Validate integrated FFmpeg library delivery stack

[Blackspirits]

Purpose

Integration-only validation of the audited FFmpeg library delivery + runtime availability stack.

The base is #136, so it already includes:

• Pin and verify the FFmpeg shared-library archive #134: pinned/reviewed Windows x64 shared-library archive with SHA-256 verification;
• Install verified FFmpeg libraries transactionally #135: staging + validation + transactional install + rollback;
• Cancel FFmpeg library work when the dialog closes #136: dialog close/cancel uses the same cancellation token and cleans the temporary ZIP.

This integration commit layers:

• Gate FFmpeg library download to Windows x64 #137: one Windows+x64 capability contract shared by the service and Settings UI;
• Probe the full FFmpeg native library stack #127: runtime availability probes every native FFmpeg library actually used and verifies each ABI major.

It is audit evidence only and is not a merge candidate.

Current upstream SubtitleEdit/subtitleedit main was rechecked at dda1fce8f9d4a605b1b6732acc072c7109dc6323; the current upstream changes do not touch this FFmpeg delivery/runtime path.

End-to-end contract validated

1. Package identity

The Windows package is not a moving latest URL.

• release tag is pinned;
• asset is ffmpeg-n9.0.1-…-win64-lgpl-shared-9.0.zip;
• FfmpegLibraries.MajorVersion is 9.0;
• the exact archive SHA-256 is pinned and verified before extraction;
• mismatch removes the downloaded archive and fails closed.

2. Platform capability

A single service-owned capability defines support:

• Windows x64 -> supported;
• Windows ARM64/x86 -> unsupported;
• non-Windows -> unsupported by this downloader.

Settings consumes the same capability, so it cannot advertise an action that the service will deterministically reject.

3. Transactional installation

The verified ZIP is extracted only into a staging directory.

Before the active library folder is touched, staging must contain exactly the five runtime library families the player uses:

• avcodec;
• avformat;
• avutil;
• swscale;
• swresample.

The required Windows filenames are derived from the same FFmpeg.AutoGen major constants used by the runtime bindings.

Install then commits with per-file backup. Any exception/cancellation rolls back already-replaced files; rollback failure preserves the backup directory rather than pretending success.

4. Dialog/work lifetime

Closing through Cancel/Escape/title-bar X:

• cancels the same token used by download/hash/install;
• stops progress work;
• waits asynchronously for the downloader to release the ZIP before deletion;
• does not leave the window detached while native-library installation continues unowned.

5. Runtime availability is stronger than file presence

FfmpegLibraries.IsAvailable() does not treat a single avcodec file or a successful avutil call as proof that the player can run.

It loads/probes:

• avcodec_version();
• avformat_version();
• avutil_version();
• swscale_version();
• swresample_version().

Every returned major must match the FFmpeg.AutoGen constants before the player is reported available.

Thus the install contract and runtime contract use the same five library families and the same generated ABI majors.

Regression coverage inherited by this integrated tree

• reviewed URL/tag/asset/digest;
• hash match keeps the file;
• hash mismatch throws and deletes it;
• Windows x64 capability matrix;
• complete archive commits required DLLs and preserves unrelated files;
• incomplete archive leaves existing installation untouched;
• mid-commit failure rolls back an already-replaced DLL;
• cancellation before commit leaves the active installation untouched;
• closing the dialog cancels pending download;
• temp-file cleanup waits for the task and also runs after a fault;
• runtime ABI-major matching rejects any mismatched native library.

Scope / branch state

• PR base: Cancel FFmpeg library work when the dialog closes #136
• base HEAD: eed96e1a1c5f3c57411293fdd3ee56316c385ef0
• integration HEAD: 1fb4a403d864fd49f1b44949a29faf7a10ef1618
• 1 integration commit
• 5 files changed relative to Cancel FFmpeg library work when the dialog closes #136
• source integrations: Gate FFmpeg library download to Windows x64 #137, Probe the full FFmpeg native library stack #127
• inherited delivery stack: Pin and verify the FFmpeg shared-library archive #134, Install verified FFmpeg libraries transactionally #135, Cancel FFmpeg library work when the dialog closes #136
• current upstream main checked: dda1fce8f9d4a605b1b6732acc072c7109dc6323
• evidence only; no merge/promotion intended

Acceptance

• full restore/build/test suite must pass on this exact HEAD;
• no new warning;
• retry step must remain unused;
• final adversarial review must confirm package/platform/install/runtime contracts remain aligned.

AI assistance: ChatGPT was used for cross-branch library-delivery reconciliation, package/runtime ABI contract comparison, transaction/lifecycle review and integration acceptance design.

Final CI

Authoritative run: SubtitleEdit#295 on 1fb4a403d864fd49f1b44949a29faf7a10ef1618

• SeConv: 488 passed / 2 skipped / 0 failed
• LibUiLogic: 905 passed / 0 skipped / 0 failed
• LibSE: 2017 passed / 0 skipped / 0 failed
• UI: 5246 passed / 9 skipped / 0 failed
• build: 0 errors / 7 pre-existing warnings
• retry step skipped
• failure-artifact upload skipped

Final adversarial integration review was performed on this exact HEAD after CI; package identity, platform capability, transactional install, dialog lifetime and runtime ABI availability remain aligned end-to-end.

[Blackspirits]

Final adversarial integration review on 1fb4a403d864fd49f1b44949a29faf7a10ef1618 after CI SubtitleEdit#295: no blocker found. Verified package identity/digest, Windows-x64 capability, staging validation of all five runtime library families, transactional install/rollback, dialog cancellation/temp cleanup, and runtime availability probing of avcodec/avformat/avutil/swscale/swresample with ABI-major matching remain aligned end-to-end. Evidence-only PR; no merge/promotion performed.