textflowkit 0.1.7__tar.gz → 0.1.8__tar.gz

{textflowkit-0.1.7 → textflowkit-0.1.8}/.github/workflows/publish-pypi.yml

@@ -149,12 +149,24 @@ jobs:
           packages-dir: dist/main/
 
   publish-github-release:
-    # Deliberately no `if:` here. The implicit `success()` plus the default skip
-    # propagation is the gate that matters: a core upload that failed or was
-    # skipped for any reason skips this job too, so a failed release cannot end
-    # in a public GitHub release. Adding a status check function here would
-    # weaken that, not strengthen it.
+    # The release exists only to advertise a core version that is on PyPI, so it
+    # runs exactly on a successful core upload and nothing else. The condition is
+    # written out rather than left implicit for the same reason as the core
+    # upload above: a status check function must defeat skip propagation. An
+    # implicit `success()` here is still subject to it, and on a reused fonts
+    # release the workflow-wide propagation from the *skipped* fonts job reaches
+    # this job through `publish-main` and its skipped fonts dependency - v0.1.7
+    # initially skipped the release even though core reached PyPI, and the
+    # recovery published it.
+    #
+    # `always()` would also defeat the propagation, but it runs the job in a
+    # cancelled run too, so it is not used. Only a `success` core upload reaches
+    # the release: a failed, skipped or cancelled core upload, a cancelled run,
+    # and a build that did not succeed all leave no public release, so the
+    # release can never advertise a core version that is not on PyPI.
     needs: publish-main
+    if: >-
+      ${{ !cancelled() && needs.publish-main.result == 'success' }}
     runs-on: ubuntu-latest
     permissions:
       contents: write

{textflowkit-0.1.7 → textflowkit-0.1.8}/CHANGELOG.md

@@ -1,5 +1,48 @@
 # Changelog
 
+## v0.1.8 — 2026-10-02
+
+The 2026-10-02 audit-lite repair release. Core version: 0.1.8; unchanged optional fonts: 0.1.6. It carries the four fixes for the post-release audit-lite of 2026-10-01 (findings AL-001 – AL-004). Release artifacts and publication status are recorded on [GitHub Releases](https://github.com/scottconverse/textflowkit/releases/tag/v0.1.8). Local source-candidate verification does not establish installed-package or individual harness compatibility.
+
+### Engineering fixes
+
+- **AL-001 — CLI owning-process startup recovery.** A CLI invocation that was
+  interrupted left its PENDING/RUNNING row active; because the CLI submits with
+  `background=False` it never started the recovering executor, so a later
+  `--resume` read the orphan as "already active" and refused a job whose expensive
+  work was saved. Recovery now runs once per owning process at the CLI's
+  process/store boundary (`cli.main`), before single or batch resume selection,
+  through the shared per-store owner. It is deliberately **not** an unconditional
+  reap in every `submit_request(background=False)`: an embedding process can hold
+  genuinely live work. A recovery write failure is reported as a clear error with
+  a nonzero exit, not a false success or a raw traceback. The documented
+  one-owning-process-per-database model is unchanged.
+- **AL-002 — preserve the completed transcript across resume setup failures.** The
+  source checkpoint serialized the local transcript (still `None`) before
+  hydrating the previous transcript, so a directory/`mkdtemp` failure replaced a
+  durable completed transcript with `null` while still listing `transcribe` as
+  finished. Reuse is now hydrated and validated **before** any directory setup,
+  and a replacement snapshot can no longer drop a still-finished transcript. A
+  changed local source is still refused, stages are never falsely marked complete,
+  and a healthy retry reuses the recognized work.
+
+### Documentation corrections
+
+- **AL-003 — MCP batch cookie capability.** The adapter guide said
+  `submit_batch_media` has no `cookies_from_browser` parameter. It does: the tool
+  accepts one shared value and forwards it to every request, and the production
+  refusal is enforced by the same shared guard as the other surfaces. The matrix
+  and paragraph (and the historical DOC-003 changelog text) were corrected, with a
+  schema-consistency regression test that reads the real SDK-generated tool schema.
+- **AL-004 — roadmap evidence.** The POSIX file-mode and fonts-reuse follow-ups
+  are marked done against their exact receipts: current-main CI run 36961982098
+  (12 OS/Python test jobs + three installed-wheel jobs + Ruff) verifies POSIX modes
+  on Linux/macOS, and release-workflow run 36961162844 built the reused 0.1.6
+  fonts, skipped the fonts upload, and published core to PyPI. The GitHub-release
+  job skip, its manual recovery, and the PR #23 condition repair are recorded
+  without claiming the original workflow was all green or the repaired automatic
+  path has been live-tested. The v0.1.7 history and version are preserved.
+
 ## v0.1.7 — 2026-10-01
 
 The 2026-10-01 audit repair release. Core version: 0.1.7; unchanged optional fonts: 0.1.6. Release artifacts and publication status are recorded on [GitHub Releases](https://github.com/scottconverse/textflowkit/releases/tag/v0.1.7). Local source-candidate verification does not establish installed-package or individual harness compatibility.
@@ -63,12 +106,17 @@ The 2026-10-01 audit repair release. Core version: 0.1.7; unchanged optional fon
   overlapping rather than clipped.
 - **DOC-003** — "same options" is replaced with a per-surface parameter matrix
   (HTTP `formats` array vs MCP comma-separated string; HTTP batch options are
-  **per item**, MCP batch options are shared and expose **no**
-  `cookies_from_browser` parameter), and the batch contract now states that 202
-  means admission, not completion, with per-item indexed errors. MCP
+  **per item**, MCP batch options are shared), and the batch contract now states
+  that 202 means admission, not completion, with per-item indexed errors. MCP
   `sources` is documented as a list of **strings**: a non-string entry (including
   a nested object or a number) is that entry's own error, not a whole-call
   refusal, while a string remains valid.
+  *Correction (2026-10-01, audit-lite AL-003):* the v0.1.7 text of this entry
+  claimed the MCP batch tool exposes **no** `cookies_from_browser` parameter.
+  That was wrong. `submit_batch_media` accepts `cookies_from_browser` and
+  forwards the one shared value to every request it builds; the production
+  refusal is enforced by the same shared guard as the other surfaces. The
+  adapter guide was corrected to match the generated tool schema.
 - **DOC-004** — a full production settings reference (names, defaults, units,
   required fields) is added to the adapter guide, and the production refusal of
   browser-cookie submissions is stated across the adapter guide, the sources
@@ -96,5 +144,6 @@ for the complete list and completion criteria. The current repair goal still
 covers decoder confinement, job lifecycle, publication/resume, translation and
 batch correctness, major terminal guidance/documentation, and its final gate.
 
-This changelog starts with the v0.1.7 release notes; published historical
+This changelog starts with the v0.1.8 release notes, followed by the v0.1.7
+release notes; published historical
 release notes remain on [GitHub Releases](https://github.com/scottconverse/textflowkit/releases).

{textflowkit-0.1.7 → textflowkit-0.1.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: textflowkit
-Version: 0.1.7
+Version: 0.1.8
 Summary: Cross-platform media transcription toolkit: URL or file in, timestamped transcripts and subtitle files out.
 Project-URL: Homepage, https://www.textflowkit.org/
 Project-URL: Issues, https://github.com/scottconverse/textflowkit/issues
@@ -64,7 +64,7 @@ Cross-platform media transcription toolkit. **One core, one CLI, thin adapters.*
 [GitHub releases](https://github.com/scottconverse/textflowkit/releases) ·
 [User manual](https://github.com/scottconverse/textflowkit/blob/main/docs/user-manual.md)
 
-**Current release: [v0.1.7](https://github.com/scottconverse/textflowkit/releases/tag/v0.1.7).**
+**Current release: [v0.1.8](https://github.com/scottconverse/textflowkit/releases/tag/v0.1.8).**
 
 The [static site deployment](https://github.com/scottconverse/textflowkit/blob/main/docs/site-deployment.md) is hosted on Cloudflare
 Pages. GitHub remains the source and CI host; the website does not run the
@@ -338,14 +338,14 @@ web frontend share the job contract without blocking a request.
 
 ## Status
 
-**v0.1.7 release.** Core, CLI, MCP, and HTTP have automated
-coverage. This release is the 2026-10-01 audit repair set — the post-v0.1.6
-review follow-ups the owner accepted on 2026-10-01: a confined decoder boundary
-for rooted local inputs, atomic job-attempt ownership with atomic worker startup
-and cancellation finalization, DOCX completed-output identity, per-request
-completed-stage reuse, an aggregate export preflight, translation completeness
-and per-item batch validation, live terminal feedback, and major documentation
-corrections. Implementation was verified on a native-Windows source candidate with real CLI, HTTP and MCP speech, seven-format exports and completed resume. Release publication uses the tag workflow, which requires successful exact-commit main CI before PyPI uploads and creates the public GitHub release only afterward. Check the linked release for artifacts and workflow status; local source verification is not a fresh PyPI-install or individual-harness receipt.
+**v0.1.8 release.** Core, CLI, MCP, and HTTP have automated
+coverage. This release carries the four fixes for the 2026-10-01 post-release
+audit-lite (findings AL-001 – AL-004): CLI owning-process startup recovery so an
+interrupted run's saved work can be resumed instead of being refused as
+"already active", preservation of the completed transcript across resume setup
+failures, a correction to the MCP batch cookie capability, and corrected roadmap
+evidence receipts. It builds on the v0.1.7 audit repair set and the v0.1.6
+review repairs that precede it. The preceding v0.1.7 source candidate was verified with real CLI, HTTP and MCP speech, seven-format exports and completed resume. The v0.1.8 runtime fixes were independently checked through fresh-process CLI restart probes, real SQLite setup-failure tests, and the full Windows test suite; those checks are not new individual-harness receipts. Release publication uses the tag workflow, which requires successful exact-commit main CI before PyPI uploads and creates the public GitHub release only afterward. Check the linked release for artifacts and workflow status; local source verification is not a fresh PyPI-install or individual-harness receipt.
 
 The v0.1.6 release was the post-v0.1.5 review repair set: security hardening
 for media acquisition and the HTTP and MCP adapters, safer subtitle wrapping and
@@ -362,9 +362,9 @@ The v0.1.6 release is public: the
 [v0.1.6 GitHub release](https://github.com/scottconverse/textflowkit/releases/tag/v0.1.6)
 and both [core](https://pypi.org/project/textflowkit/0.1.6/) and
 [fonts](https://pypi.org/project/textflowkit-fonts/0.1.6/) PyPI projects are
-live — that is the previous release's evidence, not a receipt for v0.1.7.
+live — that is the previous release's evidence, not a receipt for v0.1.8.
 Everything from here to the end of this section is the v0.1.6 release's
-historical record as published: it is not re-verified for v0.1.7, whose separate release evidence is not supplied by these historical paragraphs.
+historical record as published: it is not re-verified for v0.1.8, whose separate release evidence is not supplied by these historical paragraphs.
 Merged-main CI passed 16/16 on the tagged commit; the published wheel and
 sdist digests match the GitHub release assets and their SHA-256 list; and a fresh
 Windows Python 3.12 install of `textflowkit[export,mcp,http]==0.1.6` from PyPI

{textflowkit-0.1.7 → textflowkit-0.1.8}/README.md

@@ -7,7 +7,7 @@ Cross-platform media transcription toolkit. **One core, one CLI, thin adapters.*
 [GitHub releases](https://github.com/scottconverse/textflowkit/releases) ·
 [User manual](https://github.com/scottconverse/textflowkit/blob/main/docs/user-manual.md)
 
-**Current release: [v0.1.7](https://github.com/scottconverse/textflowkit/releases/tag/v0.1.7).**
+**Current release: [v0.1.8](https://github.com/scottconverse/textflowkit/releases/tag/v0.1.8).**
 
 The [static site deployment](https://github.com/scottconverse/textflowkit/blob/main/docs/site-deployment.md) is hosted on Cloudflare
 Pages. GitHub remains the source and CI host; the website does not run the
@@ -281,14 +281,14 @@ web frontend share the job contract without blocking a request.
 
 ## Status
 
-**v0.1.7 release.** Core, CLI, MCP, and HTTP have automated
-coverage. This release is the 2026-10-01 audit repair set — the post-v0.1.6
-review follow-ups the owner accepted on 2026-10-01: a confined decoder boundary
-for rooted local inputs, atomic job-attempt ownership with atomic worker startup
-and cancellation finalization, DOCX completed-output identity, per-request
-completed-stage reuse, an aggregate export preflight, translation completeness
-and per-item batch validation, live terminal feedback, and major documentation
-corrections. Implementation was verified on a native-Windows source candidate with real CLI, HTTP and MCP speech, seven-format exports and completed resume. Release publication uses the tag workflow, which requires successful exact-commit main CI before PyPI uploads and creates the public GitHub release only afterward. Check the linked release for artifacts and workflow status; local source verification is not a fresh PyPI-install or individual-harness receipt.
+**v0.1.8 release.** Core, CLI, MCP, and HTTP have automated
+coverage. This release carries the four fixes for the 2026-10-01 post-release
+audit-lite (findings AL-001 – AL-004): CLI owning-process startup recovery so an
+interrupted run's saved work can be resumed instead of being refused as
+"already active", preservation of the completed transcript across resume setup
+failures, a correction to the MCP batch cookie capability, and corrected roadmap
+evidence receipts. It builds on the v0.1.7 audit repair set and the v0.1.6
+review repairs that precede it. The preceding v0.1.7 source candidate was verified with real CLI, HTTP and MCP speech, seven-format exports and completed resume. The v0.1.8 runtime fixes were independently checked through fresh-process CLI restart probes, real SQLite setup-failure tests, and the full Windows test suite; those checks are not new individual-harness receipts. Release publication uses the tag workflow, which requires successful exact-commit main CI before PyPI uploads and creates the public GitHub release only afterward. Check the linked release for artifacts and workflow status; local source verification is not a fresh PyPI-install or individual-harness receipt.
 
 The v0.1.6 release was the post-v0.1.5 review repair set: security hardening
 for media acquisition and the HTTP and MCP adapters, safer subtitle wrapping and
@@ -305,9 +305,9 @@ The v0.1.6 release is public: the
 [v0.1.6 GitHub release](https://github.com/scottconverse/textflowkit/releases/tag/v0.1.6)
 and both [core](https://pypi.org/project/textflowkit/0.1.6/) and
 [fonts](https://pypi.org/project/textflowkit-fonts/0.1.6/) PyPI projects are
-live — that is the previous release's evidence, not a receipt for v0.1.7.
+live — that is the previous release's evidence, not a receipt for v0.1.8.
 Everything from here to the end of this section is the v0.1.6 release's
-historical record as published: it is not re-verified for v0.1.7, whose separate release evidence is not supplied by these historical paragraphs.
+historical record as published: it is not re-verified for v0.1.8, whose separate release evidence is not supplied by these historical paragraphs.
 Merged-main CI passed 16/16 on the tagged commit; the published wheel and
 sdist digests match the GitHub release assets and their SHA-256 list; and a fresh
 Windows Python 3.12 install of `textflowkit[export,mcp,http]==0.1.6` from PyPI

{textflowkit-0.1.7 → textflowkit-0.1.8}/docs/adapters.md

@@ -1,6 +1,6 @@
 # Adapters and integration
 
-Current published release: [v0.1.7](https://github.com/scottconverse/textflowkit/releases/tag/v0.1.7).
+Current published release: [v0.1.8](https://github.com/scottconverse/textflowkit/releases/tag/v0.1.8).
 Start with the [user manual](user-manual.md) for everyday use. Harness versions
 in the compatibility table below identify **historical test sessions**, not
 the version of TextFlowKit currently published.
@@ -105,16 +105,17 @@ HTTP batch item by hand.
 | Input | `source: string`, required | `source: string`, required | `sources: list[string]`, required |
 | `formats` | **list** of strings (e.g. `["json","srt"]`); default `json`,`srt`,`txt` | **comma-separated string** `"json,srt,txt"` | **comma-separated string** |
 | `language`, `output_dir`, `model`, `device`, `engine`, `diarize`, `translate_to` | same fields on the single item; on HTTP batch each item carries its **own** copy, applied only to that item | same | shared across all sources |
-| `cookies_from_browser` | accepted on the HTTP single `POST /jobs` and on each HTTP batch item | accepted | **not a supported parameter** - callers must not supply it |
+| `cookies_from_browser` | accepted on the HTTP single `POST /jobs` and on each HTTP batch item | accepted | accepted (shared across all sources) |
 | Resume | batch wrapper `resume: bool`; single `POST /jobs/{id}/resume` | `resume_job` tool | `resume: bool` |
 
-The MCP batch tool's `cookies_from_browser` row is the one place the surfaces
-genuinely differ: `submit_batch_media`'s signature has no such parameter, so a
-caller cannot pass browser cookies through it — only through `transcribe_media`
-or an HTTP submission. On HTTP, batch options are **per item**: each entry of
-`jobs` is a full `TranscribeRequest`, so two items can name different models or
-languages. The MCP batch tool instead takes its options **once** and applies them
-to every source.
+The `cookies_from_browser` value is accepted on every surface. On `transcribe_media`
+and `submit_batch_media` it is one shared value applied to each request the call
+builds; on HTTP it is **per item**: each entry of `jobs` is a full
+`TranscribeRequest`, so two items can name different models or languages. The MCP
+batch tool instead takes its options **once** and applies them to every source.
+Whichever surface supplies it, a cookie request is refused by the shared
+production guard when `TEXTFLOWKIT_PROFILE=production` (see the production
+settings reference below); it is honoured only in the developer/owner profile.
 
 `output_dir` omitted writes no rendered files, but a durable transcript is still
 kept: with `TEXTFLOWKIT_DB` set the transcript survives the process, so "no

{textflowkit-0.1.7 → textflowkit-0.1.8}/docs/index.html

@@ -188,7 +188,7 @@
   <main id="main">
     <div class="wrap hero">
       <div>
-        <span class="eyebrow">Open source · Apache 2.0 · v0.1.7</span>
+        <span class="eyebrow">Open source · Apache 2.0 · v0.1.8</span>
         <h1>Media in.<br><em>Useful text</em> out.</h1>
         <p class="lead">Transcribe video and audio into timestamped, searchable text. One shared core for your command line, AI harness, and application.</p>
         <div class="actions">
@@ -196,7 +196,7 @@
           <a class="button secondary" href="https://pypi.org/project/textflowkit/">Install from PyPI <span aria-hidden="true">&nbsp;↗</span></a>
         </div>
         <p class="micro">Self-hosted toolkit · Native Windows, macOS, Linux · No account required</p>
-        <p class="micro">Latest verified release: <a href="https://github.com/scottconverse/textflowkit/releases/tag/v0.1.7">v0.1.7</a> · <a href="https://github.com/scottconverse/textflowkit/blob/main/docs/user-manual.md">User manual</a></p>
+        <p class="micro">Latest verified release: <a href="https://github.com/scottconverse/textflowkit/releases/tag/v0.1.8">v0.1.8</a> · <a href="https://github.com/scottconverse/textflowkit/blob/main/docs/user-manual.md">User manual</a></p>
       </div>
       <div class="terminal" aria-label="Example transcription command and output">
         <div class="terminal-top"><span class="dot"></span><span class="dot"></span><span class="dot"></span><span class="terminal-label">textflowkit / terminal</span></div>
@@ -276,7 +276,7 @@
           <li>Find the right setup for AMD ROCm in the install guide before installing dependencies.</li>
         </ul>
         <a class="button secondary" href="https://github.com/scottconverse/textflowkit/blob/main/docs/install.md">Read install guide ↗</a>
-        <p class="note">New here? Follow the <a href="https://github.com/scottconverse/textflowkit/blob/main/docs/user-manual.md">v0.1.7 user manual</a> for CLI, MCP, HTTP, export, and troubleshooting examples.</p>
+        <p class="note">New here? Follow the <a href="https://github.com/scottconverse/textflowkit/blob/main/docs/user-manual.md">v0.1.8 user manual</a> for CLI, MCP, HTTP, export, and troubleshooting examples.</p>
       </div>
       <div>
         <pre class="codebox"><span class="prompt">$ </span>python -m pip install "textflowkit[mcp,http]"

{textflowkit-0.1.7 → textflowkit-0.1.8}/docs/install.md

@@ -1,6 +1,6 @@
 # Install notes
 
-Current release: [v0.1.7](https://github.com/scottconverse/textflowkit/releases/tag/v0.1.7).
+Current release: [v0.1.8](https://github.com/scottconverse/textflowkit/releases/tag/v0.1.8).
 Use `textflowkit --version` to confirm the installed version. For everyday
 commands and outputs, start with the [user manual](user-manual.md).
 

{textflowkit-0.1.7 → textflowkit-0.1.8}/docs/release-checklist.md

@@ -75,7 +75,7 @@ receipt. It does not upload cookies, media, or transcripts to GitHub.
 ## PyPI publication
 
 After merged-main CI and the local release checks pass, push an annotated final
-version tag (for example `v0.1.7` for a future release) on that verified
+version tag (for example `v0.1.8` for a future release) on that verified
 `main` commit. Do **not**
 create or publish a GitHub release manually. The tag push triggers
 [`publish-pypi.yml`](../.github/workflows/publish-pypi.yml). It verifies the
@@ -147,9 +147,15 @@ the version declared in `packages/textflowkit-fonts/pyproject.toml` and asks
   and the resolution reported a reuse, and it refuses to continue for a failed
   or cancelled fonts upload, a failed build, a cancelled run, or a skipped
   fonts job that was not a reuse. So a core release can never be published
-  against a fonts version that is not on PyPI. The GitHub release job has no
-  condition of its own, so a core upload that failed or was skipped leaves the
-  release uncreated.
+  against a fonts version that is not on PyPI. The GitHub release job also
+  carries its own condition, for the same reason: the skip propagation from the
+  reused fonts job reaches it through `publish-main` and its skipped fonts
+  dependency, so an implicit `success()` would suppress the release on the reuse
+  path — v0.1.7 initially skipped the release even though core reached PyPI, and
+  the recovery published it. It runs only on a `success` core upload, using a
+  status check function so the reuse path is not suppressed, while a failed,
+  skipped or cancelled core upload or a cancelled run still leaves the release
+  uncreated.
 - **Anything else stops the release before it builds or uploads.** A transient
   or 5xx answer, a response that is not JSON or has no file list, a release whose
   files are not exactly one wheel and one sdist for that version (a partial

{textflowkit-0.1.7 → textflowkit-0.1.8}/docs/roadmap.md

@@ -105,27 +105,46 @@ matched, and a fresh install passed self-test, transcription, and PDF export.
   identity, per-request completed-stage reuse, an aggregate export preflight,
   translation completeness and per-item batch validation, live terminal
   feedback, and the DOC-001 – DOC-006 documentation corrections. Implementation verification is complete; publication and its exact-commit CI are tracked by the [v0.1.7 release workflow](https://github.com/scottconverse/textflowkit/actions/workflows/publish-pypi.yml). Fonts remain 0.1.6 and are reused without republishing. Historical release evidence above remains scoped to its stated version.
-- [ ] Follow-up: normalize exported file permissions on POSIX to respect the
-  process umask. Current atomic temporary files can leave outputs mode `0600`,
-  preventing another account (such as a separate web server user) from reading
-  exported subtitles or documents. Fix and regression-test separately.
-  The mode is now measured and applied before publication, with regression
-  tests for it, but the POSIX behaviour has not been verified on a live POSIX
-  host yet, so this stays open until CI or a POSIX machine confirms it.
-- [ ] Follow-up: decouple the fonts package's version from core releases so
-  unchanged font wheels are not rebuilt/uploaded every patch. The publish
-  workflow now resolves the fonts version against PyPI before it builds: an
-  unpublished version is built and uploaded, and a published one is fetched
-  from PyPI with its recorded SHA-256 and size verified and is never rebuilt,
-  re-uploaded, or hidden behind `skip-existing`. A changed fonts package must
-  carry a new version, and the fonts upload and the core upload are conditional
-  so the reuse path still publishes the core release. See the
+- [x] Ship v0.1.8 review follow-ups: the 2026-10-01 post-release audit-lite
+  follow-ups (AL-001 – AL-004). AL-001 gives the CLI owning-process startup
+  recovery at its process/store boundary, so an interrupted job's saved work can
+  be resumed instead of being refused as "already active"; AL-002 validates and
+  rehydrates reusable work **before** publishing a checkpoint, so a resume setup
+  failure can no longer replace a durable completed transcript with an empty one;
+  AL-003 corrects the MCP batch cookie-capability documentation and its
+  schema-consistency test; AL-004 corrects roadmap evidence receipts. These are
+  the four fixes recorded for [v0.1.8](https://github.com/scottconverse/textflowkit/releases/tag/v0.1.8),
+  whose publication and exact-commit CI are tracked by the [release workflow](https://github.com/scottconverse/textflowkit/actions/workflows/publish-pypi.yml).
+  Fonts remain 0.1.6 and are reused without republishing. This entry does not
+  restate or rewrite the historical v0.1.7 achievements below, whose evidence
+  remains scoped to its stated version.
+- [x] Normalize exported file permissions on POSIX to respect the process
+  umask. The mode is measured and applied before publication, with regression
+  tests for it. The POSIX behaviour is now verified on live POSIX hosts: the
+  Linux/macOS jobs of the current-main [CI run 36961982098](https://github.com/scottconverse/textflowkit/actions/runs/36961982098)
+  run the full suite (12 OS/Python test jobs plus three installed-wheel jobs
+  and Ruff) on the audited commit, and `tests/test_export_file_mode.py` carries
+  the six umask/publication cases (Windows-only excluded). This is no longer
+  unverified.
+- [x] Decouple the fonts package's version from core releases so unchanged font
+  wheels are not rebuilt/uploaded every patch. The publish workflow resolves the
+  fonts version against PyPI before it builds: an unpublished version is built
+  and uploaded, and a published one is fetched from PyPI with its recorded
+  SHA-256 and size verified and is never rebuilt, re-uploaded, or hidden behind
+  `skip-existing`. A changed fonts package must carry a new version, and the
+  fonts upload and the core upload are conditional so the reuse path still
+  publishes the core release. See the
   [release checklist](release-checklist.md#the-fonts-version-contract-issue-15).
-  This stays open until a release actually reuses a published fonts version on
-  PyPI. v0.1.6 exercised only the new-fonts path, where 0.1.6 was not yet
-  published and both packages were built and uploaded; the reuse path is still
-  covered by deterministic tests over injected index responses, not by a live
-  tag.
+  The reuse path is now exercised by a live release: the v0.1.7 build
+  ([release workflow run 36961162844](https://github.com/scottconverse/textflowkit/actions/runs/36961162844))
+  resolved the unchanged 0.1.6 fonts for reuse, **skipped** the fonts upload,
+  and published core to PyPI successfully. One nuance stays recorded rather than
+  papered over: that same run's GitHub-release job was skipped by a transitive
+  condition, and GitHub publication was recovered manually from the original
+  verified artifacts; PR #23 repaired the condition on main, so the repaired
+  future automatic GitHub-release path has deterministic tests, **not** a second
+  live tag run. This entry does not claim the original workflow was all green, nor
+  that the repaired publication path has been live-tested.
 
 The 13 listed media platforms are recognised through `yt-dlp`; **only YouTube**
 has an opt-in [live URL transcription release gate](release-checklist.md), not

{textflowkit-0.1.7 → textflowkit-0.1.8}/docs/user-manual.md

@@ -1,4 +1,4 @@
-# TextFlowKit user manual — v0.1.7
+# TextFlowKit user manual — v0.1.8
 
 TextFlowKit turns a local audio/video file or a supported media URL into a
 timestamped transcript. It is a **self-hosted developer tool**, not a hosted
@@ -12,7 +12,7 @@ Install Python 3.10 or later and `ffmpeg`/`ffprobe` on `PATH`. For a standard
 CPU setup, install the current release from PyPI:
 
 ```bash
-python -m pip install 'textflowkit[export,mcp,http]==0.1.7'
+python -m pip install 'textflowkit[export,mcp,http]==0.1.8'
 textflowkit --version
 textflowkit doctor
 textflowkit selftest
@@ -105,6 +105,22 @@ match. Without `TEXTFLOWKIT_DB`, jobs are in memory and cannot survive a
 process restart. The job executor bounds concurrent work; consult
 [adapter and production settings](adapters.md) before running a service.
 
+The durable store assumes **one owning process per database**. A CLI invocation
+owns its store for the length of the command, so before it selects work to
+resume it recovers rows left `pending` or `running` by a process that died:
+those orphans have no worker, and without recovery a `--resume` reads them as
+"already active" and refuses a job whose expensive work was saved. Run only one
+process against a given `TEXTFLOWKIT_DB`; a second one would recover the first
+one's live jobs. A recovery write that fails stops the command with an error
+rather than continuing.
+
+Resume preserves the completed transcript. Reusable work is validated and
+rehydrated **before** any working-directory setup, so a setup failure (an
+unusable work directory, a scratch directory that cannot be created) leaves the
+previous durable checkpoint — including its finished transcript — intact for a
+later retry instead of replacing it with an empty one. A changed local source is
+still refused, and a stage is only ever listed as finished when it really is.
+
 ## 4. Export or inspect a saved transcript
 
 ```bash
@@ -244,11 +260,11 @@ See the [adapter guide](adapters.md#input-paths-unconfined-by-default) and
 
 ## 7. Release and help
 
-- [v0.1.7 GitHub release](https://github.com/scottconverse/textflowkit/releases/tag/v0.1.7)
-- [Core package 0.1.7 on PyPI](https://pypi.org/project/textflowkit/0.1.7/) and [unchanged optional font package 0.1.6](https://pypi.org/project/textflowkit-fonts/0.1.6/)
+- [v0.1.8 GitHub release](https://github.com/scottconverse/textflowkit/releases/tag/v0.1.8)
+- [Core package 0.1.8 on PyPI](https://pypi.org/project/textflowkit/0.1.8/) and [unchanged optional font package 0.1.6](https://pypi.org/project/textflowkit-fonts/0.1.6/)
 - [Release verification procedure](release-checklist.md), [security policy](../SECURITY.md), and [issues](https://github.com/scottconverse/textflowkit/issues)
 
-Local source-candidate verification covered real CLI/HTTP/MCP speech, exports and completed resume. See release artifacts and workflow results for publication evidence. The following paragraphs retain historical evidence for v0.1.6 and v0.1.5; they do not establish v0.1.7 installed-package or harness verification.
+The preceding v0.1.7 source-candidate verification covered real CLI/HTTP/MCP speech, exports and completed resume. The v0.1.8 runtime fixes were independently checked through fresh-process CLI restart probes, real SQLite setup-failure tests, and the full Windows test suite. See release artifacts and workflow results for publication evidence. The following paragraphs retain historical evidence for v0.1.6 and v0.1.5; they do not establish v0.1.8 installed-package or harness verification.
 
 The v0.1.6 release passed the Windows/Linux/macOS CI matrix on the tagged
 commit, and a fresh Windows Python 3.12 install of

{textflowkit-0.1.7 → textflowkit-0.1.8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "textflowkit"
-version = "0.1.7"
+version = "0.1.8"
 description = "Cross-platform media transcription toolkit: URL or file in, timestamped transcripts and subtitle files out."
 readme = "README.md"
 requires-python = ">=3.10"

{textflowkit-0.1.7 → textflowkit-0.1.8}/src/textflowkit/__init__.py

@@ -3,6 +3,6 @@
 from textflowkit.core.model import Segment, Transcript, WordTiming
 from textflowkit.core.pipeline import PipelineError, transcribe
 
-__version__ = "0.1.7"
+__version__ = "0.1.8"
 
 __all__ = ["PipelineError", "Segment", "Transcript", "WordTiming", "__version__", "transcribe"]

{textflowkit-0.1.7 → textflowkit-0.1.8}/src/textflowkit/cli.py

@@ -18,6 +18,7 @@ from textflowkit.core.model import Transcript
 from textflowkit.core.paths import default_input_root, output_root
 from textflowkit.core.pipeline import TranscribeResult
 from textflowkit.core.runner import transcript_for
+from textflowkit.core.startup import StartupRecoveryError, recover_startup
 from textflowkit.core.submission import SubmissionRequest, submit_request
 from textflowkit.render import (
     BINARY_FORMATS,
@@ -170,6 +171,38 @@ def _store_is_durable() -> bool:
     return bool(os.environ.get("TEXTFLOWKIT_DB"))
 
 
+def _recover_owned_store() -> int:
+    """Recover orphaned rows once for the store this CLI process owns.
+
+    A CLI invocation owns its store for the duration of the command: the jobs
+    this process runs are created after this call, so any PENDING/RUNNING row
+    already in a durable store is an orphan from a process that died - it has no
+    worker, and without recovery a ``--resume`` reads it as "already active" and
+    refuses to reuse the saved work (audit finding AL-001).
+
+    This belongs at the CLI's process/store ownership boundary, *not* inside
+    ``submit_request(background=False)``: an embedding process can hold
+    genuinely live work, so an unconditional reap there would fail rows it does
+    not own. Recovery is delegated to the shared per-store owner, so a single
+    CLI process reaps exactly once even if both the transcribe and batch paths
+    were to ask. It runs only against a durable store; an in-memory store is
+    fresh per process and has no orphans to recover.
+
+    Returns 0 when recovery ran or was unnecessary, and 1 (with a clear message
+    on stderr, no traceback) when the store rejected the recovery write: the
+    command must fail rather than proceed over a store whose orphans still read
+    ``running``.
+    """
+    if not _store_is_durable():
+        return 0
+    try:
+        recover_startup(get_default_store())
+    except StartupRecoveryError as exc:
+        print(f"error: {exc}", file=sys.stderr)
+        return 1
+    return 0
+
+
 def _preflight_engine(name: str) -> str | None:
     """Reject an unusable ``--engine`` before any work is submitted.
 
@@ -569,8 +602,19 @@ def main(argv: list[str] | None = None) -> int:
     parser = _build_parser()
     args = parser.parse_args(argv)
     if args.command == "transcribe":
+        # Recover the durable store this process owns before resume selection,
+        # so an interrupted job from a dead process is reusable rather than
+        # refused as "already active". Only the commands that submit and resume
+        # work need this; `export`, `sources`, `doctor` and `selftest` neither
+        # own nor select jobs and are left with their existing side effects.
+        recovery = _recover_owned_store()
+        if recovery != 0:
+            return recovery
         return _cmd_transcribe(args)
     if args.command == "batch":
+        recovery = _recover_owned_store()
+        if recovery != 0:
+            return recovery
         return _cmd_batch(args)
     if args.command == "export":
         return _cmd_export(args)