Validate WinMM hardening on integrated FFmpeg audio core

[Blackspirits]

Purpose

Integration-only validation of the audited FFmpeg Windows/WinMM audio sink hardening on top of the integrated audio-core stack #147.

The base is #147, so it already composes:

• Fix FFmpeg EOF handling for unknown durations #116/Fix FFmpeg fallback duration for selected streams #120 unknown-duration EOF and selected-stream duration;
• Fail closed when FFmpeg seek fails #117/Make FFmpeg audio-track switching transactional #121 transactional seek and audio-track switching;
• Preserve FFmpeg position when playback speed changes #118 speed-position preservation;
• audio EAGAIN ownership from Retry FFmpeg decoder packets rejected with EAGAIN #119;
• Fence FFmpeg audio writes by seek serial #125/Fail closed when native FFmpeg audio reset fails #128/Fail closed when Core Audio queue cannot start #130 serial/reset/start fencing;
• Fall back to wall clock after FFmpeg audio sink failure #144 wall-clock failover and decode-only continuation after output failure.

This integration commit layers the Windows-specific audited behavior from:

• Handle alternate WinMM playback position formats #126: normalize TIME_SAMPLES/TIME_BYTES/TIME_MS position formats and 32-bit wrap;
• Fail closed when WinMM output setup is incomplete #129: fail closed when WinMM event/header preparation is incomplete;
• Retain WinMM buffers when teardown cannot reclaim them #131: retain native buffers/events when reset/unprepare/close cannot safely reclaim them.

It is audit evidence only and is not a merge candidate.

Current upstream SubtitleEdit/subtitleedit main was rechecked at 2998aeedbc39a3a5a1c19269c2464122df1aa66b; the newer upstream changes remain outside the FFmpeg player/sinks.

Composition invariants

1. Seek serial remains the ownership fence.
   Fail closed when native FFmpeg audio reset fails #128's Reset(int serial) remains intact: generation advances first, the accepted serial is set to rejected before native reset, and a new serial is published only after successful waveOutReset.

2. Position-format hardening does not weaken reset semantics.
   Handle alternate WinMM playback position formats #126's position normalization/wrap tracking is reset only after native reset succeeds.

3. Open is all-or-nothing.
   Fail closed when WinMM output setup is incomplete #129 verifies the event handle and every waveOutPrepareHeader; all headers are initialized before any partial cleanup can inspect them.

4. Write remains copy+enqueue atomic against Reset.
   The Fence FFmpeg audio writes by seek serial #125 critical section and serial/generation checks remain unchanged while the Handle alternate WinMM playback position formats #126 position logic is layered around them.

5. Teardown is fail closed.
   Retain WinMM buffers when teardown cannot reclaim them #131 frees no header/data buffer while WinMM still reports reset/unprepare/close failure.

6. Retryable native cleanup is preserved.
   A later Open/Dispose can retry retained WinMM state instead of using/freing a half-reclaimed device boundary.

7. Clock position is monotonic across driver format changes.
   Samples/bytes/ms replies are normalized to bytes and format-switch rounding cannot manufacture a 32-bit wrap jump.

Deliberate residual finding

This integration does not yet solve native clock-query health.

Both WinMM and Core Audio currently return their last known playback position when the native clock API itself fails. That is safer than returning garbage, but it means the player cannot distinguish “temporarily unchanged clock” from “clock query is no longer valid”.

A separate follow-up will expose clock validity explicitly so persistent waveOutGetPosition / AudioQueueGetCurrentTime failure can trigger the #144 wall-clock failover without timeout heuristics.

Scope / branch state

• PR base: Validate integrated FFmpeg audio core hardening stack #147
• base HEAD: 017540a328cfb460a90cd3b6bace32d698edb1c7
• integration HEAD: fd98fcc6bce4c01845ddff9b1ad5d35757478c99
• 1 integration commit
• 2 changed files
• source integrations: Handle alternate WinMM playback position formats #126, Fail closed when WinMM output setup is incomplete #129, Retain WinMM buffers when teardown cannot reclaim them #131
• current upstream main checked: 2998aeedbc39a3a5a1c19269c2464122df1aa66b
• evidence only; no merge/promotion intended

Acceptance

• full restore/build/test suite must pass on this exact integrated tree;
• no new warning;
• retry step must remain unused;
• final adversarial review must confirm the seven invariants above and keep the clock-health gap explicitly open.

AI assistance: ChatGPT was used for cross-branch WinMM reconciliation, serial/reset/open/teardown invariant review, and integration acceptance design.

Final CI

Authoritative run: SubtitleEdit#292 on fd98fcc6bce4c01845ddff9b1ad5d35757478c99

• SeConv: 488 passed / 2 skipped / 0 failed
• LibUiLogic: 905 passed / 0 skipped / 0 failed
• LibSE: 2017 passed / 0 skipped / 0 failed
• UI: 5288 passed / 9 skipped / 0 failed
• build: 0 errors / 7 pre-existing warnings
• retry step skipped
• failure-artifact upload skipped

The first integrated run SubtitleEdit#290 exposed one integration-only duplicate-using warning in WaveOutAudioSink. That warning was removed, the branch was re-compacted to one commit, and SubtitleEdit#292 is the authoritative clean run.

Final adversarial integration review was performed on this exact HEAD after CI; all seven WinMM composition invariants remain satisfied.

[Blackspirits]

Final adversarial integration review on fd98fcc6bce4c01845ddff9b1ad5d35757478c99 after CI SubtitleEdit#292: no blocker found. Verified serial-fenced Reset(int), position-format/wrap normalization, all-or-nothing WinMM open, atomic copy+enqueue vs Reset, fail-closed teardown, retryable retained native cleanup, and monotonic position across driver format changes. The only new warning seen in superseded CI SubtitleEdit#290 was a duplicate using introduced by integration; it was removed before SubtitleEdit#292. Native clock-query health remains explicitly open for the follow-up. No merge/promotion performed.