Repair campaign recovery and native client progress across platforms

.github/workflows/build.yml

@@ -138,10 +138,8 @@ jobs:
           set -euo pipefail
           mkdir -p "$RUNNER_TEMP/ffmpeg-runtime"
           cd "$RUNNER_TEMP/ffmpeg-runtime"
-          curl -L --fail --silent --show-error -o ffmpeg-linux.tar.xz \
-            https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-09-09-14-51/ffmpeg-n8.1.2-51-g7ba069f4f1-linux64-gpl-8.1.tar.xz
-          echo "1288c1e46efce263651f5b10755f9ef11419a91558407fe61cc178aa9869fa1b  ffmpeg-linux.tar.xz" | shasum -a 256 -c -
-          tar -xf ffmpeg-linux.tar.xz
+          python -m pip install --disable-pip-version-check pyinstaller==6.19.0
+          python "$GITHUB_WORKSPACE/scripts/provision_pinned_runtime.py" --platform linux --output-root "$PWD"
           bundle_dir="$(find "$PWD" -mindepth 1 -maxdepth 1 -type d -name 'ffmpeg-*' -print -quit)"
           test -x "$bundle_dir/bin/ffmpeg"
           test -x "$bundle_dir/bin/ffprobe"
@@ -172,10 +170,8 @@ jobs:
           set -euo pipefail
           mkdir -p "$RUNNER_TEMP/ffmpeg-runtime"
           cd "$RUNNER_TEMP/ffmpeg-runtime"
-          curl -L --fail --silent --show-error -o ffmpeg-linux.tar.xz \
-            https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-09-09-14-51/ffmpeg-n8.1.2-51-g7ba069f4f1-linux64-gpl-8.1.tar.xz
-          echo "1288c1e46efce263651f5b10755f9ef11419a91558407fe61cc178aa9869fa1b  ffmpeg-linux.tar.xz" | shasum -a 256 -c -
-          tar -xf ffmpeg-linux.tar.xz
+          python -m pip install --disable-pip-version-check pyinstaller==6.19.0
+          python "$GITHUB_WORKSPACE/scripts/provision_pinned_runtime.py" --platform linux --output-root "$PWD"
           bundle_dir="$(find "$PWD" -mindepth 1 -maxdepth 1 -type d -name 'ffmpeg-*' -print -quit)"
           test -x "$bundle_dir/bin/ffmpeg"
           test -x "$bundle_dir/bin/ffprobe"
@@ -323,13 +319,8 @@ jobs:
         run: |
           $runtimeDir = Join-Path $env:RUNNER_TEMP "ffmpeg-runtime"
           New-Item -ItemType Directory -Path $runtimeDir -Force | Out-Null
-          $archive = Join-Path $runtimeDir "ffmpeg-win.zip"
-          Invoke-WebRequest -Uri "https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-09-09-14-51/ffmpeg-n8.1.2-51-g7ba069f4f1-win64-gpl-8.1.zip" -OutFile $archive
-          $actualHash = (Get-FileHash -Algorithm SHA256 -Path $archive).Hash.ToLowerInvariant()
-          if ($actualHash -ne "4e40699fa864811312d6c1895ea4873beaf8475e1188563fee57fac860554601") {
-            throw "Unexpected FFmpeg archive hash: $actualHash"
-          }
-          Expand-Archive -LiteralPath $archive -DestinationPath $runtimeDir -Force
+          python -m pip install --disable-pip-version-check pyinstaller==6.19.0
+          python scripts/provision_pinned_runtime.py --platform win --output-root $runtimeDir
           $bundleDir = Get-ChildItem -LiteralPath $runtimeDir -Directory | Where-Object { $_.Name -like "ffmpeg-*" } | Select-Object -First 1
           if (-not $bundleDir) { throw "Expanded FFmpeg bundle directory not found" }
           $ffmpeg = Join-Path $bundleDir.FullName "bin\\ffmpeg.exe"
@@ -535,10 +526,8 @@ jobs:
           set -euo pipefail
           mkdir -p "$RUNNER_TEMP/ffmpeg-runtime"
           cd "$RUNNER_TEMP/ffmpeg-runtime"
-          curl -L --fail --silent --show-error -o ffmpeg-linux.tar.xz \
-            https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-09-09-14-51/ffmpeg-n8.1.2-51-g7ba069f4f1-linux64-gpl-8.1.tar.xz
-          echo "1288c1e46efce263651f5b10755f9ef11419a91558407fe61cc178aa9869fa1b  ffmpeg-linux.tar.xz" | shasum -a 256 -c -
-          tar -xf ffmpeg-linux.tar.xz
+          python -m pip install --disable-pip-version-check pyinstaller==6.19.0
+          python "$GITHUB_WORKSPACE/scripts/provision_pinned_runtime.py" --platform linux --output-root "$PWD"
           bundle_dir="$(find "$PWD" -mindepth 1 -maxdepth 1 -type d -name 'ffmpeg-*' -print -quit)"
           test -x "$bundle_dir/bin/ffmpeg"
           test -x "$bundle_dir/bin/ffprobe"

.github/workflows/release-preflight.yml

@@ -30,10 +30,8 @@ jobs:
           sudo apt-get install -y --no-install-recommends openssl ripgrep
           mkdir -p "$RUNNER_TEMP/ffmpeg-runtime"
           cd "$RUNNER_TEMP/ffmpeg-runtime"
-          curl -L --fail --silent --show-error -o ffmpeg-linux.tar.xz \
-            https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-09-09-14-51/ffmpeg-n8.1.2-51-g7ba069f4f1-linux64-gpl-8.1.tar.xz
-          echo "1288c1e46efce263651f5b10755f9ef11419a91558407fe61cc178aa9869fa1b  ffmpeg-linux.tar.xz" | shasum -a 256 -c -
-          tar -xf ffmpeg-linux.tar.xz
+          python -m pip install --disable-pip-version-check pyinstaller==6.19.0
+          python "$GITHUB_WORKSPACE/scripts/provision_pinned_runtime.py" --platform linux --output-root "$PWD"
           bundle_dir="$(find "$PWD" -mindepth 1 -maxdepth 1 -type d -name 'ffmpeg-*' -print -quit)"
           test -x "$bundle_dir/bin/ffmpeg"
           test -x "$bundle_dir/bin/ffprobe"

CHANGELOG.md

@@ -5,6 +5,44 @@ All notable changes to this project will be documented in this file.
 The format is based on Keep a Changelog, and this repository uses date-stamped
 release notes until a stricter semver/tagging policy is formalized.
 
+## [1.3.0-rc.8] - 2026-09-29
+
+Unpublished review candidate. Client 0.3.8 builds console onefile launchers
+without forwarding process-group signals twice. The exact rc.7 Mac DMG exited
+130 when its child alone received SIGINT during a held upload response, but a
+terminal-style group SIGINT left the child waiting; the saved queue survived.
+This packaging correction leaves Windows GUI Stop/Close on its own owned
+cancellation event. Protocol 7.1 and the frozen suite remain unchanged.
+
+## [1.3.0-rc.7] - 2026-09-29
+
+Unpublished review candidate. Client 0.3.7 gives terminal Publish/Retry a
+scoped interrupt signal that cancels and reaps owned network work before it
+returns exit 130. A held-response native fault exposed an unhandled interrupt
+in rc.6; its queue remained durable, but the exit and traceback were wrong.
+The measurement protocol, frozen suite and scientific checks are unchanged.
+No public asset is promoted by this note.
+
+## [1.3.0-rc.6] - 2026-09-28
+
+Unpublished review candidate for the September 28 client reliability work.
+Client 0.3.6 bounds runtime preparation, carries cancellation and deadlines
+through normal uploads, reconciles saved campaign evidence and queue receipts,
+and gives Windows Overall and Batch progress durable attempt units that move
+as warmups and measurements are recorded, including across checkpoints.
+It keeps the guided menu reachable with local queue settings and makes console
+output safe under Windows code pages that cannot print every Unicode symbol.
+Protocol 7.1, the frozen suite bytes and scientific admission checks are
+unchanged. Source and focused tests do not certify the native Medium, fault,
+recovery or four-asset release gates; no public asset is promoted by this note.
+
+## [1.3.0-rc.5] - 2026-09-22
+
+Published macOS resume and storage repair from source `b0607f0`. The Windows
+GUI and console assets carried the rc.4 binaries; Linux carried an rc.2-era
+binary. This release did not contain the later draft PR #22 client work, and
+the four assets did not share one updated client source.
+
 ## [1.3.0-rc.4] - 2026-09-22
 
 Windows-focused repair with automatic recovery. A suite-cache extraction folder

README.md

@@ -127,29 +127,38 @@ For authoritative V7 submissions, the client also uploads the encoded benchmark
 
 ## Client downloads and candidate commands
 
-Published **1.2.0 / client/0.2.0** downloads: [Windows GUI](https://github.com/oliverdougherC/Encoding_Database/releases/download/1.2.0/encodingdb-client-windows.exe),
-[Windows console](https://github.com/oliverdougherC/Encoding_Database/releases/download/1.2.0/encodingdb-client-windows-console.exe),
-[Linux](https://github.com/oliverdougherC/Encoding_Database/releases/download/1.2.0/encodingdb-client-linux),
-and [macOS](https://github.com/oliverdougherC/Encoding_Database/releases/download/1.2.0/encodingdb-client-macos).
-These historical builds do not implement the corrected campaign interface below
-and cannot establish the protocol 7.1 epoch. Their unsigned/notarization and
-translated-helper limits remain in the published release notes.
-
-Application candidate `b3ef24a` now has physical Windows seven-clip software and
+The current public download is [1.3.0-rc.5](https://github.com/oliverdougherC/Encoding_Database/releases/tag/1.3.0-rc.5).
+Verify its `SHA256SUMS` before use. Its macOS DMG contains the September 22
+resume repair; the Windows GUI/console binaries were carried forward from
+rc.4, and the Linux archive from an rc.2-era build. These assets do not share
+one corrected client source. Draft PR #22 contains later unpublished candidate
+work and is not part of any public download. The September 28 failed Medium
+sweeps and current readiness limits are recorded in
+[the original incident ledger](docs/collection-readiness/reliability-20260928/ORIGINAL-INCIDENTS.md).
+Per-clip assets in PR #22 remain staged with `published=false`, so a cold
+public guided run can still require the full roughly 1.51 GB frozen suite pack.
+
+Published **1.2.0 / client/0.2.0** downloads remain available as historical
+assets in their [release](https://github.com/oliverdougherC/Encoding_Database/releases/tag/1.2.0).
+They do not implement the protocol 7.1 campaign interface.
+
+Historical application candidate `b3ef24a` has physical Windows seven-clip software and
 NVENC evidence: 63 VALID attempts, 42 measured runs and 21 stable groups across
 three campaigns, plus four controlled recovery/failure cases. Hosted Windows
-seven-clip console acceptance also passed; final GUI acceptance remains pending.
+seven-clip console acceptance also passed; GUI acceptance was pending at that
+checkpoint.
 The [Mac package smoke](docs/collection-readiness/mac-build-b3ef24a/README.md) passed
 with native ARM64 helpers and a **macOS 27.0** runtime floor; signing is ad hoc,
 with no Developer ID signature or notarization. Both b3 Mac seven-clip campaigns
 finished: 46 artifacts verified, with two unstable software groups and six
-GPU-suspect hardware measurements retained. Publication remains unverified.
+GPU-suspect hardware measurements retained. Publication was unverified at that
+checkpoint.
 The Linux candidate build, migrations,
-trusted TLS and isolated restore passed; final native acceptance is now running
-after the capacity trial. These results do not establish collection readiness or validated
+trusted TLS and isolated restore passed; final native acceptance was still
+running after the capacity trial. These results do not establish collection readiness or validated
 PL. See the [current evidence and open gates](docs/FINAL_RELEASE_HANDOFF.md).
 
-From the corrected source checkout with client requirements installed and a
+From a source checkout with client requirements installed and a
 compatible local staging server, run one clip without publication:
 
 ```bash
@@ -280,9 +289,10 @@ V7 artifact authorization uses `ARTIFACT_UPLOAD_SECRET` only on the server to si
 
 ## Version identities
 
-- Published project release: `1.3.0-rc.4` / `2026-09-22` in `release.json`; client/0.3.3, protocol `7.1`.
+- Published project release: `1.3.0-rc.5` / `2026-09-22`, protocol `7.1`. Its macOS and Windows assets identify `client/0.3.3`; the carried Linux asset identifies `client/0.3.1` in retained native envelopes.
+- Unpublished review candidate: proposed `1.3.0-rc.8` / `client/0.3.8`, protocol `7.1`; native acceptance and promotion remain open. The rc.6 and rc.7 builds are retained as diagnostic evidence.
 - Historical project release: `1.2.0` / `client/0.2.0`, protocol `7.0` (historical timing).
-- Candidate client implementation/minimum version: `client/0.3.0`.
+- Minimum accepted client implementation version: `client/0.3.0`.
 - Candidate benchmark protocol version: `7.1`, timer boundary `ffmpeg-process-v1`.
 - PL formula version: `7.0`.
 - Test-suite version: EncodingDB Test Suite v1 (`encodingdb-test-suite-v1`).

client/ENCODINGDB_TEST_SUITE_V1.md

@@ -18,7 +18,9 @@ python3 scripts/test_suite_drift_check.py
 
 The materializer verifies archive, metadata, notices and every reference, then installs matching client/server resources. Run it before native builds or Docker builds. Frozen references have no synthetic fallback; `build_test_suite_v1.py --rewrite-manifest` refuses a frozen suite.
 
-Packaged clients obtain the archive beside the executable or through the manifest download URLs, with verified cache reuse and atomic extraction. Explicit overrides: `ENCODINGDB_SUITE_CACHE_DIR`, `ENCODINGDB_SUITE_PACK_PATH`, `ENCODINGDB_SUITE_PACK_URL`, and `ENCODINGDB_QUICK_CLIP_ID`.
+Packaged clients reuse hash-verified cached clips and prefer the separately addressable clips declared in `clip-distribution.json` when those assets are published. The checked-in per-clip inventory is staged but **not published** yet; current public clients still use the external 1.51 GB pack. A full-pack fallback states its transfer size before downloading. `ENCODINGDB_ALLOW_FULL_PACK=0` refuses that fallback, and `ENCODINGDB_SUITE_CLIP_BASE_URL` selects a staged per-clip host for testing. Other overrides: `ENCODINGDB_SUITE_CACHE_DIR`, `ENCODINGDB_SUITE_PACK_PATH`, `ENCODINGDB_SUITE_PACK_URL`, and `ENCODINGDB_QUICK_CLIP_ID`.
+
+`scripts/prepare_client_suite_distribution.py --clip-bundle-out DIR` stages flat, unique release-asset filenames with exactly the frozen clip bytes and bound license notices. Staging does not upload them or activate public URLs. Publication and actual download verification belong to the release gate in PLA-90.
 
 Per-clip attributions, modification notices and license texts travel inside the pack and are hash-bound to its inventory. Third-party CC BY media is not relabeled CC0 or covered by Apache-2.0.