@gobing-ai/knowledge-kit 0.0.35 → 0.0.36

package/plugins/kk/scripts/daily-stages.ts

@@ -124,6 +124,8 @@ export function dailyQcContent(args: string[]): void {
         minUrgency = '',
         minImpact = '',
         minEpisodeItems = '',
+        minMinutes = '',
+        vdriver = '',
     ] = args;
     const candidates = join(workDir, '21-plan', `${runDate}_04_quality-control-content_candidates.json`);
     const annotated = join(workDir, '21-plan', `${runDate}_04_quality-control-content_annotated.json`);
@@ -158,6 +160,7 @@ export function dailyQcContent(args: string[]): void {
                 },
             },
         );
+        applyFloorGate(candidates, workDir, runDate, minMinutes, vdriver);
     });
     // Topic boundary (task 0189 R2) runs on every invocation — re-applying to already-filtered
     // candidates is a no-op, so cached reruns stay idempotent while a crash between the candidates
@@ -208,6 +211,79 @@ export function dailyQcContent(args: string[]): void {
  * episode-plan-gen's `titleSimilarity`. Duplicated on purpose: this file is node-builtins-only
  * (no workspace imports), so it cannot reach that module.
  */
+/**
+ * The factor between a candidate's raw body characters and the characters the episode actually
+ * speaks, calibrated on the two 2026-10-11 runs: 3 thin candidates (1.8k chars) scripted to 1270
+ * spoken characters (4.0 min, failed the 15-min gate) and 7 candidates (4.3k chars) scripted to 5925
+ * (16.8 min, shipped). The agent expands the news register, so the raw count under-predicts by ~1.4x;
+ * with it, both runs land on the right side of the floor.
+ */
+const SPEAK_CHAR_EXPANSION = 1.4;
+
+/**
+ * The calibrated pre-spend estimate over a kept pool (title+body characters × the 1.4 expansion,
+ * over the driver's measured char rate, plus the 8 s intro sting) — shared by the pre-spend floor
+ * gate (applyFloorGate) and the post-spend duration refusal (dailyEpisodeDuration, 0266), so both
+ * artifacts report the same arithmetic. `seconds` is unrounded: the floor gate compares seconds.
+ */
+function estimateSpokenMinutes(docs: unknown[], vdriver: string): { minutes: number; seconds: number; chars: number } {
+    const chars = docs.reduce((sum, doc) => {
+        const entry = (doc ?? {}) as Record<string, unknown>;
+        return sum + `${String(entry.title ?? '')}`.length + String(entry.body ?? '').length;
+    }, 0);
+    const seconds = 8 + (chars * SPEAK_CHAR_EXPANSION) / spokenCharRate(vdriver);
+    return { minutes: Math.round((seconds / 60) * 10) / 10, seconds, chars };
+}
+
+/**
+ * Pre-spend floor gate (2026-10-12). `daily-episode-duration` also refuses a final episode below
+ * the floor, but it runs after the TTS spend — a thin pool would still pay for a full synthesis
+ * pass (the 04:30 tick of 2026-10-11: 3 candidates → 4.0 min episode, nothing published; since
+ * 0266 that post-spend refusal closes as no-content instead of aborting, but the spend is gone).
+ * This estimates the spoken length from the kept
+ * candidates and, when it cannot reach the floor, empties the candidate list: every downstream
+ * `pool-count --min 1` guard then skips the content, audio, publish and XHS subtrees, and the run
+ * closes through run-report and the ledger exactly like an empty pool. The estimate and its inputs
+ * land in a refusal artifact next to the candidates.
+ */
+function applyFloorGate(
+    candidates: string,
+    workDir: string,
+    runDate: string,
+    minMinutes: string,
+    vdriver: string,
+): void {
+    const floor = Number(minMinutes);
+    if (minMinutes === '' || !Number.isFinite(floor) || floor <= 0) return;
+    const content = readJson(candidates);
+    const docs = metadataOf(content).docs;
+    if (!Array.isArray(docs) || docs.length === 0) return;
+    const { minutes: estimatedMinutes, seconds: estimatedSeconds, chars } = estimateSpokenMinutes(docs, vdriver);
+    if (estimatedSeconds >= floor * 60) {
+        console.log(`floor gate: estimated ${estimatedMinutes} min from ${chars} chars — above the ${floor} min floor`);
+        return;
+    }
+    const refusal = join(workDir, '21-plan', `${runDate}_04_quality-control-content_floor-refusal.json`);
+    const ids = docs.map((doc) => String((doc as Record<string, unknown> | null)?.id ?? ''));
+    sted('write', refusal, () =>
+        writeJqText(refusal, {
+            estimatedMinutes,
+            minMinutes: floor,
+            candidateChars: chars,
+            expansion: SPEAK_CHAR_EXPANSION,
+            charRate: spokenCharRate(vdriver),
+            ids,
+            reason: `a ${docs.length}-item pool estimates ${estimatedMinutes} min of speech, below the ${floor} min floor — refusing before any TTS spend`,
+        }),
+    );
+    sted('write', candidates, () =>
+        writeJsonText(candidates, { ...(content ?? {}), metadata: { ...metadataOf(content), docs: [] } }),
+    );
+    console.error(
+        `floor gate: ${docs.length} candidates estimate ${estimatedMinutes} min < ${floor} min — candidates emptied, the run closes as no-content (see ${refusal})`,
+    );
+}
+
 export function dailyArticle(args: string[]): void {
     const [workDir = '', runDate = '', pluginsPath = ''] = args;
     const articleMd = join(workDir, '22-article', `${runDate}_06_article_article.md`);
@@ -383,9 +459,16 @@ export function dailyCoverNormalize(args: string[]): void {
  * content's `metadata.duration` — after the intro sting merged, this is the true episode length —
  * and fails loud outside `[min, max]` seconds-worth of minutes. A missing duration is a failure,
  * not a pass: the gate must never silently let an under-length episode through again.
+ *
+ * 0266 (policy (c), 2026-10-13): an under-minutes episode is a thin day, not a broken run — the
+ * gate refuses it like the pre-spend floor gate does instead of aborting before run-report/ledger:
+ * write `_11_generate_content_duration-refusal.json` beside the content, empty the candidates
+ * file (every pool-count-gated node downstream then skips) and exit 0, so the run closes as
+ * no-content with the measured vs estimated minutes recorded. Over-max still fails loud — trimming
+ * is a different problem.
  */
 export function dailyEpisodeDuration(args: string[]): void {
-    const [workDir = '', runDate = '', minArg = '', maxArg = ''] = args;
+    const [workDir = '', runDate = '', minArg = '', maxArg = '', vdriver = ''] = args;
     if (!workDir) fail('missing work_dir');
     if (!runDate) fail('missing run_date');
     const minMinutes = Number(minArg);
@@ -411,10 +494,43 @@ export function dailyEpisodeDuration(args: string[]): void {
     const minutes = seconds / 60;
     const shown = minutes.toFixed(1);
     if (minutes < minMinutes) {
-        failWith(
-            1,
-            `episode-duration: episode runs ${shown} min, below the ${minMinutes}–${maxMinutes} min requirement (duration is authoritative). The candidate pool is too thin — deepen per-item treatment or add items; do not ship a short episode silently.`,
+        const refusal = join(workDir, '30-audio', `${runDate}_11_generate_content_duration-refusal.json`);
+        const candidates = join(workDir, '21-plan', `${runDate}_04_quality-control-content_candidates.json`);
+        const content = readJson(candidates);
+        const docs = Array.isArray(metadataOf(content).docs) ? (metadataOf(content).docs as unknown[]) : [];
+        // Idempotency first: a rerun must not recompute an estimate from the already-emptied candidates.
+        // A kill between the two writes below leaves the refusal beside non-empty candidates, which would
+        // let the pool-gated publish fan package a sub-floor episode — so finish the emptying here.
+        if (isFile(refusal)) {
+            if (content !== null && docs.length > 0) {
+                sted('write', candidates, () =>
+                    writeJsonText(candidates, { ...content, metadata: { ...metadataOf(content), docs: [] } }),
+                );
+            }
+            console.log(`episode-duration: duration refusal already recorded (${refusal}) — nothing to do`);
+            return;
+        }
+        const estimated = estimateSpokenMinutes(docs, vdriver);
+        const measuredMinutes = Math.round(minutes * 10) / 10;
+        sted('write', refusal, () =>
+            writeJqText(refusal, {
+                measuredMinutes,
+                estimatedMinutes: estimated.minutes,
+                minMinutes,
+                keptCount: docs.length,
+                candidateChars: estimated.chars,
+                reason: `the episode ran ${shown} min of speech, below the ${minMinutes} min floor (pre-spend estimate ${estimated.minutes} min) — refusing after synthesis`,
+            }),
         );
+        if (content !== null) {
+            sted('write', candidates, () =>
+                writeJsonText(candidates, { ...content, metadata: { ...metadataOf(content), docs: [] } }),
+            );
+        }
+        console.error(
+            `episode-duration: episode ran ${shown} min (estimate ${estimated.minutes} min), below the ${minMinutes}–${maxMinutes} min requirement — candidates emptied, the run closes as no-content (see ${refusal})`,
+        );
+        return;
     }
     if (minutes > maxMinutes) {
         failWith(
@@ -460,6 +576,158 @@ function geminiQuotaProbeOk(workDir: string, pluginsPath: string, transcodeMp3:
     return true;
 }
 
+/** `VOICE_GEN_MP3` truthiness, matching voice-gen's own parse (`plugins/generations/voice-gen/src/mp3.ts`). */
+const MP3_TRUTHY = new Set(['1', 'true', 'yes', 'on']);
+
+/**
+ * `transcode_mp3=true` is a workflow contract, not a driver hint: the run publishes an MP3
+ * enclosure and `daily-publish-prep` refuses a WAV (0171 R2). Only voice-gen honours
+ * `VOICE_GEN_MP3`; gemini-tts and omni-voice-gen write WAV only, so `metadata.mp3Path` stayed
+ * unset for them and every publishing run died at publish-prep. Derive the sibling MP3 here —
+ * the one place that knows both the requested transcode and what the driver actually wrote —
+ * so `daily-intro` re-transcodes the intro-merged audio to the same recorded path.
+ */
+function ensurePublishMp3(contentPath: string, transcodeMp3: string): void {
+    if (!MP3_TRUTHY.has(transcodeMp3.trim().toLowerCase())) return;
+    const content = readJson(contentPath);
+    if (content === null) return;
+    const meta = (content.metadata ?? {}) as Record<string, unknown>;
+    const recorded = meta.mp3Path;
+    if (typeof recorded === 'string' && recorded !== '' && existsSync(resolve(recorded))) return;
+    const wav = [meta.audioPath, content.audioPath].find(
+        (candidate): candidate is string =>
+            typeof candidate === 'string' && candidate.endsWith('.wav') && existsSync(resolve(candidate)),
+    );
+    if (wav === undefined) return;
+    const wavPath = resolve(wav);
+    const mp3Path = wavPath.replace(/\.wav$/i, '.mp3');
+    const proc = spawnSync('ffmpeg', [
+        '-y',
+        '-hide_banner',
+        '-loglevel',
+        'error',
+        '-i',
+        wavPath,
+        '-codec:a',
+        'libmp3lame',
+        '-b:a',
+        '64k',
+        mp3Path,
+    ]);
+    if (proc.status !== 0 || !existsSync(mp3Path)) {
+        const detail = (proc.stderr?.toString() ?? '').trim() || `exit ${String(proc.status)}`;
+        failWith(1, `generate: publish MP3 transcode failed: ${detail}`);
+    }
+    meta.mp3Path = mp3Path;
+    content.metadata = meta;
+    sted('write', contentPath, () => writeJsonText(contentPath, content));
+    console.log(`generate: wrote publish MP3 ${mp3Path}`);
+}
+
+/** ffprobe one audio attribute; empty string when the file is absent/unreadable. */
+function probeAudio(file: string, entries: string): string {
+    return (
+        spawnSync('ffprobe', [
+            '-v',
+            'error',
+            '-select_streams',
+            'a:0',
+            '-show_entries',
+            entries,
+            '-of',
+            'csv=p=0',
+            file,
+        ])
+            .stdout?.toString()
+            .trim() ?? ''
+    );
+}
+
+/** A playable local audio artifact: present, positive native sample rate and positive duration. */
+function validNativeAudio(path: unknown): boolean {
+    if (typeof path !== 'string' || path === '' || !existsSync(resolve(path))) return false;
+    const rate = Number.parseFloat(probeAudio(resolve(path), 'stream=sample_rate'));
+    const duration = Number.parseFloat(probeAudio(resolve(path), 'format=duration'));
+    return Number.isFinite(rate) && rate > 0 && Number.isFinite(duration) && duration > 0;
+}
+
+/**
+ * Whole-document speech cache hit (0105 R2 / 0257 R2): the recorded Content must carry THIS run's
+ * generator identity (`kk:<plugin>`), a passing QC report and a playable native-rate WAV. Foreign,
+ * legacy or corrupt output is a miss — never relabel another driver's audio. A valid cache missing
+ * only the requested MP3 is repaired in place from the already-rendered speech (no resynthesis).
+ */
+function wholeDocCache(contentPath: string, plugin: string, transcodeMp3: string): boolean {
+    const content = readJson(contentPath);
+    if (content === null) return false;
+    const meta = metadataOf(content);
+    const qc = meta.qc as Record<string, unknown> | undefined;
+    if (meta.generator !== `kk:${plugin}`) return false;
+    if (qc?.passed === true && validNativeAudio(meta.audioPath)) {
+        ensurePublishMp3(contentPath, transcodeMp3);
+        return true;
+    }
+    return false;
+}
+
+/**
+ * Joined-final cache identity (0257 R3): exact ordered `metadata.sectionHashes` equality, matching
+ * generator, passing QC and a playable WAV. A stale or legacy final is a miss even when every
+ * section still hits — the caller rejoins the cached sections without model calls. The requested
+ * MP3 is repaired from the valid joined WAV; a failed derivative fails loud.
+ */
+function joinedFinalFresh(contentPath: string, plugin: string, hashes: string[], transcodeMp3: string): boolean {
+    const content = readJson(contentPath);
+    if (content === null) return false;
+    const meta = metadataOf(content);
+    if (meta.generator !== `kk:${plugin}`) return false;
+    const frozen = meta.sectionHashes;
+    if (!Array.isArray(frozen) || frozen.length !== hashes.length || !frozen.every((h, i) => h === hashes[i])) {
+        return false;
+    }
+    const qc = meta.qc as Record<string, unknown> | undefined;
+    if (qc?.passed !== true || !validNativeAudio(meta.audioPath)) return false;
+    ensurePublishMp3(contentPath, transcodeMp3);
+    return true;
+}
+
+/**
+ * Aggregate the current sections' QC into the shared VoiceQualityReport names (0257 R3): passed
+ * iff every section passed; overallScore is the minimum when every section reports a finite one
+ * (absent evidence stays unavailable, never an invented zero); segmentAudits are concatenated with
+ * globally ordered segmentIndex; criticalIssues are flattened with section labels.
+ */
+function aggregateSectionQc(
+    plans: Array<{ def: { name: string }; jsonPath: string }>,
+    totalDuration: number,
+): Record<string, unknown> {
+    const segmentAudits: Array<Record<string, unknown>> = [];
+    const criticalIssues: string[] = [];
+    const scores: number[] = [];
+    let allPassed = true;
+    let allScored = true;
+    for (const plan of plans) {
+        const report = metadataOf(readJson(plan.jsonPath)).qc;
+        const qc = report !== null && typeof report === 'object' ? (report as Record<string, unknown>) : {};
+        if (qc.passed !== true) allPassed = false;
+        if (typeof qc.overallScore === 'number' && Number.isFinite(qc.overallScore)) scores.push(qc.overallScore);
+        else allScored = false;
+        if (Array.isArray(qc.segmentAudits)) {
+            for (const audit of qc.segmentAudits) {
+                if (audit !== null && typeof audit === 'object') {
+                    segmentAudits.push({ ...(audit as Record<string, unknown>), segmentIndex: segmentAudits.length });
+                }
+            }
+        }
+        if (Array.isArray(qc.criticalIssues)) {
+            for (const issue of qc.criticalIssues) criticalIssues.push(`${plan.def.name}: ${String(issue)}`);
+        }
+    }
+    const aggregate: Record<string, unknown> = { passed: allPassed, totalDuration, segmentAudits, criticalIssues };
+    if (allScored && scores.length > 0) aggregate.overallScore = Math.min(...scores);
+    return aggregate;
+}
+
 export function dailyGenerate(args: string[]): void {
     const [
         workDir = '',
@@ -476,6 +744,7 @@ export function dailyGenerate(args: string[]): void {
         ominivoice: 'omni-voice-gen',
         voicebox: 'voice-gen',
         gemini: 'gemini-tts',
+        voxcpm: 'voxcpm-tts',
     };
     let voiceGenerator = VOICE_DRIVERS[vdriver];
     if (!voiceGenerator) {
@@ -494,12 +763,9 @@ export function dailyGenerate(args: string[]): void {
 
     if (!sectionConcurrency) {
         timed(workDir, 'generate', () => {
-            if (isFile(content) && metadataOf(readJson(content)).qc !== undefined) {
-                const qc = metadataOf(readJson(content)).qc as Record<string, unknown> | undefined;
-                if (qc?.passed === true) {
-                    console.log(`audio cached: ${content} (QC passed)`);
-                    return;
-                }
+            if (wholeDocCache(content, voiceGenerator, transcodeMp3)) {
+                console.log(`audio cached: ${content} (QC passed)`);
+                return;
             }
             // Gemini quota probe (20261006): the 06:00 cron hit gemini-3.8-flash-tts 429 with a
             // multi-hour retry-after after the shared key's window drained overnight. One tiny
@@ -513,11 +779,19 @@ export function dailyGenerate(args: string[]): void {
                     !geminiQuotaProbeOk(workDir, pluginsPath, transcodeMp3, [{ ...docsList[0], body: 'Hello.' }])
                 ) {
                     voiceGenerator = VOICE_DRIVERS.voicebox;
+                    // The fallback driver's own cache may already hold this episode (0257 R2) —
+                    // reuse it instead of paying for a second local render. VoxCPM never probes
+                    // Gemini and never falls back, so this branch is Gemini-only.
+                    if (wholeDocCache(content, voiceGenerator, transcodeMp3)) {
+                        console.log(`audio cached: ${content} (QC passed)`);
+                        return;
+                    }
                 }
             }
             kk(voiceExecutorArgs(voiceGenerator, docs, content, pluginsPath), {
                 env: { VOICE_GEN_MP3: transcodeMp3 },
             });
+            ensurePublishMp3(content, transcodeMp3);
         });
         return;
     }
@@ -642,6 +916,8 @@ export function dailyGenerate(args: string[]): void {
         // 4645 / 789.9 s of section speech = 5.88 — a 5.3–5.9 range, so 5.4 deliberately errs low (a
         // slightly early refusal is cheaper than a rendered episode the duration gate then rejects).
         // voice-gen: 20261006 6376 / 1135 = 5.62. A 20-minute ceiling is therefore ~6400 characters.
+        // VoxCPM (voxcpm-tts) shares the 5.6 voicebox estimate — PROVISIONAL: no measured VoxCPM
+        // episode exists yet (0258 supplies the evidence); the measured duration stays authoritative.
         // The style sidecar's 3.3 / 6.3 figures are stale and mutually inconsistent with its own
         // 4300–5800 字 budget (which is 13–29 min at 3.3); using them refused a script that really
         // renders in 17 min. Recalibrate from a fresh pair of `metadata.duration` readings when a
@@ -687,7 +963,16 @@ export function dailyGenerate(args: string[]): void {
                     try {
                         const sidecar = readJson(jsonPath) as Record<string, unknown>;
                         const sidecarMeta = metadataOf(sidecar) as Record<string, unknown>;
-                        if (sidecar.hash === hash || sidecarMeta.hash === hash) {
+                        const sidecarQc = sidecarMeta.qc as Record<string, unknown> | undefined;
+                        // A completed section is reusable only when its provenance, QC and audio
+                        // all belong to this driver/text/profile — a foreign or half-written
+                        // sidecar re-renders (0257 R2). The hash already folds in the driver.
+                        if (
+                            (sidecar.hash === hash || sidecarMeta.hash === hash) &&
+                            sidecarMeta.generator === `kk:${driver}` &&
+                            sidecarQc?.passed === true &&
+                            validNativeAudio(wavPath)
+                        ) {
                             cached = true;
                         }
                     } catch {}
@@ -705,7 +990,18 @@ export function dailyGenerate(args: string[]): void {
         let plans = computePlans(voiceGenerator);
         const anySynthesisNeeded = plans.some((p) => p.needsSynthesis);
 
-        if (!anySynthesisNeeded && existsSync(joinedWavPath) && existsSync(joinedContentPath)) {
+        // All sections hit, but the joined final is reusable only when its frozen identity matches
+        // this run's ordered section hashes (0257 R3). A stale or legacy final — e.g. a previous
+        // join failed — falls through and rejoins the cached sections below, with no model calls.
+        if (
+            !anySynthesisNeeded &&
+            joinedFinalFresh(
+                joinedContentPath,
+                voiceGenerator,
+                plans.map((p) => p.hash),
+                transcodeMp3,
+            )
+        ) {
             console.log('generate: all sections cached, joined speech reused');
             return;
         }
@@ -752,10 +1048,25 @@ export function dailyGenerate(args: string[]): void {
             };
             writeJsonText(secDocIn, [doc]);
             try {
-                const status = kk(voiceExecutorArgs(voiceGenerator, secDocIn, plan.jsonPath, pluginsPath), {
+                // 0269-shaped hardening (20261012): one retry for a failed section. The design already
+                // bounds the episode's risk with the pre-flight quota probe and the per-section cache,
+                // but a failure that arrives MID-render (a 429 once the window drains, a network blip)
+                // still cost the whole episode — the one step nothing can publish without. The retry is
+                // cheap and bounded: the successful sections are cache hits, so at most one extra
+                // request per failed section is issued, and a persistent failure still fails loud.
+                let status = kk(voiceExecutorArgs(voiceGenerator, secDocIn, plan.jsonPath, pluginsPath), {
                     env: { VOICE_GEN_MP3: transcodeMp3 },
                     soft: true,
                 });
+                if (status !== 0) {
+                    console.log(
+                        `generate: section ${plan.def.stem} synthesis failed (exit ${status}) — retrying it once`,
+                    );
+                    status = kk(voiceExecutorArgs(voiceGenerator, secDocIn, plan.jsonPath, pluginsPath), {
+                        env: { VOICE_GEN_MP3: transcodeMp3 },
+                        soft: true,
+                    });
+                }
                 if (status !== 0) {
                     failWith(status, `generate: section synthesis failed for ${plan.def.stem}`);
                 }
@@ -814,21 +1125,52 @@ export function dailyGenerate(args: string[]): void {
         }
 
         const joinedDuration = Number.parseFloat(probeHelper(joinedWavPath, 'format=duration'));
+        if (!validNativeAudio(joinedWavPath) || !Number.isFinite(joinedDuration)) {
+            failWith(1, `generate: joined audio is not a playable native-rate WAV: ${joinedWavPath}`);
+        }
 
-        let contentObj: Record<string, unknown> = {};
-        if (existsSync(joinedContentPath)) {
-            try {
-                contentObj = readJson(joinedContentPath) as Record<string, unknown>;
-            } catch {}
+        // podcast-pub renders the show-notes timeline from `metadata.segments[]` (per-segment
+        // duration + ASR transcription). The one-shot path receives them from the voice plugin, but
+        // this sectioned path synthesizes one sidecar per section and dropped them at the join — every
+        // timeline row rendered 0:00 (2026-10-11). Rebuild the list in section order from the CURRENT
+        // sidecars, never inherit the previous final's list (0257 R3).
+        const joinedSegments: Array<Record<string, unknown>> = [];
+        for (const plan of plans) {
+            const sectionSegments = metadataOf(readJson(plan.jsonPath)).segments;
+            if (Array.isArray(sectionSegments)) {
+                joinedSegments.push(...(sectionSegments as Array<Record<string, unknown>>));
+            }
         }
-        const meta = (contentObj.metadata ?? {}) as Record<string, unknown>;
-        delete meta.introMerged;
-        meta.audioPath = joinedWavPath;
-        meta.duration = joinedDuration;
-        contentObj.audioPath = joinedWavPath;
-        contentObj.mediaType = 'audio/wav';
-        contentObj.metadata = meta;
+        // Rebuild the Content envelope from the current script/sections. The previous final's
+        // generator/QC/mp3Path/sectionHashes must never survive a fresh join, and mp3Path is
+        // deliberately absent so ensurePublishMp3 regenerates the requested derivative (0257 R3).
+        const baseMeta: Record<string, unknown> = {
+            generator: `kk:${voiceGenerator}`,
+            audioPath: joinedWavPath,
+            duration: joinedDuration,
+        };
+        if (joinedSegments.length > 0) baseMeta.segments = joinedSegments;
+        const contentObj: Record<string, unknown> = {
+            title: typeof script.title === 'string' && script.title !== '' ? script.title : 'Daily AI News',
+            body: scriptRaw,
+            format: 'audio',
+            references: [],
+            audioPath: joinedWavPath,
+            mediaType: 'audio/wav',
+            metadata: baseMeta,
+        };
         writeJsonText(joinedContentPath, contentObj);
+        // Transcode the requested MP3 before any success claim is written: a failed conversion
+        // fails loud with no qc.passed on disk, so the next run rejoins the cached sections rather
+        // than trusting a broken final (0257 R3).
+        ensurePublishMp3(joinedContentPath, transcodeMp3);
+        // Join and derivative are proven; only now record the frozen identity and aggregated QC.
+        const finalized = readJson(joinedContentPath) ?? contentObj;
+        const finalMeta = metadataOf(finalized);
+        finalMeta.qc = aggregateSectionQc(plans, joinedDuration);
+        finalMeta.sectionHashes = plans.map((p) => p.hash);
+        finalized.metadata = finalMeta;
+        writeJsonText(joinedContentPath, finalized);
     });
 }
 
@@ -1647,7 +1989,7 @@ function voicescriptToBlockYaml(script: Record<string, unknown>): string {
     return lines.join('\n');
 }
 
-/** Measured driver rates from dailyGenerate. Unknown drivers use the voicebox rate. */
+/** Measured driver rates from dailyGenerate. Unknown drivers (incl. voxcpm, provisionally) use the voicebox rate. */
 function spokenCharRate(vdriver: string): number {
     return vdriver === 'gemini' ? 5.4 : 5.6;
 }
@@ -2082,6 +2424,37 @@ export function xhsOverflowPoints(stderr: string, card: XhsCard): number[] | nul
 /** The sentence-ending marks the shorten rule cuts at. */
 const POINT_SENTENCE_MARKS = new Set(['。', '！', '？']);
 
+/** Fewest bullets a card keeps: below two, the block stops reading as a list. */
+const XHS_MIN_POINTS = 2;
+
+/** How many rewrites a refused card gets; each attempt re-bills one illustration. */
+const XHS_OVERFLOW_ATTEMPTS = 3;
+
+/**
+ * 0251 R1 + 2026-10-12: reduce the points of a card the composer refused, so the next compose pass
+ * can fit them. Rule 1 shortens each point the composer named ({@link shortenOverflowedPoint}). When
+ * no point can get shorter the block itself is over budget — measured on 20261011-ai-2026-10-11, whose
+ * cover points are 12–16 code-point single sentences that both shortening rules leave untouched, so
+ * the old single-shot retry never fired and the whole series was lost — so rule 2 drops the trailing
+ * point. Returns whether the card changed, the caller's signal to retry.
+ */
+export function reduceOverflowingPoints(points: string[], named: readonly number[]): boolean {
+    let changed = false;
+    for (const n of named) {
+        const point = points[n] ?? '';
+        const next = shortenOverflowedPoint(point);
+        if (next !== point) {
+            points[n] = next;
+            changed = true;
+        }
+    }
+    if (!changed && points.length > XHS_MIN_POINTS) {
+        points.pop();
+        changed = true;
+    }
+    return changed;
+}
+
 /**
  * 0251 R1: shorten one overflowing card point — drop its last sentence (cut at the last
  * 。/！/？ that is not the final character, inclusive); a one-sentence point longer than 36
@@ -2191,30 +2564,39 @@ export function dailyXhsRender(args: string[]): void {
                 const resumeLine = (status: number): string =>
                     `xhs render: card ${card.index} failed (image-gen exit ${status}); cards before it are kept — re-run daily-xhs-render to resume from card ${card.index}`;
                 let result = kkCaptured(imageGenArgs, { soft: true });
-                if (result.status !== 0) {
-                    // 0251 R1: retry ONCE, only on a points[n] safe-area overflow where at least one
-                    // named point got shorter. The envelope is rewritten in the same shape and
-                    // image-gen is called once more; a second failure takes the resume line.
-                    let shortened = false;
-                    for (const n of xhsOverflowPoints(result.stderr, card) ?? []) {
-                        const point = card.points[n] ?? '';
-                        const next = shortenOverflowedPoint(point);
-                        if (next !== point) {
-                            card.points[n] = next;
-                            shortened = true;
-                        }
-                    }
-                    if (shortened) {
-                        (imageGen.vars as Record<string, unknown>).points = card.points.join('\n');
-                        sted('write', envPath, () =>
-                            writeJsonText(envPath, [
-                                { id: `xhs-card-${card.index}`, title: runDate, body: '', metadata: { imageGen } },
-                            ]),
+                // 0269: a failure the composer's overflow sentence does NOT explain is retried once with
+                // the SAME envelope, because the observed cause of those is the provider, not the input:
+                // on 2026-10-12 card 02 was rewritten for a points[3] overflow and the second call then
+                // failed with only a vendor-fallback warning (minimax flaked); re-running that exact
+                // saved envelope by hand rendered on the first try. 0251 R2 read "not an overflow ⇒ do not
+                // retry" as fail-fast, which is what lost the whole series that day (and every day since
+                // 10-08). The budget stays bounded: overflow rewrites keep their 3, a provider failure
+                // gets exactly 1, so a permanently broken card costs one extra illustration and not four.
+                let transientRetryUsed = false;
+                for (let attempt = 0; result.status !== 0 && attempt < XHS_OVERFLOW_ATTEMPTS; attempt += 1) {
+                    // 0251 R1 (+ the block-level rule 2): a points[n] safe-area overflow is rewritable —
+                    // shorten the named points, then drop the trailing one. The envelope is rewritten in
+                    // the same shape and image-gen is called again.
+                    const named = xhsOverflowPoints(result.stderr, card);
+                    if (named === null) {
+                        if (transientRetryUsed) break;
+                        transientRetryUsed = true;
+                        console.log(
+                            `xhs render: card ${card.index} failed without a safe-area overflow — retrying the same envelope once (exit ${result.status})`,
                         );
                         result = kkCaptured(imageGenArgs, { soft: true });
+                        continue;
                     }
-                    if (result.status !== 0) failWith(result.status, resumeLine(result.status));
+                    if (!reduceOverflowingPoints(card.points, named)) break;
+                    (imageGen.vars as Record<string, unknown>).points = card.points.join('\n');
+                    sted('write', envPath, () =>
+                        writeJsonText(envPath, [
+                            { id: `xhs-card-${card.index}`, title: runDate, body: '', metadata: { imageGen } },
+                        ]),
+                    );
+                    result = kkCaptured(imageGenArgs, { soft: true });
                 }
+                if (result.status !== 0) failWith(result.status, resumeLine(result.status));
                 artifact = firstArtifact(requireJson(out, 'xhs render'));
             }
             if (artifact === null) failWith(1, `xhs render: card ${card.index} recorded no image artifact (${out})`);