+	}
+	// Driver stores often under /usr/lib/libcuda* — parent dirs already covered.
+	// Also scan common multiarch for libcuda.so
+	for _, dir := range []string{"/usr/lib", "/usr/lib64", "/usr/lib/x86_64-linux-gnu", "/lib", "/lib64"} {
+		if matchesAny(dir, "libcuda.so*") || matchesAny(dir, "libnvidia-*.so*") {
+			hints = append(hints, dir)
+		}
+	}
+	return hints
+}
+
+func rocmLibHints() []string {
+	hints := []string{
+		"/usr/lib/x86_64-linux-gnu",
+		"/usr/lib64",
+		"/opt/amdgpu",
+	}
+	// ROCm versioned trees under /opt/rocm-*
+	if entries, err := os.ReadDir("/opt"); err == nil {
+		for _, e := range entries {
+			if e.IsDir() && strings.HasPrefix(e.Name(), "rocm") {
+				hints = append(hints, filepath.Join("/opt", e.Name()))
+			}
+		}
+	}
+	return hints
+}
+
+func intelLibHints() []string {
+	return []string{
+		"/usr/lib/x86_64-linux-gnu",
+		"/usr/lib64",
+		"/usr/lib/intel-opencl",
+		"/etc/OpenCL",
+	}
+}
+
+func matchesAny(dir, glob string) bool {
+	m, err := filepath.Glob(filepath.Join(dir, glob))
+	return err == nil && len(m) > 0
+}
+
+func containsString(ss []string, s string) bool {
+	for _, x := range ss {
+		if x == s {
+			return true
+		}
+	}
+	return false
+}
+
+func uniqueBinds(in []Bind) []Bind {
+	seen := make(map[string]bool)
+	var out []Bind
+	for _, b := range in {
+		key := b.Host + "|" + b.Dest + "|"
+		if b.Dev {
+			key += "d"
+		}
+		if b.ReadOnly {
+			key += "r"
+		}
+		if seen[key] {
+			continue
+		}
+		seen[key] = true
+		out = append(out, b)
+	}
+	return out
+}
+
+// ExistingBinds filters to binds whose host path exists (or non-optional always kept for error reporting).
+func ExistingBinds(binds []Bind) []Bind {
+	var out []Bind
+	for _, b := range binds {
+		if pathExists(b.Host) {
+			out = append(out, b)
+			continue
+		}
+		if !b.Optional {
+			out = append(out, b) // caller may error
+		}
+	}
+	return out
+}

internal/runner/sandbox/none.go

@@ -0,0 +1,18 @@
+package sandbox
+
+import "os/exec"
+
+type noneWrapper struct{}
+
+func (w *noneWrapper) Name() string { return BackendNone }
+
+func (w *noneWrapper) Available() error { return nil }
+
+func (w *noneWrapper) Wrap(spec Spec) (*exec.Cmd, error) {
+	cmd := exec.Command(spec.BlenderBinary, spec.Args...)
+	cmd.Dir = spec.WorkDir
+	if len(spec.Env) > 0 {
+		cmd.Env = spec.Env
+	}
+	return cmd, nil
+}

internal/runner/sandbox/paths.go

@@ -0,0 +1,13 @@
+package sandbox
+
+import "path/filepath"
+
+func execAbs(p string) (string, error) {
+	return filepath.Abs(p)
+}
+
+// blenderRoot returns the directory that contains the blender binary
+// (the version extract root, e.g. .../blender-versions/4.5.7).
+func blenderRoot(blenderBinary string) string {
+	return filepath.Dir(mustAbs(blenderBinary))
+}

internal/runner/sandbox/podman.go

@@ -0,0 +1,121 @@
+package sandbox
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strconv"
+	"strings"
+)
+
+const defaultPodmanImage = "registry.fedoraproject.org/fedora-minimal:41"
+
+type podmanWrapper struct {
+	allowNetwork bool
+	image        string
+}
+
+func (w *podmanWrapper) Name() string { return BackendPodman }
+
+func (w *podmanWrapper) Available() error {
+	if _, err := LookPath("podman"); err != nil {
+		return fmt.Errorf("podman not found in PATH: %w", err)
+	}
+	return nil
+}
+
+func (w *podmanWrapper) Wrap(spec Spec) (*exec.Cmd, error) {
+	if err := w.Available(); err != nil {
+		return nil, err
+	}
+	bin := mustAbs(spec.BlenderBinary)
+	work := mustAbs(spec.WorkDir)
+	home := mustAbs(spec.HomeDir)
+	if home == "" {
+		home = filepath.Join(work, "home")
+	}
+	root := blenderRoot(bin)
+
+	args := []string{
+		"run", "--rm",
+		"--security-opt", "label=disable",
+		// Keep user groups for /dev/dri access (render/video)
+		"--group-add", "keep-groups",
+	}
+	if !w.allowNetwork {
+		args = append(args, "--network=none")
+	}
+	// Map to same UID so bind mounts are writable
+	uid := os.Getuid()
+	gid := os.Getgid()
+	args = append(args, "--user", fmt.Sprintf("%d:%d", uid, gid))
+
+	// Thin OS image + host Blender tree + job dir
+	args = append(args,
+		"-v", root+":"+root+":ro",
+		"-v", work+":"+work+":rw",
+	)
+	if home != work && !strings.HasPrefix(home, work+string(os.PathSeparator)) {
+		_ = os.MkdirAll(home, 0755)
+		args = append(args, "-v", home+":"+home+":rw")
+	}
+
+	// System libs for GPU ICDs / dynamic linker (Blender tarball is mostly self-contained)
+	for _, p := range []string{"/usr", "/lib", "/lib64", "/etc"} {
+		if pathExists(p) {
+			args = append(args, "-v", p+":"+p+":ro")
+		}
+	}
+
+	// GPU devices and extra lib roots
+	for _, b := range ExistingBinds(GPUMounts(spec.HasAMD, spec.HasNVIDIA, spec.HasIntel, spec.ForceCPU)) {
+		if !pathExists(b.Host) {
+			continue
+		}
+		if b.Dev {
+			// --device works for character devices; for /dev/dri use volume
+			info, err := os.Stat(b.Host)
+			if err != nil {
+				continue
+			}
+			if info.IsDir() {
+				args = append(args, "-v", b.Host+":"+b.Dest+":ro")
+			} else {
+				args = append(args, "--device", b.Host)
+			}
+			continue
+		}
+		mode := "ro"
+		if !b.ReadOnly {
+			mode = "rw"
+		}
+		args = append(args, "-v", b.Host+":"+b.Dest+":"+mode)
+	}
+
+	// Environment
+	for _, e := range spec.Env {
+		args = append(args, "-e", e)
+	}
+	if home != "" {
+		args = append(args, "-e", "HOME="+home)
+	}
+
+	args = append(args, "--workdir", work)
+	args = append(args, "--entrypoint", bin)
+	args = append(args, w.image)
+	// entrypoint is blender; remaining args are blender args
+	args = append(args, spec.Args...)
+
+	cmd := exec.Command("podman", args...)
+	cmd.Dir = work
+	return cmd, nil
+}
+
+// PodmanImageDefault returns the default thin runtime image name.
+func PodmanImageDefault() string { return defaultPodmanImage }
+
+// FormatUIDGID is a small helper for tests.
+func FormatUIDGID(uid, gid int) string {
+	return strconv.Itoa(uid) + ":" + strconv.Itoa(gid)
+}

internal/runner/sandbox/sandbox.go

@@ -0,0 +1,128 @@
+// Package sandbox wraps Blender (and similar) invocations in optional isolation.
+//
+// Backends:
+//   - none:   run on the host (current behavior)
+//   - podman: rootless podman container; Blender tarball is bind-mounted (not baked into an image)
+//
+// GPU access is provided by passing host device nodes and common userspace lib roots
+// discovered at wrap time (NVIDIA / AMD ROCm / Intel DRM), not by shipping per-version
+// Blender container images.
+package sandbox
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+)
+
+// Backend names accepted by New and CLI flags.
+const (
+	BackendNone   = "none"
+	BackendPodman = "podman"
+)
+
+// Options configures sandbox construction.
+type Options struct {
+	// Backend is none|podman (default none).
+	Backend string
+	// AllowNetwork keeps network in the sandbox (default false for podman).
+	AllowNetwork bool
+	// PodmanImage is used only for backend=podman. The image is a thin OS root;
+	// Blender comes from a host bind of the versioned tarball tree.
+	// Default: registry.fedoraproject.org/fedora-minimal:41
+	PodmanImage string
+}
+
+// Spec describes a Blender process to run under the sandbox.
+type Spec struct {
+	// BlenderBinary is an absolute path to the blender executable.
+	BlenderBinary string
+	// Args are arguments after the binary (not including argv0).
+	Args []string
+	// WorkDir is the process working directory (job workspace); bind-mounted RW.
+	WorkDir string
+	// HomeDir is Blender HOME (usually WorkDir/home); bind-mounted RW.
+	HomeDir string
+	// Env is the full environment for the process (HOME, LD_LIBRARY_PATH, etc.).
+	Env []string
+
+	// GPU hints from host detection (used to select device/lib binds).
+	HasAMD    bool
+	HasNVIDIA bool
+	HasIntel  bool
+	// ForceCPU skips GPU device binds when true.
+	ForceCPU bool
+	// AllowNetwork overrides Options.AllowNetwork when non-nil... kept simple: use Options only.
+}
+
+// Wrapper turns a Spec into an *exec.Cmd ready to Start.
+type Wrapper interface {
+	// Name returns the backend name.
+	Name() string
+	// Available reports whether required host tools exist.
+	Available() error
+	// Wrap builds the command. Callers own Start/Wait/pipes.
+	Wrap(spec Spec) (*exec.Cmd, error)
+}
+
+// New returns a sandbox Wrapper for the given options.
+func New(opts Options) (Wrapper, error) {
+	backend := strings.ToLower(strings.TrimSpace(opts.Backend))
+	if backend == "" {
+		backend = BackendPodman
+	}
+	switch backend {
+	case BackendNone:
+		return &noneWrapper{}, nil
+	case BackendPodman:
+		img := opts.PodmanImage
+		if img == "" {
+			img = defaultPodmanImage
+		}
+		w := &podmanWrapper{allowNetwork: opts.AllowNetwork, image: img}
+		return w, nil
+	default:
+		return nil, fmt.Errorf("unknown sandbox backend %q (want none or podman)", opts.Backend)
+	}
+}
+
+// NormalizeBackend validates and returns a canonical backend name.
+func NormalizeBackend(s string) (string, error) {
+	b := strings.ToLower(strings.TrimSpace(s))
+	if b == "" {
+		return BackendPodman, nil
+	}
+	switch b {
+	case BackendNone, BackendPodman:
+		return b, nil
+	default:
+		return "", fmt.Errorf("unknown sandbox backend %q (want none or podman)", s)
+	}
+}
+
+// LookPath is os/exec.LookPath, overridable in tests.
+var LookPath = exec.LookPath
+
+// pathExists reports whether path exists.
+func pathExists(p string) bool {
+	_, err := os.Stat(p)
+	return err == nil
+}
+
+// mustAbs returns an absolute path or the original on error.
+func mustAbs(p string) string {
+	if p == "" {
+		return p
+	}
+	abs, err := absPath(p)
+	if err != nil {
+		return p
+	}
+	return abs
+}
+
+// absPath is filepath.Abs, isolated for tests.
+var absPath = func(p string) (string, error) {
+	return execAbs(p)
+}

internal/runner/sandbox/sandbox_test.go

@@ -0,0 +1,132 @@
+package sandbox
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestNormalizeBackend(t *testing.T) {
+	got, err := NormalizeBackend("PODMAN")
+	if err != nil || got != BackendPodman {
+		t.Fatalf("got %q err %v", got, err)
+	}
+	if _, err := NormalizeBackend("bwrap"); err == nil {
+		t.Fatal("expected error for removed bwrap backend")
+	}
+	if _, err := NormalizeBackend("firecracker"); err == nil {
+		t.Fatal("expected error for unknown backend")
+	}
+	got, err = NormalizeBackend("")
+	if err != nil || got != BackendPodman {
+		t.Fatalf("empty -> podman, got %q %v", got, err)
+	}
+}
+
+func TestNoneWrap_Passthrough(t *testing.T) {
+	w, err := New(Options{Backend: BackendNone})
+	if err != nil {
+		t.Fatal(err)
+	}
+	bin := "/opt/blender/blender"
+	cmd, err := w.Wrap(Spec{
+		BlenderBinary: bin,
+		Args:          []string{"-b", "scene.blend"},
+		WorkDir:       "/tmp/job",
+		Env:           []string{"HOME=/tmp/job/home"},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(cmd.Args) == 0 || cmd.Args[0] != bin {
+		t.Fatalf("args[0]=%v path=%q", cmd.Args, cmd.Path)
+	}
+	if cmd.Dir != "/tmp/job" {
+		t.Fatalf("Dir=%q", cmd.Dir)
+	}
+}
+
+func TestGPUMounts_ForceCPUEmpty(t *testing.T) {
+	m := GPUMounts(true, true, true, true)
+	if len(m) != 0 {
+		t.Fatalf("force CPU should skip GPU mounts, got %#v", m)
+	}
+}
+
+func TestGPUMounts_AMDIncludesKFD(t *testing.T) {
+	m := GPUMounts(true, false, false, false)
+	var hosts []string
+	for _, b := range m {
+		hosts = append(hosts, b.Host)
+	}
+	joined := strings.Join(hosts, ",")
+	if !strings.Contains(joined, "/dev/dri") {
+		t.Fatalf("AMD mounts should include /dev/dri, got %v", hosts)
+	}
+	if !strings.Contains(joined, "/dev/kfd") {
+		t.Fatalf("AMD mounts should include /dev/kfd, got %v", hosts)
+	}
+}
+
+func TestGPUMounts_NVIDIAIncludesCtl(t *testing.T) {
+	m := GPUMounts(false, true, false, false)
+	found := false
+	for _, b := range m {
+		if strings.Contains(b.Host, "nvidia") {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Fatalf("NVIDIA mounts should include nvidia devices, got %#v", m)
+	}
+}
+
+func TestPodmanWrap_BuildsRunArgs(t *testing.T) {
+	w := &podmanWrapper{allowNetwork: false, image: "example.com/thin:latest"}
+	if err := w.Available(); err != nil {
+		t.Skipf("podman not installed: %v", err)
+	}
+	tmp := t.TempDir()
+	blendDir := filepath.Join(tmp, "bver")
+	_ = os.MkdirAll(blendDir, 0755)
+	bin := filepath.Join(blendDir, "blender")
+	_ = os.WriteFile(bin, []byte("x"), 0755)
+	job := filepath.Join(tmp, "job")
+	_ = os.MkdirAll(job, 0755)
+
+	cmd, err := w.Wrap(Spec{
+		BlenderBinary: bin,
+		Args:          []string{"-b", "x.blend"},
+		WorkDir:       job,
+		HomeDir:       filepath.Join(job, "home"),
+		Env:           []string{"HOME=" + filepath.Join(job, "home")},
+		HasNVIDIA:     true,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	joined := strings.Join(cmd.Args, " ")
+	if !strings.Contains(joined, "run") || !strings.Contains(joined, "--network=none") {
+		t.Fatalf("expected podman run --network=none: %s", joined)
+	}
+	if !strings.Contains(joined, "example.com/thin:latest") {
+		t.Fatalf("expected image in args: %s", joined)
+	}
+	if !strings.Contains(joined, "--entrypoint") || !strings.Contains(joined, bin) {
+		t.Fatalf("expected entrypoint blender: %s", joined)
+	}
+	if !strings.Contains(joined, blendDir) || !strings.Contains(joined, job) {
+		t.Fatalf("expected volume binds: %s", joined)
+	}
+}
+
+func TestNew_UnknownBackend(t *testing.T) {
+	if _, err := New(Options{Backend: "bwrap"}); err == nil {
+		t.Fatal("expected error for bwrap")
+	}
+	if _, err := New(Options{Backend: "gvisor"}); err == nil {
+		t.Fatal("expected error")
+	}
+}

internal/runner/tasks/encode.go

@@ -246,6 +246,8 @@ func (p *EncodeProcessor) Process(ctx *Context) error {
 		TwoPass:      true,
 	})
 	if err := pass1Cmd.Run(); err != nil {
+		// Pass 1 is analysis-only (writes to /dev/null). FFmpeg often exits non-zero
+		// on benign codec/option warnings while still producing passlogfile stats.
 		ctx.Warn(fmt.Sprintf("Pass 1 completed (warnings expected): %v", err))
 	}
 
@@ -298,6 +300,9 @@ func (p *EncodeProcessor) Process(ctx *Context) error {
 				ctx.Info(line)
 			}
 		}
+		if err := scanner.Err(); err != nil {
+			log.Printf("Error reading encode stdout: %v", err)
+		}
 	}()
 
 	// Stream stderr
@@ -311,6 +316,9 @@ func (p *EncodeProcessor) Process(ctx *Context) error {
 				ctx.Warn(line)
 			}
 		}
+		if err := scanner.Err(); err != nil {
+			log.Printf("Error reading encode stderr: %v", err)
+		}
 	}()
 
 	err = cmd.Wait()
@@ -379,7 +387,7 @@ func (p *EncodeProcessor) Process(ctx *Context) error {
 func detectAlphaChannel(ctx *Context, filePath string) bool {
 	// Use ffprobe to check pixel format and stream properties
 	// EXR files with alpha will have formats like gbrapf32le (RGBA) vs gbrpf32le (RGB)
-	cmd := exec.Command("ffprobe",
+	cmd := execCommand("ffprobe",
 		"-v", "error",
 		"-select_streams", "v:0",
 		"-show_entries", "stream=pix_fmt:stream=codec_name",
@@ -412,7 +420,7 @@ func detectAlphaChannel(ctx *Context, filePath string) bool {
 // detectHDR checks if an EXR file contains HDR content using ffprobe
 func detectHDR(ctx *Context, filePath string) bool {
 	// First, check if the pixel format supports HDR (32-bit float)
-	cmd := exec.Command("ffprobe",
+	cmd := execCommand("ffprobe",
 		"-v", "error",
 		"-select_streams", "v:0",
 		"-show_entries", "stream=pix_fmt",
@@ -440,7 +448,7 @@ func detectHDR(ctx *Context, filePath string) bool {
 	// For 32-bit float EXR, sample pixels to check if values exceed SDR range (> 1.0)
 	// Use ffmpeg to extract pixel statistics - check max pixel values
 	// This is more efficient than sampling individual pixels
-	cmd = exec.Command("ffmpeg",
+	cmd = execCommand("ffmpeg",
 		"-v", "error",
 		"-i", filePath,
 		"-vf", "signalstats",
@@ -483,7 +491,7 @@ func detectHDRBySampling(ctx *Context, filePath string) bool {
 	}
 
 	for _, region := range sampleRegions {
-		cmd := exec.Command("ffmpeg",
+		cmd := execCommand("ffmpeg",
 			"-v", "error",
 			"-i", filePath,
 			"-vf", fmt.Sprintf("%s,scale=1:1", region),

internal/runner/tasks/encode_test.go

@@ -0,0 +1,120 @@
+package tasks
+
+import (
+	"encoding/binary"
+	"math"
+	"os"
+	"os/exec"
+	"strings"
+	"testing"
+)
+
+func TestFloat32FromBytes(t *testing.T) {
+	got := float32FromBytes([]byte{0x00, 0x00, 0x80, 0x3f}) // 1.0 little-endian
+	if got != 1.0 {
+		t.Fatalf("float32FromBytes() = %v, want 1.0", got)
+	}
+}
+
+func TestMax(t *testing.T) {
+	if got := max(1, 2); got != 2 {
+		t.Fatalf("max() = %v, want 2", got)
+	}
+}
+
+func TestExtractFrameNumber(t *testing.T) {
+	if got := extractFrameNumber("render_0042.png"); got != 42 {
+		t.Fatalf("extractFrameNumber() = %d, want 42", got)
+	}
+}
+
+func TestCheckFFmpegSizeError(t *testing.T) {
+	err := checkFFmpegSizeError("hardware does not support encoding at size ... constraints: width 128-4096 height 128-4096")
+	if err == nil {
+		t.Fatal("expected a size error")
+	}
+}
+
+func TestDetectAlphaChannel_UsesExecSeam(t *testing.T) {
+	orig := execCommand
+	execCommand = fakeExecCommand
+	defer func() { execCommand = orig }()
+
+	if !detectAlphaChannel(&Context{}, "/tmp/frame.exr") {
+		t.Fatal("expected alpha channel detection via mocked ffprobe output")
+	}
+}
+
+func TestDetectHDR_UsesExecSeam(t *testing.T) {
+	orig := execCommand
+	execCommand = fakeExecCommand
+	defer func() { execCommand = orig }()
+
+	if !detectHDR(&Context{}, "/tmp/frame.exr") {
+		t.Fatal("expected HDR detection via mocked ffmpeg sampling output")
+	}
+}
+
+func fakeExecCommand(command string, args ...string) *exec.Cmd {
+	cs := []string{"-test.run=TestExecHelperProcess", "--", command}
+	cs = append(cs, args...)
+	cmd := exec.Command(os.Args[0], cs...)
+	cmd.Env = append(os.Environ(), "GO_WANT_HELPER_PROCESS=1")
+	return cmd
+}
+
+func TestExecHelperProcess(t *testing.T) {
+	if os.Getenv("GO_WANT_HELPER_PROCESS") != "1" {
+		return
+	}
+
+	idx := 0
+	for i, a := range os.Args {
+		if a == "--" {
+			idx = i
+			break
+		}
+	}
+	if idx == 0 || idx+1 >= len(os.Args) {
+		os.Exit(2)
+	}
+
+	cmdName := os.Args[idx+1]
+	cmdArgs := os.Args[idx+2:]
+
+	switch cmdName {
+	case "ffprobe":
+		if containsArg(cmdArgs, "stream=pix_fmt:stream=codec_name") {
+			_, _ = os.Stdout.WriteString("pix_fmt=gbrapf32le\ncodec_name=exr\n")
+			os.Exit(0)
+		}
+		_, _ = os.Stdout.WriteString("gbrpf32le\n")
+		os.Exit(0)
+	case "ffmpeg":
+		if containsArg(cmdArgs, "signalstats") {
+			_, _ = os.Stderr.WriteString("signalstats failed")
+			os.Exit(1)
+		}
+		if containsArg(cmdArgs, "rawvideo") {
+			buf := make([]byte, 12)
+			binary.LittleEndian.PutUint32(buf[0:4], math.Float32bits(1.5))
+			binary.LittleEndian.PutUint32(buf[4:8], math.Float32bits(0.2))
+			binary.LittleEndian.PutUint32(buf[8:12], math.Float32bits(0.1))
+			_, _ = os.Stdout.Write(buf)
+			os.Exit(0)
+		}
+		os.Exit(0)
+	default:
+		os.Exit(0)
+	}
+}
+
+func containsArg(args []string, target string) bool {
+	for _, a := range args {
+		if strings.Contains(a, target) {
+			return true
+		}
+	}
+	return false
+}
+

internal/runner/tasks/exec_seams.go

@@ -0,0 +1,7 @@
+package tasks
+
+import "os/exec"
+
+// execCommand is a seam for process execution in tests.
+var execCommand = exec.Command
+

internal/runner/tasks/exr_merge.go

@@ -0,0 +1,46 @@
+package tasks
+
+import (
+	"fmt"
+	"os/exec"
+	"strings"
+)
+
+// mergeEXRFiles averages multiple linear EXR renders into one (Monte Carlo accumulation).
+func mergeEXRFiles(output string, inputs []string) error {
+	if len(inputs) == 0 {
+		return fmt.Errorf("no input EXR files to merge")
+	}
+	if len(inputs) == 1 {
+		return copyFile(inputs[0], output)
+	}
+
+	args := append([]string{}, inputs...)
+	args = append(args, "-evaluate-sequence", "mean", output)
+
+	if path, err := exec.LookPath("magick"); err == nil {
+		cmd := exec.Command(path, args...)
+		if out, err := cmd.CombinedOutput(); err != nil {
+			return fmt.Errorf("magick merge failed: %w (%s)", err, strings.TrimSpace(string(out)))
+		}
+		return nil
+	}
+
+	if path, err := exec.LookPath("convert"); err == nil {
+		cmd := exec.Command(path, args...)
+		if out, err := cmd.CombinedOutput(); err != nil {
+			return fmt.Errorf("convert merge failed: %w (%s)", err, strings.TrimSpace(string(out)))
+		}
+		return nil
+	}
+
+	return fmt.Errorf("ImageMagick (magick or convert) required to merge batched EXR renders")
+}
+
+func copyFile(src, dst string) error {
+	cmd := exec.Command("cp", "-f", src, dst)
+	if out, err := cmd.CombinedOutput(); err != nil {
+		return fmt.Errorf("copy %s to %s: %w (%s)", src, dst, err, strings.TrimSpace(string(out)))
+	}
+	return nil
+}

internal/runner/tasks/processor.go

@@ -7,6 +7,7 @@ import (
 	"jiggablend/internal/runner/api"
 	"jiggablend/internal/runner/blender"
 	"jiggablend/internal/runner/encoding"
+	"jiggablend/internal/runner/sandbox"
 	"jiggablend/internal/runner/workspace"
 	"jiggablend/pkg/executils"
 	"jiggablend/pkg/types"
@@ -38,12 +39,37 @@ type Context struct {
 	Blender   *blender.Manager
 	Encoder   *encoding.Selector
 	Processes *executils.ProcessTracker
+
+	// GPULockedOut is set when the runner has detected a GPU error (e.g. HIP) and disables GPU for all jobs.
+	GPULockedOut bool
+	// GPULockoutArmedThisAttempt is true when this task attempt newly enabled runner GPU lockout.
+	// Failures with this set free-requeue without incrementing retry_count (expected ROCm warmup).
+	GPULockoutArmedThisAttempt bool
+	// HasAMD is true when the runner detected AMD devices at startup.
+	HasAMD bool
+	// HasNVIDIA is true when the runner detected NVIDIA GPUs at startup.
+	HasNVIDIA bool
+	// HasIntel is true when the runner detected Intel GPUs (e.g. Arc) at startup.
+	HasIntel bool
+	// GPUDetectionFailed is true when startup GPU backend detection could not run; we force CPU for all versions (backend availability unknown).
+	GPUDetectionFailed bool
+	// OnGPUError is called when a GPU error line is seen in render logs; typically sets runner GPU lockout.
+	OnGPUError func()
+	// ForceCPURendering is a runner-level override that forces CPU rendering for all jobs.
+	ForceCPURendering bool
+	// DisableRT disables GPU ray tracing acceleration (runner-level flag).
+	DisableRT bool
+	// HipGPUSampleBatch limits samples per GPU render pass on gfx115x (0 = no batching).
+	HipGPUSampleBatch int
+	// Sandbox wraps Blender execution (none/podman). Nil means none.
+	Sandbox sandbox.Wrapper
 }
 
 // ErrJobCancelled indicates the manager-side job was cancelled during execution.
 var ErrJobCancelled = errors.New("job cancelled")
 
 // NewContext creates a new task context. frameEnd should be >= frame; if 0 or less than frame, it is treated as single-frame (frameEnd = frame).
+// gpuLockedOut is the runner's current GPU lockout state; gpuDetectionFailed means detection failed at startup (force CPU for all versions); onGPUError is called when a GPU error is detected in logs (may be nil).
 func NewContext(
 	taskID, jobID int64,
 	jobName string,
@@ -58,26 +84,46 @@ func NewContext(
 	blenderMgr *blender.Manager,
 	encoder *encoding.Selector,
 	processes *executils.ProcessTracker,
+	gpuLockedOut bool,
+	hasAMD bool,
+	hasNVIDIA bool,
+	hasIntel bool,
+	gpuDetectionFailed bool,
+	forceCPURendering bool,
+	disableRT bool,
+	hipGPUSampleBatch int,
+	onGPUError func(),
+	sb sandbox.Wrapper,
 ) *Context {
 	if frameEnd < frameStart {
 		frameEnd = frameStart
 	}
 	return &Context{
-		TaskID:    taskID,
-		JobID:     jobID,
-		JobName:   jobName,
-		Frame:     frameStart,
-		FrameEnd:  frameEnd,
-		TaskType:  taskType,
-		WorkDir:   workDir,
-		JobToken:  jobToken,
-		Metadata:  metadata,
-		Manager:   manager,
-		JobConn:   jobConn,
-		Workspace: ws,
-		Blender:   blenderMgr,
-		Encoder:   encoder,
-		Processes: processes,
+		TaskID:             taskID,
+		JobID:              jobID,
+		JobName:            jobName,
+		Frame:              frameStart,
+		FrameEnd:           frameEnd,
+		TaskType:           taskType,
+		WorkDir:            workDir,
+		JobToken:           jobToken,
+		Metadata:           metadata,
+		Manager:            manager,
+		JobConn:            jobConn,
+		Workspace:          ws,
+		Blender:            blenderMgr,
+		Encoder:            encoder,
+		Processes:          processes,
+		GPULockedOut:       gpuLockedOut,
+		HasAMD:             hasAMD,
+		HasNVIDIA:          hasNVIDIA,
+		HasIntel:           hasIntel,
+		GPUDetectionFailed: gpuDetectionFailed,
+		ForceCPURendering:  forceCPURendering,
+		DisableRT:           disableRT,
+		HipGPUSampleBatch:   hipGPUSampleBatch,
+		OnGPUError:          onGPUError,
+		Sandbox:             sb,
 	}
 }
 
@@ -118,18 +164,22 @@ func (c *Context) OutputUploaded(fileName string) {
 }
 
 // Complete sends task completion.
+// When the failure newly armed GPU lockout, free_requeue is set so the manager
+// requeues without burning retry_count.
 func (c *Context) Complete(success bool, errorMsg error) {
 	if c.JobConn != nil {
-		c.JobConn.Complete(c.TaskID, success, errorMsg)
+		freeRequeue := !success && c.GPULockoutArmedThisAttempt
+		c.JobConn.Complete(c.TaskID, success, errorMsg, freeRequeue)
 	}
 }
 
 // GetOutputFormat returns the output format from metadata or default.
+// Product default is EXR (Blender always renders EXR; deliverable may add video).
 func (c *Context) GetOutputFormat() string {
 	if c.Metadata != nil && c.Metadata.RenderSettings.OutputFormat != "" {
 		return c.Metadata.RenderSettings.OutputFormat
 	}
-	return "PNG"
+	return "EXR"
 }
 
 // GetFrameRate returns the frame rate from metadata or default.
@@ -153,11 +203,99 @@ func (c *Context) ShouldUnhideObjects() bool {
 	return c.Metadata != nil && c.Metadata.UnhideObjects != nil && *c.Metadata.UnhideObjects
 }
 
-// ShouldEnableExecution returns whether to enable auto-execution.
+// ShouldEnableExecution returns whether to pass Blender --enable-autoexec
+// (Python drivers/scripts inside the .blend). Job-bundled blender_addons/ install
+// independently whenever that folder is present in the context.
 func (c *Context) ShouldEnableExecution() bool {
 	return c.Metadata != nil && c.Metadata.EnableExecution != nil && *c.Metadata.EnableExecution
 }
 
+// ShouldForceCPU returns true if GPU should be disabled and CPU rendering forced
+// (runner GPU lockout, GPU detection failed at startup, or metadata force_cpu).
+func (c *Context) ShouldForceCPU() bool {
+	if c.ForceCPURendering {
+		return true
+	}
+	if c.GPULockedOut {
+		return true
+	}
+	// Detection failed at startup: backend availability unknown, so force CPU for all versions.
+	if c.GPUDetectionFailed {
+		return true
+	}
+	if c.Metadata != nil && c.Metadata.RenderSettings.EngineSettings != nil {
+		if v, ok := c.Metadata.RenderSettings.EngineSettings["force_cpu"]; ok {
+			if b, ok := v.(bool); ok && b {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// GetCyclesSamples returns the target Cycles sample count from metadata (default 128).
+func (c *Context) GetCyclesSamples() int {
+	if c.Metadata != nil && c.Metadata.RenderSettings.EngineSettings != nil {
+		if v, ok := c.Metadata.RenderSettings.EngineSettings["samples"]; ok {
+			switch n := v.(type) {
+			case float64:
+				if int(n) > 0 {
+					return int(n)
+				}
+			case int:
+				if n > 0 {
+					return n
+				}
+			}
+		}
+	}
+	return 128
+}
+
+// GetCyclesSeed returns the Cycles seed from metadata (default 0).
+func (c *Context) GetCyclesSeed() int {
+	if c.Metadata != nil && c.Metadata.RenderSettings.EngineSettings != nil {
+		if v, ok := c.Metadata.RenderSettings.EngineSettings["seed"]; ok {
+			switch n := v.(type) {
+			case float64:
+				return int(n)
+			case int:
+				return n
+			}
+		}
+	}
+	return 0
+}
+
+// ShouldBatchGPUSamples returns true when HIP GPU renders should be split into sample batches.
+func (c *Context) ShouldBatchGPUSamples() bool {
+	if c.ShouldForceCPU() || c.HipGPUSampleBatch <= 0 {
+		return false
+	}
+	return c.GetCyclesSamples() > c.HipGPUSampleBatch
+}
+
+// ShouldDisableRT returns true when GPU ray tracing acceleration should be disabled.
+func (c *Context) ShouldDisableRT() bool {
+	if c.DisableRT {
+		return true
+	}
+	if c.Metadata != nil && c.Metadata.RenderSettings.EngineSettings != nil {
+		settings := c.Metadata.RenderSettings.EngineSettings
+		if v, ok := settings["disable_rt"]; ok {
+			if b, ok := v.(bool); ok && b {
+				return true
+			}
+		}
+		if v, ok := settings["disable_hiprt"]; ok {
+			if b, ok := v.(bool); ok && b {
+				return true
+			}
+		}
+	}
+	return false
+}
+
 // IsJobCancelled checks whether the manager marked this job as cancelled.
 func (c *Context) IsJobCancelled() (bool, error) {
 	if c.Manager == nil {

internal/runner/tasks/processor_test.go

@@ -0,0 +1,42 @@
+package tasks
+
+import (
+	"errors"
+	"testing"
+
+	"jiggablend/pkg/types"
+)
+
+func TestNewContext_NormalizesFrameEnd(t *testing.T) {
+	ctx := NewContext(1, 2, "job", 10, 1, "render", "/tmp", "tok", nil, nil, nil, nil, nil, nil, nil, false, false, false, false, false, false, false, 0, nil, nil)
+	if ctx.FrameEnd != 10 {
+		t.Fatalf("expected FrameEnd to be normalized to Frame, got %d", ctx.FrameEnd)
+	}
+}
+
+func TestContext_GetOutputFormat_Default(t *testing.T) {
+	ctx := &Context{}
+	if got := ctx.GetOutputFormat(); got != "EXR" {
+		t.Fatalf("GetOutputFormat() = %q, want EXR", got)
+	}
+}
+
+func TestContext_ShouldForceCPU(t *testing.T) {
+	ctx := &Context{ForceCPURendering: true}
+	if !ctx.ShouldForceCPU() {
+		t.Fatal("expected force cpu when runner-level flag is set")
+	}
+
+	force := true
+	ctx = &Context{Metadata: &types.BlendMetadata{RenderSettings: types.RenderSettings{EngineSettings: map[string]interface{}{"force_cpu": force}}}}
+	if !ctx.ShouldForceCPU() {
+		t.Fatal("expected force cpu when metadata requests it")
+	}
+}
+
+func TestErrJobCancelled_IsSentinel(t *testing.T) {
+	if !errors.Is(ErrJobCancelled, ErrJobCancelled) {
+		t.Fatal("sentinel error should be self-identical")
+	}
+}
+

internal/runner/tasks/render.go

@@ -12,6 +12,7 @@ import (
 	"strings"
 
 	"jiggablend/internal/runner/blender"
+	"jiggablend/internal/runner/sandbox"
 	"jiggablend/internal/runner/workspace"
 	"jiggablend/pkg/scripts"
 	"jiggablend/pkg/types"
@@ -25,6 +26,38 @@ func NewRenderProcessor() *RenderProcessor {
 	return &RenderProcessor{}
 }
 
+// gpuErrorSubstrings are log line substrings that indicate a GPU backend error (matched case-insensitively); any match triggers full GPU lockout.
+var gpuErrorSubstrings = []string{
+	"illegal address in hip", // HIP (AMD) e.g. "Illegal address in HIP" or "Illegal address in hip"
+	"memory access fault",    // AMDGPU page fault during HIP/HIPRT (not necessarily OOM)
+	"page not present",       // AMDGPU GCVM page fault detail
+	"hiperror",               // hipError* codes
+	"hip error",
+	"cuda error",
+	"cuerror",
+	"optix error",
+	"oneapi error",
+	"opencl error",
+}
+
+// checkGPUErrorLine checks a log line for GPU error indicators and triggers runner GPU lockout if found.
+// Once lockout is already active for this attempt (or was active at context creation), further
+// matching lines are ignored so we do not spam lockout callbacks/logs on multi-line fault dumps.
+func (p *RenderProcessor) checkGPUErrorLine(ctx *Context, line string) {
+	if ctx.GPULockedOut || ctx.GPULockoutArmedThisAttempt {
+		return
+	}
+	lower := strings.ToLower(line)
+	for _, sub := range gpuErrorSubstrings {
+		if strings.Contains(lower, sub) {
+			if ctx.OnGPUError != nil {
+				ctx.OnGPUError()
+			}
+			return
+		}
+	}
+}
+
 // Process executes a render task.
 func (p *RenderProcessor) Process(ctx *Context) error {
 	if err := ctx.CheckCancelled(); err != nil {
@@ -47,21 +80,24 @@ func (p *RenderProcessor) Process(ctx *Context) error {
 		return fmt.Errorf("failed to find blend file: %w", err)
 	}
 
-	// Get Blender binary
-	blenderBinary := "blender"
-	if version := ctx.GetBlenderVersion(); version != "" {
-		ctx.Info(fmt.Sprintf("Job requires Blender %s", version))
-		binaryPath, err := ctx.Blender.GetBinaryPath(version)
-		if err != nil {
-			ctx.Warn(fmt.Sprintf("Could not get Blender %s, using system blender: %v", version, err))
-		} else {
-			blenderBinary = binaryPath
-			ctx.Info(fmt.Sprintf("Using Blender binary: %s", blenderBinary))
-		}
-	} else {
-		ctx.Info("No Blender version specified, using system blender")
+	// Runners must use manager-provided Blender versions; never fall back to system blender.
+	version := ctx.GetBlenderVersion()
+	if version == "" {
+		return fmt.Errorf("job metadata missing blender_version: runner cannot use system blender")
 	}
 
+	ctx.Info(fmt.Sprintf("Job requires Blender %s", version))
+	binaryPath, err := ctx.Blender.GetBinaryPath(version)
+	if err != nil {
+		return fmt.Errorf("failed to get Blender %s from manager: %w", version, err)
+	}
+
+	blenderBinary, err := blender.ResolveBinaryPath(binaryPath)
+	if err != nil {
+		return fmt.Errorf("failed to resolve Blender %s binary: %w", version, err)
+	}
+	ctx.Info(fmt.Sprintf("Using Blender binary: %s", blenderBinary))
+
 	// Create output directory
 	outputDir := filepath.Join(ctx.WorkDir, "output")
 	if err := os.MkdirAll(outputDir, 0755); err != nil {
@@ -77,9 +113,23 @@ func (p *RenderProcessor) Process(ctx *Context) error {
 	// We always render EXR (linear) for VFX accuracy; job output_format is the deliverable (EXR sequence or video).
 	renderFormat := "EXR"
 
-	// Create render script
-	if err := p.createRenderScript(ctx, renderFormat); err != nil {
-		return err
+	if ctx.ShouldForceCPU() {
+		if ctx.ForceCPURendering {
+			ctx.Info("Runner compatibility flag is enabled: forcing CPU rendering for this job")
+		} else if ctx.GPUDetectionFailed {
+			ctx.Info("GPU backend detection failed at startup—we could not determine available GPU backends, so rendering will use CPU to avoid compatibility issues")
+		} else {
+			ctx.Info("GPU lockout active: using CPU rendering only")
+		}
+	} else if ctx.ShouldDisableRT() {
+		ctx.Info("GPU ray tracing acceleration disabled for this job (--disable-rt)")
+	}
+	if ctx.ShouldBatchGPUSamples() {
+		total := ctx.GetCyclesSamples()
+		ctx.Info(fmt.Sprintf(
+			"gfx115x HIP sample batching: rendering %d samples in passes of %d (ROCm driver limit, not system RAM)",
+			total, ctx.HipGPUSampleBatch,
+		))
 	}
 
 	// Render
@@ -88,7 +138,7 @@ func (p *RenderProcessor) Process(ctx *Context) error {
 	} else {
 		ctx.Info(fmt.Sprintf("Starting Blender render for frame %d...", ctx.Frame))
 	}
-	if err := p.runBlender(ctx, blenderBinary, blendFile, outputDir, renderFormat, blenderHome); err != nil {
+	if err := p.renderFrames(ctx, blenderBinary, blendFile, outputDir, renderFormat, blenderHome); err != nil {
 		if errors.Is(err, ErrJobCancelled) {
 			ctx.Warn("Render stopped because job was cancelled")
 			return err
@@ -111,7 +161,84 @@ func (p *RenderProcessor) Process(ctx *Context) error {
 	return nil
 }
 
-func (p *RenderProcessor) createRenderScript(ctx *Context, renderFormat string) error {
+type renderPassOptions struct {
+	samplesOverride *int
+	seedOverride    *int
+}
+
+func (p *RenderProcessor) renderFrames(ctx *Context, blenderBinary, blendFile, outputDir, renderFormat, blenderHome string) error {
+	if !ctx.ShouldBatchGPUSamples() {
+		if err := p.createRenderScript(ctx, renderFormat, nil); err != nil {
+			return err
+		}
+		return p.runBlender(ctx, blenderBinary, blendFile, outputDir, renderFormat, blenderHome)
+	}
+
+	totalSamples := ctx.GetCyclesSamples()
+	batchSize := ctx.HipGPUSampleBatch
+	baseSeed := ctx.GetCyclesSeed()
+	batchDir := filepath.Join(ctx.WorkDir, "sample_batches")
+	if err := os.MkdirAll(batchDir, 0755); err != nil {
+		return fmt.Errorf("failed to create sample batch directory: %w", err)
+	}
+
+	var batchOutputs []string
+	remaining := totalSamples
+	batchNum := 0
+	for remaining > 0 {
+		if err := ctx.CheckCancelled(); err != nil {
+			return err
+		}
+		passSamples := batchSize
+		if remaining < passSamples {
+			passSamples = remaining
+		}
+		seed := baseSeed + batchNum
+		batchNum++
+		ctx.Info(fmt.Sprintf("GPU sample batch %d: %d samples (seed %d, %d remaining)", batchNum, passSamples, seed, remaining-passSamples))
+
+		passOutput := filepath.Join(batchDir, fmt.Sprintf("batch_%03d", batchNum))
+		if err := os.MkdirAll(passOutput, 0755); err != nil {
+			return err
+		}
+		opts := &renderPassOptions{
+			samplesOverride: &passSamples,
+			seedOverride:    &seed,
+		}
+		if err := p.createRenderScript(ctx, renderFormat, opts); err != nil {
+			return err
+		}
+		if err := p.runBlender(ctx, blenderBinary, blendFile, passOutput, renderFormat, blenderHome); err != nil {
+			return err
+		}
+		if err := p.verifyOutputRange(ctx, passOutput, renderFormat); err != nil {
+			return err
+		}
+		batchOutputs = append(batchOutputs, p.firstFrameOutputPath(ctx, passOutput, renderFormat))
+		remaining -= passSamples
+	}
+
+	if err := os.MkdirAll(outputDir, 0755); err != nil {
+		return err
+	}
+	finalOutput := p.firstFrameOutputPath(ctx, outputDir, renderFormat)
+	ctx.Info(fmt.Sprintf("Merging %d GPU sample batches into final EXR...", len(batchOutputs)))
+	if err := mergeEXRFiles(finalOutput, batchOutputs); err != nil {
+		return err
+	}
+	ctx.Info("GPU sample batch merge completed")
+	return nil
+}
+
+func (p *RenderProcessor) firstFrameOutputPath(ctx *Context, outputDir, renderFormat string) string {
+	ext := strings.ToLower(renderFormat)
+	if ctx.FrameEnd > ctx.Frame {
+		return filepath.Join(outputDir, fmt.Sprintf("frame_%04d.%s", ctx.Frame, ext))
+	}
+	return filepath.Join(outputDir, fmt.Sprintf("frame_%04d.%s", ctx.Frame, ext))
+}
+
+func (p *RenderProcessor) createRenderScript(ctx *Context, renderFormat string, opts *renderPassOptions) error {
 	formatFilePath := filepath.Join(ctx.WorkDir, "output_format.txt")
 	renderSettingsFilePath := filepath.Join(ctx.WorkDir, "render_settings.json")
 
@@ -121,7 +248,9 @@ func (p *RenderProcessor) createRenderScript(ctx *Context, renderFormat string)
 		unhideCode = scripts.UnhideObjects
 	}
 
-	// Load template and replace placeholders
+	// Load template and replace placeholders.
+	// Job-bundled blender_addons/ always auto-install when present (users ship addons with scenes).
+	// enable_execution only controls Blender --enable-autoexec (scripts inside .blend).
 	scriptContent := scripts.RenderBlenderTemplate
 	scriptContent = strings.ReplaceAll(scriptContent, "{{UNHIDE_CODE}}", unhideCode)
 	scriptContent = strings.ReplaceAll(scriptContent, "{{FORMAT_FILE_PATH}}", fmt.Sprintf("%q", formatFilePath))
@@ -142,23 +271,80 @@ func (p *RenderProcessor) createRenderScript(ctx *Context, renderFormat string)
 		return errors.New(errMsg)
 	}
 
-	// Write render settings if available
+	// Write render settings: merge job metadata with runner force_cpu (GPU lockout)
+	var settingsMap map[string]interface{}
 	if ctx.Metadata != nil && ctx.Metadata.RenderSettings.EngineSettings != nil {
-		settingsJSON, err := json.Marshal(ctx.Metadata.RenderSettings)
+		raw, err := json.Marshal(ctx.Metadata.RenderSettings)
 		if err == nil {
-			if err := os.WriteFile(renderSettingsFilePath, settingsJSON, 0644); err != nil {
-				ctx.Warn(fmt.Sprintf("Failed to write render settings file: %v", err))
-			}
+			_ = json.Unmarshal(raw, &settingsMap)
+		}
+	}
+	if settingsMap == nil {
+		settingsMap = make(map[string]interface{})
+	}
+	settingsMap["force_cpu"] = ctx.ShouldForceCPU()
+	settingsMap["disable_rt"] = ctx.ShouldDisableRT()
+	if ctx.ShouldBatchGPUSamples() {
+		// gfx115x: large tiles trigger AMDGPU page faults during HIP renders.
+		settingsMap["tile_size_override"] = 256
+		settingsMap["use_auto_tile_override"] = true
+	}
+	if opts != nil {
+		if opts.samplesOverride != nil {
+			settingsMap["samples_override"] = *opts.samplesOverride
+		}
+		if opts.seedOverride != nil {
+			settingsMap["seed_override"] = *opts.seedOverride
+		}
+	}
+	settingsJSON, err := json.Marshal(settingsMap)
+	if err == nil {
+		if err := os.WriteFile(renderSettingsFilePath, settingsJSON, 0644); err != nil {
+			ctx.Warn(fmt.Sprintf("Failed to write render settings file: %v", err))
 		}
 	}
 
 	return nil
 }
 
+// wrapBlenderCmd builds the Blender *exec.Cmd, optionally through the sandbox wrapper.
+func wrapBlenderCmd(ctx *Context, blenderBinary string, args, env []string, blenderHome string) (*exec.Cmd, error) {
+	sb := ctx.Sandbox
+	if sb == nil {
+		var err error
+		sb, err = sandbox.New(sandbox.Options{Backend: sandbox.BackendNone})
+		if err != nil {
+			return nil, err
+		}
+	}
+	if sb.Name() != sandbox.BackendNone {
+		ctx.Info(fmt.Sprintf("Running Blender under sandbox backend %q", sb.Name()))
+	}
+	return sb.Wrap(sandbox.Spec{
+		BlenderBinary: blenderBinary,
+		Args:          args,
+		WorkDir:       ctx.WorkDir,
+		HomeDir:       blenderHome,
+		Env:           env,
+		HasAMD:        ctx.HasAMD,
+		HasNVIDIA:     ctx.HasNVIDIA,
+		HasIntel:      ctx.HasIntel,
+		ForceCPU:      ctx.ShouldForceCPU(),
+	})
+}
+
 func (p *RenderProcessor) runBlender(ctx *Context, blenderBinary, blendFile, outputDir, renderFormat, blenderHome string) error {
 	scriptPath := filepath.Join(ctx.WorkDir, "enable_gpu.py")
+	blendFileAbs, err := filepath.Abs(blendFile)
+	if err != nil {
+		return fmt.Errorf("failed to resolve blend file path: %w", err)
+	}
+	scriptPathAbs, err := filepath.Abs(scriptPath)
+	if err != nil {
+		return fmt.Errorf("failed to resolve blender script path: %w", err)
+	}
 
-	args := []string{"-b", blendFile, "--python", scriptPath}
+	args := []string{"-b", blendFileAbs, "--python", scriptPathAbs}
 	if ctx.ShouldEnableExecution() {
 		args = append(args, "--enable-autoexec")
 	}
@@ -175,15 +361,9 @@ func (p *RenderProcessor) runBlender(ctx *Context, blenderBinary, blendFile, out
 		args = append(args, "-f", fmt.Sprintf("%d", ctx.Frame))
 	}
 
-	// Wrap with xvfb-run
-	xvfbArgs := []string{"-a", "-s", "-screen 0 800x600x24", blenderBinary}
-	xvfbArgs = append(xvfbArgs, args...)
-	cmd := exec.Command("xvfb-run", xvfbArgs...)
-	cmd.Dir = ctx.WorkDir
-
-	// Set up environment with custom HOME directory
+	// Set up environment: LD_LIBRARY_PATH for tarball Blender, then custom HOME
 	env := os.Environ()
-	// Remove existing HOME if present and add our custom one
+	env = blender.TarballEnv(blenderBinary, env)
 	newEnv := make([]string, 0, len(env)+1)
 	for _, e := range env {
 		if !strings.HasPrefix(e, "HOME=") {
@@ -191,7 +371,11 @@ func (p *RenderProcessor) runBlender(ctx *Context, blenderBinary, blendFile, out
 		}
 	}
 	newEnv = append(newEnv, fmt.Sprintf("HOME=%s", blenderHome))
-	cmd.Env = newEnv
+
+	cmd, err := wrapBlenderCmd(ctx, blenderBinary, args, newEnv, blenderHome)
+	if err != nil {
+		return fmt.Errorf("failed to build sandboxed blender command: %w", err)
+	}
 
 	// Set up pipes
 	stdoutPipe, err := cmd.StdoutPipe()
@@ -214,7 +398,7 @@ func (p *RenderProcessor) runBlender(ctx *Context, blenderBinary, blendFile, out
 	ctx.Processes.Track(ctx.TaskID, cmd)
 	defer ctx.Processes.Untrack(ctx.TaskID)
 
-	// Stream stdout
+	// Stream stdout and watch for GPU error lines (lock out all GPU on any backend error)
 	stdoutDone := make(chan bool)
 	go func() {
 		defer close(stdoutDone)
@@ -222,15 +406,19 @@ func (p *RenderProcessor) runBlender(ctx *Context, blenderBinary, blendFile, out
 		for scanner.Scan() {
 			line := scanner.Text()
 			if line != "" {
+				p.checkGPUErrorLine(ctx, line)
 				shouldFilter, logLevel := blender.FilterLog(line)
 				if !shouldFilter {
 					ctx.Log(logLevel, line)
 				}
 			}
 		}
+		if err := scanner.Err(); err != nil {
+			log.Printf("Error reading stdout: %v", err)
+		}
 	}()
 
-	// Stream stderr
+	// Stream stderr and watch for GPU error lines
 	stderrDone := make(chan bool)
 	go func() {
 		defer close(stderrDone)
@@ -238,6 +426,7 @@ func (p *RenderProcessor) runBlender(ctx *Context, blenderBinary, blendFile, out
 		for scanner.Scan() {
 			line := scanner.Text()
 			if line != "" {
+				p.checkGPUErrorLine(ctx, line)
 				shouldFilter, logLevel := blender.FilterLog(line)
 				if !shouldFilter {
 					if logLevel == types.LogLevelInfo {
@@ -247,6 +436,9 @@ func (p *RenderProcessor) runBlender(ctx *Context, blenderBinary, blendFile, out
 				}
 			}
 		}
+		if err := scanner.Err(); err != nil {
+			log.Printf("Error reading stderr: %v", err)
+		}
 	}()
 
 	// Wait for completion

internal/runner/tasks/render_test.go

@@ -0,0 +1,57 @@
+package tasks
+
+import "testing"
+
+func TestCheckGPUErrorLine_TriggersCallback(t *testing.T) {
+	p := NewRenderProcessor()
+	triggered := 0
+	ctx := &Context{
+		OnGPUError: func() {
+			triggered++
+			// Simulate runner arming lockout for this attempt.
+		},
+	}
+	p.checkGPUErrorLine(ctx, "Fatal: Illegal address in HIP kernel execution")
+	if triggered != 1 {
+		t.Fatalf("expected GPU error callback once, got %d", triggered)
+	}
+	// After arming, further fault lines must not re-fire (spam protection).
+	ctx.GPULockoutArmedThisAttempt = true
+	p.checkGPUErrorLine(ctx, "page not present in GPU memory")
+	if triggered != 1 {
+		t.Fatalf("expected no further callbacks after arm, got %d", triggered)
+	}
+}
+
+func TestCheckGPUErrorLine_SkipsWhenAlreadyLockedOut(t *testing.T) {
+	p := NewRenderProcessor()
+	triggered := false
+	ctx := &Context{
+		GPULockedOut: true,
+		OnGPUError:   func() { triggered = true },
+	}
+	p.checkGPUErrorLine(ctx, "Illegal address in HIP")
+	if triggered {
+		t.Fatal("did not expect callback when GPU already locked out")
+	}
+}
+
+func TestGetBlenderVersion_EmptyWhenMissing(t *testing.T) {
+	ctx := &Context{}
+	if got := ctx.GetBlenderVersion(); got != "" {
+		t.Fatalf("expected empty blender version, got %q", got)
+	}
+}
+
+func TestCheckGPUErrorLine_IgnoresNormalLine(t *testing.T) {
+	p := NewRenderProcessor()
+	triggered := false
+	ctx := &Context{
+		OnGPUError: func() { triggered = true },
+	}
+	p.checkGPUErrorLine(ctx, "Render completed successfully")
+	if triggered {
+		t.Fatal("did not expect GPU callback for normal line")
+	}
+}
+

internal/runner/workspace/archive.go

@@ -99,6 +99,11 @@ func ExtractTarStripPrefix(reader io.Reader, destDir string) error {
 
 		targetPath := filepath.Join(destDir, name)
 
+		// Sanitize path to prevent directory traversal
+		if !strings.HasPrefix(filepath.Clean(targetPath), filepath.Clean(destDir)+string(os.PathSeparator)) {
+			return fmt.Errorf("invalid file path in tar: %s", header.Name)
+		}
+
 		switch header.Typeflag {
 		case tar.TypeDir:
 			if err := os.MkdirAll(targetPath, os.FileMode(header.Mode)); err != nil {
@@ -123,6 +128,20 @@ func ExtractTarStripPrefix(reader io.Reader, destDir string) error {
 			if err := os.MkdirAll(filepath.Dir(targetPath), 0755); err != nil {
 				return err
 			}
+			// Reject absolute or escaping symlink targets so extraction cannot
+			// plant links that point outside destDir.
+			linkTarget := header.Linkname
+			if linkTarget == "" {
+				return fmt.Errorf("invalid empty symlink target in tar: %s", header.Name)
+			}
+			if filepath.IsAbs(linkTarget) {
+				return fmt.Errorf("absolute symlink target not allowed in tar: %s -> %s", header.Name, linkTarget)
+			}
+			resolvedLink := filepath.Clean(filepath.Join(filepath.Dir(targetPath), linkTarget))
+			cleanDest := filepath.Clean(destDir)
+			if resolvedLink != cleanDest && !strings.HasPrefix(resolvedLink, cleanDest+string(os.PathSeparator)) {
+				return fmt.Errorf("symlink target escapes extract root: %s -> %s", header.Name, linkTarget)
+			}
 			os.Remove(targetPath) // Remove existing symlink if present
 			if err := os.Symlink(header.Linkname, targetPath); err != nil {
 				return err

internal/runner/workspace/archive_test.go

@@ -0,0 +1,144 @@
+package workspace
+
+import (
+	"archive/tar"
+	"bytes"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func createTarBuffer(files map[string]string) *bytes.Buffer {
+	var buf bytes.Buffer
+	tw := tar.NewWriter(&buf)
+	for name, content := range files {
+		hdr := &tar.Header{
+			Name: name,
+			Mode: 0644,
+			Size: int64(len(content)),
+		}
+		tw.WriteHeader(hdr)
+		tw.Write([]byte(content))
+	}
+	tw.Close()
+	return &buf
+}
+
+func TestExtractTarStripPrefix_RejectsEscapingSymlink(t *testing.T) {
+	destDir := t.TempDir()
+	var buf bytes.Buffer
+	tw := tar.NewWriter(&buf)
+	// Top-level prefix like Blender archives
+	_ = tw.WriteHeader(&tar.Header{Name: "blender-x/", Typeflag: tar.TypeDir, Mode: 0755})
+	_ = tw.WriteHeader(&tar.Header{
+		Name:     "blender-x/evil",
+		Typeflag: tar.TypeSymlink,
+		Linkname: "../../outside",
+		Mode:     0777,
+	})
+	_ = tw.Close()
+
+	if err := ExtractTarStripPrefix(&buf, destDir); err == nil {
+		t.Fatal("expected escaping symlink to be rejected")
+	}
+}
+
+func TestExtractTar(t *testing.T) {
+	destDir := t.TempDir()
+
+	buf := createTarBuffer(map[string]string{
+		"hello.txt": "world",
+		"sub/a.txt": "nested",
+	})
+
+	if err := ExtractTar(buf, destDir); err != nil {
+		t.Fatalf("ExtractTar: %v", err)
+	}
+
+	data, err := os.ReadFile(filepath.Join(destDir, "hello.txt"))
+	if err != nil {
+		t.Fatalf("read hello.txt: %v", err)
+	}
+	if string(data) != "world" {
+		t.Errorf("hello.txt = %q, want %q", data, "world")
+	}
+
+	data, err = os.ReadFile(filepath.Join(destDir, "sub", "a.txt"))
+	if err != nil {
+		t.Fatalf("read sub/a.txt: %v", err)
+	}
+	if string(data) != "nested" {
+		t.Errorf("sub/a.txt = %q, want %q", data, "nested")
+	}
+}
+
+func TestExtractTarStripPrefix(t *testing.T) {
+	destDir := t.TempDir()
+
+	buf := createTarBuffer(map[string]string{
+		"toplevel/":        "",
+		"toplevel/foo.txt": "bar",
+	})
+
+	if err := ExtractTarStripPrefix(buf, destDir); err != nil {
+		t.Fatalf("ExtractTarStripPrefix: %v", err)
+	}
+
+	data, err := os.ReadFile(filepath.Join(destDir, "foo.txt"))
+	if err != nil {
+		t.Fatalf("read foo.txt: %v", err)
+	}
+	if string(data) != "bar" {
+		t.Errorf("foo.txt = %q, want %q", data, "bar")
+	}
+}
+
+func TestExtractTarStripPrefix_PathTraversal(t *testing.T) {
+	destDir := t.TempDir()
+
+	buf := createTarBuffer(map[string]string{
+		"prefix/../../../etc/passwd": "pwned",
+	})
+
+	err := ExtractTarStripPrefix(buf, destDir)
+	if err == nil {
+		t.Fatal("expected error for path traversal, got nil")
+	}
+}
+
+func TestExtractTar_PathTraversal(t *testing.T) {
+	destDir := t.TempDir()
+
+	buf := createTarBuffer(map[string]string{
+		"../../../etc/passwd": "pwned",
+	})
+
+	err := ExtractTar(buf, destDir)
+	if err == nil {
+		t.Fatal("expected error for path traversal, got nil")
+	}
+}
+
+func TestExtractTarFile(t *testing.T) {
+	destDir := t.TempDir()
+	tarPath := filepath.Join(t.TempDir(), "archive.tar")
+
+	buf := createTarBuffer(map[string]string{
+		"hello.txt": "world",
+	})
+	if err := os.WriteFile(tarPath, buf.Bytes(), 0644); err != nil {
+		t.Fatalf("write tar file: %v", err)
+	}
+
+	if err := ExtractTarFile(tarPath, destDir); err != nil {
+		t.Fatalf("ExtractTarFile: %v", err)
+	}
+
+	got, err := os.ReadFile(filepath.Join(destDir, "hello.txt"))
+	if err != nil {
+		t.Fatalf("read extracted file: %v", err)
+	}
+	if string(got) != "world" {
+		t.Fatalf("unexpected file content: %q", got)
+	}
+}

internal/runner/workspace/workspace_test.go

@@ -0,0 +1,40 @@
+package workspace
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestSanitizeName_ReplacesUnsafeChars(t *testing.T) {
+	got := sanitizeName("runner / with\\bad:chars")
+	if strings.ContainsAny(got, " /\\:") {
+		t.Fatalf("sanitizeName did not sanitize input: %q", got)
+	}
+}
+
+func TestFindBlendFiles_IgnoresBlendSaveFiles(t *testing.T) {
+	dir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(dir, "scene.blend"), []byte("x"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "scene.blend1"), []byte("x"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	files, err := FindBlendFiles(dir)
+	if err != nil {
+		t.Fatalf("FindBlendFiles failed: %v", err)
+	}
+	if len(files) != 1 || files[0] != "scene.blend" {
+		t.Fatalf("unexpected files: %#v", files)
+	}
+}
+
+func TestFindFirstBlendFile_ReturnsErrorWhenMissing(t *testing.T) {
+	_, err := FindFirstBlendFile(t.TempDir())
+	if err == nil {
+		t.Fatal("expected error when no blend file exists")
+	}
+}
+

internal/storage/storage.go

@@ -80,8 +80,55 @@ func (s *Storage) JobPath(jobID int64) string {
 	return filepath.Join(s.basePath, "jobs", fmt.Sprintf("%d", jobID))
 }
 
+// SanitizeFilename returns a safe basename for client-supplied names.
+// Rejects empty, ".", "..", and root-like basenames.
+func SanitizeFilename(name string) (string, error) {
+	cleaned := filepath.Clean(strings.ReplaceAll(name, "\\", "/"))
+	base := filepath.Base(cleaned)
+	// filepath.Base("..") is ".." ; Clean("/../..") style inputs can yield "/" or "."
+	if base == "" || base == "." || base == ".." || base == "/" || base == string(os.PathSeparator) {
+		return "", fmt.Errorf("invalid filename: %q", name)
+	}
+	// Reject if the cleaned path still has parent references after basenaming was skipped
+	if strings.Contains(cleaned, "..") && base == cleaned {
+		return "", fmt.Errorf("invalid filename: %q", name)
+	}
+	return base, nil
+}
+
+// SafePathUnderRoot joins root and a relative path and ensures the result stays under root.
+func SafePathUnderRoot(root, rel string) (string, error) {
+	if rel == "" {
+		return "", fmt.Errorf("empty path")
+	}
+	// Normalize to forward slashes then clean
+	rel = filepath.ToSlash(rel)
+	if filepath.IsAbs(rel) || strings.HasPrefix(rel, "/") {
+		return "", fmt.Errorf("absolute path not allowed: %q", rel)
+	}
+	cleanRel := filepath.Clean(rel)
+	if cleanRel == ".." || strings.HasPrefix(cleanRel, ".."+string(os.PathSeparator)) {
+		return "", fmt.Errorf("path escapes root: %q", rel)
+	}
+	cleanRoot := filepath.Clean(root)
+	full := filepath.Join(cleanRoot, cleanRel)
+	cleanFull := filepath.Clean(full)
+	sep := string(os.PathSeparator)
+	if cleanFull != cleanRoot && !strings.HasPrefix(cleanFull, cleanRoot+sep) {
+		return "", fmt.Errorf("path escapes root: %q", rel)
+	}
+	return cleanFull, nil
+}
+
 // SaveUpload saves an uploaded file
 func (s *Storage) SaveUpload(jobID int64, filename string, reader io.Reader) (string, error) {
+	// Sanitize filename to prevent path traversal
+	var err error
+	filename, err = SanitizeFilename(filename)
+	if err != nil {
+		return "", err
+	}
+
 	jobPath := s.JobPath(jobID)
 	if err := os.MkdirAll(jobPath, 0755); err != nil {
 		return "", fmt.Errorf("failed to create job directory: %w", err)
@@ -103,12 +150,26 @@ func (s *Storage) SaveUpload(jobID int64, filename string, reader io.Reader) (st
 
 // SaveOutput saves an output file
 func (s *Storage) SaveOutput(jobID int64, filename string, reader io.Reader) (string, error) {
+	// Sanitize filename to prevent path traversal (parity with SaveUpload)
+	var err error
+	filename, err = SanitizeFilename(filename)
+	if err != nil {
+		return "", err
+	}
+
 	outputPath := filepath.Join(s.outputsPath(), fmt.Sprintf("%d", jobID))
 	if err := os.MkdirAll(outputPath, 0755); err != nil {
 		return "", fmt.Errorf("failed to create output directory: %w", err)
 	}
 
 	filePath := filepath.Join(outputPath, filename)
+	// Defense in depth: ensure resolved path stays under output dir
+	if resolved, err := SafePathUnderRoot(outputPath, filename); err != nil {
+		return "", err
+	} else {
+		filePath = resolved
+	}
+
 	file, err := os.Create(filePath)
 	if err != nil {
 		return "", fmt.Errorf("failed to create file: %w", err)

internal/storage/storage_test.go

@@ -0,0 +1,140 @@
+package storage
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func setupStorage(t *testing.T) *Storage {
+	t.Helper()
+	dir := t.TempDir()
+	s, err := NewStorage(dir)
+	if err != nil {
+		t.Fatalf("NewStorage: %v", err)
+	}
+	return s
+}
+
+func TestSaveUpload(t *testing.T) {
+	s := setupStorage(t)
+	path, err := s.SaveUpload(1, "test.blend", strings.NewReader("data"))
+	if err != nil {
+		t.Fatalf("SaveUpload: %v", err)
+	}
+
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("read saved file: %v", err)
+	}
+	if string(data) != "data" {
+		t.Errorf("got %q, want %q", data, "data")
+	}
+}
+
+func TestSaveUpload_PathTraversal(t *testing.T) {
+	s := setupStorage(t)
+	path, err := s.SaveUpload(1, "../../etc/passwd", strings.NewReader("evil"))
+	if err != nil {
+		t.Fatalf("SaveUpload: %v", err)
+	}
+
+	// filepath.Base strips traversal, so the file should be inside the job dir
+	if !strings.HasPrefix(path, s.JobPath(1)) {
+		t.Errorf("saved file %q escaped job directory %q", path, s.JobPath(1))
+	}
+
+	if filepath.Base(path) != "passwd" {
+		t.Errorf("expected basename 'passwd', got %q", filepath.Base(path))
+	}
+}
+
+func TestSaveOutput(t *testing.T) {
+	s := setupStorage(t)
+	path, err := s.SaveOutput(42, "output.png", strings.NewReader("img"))
+	if err != nil {
+		t.Fatalf("SaveOutput: %v", err)
+	}
+
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("read saved output: %v", err)
+	}
+	if string(data) != "img" {
+		t.Errorf("got %q, want %q", data, "img")
+	}
+}
+
+func TestSaveOutput_PathTraversal(t *testing.T) {
+	s := setupStorage(t)
+	path, err := s.SaveOutput(42, "../../etc/passwd", strings.NewReader("evil"))
+	if err != nil {
+		t.Fatalf("SaveOutput: %v", err)
+	}
+	outRoot := filepath.Join(s.BasePath(), "outputs", "42")
+	if !strings.HasPrefix(path, outRoot) {
+		t.Errorf("saved file %q escaped output directory %q", path, outRoot)
+	}
+	if filepath.Base(path) != "passwd" {
+		t.Errorf("expected basename passwd, got %q", filepath.Base(path))
+	}
+}
+
+func TestSanitizeFilename(t *testing.T) {
+	got, err := SanitizeFilename("../../etc/passwd")
+	if err != nil {
+		t.Fatalf("SanitizeFilename: %v", err)
+	}
+	if got != "passwd" {
+		t.Fatalf("got %q want passwd", got)
+	}
+	if _, err := SanitizeFilename(".."); err == nil {
+		t.Fatal("expected error for ..")
+	}
+}
+
+func TestSafePathUnderRoot(t *testing.T) {
+	root := t.TempDir()
+	ok, err := SafePathUnderRoot(root, "subdir/file.blend")
+	if err != nil {
+		t.Fatalf("SafePathUnderRoot: %v", err)
+	}
+	if !strings.HasPrefix(ok, root) {
+		t.Fatalf("path %q not under root %q", ok, root)
+	}
+	if _, err := SafePathUnderRoot(root, "../escape.blend"); err == nil {
+		t.Fatal("expected escape to fail")
+	}
+	if _, err := SafePathUnderRoot(root, "/abs.blend"); err == nil {
+		t.Fatal("expected absolute path to fail")
+	}
+}
+
+func TestGetFile(t *testing.T) {
+	s := setupStorage(t)
+	savedPath, err := s.SaveUpload(1, "readme.txt", strings.NewReader("hello"))
+	if err != nil {
+		t.Fatalf("SaveUpload: %v", err)
+	}
+
+	f, err := s.GetFile(savedPath)
+	if err != nil {
+		t.Fatalf("GetFile: %v", err)
+	}
+	defer f.Close()
+
+	buf := make([]byte, 64)
+	n, _ := f.Read(buf)
+	if string(buf[:n]) != "hello" {
+		t.Errorf("got %q, want %q", string(buf[:n]), "hello")
+	}
+}
+
+func TestJobPath(t *testing.T) {
+	s := setupStorage(t)
+	path := s.JobPath(99)
+	if !strings.Contains(path, "99") {
+		t.Errorf("JobPath(99) = %q, expected to contain '99'", path)
+	}
+}

pkg/blendfile/version.go

@@ -0,0 +1,123 @@
+package blendfile
+
+import (
+	"compress/gzip"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+)
+
+// ParseVersionFromReader parses the Blender version from a reader.
+// Returns major and minor version numbers.
+//
+// Blend file header layout (12 bytes):
+//
+//	"BLENDER" (7) + pointer-size (1: '-'=64, '_'=32) + endian (1: 'v'=LE, 'V'=BE)
+//	+ version (3 digits, e.g. "402" = 4.02)
+//
+// Supports uncompressed, gzip-compressed, and zstd-compressed blend files.
+func ParseVersionFromReader(r io.ReadSeeker) (major, minor int, err error) {
+	header := make([]byte, 12)
+	n, err := r.Read(header)
+	if err != nil || n < 12 {
+		return 0, 0, fmt.Errorf("failed to read blend file header: %w", err)
+	}
+
+	if string(header[:7]) != "BLENDER" {
+		r.Seek(0, 0)
+		return parseCompressedVersion(r)
+	}
+
+	return parseVersionDigits(header[9:12])
+}
+
+// ParseVersionFromFile opens a blend file and parses the Blender version.
+func ParseVersionFromFile(blendPath string) (major, minor int, err error) {
+	file, err := os.Open(blendPath)
+	if err != nil {
+		return 0, 0, fmt.Errorf("failed to open blend file: %w", err)
+	}
+	defer file.Close()
+
+	return ParseVersionFromReader(file)
+}
+
+// VersionString returns a formatted version string like "4.2".
+func VersionString(major, minor int) string {
+	return fmt.Sprintf("%d.%d", major, minor)
+}
+
+func parseVersionDigits(versionBytes []byte) (major, minor int, err error) {
+	if len(versionBytes) != 3 {
+		return 0, 0, fmt.Errorf("expected 3 version digits, got %d", len(versionBytes))
+	}
+	fmt.Sscanf(string(versionBytes[0]), "%d", &major)
+	fmt.Sscanf(string(versionBytes[1:3]), "%d", &minor)
+	return major, minor, nil
+}
+
+func parseCompressedVersion(r io.ReadSeeker) (major, minor int, err error) {
+	magic := make([]byte, 4)
+	if _, err := r.Read(magic); err != nil {
+		return 0, 0, err
+	}
+	r.Seek(0, 0)
+
+	// gzip: 0x1f 0x8b
+	if magic[0] == 0x1f && magic[1] == 0x8b {
+		gzReader, err := gzip.NewReader(r)
+		if err != nil {
+			return 0, 0, fmt.Errorf("failed to create gzip reader: %w", err)
+		}
+		defer gzReader.Close()
+
+		header := make([]byte, 12)
+		n, err := gzReader.Read(header)
+		if err != nil || n < 12 {
+			return 0, 0, fmt.Errorf("failed to read compressed blend header: %w", err)
+		}
+		if string(header[:7]) != "BLENDER" {
+			return 0, 0, fmt.Errorf("invalid blend file format")
+		}
+		return parseVersionDigits(header[9:12])
+	}
+
+	// zstd: 0x28 0xB5 0x2F 0xFD
+	if magic[0] == 0x28 && magic[1] == 0xb5 && magic[2] == 0x2f && magic[3] == 0xfd {
+		return parseZstdVersion(r)
+	}
+
+	return 0, 0, fmt.Errorf("unknown blend file format")
+}
+
+func parseZstdVersion(r io.ReadSeeker) (major, minor int, err error) {
+	r.Seek(0, 0)
+
+	cmd := exec.Command("zstd", "-d", "-c")
+	cmd.Stdin = r
+
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		return 0, 0, fmt.Errorf("failed to create zstd stdout pipe: %w", err)
+	}
+
+	if err := cmd.Start(); err != nil {
+		return 0, 0, fmt.Errorf("failed to start zstd decompression: %w", err)
+	}
+
+	header := make([]byte, 12)
+	n, readErr := io.ReadFull(stdout, header)
+
+	cmd.Process.Kill()
+	cmd.Wait()
+
+	if readErr != nil || n < 12 {
+		return 0, 0, fmt.Errorf("failed to read zstd compressed blend header: %v", readErr)
+	}
+	if string(header[:7]) != "BLENDER" {
+		return 0, 0, fmt.Errorf("invalid blend file format in zstd archive")
+	}
+
+	return parseVersionDigits(header[9:12])
+}

pkg/blendfile/version_test.go

@@ -0,0 +1,96 @@
+package blendfile
+
+import (
+	"bytes"
+	"compress/gzip"
+	"testing"
+)
+
+func makeBlendHeader(major, minor int) []byte {
+	header := make([]byte, 12)
+	copy(header[:7], "BLENDER")
+	header[7] = '-'
+	header[8] = 'v'
+	header[9] = byte('0' + major)
+	header[10] = byte('0' + minor/10)
+	header[11] = byte('0' + minor%10)
+	return header
+}
+
+func TestParseVersionFromReader_Uncompressed(t *testing.T) {
+	tests := []struct {
+		name       string
+		major      int
+		minor      int
+		wantMajor  int
+		wantMinor  int
+	}{
+		{"Blender 4.02", 4, 2, 4, 2},
+		{"Blender 3.06", 3, 6, 3, 6},
+		{"Blender 2.79", 2, 79, 2, 79},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			header := makeBlendHeader(tt.major, tt.minor)
+			r := bytes.NewReader(header)
+
+			major, minor, err := ParseVersionFromReader(r)
+			if err != nil {
+				t.Fatalf("ParseVersionFromReader: %v", err)
+			}
+			if major != tt.wantMajor || minor != tt.wantMinor {
+				t.Errorf("got %d.%d, want %d.%d", major, minor, tt.wantMajor, tt.wantMinor)
+			}
+		})
+	}
+}
+
+func TestParseVersionFromReader_GzipCompressed(t *testing.T) {
+	header := makeBlendHeader(4, 2)
+	// Pad to ensure gzip has enough data for a full read
+	data := make([]byte, 128)
+	copy(data, header)
+
+	var buf bytes.Buffer
+	gz := gzip.NewWriter(&buf)
+	gz.Write(data)
+	gz.Close()
+
+	r := bytes.NewReader(buf.Bytes())
+	major, minor, err := ParseVersionFromReader(r)
+	if err != nil {
+		t.Fatalf("ParseVersionFromReader (gzip): %v", err)
+	}
+	if major != 4 || minor != 2 {
+		t.Errorf("got %d.%d, want 4.2", major, minor)
+	}
+}
+
+func TestParseVersionFromReader_InvalidMagic(t *testing.T) {
+	data := []byte("NOT_BLEND_DATA_HERE")
+	r := bytes.NewReader(data)
+
+	_, _, err := ParseVersionFromReader(r)
+	if err == nil {
+		t.Fatal("expected error for invalid magic, got nil")
+	}
+}
+
+func TestParseVersionFromReader_TooShort(t *testing.T) {
+	data := []byte("SHORT")
+	r := bytes.NewReader(data)
+
+	_, _, err := ParseVersionFromReader(r)
+	if err == nil {
+		t.Fatal("expected error for short data, got nil")
+	}
+}
+
+func TestVersionString(t *testing.T) {
+	got := VersionString(4, 2)
+	want := "4.2"
+	if got != want {
+		t.Errorf("VersionString(4, 2) = %q, want %q", got, want)
+	}
+}

pkg/executils/exec.go

@@ -361,6 +361,9 @@ func RunCommandWithStreaming(
 				}
 			}
 		}
+		if err := scanner.Err(); err != nil && !isBenignPipeReadError(err) {
+			logSender(taskID, types.LogLevelWarn, fmt.Sprintf("stdout read error: %v", err), stepName)
+		}
 	}()
 
 	go func() {
@@ -375,6 +378,9 @@ func RunCommandWithStreaming(
 				}
 			}
 		}
+		if err := scanner.Err(); err != nil && !isBenignPipeReadError(err) {
+			logSender(taskID, types.LogLevelWarn, fmt.Sprintf("stderr read error: %v", err), stepName)
+		}
 	}()
 
 	err = cmd.Wait()

pkg/executils/exec_test.go

@@ -4,7 +4,9 @@ import (
 	"errors"
 	"io"
 	"os"
+	"os/exec"
 	"testing"
+	"time"
 )
 
 func TestIsBenignPipeReadError(t *testing.T) {
@@ -30,3 +32,24 @@ func TestIsBenignPipeReadError(t *testing.T) {
 		})
 	}
 }
+
+func TestProcessTracker_TrackUntrack(t *testing.T) {
+	pt := NewProcessTracker()
+	cmd := exec.Command("sh", "-c", "sleep 1")
+	pt.Track(1, cmd)
+	if count := pt.Count(); count != 1 {
+		t.Fatalf("Count() = %d, want 1", count)
+	}
+	pt.Untrack(1)
+	if count := pt.Count(); count != 0 {
+		t.Fatalf("Count() = %d, want 0", count)
+	}
+}
+
+func TestRunCommandWithTimeout_TimesOut(t *testing.T) {
+	pt := NewProcessTracker()
+	_, err := RunCommandWithTimeout(200*time.Millisecond, "sh", []string{"-c", "sleep 2"}, "", nil, 99, pt)
+	if err == nil {
+		t.Fatal("expected timeout error")
+	}
+}

pkg/scripts/scripts/render_blender.py.template

@@ -12,8 +12,9 @@ try:
 except Exception as e:
     print(f"Warning: Could not make paths relative: {e}")
 
-# Auto-enable addons from blender_addons folder in context
-# Supports .zip files (installed via Blender API) and already-extracted addons
+# Auto-install addons from blender_addons/ in the job context when present.
+# Users ship scene-required addons with the upload — no admin step and no job flag.
+# (Blender --enable-autoexec is separate: controlled by enable_execution on the job.)
 blend_dir = os.path.dirname(bpy.data.filepath) if bpy.data.filepath else os.getcwd()
 addons_dir = os.path.join(blend_dir, "blender_addons")
 
@@ -171,6 +172,34 @@ if render_settings_override:
         except Exception as e:
             print(f"Warning: Could not set resolution_y: {e}")
 
+    # Runner sample batching overrides (gfx115x HIP driver workaround)
+    if current_engine.upper() == 'CYCLES':
+        cycles = scene.cycles
+        if 'samples_override' in render_settings_override:
+            try:
+                cycles.samples = int(render_settings_override['samples_override'])
+                print(f"Set Cycles.samples override = {cycles.samples}")
+            except Exception as e:
+                print(f"Warning: Could not set samples override: {e}")
+        if 'seed_override' in render_settings_override:
+            try:
+                cycles.seed = int(render_settings_override['seed_override'])
+                print(f"Set Cycles.seed override = {cycles.seed}")
+            except Exception as e:
+                print(f"Warning: Could not set seed override: {e}")
+        if 'tile_size_override' in render_settings_override:
+            try:
+                cycles.tile_size = int(render_settings_override['tile_size_override'])
+                print(f"Set Cycles.tile_size override = {cycles.tile_size}")
+            except Exception as e:
+                print(f"Warning: Could not set tile_size override: {e}")
+        if render_settings_override.get('use_auto_tile_override'):
+            try:
+                cycles.use_auto_tile = True
+                print(f"Set Cycles.use_auto_tile override = True")
+            except Exception as e:
+                print(f"Warning: Could not set use_auto_tile override: {e}")
+
 # Only override device selection if using Cycles (other engines handle GPU differently)
 if current_engine == 'CYCLES':
     # Check if CPU rendering is forced
@@ -209,9 +238,19 @@ if current_engine == 'CYCLES':
                 traceback.print_exc()
                 sys.exit(1)
 
-        # Check all devices and choose the best GPU type
-        # Device type preference order (most performant first)
-        device_type_preference = ['OPTIX', 'CUDA', 'HIP', 'ONEAPI', 'METAL']
+        # Check all devices and choose the best GPU type.
+        # Explicit fallback policy: NVIDIA -> Intel -> AMD -> CPU.
+        # (OPTIX/CUDA are NVIDIA, ONEAPI is Intel, HIP/OPENCL are AMD)
+        disable_rt = False
+        if render_settings_override:
+            disable_rt = bool(
+                render_settings_override.get('disable_rt', render_settings_override.get('disable_hiprt', False))
+            )
+        if disable_rt:
+            # Prefer non-RT backends when GPU ray tracing acceleration is disabled.
+            device_type_preference = ['CUDA', 'ONEAPI', 'HIP', 'OPENCL', 'OPTIX']
+        else:
+            device_type_preference = ['OPTIX', 'CUDA', 'ONEAPI', 'HIP', 'OPENCL']
         gpu_available = False
         best_device_type = None
         best_gpu_devices = []
@@ -317,50 +356,42 @@ if current_engine == 'CYCLES':
                     except Exception as e:
                         print(f"  Warning: Could not enable device {getattr(device, 'name', 'Unknown')}: {e}")
                 
-                # Enable ray tracing acceleration for supported device types
+                # Configure GPU ray tracing acceleration for supported device types
                 try:
-                    if best_device_type == 'HIP':
-                        # HIPRT (HIP Ray Tracing) for AMD GPUs
+                    if disable_rt:
+                        if hasattr(cycles_prefs, 'use_hiprt'):
+                            cycles_prefs.use_hiprt = False
+                        if hasattr(scene.cycles, 'use_hiprt'):
+                            scene.cycles.use_hiprt = False
+                        if hasattr(scene.cycles, 'use_optix_denoising'):
+                            scene.cycles.use_optix_denoising = False
+                        print("  GPU ray tracing acceleration disabled (--disable-rt)")
+                    elif best_device_type == 'HIP':
                         if hasattr(cycles_prefs, 'use_hiprt'):
                             cycles_prefs.use_hiprt = True
-                            print(f"  Enabled HIPRT (HIP Ray Tracing) for faster rendering")
+                            print("  Enabled HIPRT (HIP Ray Tracing) for faster rendering")
                         elif hasattr(scene.cycles, 'use_hiprt'):
                             scene.cycles.use_hiprt = True
-                            print(f"  Enabled HIPRT (HIP Ray Tracing) for faster rendering")
+                            print("  Enabled HIPRT (HIP Ray Tracing) for faster rendering")
                         else:
-                            print(f"  HIPRT not available (requires Blender 4.0+)")
+                            print("  HIPRT not available (requires Blender 4.0+)")
                     elif best_device_type == 'OPTIX':
-                        # OptiX is already enabled when using OPTIX device type
-                        # But we can check if there are any OptiX-specific settings
                         if hasattr(scene.cycles, 'use_optix_denoising'):
                             scene.cycles.use_optix_denoising = True
-                            print(f"  Enabled OptiX denoising")
-                        print(f"  OptiX ray tracing is active (using OPTIX device type)")
+                            print("  Enabled OptiX denoising")
+                        print("  OptiX ray tracing is active (using OPTIX device type)")
                     elif best_device_type == 'CUDA':
-                        # CUDA can use OptiX if available, but it's usually automatic
-                        # Check if we can prefer OptiX over CUDA
                         if hasattr(scene.cycles, 'use_optix_denoising'):
                             scene.cycles.use_optix_denoising = True
-                            print(f"  Enabled OptiX denoising (if OptiX available)")
-                        print(f"  CUDA ray tracing active")
-                    elif best_device_type == 'METAL':
-                        # MetalRT for Apple Silicon (if available)
-                        if hasattr(scene.cycles, 'use_metalrt'):
-                            scene.cycles.use_metalrt = True
-                            print(f"  Enabled MetalRT (Metal Ray Tracing) for faster rendering")
-                        elif hasattr(cycles_prefs, 'use_metalrt'):
-                            cycles_prefs.use_metalrt = True
-                            print(f"  Enabled MetalRT (Metal Ray Tracing) for faster rendering")
-                        else:
-                            print(f"  MetalRT not available")
+                            print("  Enabled OptiX denoising (if OptiX available)")
+                        print("  CUDA ray tracing active")
                     elif best_device_type == 'ONEAPI':
-                        # Intel oneAPI - Embree might be available
                         if hasattr(scene.cycles, 'use_embree'):
                             scene.cycles.use_embree = True
-                            print(f"  Enabled Embree for faster CPU ray tracing")
-                        print(f"  oneAPI ray tracing active")
+                            print("  Enabled Embree for faster CPU ray tracing")
+                        print("  oneAPI ray tracing active")
                 except Exception as e:
-                    print(f"  Could not enable ray tracing acceleration: {e}")
+                    print(f"  Could not configure ray tracing acceleration: {e}")
                 
                 print(f"SUCCESS: Enabled {enabled_count} GPU device(s) for {best_device_type}")
                 gpu_available = True

pkg/scripts/scripts_test.go

@@ -0,0 +1,19 @@
+package scripts
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestEmbeddedScripts_ArePresent(t *testing.T) {
+	if strings.TrimSpace(ExtractMetadata) == "" {
+		t.Fatal("ExtractMetadata script should not be empty")
+	}
+	if strings.TrimSpace(UnhideObjects) == "" {
+		t.Fatal("UnhideObjects script should not be empty")
+	}
+	if strings.TrimSpace(RenderBlenderTemplate) == "" {
+		t.Fatal("RenderBlenderTemplate should not be empty")
+	}
+}
+

pkg/types/types.go

@@ -137,7 +137,7 @@ type CreateJobRequest struct {
 	RenderSettings  *RenderSettings `json:"render_settings,omitempty"`   // Optional: Override blend file render settings
 	UploadSessionID *string         `json:"upload_session_id,omitempty"` // Optional: Session ID from file upload
 	UnhideObjects   *bool           `json:"unhide_objects,omitempty"`    // Optional: Enable unhide tweaks for objects/collections
-	EnableExecution *bool           `json:"enable_execution,omitempty"`  // Optional: Enable auto-execution in Blender (adds --enable-autoexec flag, defaults to false)
+	EnableExecution *bool           `json:"enable_execution,omitempty"`  // Optional: allow Python autoexec inside the .blend (--enable-autoexec). Job blender_addons/ always install when present.
 	BlenderVersion  *string         `json:"blender_version,omitempty"`   // Optional: Override Blender version (e.g., "4.2" or "4.2.3")
 }
 
@@ -231,7 +231,7 @@ type BlendMetadata struct {
 	SceneInfo         SceneInfo         `json:"scene_info"`
 	MissingFilesInfo  *MissingFilesInfo `json:"missing_files_info,omitempty"`
 	UnhideObjects     *bool             `json:"unhide_objects,omitempty"`   // Enable unhide tweaks for objects/collections
-	EnableExecution   *bool             `json:"enable_execution,omitempty"` // Enable auto-execution in Blender (adds --enable-autoexec flag, defaults to false)
+	EnableExecution   *bool             `json:"enable_execution,omitempty"` // Allow .blend Python autoexec (--enable-autoexec); separate from blender_addons/ install
 	BlenderVersion    string            `json:"blender_version,omitempty"`  // Detected or overridden Blender version (e.g., "4.2" or "4.2.3")
 }
 

pkg/types/types_test.go

@@ -0,0 +1,49 @@
+package types
+
+import (
+	"encoding/json"
+	"testing"
+	"time"
+)
+
+func TestJobJSON_RoundTrip(t *testing.T) {
+	now := time.Now().UTC().Truncate(time.Second)
+	frameStart, frameEnd := 1, 10
+	format := "PNG"
+	job := Job{
+		ID:           42,
+		UserID:       7,
+		JobType:      JobTypeRender,
+		Name:         "demo",
+		Status:       JobStatusPending,
+		Progress:     12.5,
+		FrameStart:   &frameStart,
+		FrameEnd:     &frameEnd,
+		OutputFormat: &format,
+		BlendMetadata: &BlendMetadata{
+			FrameStart: 1,
+			FrameEnd:   10,
+			RenderSettings: RenderSettings{
+				ResolutionX: 1920,
+				ResolutionY: 1080,
+				FrameRate:   24.0,
+			},
+		},
+		CreatedAt: now,
+	}
+
+	raw, err := json.Marshal(job)
+	if err != nil {
+		t.Fatalf("marshal failed: %v", err)
+	}
+
+	var out Job
+	if err := json.Unmarshal(raw, &out); err != nil {
+		t.Fatalf("unmarshal failed: %v", err)
+	}
+
+	if out.ID != job.ID || out.JobType != JobTypeRender || out.BlendMetadata == nil {
+		t.Fatalf("unexpected roundtrip result: %+v", out)
+	}
+}
+

version/version_test.go

@@ -0,0 +1,19 @@
+package version
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestInitDefaults_AreSet(t *testing.T) {
+	if Version == "" {
+		t.Fatal("Version should be initialized")
+	}
+	if Date == "" {
+		t.Fatal("Date should be initialized")
+	}
+	if !strings.Contains(Version, ".") {
+		t.Fatalf("Version should look semantic-ish, got %q", Version)
+	}
+}
+

web/embed_test.go

@@ -0,0 +1,30 @@
+package web
+
+import (
+	"net/http/httptest"
+	"testing"
+)
+
+func TestGetStaticFileSystem_NonNil(t *testing.T) {
+	fs := GetStaticFileSystem()
+	if fs == nil {
+		t.Fatal("static filesystem should not be nil")
+	}
+}
+
+func TestStaticHandler_ServesWithoutPanic(t *testing.T) {
+	h := StaticHandler()
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest("GET", "/assets/does-not-exist.txt", nil)
+	h.ServeHTTP(rr, req)
+	if rr.Code == 0 {
+		t.Fatal("handler should write a status code")
+	}
+}
+
+func TestGetTemplateFS_NonNil(t *testing.T) {
+	if GetTemplateFS() == nil {
+		t.Fatal("template fs should not be nil")
+	}
+}
+

web/static/job_new.js

@@ -21,9 +21,19 @@
   const enableExecutionInput = document.getElementById("enable-execution");
 
   let sessionID = "";
+  let detectedBlenderVersion = "";
   let pollTimer = null;
   let uploadInProgress = false;
 
+  function escapeHtml(value) {
+    return String(value ?? "")
+      .replaceAll("&", "&")
+      .replaceAll("<", "&lt;")
+      .replaceAll(">", "&gt;")
+      .replaceAll('"', "&quot;")
+      .replaceAll("'", "&#39;");
+  }
+
   function showError(msg) {
     errorEl.textContent = msg || "";
     errorEl.classList.toggle("hidden", !msg);
@@ -31,7 +41,10 @@
 
   function showStatus(msg) {
     statusEl.classList.remove("hidden");
-    statusEl.innerHTML = `<p>${msg}</p>`;
+    statusEl.replaceChildren();
+    const p = document.createElement("p");
+    p.textContent = msg || "";
+    statusEl.appendChild(p);
   }
 
   function setUploadBusy(busy) {
@@ -68,8 +81,9 @@
       outputFormatInput.value = "EXR";
     }
 
-    if (metadata.blender_version && blendVersionEl.querySelector(`option[value="${metadata.blender_version}"]`)) {
-      blendVersionEl.value = metadata.blender_version;
+    detectedBlenderVersion = metadata.blender_version || "";
+    if (detectedBlenderVersion && blendVersionEl.querySelector(`option[value="${detectedBlenderVersion}"]`)) {
+      blendVersionEl.value = detectedBlenderVersion;
     } else {
       blendVersionEl.value = "";
     }
@@ -80,12 +94,12 @@
     const scenes = metadata.scene_info || {};
     metadataPreview.innerHTML = `
       <div class="metadata-grid">
-        <div><strong>Detected file:</strong> ${status.file_name || fileName || "-"}</div>
-        <div><strong>Frames:</strong> ${metadata.frame_start ?? "-"} - ${metadata.frame_end ?? "-"}</div>
-        <div><strong>Render engine:</strong> ${render.engine || "-"}</div>
-        <div><strong>Resolution:</strong> ${render.resolution_x || "-"} x ${render.resolution_y || "-"}</div>
-        <div><strong>Frame rate:</strong> ${render.frame_rate || "-"}</div>
-        <div><strong>Objects:</strong> ${scenes.object_count ?? "-"}</div>
+        <div><strong>Detected file:</strong> ${escapeHtml(status.file_name || fileName || "-")}</div>
+        <div><strong>Frames:</strong> ${escapeHtml(metadata.frame_start ?? "-")} - ${escapeHtml(metadata.frame_end ?? "-")}</div>
+        <div><strong>Render engine:</strong> ${escapeHtml(render.engine || "-")}</div>
+        <div><strong>Resolution:</strong> ${escapeHtml(render.resolution_x || "-")} x ${escapeHtml(render.resolution_y || "-")}</div>
+        <div><strong>Frame rate:</strong> ${escapeHtml(render.frame_rate || "-")}</div>
+        <div><strong>Objects:</strong> ${escapeHtml(scenes.object_count ?? "-")}</div>
       </div>
     `;
   }
@@ -169,11 +183,28 @@
     });
     const data = await res.json().catch(() => ({}));
     if (!res.ok) {
-      throw new Error(data.error || "Job creation failed");
+      const err = new Error(data.error || "Job creation failed");
+      if (data && typeof data.code === "string") {
+        err.code = data.code;
+      }
+      throw err;
     }
     return data;
   }
 
+  function resetToUploadStep(message) {
+    sessionID = "";
+    detectedBlenderVersion = "";
+    clearInterval(pollTimer);
+    setUploadBusy(false);
+    mainBlendWrapper.classList.add("hidden");
+    metadataPreview.innerHTML = "";
+    configSection.classList.add("hidden");
+    setStep(1);
+    showStatus("Please upload the file again.");
+    showError(message);
+  }
+
   async function runSubmission(mainBlendFile) {
     showError("");
     setStep(1);
@@ -248,7 +279,7 @@
       unhide_objects: Boolean(fd.get("unhide_objects")),
       enable_execution: Boolean(fd.get("enable_execution")),
     };
-    const blenderVersion = fd.get("blender_version");
+    const blenderVersion = fd.get("blender_version") || detectedBlenderVersion;
     if (blenderVersion) payload.blender_version = blenderVersion;
 
     const job = await createJob(payload);
@@ -277,6 +308,14 @@
       showError("");
       await submitJobConfig();
     } catch (err) {
+      if (err && err.code === "UPLOAD_SESSION_EXPIRED") {
+        resetToUploadStep(err.message || "Upload session expired. Please upload the file again.");
+        return;
+      }
+      if (err && err.code === "UPLOAD_SESSION_NOT_READY") {
+        showError(err.message || "Upload session is still processing. Please wait and try again.");
+        return;
+      }
       showError(err.message || "Failed to create job");
     }
   });

web/static/job_show.js

@@ -259,13 +259,20 @@
       return;
     }
 
+    const escapeHtml = (value) => String(value ?? "")
+      .replaceAll("&", "&")
+      .replaceAll("<", "&lt;")
+      .replaceAll(">", "&gt;")
+      .replaceAll('"', "&quot;")
+      .replaceAll("'", "&#39;");
     output.innerHTML = filtered.map((entry) => {
       const level = String(entry.log_level || "INFO").toUpperCase();
-      const step = entry.step_name ? ` <span class="log-step">(${entry.step_name})</span>` : "";
-      const message = String(entry.message || "").replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+      const stepName = entry.step_name ? escapeHtml(entry.step_name) : "";
+      const step = stepName ? ` <span class="log-step">(${stepName})</span>` : "";
+      const message = escapeHtml(entry.message || "");
       return `<div class="log-line">
-        <span class="log-time">${formatTime(entry.created_at)}</span>
-        <span class="log-level ${levelClass(level)}">${level}</span>${step}
+        <span class="log-time">${escapeHtml(formatTime(entry.created_at))}</span>
+        <span class="log-level ${levelClass(level)}">${escapeHtml(level)}</span>${step}
         <span class="log-message">${message}</span>
       </div>`;
     }).join("");

web/templates/job_new.html

@@ -52,7 +52,7 @@
     </label>
     <div class="check-row">
       <label><input type="checkbox" id="unhide-objects" name="unhide_objects"> Unhide objects/collections</label>
-      <label><input type="checkbox" id="enable-execution" name="enable_execution"> Enable auto-execution in Blender</label>
+      <label><input type="checkbox" id="enable-execution" name="enable_execution" title="Allows Python drivers/scripts embedded in the .blend (--enable-autoexec). Job-bundled blender_addons/ always install automatically when present."> Allow .blend Python autoexec</label>
     </div>
     <button type="submit" class="btn primary">Create Job</button>
   </form>