Harden audio integrity, resource lifecycle, accessibility and product quality

[bigbruno]

Purpose

Implement the technical/product audit of 95f02c3a019af7cb40813fa38af25c7b3906c99c without changing main directly. This is a draft while remediation and acceptance testing continue. It is not a claim that all 34 findings have already been closed.

Implemented first group

• Private, same-filesystem output staging and atomic no-clobber publication, including existing segment outputs, more than 100 naming collisions, dangling symlinks and concurrent exports.
• Strict segment request validation: invalid or incomplete requests cannot silently report success.
• Independent filtering and codec selection during segment extraction, so volume and playback-speed settings reach the exported audio.
• A shared cancellable subprocess owner which drains both pipes, bounds diagnostic memory, terminates and reaps its child before acknowledging cancellation, and cleans unpublished output.
• Explicit PCM precision and output sample-rate policies, including WAV24 preservation and restoring the intended rate after loudness normalization.
• Metadata/attached-picture mapping, structured per-file and batch results, and real-path precedence over legacy :: track identifiers.
• Explicit errors rather than silently omitting unavailable neural processing.
• Required NumPy/build dependencies and an isolated, read-only PR quality workflow with immutable Action references.

Validation actually completed

Native Ubuntu 24.04 runtime: Python/PyGObject/GTK4/libadwaita/python-mpv/FFmpeg installed from distribution packages; no GLib import stubs.

98 tests passed in 8.00 seconds on generated source commit 35c3e11b066ec080e15bf1993aac7f25fd4a5c89.

Execution and retained JUnit evidence.

These tests include real FFmpeg output/PCM checks, cancellation with an observed live FFmpeg PID, absence of a remaining process after cancellation, concurrent publication and Unicode filenames. They do not constitute graphical accessibility or complete product acceptance.

Work still being verified

Waveform accuracy and cancellation, player teardown and callback identity, asynchronous UI probes, keyboard-accessible segment editing, adaptive presentation, contextual help, configuration persistence, gettext, packaging, desktop integration, release/translation automation, and before/after resource measurements.

The existing MIT/GPL license disagreement requires an explicit maintainer decision; this PR must not silently relicense the project.

Development-only files

The temporary .audit-dev/ transformations and branch-restricted development workflow enable native Linux execution while the local executor is unavailable. They are development scaffolding and will be removed from the final proposed source tree. Only this feature branch is written by that workflow.

Review policy

Each finding will be tracked as implemented/tested, implemented/pending acceptance, or unresolved with a reason. No silent transcoding in stream-copy mode, hidden normalization/limiting, removal of user-facing functionality to satisfy tests, or arbitrary license changes.

[bigbruno]

Native graphical baseline is now available

The offline Debian 13 amd64 dependencies and the complete source snapshot have been installed in the local test executor. All 99 tracked files were verified against the audited Git blobs, including a second verification after testing; no production source was changed in this validation step.

Scope: these results are for base commit 95f02c3a019af7cb40813fa38af25c7b3906c99c, not this PR's patched head. They do not replace or extend the PR-head CI result.

Executed, not just imported

• The full GTK application and welcome window rendered under Xvfb/Openbox, using GTK 4.18.6, libadwaita 1.7.6, PyGObject 3.50.0 and Python 3.13.5.
• Real XTEST mouse/keyboard events operated the GTK file picker, added synthetic WAV files, created two waveform segments, opened all ten EQ band controls, selected FLAC and started conversion with Ctrl+Return.
• The GUI produced two FLAC outputs. ffprobe confirmed 48 kHz, mono, 24-bit precision and 2.403 seconds per output.
• First playback, pause, resume before EOF and paused seeking worked with real libmpv 0.40.0 and ao=null. This validates decoding/transport, not physical audio output or listening quality.
• The window resized to outer sizes 1024x768 and 1220x880; basic Tab/Shift+Tab focus navigation was exercised in the main window and completion dialog. This is not complete keyboard-only editing or Orca acceptance.
• The original test suite passed with real PyGObject: 66 passed. No GLib import shim was used.

Confirmed baseline defects to cover during remediation

1. Replay after natural EOF: reproduced in the GUI on two synthetic sources and isolated with the production AudioPlayer plus the real GLib main context. After EOF, play() returns true and the application reports playing, but _position stays 0, libmpv time_pos is None and idle_active remains true. The first-playback control passes; the replay contract fails. The baseline AudioPlayer.play() only clears pause and does not reload the file, while EOF reload logic exists separately in seek. Please retain a native EOF-to-play regression when validating the player changes; this comment does not assert that the current PR head still has the defect.
2. BAC-007 metadata loss: both GUI-exported segments lost the source title, confirming the earlier backend finding through the real UI. Their PCM precision/sample rate were retained in this particular FLAC scenario.

Limits and test-harness notes

The application exited through Ctrl+Q and no application-owned FFmpeg remained alive. The exploratory detached D-Bus test launcher/daemon became PID-1-owned zombies in the container; these are recorded separately rather than claiming that every test process was reaped. A premature waveform assertion in the driver was superseded by waiting for the asynchronous result. An initial native-test teardown error (commanding a libmpv handle already terminated by the harness) was corrected by detaching the destroyed handle; that harness-induced crash is not classified as a normal application crash.

Still not validated here: this PR's patched head, physical sound output, Wayland/HiDPI, Orca/AT-SPI, full theme/RTL coverage, GUI cancellation under load, optional neural processing, clean Arch package installation and long-session resource behavior. No additional dependency or source upload is required for basic local graphical testing now.