The point of isolation is that one bad stream can't take the node down — this makes good on it. A worker that stops producing frames (a wedged native pipeline gst can't drain) is presumed dead and killed via the cancellable command context, bounded by ingestWorkerWatchdog (30s; reset on every frame). MKVIngestIsolated then returns an error instead of hanging the session. TestMKVIngestIsolatedWedgeContained proves it with a real node-killer: sample-stream.mkv carries four audio tracks, so the single-audio pipeline leaves three matroskademux pads unlinked and wedges with no EOS. In-process that hangs (or OOMs) the node; isolated, the watchdog kills the worker and the supervisor returns "ingest worker exited: signal: killed" in seconds — with the test process (the node) still running to assert it. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>