Two faults seen on a long render, plus the image-side work from the same
reports.

Caption timings never worked. The render asks for word timestamps on the
narration clip it just wrote, so it passes a NAME where the HTTP endpoint
passes an upload -- and the transcription core read `.filename` off it
unconditionally, raising `'str' object has no attribute 'filename'` on every
scene of every render. The caller caught it and fell back to estimating from
character counts, so captions drifted against the voice and nothing ever
failed. `_upload_name` now takes a path, an upload or nothing; only the
extension is read from it, so a name was always enough.

Fixing that alone would have changed nothing visible. The model the renderer
picked by default was chosen by NAME -- "whisper" first, then canary -- and
both are the two backends that cannot time words: the whisper.cpp runner
returns text with no word array, and the NeMo worker ignores the flag. The
pick now asks which backends report them (the HF pipelines, vosk,
faster-whisper), and a model that answers with none of them is named in the
job's warnings instead of silently downgrading the captions.

Polling a render cost a render. `GET /v1/video/compose/{id}` sits under the
`/v1/video/` prefix, which allows 10 requests a minute per IP, so a client
polling a four-minute render from the address it submits from spent the whole
budget on the polls and got 429 on the work. Read-only job status -- compose
and talking-head -- is now exempt from the limit, by prefix and for GET only,
so the sibling POST .../cancel stays limited. It is NOT exempt from
authentication: the document names the job's output, unlike the progress
endpoints it sits beside.

Also here, from the image-edit reports: a uniformly black or white result is
refused with the dtype named rather than answered 200, `--no-ram` no longer
coerces a configured bf16 to fp16 (same two bytes, a quarter of the range,
NaN latents, black picture), single-file and GGUF checkpoints load through the
configured loader instead of falling back to a different one, per-model LoRAs
are an identity rather than a hint, and a repository may run its own pipeline
code only from an allow-list that starts empty.

And: the measurements stay, the customer names go -- shipped images are public.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S8LAP3ueNzQJtwzhgVbq66