v4.7.1 - Agent Recovery, Local Voice Options & Runtime Reliability

v4.7.1 - Agent Recovery, Local Voice Options & Runtime Reliability

This patch release builds on v4.7.0 with focused agent-orchestration,
local-voice, channel-startup, model-readiness, memory-cache, and release-
validation fixes. It lets parallel child Agents work in explicitly assigned
local folders, restores interrupted parents safely after detached shell work,
adds an explicit offline SenseVoice transcription option, makes Telegram and
remote-access startup degrade cleanly, trusts Ollama's native tool-capability
metadata, and hardens Docker smoke diagnostics without weakening local-first,
approval, or credential boundaries.

Agent Workspaces, Shell Completion And Restart Recovery

• Folder-scoped child workspaces - adds developer_workspace_path to
  delegate_work, registers an existing local folder as the child's Developer
  workspace, rejects missing paths and conflicting workspace-id/path inputs,
  and keeps the assignment scoped to that child run.
• Independent parallel writers - keys write ownership to each assigned
  Developer workspace so child Agents in distinct folders can edit
  concurrently while children assigned to the same folder still serialize.
• Durable first-delegation state - records the original parent's safe
  configurable runtime fields, enabled tools, model, approval mode, and
  delivery context when asynchronous orchestration begins, excluding
  non-serializable internal graph callbacks.
• Checkpoint-safe parent repair - closes only unanswered tool calls after
  an app restart, marks them as interrupted rather than replaying them, and
  resumes the original parent from its saved checkpoint when retained required
  child results are ready.
• Legacy recovery compatibility - can wake and complete an interrupted v2
  parent whose children already finished even when older orchestration rows do
  not contain the newly persisted continuation snapshot.
• Detached-process completion - captures owned subprocess output in
  temporary files so a deliberately detached descendant cannot keep inherited
  stdout or stderr pipes open and indefinitely block its parent Agent or shell
  workspace lock.
• Bounded cancellation and timeout drain - preserves partial output and
  cancellation status, terminates the owned process tree, and avoids a second
  unbounded communicate() wait after timeout.

Optional Local SenseVoice Transcription

• FunASR / SenseVoice choice - adds SenseVoice Small as a selectable local
  speech-to-text model for Talk and Dictation alongside faster-whisper, with
  the selected local model applied consistently when either voice mode starts.
• Explicit installation only - keeps readiness checks, startup, and normal
  transcription cache-only; the approximately 940 MB ModelScope snapshot is
  downloaded only from the Voice settings action.
• Verified offline snapshot - accepts only a complete model inside
  Row-Bot's SenseVoice cache, persists the verified path across restarts, runs
  CPU inference against that local path, and disables FunASR update checks.
• Recoverable status and setup - distinguishes unsupported platforms,
  missing packages, missing model data, and invalid snapshots; exposes clear
  install or reinstall guidance without making the model appear ready early.
• Transparent network boundary - discloses the ModelScope download, model
  size, license, and SDK user-agent before installation; no audio, prompts, or
  usage data are sent, and regular transcription remains offline.
• Platform guard - keeps SenseVoice unavailable on Intel macOS, where the
  matching CPU PyTorch and Torchaudio wheels are not published, while leaving
  local Whisper available.

Telegram, Tunnel And Startup Resilience

• Retryable Telegram initialization - retries one transient Telegram
  network failure and gives polling one bootstrap retry without looping on an
  invalid token.
• Clean failed-start recovery - shuts down every partially initialized
  Telegram component best-effort, clears global lifecycle state, surfaces a
  safe actionable invalid-token error, and permits a fresh start afterwards.
• Non-blocking command registration - starts polling before registering
  the BotFather command menu so a registration failure cannot take a working
  bot offline.
• Responsive tunnel auto-start - shows an explicit startup stage and moves
  main-app tunnel creation off the UI event loop so slow tunnel setup does not
  freeze the startup experience.
• Reliable splash completion - treats the /readyz HTTP success status as
  the readiness contract instead of requiring a JSON body that the public
  readiness boundary does not promise.
• Credential-safe channel diagnostics - records only the channel name and
  exception type for manual start failures while preserving the existing
  user-facing error notification.

Ollama Readiness And Docker Release Validation

• Native Ollama capabilities - consumes the daemon-reported
  capabilities list when available, allowing new or unknown model families
  that advertise tools to enter Agent mode without an unnecessary live
  round-trip probe.
• Authoritative negative detection - does not mark a familiar family as
  tool-capable when Ollama explicitly omits tools; an explicit boolean
  capability remains highest priority and the maintained family table remains
  the fallback only when native metadata is absent.
• Stable container readiness - requires two consecutive successful
  /healthz and /readyz samples and gives every functional Docker smoke
  request a configurable timeout.
• Safe transient HTTP retry - retries short-lived transport failures only
  for idempotent GET checks after restarts or recreation and never replays
  invitation claims, refreshes, or other POST operations.
• Actionable secret-safe failures - reports the failed stage, HTTP method,
  path, and exception type, then emits bounded container state and log-tail
  diagnostics with exact smoke-owned invitation, session, and encryption
  values redacted.

Memory, Dependencies And Public Documentation

• Consistent embedding snapshots - applies the same GGUF, ONNX, and
  OpenVINO ignore filters during cache-only local-embedding lookup as during
  explicit download, preventing a valid cached snapshot from being
  misidentified or resolved differently.
• Voice runtime dependency verification - adds FunASR, ModelScope,
  matching CPU PyTorch/Torchaudio packages, lockfile coverage, installer export
  coverage, and platform-aware import verification to the voice and all extras.
• Security dependency cleanup - updates the Python, documentation-site,
  and WhatsApp bridge resolutions, upgrades the supported arXiv,
  Hugging Face/Transformers, and pytest lines, pins vulnerable documentation
  transitive packages where compatible, and narrows OSV exceptions to the
  remaining reviewed packages without compatible fixes.
• 4.7 public-site alignment - updates the post-tag landing, Features, and
  Architecture pages and their contracts to the v4.7.0 downloads, metadata,
  cache revisions, progressive capability loading, context management, and
  trusted-address descriptions.
• README voice disclosure - documents the SenseVoice option, explicit
  ModelScope download, offline inference boundary, Intel macOS limitation, and
  FunASR acknowledgement.
• 4.7.1 release documentation - updates the full README and architecture
  reference, public Voice, Remote Access, Agents, Developer, Channels, Ollama,
  and Docker guides, generated reference/search artifacts, installer build
  notes, marketing support pages, and release-version metadata while leaving
  the separately staged landing index.html unchanged.

Tests And Release Validation

• Agent recovery coverage - verifies folder registration, invalid workspace
  inputs, independent writer locks, first-delegation snapshots, orphan-only
  checkpoint repair, terminal-child parent wakeup, detached descendants,
  bounded timeout cleanup, cancellation output, and shell lock release.
• Voice coverage - verifies no-download startup and transcription,
  explicit snapshot installation, persisted and contained model paths,
  incomplete-cache recovery, package/platform status, catalog readiness,
  Talk/Dictation selection, dependency metadata, and settings disclosures.
• Telegram lifecycle coverage - verifies one-retry success, exhausted
  network cleanup, invalid-token handling, non-fatal command registration, and
  a clean restart after partial initialization failure.
• Provider and Docker coverage - verifies Ollama native positive, negative,
  and explicit-override precedence plus Docker readiness stability, GET-only
  retries, POST no-replay, functional request deadlines, bounded diagnostics,
  and credential redaction.
• Documentation contracts - verifies the staged v4.7.1 support-page
  downloads and metadata alongside the unchanged v4.7.0 landing page,
  evergreen feature inventory, generated references, architecture copy,
  internal links, responsive fallbacks, and analytics boundaries.

Breaking Changes And Caveats

• No application data migration or public CLI break is introduced by v4.7.1.
• SenseVoice requires an explicit approximately 940 MB ModelScope download and
  is not supported on Intel macOS. Local Whisper remains the default and the
  fallback local transcription path.
• Separate developer_workspace_path folders permit independent child writer
  locks; changing only a shell working directory does not. Existing folders
  are registered, never created implicitly, and the same folder still permits
  only one child writer at a time.
• A detached command is considered complete when the directly launched process
  exits. Row-Bot does not adopt or later cancel an intentionally detached
  descendant that has left the owned process group.
• Docker smoke transport retries remain deliberately limited to GET requests;
  non-idempotent access and session operations fail without replay.
• The remaining temporary OSV exceptions cover only reviewed dependency
  versions without a compatible fixed line and expire on September 30, 2026.

schema: 1
files:
  Row-Bot-4.7.1-Linux-x86_64.tar.gz: sha256=6a88dc3899de8f8ab47fcc65cd9ce32eab4386bd7ddc060e77d28145793a582b
  Row-Bot-4.7.1-Windows-x64.exe: sha256=d4ffc96b958f1d227c58ecdb895167cc0761521074f969a089a63bad48cc395e
  Row-Bot-4.7.1-macOS-arm64.dmg: sha256=b645d044f9241094cde559ae35b3d5cdfc46abaabfa521ae53d21d3561a09e10