Hardening ahead of the public announcement, from a hostile-input test pass (silent recordings, odd containers, corrupt files, offline machines).
Key fix — warm runs are now zero-network: whisper loads from the local cache first; previously huggingface_hub revalidated metadata against huggingface.co on every model load, even fully cached. Verified by running the full pipeline with all sockets blocked.
Also: tool errors name the binary instead of the full venv path, softer static-ffmpeg log, and the Quickstart now names its one real prerequisite (uv).
Verified graceful in this pass (no changes needed): videos without audio tracks, .webm/.mkv, 2-second clips, unicode filenames, corrupt files (clean exit 2), Intel-mac installs.
Full changelog: CHANGELOG.md