fix(v1): harden legacy maintenance runtime

[DF-wu]

Standing comparison — do not merge. This PR intentionally remains open as
the comparison between immutable archive/v1-legacy and the fork-maintained
maintenance/v1 line. Keep the archive unchanged; maintain and release fork
v1 directly from maintenance/v1 under fork-v1.* tags. This is fork-owned
maintenance, not an upstream merge request.

Summary

• Bound WebSocket frames, decoded audio chunks, segmentation geometry, task IDs, and context while preserving the existing client wire format.
• Isolate recognition state by WebSocket connection so identical client task IDs cannot merge or misroute transcripts.
• Harden the optional HTTP API with pre-parser authentication/media-type checks, constant-time token comparison, bounded upload reads, cancellation cleanup, and redacted errors/logging.
• Fix subtitle timestamp carry behavior and update security-sensitive runtime pins.
• Separate the legacy Linux Server/API/container source from the compatibility-preserved upstream-era Windows desktop Client source.
• Make the v1 release source-only: Compose builds capswriter-offline-v1-local:source, passes explicit HTTP settings into the container, and never defaults to v2 latest.
• Keep mutable hot-server.txt, hot.txt, hot-rule.txt, and hot-rectify.txt out of local image layers.
• Add paired README/maintenance/release documentation plus a bilingual HTTP API guide with clear Server, Client, native-bind, Compose-publish, and remote-TLS boundaries.

Release boundary

• fork-v1.0.0-rc.1 is a source-only pre-release candidate from this exact maintenance/v1 head.
• No v1 container image or Windows executable is published.
• Source contains the legacy Server/API/container code and start_client.py desktop source.
• v2 Web Console, CLI, TUI, and universal Windows package are not part of v1.
• The standing comparison PR must remain open and must not merge into immutable archive/v1-legacy.

Local verification on efd24cb1bd1ea5e624561dd869aaea9c5d5c02a5

• Python 3.12 isolated suite: 51/51 tests passed
• compileall for supported Server/Client entry points passed
• bash -n docker/server/entrypoint.sh passed
• Main and example Compose configuration passed
• Selected bilingual README/API documentation links passed
• git diff --check passed

The hosted push and pull-request matrices are the release evidence for this exact head. Every matrix leg runs the maintenance tests and compile checks; Compose and entrypoint validation run only in the Ubuntu 24.04 / Python 3.10 validation job.

Stable-release qualification still required

• Disposable v1 image build and cold model bootstrap.
• Model-backed Mandarin/English known-audio tests and target CPU/GPU backend evidence.
• Real Windows desktop launch/exit, tray, hotkey, microphone, clipboard, FFmpeg, model, and child-cleanup qualification.
• A separately reviewed immutable v1 image workflow before advertising any v1 image.

[DF-wu]

Self-review completed for maintenance/v1 head 6005264.

Reviewed the bounded legacy WebSocket/HTTP paths, per-connection recognition isolation, authentication ordering and redaction, subtitle carry fix, security-sensitive dependency updates, Ubuntu/Windows Python 3.10/3.12 matrix, and the maintenance/security/release documentation. The duplicate maintenance matrices and documented dependency audits are green, with no remaining blocking backport finding.

The model-backed, known-audio, accelerator, disposable-image, and real Windows desktop checks remain mandatory before cutting a legacy release.

Disposition: this is a standing comparison PR and must not be merged into immutable archive/v1-legacy. Continue fork-owned best-effort maintenance and releases directly from maintenance/v1 under fork-v1.* tags; this is not an upstream-supported release line.

[DF-wu]

Self-review completed for maintenance/v1 head 9090277.

Reviewed the Server/Client ownership rewrite, source-only RC notes, Compose build semantics, environment defaults, and every remaining capswriter-offline-server:latest reference. v1 now builds its own local image from the tagged source and cannot silently consume v2 latest. The Windows client claim is limited to the upstream-era start_client.py source; no v2 Web/CLI/TUI/universal-package or unqualified Windows binary is advertised.

Local Python 3.12 evidence is 45/45 tests plus compile, Compose, shell, and diff checks. Both duplicate hosted Ubuntu/Windows × Python 3.10/3.12 matrices are green at this exact head.

No blocking finding remains for a source-only fork-v1.0.0-rc.1 pre-release. The standing comparison PR must remain open and must not merge into immutable archive/v1-legacy.

[DF-wu]

Self-review completed for maintenance/v1 head efd24cb1bd1ea5e624561dd869aaea9c5d5c02a5.

Reviewed the legacy Server/API versus upstream-era start_client.py Client boundary, Compose container-bind/host-publish separation, source-only image policy, mutable hotword exclusions (including hot-rectify.txt), bilingual HTTP API guides, and precise release evidence wording. The English guide now has a working counterpart and the README no longer points at absent local changelog/license files.

Local evidence is 51/51 isolated tests, compile checks, entrypoint syntax, Compose validation, selected bilingual link validation, and clean diff checks. Both duplicate hosted push and pull-request matrices are green at this exact head (8/8 checks). The exact hosted workflow runs prove the matrix tests; Compose and entrypoint validation are limited to the Ubuntu 24.04 / Python 3.10 validation job as documented.

No blocking finding remains for a source-only fork-v1.0.0-rc.1 pre-release. Keep this standing comparison PR open and do not merge it into archive/v1-legacy. Release directly from this maintenance/v1 commit; model-backed, image, accelerator, and real Windows qualification remain explicitly required before a stable claim.