[iamwavecut]

Requests to generate a track with supplied lyrics could fail before reaching the music provider. The director rejected short or mixed-language lyrics, and a malformed tag-list response stopped the model fallback chain. The failure explainer then treated the original song request as a new task with tools disabled and could claim that music generation was unsupported.

Validate supplied lyrics against the original user message before exempting them from generated-song structure and script checks. Keep the size limit and strict validation for unrelated generated text. Treat song payload decode errors as retryable provider protocol errors. Give the failure explainer an explicit delivery-reporting task, preserving partial-delivery semantics. Instruct the director to keep supplied lyrics without added verses or repetitions.

Validation: both regressions failed before the fix. cargo test --locked -p openplotva-media -p openplotva-llm -p openplotva-app passed (1,734 tests, 9 ignored). cargo clippy --workspace --all-targets -- -D warnings, cargo fmt --all -- --check, and git diff --check passed.

The existing dependency audit blocked CI on RUSTSEC-2026-0414. Update pulldown-cmark from 0.13.4 to 0.13.5. The rerun passed 1,971 tests (9 ignored), workspace Clippy, and cargo audit with the repository's existing optional-MySQL advisory exclusion.

Live verification: replayed the failed director output through the fixed validator. A fresh request to the configured director returned validated material with the supplied words intact. ACE-Step generated a 69.96-second MP3 from that material (1,612,220 bytes, 48 kHz stereo, inspected with macOS afinfo). A separate failure-notice probe no longer denied the bot's music capability. These probes did not send a Telegram message.

[github-actions]

	Warnings
⚠️	Prompt files are cache-sensitive contracts; confirm prompt shape and role markers were preserved intentionally.

	Messages
📖	Danger checked 8 changed file(s).

Generated by 🚫 dangerJS against 475bbc6

[iamwavecut]

The song director keeps the existing system/user role markers, template inputs, schema, and output shape. The new instruction only prioritizes supplied lyrics over generated-song length and rhyme rules. The updated prompt passed a live director probe using the failed request: the output contained only the supplied words and passed validation. The failure-notice probe also stopped claiming that music generation was unsupported.

The dependency gate found RUSTSEC-2026-0414 in the existing pulldown-cmark 0.13.4. The follow-up commit updates it to 0.13.5 and reruns Telegram tests and the dependency audit.