Changelog

All notable changes to this project are documented in this file.

Unreleased

Private-LAN Audnexus metadata and chapter retrieval from Discovery at 192.168.86.168:3333, with independent metadata/chapter approval.
Exact-runtime publisher chapters, conservative silence-guided alignment, and deterministic silence-only chapter candidates with detailed preview reasons.
Bounded FFmpeg silence analysis across sorted multi-track input and a deterministic container smoke fixture covering real detector integration.
Persistent conversion progress for converting, chapter application, validation, and final moves, with elapsed time, observable output size, terminal status, and mirrored log records.

Plain HTTP Audnexus URLs accept only literal RFC1918 IPv4 or loopback addresses. Public addresses, hostnames, credentials, paths, queries, fragments, and redirects remain rejected.
Remote cover downloads remain HTTPS-only and bounded despite private HTTP API access.

Documented Discovery configuration, chapter thresholds, known limitations, real-ASIN Enterprise-D acceptance, explicit approval, and absence of invented percentage or ETA.
Documented five-second progress cadence, cancellation behavior, persistent log location, and filesystem-only observation of growing output.

Keyboard-driven SSH workflow for scanning MP3 books, previewing metadata and chapters, and requiring exact typed approval before conversion or review.
Shell-free m4b-tool conversion planning, ffmetadata chapter application, output probing, timestamped persistent logs, and safe recovery of stale work.
Collision-safe ready, done, and review transitions with verified cross-filesystem moves.
Optional unauthenticated Audnexus ASIN lookup with bounded timeouts and local metadata fallback, bounded response/download bodies, validated external fields, and accepted-cover staging.
Pinned Docker/Compose packaging, numeric UID/GID execution, diagnostics, a synthetic container smoke test, and Enterprise-D operator documentation.

Root containment and symlink checks protect configured filesystem boundaries.
Configuration paths are absolute/canonical and media roots cannot overlap one another or persistent state/work roots.
Source and track symlinks are rejected before probing; manual chapter paths are derived only from the selected book.
Cross-device temporary copies are cleaned best-effort on caught failure and supported crash-left .moving-* artifacts participate in explicit recovery.
Existing outputs and workflow destinations are never overwritten.
Conversion, review, and full stale cleanup require explicit operator tokens.

Local Python verification is recorded in the release report.
Docker configuration, build, doctor, and smoke acceptance remain pending on Enterprise-D because Docker was unavailable in the authoring environment.