dsh-deepmoyu 2.7.1 → 2.8.0

package/lib/pv.py

@@ -56,18 +56,27 @@ FONT_DIR = Path(os.environ.get("WINDIR", r"C:\Windows")) / "Fonts"
 
 @lru_cache(maxsize=96)
 def _font(name: str, size: int) -> ImageFont.FreeTypeFont:
-    """按粗/细挑字体；找不到就退到雅黑，再不行退 PIL 默认。
+    """按粗/细挑字体，兼容 Windows、macOS 与 Linux 的中文字体。
 
     字体对象很贵（每次 truetype 都要读一遍表），逐帧调用必须缓存。
     """
-    for cand in (name, "msyh.ttc", "msyhbd.ttc", "simhei.ttf"):
-        p = FONT_DIR / cand
+    directories = [FONT_DIR, Path.home() / "Library/Fonts",
+                   Path("/System/Library/Fonts"), Path("/System/Library/Fonts/Supplemental"),
+                   Path("/Library/Fonts"), Path("/usr/share/fonts/opentype/noto"),
+                   Path("/usr/share/fonts/truetype/noto"), Path.home() / ".local/share/fonts"]
+    if os.environ.get("DEEPMOYU_FONT_DIR"):
+        directories.insert(0, Path(os.environ["DEEPMOYU_FONT_DIR"]))
+    bold = "bd" in name.lower() or "bold" in name.lower()
+    names = (name, "msyhbd.ttc" if bold else "msyh.ttc", "msyhbd.ttc", "simhei.ttf",
+             "NotoSansSC-VF.ttf", "NotoSansCJK-Bold.ttc" if bold else "NotoSansCJK-Regular.ttc",
+             "PingFang.ttc", "STHeiti Medium.ttc", "Arial Unicode.ttf")
+    for p in (directory / cand for directory in directories for cand in names):
         if p.exists():
             try:
                 return ImageFont.truetype(str(p), size)
             except Exception:
                 continue
-    return ImageFont.load_default()
+    return ImageFont.load_default(size=size)
 
 
 def F(size: int, bold: bool = False) -> ImageFont.FreeTypeFont:
@@ -81,15 +90,20 @@ NOTO_SERIF = FONT_DIR / "NotoSerifSC-VF.ttf"
 @lru_cache(maxsize=96)
 def NF(size: int, weight: str = "Medium") -> ImageFont.FreeTypeFont:
     """思源黑体（可变字重）。屏幕小字比雅黑清楚，字幕正文用它。"""
-    try:
-        f = ImageFont.truetype(str(NOTO_SANS), size)
+    candidates = [NOTO_SANS]
+    if os.environ.get("DEEPMOYU_FONT_DIR"):
+        candidates.insert(0, Path(os.environ["DEEPMOYU_FONT_DIR"]) / "NotoSansSC-VF.ttf")
+    for candidate in candidates:
         try:
-            f.set_variation_by_name(weight)
-        except Exception:
-            pass
-        return f
-    except Exception:
-        return F(size, bold=weight in ("Medium", "Bold", "Black"))
+            f = ImageFont.truetype(str(candidate), size)
+            try:
+                f.set_variation_by_name(weight)
+            except Exception:
+                pass
+            return f
+        except OSError:
+            continue
+    return F(size, bold=weight in ("Medium", "Bold", "Black"))
 
 
 def clamp(v, a, b):
@@ -720,7 +734,14 @@ def ffmpeg_exe():
         import imageio_ffmpeg
         return imageio_ffmpeg.get_ffmpeg_exe()
     except Exception:
-        return shutil.which("ffmpeg") or "ffmpeg"
+        pass
+    found = shutil.which("ffmpeg")
+    if not found:
+        # P3-35: 裸 FileNotFoundError 排不了障 —— 报错带安装指引
+        raise RuntimeError(
+            "找不到 ffmpeg —— imageio_ffmpeg 会随渲染依赖自动安装（uv/pip 装依赖时带上），"
+            "或手动安装 ffmpeg 并加入 PATH 后重试")
+    return found
 
 
 def gsv_batch(texts, out_dir: Path, voice: dict, log=print):
@@ -763,6 +784,20 @@ def gsv_batch(texts, out_dir: Path, voice: dict, log=print):
            "--top-p", str(voice.get("gsvTopP", 0.9)),
            "--temp", str(voice.get("gsvTemp", 0.75)),
            "--repetition-penalty", str(voice.get("gsvRepPen", 1.3))]
+    # P2-11: gsvPython 漏配时会落到渲染 venv（sys.executable）—— 它没有 torch/soundfile，
+    #   子进程必死在 _patch_torchaudio 的 ModuleNotFoundError 上且报错不指向根因。
+    #   启动前先用同一个解释器跑一次 import 预检（首次冷盘导入也可能要十几秒，给 120s）。
+    try:
+        probe = subprocess.run([py, "-c", "import torch, soundfile"], capture_output=True, timeout=120)
+    except (OSError, subprocess.TimeoutExpired) as exc:
+        raise RuntimeError(
+            f"gsvPython（{py}）预检失败（{type(exc).__name__}）——在设置页把 gsvPython "
+            "指到 GPT-SoVITS 自带的 python，或换一个能用的解释器") from exc
+    if probe.returncode != 0:
+        tail = (probe.stderr or b"").decode("utf-8", "ignore").strip().splitlines()
+        raise RuntimeError(
+            f"gsvPython（{py}）缺少 torch/soundfile（{(tail[-1] if tail else 'import 失败')}）——"
+            "在设置页把 gsvPython 指到 GPT-SoVITS 自带的 python，或在其环境里 pip install torch soundfile")
     log(f"🎙  GPT-SoVITS 批处理：{len(texts)} 句（加载模型要 30~50 秒）")
     t0 = time.time()
     # ⚠️ 必须给子进程钉死 UTF-8：它会往管道里打中文和 emoji，Windows 默认 GBK 会炸
@@ -798,7 +833,9 @@ def tts(text: str, out_mp3: Path, voice="zh-CN-XiaoyiNeural", rate="+8%", pitch=
 
         async def go():
             c = edge_tts.Communicate(text, voice, rate=rate, pitch=pitch)
-            await c.save(str(out_mp3))
+            # P2-14: 主合成路径此前没有任何超时 —— websocket 半开时 save() 永久挂起，
+            #   prepare_audio 停摆到 JS 强杀。120s 墙钟；TimeoutError 落到下面的 SAPI 兜底。
+            await asyncio.wait_for(c.save(str(out_mp3)), timeout=120)
 
         asyncio.run(go())
         # ⭐ 2026-10-26：阈值 1200→600 —— "嗯。"这种极短句的 mp3 可能不足 1200 字节，
@@ -903,6 +940,71 @@ def squeeze_silence(pcm, rate, max_gap=0.42, keep=0.30, th=450.0, edge=0.12):
     return out
 
 
+def weight_len(s) -> float:
+    """P3-27: 加权字符数 —— CJK=1、数字=0.5、拉丁字母=0.35、其他=1。
+
+    等权字符数会让「数字/英文读得快」的句子字幕切得慢（探针 F：英文估 3 倍偏差）。
+    """
+    total = 0.0
+    for ch in str(s or ""):
+        if "\u4e00" <= ch <= "\u9fff":
+            total += 1
+        elif ch.isascii() and ch.isdigit():
+            total += 0.5
+        elif ch.isascii() and ch.isalpha():
+            total += 0.35
+        else:
+            total += 1
+    return total
+
+
+def spoken_chars(text) -> float:
+    """P1-5: 有效字数（去标点/空白）：CJK 记 1，连续英文/数字串整段记 0.5。
+
+    与 bili-video/build.py 的 0.32s/字守卫同一套「字数观」——标点不占口播时长。
+    """
+    total, run = 0.0, 0
+    for ch in str(text or ""):
+        if ch.isascii() and ch.isalnum():
+            run += 1          # 连续英文/数字串攒着，断开时整段记 0.5
+            continue
+        if run:
+            total += 0.5
+            run = 0
+        if "\u4e00" <= ch <= "\u9fff":
+            total += 1
+    if run:
+        total += 0.5
+    return total
+
+
+# P1-5 上限的短句开销余量（秒）：「嗯。」这类一两个字的句子有起振/收音固定开销，
+# 纯 0.32s/字会误杀 —— build.py 只跑长句所以没这问题，插件的单句可以很短。
+GSV_TAKE_MIN_RATE = 0.15   # s/有效字，低于即截断（真机 GSV 正常 0.20~0.25）
+GSV_TAKE_MAX_RATE = 0.32   # s/字（含标点），超过即复读/拖长（与 bili-video/build.py:85-95 同口径）
+GSV_TAKE_OVERHEAD = 1.0    # 上限的固定余量
+
+
+def gsv_take_guard(index: int, text: str, dur: float) -> None:
+    """P1-5: GSV 句级时长守卫 —— 截断/复读 take 拦在渲染前，别烧几十分钟渲废片。
+
+    真机实测（bili-work 各 timeline.json）：正常 GSV ≈0.20~0.25s/有效字；
+    探针实测的截断形态是 15 字句只出 0.8s（0.053s/字），复读形态是时长成倍超上限。
+    """
+    text = str(text or "")
+    eff = spoken_chars(text)
+    raw = max(1, len(text.strip()))
+    if eff > 0 and dur < eff * GSV_TAKE_MIN_RATE:
+        raise RuntimeError(
+            f"第 {index+1} 句 GSV 音频异常偏短（疑似截断）：{dur:.2f}s / {eff:g} 有效字"
+            f"= {dur / eff:.2f}s/字（下限 {GSV_TAKE_MIN_RATE}s/字）——句首：「{text[:12]}」")
+    if dur > raw * GSV_TAKE_MAX_RATE + GSV_TAKE_OVERHEAD:
+        raise RuntimeError(
+            f"第 {index+1} 句 GSV 音频异常偏长（疑似复读）：{dur:.2f}s / {raw} 字"
+            f"= {dur / raw:.2f}s/字（上限 {GSV_TAKE_MAX_RATE}s/字，同 bili-video/build.py）"
+            f"——句首：「{text[:12]}」")
+
+
 def envelope(pcm, rate, fps):
     """把波形压成每帧一个 0~1 的响度包络（口型用）。"""
     step = rate / fps
@@ -1962,17 +2064,40 @@ def split_sentences(text, maxlen=18):
 
     用户说「字幕对不上」⇒ 根因是字幕显示的是摘要、语音念的是全文。
     现在一句话一个镜头、字幕就是这句原话，字幕自然对得上。
+
+    ⭐ P3-26（2026-11-12 审计）：连续省略号（……）合并成一个边界，不再逐字切出
+    孤立「…」碎句；句末标点后紧跟闭引号（」』"'）时不当断句 —— 引号里的
+    「你好。」是引语的一部分，句子续到真正的结尾（探针 A 实测）。
     """
     text = str(text or "").strip()
     if not text:
         return []
+    closing = "」』\"'"
     # 先按句末标点切
     parts, buf = [], ""
-    for ch in text:
+    i, n = 0, len(text)
+    while i < n:
+        ch = text[i]
         buf += ch
+        if ch == "…":
+            # 连续省略号（……）并成一个边界单位
+            while i + 1 < n and text[i + 1] == "…":
+                i += 1
+                buf += "…"
         if ch in "。！？…；!?;":
-            parts.append(buf)
-            buf = ""
+            j = i + 1
+            while j < n and text[j] in closing:
+                j += 1
+            if j > i + 1 and j < n:
+                # 句末标点后紧跟闭引号且后面还有正文 ⇒ 引语内标点，不断句，引号吸进本句
+                buf += text[i + 1:j]
+                i = j
+                continue
+            # 有实词才落句：开头就是省略号（buf 只剩标点）时不切出孤立「…」碎句
+            if buf.strip(closing + "。！？…；!?;，,、：: \u3000\t"):
+                parts.append(buf)
+                buf = ""
+        i += 1
     if buf.strip():
         parts.append(buf)
     out = []
@@ -1996,11 +2121,11 @@ def split_sentences(text, maxlen=18):
     return out
 
 
-def subtitle(img, text, t, dur, words):
+def subtitle(img, text, t, dur):
     """底部字幕：只占左栏内容列（SUB_W），永不盖到右侧的角色。
 
     ⚠️ 「字幕对不上」的根因：以前字幕显示的是整段摘要，语音念的是全文。
-    现在按句切分、按字数分配时长，字幕只显示「此刻正在念的那一句」。
+    现在按句切分、按加权字数分配时长，字幕只显示「此刻正在念的那一句」。
     浅色主题 ⇒ 白色圆角条 + 深墨字，念过的字变浅。
     """
     if not text:
@@ -2009,10 +2134,11 @@ def subtitle(img, text, t, dur, words):
     # —— 选出当前这句 ——
     sents = split_sentences(text, maxlen=22) or [text]
     if len(sents) > 1 and dur > 0:
-        total_chars = sum(max(1, len(s)) for s in sents)
+        # P3-27: 按 weight_len 分摊 —— 数字/英文读得快，等权字符数会把它们切慢
+        total_chars = sum(max(1.0, weight_len(s)) for s in sents)
         acc, cur = 0.0, sents[-1]
         for s in sents:
-            span = dur * max(1, len(s)) / total_chars
+            span = dur * max(1.0, weight_len(s)) / total_chars
             if t < acc + span:
                 cur = s
                 break
@@ -2033,13 +2159,7 @@ def subtitle(img, text, t, dur, words):
                          outline=(150, 190, 226, 175), width=2)
     paste_rgba(img, box, (x0, y0 - 14))
     done_chars = len(cur)
-    if words:
-        done_chars = 0
-        for wd in words:
-            if t * 10_000_000 >= wd["offset"]:
-                done_chars = min(len(cur), done_chars + len(wd["text"]))
-            else:
-                break
+    # 2026-11-12 审计移除：words 逐字卡拉OK高亮是无生产者的死路径，且 100ns ticks 单位无文档
     idx = 0
     for i, ln in enumerate(lines):
         yy = y0 + i * lh
@@ -2232,6 +2352,12 @@ def prepare_audio(shots, base_voice, work, fps):
                         pass
             pcm,rate = to_wav(source,wav_path)
             if engine == "gsv":
+                # P2-10: 全静音/近静音的 take 要拦在合成后 —— 以前一路渲完整片才在 verify
+                #   报「缺少有效对白或口型帧」，不指向根因句，白烧几十分钟。
+                _rms = math.sqrt(sum(v * v for v in pcm) / max(1, len(pcm))) if pcm else 0.0
+                if _rms < 100.0:   # 16bit 满幅 32767；正常语音 RMS 在千级
+                    raise RuntimeError(
+                        f"第 {index+1} 句 GSV 输出为静音（RMS {_rms:.0f} < 100）——句首：「{text[:12]}」")
                 # ⭐ 2026-10-26：把 squeeze_silence 真正接上 —— 这个函数当初就是为
                 #   「GPT-SoVITS 分句边界偶发几秒死寂」写的，但一直没有任何调用点。
                 #   压缩后**写回 wav_path**：timeline 的时长和最终混音（重读 wav/xx.wav）
@@ -2242,6 +2368,8 @@ def prepare_audio(shots, base_voice, work, fps):
                     w.setsampwidth(2)
                     w.setframerate(rate)
                     w.writeframes(pcm.tobytes())
+                # P1-5: 压完静音再按最终时长判 —— squeeze 能救回的（句中长死寂）不误杀
+                gsv_take_guard(index, text, len(pcm) / rate)
             dur = len(pcm) / rate
             if dur <= .02:
                 raise RuntimeError(f"第 {index+1} 句音频为空")
@@ -2293,6 +2421,12 @@ def build(plan: dict, out_path: Path, work: Path, fps=FPS, scale=1.0, still=None
         raise ValueError("fps must be 1..60; scale must be 0.1..2")
     t_start = time.time()
     shots = plan["shots"]
+    # P2-13: 含空文本镜头的 plan 会把整片渲完才在 verify 必挂 —— 开头就拦，报错指向第几镜
+    for _i, _shot in enumerate(shots):
+        if not str((_shot or {}).get("text") or "").strip():
+            raise ValueError(
+                f"第 {_i+1} 镜（id={(_shot or {}).get('id', '?')}）没有台词"
+                "——纯视觉镜头暂不支持，给它一句旁白或删掉")
     # Editorial v2 and dialogue plans use the 1080p stage. Legacy cards remain 720p.
     editorial_plan = plan.get("schema") == "deepmoyu-editorial-v2"
     editorial_renderer = None
@@ -2381,7 +2515,8 @@ def build(plan: dict, out_path: Path, work: Path, fps=FPS, scale=1.0, still=None
         elif shot.get("kind") == "dialogue":
             frame = dialogue_subtitle(frame,shot,active,max(0,local))
         else:
-            frame = subtitle(frame,str(shot.get("text","")),max(0,local),duration,shot.get("words"))
+            # 2026-11-12 审计移除：words 字段读取随卡拉OK死路径一并删掉（无生产者）
+            frame = subtitle(frame,str(shot.get("text","")),max(0,local),duration)
             if frame.size != (NAT_W,NAT_H):
                 frame = frame.resize((NAT_W,NAT_H),Image.Resampling.LANCZOS)
         if (W2,H2) != (NAT_W,NAT_H):
@@ -2481,7 +2616,10 @@ def build(plan: dict, out_path: Path, work: Path, fps=FPS, scale=1.0, still=None
                         frame = Image.blend(prev, frame, amount)
             # 片头片尾各 600ms 淡入淡出（像一段真正剪过的短片，而不是突然开始）
             if dialogue_plan:
-                head = clamp(tnow / .60, 0, 1)
+                # P3-34: 淡入 0.60s 会盖过 0.18s lead 的开头语音（开头两个字有声音没画面）
+                #   —— 淡入时长不得超过 lead；lead=0 时直接不做淡入（避免除零）。
+                fade_in = min(.60, lead) if lead > 0 else 0.0
+                head = 1.0 if fade_in <= 0 else clamp(tnow / fade_in, 0, 1)
                 tailf = clamp((total - tnow) / .60, 0, 1)
                 alpha = min(head, tailf)
                 if alpha < 1:

package/lib/pv_cover.py

@@ -16,11 +16,20 @@ import argparse
 import json
 import os
 import re
+import sys
 from pathlib import Path
 from typing import Any
 
 from PIL import Image, ImageDraw, ImageFilter
 
+# P3-31: Windows 管道默认 GBK —— 中文日志会乱码甚至把 print 打挂，先钉 UTF-8
+#（写法照 lib/pv.py:41-46）
+for _stream in (sys.stdout, sys.stderr):
+    try:
+        _stream.reconfigure(encoding="utf-8", errors="replace")
+    except Exception:
+        pass
+
 try:  # Loaded as a top-level module by the CLI and tests.
     from pv import F, NF, Fish, Portrait, bg_ocean
 except ImportError:  # pragma: no cover - package import fallback
@@ -436,7 +445,8 @@ def main() -> int:
             if drawn != title:
                 print(f"  {ratio} 排不下全文，封面用：{drawn}", flush=True)
         return 0
-    except (OSError, ValueError, TypeError, json.JSONDecodeError, RuntimeError) as exc:
+    except (OSError, ValueError, TypeError, KeyError, json.JSONDecodeError, RuntimeError) as exc:
+        # P3-29: KeyError 补进兜底 —— plan 带未知 theme 时给一行人话，不再裸 traceback
         parser.exit(1, f"封面生成失败：{exc}\n")
 
 

package/lib/pv_editorial.py

@@ -16,9 +16,10 @@ from PIL import Image, ImageDraw, ImageFont
 try:
     # pv imports this module lazily during build, so the shared portrait driver
     # is available without creating a second character implementation.
-    from pv import Portrait, Fish, DialoguePortrait
+    from pv import Portrait, Fish, DialoguePortrait, _font as shared_font
 except ImportError:  # pragma: no cover - standalone renderer smoke tests
     Portrait = Fish = DialoguePortrait = None
+    shared_font = None
 
 WIDTH, HEIGHT = 1920, 1080
 # Keep the three persisted names, but make them bright editorial directions rather
@@ -33,6 +34,8 @@ THEMES = {
 
 @lru_cache(maxsize=128)
 def font(size, serif=False):
+    if shared_font is not None:
+        return shared_font("NotoSerifSC-VF.ttf" if serif else "NotoSansSC-VF.ttf", size)
     directory = Path(os.environ.get("WINDIR", r"C:\Windows")) / "Fonts"
     names = ("NotoSerifSC-VF.ttf", "simhei.ttf", "msyhbd.ttc") if serif else ("NotoSansSC-VF.ttf", "msyhbd.ttc", "simhei.ttf")
     candidates = [directory / name for name in names]
@@ -42,7 +45,7 @@ def font(size, serif=False):
             return ImageFont.truetype(str(candidate), size)
         except OSError:
             pass
-    return ImageFont.load_default()
+    return ImageFont.load_default(size=size)
 
 
 def ease(value):
@@ -173,14 +176,32 @@ def caption_parts(text, limit=23):
     return parts
 
 
+def weight_len(s) -> float:
+    """P3-27: 加权字符数（CJK=1、数字=0.5、拉丁字母=0.35、其他=1）—— 与 lib/pv.py 同款。
+
+    等权字符数会让「数字/英文读得快」的短语字幕切得慢（探针 F：英文估 3 倍偏差）。
+    """
+    total = 0.0
+    for ch in str(s or ""):
+        if "\u4e00" <= ch <= "\u9fff":
+            total += 1
+        elif ch.isascii() and ch.isdigit():
+            total += 0.5
+        elif ch.isascii() and ch.isalpha():
+            total += 0.35
+        else:
+            total += 1
+    return total
+
+
 def active_caption(text, t, duration):
     """Phrase timing is proportional within the measured utterance, not ASR."""
     if not text or not 0 <= t < duration:
         return ""
     parts = caption_parts(text)
-    position = t / max(.01, duration) * sum(len(part) for part in parts)
+    position = t / max(.01, duration) * sum(max(1.0, weight_len(part)) for part in parts)
     for part in parts:
-        position -= len(part)
+        position -= max(1.0, weight_len(part))
         if position < 0:
             return part
     return parts[-1]
@@ -232,6 +253,9 @@ def place_host(image, draw, state, t, colors, compact=False):
 
 def render(shot, t, duration, state):
     theme = state.get("theme", "paper")
+    if theme not in THEMES:
+        # P3-29: 未知 theme 直接 KeyError 裸崩（探针 I）—— 回退 paper，渲染继续而不是渲到一半炸
+        theme = "paper"
     colors = THEMES[theme]
     image = backdrop(theme).copy().convert("RGBA")
     draw = ImageDraw.Draw(image)

package/lib/pv_plan.py

@@ -256,9 +256,27 @@ CLOSING_LINES = ("所以，这碗白米饭终于能吃了？",      # ⚠️ 收
                  "等本鱼把笔记放好。饭要趁热，脑袋也要开工。")  # auto_plan 各出现一次，改时两处同步
 
 
+def weight_len(s) -> float:
+    """P3-27: 加权字符数（CJK=1、数字=0.5、拉丁字母=0.35、其他=1）—— 与 lib/pv.py 同款。
+
+    等权 len() 会给英文/数字多的镜头多算时长（它们读得快），规划预算随之虚高。
+    """
+    total = 0.0
+    for ch in str(s or ""):
+        if "\u4e00" <= ch <= "\u9fff":
+            total += 1
+        elif ch.isascii() and ch.isdigit():
+            total += 0.5
+        elif ch.isascii() and ch.isalpha():
+            total += 0.35
+        else:
+            total += 1
+    return total
+
+
 def est_dur(shot: dict) -> float:
-    """单镜时长估算：max(2.0, 字数/3.8) + 0.35。"""
-    return max(MIN_SHOT_SPEECH, len(str(shot.get("text") or "")) / SPEECH_RATE) + SHOT_OVERHEAD
+    """单镜时长估算：max(2.0, 加权字数/4.4) + 0.35。"""
+    return max(MIN_SHOT_SPEECH, weight_len(str(shot.get("text") or "")) / SPEECH_RATE) + SHOT_OVERHEAD
 
 
 def plan_seconds(shots: list) -> float:

package/lib/pv_verify.py

@@ -11,11 +11,19 @@ import json
 import math
 import subprocess
 import sys
+import time
 from pathlib import Path
 
 import imageio_ffmpeg
 from PIL import Image
 
+# P3-31: Windows 管道默认 GBK —— 错误 JSON 里的中文会乱码，先钉 UTF-8（写法照 lib/pv.py:41-46）
+for _stream in (sys.stdout, sys.stderr):
+    try:
+        _stream.reconfigure(encoding="utf-8", errors="replace")
+    except Exception:
+        pass
+
 
 def _probe(video: Path) -> tuple[dict, int]:
     # imageio-ffmpeg bundles ffmpeg, not ffprobe. Decode without frame duplication
@@ -24,10 +32,16 @@ def _probe(video: Path) -> tuple[dict, int]:
     reader = imageio_ffmpeg.read_frames(
         str(video), pix_fmt="rgb24", input_params=["-xerror"], output_params=["-vsync", "0"]
     )
+    started = time.monotonic()
     try:
         metadata = next(reader)
         for _ in reader:
             frame_count += 1
+            if frame_count % 500 == 0 and time.monotonic() - started > 90.0:
+                # P3-30: 全帧解码没有看门狗会挂到 JS 任务级强杀（对照 _decode_frames 的 120s）
+                raise TimeoutError  # 哨兵：下面的分支原样转成带上下文的 TimeoutError
+    except TimeoutError:
+        raise TimeoutError(f"视频解码超时（>90s，已解 {frame_count} 帧）：{video.name}") from None
     except Exception as exc:
         raise ValueError(f"视频无法完整解码：{str(exc)[-300:]}") from exc
     finally:

package/lib/session-continuation.mjs

@@ -0,0 +1,47 @@
+/** Pure decision for resuming a truncated owned browsing turn; never resumes a host goal itself. */
+export const MAX_CONSECUTIVE_TRUNCATIONS = 2
+const finite = value => typeof value === 'number' && Number.isFinite(value)
+const count = value => Number.isSafeInteger(value) && value >= 0 ? value : 0
+
+/**
+ * `madeProgress` means an observed successful browsing tool result, never model narration.
+ * The caller captures a real turn identity and rechecks current ownership/intervention before resume().
+ * Budget values are cumulative for this run; unknown usage cannot authorize extra budgeted work.
+ */
+export function sessionContinuationDecision({ goal, run, selected, endReason, turnId,
+  madeProgress = false, intervened = false, state, now = Date.now() } = {}) {
+  const previous = {
+    lastTurn: typeof state?.lastTurn === 'string' ? state.lastTurn : '',
+    consecutiveTruncations: count(state?.consecutiveTruncations),
+  }
+  const turn = typeof turnId === 'string' && turnId ? turnId
+    : Number.isSafeInteger(turnId) && turnId >= 0 ? String(turnId) : ''
+  const result = (reason, next = previous, recover = false) => ({ recover, reason, state: next })
+  if (!turn) return result('turn-unknown')
+  if (previous.lastTurn === turn) return result('already-handled')
+  const consecutive = endReason === 'completed' && madeProgress === true ? 0 : previous.consecutiveTruncations
+  const next = { lastTurn: turn, consecutiveTruncations: consecutive + (endReason === 'max-tokens' ? 1 : 0) }
+  if (endReason !== 'max-tokens') return result(endReason === 'completed' ? 'completed' : 'turn-not-truncated', next)
+  if (selected !== true) return result('mode-exit', next)
+  if (!goal || !run || typeof run.goalId !== 'string' || !run.goalId || goal.id !== run.goalId) return result('goal-not-owned', next)
+  if (run.stoppedAt || intervened === true) return result('interrupted', next)
+  if (madeProgress !== true) return result('no-progress', next)
+  if (goal.phase !== 'active' || goal.activation !== 'disarmed') return result('goal-not-disarmed', next)
+  if (!Number.isSafeInteger(goal.roundsStarted) || !Number.isSafeInteger(goal.maxGoalRounds)
+    || goal.roundsStarted < 0 || goal.maxGoalRounds < 1 || goal.roundsStarted >= goal.maxGoalRounds) return result('round-limit', next)
+  if (!finite(now) || (run.deadlineAt && (!finite(run.deadlineAt) || now >= run.deadlineAt))) return result('time-limit', next)
+  for (const [budgetKey, usageKey, reason] of [
+    ['tokenBudget', 'tokensUsed', 'token-budget'],
+    ['totalTokenBudget', 'totalTokensUsed', 'total-budget'],
+  ]) {
+    const budget = run[budgetKey]
+    if (budget !== undefined && (!finite(budget) || budget < 0)) return result('budget-invalid', next)
+    if (budget > 0) {
+      const used = run[usageKey]
+      if (!finite(used) || used < 0) return result('usage-unknown', next)
+      if (used >= budget) return result(reason, next)
+    }
+  }
+  if (next.consecutiveTruncations > MAX_CONSECUTIVE_TRUNCATIONS) return result('truncation-limit', next)
+  return result('max-tokens', next, true)
+}

package/lib/state.mjs

@@ -79,11 +79,15 @@ export function ensureHomeFiles(pluginDir, stateDir, log = () => {}) {
     [join(pluginDir, 'vendor', 'bilibili-mcp', 'runtime_guard.py'), join(stateDir, 'runtime_guard.py'), true],
     [join(pluginDir, 'lib', 'asr.py'), join(stateDir, 'asr.py'), true],
     [join(pluginDir, 'lib', 'favops.py'), join(stateDir, 'favops.py'), true],
-    // 🎬 「昨日冲浪报告」视频（2026-10-22）：pv.mjs 起的是**家目录**那两个脚本，
-    //    所以它们必须跟 mcp_server.py 一样铺过来；不铺 ⇒ 家目录没有、渲染直接报「脚本没铺好」。
+    // 🎬 「昨日冲浪报告」视频（2026-10-22）：pv.mjs 优先起插件 lib 下的脚本，家目录副本是
+    //    pluginDir/lib 不可用时的回退 —— 回退形态也要能独立跑全。审计 P3-21（2026-11-12）
+    //    补齐 pv_verify.py / pv_editorial.py：pv.py 渲染中段 `import pv_editorial`，verify 阶段
+    //    独立跑 pv_verify.py —— 这两个以前没铺，回退部署会在 plan/cover 都跑完之后才崩。
     [join(pluginDir, 'lib', 'pv.py'), join(stateDir, 'pv.py'), true],
     [join(pluginDir, 'lib', 'pv_plan.py'), join(stateDir, 'pv_plan.py'), true],
     [join(pluginDir, 'lib', 'pv_cover.py'), join(stateDir, 'pv_cover.py'), true],
+    [join(pluginDir, 'lib', 'pv_verify.py'), join(stateDir, 'pv_verify.py'), true],
+    [join(pluginDir, 'lib', 'pv_editorial.py'), join(stateDir, 'pv_editorial.py'), true],
     // 🎙 真·本鱼音色（2026-10-22）：pv.py 用 subprocess 调它跑 GPT-SoVITS 批量合成，
     //    同样必须在家目录里 —— 不然设置页填了音色也会报「找不到 pv_gsv.py」。
     [join(pluginDir, 'lib', 'pv_gsv.py'), join(stateDir, 'pv_gsv.py'), true],

package/lib/sticker-automation.mjs

@@ -84,7 +84,18 @@ export function createStickerAutomation({ stateDir, getConfig, now = Date.now, r
     if (veto) return { suitable: false, score: 0, description: '', tags: [], reason: veto, source: 'lexicon' }
     if (!enabled || typeof judge !== 'function') return { suitable: true, score: null, description: '', tags: [], reason: '', source: 'off' }
     try {
-      const verdict = await judge({ candidate, signal })
+      /* 审计 P2-7（2026-11-12）：20s 超时全靠 judge 内部把 signal 传播给宿主 llm——宿主
+       * 不理会 AbortSignal 时 judge 永不 settle，drain 的 active 永不释放，后续 offer 全部
+       * 静默拒绝，自动收集停摆到重启。这里加一道**独立墙钟**兜底（judge 自己的 20s + 1s 余量）：
+       * 超时按 fail-open 记 'error'，队列照常流动——与文件头的 fail-open 约定一致。 */
+      const verdict = await Promise.race([
+        Promise.resolve(judge({ candidate, signal })),
+        new Promise((resolve) => {
+          const timer = setTimeout(() => resolve(null), 21_000)
+          timer.unref?.()
+        }),
+      ])
+      if (verdict === null) return { suitable: true, score: null, description: '', tags: [], reason: '判图 21 秒无响应（宿主线路挂起），本轮 fail-open 跳过', source: 'timeout' }
       if (!verdict || typeof verdict !== 'object') return { suitable: true, score: null, description: '', tags: [], reason: '', source: 'off' }
       return { suitable: verdict.suitable !== false, score: Number.isFinite(Number(verdict.score)) ? Number(verdict.score) : null,
         description: String(verdict.description || '').slice(0, 60), tags: Array.isArray(verdict.tags) ? verdict.tags.slice(0, 4).map(String) : [],
@@ -99,8 +110,11 @@ export function createStickerAutomation({ stateDir, getConfig, now = Date.now, r
   }
   const schedule = () => {
     if (disposed || active || immediate || !queue.length) return
+    /* 审计 P3-12（2026-11-12）：unref 的 immediate 在事件循环只靠长 timer 空转时会被推迟。
+     * 修复 = **去掉 unref**：ref 的 setImmediate 在同一轮 check 相位就执行（不引入 timer 相位的
+     * 延迟，测试时序不变），并且会把事件循环拽醒——空闲进程里排队项不再被无限期搁置。
+     * stop() 的 clearImmediate 取消语义不变。 */
     immediate = setImmediate(() => { immediate = null; void drain() })
-    immediate.unref?.()
   }
   const drain = async () => {
     if (active || disposed) return

package/lib/sticker.mjs

@@ -177,7 +177,10 @@ export function snapshotStickerForSend(stateDir, input) {
         const bytes = readFileSync(info.file)
         const hash = sha256(bytes)
         // A stale ledger hash fails closed; never send bytes that changed after review.
-        if (meta.hash && meta.hash !== hash) return null
+        // 审计 P3-5（2026-11-12）：缺 hash 的历史条目以前 fail-open（同名换字节发现不了）——
+        // 现在 fail-closed，与「发送绑定已批准字节快照」一致。恢复路径：重新 collect + 过审
+        //（decideSticker 落库时必写 hash）。
+        if (meta.hash !== hash) return null
         return { name, source: 'collected', bytes: bytes.length, hash, ...makeSendSnapshot(bytes, info.fmt) }
       }
       // Builtins are read-only and always approved.