Validate complete integrated FFmpeg hardening stack

[Blackspirits]

Purpose

Final integration-only validation of the complete audited FFmpeg stack: runtime + native audio/video lifetime + library delivery/runtime availability.

The base is #150, which already validates the complete runtime composition:

• load-generation Session ownership/lifetime;
• seek-serial transactional semantics and frame publication;
• hardware fallback/replay-serial fencing;
• demux transient-error handling and decoder-open fallback;
• audio serial/reset/start fencing;
• explicit native clock health + wall-clock failover;
• decode-only continuation after sink failure for unknown-duration EOF;
• WinMM open/position/teardown hardening;
• UI final teardown off the UI thread and exactly-once.

This final integration commit adds the fully validated delivery/runtime-library stack from #151:

• Pin and verify the FFmpeg shared-library archive #134 pinned Windows x64 archive + SHA-256 verification;
• Install verified FFmpeg libraries transactionally #135 staging/validation/transactional install + rollback;
• Cancel FFmpeg library work when the dialog closes #136 cancel/X close lifetime + temp ZIP cleanup;
• Gate FFmpeg library download to Windows x64 #137 single Windows-x64 capability contract shared by service/UI;
• Probe the full FFmpeg native library stack #127 runtime probe of all five FFmpeg native libraries and ABI majors.

This PR is audit evidence only and is not a merge candidate.

Current upstream SubtitleEdit/subtitleedit main was rechecked at dda1fce8f9d4a605b1b6732acc072c7109dc6323; current upstream changes are Auto-Translate related and do not touch the audited FFmpeg runtime or delivery paths.

Why this final integration matters

The runtime and delivery stacks were intentionally audited separately. The final product contract, however, is end-to-end:

1. Settings must only offer a package the downloader supports;
2. the downloaded bytes must be pinned and authenticated;
3. installation must provide every native library the runtime actually uses, atomically;
4. runtime availability must reject missing/mismatched ABI components;
5. once available, the fully integrated player must preserve all audited lifetime/seek/audio/video invariants.

A green runtime tree plus a green delivery tree independently does not prove those contracts remain aligned in one build.

End-to-end invariants

Delivery / availability

1. Package identity is immutable.
   The Windows x64 shared build uses the reviewed tag/asset and exact SHA-256; no moving latest URL remains in this path.

2. Platform capability is single-source.
   Windows x64 is supported; Windows ARM64/x86 and non-Windows are not advertised by this downloader.

3. Install is fail closed and transactional.
   Extraction occurs in staging; all five required runtime families must be present before commit; partial commit failure/cancellation rolls back active files.

4. Dialog lifetime owns the work.
   Cancel/Escape/title-bar X cancel the same token used by download/hash/install and clean the temporary ZIP after the task releases it.

5. Runtime availability matches install requirements.
   avcodec, avformat, avutil, swscale, and swresample are all probed and every returned ABI major must match the FFmpeg.AutoGen binding constants.

Runtime

6. Load generation fences old Sessions.
   Stale decoder/frame writes and stale CloseFile cleanup cannot mutate a replacement load.

7. Session startup/teardown is fail closed, reclaimable and UI-safe.
   Partial worker startup rolls back; timed-out workers retain resources until safe reclamation; final UI teardown is off-thread and exactly once.

8. Seek serial is the pipeline ownership fence.
   Seek is transactional; stale compressed packets/frames cannot enter or publish into the committed pipeline.

9. Hardware fallback replays from a fresh serial.
   A fresh software decoder never consumes pre-replay compressed packets.

10. Audio native ownership is serial/generation fenced.
    Reset publishes a serial only after successful native reset; all PCM writes carry it.

11. Audio clock failure is explicit, not heuristic.
    WinMM/Core Audio report clock-read validity; a current/latest clock failure transitions to the same wall-clock failover used for output-write failure.

12. Unknown-duration playback remains observable after output failure.
    Decode-only mode preserves timestamps/resampler drain/EOF while native PCM output is skipped.

13. Native WinMM lifetime is fail closed.
    Open preparation is all-or-nothing; position formats/wrap are normalized; teardown never frees buffers still owned by the driver.

14. Recoverable demux/decoder failures do not become false EOF or corrupted replay.
    Recoverable reads retry, hardware decoder-open falls back once, and EAGAIN retains packet ownership correctly.

Integration reconciliation

The only shared test-file conflict between #150 and #151 was the historical extraction regression: it still encoded the pre-#135 contract where one avcodec DLL counted as a successful install.

The final tree deliberately keeps the production installer strict and updates only that regression:

• the fixture now supplies the complete five-library set from FfmpegLibraryInstaller.RequiredWindowsLibraryNames;
• unrelated ffmpeg.exe, import-lib and header entries remain ignored;
• the installed flat set must equal the required runtime DLL set.

All other #150 runtime tests were preserved. ABI-major tests are kept in a separate integration test file so the runtime test suite is not replaced or weakened.

A pre-CI whole-file diff gate also caught and reverted one accidental expected-value edit in an unrelated duration test before this PR was opened.

Scope / branch state

• PR base: Validate integrated FFmpeg runtime hardening stack #150
• base HEAD: 3e2971cbbdb1376d2029f2ee37878c66bb326ce9
• final integration HEAD: 997f25952dbf2fff1941e332441e6160b4d1a27b
• 1 integration commit
• 10 changed files relative to Validate integrated FFmpeg runtime hardening stack #150
• runtime source: Validate integrated FFmpeg runtime hardening stack #150
• delivery/runtime-library source: Validate integrated FFmpeg library delivery stack #151
• current upstream main checked: dda1fce8f9d4a605b1b6732acc072c7109dc6323
• evidence only; no merge/promotion intended

Acceptance

• full restore/build/test suite must pass on this exact HEAD;
• no new warning;
• retry step must remain unused;
• failure artifact must remain unused;
• final adversarial review must re-check runtime and delivery invariants together;
• upstream drift must be rechecked again after CI before declaring the FFmpeg audit technically closed.

AI assistance: ChatGPT was used for final runtime/delivery composition, exact-blob reconciliation, detection and correction of the stale extraction regression, whole-file regression-diff review, and end-to-end acceptance design.

Final CI

Authoritative run: SubtitleEdit#311 on 997f25952dbf2fff1941e332441e6160b4d1a27b

• SeConv: 488 passed / 2 skipped / 0 failed
• LibUiLogic: 905 passed / 0 skipped / 0 failed
• LibSE: 2017 passed / 0 skipped / 0 failed
• UI: 5337 passed / 9 skipped / 0 failed
• build: 0 errors / 7 pre-existing warnings
• retry step skipped
• failure-artifact upload skipped

Final upstream drift gate

Upstream main was rechecked at dda1fce8f9d4a605b1b6732acc072c7109dc6323.

The 22-commit delta since 6c6b83dd043d8d38fb7a2b1800fdb9465526833b does not touch the FFmpeg player, audio sinks, download service, installer or runtime-library loader. SettingsViewModel.cs changed elsewhere, but the FFmpeg download-visibility assignment remained byte-for-byte the same in upstream across that delta, so #137/#152 do not hide a semantic conflict there.

Final adversarial review was performed on this exact HEAD after CI and drift revalidation; no blocker found.

This run supersedes final integration HEAD c2e75d8787f24b09d0dc97a6b0b715368a235148 / CI SubtitleEdit#298. The final tree was rebuilt after #149 strengthened clock-health handling: invalid post-reset baselines now fail safe at zero played delta, a single transient native query error is tolerated, and two consecutive failures mark the native clock unhealthy. The corrected sink blobs and policy regressions are preserved through #150 and this final end-to-end tree.

[Blackspirits]

Final adversarial end-to-end review on c2e75d8787f24b09d0dc97a6b0b715368a235148 after CI SubtitleEdit#298: no blocker found. Verified the delivery/runtime-library contract and complete runtime stack coexist on one tree; all five native families/ABI majors align with the transactional installer; platform/download/hash/cancel semantics remain intact; load-generation, seek-serial and sink-generation fences remain intact; clock-health failover + decode-only unknown-duration EOF remain intact; UI/native teardown remains fail-closed and exactly-once. Upstream drift through dda1fce8f9d4a605b1b6732acc072c7109dc6323 was rechecked: no FFmpeg runtime/delivery path changed, and the shared Settings FFmpeg visibility line is unchanged upstream. Evidence-only PR; no merge/promotion performed.

[Blackspirits]

Final adversarial end-to-end review on 997f25952dbf2fff1941e332441e6160b4d1a27b after CI SubtitleEdit#311 and upstream drift revalidation: no blocker found. Rechecked delivery/runtime alignment plus all runtime ownership domains after the #149 clock-health correction. Invalid reset baselines cannot manufacture a native-clock delta; one transient query failure is tolerated; repeated failures converge on wall-clock failover; load-generation, seek-serial and sink-serial fences remain intact; unknown-duration EOF remains observable in decode-only failover; package digest/platform/install/runtime ABI contracts remain aligned. Upstream dda1fce8... still has no FFmpeg runtime/delivery changes, and its SettingsViewModel FFmpeg visibility assignment is unchanged across the 22-commit drift window. Evidence-only PR; no merge/promotion performed.