From a92f5c0daf97858fdc7b07aea41c36c09a300f10 Mon Sep 17 00:00:00 2001
From: Codex <codex@example.local>
Date: Mon, 24 Aug 2026 20:35:26 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=EF=BC=9A=E6=94=B6=E7=B4=A7?=
 =?UTF-8?q?=E4=BB=BB=E5=8A=A1=E7=8A=B6=E6=80=81=E4=B8=8E=E5=88=87=E7=89=87?=
 =?UTF-8?q?=E5=8E=9F=E5=AD=90=E6=80=A7?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .codemap/codemap.html                      |   2 +-
 .codemap/codemap.md                        |  99 ++---
 .codemap/modules.json                      | 259 ++++--------
 DEVELOPMENT_LOG.md                         |  17 +
 NEXT_STEPS.md                              |   7 +-
 PROJECT_AUDIT.md                           |  17 +
 STABILITY_P1_STATE_ATOMICITY_TASK.md       | 110 +++++
 app/db/database.py                         |   2 +-
 app/models/task.py                         |   1 +
 app/routers/tasks.py                       |   5 +-
 app/services/auto_publish_service.py       |   2 +
 app/services/job_service.py                | 157 ++++++-
 app/services/job_worker.py                 |  12 +-
 app/services/pipeline_engine.py            | 161 ++++++-
 app/services/task_lifecycle_service.py     | 235 ++++++++++-
 app/services/task_service.py               |  21 +-
 app/services/video_cut_workflow_service.py | 464 ++++++++++++++++++---
 tests/conftest.py                          |  11 +
 tests/test_auto_pipeline.py                |   8 +-
 tests/test_cut_atomicity.py                | 353 ++++++++++++++++
 tests/test_pipeline_state_stability.py     | 314 ++++++++++++++
 tests/test_task_state_machine.py           | 149 +++++++
 22 files changed, 2065 insertions(+), 341 deletions(-)
 create mode 100644 STABILITY_P1_STATE_ATOMICITY_TASK.md
 create mode 100644 tests/test_cut_atomicity.py
 create mode 100644 tests/test_pipeline_state_stability.py
 create mode 100644 tests/test_task_state_machine.py

diff --git a/.codemap/codemap.html b/.codemap/codemap.html
index 66a7c7e..a0e7fb9 100644
--- a/.codemap/codemap.html
+++ b/.codemap/codemap.html
@@ -195,7 +195,7 @@ <h1 id="projTitle">Functional Architecture Map</h1>
 <div class="modal" id="stdModal"></div>
 
 <script>
-const DATA = {"meta": {"project": "NiuMa Studio", "lang": "zh", "subtitle": "牛马片场 · 本地 AI 高光生产后台工程体检", "generatedAt": "2026-08-24", "htmlPath": ".codemap/codemap.html", "mdPath": ".codemap/codemap.md", "spineDesc": "用户通过页面/API 创建素材任务，SQLite Job 驱动转写、AI 选片、审核切片和字幕，再由发送中心排期并交给 Windows Chrome Worker，所有状态与审计证据回写 SQLite。", "tracked_loc": 49906, "tracked_files": 132, "rev": "8fabe125e2e358d173603203407104ad6727b2ab"}, "bands": [{"id": "presentation", "tier": "fe", "t": "界面 · API", "d": "浏览器页面、前端交互、FastAPI 路由与运行配置"}, {"id": "wire1", "wire": true, "t": "HTTP / JSON / 文件上传"}, {"id": "workflow", "tier": "be", "t": "业务编排", "d": "任务、流水线、发送中心和状态机"}, {"id": "processing", "tier": "be", "t": "媒体与 AI 处理", "d": "转写、AI 选片、切片和字幕"}, {"id": "execution", "tier": "be", "t": "外部执行边界", "d": "调度、Publisher 与 Windows Chrome Worker"}, {"id": "persistence", "tier": "be", "t": "持久化与运维", "d": "SQLite Schema/迁移/备份与本地交付脚本"}], "spine": ["frontend_ui", "api_runtime", "pipeline_queue", "transcription", "ai_selection", "task_review_cut", "subtitle", "publish_center", "publish_scheduler", "publisher_worker", "persistence"], "reportThemes": [["本地单体架构是当前可运行的主要原因", "FastAPI + SQLite WAL + 文件产物 + 持久化 Job + Windows Worker 与个人本机规模匹配；不需要微服务化，现有恢复骨架应保留。"], ["P0 数据一致性边界已封口，事务型旧债仍需继续", "活动库外键、测试误删和媒体删除回滚已修复；迁移无账本、切片批次半提交与并发版本号仍是下一阶段重点。"], ["Job 与发布执行代际已封口，下一风险转向业务状态原子性", "Workflow lease token、Publish execution fencing 和 Windows Worker journal 幂等已经完成；任务状态跳跃、切片半提交和取消恢复仍是下一阶段重点。"], ["可用性 fallback 正在掩盖降级结果", "AI 部分窗口、转写旧产物、损坏 JSON、封面生成、批量发布和风险字段多处静默继续，用户不一定能区分完整成功、部分成功和旧结果。"], ["发布与配置读取是主要安全边界", "Publish Center、AI Config 与 Frontend 仍存在原始 Secret 响应、可选写鉴权和 DOM XSS；Worker 路径与 journal 脱敏已收紧，但本地管理员接口门禁尚未完成。"], ["复杂度集中而非全项目平均恶化", "publish_service.py、publish-center.js、app.js、publish_scheduler.py、subtitle_data_service.py 和 transcript_service.py 是主要 God Component；应按业务边界渐进拆分。"], ["测试已与活动数据隔离，但 Coverage 与真实故障闭环仍不足", "610 项测试全部通过，Pytest 已强制使用进程级 sandbox；Coverage 尚未采集，真实平台 E2E 和故障注入仍需在不触发生产副作用的边界下补齐。"]], "standard": {"rubric": [{"grade": "A", "score": 95, "range": "90–100", "en": "clean, well-scoped, idiomatic", "zh": "干净、职责单一、地道"}, {"grade": "B", "score": 82, "range": "75–89", "en": "minor issues: a documented shim, mild bloat", "zh": "小问题：有文档的兼容、轻微臃肿"}, {"grade": "C", "score": 67, "range": "60–74", "en": "notable hacks / fallbacks / bloat / duplication", "zh": "明显的 hack / 回退 / 臃肿 / 重复"}, {"grade": "D", "score": 50, "range": "40–59", "en": "significant legacy / stubs / duplication, or a protocol violation", "zh": "严重的遗留 / 占位 / 重复，或协议违规"}, {"grade": "F", "score": 25, "range": "0–39", "en": "broken, fake output, or unfinished-but-wired", "zh": "损坏、伪造输出，或未完成却已接线"}], "severities": [{"key": "HIGH", "en": "wrong / dangerous / fake, a protocol or security issue, or a genuine maintenance hazard", "zh": "错误 / 危险 / 伪造、协议或安全问题，或真正的维护地雷"}, {"key": "MED", "en": "a real smell a maintainer should fix", "zh": "维护者该修的真坏味"}, {"key": "LOW", "en": "a documented shim, a cosmetic cast, benign bloat — worth noting, not urgent", "zh": "有文档的兼容、装饰性 cast、良性臃肿 —— 值得记、不紧急"}], "coupling": [{"key": "core", "en": "system spine — central to almost everything", "zh": "系统主线 —— 几乎牵连一切"}, {"key": "high", "en": "many connections", "zh": "连接很多"}, {"key": "med", "en": "moderate", "zh": "中等"}, {"key": "low", "en": "leaf / self-contained", "zh": "叶子 / 自洽"}], "tags": [{"id": "monkeypatch", "label": "monkeypatch", "labelZh": "猴补丁", "bad": true, "en": "runtime mutation of another module / stdlib / vendor; reflection or prototype patching", "zh": "运行时改写别的模块/标准库/依赖；反射或原型补丁"}, {"id": "fallback", "label": "fallback", "labelZh": "回退兜底", "bad": true, "en": "'try the real thing, then fake/degrade'; a||b||c chains that hide which value is real", "zh": "“先试真的再退化/造假”；a||b||c 掩盖哪个是真值"}, {"id": "silent-except", "label": "silent-except", "labelZh": "静默吞错", "bad": true, "en": "swallowed errors: empty catch / except:pass / ignored return codes", "zh": "吞掉错误：空 catch / except:pass / 忽略返回码"}, {"id": "legacy", "label": "legacy", "labelZh": "遗留", "bad": true, "en": "deprecated/back-compat shims, dead-but-shipped code, parallel old+new paths", "zh": "遗留/兼容垫片、已发布的死代码、新旧并存"}, {"id": "dual-format", "label": "dual-format", "labelZh": "双格式", "bad": true, "en": "accepting two shapes for one field (snake||camel), patched through the code", "zh": "同一字段接受两种形态（snake||camel）并散落各处"}, {"id": "stub", "label": "stub", "labelZh": "占位桩", "bad": true, "en": "NotImplemented / TODO / dead buttons / demo scripts presented as real", "zh": "未实现/TODO/死按钮/演示脚本当成品"}, {"id": "fake-output", "label": "fake-output", "labelZh": "伪造输出", "bad": true, "en": "returns random/canned/hardcoded results where real work is implied", "zh": "本应真算的地方返回随机/写死结果"}, {"id": "duplication", "label": "duplication", "labelZh": "重复", "bad": true, "en": "copy-pasted logic, or an existing shared abstraction not reused", "zh": "复制粘贴，或已有共享抽象却不复用"}, {"id": "bloat", "label": "bloat", "labelZh": "臃肿", "bad": true, "en": "oversized file / function; too many responsibilities in one unit", "zh": "超大文件/函数；单元职责过多"}, {"id": "glue", "label": "glue", "labelZh": "胶水", "bad": true, "en": "valueless pass-through: rows of thin forwarders / no-op adapters", "zh": "无价值透传：成片薄包装 / 零转换适配器"}, {"id": "any-escape", "label": "any-escape", "labelZh": "类型逃逸", "bad": true, "en": "bypassing the type system: as any / @ts-ignore / dynamic / void* / reinterpret_cast / unsafe", "zh": "绕过类型系统：as any / @ts-ignore / dynamic / void* / reinterpret_cast / unsafe"}, {"id": "over-fit", "label": "over-fit", "labelZh": "过度特化", "bad": true, "en": "hardcoded to one case where a small generalization was expected", "zh": "硬编码单一情况，本应小幅泛化"}, {"id": "god-component", "label": "god-component", "labelZh": "上帝组件", "bad": true, "en": "one component/class/file doing far too much", "zh": "一个组件/类/文件做太多事"}, {"id": "placeholder", "label": "placeholder", "labelZh": "占位", "bad": true, "en": "unfinished UI / data presented as if complete", "zh": "未完成的 UI/数据当作已完成"}, {"id": "clean", "label": "clean", "labelZh": "干净", "bad": false, "en": "no material issues — well-scoped", "zh": "无实质问题 —— 职责单一"}]}, "modules": [{"id": "frontend_ui", "label": "Frontend UI", "band": "presentation", "path": "app/templates + app/static", "desc": "用 Jinja2、原生 JavaScript 和 CSS 提供任务、审核、字幕与发送中心界面。", "coupling": "high", "deps": ["api_runtime"], "loc": 13840, "score": 65, "grade": "C", "tags": ["god-component", "bloat", "glue", "duplication", "legacy"], "findings": [{"sev": "HIGH", "loc": "app/static/js/app.js:211", "text": "多个写请求绕过统一 apiFetch；启用 LOCAL_ADMIN_TOKEN 时可能缺失 Authorization 并被 API 拒绝。"}, {"sev": "HIGH", "loc": "app/static/js/app.js:1729", "text": "接口或任务数据直接拼接到 innerHTML；publish-center.js:2152 有同类路径，存在本地 DOM XSS/页面结构破坏风险。"}, {"sev": "MED", "loc": "app/templates/system_status.html:98", "text": "配置/API Key 字段进入 DOM，base.html:11 还承载本地管理 Token；需确认全链路始终掩码。"}, {"sev": "MED", "loc": "app/static/css/styles.css:870", "text": "使用多个未在 :root 定义的 CSS 自定义属性，相关声明可能失效。"}, {"sev": "MED", "loc": "app/static/js/app.js:1", "text": "任务、转写、AI、审核、切片、字幕和配置行为集中在超大全局脚本，回归半径较大。"}, {"sev": "MED", "loc": "tests/test_publish_center_browser.py:16", "text": "Playwright 缺失时核心浏览器测试可静默跳过，字幕交互与鉴权失败路径覆盖不足。"}, {"sev": "LOW", "loc": "app/static/js/subtitle-editor.js:171", "text": "字幕编辑器已有 escapeHtml、虚拟列表、竞态 token 与自动保存版本控制，是可保留的正向实现。"}, {"sev": "LOW", "loc": "app/static/js/publish-center.js:4", "text": "前端明确只创建抖音任务，B站保留后端兼容；这是当前产品边界而非应机械删除的代码。"}]}, {"id": "api_runtime", "label": "API & Runtime", "band": "presentation", "path": "app/main.py + core/models/routers", "desc": "加载配置、初始化应用与安全中间件，并把页面/API 请求路由到业务服务。", "coupling": "core", "deps": ["media_storage", "transcription", "ai_selection", "task_review_cut", "subtitle", "pipeline_queue", "publish_center", "publish_scheduler", "persistence"], "loc": 2749, "score": 58, "grade": "D", "tags": ["fallback", "legacy", "dual-format", "duplication", "glue", "bloat", "god-component", "silent-except", "any-escape"], "findings": [{"sev": "HIGH", "loc": "app/routers/settings.py:44", "text": "AI/发布设置读取接口仍可能返回原始 Secret/API Key/OAuth Token；本地页面脚本和任意能访问接口的调用方可读取敏感配置。"}, {"sev": "HIGH", "loc": "app/services/task_lifecycle_service.py:152", "text": "任务主状态仍可由 PATCH /api/tasks/{task_id}/status 直接写入，未校验合法状态转移、前置产物或当前状态；空任务可被标记 completed。"}, {"sev": "MED", "loc": "app/core/security.py:23", "text": "本地管理员鉴权是可选配置；token 为空时写接口仅依赖 loopback/CORS 部署假设，若监听范围或反向代理配置改变会扩大未授权操作面。"}, {"sev": "MED", "loc": "app/services/task_service.py:587", "text": "任务详情按 id 查询但不统一过滤 is_deleted，已永久删除任务仍可能被详情和后续动作读取，删除语义与查询语义不一致。"}, {"sev": "MED", "loc": "app/routers/tasks.py:127", "text": "多个 async 路由直接执行同步 SQLite、文件系统、FFprobe/FFmpeg 辅助逻辑，慢磁盘或损坏媒体可阻塞事件循环。"}, {"sev": "MED", "loc": "app/models/task.py:12", "text": "任务状态同时存在枚举、大小写字符串和旧别名，多处路由/服务自行转换，状态口径容易漂移。"}, {"sev": "MED", "loc": "app/routers/files.py:30", "text": "已有文件浏览接口在本地鉴权可选时允许匿名枚举白名单根目录中的媒体元数据，部署边界变化后会泄露本地文件信息。"}, {"sev": "LOW", "loc": "app/main.py:91", "text": "/health 只返回进程级 ok，未覆盖数据库可写、任务存储、Scheduler/Worker readiness，无法作为完整就绪判断。"}, {"sev": "LOW", "loc": "app/routers/settings.py:170", "text": "OAuth 错误信息通过 query 参数回显到页面，缺少统一长度/字符约束与结构化错误码。"}, {"sev": "LOW", "loc": "app/core/config.py:1", "text": "配置定义和兼容别名仍分散在 settings、环境变量与发布服务，存在重复默认值和 dual-format 维护成本。"}, {"sev": "LOW", "loc": "app/models/task.py:360", "text": "speaker_styles 等动态结构仍使用 Any，边界校验主要依赖下游调用方。"}, {"sev": "MED", "loc": "app/services/publish_scheduler.py:274", "text": "Scheduler 关闭会等待当前 run_once 完成；真实发布/恢复调用最长可接近配置的 1800 秒，停机延迟虽优先保证不重复投稿，但仍缺独立可观测的 drain 超时策略。"}]}, {"id": "media_storage", "label": "Media & Storage", "band": "processing", "path": "storage/media/FFmpeg services", "desc": "管理 E 盘任务目录、路径安全、素材预检、FFmpeg/FFprobe 与受控子进程。", "coupling": "high", "deps": ["persistence"], "loc": 1614, "score": 84, "grade": "B", "tags": ["legacy", "dual-format", "glue", "fallback", "silent-except"], "findings": [{"sev": "MED", "loc": "app/services/storage_service.py:840-846", "text": "move_task_directory_to_trash 明确传入 reserve=False，仍采用查询后检查目录的非原子分配；当前无运行时调用，属于遗留兼容入口，但未来恢复调用时仍可能并发复用同一回收站目录。"}, {"sev": "MED", "loc": "app/services/storage_service.py:361-367", "text": "通用 resolve_video_file_path 对已存在路径仍原样返回。媒体 HTTP 路由已增加任务边界，但 publish/auto-publish/subtitle/task 查询等非 HTTP 调用方仍可把数据库中的现有外部路径交给后续读取或上传逻辑。"}, {"sev": "LOW", "loc": "tests/test_storage_boundaries.py:14-32", "text": "新增边界测试没有覆盖任务目录数据库读取在 sqlite3.Error、锁定或损坏数据库下显式失败的回归；代码已有保护但证据不足。"}, {"sev": "LOW", "loc": "app/services/storage_service.py:257-300", "text": "reserve=True 会在数据库任务记录写入前创建目录；进程在预占后崩溃可能留下无数据库记录的空目录，虽不会覆盖数据，但会造成孤儿目录累积。"}]}, {"id": "transcription", "label": "Transcription", "band": "processing", "path": "transcript services", "desc": "提取音频，调用火山引擎或 faster-whisper，并以分块 checkpoint 生成时间戳转写。", "coupling": "high", "deps": ["media_storage", "persistence"], "loc": 1960, "score": 59, "grade": "D", "tags": ["fallback", "silent-except", "fake-output", "duplication", "god-component", "glue", "over-fit"], "findings": [{"sev": "HIGH", "loc": "app/services/transcript_workflow_service.py:317", "text": "transcript Markdown 存在即返回 completed，未校验源指纹、Provider、进度状态或文件完整性。"}, {"sev": "HIGH", "loc": "app/services/transcript_service.py:265", "text": "JobLeaseLostError 已显式透传，但 TranscriptCancelledError 仍会被统一包装为 RuntimeError，取消可能落成 failed。"}, {"sev": "HIGH", "loc": "app/services/transcript_service.py:516", "text": "远程分块请求每次使用随机 request id，缺少持久化幂等键和超时后结果确认，重试可能重复计费。"}, {"sev": "MED", "loc": "app/services/transcript_service.py:516", "text": "HTTP 429、Retry-After、网络瞬断和可恢复服务错误缺少专门退避策略。"}, {"sev": "MED", "loc": "app/services/transcript_service.py:556", "text": "响应 result.message 可能被当作 0-1 秒转写正文写入结果。"}, {"sev": "MED", "loc": "app/services/transcript_service.py:831", "text": "进度文件 IO/JSON 损坏时静默返回空字典，可能隐藏故障并触发重复执行。"}, {"sev": "MED", "loc": "app/services/transcript_workflow_service.py:224", "text": "运行和取消状态仍是进程内 set，多进程/重启时不能可靠去重或取消。"}, {"sev": "MED", "loc": "app/services/transcript_service.py:325", "text": "本地和远程转写复制分块、checkpoint、异常和进度循环，行为容易漂移。"}, {"sev": "MED", "loc": "app/services/transcript_service.py:1088", "text": "Provider/模型/设备为模块级可变全局，并发任务可能互相覆盖运行元数据。"}, {"sev": "MED", "loc": "app/services/transcript_service.py:83", "text": "约 1300 行文件混合 FFmpeg、本地模型、远程 HTTP、checkpoint、进度和 Markdown，职责过大。"}, {"sev": "LOW", "loc": "tests/test_long_live_foundation.py:65", "text": "已覆盖失租 checkpoint 和异常透传，仍缺取消、429/坏响应、重复计费与真实 Markdown 闭环。"}]}, {"id": "ai_selection", "label": "AI Selection", "band": "processing", "path": "AI providers and analyzers", "desc": "选择 Codex/远程/本地 Provider，解析不稳定 AI 输出并生成通用、综艺或长直播候选片段。", "coupling": "core", "deps": ["transcription", "persistence"], "loc": 4420, "score": 63, "grade": "C", "tags": ["fallback", "silent-except", "legacy", "dual-format", "stub", "fake-output", "bloat", "duplication", "god-component"], "findings": [{"sev": "HIGH", "loc": "app/services/ai_config_service.py:318", "text": "get_ai_config_context 返回含 AI/ASR Key 的完整 values，GET /api/settings/ai 无读取鉴权，页面也复用该上下文。"}, {"sev": "MED", "loc": "app/services/ai/ai_clip_service.py:4", "text": "generate_candidate_clips_placeholder 返回三条硬编码 ClipCandidate；虽当前无调用方，误接线会产生 fake output。"}, {"sev": "MED", "loc": "app/services/ai/ai_clip_analyzer.py:131", "text": "分段分析失败窗口被跳过，只要其他窗口有候选便返回；通用路径缺少最低覆盖率门槛。"}, {"sev": "MED", "loc": "app/services/ai/variety_comedy_analyzer.py:513", "text": "全局评审失败时隐式降级到扩展阶段评分，Provider 失败仍可形成候选。"}, {"sev": "MED", "loc": "app/services/ai/local_model_provider.py:19", "text": "fallback_protocol 对任意 AIProviderError 都执行第二协议，未区分限流、认证和协议错误，可能重复调用与计费。"}, {"sev": "MED", "loc": "app/services/ai_analysis_workflow_service.py:738", "text": "候选事务替换、JSON 文件和 run 历史分步持久化，后续失败会形成数据库与文件/历史不一致。"}, {"sev": "MED", "loc": "app/services/ai/long_live_talk_analyzer.py:427", "text": "checkpoint 更新无 run/lease/owner fencing，并发或旧进程恢复可能互相覆盖窗口状态。"}, {"sev": "MED", "loc": "app/services/ai_analysis_workflow_service.py:71", "text": "分析元文件不存在、损坏或读取异常时静默返回空字典，无法区分未分析与产物损坏。"}, {"sev": "LOW", "loc": "app/services/ai/ai_clip_analyzer.py:456", "text": "输出归一化同时接受多组历史字段并填大量默认值，兼容有效但维护成本高。"}, {"sev": "LOW", "loc": "app/services/ai_config_service.py:55", "text": "旧 AI_REMOTE 与新分析/发布配置并存，运行时还改写全局 settings，形成双路径。"}, {"sev": "MED", "loc": "app/services/ai_analysis_workflow_service.py:685", "text": "单文件集中 profile、Provider、状态、候选、文件、历史与恢复，模块回归半径大。"}, {"sev": "MED", "loc": "app/services/ai/ai_clip_analyzer.py:252", "text": "多个分析器重复偏好摘要、时间转换、默认字段和 AI 输出解析逻辑。"}, {"sev": "MED", "loc": "tests/test_split_services.py:200", "text": "缺少真实 Provider 成功路径、文件写入失败一致性、并发运行和旧 checkpoint 覆盖测试。"}, {"sev": "MED", "loc": "tests/test_codex_cli_provider.py:12", "text": "Provider 测试主要 monkeypatch，缺少 HTTP 429/500/超时和协议 fallback 重复调用边界。"}, {"sev": "LOW", "loc": "tests/test_variety_comedy_selection.py:291", "text": "算法分支覆盖较好，但真实三阶段 Provider、资源消耗和全局评审降级未由集成测试锁定。"}]}, {"id": "task_review_cut", "label": "Task Review & Cut", "band": "workflow", "path": "task and cut workflow services", "desc": "维护任务状态与视图，保存候选审核选择，生成切片版本并同步发送中心。", "coupling": "core", "deps": ["media_storage", "ai_selection", "publish_center", "persistence"], "loc": 2462, "score": 60, "grade": "C", "tags": ["god-component", "glue", "duplication", "dual-format", "fallback", "legacy", "over-fit", "silent-except"], "findings": [{"sev": "HIGH", "loc": "app/services/video_cut_workflow_service.py:248-255", "text": "每个 CutResult 通过 _insert_output_clip_record 独立提交事务；中途插入异常时前面的 output_clip 已落库，cut_run 未被标记 failed，任务可能停留在 cutting 并同时暴露半批新结果。"}, {"sev": "HIGH", "loc": "app/services/task_lifecycle_service.py:156-180", "text": "update_task_status 仍按 task_id 直接写入任意传入状态和进度，没有合法状态迁移、前置产物或并发条件；API 直接暴露 PATCH /status，可将空任务跳转为 completed。"}, {"sev": "HIGH", "loc": "app/services/task_service.py:451-478", "text": "_probe_video 调用 ffprobe 没有 timeout，也没有捕获 subprocess OSError、媒体读取异常或 stat 异常；get_task 默认 include_video_probe=True，损坏、卡死或不可达媒体可长期阻塞任务详情或直接 500。"}, {"sev": "MED", "loc": "app/services/video_cut_workflow_service.py:18-45", "text": "_next_cut_run_number 先 SELECT MAX(run_number)，随后由独立连接 INSERT，缺少事务序列化或唯一约束；并发重切可能产生重复 run_number。"}, {"sev": "MED", "loc": "app/services/task_lifecycle_service.py:66-71", "text": "allocate_task_dir_name 会先原子预占目录，再由 create_task_directory 和数据库 INSERT 继续执行；后续目录初始化或数据库提交失败时没有统一释放已预占的空目录，可能累积孤儿目录并影响后续命名。"}, {"sev": "MED", "loc": "app/services/task_service.py:14-96", "text": "task_service 仍集中导入 AI、字幕、转写、存储、切片等大量私有服务函数，并与 task_lifecycle_service 形成动态反向依赖，职责边界复杂。"}, {"sev": "MED", "loc": "app/services/task_query_service.py:89-172", "text": "_batch_all_output_clips 复制 task_service.list_output_clips 的路径解析、字幕状态和发布就绪判断；两套口径未来可能分叉。"}, {"sev": "MED", "loc": "app/services/task_service.py:587-603", "text": "get_task 查询只按 id，不过滤 is_deleted；已永久删除且仅应保留历史的任务仍可被详情和后续动作读取。"}, {"sev": "MED", "loc": "app/services/task_service.py:717-718", "text": "list_clip_candidates 直接解析每条 start_time/end_time，单条历史脏时间格式可阻断整个审核页。"}, {"sev": "MED", "loc": "app/services/video_cut_workflow_service.py:269-289", "text": "切片成功后先把任务更新为完成，再同步发送中心；同步异常只返回 partial，主状态与发布关联可能不一致。"}, {"sev": "LOW", "loc": "tests/test_path_resolution.py:44-68", "text": "目录唯一性单元测试为连续调用；并发线程回归由 tests/test_storage_boundaries.py 单独覆盖。"}, {"sev": "LOW", "loc": "tests/test_split_services.py:119-137", "text": "测试将没有产物的任务直接更新为 completed 并断言成功，固化了任意状态跳跃行为。"}, {"sev": "LOW", "loc": "tests/test_versioning_rollback.py:163-178", "text": "版本测试使用虚构输出路径，只验证数据库标记，没有覆盖真实 FFmpeg 输出、文件切换和恢复。"}]}, {"id": "subtitle", "label": "Subtitle", "band": "processing", "path": "subtitle services", "desc": "维护字幕轨、不可变 revision、cue、AI 建议、渲染验证与自动流水线交付决定。", "coupling": "high", "deps": ["media_storage", "task_review_cut", "ai_selection", "persistence"], "loc": 2409, "score": 70, "grade": "C", "tags": ["fallback", "silent-except", "legacy", "bloat", "god-component", "monkeypatch"], "findings": [{"sev": "MED", "loc": "app/services/subtitle_data_service.py:352", "text": "手工 revision 的 active/base 检查在事务外，并发编辑可覆盖 active 选择。"}, {"sev": "MED", "loc": "app/services/subtitle_data_service.py:489", "text": "批准 revision 在事务外校验，并发或重放旧请求可回退 active 版本。"}, {"sev": "MED", "loc": "app/services/subtitle_data_service.py:135", "text": "source/clip track 先查后插，NULL output_clip_id 约束不足，并发可能重复源轨。"}, {"sev": "MED", "loc": "app/services/subtitle_auto_workflow_service.py:87", "text": "批量批准逐 clip 独立提交，Job 后创建；中途失败会留下部分批准。"}, {"sev": "MED", "loc": "app/services/subtitle_data_service.py:168", "text": "source revision 提交后逐 clip 独立同步，异常会形成混合版本。"}, {"sev": "MED", "loc": "app/services/subtitle_workflow_service.py:475", "text": "字幕 job 完成与激活分两次写入，迟到 worker 仍可能激活旧成片。"}, {"sev": "LOW", "loc": "app/services/subtitle_auto_workflow_service.py:273", "text": "auto_config_json 损坏时静默降为空并写回，可能丢弃其他配置。"}, {"sev": "MED", "loc": "app/services/subtitle_data_service.py:1045", "text": "字幕数据服务聚合 track、revision、cue、导入导出、波形和渲染辅助，回归半径大。"}, {"sev": "LOW", "loc": "app/services/subtitle_workflow_service.py:312", "text": "统一 revision 外仍保留旧调用方适配，存在历史口径漂移成本。"}, {"sev": "MED", "loc": "tests/test_subtitle_editor.py:189", "text": "缺并发 save/approve/ensure track 与批处理中途失败测试。"}, {"sev": "LOW", "loc": "tests/test_subtitle_auto_workflow.py:172", "text": "核心真实渲染在 FFmpeg/FFprobe 缺失时会跳过，异常 Provider 证据不足。"}, {"sev": "LOW", "loc": "app/services/subtitle_data_service.py:761", "text": "波形处理把完整 PCM 捕获到内存，超长媒体存在时长线性内存峰值。"}, {"sev": "LOW", "loc": "app/services/subtitle_data_service.py:1024", "text": "单条字幕文本可接近文件上限，放大渲染、导出和 Prompt 资源消耗。"}]}, {"id": "pipeline_queue", "label": "Pipeline & Job Queue", "band": "workflow", "path": "pipeline and workflow job services", "desc": "用 SQLite Job、Lease、Heartbeat、Checkpoint 和子进程串联长任务与自动流水线。", "coupling": "core", "deps": ["transcription", "ai_selection", "task_review_cut", "subtitle", "publish_center", "persistence"], "loc": 2048, "score": 74, "grade": "C", "tags": ["fallback", "silent-except", "legacy", "stub", "god-component", "glue", "over-fit"], "findings": [{"sev": "HIGH", "loc": "app/services/pipeline_engine.py:118", "text": "取消仍只在每个 step 开始前检查；step 执行期间及最后一步完成后缺少统一取消门禁，Workflow Job 与任务主状态仍可能分叉。"}, {"sev": "HIGH", "loc": "app/services/pipeline_engine.py:158", "text": "READY_TO_PUBLISH 在同一次 run 中立即转为 COMPLETED，待人工确认状态不可稳定观察。"}, {"sev": "MED", "loc": "app/services/pipeline_engine.py:104", "text": "Pipeline context 仍只保存在内存，缺少按 step 的可重放副作用 checkpoint；重启可能重复 AI、封面或排期动作。"}, {"sev": "MED", "loc": "app/services/pipeline_engine.py:145", "text": "普通 step 失败后写 summary 仍可能二次失败并遮蔽原始异常。"}, {"sev": "MED", "loc": "app/services/job_worker.py:198", "text": "子进程 stdout/stderr 仍丢弃，父进程只保留退出码，恢复与诊断证据不足。"}, {"sev": "MED", "loc": "app/services/job_service.py:126", "text": "Job JSON 损坏时静默保留原字符串，执行器可能产生不明确的数据错误。"}, {"sev": "MED", "loc": "app/services/job_service.py:18", "text": "ai_analysis 与 publish 类型仍可创建但 worker 未实现，属于可创建不可执行的 legacy/stub。"}, {"sev": "LOW", "loc": "tests/test_job_fencing.py:59", "text": "已覆盖 owner/token、迁移、转写 checkpoint 与字幕 cleanup fencing，但尚无真实父子进程重启中失租测试。"}, {"sev": "LOW", "loc": "tests/test_auto_pipeline.py:204", "text": "仍缺稳定 READY 状态、最后一步取消和重启副作用去重测试。"}, {"sev": "LOW", "loc": "app/services/pipeline_engine.py:572", "text": "JSON/时间配置损坏时静默回退默认排期，故障可见性不足。"}]}, {"id": "publish_center", "label": "Publish Center", "band": "workflow", "path": "publish content preparation services", "desc": "准备标题、简介、话题、封面、账号和发布草稿，并保留历史兼容执行入口。", "coupling": "core", "deps": ["task_review_cut", "subtitle", "publish_scheduler", "publisher_worker", "persistence"], "loc": 5593, "score": 52, "grade": "D", "tags": ["god-component", "bloat", "legacy", "dual-format", "fallback", "silent-except", "placeholder", "duplication"], "findings": [{"sev": "HIGH", "loc": "app/services/publish_service.py:570", "text": "_normalize_config/_normalize_account 仅新增 *_masked 字段，却保留 client_secret、access_token、refresh_token 原字段；GET /api/publish/platforms、/accounts 及保存配置/账号响应直接返回这些原始密钥，存在敏感凭据泄漏风险。"}, {"sev": "MED", "loc": "app/services/publish_service.py:266", "text": "publish_service.py 当前约4750行，混合配置/账号/OAuth、文案与封面、队列同步、历史、旧 OpenCLI 脚本、API Provider 和页面上下文，形成高耦合 God Component，任一发布流程改动的 blast radius 很大。"}, {"sev": "MED", "loc": "app/services/publish_service.py:2941", "text": "历史查询 SQL 只按 PUBLISH_HISTORY_STATUSES 的大写值过滤，之后才调用 _normalize_publish_status；LEGACY_STATUS_MAP 支持旧小写状态但旧记录会在 SQL 层被提前排除，历史页可能漏数据。"}, {"sev": "MED", "loc": "app/services/publish_service.py:2144", "text": "sync_task_publish_jobs 封面生成失败时只把 {'cover_error': ...} 放入 item_covers，仍继续插入 WAITING 任务且不计入 errors；同步可能返回 ok，但生成的任务实际无法通过 local_browser readiness。"}, {"sev": "MED", "loc": "app/services/publish_service.py:2787", "text": "create_batch_publish_jobs 对不存在的 output_clip_id 直接 continue，全部无效或部分无效时仍返回 status='ok'，调用方无法区分‘创建成功’与‘输入被静默丢弃’。"}, {"sev": "MED", "loc": "app/services/publish_readiness.py:167", "text": "publish_domain/create_publish_job 仍允许 api_publish，publishers registry 也保留兼容入口，但统一 readiness 只接受 local_browser/manual_export 并将 api_publish 标记 unsupported_publish_mode，持久化任务与调度契约不一致。"}, {"sev": "MED", "loc": "app/services/publish_providers.py:117", "text": "BilibiliPublishProvider 在完成配置和 token 校验后始终抛出 bilibili_provider_pending；api_publish 模式仍可创建/注册，因此这是已接线但必然失败的 placeholder 路径。"}, {"sev": "MED", "loc": "app/services/publish_providers.py:66", "text": "旧 Douyin API Provider 将 upload 与 create 分成两个无幂等键的请求；_request_json 只包装 HTTPError/URLError，平台已接收后网络超时或连接异常可能被判失败，重试会重复上传/投稿且没有 NEED_REVIEW 不确定态。"}, {"sev": "LOW", "loc": "app/services/publish_providers.py:204", "text": "_post_multipart 先 file_path.read_bytes() 再 b''.join(chunks)，完整视频和完整 multipart body 同时驻留内存，大文件发布存在约双倍峰值。"}, {"sev": "LOW", "loc": "app/services/publish_service.py:1569", "text": "_batch_find_publish_jobs 对每条记录直接调用 _normalize_job(row)，未传入预取 accounts；_normalize_job 会逐条触发 readiness/account 查询，发布中心批量切片时形成 N+1 查询。"}, {"sev": "LOW", "loc": "tests/test_publish_history.py:111", "text": "现有定向测试未覆盖原始 Secret/Token 响应、旧小写历史状态、同步封面 partial、批量无效 ID，以及 API 超时后已接收的重复投稿边界。"}]}, {"id": "publish_scheduler", "label": "Publish Scheduler", "band": "execution", "path": "scheduler/repository/executor", "desc": "计算排期、原子领取发布任务、重试、恢复不确定执行并维护发布状态机。", "coupling": "core", "deps": ["publish_center", "publisher_worker", "persistence"], "loc": 2329, "score": 71, "grade": "C", "tags": ["god-component", "bloat", "legacy", "silent-except"], "findings": [{"sev": "MED", "loc": "app/services/publish_scheduler.py:756-785", "text": "recover_interrupted_jobs 每轮加载全部 PUBLISHING 任务，并对每个任务串行查询 Worker，没有批量上限、并发控制或退避；Worker 不可用或卡住任务较多时，单轮耗时按任务数乘以网络超时增长，会延迟后续排期处理。"}, {"sev": "MED", "loc": "app/services/publish_scheduler.py:281-302", "text": "list_due_jobs 每轮 SELECT 全部 SCHEDULED 记录，再逐条在 Python 中解析时间；虽已有状态/排期索引，但没有 SQL due 条件、分页或批量上限，排期量增长后会增加扫描内存和调度延迟。"}, {"sev": "MED", "loc": "app/services/publish_scheduler.py:133-1788", "text": "PublishScheduler 约 1891 行、42 个方法，同时承担排期计算、任务领取、执行结果写回、Worker 恢复、重试修复、人工复核、批量排期和旧版兼容；职责边界过宽，修改任一状态路径的回归半径较大。"}, {"sev": "LOW", "loc": "app/services/publish_scheduler.py:274-279", "text": "shutdown 已能追踪并等待后台 Task，但没有超时或取消兜底；若当前 run_once 被数据库锁、Worker 串行查询或文件操作长期阻塞，应用优雅停机仍可能无限等待。"}, {"sev": "LOW", "loc": "app/services/publish_scheduler.py:1807-1812", "text": "queue_snapshot 对非法 scheduled_at 捕获 ValueError 后静默 pass；损坏排期会从“今日任务”视图中消失，未产生告警或错误计数，降低数据异常可见性。"}]}, {"id": "publisher_worker", "label": "Publishers & Worker", "band": "execution", "path": "publisher registry and Windows worker", "desc": "通过 Publisher Registry 和 Windows Chrome Worker 执行抖音/B站投稿、导出与兼容模式。", "coupling": "high", "deps": ["media_storage", "persistence"], "loc": 2699, "score": 76, "grade": "B", "tags": ["legacy", "glue", "silent-except", "fallback"], "findings": [{"sev": "MED", "loc": "scripts/publish_host_worker.py:321", "text": "_prior_job_execution_requires_review 扫描旧 execution journal 时，若 journal 缺少 identity 或已损坏，直接 continue；跨 execution 无法确认其 job_id 时不会阻断新 execution。旧 Worker 在上传后崩溃并留下无身份/损坏日志时，仍存在重复投稿边界。"}, {"sev": "LOW", "loc": "app/services/publishers/page_scripts.py:14", "text": "页面脚本入口仍通过延迟导入 publish_service 私有函数来转发大量 DOM 脚本；这是有意保留的兼容层，但形成 legacy glue，脚本变更仍会牵连 4750 行 God Service。"}, {"sev": "LOW", "loc": "app/services/publishers/browser_runtime.py:315", "text": "screenshot 捕获裸 Exception 后返回空字符串，截图失败不会进入发布结果或健康信号；发布可以继续但缺少关键诊断证据。"}, {"sev": "LOW", "loc": "scripts/opencli_host_bridge.py:74", "text": "旧 OpenCLIHostBridgeHandler 的 /run 处理器本身没有 Bearer Token 校验；当前 main 已转调受保护的 publish_host_worker，默认入口不再使用它，但保留的可直接实例化旧处理器仍会造成安全边界误解。"}, {"sev": "LOW", "loc": "tests/test_publish_worker_client.py:155", "text": "当前测试已覆盖双进程锁竞争、死进程锁回收和常规 execution fencing，但仍未覆盖无身份/损坏旧 journal 被跨 execution 扫描跳过、screenshot 失败信号及旧 bridge 处理器被直接启动时的鉴权边界。"}]}, {"id": "persistence", "label": "SQLite Persistence", "band": "persistence", "path": "app/db + backup services", "desc": "创建 SQLite Schema、执行启动时兼容迁移和索引，并提供 WAL 安全备份恢复。", "coupling": "core", "deps": [], "loc": 3436, "score": 69, "grade": "C", "tags": ["silent-except", "fallback", "legacy", "dual-format", "glue", "bloat", "god-component", "monkeypatch"], "findings": [{"sev": "MED", "loc": "app/db/database.py:31", "text": "init_db 仍依赖结构探测执行启动迁移，没有 user_version 或 schema_migrations 账本。"}, {"sev": "MED", "loc": "app/db/database.py:625", "text": "索引创建捕获所有 sqlite3.Error 后静默继续，关键唯一索引失败可能无告警。"}, {"sev": "MED", "loc": "app/db/database.py:675", "text": "历史表迁移主要补列，未系统重建或验证旧库 Foreign Key、UNIQUE、CHECK 约束。"}, {"sev": "MED", "loc": "scripts/backup_restore.py:305", "text": "备份验证未覆盖 foreign_key_check、关键索引和迁移版本。"}, {"sev": "MED", "loc": "scripts/backup_restore.py:529", "text": "直接恢复函数内部没有统一进程锁或活动连接门禁。"}, {"sev": "LOW", "loc": "app/db/database.py:656", "text": "Workflow claim 索引未覆盖 lease_expires_at，队列规模增长后过期接管扫描可能退化。"}, {"sev": "LOW", "loc": "tests/test_job_fencing.py:206", "text": "已覆盖并发补列和旧 running guard，仍缺完整启动链迁移失败回滚测试。"}]}, {"id": "ops_delivery", "label": "Ops & Delivery", "band": "persistence", "path": "Docker/PowerShell/CI", "desc": "提供 Windows/Docker 启停、诊断、CI、发布门禁、Demo 与维护脚本。", "coupling": "med", "deps": ["api_runtime", "publisher_worker", "persistence"], "loc": 4347, "score": 68, "grade": "C", "tags": ["fallback", "legacy", "dual-format", "duplication", "bloat", "glue", "silent-except", "monkeypatch"], "findings": [{"sev": "MED", "loc": ".github/workflows/ci.yml:3", "text": "CI 仅监听 master push/PR；feature/docs 直接 push 不即时验证，问题延迟到开 PR。"}, {"sev": "MED", "loc": "scripts/start_docker_opencli.ps1:24", "text": "健康检查异常只警告不返回非零，服务失败也可能被调用方视为启动成功。"}, {"sev": "MED", "loc": "scripts/start.ps1:30", "text": "Demo 覆盖生效前先对正式 E 盘配置运行 doctor，新机/迁移机的隔离 Demo 可能被旧路径阻断。"}, {"sev": "MED", "loc": "scripts/start.ps1:71", "text": "Worker 启动异常被捕获后继续并报告工作台成功，发布能力不可用时易被误判完整健康。"}, {"sev": "HIGH", "loc": "scripts/migrate_task_dirs_to_project_names.py:211", "text": "任务目录迁移用非 WAL-aware 主库 copy，先移动目录再统一更新提交，无文件补偿，异常会让路径/DB 不一致。"}, {"sev": "MED", "loc": "scripts/restore.ps1:27", "text": "恢复只以健康响应判断 App 运行，StopServices 只停 Compose；native/异常健康进程可能仍持有 DB 时执行替换。"}, {"sev": "MED", "loc": "scripts/backup.ps1:33", "text": "备份默认包含 .env 且不加密，仅显式 ExcludeEnv 才排除，包被共享时泄漏本机秘密。"}, {"sev": "MED", "loc": "tests/test_native_scripts.py:11", "text": "启停测试主要是源码字符串断言，Windows smoke 不做实际 restore/冲突/清理失败与恢复后健康验证。"}, {"sev": "MED", "loc": "scripts/seed_demo_data.py:32", "text": "缺 FFmpeg 时仍插入无媒体路径 Demo 数据并成功退出，数量检查通过但媒体 smoke 不可信。"}, {"sev": "LOW", "loc": "scripts/acceptance.ps1:115", "text": "验收递归扫描正式任务目录，媒体量大/锁文件会显著拖慢或阻断 release gate。"}, {"sev": "LOW", "loc": "scripts/backup_restore_runtime.py:142", "text": "import 时 monkeypatch backup core，全局行为依赖导入顺序。"}, {"sev": "LOW", "loc": "docs/PORTABLE_SETUP.md:127", "text": "文档描述与当前 start.ps1 实现不符，旧 Next Steps 又保留兼容入口，启动排障认知漂移。"}]}]};
+const DATA = {"meta": {"project": "NiuMa Studio", "lang": "zh", "subtitle": "牛马片场 · 本地 AI 高光生产后台工程体检", "generatedAt": "2026-08-24", "htmlPath": ".codemap/codemap.html", "mdPath": ".codemap/codemap.md", "spineDesc": "用户通过页面/API 创建素材任务，SQLite Job 驱动转写、AI 选片、审核切片和字幕，再由发送中心排期并交给 Windows Chrome Worker，所有状态与审计证据回写 SQLite。", "tracked_loc": 50778, "tracked_files": 132, "rev": "a01f103c43916d25310254f6f8389e9fc9e52521"}, "bands": [{"id": "presentation", "tier": "fe", "t": "界面 · API", "d": "浏览器页面、前端交互、FastAPI 路由与运行配置"}, {"id": "wire1", "wire": true, "t": "HTTP / JSON / 文件上传"}, {"id": "workflow", "tier": "be", "t": "业务编排", "d": "任务、流水线、发送中心和状态机"}, {"id": "processing", "tier": "be", "t": "媒体与 AI 处理", "d": "转写、AI 选片、切片和字幕"}, {"id": "execution", "tier": "be", "t": "外部执行边界", "d": "调度、Publisher 与 Windows Chrome Worker"}, {"id": "persistence", "tier": "be", "t": "持久化与运维", "d": "SQLite Schema/迁移/备份与本地交付脚本"}], "spine": ["frontend_ui", "api_runtime", "pipeline_queue", "transcription", "ai_selection", "task_review_cut", "subtitle", "publish_center", "publish_scheduler", "publisher_worker", "persistence"], "reportThemes": [["本地单体架构是当前可运行的主要原因", "FastAPI + SQLite WAL + 文件产物 + 持久化 Job + Windows Worker 与个人本机规模匹配；不需要微服务化，现有恢复骨架应保留。"], ["P0 数据一致性边界已封口，事务型旧债仍需继续", "活动库外键、测试误删、媒体删除回滚和切片批次原子提交已修复；迁移无账本与索引重建失败静默降级仍是下一阶段重点。"], ["Job、发布执行和任务状态代际已封口，下一风险转向跨进程精确续跑", "Workflow lease token、Publish execution fencing、任务状态转换、取消恢复和切片原子提交已经完成；下一阶段重点是持久化 step checkpoint 与副作用复用。"], ["可用性 fallback 正在掩盖降级结果", "AI 部分窗口、转写旧产物、损坏 JSON、封面生成、批量发布和风险字段多处静默继续，用户不一定能区分完整成功、部分成功和旧结果。"], ["发布与配置读取是主要安全边界", "Publish Center、AI Config 与 Frontend 仍存在原始 Secret 响应、可选写鉴权和 DOM XSS；Worker 路径与 journal 脱敏已收紧，但本地管理员接口门禁尚未完成。"], ["复杂度集中而非全项目平均恶化", "publish_service.py、publish-center.js、app.js、publish_scheduler.py、subtitle_data_service.py 和 transcript_service.py 是主要 God Component；应按业务边界渐进拆分。"], ["测试已与活动数据隔离，但 Coverage 与真实故障闭环仍不足", "637 项测试全部通过，Pytest 已强制使用进程级 sandbox；Coverage 尚未采集，真实平台 E2E 和故障注入仍需在不触发生产副作用的边界下补齐。"]], "standard": {"rubric": [{"grade": "A", "score": 95, "range": "90–100", "en": "clean, well-scoped, idiomatic", "zh": "干净、职责单一、地道"}, {"grade": "B", "score": 82, "range": "75–89", "en": "minor issues: a documented shim, mild bloat", "zh": "小问题：有文档的兼容、轻微臃肿"}, {"grade": "C", "score": 67, "range": "60–74", "en": "notable hacks / fallbacks / bloat / duplication", "zh": "明显的 hack / 回退 / 臃肿 / 重复"}, {"grade": "D", "score": 50, "range": "40–59", "en": "significant legacy / stubs / duplication, or a protocol violation", "zh": "严重的遗留 / 占位 / 重复，或协议违规"}, {"grade": "F", "score": 25, "range": "0–39", "en": "broken, fake output, or unfinished-but-wired", "zh": "损坏、伪造输出，或未完成却已接线"}], "severities": [{"key": "HIGH", "en": "wrong / dangerous / fake, a protocol or security issue, or a genuine maintenance hazard", "zh": "错误 / 危险 / 伪造、协议或安全问题，或真正的维护地雷"}, {"key": "MED", "en": "a real smell a maintainer should fix", "zh": "维护者该修的真坏味"}, {"key": "LOW", "en": "a documented shim, a cosmetic cast, benign bloat — worth noting, not urgent", "zh": "有文档的兼容、装饰性 cast、良性臃肿 —— 值得记、不紧急"}], "coupling": [{"key": "core", "en": "system spine — central to almost everything", "zh": "系统主线 —— 几乎牵连一切"}, {"key": "high", "en": "many connections", "zh": "连接很多"}, {"key": "med", "en": "moderate", "zh": "中等"}, {"key": "low", "en": "leaf / self-contained", "zh": "叶子 / 自洽"}], "tags": [{"id": "monkeypatch", "label": "monkeypatch", "labelZh": "猴补丁", "bad": true, "en": "runtime mutation of another module / stdlib / vendor; reflection or prototype patching", "zh": "运行时改写别的模块/标准库/依赖；反射或原型补丁"}, {"id": "fallback", "label": "fallback", "labelZh": "回退兜底", "bad": true, "en": "'try the real thing, then fake/degrade'; a||b||c chains that hide which value is real", "zh": "“先试真的再退化/造假”；a||b||c 掩盖哪个是真值"}, {"id": "silent-except", "label": "silent-except", "labelZh": "静默吞错", "bad": true, "en": "swallowed errors: empty catch / except:pass / ignored return codes", "zh": "吞掉错误：空 catch / except:pass / 忽略返回码"}, {"id": "legacy", "label": "legacy", "labelZh": "遗留", "bad": true, "en": "deprecated/back-compat shims, dead-but-shipped code, parallel old+new paths", "zh": "遗留/兼容垫片、已发布的死代码、新旧并存"}, {"id": "dual-format", "label": "dual-format", "labelZh": "双格式", "bad": true, "en": "accepting two shapes for one field (snake||camel), patched through the code", "zh": "同一字段接受两种形态（snake||camel）并散落各处"}, {"id": "stub", "label": "stub", "labelZh": "占位桩", "bad": true, "en": "NotImplemented / TODO / dead buttons / demo scripts presented as real", "zh": "未实现/TODO/死按钮/演示脚本当成品"}, {"id": "fake-output", "label": "fake-output", "labelZh": "伪造输出", "bad": true, "en": "returns random/canned/hardcoded results where real work is implied", "zh": "本应真算的地方返回随机/写死结果"}, {"id": "duplication", "label": "duplication", "labelZh": "重复", "bad": true, "en": "copy-pasted logic, or an existing shared abstraction not reused", "zh": "复制粘贴，或已有共享抽象却不复用"}, {"id": "bloat", "label": "bloat", "labelZh": "臃肿", "bad": true, "en": "oversized file / function; too many responsibilities in one unit", "zh": "超大文件/函数；单元职责过多"}, {"id": "glue", "label": "glue", "labelZh": "胶水", "bad": true, "en": "valueless pass-through: rows of thin forwarders / no-op adapters", "zh": "无价值透传：成片薄包装 / 零转换适配器"}, {"id": "any-escape", "label": "any-escape", "labelZh": "类型逃逸", "bad": true, "en": "bypassing the type system: as any / @ts-ignore / dynamic / void* / reinterpret_cast / unsafe", "zh": "绕过类型系统：as any / @ts-ignore / dynamic / void* / reinterpret_cast / unsafe"}, {"id": "over-fit", "label": "over-fit", "labelZh": "过度特化", "bad": true, "en": "hardcoded to one case where a small generalization was expected", "zh": "硬编码单一情况，本应小幅泛化"}, {"id": "god-component", "label": "god-component", "labelZh": "上帝组件", "bad": true, "en": "one component/class/file doing far too much", "zh": "一个组件/类/文件做太多事"}, {"id": "placeholder", "label": "placeholder", "labelZh": "占位", "bad": true, "en": "unfinished UI / data presented as if complete", "zh": "未完成的 UI/数据当作已完成"}, {"id": "clean", "label": "clean", "labelZh": "干净", "bad": false, "en": "no material issues — well-scoped", "zh": "无实质问题 —— 职责单一"}]}, "modules": [{"id": "frontend_ui", "label": "Frontend UI", "band": "presentation", "path": "app/templates + app/static", "desc": "用 Jinja2、原生 JavaScript 和 CSS 提供任务、审核、字幕与发送中心界面。", "coupling": "high", "deps": ["api_runtime"], "loc": 13840, "score": 65, "grade": "C", "tags": ["god-component", "bloat", "glue", "duplication", "legacy"], "findings": [{"sev": "HIGH", "loc": "app/static/js/app.js:211", "text": "多个写请求绕过统一 apiFetch；启用 LOCAL_ADMIN_TOKEN 时可能缺失 Authorization 并被 API 拒绝。"}, {"sev": "HIGH", "loc": "app/static/js/app.js:1729", "text": "接口或任务数据直接拼接到 innerHTML；publish-center.js:2152 有同类路径，存在本地 DOM XSS/页面结构破坏风险。"}, {"sev": "MED", "loc": "app/templates/system_status.html:98", "text": "配置/API Key 字段进入 DOM，base.html:11 还承载本地管理 Token；需确认全链路始终掩码。"}, {"sev": "MED", "loc": "app/static/css/styles.css:870", "text": "使用多个未在 :root 定义的 CSS 自定义属性，相关声明可能失效。"}, {"sev": "MED", "loc": "app/static/js/app.js:1", "text": "任务、转写、AI、审核、切片、字幕和配置行为集中在超大全局脚本，回归半径较大。"}, {"sev": "MED", "loc": "tests/test_publish_center_browser.py:16", "text": "Playwright 缺失时核心浏览器测试可静默跳过，字幕交互与鉴权失败路径覆盖不足。"}, {"sev": "LOW", "loc": "app/static/js/subtitle-editor.js:171", "text": "字幕编辑器已有 escapeHtml、虚拟列表、竞态 token 与自动保存版本控制，是可保留的正向实现。"}, {"sev": "LOW", "loc": "app/static/js/publish-center.js:4", "text": "前端明确只创建抖音任务，B站保留后端兼容；这是当前产品边界而非应机械删除的代码。"}]}, {"id": "api_runtime", "label": "API & Runtime", "band": "presentation", "path": "app/main.py + core/models/routers", "desc": "加载配置、初始化应用与安全中间件，并把页面/API 请求路由到业务服务。", "coupling": "core", "deps": ["media_storage", "transcription", "ai_selection", "task_review_cut", "subtitle", "pipeline_queue", "publish_center", "publish_scheduler", "persistence"], "loc": 2753, "score": 48, "grade": "D", "tags": ["fallback", "legacy", "dual-format", "bloat", "glue"], "findings": [{"sev": "HIGH", "loc": "app/routers/settings.py:10", "text": "GET /api/settings/ai 未做鉴权，返回 ai_config_service.get_ai_config_context() 中的原始 values；该上下文会从 .env/环境变量读取 API key、token 等 Secret，并同时返回 env_path。前端或本地恶意页面可直接读取凭据。"}, {"sev": "HIGH", "loc": "app/main.py:98", "text": "本地管理鉴权是可选的：只有 LOCAL_ADMIN_TOKEN 非空时才校验写请求；配置默认值为空，因此未配置 Token 时所有 POST/PUT/PATCH/DELETE API 均可被无认证调用。"}, {"sev": "HIGH", "loc": "app/routers/files.py:9", "text": "未鉴权的 /api/files/browse 调用 browse_video_directory，虽限制了根目录和路径穿越，但仍枚举 configured allowed roots 下的目录名、文件名、绝对路径、父路径和文件大小，造成本地媒体元数据泄露。"}, {"sev": "HIGH", "loc": "app/routers/tasks.py:223", "text": "async 路由直接执行同步重任务：音频处理、转写、切片和任务详情 ffprobe 可阻塞 FastAPI event loop，影响无关请求。"}, {"sev": "MED", "loc": "app/routers/tasks.py:35", "text": "大量 async 路由直接调用同步数据库、文件和服务函数；仅少数入口使用 run_in_threadpool，异步边界不一致，容易出现请求串行化和响应抖动。"}, {"sev": "MED", "loc": "app/models/task.py:7-41", "text": "TaskStatus 同时保留大写自动流水线状态和小写 legacy 状态；任意状态跳跃虽已修复，但模型、旧页面和 API 客户端仍需兼容两套值。"}, {"sev": "MED", "loc": "app/routers/tasks.py:35; app/routers/publish.py:1", "text": "tasks.py 与 publish.py 聚合大量路由、异常映射、同步/异步调度和业务编排，新增流程的 blast radius 较大。"}]}, {"id": "media_storage", "label": "Media & Storage", "band": "processing", "path": "storage/media/FFmpeg services", "desc": "管理 E 盘任务目录、路径安全、素材预检、FFmpeg/FFprobe 与受控子进程。", "coupling": "high", "deps": ["persistence"], "loc": 1614, "score": 84, "grade": "B", "tags": ["legacy", "dual-format", "glue", "fallback", "silent-except"], "findings": [{"sev": "MED", "loc": "app/services/storage_service.py:840-846", "text": "move_task_directory_to_trash 明确传入 reserve=False，仍采用查询后检查目录的非原子分配；当前无运行时调用，属于遗留兼容入口，但未来恢复调用时仍可能并发复用同一回收站目录。"}, {"sev": "MED", "loc": "app/services/storage_service.py:361-367", "text": "通用 resolve_video_file_path 对已存在路径仍原样返回。媒体 HTTP 路由已增加任务边界，但 publish/auto-publish/subtitle/task 查询等非 HTTP 调用方仍可把数据库中的现有外部路径交给后续读取或上传逻辑。"}, {"sev": "LOW", "loc": "tests/test_storage_boundaries.py:14-32", "text": "新增边界测试没有覆盖任务目录数据库读取在 sqlite3.Error、锁定或损坏数据库下显式失败的回归；代码已有保护但证据不足。"}, {"sev": "LOW", "loc": "app/services/storage_service.py:257-300", "text": "reserve=True 会在数据库任务记录写入前创建目录；进程在预占后崩溃可能留下无数据库记录的空目录，虽不会覆盖数据，但会造成孤儿目录累积。"}]}, {"id": "transcription", "label": "Transcription", "band": "processing", "path": "transcript services", "desc": "提取音频，调用火山引擎或 faster-whisper，并以分块 checkpoint 生成时间戳转写。", "coupling": "high", "deps": ["media_storage", "persistence"], "loc": 1960, "score": 59, "grade": "D", "tags": ["fallback", "silent-except", "fake-output", "duplication", "god-component", "glue", "over-fit"], "findings": [{"sev": "HIGH", "loc": "app/services/transcript_workflow_service.py:317", "text": "transcript Markdown 存在即返回 completed，未校验源指纹、Provider、进度状态或文件完整性。"}, {"sev": "HIGH", "loc": "app/services/transcript_service.py:265", "text": "JobLeaseLostError 已显式透传，但 TranscriptCancelledError 仍会被统一包装为 RuntimeError，取消可能落成 failed。"}, {"sev": "HIGH", "loc": "app/services/transcript_service.py:516", "text": "远程分块请求每次使用随机 request id，缺少持久化幂等键和超时后结果确认，重试可能重复计费。"}, {"sev": "MED", "loc": "app/services/transcript_service.py:516", "text": "HTTP 429、Retry-After、网络瞬断和可恢复服务错误缺少专门退避策略。"}, {"sev": "MED", "loc": "app/services/transcript_service.py:556", "text": "响应 result.message 可能被当作 0-1 秒转写正文写入结果。"}, {"sev": "MED", "loc": "app/services/transcript_service.py:831", "text": "进度文件 IO/JSON 损坏时静默返回空字典，可能隐藏故障并触发重复执行。"}, {"sev": "MED", "loc": "app/services/transcript_workflow_service.py:224", "text": "运行和取消状态仍是进程内 set，多进程/重启时不能可靠去重或取消。"}, {"sev": "MED", "loc": "app/services/transcript_service.py:325", "text": "本地和远程转写复制分块、checkpoint、异常和进度循环，行为容易漂移。"}, {"sev": "MED", "loc": "app/services/transcript_service.py:1088", "text": "Provider/模型/设备为模块级可变全局，并发任务可能互相覆盖运行元数据。"}, {"sev": "MED", "loc": "app/services/transcript_service.py:83", "text": "约 1300 行文件混合 FFmpeg、本地模型、远程 HTTP、checkpoint、进度和 Markdown，职责过大。"}, {"sev": "LOW", "loc": "tests/test_long_live_foundation.py:65", "text": "已覆盖失租 checkpoint 和异常透传，仍缺取消、429/坏响应、重复计费与真实 Markdown 闭环。"}]}, {"id": "ai_selection", "label": "AI Selection", "band": "processing", "path": "AI providers and analyzers", "desc": "选择 Codex/远程/本地 Provider，解析不稳定 AI 输出并生成通用、综艺或长直播候选片段。", "coupling": "core", "deps": ["transcription", "persistence"], "loc": 4420, "score": 63, "grade": "C", "tags": ["fallback", "silent-except", "legacy", "dual-format", "stub", "fake-output", "bloat", "duplication", "god-component"], "findings": [{"sev": "HIGH", "loc": "app/services/ai_config_service.py:318", "text": "get_ai_config_context 返回含 AI/ASR Key 的完整 values，GET /api/settings/ai 无读取鉴权，页面也复用该上下文。"}, {"sev": "MED", "loc": "app/services/ai/ai_clip_service.py:4", "text": "generate_candidate_clips_placeholder 返回三条硬编码 ClipCandidate；虽当前无调用方，误接线会产生 fake output。"}, {"sev": "MED", "loc": "app/services/ai/ai_clip_analyzer.py:131", "text": "分段分析失败窗口被跳过，只要其他窗口有候选便返回；通用路径缺少最低覆盖率门槛。"}, {"sev": "MED", "loc": "app/services/ai/variety_comedy_analyzer.py:513", "text": "全局评审失败时隐式降级到扩展阶段评分，Provider 失败仍可形成候选。"}, {"sev": "MED", "loc": "app/services/ai/local_model_provider.py:19", "text": "fallback_protocol 对任意 AIProviderError 都执行第二协议，未区分限流、认证和协议错误，可能重复调用与计费。"}, {"sev": "MED", "loc": "app/services/ai_analysis_workflow_service.py:738", "text": "候选事务替换、JSON 文件和 run 历史分步持久化，后续失败会形成数据库与文件/历史不一致。"}, {"sev": "MED", "loc": "app/services/ai/long_live_talk_analyzer.py:427", "text": "checkpoint 更新无 run/lease/owner fencing，并发或旧进程恢复可能互相覆盖窗口状态。"}, {"sev": "MED", "loc": "app/services/ai_analysis_workflow_service.py:71", "text": "分析元文件不存在、损坏或读取异常时静默返回空字典，无法区分未分析与产物损坏。"}, {"sev": "LOW", "loc": "app/services/ai/ai_clip_analyzer.py:456", "text": "输出归一化同时接受多组历史字段并填大量默认值，兼容有效但维护成本高。"}, {"sev": "LOW", "loc": "app/services/ai_config_service.py:55", "text": "旧 AI_REMOTE 与新分析/发布配置并存，运行时还改写全局 settings，形成双路径。"}, {"sev": "MED", "loc": "app/services/ai_analysis_workflow_service.py:685", "text": "单文件集中 profile、Provider、状态、候选、文件、历史与恢复，模块回归半径大。"}, {"sev": "MED", "loc": "app/services/ai/ai_clip_analyzer.py:252", "text": "多个分析器重复偏好摘要、时间转换、默认字段和 AI 输出解析逻辑。"}, {"sev": "MED", "loc": "tests/test_split_services.py:200", "text": "缺少真实 Provider 成功路径、文件写入失败一致性、并发运行和旧 checkpoint 覆盖测试。"}, {"sev": "MED", "loc": "tests/test_codex_cli_provider.py:12", "text": "Provider 测试主要 monkeypatch，缺少 HTTP 429/500/超时和协议 fallback 重复调用边界。"}, {"sev": "LOW", "loc": "tests/test_variety_comedy_selection.py:291", "text": "算法分支覆盖较好，但真实三阶段 Provider、资源消耗和全局评审降级未由集成测试锁定。"}]}, {"id": "task_review_cut", "label": "Task Review & Cut", "band": "workflow", "path": "task and cut workflow services", "desc": "维护任务状态与视图，保存候选审核选择，生成切片版本并同步发送中心。", "coupling": "core", "deps": ["media_storage", "ai_selection", "publish_center", "persistence"], "loc": 3036, "score": 78, "grade": "B", "tags": ["god-component", "glue", "fallback", "dual-format", "legacy", "over-fit"], "findings": [{"sev": "HIGH", "loc": "app/services/task_service.py:458-485,594-616", "text": "任务详情默认执行无 timeout 的 ffprobe，且未捕获 OSError/Path.stat 异常；NAS、损坏或卡死媒体可能阻塞详情请求或返回 500。明确延期至 P1.4。"}, {"sev": "MED", "loc": "app/services/task_lifecycle_service.py:373-401; tests/test_task_state_machine.py:69-82", "text": "公共状态转换前置条件只检查数据库字段或路径字符串，不验证源视频、候选产物和活跃 output 文件真实存在。明确延期至 P1.4。"}, {"sev": "MED", "loc": "app/services/task_service.py:1-98,1220-1273; app/services/task_query_service.py:16-24", "text": "TaskService 仍集中承担大量业务、数据库和展示职责，并与 task_query_service 互相导入、保留包装函数，维护 blast radius 较大。建议作为 P2 延后拆分。"}, {"sev": "MED", "loc": "app/services/task_service.py:717-718", "text": "候选片段列表会直接解析每条历史时间字段，单条异常格式仍可能阻断整个审核列表。"}, {"sev": "LOW", "loc": "app/services/task_lifecycle_service.py:139-225", "text": "任务目录预占后若后续数据库写入失败，仍缺少统一释放空目录的补偿路径，可能留下少量孤儿目录。"}]}, {"id": "subtitle", "label": "Subtitle", "band": "processing", "path": "subtitle services", "desc": "维护字幕轨、不可变 revision、cue、AI 建议、渲染验证与自动流水线交付决定。", "coupling": "high", "deps": ["media_storage", "task_review_cut", "ai_selection", "persistence"], "loc": 2409, "score": 70, "grade": "C", "tags": ["fallback", "silent-except", "legacy", "bloat", "god-component", "monkeypatch"], "findings": [{"sev": "MED", "loc": "app/services/subtitle_data_service.py:352", "text": "手工 revision 的 active/base 检查在事务外，并发编辑可覆盖 active 选择。"}, {"sev": "MED", "loc": "app/services/subtitle_data_service.py:489", "text": "批准 revision 在事务外校验，并发或重放旧请求可回退 active 版本。"}, {"sev": "MED", "loc": "app/services/subtitle_data_service.py:135", "text": "source/clip track 先查后插，NULL output_clip_id 约束不足，并发可能重复源轨。"}, {"sev": "MED", "loc": "app/services/subtitle_auto_workflow_service.py:87", "text": "批量批准逐 clip 独立提交，Job 后创建；中途失败会留下部分批准。"}, {"sev": "MED", "loc": "app/services/subtitle_data_service.py:168", "text": "source revision 提交后逐 clip 独立同步，异常会形成混合版本。"}, {"sev": "MED", "loc": "app/services/subtitle_workflow_service.py:475", "text": "字幕 job 完成与激活分两次写入，迟到 worker 仍可能激活旧成片。"}, {"sev": "LOW", "loc": "app/services/subtitle_auto_workflow_service.py:273", "text": "auto_config_json 损坏时静默降为空并写回，可能丢弃其他配置。"}, {"sev": "MED", "loc": "app/services/subtitle_data_service.py:1045", "text": "字幕数据服务聚合 track、revision、cue、导入导出、波形和渲染辅助，回归半径大。"}, {"sev": "LOW", "loc": "app/services/subtitle_workflow_service.py:312", "text": "统一 revision 外仍保留旧调用方适配，存在历史口径漂移成本。"}, {"sev": "MED", "loc": "tests/test_subtitle_editor.py:189", "text": "缺并发 save/approve/ensure track 与批处理中途失败测试。"}, {"sev": "LOW", "loc": "tests/test_subtitle_auto_workflow.py:172", "text": "核心真实渲染在 FFmpeg/FFprobe 缺失时会跳过，异常 Provider 证据不足。"}, {"sev": "LOW", "loc": "app/services/subtitle_data_service.py:761", "text": "波形处理把完整 PCM 捕获到内存，超长媒体存在时长线性内存峰值。"}, {"sev": "LOW", "loc": "app/services/subtitle_data_service.py:1024", "text": "单条字幕文本可接近文件上限，放大渲染、导出和 Prompt 资源消耗。"}]}, {"id": "pipeline_queue", "label": "Pipeline & Job Queue", "band": "workflow", "path": "pipeline and workflow job services", "desc": "用 SQLite Job、Lease、Heartbeat、Checkpoint 和子进程串联长任务与自动流水线。", "coupling": "core", "deps": ["transcription", "ai_selection", "task_review_cut", "subtitle", "publish_center", "persistence"], "loc": 2342, "score": 72, "grade": "C", "tags": ["fallback", "silent-except", "legacy", "stub", "god-component", "glue", "over-fit"], "findings": [{"sev": "MED", "loc": "app/services/pipeline_engine.py:108,311-314; app/services/job_service.py:488-504", "text": "自动流水线仅在内存 context 中保存步骤结果，虽有 update_job_checkpoint API，但 PipelineEngine 未持久化调用；重启后可能从 PREPARING_SOURCE 重新执行并重复 AI、封面和排期副作用。"}, {"sev": "MED", "loc": "app/services/job_worker.py:198-202", "text": "WorkflowJobRunner 将子进程 stdout/stderr 重定向到 DEVNULL，父进程通常只能记录退出码，重启恢复和人工诊断证据不足。"}, {"sev": "MED", "loc": "app/services/job_service.py:127-139", "text": "payload/result/checkpoint JSON 损坏时静默保留原字符串，执行器后续可能产生不明确的数据类型错误。"}, {"sev": "MED", "loc": "app/services/job_service.py:19-23; app/services/job_worker.py:60-69", "text": "ai_analysis 与 publish job 类型仍可创建，但 Worker 没有对应执行分支，最终统一失败，属于可创建但不可执行的 legacy/stub 入口。"}, {"sev": "LOW", "loc": "app/services/pipeline_engine.py:693-720", "text": "产物 JSON 或排期时间配置损坏时静默回退默认值，故障可见性不足。"}, {"sev": "LOW", "loc": "app/services/job_worker.py:310-353", "text": "父 Worker 在 lease 已过期但尚未被其他执行接管时仍可能写入 Job 终态；token 接管后会被拒绝，当前属于较低概率恢复边界。"}]}, {"id": "publish_center", "label": "Publish Center", "band": "workflow", "path": "publish content preparation services", "desc": "准备标题、简介、话题、封面、账号和发布草稿，并保留历史兼容执行入口。", "coupling": "core", "deps": ["task_review_cut", "subtitle", "publish_scheduler", "publisher_worker", "persistence"], "loc": 5593, "score": 52, "grade": "D", "tags": ["god-component", "bloat", "legacy", "dual-format", "fallback", "silent-except", "placeholder", "duplication"], "findings": [{"sev": "HIGH", "loc": "app/services/publish_service.py:570", "text": "_normalize_config/_normalize_account 仅新增 *_masked 字段，却保留 client_secret、access_token、refresh_token 原字段；GET /api/publish/platforms、/accounts 及保存配置/账号响应直接返回这些原始密钥，存在敏感凭据泄漏风险。"}, {"sev": "MED", "loc": "app/services/publish_service.py:266", "text": "publish_service.py 当前约4750行，混合配置/账号/OAuth、文案与封面、队列同步、历史、旧 OpenCLI 脚本、API Provider 和页面上下文，形成高耦合 God Component，任一发布流程改动的 blast radius 很大。"}, {"sev": "MED", "loc": "app/services/publish_service.py:2941", "text": "历史查询 SQL 只按 PUBLISH_HISTORY_STATUSES 的大写值过滤，之后才调用 _normalize_publish_status；LEGACY_STATUS_MAP 支持旧小写状态但旧记录会在 SQL 层被提前排除，历史页可能漏数据。"}, {"sev": "MED", "loc": "app/services/publish_service.py:2144", "text": "sync_task_publish_jobs 封面生成失败时只把 {'cover_error': ...} 放入 item_covers，仍继续插入 WAITING 任务且不计入 errors；同步可能返回 ok，但生成的任务实际无法通过 local_browser readiness。"}, {"sev": "MED", "loc": "app/services/publish_service.py:2787", "text": "create_batch_publish_jobs 对不存在的 output_clip_id 直接 continue，全部无效或部分无效时仍返回 status='ok'，调用方无法区分‘创建成功’与‘输入被静默丢弃’。"}, {"sev": "MED", "loc": "app/services/publish_readiness.py:167", "text": "publish_domain/create_publish_job 仍允许 api_publish，publishers registry 也保留兼容入口，但统一 readiness 只接受 local_browser/manual_export 并将 api_publish 标记 unsupported_publish_mode，持久化任务与调度契约不一致。"}, {"sev": "MED", "loc": "app/services/publish_providers.py:117", "text": "BilibiliPublishProvider 在完成配置和 token 校验后始终抛出 bilibili_provider_pending；api_publish 模式仍可创建/注册，因此这是已接线但必然失败的 placeholder 路径。"}, {"sev": "MED", "loc": "app/services/publish_providers.py:66", "text": "旧 Douyin API Provider 将 upload 与 create 分成两个无幂等键的请求；_request_json 只包装 HTTPError/URLError，平台已接收后网络超时或连接异常可能被判失败，重试会重复上传/投稿且没有 NEED_REVIEW 不确定态。"}, {"sev": "LOW", "loc": "app/services/publish_providers.py:204", "text": "_post_multipart 先 file_path.read_bytes() 再 b''.join(chunks)，完整视频和完整 multipart body 同时驻留内存，大文件发布存在约双倍峰值。"}, {"sev": "LOW", "loc": "app/services/publish_service.py:1569", "text": "_batch_find_publish_jobs 对每条记录直接调用 _normalize_job(row)，未传入预取 accounts；_normalize_job 会逐条触发 readiness/account 查询，发布中心批量切片时形成 N+1 查询。"}, {"sev": "LOW", "loc": "tests/test_publish_history.py:111", "text": "现有定向测试未覆盖原始 Secret/Token 响应、旧小写历史状态、同步封面 partial、批量无效 ID，以及 API 超时后已接收的重复投稿边界。"}]}, {"id": "publish_scheduler", "label": "Publish Scheduler", "band": "execution", "path": "scheduler/repository/executor", "desc": "计算排期、原子领取发布任务、重试、恢复不确定执行并维护发布状态机。", "coupling": "core", "deps": ["publish_center", "publisher_worker", "persistence"], "loc": 2329, "score": 71, "grade": "C", "tags": ["god-component", "bloat", "legacy", "silent-except"], "findings": [{"sev": "MED", "loc": "app/services/publish_scheduler.py:756-785", "text": "recover_interrupted_jobs 每轮加载全部 PUBLISHING 任务，并对每个任务串行查询 Worker，没有批量上限、并发控制或退避；Worker 不可用或卡住任务较多时，单轮耗时按任务数乘以网络超时增长，会延迟后续排期处理。"}, {"sev": "MED", "loc": "app/services/publish_scheduler.py:281-302", "text": "list_due_jobs 每轮 SELECT 全部 SCHEDULED 记录，再逐条在 Python 中解析时间；虽已有状态/排期索引，但没有 SQL due 条件、分页或批量上限，排期量增长后会增加扫描内存和调度延迟。"}, {"sev": "MED", "loc": "app/services/publish_scheduler.py:133-1788", "text": "PublishScheduler 约 1891 行、42 个方法，同时承担排期计算、任务领取、执行结果写回、Worker 恢复、重试修复、人工复核、批量排期和旧版兼容；职责边界过宽，修改任一状态路径的回归半径较大。"}, {"sev": "LOW", "loc": "app/services/publish_scheduler.py:274-279", "text": "shutdown 已能追踪并等待后台 Task，但没有超时或取消兜底；若当前 run_once 被数据库锁、Worker 串行查询或文件操作长期阻塞，应用优雅停机仍可能无限等待。"}, {"sev": "LOW", "loc": "app/services/publish_scheduler.py:1807-1812", "text": "queue_snapshot 对非法 scheduled_at 捕获 ValueError 后静默 pass；损坏排期会从“今日任务”视图中消失，未产生告警或错误计数，降低数据异常可见性。"}]}, {"id": "publisher_worker", "label": "Publishers & Worker", "band": "execution", "path": "publisher registry and Windows worker", "desc": "通过 Publisher Registry 和 Windows Chrome Worker 执行抖音/B站投稿、导出与兼容模式。", "coupling": "high", "deps": ["media_storage", "persistence"], "loc": 2699, "score": 76, "grade": "B", "tags": ["legacy", "glue", "silent-except", "fallback"], "findings": [{"sev": "MED", "loc": "scripts/publish_host_worker.py:321", "text": "_prior_job_execution_requires_review 扫描旧 execution journal 时，若 journal 缺少 identity 或已损坏，直接 continue；跨 execution 无法确认其 job_id 时不会阻断新 execution。旧 Worker 在上传后崩溃并留下无身份/损坏日志时，仍存在重复投稿边界。"}, {"sev": "LOW", "loc": "app/services/publishers/page_scripts.py:14", "text": "页面脚本入口仍通过延迟导入 publish_service 私有函数来转发大量 DOM 脚本；这是有意保留的兼容层，但形成 legacy glue，脚本变更仍会牵连 4750 行 God Service。"}, {"sev": "LOW", "loc": "app/services/publishers/browser_runtime.py:315", "text": "screenshot 捕获裸 Exception 后返回空字符串，截图失败不会进入发布结果或健康信号；发布可以继续但缺少关键诊断证据。"}, {"sev": "LOW", "loc": "scripts/opencli_host_bridge.py:74", "text": "旧 OpenCLIHostBridgeHandler 的 /run 处理器本身没有 Bearer Token 校验；当前 main 已转调受保护的 publish_host_worker，默认入口不再使用它，但保留的可直接实例化旧处理器仍会造成安全边界误解。"}, {"sev": "LOW", "loc": "tests/test_publish_worker_client.py:155", "text": "当前测试已覆盖双进程锁竞争、死进程锁回收和常规 execution fencing，但仍未覆盖无身份/损坏旧 journal 被跨 execution 扫描跳过、screenshot 失败信号及旧 bridge 处理器被直接启动时的鉴权边界。"}]}, {"id": "persistence", "label": "SQLite Persistence", "band": "persistence", "path": "app/db + backup services", "desc": "创建 SQLite Schema、执行启动时兼容迁移和索引，并提供 WAL 安全备份恢复。", "coupling": "core", "deps": [], "loc": 3436, "score": 64, "grade": "C", "tags": ["silent-except", "legacy", "dual-format", "bloat", "god-component"], "findings": [{"sev": "HIGH", "loc": "app/db/database.py:628-671", "text": "_create_indexes 先删除 uq_publish_jobs_active_clip_platform_mode，随后对所有索引创建统一捕获 sqlite3.Error 并静默忽略；唯一部分索引创建失败时，旧索引已删除且无告警，活动发布任务可能失去唯一约束并产生重复记录。"}, {"sev": "MED", "loc": "app/db/database.py:31-617", "text": "数据库初始化依赖多个结构探针和缺列即 ALTER TABLE，没有 PRAGMA user_version、schema_migrations 或可追踪迁移版本；历史数据库的实际结构只能由当前代码反推。"}, {"sev": "MED", "loc": "app/db/database.py:754,1162", "text": "多个迁移函数使用 executescript，发布表迁移还会在数据规范化前提交新增列；后续失败时可能已持久化部分结构，init_db 不是原子升级。"}, {"sev": "LOW", "loc": "app/db/database.py:656-657", "text": "workflow job claim 索引未覆盖 lease_expires_at；队列规模增大或过期任务集中时可能读取更多候选行，属于性能退化而非当前正确性故障。"}]}, {"id": "ops_delivery", "label": "Ops & Delivery", "band": "persistence", "path": "Docker/PowerShell/CI", "desc": "提供 Windows/Docker 启停、诊断、CI、发布门禁、Demo 与维护脚本。", "coupling": "med", "deps": ["api_runtime", "publisher_worker", "persistence"], "loc": 4347, "score": 68, "grade": "C", "tags": ["fallback", "legacy", "dual-format", "duplication", "bloat", "glue", "silent-except", "monkeypatch"], "findings": [{"sev": "MED", "loc": ".github/workflows/ci.yml:3", "text": "CI 仅监听 master push/PR；feature/docs 直接 push 不即时验证，问题延迟到开 PR。"}, {"sev": "MED", "loc": "scripts/start_docker_opencli.ps1:24", "text": "健康检查异常只警告不返回非零，服务失败也可能被调用方视为启动成功。"}, {"sev": "MED", "loc": "scripts/start.ps1:30", "text": "Demo 覆盖生效前先对正式 E 盘配置运行 doctor，新机/迁移机的隔离 Demo 可能被旧路径阻断。"}, {"sev": "MED", "loc": "scripts/start.ps1:71", "text": "Worker 启动异常被捕获后继续并报告工作台成功，发布能力不可用时易被误判完整健康。"}, {"sev": "HIGH", "loc": "scripts/migrate_task_dirs_to_project_names.py:211", "text": "任务目录迁移用非 WAL-aware 主库 copy，先移动目录再统一更新提交，无文件补偿，异常会让路径/DB 不一致。"}, {"sev": "MED", "loc": "scripts/restore.ps1:27", "text": "恢复只以健康响应判断 App 运行，StopServices 只停 Compose；native/异常健康进程可能仍持有 DB 时执行替换。"}, {"sev": "MED", "loc": "scripts/backup.ps1:33", "text": "备份默认包含 .env 且不加密，仅显式 ExcludeEnv 才排除，包被共享时泄漏本机秘密。"}, {"sev": "MED", "loc": "tests/test_native_scripts.py:11", "text": "启停测试主要是源码字符串断言，Windows smoke 不做实际 restore/冲突/清理失败与恢复后健康验证。"}, {"sev": "MED", "loc": "scripts/seed_demo_data.py:32", "text": "缺 FFmpeg 时仍插入无媒体路径 Demo 数据并成功退出，数量检查通过但媒体 smoke 不可信。"}, {"sev": "LOW", "loc": "scripts/acceptance.ps1:115", "text": "验收递归扫描正式任务目录，媒体量大/锁文件会显著拖慢或阻断 release gate。"}, {"sev": "LOW", "loc": "scripts/backup_restore_runtime.py:142", "text": "import 时 monkeypatch backup core，全局行为依赖导入顺序。"}, {"sev": "LOW", "loc": "docs/PORTABLE_SETUP.md:127", "text": "文档描述与当前 start.ps1 实现不符，旧 Next Steps 又保留兼容入口，启动排障认知漂移。"}]}]};
 const M = DATA.modules || [];
 const BANDS = DATA.bands || [];
 const SPINE = DATA.spine || [];
diff --git a/.codemap/codemap.md b/.codemap/codemap.md
index a997cab..c7397a2 100644
--- a/.codemap/codemap.md
+++ b/.codemap/codemap.md
@@ -7,17 +7,17 @@
 
 > **Interactive view:** [`.codemap/codemap.html`](codemap.html) — per-module scores, findings, LoC, and the dependency graph. This file is the written report.
 
-**Generated:** 2026-08-24 · **Modules:** 13 · **Size:** 49906 tracked LoC across 132 files
+**Generated:** 2026-08-24 · **Modules:** 13 · **Size:** 50778 tracked LoC across 132 files
 
 ## Health by layer
 
 | Layer | Modules | Avg score |
 |---|--:|--:|
-| 界面 · API | 2 | 62 |
-| 业务编排 | 3 | 62 |
+| 界面 · API | 2 | 56 |
+| 业务编排 | 3 | 67 |
 | 媒体与 AI 处理 | 4 | 69 |
 | 外部执行边界 | 2 | 74 |
-| 持久化与运维 | 2 | 68 |
+| 持久化与运维 | 2 | 66 |
 
 ## Per-module lines of code & score
 
@@ -28,15 +28,15 @@ _LoC is the representative file/folder per module; folder-level modules overlap
 | Module | LoC | Score | Tags |
 |---|--:|:--|:--|
 | Frontend UI | 13,840 | 65 C | god-component, bloat, glue, duplication, legacy |
-| API & Runtime | 2,749 | 58 D | fallback, legacy, dual-format, duplication, glue, bloat, god-component, silent-except, any-escape |
+| API & Runtime | 2,753 | 48 D | fallback, legacy, dual-format, bloat, glue |
 
 ### 业务编排
 
 | Module | LoC | Score | Tags |
 |---|--:|:--|:--|
 | Publish Center | 5,593 | 52 D | god-component, bloat, legacy, dual-format, fallback, silent-except, placeholder, duplication |
-| Task Review & Cut | 2,462 | 60 C | god-component, glue, duplication, dual-format, fallback, legacy, over-fit, silent-except |
-| Pipeline & Job Queue | 2,048 | 74 C | fallback, silent-except, legacy, stub, god-component, glue, over-fit |
+| Task Review & Cut | 3,036 | 78 B | god-component, glue, fallback, dual-format, legacy, over-fit |
+| Pipeline & Job Queue | 2,342 | 72 C | fallback, silent-except, legacy, stub, god-component, glue, over-fit |
 
 ### 媒体与 AI 处理
 
@@ -59,53 +59,49 @@ _LoC is the representative file/folder per module; folder-level modules overlap
 | Module | LoC | Score | Tags |
 |---|--:|:--|:--|
 | Ops & Delivery | 4,347 | 68 C | fallback, legacy, dual-format, duplication, bloat, glue, silent-except, monkeypatch |
-| SQLite Persistence | 3,436 | 69 C | silent-except, fallback, legacy, dual-format, glue, bloat, god-component, monkeypatch |
+| SQLite Persistence | 3,436 | 64 C | silent-except, legacy, dual-format, bloat, god-component |
 
 ## Worst offenders
 
+- **API & Runtime (48/D)** — app/routers/settings.py:10: GET /api/settings/ai 未做鉴权，返回 ai_config_service.get_ai_config_context() 中的原始 values；该上下文会从 .env/环境变量读取 API key、token 等 Secret，并同时返回 env_path。前端或本地恶意页面可直接读取凭据。
 - **Publish Center (52/D)** — app/services/publish_service.py:570: _normalize_config/_normalize_account 仅新增 *_masked 字段，却保留 client_secret、access_token、refresh_token 原字段；GET /api/publish/platforms、/accounts 及保存配置/账号响应直接返回这些原始密钥，存在敏感凭据泄漏风险。
-- **API & Runtime (58/D)** — app/routers/settings.py:44: AI/发布设置读取接口仍可能返回原始 Secret/API Key/OAuth Token；本地页面脚本和任意能访问接口的调用方可读取敏感配置。
 - **Transcription (59/D)** — app/services/transcript_workflow_service.py:317: transcript Markdown 存在即返回 completed，未校验源指纹、Provider、进度状态或文件完整性。
-- **Task Review & Cut (60/C)** — app/services/video_cut_workflow_service.py:248-255: 每个 CutResult 通过 _insert_output_clip_record 独立提交事务；中途插入异常时前面的 output_clip 已落库，cut_run 未被标记 failed，任务可能停留在 cutting 并同时暴露半批新结果。
 - **AI Selection (63/C)** — app/services/ai_config_service.py:318: get_ai_config_context 返回含 AI/ASR Key 的完整 values，GET /api/settings/ai 无读取鉴权，页面也复用该上下文。
+- **SQLite Persistence (64/C)** — app/db/database.py:628-671: _create_indexes 先删除 uq_publish_jobs_active_clip_platform_mode，随后对所有索引创建统一捕获 sqlite3.Error 并静默忽略；唯一部分索引创建失败时，旧索引已删除且无告警，活动发布任务可能失去唯一约束并产生重复记录。
 - **Frontend UI (65/C)** — app/static/js/app.js:211: 多个写请求绕过统一 apiFetch；启用 LOCAL_ADMIN_TOKEN 时可能缺失 Authorization 并被 API 拒绝。
 - **Ops & Delivery (68/C)** — scripts/migrate_task_dirs_to_project_names.py:211: 任务目录迁移用非 WAL-aware 主库 copy，先移动目录再统一更新提交，无文件补偿，异常会让路径/DB 不一致。
-- **SQLite Persistence (69/C)** — app/db/database.py:31: init_db 仍依赖结构探测执行启动迁移，没有 user_version 或 schema_migrations 账本。
 - **Subtitle (70/C)** — app/services/subtitle_data_service.py:352: 手工 revision 的 active/base 检查在事务外，并发编辑可覆盖 active 选择。
 - **Publish Scheduler (71/C)** — app/services/publish_scheduler.py:756-785: recover_interrupted_jobs 每轮加载全部 PUBLISHING 任务，并对每个任务串行查询 Worker，没有批量上限、并发控制或退避；Worker 不可用或卡住任务较多时，单轮耗时按任务数乘以网络超时增长，会延迟后续排期处理。
+- **Pipeline & Job Queue (72/C)** — app/services/pipeline_engine.py:108,311-314; app/services/job_service.py:488-504: 自动流水线仅在内存 context 中保存步骤结果，虽有 update_job_checkpoint API，但 PipelineEngine 未持久化调用；重启后可能从 PREPARING_SOURCE 重新执行并重复 AI、封面和排期副作用。
 
 ## All findings
 
-### HIGH (15)
+### HIGH (14)
 
 - **Frontend UI** · `app/static/js/app.js:211` — 多个写请求绕过统一 apiFetch；启用 LOCAL_ADMIN_TOKEN 时可能缺失 Authorization 并被 API 拒绝。
 - **Frontend UI** · `app/static/js/app.js:1729` — 接口或任务数据直接拼接到 innerHTML；publish-center.js:2152 有同类路径，存在本地 DOM XSS/页面结构破坏风险。
-- **API & Runtime** · `app/routers/settings.py:44` — AI/发布设置读取接口仍可能返回原始 Secret/API Key/OAuth Token；本地页面脚本和任意能访问接口的调用方可读取敏感配置。
-- **API & Runtime** · `app/services/task_lifecycle_service.py:152` — 任务主状态仍可由 PATCH /api/tasks/{task_id}/status 直接写入，未校验合法状态转移、前置产物或当前状态；空任务可被标记 completed。
+- **API & Runtime** · `app/routers/settings.py:10` — GET /api/settings/ai 未做鉴权，返回 ai_config_service.get_ai_config_context() 中的原始 values；该上下文会从 .env/环境变量读取 API key、token 等 Secret，并同时返回 env_path。前端或本地恶意页面可直接读取凭据。
+- **API & Runtime** · `app/main.py:98` — 本地管理鉴权是可选的：只有 LOCAL_ADMIN_TOKEN 非空时才校验写请求；配置默认值为空，因此未配置 Token 时所有 POST/PUT/PATCH/DELETE API 均可被无认证调用。
+- **API & Runtime** · `app/routers/files.py:9` — 未鉴权的 /api/files/browse 调用 browse_video_directory，虽限制了根目录和路径穿越，但仍枚举 configured allowed roots 下的目录名、文件名、绝对路径、父路径和文件大小，造成本地媒体元数据泄露。
+- **API & Runtime** · `app/routers/tasks.py:223` — async 路由直接执行同步重任务：音频处理、转写、切片和任务详情 ffprobe 可阻塞 FastAPI event loop，影响无关请求。
 - **Transcription** · `app/services/transcript_workflow_service.py:317` — transcript Markdown 存在即返回 completed，未校验源指纹、Provider、进度状态或文件完整性。
 - **Transcription** · `app/services/transcript_service.py:265` — JobLeaseLostError 已显式透传，但 TranscriptCancelledError 仍会被统一包装为 RuntimeError，取消可能落成 failed。
 - **Transcription** · `app/services/transcript_service.py:516` — 远程分块请求每次使用随机 request id，缺少持久化幂等键和超时后结果确认，重试可能重复计费。
 - **AI Selection** · `app/services/ai_config_service.py:318` — get_ai_config_context 返回含 AI/ASR Key 的完整 values，GET /api/settings/ai 无读取鉴权，页面也复用该上下文。
-- **Task Review & Cut** · `app/services/video_cut_workflow_service.py:248-255` — 每个 CutResult 通过 _insert_output_clip_record 独立提交事务；中途插入异常时前面的 output_clip 已落库，cut_run 未被标记 failed，任务可能停留在 cutting 并同时暴露半批新结果。
-- **Task Review & Cut** · `app/services/task_lifecycle_service.py:156-180` — update_task_status 仍按 task_id 直接写入任意传入状态和进度，没有合法状态迁移、前置产物或并发条件；API 直接暴露 PATCH /status，可将空任务跳转为 completed。
-- **Task Review & Cut** · `app/services/task_service.py:451-478` — _probe_video 调用 ffprobe 没有 timeout，也没有捕获 subprocess OSError、媒体读取异常或 stat 异常；get_task 默认 include_video_probe=True，损坏、卡死或不可达媒体可长期阻塞任务详情或直接 500。
-- **Pipeline & Job Queue** · `app/services/pipeline_engine.py:118` — 取消仍只在每个 step 开始前检查；step 执行期间及最后一步完成后缺少统一取消门禁，Workflow Job 与任务主状态仍可能分叉。
-- **Pipeline & Job Queue** · `app/services/pipeline_engine.py:158` — READY_TO_PUBLISH 在同一次 run 中立即转为 COMPLETED，待人工确认状态不可稳定观察。
+- **Task Review & Cut** · `app/services/task_service.py:458-485,594-616` — 任务详情默认执行无 timeout 的 ffprobe，且未捕获 OSError/Path.stat 异常；NAS、损坏或卡死媒体可能阻塞详情请求或返回 500。明确延期至 P1.4。
 - **Publish Center** · `app/services/publish_service.py:570` — _normalize_config/_normalize_account 仅新增 *_masked 字段，却保留 client_secret、access_token、refresh_token 原字段；GET /api/publish/platforms、/accounts 及保存配置/账号响应直接返回这些原始密钥，存在敏感凭据泄漏风险。
+- **SQLite Persistence** · `app/db/database.py:628-671` — _create_indexes 先删除 uq_publish_jobs_active_clip_platform_mode，随后对所有索引创建统一捕获 sqlite3.Error 并静默忽略；唯一部分索引创建失败时，旧索引已删除且无告警，活动发布任务可能失去唯一约束并产生重复记录。
 - **Ops & Delivery** · `scripts/migrate_task_dirs_to_project_names.py:211` — 任务目录迁移用非 WAL-aware 主库 copy，先移动目录再统一更新提交，无文件补偿，异常会让路径/DB 不一致。
 
-### MED (74)
+### MED (63)
 
 - **Frontend UI** · `app/templates/system_status.html:98` — 配置/API Key 字段进入 DOM，base.html:11 还承载本地管理 Token；需确认全链路始终掩码。
 - **Frontend UI** · `app/static/css/styles.css:870` — 使用多个未在 :root 定义的 CSS 自定义属性，相关声明可能失效。
 - **Frontend UI** · `app/static/js/app.js:1` — 任务、转写、AI、审核、切片、字幕和配置行为集中在超大全局脚本，回归半径较大。
 - **Frontend UI** · `tests/test_publish_center_browser.py:16` — Playwright 缺失时核心浏览器测试可静默跳过，字幕交互与鉴权失败路径覆盖不足。
-- **API & Runtime** · `app/core/security.py:23` — 本地管理员鉴权是可选配置；token 为空时写接口仅依赖 loopback/CORS 部署假设，若监听范围或反向代理配置改变会扩大未授权操作面。
-- **API & Runtime** · `app/services/task_service.py:587` — 任务详情按 id 查询但不统一过滤 is_deleted，已永久删除任务仍可能被详情和后续动作读取，删除语义与查询语义不一致。
-- **API & Runtime** · `app/routers/tasks.py:127` — 多个 async 路由直接执行同步 SQLite、文件系统、FFprobe/FFmpeg 辅助逻辑，慢磁盘或损坏媒体可阻塞事件循环。
-- **API & Runtime** · `app/models/task.py:12` — 任务状态同时存在枚举、大小写字符串和旧别名，多处路由/服务自行转换，状态口径容易漂移。
-- **API & Runtime** · `app/routers/files.py:30` — 已有文件浏览接口在本地鉴权可选时允许匿名枚举白名单根目录中的媒体元数据，部署边界变化后会泄露本地文件信息。
-- **API & Runtime** · `app/services/publish_scheduler.py:274` — Scheduler 关闭会等待当前 run_once 完成；真实发布/恢复调用最长可接近配置的 1800 秒，停机延迟虽优先保证不重复投稿，但仍缺独立可观测的 drain 超时策略。
+- **API & Runtime** · `app/routers/tasks.py:35` — 大量 async 路由直接调用同步数据库、文件和服务函数；仅少数入口使用 run_in_threadpool，异步边界不一致，容易出现请求串行化和响应抖动。
+- **API & Runtime** · `app/models/task.py:7-41` — TaskStatus 同时保留大写自动流水线状态和小写 legacy 状态；任意状态跳跃虽已修复，但模型、旧页面和 API 客户端仍需兼容两套值。
+- **API & Runtime** · `app/routers/tasks.py:35; app/routers/publish.py:1` — tasks.py 与 publish.py 聚合大量路由、异常映射、同步/异步调度和业务编排，新增流程的 blast radius 较大。
 - **Media & Storage** · `app/services/storage_service.py:840-846` — move_task_directory_to_trash 明确传入 reserve=False，仍采用查询后检查目录的非原子分配；当前无运行时调用，属于遗留兼容入口，但未来恢复调用时仍可能并发复用同一回收站目录。
 - **Media & Storage** · `app/services/storage_service.py:361-367` — 通用 resolve_video_file_path 对已存在路径仍原样返回。媒体 HTTP 路由已增加任务边界，但 publish/auto-publish/subtitle/task 查询等非 HTTP 调用方仍可把数据库中的现有外部路径交给后续读取或上传逻辑。
 - **Transcription** · `app/services/transcript_service.py:516` — HTTP 429、Retry-After、网络瞬断和可恢复服务错误缺少专门退避策略。
@@ -126,13 +122,9 @@ _LoC is the representative file/folder per module; folder-level modules overlap
 - **AI Selection** · `app/services/ai/ai_clip_analyzer.py:252` — 多个分析器重复偏好摘要、时间转换、默认字段和 AI 输出解析逻辑。
 - **AI Selection** · `tests/test_split_services.py:200` — 缺少真实 Provider 成功路径、文件写入失败一致性、并发运行和旧 checkpoint 覆盖测试。
 - **AI Selection** · `tests/test_codex_cli_provider.py:12` — Provider 测试主要 monkeypatch，缺少 HTTP 429/500/超时和协议 fallback 重复调用边界。
-- **Task Review & Cut** · `app/services/video_cut_workflow_service.py:18-45` — _next_cut_run_number 先 SELECT MAX(run_number)，随后由独立连接 INSERT，缺少事务序列化或唯一约束；并发重切可能产生重复 run_number。
-- **Task Review & Cut** · `app/services/task_lifecycle_service.py:66-71` — allocate_task_dir_name 会先原子预占目录，再由 create_task_directory 和数据库 INSERT 继续执行；后续目录初始化或数据库提交失败时没有统一释放已预占的空目录，可能累积孤儿目录并影响后续命名。
-- **Task Review & Cut** · `app/services/task_service.py:14-96` — task_service 仍集中导入 AI、字幕、转写、存储、切片等大量私有服务函数，并与 task_lifecycle_service 形成动态反向依赖，职责边界复杂。
-- **Task Review & Cut** · `app/services/task_query_service.py:89-172` — _batch_all_output_clips 复制 task_service.list_output_clips 的路径解析、字幕状态和发布就绪判断；两套口径未来可能分叉。
-- **Task Review & Cut** · `app/services/task_service.py:587-603` — get_task 查询只按 id，不过滤 is_deleted；已永久删除且仅应保留历史的任务仍可被详情和后续动作读取。
-- **Task Review & Cut** · `app/services/task_service.py:717-718` — list_clip_candidates 直接解析每条 start_time/end_time，单条历史脏时间格式可阻断整个审核页。
-- **Task Review & Cut** · `app/services/video_cut_workflow_service.py:269-289` — 切片成功后先把任务更新为完成，再同步发送中心；同步异常只返回 partial，主状态与发布关联可能不一致。
+- **Task Review & Cut** · `app/services/task_lifecycle_service.py:373-401; tests/test_task_state_machine.py:69-82` — 公共状态转换前置条件只检查数据库字段或路径字符串，不验证源视频、候选产物和活跃 output 文件真实存在。明确延期至 P1.4。
+- **Task Review & Cut** · `app/services/task_service.py:1-98,1220-1273; app/services/task_query_service.py:16-24` — TaskService 仍集中承担大量业务、数据库和展示职责，并与 task_query_service 互相导入、保留包装函数，维护 blast radius 较大。建议作为 P2 延后拆分。
+- **Task Review & Cut** · `app/services/task_service.py:717-718` — 候选片段列表会直接解析每条历史时间字段，单条异常格式仍可能阻断整个审核列表。
 - **Subtitle** · `app/services/subtitle_data_service.py:352` — 手工 revision 的 active/base 检查在事务外，并发编辑可覆盖 active 选择。
 - **Subtitle** · `app/services/subtitle_data_service.py:489` — 批准 revision 在事务外校验，并发或重放旧请求可回退 active 版本。
 - **Subtitle** · `app/services/subtitle_data_service.py:135` — source/clip track 先查后插，NULL output_clip_id 约束不足，并发可能重复源轨。
@@ -141,11 +133,10 @@ _LoC is the representative file/folder per module; folder-level modules overlap
 - **Subtitle** · `app/services/subtitle_workflow_service.py:475` — 字幕 job 完成与激活分两次写入，迟到 worker 仍可能激活旧成片。
 - **Subtitle** · `app/services/subtitle_data_service.py:1045` — 字幕数据服务聚合 track、revision、cue、导入导出、波形和渲染辅助，回归半径大。
 - **Subtitle** · `tests/test_subtitle_editor.py:189` — 缺并发 save/approve/ensure track 与批处理中途失败测试。
-- **Pipeline & Job Queue** · `app/services/pipeline_engine.py:104` — Pipeline context 仍只保存在内存，缺少按 step 的可重放副作用 checkpoint；重启可能重复 AI、封面或排期动作。
-- **Pipeline & Job Queue** · `app/services/pipeline_engine.py:145` — 普通 step 失败后写 summary 仍可能二次失败并遮蔽原始异常。
-- **Pipeline & Job Queue** · `app/services/job_worker.py:198` — 子进程 stdout/stderr 仍丢弃，父进程只保留退出码，恢复与诊断证据不足。
-- **Pipeline & Job Queue** · `app/services/job_service.py:126` — Job JSON 损坏时静默保留原字符串，执行器可能产生不明确的数据错误。
-- **Pipeline & Job Queue** · `app/services/job_service.py:18` — ai_analysis 与 publish 类型仍可创建但 worker 未实现，属于可创建不可执行的 legacy/stub。
+- **Pipeline & Job Queue** · `app/services/pipeline_engine.py:108,311-314; app/services/job_service.py:488-504` — 自动流水线仅在内存 context 中保存步骤结果，虽有 update_job_checkpoint API，但 PipelineEngine 未持久化调用；重启后可能从 PREPARING_SOURCE 重新执行并重复 AI、封面和排期副作用。
+- **Pipeline & Job Queue** · `app/services/job_worker.py:198-202` — WorkflowJobRunner 将子进程 stdout/stderr 重定向到 DEVNULL，父进程通常只能记录退出码，重启恢复和人工诊断证据不足。
+- **Pipeline & Job Queue** · `app/services/job_service.py:127-139` — payload/result/checkpoint JSON 损坏时静默保留原字符串，执行器后续可能产生不明确的数据类型错误。
+- **Pipeline & Job Queue** · `app/services/job_service.py:19-23; app/services/job_worker.py:60-69` — ai_analysis 与 publish job 类型仍可创建，但 Worker 没有对应执行分支，最终统一失败，属于可创建但不可执行的 legacy/stub 入口。
 - **Publish Center** · `app/services/publish_service.py:266` — publish_service.py 当前约4750行，混合配置/账号/OAuth、文案与封面、队列同步、历史、旧 OpenCLI 脚本、API Provider 和页面上下文，形成高耦合 God Component，任一发布流程改动的 blast radius 很大。
 - **Publish Center** · `app/services/publish_service.py:2941` — 历史查询 SQL 只按 PUBLISH_HISTORY_STATUSES 的大写值过滤，之后才调用 _normalize_publish_status；LEGACY_STATUS_MAP 支持旧小写状态但旧记录会在 SQL 层被提前排除，历史页可能漏数据。
 - **Publish Center** · `app/services/publish_service.py:2144` — sync_task_publish_jobs 封面生成失败时只把 {'cover_error': ...} 放入 item_covers，仍继续插入 WAITING 任务且不计入 errors；同步可能返回 ok，但生成的任务实际无法通过 local_browser readiness。
@@ -157,11 +148,8 @@ _LoC is the representative file/folder per module; folder-level modules overlap
 - **Publish Scheduler** · `app/services/publish_scheduler.py:281-302` — list_due_jobs 每轮 SELECT 全部 SCHEDULED 记录，再逐条在 Python 中解析时间；虽已有状态/排期索引，但没有 SQL due 条件、分页或批量上限，排期量增长后会增加扫描内存和调度延迟。
 - **Publish Scheduler** · `app/services/publish_scheduler.py:133-1788` — PublishScheduler 约 1891 行、42 个方法，同时承担排期计算、任务领取、执行结果写回、Worker 恢复、重试修复、人工复核、批量排期和旧版兼容；职责边界过宽，修改任一状态路径的回归半径较大。
 - **Publishers & Worker** · `scripts/publish_host_worker.py:321` — _prior_job_execution_requires_review 扫描旧 execution journal 时，若 journal 缺少 identity 或已损坏，直接 continue；跨 execution 无法确认其 job_id 时不会阻断新 execution。旧 Worker 在上传后崩溃并留下无身份/损坏日志时，仍存在重复投稿边界。
-- **SQLite Persistence** · `app/db/database.py:31` — init_db 仍依赖结构探测执行启动迁移，没有 user_version 或 schema_migrations 账本。
-- **SQLite Persistence** · `app/db/database.py:625` — 索引创建捕获所有 sqlite3.Error 后静默继续，关键唯一索引失败可能无告警。
-- **SQLite Persistence** · `app/db/database.py:675` — 历史表迁移主要补列，未系统重建或验证旧库 Foreign Key、UNIQUE、CHECK 约束。
-- **SQLite Persistence** · `scripts/backup_restore.py:305` — 备份验证未覆盖 foreign_key_check、关键索引和迁移版本。
-- **SQLite Persistence** · `scripts/backup_restore.py:529` — 直接恢复函数内部没有统一进程锁或活动连接门禁。
+- **SQLite Persistence** · `app/db/database.py:31-617` — 数据库初始化依赖多个结构探针和缺列即 ALTER TABLE，没有 PRAGMA user_version、schema_migrations 或可追踪迁移版本；历史数据库的实际结构只能由当前代码反推。
+- **SQLite Persistence** · `app/db/database.py:754,1162` — 多个迁移函数使用 executescript，发布表迁移还会在数据规范化前提交新增列；后续失败时可能已持久化部分结构，init_db 不是原子升级。
 - **Ops & Delivery** · `.github/workflows/ci.yml:3` — CI 仅监听 master push/PR；feature/docs 直接 push 不即时验证，问题延迟到开 PR。
 - **Ops & Delivery** · `scripts/start_docker_opencli.ps1:24` — 健康检查异常只警告不返回非零，服务失败也可能被调用方视为启动成功。
 - **Ops & Delivery** · `scripts/start.ps1:30` — Demo 覆盖生效前先对正式 E 盘配置运行 doctor，新机/迁移机的隔离 Demo 可能被旧路径阻断。
@@ -171,31 +159,24 @@ _LoC is the representative file/folder per module; folder-level modules overlap
 - **Ops & Delivery** · `tests/test_native_scripts.py:11` — 启停测试主要是源码字符串断言，Windows smoke 不做实际 restore/冲突/清理失败与恢复后健康验证。
 - **Ops & Delivery** · `scripts/seed_demo_data.py:32` — 缺 FFmpeg 时仍插入无媒体路径 Demo 数据并成功退出，数量检查通过但媒体 smoke 不可信。
 
-### LOW (37)
+### LOW (29)
 
 - **Frontend UI** · `app/static/js/subtitle-editor.js:171` — 字幕编辑器已有 escapeHtml、虚拟列表、竞态 token 与自动保存版本控制，是可保留的正向实现。
 - **Frontend UI** · `app/static/js/publish-center.js:4` — 前端明确只创建抖音任务，B站保留后端兼容；这是当前产品边界而非应机械删除的代码。
-- **API & Runtime** · `app/main.py:91` — /health 只返回进程级 ok，未覆盖数据库可写、任务存储、Scheduler/Worker readiness，无法作为完整就绪判断。
-- **API & Runtime** · `app/routers/settings.py:170` — OAuth 错误信息通过 query 参数回显到页面，缺少统一长度/字符约束与结构化错误码。
-- **API & Runtime** · `app/core/config.py:1` — 配置定义和兼容别名仍分散在 settings、环境变量与发布服务，存在重复默认值和 dual-format 维护成本。
-- **API & Runtime** · `app/models/task.py:360` — speaker_styles 等动态结构仍使用 Any，边界校验主要依赖下游调用方。
 - **Media & Storage** · `tests/test_storage_boundaries.py:14-32` — 新增边界测试没有覆盖任务目录数据库读取在 sqlite3.Error、锁定或损坏数据库下显式失败的回归；代码已有保护但证据不足。
 - **Media & Storage** · `app/services/storage_service.py:257-300` — reserve=True 会在数据库任务记录写入前创建目录；进程在预占后崩溃可能留下无数据库记录的空目录，虽不会覆盖数据，但会造成孤儿目录累积。
 - **Transcription** · `tests/test_long_live_foundation.py:65` — 已覆盖失租 checkpoint 和异常透传，仍缺取消、429/坏响应、重复计费与真实 Markdown 闭环。
 - **AI Selection** · `app/services/ai/ai_clip_analyzer.py:456` — 输出归一化同时接受多组历史字段并填大量默认值，兼容有效但维护成本高。
 - **AI Selection** · `app/services/ai_config_service.py:55` — 旧 AI_REMOTE 与新分析/发布配置并存，运行时还改写全局 settings，形成双路径。
 - **AI Selection** · `tests/test_variety_comedy_selection.py:291` — 算法分支覆盖较好，但真实三阶段 Provider、资源消耗和全局评审降级未由集成测试锁定。
-- **Task Review & Cut** · `tests/test_path_resolution.py:44-68` — 目录唯一性单元测试为连续调用；并发线程回归由 tests/test_storage_boundaries.py 单独覆盖。
-- **Task Review & Cut** · `tests/test_split_services.py:119-137` — 测试将没有产物的任务直接更新为 completed 并断言成功，固化了任意状态跳跃行为。
-- **Task Review & Cut** · `tests/test_versioning_rollback.py:163-178` — 版本测试使用虚构输出路径，只验证数据库标记，没有覆盖真实 FFmpeg 输出、文件切换和恢复。
+- **Task Review & Cut** · `app/services/task_lifecycle_service.py:139-225` — 任务目录预占后若后续数据库写入失败，仍缺少统一释放空目录的补偿路径，可能留下少量孤儿目录。
 - **Subtitle** · `app/services/subtitle_auto_workflow_service.py:273` — auto_config_json 损坏时静默降为空并写回，可能丢弃其他配置。
 - **Subtitle** · `app/services/subtitle_workflow_service.py:312` — 统一 revision 外仍保留旧调用方适配，存在历史口径漂移成本。
 - **Subtitle** · `tests/test_subtitle_auto_workflow.py:172` — 核心真实渲染在 FFmpeg/FFprobe 缺失时会跳过，异常 Provider 证据不足。
 - **Subtitle** · `app/services/subtitle_data_service.py:761` — 波形处理把完整 PCM 捕获到内存，超长媒体存在时长线性内存峰值。
 - **Subtitle** · `app/services/subtitle_data_service.py:1024` — 单条字幕文本可接近文件上限，放大渲染、导出和 Prompt 资源消耗。
-- **Pipeline & Job Queue** · `tests/test_job_fencing.py:59` — 已覆盖 owner/token、迁移、转写 checkpoint 与字幕 cleanup fencing，但尚无真实父子进程重启中失租测试。
-- **Pipeline & Job Queue** · `tests/test_auto_pipeline.py:204` — 仍缺稳定 READY 状态、最后一步取消和重启副作用去重测试。
-- **Pipeline & Job Queue** · `app/services/pipeline_engine.py:572` — JSON/时间配置损坏时静默回退默认排期，故障可见性不足。
+- **Pipeline & Job Queue** · `app/services/pipeline_engine.py:693-720` — 产物 JSON 或排期时间配置损坏时静默回退默认值，故障可见性不足。
+- **Pipeline & Job Queue** · `app/services/job_worker.py:310-353` — 父 Worker 在 lease 已过期但尚未被其他执行接管时仍可能写入 Job 终态；token 接管后会被拒绝，当前属于较低概率恢复边界。
 - **Publish Center** · `app/services/publish_providers.py:204` — _post_multipart 先 file_path.read_bytes() 再 b''.join(chunks)，完整视频和完整 multipart body 同时驻留内存，大文件发布存在约双倍峰值。
 - **Publish Center** · `app/services/publish_service.py:1569` — _batch_find_publish_jobs 对每条记录直接调用 _normalize_job(row)，未传入预取 accounts；_normalize_job 会逐条触发 readiness/account 查询，发布中心批量切片时形成 N+1 查询。
 - **Publish Center** · `tests/test_publish_history.py:111` — 现有定向测试未覆盖原始 Secret/Token 响应、旧小写历史状态、同步封面 partial、批量无效 ID，以及 API 超时后已接收的重复投稿边界。
@@ -205,8 +186,7 @@ _LoC is the representative file/folder per module; folder-level modules overlap
 - **Publishers & Worker** · `app/services/publishers/browser_runtime.py:315` — screenshot 捕获裸 Exception 后返回空字符串，截图失败不会进入发布结果或健康信号；发布可以继续但缺少关键诊断证据。
 - **Publishers & Worker** · `scripts/opencli_host_bridge.py:74` — 旧 OpenCLIHostBridgeHandler 的 /run 处理器本身没有 Bearer Token 校验；当前 main 已转调受保护的 publish_host_worker，默认入口不再使用它，但保留的可直接实例化旧处理器仍会造成安全边界误解。
 - **Publishers & Worker** · `tests/test_publish_worker_client.py:155` — 当前测试已覆盖双进程锁竞争、死进程锁回收和常规 execution fencing，但仍未覆盖无身份/损坏旧 journal 被跨 execution 扫描跳过、screenshot 失败信号及旧 bridge 处理器被直接启动时的鉴权边界。
-- **SQLite Persistence** · `app/db/database.py:656` — Workflow claim 索引未覆盖 lease_expires_at，队列规模增长后过期接管扫描可能退化。
-- **SQLite Persistence** · `tests/test_job_fencing.py:206` — 已覆盖并发补列和旧 running guard，仍缺完整启动链迁移失败回滚测试。
+- **SQLite Persistence** · `app/db/database.py:656-657` — workflow job claim 索引未覆盖 lease_expires_at；队列规模增大或过期任务集中时可能读取更多候选行，属于性能退化而非当前正确性故障。
 - **Ops & Delivery** · `scripts/acceptance.ps1:115` — 验收递归扫描正式任务目录，媒体量大/锁文件会显著拖慢或阻断 release gate。
 - **Ops & Delivery** · `scripts/backup_restore_runtime.py:142` — import 时 monkeypatch backup core，全局行为依赖导入顺序。
 - **Ops & Delivery** · `docs/PORTABLE_SETUP.md:127` — 文档描述与当前 start.ps1 实现不符，旧 Next Steps 又保留兼容入口，启动排障认知漂移。
@@ -214,9 +194,10 @@ _LoC is the representative file/folder per module; folder-level modules overlap
 ## Cross-cutting themes
 
 - **本地单体架构是当前可运行的主要原因.** FastAPI + SQLite WAL + 文件产物 + 持久化 Job + Windows Worker 与个人本机规模匹配；不需要微服务化，现有恢复骨架应保留。
-- **P0 数据一致性边界已封口，事务型旧债仍需继续.** 活动库外键、测试误删和媒体删除回滚已修复；迁移无账本、切片批次半提交与并发版本号仍是下一阶段重点。
-- **Job 与发布执行代际已封口，下一风险转向业务状态原子性.** Workflow lease token、Publish execution fencing 和 Windows Worker journal 幂等已经完成；任务状态跳跃、切片半提交和取消恢复仍是下一阶段重点。
+- **P0 数据一致性边界已封口，事务型旧债仍需继续.** 活动库外键、测试误删、媒体删除回滚和切片批次原子提交已修复；迁移无账本与索引重建失败静默降级仍是下一阶段重点。
+- **Job、发布执行和任务状态代际已封口，下一风险转向跨进程精确续跑.** Workflow lease token、Publish execution fencing、任务状态转换、取消恢复和切片原子提交已经完成；下一阶段重点是持久化 step checkpoint 与副作用复用。
 - **可用性 fallback 正在掩盖降级结果.** AI 部分窗口、转写旧产物、损坏 JSON、封面生成、批量发布和风险字段多处静默继续，用户不一定能区分完整成功、部分成功和旧结果。
 - **发布与配置读取是主要安全边界.** Publish Center、AI Config 与 Frontend 仍存在原始 Secret 响应、可选写鉴权和 DOM XSS；Worker 路径与 journal 脱敏已收紧，但本地管理员接口门禁尚未完成。
 - **复杂度集中而非全项目平均恶化.** publish_service.py、publish-center.js、app.js、publish_scheduler.py、subtitle_data_service.py 和 transcript_service.py 是主要 God Component；应按业务边界渐进拆分。
-- **测试已与活动数据隔离，但 Coverage 与真实故障闭环仍不足.** 610 项测试全部通过，Pytest 已强制使用进程级 sandbox；Coverage 尚未采集，真实平台 E2E 和故障注入仍需在不触发生产副作用的边界下补齐。
+- **测试已与活动数据隔离，但 Coverage 与真实故障闭环仍不足.** 637 项测试全部通过，Pytest 已强制使用进程级 sandbox；Coverage 尚未采集，真实平台 E2E 和故障注入仍需在不触发生产副作用的边界下补齐。
+
diff --git a/.codemap/modules.json b/.codemap/modules.json
index 7c6896f..8fdd5cc 100644
--- a/.codemap/modules.json
+++ b/.codemap/modules.json
@@ -7,9 +7,9 @@
   "htmlPath": ".codemap/codemap.html",
   "mdPath": ".codemap/codemap.md",
   "spineDesc": "用户通过页面/API 创建素材任务，SQLite Job 驱动转写、AI 选片、审核切片和字幕，再由发送中心排期并交给 Windows Chrome Worker，所有状态与审计证据回写 SQLite。",
-  "tracked_loc": 49906,
+  "tracked_loc": 50778,
   "tracked_files": 132,
-  "rev": "8fabe125e2e358d173603203407104ad6727b2ab"
+  "rev": "a01f103c43916d25310254f6f8389e9fc9e52521"
  },
  "excludes": [
   ".venv/",
@@ -83,11 +83,11 @@
   ],
   [
    "P0 数据一致性边界已封口，事务型旧债仍需继续",
-   "活动库外键、测试误删和媒体删除回滚已修复；迁移无账本、切片批次半提交与并发版本号仍是下一阶段重点。"
+   "活动库外键、测试误删、媒体删除回滚和切片批次原子提交已修复；迁移无账本与索引重建失败静默降级仍是下一阶段重点。"
   ],
   [
-   "Job 与发布执行代际已封口，下一风险转向业务状态原子性",
-   "Workflow lease token、Publish execution fencing 和 Windows Worker journal 幂等已经完成；任务状态跳跃、切片半提交和取消恢复仍是下一阶段重点。"
+   "Job、发布执行和任务状态代际已封口，下一风险转向跨进程精确续跑",
+   "Workflow lease token、Publish execution fencing、任务状态转换、取消恢复和切片原子提交已经完成；下一阶段重点是持久化 step checkpoint 与副作用复用。"
   ],
   [
    "可用性 fallback 正在掩盖降级结果",
@@ -103,7 +103,7 @@
   ],
   [
    "测试已与活动数据隔离，但 Coverage 与真实故障闭环仍不足",
-   "610 项测试全部通过，Pytest 已强制使用进程级 sandbox；Coverage 尚未采集，真实平台 E2E 和故障注入仍需在不触发生产副作用的边界下补齐。"
+   "637 项测试全部通过，Pytest 已强制使用进程级 sandbox；Coverage 尚未采集，真实平台 E2E 和故障注入仍需在不触发生产副作用的边界下补齐。"
   ]
  ],
  "modules": [
@@ -213,86 +213,57 @@
     "tests/test_publish_api_flow.py",
     "tests/test_task_defaults.py"
    ],
-   "loc": 2749,
-   "contentHash": "bb078bebcbae22363a4d74cc17097c1bf255af1c6b30c3919cd9cee81896ff29",
-   "score": 58,
+   "loc": 2753,
+   "contentHash": "8a8fa3f1a5adcab077b892a2318643b14312c8fe82905fe42995c618acf40638",
+   "score": 48,
    "grade": "D",
    "tags": [
     "fallback",
     "legacy",
     "dual-format",
-    "duplication",
-    "glue",
     "bloat",
-    "god-component",
-    "silent-except",
-    "any-escape"
+    "glue"
    ],
    "findings": [
     {
      "sev": "HIGH",
-     "loc": "app/routers/settings.py:44",
-     "text": "AI/发布设置读取接口仍可能返回原始 Secret/API Key/OAuth Token；本地页面脚本和任意能访问接口的调用方可读取敏感配置。"
+     "loc": "app/routers/settings.py:10",
+     "text": "GET /api/settings/ai 未做鉴权，返回 ai_config_service.get_ai_config_context() 中的原始 values；该上下文会从 .env/环境变量读取 API key、token 等 Secret，并同时返回 env_path。前端或本地恶意页面可直接读取凭据。"
     },
     {
      "sev": "HIGH",
-     "loc": "app/services/task_lifecycle_service.py:152",
-     "text": "任务主状态仍可由 PATCH /api/tasks/{task_id}/status 直接写入，未校验合法状态转移、前置产物或当前状态；空任务可被标记 completed。"
+     "loc": "app/main.py:98",
+     "text": "本地管理鉴权是可选的：只有 LOCAL_ADMIN_TOKEN 非空时才校验写请求；配置默认值为空，因此未配置 Token 时所有 POST/PUT/PATCH/DELETE API 均可被无认证调用。"
     },
     {
-     "sev": "MED",
-     "loc": "app/core/security.py:23",
-     "text": "本地管理员鉴权是可选配置；token 为空时写接口仅依赖 loopback/CORS 部署假设，若监听范围或反向代理配置改变会扩大未授权操作面。"
-    },
-    {
-     "sev": "MED",
-     "loc": "app/services/task_service.py:587",
-     "text": "任务详情按 id 查询但不统一过滤 is_deleted，已永久删除任务仍可能被详情和后续动作读取，删除语义与查询语义不一致。"
+     "sev": "HIGH",
+     "loc": "app/routers/files.py:9",
+     "text": "未鉴权的 /api/files/browse 调用 browse_video_directory，虽限制了根目录和路径穿越，但仍枚举 configured allowed roots 下的目录名、文件名、绝对路径、父路径和文件大小，造成本地媒体元数据泄露。"
     },
     {
-     "sev": "MED",
-     "loc": "app/routers/tasks.py:127",
-     "text": "多个 async 路由直接执行同步 SQLite、文件系统、FFprobe/FFmpeg 辅助逻辑，慢磁盘或损坏媒体可阻塞事件循环。"
+     "sev": "HIGH",
+     "loc": "app/routers/tasks.py:223",
+     "text": "async 路由直接执行同步重任务：音频处理、转写、切片和任务详情 ffprobe 可阻塞 FastAPI event loop，影响无关请求。"
     },
     {
      "sev": "MED",
-     "loc": "app/models/task.py:12",
-     "text": "任务状态同时存在枚举、大小写字符串和旧别名，多处路由/服务自行转换，状态口径容易漂移。"
+     "loc": "app/routers/tasks.py:35",
+     "text": "大量 async 路由直接调用同步数据库、文件和服务函数；仅少数入口使用 run_in_threadpool，异步边界不一致，容易出现请求串行化和响应抖动。"
     },
     {
      "sev": "MED",
-     "loc": "app/routers/files.py:30",
-     "text": "已有文件浏览接口在本地鉴权可选时允许匿名枚举白名单根目录中的媒体元数据，部署边界变化后会泄露本地文件信息。"
-    },
-    {
-     "sev": "LOW",
-     "loc": "app/main.py:91",
-     "text": "/health 只返回进程级 ok，未覆盖数据库可写、任务存储、Scheduler/Worker readiness，无法作为完整就绪判断。"
-    },
-    {
-     "sev": "LOW",
-     "loc": "app/routers/settings.py:170",
-     "text": "OAuth 错误信息通过 query 参数回显到页面，缺少统一长度/字符约束与结构化错误码。"
-    },
-    {
-     "sev": "LOW",
-     "loc": "app/core/config.py:1",
-     "text": "配置定义和兼容别名仍分散在 settings、环境变量与发布服务，存在重复默认值和 dual-format 维护成本。"
-    },
-    {
-     "sev": "LOW",
-     "loc": "app/models/task.py:360",
-     "text": "speaker_styles 等动态结构仍使用 Any，边界校验主要依赖下游调用方。"
+     "loc": "app/models/task.py:7-41",
+     "text": "TaskStatus 同时保留大写自动流水线状态和小写 legacy 状态；任意状态跳跃虽已修复，但模型、旧页面和 API 客户端仍需兼容两套值。"
     },
     {
      "sev": "MED",
-     "loc": "app/services/publish_scheduler.py:274",
-     "text": "Scheduler 关闭会等待当前 run_once 完成；真实发布/恢复调用最长可接近配置的 1800 秒，停机延迟虽优先保证不重复投稿，但仍缺独立可观测的 drain 超时策略。"
+     "loc": "app/routers/tasks.py:35; app/routers/publish.py:1",
+     "text": "tasks.py 与 publish.py 聚合大量路由、异常映射、同步/异步调度和业务编排，新增流程的 blast radius 较大。"
     }
    ],
-   "auditedHash": "bb078bebcbae22363a4d74cc17097c1bf255af1c6b30c3919cd9cee81896ff29",
+   "auditedHash": "8a8fa3f1a5adcab077b892a2318643b14312c8fe82905fe42995c618acf40638",
    "auditedAt": "2026-08-24",
-   "auditedRev": "8fabe125e2e358d173603203407104ad6727b2ab"
+   "auditedRev": ""
   },
   {
    "id": "media_storage",
@@ -595,88 +566,46 @@
     "tests/test_clip_review_publish_sync.py",
     "tests/test_versioning_rollback.py"
    ],
-   "loc": 2462,
-   "contentHash": "6122597a1799e3f9353e73d1b13507a3da8904a548dd2cd60baf37f3dd3f8f75",
-   "score": 60,
-   "grade": "C",
+   "loc": 3036,
+   "contentHash": "a680b073e141a493339c3379357671ca9b43bcf84d7b9149928168449e1f2fc6",
+   "score": 78,
+   "grade": "B",
    "tags": [
     "god-component",
     "glue",
-    "duplication",
-    "dual-format",
     "fallback",
+    "dual-format",
     "legacy",
-    "over-fit",
-    "silent-except"
+    "over-fit"
    ],
    "findings": [
     {
      "sev": "HIGH",
-     "loc": "app/services/video_cut_workflow_service.py:248-255",
-     "text": "每个 CutResult 通过 _insert_output_clip_record 独立提交事务；中途插入异常时前面的 output_clip 已落库，cut_run 未被标记 failed，任务可能停留在 cutting 并同时暴露半批新结果。"
-    },
-    {
-     "sev": "HIGH",
-     "loc": "app/services/task_lifecycle_service.py:156-180",
-     "text": "update_task_status 仍按 task_id 直接写入任意传入状态和进度，没有合法状态迁移、前置产物或并发条件；API 直接暴露 PATCH /status，可将空任务跳转为 completed。"
-    },
-    {
-     "sev": "HIGH",
-     "loc": "app/services/task_service.py:451-478",
-     "text": "_probe_video 调用 ffprobe 没有 timeout，也没有捕获 subprocess OSError、媒体读取异常或 stat 异常；get_task 默认 include_video_probe=True，损坏、卡死或不可达媒体可长期阻塞任务详情或直接 500。"
-    },
-    {
-     "sev": "MED",
-     "loc": "app/services/video_cut_workflow_service.py:18-45",
-     "text": "_next_cut_run_number 先 SELECT MAX(run_number)，随后由独立连接 INSERT，缺少事务序列化或唯一约束；并发重切可能产生重复 run_number。"
-    },
-    {
-     "sev": "MED",
-     "loc": "app/services/task_lifecycle_service.py:66-71",
-     "text": "allocate_task_dir_name 会先原子预占目录，再由 create_task_directory 和数据库 INSERT 继续执行；后续目录初始化或数据库提交失败时没有统一释放已预占的空目录，可能累积孤儿目录并影响后续命名。"
+     "loc": "app/services/task_service.py:458-485,594-616",
+     "text": "任务详情默认执行无 timeout 的 ffprobe，且未捕获 OSError/Path.stat 异常；NAS、损坏或卡死媒体可能阻塞详情请求或返回 500。明确延期至 P1.4。"
     },
     {
      "sev": "MED",
-     "loc": "app/services/task_service.py:14-96",
-     "text": "task_service 仍集中导入 AI、字幕、转写、存储、切片等大量私有服务函数，并与 task_lifecycle_service 形成动态反向依赖，职责边界复杂。"
+     "loc": "app/services/task_lifecycle_service.py:373-401; tests/test_task_state_machine.py:69-82",
+     "text": "公共状态转换前置条件只检查数据库字段或路径字符串，不验证源视频、候选产物和活跃 output 文件真实存在。明确延期至 P1.4。"
     },
     {
      "sev": "MED",
-     "loc": "app/services/task_query_service.py:89-172",
-     "text": "_batch_all_output_clips 复制 task_service.list_output_clips 的路径解析、字幕状态和发布就绪判断；两套口径未来可能分叉。"
-    },
-    {
-     "sev": "MED",
-     "loc": "app/services/task_service.py:587-603",
-     "text": "get_task 查询只按 id，不过滤 is_deleted；已永久删除且仅应保留历史的任务仍可被详情和后续动作读取。"
+     "loc": "app/services/task_service.py:1-98,1220-1273; app/services/task_query_service.py:16-24",
+     "text": "TaskService 仍集中承担大量业务、数据库和展示职责，并与 task_query_service 互相导入、保留包装函数，维护 blast radius 较大。建议作为 P2 延后拆分。"
     },
     {
      "sev": "MED",
      "loc": "app/services/task_service.py:717-718",
-     "text": "list_clip_candidates 直接解析每条 start_time/end_time，单条历史脏时间格式可阻断整个审核页。"
-    },
-    {
-     "sev": "MED",
-     "loc": "app/services/video_cut_workflow_service.py:269-289",
-     "text": "切片成功后先把任务更新为完成，再同步发送中心；同步异常只返回 partial，主状态与发布关联可能不一致。"
-    },
-    {
-     "sev": "LOW",
-     "loc": "tests/test_path_resolution.py:44-68",
-     "text": "目录唯一性单元测试为连续调用；并发线程回归由 tests/test_storage_boundaries.py 单独覆盖。"
-    },
-    {
-     "sev": "LOW",
-     "loc": "tests/test_split_services.py:119-137",
-     "text": "测试将没有产物的任务直接更新为 completed 并断言成功，固化了任意状态跳跃行为。"
+     "text": "候选片段列表会直接解析每条历史时间字段，单条异常格式仍可能阻断整个审核列表。"
     },
     {
      "sev": "LOW",
-     "loc": "tests/test_versioning_rollback.py:163-178",
-     "text": "版本测试使用虚构输出路径，只验证数据库标记，没有覆盖真实 FFmpeg 输出、文件切换和恢复。"
+     "loc": "app/services/task_lifecycle_service.py:139-225",
+     "text": "任务目录预占后若后续数据库写入失败，仍缺少统一释放空目录的补偿路径，可能留下少量孤儿目录。"
     }
    ],
-   "auditedHash": "6122597a1799e3f9353e73d1b13507a3da8904a548dd2cd60baf37f3dd3f8f75",
+   "auditedHash": "a680b073e141a493339c3379357671ca9b43bcf84d7b9149928168449e1f2fc6",
    "auditedAt": "2026-08-24",
    "auditedRev": ""
   },
@@ -811,9 +740,9 @@
     "tests/test_job_queue.py",
     "tests/test_subtitle_auto_workflow.py"
    ],
-   "loc": 2048,
-   "contentHash": "954a67ff0864dc491a4457f64a830e5ae6d876fde40ae22bd0c335661a9b9fa1",
-   "score": 74,
+   "loc": 2342,
+   "contentHash": "6c81ef8f8e0fb45e635df5c6facba8ed4366581b7aca28e6c1ab9fd1b070a8dc",
+   "score": 72,
    "grade": "C",
    "tags": [
     "fallback",
@@ -825,60 +754,40 @@
     "over-fit"
    ],
    "findings": [
-    {
-     "sev": "HIGH",
-     "loc": "app/services/pipeline_engine.py:118",
-     "text": "取消仍只在每个 step 开始前检查；step 执行期间及最后一步完成后缺少统一取消门禁，Workflow Job 与任务主状态仍可能分叉。"
-    },
-    {
-     "sev": "HIGH",
-     "loc": "app/services/pipeline_engine.py:158",
-     "text": "READY_TO_PUBLISH 在同一次 run 中立即转为 COMPLETED，待人工确认状态不可稳定观察。"
-    },
     {
      "sev": "MED",
-     "loc": "app/services/pipeline_engine.py:104",
-     "text": "Pipeline context 仍只保存在内存，缺少按 step 的可重放副作用 checkpoint；重启可能重复 AI、封面或排期动作。"
+     "loc": "app/services/pipeline_engine.py:108,311-314; app/services/job_service.py:488-504",
+     "text": "自动流水线仅在内存 context 中保存步骤结果，虽有 update_job_checkpoint API，但 PipelineEngine 未持久化调用；重启后可能从 PREPARING_SOURCE 重新执行并重复 AI、封面和排期副作用。"
     },
     {
      "sev": "MED",
-     "loc": "app/services/pipeline_engine.py:145",
-     "text": "普通 step 失败后写 summary 仍可能二次失败并遮蔽原始异常。"
+     "loc": "app/services/job_worker.py:198-202",
+     "text": "WorkflowJobRunner 将子进程 stdout/stderr 重定向到 DEVNULL，父进程通常只能记录退出码，重启恢复和人工诊断证据不足。"
     },
     {
      "sev": "MED",
-     "loc": "app/services/job_worker.py:198",
-     "text": "子进程 stdout/stderr 仍丢弃，父进程只保留退出码，恢复与诊断证据不足。"
+     "loc": "app/services/job_service.py:127-139",
+     "text": "payload/result/checkpoint JSON 损坏时静默保留原字符串，执行器后续可能产生不明确的数据类型错误。"
     },
     {
      "sev": "MED",
-     "loc": "app/services/job_service.py:126",
-     "text": "Job JSON 损坏时静默保留原字符串，执行器可能产生不明确的数据错误。"
-    },
-    {
-     "sev": "MED",
-     "loc": "app/services/job_service.py:18",
-     "text": "ai_analysis 与 publish 类型仍可创建但 worker 未实现，属于可创建不可执行的 legacy/stub。"
-    },
-    {
-     "sev": "LOW",
-     "loc": "tests/test_job_fencing.py:59",
-     "text": "已覆盖 owner/token、迁移、转写 checkpoint 与字幕 cleanup fencing，但尚无真实父子进程重启中失租测试。"
+     "loc": "app/services/job_service.py:19-23; app/services/job_worker.py:60-69",
+     "text": "ai_analysis 与 publish job 类型仍可创建，但 Worker 没有对应执行分支，最终统一失败，属于可创建但不可执行的 legacy/stub 入口。"
     },
     {
      "sev": "LOW",
-     "loc": "tests/test_auto_pipeline.py:204",
-     "text": "仍缺稳定 READY 状态、最后一步取消和重启副作用去重测试。"
+     "loc": "app/services/pipeline_engine.py:693-720",
+     "text": "产物 JSON 或排期时间配置损坏时静默回退默认值，故障可见性不足。"
     },
     {
      "sev": "LOW",
-     "loc": "app/services/pipeline_engine.py:572",
-     "text": "JSON/时间配置损坏时静默回退默认排期，故障可见性不足。"
+     "loc": "app/services/job_worker.py:310-353",
+     "text": "父 Worker 在 lease 已过期但尚未被其他执行接管时仍可能写入 Job 终态；token 接管后会被拒绝，当前属于较低概率恢复边界。"
     }
    ],
-   "auditedHash": "954a67ff0864dc491a4457f64a830e5ae6d876fde40ae22bd0c335661a9b9fa1",
+   "auditedHash": "6c81ef8f8e0fb45e635df5c6facba8ed4366581b7aca28e6c1ab9fd1b070a8dc",
    "auditedAt": "2026-08-24",
-   "auditedRev": "9ae8440d80d0527c7dd296fe1331b63aac2818ea"
+   "auditedRev": ""
   },
   {
    "id": "publish_center",
@@ -1136,59 +1045,41 @@
     "tests/test_p1_1_db_performance.py"
    ],
    "loc": 3436,
-   "contentHash": "fe28b5f8835fb06486b9b9465f880bc872b6b6c95116d92c74c5ac8b442a08ae",
-   "score": 69,
+   "contentHash": "11881e23de872fd56070da719c9ca72f8e8f23e1dead1b32b099f7a56adfbdcf",
+   "score": 64,
    "grade": "C",
    "tags": [
     "silent-except",
-    "fallback",
     "legacy",
     "dual-format",
-    "glue",
     "bloat",
-    "god-component",
-    "monkeypatch"
+    "god-component"
    ],
    "findings": [
     {
-     "sev": "MED",
-     "loc": "app/db/database.py:31",
-     "text": "init_db 仍依赖结构探测执行启动迁移，没有 user_version 或 schema_migrations 账本。"
-    },
-    {
-     "sev": "MED",
-     "loc": "app/db/database.py:625",
-     "text": "索引创建捕获所有 sqlite3.Error 后静默继续，关键唯一索引失败可能无告警。"
-    },
-    {
-     "sev": "MED",
-     "loc": "app/db/database.py:675",
-     "text": "历史表迁移主要补列，未系统重建或验证旧库 Foreign Key、UNIQUE、CHECK 约束。"
+     "sev": "HIGH",
+     "loc": "app/db/database.py:628-671",
+     "text": "_create_indexes 先删除 uq_publish_jobs_active_clip_platform_mode，随后对所有索引创建统一捕获 sqlite3.Error 并静默忽略；唯一部分索引创建失败时，旧索引已删除且无告警，活动发布任务可能失去唯一约束并产生重复记录。"
     },
     {
      "sev": "MED",
-     "loc": "scripts/backup_restore.py:305",
-     "text": "备份验证未覆盖 foreign_key_check、关键索引和迁移版本。"
+     "loc": "app/db/database.py:31-617",
+     "text": "数据库初始化依赖多个结构探针和缺列即 ALTER TABLE，没有 PRAGMA user_version、schema_migrations 或可追踪迁移版本；历史数据库的实际结构只能由当前代码反推。"
     },
     {
      "sev": "MED",
-     "loc": "scripts/backup_restore.py:529",
-     "text": "直接恢复函数内部没有统一进程锁或活动连接门禁。"
+     "loc": "app/db/database.py:754,1162",
+     "text": "多个迁移函数使用 executescript，发布表迁移还会在数据规范化前提交新增列；后续失败时可能已持久化部分结构，init_db 不是原子升级。"
     },
     {
      "sev": "LOW",
-     "loc": "app/db/database.py:656",
-     "text": "Workflow claim 索引未覆盖 lease_expires_at，队列规模增长后过期接管扫描可能退化。"
-    },
-    {
-     "sev": "LOW",
-     "loc": "tests/test_job_fencing.py:206",
-     "text": "已覆盖并发补列和旧 running guard，仍缺完整启动链迁移失败回滚测试。"
+     "loc": "app/db/database.py:656-657",
+     "text": "workflow job claim 索引未覆盖 lease_expires_at；队列规模增大或过期任务集中时可能读取更多候选行，属于性能退化而非当前正确性故障。"
     }
    ],
-   "auditedHash": "fe28b5f8835fb06486b9b9465f880bc872b6b6c95116d92c74c5ac8b442a08ae",
+   "auditedHash": "11881e23de872fd56070da719c9ca72f8e8f23e1dead1b32b099f7a56adfbdcf",
    "auditedAt": "2026-08-24",
-   "auditedRev": "9ae8440d80d0527c7dd296fe1331b63aac2818ea"
+   "auditedRev": ""
   },
   {
    "id": "ops_delivery",
diff --git a/DEVELOPMENT_LOG.md b/DEVELOPMENT_LOG.md
index 54669c7..77a8d9b 100644
--- a/DEVELOPMENT_LOG.md
+++ b/DEVELOPMENT_LOG.md
@@ -1,5 +1,22 @@
 # Development Log
 
+## 2026-08-24 稳定 V1 P1.3a 任务状态与切片原子性
+
+- `PATCH /api/tasks/{task_id}/status` 改为显式允许表 + `BEGIN IMMEDIATE` 条件更新；空任务不能直接标记完成，并发状态变化不会被旧请求覆盖。所有内部状态写入同时拒绝已永久删除任务。
+- 自动流水线在每个步骤开始前、处理完成后和最终 READY 写入前检查取消；取消后任务稳定进入 `CANCELLED`，Job 进入 `cancelled`，重试仍可从流水线起点恢复。
+- 自动流水线成功后稳定停在 `READY_TO_PUBLISH`，不再在同一次 run 内立刻覆盖为 `COMPLETED`；这表示内容已准备好，但仍等待用户在发送中心人工确认。
+- Task 步骤状态、切片批次和最终 READY 写回全部绑定当前 Workflow Job 的 owner、token、未过期 lease 与取消标记；旧 Worker 或锁等待期间过期的执行不能覆盖新状态。
+- 公开 Task 取消会在同一 SQLite 事务中请求活跃自动 Job 停止；READY 后取消只清理 `provider_response.workflow_job_id` 明确属于本轮且尚未发布的记录，不会误伤其他排期。
+- `running + cancel_requested` 在子进程退出或 lease 过期时会收敛为 `cancelled`，不再永久卡在运行态。
+- 任务汇总文件写入改为非遮蔽降级：磁盘或源文件异常只补充日志，不会覆盖原始业务失败或取消原因。
+- `cut_run` 编号分配放入 `BEGIN IMMEDIATE`；每个批次使用 `run_序号_id` 独立输出目录，避免并发/重试覆盖同名视频。
+- 一个批次的全部 `output_clip`、旧版本停用和新版本激活在同一个 SQLite 事务内提交；中途失败整批回滚并保留旧 active，较老批次即使最后完成也不能覆盖已完成的较新批次。
+- `cut_run` 创建与 Task=`cutting` 同事务，Task 终态只允许从当前 `cutting` CAS 写入；用户或其他流程刚更新的状态不会被晚到的切片结果覆盖。
+- Pytest 增加 session 级隔离数据库初始化，测试文件单独或换顺序执行时不再依赖其他文件先调用 `init_db()`。
+- 本轮不修改数据库 Schema、活动数据、AI Provider、FFmpeg 参数或真实发布流程；没有触发 AI、Chrome、抖音或 B站。
+- 最终隔离验收通过：完整测试 `637 passed`；Ruff 和 Python Compileall 全部通过，业务代码与文档的 whitespace 检查通过。Codemap 复评为 `Task Review & Cut 78/B`、`Pipeline & Job Queue 72/C`、`API & Runtime 48/D`、`SQLite Persistence 64/C`。
+- API/Persistence 分数下降不是本轮状态修复回归：独立复评删除了已修的状态跳跃/deleted 发现，同时把原始 Secret 读取、可选鉴权、同步重任务阻塞 async 路由、唯一索引重建失败静默吞掉和无版本迁移重新按 HIGH/MED 计分；这些保留到 P1.3b～P1.5。
+
 ## 2026-08-24 稳定 V1 P1B.2 发布执行代际与 Worker 幂等
 
 - Scheduler 每次领取发布任务都会保留唯一 `execution_id`；平台结果、阶段、成功、导出、失败、人工复核和安全重排队全部要求命中当前 `PUBLISHING + execution_id`。旧执行写回会返回 `skipped`，同一事务中的结果和事件一并回滚。
diff --git a/NEXT_STEPS.md b/NEXT_STEPS.md
index 6c99c94..b5a7174 100644
--- a/NEXT_STEPS.md
+++ b/NEXT_STEPS.md
@@ -9,7 +9,9 @@
 - [x] P1.1：收紧媒体读取与任务目录边界，补齐核心读写路径的 traversal / arbitrary-file 回归测试；并补充同名目录原子预占和进程树退出确认。
 - [x] P1.2a：Workflow Job 增加每次 claim 唯一的 `lease_token`，旧 Worker 的心跳、进度、checkpoint、终态和 release 均不能覆盖新执行。
 - [x] P1.2b：Publish Job 使用现有 `execution_id` 完成所有写回 fencing，并让 Windows Publish Worker 对重复 execution 幂等；跨进程锁、恢复 fail-closed 和 Scheduler 优雅停机已覆盖。
-- [ ] P1.3：补齐任务状态转移约束、批处理原子性、取消/重启恢复和明确失败状态。
+- [x] P1.3a：任务状态接口受控转换；Task/Job lease 代际一致；自动流水线取消恢复、READY 终态和关联发布清理明确；切片批次编号、输出目录、Task 终态和数据库激活原子化。
+- [ ] P1.3b：为自动流水线增加按步骤持久化 checkpoint 和副作用复用，补齐进程重启后的精确续跑；再处理字幕批准批次原子性与中断目录清理。
+- [ ] P1.3c：修复数据库唯一索引重建失败被静默吞掉的问题，并为幂等迁移增加可追踪版本与失败证据；不在本轮直接迁移活动库。
 - [ ] P1.4：统一第三方 AI/FFmpeg 超时、错误 JSON、429/5xx 与重试幂等边界，并避免重复计费。
 - [ ] P1.5：在不扩大个人本地项目范围的前提下处理密钥日志、输入校验和本地管理员接口门禁。
 - [ ] P2：拆分 God Service、去除查询重复、补核心集成/故障测试和可观测性；不做全面重构。
@@ -20,7 +22,8 @@
 2. 不需要点击“立即发送”；本轮没有执行真实投稿，也没有改变 28 条 `NEED_REVIEW` 的人工确认边界。
 3. 若未来永久删除返回 `cleanup_pending`，不要手工移动隔离目录；保留返回信息和 manifest，使用后续安全清理入口重试。
 4. 修复前数据库备份位于 `data/backups/workflow-before-foreign-key-repair-20260824-130321-535723-35a0f972.sqlite3`，只有活动库无法通过完整性检查时才考虑恢复，不要直接覆盖当前数据库。
-5. P1B.1/P1B.2 代码与隔离测试均已完成；活动库尚未增加 `workflow_jobs.lease_token`。下一独立轮先确认没有活动 Workflow Job，再做在线备份、幂等迁移和正式重启烟测。
+5. P1B.1/P1B.2 与 P1.3a 代码、隔离测试均已完成；活动库尚未增加 `workflow_jobs.lease_token`，本轮也未重启正式服务。下一独立轮先确认没有活动 Workflow Job，再做在线备份、幂等迁移和正式重启烟测。
+6. P1.3a 不需要手工修改数据库。合并后可用一条低风险测试任务验证：取消后显示“已取消”；正常完成后停在“待人工确认发布”；不要点击真实发布。
 
 ## 2026-08-24 工程体检确认的原始整改顺序
 
diff --git a/PROJECT_AUDIT.md b/PROJECT_AUDIT.md
index efaf3a1..7aad9b8 100644
--- a/PROJECT_AUDIT.md
+++ b/PROJECT_AUDIT.md
@@ -63,6 +63,23 @@ P1B.1 与 P1B.2 已把“旧 Worker/旧发布 execution 覆盖新执行”和“
 
 Codemap 独立复评结果：`Publish Scheduler 62→71（C）`、`Publishers & Worker 62→76（B）`；`Publish Center` 因 4750 行 God Service、原始 Secret 响应和旧 API Provider 风险仍维持 `52（D）`。复评未发现 Scheduler/Worker 新的 HIGH 问题；Worker 尚保留“升级前无 identity/损坏 journal 无法归属 job”的兼容边界，不能据此对历史不确定任务自动重投。
 
+## 0.4 P1.3a 任务状态与切片原子性状态（2026-08-24）
+
+| P1.3a 项目 | 结果 | 验证证据 |
+| --- | --- | --- |
+| 对外任务状态跳跃 | 已封口 | `PATCH /status` 使用显式允许转换表和同事务条件更新；空任务直接标记完成返回 409，已删除任务拒绝任何后续状态写入。 |
+| 取消后的明确终态 | 已封口 | 自动 Job 请求取消时任务进入 `CANCELLED`；流水线在步骤前、步骤后和 READY 前复核取消，不再把取消映射为失败或继续完成。 |
+| Task/Job 执行代际 | 已封口 | Task 步骤、切片提交和 READY 写回均校验当前 owner、token、未过期 lease 与取消标记；锁等待跨过租约时旧执行写回被拒。 |
+| 取消恢复与发布清理 | 已封口 | 公开取消会同步停止活跃自动 Job；子进程退出或租约过期可收敛为 cancelled；只清理本 workflow_job_id 关联且尚未发布的任务。 |
+| `READY_TO_PUBLISH` 瞬态 | 已封口 | 流水线成功后稳定保留 `READY_TO_PUBLISH`，Job 可以完成，但任务继续表示“等待人工确认发布”。 |
+| 切片半提交 | 已封口 | 一个批次的全部 output clip、旧 active 停用和新 active 激活在同一 `BEGIN IMMEDIATE` 事务提交；第二条插入失败时整批回滚。 |
+| 切片并发覆盖 | 已封口 | run number 在写锁内分配；每个 run 使用独立输出目录；较老 run 最后完成时不能覆盖任意已完成的较新 run。 |
+| Task 终态 CAS | 已封口 | cut_run 创建与 `cutting` 同事务；切片终态只从当前 `cutting` 写入，其他流程刚更新的状态不会被晚到批次覆盖。 |
+| 失败证据遮蔽 | 已封口 | summary 写入异常降级为日志和空路径，原始失败/取消状态与错误保持不变。 |
+| 隔离回归 | 通过 | 完整测试 `637 passed`，Ruff 与 Python Compileall 通过；未调用真实 AI、FFmpeg、Chrome 或平台投稿。 |
+
+本轮没有增加或迁移数据库列，也没有触碰活动数据、真实 AI 或真实投稿。Codemap 增量复评为 `Task Review & Cut 78/B`、`Pipeline & Job Queue 72/C`、`API & Runtime 48/D`、`SQLite Persistence 64/C`。后两项分数下降不是本轮状态修复回归，而是独立复评把原始 Secret 读取、可选鉴权、同步重任务阻塞 async 路由、唯一索引重建失败静默吞掉和无版本迁移重新按实际风险计分。P1.3a 解决的是“状态与切片提交能否可信”这一层；自动流水线的跨进程 step checkpoint、数据库迁移 fail-open、FFprobe/第三方错误边界和 Secret/本地管理员门禁仍按后续独立轮次处理。因此项目继续维持“可用 V1”，不能在剩余 P1 门禁完成前提前宣称“稳定 V1”。
+
 ## 1. Executive Summary
 
 ### 结论
diff --git a/STABILITY_P1_STATE_ATOMICITY_TASK.md b/STABILITY_P1_STATE_ATOMICITY_TASK.md
new file mode 100644
index 0000000..44d6d93
--- /dev/null
+++ b/STABILITY_P1_STATE_ATOMICITY_TASK.md
@@ -0,0 +1,110 @@
+# P1.3 任务状态与切片原子性
+
+## 背景
+
+工程审计确认了四个相互关联的稳定性缺口：任务状态接口可以任意跳转；全自动流水线的取消会被记录成失败或继续完成；`READY_TO_PUBLISH` 只短暂存在；切片结果逐条提交，失败时可能留下半成功数据。
+
+基线证据：隔离测试数据库初始化后，相关 8 个测试文件共 `112 passed`，Ruff 检查通过。
+
+## 目标
+
+1. 对外状态更新只能执行明确允许的相邻或恢复转换，禁止把空任务直接标记完成。
+2. 自动流水线在步骤前后都检查取消，取消后任务进入明确、可重试的 `CANCELLED` 状态。
+3. 自动流水线成功终态稳定保留为 `READY_TO_PUBLISH`，不再立即覆盖为 `COMPLETED`。
+4. 同一切片批次的结果写入、旧版本停用和新版本激活在一个 SQLite 事务内完成。
+5. 每个切片批次写入独立目录，避免并发/重试覆盖同名媒体文件。
+6. 汇总文件写入失败不得遮蔽原始业务错误或取消原因。
+
+## 影响与成本
+
+| 项目 | 影响 | 成本 | 本轮决策 |
+| --- | --- | --- | --- |
+| 测试数据库统一初始化 | 高 | 低 | 实施 |
+| 状态接口受控转换 | 高 | 中 | 实施 |
+| 取消终态与 READY 稳定化 | 高 | 中 | 实施 |
+| 切片事务与批次目录隔离 | 高 | 中 | 实施 |
+| 汇总写入降级 | 中 | 低 | 实施 |
+| 流水线跨进程持久化步骤 checkpoint | 高 | 高 | 留到 P1.3b |
+| FFprobe、AI Provider、Secret/Auth | 高 | 中至高 | 按后续独立轮次处理 |
+
+## 状态图
+
+修改前：
+
+```text
+任意状态 --PATCH /status--> 任意状态
+PUBLISH_JOB_CREATING -> READY_TO_PUBLISH -> COMPLETED
+运行中 --取消/异常--> FAILED_<STEP> 或残留运行态
+```
+
+修改后：
+
+```text
+对外 PATCH: 当前状态 --允许表--> 相邻状态/明确恢复状态
+PUBLISH_JOB_CREATING -> READY_TO_PUBLISH（稳定终态，等待人工发布）
+运行中 --取消--> CANCELLED --重试--> 对应流水线起点
+```
+
+## 允许修改范围
+
+- `app/models/task.py`
+- `app/routers/tasks.py`
+- `app/services/task_lifecycle_service.py`
+- `app/services/task_service.py`
+- `app/services/pipeline_engine.py`
+- `app/services/auto_publish_service.py`
+- `app/services/job_service.py`
+- `app/services/job_worker.py`
+- `app/services/video_cut_workflow_service.py`
+- 与上述行为直接相关的测试
+- `PROJECT_AUDIT.md`、`DEVELOPMENT_LOG.md`、`NEXT_STEPS.md`
+- Codemap 生成数据与产物（必须通过 skill 脚本生成）
+
+## 禁止修改范围
+
+- 数据库 Schema 和生产数据
+- AI Provider、Prompt、FFmpeg 参数和发布平台逻辑
+- UI 结构与样式
+- 依赖版本
+- Dead Code 删除和大规模模块拆分
+
+## 已确定实现要求
+
+- 保留手动流程小写状态与自动流程大写状态的兼容性。
+- 内部工作流仍可写步骤状态；对外 `PATCH /status` 必须走独立的合法转换检查和数据库条件更新。
+- 所有任务状态写入拒绝已永久删除任务。
+- 切片数据库提交失败时，新批次标记失败，旧 active 版本保持不变。
+- 较旧并发批次不得覆盖已经完成的较新 active 批次。
+- 发布中心同步只能在当前批次成功激活后执行。
+- 取消检查放在步骤开始前和处理完成后，最终 READY 写入前再检查一次。
+- Task 步骤状态、切片提交和 READY 写回必须绑定当前 Workflow Job 的 owner、token 与未过期 lease。
+- 公开 Task 取消必须同步请求活跃自动 Job 停止；Job 取消只清理 provider 证据明确关联到本执行代际的未发布任务。
+- `running + cancel_requested` 在子进程退出或 lease 过期后必须收敛到 `cancelled`，不能永久残留运行态。
+
+## 验收标准
+
+- 空任务不能通过 API 直接变成 `completed`/`COMPLETED`，返回 HTTP 409。
+- 合法相邻状态转换成功；并发状态变化时条件更新失败，不覆盖新状态。
+- 取消的自动任务最终为 `CANCELLED`，job 为 `cancelled`，不会写 READY/COMPLETED。
+- 旧 lease Worker 不能写 Task 步骤、切片结果或 READY；READY 后取消会清理本轮关联且尚未发布的排期记录。
+- 成功流水线最终任务状态和返回状态均为 `READY_TO_PUBLISH`/`ready_to_publish`。
+- 人为制造第二条 output clip 插入失败时，数据库中不保留该批次的部分 clip，旧 active 结果不变。
+- 并发创建 cut run 时 `run_number` 不重复；批次输出目录不同。
+- 汇总写入失败时仍返回原始失败/取消结果。
+- 定向测试、全量测试和 Ruff 全部通过。
+
+## 建议测试命令
+
+```powershell
+python -m pytest tests/test_task_state_machine.py tests/test_cut_atomicity.py tests/test_auto_pipeline.py tests/test_job_queue.py tests/test_job_fencing.py -q
+python -m pytest -q
+python -m ruff check app tests
+```
+
+## 回滚方式
+
+本轮不迁移 Schema；回滚代码提交即可。新生成的 `clips/run_*` 目录由现有数据库路径引用，旧目录和旧记录不会删除。`provider_response.workflow_job_id` 只是本地关联证据，不改变发布表结构。
+
+## 返回格式
+
+报告修改文件、状态行为变化、测试证据、Codemap 复审结果、提交哈希、分支、Push 与 PR 链接。
diff --git a/app/db/database.py b/app/db/database.py
index 0969ebb..85e04d8 100644
--- a/app/db/database.py
+++ b/app/db/database.py
@@ -784,7 +784,7 @@ def _migrate_tasks_table(connection: sqlite3.Connection) -> None:
             'CLIP_SELECTING', 'VIDEO_CUTTING', 'SUBTITLE_DRAFTING',
             'PENDING_SUBTITLE_REVIEW', 'METADATA_GENERATING',
             'SCHEDULE_CREATING', 'PUBLISH_JOB_CREATING', 'READY_TO_PUBLISH',
-            'COMPLETED', 'FAILED_PREPARING_SOURCE', 'FAILED_TRANSCRIBING',
+            'COMPLETED', 'CANCELLED', 'FAILED_PREPARING_SOURCE', 'FAILED_TRANSCRIBING',
             'FAILED_AI_ANALYZING', 'FAILED_CLIP_SELECTING', 'FAILED_VIDEO_CUTTING',
             'FAILED_SUBTITLE_DRAFTING',
             'FAILED_METADATA_GENERATING', 'FAILED_SCHEDULE_CREATING',
diff --git a/app/models/task.py b/app/models/task.py
index adf8156..6be1b67 100644
--- a/app/models/task.py
+++ b/app/models/task.py
@@ -18,6 +18,7 @@ class TaskStatus(str, Enum):
     PUBLISH_JOB_CREATING = "PUBLISH_JOB_CREATING"
     READY_TO_PUBLISH = "READY_TO_PUBLISH"
     COMPLETED = "COMPLETED"
+    CANCELLED = "CANCELLED"
     FAILED_PREPARING_SOURCE = "FAILED_PREPARING_SOURCE"
     FAILED_TRANSCRIBING = "FAILED_TRANSCRIBING"
     FAILED_AI_ANALYZING = "FAILED_AI_ANALYZING"
diff --git a/app/routers/tasks.py b/app/routers/tasks.py
index 2f7ba41..d9a9a6e 100644
--- a/app/routers/tasks.py
+++ b/app/routers/tasks.py
@@ -173,7 +173,10 @@ async def delete_task(task_id: str) -> dict:
 
 @router.patch("/{task_id}/status")
 async def patch_task_status(task_id: str, payload: TaskStatusUpdate) -> dict:
-    task = task_service.update_task_status(task_id, payload.status, payload.error_message)
+    try:
+        task = task_service.transition_task_status(task_id, payload.status, payload.error_message)
+    except task_service.TaskStatusConflictError as exc:
+        raise HTTPException(status_code=409, detail=str(exc)) from exc
     if not task:
         raise HTTPException(status_code=404, detail="任务不存在")
     return task
diff --git a/app/services/auto_publish_service.py b/app/services/auto_publish_service.py
index d36739d..841dd88 100644
--- a/app/services/auto_publish_service.py
+++ b/app/services/auto_publish_service.py
@@ -24,6 +24,7 @@ def create_auto_publish_jobs(
     scheduled_items: list[dict],
     *,
     subtitle_delivery_mode: str,
+    workflow_job_id: str | None = None,
 ) -> dict:
     """为全自动流水线生成发布任务。
 
@@ -106,6 +107,7 @@ def create_auto_publish_jobs(
             job_id = uuid4().hex[:12]
             provider_response = {
                 "source": "auto_pipeline",
+                "workflow_job_id": workflow_job_id or "",
                 "target_platform": platform,
                 "metadata_source": metadata.get("source") or "",
                 "metadata_error": metadata.get("error") or "",
diff --git a/app/services/job_service.py b/app/services/job_service.py
index 3750ba0..3e5bb19 100644
--- a/app/services/job_service.py
+++ b/app/services/job_service.py
@@ -358,6 +358,17 @@ def claim_next_job(lease_owner: str, lease_seconds: int = 120) -> dict | None:
     lease_token = uuid4().hex
     with get_connection() as connection:
         connection.execute("BEGIN IMMEDIATE")
+        connection.execute(
+            """
+            UPDATE workflow_jobs
+            SET status = ?, message = '任务已取消，过期执行已回收',
+                finished_at = ?, updated_at = ?, lease_owner = NULL,
+                lease_token = NULL, lease_expires_at = NULL, heartbeat_at = NULL
+            WHERE status = ? AND cancel_requested = 1
+              AND (lease_expires_at IS NULL OR lease_expires_at <= ?)
+            """,
+            (JOB_STATUS_CANCELLED, now, now, JOB_STATUS_RUNNING, now),
+        )
         connection.execute(
             """
             UPDATE workflow_jobs SET status = ?, error_message = '已达到最大尝试次数',
@@ -496,25 +507,155 @@ def update_job_checkpoint(
 def request_job_cancel(job_id: str) -> dict | None:
     now = _now_iso()
     with get_connection() as connection:
-        row = connection.execute("SELECT status FROM workflow_jobs WHERE id = ?", (job_id,)).fetchone()
+        connection.execute("BEGIN IMMEDIATE")
+        row = connection.execute(
+            "SELECT status, job_type, task_id FROM workflow_jobs WHERE id = ?",
+            (job_id,),
+        ).fetchone()
         if not row:
+            connection.rollback()
             return None
         if row["status"] == JOB_STATUS_QUEUED:
-            connection.execute(
+            cursor = connection.execute(
                 """UPDATE workflow_jobs SET status = ?, cancel_requested = 1, message = '任务已取消',
                    finished_at = ?, updated_at = ?, lease_owner = NULL, lease_token = NULL,
-                   lease_expires_at = NULL WHERE id = ?""",
-                (JOB_STATUS_CANCELLED, now, now, job_id),
+                   lease_expires_at = NULL WHERE id = ? AND status = ?""",
+                (JOB_STATUS_CANCELLED, now, now, job_id, JOB_STATUS_QUEUED),
             )
         elif row["status"] == JOB_STATUS_RUNNING:
+            cursor = connection.execute(
+                """
+                UPDATE workflow_jobs
+                SET cancel_requested = 1, message = '正在停止任务', updated_at = ?
+                WHERE id = ? AND status = ?
+                """,
+                (now, job_id, JOB_STATUS_RUNNING),
+            )
+        else:
+            cursor = None
+        if cursor and cursor.rowcount == 1 and row["job_type"] == JOB_TYPE_AUTO_PIPELINE:
+            _cancel_linked_auto_publish_jobs(
+                connection,
+                task_id=str(row["task_id"] or ""),
+                workflow_job_ids=[job_id],
+                now=now,
+            )
             connection.execute(
-                "UPDATE workflow_jobs SET cancel_requested = 1, message = '正在停止任务', updated_at = ? WHERE id = ?",
-                (now, job_id),
+                """
+                UPDATE tasks
+                SET status = 'CANCELLED', progress = 0,
+                    error_message = '用户已取消全自动流水线',
+                    last_error = '用户已取消全自动流水线', updated_at = ?
+                WHERE id = ? AND COALESCE(is_deleted, 0) = 0
+                """,
+                (now, str(row["task_id"] or "")),
             )
         connection.commit()
     return get_job(job_id)
 
 
+def cancel_active_auto_pipeline_jobs_for_task(
+    connection,
+    task_id: str,
+    *,
+    now: str,
+) -> int:
+    """在调用方事务中取消一个 Task 的活跃自动流水线及其未发布结果。"""
+    rows = connection.execute(
+        """
+        SELECT id, status
+        FROM workflow_jobs
+        WHERE task_id = ? AND job_type = ? AND status IN (?, ?)
+        """,
+        (task_id, JOB_TYPE_AUTO_PIPELINE, JOB_STATUS_QUEUED, JOB_STATUS_RUNNING),
+    ).fetchall()
+    if not rows:
+        return 0
+
+    queued_ids = [str(row["id"]) for row in rows if row["status"] == JOB_STATUS_QUEUED]
+    running_ids = [str(row["id"]) for row in rows if row["status"] == JOB_STATUS_RUNNING]
+    if queued_ids:
+        placeholders = ", ".join("?" for _ in queued_ids)
+        connection.execute(
+            f"""
+            UPDATE workflow_jobs
+            SET status = ?, cancel_requested = 1, message = '任务已取消',
+                finished_at = ?, updated_at = ?, lease_owner = NULL,
+                lease_token = NULL, lease_expires_at = NULL, heartbeat_at = NULL
+            WHERE id IN ({placeholders}) AND status = ?
+            """,
+            (JOB_STATUS_CANCELLED, now, now, *queued_ids, JOB_STATUS_QUEUED),
+        )
+    if running_ids:
+        placeholders = ", ".join("?" for _ in running_ids)
+        connection.execute(
+            f"""
+            UPDATE workflow_jobs
+            SET cancel_requested = 1, message = '正在停止任务', updated_at = ?
+            WHERE id IN ({placeholders}) AND status = ?
+            """,
+            (now, *running_ids, JOB_STATUS_RUNNING),
+        )
+    _cancel_linked_auto_publish_jobs(
+        connection,
+        task_id=task_id,
+        workflow_job_ids=[str(row["id"]) for row in rows],
+        now=now,
+    )
+    return len(rows)
+
+
+def _cancel_linked_auto_publish_jobs(
+    connection,
+    *,
+    task_id: str,
+    workflow_job_ids: list[str],
+    now: str,
+) -> int:
+    """只取消 provider_response 明确归属于指定流水线的未发布任务。"""
+    resolved_ids = [job_id for job_id in workflow_job_ids if job_id]
+    if not task_id or not resolved_ids:
+        return 0
+    candidates = connection.execute(
+        """
+        SELECT id, provider_response
+        FROM publish_jobs
+        WHERE task_id = ? AND status IN ('DRAFT', 'WAITING', 'SCHEDULED', 'NEED_REVIEW')
+        """,
+        (task_id,),
+    ).fetchall()
+    linked_ids: list[str] = []
+    allowed_workflow_ids = set(resolved_ids)
+    for row in candidates:
+        try:
+            provider_response = json.loads(str(row["provider_response"] or "{}"))
+        except (TypeError, json.JSONDecodeError):
+            continue
+        if not isinstance(provider_response, dict):
+            continue
+        if (
+            provider_response.get("source") == "auto_pipeline"
+            and str(provider_response.get("workflow_job_id") or "") in allowed_workflow_ids
+        ):
+            linked_ids.append(str(row["id"]))
+    if not linked_ids:
+        return 0
+    placeholders = ", ".join("?" for _ in linked_ids)
+    cursor = connection.execute(
+        f"""
+        UPDATE publish_jobs
+        SET status = 'CANCELLED', error_code = 'pipeline_cancelled',
+            error_message = '全自动流水线已取消', last_error = '全自动流水线已取消',
+            finished_at = ?, updated_at = ?
+        WHERE task_id = ?
+          AND status IN ('DRAFT', 'WAITING', 'SCHEDULED', 'NEED_REVIEW')
+          AND id IN ({placeholders})
+        """,
+        (now, now, task_id, *linked_ids),
+    )
+    return cursor.rowcount
+
+
 def is_cancel_requested(job_id: str) -> bool:
     job = get_job(job_id)
     return bool(job and int(job.get("cancel_requested") or 0))
@@ -603,7 +744,7 @@ def mark_job_completed(
                 message = '任务已完成', result_json = ?,
                 finished_at = ?, updated_at = ?, lease_owner = NULL,
                 lease_token = NULL, lease_expires_at = NULL, heartbeat_at = NULL
-            WHERE {condition}
+            WHERE {condition} AND cancel_requested = 0
             """,
             (JOB_STATUS_COMPLETED, result_json, now, now, job_id, *lease_params),
         )
@@ -632,7 +773,7 @@ def mark_job_failed(
             SET status = ?, error_message = ?, message = ?,
                 finished_at = ?, updated_at = ?, lease_owner = NULL,
                 lease_token = NULL, lease_expires_at = NULL, heartbeat_at = NULL
-            WHERE {condition}
+            WHERE {condition} AND cancel_requested = 0
             """,
             (
                 JOB_STATUS_FAILED,
diff --git a/app/services/job_worker.py b/app/services/job_worker.py
index 2c50a5c..3570099 100644
--- a/app/services/job_worker.py
+++ b/app/services/job_worker.py
@@ -138,6 +138,9 @@ def _execute_auto_pipeline(job_id: str, task_id: str, payload: dict) -> None:
     if job_service.is_cancel_requested(job_id):
         job_service.mark_job_cancelled(job_id, "全自动流水线已取消")
         return
+    if result.get("status") == "cancelled":
+        job_service.mark_job_cancelled(job_id, "全自动流水线已取消")
+        return
     if result.get("status") == "failed":
         raise RuntimeError(str(result.get("last_error") or "全自动流水线失败"))
     job_service.mark_job_completed(job_id, result)
@@ -311,7 +314,14 @@ def _run_job_subprocess(self, job_id: str) -> None:
             and final_job.get("lease_owner") == self.owner
             and final_job.get("lease_token") == lease_token
         )
-        if process.returncode != 0 and owns_final_lease:
+        if owns_final_lease and int(final_job.get("cancel_requested") or 0):
+            job_service.mark_job_cancelled(
+                job_id,
+                "任务已取消，子进程已退出",
+                lease_owner=self.owner,
+                lease_token=lease_token,
+            )
+        elif process.returncode != 0 and owns_final_lease:
             if final_job.get("job_type") == job_service.JOB_TYPE_SUBTITLE:
                 from app.services.subtitle_auto_workflow_service import cleanup_interrupted_subtitle_job
 
diff --git a/app/services/pipeline_engine.py b/app/services/pipeline_engine.py
index 1252452..d3cef81 100644
--- a/app/services/pipeline_engine.py
+++ b/app/services/pipeline_engine.py
@@ -73,6 +73,10 @@
 }
 
 
+class PipelineCancelledError(RuntimeError):
+    """用户请求取消当前全自动流水线。"""
+
+
 class PipelineEngine:
     """只做流程调度，复用现有转写、AI、切片和发布任务服务。"""
 
@@ -101,7 +105,7 @@ def run(
         else:
             append_task_log(task_id, f"从失败步骤重试全自动流水线：{resolved_start_step.value}")
 
-        context: dict[str, Any] = {"config": config}
+        context: dict[str, Any] = {"config": config, "workflow_job_id": job_id or ""}
         steps = STEP_STATUSES[STEP_STATUSES.index(resolved_start_step) :]
         handlers = {
             TaskStatus.PREPARING_SOURCE: self._prepare_source,
@@ -118,8 +122,7 @@ def run(
         for step in steps:
             try:
                 if job_id:
-                    if job_service.is_cancel_requested(job_id):
-                        raise RuntimeError("用户已取消全自动流水线")
+                    self._raise_if_cancelled(job_id)
                     step_index = STEP_STATUSES.index(step)
                     job_service.update_job_progress(
                         job_id,
@@ -131,14 +134,21 @@ def run(
                 context[step.value] = handlers[step](task_id, context)
                 if job_id:
                     job_service.heartbeat_job(job_id)
+                    self._raise_if_cancelled(job_id)
                 if step == TaskStatus.SUBTITLE_DRAFTING:
-                    summary = self._write_task_summary(task_id, TaskStatus.PENDING_SUBTITLE_REVIEW.value, "")
+                    summary = self._safe_write_task_summary(
+                        task_id,
+                        TaskStatus.PENDING_SUBTITLE_REVIEW.value,
+                        "",
+                    )
                     return {
                         "status": "pending_subtitle_review",
                         "message": "字幕草稿已生成，等待人工审核后再继续。",
                         "summary_path": summary["summary_path"],
                         "task": task_service.get_task(task_id, include_video_probe=False),
                     }
+            except PipelineCancelledError as exc:
+                return self._cancel_pipeline(task_id, str(exc), context)
             except job_service.JobLeaseLostError:
                 raise
             except Exception as exc:
@@ -146,7 +156,7 @@ def run(
                 error = str(exc) or f"{step.value} 失败"
                 task_service.update_task_status(task_id, failed_status, error)
                 append_task_log(task_id, f"全自动流水线失败：{step.value}，原因：{error}")
-                summary = self._write_task_summary(task_id, "failed", error)
+                summary = self._safe_write_task_summary(task_id, "failed", error)
                 return {
                     "status": "failed",
                     "failed_step": step.value,
@@ -156,17 +166,147 @@ def run(
                     "task": task_service.get_task(task_id, include_video_probe=False),
                 }
 
-        task_service.update_task_status(task_id, TaskStatus.READY_TO_PUBLISH)
+        if job_id:
+            try:
+                self._raise_if_cancelled(job_id)
+            except PipelineCancelledError as exc:
+                return self._cancel_pipeline(task_id, str(exc), context)
+        if not self._mark_ready_to_publish(task_id, job_id):
+            return self._cancel_pipeline(task_id, "用户已取消全自动流水线", context)
         append_task_log(task_id, "发布任务已创建，进入待人工确认发布状态")
-        summary = self._write_task_summary(task_id, "ready_to_publish", "")
-        task_service.update_task_status(task_id, TaskStatus.COMPLETED)
-        append_task_log(task_id, "全自动流水线完成，发布内容已按用户确认的字幕交付方式创建。")
+        summary = self._safe_write_task_summary(task_id, "ready_to_publish", "")
+        append_task_log(task_id, "全自动流水线准备完成，发布内容等待人工确认。")
         return {
-            "status": "completed",
+            "status": "ready_to_publish",
             "summary_path": summary["summary_path"],
             "task": task_service.get_task(task_id, include_video_probe=False),
         }
 
+    def _raise_if_cancelled(self, job_id: str) -> None:
+        if job_service.is_cancel_requested(job_id):
+            raise PipelineCancelledError("用户已取消全自动流水线")
+
+    def _mark_ready_to_publish(self, task_id: str, job_id: str | None) -> bool:
+        if not job_id:
+            task_service.update_task_status(task_id, TaskStatus.READY_TO_PUBLISH)
+            return True
+
+        active_lease = job_service.current_job_lease()
+        if not active_lease or active_lease[0] != job_id:
+            raise job_service.JobLeaseLostError(
+                f"Workflow Job 没有当前执行代际，不能写入 READY：{job_id}"
+            )
+        _, lease_owner, lease_token = active_lease
+        with get_connection() as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            now = task_service._now_iso()
+            job = connection.execute(
+                """
+                SELECT status, cancel_requested, lease_owner, lease_token, lease_expires_at
+                FROM workflow_jobs WHERE id = ?
+                """,
+                (job_id,),
+            ).fetchone()
+            if not job:
+                connection.rollback()
+                raise ValueError("全自动 Workflow Job 不存在")
+            if int(job["cancel_requested"] or 0) or job["status"] == job_service.JOB_STATUS_CANCELLED:
+                connection.rollback()
+                return False
+            if (
+                job["status"] != job_service.JOB_STATUS_RUNNING
+                or job["lease_owner"] != lease_owner
+                or job["lease_token"] != lease_token
+                or not job["lease_expires_at"]
+                or str(job["lease_expires_at"]) <= now
+            ):
+                connection.rollback()
+                raise job_service.JobLeaseLostError(f"Workflow Job 租约已失效，不能写入 READY：{job_id}")
+            final_now = task_service._now_iso()
+            cursor = connection.execute(
+                """
+                UPDATE tasks
+                SET status = ?, progress = 100, error_message = NULL,
+                    last_error = NULL, updated_at = ?
+                WHERE id = ? AND COALESCE(is_deleted, 0) = 0
+                  AND EXISTS (
+                      SELECT 1 FROM workflow_jobs
+                      WHERE id = ? AND task_id = ? AND status = ?
+                        AND lease_owner = ? AND lease_token = ?
+                        AND lease_expires_at > ? AND cancel_requested = 0
+                  )
+                """,
+                (
+                    TaskStatus.READY_TO_PUBLISH.value,
+                    final_now,
+                    task_id,
+                    job_id,
+                    task_id,
+                    job_service.JOB_STATUS_RUNNING,
+                    lease_owner,
+                    lease_token,
+                    final_now,
+                ),
+            )
+            if cursor.rowcount != 1:
+                connection.rollback()
+                raise job_service.JobLeaseLostError(
+                    f"Workflow Job 租约已失效或任务不可写，不能写入 READY：{job_id}"
+                )
+            connection.commit()
+        return True
+
+    def _cancel_pipeline(self, task_id: str, message: str, context: dict | None = None) -> dict:
+        cancelled_publish_jobs = self._cancel_unpublished_auto_jobs(task_id, context or {})
+        task_service.update_task_status(task_id, TaskStatus.CANCELLED, message)
+        append_task_log(task_id, f"全自动流水线已取消：{message}")
+        summary = self._safe_write_task_summary(task_id, "cancelled", message)
+        return {
+            "status": "cancelled",
+            "last_error": message,
+            "cancelled_publish_jobs": cancelled_publish_jobs,
+            "summary_path": summary["summary_path"],
+            "task": task_service.get_task(task_id, include_video_probe=False),
+        }
+
+    def _cancel_unpublished_auto_jobs(self, task_id: str, context: dict) -> int:
+        publish_result = context.get(TaskStatus.PUBLISH_JOB_CREATING.value) or {}
+        created_ids = [
+            str(item.get("id") or "")
+            for item in publish_result.get("created") or []
+            if isinstance(item, dict) and item.get("id")
+        ]
+        if not created_ids:
+            return 0
+        placeholders = ", ".join("?" for _ in created_ids)
+        now = task_service._now_iso()
+        with get_connection() as connection:
+            cursor = connection.execute(
+                f"""
+                UPDATE publish_jobs
+                SET status = 'CANCELLED', error_code = 'pipeline_cancelled',
+                    error_message = '全自动流水线已取消', last_error = '全自动流水线已取消',
+                    finished_at = ?, updated_at = ?
+                WHERE task_id = ? AND id IN ({placeholders})
+                  AND status IN ('DRAFT', 'WAITING', 'SCHEDULED', 'NEED_REVIEW')
+                """,
+                (now, now, task_id, *created_ids),
+            )
+            connection.commit()
+        if cursor.rowcount:
+            append_task_log(task_id, f"已取消本轮新建但尚未发布的发送任务：{cursor.rowcount} 条")
+        return cursor.rowcount
+
+    def _safe_write_task_summary(self, task_id: str, status: str, error: str) -> dict:
+        try:
+            return self._write_task_summary(task_id, status, error)
+        except Exception as exc:
+            try:
+                append_task_log(task_id, f"任务汇总写入失败，但主流程状态已保留：{exc}")
+            except Exception:
+                pass
+            return {"summary_path": ""}
+
     def _get_task(self, task_id: str) -> dict:
         task = task_service.get_task(task_id, include_video_probe=False)
         if not task:
@@ -402,6 +542,7 @@ def _create_publish_jobs(self, task_id: str, context: dict) -> dict:
             task,
             scheduled_items,
             subtitle_delivery_mode=delivery_mode,
+            workflow_job_id=str(context.get("workflow_job_id") or "") or None,
         )
         append_task_log(
             task_id,
diff --git a/app/services/task_lifecycle_service.py b/app/services/task_lifecycle_service.py
index 906cfb2..ee19fd5 100644
--- a/app/services/task_lifecycle_service.py
+++ b/app/services/task_lifecycle_service.py
@@ -4,6 +4,7 @@
 """
 
 import json
+from sqlite3 import Connection
 from uuid import uuid4
 
 from app.db.database import get_connection
@@ -25,6 +26,93 @@ class TaskDeletionConflictError(RuntimeError):
     """任务仍在执行，暂时不能删除其媒体文件。"""
 
 
+class TaskStatusConflictError(RuntimeError):
+    """任务状态已变化、已删除，或请求的状态转换不被允许。"""
+
+
+PUBLIC_TASK_STATUS_TRANSITIONS: dict[str, set[str]] = {
+    TaskStatus.pending_video.value: {TaskStatus.pending_processing.value},
+    TaskStatus.pending_processing.value: {TaskStatus.audio_extracting.value, TaskStatus.failed.value},
+    TaskStatus.audio_extracting.value: {TaskStatus.transcribing.value, TaskStatus.failed.value},
+    TaskStatus.transcribing.value: {TaskStatus.pending_ai.value, TaskStatus.failed.value},
+    TaskStatus.pending_ai.value: {TaskStatus.ai_analyzing.value, TaskStatus.failed.value},
+    TaskStatus.ai_analyzing.value: {TaskStatus.pending_review.value, TaskStatus.failed.value},
+    TaskStatus.pending_review.value: {TaskStatus.ai_analyzing.value, TaskStatus.cutting.value},
+    TaskStatus.cutting.value: {
+        TaskStatus.completed.value,
+        TaskStatus.completed_with_errors.value,
+        TaskStatus.failed.value,
+    },
+    TaskStatus.completed.value: {TaskStatus.cutting.value},
+    TaskStatus.completed_with_errors.value: {TaskStatus.cutting.value},
+    TaskStatus.failed.value: {
+        TaskStatus.pending_processing.value,
+        TaskStatus.audio_extracting.value,
+        TaskStatus.transcribing.value,
+        TaskStatus.pending_ai.value,
+        TaskStatus.ai_analyzing.value,
+        TaskStatus.cutting.value,
+    },
+    TaskStatus.CREATED.value: {TaskStatus.PREPARING_SOURCE.value},
+    TaskStatus.PREPARING_SOURCE.value: {
+        TaskStatus.TRANSCRIBING.value,
+        TaskStatus.FAILED_PREPARING_SOURCE.value,
+        TaskStatus.CANCELLED.value,
+    },
+    TaskStatus.TRANSCRIBING.value: {
+        TaskStatus.AI_ANALYZING.value,
+        TaskStatus.FAILED_TRANSCRIBING.value,
+        TaskStatus.CANCELLED.value,
+    },
+    TaskStatus.AI_ANALYZING.value: {
+        TaskStatus.CLIP_SELECTING.value,
+        TaskStatus.FAILED_AI_ANALYZING.value,
+        TaskStatus.CANCELLED.value,
+    },
+    TaskStatus.CLIP_SELECTING.value: {
+        TaskStatus.VIDEO_CUTTING.value,
+        TaskStatus.FAILED_CLIP_SELECTING.value,
+        TaskStatus.CANCELLED.value,
+    },
+    TaskStatus.VIDEO_CUTTING.value: {
+        TaskStatus.SUBTITLE_DRAFTING.value,
+        TaskStatus.FAILED_VIDEO_CUTTING.value,
+        TaskStatus.CANCELLED.value,
+    },
+    TaskStatus.SUBTITLE_DRAFTING.value: {
+        TaskStatus.PENDING_SUBTITLE_REVIEW.value,
+        TaskStatus.FAILED_SUBTITLE_DRAFTING.value,
+        TaskStatus.CANCELLED.value,
+    },
+    TaskStatus.PENDING_SUBTITLE_REVIEW.value: {TaskStatus.METADATA_GENERATING.value},
+    TaskStatus.METADATA_GENERATING.value: {
+        TaskStatus.SCHEDULE_CREATING.value,
+        TaskStatus.FAILED_METADATA_GENERATING.value,
+        TaskStatus.CANCELLED.value,
+    },
+    TaskStatus.SCHEDULE_CREATING.value: {
+        TaskStatus.PUBLISH_JOB_CREATING.value,
+        TaskStatus.FAILED_SCHEDULE_CREATING.value,
+        TaskStatus.CANCELLED.value,
+    },
+    TaskStatus.PUBLISH_JOB_CREATING.value: {
+        TaskStatus.READY_TO_PUBLISH.value,
+        TaskStatus.FAILED_PUBLISH_JOB_CREATING.value,
+        TaskStatus.CANCELLED.value,
+    },
+    TaskStatus.FAILED_PREPARING_SOURCE.value: {TaskStatus.PREPARING_SOURCE.value},
+    TaskStatus.FAILED_TRANSCRIBING.value: {TaskStatus.TRANSCRIBING.value},
+    TaskStatus.FAILED_AI_ANALYZING.value: {TaskStatus.AI_ANALYZING.value},
+    TaskStatus.FAILED_CLIP_SELECTING.value: {TaskStatus.CLIP_SELECTING.value},
+    TaskStatus.FAILED_VIDEO_CUTTING.value: {TaskStatus.VIDEO_CUTTING.value},
+    TaskStatus.FAILED_SUBTITLE_DRAFTING.value: {TaskStatus.SUBTITLE_DRAFTING.value},
+    TaskStatus.FAILED_METADATA_GENERATING.value: {TaskStatus.METADATA_GENERATING.value},
+    TaskStatus.FAILED_SCHEDULE_CREATING.value: {TaskStatus.SCHEDULE_CREATING.value},
+    TaskStatus.FAILED_PUBLISH_JOB_CREATING.value: {TaskStatus.PUBLISH_JOB_CREATING.value},
+    TaskStatus.CANCELLED.value: {TaskStatus.PREPARING_SOURCE.value},
+}
+
+
 ACTIVE_TASK_STATUSES = {
     TaskStatus.CREATED.value,
     TaskStatus.PREPARING_SOURCE.value,
@@ -159,25 +247,158 @@ def update_task_status(
     error_message: str | None = None,
 ) -> dict | None:
     from app.services.task_service import _now_iso, get_task, STATUS_PROGRESS  # noqa: F811
+    from app.services import job_service
 
-    now = _now_iso()
     status_value = new_status.value
     progress = STATUS_PROGRESS.get(status_value, 0)
+    active_lease = job_service.current_job_lease()
 
     with get_connection() as connection:
+        connection.execute("BEGIN IMMEDIATE")
+        now = _now_iso()
+        current = connection.execute(
+            "SELECT COALESCE(is_deleted, 0) AS is_deleted FROM tasks WHERE id = ?",
+            (task_id,),
+        ).fetchone()
+        if not current:
+            connection.rollback()
+            return None
+        if int(current["is_deleted"] or 0):
+            connection.rollback()
+            raise TaskStatusConflictError("任务已永久删除，不能再更新处理状态")
+
+        lease_condition = ""
+        lease_params: tuple[str, ...] = ()
+        if active_lease:
+            active_job_id, lease_owner, lease_token = active_lease
+            cancel_condition = "" if new_status == TaskStatus.CANCELLED else "AND cancel_requested = 0"
+            lease_condition = f"""
+                AND EXISTS (
+                    SELECT 1 FROM workflow_jobs
+                    WHERE id = ? AND task_id = ? AND status = ?
+                      AND lease_owner = ? AND lease_token = ?
+                      AND lease_expires_at > ? {cancel_condition}
+                )
+            """
+            lease_params = (
+                active_job_id,
+                task_id,
+                job_service.JOB_STATUS_RUNNING,
+                lease_owner,
+                lease_token,
+                now,
+            )
+        cursor = connection.execute(
+            f"""
+            UPDATE tasks
+            SET status = ?, progress = ?, error_message = ?, last_error = ?, updated_at = ?
+            WHERE id = ? AND COALESCE(is_deleted, 0) = 0 {lease_condition}
+            """,
+            (status_value, progress, error_message, error_message, now, task_id, *lease_params),
+        )
+        if cursor.rowcount == 0:
+            connection.rollback()
+            if active_lease:
+                raise job_service.JobLeaseLostError(
+                    f"Workflow Job 租约已失效，拒绝覆盖 Task 状态：{active_lease[0]}"
+                )
+            raise TaskStatusConflictError("任务状态更新失败，请刷新后重试")
+        connection.commit()
+
+    return get_task(task_id, include_video_probe=False)
+
+
+def transition_task_status(
+    task_id: str,
+    new_status: TaskStatus,
+    error_message: str | None = None,
+) -> dict | None:
+    """执行对外可见的受控状态转换，并避免覆盖并发产生的新状态。"""
+    from app.services.task_service import _now_iso, get_task, STATUS_PROGRESS  # noqa: F811
+
+    status_value = new_status.value
+    progress = STATUS_PROGRESS.get(status_value, 0)
+    with get_connection() as connection:
+        connection.execute("BEGIN IMMEDIATE")
+        now = _now_iso()
+        current = connection.execute(
+            "SELECT status, COALESCE(is_deleted, 0) AS is_deleted FROM tasks WHERE id = ?",
+            (task_id,),
+        ).fetchone()
+        if not current:
+            connection.rollback()
+            return None
+        if int(current["is_deleted"] or 0):
+            connection.rollback()
+            raise TaskStatusConflictError("任务已永久删除，不能再更新处理状态")
+
+        current_status = str(current["status"] or "")
+        allowed = PUBLIC_TASK_STATUS_TRANSITIONS.get(current_status, set())
+        if status_value != current_status and status_value not in allowed:
+            connection.rollback()
+            raise TaskStatusConflictError(
+                f"不允许从 {current_status or '未知状态'} 跳转到 {status_value}"
+            )
+        _validate_public_transition_preconditions(connection, task_id, status_value)
+        if status_value == TaskStatus.CANCELLED.value:
+            from app.services import job_service
+
+            job_service.cancel_active_auto_pipeline_jobs_for_task(
+                connection,
+                task_id,
+                now=now,
+            )
+            error_message = error_message or "用户已取消全自动流水线"
+
         cursor = connection.execute(
             """
             UPDATE tasks
             SET status = ?, progress = ?, error_message = ?, last_error = ?, updated_at = ?
-            WHERE id = ?
+            WHERE id = ? AND status = ? AND COALESCE(is_deleted, 0) = 0
             """,
-            (status_value, progress, error_message, error_message, now, task_id),
+            (status_value, progress, error_message, error_message, now, task_id, current_status),
         )
+        if cursor.rowcount != 1:
+            connection.rollback()
+            raise TaskStatusConflictError("任务状态已被其他流程更新，请刷新后重试")
         connection.commit()
+    return get_task(task_id, include_video_probe=False)
 
-    if cursor.rowcount == 0:
-        return None
-    return get_task(task_id)
+
+def _validate_public_transition_preconditions(
+    connection: Connection,
+    task_id: str,
+    status_value: str,
+) -> None:
+    if status_value == TaskStatus.pending_processing.value:
+        source = connection.execute(
+            "SELECT original_video_path, nas_file_path FROM tasks WHERE id = ?",
+            (task_id,),
+        ).fetchone()
+        if not source or not str(source["nas_file_path"] or source["original_video_path"] or "").strip():
+            raise TaskStatusConflictError("任务尚未绑定源视频，不能进入待处理状态")
+    elif status_value == TaskStatus.cutting.value:
+        enabled = connection.execute(
+            """
+            SELECT 1 FROM clip_candidates
+            WHERE task_id = ? AND enabled = 1 AND COALESCE(is_deleted, 0) = 0
+            LIMIT 1
+            """,
+            (task_id,),
+        ).fetchone()
+        if not enabled:
+            raise TaskStatusConflictError("任务没有已启用的候选片段，不能进入切割状态")
+    elif status_value in {TaskStatus.completed.value, TaskStatus.completed_with_errors.value}:
+        output = connection.execute(
+            """
+            SELECT 1 FROM output_clip
+            WHERE task_id = ? AND status = 'completed' AND COALESCE(is_active, 1) = 1
+            LIMIT 1
+            """,
+            (task_id,),
+        ).fetchone()
+        if not output:
+            raise TaskStatusConflictError("任务没有成功的活跃切片，不能标记完成")
 
 
 def update_task_ai_preference(task_id: str, ai_preference: str | None) -> dict:
@@ -294,7 +515,7 @@ def update_task_selection_settings(
 def delete_task_permanently(task_id: str) -> dict:
     from app.services.task_service import _now_iso, get_task  # noqa: F811
 
-    task = get_task(task_id, include_video_probe=False)
+    task = get_task(task_id, include_video_probe=False, include_deleted=True)
     if not task:
         raise ValueError("任务不存在")
     cleanup_plan = build_task_media_cleanup_plan(task)
diff --git a/app/services/task_service.py b/app/services/task_service.py
index caf6fb3..64935e2 100644
--- a/app/services/task_service.py
+++ b/app/services/task_service.py
@@ -46,8 +46,10 @@
     resolve_video_file_path,
 )
 from app.services.task_lifecycle_service import (
+    TaskStatusConflictError,
     create_task_record,
     soft_delete_task,
+    transition_task_status,
     update_task_ai_preference,
     update_task_candidate_clip_count,
     update_task_selection_settings,
@@ -135,6 +137,7 @@
     TaskStatus.PUBLISH_JOB_CREATING.value: "创建发布任务中",
     TaskStatus.READY_TO_PUBLISH.value: "待人工确认发布",
     TaskStatus.COMPLETED.value: "全自动流程完成",
+    TaskStatus.CANCELLED.value: "已取消",
     TaskStatus.FAILED_PREPARING_SOURCE.value: "准备视频失败",
     TaskStatus.FAILED_TRANSCRIBING.value: "转写失败",
     TaskStatus.FAILED_AI_ANALYZING.value: "AI 分析失败",
@@ -171,6 +174,7 @@
     TaskStatus.PUBLISH_JOB_CREATING.value: 95,
     TaskStatus.READY_TO_PUBLISH.value: 100,
     TaskStatus.COMPLETED.value: 100,
+    TaskStatus.CANCELLED.value: 0,
     TaskStatus.FAILED_PREPARING_SOURCE.value: 8,
     TaskStatus.FAILED_TRANSCRIBING.value: 25,
     TaskStatus.FAILED_AI_ANALYZING.value: 45,
@@ -222,6 +226,7 @@
 }
 
 AUTO_PIPELINE_RESUMABLE_STATUSES = {
+    TaskStatus.CANCELLED.value,
     TaskStatus.pending_review.value,
     TaskStatus.completed_with_errors.value,
     TaskStatus.failed.value,
@@ -270,6 +275,7 @@ def get_task_workflow_steps(task: dict) -> list[dict[str, str]]:
             TaskStatus.PUBLISH_JOB_CREATING.value: 10,
             TaskStatus.READY_TO_PUBLISH.value: 11,
             TaskStatus.COMPLETED.value: 11,
+            TaskStatus.CANCELLED.value: 1,
             TaskStatus.FAILED_PREPARING_SOURCE.value: 2,
             TaskStatus.FAILED_TRANSCRIBING.value: 3,
             TaskStatus.FAILED_AI_ANALYZING.value: 4,
@@ -296,6 +302,7 @@ def get_task_workflow_steps(task: dict) -> list[dict[str, str]]:
             TaskStatus.FAILED_PUBLISH_JOB_CREATING.value,
             TaskStatus.completed_with_errors.value,
             TaskStatus.failed.value,
+            TaskStatus.CANCELLED.value,
         }
         completed_statuses = {
             TaskStatus.READY_TO_PUBLISH.value,
@@ -584,10 +591,16 @@ def list_task_name_history() -> list[str]:
     return [str(row["task_name"]) for row in rows]
 
 
-def get_task(task_id: str, include_video_probe: bool = True) -> dict | None:
+def get_task(
+    task_id: str,
+    include_video_probe: bool = True,
+    *,
+    include_deleted: bool = False,
+) -> dict | None:
+    deleted_clause = "" if include_deleted else " AND COALESCE(is_deleted, 0) = 0"
     with get_connection() as connection:
         row = connection.execute(
-            """
+            f"""
             SELECT
                 id, task_name, task_dir_name, source_type, platform, original_video_path, nas_file_path,
                 max_clip_duration, candidate_clip_count, selection_profile, final_clip_target,
@@ -596,7 +609,7 @@ def get_task(task_id: str, include_video_probe: bool = True) -> dict | None:
                 auto_config_json, status, progress, error_message, last_error,
                 is_deleted, deleted_at, created_at, updated_at
             FROM tasks
-            WHERE id = ?
+            WHERE id = ?{deleted_clause}
             """,
             (task_id,),
         ).fetchone()
@@ -611,7 +624,7 @@ def get_task_live_status(task_id: str) -> dict:
     status = task["status"]
     auto_mode = bool(task.get("auto_mode"))
     is_running = auto_mode and status in AUTO_PIPELINE_RUNNING_STATUSES
-    should_poll = is_running or (auto_mode and status == TaskStatus.READY_TO_PUBLISH.value)
+    should_poll = is_running
     candidate_count = count_clip_candidates(task_id)
     output_clip_count = int(task.get("output_clip_count") or 0)
 
diff --git a/app/services/video_cut_workflow_service.py b/app/services/video_cut_workflow_service.py
index 6c86da1..52d5a1a 100644
--- a/app/services/video_cut_workflow_service.py
+++ b/app/services/video_cut_workflow_service.py
@@ -4,6 +4,9 @@
 支持 cut_run 版本化：每次切片创建新的 run，成功后才切换 active，失败保留旧结果。
 """
 
+from pathlib import Path
+import shutil
+from sqlite3 import Connection
 from uuid import uuid4
 
 from app.core.config import settings
@@ -15,9 +18,15 @@
 
 # ---------- Cut Run 数据库操作 ----------
 
-def _next_cut_run_number(task_id: str) -> int:
+def _next_cut_run_number(task_id: str, connection: Connection | None = None) -> int:
     from app.db.database import get_connection
 
+    if connection is not None:
+        row = connection.execute(
+            "SELECT COALESCE(MAX(run_number), 0) AS max_run_number FROM cut_runs WHERE task_id = ?",
+            (task_id,),
+        ).fetchone()
+        return int(row["max_run_number"] or 0) + 1
     with get_connection() as connection:
         row = connection.execute(
             "SELECT COALESCE(MAX(run_number), 0) AS max_run_number FROM cut_runs WHERE task_id = ?",
@@ -29,12 +38,31 @@ def _next_cut_run_number(task_id: str) -> int:
 def _create_cut_run(task_id: str) -> dict:
     """创建新的切割 run，状态为 processing，is_active=0"""
     from app.db.database import get_connection
-    from app.services.task_service import _now_iso
+    from app.services import job_service
+    from app.services.task_service import _now_iso, STATUS_PROGRESS
 
-    now = _now_iso()
     run_id = uuid4().hex[:12]
-    run_number = _next_cut_run_number(task_id)
+    active_lease = job_service.current_job_lease()
     with get_connection() as connection:
+        connection.execute("BEGIN IMMEDIATE")
+        now = _now_iso()
+        if active_lease:
+            workflow_job_id, lease_owner, lease_token = active_lease
+            valid_lease = connection.execute(
+                """
+                SELECT 1 FROM workflow_jobs
+                WHERE id = ? AND task_id = ? AND status = 'running'
+                  AND lease_owner = ? AND lease_token = ?
+                  AND lease_expires_at > ? AND cancel_requested = 0
+                """,
+                (workflow_job_id, task_id, lease_owner, lease_token, now),
+            ).fetchone()
+            if not valid_lease:
+                connection.rollback()
+                raise job_service.JobLeaseLostError(
+                    f"Workflow Job 租约已失效，拒绝创建切片批次：{workflow_job_id}"
+                )
+        run_number = _next_cut_run_number(task_id, connection)
         connection.execute(
             """
             INSERT INTO cut_runs (id, task_id, run_number, status, is_active, created_at, updated_at)
@@ -42,10 +70,48 @@ def _create_cut_run(task_id: str) -> dict:
             """,
             (run_id, task_id, run_number, now, now),
         )
+        final_now = _now_iso()
+        lease_condition = ""
+        lease_params: tuple[str, ...] = ()
+        if active_lease:
+            workflow_job_id, lease_owner, lease_token = active_lease
+            lease_condition = """
+                AND EXISTS (
+                    SELECT 1 FROM workflow_jobs
+                    WHERE id = ? AND task_id = ? AND status = 'running'
+                      AND lease_owner = ? AND lease_token = ?
+                      AND lease_expires_at > ? AND cancel_requested = 0
+                )
+            """
+            lease_params = (workflow_job_id, task_id, lease_owner, lease_token, final_now)
+        cursor = connection.execute(
+            f"""
+            UPDATE tasks
+            SET status = ?, progress = ?, error_message = NULL, last_error = NULL, updated_at = ?
+            WHERE id = ? AND COALESCE(is_deleted, 0) = 0 AND status != ?
+              {lease_condition}
+            """,
+            (
+                TaskStatus.cutting.value,
+                STATUS_PROGRESS.get(TaskStatus.cutting.value, 0),
+                final_now,
+                task_id,
+                TaskStatus.CANCELLED.value,
+                *lease_params,
+            ),
+        )
+        if cursor.rowcount != 1:
+            connection.rollback()
+            raise RuntimeError("任务已取消、删除或不存在，不能创建新的切片批次")
         connection.commit()
     return {"id": run_id, "run_number": run_number, "task_id": task_id}
 
 
+def _cut_run_output_dir(clips_dir: Path, cut_run: dict) -> Path:
+    """每个 cut_run 使用独立目录，重试或并发不会覆盖同名媒体。"""
+    return clips_dir / f"run_{int(cut_run['run_number']):04d}_{cut_run['id']}"
+
+
 def _activate_cut_run(task_id: str, run_id: str) -> None:
     """激活指定的 cut_run，同时将该 task 下其他 run 和旧 output_clip 标记为非活跃"""
     from app.db.database import get_connection
@@ -79,12 +145,93 @@ def _fail_cut_run(run_id: str, error_message: str = "") -> None:
     now = _now_iso()
     with get_connection() as connection:
         connection.execute(
-            "UPDATE cut_runs SET status = 'failed', error_message = ?, updated_at = ? WHERE id = ?",
+            """
+            UPDATE cut_runs
+            SET status = 'failed', error_message = ?, updated_at = ?
+            WHERE id = ? AND status = 'processing'
+            """,
             (error_message, now, run_id),
         )
         connection.commit()
 
 
+def _finalize_task_for_cut_run(
+    task_id: str,
+    cut_run_id: str,
+    status: TaskStatus,
+    error_message: str | None,
+    *,
+    connection: Connection | None = None,
+) -> bool:
+    """仅允许最新 cut_run 在有效 Workflow Job 代际内写回 Task 主状态。"""
+    from app.db.database import get_connection
+    from app.services import job_service
+    from app.services.task_service import _now_iso, STATUS_PROGRESS
+
+    if connection is None:
+        with get_connection() as owned_connection:
+            owned_connection.execute("BEGIN IMMEDIATE")
+            try:
+                finalized = _finalize_task_for_cut_run(
+                    task_id,
+                    cut_run_id,
+                    status,
+                    error_message,
+                    connection=owned_connection,
+                )
+                owned_connection.commit()
+                return finalized
+            except Exception:
+                owned_connection.rollback()
+                raise
+
+    now = _now_iso()
+    active_lease = job_service.current_job_lease()
+    lease_condition = ""
+    lease_params: tuple[str, ...] = ()
+    if active_lease:
+        workflow_job_id, lease_owner, lease_token = active_lease
+        lease_condition = """
+            AND EXISTS (
+                SELECT 1 FROM workflow_jobs
+                WHERE id = ? AND task_id = ? AND status = 'running'
+                  AND lease_owner = ? AND lease_token = ?
+                  AND lease_expires_at > ? AND cancel_requested = 0
+            )
+        """
+        lease_params = (workflow_job_id, task_id, lease_owner, lease_token, now)
+    cursor = connection.execute(
+            f"""
+            UPDATE tasks
+            SET status = ?, progress = ?, error_message = ?, last_error = ?, updated_at = ?
+            WHERE id = ? AND COALESCE(is_deleted, 0) = 0 AND status = ?
+              AND EXISTS (
+                  SELECT 1 FROM cut_runs current_run
+                  WHERE current_run.id = ? AND current_run.task_id = ?
+                    AND NOT EXISTS (
+                        SELECT 1 FROM cut_runs newer_run
+                        WHERE newer_run.task_id = current_run.task_id
+                          AND newer_run.run_number > current_run.run_number
+                    )
+              )
+              {lease_condition}
+            """,
+            (
+                status.value,
+                STATUS_PROGRESS.get(status.value, 0),
+                error_message,
+                error_message,
+                now,
+                task_id,
+                TaskStatus.cutting.value,
+                cut_run_id,
+                task_id,
+                *lease_params,
+            ),
+        )
+    return cursor.rowcount == 1
+
+
 # ---------- Output Clip 数据库操作 ----------
 
 def _insert_output_clip_record(
@@ -93,52 +240,239 @@ def _insert_output_clip_record(
     result: CutResult,
     *,
     source_fingerprint: str = "",
+    connection: Connection | None = None,
+    is_active: bool = True,
 ) -> None:
     from app.db.database import get_connection
     from app.services.task_service import _now_iso
 
     now = _now_iso()
-    with get_connection() as connection:
-        candidate = connection.execute(
-            "SELECT start_time, end_time FROM clip_candidates WHERE id = ? AND task_id = ?",
-            (result.clip_candidate_id, task_id),
-        ).fetchone()
-        source_start_ms = None
-        source_end_ms = None
-        snapshot_source = "legacy_inferred"
-        if candidate:
-            source_start_ms = round(parse_time_to_seconds(candidate["start_time"]) * 1000)
-            source_end_ms = round(parse_time_to_seconds(candidate["end_time"]) * 1000)
-            snapshot_source = "cut_commit"
-        connection.execute(
-            """
-            INSERT INTO output_clip (
-                id, task_id, clip_candidate_id, output_file_path, output_file_name,
-                status, error_message, cut_run_id, is_active,
-                source_start_ms, source_end_ms, source_duration_ms,
-                source_fingerprint, snapshot_source, created_at, updated_at
-            )
-            VALUES (?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?, ?, ?, ?, ?, ?)
-            """,
-            (
-                uuid4().hex[:12],
+    if connection is None:
+        with get_connection() as owned_connection:
+            _insert_output_clip_record_on_connection(
+                owned_connection,
                 task_id,
-                result.clip_candidate_id,
-                result.output_file_path,
-                result.output_file_name,
-                result.status,
-                result.error_message,
                 cut_run_id,
-                source_start_ms,
-                source_end_ms,
-                source_end_ms - source_start_ms if source_start_ms is not None and source_end_ms is not None else None,
-                source_fingerprint,
-                snapshot_source,
-                now,
-                now,
-            ),
+                result,
+                source_fingerprint=source_fingerprint,
+                is_active=is_active,
+                now=now,
+            )
+            owned_connection.commit()
+        return
+    _insert_output_clip_record_on_connection(
+        connection,
+        task_id,
+        cut_run_id,
+        result,
+        source_fingerprint=source_fingerprint,
+        is_active=is_active,
+        now=now,
+    )
+
+
+def _insert_output_clip_record_on_connection(
+    connection: Connection,
+    task_id: str,
+    cut_run_id: str,
+    result: CutResult,
+    *,
+    source_fingerprint: str,
+    is_active: bool,
+    now: str,
+) -> None:
+    candidate = connection.execute(
+        "SELECT start_time, end_time FROM clip_candidates WHERE id = ? AND task_id = ?",
+        (result.clip_candidate_id, task_id),
+    ).fetchone()
+    source_start_ms = None
+    source_end_ms = None
+    snapshot_source = "legacy_inferred"
+    if candidate:
+        source_start_ms = round(parse_time_to_seconds(candidate["start_time"]) * 1000)
+        source_end_ms = round(parse_time_to_seconds(candidate["end_time"]) * 1000)
+        snapshot_source = "cut_commit"
+    connection.execute(
+        """
+        INSERT INTO output_clip (
+            id, task_id, clip_candidate_id, output_file_path, output_file_name,
+            status, error_message, cut_run_id, is_active,
+            source_start_ms, source_end_ms, source_duration_ms,
+            source_fingerprint, snapshot_source, created_at, updated_at
         )
-        connection.commit()
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        """,
+        (
+            uuid4().hex[:12],
+            task_id,
+            result.clip_candidate_id,
+            result.output_file_path,
+            result.output_file_name,
+            result.status,
+            result.error_message,
+            cut_run_id,
+            1 if is_active else 0,
+            source_start_ms,
+            source_end_ms,
+            source_end_ms - source_start_ms if source_start_ms is not None and source_end_ms is not None else None,
+            source_fingerprint,
+            snapshot_source,
+            now,
+            now,
+        ),
+    )
+
+
+def _commit_cut_run_results(
+    task_id: str,
+    cut_run_id: str,
+    results: list[CutResult],
+    *,
+    source_fingerprint: str,
+    error_message: str = "",
+) -> dict[str, bool]:
+    """原子写入一个批次的所有结果，并按 run_number 决定是否激活。"""
+    from app.db.database import get_connection
+    from app.services import job_service
+    from app.services.task_service import _now_iso
+
+    active_lease = job_service.current_job_lease()
+    try:
+        with get_connection() as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            now = _now_iso()
+            if active_lease:
+                workflow_job_id, lease_owner, lease_token = active_lease
+                valid_lease = connection.execute(
+                    """
+                    SELECT 1 FROM workflow_jobs
+                    WHERE id = ? AND task_id = ? AND status = 'running'
+                      AND lease_owner = ? AND lease_token = ?
+                      AND lease_expires_at > ? AND cancel_requested = 0
+                    """,
+                    (workflow_job_id, task_id, lease_owner, lease_token, now),
+                ).fetchone()
+                if not valid_lease:
+                    raise job_service.JobLeaseLostError(
+                        f"Workflow Job 租约已失效，拒绝提交切片批次：{workflow_job_id}"
+                    )
+            run = connection.execute(
+                "SELECT run_number, status, is_active FROM cut_runs WHERE id = ? AND task_id = ?",
+                (cut_run_id, task_id),
+            ).fetchone()
+            if not run:
+                raise ValueError("切片批次不存在")
+            if run["status"] in {"completed", "completed_with_errors"}:
+                newer = connection.execute(
+                    "SELECT 1 FROM cut_runs WHERE task_id = ? AND run_number > ? LIMIT 1",
+                    (task_id, int(run["run_number"])),
+                ).fetchone()
+                connection.rollback()
+                return {
+                    "activated": bool(run["is_active"]),
+                    "is_latest": newer is None,
+                    "already_committed": True,
+                }
+            if run["status"] != "processing":
+                raise RuntimeError(f"切片批次状态不是 processing：{run['status']}")
+
+            for result in results:
+                _insert_output_clip_record(
+                    task_id,
+                    cut_run_id,
+                    result,
+                    source_fingerprint=source_fingerprint,
+                    connection=connection,
+                    is_active=False,
+                )
+
+            has_success = any(result.status == "completed" for result in results)
+            has_failures = any(result.status != "completed" for result in results)
+            committed_status = (
+                "completed_with_errors"
+                if has_success and has_failures
+                else "completed" if has_success else "failed"
+            )
+            newer = connection.execute(
+                """
+                SELECT 1
+                FROM cut_runs
+                WHERE task_id = ? AND run_number > ?
+                LIMIT 1
+                """,
+                (task_id, int(run["run_number"])),
+            ).fetchone()
+            newer_completed = connection.execute(
+                """
+                SELECT 1
+                FROM cut_runs
+                WHERE task_id = ? AND run_number > ?
+                  AND status IN ('completed', 'completed_with_errors')
+                LIMIT 1
+                """,
+                (task_id, int(run["run_number"])),
+            ).fetchone()
+            is_latest = newer is None
+            activated = has_success and newer_completed is None
+
+            connection.execute(
+                """
+                UPDATE cut_runs
+                SET status = ?, is_active = ?, error_message = ?, updated_at = ?
+                WHERE id = ?
+                """,
+                (
+                    committed_status,
+                    1 if activated else 0,
+                    error_message or None,
+                    now,
+                    cut_run_id,
+                ),
+            )
+            if activated:
+                connection.execute(
+                    "UPDATE cut_runs SET is_active = 0, updated_at = ? WHERE task_id = ? AND id != ?",
+                    (now, task_id, cut_run_id),
+                )
+                connection.execute(
+                    """
+                    UPDATE output_clip
+                    SET is_active = 0
+                    WHERE task_id = ? AND (cut_run_id IS NULL OR cut_run_id != ?)
+                    """,
+                    (task_id, cut_run_id),
+                )
+                connection.execute(
+                    "UPDATE output_clip SET is_active = 1 WHERE task_id = ? AND cut_run_id = ?",
+                    (task_id, cut_run_id),
+                )
+            final_task_status = (
+                TaskStatus.completed_with_errors
+                if committed_status == "completed_with_errors"
+                else TaskStatus.completed if committed_status == "completed" else TaskStatus.failed
+            )
+            task_finalized = _finalize_task_for_cut_run(
+                task_id,
+                cut_run_id,
+                final_task_status,
+                error_message or None,
+                connection=connection,
+            )
+            connection.commit()
+        return {
+            "activated": activated,
+            "is_latest": is_latest,
+            "already_committed": False,
+            "task_finalized": task_finalized,
+        }
+    except Exception as exc:
+        try:
+            _fail_cut_run(cut_run_id, str(exc))
+        except Exception as fail_mark_error:
+            raise RuntimeError(
+                f"切片批次提交失败：{exc}；失败状态也未能写入：{fail_mark_error}"
+            ) from exc
+        raise
 
 
 def _deactivate_output_clips(task_id: str, except_run_id: str | None = None) -> None:
@@ -219,57 +553,61 @@ def process_task_video_cuts(task_id: str, *, sync_publish_jobs: bool = True) ->
         raise ValueError(error)
 
     paths = get_artifact_paths(task_id)
-    update_task_status(task_id, TaskStatus.cutting)
-    append_task_log(task_id, f"开始自动切割视频，启用片段数：{len(enabled_clips)}")
-
     # === 版本化：创建新的 cut_run，不删除旧记录 ===
     cut_run = _create_cut_run(task_id)
     cut_run_id = cut_run["id"]
+    append_task_log(task_id, f"开始自动切割视频，启用片段数：{len(enabled_clips)}")
     append_task_log(task_id, f"创建切割批次：第 {cut_run['run_number']} 次切割")
 
     try:
         from app.services.transcription_checkpoint_service import fingerprint_file
 
         source_fingerprint = fingerprint_file(source_path)
+        cut_output_dir = _cut_run_output_dir(paths["clips_dir"], cut_run)
         results = cut_clips(
             source_video=source_path,
             clips=enabled_clips,
-            output_dir=paths["clips_dir"],
+            output_dir=cut_output_dir,
             strategy=settings.default_cut_strategy,
         )
     except Exception as exc:
         error = str(exc)
         # 失败时：标记 cut_run 为 failed，保留旧的 active output_clip
         _fail_cut_run(cut_run_id, error)
-        update_task_status(task_id, TaskStatus.failed, error)
+        _finalize_task_for_cut_run(task_id, cut_run_id, TaskStatus.failed, error)
         append_task_log(task_id, f"视频切割失败：{error}")
         raise
 
-    # 插入新 output_clip 记录，关联到当前 cut_run
-    for result in results:
-        _insert_output_clip_record(
+    final_status, final_error = _resolve_final_cut_status(results)
+    try:
+        commit_result = _commit_cut_run_results(
             task_id,
             cut_run_id,
-            result,
+            results,
             source_fingerprint=source_fingerprint,
+            error_message=final_error or "",
         )
+    except Exception as exc:
+        error = f"切片文件已生成，但批次结果未能原子写入数据库：{exc}"
+        try:
+            if cut_output_dir.exists():
+                shutil.rmtree(cut_output_dir)
+        except OSError as cleanup_error:
+            error = f"{error}；未提交的批次目录清理失败：{cleanup_error}"
+        _finalize_task_for_cut_run(task_id, cut_run_id, TaskStatus.failed, error)
+        append_task_log(task_id, error)
+        raise RuntimeError(error) from exc
+
+    for result in results:
         if result.status == "completed":
             append_task_log(task_id, f"切片完成：{result.output_file_name}")
         else:
             append_task_log(task_id, f"切片失败：{result.clip_candidate_id}，原因：{result.error_message}")
 
-    final_status, final_error = _resolve_final_cut_status(results)
-
     publish_sync = None
     if final_status == TaskStatus.failed:
-        # 全部失败：不激活新 run，旧 active 保持不变
-        _fail_cut_run(cut_run_id, final_error or "全部切片失败")
-        update_task_status(task_id, final_status, final_error)
         append_task_log(task_id, "切割批次失败，旧切片结果保留不变")
-    else:
-        # 成功或部分成功：激活新 run，旧 output_clip 标记为非活跃
-        _activate_cut_run(task_id, cut_run_id)
-        update_task_status(task_id, final_status, final_error)
+    elif commit_result["activated"] and commit_result["task_finalized"]:
         append_task_log(task_id, f"自动切割结束：{get_status_label(final_status.value)}")
         if sync_publish_jobs:
             try:
@@ -287,12 +625,14 @@ def process_task_video_cuts(task_id: str, *, sync_publish_jobs: bool = True) ->
                     "errors": [str(exc)],
                 }
                 append_task_log(task_id, f"切片完成后的发送中心同步失败：{exc}")
+    else:
+        append_task_log(task_id, "切割批次已完成，但任务已取消或已有更新批次，未覆盖当前主状态")
 
     return {
         "status": final_status.value,
         "status_label": get_status_label(final_status.value),
         "message": "视频切割流程已完成",
-        "output_dir": str(paths["clips_dir"]),
+        "output_dir": str(cut_output_dir),
         "cut_run_id": cut_run_id,
         "cut_run_number": cut_run["run_number"],
         "results": [result.__dict__ for result in results],
diff --git a/tests/conftest.py b/tests/conftest.py
index 320d173..e9bf998 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -5,6 +5,8 @@
 import tempfile
 from pathlib import Path
 
+import pytest
+
 # 让测试代码可以直接导入 app 模块
 PROJECT_ROOT = Path(__file__).resolve().parents[1]
 sys.path.insert(0, str(PROJECT_ROOT))
@@ -30,3 +32,12 @@
         "NIUMA_PYTEST_SANDBOX_ROOT": str(PYTEST_SANDBOX_ROOT),
     }
 )
+
+
+@pytest.fixture(scope="session", autouse=True)
+def initialize_isolated_test_database():
+    """在任何测试访问服务层之前初始化本进程专属临时数据库。"""
+
+    from app.db.database import init_db
+
+    init_db()
diff --git a/tests/test_auto_pipeline.py b/tests/test_auto_pipeline.py
index 1f595b9..9f8f289 100644
--- a/tests/test_auto_pipeline.py
+++ b/tests/test_auto_pipeline.py
@@ -305,8 +305,14 @@ def test_create_auto_publish_job_records_scheduled_at():
             "scheduled_at": "2026-06-23T08:10:00+00:00",
         }
     ]
-    result = create_auto_publish_jobs(task, scheduled_items, subtitle_delivery_mode="original")
+    result = create_auto_publish_jobs(
+        task,
+        scheduled_items,
+        subtitle_delivery_mode="original",
+        workflow_job_id="test-auto-workflow-job",
+    )
     assert result["created_count"] == 1
+    assert result["created"][0]["provider_payload"]["workflow_job_id"] == "test-auto-workflow-job"
     with get_connection() as connection:
         row = connection.execute(
             "SELECT scheduled_at, status, video_source, cover_mode, cover_time_seconds, cover_file_path FROM publish_jobs WHERE task_id = ?",
diff --git a/tests/test_cut_atomicity.py b/tests/test_cut_atomicity.py
new file mode 100644
index 0000000..c80d09b
--- /dev/null
+++ b/tests/test_cut_atomicity.py
@@ -0,0 +1,353 @@
+"""P1.3：切片批次编号、结果提交和版本激活原子性。"""
+
+from __future__ import annotations
+
+from concurrent.futures import ThreadPoolExecutor
+from pathlib import Path
+
+import pytest
+
+from app.core.config import settings
+from app.db.database import get_connection
+from app.models.task import TaskCreate, TaskStatus
+from app.services.task_lifecycle_service import create_task_record
+from app.services.video_cut_service import CutResult
+
+
+@pytest.fixture(autouse=True)
+def cleanup_cut_data():
+    yield
+    with get_connection() as connection:
+        connection.execute("DELETE FROM workflow_jobs WHERE task_id LIKE 'test-atomic-%'")
+        connection.execute("DELETE FROM output_clip WHERE task_id LIKE 'test-atomic-%'")
+        connection.execute("DELETE FROM cut_runs WHERE task_id LIKE 'test-atomic-%'")
+        connection.execute("DELETE FROM clip_candidates WHERE task_id LIKE 'test-atomic-%'")
+        connection.execute("DELETE FROM tasks WHERE id LIKE 'test-atomic-%'")
+        connection.commit()
+
+
+def _create_task(task_id: str) -> None:
+    create_task_record(
+        TaskCreate(
+            task_name=task_id,
+            source_type="upload",
+            platform="general",
+            selection_profile="general",
+        ),
+        task_id=task_id,
+        task_dir_name=task_id,
+    )
+
+
+def _insert_candidate(task_id: str, clip_id: str) -> None:
+    from app.services.task_service import _now_iso
+
+    now = _now_iso()
+    with get_connection() as connection:
+        connection.execute(
+            """
+            INSERT INTO clip_candidates (
+                id, task_id, clip_key, title, start_time, end_time, duration_seconds,
+                summary, reason, highlight_reason, spread_value, suggested_editing,
+                confidence_score, selected_by_default, enabled, reviewed, created_at, updated_at
+            ) VALUES (?, ?, ?, ?, '00:00:01', '00:00:03', 2, '', '', '', '', '', 0.8, 1, 1, 0, ?, ?)
+            """,
+            (clip_id, task_id, clip_id, clip_id, now, now),
+        )
+        connection.commit()
+
+
+def _result(clip_id: str, filename: str) -> CutResult:
+    return CutResult(clip_id, f"C:/tmp/{filename}", filename, "completed")
+
+
+def test_concurrent_cut_run_numbers_are_unique():
+    from app.services.video_cut_workflow_service import _create_cut_run
+
+    task_id = "test-atomic-run-number"
+    _create_task(task_id)
+
+    with ThreadPoolExecutor(max_workers=4) as executor:
+        runs = list(executor.map(lambda _index: _create_cut_run(task_id), range(8)))
+
+    numbers = sorted(run["run_number"] for run in runs)
+    assert numbers == list(range(1, 9))
+
+
+def test_cut_result_batch_rolls_back_on_second_insert(monkeypatch):
+    import app.services.video_cut_workflow_service as workflow
+
+    task_id = "test-atomic-rollback"
+    _create_task(task_id)
+    _insert_candidate(task_id, "test-atomic-clip-1")
+    _insert_candidate(task_id, "test-atomic-clip-2")
+    run = workflow._create_cut_run(task_id)
+    original_insert = workflow._insert_output_clip_record
+    calls = 0
+
+    def fail_second_insert(*args, **kwargs):
+        nonlocal calls
+        calls += 1
+        if calls == 2:
+            raise RuntimeError("模拟第二条写入失败")
+        return original_insert(*args, **kwargs)
+
+    monkeypatch.setattr(workflow, "_insert_output_clip_record", fail_second_insert)
+
+    with pytest.raises(RuntimeError, match="第二条写入失败"):
+        workflow._commit_cut_run_results(
+            task_id,
+            run["id"],
+            [_result("test-atomic-clip-1", "one.mp4"), _result("test-atomic-clip-2", "two.mp4")],
+            source_fingerprint="fingerprint",
+        )
+
+    with get_connection() as connection:
+        count = connection.execute(
+            "SELECT COUNT(*) AS total FROM output_clip WHERE cut_run_id = ?", (run["id"],)
+        ).fetchone()["total"]
+        run_row = connection.execute("SELECT status, is_active FROM cut_runs WHERE id = ?", (run["id"],)).fetchone()
+    assert count == 0
+    assert dict(run_row) == {"status": "failed", "is_active": 0}
+
+
+def test_older_run_cannot_replace_newer_completed_run():
+    from app.services.video_cut_workflow_service import _commit_cut_run_results, _create_cut_run
+
+    task_id = "test-atomic-order"
+    _create_task(task_id)
+    _insert_candidate(task_id, "test-atomic-order-clip")
+    older = _create_cut_run(task_id)
+    newer = _create_cut_run(task_id)
+    newest_failed = _create_cut_run(task_id)
+
+    newer_commit = _commit_cut_run_results(
+        task_id,
+        newer["id"],
+        [_result("test-atomic-order-clip", "newer.mp4")],
+        source_fingerprint="newer",
+    )
+    _commit_cut_run_results(
+        task_id,
+        newest_failed["id"],
+        [
+            CutResult(
+                "test-atomic-order-clip",
+                "C:/tmp/failed.mp4",
+                "failed.mp4",
+                "failed",
+                "模拟失败",
+            )
+        ],
+        source_fingerprint="failed",
+        error_message="模拟失败",
+    )
+    older_commit = _commit_cut_run_results(
+        task_id,
+        older["id"],
+        [_result("test-atomic-order-clip", "older.mp4")],
+        source_fingerprint="older",
+    )
+
+    assert newer_commit["activated"] is True
+    assert older_commit["activated"] is False
+    with get_connection() as connection:
+        active = connection.execute(
+            "SELECT id FROM cut_runs WHERE task_id = ? AND is_active = 1", (task_id,)
+        ).fetchall()
+    assert [row["id"] for row in active] == [newer["id"]]
+
+
+def test_older_run_cannot_finalize_task_after_newer_run_starts():
+    from app.services.task_service import get_task
+    from app.services.video_cut_workflow_service import _commit_cut_run_results, _create_cut_run
+
+    task_id = "test-atomic-task-finalize-order"
+    _create_task(task_id)
+    _insert_candidate(task_id, "test-atomic-task-finalize-clip")
+    older = _create_cut_run(task_id)
+    newer = _create_cut_run(task_id)
+
+    older_commit = _commit_cut_run_results(
+        task_id,
+        older["id"],
+        [_result("test-atomic-task-finalize-clip", "older-finished.mp4")],
+        source_fingerprint="older-finished",
+    )
+
+    assert older_commit["task_finalized"] is False
+    assert get_task(task_id, include_video_probe=False)["status"] == TaskStatus.cutting.value
+
+    newer_commit = _commit_cut_run_results(
+        task_id,
+        newer["id"],
+        [_result("test-atomic-task-finalize-clip", "newer-finished.mp4")],
+        source_fingerprint="newer-finished",
+    )
+
+    assert newer_commit["task_finalized"] is True
+    assert get_task(task_id, include_video_probe=False)["status"] == TaskStatus.completed.value
+
+
+def test_cut_commit_cannot_overwrite_task_status_changed_during_run():
+    from app.services.task_lifecycle_service import update_task_status
+    from app.services.task_service import get_task
+    from app.services.video_cut_workflow_service import _commit_cut_run_results, _create_cut_run
+
+    task_id = "test-atomic-task-status-cas"
+    _create_task(task_id)
+    _insert_candidate(task_id, "test-atomic-task-status-cas-clip")
+    run = _create_cut_run(task_id)
+    update_task_status(task_id, TaskStatus.failed, "外部流程已更新状态")
+
+    committed = _commit_cut_run_results(
+        task_id,
+        run["id"],
+        [_result("test-atomic-task-status-cas-clip", "status-cas.mp4")],
+        source_fingerprint="status-cas",
+    )
+
+    assert committed["task_finalized"] is False
+    task = get_task(task_id, include_video_probe=False)
+    assert task["status"] == TaskStatus.failed.value
+    assert task["last_error"] == "外部流程已更新状态"
+
+
+def test_expired_worker_cannot_create_cut_run_or_write_cutting_state():
+    from app.services import job_service
+    from app.services.task_service import get_task
+    from app.services.video_cut_workflow_service import _create_cut_run
+
+    task_id = "test-atomic-expired-create"
+    _create_task(task_id)
+    job, _created = job_service.create_or_get_active_job(
+        task_id=task_id,
+        job_type=job_service.JOB_TYPE_VIDEO_CUT,
+    )
+    claimed = job_service.claim_job(job["id"], "expired-cut-owner")
+    assert claimed is not None
+    with get_connection() as connection:
+        connection.execute(
+            "UPDATE workflow_jobs SET lease_expires_at = '2000-01-01T00:00:00+00:00' WHERE id = ?",
+            (job["id"],),
+        )
+        connection.commit()
+
+    with job_service.job_lease_context(job["id"], "expired-cut-owner", claimed["lease_token"]):
+        with pytest.raises(job_service.JobLeaseLostError):
+            _create_cut_run(task_id)
+
+    assert get_task(task_id, include_video_probe=False)["status"] == "pending_video"
+
+
+def test_duplicate_commit_does_not_downgrade_completed_run():
+    from app.services.video_cut_workflow_service import _commit_cut_run_results, _create_cut_run
+
+    task_id = "test-atomic-idempotent"
+    _create_task(task_id)
+    _insert_candidate(task_id, "test-atomic-idempotent-clip")
+    run = _create_cut_run(task_id)
+    results = [_result("test-atomic-idempotent-clip", "once.mp4")]
+
+    first = _commit_cut_run_results(task_id, run["id"], results, source_fingerprint="same")
+    second = _commit_cut_run_results(task_id, run["id"], results, source_fingerprint="same")
+
+    assert first["already_committed"] is False
+    assert second["already_committed"] is True
+    with get_connection() as connection:
+        run_row = connection.execute("SELECT status FROM cut_runs WHERE id = ?", (run["id"],)).fetchone()
+        count = connection.execute(
+            "SELECT COUNT(*) AS total FROM output_clip WHERE cut_run_id = ?", (run["id"],)
+        ).fetchone()["total"]
+    assert run_row["status"] == "completed"
+    assert count == 1
+
+
+def test_partial_success_is_preserved_in_cut_run_status():
+    from app.services.video_cut_workflow_service import _commit_cut_run_results, _create_cut_run
+
+    task_id = "test-atomic-partial"
+    _create_task(task_id)
+    _insert_candidate(task_id, "test-atomic-partial-ok")
+    _insert_candidate(task_id, "test-atomic-partial-failed")
+    run = _create_cut_run(task_id)
+
+    committed = _commit_cut_run_results(
+        task_id,
+        run["id"],
+        [
+            _result("test-atomic-partial-ok", "ok.mp4"),
+            CutResult(
+                "test-atomic-partial-failed",
+                "C:/tmp/failed.mp4",
+                "failed.mp4",
+                "failed",
+                "模拟失败",
+            ),
+        ],
+        source_fingerprint="partial",
+        error_message="部分失败",
+    )
+
+    assert committed["activated"] is True
+    with get_connection() as connection:
+        run_row = connection.execute(
+            "SELECT status, error_message FROM cut_runs WHERE id = ?", (run["id"],)
+        ).fetchone()
+    assert dict(run_row) == {"status": "completed_with_errors", "error_message": "部分失败"}
+
+
+def test_each_cut_run_uses_a_distinct_output_directory(tmp_path):
+    from app.services.video_cut_workflow_service import _cut_run_output_dir
+
+    first = {"id": "abc123", "run_number": 1}
+    second = {"id": "def456", "run_number": 2}
+
+    assert _cut_run_output_dir(tmp_path, first) != _cut_run_output_dir(tmp_path, second)
+    assert _cut_run_output_dir(tmp_path, first).parent == tmp_path
+
+
+def test_process_cut_commits_batch_and_returns_run_directory(monkeypatch):
+    import app.services.task_service as task_service
+    import app.services.video_cut_workflow_service as workflow
+
+    task_id = "test-atomic-process"
+    _create_task(task_id)
+    _insert_candidate(task_id, "test-atomic-process-clip")
+    source = settings.tasks_dir / "_test_inputs" / "test-atomic-process.mp4"
+    source.parent.mkdir(parents=True, exist_ok=True)
+    source.write_bytes(b"fake-video")
+    with get_connection() as connection:
+        connection.execute(
+            "UPDATE tasks SET original_video_path = ?, source_type = 'upload' WHERE id = ?",
+            (str(source), task_id),
+        )
+        connection.commit()
+
+    original_get_task = task_service.get_task
+    monkeypatch.setattr(
+        task_service,
+        "get_task",
+        lambda value, include_video_probe=True: original_get_task(value, include_video_probe=False),
+    )
+
+    def fake_cut_clips(*, source_video, clips, output_dir, strategy):
+        del source_video, clips, strategy
+        output_dir.mkdir(parents=True, exist_ok=True)
+        output = output_dir / "clip.mp4"
+        output.write_bytes(b"clip")
+        return [CutResult("test-atomic-process-clip", str(output), output.name, "completed")]
+
+    monkeypatch.setattr(workflow, "cut_clips", fake_cut_clips)
+
+    result = workflow.process_task_video_cuts(task_id, sync_publish_jobs=False)
+
+    assert Path(result["output_dir"]).name.startswith("run_0001_")
+    with get_connection() as connection:
+        rows = connection.execute(
+            "SELECT cut_run_id, is_active FROM output_clip WHERE task_id = ?",
+            (task_id,),
+        ).fetchall()
+    assert len(rows) == 1
+    assert rows[0]["cut_run_id"] == result["cut_run_id"]
+    assert rows[0]["is_active"] == 1
diff --git a/tests/test_pipeline_state_stability.py b/tests/test_pipeline_state_stability.py
new file mode 100644
index 0000000..e70cdfd
--- /dev/null
+++ b/tests/test_pipeline_state_stability.py
@@ -0,0 +1,314 @@
+"""P1.3：全自动流水线取消、终态和失败证据。"""
+
+from __future__ import annotations
+
+import json
+from unittest.mock import Mock
+
+import pytest
+
+from app.db.database import get_connection, init_db
+from app.models.task import TaskCreate, TaskStatus
+from app.services import job_service, task_service
+from app.services.pipeline_engine import PipelineEngine
+from app.services.task_lifecycle_service import create_task_record
+from app.services.task_service import get_task
+
+
+@pytest.fixture(autouse=True)
+def cleanup_pipeline_data():
+    yield
+    with get_connection() as connection:
+        connection.execute("DELETE FROM publish_jobs WHERE task_id LIKE 'test-pipeline-state-%'")
+        connection.execute("DELETE FROM workflow_jobs WHERE task_id LIKE 'test-pipeline-state-%'")
+        connection.execute("DELETE FROM output_clip WHERE task_id LIKE 'test-pipeline-state-%'")
+        connection.execute("DELETE FROM tasks WHERE id LIKE 'test-pipeline-state-%'")
+        connection.commit()
+
+
+def _create_auto_task(task_id: str) -> dict:
+    create_task_record(
+        TaskCreate(
+            task_name=task_id,
+            source_type="upload",
+            platform="general",
+            selection_profile="general",
+            auto_mode=True,
+        ),
+        task_id=task_id,
+        task_dir_name=task_id,
+    )
+    return get_task(task_id, include_video_probe=False)
+
+
+def _engine_for_last_step(monkeypatch, task_id: str) -> PipelineEngine:
+    engine = PipelineEngine()
+    monkeypatch.setattr(engine, "_create_publish_jobs", Mock(return_value={"created_count": 1}))
+    monkeypatch.setattr(
+        engine,
+        "_write_task_summary",
+        Mock(return_value={"summary_path": f"C:/tmp/{task_id}.json"}),
+    )
+    return engine
+
+
+def test_success_stays_ready_to_publish(monkeypatch):
+    task = _create_auto_task("test-pipeline-state-ready")
+    engine = _engine_for_last_step(monkeypatch, task["id"])
+
+    result = engine.run(task["id"], start_step=TaskStatus.PUBLISH_JOB_CREATING)
+
+    assert result["status"] == "ready_to_publish"
+    assert get_task(task["id"], include_video_probe=False)["status"] == TaskStatus.READY_TO_PUBLISH.value
+    assert task_service.get_task_live_status(task["id"])["should_poll"] is False
+
+
+def test_cancel_after_step_does_not_write_ready(monkeypatch):
+    task = _create_auto_task("test-pipeline-state-cancel")
+    job, _created = job_service.create_or_get_active_job(
+        task_id=task["id"], job_type=job_service.JOB_TYPE_AUTO_PIPELINE
+    )
+    engine = _engine_for_last_step(monkeypatch, task["id"])
+    cancelled = iter([False, True])
+    monkeypatch.setattr(job_service, "is_cancel_requested", lambda _job_id: next(cancelled))
+    monkeypatch.setattr(job_service, "update_job_progress", Mock())
+    monkeypatch.setattr(job_service, "heartbeat_job", Mock())
+
+    result = engine.run(
+        task["id"],
+        start_step=TaskStatus.PUBLISH_JOB_CREATING,
+        job_id=job["id"],
+    )
+
+    assert result["status"] == "cancelled"
+    assert get_task(task["id"], include_video_probe=False)["status"] == TaskStatus.CANCELLED.value
+
+
+def test_summary_write_failure_does_not_hide_business_failure(monkeypatch):
+    task = _create_auto_task("test-pipeline-state-summary")
+    engine = PipelineEngine()
+    monkeypatch.setattr(engine, "_create_publish_jobs", Mock(side_effect=ValueError("原始业务错误")))
+    monkeypatch.setattr(engine, "_write_task_summary", Mock(side_effect=OSError("磁盘暂不可写")))
+
+    result = engine.run(task["id"], start_step=TaskStatus.PUBLISH_JOB_CREATING)
+
+    assert result["status"] == "failed"
+    assert result["last_error"] == "原始业务错误"
+    assert result["summary_path"] == ""
+    assert get_task(task["id"], include_video_probe=False)["last_error"] == "原始业务错误"
+
+
+def test_request_cancel_marks_auto_task_cancelled():
+    task = _create_auto_task("test-pipeline-state-request-cancel")
+    job, _created = job_service.create_or_get_active_job(
+        task_id=task["id"], job_type=job_service.JOB_TYPE_AUTO_PIPELINE
+    )
+
+    cancelled = job_service.request_job_cancel(job["id"])
+
+    assert cancelled["status"] == job_service.JOB_STATUS_CANCELLED
+    assert get_task(task["id"], include_video_probe=False)["status"] == TaskStatus.CANCELLED.value
+
+
+def test_cancelled_status_survives_database_initialization():
+    task = _create_auto_task("test-pipeline-state-restart")
+    job, _created = job_service.create_or_get_active_job(
+        task_id=task["id"], job_type=job_service.JOB_TYPE_AUTO_PIPELINE
+    )
+    job_service.request_job_cancel(job["id"])
+
+    init_db()
+
+    assert get_task(task["id"], include_video_probe=False)["status"] == TaskStatus.CANCELLED.value
+
+
+def test_cancel_requested_running_job_cannot_be_marked_completed():
+    task = _create_auto_task("test-pipeline-state-terminal-race")
+    job, _created = job_service.create_or_get_active_job(
+        task_id=task["id"], job_type=job_service.JOB_TYPE_AUTO_PIPELINE
+    )
+    claimed = job_service.claim_job(job["id"], "test-owner")
+    token = claimed["lease_token"]
+    job_service.request_job_cancel(job["id"])
+
+    with job_service.job_lease_context(job["id"], "test-owner", token):
+        with pytest.raises(job_service.JobLeaseLostError):
+            job_service.mark_job_completed(job["id"], {"status": "ready_to_publish"})
+
+    current = job_service.get_job(job["id"])
+    assert current["status"] == job_service.JOB_STATUS_RUNNING
+    assert current["cancel_requested"] == 1
+    assert get_task(task["id"], include_video_probe=False)["status"] == TaskStatus.CANCELLED.value
+
+
+def test_cancel_between_final_check_and_ready_write_wins(monkeypatch):
+    task = _create_auto_task("test-pipeline-state-final-race")
+    job, _created = job_service.create_or_get_active_job(
+        task_id=task["id"], job_type=job_service.JOB_TYPE_AUTO_PIPELINE
+    )
+    claimed = job_service.claim_job(job["id"], "final-race-owner")
+    assert claimed is not None
+    engine = _engine_for_last_step(monkeypatch, task["id"])
+    monkeypatch.setattr(job_service, "update_job_progress", Mock())
+    monkeypatch.setattr(job_service, "heartbeat_job", Mock())
+    checks = 0
+
+    def cancel_after_final_check(_job_id):
+        nonlocal checks
+        checks += 1
+        if checks == 3:
+            job_service.request_job_cancel(job["id"])
+
+    monkeypatch.setattr(engine, "_raise_if_cancelled", cancel_after_final_check)
+
+    with job_service.job_lease_context(job["id"], "final-race-owner", claimed["lease_token"]):
+        result = engine.run(
+            task["id"],
+            start_step=TaskStatus.PUBLISH_JOB_CREATING,
+            job_id=job["id"],
+        )
+
+    assert result["status"] == "cancelled"
+    assert get_task(task["id"], include_video_probe=False)["status"] == TaskStatus.CANCELLED.value
+
+
+def test_cancel_pipeline_cancels_only_jobs_created_by_current_run():
+    task = _create_auto_task("test-pipeline-state-publish-cleanup")
+    now = task_service._now_iso()
+    with get_connection() as connection:
+        connection.execute(
+            """
+            INSERT INTO output_clip (
+                id, task_id, output_file_path, output_file_name, status,
+                is_active, created_at, updated_at
+            ) VALUES ('pipeline-output', ?, '', 'clip.mp4', 'completed', 1, ?, ?)
+            """,
+            (task["id"], now, now),
+        )
+        for job_id, platform in (
+            ("pipeline-created-job", "douyin"),
+            ("pipeline-existing-job", "bilibili"),
+        ):
+            connection.execute(
+                """
+                INSERT INTO publish_jobs (
+                    id, task_id, output_clip_id, platform, status, created_at, updated_at
+                ) VALUES (?, ?, 'pipeline-output', ?, 'WAITING', ?, ?)
+                """,
+                (job_id, task["id"], platform, now, now),
+            )
+        connection.commit()
+
+    cancelled = PipelineEngine()._cancel_unpublished_auto_jobs(
+        task["id"],
+        {TaskStatus.PUBLISH_JOB_CREATING.value: {"created": [{"id": "pipeline-created-job"}]}},
+    )
+
+    with get_connection() as connection:
+        rows = {
+            row["id"]: row["status"]
+            for row in connection.execute(
+                "SELECT id, status FROM publish_jobs WHERE task_id = ?", (task["id"],)
+            ).fetchall()
+        }
+    assert cancelled == 1
+    assert rows == {
+        "pipeline-created-job": "CANCELLED",
+        "pipeline-existing-job": "WAITING",
+    }
+
+
+def test_old_worker_cannot_write_ready_after_lease_takeover():
+    task = _create_auto_task("test-pipeline-state-ready-fence")
+    job, _created = job_service.create_or_get_active_job(
+        task_id=task["id"], job_type=job_service.JOB_TYPE_AUTO_PIPELINE
+    )
+    old_claim = job_service.claim_job(job["id"], "old-owner")
+    with get_connection() as connection:
+        connection.execute(
+            "UPDATE workflow_jobs SET lease_expires_at = '2000-01-01T00:00:00+00:00' WHERE id = ?",
+            (job["id"],),
+        )
+        connection.commit()
+    new_claim = job_service.claim_job(job["id"], "new-owner")
+    assert new_claim is not None
+
+    with job_service.job_lease_context(job["id"], "old-owner", old_claim["lease_token"]):
+        with pytest.raises(job_service.JobLeaseLostError):
+            PipelineEngine()._mark_ready_to_publish(task["id"], job["id"])
+
+    assert get_task(task["id"], include_video_probe=False)["status"] == TaskStatus.CREATED.value
+
+
+def test_expired_cancel_requested_job_is_recovered_as_cancelled():
+    task = _create_auto_task("test-pipeline-state-cancel-recovery")
+    job, _created = job_service.create_or_get_active_job(
+        task_id=task["id"], job_type=job_service.JOB_TYPE_AUTO_PIPELINE
+    )
+    claimed = job_service.claim_job(job["id"], "cancel-recovery-owner")
+    assert claimed is not None
+    job_service.request_job_cancel(job["id"])
+    with get_connection() as connection:
+        connection.execute(
+            "UPDATE workflow_jobs SET lease_expires_at = '2000-01-01T00:00:00+00:00' WHERE id = ?",
+            (job["id"],),
+        )
+        connection.commit()
+
+    job_service.claim_next_job("recovery-worker")
+
+    recovered = job_service.get_job(job["id"])
+    assert recovered["status"] == job_service.JOB_STATUS_CANCELLED
+    assert recovered["lease_owner"] is None
+    assert recovered["lease_token"] is None
+
+
+def test_job_cancel_cleans_only_publish_jobs_linked_to_same_pipeline():
+    task = _create_auto_task("test-pipeline-state-linked-publish")
+    job, _created = job_service.create_or_get_active_job(
+        task_id=task["id"], job_type=job_service.JOB_TYPE_AUTO_PIPELINE
+    )
+    now = task_service._now_iso()
+    with get_connection() as connection:
+        connection.execute(
+            """
+            INSERT INTO output_clip (
+                id, task_id, output_file_path, output_file_name, status,
+                is_active, created_at, updated_at
+            ) VALUES ('linked-pipeline-output', ?, '', 'clip.mp4', 'completed', 1, ?, ?)
+            """,
+            (task["id"], now, now),
+        )
+        for publish_job_id, workflow_job_id, platform in (
+            ("linked-pipeline-publish", job["id"], "douyin"),
+            ("other-pipeline-publish", "another-workflow-job", "bilibili"),
+        ):
+            provider_response = json.dumps(
+                {"source": "auto_pipeline", "workflow_job_id": workflow_job_id},
+                ensure_ascii=False,
+            )
+            connection.execute(
+                """
+                INSERT INTO publish_jobs (
+                    id, task_id, output_clip_id, platform, status,
+                    provider_response, created_at, updated_at
+                ) VALUES (?, ?, 'linked-pipeline-output', ?, 'SCHEDULED', ?, ?, ?)
+                """,
+                (publish_job_id, task["id"], platform, provider_response, now, now),
+            )
+        connection.commit()
+
+    job_service.request_job_cancel(job["id"])
+
+    with get_connection() as connection:
+        statuses = {
+            row["id"]: row["status"]
+            for row in connection.execute(
+                "SELECT id, status FROM publish_jobs WHERE task_id = ?",
+                (task["id"],),
+            ).fetchall()
+        }
+    assert statuses == {
+        "linked-pipeline-publish": "CANCELLED",
+        "other-pipeline-publish": "SCHEDULED",
+    }
diff --git a/tests/test_task_state_machine.py b/tests/test_task_state_machine.py
new file mode 100644
index 0000000..3e3ad30
--- /dev/null
+++ b/tests/test_task_state_machine.py
@@ -0,0 +1,149 @@
+"""P1.3：任务状态机与删除任务写保护。"""
+
+from __future__ import annotations
+
+from fastapi.testclient import TestClient
+import pytest
+
+from app.core.config import settings
+from app.db.database import get_connection
+from app.main import app
+from app.models.task import TaskCreate, TaskStatus
+from app.services import job_service
+from app.services.task_lifecycle_service import (
+    TaskStatusConflictError,
+    create_task_record,
+    update_task_status,
+)
+
+
+def _headers() -> dict[str, str]:
+    if settings.local_admin_token:
+        return {"Authorization": f"Bearer {settings.local_admin_token}"}
+    return {}
+
+
+@pytest.fixture(autouse=True)
+def cleanup_tasks():
+    yield
+    with get_connection() as connection:
+        connection.execute("DELETE FROM publish_jobs WHERE task_id LIKE 'test-state-%'")
+        connection.execute("DELETE FROM workflow_jobs WHERE task_id LIKE 'test-state-%'")
+        connection.execute("DELETE FROM tasks WHERE id LIKE 'test-state-%'")
+        connection.commit()
+
+
+def _create_task(task_id: str, *, auto_mode: bool = False) -> dict:
+    return create_task_record(
+        TaskCreate(
+            task_name=task_id,
+            source_type="upload",
+            platform="general",
+            selection_profile="general",
+            auto_mode=auto_mode,
+        ),
+        task_id=task_id,
+        task_dir_name=task_id,
+    )
+
+
+def test_status_api_rejects_jump_from_empty_task_to_completed():
+    task = _create_task("test-state-no-jump")
+
+    with TestClient(app) as client:
+        response = client.patch(
+            f"/api/tasks/{task['id']}/status",
+            json={"status": TaskStatus.completed.value},
+            headers=_headers(),
+        )
+
+    assert response.status_code == 409
+    with get_connection() as connection:
+        row = connection.execute("SELECT status FROM tasks WHERE id = ?", (task["id"],)).fetchone()
+    assert row["status"] == TaskStatus.pending_video.value
+
+
+def test_status_api_allows_declared_adjacent_transition():
+    task = _create_task("test-state-adjacent")
+    with get_connection() as connection:
+        connection.execute(
+            "UPDATE tasks SET original_video_path = 'C:/managed/source.mp4' WHERE id = ?",
+            (task["id"],),
+        )
+        connection.commit()
+
+    with TestClient(app) as client:
+        response = client.patch(
+            f"/api/tasks/{task['id']}/status",
+            json={"status": TaskStatus.pending_processing.value},
+            headers=_headers(),
+        )
+
+    assert response.status_code == 200
+    assert response.json()["status"] == TaskStatus.pending_processing.value
+
+
+def test_status_api_requires_source_before_pending_processing():
+    task = _create_task("test-state-source-required")
+
+    with TestClient(app) as client:
+        response = client.patch(
+            f"/api/tasks/{task['id']}/status",
+            json={"status": TaskStatus.pending_processing.value},
+            headers=_headers(),
+        )
+
+    assert response.status_code == 409
+    assert "尚未绑定源视频" in response.json()["detail"]
+
+
+def test_internal_status_write_rejects_deleted_task():
+    task = _create_task("test-state-deleted")
+    with get_connection() as connection:
+        connection.execute("UPDATE tasks SET is_deleted = 1 WHERE id = ?", (task["id"],))
+        connection.commit()
+
+    with pytest.raises(TaskStatusConflictError, match="已永久删除"):
+        update_task_status(task["id"], TaskStatus.completed)
+
+    with get_connection() as connection:
+        row = connection.execute("SELECT status FROM tasks WHERE id = ?", (task["id"],)).fetchone()
+    assert row["status"] == TaskStatus.pending_video.value
+
+
+def test_deleted_task_is_hidden_from_detail_and_media_apis():
+    task = _create_task("test-state-hidden")
+    with get_connection() as connection:
+        connection.execute("UPDATE tasks SET is_deleted = 1 WHERE id = ?", (task["id"],))
+        connection.commit()
+
+    with TestClient(app) as client:
+        detail = client.get(f"/api/tasks/{task['id']}", headers=_headers())
+        media = client.get(f"/media/tasks/{task['id']}/source-video", headers=_headers())
+
+    assert detail.status_code == 404
+    assert media.status_code == 404
+
+
+def test_public_cancel_also_requests_active_auto_pipeline_stop():
+    task = _create_task("test-state-public-cancel", auto_mode=True)
+    update_task_status(task["id"], TaskStatus.PREPARING_SOURCE)
+    job, _created = job_service.create_or_get_active_job(
+        task_id=task["id"],
+        job_type=job_service.JOB_TYPE_AUTO_PIPELINE,
+    )
+    claimed = job_service.claim_job(job["id"], "public-cancel-owner")
+    assert claimed is not None
+
+    with TestClient(app) as client:
+        response = client.patch(
+            f"/api/tasks/{task['id']}/status",
+            json={"status": TaskStatus.CANCELLED.value},
+            headers=_headers(),
+        )
+
+    assert response.status_code == 200
+    assert response.json()["status"] == TaskStatus.CANCELLED.value
+    current_job = job_service.get_job(job["id"])
+    assert current_job["status"] == job_service.JOB_STATUS_RUNNING
+    assert current_job["cancel_requested"] == 1