[alexanderludwig]

Summary

Fixes the two findings from the review of #1201. Stacked on #1201 (base branch codex/media-dead-seller-health); merge #1201 first.

P1: existing videos stay downloadable after their model is hidden. When the health checks unadvertise a model (no credits, model retired), the seller and both video plugins refused every request for it, including downloads of jobs that had already started. The buyer lost the video and the seller was not paid, since videos are charged on download.

• Seller: a download matches its provider through the protocol table, which health checks never change. Only the job's owner gets past the existing ownership check.
• fal and Venice plugins: downloads are checked against the configured model list, not the live one.
• New jobs for a hidden model are still refused.

P2: hidden fal models come back when the key can't read the balance. With a fal key without billing permission, the account check always answered unknown, which blocked a model from ever being re-advertised after fal briefly reported it gone.

• checkUpstreamAccount may now return null, meaning the check cannot run. The model check alone then hides and restores models. A real unknown still blocks a restore.

Tests

• New: seller download routing after unadvertising (node-payment-pricing), fal and Venice download-vs-create after unadvertising, model check alone hides and restores when the account check cannot run (model-health-checker).
• Ran locally: build, typecheck, node (1364), fal (30), Venice (19), CLI (1263, 1 skipped), e2e image-video-payment-flow (8, 1 skipped live).

CHANGELOG updated.

[alexanderludwig]

@reviewant

[reviewant]

Antseed Review Summary

The PR separates video download eligibility from current model advertisement, allowing existing jobs to remain retrievable while new jobs for unhealthy models are refused. It also lets providers return null when an upstream account check cannot run, so fal model health checks can independently remove and restore advertised services. Regression tests and the changelog cover both behaviors.

• No issues found in the reviewed changes.

Confidence Score: 5/5

Safe to merge; no verified issues found.

The retrieval exception remains constrained by the service's video protocol, and the seller's ownership check still runs before upstream forwarding; both video plugins retain their configured service list while rejecting new jobs for unadvertised services. The health checker correctly excludes null account results without treating an absence of all checks as healthy. Using the provided test runner, all 1,364 node tests, 30 fal video tests, and 19 Venice video tests passed. Upstream behavior was verified through code inspection and mocked tests, not live provider accounts.

Important Files Changed

Filename	Overview
packages/node/src/health/model-health-checker.ts	Excludes unavailable account checks from combined health results and preserves an inconclusive result when no check ran.
packages/node/src/interfaces/seller-provider.ts	Documents and types the optional null account-check result consistently with its implementation.
packages/node/src/seller-request-handler.ts	Allows video retrieval to match unadvertised services while retaining protocol matching and downstream ownership enforcement.
plugins/provider-fal-video/src/index.ts	Retains configured services for existing downloads and returns null when billing checks are disabled by missing permission.
plugins/provider-venice-video/src/index.ts	Uses the configured service set for retrieval while continuing to require an advertised service for job creation.
packages/node/tests/model-health-checker.test.ts	Adds coverage for model removal and recovery when the account check returns null.
packages/node/tests/node-payment-pricing.test.ts	Checks retrieval matching after unadvertisement and rejection of new jobs and unknown services.
plugins/provider-fal-video/src/index.test.ts	Tests retrieval after unadvertisement and the updated disabled-billing-check contract.
plugins/provider-venice-video/src/index.test.ts	Tests that existing retrieval requests still reach upstream after unadvertisement while creation is refused.
CHANGELOG.md	Explains continued retrieval of existing jobs and model-only recovery when account checks cannot run.

Diagram

flowchart TD
  A[Video request] --> B{Create or retrieve}
  B -->|Create| C[Require advertised service]
  B -->|Retrieve| D[Match configured video protocol]
  D --> E[Verify buyer owns job]
  E --> F[Plugin accepts configured service]
  F --> G[Retrieve upstream status or video]
  H[Health sweep] --> I[Account and model checks]
  I --> J[Exclude null account result]
  J --> K[Remove or restore advertisement]

Loading

_{Core files read in full: packages/node/src/health/model-health-checker.ts, packages/node/src/interfaces/seller-provider.ts, packages/node/src/seller-request-handler.ts}

_{Reviews (1): Last reviewed commit: fix(media): keep existing video downloads after a model is u (7311a6a4d0) | automatic review of a new PR | Tag @reviewant with "re-review" to run again}

[reviewant]

@alexanderludwig I already reviewed this commit (7311a6a): #1264 (comment)
Push new commits, or tag me with "re-review" to run a fresh pass.