dsh-deepmoyu 2.3.0 → 2.4.1

package/lib/pv.mjs

@@ -1,35 +1,19 @@
-/**
- * lib/pv.mjs —— 「昨日冲浪报告」PV 视频的 Node 侧编排
- * ============================================================================
- * 它是什么（2026-10-22 使用者要求）：
- *   「每天生成一个视频，讲今天的冲浪情况 —— 今天刷了什么内容、有什么感悟、
- *     私信和评论是什么情况。用鲸鱼摸鱼的虚拟形象讲解，要有声音。」
- *
- * 为什么视频不在 Node 里做：
- *   画 Q 版角色、TTS、逐帧渲染、混音全是 Python 的活（Pillow + edge-tts + imageio-ffmpeg），
- *   见 `lib/pv.py`（渲染器）与 `lib/pv_plan.py`（把某天的日报/流水整理成分镜）。
- *   这一层只负责**编排**：出分镜 → 渲染 → 收成品，全程可看日志。
- *
- * 不变量（改之前先读）：
- *   · 渲染要几分钟 ⇒ **绝不能在工具调用里同步等**。start() 立刻返回，
- *     进度靠 status() 轮询（HTTP /api/bili-duty/pv 与 bili_pv({action:'status'}) 都走它）。
- *   · 成品先写 `*.partial.mp4`，成功了才 rename 成正式名 ——
- *     半截文件永远不能被当成"做好了"（客户端是按文件名认的）。
- *   · 一次只跑一个：两个 ffmpeg 抢 CPU 只会把两边都拖慢，而且中间产物目录会打架。
- *   · 任何失败都只记进日志 + status.error，**绝不抛到宿主**（做视频挂了不能影响刷B站）。
- *   · 输出目录**不写死盘符**：默认取镜像目录反推出的工作区根（见 lib/mirror.mjs），
- *     推不出来才退回家目录的 out/。
- */
+/** Local PV coordinator: authored productions, isolated jobs and verified publication. */
 import { spawn } from 'node:child_process'
-import { appendFileSync, copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync } from 'node:fs'
-import { join } from 'node:path'
+import { randomUUID } from 'node:crypto'
+import { appendFileSync, copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs'
+import { isAbsolute, join, relative, resolve } from 'node:path'
+import { normalizeProduction } from './pv-production.mjs'
 
-/** 成品文件名前缀：`大肥鱼日报_2026-10-20.mp4` */
 export const PV_PREFIX = '大肥鱼日报'
 const PV_RE = /^大肥鱼日报_(\d{4}-\d{2}-\d{2})\.mp4$/
 const DATE_RE = /^\d{4}-\d{2}-\d{2}$/
+const PRODUCTION_ID_RE = /^\d{8}-[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/
 const COVER_NAMES = { '16x9': '封面_16x9.png', '4x3': '封面_4x3.png' }
 const COVER_SIZES = { '16x9': [1920, 1080], '4x3': [1440, 1080] }
+const ACTIVE_STAGES = new Set(['plan', 'cover', 'render', 'verify', 'publish'])
+export const PV_RUNTIME_CHECK = 'import sys,PIL,edge_tts,imageio_ffmpeg;sys.exit(0 if (3,11)<=sys.version_info[:2]<(3,14) and int(PIL.__version__.split(".")[0])>=13 else 2)'
+export const PV_COVER_RUNTIME_CHECK = 'import sys,PIL;sys.exit(0 if (3,11)<=sys.version_info[:2]<(3,14) and int(PIL.__version__.split(".")[0])>=13 else 2)'
 
 export const pvDateOk = (s) => {
   const value = String(s || '')
@@ -38,36 +22,45 @@ export const pvDateOk = (s) => {
   return Number.isFinite(parsed.getTime()) && parsed.toISOString().slice(0, 10) === value
 }
 
-/** 「昨天」= 本地时区的昨天（不能用 toISOString，那是 UTC，东八区早上 8 点前会算错一天） */
+export const PV_FAILURES_FILE = 'pv-failures.json'
+export const FAILURE_KEEP = 20
+export function readPvFailures(stateDir, keep = FAILURE_KEEP) {
+  try {
+    const list = JSON.parse(readFileSync(join(stateDir, PV_FAILURES_FILE), 'utf8'))
+    return Array.isArray(list) ? list.slice(-keep).reverse() : []
+  } catch { return [] }
+}
+function appendPvFailure(stateDir, entry) {
+  try {
+    const file = join(stateDir, PV_FAILURES_FILE)
+    let list = []
+    try { const parsed = JSON.parse(readFileSync(file, 'utf8')); if (Array.isArray(parsed)) list = parsed } catch { /* first failure */ }
+    list.push(entry)
+    mkdirSync(stateDir, { recursive: true })
+    const tmp = `${file}.tmp`
+    writeFileSync(tmp, JSON.stringify(list.slice(-FAILURE_KEEP), null, 2), 'utf8')
+    renameSync(tmp, file)
+  } catch { /* Failure history cannot break the host. */ }
+}
+
+/** Yesterday in the local timezone. */
 export function pvYesterday(now = new Date()) {
   const d = new Date(now.getTime() - 86400_000)
   const p = (n) => String(n).padStart(2, '0')
   return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())}`
 }
-
-/**
- * 视频放哪儿。
- * @param {string} stateDir 插件家目录
- * @param {{pvDir?:string, mirrorDir?:string, resolveMirror?:(s:string,e:string)=>string}} o
- * @returns {{root:string, out:string, work:string}}
- *   `root` = 反推出的工作区根（推不出来是空串）
- */
 export function pvDirs(stateDir, o = {}) {
   const explicit = String(o.pvDir || '').trim()
-  if (explicit) {
-    return { root: explicit, out: explicit, legacy: explicit, legacyDirs: [explicit], work: join(explicit, '_work') }
-  }
+  if (explicit) return { root: explicit, out: explicit, legacy: explicit, legacyDirs: [explicit], work: join(explicit, '_work') }
   let root = ''
-  try { root = String((o.resolveMirror ? o.resolveMirror(stateDir, o.mirrorDir || '') : '') || '').trim() } catch { root = '' }
+  try { root = String((o.resolveMirror ? o.resolveMirror(stateDir, o.mirrorDir || '') : '') || '').trim() } catch { /* no mirror */ }
   if (root) {
     const base = join(root, 'bili-work', 'pv')
     return { root, out: join(base, '日报'), legacy: root, legacyDirs: [root, base], work: base }
   }
-  // Keep the same dated structure even when workspace discovery is unavailable.
   const base = join(stateDir, 'out')
   return { root: '', out: join(base, '日报'), legacy: base, legacyDirs: [base], work: join(stateDir, 'pv') }
 }
-
 const dateDir = (outDir, date) => join(outDir, date)
 const finalOf = (outDir, date) => join(dateDir(outDir, date), `${PV_PREFIX}_${date}.mp4`)
 const legacyFinalOf = (outDir, date) => join(outDir, `${PV_PREFIX}_${date}.mp4`)
@@ -76,7 +69,7 @@ const usableVideo = (file) => {
   try { const s = statSync(file); return s.isFile() && s.size > 1024 } catch { return false }
 }
 
-/** Scan canonical YYYY-MM-DD folders and flat legacy files. Canonical wins. */
+/** Keep the historical date-indexed list compatible; studio jobs have productions(). */
 export function listPv(outDir, legacyDirs = outDir) {
   const byDate = new Map()
   const add = (date, file, canonical) => {
@@ -93,7 +86,7 @@ export function listPv(outDir, legacyDirs = outDir) {
       if (m) add(m[1], join(outDir, n), false)
       if (DATE_RE.test(n) && pvDateOk(n)) add(n, finalOf(outDir, n), true)
     }
-  } catch { /* directory not created yet */ }
+  } catch { /* directory not created */ }
   for (const legacyDir of asDirs(legacyDirs)) {
     if (legacyDir === outDir) continue
     try {
@@ -101,11 +94,10 @@ export function listPv(outDir, legacyDirs = outDir) {
         const m = PV_RE.exec(n)
         if (m) add(m[1], join(legacyDir, n), false)
       }
-    } catch { /* legacy directory may not exist */ }
+    } catch { /* optional legacy directory */ }
   }
-  return [...byDate.values()].sort((a, b) => (a.date < b.date ? 1 : -1))
+  return [...byDate.values()].sort((a, b) => b.date.localeCompare(a.date))
 }
-
 export function pvFileOf(outDir, date, legacyDirs = outDir) {
   if (!pvDateOk(date)) return ''
   const canonical = finalOf(outDir, date)
@@ -116,341 +108,441 @@ export function pvFileOf(outDir, date, legacyDirs = outDir) {
   }
   return canonical
 }
-
 const validCover = (file, ratio) => {
   try {
     const [width, height] = COVER_SIZES[ratio]
-    if (!statSync(file).isFile() || statSync(file).size === 0) return false
-    // PNG IHDR width / height; the helper process also performs full decoding.
+    if (!statSync(file).isFile()) return false
     const data = readFileSync(file)
     return data.length > 24 && data.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]))
       && data.readUInt32BE(16) === width && data.readUInt32BE(20) === height
   } catch { return false }
 }
-
 const tailOf = (file, n = 2600) => {
+  try { const s = readFileSync(file, 'utf8'); return s.length > n ? s.slice(-n) : s } catch { return '' }
+}
+const readJson = (file) => {
+  try { return JSON.parse(readFileSync(file, 'utf8')) } catch { return null }
+}
+const verificationOk = (file) => readJson(file)?.ok === true
+const atomicJson = (file, data) => {
+  const tmp = `${file}.tmp-${randomUUID()}`
+  try { writeFileSync(tmp, `${JSON.stringify(data, null, 2)}\n`, 'utf8'); renameSync(tmp, file) }
+  finally { rmSync(tmp, { force: true }) }
+}
+const within = (root, file) => {
+  const rel = relative(root, file)
+  return rel !== '..' && !rel.startsWith(`..\\`) && !rel.startsWith('../') && !isAbsolute(rel)
+}
+/** Refuse symlinks/junction escapes for the HTTP-serving production index. */
+const confinedProduction = (outDir, id) => {
+  if (typeof id !== 'string' || !PRODUCTION_ID_RE.test(id)) return ''
   try {
-    const s = readFileSync(file, 'utf8')
-    return s.length > n ? s.slice(-n) : s
+    const studio = resolve(outDir, 'studio')
+    if (lstatSync(studio).isSymbolicLink()) return ''
+    const path = resolve(studio, id)
+    if (!within(studio, path) || !lstatSync(path).isDirectory() || lstatSync(path).isSymbolicLink()) return ''
+    const realStudio = realpathSync(studio)
+    if (!within(realStudio, realpathSync(path))) return ''
+    for (const name of ['production.json', 'video.mp4', 'verification.json']) {
+      const file = join(path, name)
+      if (lstatSync(file).isSymbolicLink() || !lstatSync(file).isFile() || !within(realStudio, realpathSync(file))) return ''
+    }
+    return path
   } catch { return '' }
 }
+const productionRow = (outDir, id) => {
+  const path = confinedProduction(outDir, id)
+  if (!path) return null
+  const metadata = readJson(join(path, 'production.json'))
+  const file = join(path, 'video.mp4')
+  if (!metadata || metadata.id !== id || metadata.status !== 'done' || !verificationOk(join(path, 'verification.json')) || !usableVideo(file)) return null
+  return { id, mode: String(metadata.mode || ''), title: String(metadata.title || ''), date: String(metadata.date || ''),
+    status: 'done', stage: 'done', path, metadata: join(path, 'production.json'), file, size: statSync(file).size,
+    at: String(metadata.completedAt || metadata.startedAt || ''), plan: join(path, 'plan.json'), timeline: join(path, 'timeline.json'),
+    log: join(path, 'build.log'), verification: join(path, 'verification.json'), targetDurationSec: metadata.targetDurationSec,
+    maxDurationSec: metadata.maxDurationSec, covers: Object.fromEntries(Object.entries(COVER_NAMES).map(([ratio, name]) => [ratio, join(path, name)])) }
+}
 
 /**
- * 造一个 PV 编排器。
- * @param {{
- *   stateDir: string,
- *   pluginDir: string,
- *   python: () => string,           // 每次现算（cfg 可能被设置页改掉）
- *   dirs: () => {root:string,out:string,work:string},
- *   env?: Record<string,string>,
- *   log?: (s:string)=>void,
- *   timeoutMs?: number,
- * }} o
+ * No model calls occur here. render() consumes a complete model-authored plan.
+ * @param {{stateDir:string,pluginDir:string,python:()=>string,dirs:()=>object,env?:object,log?:(s:string)=>void,timeoutMs?:number,gsv?:()=>object}} o
  */
 export function createPv(o) {
   const { stateDir, pluginDir, python, dirs, env = null } = o
-  const say = (s) => { try { o.log?.(s) } catch { /* 日志不许炸 */ } }
-  const timeoutMs = Number(o.timeoutMs) || 20 * 60_000
-  /** 🎙 真·本鱼音色（GPT-SoVITS）：返回 {gsvRepo,gsvRef,gsvPrompt,gsvPython} 或 null */
+  const say = (s) => { try { o.log?.(s) } catch { /* host logger */ } }
+  const timeoutMs = Number(o.timeoutMs) > 0 ? Number(o.timeoutMs) : 20 * 60_000
   const gsvOf = () => { try { return o.gsv?.() || null } catch { return null } }
-  /** @type {null | {date:string, stage:string, startedAt:string, t0:number, out:string, log:string, error?:string, file?:string, proc?:any, killed?:boolean}} */
   let job = null
+  const settledListeners = new Set()
+  const onSettled = (listener) => { settledListeners.add(listener); return () => settledListeners.delete(listener) }
   let depsCache = { at: 0, ok: null }
-
   const scripts = () => {
-    const pick = (name) => {
-      const packaged = join(pluginDir, 'lib', name)
-      return existsSync(packaged) ? packaged : join(stateDir, name)
-    }
-    return { plan: pick('pv_plan.py'), render: pick('pv.py'), cover: pick('pv_cover.py') }
+    const pick = (name) => existsSync(join(pluginDir, 'lib', name)) ? join(pluginDir, 'lib', name) : join(stateDir, name)
+    return { plan: pick('pv_plan.py'), render: pick('pv.py'), cover: pick('pv_cover.py'), verify: pick('pv_verify.py') }
   }
-
-  const append = (file, s) => { try { appendFileSync(file, String(s), 'utf8') } catch { /* 日志写不了也不能炸 */ } }
-
-  const run = (cmd, args, logFile, jobRef) => new Promise((resolve) => {
-    append(logFile, `\n$ ${cmd} ${args.join(' ')}\n`)
-    let c = null
-    try { c = spawn(cmd, args, { cwd: stateDir, windowsHide: true, stdio: ['ignore', 'pipe', 'pipe'], env: env || process.env }) }
-    catch (e) { append(logFile, `起不来：${e?.message ?? e}\n`); return resolve(1) }
-    if (jobRef) jobRef.proc = c
-    const w = (b) => append(logFile, String(b))
-    c.stdout?.on('data', w)
-    c.stderr?.on('data', w)
-    const timer = setTimeout(() => {
-      append(logFile, `\n--- 超时 ${Math.round(timeoutMs / 60000)} 分钟，强制结束 ---\n`)
-      try { c.kill('SIGKILL') } catch { /* 已经没了 */ }
-    }, timeoutMs)
-    timer.unref?.()
-    c.on('close', (code) => { clearTimeout(timer); if (jobRef?.proc === c) jobRef.proc = null; append(logFile, `\n--- exit ${code} ---\n`); resolve(code ?? 1) })
-    c.on('error', (e) => { clearTimeout(timer); append(logFile, `起不来：${e?.message ?? e}\n`); resolve(1) })
+  const append = (file, s) => { try { appendFileSync(file, String(s), 'utf8') } catch { /* disk/log failure */ } }
+  const busy = () => Boolean(job && (job.active || job.proc || job.killProc || ACTIVE_STAGES.has(job.stage)))
+  const productions = () => {
+    const d = dirs()
+    try { return readdirSync(join(d.out, 'studio')).map((id) => productionRow(d.out, id)).filter(Boolean).sort((a, b) => b.at.localeCompare(a.at)) }
+    catch { return [] }
+  }
+  const productionOf = (j) => j?.production ? { ...j.production, status: j.stage, stage: j.stage,
+    error: j.error || '', ...(j.completedAt ? { completedAt: j.completedAt } : {}) } : null
+  const persist = (j) => {
+    if (!j.metadata) return
+    atomicJson(j.metadata, j.production ? productionOf(j) : { date: j.date, status: j.stage, stage: j.stage,
+      startedAt: j.startedAt, completedAt: j.completedAt || '', repairOnly: j.repairOnly,
+      verificationSkipped: j.verificationSkipped || false, error: j.error || '', plan: j.plan, timeline: j.timeline, verification: j.verification, file: j.file, log: j.log })
+  }
+  const recordFailure = (j, failedStage) => {
+    if (j.failureRecorded) return
+    j.failureRecorded = true
+    appendPvFailure(stateDir, { at: new Date().toISOString(), date: j.date, id: j.id || '', stage: failedStage,
+      repairOnly: Boolean(j.repairOnly), error: j.error, log: j.log })
+  }
+  const terminate = (j) => {
+    const child = j.proc
+    if (!child || j.killProc) return
+    if (process.platform === 'win32' && Number.isSafeInteger(child.pid) && child.pid > 0) {
+      let killer
+      try { killer = spawn('taskkill', ['/pid', String(child.pid), '/t', '/f'], { windowsHide: true, stdio: 'ignore', env: env || process.env }) }
+      catch { try { child.kill('SIGKILL') } catch { /* already exited */ }; return }
+      j.killProc = killer
+      j.killPromise = new Promise((resolveKill) => {
+        let done = false
+        const finish = (code) => {
+          if (done) return
+          done = true
+          if (j.killProc === killer) j.killProc = null
+          if (code !== 0) { try { child.kill('SIGKILL') } catch { /* exited */ } }
+          resolveKill()
+        }
+        killer.once('close', finish)
+        killer.once('error', () => finish(1))
+      })
+    } else { try { child.kill('SIGKILL') } catch { /* exited */ } }
+  }
+  const cancel = (j, timedOut = false) => {
+    if (j.killed) return
+    const priorStage = j.stage
+    j.killed = true // Set before terminating any child or notifying observers.
+    j.stage = timedOut ? 'failed' : 'stopped'
+    j.error = timedOut ? `制作任务总时限已到（${timeoutMs}ms）` : ''
+    append(j.log, timedOut ? `\n--- ${j.error}，终止进程树 ---\n` : '\n--- 手动停下；等待子进程退出 ---\n')
+    try { persist(j) } catch { /* cancellation must remain immediate */ }
+    if (timedOut) recordFailure(j, priorStage)
+    terminate(j)
+  }
+  const alive = (j) => {
+    if (j.killed) throw new Error('PV_JOB_CANCELLED')
+    if (Date.now() >= j.deadline) { cancel(j, true); throw new Error('PV_JOB_CANCELLED') }
+  }
+  const run = (cmd, args, j) => new Promise((resolveRun) => {
+    if (j.killed) return resolveRun(null)
+    try { alive(j) } catch { return resolveRun(null) }
+    append(j.log, `\n$ ${cmd} ${args.join(' ')}\n`)
+    let child
+    try { child = spawn(cmd, args, { cwd: stateDir, windowsHide: true, stdio: ['ignore', 'pipe', 'pipe'], env: env || process.env }) }
+    catch (e) { append(j.log, `起不来：${e?.message ?? e}\n`); return resolveRun(1) }
+    j.proc = child
+    child.stdout?.on('data', (b) => append(j.log, b.toString()))
+    child.stderr?.on('data', (b) => append(j.log, b.toString()))
+    // close, not exit: stdout/stderr and grandchildren must have finished first.
+    child.once('error', (e) => append(j.log, `起不来：${e?.message ?? e}\n`))
+    child.once('close', (code) => {
+      if (j.proc === child) j.proc = null
+      append(j.log, `\n--- exit ${code} ---\n`)
+      resolveRun(code ?? 1)
+    })
   })
-
+  const phase = (j, stage) => { alive(j); j.stage = stage; persist(j) }
+  const requireExit = (code, message) => { if (code !== 0) throw new Error(`${message}（exit ${code}）`) }
   const status = () => {
     const d = dirs()
-    const running = !!job && (job.stage === 'plan' || job.stage === 'cover' || job.stage === 'render')
-    const base = {
-      ok: true,
-      running,
-      stage: job ? job.stage : 'idle',
-      date: job ? job.date : '',
-      startedAt: job ? job.startedAt : '',
-      ms: job ? Date.now() - job.t0 : 0,
-      file: job ? (job.file || job.out) : '',
-      log: job ? job.log : '',
-      plan: job ? job.plan : '',
-      timeline: job ? job.timeline : '',
-      error: job ? (job.error || '') : '',
-      tail: job ? tailOf(job.log) : '',
-      out: d.out,
-      work: d.work,
-      root: d.root,
-      videos: listPv(d.out, d.legacyDirs || d.legacy || d.out),
-    }
-    return base
+    return { ok: true, running: busy(), stopping: Boolean(job?.killed && (job?.proc || job?.killProc || job?.active)),
+      stage: job?.stage || 'idle', date: job?.date || '', id: job?.id || '', startedAt: job?.startedAt || '',
+      ms: job ? Date.now() - job.t0 : 0, file: job ? (job.file || job.out) : '', log: job?.log || '',
+      plan: job?.plan || '', timeline: job?.timeline || '', verification: job?.verification || '',
+      verificationSkipped: Boolean(job?.verificationSkipped), repairOnly: Boolean(job?.repairOnly),
+      production: productionOf(job), productions: productions(), error: job?.error || '', tail: job ? tailOf(job.log) : '',
+      out: d.out, work: d.work, root: d.root, videos: listPv(d.out, d.legacyDirs || d.legacy || d.out), failures: readPvFailures(stateDir) }
   }
-
-  /** 依赖探一下（edge-tts / imageio-ffmpeg / Pillow）—— 拿不到就说拿不到，别让它跑到一半才炸 */
+  const checkImport = (imports) => new Promise((resolveCheck) => {
+    try {
+      const child = spawn(String(python() || 'python'), ['-c', imports], { windowsHide: true, stdio: 'ignore', env: env || process.env })
+      const timer = setTimeout(() => { try { child.kill('SIGKILL') } catch { /* exited */ } }, Math.min(timeoutMs, 30_000))
+      timer.unref?.()
+      child.once('close', (code) => { clearTimeout(timer); resolveCheck(code === 0) })
+      child.once('error', () => { clearTimeout(timer); resolveCheck(false) })
+    } catch { resolveCheck(false) }
+  })
   const checkDeps = async (force = false) => {
     if (!force && depsCache.ok !== null && Date.now() - depsCache.at < 60_000) return depsCache.ok
-    const py = String(python() || 'python')
-    const exit = await new Promise((resolve) => {
-      try {
-        const c = spawn(py, ['-c', 'import edge_tts, imageio_ffmpeg, PIL'], { windowsHide: true, stdio: 'ignore', env: env || process.env })
-        c.on('exit', (n) => resolve(n ?? 1))
-        c.on('error', () => resolve(1))
-      } catch { resolve(1) }
-    })
-    depsCache = { at: Date.now(), ok: exit === 0 }
-    return depsCache.ok
+    const ok = await checkImport(PV_RUNTIME_CHECK)
+    depsCache = { at: Date.now(), ok }
+    return ok
   }
-
+  const checkCoverDeps = () => checkImport(PV_COVER_RUNTIME_CHECK)
   const isCoverRepair = (date, force = false) => {
-    if (force) return false
+    if (force || !pvDateOk(date)) return false
     const d = dirs()
     const current = pvFileOf(d.out, date, d.legacyDirs || d.legacy || d.out)
-    if (!existsSync(current)) return false
-    if (current !== finalOf(d.out, date)) return true
-    return !Object.entries(COVER_NAMES).every(([ratio, name]) => validCover(join(dateDir(d.out, date), name), ratio))
+    if (!usableVideo(current)) return false
+    return current !== finalOf(d.out, date) || !Object.entries(COVER_NAMES).every(([ratio, name]) => validCover(join(dateDir(d.out, date), name), ratio))
   }
   const needsWork = (date) => {
     const d = dirs()
     return !usableVideo(pvFileOf(d.out, date, d.legacyDirs || d.legacy || d.out)) || isCoverRepair(date)
   }
-  const checkCoverDeps = async () => {
-    const py = String(python() || 'python')
-    return new Promise((resolve) => {
-      try {
-        const c = spawn(py, ['-c', 'import PIL'], { windowsHide: true, stdio: 'ignore', env: env || process.env })
-        c.on('exit', (n) => resolve(n === 0))
-        c.on('error', () => resolve(false))
-      } catch { resolve(false) }
-    })
-  }
-
   const copyReport = (date, targetDir, logFile) => {
     const source = join(stateDir, 'out', `${date}.md`)
     if (!existsSync(source)) return
     const target = join(targetDir, '日报.md')
     const ready = `${target}.ready`
-    try {
-      mkdirSync(targetDir, { recursive: true })
-      copyFileSync(source, ready)
-      renameSync(ready, target)
-      append(logFile, `\n日报副本 → ${target}\n`)
-    } catch (e) {
-      try { rmSync(ready, { force: true }) } catch { /* best effort */ }
-      append(logFile, `\n日报副本未复制（不影响成片）：${e?.message ?? e}\n`)
-    }
+    try { copyFileSync(source, ready); renameSync(ready, target) }
+    catch (e) { try { rmSync(ready, { force: true }) } catch { /* cleanup */ }; append(logFile, `\n日报副本未复制：${e?.message ?? e}\n`) }
   }
-
-  const commitOutputs = (tmp, stagedCovers, final, date, outDir) => {
-    const targetDir = dateDir(outDir, date)
-    mkdirSync(targetDir, { recursive: true })
-    const pairs = [{ source: tmp, target: final, ratio: '' },
-      ...Object.entries(COVER_NAMES).map(([ratio, name]) => ({ source: join(stagedCovers, name), target: join(targetDir, name), ratio }))]
-    const stamp = `${process.pid}-${Date.now()}`
-    const ready = pairs.map(({ target }) => ({ target, ready: `${target}.ready-${stamp}`, backup: `${target}.backup-${stamp}` }))
-    let backedUp = false
+  /** Transactional replacement preserves a previously published daily package. */
+  const commitOutputs = (pairs) => {
+    const stamp = randomUUID()
+    const ready = pairs.map(({ target }) => ({ target, ready: `${target}.ready-${stamp}`, backup: `${target}.backup-${stamp}`, existed: existsSync(target) }))
+    let changing = false
     try {
-      for (let i = 0; i < pairs.length; i++) {
-        if (pairs[i].ratio && !validCover(pairs[i].source, pairs[i].ratio)) throw new Error(`封面校验失败：${pairs[i].source}`)
-        if (!pairs[i].ratio && statSync(pairs[i].source).size < 1024) throw new Error('输出文件为空或不完整')
-        copyFileSync(pairs[i].source, ready[i].ready)
+      for (let i = 0; i < pairs.length; i++) copyFileSync(pairs[i].source, ready[i].ready)
+      for (const item of ready) if (item.existed) copyFileSync(item.target, item.backup)
+      changing = true
+      for (const item of ready) { rmSync(item.target, { force: true }); renameSync(item.ready, item.target) }
+    } catch (e) {
+      if (changing) for (const item of ready) {
+        if (item.existed && existsSync(item.backup)) copyFileSync(item.backup, item.target)
+        else if (!item.existed) rmSync(item.target, { force: true })
       }
-      for (const item of ready) if (existsSync(item.target)) copyFileSync(item.target, item.backup)
-      backedUp = true
-      try {
-        for (const item of ready) {
-          rmSync(item.target, { force: true })
-          renameSync(item.ready, item.target)
-        }
-      } catch (error) {
-        if (backedUp) {
-          for (const item of ready) {
-            if (existsSync(item.backup)) copyFileSync(item.backup, item.target)
-            else rmSync(item.target, { force: true })
-          }
+      throw e
+    } finally { for (const item of ready) { rmSync(item.ready, { force: true }); rmSync(item.backup, { force: true }) } }
+  }
+  const setupCheck = (sc, names) => {
+    const missing = names.find((name) => !existsSync(sc[name]))
+    if (missing) return { ok: false, error: `渲染脚本没铺好（缺 ${missing === 'render' ? 'pv.py' : `pv_${missing}.py`}）` }
+    const py = String(python() || 'python')
+    if (!existsSync(py) && py !== 'python' && py !== 'python3') return { ok: false, error: `Python 找不到：${py}（检查设置里的 pythonPath）` }
+    return { ok: true, py }
+  }
+  const busyError = () => ({ ok: false, running: true, date: job.date, id: job.id || '', production: productionOf(job), error: `正在做 ${job.date} 的视频或等待子进程退出，等它结束再来` })
+  const execute = (j, task) => {
+    job = j
+    j.active = true
+    j.deadline = j.t0 + timeoutMs
+    j.timer = setTimeout(() => cancel(j, true), Math.max(1, j.deadline - Date.now()))
+    j.timer.unref?.()
+    // Start on a microtask so callers always receive the job before child work starts.
+    Promise.resolve().then(() => { alive(j); return task() })
+      .catch((e) => {
+        if (j.killed) return
+        const failedStage = j.stage
+        j.stage = 'failed'
+        j.error = String(e?.message ?? e)
+        append(j.log, `\n❌ ${j.error}\n`)
+        try { persist(j) } catch { /* original failure remains */ }
+        recordFailure(j, failedStage)
+        say(`🎬 ${j.date} 的视频失败：${j.error}`)
+      })
+      .finally(async () => {
+        clearTimeout(j.timer)
+        if (j.killPromise) await j.killPromise
+        j.active = false
+        // Observers receive only a settled job, never a partially published artifact.
+        const settled = { ok: j.stage === 'done', id: j.id || '', date: j.date, stage: j.stage, error: j.error || '',
+          file: j.file, plan: j.plan, timeline: j.timeline, verification: j.verification, log: j.log,
+          production: productionOf(j), verificationSkipped: Boolean(j.verificationSkipped) }
+        for (const listener of settledListeners) {
+          try { Promise.resolve(listener(settled)).catch(error => say(`🎬 制作回执未送达：${String(error?.message || error)}`)) }
+          catch (error) { say(`🎬 制作回执未送达：${String(error?.message || error)}`) }
         }
-        throw error
-      }
-    } finally {
-      for (const item of ready) {
-        rmSync(item.ready, { force: true })
-        rmSync(item.backup, { force: true })
-      }
-    }
-    rmSync(tmp, { force: true })
+        // Keep failures/stops visible. A successful job may be released later.
+        if (j.stage !== 'done') return
+        const timer = setTimeout(() => { if (job === j && !busy()) job = null }, 30_000)
+        timer.unref?.()
+      })
+  }
+  const covers = async (j, sc, py, out, repair = false) => {
+    phase(j, 'cover')
+    const args = [sc.cover, '--plan', j.plan, '--outdir', out]
+    if (repair) args.push('--only-missing')
+    const code = await run(py, args, j)
+    alive(j)
+    requireExit(code, '封面生成失败')
+    for (const [ratio, name] of Object.entries(COVER_NAMES)) if (!validCover(join(out, name), ratio)) throw new Error(`封面缺失或尺寸不正确：${join(out, name)}`)
+  }
+  const renderVerify = async (j, sc, py) => {
+    phase(j, 'render')
+    const code = await run(py, [sc.render, '--plan', j.plan, '--out', j.tmp, '--work', j.renderWork], j)
+    alive(j)
+    requireExit(code, '渲染失败')
+    if (!usableVideo(j.tmp)) throw new Error('输出文件为空或不完整')
+    if (!existsSync(j.renderTimeline)) throw new Error('渲染器没有生成 timeline.json')
+    copyFileSync(j.renderTimeline, j.timeline)
+    phase(j, 'verify')
+    // No stale/forged receipt may authorize a later render.
+    rmSync(j.verification, { force: true })
+    const verifyArgs = [sc.verify, '--video', j.tmp, '--timeline', j.timeline, '--outdir', j.packageDir, '--max-duration', String(j.maxDurationSec)]
+    if (Number(j.targetDurationSec) > 0) verifyArgs.push('--target-duration', String(j.targetDurationSec))
+    const verifyCode = await run(py, verifyArgs, j)
+    alive(j)
+    requireExit(verifyCode, '成片校验失败')
+    const receipt = readJson(j.verification)
+    if (receipt?.ok !== true) throw new Error('成片校验失败：verification.json 缺失或未明确给出 ok:true')
+    // Publication preserves the exact validated bytes by renaming the temporary
+    // file. Expose the durable final path; keep only the relative input name as
+    // provenance because the temporary absolute path stops existing after rename.
+    atomicJson(j.verification, { ...receipt, video: j.file, verifiedVideo: j.file,
+      verificationInput: relative(j.packageDir, receipt.video || j.tmp) })
+    phase(j, 'publish')
+  }
+  const done = (j) => {
+    alive(j)
+    j.stage = 'done'
+    j.completedAt = new Date().toISOString()
+    persist(j)
+    append(j.log, `\n✅ ${j.file}\n`)
+    say(`🎬 ${j.date} 的视频做好了：${j.file}`)
   }
 
-  /**
-   * Start rendering or repair only missing covers; always returns immediately.
-   * @param {string} date YYYY-MM-DD
-   * @param {{force?:boolean, noNet?:boolean}} opt
-   */
+  /** Legacy date-based path, retained for scheduled daily films and cover repairs. */
   const start = (date, opt = {}) => {
     const day = String(date || '').trim()
     if (!pvDateOk(day)) return { ok: false, error: `日期得是 YYYY-MM-DD（拿到的是 "${day}"）` }
-    if (job && (job.stage === 'plan' || job.stage === 'cover' || job.stage === 'render' || job.proc)) {
-      return { ok: false, running: true, date: job.date, error: `正在做 ${job.date} 的视频，等它做完再来` }
-    }
-    const sc = scripts()
-    if (!existsSync(sc.plan) || !existsSync(sc.render) || !existsSync(sc.cover)) {
-      const missing = !existsSync(sc.plan) ? 'pv_plan.py' : !existsSync(sc.cover) ? 'pv_cover.py' : 'pv.py'
-      return { ok: false, error: `渲染脚本没铺好（缺 ${missing}）—— 重启一次插件会让 lib/state.mjs 铺过去` }
-    }
-    const py = String(python() || 'python')
-    if (!existsSync(py) && py !== 'python' && py !== 'python3') {
-      return { ok: false, error: `Python 找不到：${py}（先装依赖 / 检查设置里的 pythonPath）` }
-    }
+    if (busy()) return busyError()
     const d = dirs()
     const current = pvFileOf(d.out, day, d.legacyDirs || d.legacy || d.out)
     const repairOnly = isCoverRepair(day, opt.force === true)
-    if (existsSync(current) && !opt.force && !repairOnly) {
-      return { ok: true, skipped: true, date: day, file: current, hint: '这天的视频和两张封面都已经有了；要重做传 force:true' }
-    }
-    const final = finalOf(d.out, day)
+    if (usableVideo(current) && !opt.force && !repairOnly) return { ok: true, skipped: true, date: day, file: current, hint: '这天的视频和两张封面都已经有了；要重做传 force:true' }
+    const sc = scripts()
+    const check = setupCheck(sc, repairOnly ? ['plan', 'cover'] : ['plan', 'cover', 'render', 'verify'])
+    if (!check.ok) return check
+    const { py } = check
+    const runDir = join(d.work, 'runs', `${day.replace(/-/g, '')}-${randomUUID()}`)
+    const packageDir = join(runDir, 'package')
+    const renderWork = join(runDir, 'media')
     const targetDir = dateDir(d.out, day)
-    const plan = join(d.work, `plan_${day}.json`)
-    const tmp = join(d.work, `${PV_PREFIX}_${day}.partial.mp4`)
-    const stageDir = join(d.work, `_publish_${day}`)
-    const coverOut = repairOnly ? targetDir : stageDir
+    const plan = join(packageDir, 'plan.json')
     try {
-      mkdirSync(d.out, { recursive: true })
-      mkdirSync(d.work, { recursive: true })
+      mkdirSync(packageDir, { recursive: true })
       mkdirSync(targetDir, { recursive: true })
-      if (!repairOnly) { rmSync(stageDir, { recursive: true, force: true }); mkdirSync(stageDir, { recursive: true }) }
     } catch (e) { return { ok: false, error: `建目录失败：${e?.message ?? e}` } }
-
-    const logFile = join(d.work, `build_${day}.log`)
-    try { rmSync(logFile, { force: true }) } catch { /* 清不掉就追加 */ }
-    const j = { date: day, stage: repairOnly && existsSync(plan) ? 'cover' : 'plan', startedAt: new Date().toISOString(), t0: Date.now(), out: final, file: final, log: logFile, plan, timeline: join(d.work, `_w${day.replace(/-/g, '')}`, 'timeline.json'), proc: null, killed: false, repairOnly }
-    job = j
-    append(logFile, `=== ${PV_PREFIX} ${day} ${repairOnly ? '补封面' : '开始'} ${new Date().toLocaleString('zh-CN')} ===\n`)
-    say(repairOnly ? `🎬 ${day} 已有成片，只补封面` : `🎬 开始做 ${day} 的视频`)
-
+    const j = { date: day, stage: 'plan', startedAt: new Date().toISOString(), t0: Date.now(), file: finalOf(d.out, day),
+      out: finalOf(d.out, day), log: join(packageDir, 'build.log'), plan, timeline: join(packageDir, 'timeline.json'),
+      verification: join(packageDir, 'verification.json'), metadata: join(packageDir, 'job.json'), renderWork,
+      renderTimeline: join(renderWork, 'timeline.json'), tmp: join(packageDir, 'video.partial.mp4'), packageDir,
+      maxDurationSec: 300, proc: null, killed: false, repairOnly, verificationSkipped: repairOnly }
+    append(j.log, `=== ${PV_PREFIX} ${day} ${repairOnly ? '仅补封面（旧成片未重新校验）' : '开始'} ===\n`)
+    try { persist(j) } catch (e) { return { ok: false, error: `任务记录写入失败：${e?.message ?? e}` } }
     const planArgs = [sc.plan, '--auto', day, '-o', plan, '--home', stateDir]
     if (opt.noNet) planArgs.push('--no-net')
-    let isFirst = false
-    try { isFirst = !listPv(d.out, d.legacy || d.out).some((v) => v.date < day) } catch { isFirst = false }
-    if (isFirst) planArgs.push('--first')
+    if (!listPv(d.out, d.legacyDirs || d.legacy || d.out).some((v) => v.date < day)) planArgs.push('--first')
     if (opt.voice) planArgs.push('--voice', String(opt.voice))
     const gsv = gsvOf()
     if (gsv) {
       planArgs.push('--gsv-repo', gsv.gsvRepo, '--gsv-ref', gsv.gsvRef, '--gsv-prompt', gsv.gsvPrompt)
       if (gsv.gsvPython) planArgs.push('--gsv-python', gsv.gsvPython)
-      append(logFile, `🎙 音色：GPT-SoVITS（参考 ${gsv.gsvRef}）\n`)
-    }
-
-    const planRun = repairOnly && existsSync(plan) ? Promise.resolve(0) : run(py, planArgs, logFile, j)
-    planRun
-      .then((planCode) => {
-        if (j.killed) return null
-        if (planCode !== 0) throw new Error(`出分镜失败（exit ${planCode}），看日志 ${logFile}`)
-        j.stage = 'cover'
-        append(logFile, repairOnly ? '\n只补缺失封面，不重做配音或视频。\n' : '\n生成两种比例封面。\n')
-        const coverArgs = [sc.cover, '--plan', plan, '--outdir', coverOut]
-        if (repairOnly) coverArgs.push('--only-missing')
-        return run(py, coverArgs, logFile, j)
-      })
-      .then((coverCode) => {
-        if (j.killed || coverCode === null) return null
-        if (coverCode !== 0) throw new Error(`封面生成失败（exit ${coverCode}），看日志 ${logFile}`)
-        for (const [ratio, name] of Object.entries(COVER_NAMES)) {
-          if (!validCover(join(coverOut, name), ratio)) throw new Error(`封面缺失或尺寸不正确：${join(coverOut, name)}`)
-        }
-        if (repairOnly) {
-          if (!existsSync(final) && existsSync(current)) {
-            const ready = `${final}.ready.mp4`
-            try { copyFileSync(current, ready); renameSync(ready, final) }
-            catch (e) { rmSync(ready, { force: true }); throw new Error(`旧成片归档失败（原文件仍保留）：${e?.message ?? e}`) }
-          }
-          copyReport(day, targetDir, logFile)
-          j.stage = 'done'
-          j.file = final
-          append(logFile, `\n封面已补齐：${targetDir}\n`)
-          say(`🎬 ${day} 的封面已补齐：${targetDir}`)
-          return null
-        }
-        j.stage = 'render'
-        say(`🎬 ${day} 封面就绪，开始渲染视频`)
-        return run(py, [sc.render, '--plan', plan, '--out', tmp, '--work', join(d.work, `_w${day.replace(/-/g, '')}`)], logFile, j)
-      })
-      .then((renderCode) => {
-        if (j.killed || renderCode === null || repairOnly) return
-        if (renderCode !== 0) throw new Error(`渲染失败（exit ${renderCode}），看日志 ${logFile}`)
-        if (statSync(tmp).size < 1024) throw new Error('输出文件为空或不完整')
-        commitOutputs(tmp, stageDir, final, day, d.out)
-        copyReport(day, targetDir, logFile)
-        j.stage = 'done'
-        j.file = final
-        append(logFile, `\n✅ ${final}\n`)
-        say(`🎬 ${day} 的视频做好了：${final}`)
-      })
-      .catch((e) => {
-        j.stage = 'failed'
-        j.error = String(e?.message ?? e)
-        append(logFile, `\n❌ ${j.error}\n`)
-        say(`🎬 ${day} 的视频失败：${j.error}`)
-      })
-      .finally(() => {
-        j.proc = null
-        if (!repairOnly) { try { rmSync(stageDir, { recursive: true, force: true }) } catch { /* staging cleanup */ } }
-        const t = setTimeout(() => { if (job === j) job = null }, 30_000)
-        t.unref?.()
-      })
-
-    return {
-      ok: true, started: true, repairing: repairOnly, date: day, file: final, log: logFile, work: d.work,
-      hint: repairOnly ? '正在只补两种比例的封面，不会重做视频或配音。' : '做好了我会写日志；进度用 bili_pv({action:"status"}) 或桌宠 ⚙️ 设置 →「视频 · 模型」里的「做视频」看（一条 2–6 分钟）',
     }
+    execute(j, async () => {
+      const previousPlan = [join(targetDir, 'plan.json'), join(d.work, `plan_${day}.json`)].find((file) => existsSync(file))
+      if (repairOnly && previousPlan) copyFileSync(previousPlan, plan)
+      else {
+        const code = await run(py, planArgs, j)
+        alive(j)
+        requireExit(code, '出分镜失败')
+      }
+      await covers(j, sc, py, repairOnly ? targetDir : packageDir, repairOnly)
+      alive(j)
+      if (repairOnly) {
+        if (!usableVideo(j.file) && usableVideo(current)) commitOutputs([{ source: current, target: j.file }])
+        copyReport(day, targetDir, j.log)
+        append(j.log, '\n仅补封面：原成片未重新校验；不据此声称旧影片通过验证。\n')
+        done(j)
+        return
+      }
+      await renderVerify(j, sc, py)
+      alive(j)
+      const names = ['plan.json', 'timeline.json', 'verification.json', ...Object.values(COVER_NAMES)]
+      commitOutputs([{ source: j.tmp, target: j.file }, ...names.map((name) => ({ source: join(packageDir, name), target: join(targetDir, name) }))])
+      copyReport(day, targetDir, j.log)
+      done(j)
+      // The completed, validated package retains its provenance and build log beside the film.
+      copyFileSync(j.log, join(targetDir, 'build.log'))
+      copyFileSync(j.metadata, join(targetDir, 'job.json'))
+    })
+    say(repairOnly ? `🎬 ${day} 已有成片，只补封面（不重新校验旧影片）` : `🎬 开始做 ${day} 的视频`)
+    return { ok: true, started: true, repairing: repairOnly, verificationSkipped: repairOnly, date: day, file: j.file,
+      log: j.log, work: runDir, plan, timeline: j.timeline, verification: j.verification,
+      hint: repairOnly ? '只补两种比例封面；已有影片未重新校验。' : '正在制作；渲染后必须通过音视频校验才会替换正式成片。' }
   }
 
+  /** Start an authored production immediately; options are trusted host configuration. */
+  const render = (production, opt = {}) => {
+    if (busy()) return busyError()
+    let plan
+    try { plan = normalizeProduction(production, { date: opt.date, voice: opt.voice, gsv: opt.gsv === undefined ? gsvOf() : opt.gsv }) }
+    catch (e) { return { ok: false, error: String(e?.message ?? e) } }
+    const sc = scripts()
+    const check = setupCheck(sc, ['cover', 'render', 'verify'])
+    if (!check.ok) return check
+    const d = dirs()
+    const id = `${plan.date.replace(/-/g, '')}-${randomUUID()}`
+    const studio = join(d.out, 'studio')
+    const path = join(studio, id)
+    try {
+      mkdirSync(studio, { recursive: true })
+      if (lstatSync(studio).isSymbolicLink()) throw new Error('studio 不能是符号链接或目录联接')
+      mkdirSync(path) // Exclusive UUID folder: never reuse or overwrite another output.
+    } catch (e) { return { ok: false, error: `建制作目录失败：${e?.message ?? e}` } }
+    const renderWork = join(path, 'media')
+    const j = { id, date: plan.date, stage: 'cover', startedAt: new Date().toISOString(), t0: Date.now(),
+      out: join(path, 'video.mp4'), file: join(path, 'video.mp4'), log: join(path, 'build.log'), plan: join(path, 'plan.json'),
+      timeline: join(path, 'timeline.json'), verification: join(path, 'verification.json'), metadata: join(path, 'production.json'),
+      packageDir: path, renderWork, renderTimeline: join(renderWork, 'timeline.json'), tmp: join(path, 'video.partial.mp4'),
+      proc: null, killed: false, repairOnly: false, targetDurationSec: plan.targetDurationSec, maxDurationSec: plan.maxDurationSec }
+    j.production = { id, mode: plan.mode, title: plan.title, date: plan.date, path, metadata: j.metadata,
+      file: j.file, plan: j.plan, timeline: j.timeline, log: j.log, verification: j.verification, startedAt: j.startedAt,
+      targetDurationSec: plan.targetDurationSec, maxDurationSec: plan.maxDurationSec, estimatedDurationSec: plan.estimatedDurationSec }
+    try {
+      atomicJson(j.plan, plan)
+      append(j.log, `=== studio ${id} · ${plan.mode} · ${plan.title} ===\n`)
+      persist(j)
+    } catch (e) { return { ok: false, error: `制作计划写入失败：${e?.message ?? e}` } }
+    execute(j, async () => {
+      await covers(j, sc, check.py, path)
+      await renderVerify(j, sc, check.py)
+      alive(j)
+      renameSync(j.tmp, j.file)
+      try { done(j) }
+      catch (e) {
+        // Failed metadata commit cannot leave a publicly named successful movie.
+        renameSync(j.file, j.tmp)
+        throw e
+      }
+    })
+    say(`🎬 制作会话交来的《${plan.title}》开始渲染`)
+    return { ok: true, started: true, id, date: plan.date, stage: j.stage, production: productionOf(j), file: j.file,
+      log: j.log, work: path, plan: j.plan, timeline: j.timeline, verification: j.verification,
+      hint: '已接收完整原创分镜；封面、渲染、实测校验完成后才会出现在成片列表。' }
+  }
   const stop = () => {
-    if (!job) return { ok: true, stopped: false, hint: '现在没有在做视频' }
+    if (!job || !busy()) return { ok: true, stopped: false, hint: '现在没有在做视频' }
     const j = job
-    j.killed = true
-    try { j.proc?.kill('SIGKILL') } catch { /* 已经没了 */ }
-    append(j.log, '\n--- 手动停下 ---\n')
-    j.stage = 'stopped'
-    const day = j.date
-    // ⚠️ 必须在 5 秒后才清 —— 不然 stop 刚返回，界面下一次轮询就看不到「停下了」这件事
-    const t = setTimeout(() => { if (job === j && !j.proc) job = null }, 5_000)
-    t.unref?.()
-    say(`🎬 ${day} 的视频手动停了`)
-    return { ok: true, stopped: true, date: day }
+    cancel(j)
+    say(`🎬 ${j.date} 的视频手动停了`)
+    return { ok: true, stopped: true, date: j.date, id: j.id || '', stage: j.stage,
+      stopping: Boolean(j.active || j.proc || j.killProc), production: productionOf(j) }
   }
-
   return {
-    status, start, stop, checkDeps, checkCoverDeps,
-    needsCoverRepair: (date) => isCoverRepair(date),
-    needsWork: (date) => needsWork(date),
+    status, start, render, stop, checkDeps, checkCoverDeps, productions, onSettled,
+    productionFileOf: (id) => productionRow(dirs().out, id)?.file || '',
+    needsCoverRepair: (date) => isCoverRepair(date), needsWork,
     list: () => { const d = dirs(); return listPv(d.out, d.legacyDirs || d.legacy || d.out) },
     paths: () => dirs(),
     fileOf: (date) => { const d = dirs(); return pvFileOf(d.out, date, d.legacyDirs || d.legacy || d.out) },
-    /** 🎙 现在用的是什么音色（设置页要显示「真·本鱼原声」还是「edge-tts 顶班」） */
-    voiceMode: () => {
-      const g = gsvOf()
-      return g ? { mode: 'gsv', repo: g.gsvRepo, ref: g.gsvRef } : { mode: 'edge' }
-    },
+    voiceMode: () => { const g = gsvOf(); return g ? { mode: 'gsv', repo: g.gsvRepo, ref: g.gsvRef } : { mode: 'edge' } },
   }
 }