Recover split and listening work, account usage, and bug reports

.github/workflows/cloudflare-candidate.yml

@@ -40,6 +40,8 @@ jobs:
           //npm.pkg.github.com/:_authToken=${CAIL_PACKAGES_TOKEN}
           NPMRC
           bun install --frozen-lockfile
+      - name: Install the local audio validation oracle
+        run: bash .github/scripts/install-media-tools.sh ffmpeg
       - name: Verify private identity and Gateway boundaries in Workerd
         working-directory: cloudflare
         run: bun run typecheck && bun run test

.github/workflows/yt-audio-candidate.yml

@@ -0,0 +1,71 @@
+name: YouTube extractor candidate image
+
+on:
+  pull_request:
+    paths:
+      - 'replicate-yt-audio/**'
+      - 'scripts/lib/pin-check.mjs'
+      - '.github/workflows/yt-audio-candidate.yml'
+  push:
+    branches: [codex/stem-reliability-20261006]
+    paths:
+      - 'replicate-yt-audio/**'
+      - 'scripts/lib/pin-check.mjs'
+      - '.github/workflows/yt-audio-candidate.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: stem-youtube-image-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: CPU extractor build and offline smoke
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    env:
+      EXTRACTOR_SOURCE_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '22.23.1'
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.12.13'
+      - name: Verify native runner
+        run: |
+          set -euo pipefail
+          test "$(uname -s)" = Linux
+          test "$(uname -m)" = x86_64
+          test "$(docker info --format '{{.OSType}}/{{.Architecture}}')" = linux/x86_64
+      - name: Run free extractor fixtures
+        run: python3 -m unittest discover -s replicate-yt-audio -p 'test_*.py'
+      - name: Install pinned Cog without registry authentication
+        uses: replicate/setup-cog@8a5fea3c1818b6950dcf8027285f5a9b447c0c4a # v2
+        with:
+          cog-version: 'v0.23.0'
+          token: ''
+          install-cuda: false
+      - name: Build CPU image locally on the runner
+        working-directory: replicate-yt-audio
+        run: cog build --progress plain -t "stem-youtube-candidate:${EXTRACTOR_SOURCE_COMMIT}"
+      - name: Verify image dependencies, schema and setup without network access
+        run: >-
+          node replicate-yt-audio/verify-image.mjs
+          "stem-youtube-candidate:${EXTRACTOR_SOURCE_COMMIT}"
+          "$EXTRACTOR_SOURCE_COMMIT"
+          "$RUNNER_TEMP/yt-audio-candidate-evidence.json"
+      - name: Preserve sanitized image evidence
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: yt-audio-candidate-${{ github.event.pull_request.head.sha || github.sha }}
+          path: ${{ runner.temp }}/yt-audio-candidate-evidence.json
+          if-no-files-found: error
+          retention-days: 30

TODO.md

@@ -2,7 +2,7 @@
 
 Updated October 6, 2026. This is an implementation plan, not a release authorization or a claim that unchecked work is complete.
 
-**Execution update — October 6, 2026, 19:39 UTC:** the user has separately authorized implementing these three PR groups, publishing at most three actual draft PRs, and merging after an independent Astra High audit of the final commits. Implementation workers were started with explicit Astra Max settings, and a separate auditor with explicit Astra High settings; creation requests were accepted, but actual backend model/effort metadata is not independently exposed. Production deployment, database cutover, paid inference/provider jobs, credential changes and permission expansion remain outside that authorization. Portal `main` automatically releases changed Workers; separate deployment approval is pending. Stem's inspected GitHub target workflows check and dry-build; external auto-deployment remains unverified because the configured Cloudflare MCP sessions do not authorize the target account. No merges, deployments or remote database changes have run. Completion boxes remain unchecked until final-head evidence is recorded.
+**Execution update — October 6, 2026, 20:06 UTC:** the user has separately authorized implementing these three PR groups, publishing at most three actual draft PRs, and merging after an independent Astra High audit of the final commits. Implementation workers were started with explicit Astra Max settings, and a separate auditor with explicit Astra High settings; creation requests were accepted, but actual backend model/effort metadata is not independently exposed. Production deployment, database cutover, paid inference/provider jobs, credential changes and permission expansion remain outside that authorization. Portal `main` automatically releases changed Workers; separate deployment approval is pending. Stem's inspected GitHub target workflows check and dry-build; external auto-deployment remains unverified because the configured Cloudflare MCP sessions do not authorize the target account. No merges, deployments or remote database changes have run. The table records the dated implementation evidence. Full acceptance boxes remain open where live access, release authorization or unverified scenarios are still required; the linked PRs hold the current exact-head review and CI results.
 
 **Resolved product decisions:** course visibility applies only to newly and explicitly assigned course work. Existing personal splits and private transcripts remain private, with no historical backfill or transcript import. Folders remain private or course-scoped. The Listening Guy allowance is 50 human inputs per student across courses per UTC day; failed work without a usable reply releases its reservation, while a delivered partial reply counts once. Split allowance settles against the UTC submission day. Reset removes conversation content; content-free accounting evidence may remain.
 
@@ -11,8 +11,8 @@ Updated October 6, 2026. This is an implementation plan, not a release authoriza
 | Implementation checkpoint | Concrete evidence and remaining work |
 | --- | --- |
 | PR1 — [Portal draft #295](https://github.com/CUNY-AI-Lab/cail-tools-admission/pull/295) | Published and independently passed at `9b9d8ed299519fa32b2235bc6c15adfb4093376d`. Local pinned-Bun workspace gate: 1,210 passed, 13 optional skips, both dry builds; frozen install and dependency audit passed. Both account/owner P2s and the Linux narrow-screen failure are corrected. Independent review reran 45 focused tests plus account-switch/outage/long-name browser probes. GitHub's authoritative workspace check passed on this head. Merge/deployment remain held. |
-| PR2 — [Stem classroom draft #28](https://github.com/CUNY-AI-Lab/stem-splitter/pull/28) | Corrected source committed at `1f7e0205a4130bd46cf2180772671e57cc9387fe`: 50 Cloudflare, 36 Chrome, 25 Firefox and 25 WebKit cases pass; the Chromium-only native zoom case is explicitly skipped in the other engines. All 19 local-hosting cases, root suite and dry build pass. All three UI audit defects have negative regression tests: account-outage concealment, course-bound prompt requests and rapid selection/folder-write fencing. Every waveform uses the shared seek path; native 200% mouse and keyboard seeking passed with two synchronized stems after correcting the fixture byte-range responses. The shallow-history schema fixture and title/logo CI expectations are fixed locally. Exact-final-head independent review and refreshed remote CI remain pending; the previously published checkpoint is not approved. |
-| PR3 — [Stem reliability draft #29](https://github.com/CUNY-AI-Lab/stem-splitter/pull/29) | Published checkpoint `aa74797ce38d9b5dbfcc4849daf17b0cd41a4c96` had 66/66 local Cloudflare and 20/20 importer tests, but independent review reproduced five recovery defects: lost commit acknowledgement deleted committed audio, abandoned ingestion blocked the queue, stale importers failed newer work, missing pins held capacity and polling ignored Retry-After. Corrections now pass local negative tests; current working checks include 74 Cloudflare cases, importer21/21 and actual Workerd overlap of a ten-minute MP3 decode with a 12 MiB inline import. Guest 5/25 routed Worker/storage tests pass with mocked providers; guest browser integration, usage-event verification, final restack, CI and independent review remain open. Production cause of the YouTube report remains unconfirmed. No paid job, extractor publication or production change occurred. |
+| PR2 — [Stem classroom draft #28](https://github.com/CUNY-AI-Lab/stem-splitter/pull/28) | Final `f5506597f8fab2196d3f55119242d76210ff553d` is published, independently PASS and green on every remote check (runs `37522342154`, `37522342260`). Local evidence: shared321, server42, Cloudflare50, Chrome36, Firefox25 and WebKit25 plus the explicit native-Chromium-only skip; local-hosting19, migration, typechecks and dry build pass. Original account-outage, wrong-course prompt and rapid-selection defects are closed. Every waveform uses the shared seek path; actual native 200% pointer/keyboard seeking passed. Merge and live acceptance remain held. |
+| PR3 — [Stem reliability draft #29](https://github.com/CUNY-AI-Lab/stem-splitter/pull/29) | Integrated implementation `0bbabd44514a20bed6093e305942327a78b5d8d2` descends from final PR2. Local checks: shared325, server42, Python5/30/9, Cloudflare84, importer21, extractor4, Chrome38, Firefox23 and WebKit24; typechecks, adapter audit and candidate dry build pass. Guest5/25 is separate from member15/50 and remains OFF. Recovery corrections, bounded12MiB imports, chat settlement fencing and redacted actor-bound usage events are integrated. Two actual local Workers verify atomic admission; twenty students across two database coordinators verify fairness. These are not production capacity measurements. Independent exact-final review and refreshed hosted CI are tracked on this PR; earlier published `aa74797` is not approval. The live YouTube cause remains unconfirmed. No paid job, extractor publication or production change occurred. |
 
 The current Gateway catalog lists both requested model IDs. Read-only deployment/version verification also matches serving Gateway source `36cd8cdb7d61e2aebc94a03171b5990cea00bf5e`, version `98a500ab-2ea7-49b1-9909-ddb06d60cff7` at 100%. Its documented retryable `upstream_rate_limited`, `upstream_unavailable` and `model_unavailable` codes inform local fallback tests; quota/authentication/payment/ambiguous-timeout outcomes do not qualify. This proves neither account entitlement nor a live inference result.
 

cloudflare/README.md

@@ -1,5 +1,17 @@
 # Cloudflare deployment
 
+## Reliability and guest candidate — October 6, 2026
+
+The PR3 source replaces historical attempt counting with 15 successful member
+splits and 50 human Listening Guy inputs per UTC submission day, durable
+reservations/recovery, bounded import validation and redacted usage evidence.
+The optional guest path has separate 5/25 allowances and private ownership;
+it remains disabled until separately approved bot verification and Gateway
+sponsor configuration are installed. See [the operation/migration runbook](../docs/reliability-operations.md),
+[guest access gates](../docs/guest-access.md) and [local verification](../docs/evidence/reliability-20261006/verification.md).
+These are candidate source semantics, not a deployment or permission change.
+The dated ten-attempt/visitor-disabled receipts below describe the older release.
+
 ## Classroom candidate — October 6, 2026
 
 The prospective course implementation and migration `0021` are described in

cloudflare/account-rack.spec.mjs

@@ -70,7 +70,7 @@ test('account rack recovers on a new browser; isolates people; handles paging, i
     });
     await page.locator('#yt-url').fill('https://www.youtube.com/watch?v=fixture1234');
     await page.locator('#yt-form button').click();
-    await expect(page.locator('#upload-message')).toContainText("You've used today's runs.");
+    await expect(page.locator('#upload-message')).toContainText("Today's 15 places are completed or in progress.");
     await expect(page.locator('#upload-message')).not.toContainText('Saved to your account');
     await page.unroute('**/api/jobs');
     await page.getByRole('link', { name: 'My account', exact: true }).click();