Validate integrated FFmpeg video hardening stack

[Blackspirits]

Purpose

Integration-only validation of the current FFmpeg video hardening stack.

The base is #145, so it already includes:

• Retry FFmpeg decoder packets rejected with EAGAIN #119: EAGAIN-safe decoder packet ownership/retry for video and audio;
• Replay FFmpeg video after fatal hardware send failures #122: software replay after fatal hardware send failure;
• Wait for a fresh FFmpeg replay serial after hardware fallback #145: reject compressed packets older than the hardware-fallback replay serial.

This integration commit layers the final audited behavior from:

• Fail closed when FFmpeg seek fails #117: transactional native seek / failed-seek rollback / EOF+Play seek guards;
• Do not recycle FFmpeg frames removed by seek flush #132: dispose queued frames on seek flush instead of recycling objects the presenter may still reference;
• Fence FFmpeg frame publication by seek serial #133: publish a frame only while holding the seek-serial fence, with callbacks outside the seek lock;
• Release detached FFmpeg seek frame on video-loop exit #141: return detached lastDropped seek frames on every video-loop exit.

It is audit evidence only and is not a merge candidate.

Current upstream SubtitleEdit/subtitleedit main was rechecked at 6c6b83dd043d8d38fb7a2b1800fdb9465526833b; the current upstream delta is Burn-in/encoder-settings work and does not touch this player stack.

Why this integration matters

These fixes all manipulate the same three pieces of state at different layers:

• seek serials;
• queued/peeked/published video frames;
• fresh software-decoder state after hardware fallback.

Passing them independently is not sufficient to prove that their lock/order assumptions still compose.

Invariants validated by this tree

1. Hardware fallback never feeds old compressed packets into the fresh software decoder.
   Wait for a fresh FFmpeg replay serial after hardware fallback #145's replay-serial gate remains before decoder serial switching and packet send.

2. Native seek failure does not falsely commit replay state.
   Fail closed when FFmpeg seek fails #117 makes PerformSeek transactional. If the hardware-replay seek itself fails, the committed old serial is preserved; Wait for a fresh FFmpeg replay serial after hardware fallback #145 therefore keeps rejecting old-serial packets. This is deliberately fail-closed.

3. Successful seek commits the serial before old decoded frames can publish.
   Fence FFmpeg frame publication by seek serial #133's ShowFrame holds the same seek lock used to commit _currentSerial.

4. Seek flush cannot recycle an object still held by the presenter.
   Do not recycle FFmpeg frames removed by seek flush #132 disposes queued frames rather than immediately pooling them.

5. Detached seek-frame ownership is closed on every video-loop exit.
   Release detached FFmpeg seek frame on video-loop exit #141 returns lastDropped from finally.

6. EAGAIN ownership from Retry FFmpeg decoder packets rejected with EAGAIN #119 is preserved.
   The integration does not alter retained/retried packet ownership or exact-once freeing.

Integration reconciliation

Three textual overlaps required manual reconciliation:

• Fail closed when FFmpeg seek fails #117 tests vs the later Retry FFmpeg decoder packets rejected with EAGAIN #119/Replay FFmpeg video after fatal hardware send failures #122 test block;
• Fence FFmpeg frame publication by seek serial #133 helper placement vs the Retry FFmpeg decoder packets rejected with EAGAIN #119/Wait for a fresh FFmpeg replay serial after hardware fallback #145 helpers;
• Release detached FFmpeg seek frame on video-loop exit #141's lastDropped declaration vs Wait for a fresh FFmpeg replay serial after hardware fallback #145's minimumReplaySerial.

These were resolved by semantic intent, not line-number preference.

During pre-PR adversarial review the first reconstruction also caught and corrected one integration-only regression: the else if (!_playing) _pausedPosition = frame.Pts branch from final #133 had initially been omitted while rebuilding ShowFrame. The current HEAD restores it exactly before this PR was opened.

Scope / branch state

• PR base: Wait for a fresh FFmpeg replay serial after hardware fallback #145
• base HEAD: ed2e6129d4c84ed0651941331e080dcc559050f1
• integration HEAD: 0d5b86186568ff1e9dcda42c30e6190ff00ce048
• 1 integration commit
• 4 changed files
• source integrations: Fail closed when FFmpeg seek fails #117, Do not recycle FFmpeg frames removed by seek flush #132, Fence FFmpeg frame publication by seek serial #133, Release detached FFmpeg seek frame on video-loop exit #141
• current upstream main checked: 6c6b83dd043d8d38fb7a2b1800fdb9465526833b
• evidence only; no merge/promotion intended

AI assistance: ChatGPT was used to perform the cross-branch semantic reconciliation, detect the initial paused-position integration omission, and design the integration acceptance review.

Final CI

Authoritative run: SubtitleEdit#285 on 0d5b86186568ff1e9dcda42c30e6190ff00ce048

• SeConv: 488 passed / 2 skipped / 0 failed
• LibUiLogic: 905 passed / 0 skipped / 0 failed
• LibSE: 2017 passed / 0 skipped / 0 failed
• UI: 5250 passed / 9 skipped / 0 failed
• build: 0 errors / 7 pre-existing warnings
• retry step skipped
• failure-artifact upload skipped

Final adversarial review was performed on this exact integrated HEAD after CI; all six composition invariants above remain satisfied.

[Blackspirits]

Final adversarial integration review on 0d5b86186568ff1e9dcda42c30e6190ff00ce048 after CI SubtitleEdit#285: no blocker found. Verified replay-serial filtering precedes decoder serial/send, failed seeks do not falsely commit replay state, successful seek serial commit composes with #133 publication fencing, #132 prevents flush-time object reuse, #141 closes detached lastDropped ownership, and #119 EAGAIN packet ownership/freeing remains unchanged. The pre-PR paused-position omission was corrected before this run. Evidence-only PR; no merge/promotion performed.