Install verified FFmpeg libraries transactionally

[Blackspirits]

Purpose

Dependent follow-up to #134 ("Pin and verify the FFmpeg shared-library archive").

#134 authenticates the downloaded native-code archive before extraction. This tranche hardens the next boundary: installing those verified DLLs into the active FFmpeg library folder without leaving a partial/hybrid runtime if extraction or replacement fails.

Current upstream SubtitleEdit/subtitleedit main was rechecked at d6917286e355976da953d0ee22208b4bf9461699; its latest delta only changes the mpv preview subtitle margin and does not touch the FFmpeg downloader/installer.

Findings fixed

Failed extraction could leave a mixed FFmpeg installation

ExtractLibraries() previously wrote every /bin/*.dll directly into the active folder with overwrite enabled. Cancellation, disk-full, permissions, AV/file-locking or ZIP failure after some entries had been written could leave new and old FFmpeg DLLs mixed together.

Any single DLL counted as success

The old success condition was only count > 0. The player directly requires avcodec, avformat, avutil, swscale and swresample, so a partial archive could be reported as installed.

Fix

Installation is now a fail-closed transaction:

• extract /bin/*.dll only into private staging;
• reject duplicate flattened leaf names;
• require all five direct runtime DLLs, with names derived from FFmpeg.AutoGen binding-major constants;
• only then begin changing the active folder;
• back up each existing target before replacement;
• on exception or cancellation, remove already-installed new files and restore all originals;
• if rollback itself fails, preserve the backup directory and surface an aggregate error instead of deleting the last recoverable original bytes;
• preserve unrelated target files and continue installing additional trusted /bin/*.dll entries from the verified archive.

Regression coverage

Tests cover complete installation, incomplete archive fail-before-change, cancellation before commit, rollback after the first active DLL has already been replaced, cleanup of staging/backup after successful paths, preservation of unrelated files, and the updated complete-runtime extraction contract.

Scope / branch state

• dependency/base PR: Pin and verify the FFmpeg shared-library archive #134
• base HEAD: 88f1405ec15e2b73d9192c0307cb2efc3da65d3e
• HEAD: dd7e85e4319154aaf3105f85e745509ea902c4dc
• 1 commit
• 4 files
• +349 / -34
• current upstream main checked: d6917286e355976da953d0ee22208b4bf9461699
• audit draft only; no merge/promotion intended

AI assistance: ChatGPT was used for adversarial native-library installation review, transactional staging/rollback design, binding-major validation and focused failure-path regression coverage.

Final CI

Authoritative run: SubtitleEdit#270 on dd7e85e4319154aaf3105f85e745509ea902c4dc

• SeConv: 488 passed / 2 skipped / 0 failed
• LibUiLogic: 905 passed / 0 skipped / 0 failed
• LibSE: 2017 passed / 0 skipped / 0 failed
• UI: 5237 passed / 9 skipped / 0 failed
• build: 0 errors / 7 pre-existing warnings
• retry step skipped
• failure-artifact upload skipped

Final adversarial review was performed on this exact HEAD after CI; no blocker found.

[Blackspirits]

Final adversarial review on exact HEAD dd7e85e4319154aaf3105f85e745509ea902c4dc after authoritative CI SubtitleEdit#270. Rechecked staging/validation/commit ordering, cancellation boundaries, partial replacement rollback, preservation of unrelated target files, duplicate flattened leaf-name rejection, binding-major-derived required DLL names, and the fail-closed path when rollback itself fails. The active FFmpeg folder is not touched until all five directly required runtime libraries are present; handled commit failures restore prior bytes. No correctness blocker found. PR remains draft; no merge/promotion performed.