From 1689d59b1a28ea86a53aad31598bd5c5a213b95e Mon Sep 17 00:00:00 2001
From: Codex <codex@example.local>
Date: Mon, 24 Aug 2026 22:20:31 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=EF=BC=9A=E5=A2=9E=E5=8A=A0?=
 =?UTF-8?q?=E6=B5=81=E6=B0=B4=E7=BA=BF=E6=96=AD=E7=82=B9=E6=81=A2=E5=A4=8D?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .codemap/codemap.html                       |    2 +-
 .codemap/codemap.md                         |   18 +-
 .codemap/modules.json                       |   48 +-
 DEVELOPMENT_LOG.md                          |   14 +
 NEXT_STEPS.md                               |    7 +-
 PROJECT_AUDIT.md                            |   16 +
 STABILITY_P1_PIPELINE_CHECKPOINT_TASK.md    |   85 ++
 app/services/job_service.py                 |   59 ++
 app/services/pipeline_checkpoint_service.py |  259 +++++
 app/services/pipeline_engine.py             | 1013 ++++++++++++++++++-
 tests/test_pipeline_checkpoint.py           |  723 +++++++++++++
 tests/test_pipeline_state_stability.py      |   83 +-
 12 files changed, 2240 insertions(+), 87 deletions(-)
 create mode 100644 STABILITY_P1_PIPELINE_CHECKPOINT_TASK.md
 create mode 100644 app/services/pipeline_checkpoint_service.py
 create mode 100644 tests/test_pipeline_checkpoint.py

diff --git a/.codemap/codemap.html b/.codemap/codemap.html
index a0e7fb9..24e88fa 100644
--- a/.codemap/codemap.html
+++ b/.codemap/codemap.html
@@ -195,7 +195,7 @@ <h1 id="projTitle">Functional Architecture Map</h1>
 <div class="modal" id="stdModal"></div>
 
 <script>
-const DATA = {"meta": {"project": "NiuMa Studio", "lang": "zh", "subtitle": "牛马片场 · 本地 AI 高光生产后台工程体检", "generatedAt": "2026-08-24", "htmlPath": ".codemap/codemap.html", "mdPath": ".codemap/codemap.md", "spineDesc": "用户通过页面/API 创建素材任务，SQLite Job 驱动转写、AI 选片、审核切片和字幕，再由发送中心排期并交给 Windows Chrome Worker，所有状态与审计证据回写 SQLite。", "tracked_loc": 50778, "tracked_files": 132, "rev": "a01f103c43916d25310254f6f8389e9fc9e52521"}, "bands": [{"id": "presentation", "tier": "fe", "t": "界面 · API", "d": "浏览器页面、前端交互、FastAPI 路由与运行配置"}, {"id": "wire1", "wire": true, "t": "HTTP / JSON / 文件上传"}, {"id": "workflow", "tier": "be", "t": "业务编排", "d": "任务、流水线、发送中心和状态机"}, {"id": "processing", "tier": "be", "t": "媒体与 AI 处理", "d": "转写、AI 选片、切片和字幕"}, {"id": "execution", "tier": "be", "t": "外部执行边界", "d": "调度、Publisher 与 Windows Chrome Worker"}, {"id": "persistence", "tier": "be", "t": "持久化与运维", "d": "SQLite Schema/迁移/备份与本地交付脚本"}], "spine": ["frontend_ui", "api_runtime", "pipeline_queue", "transcription", "ai_selection", "task_review_cut", "subtitle", "publish_center", "publish_scheduler", "publisher_worker", "persistence"], "reportThemes": [["本地单体架构是当前可运行的主要原因", "FastAPI + SQLite WAL + 文件产物 + 持久化 Job + Windows Worker 与个人本机规模匹配；不需要微服务化，现有恢复骨架应保留。"], ["P0 数据一致性边界已封口，事务型旧债仍需继续", "活动库外键、测试误删、媒体删除回滚和切片批次原子提交已修复；迁移无账本与索引重建失败静默降级仍是下一阶段重点。"], ["Job、发布执行和任务状态代际已封口，下一风险转向跨进程精确续跑", "Workflow lease token、Publish execution fencing、任务状态转换、取消恢复和切片原子提交已经完成；下一阶段重点是持久化 step checkpoint 与副作用复用。"], ["可用性 fallback 正在掩盖降级结果", "AI 部分窗口、转写旧产物、损坏 JSON、封面生成、批量发布和风险字段多处静默继续，用户不一定能区分完整成功、部分成功和旧结果。"], ["发布与配置读取是主要安全边界", "Publish Center、AI Config 与 Frontend 仍存在原始 Secret 响应、可选写鉴权和 DOM XSS；Worker 路径与 journal 脱敏已收紧，但本地管理员接口门禁尚未完成。"], ["复杂度集中而非全项目平均恶化", "publish_service.py、publish-center.js、app.js、publish_scheduler.py、subtitle_data_service.py 和 transcript_service.py 是主要 God Component；应按业务边界渐进拆分。"], ["测试已与活动数据隔离，但 Coverage 与真实故障闭环仍不足", "637 项测试全部通过，Pytest 已强制使用进程级 sandbox；Coverage 尚未采集，真实平台 E2E 和故障注入仍需在不触发生产副作用的边界下补齐。"]], "standard": {"rubric": [{"grade": "A", "score": 95, "range": "90–100", "en": "clean, well-scoped, idiomatic", "zh": "干净、职责单一、地道"}, {"grade": "B", "score": 82, "range": "75–89", "en": "minor issues: a documented shim, mild bloat", "zh": "小问题：有文档的兼容、轻微臃肿"}, {"grade": "C", "score": 67, "range": "60–74", "en": "notable hacks / fallbacks / bloat / duplication", "zh": "明显的 hack / 回退 / 臃肿 / 重复"}, {"grade": "D", "score": 50, "range": "40–59", "en": "significant legacy / stubs / duplication, or a protocol violation", "zh": "严重的遗留 / 占位 / 重复，或协议违规"}, {"grade": "F", "score": 25, "range": "0–39", "en": "broken, fake output, or unfinished-but-wired", "zh": "损坏、伪造输出，或未完成却已接线"}], "severities": [{"key": "HIGH", "en": "wrong / dangerous / fake, a protocol or security issue, or a genuine maintenance hazard", "zh": "错误 / 危险 / 伪造、协议或安全问题，或真正的维护地雷"}, {"key": "MED", "en": "a real smell a maintainer should fix", "zh": "维护者该修的真坏味"}, {"key": "LOW", "en": "a documented shim, a cosmetic cast, benign bloat — worth noting, not urgent", "zh": "有文档的兼容、装饰性 cast、良性臃肿 —— 值得记、不紧急"}], "coupling": [{"key": "core", "en": "system spine — central to almost everything", "zh": "系统主线 —— 几乎牵连一切"}, {"key": "high", "en": "many connections", "zh": "连接很多"}, {"key": "med", "en": "moderate", "zh": "中等"}, {"key": "low", "en": "leaf / self-contained", "zh": "叶子 / 自洽"}], "tags": [{"id": "monkeypatch", "label": "monkeypatch", "labelZh": "猴补丁", "bad": true, "en": "runtime mutation of another module / stdlib / vendor; reflection or prototype patching", "zh": "运行时改写别的模块/标准库/依赖；反射或原型补丁"}, {"id": "fallback", "label": "fallback", "labelZh": "回退兜底", "bad": true, "en": "'try the real thing, then fake/degrade'; a||b||c chains that hide which value is real", "zh": "“先试真的再退化/造假”；a||b||c 掩盖哪个是真值"}, {"id": "silent-except", "label": "silent-except", "labelZh": "静默吞错", "bad": true, "en": "swallowed errors: empty catch / except:pass / ignored return codes", "zh": "吞掉错误：空 catch / except:pass / 忽略返回码"}, {"id": "legacy", "label": "legacy", "labelZh": "遗留", "bad": true, "en": "deprecated/back-compat shims, dead-but-shipped code, parallel old+new paths", "zh": "遗留/兼容垫片、已发布的死代码、新旧并存"}, {"id": "dual-format", "label": "dual-format", "labelZh": "双格式", "bad": true, "en": "accepting two shapes for one field (snake||camel), patched through the code", "zh": "同一字段接受两种形态（snake||camel）并散落各处"}, {"id": "stub", "label": "stub", "labelZh": "占位桩", "bad": true, "en": "NotImplemented / TODO / dead buttons / demo scripts presented as real", "zh": "未实现/TODO/死按钮/演示脚本当成品"}, {"id": "fake-output", "label": "fake-output", "labelZh": "伪造输出", "bad": true, "en": "returns random/canned/hardcoded results where real work is implied", "zh": "本应真算的地方返回随机/写死结果"}, {"id": "duplication", "label": "duplication", "labelZh": "重复", "bad": true, "en": "copy-pasted logic, or an existing shared abstraction not reused", "zh": "复制粘贴，或已有共享抽象却不复用"}, {"id": "bloat", "label": "bloat", "labelZh": "臃肿", "bad": true, "en": "oversized file / function; too many responsibilities in one unit", "zh": "超大文件/函数；单元职责过多"}, {"id": "glue", "label": "glue", "labelZh": "胶水", "bad": true, "en": "valueless pass-through: rows of thin forwarders / no-op adapters", "zh": "无价值透传：成片薄包装 / 零转换适配器"}, {"id": "any-escape", "label": "any-escape", "labelZh": "类型逃逸", "bad": true, "en": "bypassing the type system: as any / @ts-ignore / dynamic / void* / reinterpret_cast / unsafe", "zh": "绕过类型系统：as any / @ts-ignore / dynamic / void* / reinterpret_cast / unsafe"}, {"id": "over-fit", "label": "over-fit", "labelZh": "过度特化", "bad": true, "en": "hardcoded to one case where a small generalization was expected", "zh": "硬编码单一情况，本应小幅泛化"}, {"id": "god-component", "label": "god-component", "labelZh": "上帝组件", "bad": true, "en": "one component/class/file doing far too much", "zh": "一个组件/类/文件做太多事"}, {"id": "placeholder", "label": "placeholder", "labelZh": "占位", "bad": true, "en": "unfinished UI / data presented as if complete", "zh": "未完成的 UI/数据当作已完成"}, {"id": "clean", "label": "clean", "labelZh": "干净", "bad": false, "en": "no material issues — well-scoped", "zh": "无实质问题 —— 职责单一"}]}, "modules": [{"id": "frontend_ui", "label": "Frontend UI", "band": "presentation", "path": "app/templates + app/static", "desc": "用 Jinja2、原生 JavaScript 和 CSS 提供任务、审核、字幕与发送中心界面。", "coupling": "high", "deps": ["api_runtime"], "loc": 13840, "score": 65, "grade": "C", "tags": ["god-component", "bloat", "glue", "duplication", "legacy"], "findings": [{"sev": "HIGH", "loc": "app/static/js/app.js:211", "text": "多个写请求绕过统一 apiFetch；启用 LOCAL_ADMIN_TOKEN 时可能缺失 Authorization 并被 API 拒绝。"}, {"sev": "HIGH", "loc": "app/static/js/app.js:1729", "text": "接口或任务数据直接拼接到 innerHTML；publish-center.js:2152 有同类路径，存在本地 DOM XSS/页面结构破坏风险。"}, {"sev": "MED", "loc": "app/templates/system_status.html:98", "text": "配置/API Key 字段进入 DOM，base.html:11 还承载本地管理 Token；需确认全链路始终掩码。"}, {"sev": "MED", "loc": "app/static/css/styles.css:870", "text": "使用多个未在 :root 定义的 CSS 自定义属性，相关声明可能失效。"}, {"sev": "MED", "loc": "app/static/js/app.js:1", "text": "任务、转写、AI、审核、切片、字幕和配置行为集中在超大全局脚本，回归半径较大。"}, {"sev": "MED", "loc": "tests/test_publish_center_browser.py:16", "text": "Playwright 缺失时核心浏览器测试可静默跳过，字幕交互与鉴权失败路径覆盖不足。"}, {"sev": "LOW", "loc": "app/static/js/subtitle-editor.js:171", "text": "字幕编辑器已有 escapeHtml、虚拟列表、竞态 token 与自动保存版本控制，是可保留的正向实现。"}, {"sev": "LOW", "loc": "app/static/js/publish-center.js:4", "text": "前端明确只创建抖音任务，B站保留后端兼容；这是当前产品边界而非应机械删除的代码。"}]}, {"id": "api_runtime", "label": "API & Runtime", "band": "presentation", "path": "app/main.py + core/models/routers", "desc": "加载配置、初始化应用与安全中间件，并把页面/API 请求路由到业务服务。", "coupling": "core", "deps": ["media_storage", "transcription", "ai_selection", "task_review_cut", "subtitle", "pipeline_queue", "publish_center", "publish_scheduler", "persistence"], "loc": 2753, "score": 48, "grade": "D", "tags": ["fallback", "legacy", "dual-format", "bloat", "glue"], "findings": [{"sev": "HIGH", "loc": "app/routers/settings.py:10", "text": "GET /api/settings/ai 未做鉴权，返回 ai_config_service.get_ai_config_context() 中的原始 values；该上下文会从 .env/环境变量读取 API key、token 等 Secret，并同时返回 env_path。前端或本地恶意页面可直接读取凭据。"}, {"sev": "HIGH", "loc": "app/main.py:98", "text": "本地管理鉴权是可选的：只有 LOCAL_ADMIN_TOKEN 非空时才校验写请求；配置默认值为空，因此未配置 Token 时所有 POST/PUT/PATCH/DELETE API 均可被无认证调用。"}, {"sev": "HIGH", "loc": "app/routers/files.py:9", "text": "未鉴权的 /api/files/browse 调用 browse_video_directory，虽限制了根目录和路径穿越，但仍枚举 configured allowed roots 下的目录名、文件名、绝对路径、父路径和文件大小，造成本地媒体元数据泄露。"}, {"sev": "HIGH", "loc": "app/routers/tasks.py:223", "text": "async 路由直接执行同步重任务：音频处理、转写、切片和任务详情 ffprobe 可阻塞 FastAPI event loop，影响无关请求。"}, {"sev": "MED", "loc": "app/routers/tasks.py:35", "text": "大量 async 路由直接调用同步数据库、文件和服务函数；仅少数入口使用 run_in_threadpool，异步边界不一致，容易出现请求串行化和响应抖动。"}, {"sev": "MED", "loc": "app/models/task.py:7-41", "text": "TaskStatus 同时保留大写自动流水线状态和小写 legacy 状态；任意状态跳跃虽已修复，但模型、旧页面和 API 客户端仍需兼容两套值。"}, {"sev": "MED", "loc": "app/routers/tasks.py:35; app/routers/publish.py:1", "text": "tasks.py 与 publish.py 聚合大量路由、异常映射、同步/异步调度和业务编排，新增流程的 blast radius 较大。"}]}, {"id": "media_storage", "label": "Media & Storage", "band": "processing", "path": "storage/media/FFmpeg services", "desc": "管理 E 盘任务目录、路径安全、素材预检、FFmpeg/FFprobe 与受控子进程。", "coupling": "high", "deps": ["persistence"], "loc": 1614, "score": 84, "grade": "B", "tags": ["legacy", "dual-format", "glue", "fallback", "silent-except"], "findings": [{"sev": "MED", "loc": "app/services/storage_service.py:840-846", "text": "move_task_directory_to_trash 明确传入 reserve=False，仍采用查询后检查目录的非原子分配；当前无运行时调用，属于遗留兼容入口，但未来恢复调用时仍可能并发复用同一回收站目录。"}, {"sev": "MED", "loc": "app/services/storage_service.py:361-367", "text": "通用 resolve_video_file_path 对已存在路径仍原样返回。媒体 HTTP 路由已增加任务边界，但 publish/auto-publish/subtitle/task 查询等非 HTTP 调用方仍可把数据库中的现有外部路径交给后续读取或上传逻辑。"}, {"sev": "LOW", "loc": "tests/test_storage_boundaries.py:14-32", "text": "新增边界测试没有覆盖任务目录数据库读取在 sqlite3.Error、锁定或损坏数据库下显式失败的回归；代码已有保护但证据不足。"}, {"sev": "LOW", "loc": "app/services/storage_service.py:257-300", "text": "reserve=True 会在数据库任务记录写入前创建目录；进程在预占后崩溃可能留下无数据库记录的空目录，虽不会覆盖数据，但会造成孤儿目录累积。"}]}, {"id": "transcription", "label": "Transcription", "band": "processing", "path": "transcript services", "desc": "提取音频，调用火山引擎或 faster-whisper，并以分块 checkpoint 生成时间戳转写。", "coupling": "high", "deps": ["media_storage", "persistence"], "loc": 1960, "score": 59, "grade": "D", "tags": ["fallback", "silent-except", "fake-output", "duplication", "god-component", "glue", "over-fit"], "findings": [{"sev": "HIGH", "loc": "app/services/transcript_workflow_service.py:317", "text": "transcript Markdown 存在即返回 completed，未校验源指纹、Provider、进度状态或文件完整性。"}, {"sev": "HIGH", "loc": "app/services/transcript_service.py:265", "text": "JobLeaseLostError 已显式透传，但 TranscriptCancelledError 仍会被统一包装为 RuntimeError，取消可能落成 failed。"}, {"sev": "HIGH", "loc": "app/services/transcript_service.py:516", "text": "远程分块请求每次使用随机 request id，缺少持久化幂等键和超时后结果确认，重试可能重复计费。"}, {"sev": "MED", "loc": "app/services/transcript_service.py:516", "text": "HTTP 429、Retry-After、网络瞬断和可恢复服务错误缺少专门退避策略。"}, {"sev": "MED", "loc": "app/services/transcript_service.py:556", "text": "响应 result.message 可能被当作 0-1 秒转写正文写入结果。"}, {"sev": "MED", "loc": "app/services/transcript_service.py:831", "text": "进度文件 IO/JSON 损坏时静默返回空字典，可能隐藏故障并触发重复执行。"}, {"sev": "MED", "loc": "app/services/transcript_workflow_service.py:224", "text": "运行和取消状态仍是进程内 set，多进程/重启时不能可靠去重或取消。"}, {"sev": "MED", "loc": "app/services/transcript_service.py:325", "text": "本地和远程转写复制分块、checkpoint、异常和进度循环，行为容易漂移。"}, {"sev": "MED", "loc": "app/services/transcript_service.py:1088", "text": "Provider/模型/设备为模块级可变全局，并发任务可能互相覆盖运行元数据。"}, {"sev": "MED", "loc": "app/services/transcript_service.py:83", "text": "约 1300 行文件混合 FFmpeg、本地模型、远程 HTTP、checkpoint、进度和 Markdown，职责过大。"}, {"sev": "LOW", "loc": "tests/test_long_live_foundation.py:65", "text": "已覆盖失租 checkpoint 和异常透传，仍缺取消、429/坏响应、重复计费与真实 Markdown 闭环。"}]}, {"id": "ai_selection", "label": "AI Selection", "band": "processing", "path": "AI providers and analyzers", "desc": "选择 Codex/远程/本地 Provider，解析不稳定 AI 输出并生成通用、综艺或长直播候选片段。", "coupling": "core", "deps": ["transcription", "persistence"], "loc": 4420, "score": 63, "grade": "C", "tags": ["fallback", "silent-except", "legacy", "dual-format", "stub", "fake-output", "bloat", "duplication", "god-component"], "findings": [{"sev": "HIGH", "loc": "app/services/ai_config_service.py:318", "text": "get_ai_config_context 返回含 AI/ASR Key 的完整 values，GET /api/settings/ai 无读取鉴权，页面也复用该上下文。"}, {"sev": "MED", "loc": "app/services/ai/ai_clip_service.py:4", "text": "generate_candidate_clips_placeholder 返回三条硬编码 ClipCandidate；虽当前无调用方，误接线会产生 fake output。"}, {"sev": "MED", "loc": "app/services/ai/ai_clip_analyzer.py:131", "text": "分段分析失败窗口被跳过，只要其他窗口有候选便返回；通用路径缺少最低覆盖率门槛。"}, {"sev": "MED", "loc": "app/services/ai/variety_comedy_analyzer.py:513", "text": "全局评审失败时隐式降级到扩展阶段评分，Provider 失败仍可形成候选。"}, {"sev": "MED", "loc": "app/services/ai/local_model_provider.py:19", "text": "fallback_protocol 对任意 AIProviderError 都执行第二协议，未区分限流、认证和协议错误，可能重复调用与计费。"}, {"sev": "MED", "loc": "app/services/ai_analysis_workflow_service.py:738", "text": "候选事务替换、JSON 文件和 run 历史分步持久化，后续失败会形成数据库与文件/历史不一致。"}, {"sev": "MED", "loc": "app/services/ai/long_live_talk_analyzer.py:427", "text": "checkpoint 更新无 run/lease/owner fencing，并发或旧进程恢复可能互相覆盖窗口状态。"}, {"sev": "MED", "loc": "app/services/ai_analysis_workflow_service.py:71", "text": "分析元文件不存在、损坏或读取异常时静默返回空字典，无法区分未分析与产物损坏。"}, {"sev": "LOW", "loc": "app/services/ai/ai_clip_analyzer.py:456", "text": "输出归一化同时接受多组历史字段并填大量默认值，兼容有效但维护成本高。"}, {"sev": "LOW", "loc": "app/services/ai_config_service.py:55", "text": "旧 AI_REMOTE 与新分析/发布配置并存，运行时还改写全局 settings，形成双路径。"}, {"sev": "MED", "loc": "app/services/ai_analysis_workflow_service.py:685", "text": "单文件集中 profile、Provider、状态、候选、文件、历史与恢复，模块回归半径大。"}, {"sev": "MED", "loc": "app/services/ai/ai_clip_analyzer.py:252", "text": "多个分析器重复偏好摘要、时间转换、默认字段和 AI 输出解析逻辑。"}, {"sev": "MED", "loc": "tests/test_split_services.py:200", "text": "缺少真实 Provider 成功路径、文件写入失败一致性、并发运行和旧 checkpoint 覆盖测试。"}, {"sev": "MED", "loc": "tests/test_codex_cli_provider.py:12", "text": "Provider 测试主要 monkeypatch，缺少 HTTP 429/500/超时和协议 fallback 重复调用边界。"}, {"sev": "LOW", "loc": "tests/test_variety_comedy_selection.py:291", "text": "算法分支覆盖较好，但真实三阶段 Provider、资源消耗和全局评审降级未由集成测试锁定。"}]}, {"id": "task_review_cut", "label": "Task Review & Cut", "band": "workflow", "path": "task and cut workflow services", "desc": "维护任务状态与视图，保存候选审核选择，生成切片版本并同步发送中心。", "coupling": "core", "deps": ["media_storage", "ai_selection", "publish_center", "persistence"], "loc": 3036, "score": 78, "grade": "B", "tags": ["god-component", "glue", "fallback", "dual-format", "legacy", "over-fit"], "findings": [{"sev": "HIGH", "loc": "app/services/task_service.py:458-485,594-616", "text": "任务详情默认执行无 timeout 的 ffprobe，且未捕获 OSError/Path.stat 异常；NAS、损坏或卡死媒体可能阻塞详情请求或返回 500。明确延期至 P1.4。"}, {"sev": "MED", "loc": "app/services/task_lifecycle_service.py:373-401; tests/test_task_state_machine.py:69-82", "text": "公共状态转换前置条件只检查数据库字段或路径字符串，不验证源视频、候选产物和活跃 output 文件真实存在。明确延期至 P1.4。"}, {"sev": "MED", "loc": "app/services/task_service.py:1-98,1220-1273; app/services/task_query_service.py:16-24", "text": "TaskService 仍集中承担大量业务、数据库和展示职责，并与 task_query_service 互相导入、保留包装函数，维护 blast radius 较大。建议作为 P2 延后拆分。"}, {"sev": "MED", "loc": "app/services/task_service.py:717-718", "text": "候选片段列表会直接解析每条历史时间字段，单条异常格式仍可能阻断整个审核列表。"}, {"sev": "LOW", "loc": "app/services/task_lifecycle_service.py:139-225", "text": "任务目录预占后若后续数据库写入失败，仍缺少统一释放空目录的补偿路径，可能留下少量孤儿目录。"}]}, {"id": "subtitle", "label": "Subtitle", "band": "processing", "path": "subtitle services", "desc": "维护字幕轨、不可变 revision、cue、AI 建议、渲染验证与自动流水线交付决定。", "coupling": "high", "deps": ["media_storage", "task_review_cut", "ai_selection", "persistence"], "loc": 2409, "score": 70, "grade": "C", "tags": ["fallback", "silent-except", "legacy", "bloat", "god-component", "monkeypatch"], "findings": [{"sev": "MED", "loc": "app/services/subtitle_data_service.py:352", "text": "手工 revision 的 active/base 检查在事务外，并发编辑可覆盖 active 选择。"}, {"sev": "MED", "loc": "app/services/subtitle_data_service.py:489", "text": "批准 revision 在事务外校验，并发或重放旧请求可回退 active 版本。"}, {"sev": "MED", "loc": "app/services/subtitle_data_service.py:135", "text": "source/clip track 先查后插，NULL output_clip_id 约束不足，并发可能重复源轨。"}, {"sev": "MED", "loc": "app/services/subtitle_auto_workflow_service.py:87", "text": "批量批准逐 clip 独立提交，Job 后创建；中途失败会留下部分批准。"}, {"sev": "MED", "loc": "app/services/subtitle_data_service.py:168", "text": "source revision 提交后逐 clip 独立同步，异常会形成混合版本。"}, {"sev": "MED", "loc": "app/services/subtitle_workflow_service.py:475", "text": "字幕 job 完成与激活分两次写入，迟到 worker 仍可能激活旧成片。"}, {"sev": "LOW", "loc": "app/services/subtitle_auto_workflow_service.py:273", "text": "auto_config_json 损坏时静默降为空并写回，可能丢弃其他配置。"}, {"sev": "MED", "loc": "app/services/subtitle_data_service.py:1045", "text": "字幕数据服务聚合 track、revision、cue、导入导出、波形和渲染辅助，回归半径大。"}, {"sev": "LOW", "loc": "app/services/subtitle_workflow_service.py:312", "text": "统一 revision 外仍保留旧调用方适配，存在历史口径漂移成本。"}, {"sev": "MED", "loc": "tests/test_subtitle_editor.py:189", "text": "缺并发 save/approve/ensure track 与批处理中途失败测试。"}, {"sev": "LOW", "loc": "tests/test_subtitle_auto_workflow.py:172", "text": "核心真实渲染在 FFmpeg/FFprobe 缺失时会跳过，异常 Provider 证据不足。"}, {"sev": "LOW", "loc": "app/services/subtitle_data_service.py:761", "text": "波形处理把完整 PCM 捕获到内存，超长媒体存在时长线性内存峰值。"}, {"sev": "LOW", "loc": "app/services/subtitle_data_service.py:1024", "text": "单条字幕文本可接近文件上限，放大渲染、导出和 Prompt 资源消耗。"}]}, {"id": "pipeline_queue", "label": "Pipeline & Job Queue", "band": "workflow", "path": "pipeline and workflow job services", "desc": "用 SQLite Job、Lease、Heartbeat、Checkpoint 和子进程串联长任务与自动流水线。", "coupling": "core", "deps": ["transcription", "ai_selection", "task_review_cut", "subtitle", "publish_center", "persistence"], "loc": 2342, "score": 72, "grade": "C", "tags": ["fallback", "silent-except", "legacy", "stub", "god-component", "glue", "over-fit"], "findings": [{"sev": "MED", "loc": "app/services/pipeline_engine.py:108,311-314; app/services/job_service.py:488-504", "text": "自动流水线仅在内存 context 中保存步骤结果，虽有 update_job_checkpoint API，但 PipelineEngine 未持久化调用；重启后可能从 PREPARING_SOURCE 重新执行并重复 AI、封面和排期副作用。"}, {"sev": "MED", "loc": "app/services/job_worker.py:198-202", "text": "WorkflowJobRunner 将子进程 stdout/stderr 重定向到 DEVNULL，父进程通常只能记录退出码，重启恢复和人工诊断证据不足。"}, {"sev": "MED", "loc": "app/services/job_service.py:127-139", "text": "payload/result/checkpoint JSON 损坏时静默保留原字符串，执行器后续可能产生不明确的数据类型错误。"}, {"sev": "MED", "loc": "app/services/job_service.py:19-23; app/services/job_worker.py:60-69", "text": "ai_analysis 与 publish job 类型仍可创建，但 Worker 没有对应执行分支，最终统一失败，属于可创建但不可执行的 legacy/stub 入口。"}, {"sev": "LOW", "loc": "app/services/pipeline_engine.py:693-720", "text": "产物 JSON 或排期时间配置损坏时静默回退默认值，故障可见性不足。"}, {"sev": "LOW", "loc": "app/services/job_worker.py:310-353", "text": "父 Worker 在 lease 已过期但尚未被其他执行接管时仍可能写入 Job 终态；token 接管后会被拒绝，当前属于较低概率恢复边界。"}]}, {"id": "publish_center", "label": "Publish Center", "band": "workflow", "path": "publish content preparation services", "desc": "准备标题、简介、话题、封面、账号和发布草稿，并保留历史兼容执行入口。", "coupling": "core", "deps": ["task_review_cut", "subtitle", "publish_scheduler", "publisher_worker", "persistence"], "loc": 5593, "score": 52, "grade": "D", "tags": ["god-component", "bloat", "legacy", "dual-format", "fallback", "silent-except", "placeholder", "duplication"], "findings": [{"sev": "HIGH", "loc": "app/services/publish_service.py:570", "text": "_normalize_config/_normalize_account 仅新增 *_masked 字段，却保留 client_secret、access_token、refresh_token 原字段；GET /api/publish/platforms、/accounts 及保存配置/账号响应直接返回这些原始密钥，存在敏感凭据泄漏风险。"}, {"sev": "MED", "loc": "app/services/publish_service.py:266", "text": "publish_service.py 当前约4750行，混合配置/账号/OAuth、文案与封面、队列同步、历史、旧 OpenCLI 脚本、API Provider 和页面上下文，形成高耦合 God Component，任一发布流程改动的 blast radius 很大。"}, {"sev": "MED", "loc": "app/services/publish_service.py:2941", "text": "历史查询 SQL 只按 PUBLISH_HISTORY_STATUSES 的大写值过滤，之后才调用 _normalize_publish_status；LEGACY_STATUS_MAP 支持旧小写状态但旧记录会在 SQL 层被提前排除，历史页可能漏数据。"}, {"sev": "MED", "loc": "app/services/publish_service.py:2144", "text": "sync_task_publish_jobs 封面生成失败时只把 {'cover_error': ...} 放入 item_covers，仍继续插入 WAITING 任务且不计入 errors；同步可能返回 ok，但生成的任务实际无法通过 local_browser readiness。"}, {"sev": "MED", "loc": "app/services/publish_service.py:2787", "text": "create_batch_publish_jobs 对不存在的 output_clip_id 直接 continue，全部无效或部分无效时仍返回 status='ok'，调用方无法区分‘创建成功’与‘输入被静默丢弃’。"}, {"sev": "MED", "loc": "app/services/publish_readiness.py:167", "text": "publish_domain/create_publish_job 仍允许 api_publish，publishers registry 也保留兼容入口，但统一 readiness 只接受 local_browser/manual_export 并将 api_publish 标记 unsupported_publish_mode，持久化任务与调度契约不一致。"}, {"sev": "MED", "loc": "app/services/publish_providers.py:117", "text": "BilibiliPublishProvider 在完成配置和 token 校验后始终抛出 bilibili_provider_pending；api_publish 模式仍可创建/注册，因此这是已接线但必然失败的 placeholder 路径。"}, {"sev": "MED", "loc": "app/services/publish_providers.py:66", "text": "旧 Douyin API Provider 将 upload 与 create 分成两个无幂等键的请求；_request_json 只包装 HTTPError/URLError，平台已接收后网络超时或连接异常可能被判失败，重试会重复上传/投稿且没有 NEED_REVIEW 不确定态。"}, {"sev": "LOW", "loc": "app/services/publish_providers.py:204", "text": "_post_multipart 先 file_path.read_bytes() 再 b''.join(chunks)，完整视频和完整 multipart body 同时驻留内存，大文件发布存在约双倍峰值。"}, {"sev": "LOW", "loc": "app/services/publish_service.py:1569", "text": "_batch_find_publish_jobs 对每条记录直接调用 _normalize_job(row)，未传入预取 accounts；_normalize_job 会逐条触发 readiness/account 查询，发布中心批量切片时形成 N+1 查询。"}, {"sev": "LOW", "loc": "tests/test_publish_history.py:111", "text": "现有定向测试未覆盖原始 Secret/Token 响应、旧小写历史状态、同步封面 partial、批量无效 ID，以及 API 超时后已接收的重复投稿边界。"}]}, {"id": "publish_scheduler", "label": "Publish Scheduler", "band": "execution", "path": "scheduler/repository/executor", "desc": "计算排期、原子领取发布任务、重试、恢复不确定执行并维护发布状态机。", "coupling": "core", "deps": ["publish_center", "publisher_worker", "persistence"], "loc": 2329, "score": 71, "grade": "C", "tags": ["god-component", "bloat", "legacy", "silent-except"], "findings": [{"sev": "MED", "loc": "app/services/publish_scheduler.py:756-785", "text": "recover_interrupted_jobs 每轮加载全部 PUBLISHING 任务，并对每个任务串行查询 Worker，没有批量上限、并发控制或退避；Worker 不可用或卡住任务较多时，单轮耗时按任务数乘以网络超时增长，会延迟后续排期处理。"}, {"sev": "MED", "loc": "app/services/publish_scheduler.py:281-302", "text": "list_due_jobs 每轮 SELECT 全部 SCHEDULED 记录，再逐条在 Python 中解析时间；虽已有状态/排期索引，但没有 SQL due 条件、分页或批量上限，排期量增长后会增加扫描内存和调度延迟。"}, {"sev": "MED", "loc": "app/services/publish_scheduler.py:133-1788", "text": "PublishScheduler 约 1891 行、42 个方法，同时承担排期计算、任务领取、执行结果写回、Worker 恢复、重试修复、人工复核、批量排期和旧版兼容；职责边界过宽，修改任一状态路径的回归半径较大。"}, {"sev": "LOW", "loc": "app/services/publish_scheduler.py:274-279", "text": "shutdown 已能追踪并等待后台 Task，但没有超时或取消兜底；若当前 run_once 被数据库锁、Worker 串行查询或文件操作长期阻塞，应用优雅停机仍可能无限等待。"}, {"sev": "LOW", "loc": "app/services/publish_scheduler.py:1807-1812", "text": "queue_snapshot 对非法 scheduled_at 捕获 ValueError 后静默 pass；损坏排期会从“今日任务”视图中消失，未产生告警或错误计数，降低数据异常可见性。"}]}, {"id": "publisher_worker", "label": "Publishers & Worker", "band": "execution", "path": "publisher registry and Windows worker", "desc": "通过 Publisher Registry 和 Windows Chrome Worker 执行抖音/B站投稿、导出与兼容模式。", "coupling": "high", "deps": ["media_storage", "persistence"], "loc": 2699, "score": 76, "grade": "B", "tags": ["legacy", "glue", "silent-except", "fallback"], "findings": [{"sev": "MED", "loc": "scripts/publish_host_worker.py:321", "text": "_prior_job_execution_requires_review 扫描旧 execution journal 时，若 journal 缺少 identity 或已损坏，直接 continue；跨 execution 无法确认其 job_id 时不会阻断新 execution。旧 Worker 在上传后崩溃并留下无身份/损坏日志时，仍存在重复投稿边界。"}, {"sev": "LOW", "loc": "app/services/publishers/page_scripts.py:14", "text": "页面脚本入口仍通过延迟导入 publish_service 私有函数来转发大量 DOM 脚本；这是有意保留的兼容层，但形成 legacy glue，脚本变更仍会牵连 4750 行 God Service。"}, {"sev": "LOW", "loc": "app/services/publishers/browser_runtime.py:315", "text": "screenshot 捕获裸 Exception 后返回空字符串，截图失败不会进入发布结果或健康信号；发布可以继续但缺少关键诊断证据。"}, {"sev": "LOW", "loc": "scripts/opencli_host_bridge.py:74", "text": "旧 OpenCLIHostBridgeHandler 的 /run 处理器本身没有 Bearer Token 校验；当前 main 已转调受保护的 publish_host_worker，默认入口不再使用它，但保留的可直接实例化旧处理器仍会造成安全边界误解。"}, {"sev": "LOW", "loc": "tests/test_publish_worker_client.py:155", "text": "当前测试已覆盖双进程锁竞争、死进程锁回收和常规 execution fencing，但仍未覆盖无身份/损坏旧 journal 被跨 execution 扫描跳过、screenshot 失败信号及旧 bridge 处理器被直接启动时的鉴权边界。"}]}, {"id": "persistence", "label": "SQLite Persistence", "band": "persistence", "path": "app/db + backup services", "desc": "创建 SQLite Schema、执行启动时兼容迁移和索引，并提供 WAL 安全备份恢复。", "coupling": "core", "deps": [], "loc": 3436, "score": 64, "grade": "C", "tags": ["silent-except", "legacy", "dual-format", "bloat", "god-component"], "findings": [{"sev": "HIGH", "loc": "app/db/database.py:628-671", "text": "_create_indexes 先删除 uq_publish_jobs_active_clip_platform_mode，随后对所有索引创建统一捕获 sqlite3.Error 并静默忽略；唯一部分索引创建失败时，旧索引已删除且无告警，活动发布任务可能失去唯一约束并产生重复记录。"}, {"sev": "MED", "loc": "app/db/database.py:31-617", "text": "数据库初始化依赖多个结构探针和缺列即 ALTER TABLE，没有 PRAGMA user_version、schema_migrations 或可追踪迁移版本；历史数据库的实际结构只能由当前代码反推。"}, {"sev": "MED", "loc": "app/db/database.py:754,1162", "text": "多个迁移函数使用 executescript，发布表迁移还会在数据规范化前提交新增列；后续失败时可能已持久化部分结构，init_db 不是原子升级。"}, {"sev": "LOW", "loc": "app/db/database.py:656-657", "text": "workflow job claim 索引未覆盖 lease_expires_at；队列规模增大或过期任务集中时可能读取更多候选行，属于性能退化而非当前正确性故障。"}]}, {"id": "ops_delivery", "label": "Ops & Delivery", "band": "persistence", "path": "Docker/PowerShell/CI", "desc": "提供 Windows/Docker 启停、诊断、CI、发布门禁、Demo 与维护脚本。", "coupling": "med", "deps": ["api_runtime", "publisher_worker", "persistence"], "loc": 4347, "score": 68, "grade": "C", "tags": ["fallback", "legacy", "dual-format", "duplication", "bloat", "glue", "silent-except", "monkeypatch"], "findings": [{"sev": "MED", "loc": ".github/workflows/ci.yml:3", "text": "CI 仅监听 master push/PR；feature/docs 直接 push 不即时验证，问题延迟到开 PR。"}, {"sev": "MED", "loc": "scripts/start_docker_opencli.ps1:24", "text": "健康检查异常只警告不返回非零，服务失败也可能被调用方视为启动成功。"}, {"sev": "MED", "loc": "scripts/start.ps1:30", "text": "Demo 覆盖生效前先对正式 E 盘配置运行 doctor，新机/迁移机的隔离 Demo 可能被旧路径阻断。"}, {"sev": "MED", "loc": "scripts/start.ps1:71", "text": "Worker 启动异常被捕获后继续并报告工作台成功，发布能力不可用时易被误判完整健康。"}, {"sev": "HIGH", "loc": "scripts/migrate_task_dirs_to_project_names.py:211", "text": "任务目录迁移用非 WAL-aware 主库 copy，先移动目录再统一更新提交，无文件补偿，异常会让路径/DB 不一致。"}, {"sev": "MED", "loc": "scripts/restore.ps1:27", "text": "恢复只以健康响应判断 App 运行，StopServices 只停 Compose；native/异常健康进程可能仍持有 DB 时执行替换。"}, {"sev": "MED", "loc": "scripts/backup.ps1:33", "text": "备份默认包含 .env 且不加密，仅显式 ExcludeEnv 才排除，包被共享时泄漏本机秘密。"}, {"sev": "MED", "loc": "tests/test_native_scripts.py:11", "text": "启停测试主要是源码字符串断言，Windows smoke 不做实际 restore/冲突/清理失败与恢复后健康验证。"}, {"sev": "MED", "loc": "scripts/seed_demo_data.py:32", "text": "缺 FFmpeg 时仍插入无媒体路径 Demo 数据并成功退出，数量检查通过但媒体 smoke 不可信。"}, {"sev": "LOW", "loc": "scripts/acceptance.ps1:115", "text": "验收递归扫描正式任务目录，媒体量大/锁文件会显著拖慢或阻断 release gate。"}, {"sev": "LOW", "loc": "scripts/backup_restore_runtime.py:142", "text": "import 时 monkeypatch backup core，全局行为依赖导入顺序。"}, {"sev": "LOW", "loc": "docs/PORTABLE_SETUP.md:127", "text": "文档描述与当前 start.ps1 实现不符，旧 Next Steps 又保留兼容入口，启动排障认知漂移。"}]}]};
+const DATA = {"meta": {"project": "NiuMa Studio", "lang": "zh", "subtitle": "牛马片场 · 本地 AI 高光生产后台工程体检", "generatedAt": "2026-08-24", "htmlPath": ".codemap/codemap.html", "mdPath": ".codemap/codemap.md", "spineDesc": "用户通过页面/API 创建素材任务，SQLite Job 驱动转写、AI 选片、审核切片和字幕，再由发送中心排期并交给 Windows Chrome Worker，所有状态与审计证据回写 SQLite。", "tracked_loc": 51786, "tracked_files": 132, "rev": "a01f103c43916d25310254f6f8389e9fc9e52521"}, "bands": [{"id": "presentation", "tier": "fe", "t": "界面 · API", "d": "浏览器页面、前端交互、FastAPI 路由与运行配置"}, {"id": "wire1", "wire": true, "t": "HTTP / JSON / 文件上传"}, {"id": "workflow", "tier": "be", "t": "业务编排", "d": "任务、流水线、发送中心和状态机"}, {"id": "processing", "tier": "be", "t": "媒体与 AI 处理", "d": "转写、AI 选片、切片和字幕"}, {"id": "execution", "tier": "be", "t": "外部执行边界", "d": "调度、Publisher 与 Windows Chrome Worker"}, {"id": "persistence", "tier": "be", "t": "持久化与运维", "d": "SQLite Schema/迁移/备份与本地交付脚本"}], "spine": ["frontend_ui", "api_runtime", "pipeline_queue", "transcription", "ai_selection", "task_review_cut", "subtitle", "publish_center", "publish_scheduler", "publisher_worker", "persistence"], "reportThemes": [["本地单体架构是当前可运行的主要原因", "FastAPI + SQLite WAL + 文件产物 + 持久化 Job + Windows Worker 与个人本机规模匹配；不需要微服务化，现有恢复骨架应保留。"], ["P0 数据一致性边界已封口，事务型旧债仍需继续", "活动库外键、测试误删、媒体删除回滚和切片批次原子提交已修复；迁移无账本与索引重建失败静默降级仍是下一阶段重点。"], ["Job、发布执行和任务状态代际已封口，下一风险转向跨进程精确续跑", "Workflow lease token、Publish execution fencing、任务状态转换、取消恢复和切片原子提交已经完成；下一阶段重点是持久化 step checkpoint 与副作用复用。"], ["可用性 fallback 正在掩盖降级结果", "AI 部分窗口、转写旧产物、损坏 JSON、封面生成、批量发布和风险字段多处静默继续，用户不一定能区分完整成功、部分成功和旧结果。"], ["发布与配置读取是主要安全边界", "Publish Center、AI Config 与 Frontend 仍存在原始 Secret 响应、可选写鉴权和 DOM XSS；Worker 路径与 journal 脱敏已收紧，但本地管理员接口门禁尚未完成。"], ["复杂度集中而非全项目平均恶化", "publish_service.py、publish-center.js、app.js、publish_scheduler.py、subtitle_data_service.py 和 transcript_service.py 是主要 God Component；应按业务边界渐进拆分。"], ["测试已与活动数据隔离，但 Coverage 与真实故障闭环仍不足", "637 项测试全部通过，Pytest 已强制使用进程级 sandbox；Coverage 尚未采集，真实平台 E2E 和故障注入仍需在不触发生产副作用的边界下补齐。"]], "standard": {"rubric": [{"grade": "A", "score": 95, "range": "90–100", "en": "clean, well-scoped, idiomatic", "zh": "干净、职责单一、地道"}, {"grade": "B", "score": 82, "range": "75–89", "en": "minor issues: a documented shim, mild bloat", "zh": "小问题：有文档的兼容、轻微臃肿"}, {"grade": "C", "score": 67, "range": "60–74", "en": "notable hacks / fallbacks / bloat / duplication", "zh": "明显的 hack / 回退 / 臃肿 / 重复"}, {"grade": "D", "score": 50, "range": "40–59", "en": "significant legacy / stubs / duplication, or a protocol violation", "zh": "严重的遗留 / 占位 / 重复，或协议违规"}, {"grade": "F", "score": 25, "range": "0–39", "en": "broken, fake output, or unfinished-but-wired", "zh": "损坏、伪造输出，或未完成却已接线"}], "severities": [{"key": "HIGH", "en": "wrong / dangerous / fake, a protocol or security issue, or a genuine maintenance hazard", "zh": "错误 / 危险 / 伪造、协议或安全问题，或真正的维护地雷"}, {"key": "MED", "en": "a real smell a maintainer should fix", "zh": "维护者该修的真坏味"}, {"key": "LOW", "en": "a documented shim, a cosmetic cast, benign bloat — worth noting, not urgent", "zh": "有文档的兼容、装饰性 cast、良性臃肿 —— 值得记、不紧急"}], "coupling": [{"key": "core", "en": "system spine — central to almost everything", "zh": "系统主线 —— 几乎牵连一切"}, {"key": "high", "en": "many connections", "zh": "连接很多"}, {"key": "med", "en": "moderate", "zh": "中等"}, {"key": "low", "en": "leaf / self-contained", "zh": "叶子 / 自洽"}], "tags": [{"id": "monkeypatch", "label": "monkeypatch", "labelZh": "猴补丁", "bad": true, "en": "runtime mutation of another module / stdlib / vendor; reflection or prototype patching", "zh": "运行时改写别的模块/标准库/依赖；反射或原型补丁"}, {"id": "fallback", "label": "fallback", "labelZh": "回退兜底", "bad": true, "en": "'try the real thing, then fake/degrade'; a||b||c chains that hide which value is real", "zh": "“先试真的再退化/造假”；a||b||c 掩盖哪个是真值"}, {"id": "silent-except", "label": "silent-except", "labelZh": "静默吞错", "bad": true, "en": "swallowed errors: empty catch / except:pass / ignored return codes", "zh": "吞掉错误：空 catch / except:pass / 忽略返回码"}, {"id": "legacy", "label": "legacy", "labelZh": "遗留", "bad": true, "en": "deprecated/back-compat shims, dead-but-shipped code, parallel old+new paths", "zh": "遗留/兼容垫片、已发布的死代码、新旧并存"}, {"id": "dual-format", "label": "dual-format", "labelZh": "双格式", "bad": true, "en": "accepting two shapes for one field (snake||camel), patched through the code", "zh": "同一字段接受两种形态（snake||camel）并散落各处"}, {"id": "stub", "label": "stub", "labelZh": "占位桩", "bad": true, "en": "NotImplemented / TODO / dead buttons / demo scripts presented as real", "zh": "未实现/TODO/死按钮/演示脚本当成品"}, {"id": "fake-output", "label": "fake-output", "labelZh": "伪造输出", "bad": true, "en": "returns random/canned/hardcoded results where real work is implied", "zh": "本应真算的地方返回随机/写死结果"}, {"id": "duplication", "label": "duplication", "labelZh": "重复", "bad": true, "en": "copy-pasted logic, or an existing shared abstraction not reused", "zh": "复制粘贴，或已有共享抽象却不复用"}, {"id": "bloat", "label": "bloat", "labelZh": "臃肿", "bad": true, "en": "oversized file / function; too many responsibilities in one unit", "zh": "超大文件/函数；单元职责过多"}, {"id": "glue", "label": "glue", "labelZh": "胶水", "bad": true, "en": "valueless pass-through: rows of thin forwarders / no-op adapters", "zh": "无价值透传：成片薄包装 / 零转换适配器"}, {"id": "any-escape", "label": "any-escape", "labelZh": "类型逃逸", "bad": true, "en": "bypassing the type system: as any / @ts-ignore / dynamic / void* / reinterpret_cast / unsafe", "zh": "绕过类型系统：as any / @ts-ignore / dynamic / void* / reinterpret_cast / unsafe"}, {"id": "over-fit", "label": "over-fit", "labelZh": "过度特化", "bad": true, "en": "hardcoded to one case where a small generalization was expected", "zh": "硬编码单一情况，本应小幅泛化"}, {"id": "god-component", "label": "god-component", "labelZh": "上帝组件", "bad": true, "en": "one component/class/file doing far too much", "zh": "一个组件/类/文件做太多事"}, {"id": "placeholder", "label": "placeholder", "labelZh": "占位", "bad": true, "en": "unfinished UI / data presented as if complete", "zh": "未完成的 UI/数据当作已完成"}, {"id": "clean", "label": "clean", "labelZh": "干净", "bad": false, "en": "no material issues — well-scoped", "zh": "无实质问题 —— 职责单一"}]}, "modules": [{"id": "frontend_ui", "label": "Frontend UI", "band": "presentation", "path": "app/templates + app/static", "desc": "用 Jinja2、原生 JavaScript 和 CSS 提供任务、审核、字幕与发送中心界面。", "coupling": "high", "deps": ["api_runtime"], "loc": 13840, "score": 65, "grade": "C", "tags": ["god-component", "bloat", "glue", "duplication", "legacy"], "findings": [{"sev": "HIGH", "loc": "app/static/js/app.js:211", "text": "多个写请求绕过统一 apiFetch；启用 LOCAL_ADMIN_TOKEN 时可能缺失 Authorization 并被 API 拒绝。"}, {"sev": "HIGH", "loc": "app/static/js/app.js:1729", "text": "接口或任务数据直接拼接到 innerHTML；publish-center.js:2152 有同类路径，存在本地 DOM XSS/页面结构破坏风险。"}, {"sev": "MED", "loc": "app/templates/system_status.html:98", "text": "配置/API Key 字段进入 DOM，base.html:11 还承载本地管理 Token；需确认全链路始终掩码。"}, {"sev": "MED", "loc": "app/static/css/styles.css:870", "text": "使用多个未在 :root 定义的 CSS 自定义属性，相关声明可能失效。"}, {"sev": "MED", "loc": "app/static/js/app.js:1", "text": "任务、转写、AI、审核、切片、字幕和配置行为集中在超大全局脚本，回归半径较大。"}, {"sev": "MED", "loc": "tests/test_publish_center_browser.py:16", "text": "Playwright 缺失时核心浏览器测试可静默跳过，字幕交互与鉴权失败路径覆盖不足。"}, {"sev": "LOW", "loc": "app/static/js/subtitle-editor.js:171", "text": "字幕编辑器已有 escapeHtml、虚拟列表、竞态 token 与自动保存版本控制，是可保留的正向实现。"}, {"sev": "LOW", "loc": "app/static/js/publish-center.js:4", "text": "前端明确只创建抖音任务，B站保留后端兼容；这是当前产品边界而非应机械删除的代码。"}]}, {"id": "api_runtime", "label": "API & Runtime", "band": "presentation", "path": "app/main.py + core/models/routers", "desc": "加载配置、初始化应用与安全中间件，并把页面/API 请求路由到业务服务。", "coupling": "core", "deps": ["media_storage", "transcription", "ai_selection", "task_review_cut", "subtitle", "pipeline_queue", "publish_center", "publish_scheduler", "persistence"], "loc": 2753, "score": 48, "grade": "D", "tags": ["fallback", "legacy", "dual-format", "bloat", "glue"], "findings": [{"sev": "HIGH", "loc": "app/routers/settings.py:10", "text": "GET /api/settings/ai 未做鉴权，返回 ai_config_service.get_ai_config_context() 中的原始 values；该上下文会从 .env/环境变量读取 API key、token 等 Secret，并同时返回 env_path。前端或本地恶意页面可直接读取凭据。"}, {"sev": "HIGH", "loc": "app/main.py:98", "text": "本地管理鉴权是可选的：只有 LOCAL_ADMIN_TOKEN 非空时才校验写请求；配置默认值为空，因此未配置 Token 时所有 POST/PUT/PATCH/DELETE API 均可被无认证调用。"}, {"sev": "HIGH", "loc": "app/routers/files.py:9", "text": "未鉴权的 /api/files/browse 调用 browse_video_directory，虽限制了根目录和路径穿越，但仍枚举 configured allowed roots 下的目录名、文件名、绝对路径、父路径和文件大小，造成本地媒体元数据泄露。"}, {"sev": "HIGH", "loc": "app/routers/tasks.py:223", "text": "async 路由直接执行同步重任务：音频处理、转写、切片和任务详情 ffprobe 可阻塞 FastAPI event loop，影响无关请求。"}, {"sev": "MED", "loc": "app/routers/tasks.py:35", "text": "大量 async 路由直接调用同步数据库、文件和服务函数；仅少数入口使用 run_in_threadpool，异步边界不一致，容易出现请求串行化和响应抖动。"}, {"sev": "MED", "loc": "app/models/task.py:7-41", "text": "TaskStatus 同时保留大写自动流水线状态和小写 legacy 状态；任意状态跳跃虽已修复，但模型、旧页面和 API 客户端仍需兼容两套值。"}, {"sev": "MED", "loc": "app/routers/tasks.py:35; app/routers/publish.py:1", "text": "tasks.py 与 publish.py 聚合大量路由、异常映射、同步/异步调度和业务编排，新增流程的 blast radius 较大。"}]}, {"id": "media_storage", "label": "Media & Storage", "band": "processing", "path": "storage/media/FFmpeg services", "desc": "管理 E 盘任务目录、路径安全、素材预检、FFmpeg/FFprobe 与受控子进程。", "coupling": "high", "deps": ["persistence"], "loc": 1614, "score": 84, "grade": "B", "tags": ["legacy", "dual-format", "glue", "fallback", "silent-except"], "findings": [{"sev": "MED", "loc": "app/services/storage_service.py:840-846", "text": "move_task_directory_to_trash 明确传入 reserve=False，仍采用查询后检查目录的非原子分配；当前无运行时调用，属于遗留兼容入口，但未来恢复调用时仍可能并发复用同一回收站目录。"}, {"sev": "MED", "loc": "app/services/storage_service.py:361-367", "text": "通用 resolve_video_file_path 对已存在路径仍原样返回。媒体 HTTP 路由已增加任务边界，但 publish/auto-publish/subtitle/task 查询等非 HTTP 调用方仍可把数据库中的现有外部路径交给后续读取或上传逻辑。"}, {"sev": "LOW", "loc": "tests/test_storage_boundaries.py:14-32", "text": "新增边界测试没有覆盖任务目录数据库读取在 sqlite3.Error、锁定或损坏数据库下显式失败的回归；代码已有保护但证据不足。"}, {"sev": "LOW", "loc": "app/services/storage_service.py:257-300", "text": "reserve=True 会在数据库任务记录写入前创建目录；进程在预占后崩溃可能留下无数据库记录的空目录，虽不会覆盖数据，但会造成孤儿目录累积。"}]}, {"id": "transcription", "label": "Transcription", "band": "processing", "path": "transcript services", "desc": "提取音频，调用火山引擎或 faster-whisper，并以分块 checkpoint 生成时间戳转写。", "coupling": "high", "deps": ["media_storage", "persistence"], "loc": 1960, "score": 59, "grade": "D", "tags": ["fallback", "silent-except", "fake-output", "duplication", "god-component", "glue", "over-fit"], "findings": [{"sev": "HIGH", "loc": "app/services/transcript_workflow_service.py:317", "text": "transcript Markdown 存在即返回 completed，未校验源指纹、Provider、进度状态或文件完整性。"}, {"sev": "HIGH", "loc": "app/services/transcript_service.py:265", "text": "JobLeaseLostError 已显式透传，但 TranscriptCancelledError 仍会被统一包装为 RuntimeError，取消可能落成 failed。"}, {"sev": "HIGH", "loc": "app/services/transcript_service.py:516", "text": "远程分块请求每次使用随机 request id，缺少持久化幂等键和超时后结果确认，重试可能重复计费。"}, {"sev": "MED", "loc": "app/services/transcript_service.py:516", "text": "HTTP 429、Retry-After、网络瞬断和可恢复服务错误缺少专门退避策略。"}, {"sev": "MED", "loc": "app/services/transcript_service.py:556", "text": "响应 result.message 可能被当作 0-1 秒转写正文写入结果。"}, {"sev": "MED", "loc": "app/services/transcript_service.py:831", "text": "进度文件 IO/JSON 损坏时静默返回空字典，可能隐藏故障并触发重复执行。"}, {"sev": "MED", "loc": "app/services/transcript_workflow_service.py:224", "text": "运行和取消状态仍是进程内 set，多进程/重启时不能可靠去重或取消。"}, {"sev": "MED", "loc": "app/services/transcript_service.py:325", "text": "本地和远程转写复制分块、checkpoint、异常和进度循环，行为容易漂移。"}, {"sev": "MED", "loc": "app/services/transcript_service.py:1088", "text": "Provider/模型/设备为模块级可变全局，并发任务可能互相覆盖运行元数据。"}, {"sev": "MED", "loc": "app/services/transcript_service.py:83", "text": "约 1300 行文件混合 FFmpeg、本地模型、远程 HTTP、checkpoint、进度和 Markdown，职责过大。"}, {"sev": "LOW", "loc": "tests/test_long_live_foundation.py:65", "text": "已覆盖失租 checkpoint 和异常透传，仍缺取消、429/坏响应、重复计费与真实 Markdown 闭环。"}]}, {"id": "ai_selection", "label": "AI Selection", "band": "processing", "path": "AI providers and analyzers", "desc": "选择 Codex/远程/本地 Provider，解析不稳定 AI 输出并生成通用、综艺或长直播候选片段。", "coupling": "core", "deps": ["transcription", "persistence"], "loc": 4420, "score": 63, "grade": "C", "tags": ["fallback", "silent-except", "legacy", "dual-format", "stub", "fake-output", "bloat", "duplication", "god-component"], "findings": [{"sev": "HIGH", "loc": "app/services/ai_config_service.py:318", "text": "get_ai_config_context 返回含 AI/ASR Key 的完整 values，GET /api/settings/ai 无读取鉴权，页面也复用该上下文。"}, {"sev": "MED", "loc": "app/services/ai/ai_clip_service.py:4", "text": "generate_candidate_clips_placeholder 返回三条硬编码 ClipCandidate；虽当前无调用方，误接线会产生 fake output。"}, {"sev": "MED", "loc": "app/services/ai/ai_clip_analyzer.py:131", "text": "分段分析失败窗口被跳过，只要其他窗口有候选便返回；通用路径缺少最低覆盖率门槛。"}, {"sev": "MED", "loc": "app/services/ai/variety_comedy_analyzer.py:513", "text": "全局评审失败时隐式降级到扩展阶段评分，Provider 失败仍可形成候选。"}, {"sev": "MED", "loc": "app/services/ai/local_model_provider.py:19", "text": "fallback_protocol 对任意 AIProviderError 都执行第二协议，未区分限流、认证和协议错误，可能重复调用与计费。"}, {"sev": "MED", "loc": "app/services/ai_analysis_workflow_service.py:738", "text": "候选事务替换、JSON 文件和 run 历史分步持久化，后续失败会形成数据库与文件/历史不一致。"}, {"sev": "MED", "loc": "app/services/ai/long_live_talk_analyzer.py:427", "text": "checkpoint 更新无 run/lease/owner fencing，并发或旧进程恢复可能互相覆盖窗口状态。"}, {"sev": "MED", "loc": "app/services/ai_analysis_workflow_service.py:71", "text": "分析元文件不存在、损坏或读取异常时静默返回空字典，无法区分未分析与产物损坏。"}, {"sev": "LOW", "loc": "app/services/ai/ai_clip_analyzer.py:456", "text": "输出归一化同时接受多组历史字段并填大量默认值，兼容有效但维护成本高。"}, {"sev": "LOW", "loc": "app/services/ai_config_service.py:55", "text": "旧 AI_REMOTE 与新分析/发布配置并存，运行时还改写全局 settings，形成双路径。"}, {"sev": "MED", "loc": "app/services/ai_analysis_workflow_service.py:685", "text": "单文件集中 profile、Provider、状态、候选、文件、历史与恢复，模块回归半径大。"}, {"sev": "MED", "loc": "app/services/ai/ai_clip_analyzer.py:252", "text": "多个分析器重复偏好摘要、时间转换、默认字段和 AI 输出解析逻辑。"}, {"sev": "MED", "loc": "tests/test_split_services.py:200", "text": "缺少真实 Provider 成功路径、文件写入失败一致性、并发运行和旧 checkpoint 覆盖测试。"}, {"sev": "MED", "loc": "tests/test_codex_cli_provider.py:12", "text": "Provider 测试主要 monkeypatch，缺少 HTTP 429/500/超时和协议 fallback 重复调用边界。"}, {"sev": "LOW", "loc": "tests/test_variety_comedy_selection.py:291", "text": "算法分支覆盖较好，但真实三阶段 Provider、资源消耗和全局评审降级未由集成测试锁定。"}]}, {"id": "task_review_cut", "label": "Task Review & Cut", "band": "workflow", "path": "task and cut workflow services", "desc": "维护任务状态与视图，保存候选审核选择，生成切片版本并同步发送中心。", "coupling": "core", "deps": ["media_storage", "ai_selection", "publish_center", "persistence"], "loc": 3036, "score": 78, "grade": "B", "tags": ["god-component", "glue", "fallback", "dual-format", "legacy", "over-fit"], "findings": [{"sev": "HIGH", "loc": "app/services/task_service.py:458-485,594-616", "text": "任务详情默认执行无 timeout 的 ffprobe，且未捕获 OSError/Path.stat 异常；NAS、损坏或卡死媒体可能阻塞详情请求或返回 500。明确延期至 P1.4。"}, {"sev": "MED", "loc": "app/services/task_lifecycle_service.py:373-401; tests/test_task_state_machine.py:69-82", "text": "公共状态转换前置条件只检查数据库字段或路径字符串，不验证源视频、候选产物和活跃 output 文件真实存在。明确延期至 P1.4。"}, {"sev": "MED", "loc": "app/services/task_service.py:1-98,1220-1273; app/services/task_query_service.py:16-24", "text": "TaskService 仍集中承担大量业务、数据库和展示职责，并与 task_query_service 互相导入、保留包装函数，维护 blast radius 较大。建议作为 P2 延后拆分。"}, {"sev": "MED", "loc": "app/services/task_service.py:717-718", "text": "候选片段列表会直接解析每条历史时间字段，单条异常格式仍可能阻断整个审核列表。"}, {"sev": "LOW", "loc": "app/services/task_lifecycle_service.py:139-225", "text": "任务目录预占后若后续数据库写入失败，仍缺少统一释放空目录的补偿路径，可能留下少量孤儿目录。"}]}, {"id": "subtitle", "label": "Subtitle", "band": "processing", "path": "subtitle services", "desc": "维护字幕轨、不可变 revision、cue、AI 建议、渲染验证与自动流水线交付决定。", "coupling": "high", "deps": ["media_storage", "task_review_cut", "ai_selection", "persistence"], "loc": 2409, "score": 70, "grade": "C", "tags": ["fallback", "silent-except", "legacy", "bloat", "god-component", "monkeypatch"], "findings": [{"sev": "MED", "loc": "app/services/subtitle_data_service.py:352", "text": "手工 revision 的 active/base 检查在事务外，并发编辑可覆盖 active 选择。"}, {"sev": "MED", "loc": "app/services/subtitle_data_service.py:489", "text": "批准 revision 在事务外校验，并发或重放旧请求可回退 active 版本。"}, {"sev": "MED", "loc": "app/services/subtitle_data_service.py:135", "text": "source/clip track 先查后插，NULL output_clip_id 约束不足，并发可能重复源轨。"}, {"sev": "MED", "loc": "app/services/subtitle_auto_workflow_service.py:87", "text": "批量批准逐 clip 独立提交，Job 后创建；中途失败会留下部分批准。"}, {"sev": "MED", "loc": "app/services/subtitle_data_service.py:168", "text": "source revision 提交后逐 clip 独立同步，异常会形成混合版本。"}, {"sev": "MED", "loc": "app/services/subtitle_workflow_service.py:475", "text": "字幕 job 完成与激活分两次写入，迟到 worker 仍可能激活旧成片。"}, {"sev": "LOW", "loc": "app/services/subtitle_auto_workflow_service.py:273", "text": "auto_config_json 损坏时静默降为空并写回，可能丢弃其他配置。"}, {"sev": "MED", "loc": "app/services/subtitle_data_service.py:1045", "text": "字幕数据服务聚合 track、revision、cue、导入导出、波形和渲染辅助，回归半径大。"}, {"sev": "LOW", "loc": "app/services/subtitle_workflow_service.py:312", "text": "统一 revision 外仍保留旧调用方适配，存在历史口径漂移成本。"}, {"sev": "MED", "loc": "tests/test_subtitle_editor.py:189", "text": "缺并发 save/approve/ensure track 与批处理中途失败测试。"}, {"sev": "LOW", "loc": "tests/test_subtitle_auto_workflow.py:172", "text": "核心真实渲染在 FFmpeg/FFprobe 缺失时会跳过，异常 Provider 证据不足。"}, {"sev": "LOW", "loc": "app/services/subtitle_data_service.py:761", "text": "波形处理把完整 PCM 捕获到内存，超长媒体存在时长线性内存峰值。"}, {"sev": "LOW", "loc": "app/services/subtitle_data_service.py:1024", "text": "单条字幕文本可接近文件上限，放大渲染、导出和 Prompt 资源消耗。"}]}, {"id": "pipeline_queue", "label": "Pipeline & Job Queue", "band": "workflow", "path": "pipeline and workflow job services", "desc": "用 SQLite Job、Lease、Heartbeat、Checkpoint 和子进程串联长任务与自动流水线。", "coupling": "core", "deps": ["transcription", "ai_selection", "task_review_cut", "subtitle", "publish_center", "persistence"], "loc": 3350, "score": 88, "grade": "B", "tags": ["god-component", "bloat", "legacy", "glue", "over-fit"], "findings": [{"sev": "LOW", "loc": "app/services/pipeline_engine.py:977-1073", "text": "PUBLISH_JOB_CREATING 尚无专用 reconcile 分支，恢复主要依赖重复创建的幂等去重。"}, {"sev": "LOW", "loc": "tests/test_pipeline_checkpoint.py:358-625; tests/test_pipeline_state_stability.py:275-313", "text": "仍缺真实进程重启、lease 过期边界及发布内容证据变更的进程级回归测试。"}]}, {"id": "publish_center", "label": "Publish Center", "band": "workflow", "path": "publish content preparation services", "desc": "准备标题、简介、话题、封面、账号和发布草稿，并保留历史兼容执行入口。", "coupling": "core", "deps": ["task_review_cut", "subtitle", "publish_scheduler", "publisher_worker", "persistence"], "loc": 5593, "score": 52, "grade": "D", "tags": ["god-component", "bloat", "legacy", "dual-format", "fallback", "silent-except", "placeholder", "duplication"], "findings": [{"sev": "HIGH", "loc": "app/services/publish_service.py:570", "text": "_normalize_config/_normalize_account 仅新增 *_masked 字段，却保留 client_secret、access_token、refresh_token 原字段；GET /api/publish/platforms、/accounts 及保存配置/账号响应直接返回这些原始密钥，存在敏感凭据泄漏风险。"}, {"sev": "MED", "loc": "app/services/publish_service.py:266", "text": "publish_service.py 当前约4750行，混合配置/账号/OAuth、文案与封面、队列同步、历史、旧 OpenCLI 脚本、API Provider 和页面上下文，形成高耦合 God Component，任一发布流程改动的 blast radius 很大。"}, {"sev": "MED", "loc": "app/services/publish_service.py:2941", "text": "历史查询 SQL 只按 PUBLISH_HISTORY_STATUSES 的大写值过滤，之后才调用 _normalize_publish_status；LEGACY_STATUS_MAP 支持旧小写状态但旧记录会在 SQL 层被提前排除，历史页可能漏数据。"}, {"sev": "MED", "loc": "app/services/publish_service.py:2144", "text": "sync_task_publish_jobs 封面生成失败时只把 {'cover_error': ...} 放入 item_covers，仍继续插入 WAITING 任务且不计入 errors；同步可能返回 ok，但生成的任务实际无法通过 local_browser readiness。"}, {"sev": "MED", "loc": "app/services/publish_service.py:2787", "text": "create_batch_publish_jobs 对不存在的 output_clip_id 直接 continue，全部无效或部分无效时仍返回 status='ok'，调用方无法区分‘创建成功’与‘输入被静默丢弃’。"}, {"sev": "MED", "loc": "app/services/publish_readiness.py:167", "text": "publish_domain/create_publish_job 仍允许 api_publish，publishers registry 也保留兼容入口，但统一 readiness 只接受 local_browser/manual_export 并将 api_publish 标记 unsupported_publish_mode，持久化任务与调度契约不一致。"}, {"sev": "MED", "loc": "app/services/publish_providers.py:117", "text": "BilibiliPublishProvider 在完成配置和 token 校验后始终抛出 bilibili_provider_pending；api_publish 模式仍可创建/注册，因此这是已接线但必然失败的 placeholder 路径。"}, {"sev": "MED", "loc": "app/services/publish_providers.py:66", "text": "旧 Douyin API Provider 将 upload 与 create 分成两个无幂等键的请求；_request_json 只包装 HTTPError/URLError，平台已接收后网络超时或连接异常可能被判失败，重试会重复上传/投稿且没有 NEED_REVIEW 不确定态。"}, {"sev": "LOW", "loc": "app/services/publish_providers.py:204", "text": "_post_multipart 先 file_path.read_bytes() 再 b''.join(chunks)，完整视频和完整 multipart body 同时驻留内存，大文件发布存在约双倍峰值。"}, {"sev": "LOW", "loc": "app/services/publish_service.py:1569", "text": "_batch_find_publish_jobs 对每条记录直接调用 _normalize_job(row)，未传入预取 accounts；_normalize_job 会逐条触发 readiness/account 查询，发布中心批量切片时形成 N+1 查询。"}, {"sev": "LOW", "loc": "tests/test_publish_history.py:111", "text": "现有定向测试未覆盖原始 Secret/Token 响应、旧小写历史状态、同步封面 partial、批量无效 ID，以及 API 超时后已接收的重复投稿边界。"}]}, {"id": "publish_scheduler", "label": "Publish Scheduler", "band": "execution", "path": "scheduler/repository/executor", "desc": "计算排期、原子领取发布任务、重试、恢复不确定执行并维护发布状态机。", "coupling": "core", "deps": ["publish_center", "publisher_worker", "persistence"], "loc": 2329, "score": 71, "grade": "C", "tags": ["god-component", "bloat", "legacy", "silent-except"], "findings": [{"sev": "MED", "loc": "app/services/publish_scheduler.py:756-785", "text": "recover_interrupted_jobs 每轮加载全部 PUBLISHING 任务，并对每个任务串行查询 Worker，没有批量上限、并发控制或退避；Worker 不可用或卡住任务较多时，单轮耗时按任务数乘以网络超时增长，会延迟后续排期处理。"}, {"sev": "MED", "loc": "app/services/publish_scheduler.py:281-302", "text": "list_due_jobs 每轮 SELECT 全部 SCHEDULED 记录，再逐条在 Python 中解析时间；虽已有状态/排期索引，但没有 SQL due 条件、分页或批量上限，排期量增长后会增加扫描内存和调度延迟。"}, {"sev": "MED", "loc": "app/services/publish_scheduler.py:133-1788", "text": "PublishScheduler 约 1891 行、42 个方法，同时承担排期计算、任务领取、执行结果写回、Worker 恢复、重试修复、人工复核、批量排期和旧版兼容；职责边界过宽，修改任一状态路径的回归半径较大。"}, {"sev": "LOW", "loc": "app/services/publish_scheduler.py:274-279", "text": "shutdown 已能追踪并等待后台 Task，但没有超时或取消兜底；若当前 run_once 被数据库锁、Worker 串行查询或文件操作长期阻塞，应用优雅停机仍可能无限等待。"}, {"sev": "LOW", "loc": "app/services/publish_scheduler.py:1807-1812", "text": "queue_snapshot 对非法 scheduled_at 捕获 ValueError 后静默 pass；损坏排期会从“今日任务”视图中消失，未产生告警或错误计数，降低数据异常可见性。"}]}, {"id": "publisher_worker", "label": "Publishers & Worker", "band": "execution", "path": "publisher registry and Windows worker", "desc": "通过 Publisher Registry 和 Windows Chrome Worker 执行抖音/B站投稿、导出与兼容模式。", "coupling": "high", "deps": ["media_storage", "persistence"], "loc": 2699, "score": 76, "grade": "B", "tags": ["legacy", "glue", "silent-except", "fallback"], "findings": [{"sev": "MED", "loc": "scripts/publish_host_worker.py:321", "text": "_prior_job_execution_requires_review 扫描旧 execution journal 时，若 journal 缺少 identity 或已损坏，直接 continue；跨 execution 无法确认其 job_id 时不会阻断新 execution。旧 Worker 在上传后崩溃并留下无身份/损坏日志时，仍存在重复投稿边界。"}, {"sev": "LOW", "loc": "app/services/publishers/page_scripts.py:14", "text": "页面脚本入口仍通过延迟导入 publish_service 私有函数来转发大量 DOM 脚本；这是有意保留的兼容层，但形成 legacy glue，脚本变更仍会牵连 4750 行 God Service。"}, {"sev": "LOW", "loc": "app/services/publishers/browser_runtime.py:315", "text": "screenshot 捕获裸 Exception 后返回空字符串，截图失败不会进入发布结果或健康信号；发布可以继续但缺少关键诊断证据。"}, {"sev": "LOW", "loc": "scripts/opencli_host_bridge.py:74", "text": "旧 OpenCLIHostBridgeHandler 的 /run 处理器本身没有 Bearer Token 校验；当前 main 已转调受保护的 publish_host_worker，默认入口不再使用它，但保留的可直接实例化旧处理器仍会造成安全边界误解。"}, {"sev": "LOW", "loc": "tests/test_publish_worker_client.py:155", "text": "当前测试已覆盖双进程锁竞争、死进程锁回收和常规 execution fencing，但仍未覆盖无身份/损坏旧 journal 被跨 execution 扫描跳过、screenshot 失败信号及旧 bridge 处理器被直接启动时的鉴权边界。"}]}, {"id": "persistence", "label": "SQLite Persistence", "band": "persistence", "path": "app/db + backup services", "desc": "创建 SQLite Schema、执行启动时兼容迁移和索引，并提供 WAL 安全备份恢复。", "coupling": "core", "deps": [], "loc": 3436, "score": 64, "grade": "C", "tags": ["silent-except", "legacy", "dual-format", "bloat", "god-component"], "findings": [{"sev": "HIGH", "loc": "app/db/database.py:628-671", "text": "_create_indexes 先删除 uq_publish_jobs_active_clip_platform_mode，随后对所有索引创建统一捕获 sqlite3.Error 并静默忽略；唯一部分索引创建失败时，旧索引已删除且无告警，活动发布任务可能失去唯一约束并产生重复记录。"}, {"sev": "MED", "loc": "app/db/database.py:31-617", "text": "数据库初始化依赖多个结构探针和缺列即 ALTER TABLE，没有 PRAGMA user_version、schema_migrations 或可追踪迁移版本；历史数据库的实际结构只能由当前代码反推。"}, {"sev": "MED", "loc": "app/db/database.py:754,1162", "text": "多个迁移函数使用 executescript，发布表迁移还会在数据规范化前提交新增列；后续失败时可能已持久化部分结构，init_db 不是原子升级。"}, {"sev": "LOW", "loc": "app/db/database.py:656-657", "text": "workflow job claim 索引未覆盖 lease_expires_at；队列规模增大或过期任务集中时可能读取更多候选行，属于性能退化而非当前正确性故障。"}]}, {"id": "ops_delivery", "label": "Ops & Delivery", "band": "persistence", "path": "Docker/PowerShell/CI", "desc": "提供 Windows/Docker 启停、诊断、CI、发布门禁、Demo 与维护脚本。", "coupling": "med", "deps": ["api_runtime", "publisher_worker", "persistence"], "loc": 4347, "score": 68, "grade": "C", "tags": ["fallback", "legacy", "dual-format", "duplication", "bloat", "glue", "silent-except", "monkeypatch"], "findings": [{"sev": "MED", "loc": ".github/workflows/ci.yml:3", "text": "CI 仅监听 master push/PR；feature/docs 直接 push 不即时验证，问题延迟到开 PR。"}, {"sev": "MED", "loc": "scripts/start_docker_opencli.ps1:24", "text": "健康检查异常只警告不返回非零，服务失败也可能被调用方视为启动成功。"}, {"sev": "MED", "loc": "scripts/start.ps1:30", "text": "Demo 覆盖生效前先对正式 E 盘配置运行 doctor，新机/迁移机的隔离 Demo 可能被旧路径阻断。"}, {"sev": "MED", "loc": "scripts/start.ps1:71", "text": "Worker 启动异常被捕获后继续并报告工作台成功，发布能力不可用时易被误判完整健康。"}, {"sev": "HIGH", "loc": "scripts/migrate_task_dirs_to_project_names.py:211", "text": "任务目录迁移用非 WAL-aware 主库 copy，先移动目录再统一更新提交，无文件补偿，异常会让路径/DB 不一致。"}, {"sev": "MED", "loc": "scripts/restore.ps1:27", "text": "恢复只以健康响应判断 App 运行，StopServices 只停 Compose；native/异常健康进程可能仍持有 DB 时执行替换。"}, {"sev": "MED", "loc": "scripts/backup.ps1:33", "text": "备份默认包含 .env 且不加密，仅显式 ExcludeEnv 才排除，包被共享时泄漏本机秘密。"}, {"sev": "MED", "loc": "tests/test_native_scripts.py:11", "text": "启停测试主要是源码字符串断言，Windows smoke 不做实际 restore/冲突/清理失败与恢复后健康验证。"}, {"sev": "MED", "loc": "scripts/seed_demo_data.py:32", "text": "缺 FFmpeg 时仍插入无媒体路径 Demo 数据并成功退出，数量检查通过但媒体 smoke 不可信。"}, {"sev": "LOW", "loc": "scripts/acceptance.ps1:115", "text": "验收递归扫描正式任务目录，媒体量大/锁文件会显著拖慢或阻断 release gate。"}, {"sev": "LOW", "loc": "scripts/backup_restore_runtime.py:142", "text": "import 时 monkeypatch backup core，全局行为依赖导入顺序。"}, {"sev": "LOW", "loc": "docs/PORTABLE_SETUP.md:127", "text": "文档描述与当前 start.ps1 实现不符，旧 Next Steps 又保留兼容入口，启动排障认知漂移。"}]}]};
 const M = DATA.modules || [];
 const BANDS = DATA.bands || [];
 const SPINE = DATA.spine || [];
diff --git a/.codemap/codemap.md b/.codemap/codemap.md
index c7397a2..4fd130d 100644
--- a/.codemap/codemap.md
+++ b/.codemap/codemap.md
@@ -7,14 +7,14 @@
 
 > **Interactive view:** [`.codemap/codemap.html`](codemap.html) — per-module scores, findings, LoC, and the dependency graph. This file is the written report.
 
-**Generated:** 2026-08-24 · **Modules:** 13 · **Size:** 50778 tracked LoC across 132 files
+**Generated:** 2026-08-24 · **Modules:** 13 · **Size:** 51786 tracked LoC across 132 files
 
 ## Health by layer
 
 | Layer | Modules | Avg score |
 |---|--:|--:|
 | 界面 · API | 2 | 56 |
-| 业务编排 | 3 | 67 |
+| 业务编排 | 3 | 73 |
 | 媒体与 AI 处理 | 4 | 69 |
 | 外部执行边界 | 2 | 74 |
 | 持久化与运维 | 2 | 66 |
@@ -35,8 +35,8 @@ _LoC is the representative file/folder per module; folder-level modules overlap
 | Module | LoC | Score | Tags |
 |---|--:|:--|:--|
 | Publish Center | 5,593 | 52 D | god-component, bloat, legacy, dual-format, fallback, silent-except, placeholder, duplication |
+| Pipeline & Job Queue | 3,350 | 88 B | god-component, bloat, legacy, glue, over-fit |
 | Task Review & Cut | 3,036 | 78 B | god-component, glue, fallback, dual-format, legacy, over-fit |
-| Pipeline & Job Queue | 2,342 | 72 C | fallback, silent-except, legacy, stub, god-component, glue, over-fit |
 
 ### 媒体与 AI 处理
 
@@ -72,7 +72,7 @@ _LoC is the representative file/folder per module; folder-level modules overlap
 - **Ops & Delivery (68/C)** — scripts/migrate_task_dirs_to_project_names.py:211: 任务目录迁移用非 WAL-aware 主库 copy，先移动目录再统一更新提交，无文件补偿，异常会让路径/DB 不一致。
 - **Subtitle (70/C)** — app/services/subtitle_data_service.py:352: 手工 revision 的 active/base 检查在事务外，并发编辑可覆盖 active 选择。
 - **Publish Scheduler (71/C)** — app/services/publish_scheduler.py:756-785: recover_interrupted_jobs 每轮加载全部 PUBLISHING 任务，并对每个任务串行查询 Worker，没有批量上限、并发控制或退避；Worker 不可用或卡住任务较多时，单轮耗时按任务数乘以网络超时增长，会延迟后续排期处理。
-- **Pipeline & Job Queue (72/C)** — app/services/pipeline_engine.py:108,311-314; app/services/job_service.py:488-504: 自动流水线仅在内存 context 中保存步骤结果，虽有 update_job_checkpoint API，但 PipelineEngine 未持久化调用；重启后可能从 PREPARING_SOURCE 重新执行并重复 AI、封面和排期副作用。
+- **Publishers & Worker (76/B)** — scripts/publish_host_worker.py:321: _prior_job_execution_requires_review 扫描旧 execution journal 时，若 journal 缺少 identity 或已损坏，直接 continue；跨 execution 无法确认其 job_id 时不会阻断新 execution。旧 Worker 在上传后崩溃并留下无身份/损坏日志时，仍存在重复投稿边界。
 
 ## All findings
 
@@ -93,7 +93,7 @@ _LoC is the representative file/folder per module; folder-level modules overlap
 - **SQLite Persistence** · `app/db/database.py:628-671` — _create_indexes 先删除 uq_publish_jobs_active_clip_platform_mode，随后对所有索引创建统一捕获 sqlite3.Error 并静默忽略；唯一部分索引创建失败时，旧索引已删除且无告警，活动发布任务可能失去唯一约束并产生重复记录。
 - **Ops & Delivery** · `scripts/migrate_task_dirs_to_project_names.py:211` — 任务目录迁移用非 WAL-aware 主库 copy，先移动目录再统一更新提交，无文件补偿，异常会让路径/DB 不一致。
 
-### MED (63)
+### MED (59)
 
 - **Frontend UI** · `app/templates/system_status.html:98` — 配置/API Key 字段进入 DOM，base.html:11 还承载本地管理 Token；需确认全链路始终掩码。
 - **Frontend UI** · `app/static/css/styles.css:870` — 使用多个未在 :root 定义的 CSS 自定义属性，相关声明可能失效。
@@ -133,10 +133,6 @@ _LoC is the representative file/folder per module; folder-level modules overlap
 - **Subtitle** · `app/services/subtitle_workflow_service.py:475` — 字幕 job 完成与激活分两次写入，迟到 worker 仍可能激活旧成片。
 - **Subtitle** · `app/services/subtitle_data_service.py:1045` — 字幕数据服务聚合 track、revision、cue、导入导出、波形和渲染辅助，回归半径大。
 - **Subtitle** · `tests/test_subtitle_editor.py:189` — 缺并发 save/approve/ensure track 与批处理中途失败测试。
-- **Pipeline & Job Queue** · `app/services/pipeline_engine.py:108,311-314; app/services/job_service.py:488-504` — 自动流水线仅在内存 context 中保存步骤结果，虽有 update_job_checkpoint API，但 PipelineEngine 未持久化调用；重启后可能从 PREPARING_SOURCE 重新执行并重复 AI、封面和排期副作用。
-- **Pipeline & Job Queue** · `app/services/job_worker.py:198-202` — WorkflowJobRunner 将子进程 stdout/stderr 重定向到 DEVNULL，父进程通常只能记录退出码，重启恢复和人工诊断证据不足。
-- **Pipeline & Job Queue** · `app/services/job_service.py:127-139` — payload/result/checkpoint JSON 损坏时静默保留原字符串，执行器后续可能产生不明确的数据类型错误。
-- **Pipeline & Job Queue** · `app/services/job_service.py:19-23; app/services/job_worker.py:60-69` — ai_analysis 与 publish job 类型仍可创建，但 Worker 没有对应执行分支，最终统一失败，属于可创建但不可执行的 legacy/stub 入口。
 - **Publish Center** · `app/services/publish_service.py:266` — publish_service.py 当前约4750行，混合配置/账号/OAuth、文案与封面、队列同步、历史、旧 OpenCLI 脚本、API Provider 和页面上下文，形成高耦合 God Component，任一发布流程改动的 blast radius 很大。
 - **Publish Center** · `app/services/publish_service.py:2941` — 历史查询 SQL 只按 PUBLISH_HISTORY_STATUSES 的大写值过滤，之后才调用 _normalize_publish_status；LEGACY_STATUS_MAP 支持旧小写状态但旧记录会在 SQL 层被提前排除，历史页可能漏数据。
 - **Publish Center** · `app/services/publish_service.py:2144` — sync_task_publish_jobs 封面生成失败时只把 {'cover_error': ...} 放入 item_covers，仍继续插入 WAITING 任务且不计入 errors；同步可能返回 ok，但生成的任务实际无法通过 local_browser readiness。
@@ -175,8 +171,8 @@ _LoC is the representative file/folder per module; folder-level modules overlap
 - **Subtitle** · `tests/test_subtitle_auto_workflow.py:172` — 核心真实渲染在 FFmpeg/FFprobe 缺失时会跳过，异常 Provider 证据不足。
 - **Subtitle** · `app/services/subtitle_data_service.py:761` — 波形处理把完整 PCM 捕获到内存，超长媒体存在时长线性内存峰值。
 - **Subtitle** · `app/services/subtitle_data_service.py:1024` — 单条字幕文本可接近文件上限，放大渲染、导出和 Prompt 资源消耗。
-- **Pipeline & Job Queue** · `app/services/pipeline_engine.py:693-720` — 产物 JSON 或排期时间配置损坏时静默回退默认值，故障可见性不足。
-- **Pipeline & Job Queue** · `app/services/job_worker.py:310-353` — 父 Worker 在 lease 已过期但尚未被其他执行接管时仍可能写入 Job 终态；token 接管后会被拒绝，当前属于较低概率恢复边界。
+- **Pipeline & Job Queue** · `app/services/pipeline_engine.py:977-1073` — PUBLISH_JOB_CREATING 尚无专用 reconcile 分支，恢复主要依赖重复创建的幂等去重。
+- **Pipeline & Job Queue** · `tests/test_pipeline_checkpoint.py:358-625; tests/test_pipeline_state_stability.py:275-313` — 仍缺真实进程重启、lease 过期边界及发布内容证据变更的进程级回归测试。
 - **Publish Center** · `app/services/publish_providers.py:204` — _post_multipart 先 file_path.read_bytes() 再 b''.join(chunks)，完整视频和完整 multipart body 同时驻留内存，大文件发布存在约双倍峰值。
 - **Publish Center** · `app/services/publish_service.py:1569` — _batch_find_publish_jobs 对每条记录直接调用 _normalize_job(row)，未传入预取 accounts；_normalize_job 会逐条触发 readiness/account 查询，发布中心批量切片时形成 N+1 查询。
 - **Publish Center** · `tests/test_publish_history.py:111` — 现有定向测试未覆盖原始 Secret/Token 响应、旧小写历史状态、同步封面 partial、批量无效 ID，以及 API 超时后已接收的重复投稿边界。
diff --git a/.codemap/modules.json b/.codemap/modules.json
index 8fdd5cc..36c1902 100644
--- a/.codemap/modules.json
+++ b/.codemap/modules.json
@@ -7,7 +7,7 @@
   "htmlPath": ".codemap/codemap.html",
   "mdPath": ".codemap/codemap.md",
   "spineDesc": "用户通过页面/API 创建素材任务，SQLite Job 驱动转写、AI 选片、审核切片和字幕，再由发送中心排期并交给 Windows Chrome Worker，所有状态与审计证据回写 SQLite。",
-  "tracked_loc": 50778,
+  "tracked_loc": 51786,
   "tracked_files": 132,
   "rev": "a01f103c43916d25310254f6f8389e9fc9e52521"
  },
@@ -740,52 +740,30 @@
     "tests/test_job_queue.py",
     "tests/test_subtitle_auto_workflow.py"
    ],
-   "loc": 2342,
-   "contentHash": "6c81ef8f8e0fb45e635df5c6facba8ed4366581b7aca28e6c1ab9fd1b070a8dc",
-   "score": 72,
-   "grade": "C",
+   "loc": 3350,
+   "contentHash": "79bcc0b7de14b28318a7578e71d5281909254180ff351895b72fb10cefb87c68",
+   "score": 88,
+   "grade": "B",
    "tags": [
-    "fallback",
-    "silent-except",
-    "legacy",
-    "stub",
     "god-component",
+    "bloat",
+    "legacy",
     "glue",
     "over-fit"
    ],
    "findings": [
-    {
-     "sev": "MED",
-     "loc": "app/services/pipeline_engine.py:108,311-314; app/services/job_service.py:488-504",
-     "text": "自动流水线仅在内存 context 中保存步骤结果，虽有 update_job_checkpoint API，但 PipelineEngine 未持久化调用；重启后可能从 PREPARING_SOURCE 重新执行并重复 AI、封面和排期副作用。"
-    },
-    {
-     "sev": "MED",
-     "loc": "app/services/job_worker.py:198-202",
-     "text": "WorkflowJobRunner 将子进程 stdout/stderr 重定向到 DEVNULL，父进程通常只能记录退出码，重启恢复和人工诊断证据不足。"
-    },
-    {
-     "sev": "MED",
-     "loc": "app/services/job_service.py:127-139",
-     "text": "payload/result/checkpoint JSON 损坏时静默保留原字符串，执行器后续可能产生不明确的数据类型错误。"
-    },
-    {
-     "sev": "MED",
-     "loc": "app/services/job_service.py:19-23; app/services/job_worker.py:60-69",
-     "text": "ai_analysis 与 publish job 类型仍可创建，但 Worker 没有对应执行分支，最终统一失败，属于可创建但不可执行的 legacy/stub 入口。"
-    },
     {
      "sev": "LOW",
-     "loc": "app/services/pipeline_engine.py:693-720",
-     "text": "产物 JSON 或排期时间配置损坏时静默回退默认值，故障可见性不足。"
+     "loc": "app/services/pipeline_engine.py:977-1073",
+     "text": "PUBLISH_JOB_CREATING 尚无专用 reconcile 分支，恢复主要依赖重复创建的幂等去重。"
     },
     {
      "sev": "LOW",
-     "loc": "app/services/job_worker.py:310-353",
-     "text": "父 Worker 在 lease 已过期但尚未被其他执行接管时仍可能写入 Job 终态；token 接管后会被拒绝，当前属于较低概率恢复边界。"
+     "loc": "tests/test_pipeline_checkpoint.py:358-625; tests/test_pipeline_state_stability.py:275-313",
+     "text": "仍缺真实进程重启、lease 过期边界及发布内容证据变更的进程级回归测试。"
     }
    ],
-   "auditedHash": "6c81ef8f8e0fb45e635df5c6facba8ed4366581b7aca28e6c1ab9fd1b070a8dc",
+   "auditedHash": "79bcc0b7de14b28318a7578e71d5281909254180ff351895b72fb10cefb87c68",
    "auditedAt": "2026-08-24",
    "auditedRev": ""
   },
@@ -1189,4 +1167,4 @@
    "auditedRev": "38fd60386a609b6ea85a3eb511b83cb296f4d2a1"
   }
  ]
-}
+}
\ No newline at end of file
diff --git a/DEVELOPMENT_LOG.md b/DEVELOPMENT_LOG.md
index 77a8d9b..db15f37 100644
--- a/DEVELOPMENT_LOG.md
+++ b/DEVELOPMENT_LOG.md
@@ -1,5 +1,19 @@
 # Development Log
 
+## 2026-08-24 稳定 V1 P1.3b 自动流水线断点恢复
+
+- 新增 `auto_pipeline_step_v1` 版本化 checkpoint；每一步记录 `running/succeeded/failed`、连续完成前缀、输入基线和紧凑产物证据，不保存 Secret、Prompt、完整 AI payload 或大对象。
+- checkpoint 写入继续使用 Workflow Job owner + lease token fencing；传入 `job_id` 却没有当前有效 lease 时，在状态更新、handler 和文件副作用之前直接拒绝执行。
+- Worker 重启/租约接管后会验证转写 Markdown、AI active run 与候选集合、选片 JSON、active cut run、字幕审核状态、文案/排期 JSON 和发布草稿，再从第一个未确认步骤继续。
+- AI、转写、切片、准备素材、字幕、文案和排期的 running 步骤支持产物 reconciliation；证据完整时补记成功，输入变化或证据不足时重做，不把旧产物当作新结果。
+- 切片恢复绑定 `cut_run_id`、启用候选、当前任务受控目录、非空文件、size 与首尾 fingerprint；空文件、错 run、路径越界或内容变化均 fail closed。
+- AI 恢复同时核对分析文件、数据库 `analysis_payload_json`、active run 和候选 `clip_key`；转写或候选输入变化时拒绝复用，避免恢复过期结果。
+- 发布草稿恢复绑定 schedule 的切片/平台、草稿字段、允许状态、视频路径/指纹和封面 hash；旧 Worker 取消本轮草稿时还必须满足当前 Job owner/token 的同事务 `EXISTS` 条件。
+- `/auto-retry` 现在在 `BEGIN IMMEDIATE` 中原位重排最新失败/取消 Job，保留其 checkpoint；不会另建空 Job 后重复调用 AI、FFmpeg 或发布草稿。直接 Job retry 仍保持同一语义。
+- 自动流水线 checkpoint 与字幕渲染 Job 的旧 `{completed: ...}` checkpoint 按 Job 类型隔离；没有修改数据库 Schema、活动库、AI/FFmpeg 参数或真实发布逻辑。
+- 定向回归覆盖崩溃后重领、失败 Job 原位重试、旧 token、无 lease、输入变化、损坏/未知 checkpoint、空切片/错 run、发布草稿篡改、取消竞态和测试清理隔离；最终完整测试 `651 passed`，Ruff 与 Python Compileall 全部通过。Codemap 独立复评将 `Pipeline & Job Queue` 从 `72/C` 提升到 `88/B`，剩余低风险项是发布创建步骤依赖幂等去重而非专用 reconcile，以及尚无真实进程重启级测试。
+- 诚实边界：Provider 返回前进程崩溃且没有落下可验证 run/文件时仍可能再次计费；SQLite 与外部 AI/FFmpeg 无法构成严格 exactly-once，后续 P1.4 继续处理超时与调用幂等。
+
 ## 2026-08-24 稳定 V1 P1.3a 任务状态与切片原子性
 
 - `PATCH /api/tasks/{task_id}/status` 改为显式允许表 + `BEGIN IMMEDIATE` 条件更新；空任务不能直接标记完成，并发状态变化不会被旧请求覆盖。所有内部状态写入同时拒绝已永久删除任务。
diff --git a/NEXT_STEPS.md b/NEXT_STEPS.md
index b5a7174..e849d5e 100644
--- a/NEXT_STEPS.md
+++ b/NEXT_STEPS.md
@@ -10,8 +10,9 @@
 - [x] P1.2a：Workflow Job 增加每次 claim 唯一的 `lease_token`，旧 Worker 的心跳、进度、checkpoint、终态和 release 均不能覆盖新执行。
 - [x] P1.2b：Publish Job 使用现有 `execution_id` 完成所有写回 fencing，并让 Windows Publish Worker 对重复 execution 幂等；跨进程锁、恢复 fail-closed 和 Scheduler 优雅停机已覆盖。
 - [x] P1.3a：任务状态接口受控转换；Task/Job lease 代际一致；自动流水线取消恢复、READY 终态和关联发布清理明确；切片批次编号、输出目录、Task 终态和数据库激活原子化。
-- [ ] P1.3b：为自动流水线增加按步骤持久化 checkpoint 和副作用复用，补齐进程重启后的精确续跑；再处理字幕批准批次原子性与中断目录清理。
+- [x] P1.3b：自动流水线已增加版本化步骤 checkpoint、输入/产物证据、旧 Job 原位重试和重领恢复；已覆盖 AI、转写、切片、文案、排期与发布草稿的失效边界。
 - [ ] P1.3c：修复数据库唯一索引重建失败被静默吞掉的问题，并为幂等迁移增加可追踪版本与失败证据；不在本轮直接迁移活动库。
+- [ ] P1.3d：处理字幕批准批次原子性、字幕/切片中断目录清理和剩余跨进程恢复边界。
 - [ ] P1.4：统一第三方 AI/FFmpeg 超时、错误 JSON、429/5xx 与重试幂等边界，并避免重复计费。
 - [ ] P1.5：在不扩大个人本地项目范围的前提下处理密钥日志、输入校验和本地管理员接口门禁。
 - [ ] P2：拆分 God Service、去除查询重复、补核心集成/故障测试和可观测性；不做全面重构。
@@ -22,8 +23,8 @@
 2. 不需要点击“立即发送”；本轮没有执行真实投稿，也没有改变 28 条 `NEED_REVIEW` 的人工确认边界。
 3. 若未来永久删除返回 `cleanup_pending`，不要手工移动隔离目录；保留返回信息和 manifest，使用后续安全清理入口重试。
 4. 修复前数据库备份位于 `data/backups/workflow-before-foreign-key-repair-20260824-130321-535723-35a0f972.sqlite3`，只有活动库无法通过完整性检查时才考虑恢复，不要直接覆盖当前数据库。
-5. P1B.1/P1B.2 与 P1.3a 代码、隔离测试均已完成；活动库尚未增加 `workflow_jobs.lease_token`，本轮也未重启正式服务。下一独立轮先确认没有活动 Workflow Job，再做在线备份、幂等迁移和正式重启烟测。
-6. P1.3a 不需要手工修改数据库。合并后可用一条低风险测试任务验证：取消后显示“已取消”；正常完成后停在“待人工确认发布”；不要点击真实发布。
+5. P1B.1/P1B.2、P1.3a 与 P1.3b 代码及隔离测试均已完成；活动库尚未增加 `workflow_jobs.lease_token`，本轮也未重启正式服务。下一独立轮先确认没有活动 Workflow Job，再做在线备份、幂等迁移和正式重启烟测。
+6. P1.3b 不增加数据库列。合并并完成正式迁移/重启后，可用一条低风险测试任务在 AI 或切片完成后重启 Worker，确认同一 Job 从 checkpoint 续跑；不要点击真实发布，也不要用重要待发布素材做故障演练。
 
 ## 2026-08-24 工程体检确认的原始整改顺序
 
diff --git a/PROJECT_AUDIT.md b/PROJECT_AUDIT.md
index 7aad9b8..d4a3210 100644
--- a/PROJECT_AUDIT.md
+++ b/PROJECT_AUDIT.md
@@ -80,6 +80,22 @@ Codemap 独立复评结果：`Publish Scheduler 62→71（C）`、`Publishers &
 
 本轮没有增加或迁移数据库列，也没有触碰活动数据、真实 AI 或真实投稿。Codemap 增量复评为 `Task Review & Cut 78/B`、`Pipeline & Job Queue 72/C`、`API & Runtime 48/D`、`SQLite Persistence 64/C`。后两项分数下降不是本轮状态修复回归，而是独立复评把原始 Secret 读取、可选鉴权、同步重任务阻塞 async 路由、唯一索引重建失败静默吞掉和无版本迁移重新按实际风险计分。P1.3a 解决的是“状态与切片提交能否可信”这一层；自动流水线的跨进程 step checkpoint、数据库迁移 fail-open、FFprobe/第三方错误边界和 Secret/本地管理员门禁仍按后续独立轮次处理。因此项目继续维持“可用 V1”，不能在剩余 P1 门禁完成前提前宣称“稳定 V1”。
 
+## 0.5 P1.3b 自动流水线断点恢复状态（2026-08-24）
+
+| P1.3b 项目 | 结果 | 验证证据 |
+| --- | --- | --- |
+| 步骤持久化 | 已封口 | `auto_pipeline_step_v1` 保存连续步骤状态、输入基线和紧凑证据；未知版本、损坏 JSON、越序记录或输入配置变化均 fail closed。 |
+| 重启与重领 | 已封口 | 已完成步骤逐项复核；running 的转写、AI、选片、切片、字幕、文案和排期可从持久化产物 reconcile，证据不足才重做。 |
+| 失败后重试 | 已封口 | 自动重试在写锁中原位重排旧 Workflow Job 并保留 checkpoint；新 token 接管后可复用已验证副作用，不再创建丢失上下文的新 Job。 |
+| AI/切片证据 | 已封口 | AI 同时核对 transcript、分析文件、run payload 和候选集合；切片绑定 active run、候选、受控目录、非空文件、size 与 fingerprint。 |
+| 文案/排期/草稿 | 已封口 | 下游从 JSON 恢复内存 context；发布草稿绑定 schedule、草稿字段、允许状态、视频指纹和封面 hash，篡改或文件变化会停止恢复。 |
+| Lease 与取消 | 已封口 | `job_id` 无有效 lease 时不执行；旧 Worker 不能写 checkpoint，也不能在新 Worker 接管后取消本轮发布草稿。 |
+| 人工门禁 | 保持 | 字幕完成后仍稳定停在 `PENDING_SUBTITLE_REVIEW`；最终任务仍停在 `READY_TO_PUBLISH`，不会自动真实投稿。 |
+
+完整隔离回归为 `651 passed`，Ruff 与 Python Compileall 全部通过。Codemap 独立复评将 `Pipeline & Job Queue` 从 **72/C 提升到 88/B**；未再发现本轮新增 HIGH，保留的 LOW 是发布创建步骤主要依赖数据库幂等去重而非专用 reconcile，以及尚未进行真实进程重启级故障测试。
+
+本轮没有新增数据库列、没有迁移活动库，也没有调用真实 AI、FFmpeg、Chrome、抖音或 B站。恢复语义是“有可验证证据时尽量避免重复”，不是跨 SQLite 与外部服务的严格 exactly-once：若 Provider 已计费但进程在任何 run/文件落盘前崩溃，系统无法证明该次结果，重试仍可能再次调用。数据库迁移 fail-open、第三方超时/429/错误 JSON、字幕批准批次和 Secret/本地管理接口仍属于 P1.3c～P1.5，因此项目成熟度继续维持 **可用 V1**，尚不提前改判为“稳定 V1”。
+
 ## 1. Executive Summary
 
 ### 结论
diff --git a/STABILITY_P1_PIPELINE_CHECKPOINT_TASK.md b/STABILITY_P1_PIPELINE_CHECKPOINT_TASK.md
new file mode 100644
index 0000000..621bcb8
--- /dev/null
+++ b/STABILITY_P1_PIPELINE_CHECKPOINT_TASK.md
@@ -0,0 +1,85 @@
+# P1.3b 自动流水线持久化步骤 Checkpoint
+
+## 背景
+
+P1.3a 已封住 Workflow Job 代际覆盖、Task 状态跳跃、取消竞态和切片批次半提交，但 `PipelineEngine` 的步骤结果仍只保存在进程内 `context`。Web/Worker 重启、子进程异常退出或租约接管后，同一个 Job 可能从头执行，造成重复 AI 调用、重复 FFmpeg、重复封面和上下文缺失。
+
+## 本轮目标
+
+只复用现有 `workflow_jobs.checkpoint_json`，为 `auto_pipeline` 增加版本化、带 lease fencing 的步骤 checkpoint 和重启恢复：
+
+1. 每个步骤开始前持久化 `running`、输入基线和开始时间。
+2. 每个步骤完成后只保存路径、ID、hash、计数等紧凑证据，并持久化 `succeeded`。
+3. 新 Worker 接管时逐步验证数据库/文件证据，跳过已确认完成的步骤。
+4. `running` 步骤先尝试 reconcile；证据完整则补记成功，证据不足才重做。
+5. 旧 owner/token 不能写 checkpoint、Task 状态或终态。
+6. `METADATA_GENERATING`、`SCHEDULE_CREATING` 和 `PUBLISH_JOB_CREATING` 不再依赖上一进程的内存对象。
+7. 失败/取消后的自动重试必须复用同一 Workflow Job，不能把 checkpoint 留在旧 Job 后另建空 Job。
+
+## 允许修改
+
+- `app/services/pipeline_engine.py`
+- `app/services/job_service.py`（仅必要的 checkpoint 读取错误边界）
+- 新增独立的 auto pipeline checkpoint 服务
+- 与本轮直接相关的隔离测试
+- `DEVELOPMENT_LOG.md`、`NEXT_STEPS.md`、`PROJECT_AUDIT.md`、`.codemap/*`
+
+## 禁止修改
+
+- 不新增或迁移数据库列。
+- 不修改字幕 Job 现有 `{completed: ...}` checkpoint 格式。
+- 不调用真实 AI、FFmpeg、Chrome、抖音或 B站。
+- 不处理 P1.3c 数据库迁移账本、P1.4 Provider 超时、P1.5 Secret/Auth。
+- 不删除历史 cut run、AI run、发布任务或用户数据。
+
+## 已确定实现要求
+
+### Checkpoint envelope
+
+- `kind = auto_pipeline_step_v1`，并记录 `task_id`、`start_step`、`current_step`、`completed_steps`、`steps`。
+- completed steps 必须构成从 `start_step` 开始的连续前缀；非连续、跨 Task、未知 step、未知 kind 或非字典 checkpoint 均拒绝自动执行。
+- checkpoint 不保存 Secret、完整 Prompt、完整 AI payload 或完整 output clip 对象。
+
+### 恢复与复用
+
+- 已完成步骤必须重新验证证据；证据缺失时 fail-closed，不自动覆盖人工或历史结果。
+- 中断步骤允许用本轮开始前基线识别新产生的 AI run、cut run 或 artifact；能确认完整才补记成功。
+- 切片证据必须绑定 active `cut_run_id`、候选 ID、任务受控目录、非空文件、size 与 fingerprint；发布草稿同时绑定 schedule、视频、封面和草稿字段。
+- 普通转写继续复用现有 transcript/分块 checkpoint；发布草稿继续使用现有 active 去重边界。
+- metadata/schedule 从持久化 JSON 恢复下游输入，不能依赖旧进程内存。
+- 字幕草稿完成后的 `PENDING_SUBTITLE_REVIEW` 仍是稳定人工门禁，重启不得自动越过。
+
+### 诚实边界
+
+- 外部模型/FFmpeg 与 SQLite checkpoint 无法做到同一事务；本轮目标是通过 reconciliation 显著减少重复，不宣称严格 exactly-once。
+- Provider 在返回前进程崩溃且没有可验证产物时，重试仍可能再次计费；该边界保留到 P1.4 的 Provider 幂等策略。
+
+## 验收标准
+
+1. Job 重领后从第一个未确认完成步骤继续，已完成 handler 不再调用。
+2. AI/cut 在“副作用已完成、checkpoint 未落盘”场景能根据新 run 证据恢复。
+3. metadata/schedule 能从文件恢复完整下游输入，且 checkpoint 只保存紧凑证据。
+4. 全部步骤 checkpoint 写入继续受 owner/token fencing 保护。
+5. malformed/unknown auto checkpoint 给出明确失败，不静默从头执行。
+6. NULL/空 checkpoint 和字幕旧 checkpoint 行为保持兼容。
+7. 字幕审核暂停在重启后仍返回 `pending_subtitle_review`。
+8. 定向测试、完整 Pytest、Ruff、Compileall 通过；工作区没有测试产物或活动数据改动。
+9. `job_id` 没有当前有效 lease 时，在任何 handler、Task 状态或文件副作用前 fail-closed。
+10. `/auto-retry` 复用旧 Job 的 running/failed checkpoint，并由新 token 继续恢复。
+
+## 测试命令
+
+```powershell
+.\.venv\Scripts\python.exe -m pytest -q tests/test_pipeline_checkpoint.py tests/test_pipeline_state_stability.py tests/test_job_fencing.py tests/test_auto_pipeline.py tests/test_subtitle_auto_workflow.py
+.\.venv\Scripts\python.exe -m pytest -q
+.\.venv\Scripts\python.exe -m ruff check app tests
+.\.venv\Scripts\python.exe -m compileall -q app tests scripts
+```
+
+## 返回格式
+
+- 实际修改与非目标。
+- 重启/重领/损坏 checkpoint 的验证证据。
+- 全量测试结果。
+- 仍不能保证 exactly-once 的边界。
+- Commit、分支、PR 与下一独立轮次。
diff --git a/app/services/job_service.py b/app/services/job_service.py
index 3e5bb19..f345b52 100644
--- a/app/services/job_service.py
+++ b/app/services/job_service.py
@@ -679,6 +679,65 @@ def retry_job(job_id: str) -> dict | None:
     return get_job(job_id) if cursor.rowcount else None
 
 
+def retry_latest_or_get_active_job(task_id: str, job_type: str) -> tuple[dict | None, bool]:
+    """Return the active job, or atomically requeue the latest retryable job.
+
+    Reusing the same row is important for auto-pipeline jobs because their
+    fenced step checkpoint belongs to that workflow_jobs.id.
+    """
+
+    now = _now_iso()
+    with get_connection() as connection:
+        connection.execute("BEGIN IMMEDIATE")
+        active = connection.execute(
+            """
+            SELECT id FROM workflow_jobs
+            WHERE task_id = ? AND job_type = ? AND status IN (?, ?)
+            ORDER BY created_at DESC LIMIT 1
+            """,
+            (task_id, job_type, JOB_STATUS_QUEUED, JOB_STATUS_RUNNING),
+        ).fetchone()
+        if active:
+            connection.commit()
+            return get_job(str(active["id"])), False
+
+        retryable = connection.execute(
+            """
+            SELECT id FROM workflow_jobs
+            WHERE task_id = ? AND job_type = ? AND status IN (?, ?)
+            ORDER BY created_at DESC LIMIT 1
+            """,
+            (task_id, job_type, JOB_STATUS_FAILED, JOB_STATUS_CANCELLED),
+        ).fetchone()
+        if not retryable:
+            connection.commit()
+            return None, False
+
+        cursor = connection.execute(
+            """
+            UPDATE workflow_jobs
+            SET status = ?, progress = 0, message = '任务已重新加入队列',
+                result_json = '{}', error_message = NULL, finished_at = NULL,
+                next_attempt_at = ?, cancel_requested = 0,
+                lease_owner = NULL, lease_token = NULL, lease_expires_at = NULL,
+                heartbeat_at = NULL, attempt_count = 0, updated_at = ?
+            WHERE id = ? AND status IN (?, ?)
+            """,
+            (
+                JOB_STATUS_QUEUED,
+                now,
+                now,
+                retryable["id"],
+                JOB_STATUS_FAILED,
+                JOB_STATUS_CANCELLED,
+            ),
+        )
+        connection.commit()
+    if cursor.rowcount != 1:
+        return None, False
+    return get_job(str(retryable["id"])), True
+
+
 def release_job_lease(job_id: str, lease_owner: str, lease_token: str) -> bool:
     """Web 正常停止时释放子进程 Job，供新进程立即恢复。"""
     now = _now_iso()
diff --git a/app/services/pipeline_checkpoint_service.py b/app/services/pipeline_checkpoint_service.py
new file mode 100644
index 0000000..cb0b8fc
--- /dev/null
+++ b/app/services/pipeline_checkpoint_service.py
@@ -0,0 +1,259 @@
+"""Versioned step checkpoints for the persistent auto pipeline."""
+
+from __future__ import annotations
+
+from copy import deepcopy
+from datetime import datetime, timezone
+from typing import Any, Iterable
+
+from app.services import job_service
+
+
+AUTO_PIPELINE_CHECKPOINT_KIND = "auto_pipeline_step_v1"
+_STEP_STATES = {"running", "succeeded", "failed"}
+
+
+class PipelineCheckpointError(RuntimeError):
+    """The persisted auto-pipeline checkpoint cannot be trusted."""
+
+
+def _now_iso() -> str:
+    return datetime.now(timezone.utc).isoformat(timespec="seconds")
+
+
+class AutoPipelineCheckpoint:
+    """Small, fenced state machine stored in workflow_jobs.checkpoint_json."""
+
+    def __init__(
+        self,
+        *,
+        job_id: str,
+        task_id: str,
+        start_step: str,
+        run_key: str,
+        ordered_steps: Iterable[str],
+        state: dict[str, Any],
+    ) -> None:
+        self.job_id = job_id
+        self.task_id = task_id
+        self.start_step = start_step
+        self.run_key = run_key
+        self.ordered_steps = tuple(ordered_steps)
+        self.scoped_steps = self.ordered_steps[self.ordered_steps.index(start_step) :]
+        self.state = state
+        self._validate()
+
+    @classmethod
+    def load(
+        cls,
+        *,
+        job_id: str,
+        task_id: str,
+        start_step: str,
+        run_key: str,
+        ordered_steps: Iterable[str],
+    ) -> AutoPipelineCheckpoint:
+        active = job_service.require_active_job_lease()
+        if not active or active[0] != job_id:
+            raise job_service.JobLeaseLostError(
+                f"自动流水线没有当前 Workflow Job 租约：{job_id}"
+            )
+        job = job_service.get_job(job_id)
+        if not job or job.get("job_type") != job_service.JOB_TYPE_AUTO_PIPELINE:
+            raise PipelineCheckpointError("自动流水线 checkpoint 对应的 Job 不存在或类型不正确")
+        if str(job.get("task_id") or "") != task_id:
+            raise PipelineCheckpointError("自动流水线 checkpoint 的 Task 与 Job 不一致")
+
+        raw = job.get("checkpoint_json")
+        if raw in (None, "", {}):
+            state = {
+                "kind": AUTO_PIPELINE_CHECKPOINT_KIND,
+                "task_id": task_id,
+                "run_key": run_key,
+                "start_step": start_step,
+                "current_step": "",
+                "completed_steps": [],
+                "steps": {},
+                "last_error": "",
+                "updated_at": _now_iso(),
+            }
+        elif not isinstance(raw, dict):
+            raise PipelineCheckpointError("自动流水线 checkpoint JSON 已损坏，拒绝从头重复执行")
+        else:
+            state = deepcopy(raw)
+
+        return cls(
+            job_id=job_id,
+            task_id=task_id,
+            start_step=start_step,
+            run_key=run_key,
+            ordered_steps=ordered_steps,
+            state=state,
+        )
+
+    @property
+    def has_history(self) -> bool:
+        return bool(self.state.get("steps") or self.state.get("completed_steps"))
+
+    @property
+    def current_step(self) -> str:
+        return str(self.state.get("current_step") or "")
+
+    @property
+    def completed_steps(self) -> tuple[str, ...]:
+        return tuple(str(item) for item in self.state.get("completed_steps") or [])
+
+    def is_completed(self, step: str) -> bool:
+        return step in self.completed_steps
+
+    def step_record(self, step: str) -> dict[str, Any]:
+        record = (self.state.get("steps") or {}).get(step) or {}
+        return deepcopy(record) if isinstance(record, dict) else {}
+
+    def begin_step(self, step: str, *, baseline: dict[str, Any] | None = None) -> None:
+        self._require_next_step(step)
+        now = _now_iso()
+        previous = self.step_record(step)
+        attempts = int(previous.get("attempts") or 0) + 1
+        self.state["current_step"] = step
+        self.state.setdefault("steps", {})[step] = {
+            "state": "running",
+            "attempts": attempts,
+            "started_at": now,
+            "baseline": deepcopy(baseline or {}),
+            "outputs": {},
+            "error": "",
+        }
+        self.state["last_error"] = ""
+        self._persist()
+
+    def complete_step(
+        self,
+        step: str,
+        *,
+        outputs: dict[str, Any],
+        recovered: bool = False,
+    ) -> None:
+        self._require_next_step(step)
+        previous = self.step_record(step)
+        now = _now_iso()
+        self.state.setdefault("steps", {})[step] = {
+            "state": "succeeded",
+            "attempts": max(1, int(previous.get("attempts") or 0)),
+            "started_at": str(previous.get("started_at") or now),
+            "completed_at": now,
+            "recovered": bool(recovered),
+            "baseline": deepcopy(previous.get("baseline") or {}),
+            "outputs": deepcopy(outputs),
+            "error": "",
+        }
+        completed = list(self.completed_steps)
+        completed.append(step)
+        self.state["completed_steps"] = completed
+        self.state["current_step"] = ""
+        self.state["last_error"] = ""
+        self._persist()
+
+    def fail_step(self, step: str, error: str) -> None:
+        self._require_next_step(step)
+        previous = self.step_record(step)
+        now = _now_iso()
+        self.state.setdefault("steps", {})[step] = {
+            "state": "failed",
+            "attempts": max(1, int(previous.get("attempts") or 0)),
+            "started_at": str(previous.get("started_at") or now),
+            "failed_at": now,
+            "baseline": deepcopy(previous.get("baseline") or {}),
+            "outputs": deepcopy(previous.get("outputs") or {}),
+            "error": str(error or "自动流水线步骤失败"),
+        }
+        self.state["current_step"] = step
+        self.state["last_error"] = str(error or "自动流水线步骤失败")
+        self._persist()
+
+    def invalidate_from(self, step: str, error: str) -> None:
+        if step not in self.scoped_steps:
+            raise PipelineCheckpointError(f"未知的自动流水线步骤：{step}")
+        index = self.scoped_steps.index(step)
+        retained = list(self.scoped_steps[:index])
+        if tuple(retained) != self.completed_steps[:index]:
+            raise PipelineCheckpointError("自动流水线 checkpoint 的完成顺序已损坏")
+        previous = self.step_record(step)
+        self.state["completed_steps"] = retained
+        steps = self.state.setdefault("steps", {})
+        for later in self.scoped_steps[index + 1 :]:
+            steps.pop(later, None)
+        steps[step] = {
+            "state": "failed",
+            "attempts": max(1, int(previous.get("attempts") or 0)),
+            "started_at": str(previous.get("started_at") or _now_iso()),
+            "failed_at": _now_iso(),
+            "baseline": deepcopy(previous.get("baseline") or {}),
+            "outputs": deepcopy(previous.get("outputs") or {}),
+            "error": str(error),
+        }
+        self.state["current_step"] = step
+        self.state["last_error"] = str(error)
+        self._persist()
+
+    def _require_next_step(self, step: str) -> None:
+        if step not in self.scoped_steps:
+            raise PipelineCheckpointError(f"未知的自动流水线步骤：{step}")
+        completed = self.completed_steps
+        expected = self.scoped_steps[len(completed)] if len(completed) < len(self.scoped_steps) else ""
+        if expected != step:
+            raise PipelineCheckpointError(
+                f"自动流水线 checkpoint 顺序冲突：期望 {expected or '全部完成'}，收到 {step}"
+            )
+
+    def _persist(self) -> None:
+        self.state["updated_at"] = _now_iso()
+        self._validate()
+        updated = job_service.update_job_checkpoint(self.job_id, self.state)
+        if not updated:
+            raise job_service.JobLeaseLostError(
+                f"自动流水线 checkpoint 写入失败，Workflow Job 租约已失效：{self.job_id}"
+            )
+
+    def _validate(self) -> None:
+        if self.start_step not in self.ordered_steps:
+            raise PipelineCheckpointError(f"自动流水线起始步骤无效：{self.start_step}")
+        if self.state.get("kind") != AUTO_PIPELINE_CHECKPOINT_KIND:
+            raise PipelineCheckpointError("自动流水线 checkpoint 版本未知，拒绝静默重跑")
+        if str(self.state.get("task_id") or "") != self.task_id:
+            raise PipelineCheckpointError("自动流水线 checkpoint 属于其他 Task")
+        if str(self.state.get("run_key") or "") != self.run_key:
+            raise PipelineCheckpointError("任务输入或自动配置已变化，请创建新的流水线 Job")
+        if str(self.state.get("start_step") or "") != self.start_step:
+            raise PipelineCheckpointError("自动流水线 checkpoint 的起始步骤与 Job payload 不一致")
+
+        completed = list(self.completed_steps)
+        if completed != list(self.scoped_steps[: len(completed)]):
+            raise PipelineCheckpointError("自动流水线 checkpoint 的完成步骤不是连续前缀")
+        steps = self.state.get("steps")
+        if not isinstance(steps, dict):
+            raise PipelineCheckpointError("自动流水线 checkpoint.steps 不是对象")
+        unknown = set(steps) - set(self.scoped_steps)
+        if unknown:
+            raise PipelineCheckpointError(f"自动流水线 checkpoint 包含未知步骤：{sorted(unknown)}")
+        for step, record in steps.items():
+            if not isinstance(record, dict) or record.get("state") not in _STEP_STATES:
+                raise PipelineCheckpointError(f"自动流水线 checkpoint 步骤状态无效：{step}")
+            if step in completed and record.get("state") != "succeeded":
+                raise PipelineCheckpointError(f"自动流水线已完成步骤缺少 succeeded 证据：{step}")
+            if not isinstance(record.get("outputs") or {}, dict):
+                raise PipelineCheckpointError(f"自动流水线步骤输出证据无效：{step}")
+        current = self.current_step
+        if current and current not in self.scoped_steps:
+            raise PipelineCheckpointError(f"自动流水线 current_step 无效：{current}")
+        if current and current in completed:
+            raise PipelineCheckpointError("自动流水线 current_step 与 completed_steps 冲突")
+        if current:
+            expected = self.scoped_steps[len(completed)] if len(completed) < len(self.scoped_steps) else ""
+            if current != expected:
+                raise PipelineCheckpointError("自动流水线 current_step 不是首个未完成步骤")
+        expected_records = set(completed)
+        if current:
+            expected_records.add(current)
+        if set(steps) != expected_records:
+            raise PipelineCheckpointError("自动流水线 checkpoint 包含缺失或越序的步骤记录")
diff --git a/app/services/pipeline_engine.py b/app/services/pipeline_engine.py
index d3cef81..4b326c9 100644
--- a/app/services/pipeline_engine.py
+++ b/app/services/pipeline_engine.py
@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import hashlib
 import json
 from datetime import datetime, time, timedelta
 from pathlib import Path
@@ -12,12 +13,18 @@
 from app.services import job_service, task_service
 from app.services.auto_publish_service import create_auto_publish_jobs, platforms_for_task
 from app.services.metadata_generator import MetadataGenerator
+from app.services.pipeline_checkpoint_service import (
+    AutoPipelineCheckpoint,
+    PipelineCheckpointError,
+)
 from app.services.publish_service import generate_publish_cover_for_item
 from app.services.publish_time import next_allowed_schedule_time
 from app.services.storage_service import (
+    IMAGE_EXTENSIONS,
     create_task_directory,
     get_artifact_paths,
     get_source_video_path,
+    resolve_task_media_file_path,
     validate_source_video_path,
 )
 from app.services.task_log_service import append_task_log
@@ -91,13 +98,33 @@ def run(
         if not task.get("auto_mode"):
             raise ValueError("该任务未开启 auto_mode，手动流程不会被自动流水线接管。")
 
-        config = self._load_auto_config(task)
         resolved_start_step = (
             start_step
             if isinstance(start_step, TaskStatus)
             else TaskStatus(start_step) if start_step else self._resolve_start_step(task, retry=retry)
         )
-        if not retry and start_step is None:
+        config = self._load_auto_config(task)
+        checkpoint: AutoPipelineCheckpoint | None = None
+        if job_id:
+            active_lease = job_service.current_job_lease()
+            if not active_lease or active_lease[0] != job_id:
+                raise job_service.JobLeaseLostError(
+                    f"自动流水线缺少当前 Workflow Job 租约：{job_id}"
+                )
+            checkpoint = AutoPipelineCheckpoint.load(
+                job_id=job_id,
+                task_id=task_id,
+                start_step=resolved_start_step.value,
+                run_key=self._pipeline_run_key(task, config, resolved_start_step),
+                ordered_steps=[step.value for step in STEP_STATUSES],
+            )
+
+        if checkpoint and checkpoint.has_history:
+            append_task_log(
+                task_id,
+                f"从持久化 checkpoint 恢复全自动流水线：{resolved_start_step.value}",
+            )
+        elif not retry and start_step is None:
             task_service.update_task_status(task_id, TaskStatus.CREATED)
             append_task_log(task_id, "全自动流水线启动")
         elif start_step is not None:
@@ -130,41 +157,59 @@ def run(
                         f"正在执行：{step.value}",
                     )
                     job_service.heartbeat_job(job_id)
-                task_service.update_task_status(task_id, step)
-                context[step.value] = handlers[step](task_id, context)
-                if job_id:
-                    job_service.heartbeat_job(job_id)
-                    self._raise_if_cancelled(job_id)
-                if step == TaskStatus.SUBTITLE_DRAFTING:
-                    summary = self._safe_write_task_summary(
+
+                if checkpoint and checkpoint.is_completed(step.value):
+                    context[step.value] = self._restore_checkpoint_step(
                         task_id,
-                        TaskStatus.PENDING_SUBTITLE_REVIEW.value,
-                        "",
+                        step,
+                        checkpoint.step_record(step.value).get("outputs") or {},
                     )
-                    return {
-                        "status": "pending_subtitle_review",
-                        "message": "字幕草稿已生成，等待人工审核后再继续。",
-                        "summary_path": summary["summary_path"],
-                        "task": task_service.get_task(task_id, include_video_probe=False),
-                    }
+                    append_task_log(task_id, f"checkpoint 证据有效，跳过已完成步骤：{step.value}")
+                else:
+                    recovered = None
+                    record = checkpoint.step_record(step.value) if checkpoint else {}
+                    if checkpoint and checkpoint.current_step == step.value and record.get("state") == "running":
+                        recovered = self._reconcile_interrupted_step(task_id, step, record)
+                    if recovered is not None:
+                        outputs = self._checkpoint_outputs(task_id, step, recovered)
+                        checkpoint.complete_step(step.value, outputs=outputs, recovered=True)
+                        context[step.value] = recovered
+                        append_task_log(task_id, f"已根据持久化产物恢复中断步骤：{step.value}")
+                    else:
+                        if checkpoint:
+                            checkpoint.begin_step(
+                                step.value,
+                                baseline=self._checkpoint_baseline(task_id, step),
+                            )
+                        task_service.update_task_status(task_id, step)
+                        context[step.value] = handlers[step](task_id, context)
+                        if job_id:
+                            job_service.heartbeat_job(job_id)
+                            self._raise_if_cancelled(job_id)
+                        if checkpoint:
+                            checkpoint.complete_step(
+                                step.value,
+                                outputs=self._checkpoint_outputs(task_id, step, context[step.value]),
+                            )
+                if step == TaskStatus.SUBTITLE_DRAFTING:
+                    return self._pending_subtitle_review_result(task_id)
             except PipelineCancelledError as exc:
                 return self._cancel_pipeline(task_id, str(exc), context)
             except job_service.JobLeaseLostError:
                 raise
+            except PipelineCheckpointError as exc:
+                error = str(exc)
+                if checkpoint:
+                    if checkpoint.is_completed(step.value):
+                        checkpoint.invalidate_from(step.value, error)
+                    else:
+                        checkpoint.fail_step(step.value, error)
+                return self._pipeline_failure(task_id, step, error)
             except Exception as exc:
-                failed_status = FAILED_BY_STEP[step]
                 error = str(exc) or f"{step.value} 失败"
-                task_service.update_task_status(task_id, failed_status, error)
-                append_task_log(task_id, f"全自动流水线失败：{step.value}，原因：{error}")
-                summary = self._safe_write_task_summary(task_id, "failed", error)
-                return {
-                    "status": "failed",
-                    "failed_step": step.value,
-                    "failed_status": failed_status.value,
-                    "last_error": error,
-                    "summary_path": summary["summary_path"],
-                    "task": task_service.get_task(task_id, include_video_probe=False),
-                }
+                if checkpoint:
+                    checkpoint.fail_step(step.value, error)
+                return self._pipeline_failure(task_id, step, error)
 
         if job_id:
             try:
@@ -280,6 +325,31 @@ def _cancel_unpublished_auto_jobs(self, task_id: str, context: dict) -> int:
             return 0
         placeholders = ", ".join("?" for _ in created_ids)
         now = task_service._now_iso()
+        lease_clause = ""
+        lease_params: tuple[str, ...] = ()
+        workflow_job_id = str(context.get("workflow_job_id") or "")
+        if workflow_job_id:
+            active_lease = job_service.require_active_job_lease()
+            if not active_lease or active_lease[0] != workflow_job_id:
+                raise job_service.JobLeaseLostError(
+                    f"取消发布草稿时 Workflow Job 租约已失效：{workflow_job_id}"
+                )
+            _, lease_owner, lease_token = active_lease
+            lease_clause = """
+                  AND EXISTS (
+                      SELECT 1 FROM workflow_jobs
+                        WHERE id = ? AND task_id = ? AND status = ?
+                        AND lease_owner = ? AND lease_token = ?
+                        AND julianday(lease_expires_at) > julianday('now')
+                  )
+            """
+            lease_params = (
+                workflow_job_id,
+                task_id,
+                job_service.JOB_STATUS_RUNNING,
+                lease_owner,
+                lease_token,
+            )
         with get_connection() as connection:
             cursor = connection.execute(
                 f"""
@@ -289,14 +359,862 @@ def _cancel_unpublished_auto_jobs(self, task_id: str, context: dict) -> int:
                     finished_at = ?, updated_at = ?
                 WHERE task_id = ? AND id IN ({placeholders})
                   AND status IN ('DRAFT', 'WAITING', 'SCHEDULED', 'NEED_REVIEW')
+                  {lease_clause}
                 """,
-                (now, now, task_id, *created_ids),
+                (now, now, task_id, *created_ids, *lease_params),
             )
             connection.commit()
         if cursor.rowcount:
             append_task_log(task_id, f"已取消本轮新建但尚未发布的发送任务：{cursor.rowcount} 条")
         return cursor.rowcount
 
+    def _pending_subtitle_review_result(self, task_id: str) -> dict:
+        summary = self._safe_write_task_summary(
+            task_id,
+            TaskStatus.PENDING_SUBTITLE_REVIEW.value,
+            "",
+        )
+        return {
+            "status": "pending_subtitle_review",
+            "message": "字幕草稿已生成，等待人工审核后再继续。",
+            "summary_path": summary["summary_path"],
+            "task": task_service.get_task(task_id, include_video_probe=False),
+        }
+
+    def _pipeline_failure(self, task_id: str, step: TaskStatus, error: str) -> dict:
+        failed_status = FAILED_BY_STEP[step]
+        task_service.update_task_status(task_id, failed_status, error)
+        append_task_log(task_id, f"全自动流水线失败：{step.value}，原因：{error}")
+        summary = self._safe_write_task_summary(task_id, "failed", error)
+        return {
+            "status": "failed",
+            "failed_step": step.value,
+            "failed_status": failed_status.value,
+            "last_error": error,
+            "summary_path": summary["summary_path"],
+            "task": task_service.get_task(task_id, include_video_probe=False),
+        }
+
+    def _pipeline_run_key(self, task: dict, config: dict, start_step: TaskStatus) -> str:
+        from app.services.transcription_checkpoint_service import fingerprint_file
+
+        source = get_source_video_path(task)
+        source_path = str(Path(source).resolve()) if source else ""
+        source_fingerprint = ""
+        if source and Path(source).exists() and Path(source).is_file():
+            source_fingerprint = fingerprint_file(source)
+        payload = {
+            "task_id": task.get("id") or "",
+            "source_path": source_path,
+            "source_fingerprint": source_fingerprint,
+            "start_step": start_step.value,
+            "selection_profile": task.get("selection_profile") or "",
+            "candidate_clip_count": int(task.get("candidate_clip_count") or 0),
+            "final_clip_target": int(task.get("final_clip_target") or 0),
+            "max_clip_duration": int(task.get("max_clip_duration") or 0),
+            "config": config,
+        }
+        encoded = json.dumps(payload, ensure_ascii=False, sort_keys=True, separators=(",", ":"), default=str)
+        return hashlib.sha256(encoded.encode("utf-8")).hexdigest()
+
+    def _enabled_candidate_ids(self, task_id: str) -> list[str]:
+        with get_connection() as connection:
+            rows = connection.execute(
+                """
+                SELECT id FROM clip_candidates
+                WHERE task_id = ? AND enabled = 1 AND COALESCE(is_deleted, 0) = 0
+                ORDER BY id
+                """,
+                (task_id,),
+            ).fetchall()
+        return [str(row["id"]) for row in rows]
+
+    def _active_output_ids(self, task_id: str) -> list[str]:
+        return sorted(
+            str(item.get("id") or "")
+            for item in task_service.list_output_clips(task_id)
+            if item.get("status") == "completed" and item.get("file_exists") and item.get("id")
+        )
+
+    def _cut_output_evidence(self, task_id: str, cut_run_id: str) -> list[dict]:
+        from app.services.transcription_checkpoint_service import fingerprint_file
+
+        task = self._get_task(task_id)
+        with get_connection() as connection:
+            rows = connection.execute(
+                """
+                SELECT id, clip_candidate_id, cut_run_id, output_file_path
+                FROM output_clip
+                WHERE task_id = ? AND status = 'completed' AND is_active = 1
+                ORDER BY id
+                """,
+                (task_id,),
+            ).fetchall()
+        if not rows:
+            raise PipelineCheckpointError("切片步骤没有 active output")
+
+        evidence: list[dict] = []
+        for row in rows:
+            row_run_id = str(row["cut_run_id"] or "")
+            if not row_run_id or row_run_id != cut_run_id:
+                raise PipelineCheckpointError("active output 不属于当前 cut run")
+            path = resolve_task_media_file_path(
+                str(row["output_file_path"] or ""),
+                task_id=task_id,
+                task_dir_name=task.get("task_dir_name"),
+                allowed_subdirectories=("05_clips", "clips"),
+            )
+            if path is None or not path.exists() or not path.is_file():
+                raise PipelineCheckpointError("切片输出文件缺失或不在当前任务目录")
+            size_bytes = int(path.stat().st_size)
+            if size_bytes <= 0:
+                raise PipelineCheckpointError("切片输出文件为空")
+            evidence.append(
+                {
+                    "id": str(row["id"]),
+                    "clip_candidate_id": str(row["clip_candidate_id"] or ""),
+                    "cut_run_id": row_run_id,
+                    "file": {
+                        "path": str(path.resolve()),
+                        "size_bytes": size_bytes,
+                        "fingerprint": fingerprint_file(path),
+                    },
+                }
+            )
+        return evidence
+
+    def _publish_job_evidence(self, task_id: str, job_ids: list[str]) -> list[dict]:
+        normalized_ids = sorted({str(job_id) for job_id in job_ids if job_id})
+        if not normalized_ids:
+            raise PipelineCheckpointError("发布任务 checkpoint 没有记录任何草稿")
+        placeholders = ", ".join("?" for _ in normalized_ids)
+        with get_connection() as connection:
+            rows = connection.execute(
+                f"""
+                SELECT id, output_clip_id, platform, publish_mode, video_source,
+                       video_file_path, cover_file_path, scheduled_at, status,
+                       title, description, caption, tags, hashtags, cover_text,
+                       error_code, provider_response
+                FROM publish_jobs
+                WHERE task_id = ? AND id IN ({placeholders})
+                ORDER BY id
+                """,
+                (task_id, *normalized_ids),
+            ).fetchall()
+        if len(rows) != len(normalized_ids):
+            raise PipelineCheckpointError("发布任务 checkpoint 对应的草稿已缺失")
+
+        evidence: list[dict] = []
+        task = self._get_task(task_id)
+        allowed_statuses = {"DRAFT", "WAITING", "SCHEDULED", "NEED_REVIEW"}
+        for row in rows:
+            try:
+                provider_response = json.loads(str(row["provider_response"] or "{}"))
+            except json.JSONDecodeError as exc:
+                raise PipelineCheckpointError("发布任务 provider_response 已损坏") from exc
+            if not isinstance(provider_response, dict):
+                raise PipelineCheckpointError("发布任务 provider_response 不是对象")
+            status = str(row["status"] or "").upper()
+            if status not in allowed_statuses and not (
+                status == "CANCELLED" and str(row["error_code"] or "") == "user_removed"
+            ):
+                raise PipelineCheckpointError(f"发布任务不在可恢复草稿状态：{status or 'UNKNOWN'}")
+            video_source = str(row["video_source"] or "")
+            video_subdirectories = (
+                ("06_subtitled",)
+                if video_source == "subtitled"
+                else ("05_clips", "clips")
+            )
+            video_path = resolve_task_media_file_path(
+                str(row["video_file_path"] or ""),
+                task_id=task_id,
+                task_dir_name=task.get("task_dir_name"),
+                allowed_subdirectories=video_subdirectories,
+            )
+            cover_path = resolve_task_media_file_path(
+                str(row["cover_file_path"] or ""),
+                task_id=task_id,
+                task_dir_name=task.get("task_dir_name"),
+                allowed_subdirectories=("07_covers",),
+                allowed_extensions=IMAGE_EXTENSIONS,
+            )
+            if video_path is None or not video_path.is_file() or video_path.stat().st_size <= 0:
+                raise PipelineCheckpointError("发布草稿的视频文件无效")
+            if cover_path is None or not cover_path.is_file() or cover_path.stat().st_size <= 0:
+                raise PipelineCheckpointError("发布草稿的封面文件无效")
+            from app.services.transcription_checkpoint_service import fingerprint_file
+
+            evidence.append(
+                {
+                    "id": str(row["id"]),
+                    "output_clip_id": str(row["output_clip_id"] or ""),
+                    "platform": str(row["platform"] or ""),
+                    "publish_mode": str(row["publish_mode"] or ""),
+                    "video_source": video_source,
+                    "video_file_path": str(video_path.resolve()),
+                    "video_file_size": int(video_path.stat().st_size),
+                    "video_file_fingerprint": fingerprint_file(video_path),
+                    "cover_file_path": str(cover_path.resolve()),
+                    "cover_file": self._file_evidence(cover_path),
+                    "subtitle_delivery_mode": str(
+                        provider_response.get("subtitle_delivery_mode") or ""
+                    ),
+                    "workflow_job_id": str(provider_response.get("workflow_job_id") or ""),
+                    "scheduled_at": str(row["scheduled_at"] or ""),
+                    "status": status,
+                    "title": str(row["title"] or ""),
+                    "description": str(row["description"] or ""),
+                    "caption": str(row["caption"] or ""),
+                    "tags": str(row["tags"] or ""),
+                    "hashtags": str(row["hashtags"] or ""),
+                    "cover_text": str(row["cover_text"] or ""),
+                }
+            )
+        return evidence
+
+    def _verify_publish_schedule_pairs(self, schedule_path: Path, job_evidence: list[dict]) -> None:
+        scheduled_items = self._read_json_list(schedule_path)
+        self._validate_metadata_items(scheduled_items)
+        expected_pairs = sorted(
+            (
+                str((item.get("output_clip") or {}).get("id") or ""),
+                str((item.get("metadata") or {}).get("platform") or ""),
+            )
+            for item in scheduled_items
+        )
+        actual_pairs = sorted(
+            (str(item.get("output_clip_id") or ""), str(item.get("platform") or ""))
+            for item in job_evidence
+        )
+        if not expected_pairs or expected_pairs != actual_pairs:
+            raise PipelineCheckpointError("发布草稿与当前 schedule 的切片/平台不一致")
+
+    def _checkpoint_baseline(self, task_id: str, step: TaskStatus) -> dict:
+        paths = get_artifact_paths(task_id)
+        if step == TaskStatus.AI_ANALYZING:
+            with get_connection() as connection:
+                row = connection.execute(
+                    """
+                    SELECT id FROM ai_analysis_runs
+                    WHERE task_id = ? AND COALESCE(is_active, 0) = 1
+                    ORDER BY run_number DESC LIMIT 1
+                    """,
+                    (task_id,),
+                ).fetchone()
+            return {
+                "active_ai_run_id": str(row["id"] or "") if row else "",
+                "artifact": self._safe_file_evidence(paths["analysis_path"]),
+                "input_transcript": self._safe_file_evidence(paths["transcript_path"]),
+            }
+        if step == TaskStatus.VIDEO_CUTTING:
+            with get_connection() as connection:
+                row = connection.execute(
+                    "SELECT COALESCE(MAX(run_number), 0) AS value FROM cut_runs WHERE task_id = ?",
+                    (task_id,),
+                ).fetchone()
+            return {
+                "max_cut_run_number": int(row["value"] or 0),
+                "selected_candidate_ids": self._enabled_candidate_ids(task_id),
+            }
+        if step == TaskStatus.METADATA_GENERATING:
+            return {
+                "artifact": self._safe_file_evidence(
+                    paths["analysis_path"].parent / "auto_publish_metadata.json"
+                ),
+                "output_clip_ids": self._active_output_ids(task_id),
+            }
+        if step == TaskStatus.SCHEDULE_CREATING:
+            return {
+                "artifact": self._safe_file_evidence(
+                    paths["analysis_path"].parent / "auto_publish_schedule.json"
+                ),
+                "metadata_input": self._safe_file_evidence(
+                    paths["analysis_path"].parent / "auto_publish_metadata.json"
+                ),
+            }
+        if step == TaskStatus.PUBLISH_JOB_CREATING:
+            return {
+                "schedule": self._safe_file_evidence(
+                    paths["analysis_path"].parent / "auto_publish_schedule.json"
+                )
+            }
+        artifact_by_step = {
+            TaskStatus.PREPARING_SOURCE: paths["task_dir"] / "source" / "source_reference.json",
+            TaskStatus.TRANSCRIBING: paths["transcript_path"],
+            TaskStatus.CLIP_SELECTING: paths["analysis_path"].parent / "auto_selected_clips.json",
+        }
+        artifact = artifact_by_step.get(step)
+        if artifact:
+            baseline = {"artifact": self._safe_file_evidence(artifact)}
+            if step == TaskStatus.CLIP_SELECTING:
+                baseline["input_analysis"] = self._safe_file_evidence(paths["analysis_path"])
+            return baseline
+        if step == TaskStatus.SUBTITLE_DRAFTING:
+            from app.services.subtitle_data_service import list_task_tracks
+
+            return {
+                "track_ids": sorted(
+                    str(item.get("id") or "")
+                    for item in list_task_tracks(task_id, ensure=False)
+                    if item.get("id")
+                ),
+                "output_clip_ids": self._active_output_ids(task_id),
+            }
+        return {}
+
+    def _checkpoint_outputs(self, task_id: str, step: TaskStatus, result: dict) -> dict:
+        paths = get_artifact_paths(task_id)
+        if step == TaskStatus.PREPARING_SOURCE:
+            return {
+                "source_reference": self._file_evidence(
+                    paths["task_dir"] / "source" / "source_reference.json"
+                ),
+                "source_fingerprint": str(result.get("source_fingerprint") or ""),
+            }
+        if step == TaskStatus.TRANSCRIBING:
+            return {
+                "transcript": self._file_evidence(paths["transcript_path"]),
+                "source": str(result.get("source") or ""),
+            }
+        if step == TaskStatus.AI_ANALYZING:
+            run_id = str(result.get("analysis_run_id") or "")
+            if not run_id:
+                raise PipelineCheckpointError("AI 分析完成但没有 analysis_run_id")
+            return {
+                "analysis_run_id": run_id,
+                "analysis": self._file_evidence(paths["analysis_path"]),
+                "input_transcript": self._file_evidence(paths["transcript_path"]),
+                "clip_count": int(result.get("clip_count") or len(result.get("clips") or [])),
+            }
+        if step == TaskStatus.CLIP_SELECTING:
+            selected_ids = [
+                str(item.get("clip_id") or "")
+                for item in result.get("selected") or []
+                if isinstance(item, dict) and item.get("clip_id")
+            ]
+            return {
+                "selection": self._file_evidence(
+                    paths["analysis_path"].parent / "auto_selected_clips.json"
+                ),
+                "input_analysis": self._file_evidence(paths["analysis_path"]),
+                "selected_ids": selected_ids,
+            }
+        if step == TaskStatus.VIDEO_CUTTING:
+            run_id = str(result.get("cut_run_id") or "")
+            if not run_id:
+                raise PipelineCheckpointError("切片步骤完成但缺少有效 cut_run 或输出文件")
+            output_files = self._cut_output_evidence(task_id, run_id)
+            return {
+                "cut_run_id": run_id,
+                "cut_run_number": int(result.get("cut_run_number") or 0),
+                "output_files": output_files,
+                "output_clip_ids": [item["id"] for item in output_files],
+                "selected_candidate_ids": self._enabled_candidate_ids(task_id),
+            }
+        if step == TaskStatus.SUBTITLE_DRAFTING:
+            tracks = result.get("tracks") or []
+            return {
+                "source_track_id": str(result.get("source_track_id") or ""),
+                "track_ids": sorted(
+                    str(item.get("id") or "")
+                    for item in tracks
+                    if isinstance(item, dict) and item.get("id")
+                ),
+                "track_count": int(result.get("track_count") or len(tracks)),
+                "output_clip_ids": self._active_output_ids(task_id),
+            }
+        if step == TaskStatus.METADATA_GENERATING:
+            return {
+                "metadata": self._file_evidence(
+                    paths["analysis_path"].parent / "auto_publish_metadata.json"
+                ),
+                "metadata_count": int(result.get("metadata_count") or 0),
+                "need_review_count": int(result.get("need_review_count") or 0),
+                "output_clip_ids": self._active_output_ids(task_id),
+            }
+        if step == TaskStatus.SCHEDULE_CREATING:
+            scheduled_items = result.get("scheduled_items") or []
+            return {
+                "schedule": self._file_evidence(
+                    paths["analysis_path"].parent / "auto_publish_schedule.json"
+                ),
+                "metadata_input": self._file_evidence(
+                    paths["analysis_path"].parent / "auto_publish_metadata.json"
+                ),
+                "scheduled_count": len(scheduled_items),
+            }
+        if step == TaskStatus.PUBLISH_JOB_CREATING:
+            created_ids = [
+                str(item.get("id") or "")
+                for item in result.get("created") or []
+                if isinstance(item, dict) and item.get("id")
+            ]
+            skipped_ids = [
+                str(item.get("id") or "")
+                for item in result.get("skipped") or []
+                if isinstance(item, dict) and item.get("id")
+            ]
+            schedule_path = paths["analysis_path"].parent / "auto_publish_schedule.json"
+            job_evidence = self._publish_job_evidence(task_id, [*created_ids, *skipped_ids])
+            self._verify_publish_schedule_pairs(schedule_path, job_evidence)
+            return {
+                "created_ids": created_ids,
+                "skipped_ids": skipped_ids,
+                "created_count": int(result.get("created_count") or len(created_ids)),
+                "skipped_count": int(result.get("skipped_count") or len(skipped_ids)),
+                "schedule_input": self._file_evidence(schedule_path),
+                "job_evidence": job_evidence,
+            }
+        raise PipelineCheckpointError(f"没有定义 checkpoint 证据的步骤：{step.value}")
+
+    def _restore_checkpoint_step(self, task_id: str, step: TaskStatus, outputs: dict) -> dict:
+        paths = get_artifact_paths(task_id)
+        if step == TaskStatus.PREPARING_SOURCE:
+            reference_path = paths["task_dir"] / "source" / "source_reference.json"
+            self._verify_file_evidence(reference_path, outputs.get("source_reference") or {})
+            payload = self._read_json_object(reference_path)
+            source_path = str(payload.get("source_path") or "")
+            valid, error = validate_source_video_path(source_path)
+            if not valid:
+                raise PipelineCheckpointError(f"准备素材 checkpoint 已失效：{error}")
+            return {**payload, "source_fingerprint": outputs.get("source_fingerprint") or ""}
+        if step == TaskStatus.TRANSCRIBING:
+            transcript_path = paths["transcript_path"]
+            self._verify_file_evidence(transcript_path, outputs.get("transcript") or {})
+            if not self._has_text_file(transcript_path):
+                raise PipelineCheckpointError("转写 checkpoint 对应的 transcript.md 为空")
+            return {
+                "source": str(outputs.get("source") or "checkpoint"),
+                "transcript_path": str(transcript_path),
+            }
+        if step == TaskStatus.AI_ANALYZING:
+            analysis_path = paths["analysis_path"]
+            self._verify_file_evidence(
+                paths["transcript_path"],
+                outputs.get("input_transcript") or {},
+            )
+            self._verify_file_evidence(analysis_path, outputs.get("analysis") or {})
+            analysis_payload = self._read_json_object(analysis_path)
+            run_id = str(outputs.get("analysis_run_id") or "")
+            with get_connection() as connection:
+                row = connection.execute(
+                    """
+                    SELECT id, clip_count, is_active, analysis_payload_json
+                    FROM ai_analysis_runs
+                    WHERE id = ? AND task_id = ?
+                    """,
+                    (run_id, task_id),
+                ).fetchone()
+                candidate_rows = connection.execute(
+                    """
+                    SELECT clip_key FROM clip_candidates
+                    WHERE task_id = ? AND COALESCE(is_deleted, 0) = 0
+                    ORDER BY clip_key
+                    """,
+                    (task_id,),
+                ).fetchall()
+            try:
+                run_payload = json.loads(str(row["analysis_payload_json"] or "{}")) if row else {}
+            except json.JSONDecodeError as exc:
+                raise PipelineCheckpointError("AI run 的分析 JSON 已损坏") from exc
+            clips = analysis_payload.get("clips")
+            if not isinstance(clips, list) or not all(isinstance(item, dict) for item in clips):
+                raise PipelineCheckpointError("AI checkpoint 的 clips 结构无效")
+            analysis_clip_ids = sorted(str(item.get("clip_id") or "") for item in clips)
+            candidate_clip_ids = sorted(str(item["clip_key"] or "") for item in candidate_rows)
+            if (
+                not row
+                or not int(row["is_active"] or 0)
+                or int(row["clip_count"] or 0) <= 0
+                or run_payload != analysis_payload
+                or not analysis_clip_ids
+                or "" in analysis_clip_ids
+                or candidate_clip_ids != analysis_clip_ids
+                or len(candidate_clip_ids) != int(row["clip_count"] or 0)
+            ):
+                raise PipelineCheckpointError("AI checkpoint 与 active run/候选片段不一致")
+            return {
+                "analysis_run_id": run_id,
+                "analysis_path": str(analysis_path),
+                "clip_count": int(row["clip_count"] or 0),
+            }
+        if step == TaskStatus.CLIP_SELECTING:
+            selection_path = paths["analysis_path"].parent / "auto_selected_clips.json"
+            self._verify_file_evidence(
+                paths["analysis_path"],
+                outputs.get("input_analysis") or {},
+            )
+            self._verify_file_evidence(selection_path, outputs.get("selection") or {})
+            payload = self._read_json_object(selection_path)
+            selected_ids = {str(item) for item in outputs.get("selected_ids") or [] if item}
+            with get_connection() as connection:
+                enabled_ids = {
+                    str(row["id"])
+                    for row in connection.execute(
+                        """
+                        SELECT id FROM clip_candidates
+                        WHERE task_id = ? AND enabled = 1 AND COALESCE(is_deleted, 0) = 0
+                        """,
+                        (task_id,),
+                    ).fetchall()
+                }
+            if not selected_ids or enabled_ids != selected_ids:
+                raise PipelineCheckpointError("选片 checkpoint 与当前启用候选不一致")
+            return {**payload, "selection_path": str(selection_path)}
+        if step == TaskStatus.VIDEO_CUTTING:
+            run_id = str(outputs.get("cut_run_id") or "")
+            with get_connection() as connection:
+                run = connection.execute(
+                    """
+                    SELECT run_number, status, is_active FROM cut_runs
+                    WHERE id = ? AND task_id = ?
+                    """,
+                    (run_id, task_id),
+                ).fetchone()
+            if (
+                not run
+                or run["status"] not in {"completed", "completed_with_errors"}
+                or not int(run["is_active"] or 0)
+            ):
+                raise PipelineCheckpointError("切片 checkpoint 对应的 active cut run 不存在")
+            current_output_files = self._cut_output_evidence(task_id, run_id)
+            expected_output_files = outputs.get("output_files")
+            if not isinstance(expected_output_files, list) or current_output_files != expected_output_files:
+                raise PipelineCheckpointError("切片 checkpoint 与当前输出文件证据不一致")
+            output_ids = [item["id"] for item in current_output_files]
+            if output_ids != sorted(str(item) for item in outputs.get("output_clip_ids") or []):
+                raise PipelineCheckpointError("切片 checkpoint 与当前有效输出 ID 不一致")
+            selected_ids = self._enabled_candidate_ids(task_id)
+            output_candidate_ids = sorted(
+                item["clip_candidate_id"] for item in current_output_files if item["clip_candidate_id"]
+            )
+            if (
+                selected_ids != sorted(str(item) for item in outputs.get("selected_candidate_ids") or [])
+                or output_candidate_ids != selected_ids
+            ):
+                raise PipelineCheckpointError("切片 checkpoint 与当前启用候选边界不一致")
+            return {
+                "cut_run_id": run_id,
+                "cut_run_number": int(run["run_number"] or 0),
+                "success_count": len(current_output_files),
+                "failed_count": 0,
+                "failed": [],
+            }
+        if step == TaskStatus.SUBTITLE_DRAFTING:
+            from app.services.subtitle_data_service import list_task_tracks
+
+            tracks = list_task_tracks(task_id, ensure=False)
+            track_ids = sorted(str(item.get("id") or "") for item in tracks if item.get("id"))
+            expected = sorted(
+                {
+                    str(outputs.get("source_track_id") or ""),
+                    *(str(item) for item in outputs.get("track_ids") or [] if item),
+                }
+                - {""}
+            )
+            task = self._get_task(task_id)
+            if (
+                not expected
+                or track_ids != expected
+                or self._active_output_ids(task_id)
+                != sorted(str(item) for item in outputs.get("output_clip_ids") or [])
+                or task.get("status") != TaskStatus.PENDING_SUBTITLE_REVIEW.value
+            ):
+                raise PipelineCheckpointError("字幕草稿 checkpoint 与当前审核状态不一致")
+            clip_tracks = [item for item in tracks if item.get("track_type") == "clip"]
+            return {
+                "status": "pending_subtitle_review",
+                "source_track_id": str(outputs.get("source_track_id") or ""),
+                "track_count": len(clip_tracks),
+                "tracks": clip_tracks,
+            }
+        if step == TaskStatus.METADATA_GENERATING:
+            metadata_path = paths["analysis_path"].parent / "auto_publish_metadata.json"
+            self._verify_file_evidence(metadata_path, outputs.get("metadata") or {})
+            if self._active_output_ids(task_id) != sorted(
+                str(item) for item in outputs.get("output_clip_ids") or []
+            ):
+                raise PipelineCheckpointError("文案 checkpoint 与当前 active output 不一致")
+            metadata_items = self._read_json_list(metadata_path)
+            self._validate_metadata_items(metadata_items)
+            metadata_output_ids = {
+                str((item.get("output_clip") or {}).get("id") or "")
+                for item in metadata_items
+            }
+            if metadata_output_ids != set(self._active_output_ids(task_id)):
+                raise PipelineCheckpointError("文案 checkpoint 未完整覆盖当前 active output")
+            return {
+                "metadata_path": str(metadata_path),
+                "metadata_count": len(metadata_items),
+                "need_review_count": sum(
+                    1 for item in metadata_items if (item.get("metadata") or {}).get("risk_flags")
+                ),
+                "metadata_items": metadata_items,
+            }
+        if step == TaskStatus.SCHEDULE_CREATING:
+            schedule_path = paths["analysis_path"].parent / "auto_publish_schedule.json"
+            self._verify_file_evidence(
+                paths["analysis_path"].parent / "auto_publish_metadata.json",
+                outputs.get("metadata_input") or {},
+            )
+            self._verify_file_evidence(schedule_path, outputs.get("schedule") or {})
+            scheduled_items = self._read_json_list(schedule_path)
+            self._validate_metadata_items(scheduled_items)
+            return {"schedule_path": str(schedule_path), "scheduled_items": scheduled_items}
+        if step == TaskStatus.PUBLISH_JOB_CREATING:
+            self._verify_file_evidence(
+                paths["analysis_path"].parent / "auto_publish_schedule.json",
+                outputs.get("schedule_input") or {},
+            )
+            created_ids = [str(item) for item in outputs.get("created_ids") or [] if item]
+            skipped_ids = [str(item) for item in outputs.get("skipped_ids") or [] if item]
+            all_ids = [*created_ids, *skipped_ids]
+            current_evidence = self._publish_job_evidence(task_id, all_ids)
+            expected_evidence = outputs.get("job_evidence")
+            if not isinstance(expected_evidence, list) or current_evidence != expected_evidence:
+                raise PipelineCheckpointError("发布任务 checkpoint 与当前草稿字段不一致")
+            self._verify_publish_schedule_pairs(
+                paths["analysis_path"].parent / "auto_publish_schedule.json",
+                current_evidence,
+            )
+            from app.services.publish_service import get_publish_job
+
+            return {
+                "created": [get_publish_job(job_id) for job_id in created_ids],
+                "skipped": [get_publish_job(job_id) for job_id in skipped_ids],
+                "created_count": len(created_ids),
+                "skipped_count": len(skipped_ids),
+            }
+        raise PipelineCheckpointError(f"无法恢复未知步骤：{step.value}")
+
+    def _reconcile_interrupted_step(
+        self,
+        task_id: str,
+        step: TaskStatus,
+        record: dict,
+    ) -> dict | None:
+        baseline = record.get("baseline") if isinstance(record.get("baseline"), dict) else {}
+        paths = get_artifact_paths(task_id)
+        if step == TaskStatus.AI_ANALYZING:
+            baseline_transcript = (
+                baseline.get("input_transcript")
+                if isinstance(baseline.get("input_transcript"), dict)
+                else {}
+            )
+            if (
+                not baseline_transcript
+                or self._safe_file_evidence(paths["transcript_path"]) != baseline_transcript
+            ):
+                return None
+            with get_connection() as connection:
+                row = connection.execute(
+                    """
+                    SELECT id, clip_count FROM ai_analysis_runs
+                    WHERE task_id = ? AND COALESCE(is_active, 0) = 1
+                    ORDER BY run_number DESC LIMIT 1
+                    """,
+                    (task_id,),
+                ).fetchone()
+            if row and str(row["id"] or "") != str(baseline.get("active_ai_run_id") or ""):
+                provisional = {
+                    "analysis_run_id": str(row["id"]),
+                    "analysis_path": str(paths["analysis_path"]),
+                    "clip_count": int(row["clip_count"] or 0),
+                }
+                outputs = self._checkpoint_outputs(task_id, step, provisional)
+                return self._restore_checkpoint_step(task_id, step, outputs)
+            return None
+        if step == TaskStatus.VIDEO_CUTTING:
+            baseline_candidates = sorted(
+                str(item) for item in baseline.get("selected_candidate_ids") or [] if item
+            )
+            if not baseline_candidates or self._enabled_candidate_ids(task_id) != baseline_candidates:
+                return None
+            with get_connection() as connection:
+                row = connection.execute(
+                    """
+                    SELECT id, run_number FROM cut_runs
+                    WHERE task_id = ? AND COALESCE(is_active, 0) = 1
+                      AND status IN ('completed', 'completed_with_errors')
+                    ORDER BY run_number DESC LIMIT 1
+                    """,
+                    (task_id,),
+                ).fetchone()
+            if row and int(row["run_number"] or 0) > int(baseline.get("max_cut_run_number") or 0):
+                provisional = {
+                    "cut_run_id": str(row["id"]),
+                    "cut_run_number": int(row["run_number"] or 0),
+                }
+                outputs = self._checkpoint_outputs(task_id, step, provisional)
+                return self._restore_checkpoint_step(task_id, step, outputs)
+            return None
+        if step == TaskStatus.SUBTITLE_DRAFTING:
+            from app.services.subtitle_data_service import list_task_tracks
+
+            tracks = list_task_tracks(task_id, ensure=False)
+            source_tracks = [item for item in tracks if item.get("track_type") == "source"]
+            clip_tracks = [item for item in tracks if item.get("track_type") == "clip"]
+            current_track_ids = sorted(str(item.get("id") or "") for item in tracks if item.get("id"))
+            baseline_output_ids = sorted(
+                str(item) for item in baseline.get("output_clip_ids") or [] if item
+            )
+            task = self._get_task(task_id)
+            if (
+                source_tracks
+                and clip_tracks
+                and current_track_ids
+                and self._active_output_ids(task_id) == baseline_output_ids
+                and task.get("status") == TaskStatus.PENDING_SUBTITLE_REVIEW.value
+            ):
+                provisional = {
+                    "status": "pending_subtitle_review",
+                    "source_track_id": str(source_tracks[0].get("id") or ""),
+                    "track_count": len(clip_tracks),
+                    "tracks": clip_tracks,
+                }
+                outputs = self._checkpoint_outputs(task_id, step, provisional)
+                return self._restore_checkpoint_step(task_id, step, outputs)
+            return None
+
+        artifact_by_step = {
+            TaskStatus.PREPARING_SOURCE: paths["task_dir"] / "source" / "source_reference.json",
+            TaskStatus.TRANSCRIBING: paths["transcript_path"],
+            TaskStatus.CLIP_SELECTING: paths["analysis_path"].parent / "auto_selected_clips.json",
+            TaskStatus.METADATA_GENERATING: paths["analysis_path"].parent / "auto_publish_metadata.json",
+            TaskStatus.SCHEDULE_CREATING: paths["analysis_path"].parent / "auto_publish_schedule.json",
+        }
+        artifact = artifact_by_step.get(step)
+        if artifact:
+            if step == TaskStatus.CLIP_SELECTING:
+                baseline_analysis = (
+                    baseline.get("input_analysis")
+                    if isinstance(baseline.get("input_analysis"), dict)
+                    else {}
+                )
+                if (
+                    not baseline_analysis
+                    or self._safe_file_evidence(paths["analysis_path"]) != baseline_analysis
+                ):
+                    return None
+            elif step == TaskStatus.METADATA_GENERATING:
+                baseline_outputs = sorted(
+                    str(item) for item in baseline.get("output_clip_ids") or [] if item
+                )
+                if not baseline_outputs or self._active_output_ids(task_id) != baseline_outputs:
+                    return None
+            elif step == TaskStatus.SCHEDULE_CREATING:
+                baseline_metadata = (
+                    baseline.get("metadata_input")
+                    if isinstance(baseline.get("metadata_input"), dict)
+                    else {}
+                )
+                if (
+                    not baseline_metadata
+                    or self._safe_file_evidence(
+                        paths["analysis_path"].parent / "auto_publish_metadata.json"
+                    )
+                    != baseline_metadata
+                ):
+                    return None
+            current = self._safe_file_evidence(artifact)
+            previous = baseline.get("artifact") if isinstance(baseline.get("artifact"), dict) else {}
+            if current and current != previous:
+                if step == TaskStatus.PREPARING_SOURCE:
+                    provisional = self._read_json_object(artifact)
+                elif step == TaskStatus.TRANSCRIBING:
+                    if not self._has_text_file(artifact):
+                        return None
+                    provisional = {
+                        "source": "checkpoint",
+                        "transcript_path": str(artifact),
+                    }
+                elif step == TaskStatus.CLIP_SELECTING:
+                    payload = self._read_json_object(artifact)
+                    provisional = {**payload, "selection_path": str(artifact)}
+                elif step == TaskStatus.METADATA_GENERATING:
+                    items = self._read_json_list(artifact)
+                    self._validate_metadata_items(items)
+                    provisional = {
+                        "metadata_path": str(artifact),
+                        "metadata_count": len(items),
+                        "need_review_count": sum(
+                            1 for item in items if (item.get("metadata") or {}).get("risk_flags")
+                        ),
+                        "metadata_items": items,
+                    }
+                else:
+                    items = self._read_json_list(artifact)
+                    self._validate_metadata_items(items)
+                    provisional = {"schedule_path": str(artifact), "scheduled_items": items}
+                outputs = self._checkpoint_outputs(task_id, step, provisional)
+                return self._restore_checkpoint_step(task_id, step, outputs)
+        return None
+
+    def _safe_file_evidence(self, path: Path) -> dict:
+        try:
+            return self._file_evidence(path)
+        except (OSError, PipelineCheckpointError):
+            return {}
+
+    def _file_evidence(self, path: Path) -> dict:
+        resolved = path.resolve()
+        if not resolved.exists() or not resolved.is_file():
+            raise PipelineCheckpointError(f"checkpoint 产物不存在：{resolved}")
+        digest = hashlib.sha256()
+        with resolved.open("rb") as source:
+            for chunk in iter(lambda: source.read(1024 * 1024), b""):
+                digest.update(chunk)
+        stat = resolved.stat()
+        return {
+            "path": str(resolved),
+            "size_bytes": int(stat.st_size),
+            "mtime_ns": int(stat.st_mtime_ns),
+            "sha256": digest.hexdigest(),
+        }
+
+    def _verify_file_evidence(self, path: Path, evidence: dict) -> None:
+        if not isinstance(evidence, dict) or not evidence.get("sha256"):
+            raise PipelineCheckpointError(f"checkpoint 缺少文件校验值：{path}")
+        current = self._file_evidence(path)
+        if (
+            current["path"] != str(evidence.get("path") or "")
+            or current["size_bytes"] != int(evidence.get("size_bytes") or -1)
+            or current["sha256"] != str(evidence.get("sha256") or "")
+        ):
+            raise PipelineCheckpointError(f"checkpoint 文件证据已变化：{path}")
+
+    def _read_json_object(self, path: Path) -> dict:
+        try:
+            payload = json.loads(path.read_text(encoding="utf-8"))
+        except (OSError, json.JSONDecodeError) as exc:
+            raise PipelineCheckpointError(f"checkpoint JSON 无法读取：{path}：{exc}") from exc
+        if not isinstance(payload, dict):
+            raise PipelineCheckpointError(f"checkpoint JSON 不是对象：{path}")
+        return payload
+
+    def _read_json_list(self, path: Path) -> list[dict]:
+        try:
+            payload = json.loads(path.read_text(encoding="utf-8"))
+        except (OSError, json.JSONDecodeError) as exc:
+            raise PipelineCheckpointError(f"checkpoint JSON 无法读取：{path}：{exc}") from exc
+        if not isinstance(payload, list) or not all(isinstance(item, dict) for item in payload):
+            raise PipelineCheckpointError(f"checkpoint JSON 不是对象列表：{path}")
+        return payload
+
+    def _validate_metadata_items(self, items: list[dict]) -> None:
+        if not items:
+            raise PipelineCheckpointError("checkpoint 文案/排期列表为空")
+        for item in items:
+            output_clip = item.get("output_clip")
+            metadata = item.get("metadata")
+            if (
+                not isinstance(output_clip, dict)
+                or not output_clip.get("id")
+                or not isinstance(metadata, dict)
+                or not metadata.get("platform")
+            ):
+                raise PipelineCheckpointError("checkpoint 文案/排期条目缺少切片或平台")
+
     def _safe_write_task_summary(self, task_id: str, status: str, error: str) -> dict:
         try:
             return self._write_task_summary(task_id, status, error)
@@ -333,6 +1251,8 @@ def _resolve_start_step(self, task: dict, retry: bool) -> TaskStatus:
         return TaskStatus.PREPARING_SOURCE
 
     def _prepare_source(self, task_id: str, context: dict) -> dict:
+        from app.services.transcription_checkpoint_service import fingerprint_file
+
         task = self._get_task(task_id)
         create_task_directory(task_id, task.get("task_dir_name"))
         source_path = get_source_video_path(task)
@@ -349,6 +1269,7 @@ def _prepare_source(self, task_id: str, context: dict) -> dict:
             "source_path": str(source),
             "exists": source.exists(),
             "size_bytes": source.stat().st_size if source.exists() else 0,
+            "source_fingerprint": fingerprint_file(source),
         }
         reference_path.write_text(json.dumps(reference_payload, ensure_ascii=False, indent=2), encoding="utf-8")
         append_task_log(task_id, f"全自动准备视频完成：{source}")
@@ -380,6 +1301,7 @@ def _run_ai_analysis(self, task_id: str, context: dict) -> dict:
         append_task_log(task_id, f"全自动 AI 分析完成，候选片段：{clip_count} 条")
         return {
             "clip_count": clip_count,
+            "analysis_run_id": result.get("analysis_run_id") or "",
             "analysis_path": result.get("analysis_path") or "",
             "analysis_meta": (result.get("analysis_run") or {}).get("analysis_meta") or {},
         }
@@ -459,6 +1381,7 @@ def _select_clips(self, task_id: str, context: dict) -> dict:
             json.dumps(payload, ensure_ascii=False, indent=2),
             encoding="utf-8",
         )
+        payload["selection_path"] = str(paths["analysis_path"].parent / "auto_selected_clips.json")
         append_task_log(task_id, f"全自动选片完成：选中 {len(selected)} 条，跳过 {len(skipped)} 条")
         return payload
 
@@ -472,7 +1395,13 @@ def _cut_video(self, task_id: str, context: dict) -> dict:
             raise ValueError("全部切片失败，未生成可发布的原视频裁切片段")
         self._write_clip_metadata(task_id, output_clips, metadata_items=[])
         append_task_log(task_id, f"全自动原片切割完成：成功 {len(success)} 条，失败 {len(failed)} 条")
-        return {"success_count": len(success), "failed_count": len(failed), "failed": failed}
+        return {
+            "success_count": len(success),
+            "failed_count": len(failed),
+            "failed": failed,
+            "cut_run_id": result.get("cut_run_id") or "",
+            "cut_run_number": int(result.get("cut_run_number") or 0),
+        }
 
     def _prepare_subtitle_drafts(self, task_id: str, context: dict) -> dict:
         from app.services.subtitle_auto_workflow_service import prepare_task_subtitle_review
@@ -527,7 +1456,11 @@ def _create_schedule(self, task_id: str, context: dict) -> dict:
         schedule_path = paths["analysis_path"].parent / "auto_publish_schedule.json"
         schedule_path.write_text(json.dumps(scheduled_items, ensure_ascii=False, indent=2), encoding="utf-8")
         append_task_log(task_id, f"全自动发送队列准备完成：{len(scheduled_items)} 条，发布时间待发送中心设置")
-        return {"schedule_path": str(schedule_path), "scheduled_items": scheduled_items}
+        return {
+            "schedule_path": str(schedule_path),
+            "scheduled_count": len(scheduled_items),
+            "scheduled_items": scheduled_items,
+        }
 
     def _create_publish_jobs(self, task_id: str, context: dict) -> dict:
         task = self._get_task(task_id)
@@ -801,6 +1734,22 @@ def start_auto_pipeline(
     if background_tasks is not None:
         from app.services import job_service
 
+        if retry:
+            job, requeued = job_service.retry_latest_or_get_active_job(
+                task_id,
+                job_service.JOB_TYPE_AUTO_PIPELINE,
+            )
+            if job:
+                return {
+                    "status": job["status"],
+                    "message": (
+                        "已使用原 Workflow Job 的 checkpoint 重新加入队列。"
+                        if requeued
+                        else "全自动流水线已经在排队或运行。"
+                    ),
+                    "task_id": task_id,
+                    "job_id": job["id"],
+                }
         job, created = job_service.create_or_get_active_job(
             task_id=task_id,
             job_type=job_service.JOB_TYPE_AUTO_PIPELINE,
diff --git a/tests/test_pipeline_checkpoint.py b/tests/test_pipeline_checkpoint.py
new file mode 100644
index 0000000..94320fe
--- /dev/null
+++ b/tests/test_pipeline_checkpoint.py
@@ -0,0 +1,723 @@
+"""P1.3b auto-pipeline checkpoint and restart reconciliation tests."""
+
+from __future__ import annotations
+
+import json
+import shutil
+from pathlib import Path
+from unittest.mock import Mock
+
+import pytest
+
+from app.db.database import get_connection
+from app.models.task import TaskCreate, TaskStatus
+from app.services import job_service, task_service
+from app.services.pipeline_checkpoint_service import (
+    AUTO_PIPELINE_CHECKPOINT_KIND,
+    AutoPipelineCheckpoint,
+    PipelineCheckpointError,
+)
+from app.services.pipeline_engine import PipelineEngine, STEP_STATUSES, start_auto_pipeline
+from app.services.storage_service import get_artifact_paths
+from app.services.task_lifecycle_service import create_task_record
+
+
+@pytest.fixture(autouse=True)
+def cleanup_pipeline_checkpoint_data():
+    """Keep this module's records and artifacts from leaking into later tests."""
+
+    yield
+    pattern = "test-pipeline-checkpoint-%"
+    with get_connection() as connection:
+        task_ids = [
+            str(row["id"])
+            for row in connection.execute(
+                "SELECT id FROM tasks WHERE id LIKE ?",
+                (pattern,),
+            ).fetchall()
+        ]
+        connection.execute("DELETE FROM publish_jobs WHERE task_id LIKE ?", (pattern,))
+        connection.execute("DELETE FROM subtitle_jobs WHERE task_id LIKE ?", (pattern,))
+        connection.execute(
+            """
+            DELETE FROM subtitle_cues WHERE revision_id IN (
+                SELECT revision.id FROM subtitle_revisions AS revision
+                JOIN subtitle_tracks AS track ON track.id = revision.track_id
+                WHERE track.task_id LIKE ?
+            )
+            """,
+            (pattern,),
+        )
+        connection.execute(
+            """
+            DELETE FROM subtitle_revisions WHERE track_id IN (
+                SELECT id FROM subtitle_tracks WHERE task_id LIKE ?
+            )
+            """,
+            (pattern,),
+        )
+        connection.execute("DELETE FROM subtitle_tracks WHERE task_id LIKE ?", (pattern,))
+        connection.execute("DELETE FROM clip_feedback WHERE task_id LIKE ?", (pattern,))
+        connection.execute("DELETE FROM output_clip WHERE task_id LIKE ?", (pattern,))
+        connection.execute("DELETE FROM cut_runs WHERE task_id LIKE ?", (pattern,))
+        connection.execute("DELETE FROM clip_candidates WHERE task_id LIKE ?", (pattern,))
+        connection.execute("DELETE FROM ai_analysis_windows WHERE task_id LIKE ?", (pattern,))
+        connection.execute("DELETE FROM ai_analysis_runs WHERE task_id LIKE ?", (pattern,))
+        connection.execute("DELETE FROM transcription_chunks WHERE task_id LIKE ?", (pattern,))
+        connection.execute("DELETE FROM transcription_runs WHERE task_id LIKE ?", (pattern,))
+        connection.execute("DELETE FROM workflow_jobs WHERE task_id LIKE ?", (pattern,))
+        connection.execute("DELETE FROM tasks WHERE id LIKE ?", (pattern,))
+        connection.commit()
+    for task_id in task_ids:
+        shutil.rmtree(get_artifact_paths(task_id)["task_dir"], ignore_errors=True)
+
+
+def _create_auto_task(task_id: str, *, delivery_mode: str = "original") -> dict:
+    create_task_record(
+        TaskCreate(
+            task_name=task_id,
+            source_type="upload",
+            platform="general",
+            selection_profile="general",
+            auto_mode=True,
+        ),
+        task_id=task_id,
+        task_dir_name=task_id,
+    )
+    with get_connection() as connection:
+        connection.execute(
+            "UPDATE tasks SET auto_config_json = ? WHERE id = ?",
+            (json.dumps({"subtitle_delivery_mode": delivery_mode}), task_id),
+        )
+        connection.commit()
+    return task_service.get_task(task_id, include_video_probe=False)
+
+
+def _claim_auto_job(task_id: str, start_step: TaskStatus, owner: str) -> dict:
+    job = job_service.create_job(
+        task_id=task_id,
+        job_type=job_service.JOB_TYPE_AUTO_PIPELINE,
+        payload={"retry": False, "start_step": start_step.value},
+    )
+    claimed = job_service.claim_job(job["id"], owner)
+    assert claimed is not None
+    return claimed
+
+
+def _checkpoint(
+    engine: PipelineEngine,
+    task: dict,
+    job: dict,
+    start_step: TaskStatus,
+) -> AutoPipelineCheckpoint:
+    return AutoPipelineCheckpoint.load(
+        job_id=job["id"],
+        task_id=task["id"],
+        start_step=start_step.value,
+        run_key=engine._pipeline_run_key(task, engine._load_auto_config(task), start_step),
+        ordered_steps=[step.value for step in STEP_STATUSES],
+    )
+
+
+def _insert_candidate(task_id: str, candidate_id: str, *, clip_key: str | None = None) -> None:
+    now = task_service._now_iso()
+    with get_connection() as connection:
+        connection.execute(
+            """
+            INSERT INTO clip_candidates (
+                id, task_id, clip_key, title, start_time, end_time, duration_seconds,
+                created_at, updated_at
+            ) VALUES (?, ?, ?, 'clip', '00:00:00', '00:00:30', 30, ?, ?)
+            """,
+            (candidate_id, task_id, clip_key or candidate_id, now, now),
+        )
+        connection.commit()
+
+
+def _insert_output_clip(
+    task_id: str,
+    output_id: str,
+    path: Path,
+    *,
+    cut_run_id: str | None = None,
+    clip_candidate_id: str | None = None,
+) -> None:
+    now = task_service._now_iso()
+    with get_connection() as connection:
+        connection.execute(
+            """
+            INSERT INTO output_clip (
+                id, task_id, clip_candidate_id, output_file_path, output_file_name, status,
+                cut_run_id, is_active, created_at, updated_at
+            ) VALUES (?, ?, ?, ?, ?, 'completed', ?, 1, ?, ?)
+            """,
+            (
+                output_id,
+                task_id,
+                clip_candidate_id,
+                str(path),
+                path.name,
+                cut_run_id,
+                now,
+                now,
+            ),
+        )
+        connection.commit()
+
+
+def test_auto_pipeline_checkpoint_is_versioned_and_fenced() -> None:
+    task = _create_auto_task("test-pipeline-checkpoint-envelope")
+    job = _claim_auto_job(task["id"], TaskStatus.PREPARING_SOURCE, "checkpoint-owner")
+    with job_service.job_lease_context(job["id"], "checkpoint-owner", job["lease_token"]):
+        checkpoint = _checkpoint(PipelineEngine(), task, job, TaskStatus.PREPARING_SOURCE)
+        checkpoint.begin_step(TaskStatus.PREPARING_SOURCE.value, baseline={"before": "empty"})
+        checkpoint.complete_step(
+            TaskStatus.PREPARING_SOURCE.value,
+            outputs={"source_reference": {"sha256": "evidence"}},
+        )
+
+    stored = job_service.get_job(job["id"])["checkpoint_json"]
+    assert stored["kind"] == AUTO_PIPELINE_CHECKPOINT_KIND
+    assert stored["completed_steps"] == [TaskStatus.PREPARING_SOURCE.value]
+    assert stored["steps"][TaskStatus.PREPARING_SOURCE.value]["state"] == "succeeded"
+    assert "config" not in stored
+
+    with job_service.job_lease_context(job["id"], "old-owner", "old-token"):
+        with pytest.raises(job_service.JobLeaseLostError):
+            checkpoint.begin_step(TaskStatus.TRANSCRIBING.value)
+
+
+@pytest.mark.parametrize(
+    "raw_checkpoint",
+    ["{broken", {"kind": "future_auto_pipeline_v9"}],
+)
+def test_malformed_or_unknown_checkpoint_fails_closed(raw_checkpoint) -> None:
+    task = _create_auto_task(f"test-pipeline-checkpoint-bad-{type(raw_checkpoint).__name__}")
+    job = _claim_auto_job(task["id"], TaskStatus.PUBLISH_JOB_CREATING, "bad-checkpoint-owner")
+    with get_connection() as connection:
+        value = raw_checkpoint if isinstance(raw_checkpoint, str) else json.dumps(raw_checkpoint)
+        connection.execute(
+            "UPDATE workflow_jobs SET checkpoint_json = ? WHERE id = ?",
+            (value, job["id"]),
+        )
+        connection.commit()
+    engine = PipelineEngine()
+    engine._create_publish_jobs = Mock(side_effect=AssertionError("未知 checkpoint 不得执行 handler"))
+
+    with job_service.job_lease_context(job["id"], "bad-checkpoint-owner", job["lease_token"]):
+        with pytest.raises(PipelineCheckpointError):
+            engine.run(
+                task["id"],
+                start_step=TaskStatus.PUBLISH_JOB_CREATING,
+                job_id=job["id"],
+            )
+
+    engine._create_publish_jobs.assert_not_called()
+    assert task_service.get_task(task["id"], include_video_probe=False)["status"] == TaskStatus.CREATED.value
+
+
+def test_completed_metadata_restores_context_without_regeneration(tmp_path: Path) -> None:
+    task = _create_auto_task("test-pipeline-checkpoint-metadata")
+    paths = get_artifact_paths(task["id"])
+    clip_path = paths["clips_dir"] / "checkpoint-metadata.mp4"
+    clip_path.parent.mkdir(parents=True, exist_ok=True)
+    clip_path.write_bytes(b"video")
+    _insert_output_clip(task["id"], "checkpoint-metadata-output", clip_path)
+    output_clip = task_service.list_output_clips(task["id"])[0]
+    cover_path = paths["covers_dir"] / "checkpoint-cover.jpg"
+    cover_path.parent.mkdir(parents=True, exist_ok=True)
+    cover_path.write_bytes(b"cover")
+    metadata_items = [
+        {
+            "output_clip": output_clip,
+            "metadata": {
+                "platform": "douyin",
+                "title": "checkpoint title",
+                "caption": "checkpoint caption",
+                "hashtags": ["checkpoint"],
+                "risk_flags": [],
+            },
+            "cover": {"cover_file_path": str(cover_path), "cover_time_seconds": 1},
+        }
+    ]
+    metadata_path = paths["analysis_path"].parent / "auto_publish_metadata.json"
+    metadata_path.parent.mkdir(parents=True, exist_ok=True)
+    metadata_path.write_text(json.dumps(metadata_items, ensure_ascii=False), encoding="utf-8")
+
+    engine = PipelineEngine()
+    job = _claim_auto_job(task["id"], TaskStatus.METADATA_GENERATING, "metadata-owner")
+    captured_schedule: list[dict] = []
+    with job_service.job_lease_context(job["id"], "metadata-owner", job["lease_token"]):
+        checkpoint = _checkpoint(engine, task, job, TaskStatus.METADATA_GENERATING)
+        checkpoint.begin_step(TaskStatus.METADATA_GENERATING.value)
+        metadata_result = {
+            "metadata_path": str(metadata_path),
+            "metadata_count": 1,
+            "need_review_count": 0,
+            "metadata_items": metadata_items,
+        }
+        checkpoint.complete_step(
+            TaskStatus.METADATA_GENERATING.value,
+            outputs=engine._checkpoint_outputs(
+                task["id"], TaskStatus.METADATA_GENERATING, metadata_result
+            ),
+        )
+        engine._generate_metadata = Mock(side_effect=AssertionError("metadata 不应重复生成"))
+        original_schedule = engine._create_schedule
+
+        def capture_schedule(task_id: str, context: dict) -> dict:
+            captured_schedule.extend(context[TaskStatus.METADATA_GENERATING.value]["metadata_items"])
+            return original_schedule(task_id, context)
+
+        engine._create_schedule = capture_schedule
+        engine._write_task_summary = Mock(return_value={"summary_path": str(tmp_path / "summary.json")})
+        result = engine.run(
+            task["id"],
+            start_step=TaskStatus.METADATA_GENERATING,
+            job_id=job["id"],
+        )
+
+    assert result["status"] == "ready_to_publish"
+    engine._generate_metadata.assert_not_called()
+    assert captured_schedule[0]["metadata"]["title"] == "checkpoint title"
+    stored = job_service.get_job(job["id"])["checkpoint_json"]
+    metadata_outputs = stored["steps"][TaskStatus.METADATA_GENERATING.value]["outputs"]
+    assert "metadata_items" not in metadata_outputs
+    assert stored["completed_steps"] == [
+        TaskStatus.METADATA_GENERATING.value,
+        TaskStatus.SCHEDULE_CREATING.value,
+        TaskStatus.PUBLISH_JOB_CREATING.value,
+    ]
+    publish_outputs = stored["steps"][TaskStatus.PUBLISH_JOB_CREATING.value]["outputs"]
+    with get_connection() as connection:
+        connection.execute(
+            "UPDATE publish_jobs SET platform = 'bilibili' WHERE id = ?",
+            (publish_outputs["created_ids"][0],),
+        )
+        connection.commit()
+    with pytest.raises(PipelineCheckpointError, match="草稿字段不一致"):
+        engine._restore_checkpoint_step(
+            task["id"],
+            TaskStatus.PUBLISH_JOB_CREATING,
+            publish_outputs,
+        )
+    expected_job = publish_outputs["job_evidence"][0]
+    with get_connection() as connection:
+        connection.execute(
+            "UPDATE publish_jobs SET platform = ?, title = 'tampered title' WHERE id = ?",
+            (expected_job["platform"], publish_outputs["created_ids"][0]),
+        )
+        connection.commit()
+    with pytest.raises(PipelineCheckpointError, match="草稿字段不一致"):
+        engine._restore_checkpoint_step(
+            task["id"],
+            TaskStatus.PUBLISH_JOB_CREATING,
+            publish_outputs,
+        )
+
+
+def test_interrupted_ai_step_reconciles_new_analysis_run_without_provider_call() -> None:
+    task = _create_auto_task("test-pipeline-checkpoint-ai")
+    engine = PipelineEngine()
+    job = _claim_auto_job(task["id"], TaskStatus.AI_ANALYZING, "ai-checkpoint-owner")
+    paths = get_artifact_paths(task["id"])
+    paths["transcript_path"].parent.mkdir(parents=True, exist_ok=True)
+    paths["transcript_path"].write_text(
+        "00:00:00 --> 00:00:30\ncheckpoint transcript",
+        encoding="utf-8",
+    )
+    analysis_payload = {
+        "analysis_summary": "recovered",
+        "analysis_meta": {"provider": "test", "generated_at": task_service._now_iso()},
+        "clips": [{"clip_id": "clip-1", "title": "clip"}],
+    }
+    with job_service.job_lease_context(job["id"], "ai-checkpoint-owner", job["lease_token"]):
+        checkpoint = _checkpoint(engine, task, job, TaskStatus.AI_ANALYZING)
+        checkpoint.begin_step(
+            TaskStatus.AI_ANALYZING.value,
+            baseline=engine._checkpoint_baseline(task["id"], TaskStatus.AI_ANALYZING),
+        )
+        paths["analysis_path"].parent.mkdir(parents=True, exist_ok=True)
+        paths["analysis_path"].write_text(json.dumps(analysis_payload), encoding="utf-8")
+        now = task_service._now_iso()
+        _insert_candidate(task["id"], "checkpoint-ai-clip", clip_key="clip-1")
+        with get_connection() as connection:
+            connection.execute(
+                """
+                INSERT INTO ai_analysis_runs (
+                    id, task_id, run_number, provider, provider_label, model,
+                    requested_clip_count, clip_count, analysis_payload_json,
+                    is_active, created_at
+                ) VALUES ('checkpoint-ai-run', ?, 1, 'test', 'test', 'test', 1, 1, ?, 1, ?)
+                """,
+                (task["id"], json.dumps(analysis_payload), now),
+            )
+            connection.commit()
+        engine._run_ai_analysis = Mock(side_effect=AssertionError("AI Provider 不应重复调用"))
+        engine._select_clips = Mock(side_effect=RuntimeError("stop after AI recovery"))
+        result = engine.run(
+            task["id"],
+            start_step=TaskStatus.AI_ANALYZING,
+            job_id=job["id"],
+        )
+
+    assert result["failed_step"] == TaskStatus.CLIP_SELECTING.value
+    engine._run_ai_analysis.assert_not_called()
+    stored = job_service.get_job(job["id"])["checkpoint_json"]
+    assert stored["completed_steps"] == [TaskStatus.AI_ANALYZING.value]
+    assert stored["steps"][TaskStatus.AI_ANALYZING.value]["recovered"] is True
+
+
+def test_auto_retry_reuses_failed_job_checkpoint_without_provider_call() -> None:
+    task = _create_auto_task("test-pipeline-checkpoint-ai-retry")
+    engine = PipelineEngine()
+    first_job = _claim_auto_job(task["id"], TaskStatus.AI_ANALYZING, "retry-old-owner")
+    paths = get_artifact_paths(task["id"])
+    paths["transcript_path"].parent.mkdir(parents=True, exist_ok=True)
+    paths["transcript_path"].write_text("retry transcript", encoding="utf-8")
+    analysis_payload = {
+        "analysis_summary": "recover after failed job",
+        "analysis_meta": {"provider": "test", "generated_at": task_service._now_iso()},
+        "clips": [{"clip_id": "retry-clip", "title": "retry"}],
+    }
+    with job_service.job_lease_context(
+        first_job["id"],
+        "retry-old-owner",
+        first_job["lease_token"],
+    ):
+        checkpoint = _checkpoint(engine, task, first_job, TaskStatus.AI_ANALYZING)
+        checkpoint.begin_step(
+            TaskStatus.AI_ANALYZING.value,
+            baseline=engine._checkpoint_baseline(task["id"], TaskStatus.AI_ANALYZING),
+        )
+        paths["analysis_path"].write_text(json.dumps(analysis_payload), encoding="utf-8")
+        _insert_candidate(task["id"], "checkpoint-ai-retry-clip", clip_key="retry-clip")
+        now = task_service._now_iso()
+        with get_connection() as connection:
+            connection.execute(
+                """
+                INSERT INTO ai_analysis_runs (
+                    id, task_id, run_number, provider, provider_label, model,
+                    requested_clip_count, clip_count, analysis_payload_json,
+                    is_active, created_at
+                ) VALUES ('checkpoint-ai-retry-run', ?, 1, 'test', 'test', 'test', 1, 1, ?, 1, ?)
+                """,
+                (task["id"], json.dumps(analysis_payload), now),
+            )
+            connection.commit()
+        job_service.mark_job_failed(first_job["id"], "worker exited after provider result")
+
+    queued = start_auto_pipeline(task["id"], background_tasks=object(), retry=True)
+    assert queued["job_id"] == first_job["id"]
+    assert queued["status"] == job_service.JOB_STATUS_QUEUED
+    assert job_service.get_job(first_job["id"])["checkpoint_json"]["current_step"] == (
+        TaskStatus.AI_ANALYZING.value
+    )
+
+    reclaimed = job_service.claim_job(first_job["id"], "retry-new-owner")
+    assert reclaimed is not None
+    engine._run_ai_analysis = Mock(side_effect=AssertionError("AI Provider 不应重复调用"))
+    engine._select_clips = Mock(side_effect=RuntimeError("stop after retry recovery"))
+    with job_service.job_lease_context(
+        reclaimed["id"],
+        "retry-new-owner",
+        reclaimed["lease_token"],
+    ):
+        result = engine.run(
+            task["id"],
+            start_step=TaskStatus.AI_ANALYZING,
+            job_id=reclaimed["id"],
+        )
+
+    assert result["failed_step"] == TaskStatus.CLIP_SELECTING.value
+    engine._run_ai_analysis.assert_not_called()
+    assert job_service.get_job(reclaimed["id"])["checkpoint_json"]["completed_steps"] == [
+        TaskStatus.AI_ANALYZING.value
+    ]
+
+
+def test_job_id_without_active_lease_fails_before_handler() -> None:
+    task = _create_auto_task("test-pipeline-checkpoint-no-lease")
+    job = job_service.create_job(
+        task_id=task["id"],
+        job_type=job_service.JOB_TYPE_AUTO_PIPELINE,
+        payload={"start_step": TaskStatus.AI_ANALYZING.value},
+    )
+    engine = PipelineEngine()
+    engine._run_ai_analysis = Mock(side_effect=AssertionError("无租约不得执行 handler"))
+
+    with pytest.raises(job_service.JobLeaseLostError):
+        engine.run(
+            task["id"],
+            start_step=TaskStatus.AI_ANALYZING,
+            job_id=job["id"],
+        )
+
+    engine._run_ai_analysis.assert_not_called()
+    assert task_service.get_task(task["id"], include_video_probe=False)["status"] == (
+        TaskStatus.CREATED.value
+    )
+
+
+def test_interrupted_transcript_step_reconciles_final_markdown() -> None:
+    task = _create_auto_task("test-pipeline-checkpoint-transcript")
+    engine = PipelineEngine()
+    job = _claim_auto_job(task["id"], TaskStatus.TRANSCRIBING, "transcript-owner")
+    paths = get_artifact_paths(task["id"])
+
+    with job_service.job_lease_context(job["id"], "transcript-owner", job["lease_token"]):
+        checkpoint = _checkpoint(engine, task, job, TaskStatus.TRANSCRIBING)
+        checkpoint.begin_step(
+            TaskStatus.TRANSCRIBING.value,
+            baseline=engine._checkpoint_baseline(task["id"], TaskStatus.TRANSCRIBING),
+        )
+        paths["transcript_path"].parent.mkdir(parents=True, exist_ok=True)
+        paths["transcript_path"].write_text(
+            "00:00:00 --> 00:00:30\ncompleted transcript",
+            encoding="utf-8",
+        )
+        engine._transcribe_or_read_text = Mock(
+            side_effect=AssertionError("最终 Markdown 已存在时不应重复转写")
+        )
+        engine._run_ai_analysis = Mock(side_effect=RuntimeError("stop after transcript recovery"))
+        result = engine.run(
+            task["id"],
+            start_step=TaskStatus.TRANSCRIBING,
+            job_id=job["id"],
+        )
+
+    assert result["failed_step"] == TaskStatus.AI_ANALYZING.value
+    engine._transcribe_or_read_text.assert_not_called()
+    stored = job_service.get_job(job["id"])["checkpoint_json"]
+    assert stored["completed_steps"] == [TaskStatus.TRANSCRIBING.value]
+    assert stored["steps"][TaskStatus.TRANSCRIBING.value]["recovered"] is True
+
+
+def test_interrupted_ai_step_reruns_when_transcript_changed() -> None:
+    task = _create_auto_task("test-pipeline-checkpoint-ai-input-changed")
+    engine = PipelineEngine()
+    job = _claim_auto_job(task["id"], TaskStatus.AI_ANALYZING, "ai-input-owner")
+    paths = get_artifact_paths(task["id"])
+    paths["transcript_path"].parent.mkdir(parents=True, exist_ok=True)
+    paths["transcript_path"].write_text("original transcript", encoding="utf-8")
+    analysis_payload = {
+        "analysis_summary": "stale result",
+        "analysis_meta": {"provider": "test", "generated_at": task_service._now_iso()},
+        "clips": [{"clip_id": "clip-stale", "title": "stale"}],
+    }
+
+    with job_service.job_lease_context(job["id"], "ai-input-owner", job["lease_token"]):
+        checkpoint = _checkpoint(engine, task, job, TaskStatus.AI_ANALYZING)
+        checkpoint.begin_step(
+            TaskStatus.AI_ANALYZING.value,
+            baseline=engine._checkpoint_baseline(task["id"], TaskStatus.AI_ANALYZING),
+        )
+        paths["transcript_path"].write_text("changed transcript", encoding="utf-8")
+        paths["analysis_path"].write_text(json.dumps(analysis_payload), encoding="utf-8")
+        _insert_candidate(task["id"], "checkpoint-ai-stale-clip", clip_key="clip-stale")
+        now = task_service._now_iso()
+        with get_connection() as connection:
+            connection.execute(
+                """
+                INSERT INTO ai_analysis_runs (
+                    id, task_id, run_number, provider, provider_label, model,
+                    requested_clip_count, clip_count, analysis_payload_json,
+                    is_active, created_at
+                ) VALUES ('checkpoint-ai-stale-run', ?, 1, 'test', 'test', 'test', 1, 1, ?, 1, ?)
+                """,
+                (task["id"], json.dumps(analysis_payload), now),
+            )
+            connection.commit()
+        engine._run_ai_analysis = Mock(side_effect=RuntimeError("provider rerun required"))
+        result = engine.run(
+            task["id"],
+            start_step=TaskStatus.AI_ANALYZING,
+            job_id=job["id"],
+        )
+
+    assert result["failed_step"] == TaskStatus.AI_ANALYZING.value
+    assert result["last_error"] == "provider rerun required"
+    engine._run_ai_analysis.assert_called_once()
+    stored = job_service.get_job(job["id"])["checkpoint_json"]
+    assert stored["completed_steps"] == []
+    assert stored["steps"][TaskStatus.AI_ANALYZING.value]["state"] == "failed"
+
+
+def test_interrupted_cut_step_reconciles_active_run_without_ffmpeg(tmp_path: Path) -> None:
+    task = _create_auto_task("test-pipeline-checkpoint-cut")
+    engine = PipelineEngine()
+    job = _claim_auto_job(task["id"], TaskStatus.VIDEO_CUTTING, "cut-checkpoint-owner")
+    paths = get_artifact_paths(task["id"])
+    output_path = paths["clips_dir"] / "run_0001_checkpoint-cut-run" / "clip.mp4"
+    output_path.parent.mkdir(parents=True, exist_ok=True)
+    output_path.write_bytes(b"video")
+    _insert_candidate(task["id"], "checkpoint-cut-candidate")
+    with job_service.job_lease_context(job["id"], "cut-checkpoint-owner", job["lease_token"]):
+        checkpoint = _checkpoint(engine, task, job, TaskStatus.VIDEO_CUTTING)
+        checkpoint.begin_step(
+            TaskStatus.VIDEO_CUTTING.value,
+            baseline=engine._checkpoint_baseline(task["id"], TaskStatus.VIDEO_CUTTING),
+        )
+        now = task_service._now_iso()
+        with get_connection() as connection:
+            connection.execute(
+                """
+                INSERT INTO cut_runs (
+                    id, task_id, run_number, status, is_active, created_at, updated_at
+                ) VALUES ('checkpoint-cut-run', ?, 1, 'completed', 1, ?, ?)
+                """,
+                (task["id"], now, now),
+            )
+            connection.commit()
+        _insert_output_clip(
+            task["id"],
+            "checkpoint-cut-output",
+            output_path,
+            cut_run_id="checkpoint-cut-run",
+            clip_candidate_id="checkpoint-cut-candidate",
+        )
+        engine._cut_video = Mock(side_effect=AssertionError("FFmpeg 不应重复执行"))
+        engine._prepare_subtitle_drafts = Mock(side_effect=RuntimeError("stop after cut recovery"))
+        result = engine.run(
+            task["id"],
+            start_step=TaskStatus.VIDEO_CUTTING,
+            job_id=job["id"],
+        )
+
+    assert result["failed_step"] == TaskStatus.SUBTITLE_DRAFTING.value
+    engine._cut_video.assert_not_called()
+    stored = job_service.get_job(job["id"])["checkpoint_json"]
+    assert stored["completed_steps"] == [TaskStatus.VIDEO_CUTTING.value]
+    assert stored["steps"][TaskStatus.VIDEO_CUTTING.value]["recovered"] is True
+
+
+def test_cut_checkpoint_rejects_empty_file_and_wrong_run() -> None:
+    task = _create_auto_task("test-pipeline-checkpoint-cut-evidence")
+    engine = PipelineEngine()
+    paths = get_artifact_paths(task["id"])
+    output_path = paths["clips_dir"] / "run_0001_checkpoint-cut-evidence" / "clip.mp4"
+    output_path.parent.mkdir(parents=True, exist_ok=True)
+    output_path.write_bytes(b"valid-video-evidence")
+    _insert_candidate(task["id"], "checkpoint-cut-evidence-candidate")
+    now = task_service._now_iso()
+    with get_connection() as connection:
+        connection.execute(
+            """
+            INSERT INTO cut_runs (
+                id, task_id, run_number, status, is_active, created_at, updated_at
+            ) VALUES ('checkpoint-cut-evidence-run', ?, 1, 'completed', 1, ?, ?)
+            """,
+            (task["id"], now, now),
+        )
+        connection.commit()
+    _insert_output_clip(
+        task["id"],
+        "checkpoint-cut-evidence-output",
+        output_path,
+        cut_run_id="checkpoint-cut-evidence-run",
+        clip_candidate_id="checkpoint-cut-evidence-candidate",
+    )
+    outputs = engine._checkpoint_outputs(
+        task["id"],
+        TaskStatus.VIDEO_CUTTING,
+        {"cut_run_id": "checkpoint-cut-evidence-run", "cut_run_number": 1},
+    )
+
+    output_path.write_bytes(b"")
+    with pytest.raises(PipelineCheckpointError, match="文件为空"):
+        engine._restore_checkpoint_step(task["id"], TaskStatus.VIDEO_CUTTING, outputs)
+
+    output_path.write_bytes(b"valid-video-evidence")
+    with get_connection() as connection:
+        connection.execute(
+            "UPDATE output_clip SET cut_run_id = 'another-run' WHERE id = ?",
+            ("checkpoint-cut-evidence-output",),
+        )
+        connection.commit()
+    with pytest.raises(PipelineCheckpointError, match="不属于当前 cut run"):
+        engine._restore_checkpoint_step(task["id"], TaskStatus.VIDEO_CUTTING, outputs)
+
+
+def test_interrupted_cut_step_reruns_when_selection_changed() -> None:
+    task = _create_auto_task("test-pipeline-checkpoint-cut-input-changed")
+    engine = PipelineEngine()
+    job = _claim_auto_job(task["id"], TaskStatus.VIDEO_CUTTING, "cut-input-owner")
+    paths = get_artifact_paths(task["id"])
+    output_path = paths["clips_dir"] / "run_0001_checkpoint-cut-stale" / "clip.mp4"
+    output_path.parent.mkdir(parents=True, exist_ok=True)
+    output_path.write_bytes(b"video")
+    _insert_candidate(task["id"], "checkpoint-cut-old-candidate")
+
+    with job_service.job_lease_context(job["id"], "cut-input-owner", job["lease_token"]):
+        checkpoint = _checkpoint(engine, task, job, TaskStatus.VIDEO_CUTTING)
+        checkpoint.begin_step(
+            TaskStatus.VIDEO_CUTTING.value,
+            baseline=engine._checkpoint_baseline(task["id"], TaskStatus.VIDEO_CUTTING),
+        )
+        now = task_service._now_iso()
+        with get_connection() as connection:
+            connection.execute(
+                "UPDATE clip_candidates SET enabled = 0, updated_at = ? WHERE task_id = ?",
+                (now, task["id"]),
+            )
+            connection.commit()
+        _insert_candidate(task["id"], "checkpoint-cut-new-candidate")
+        with get_connection() as connection:
+            connection.execute(
+                """
+                INSERT INTO cut_runs (
+                    id, task_id, run_number, status, is_active, created_at, updated_at
+                ) VALUES ('checkpoint-cut-stale', ?, 1, 'completed', 1, ?, ?)
+                """,
+                (task["id"], now, now),
+            )
+            connection.commit()
+        _insert_output_clip(
+            task["id"],
+            "checkpoint-cut-stale-output",
+            output_path,
+            cut_run_id="checkpoint-cut-stale",
+            clip_candidate_id="checkpoint-cut-new-candidate",
+        )
+        engine._cut_video = Mock(side_effect=RuntimeError("ffmpeg rerun required"))
+        result = engine.run(
+            task["id"],
+            start_step=TaskStatus.VIDEO_CUTTING,
+            job_id=job["id"],
+        )
+
+    assert result["failed_step"] == TaskStatus.VIDEO_CUTTING.value
+    assert result["last_error"] == "ffmpeg rerun required"
+    engine._cut_video.assert_called_once()
+    stored = job_service.get_job(job["id"])["checkpoint_json"]
+    assert stored["completed_steps"] == []
+    assert stored["steps"][TaskStatus.VIDEO_CUTTING.value]["state"] == "failed"
+
+
+def test_completed_subtitle_checkpoint_keeps_manual_review_gate(tmp_path: Path) -> None:
+    task = _create_auto_task("test-pipeline-checkpoint-subtitle")
+    engine = PipelineEngine()
+    job = _claim_auto_job(task["id"], TaskStatus.SUBTITLE_DRAFTING, "subtitle-checkpoint-owner")
+    with get_connection() as connection:
+        connection.execute(
+            "UPDATE tasks SET status = ? WHERE id = ?",
+            (TaskStatus.PENDING_SUBTITLE_REVIEW.value, task["id"]),
+        )
+        connection.commit()
+    with job_service.job_lease_context(job["id"], "subtitle-checkpoint-owner", job["lease_token"]):
+        checkpoint = _checkpoint(engine, task, job, TaskStatus.SUBTITLE_DRAFTING)
+        checkpoint.begin_step(TaskStatus.SUBTITLE_DRAFTING.value)
+        checkpoint.complete_step(TaskStatus.SUBTITLE_DRAFTING.value, outputs={"track_ids": ["track"]})
+        engine._restore_checkpoint_step = Mock(return_value={"status": "pending_subtitle_review"})
+        engine._prepare_subtitle_drafts = Mock(side_effect=AssertionError("字幕草稿不应重复生成"))
+        engine._generate_metadata = Mock(side_effect=AssertionError("人工审核前不得继续文案步骤"))
+        engine._write_task_summary = Mock(return_value={"summary_path": str(tmp_path / "summary.json")})
+        result = engine.run(
+            task["id"],
+            start_step=TaskStatus.SUBTITLE_DRAFTING,
+            job_id=job["id"],
+        )
+
+    assert result["status"] == "pending_subtitle_review"
+    engine._prepare_subtitle_drafts.assert_not_called()
+    engine._generate_metadata.assert_not_called()
diff --git a/tests/test_pipeline_state_stability.py b/tests/test_pipeline_state_stability.py
index e70cdfd..7ba124b 100644
--- a/tests/test_pipeline_state_stability.py
+++ b/tests/test_pipeline_state_stability.py
@@ -68,17 +68,24 @@ def test_cancel_after_step_does_not_write_ready(monkeypatch):
     job, _created = job_service.create_or_get_active_job(
         task_id=task["id"], job_type=job_service.JOB_TYPE_AUTO_PIPELINE
     )
+    claimed = job_service.claim_job(job["id"], "cancel-after-step-owner")
+    assert claimed is not None
     engine = _engine_for_last_step(monkeypatch, task["id"])
     cancelled = iter([False, True])
     monkeypatch.setattr(job_service, "is_cancel_requested", lambda _job_id: next(cancelled))
     monkeypatch.setattr(job_service, "update_job_progress", Mock())
     monkeypatch.setattr(job_service, "heartbeat_job", Mock())
 
-    result = engine.run(
-        task["id"],
-        start_step=TaskStatus.PUBLISH_JOB_CREATING,
-        job_id=job["id"],
-    )
+    with job_service.job_lease_context(
+        claimed["id"],
+        "cancel-after-step-owner",
+        claimed["lease_token"],
+    ):
+        result = engine.run(
+            task["id"],
+            start_step=TaskStatus.PUBLISH_JOB_CREATING,
+            job_id=job["id"],
+        )
 
     assert result["status"] == "cancelled"
     assert get_task(task["id"], include_video_probe=False)["status"] == TaskStatus.CANCELLED.value
@@ -151,6 +158,19 @@ def test_cancel_between_final_check_and_ready_write_wins(monkeypatch):
     engine = _engine_for_last_step(monkeypatch, task["id"])
     monkeypatch.setattr(job_service, "update_job_progress", Mock())
     monkeypatch.setattr(job_service, "heartbeat_job", Mock())
+    monkeypatch.setattr(
+        engine,
+        "_checkpoint_outputs",
+        Mock(
+            return_value={
+                "created_ids": ["checkpoint-publish"],
+                "skipped_ids": [],
+                "created_count": 1,
+                "skipped_count": 0,
+                "schedule_input": {"sha256": "test"},
+            }
+        ),
+    )
     checks = 0
 
     def cancel_after_final_check(_job_id):
@@ -240,6 +260,59 @@ def test_old_worker_cannot_write_ready_after_lease_takeover():
     assert get_task(task["id"], include_video_probe=False)["status"] == TaskStatus.CREATED.value
 
 
+def test_old_worker_cannot_cancel_publish_draft_after_lease_takeover():
+    task = _create_auto_task("test-pipeline-state-cancel-publish-fence")
+    job, _created = job_service.create_or_get_active_job(
+        task_id=task["id"], job_type=job_service.JOB_TYPE_AUTO_PIPELINE
+    )
+    old_claim = job_service.claim_job(job["id"], "old-cancel-owner")
+    assert old_claim is not None
+    now = task_service._now_iso()
+    with get_connection() as connection:
+        connection.execute(
+            """
+            INSERT INTO output_clip (
+                id, task_id, output_file_path, output_file_name, status,
+                is_active, created_at, updated_at
+            ) VALUES ('pipeline-fenced-output', ?, '', 'clip.mp4', 'completed', 1, ?, ?)
+            """,
+            (task["id"], now, now),
+        )
+        connection.execute(
+            """
+            INSERT INTO publish_jobs (
+                id, task_id, output_clip_id, platform, status, created_at, updated_at
+            ) VALUES ('pipeline-fenced-publish', ?, 'pipeline-fenced-output', 'douyin', 'WAITING', ?, ?)
+            """,
+            (task["id"], now, now),
+        )
+        connection.execute(
+            "UPDATE workflow_jobs SET lease_expires_at = '2000-01-01T00:00:00+00:00' WHERE id = ?",
+            (job["id"],),
+        )
+        connection.commit()
+    new_claim = job_service.claim_job(job["id"], "new-cancel-owner")
+    assert new_claim is not None
+
+    with job_service.job_lease_context(job["id"], "old-cancel-owner", old_claim["lease_token"]):
+        with pytest.raises(job_service.JobLeaseLostError):
+            PipelineEngine()._cancel_unpublished_auto_jobs(
+                task["id"],
+                {
+                    "workflow_job_id": job["id"],
+                    TaskStatus.PUBLISH_JOB_CREATING.value: {
+                        "created": [{"id": "pipeline-fenced-publish"}]
+                    },
+                },
+            )
+
+    with get_connection() as connection:
+        status = connection.execute(
+            "SELECT status FROM publish_jobs WHERE id = 'pipeline-fenced-publish'"
+        ).fetchone()["status"]
+    assert status == "WAITING"
+
+
 def test_expired_cancel_requested_job_is_recovered_as_cancelled():
     task = _create_auto_task("test-pipeline-state-cancel-recovery")
     job, _created = job_service.create_or_get_active_job(