v0.11.8

Internal release — admin and pipeline only. Nothing user-facing changed, so there is no in-app "What's new" entry (per docs/workflows/deploy-flow.md: a release that is all plumbing gets none).

Per-show publish switch (#543)

content_sources.social_enabled — an operator toggle in the admin 內容來源 table, independent of active. When off, that show's episodes are never published anywhere, while the show keeps being ingested and keeps feeding the site.

Enforced at every outbound path:

• Threads and Facebook publishers, batch scan and single-episode admin publish
• the three syndication endpoints (方格子, Substack, and the combined one)
• the pipeline, which skips the social-copy LLM call and the Marp card render outright, so a muted show costs nothing rather than generating output that is later refused

Every check fails open: an unreachable platform or a DB blip keeps publishing rather than silently muting every show.

Live on production with 財經一路發 and M觀點 muted.

Pipeline reliability

• #545 — ingest TimeoutStartSec 2h → 5h. systemd had been SIGTERMing healthy runs mid-episode: runs straddle the old ceiling (one finished cleanly at 1h20, the next hit the wall at 2h). The ceiling still guards against a wedged run holding the timer; it now sits above the real envelope and below the timer's 6h cadence.
• #546 — a 404 on episode audio is no longer retried three times. Two back-catalogue episodes whose source audio was deleted had been burning three requests each on every tick. 408 and 429 stay on the retry path.

Verification

• Both prod workflows green; api.tinboker.com/health healthy on the first poll
• tinboker-backend-prod on ghcr.io/haoweichan/tinboker-backend:v0.11.8, RestartCount=0
• Smoke suite 10/10 against api.tinboker.com + tinboker.com
• Two consecutive ingest ticks now reach Deactivated successfully (1h45 and 1h34) instead of Failed with result 'timeout'