# SmartCut64 status

## 2026-08-29 SmartCut64 1.0.3 update candidate

- Deep smart-render boundary seeks now use exact display-frame timestamps from
  a compact packet-presentation index. This avoids a cold-cache full-source
  software decode. Timestamp gaps are handled exactly; missing, reset, outlier
  or otherwise ambiguous mappings fall back to decoding safely from the start.
- Boundary failures now retain the exact FFmpeg stage, code and text together
  with frame, timestamp and packet diagnostics. Delayed decoder frames are
  drained at end of file.
- An Out mark on the final navigable frame now resolves to the true half-open
  program end, eliminating the one-frame tail shown in the customer report.
- The 99-test UCRT64 release configuration passes completely; the optional
  elevated Application Verifier case remains skipped. The no-FFmpeg MSVC x64
  configuration also passes 6/6. The 1.0.3 retail package, signing, installation
  gates and storefront publication have not yet run.

## 2026-08-27 perpetual-licence and pre-publication hardening

- The owner selected a genuine perpetual Personal licence. The production
  bridge now issues machine-bound entitlements with `expires_unix=0`; installed
  clean-export access does not depend on periodic service renewal. Refund or
  disabled-key events block future activation and transfer but cannot remotely
  revoke a token already issued to a computer. Product, policy, activation and
  support copy now state that limitation consistently.
- Evaluation still captures from the production worker are visibly marked,
  closing the full-resolution frame-reconstruction route while leaving the
  shared-memory live preview and internal 320-pixel thumbnail strip unchanged.
- The shipped UCRT64 programs enable and expose ASLR, high-entropy VA, DEP/NX,
  relocation data, stack protection, supported control-flow protection and
  optimized-build fortification. The activation client refuses redirects, CLI
  and worker arguments use complete checked parsing, S337M odd payloads fail
  safely, and persisted numeric UI settings are bounded.
- The application, package, reports, source bundle and scripts now share launch
  version `1.0.2`. Website responses add HSTS, anti-framing, MIME, referrer and
  browser-feature security headers.
- Verification on this branch passed the 14-test licensing bridge suite, the
  7-test website production-render suite, MSVC core 6/6, MSVC AddressSanitizer
  6/6, and all 94 UCRT64 retail tests. The suite's optional administrator-only
  Application Verifier case remains an explicit skip. Private-material scanning
  passed and all three retail PE files expose the intended ASLR/DEP flags.
- Engineering disposition of every supplied review item is recorded in
  `docs/PRELAUNCH_REVIEW_DISPOSITION.md`. Independent legal, codec-patent and
  trademark clearance remain external commercial-launch gates; this engineering
  pass does not represent them as complete.

## 2026-08-20 Lemon live-store approval

- Lemon Squeezy approved the LINEKERPANDI LIMITED store and authenticated Live
  Mode is available. This clears the merchant-approval gate but does not itself
  authorize public checkout.
- The next controlled phase is to copy SmartCut64 Personal into Live Mode,
  configure the isolated production activation bridge with the resulting live
  IDs and secrets, verify exact-file delivery and a real purchase/refund cycle,
  then regenerate and sign one immutable release set.
- Independent GPL/LGPL, consumer-terms, privacy/refund, trademark and codec-
  patent review, the production-key backup/continuity record, and the broader
  device/player matrix remain public-launch gates.

## 2026-08-16 pre-launch hardening and signed release candidate

- A fresh Lemon test-mode order exercised repeat activation, two distinct
  computers, third-computer rejection, deactivation/transfer, purchase-email
  mismatch, signed refund-webhook revocation of every active seat, and the
  deployed rate limiter. The live third-computer check exposed a misleading
  `503` response; the bridge now maps Lemon's activation-limit response to a
  stable `409 activation_limit_reached` contract with actionable customer
  guidance. All 14 licensing-bridge tests pass and both Cloudflare bridge
  deployments carry the fix.
- An isolated production Cloudflare KV namespace, preview namespace, rate-limit
  namespace pair, and Worker shell now exist at the intended production
  workers.dev hostname. It deliberately has no entitlement private-key secret
  and uses nonmatching placeholder Lemon IDs, so activation fails closed while
  Lemon live-store approval and production key-custody approval remain open.
- Claude's three blocking findings and six medium findings were independently
  checked against the current branch and remediated: retail automation is
  compiled out, named-pipe IPC is per-user/random/timeout-bounded, numeric input
  fails diagnostically, JSON and journal handling are strict, completed control
  threads are reaped, the licensing bridge fails closed and retains complete
  revocation state, and the retail activation endpoint cannot be redirected by
  an environment variable.
- The complete clean commercial gate completes its 91-test configuration with
  every mandatory test passing, including paid-entitlement delivery through
  the exact production-key worker and CLI. Evaluation behavior remains covered
  by the same matrix. The optional Application Verifier gate is the only
  skipped engineering check because this run was not elevated; the separate
  MSVC AddressSanitizer gate passes 6/6.
- The exact signed artifacts also pass a 19/19 mid-GOP interoperability matrix:
  each case contains boundary-reencoded and interior-copied frames, decodes
  completely with FFmpeg, and visibly advances at three points in MPC-BE.
- The three first-party executables and NSIS installer are Authenticode signed
  by LINEKERPANDI LIMITED through Azure Artifact Signing and carry Microsoft
  public RSA timestamps. Signatures were checked in the build tree and inside
  the portable ZIP; clean portable launch and installer install, shell
  registration, isolated launch, uninstall, and checksum verification pass.
- The exact corresponding-source ZIP contains the signing scripts, offline user
  guide and website source, and contains no PFX/P12/PEM/private-key/password or
  live Wrangler configuration material. A private, owner-only staging website
  provides original SmartCut64 help and product documentation without copying
  VideoReDo help text or artwork.
- Public checkout remains disabled. Lemon live-store approval, final live IDs
  and secrets in the fail-closed production bridge, a controlled live
  purchase/refund cycle, independent GPL/LGPL/customer/trademark review,
  codec-patent decisions, and the broader VLC/mpv/long-file/device-diverse
  real-media/player/GPU matrix remain launch blockers.
- Lemon Squeezy test mode now has the one-time GBP 4.99 SmartCut64 Personal
  product, generated licence keys, a two-computer activation limit, and saved
  confirmation/receipt activation guidance. Lemon reports KYC, bank connection,
  store setup, 2FA and product creation complete; live-store activation remains
  under review. Test store/product/variant IDs are held only in the ignored
  bridge deployment configuration.
- A separate 3072-bit production entitlement key was generated outside Git with
  an encrypted PFX and DPAPI-protected random password. Its public identity is
  recorded in `docs/PRODUCTION_ENTITLEMENT_KEY.md`. The public key and production
  HTTPS service URL are compiled into the commercial candidate and passed the
  paid release gate. The private key is deliberately absent from the production
  Worker until live Lemon approval; two independently verified offline backups
  and activation-service secret configuration remain mandatory.
- A separate 1600x1200 SmartCut64 store card, first-time-publisher Lemon upload
  checklist, exact-release commercial sign-off record, and non-overwriting
  staging script are now present. The staging script verifies the release
  checksums, installer and packaged first-party signatures, source pairing, and
  media dimensions; it deliberately cannot declare legal or commercial
  approval. Current binaries remain prelaunch-only until the production bridge
  is populated with approved live credentials and every external release gate
  passes.

## 2026-08-07 licence and release audit

- The former placeholder licence has been replaced by the complete GNU GPL
  version 3 text. SmartCut64 is declared `GPL-3.0-or-later`; the About dialog,
  README, copyright notice, third-party notice, commercial-distribution guide,
  portable package, and NSIS licence page now use consistent terms.
- Packaging requires the licence, copyright notice, third-party notice, SBOM,
  dependency licences, and commercial-distribution guide. The release gate now
  rejects untracked files as well as tracked modifications so corresponding
  source cannot silently omit a newly added implementation file.
- Current verification is 85/85 executed UCRT release tests (one optional
  Application Verifier skip), 6/6 MSVC debug tests, and 6/6 MSVC
  AddressSanitizer tests. AddressSanitizer tests now add the Visual Studio
  runtime directory themselves, preventing missing-runtime system dialogs.
- This is engineering and licence-compliance preparation, not approval for
  sale. Code signing, a clean matching-source release, independent legal
  review, codec-patent analysis, trademark clearance, and the broad manual
  player/format matrix remain release blockers.

## 2026-08-05 broadcast/HDR/subtitle compatibility

- Boundary rendering now preserves HLG colour signalling and exact source
  4:2:2/4:4:4 profiles for H.264 and HEVC. HDR10+ T.35 construction was fixed
  to include its registration header, and A53 closed-caption bytes are carried
  through H.264/HEVC boundary frames. Deterministic fixtures cover all paths.
- MP4/MOV export automatically converts supported text subtitles (SRT, ASS,
  WebVTT and plain text) to MOV_TEXT, preserving language and chapters. Bitmap
  subtitles that cannot be represented are rejected with actionable Matroska,
  deselection, or OCR guidance; dropped attachments are explicit in the report.
- A lossless Dolby E bridge parses supported 16-bit little-endian SMPTE 337M
  bursts itself, stores each carrier burst as an opaque Matroska edit packet,
  and restores `.s337m`/`.dolbye` byte-for-byte. The gate compares packet count,
  semantic payload hash and complete-file SHA-256. This is preservation, not a
  Dolby decoder/encoder or certification claim.
- The UCRT release build passes all 85 executed tests in its 86-test
  configuration; only optional Application Verifier is skipped when absent.

## 2026-08-05 transport-container compatibility guidance

- Save Video now preflights every selected stream before writing MPEG-TS,
  Topfield REC, or Blu-ray M2TS. Codecs that the selected container would expose
  only as unidentified private `bin_data` are explained before export instead
  of producing a nominally successful but poorly interoperable file.
- The user can switch the destination to Matroska without conversion or choose
  a compatible transcode. Verified M2TS choices are H.264, HEVC, or MPEG-2 video
  with AC-3 audio; verified TS choices additionally include AAC and MP2 audio.
  Secondary streams that cannot be converted are identified and can instead be
  preserved in Matroska or deselected.
- Compatibility transcodes use available software encoders, constrain legacy
  video to 8-bit and transport audio to supported sample-rate/channel layouts,
  and still pass the normal decode, stream, timing, and structural validation.
  The automated suite now executes 80 tests and skips only the optional
  Application Verifier test when that external tool is absent.

## 2026-08-03 remaining-workflow completion

- Tools > Edit Media Metadata now exposes arbitrary container tags and writes a
  validated packet-copy result. The worker reopens the output and requires every
  requested field to round-trip while preserving codec streams, chapters, and
  packet timing; source files cannot be overwritten.
- Joiner output can now be delivered as MKV, MP4, MOV, MPEG-PS, MPEG-TS/M2TS,
  WTV, DVR-MS, Topfield-compatible transport stream, or MXF through a validated
  Matroska join stage. Batch Manager exposes the same delivery-container set
  and persists the selected automatic naming format.

- Intelligent smart-render output now targets Matroska, MP4, QuickTime MOV, and
  MPEG transport streams. Container-specific remux policy preserves copied
  interior GOP payloads and validates container identity, frame count,
  zero-based monotonic timing, and decodability before replacing the output.
- Ad-Detective now exposes scene, average/peak black, contrast, scan-region,
  I-frame-only, pause/review, preview, process-priority, spacing, maximum-block,
  and automatic-cut controls. Detected candidates carry analysis metrics into a
  seekable review table where individual markers can be accepted or rejected.
- Joiner titles support multiple independently styled, positioned, resized, and
  layered text objects, outlines, shadows, alignment, background images/colour,
  safe-area preview, reusable templates, and a persisted default template.
- QuickStream Fix can scan source dimensions and retain or reject streams using
  minimum/maximum width and height constraints before the validated packet-copy
  rewrite.
- Batch Manager accepts media, saved SmartCut projects, and queued Ad scans;
  supports output folder/modifier/container/profile naming, reorder/remove,
  sequential execution, silent mode, and reusable `.cmd` generation. Direct and
  saved-command paths both retain cut, stream-selection, and audio-profile
  settings.
- Output profiles can copy audio or transcode the primary track to AAC, AC-3,
  MP2, Opus, or PCM S16LE with gain, bitrate, sample-rate, and channel controls. Video and
  unaffected streams remain on the smart-render/copy path. Automated checks
  verify codec selection, packet-copy video policy, and measured +6 dB gain.
- Program Options now persists default output/project folders, default output
  container, worker process priority, and whether cuts clear after queueing.
  The per-user installer registers `.smartcut` and `.scjoin`, adds media-file
  “Open with SmartCut64” commands, and removes all registrations on uninstall.
- Verification passes 85/85 executed UCRT GUI tests in the 86-test
  configuration, plus 6/6 MSVC x64 and 6/6 MSVC AddressSanitizer tests.
  Application Verifier remains the sole optional skipped test when absent.

## 2026-08-03 release-candidate workflow baseline

- Cut and Scene modes now share one normalized edit model while presenting the
  expected mode-specific timeline colours, list headings, controls, context
  commands, preview behavior, undo/redo, autosave, project, and journal state.
- The Joiner has ordered multi-file editing, descriptions, drag/drop and manual
  reordering, compatible packet-copy validation, reusable `.scjoin.json`
  project files, and Edit Selection reopening for queued source files and
  prepared edited snapshots without disturbing the list.
- Joiner title cards now have a clean-room title editor with text, font, colour,
  image/background and TV-safe-area controls plus global duration/fade options.
  Titles encode with the reference video's codec, geometry, frame rate, pixel
  format and colour fields, retain the complete stream layout, and create an
  intentional silent interval for non-video streams. Editable `.sctitle.json`
  definitions survive Joiner project save/load; title-first output uses the
  first real program as its codec-parameter template.
- Ad-Detective supports asynchronous interactive scans, progress/cancel,
  chapter markers and navigation, configurable thresholds, optional automatic
  cuts, and queued scans that save ordinary editable SmartCut project files.
  Batch marker spacing is derived from every source's probed frame rate rather
  than a fixed-rate assumption.
- Audio synchronization offsets are applied to preview and all packet-copied
  audio streams during export. Built-in output profiles are joined by editable,
  persistent custom profiles that map to validated smart, keyframe-copy, full
  source-codec transcode, and QuickStream Fix engines.
- The Audio Synchronization dialog now has the documented ±1-second slider,
  numeric control, reset, and Repeat Selection behavior. A valid marked range
  loops with the live project offset until the option or dialog is closed;
  cancel restores the original value and accepting records the project edit.
  Packet-copy profiles retain source volume. Explicit AAC, AC-3, and Opus
  profiles may instead apply user-selected gain while transcoding the primary
  track; that lossy operation is always visible in the profile.
- File now distinguishes Save Project, Save Project As, and Save Video As;
  editor context menus expose Show/Hide Plot Mask. Help > Contents and F1 open
  self-contained workflow help, while the same editable keyboard-shortcut
  manager is available from both Tools and Help.
- Previous/next keyframe navigation is exposed through the Edit menu, editor
  context menu, and configurable Ctrl+Left/Ctrl+Right shortcuts. Every export
  completion now includes a SHA-256 output digest and pinned dependency
  inventory; the GUI retains, formats, displays, and saves the full JSON report.
  Successful exports also open an Output Processing Complete summary with the
  output frame count, throughput, elapsed time, size, bitrate, validation
  result, digest, and direct access to the output folder and detailed report.
- Project-modified state now covers cuts/scenes, chapter markers, stream
  selection, audio synchronization, mode changes, and undo/redo. Opening a
  source or project, closing the source, and exiting offer Save, Discard, and
  Cancel without losing the dirty state when a replacement document fails to
  load; source reload preserves the state and explicit project save clears it.
- Tools > Create Trimmed File Copy reproduces the diagnostic raw-copy workflow
  for the beginning, end, explicit MiB offset, or current selection. The worker
  performs bounded byte-for-byte copying through a temporary file, atomically
  replaces the destination, rejects source overwrite, and reports a SHA-256.
- Tools > Display Adjustment provides persisted brightness and contrast with a
  live preview and reset behavior. Adjustment is deliberately applied only
  after display scaling, so export data and full-resolution frame capture retain
  the decoded source pixels and playback cost stays bounded by window size.
- Tools > Options now opens a VideoReDo-style multi-page Program Options dialog
  instead of a single-purpose navigation form. General settings cover overlap
  replacement, Joiner description prompts, and clearing recent files;
  Navigation retains the short/long jump controls; Playback Devices can force
  video-only editing without changing saved audio; and Audio Alerts implements
  Never, Interactive only, and Interactive and Batch completion policies with
  an optional external WAV file and system-beep fallback. Successful validated
  interactive exports and successful batch video outputs honor the policy.
- Open Video and file drag/drop now accept multiple source files. The persisted
  General option can prompt, add the sorted files to the Joiner, or Combine them
  into one validated editable program. Combine uses the existing compatible
  packet-copy Joiner engine, fingerprints source path/size/mtime, and keeps a
  reusable combined source under the per-user application-data directory; an
  offscreen gate verifies both the sorted Join route and a two-source editable
  Combine route.
- View > Show Plot Mask and the Enhanced Features options page reproduce the
  spoiler-avoidance overlay documented by the reference help. Small, Medium,
  Large, and Extra Large settings cover the centre of the scaled preview only;
  frame capture and exported pixels remain untouched. Pixel-level smoke
  coverage verifies the centre is masked while the outside image is preserved.
- Adding a cut that intersects existing cuts now follows the documented
  Overlapping Selections workflow: Combine merges the ranges, Replace removes
  the old intersecting cuts, and Cancel leaves the edit model unchanged. The
  Options dialog persists automatic replacement for users who disable prompts.
- File > Save Chapter File and Tools > Chapter Marks implement configurable
  text chapter output from cut points, scene/Ad-Detective markers, equal time
  spacing, or equal parts. Markers in removed video are omitted, later markers
  are retimed to output time/frame coordinates, minimum spacing and first-frame
  rules are enforced, and successful exports can create the atomic chapter file
  automatically using VideoReDo-compatible `%F`, `%T`, `%N`, and `%C` templates.
- The fixed control-IPC architecture now has a production Windows named-pipe
  transport and worker endpoint. Messages are local-only, versioned UTF-8 JSON
  framed by a little-endian 32-bit length with a 16 MiB ceiling. Request IDs,
  protocol/version health checks, bounded client waits, and graceful shutdown
  are verified against real worker and CLI processes under both UCRT and MSVC.
- Source navigation/index construction is the first production GUI operation
  migrated to the persistent control worker. Requests carry source paths as
  escaped UTF-8 JSON, run off the UI thread, and are generation-checked so a
  stale result cannot replace a newly opened source. The GUI restarts a dead
  control worker and falls back to the established one-shot worker after a
  bounded connection failure. Dedicated automation proves initial IPC, forced
  worker restart, and forced fallback in one end-to-end source-load sequence.
  Window teardown invalidates pending generations, stops every timer and worker,
  waits for process exit, and joins IPC clients before QObject child destruction;
  the project save/reopen/journal recovery flow passed ten consecutive teardown
  repetitions after this race was exposed by the full matrix.
- The fixed preview-IPC architecture now has a Windows local shared-memory
  transport with a versioned/magic-checked bounded header, sequence and display
  frame IDs, dimensions, stride, pixel format, colour-display and tone-map
  metadata, pixel payload, duplicate-name protection, and sequence-matched
  lifetime acknowledgement. UCRT, MSVC, and AddressSanitizer tests all exercise
  publication, independent acquisition, byte equality, bad-sequence rejection,
  acknowledgement visibility, and automatic unmapping/handle cleanup.
  Decoded GUI preview frames now use this path end to end: the worker publishes
  BGRA pixels, emits the ready descriptor, waits for the GUI's matching
  acknowledgement, and only then releases the mapping. The GUI copies the
  validated frame into its bounded eight-frame cache; no intermediate worker
  image file is used for transfer.
- The current UCRT baseline passes all 64 executed tests in its 65-test
  configuration. Application
  Verifier is reported as skipped when that optional external tool is absent.
  The clean release gate produces and independently launches the portable ZIP
  and NSIS installation, validates uninstall, verifies dependency licences and
  SBOM contents, and emits a corresponding-source ZIP.
- The refreshed 2026-08-03 release gate passed after the GUI parity updates.
  SHA-256 values for the portable ZIP, per-user installer, and corresponding
  source are written to generated `SmartCut64-1.0.2-SHA256SUMS.txt` beside the
  artifacts to avoid embedding release-instance or self-referential checksums
  in the source archive.
  The source gate now verifies that the 255-entry archive includes the tracked
  SmartCut64 application source and schemas as well as all pinned dependency
  sources; this closes the prior omission of the application's own C++ files.
- DVD authoring and burning remain deliberately deferred at the owner's
  request. The remaining external release conditions are trusted code signing,
  independent legal review, and broad manual player interoperability.

## 2026-08-03 VideoReDo-compatible workflow update

- Save Video now follows the VideoReDo cut-list model: Mark In/Out defines a
  selection, while every red cut-list range is removed from the saved program.
  The worker normalizes overlapping cuts, smart-renders each kept complement,
  preserves selected streams, joins all kept segments with continuous output
  timing, validates the result, and transactionally replaces the destination.
  The same semantics are used by queued batch jobs. Backend and offscreen-GUI
  regressions prove a one-frame middle cut produces the expected decoded frame
  count, including a selected video/audio/subtitle export.
- Verification at this interaction/recovery checkpoint passed all 52 configured tests;
  the optional external Application Verifier test was the only skipped check.
- Project save/open now serializes the complete kept-segment complement and
  selected stream set. Opening a project reopens its canonical source,
  reconstructs the red cut ranges, restores stream selection, and validates
  the audio/project metadata. A debounced atomic autosave follows later cut or
  stream changes; the offscreen round-trip gate verifies save, reopen, state
  restoration, and autosave persistence.
- Legacy navigation bindings now follow the reference help: Ctrl+O opens video,
  Ctrl+P saves a project, Ctrl+S saves video, Ctrl+Q selects streams, Ctrl+T
  opens timecode navigation, F3/F4 set selection bounds, Delete/Insert add the
  selected cut/trim, Ctrl+I/Ctrl+R manage cuts, S/E jump to selection bounds,
  Tab/Shift+Tab traverse cut boundaries, and Home/End/arrows/Page Up/Page Down
  provide reference-style navigation. File > Open Recent is now a populated,
  path-aware submenu.
- Edit/Preview mode now follows the reference workflow: P and the centre
  preview control toggle a purple output-preview timeline, cut regions become
  boundary diamonds, displayed output frame/time values exclude removed
  ranges, and playback skips red cuts. The speaker control and M toggle mute;
  Shift+M/Ctrl+M and the slider adjust live worker playback volume.
- The remaining high-frequency display/navigation bindings are present:
  Alt+Enter full screen, F1 keyboard help, F12 source reload while retaining
  edits and selected streams, Z/F7/F8 timeline zoom, comma/period zoom pan,
  numeric thumbnail navigation, and Ctrl+number or +/- interval selection. A
  real-media GUI gate verifies that reload preserves the active edit state.
- Tools > Options now configures the short and long navigation jumps instead
  of opening the thumbnail dialog. Ctrl+D shows per-stream Program
  Information, and the video, timeline, and thumbnail areas expose
  reference-style context menus; thumbnail double-click lowers the interval.
  Adding an edited project to the Joiner now smart-renders its cut/stream
  snapshot before queueing it, with a real-media GUI regression.
- Tools > Keyboard Shortcuts now edits and persists more than sixty global
  editor, transport, audio, preview, zoom, thumbnail, reload, fullscreen, and
  help bindings. It restores the legacy defaults and rejects duplicate keys;
  the offscreen smoke gate verifies runtime rebinding.
- The preview image now toggles play/pause on a left click. Cut-list rows seek
  to their start and double-clicking brackets the cut for adjustment. File,
  Edit, View, and editor context menus now expose the corresponding close,
  program-bound, selection, bookmark, thumbnail, zoom, full-screen, capture,
  and information commands.
- Projects persist chapter/Ad markers as well as cuts and streams. Every edit
  also appends a compact journal snapshot immediately; reopening selects the
  newest complete matching-source snapshot and ignores a torn final line. A
  real GUI gate proves a newer journal cut and chapter marker override an older
  atomic autosave after simulated interruption.
- Stream Selection now lists every probed video, audio, subtitle, attachment,
  and data track with codec/language/title metadata. The chosen tracks are
  honored by both whole-source and smart-rendered range exports; output packets,
  codec extradata, metadata, chapters, and zero-based timing are independently
  validated before success.
- Save Video now includes persistent VideoReDo-style output profiles:
  Intelligent smart render, Keyframe-Only lossless GOP-aligned copy, Full
  Transcode with the matching source codec, and QuickStream Fix whole-source
  packet copy. The Output Profile Manager documents each mode. A backend gate
  proves a cut inside a single GOP remains GOP-aligned in keyframe-only mode,
  while full transcode removes the exact requested display frame.

- Ad-Detective is operational end to end: asynchronous decoded-frame scanning,
  central-80-percent scene/black analysis, configurable thresholds and marker
  spacing, progress/cancel, chapter-marker navigation, and optional automatic
  commercial cuts. A synthetic scene-change fixture proves the GUI receives at
  least one real detected transition.
- The thumbnail strip now uses decoded source frames at the source display
  aspect ratio. Its interval, size, visibility (F11), and decoded audio graph
  are configurable; Shift+F11 opens the options dialog.
- Real decoded audio peaks replace the former placeholder waveform.
- Joiner packet-copies compatible ordered sources and validates the result.
- QuickStream Fix rebuilds timestamps from zero, packet-copies all compatible
  streams/chapters/attachments/tags/HDR data, and removes output unless the
  structural, payload, metadata, and timing validation passes.
- Batch Manager queues full-copy or complete cut-list jobs, supports ordering and
  removal, runs them sequentially, and records per-job completion/failure.
- Frame capture supports clipboard and PNG/JPEG/BMP/TIFF output. VideoReDo-style
  B/J bookmark set/jump behavior and timeline/info display are implemented.
- DVD authoring/burning remains deliberately deferred at the owner's request.
- Current verification baseline: all 64 executed tests pass in the 65-test
  configuration; the optional
  Application Verifier test is skipped when that external tool is not installed.

Next compatibility work: finish release-toolchain verification and extend the
manual player/interoperability corpus.

## Current milestone

M13 - hardening, performance, packaging, and release candidate. M0-M12 now
have automated implementation gates; compatibility expansion,
interoperability, independent legal review, and signing remain. The media suite exercises Main10/HDR10/HDR10+/Dolby Vision P8.1,
multitrack audio/subtitle/attachment/chapter behavior, VFR and offset timing,
and strict output validation.

## Revised-plan audit

- M0: complete. Clean x64 configure/build/test evidence is recorded.
- M1: complete. FFmpeg 9.0, x264, combined x265 Main/Main10, libaom,
  libvpx, libdovi, Qt, libplacebo, and the supporting dependency set are built
  and runtime-validated.
- M2: complete for the private metadata laboratory gates. HDR10+/Main10
  Matroska variation, five-frame source/output comparison, and Dolby Vision
  RPU coverage all pass. Production editing and GUI work proceed as the next
  milestone.
- GUI scope: future UI work will independently reproduce the requested legacy
  layout, workflows, shortcut semantics, and editing/navigation behavior.
- M3: complete. Source identity, FFmpeg stream probing, conservative HEVC
  access-unit indexing, index sidecar persistence, and stale-cache validation
  are implemented and tested.
- M4-M10: automated gates complete; broader compatibility/player testing stays
  in M13.
- M11: complete for the Version 1.0 copy policies. Two named/language audio
  tracks, text subtitles, attachments, chapters, VFR timestamps, track offsets,
  negative AAC delay timestamps, missing source packet duration, overlap
  tolerances, and ten-minute drift checkpoints are release-gated. Boundary
  audio re-encode is deliberately not offered because no per-codec encoder
  matrix has been approved.

## Exact verification

M0 successful on 2026-08-01:

- cmake --preset windows-x64-debug - configure completed with MSVC 19.51.36252.0
- cmake --build --preset windows-x64-debug - build completed
- ctest --preset windows-x64-debug - 100% passed: unit, CLI x64, and worker x64

M1 successful checks:

- dependencies/scripts/verify-lock.ps1 - M1 dependency lock verified: 9 dependencies
- dependencies/scripts/build-m1.ps1 - verified and extracted all 9 locked dependencies
- dependencies/scripts/check-runtime.ps1 -RuntimeDirectory artifacts/m1/bin - runtime DLL validation passed
- default MSVC and UCRT64 FFmpeg-enabled builds/tests - 3/3 tests passed in each configuration

M3 initial checks:

- `smartcut-cli probe --input build/m2-hdr10plus-variation.mkv` emitted a
  `source-identity-v1` record with canonical path, size, timestamp, boundary
  hashes, and a stable source UUID.
- `ctest --preset windows-x64-debug` - 3/3 tests passed, including the source
  identity unit regression and x64 PE checks.
- `smartcut-cli index --input build/m2-extracted.hevc` emitted five HEVC access
  units, classified the first as random access, and preserved NAL ranges.
- `smartcut-cli index --input build/m2-extracted.hevc --output
  build/m2-extracted.index.json` persisted an `index-cache-v1` record including
  the source identity and access-unit index.
- `smartcut-cli validate-index --input build/m2-extracted.hevc --index
  build/m2-extracted.index.json` accepted the matching cache and rejects a
  cache when the source UUID changes.
- `smartcut-cli probe --input build/m2-hdr10plus-variation.mkv` emitted a
  `probe-v1` record identifying Matroska, HEVC Main 10, 64x64, yuv420p10le,
  time base 1/1000, and the BT.2020/PQ colour fields.

## Clean-room boundary

No VideoReDo code, binaries, resources, branding, activation system, private
formats, or copyrighted media are imported. Any legacy-compatible UI will be
independently implemented.

## M1 codec build evidence

- x264: built and installed as a 64-bit shared DLL with headers, import library, and pkg-config metadata.
- x265: CMake 4.4 compatibility patch applied; configured, built, and installed successfully as a 64-bit Main10 shared DLL and static library.
- FFmpeg: rebuilt against the Main10 x265 and installed into artifacts/m1.
- libplacebo, Qt, libdovi, and all locked support dependencies built successfully.

## M2 evidence

- `metadata-lab --generate-mkv build/m2-roundtrip-injected.mkv` creates five
  Main10 HEVC frames with static HDR10 side data and serialized HDR10+ data.
- Container inventory reports `decoded_frames: 5`, `decoded_is_10bit: true`,
  `hdr10plus_t35_bytes: 23`, `hdr10plus_sei_bytes: 39`, and
  `packet_sei_nals: 5` after Matroska mux/demux.
- The independent packet scan supports both Annex-B and four-byte
  length-prefixed HEVC access units, so physical SEI coverage is not inferred
  from decoder side data.
- `rpu_injector` now wraps raw dovi_tool RPU payloads as HEVC type-62 NALs and
  prepends them to Annex-B access units; unit coverage confirms the inventory
  identifies the resulting RPU NAL.
- `metadata-lab --inject-rpu raw_rpu.bin` now writes an injected Annex-B
  stream and reports its independent NAL inventory. Against the pinned
  dovi_tool test asset, the report increased RPU coverage from 259 to 260
  units, proving the CLI path is wired end-to-end.
- `tools/inject-rpu.ps1` now wraps dovi_tool's frame-aware `inject-rpu` command
  for full per-frame RPU interleaving; the application-level prepender remains
  intentionally limited to single-payload laboratory tests.
- `tools/verify-rpu-roundtrip.ps1` compares dovi_tool's exported frame count
  with SmartCut64's independent type-62 NAL count and fails when coverage is
  incomplete.
- The verifier passes on the pinned test stream: `rpu_records: 259`,
  `hevc_rpu_nals: 259`, `coverage_complete: true`.
- `tools/verify-mkv-rpu.ps1` now applies the same check after extracting an
  HEVC track from Matroska, covering the container boundary as well.
- `tools/run-m2-roundtrip-gate.ps1` now drives the generated MKV laboratory
  and requires five decoded 10-bit frames plus physical HDR10+ SEI coverage.
- Corrected the T.35 injector to avoid duplicating FFmpeg's already-complete
  T.35 header. The regenerated MKV gate now passes without invalid type-39
  decoder warnings.
- Container reports now hash each physical SEI NAL and expose
  `packet_sei_variants`; the current fixed-payload laboratory reports one
  verified payload variant.
- Added `tools/run-m2-hdr10plus-variation-gate.ps1`, which uses the supported
  `hdr10plus_tool` editor/injector workflow with its upstream fixture, then
  remuxes and independently inventories the result. The gate passes with five
  decoded Main10 frames, five physical HDR10+ SEI messages, and four distinct
  physical payload hashes. It also extracts the remuxed metadata and compares
  SHA-256 hashes for all five source/output frame records; all five match.
- Revalidated the Matroska RPU boundary with the pinned `regular.mkv` fixture:
  dovi_tool exports 259 source records and SmartCut64 independently counts 259
  HEVC RPU NALs, with complete coverage.

## Next action

M4 initial implementation is active: seek-assisted decode, a bounded queue,
and acknowledged preview-frame transport wired to decoded FFmpeg planes are
implemented, with a source-keyed thumbnail cache and explicit display color
labels. Integer frame stepping and previous/next keyframe navigation are now
implemented for the shared core, along with an integer-rational audio-master
preview clock and drift measurement.
Playback synchronization policy now maps drift to present/hold/advance actions
using an explicit video-tick tolerance.
- FFmpeg stream probes now include start time, duration, sample rate, and channel
  count for every stream, providing the timing inputs required by audio-master
  playback.
- `smartcut-cli sync` exposes that policy as a worker-testable JSON contract;
  present, hold, and advance decisions are covered by unit tests.
- Added `audio-timing --input`, which emits native audio packet PTS, DTS,
  duration, size, and time-base records for the worker synchronization loop.
- On a generated AAC-plus-Main10 Matroska fixture, the audio timing probe
  returned a 1/1000 time base and real packet timestamps including the expected
  encoder-delay packet at PTS -21 followed by 0, 21, and 43.
- `smartcut-worker --sync-step` now owns the playback synchronizer boundary and
  emits `worker-playback-sync-v1` decisions from audio/video timestamps.
- `smartcut-worker --sync-input --input build/m4-av-fixture.mkv --frame 3`
  now combines a real audio packet timestamp with a decoded video-frame PTS and
  emits `worker-media-sync-v1`, using the video time base from the FFmpeg probe
  rather than a hard-coded assumption.
- M5 has started with an immutable project model: source references and kept
  segments use integer display-frame boundaries, and invalid source/range
  references are rejected by unit tests.
- M5 now includes reversible segment edit commands with undo/redo and atomic
  temporary-file project persistence.
- M5 autosave journaling is implemented as JSON Lines; recovery replays valid
  segment operations and is covered by unit tests.
- M5 render-plan generation now emits explicit `CopyVideoPackets` operations
  for validated kept segments and records the reason for each operation.
- M5 now classifies HEVC segment starts conservatively: random-access starts are
  copy candidates, while starts inside a GOP produce `EncodeVideoBoundary`.
- M5 repair-window merging now combines overlapping and adjacent boundary ranges
  and discards empty ranges before multi-segment planning.
- M5 multi-segment planning now resolves each segment against its source index
  and emits independent copy or boundary-encode operations with explanations.
- Render plans now serialize source UUID fingerprints and the dependency
  versions used to derive the plan.
- `smartcut-cli render-plan` generates a plan from a real source identity, and
  `validate-plan` rejects a plan when the source UUID no longer matches.
- Render execution reporting scaffolding now counts planned copy and boundary
  encode operations and explicitly labels validation as pending the executor.
- M6 initial executor slice now remuxes a complete MKV by packet copy, preserving
  codec parameters and stream time bases; final output validation remains a
  separate required step.
- The copy executor was audited against the source: five decoded Main10 frames
  and four physical HDR10+ payload variants were preserved in the copied MKV.

- `smartcut-cli frame --input build/m2-hdr10plus-variation.mkv --frame 3
  --max-decode 5` selected frame 3 at PTS 120 with yuv420p10le and preserved
  color fields after seek-assisted decode.
- The unit suite verifies the preview queue enforces capacity and FIFO order.
- `smartcut-cli preview --input build/m2-hdr10plus-variation.mkv --frame 3`
  published and acknowledged a 12,288-byte yuv420p10le preview buffer with
  width 64, height 64, and stride 128.
- `tools/run-m4-seek-gate.ps1` checks frames 0 through 4 independently and
  requires exact display indices, valid PTS values, Main10 pixel format, and
  positive dimensions for every result.
- `smartcut-cli preview --input build/m2-hdr10plus-variation.mkv --frame 3
  --bgra` converted the decoded frame to BGRA (`pixel_format: 28`), producing a
  16,384-byte 64x64 buffer with stride 256 and successful acknowledgement.
- Preview records now label `display_color_mode` and `tone_mapped`; the current
  BGRA presentation is explicitly `source-bgra` with `tone_mapped: false`.
- Added the explicit display-only `--tone-map-sdr` path. It converts through
  BGRA, applies a bounded SDR display transform, preserves source frame/color
  identity, and reports `display_color_mode: tone-mapped-sdr`.
- `tools/run-m4-preview-gate.ps1` now compares source-color BGRA and
  tone-mapped-SDR output for the same frame, requiring matching frame identity
  and geometry with distinct, truthful display labels.
- `tools/run-m4-seek-gate.ps1 -InputFile
  build/dependencies-m1/source/libdovi/assets/hevc_tests/regular.mkv
  -FrameIndexes 0,17,64,128,258` passed on the 259-frame HEVC fixture,
  covering early, middle, and final-frame seeks.

- M6 now has a keyframe-safe range executor: it accepts video-packet bounds,
  requires the first selected packet to carry a keyframe flag, and reports its
  explicit interleaved-packet audio policy.

Next action: audit the keyframe-range output by reopening it with FFmpeg and
checking the selected frame count, stream metadata, and packet boundaries.
- Full-copy validation now compares stream codec metadata and packet payloads;
  `validate-copy-mkv` passed for `build/m6-copy.mkv` with 5 packets and 0
  mismatches, while correctly rejecting the 3-packet range as non-equivalent.

Next action: add explicit output-packet timing checks before declaring the M6
executor gate complete; the full-copy executor now applies a fresh zero-based
timestamp policy during remux.
- The copy validator now rejects negative or regressing output DTS/PTS values;
  the regenerated full-copy fixture passed with 5 packets, 0 payload
  mismatches, and 0 timing violations.

Next action: integrate the validated copy operation with render-plan execution
selection and add a report that maps planned safe segments to output ranges.
- Render reports now enumerate every `CopyVideoPackets` operation with its
  operation index, source UUID, frame range, and explicit
  `packet-copy-selected` execution decision.

Next action: connect these selected ranges to the packet-range executor once
the source access-unit index supplies the frame-to-packet mapping.
- The packet-copy remux now preserves container metadata plus stream
  disposition, average frame rate, sample aspect ratio, and stream metadata
  alongside codec parameters.

- Chapter records are now copied with their time ranges and metadata, and the
  output audit rejects a chapter-count change.

- The output audit now checks source format/track/chapter tags as a subset of
  the copied metadata, while preserving attachment codec payloads through the
  existing stream codec-parameter comparison. Muxer-generated `DURATION` and
  `ENCODER` tags are intentionally excluded because fresh timestamps and the
  output muxer legitimately regenerate them.

- The multi-track M6 audit exposed and fixed leading-audio loss caused by
  seeking back to the first video keyframe during the packet scan. The executor
  now reopens the source from byte zero; the audio/video fixture copied all 16
  packets and validated with 0 metadata, payload, and timing mismatches.

Next action: add a negative regression fixture for a deliberately altered
packet, then advance to boundary smart-render execution.
- M7 boundary execution now decodes a selected video range, re-encodes it with
  the pinned libx265 path as an independently decodable closed-GOP segment, and
  emits a boundary execution report. The 3-frame fixture range encoded to 3
  packets, decoded as 3 Main10 frames, and its first packet was keyframe-marked.

- M7 boundary validation now requires exact packet and decoded-frame counts,
  a keyframe-marked first packet, and nonnegative/nonregressing timestamps. The
  3-frame boundary passed with 3 packets, 3 decoded frames, and 0 timing
  violations.
- A truncated request for frames 4 through 8 was rejected with a nonzero exit
  status and removed its partial output.

Next action: preserve and validate ordinary SDR colour metadata through the
boundary encoder, then test joining the replacement segment to copied GOPs.
- Boundary validation now compares replacement dimensions, pixel format, range,
  primaries, transfer, matrix, chroma location, and sample aspect ratio against
  the source; the replacement passed with `color_match: true`.
- Added a video-segment joiner. A one-frame copied prefix joined to the
  three-frame replacement produced four packets and passed strict decode,
  keyframe-start, color, and timestamp validation.

Next action: add a joined-output source-frame mapping and copied-prefix payload
check before widening M7 beyond the single-stream video path.
- Joined-output validation now reopens the result for strict decode and checks
  copied-prefix and replacement packet payloads in their expected order. The
  four-frame join passed with 0 payload mismatches and 0 timing violations.

Next action: add explicit source-frame mapping fields to the join report and
then begin multi-track boundary policy work.
- Join reports now include copied and replacement source frame ranges plus their
  output frame ranges. Boundary reports explicitly state that audio is not
  copied when the source contains an audio track; this executor remains a
  video-only segment primitive, not a complete multi-track export.

Next action: add the corresponding audio-track policy to render planning and
prevent a full export from treating a video-only boundary segment as complete.
- Render operations now carry an explicit audio policy, and render reports emit
  `audio_ready: false` until audio-range operations are implemented. The unit
  suite covers this refusal-to-claim-complete behavior.

Next action: add explicit audio operations to the plan model for complete
source-track copying and boundary overlap policy.
- Render plans now emit an explicit `CopyAudioPackets` placeholder for each
  kept segment, with a pending overlap/retiming policy. Reports count these
  audio operations and keep `audio_ready: false` until their implementation is
  complete.

Next action: connect `CopyAudioPackets` to probed audio streams and define the
complete-frame overlap and retiming fields without changing video mapping.
- The probe path now records the primary audio stream index, time base, sample
  rate, and channel count in the project source and render operations. The
  audio fixture plan correctly identifies stream 1 with time base 1/1000 while
  keeping its policy pending until overlap/retiming execution exists.

Next action: implement complete audio-frame overlap selection and output-time
base retiming for `CopyAudioPackets`.
- Added `audio-select`, which selects complete audio packets whose presentation
  intervals overlap a video PTS range and reports integer time-base retiming and
  measured tolerance. The audio fixture range 0..120 selected 6 packets with
  0 leading and 8 trailing time-base ticks of tolerance.

Next action: use this selection result in an audio packet-copy writer and carry
its retimed timestamps into the final MKV executor.
- Added `copy-audio-window`, which writes the selected complete audio packets to
  a fresh zero-based MKV audio track. The 0..120 fixture window wrote 6 packets;
  reopening it reported PTS 0, 21, 43, 64, 85, and 107 in time base 1/1000.

Next action: add an audio-copy validator for packet payload order and timestamp
monotonicity, then combine the validated audio track with final video output.
- Added `validate-audio-copy`; the 6-packet audio window passed with 0 payload
  mismatches and 0 timing violations. `mux-mkv` then combined it with the
  four-frame joined video, producing 4 video packets and 6 audio packets.
- The final two-stream fixture reopened with 4 decoded Main10 frames and audio
  PTS 0, 21, 43, 64, 85, and 107 in time base 1/1000.

Next action: add final combined-output validation that checks both tracks and
rejects missing or reordered audio/video packets before success.
- Added `validate-mkv-av`; the final two-track fixture passed with 4/4 video
  packets, 6/6 audio packets, 0 payload mismatches, and 0 timing violations.

Next action: wire this combined validator into the render completion status so
an export cannot report success while either track remains unvalidated.
- Render reports now emit `completion: BLOCKED-AUDIO-POLICY` when audio is not
  ready. `validate-render-report` combines the report with the AV validation;
  the current fixture had `tracks_validated: true` but was correctly rejected
  because `audio_ready` was false.

Next action: implement the completed audio policy transition only after a
final export has a concrete audio operation and retiming result.
- `validate-render-report` now accepts a passing audio-copy validation artifact
  as the concrete transition evidence. Without it, the same report remains
  blocked; with the passing 6-packet audio validation and AV validation, the
  completion result transitions to `PASSED`.

Next action: bind validation artifacts to source/output fingerprints before
allowing this completion transition for arbitrary files.
- Audio-copy validation now includes source and output fingerprints. A matching
  audio/render source completed successfully with `source_bound: true`; using
  the older render report was rejected with `source_bound: false`.

- Combined AV validation now includes the final output fingerprint. The
  completion gate accepts the extended form
  `validate-render-report --report R --validation V --audio-validation A
  --output O` only when the render source matches the audio evidence and the
  exact final output matches the AV validation artifact; the fixture passed
  with `source_bound: true`, `output_bound: true`, and all tracks validated.

Next action: carry this completion evidence into the first end-to-end export
executor and GUI progress surface.
- Added the first end-to-end `export-mkv --input ... --output ...` executor.
  It performs a fresh packet export and immediately runs the full copy audit;
  the two-track fixture completed with `status: PASSED`.

Next action: expose the same executor state through the desktop GUI command
surface while preserving the completion gate.
- Added the worker export bridge: `smartcut-worker --export --input I
  --output O` emits a flushed `worker-export-v1` `started` event followed by a
  `completed` event containing the validated export report. This is the GUI
  progress/status seam and returns a failing process status when validation
  fails.

Next action: add the Qt Widgets shell that consumes these worker events.
- Added the optional Qt Widgets shell (`SMARTCUT_BUILD_GUI=ON`). It provides
  source/export path selection, launches the worker export protocol, displays
  its JSON event stream, and reports validated or failed completion. The
  default MSVC preset remains GUI-off because the installed M1 Qt artifacts are
  MinGW-built and must not be linked into the MSVC binaries.

Next action: configure a native MinGW Qt GUI build and add its smoke launch
check alongside the existing MSVC media gates.
- Added the reproducible `windows-ucrt-gui` configure/build/test preset. It
  was configured and built with UCRT64 GCC 16.1, linked the Qt Widgets shell,
  and passed all three tests.

Next action: add the GUI smoke-launch check and begin the editor workspace
layout.
- Added `smartcut-gui-smoke`, a headless Qt initialization test using
  `QT_QPA_PLATFORM=offscreen`; the UCRT64 GUI preset now validates the shell
  startup without requiring an interactive desktop.

Next action: begin the dense editor workspace layout and connect its export
controls to the worker protocol.
- Added the first editor workspace surface: dark preview pane, inspector pane,
  timeline ruler with clip blocks/playhead, and visible keyboard workflow
  hints. Export remains connected to the worker event protocol.

Next action: add real frame navigation state and bind the timeline playhead to
the indexed source model.
- Timeline navigation is now stateful: Left/Right steps frames, J/K moves
  between keyframes, I/O sets range marks, and the playhead/status label update
  from the shared `FrameNavigation` model.

Next action: load real frame-count/keyframe data from the indexed source when
the user chooses an input.
- Added `video-navigation-v1` source probing in the worker. The GUI now probes
  a chosen input and reconfigures the timeline with its actual video packet
  count and keyframe positions; the five-frame fixture returned 5 frames and
  keyframe 0.

Next action: replace packet-count navigation with decoded-frame indexing where
codec reordering requires it, then connect preview requests to the playhead.
- Added worker preview requests with `--preview --input I --frame N`. Timeline
  movement now asks the worker to decode the selected frame and updates the
  preview pane from the returned frame metadata; fixture frame 2 decoded at
  64x64 with PTS 80.

Next action: convert decoded preview planes into a displayed Qt image and keep
preview requests cancellable during rapid timeline movement.
- Added `worker-preview-image-v1`: the worker converts decoded frames to BGRA,
  writes a temporary PPM preview, and the GUI loads it into the preview pane.
  The fixture produced a valid 64x64 image for frame 2; replacing a request
  kills the prior worker process.

Next action: add preview cache ownership and avoid a shared temporary filename
when multiple editor windows are open.
- Preview images are now owned by a per-window `QTemporaryDir`; each editor
  instance has an isolated cache path and cleanup lifecycle, so concurrent
  windows cannot overwrite one another's frame image.

Next action: add bounded multi-frame caching and invalidate it when the source
identity changes.
- Added a bounded eight-frame preview cache. Repeated playhead visits reuse
  existing images, oldest entries are removed, and selecting a new source
  clears the cache before probing the replacement identity.

Next action: surface source identity and cache state in the inspector, then
begin audio/video preview synchronization.
- The inspector now shows the probed source UUID, cache occupancy, and whether
  the displayed preview came from the worker or cache. Source selection clears
  the cache before the identity probe completes.

Next action: add audio timing state to preview events and display synchronized
video/audio drift in the inspector.
- Added `worker-preview-sync-v1`; each playhead preview now probes audio/video
  timestamps and reports drift plus the synchronization action. Fixture frame 2
  reported drift 101 and `hold_video`, which is now shown in the inspector.

Next action: make preview playback use the synchronization action and add a
transport clock for continuous playback.
- Added the first transport clock: Play/Pause drives a 25fps timer, advances
  the shared timeline navigation, and routes every frame through the existing
  preview decode and synchronization workers.

Next action: make transport honor synchronization actions and stop cleanly at
the selected range end.
- Transport now honors `hold_video` by holding one timer tick, and stops at
  the Out mark or final indexed frame with a `Playback complete` state.

Next action: add explicit play-range validation and expose transport state in
the worker protocol for deterministic playback tests.
- GUI range validation now rejects an Out mark before the In mark and prevents
  transport playback from starting/continuing with an invalid range.

Next action: expose deterministic transport events for integration tests and
connect range boundaries to export planning.
- Added `worker-transport-step-v1`, a deterministic transport-step command
  covering frame advancement, hold behavior, range validity, and completion.
  Verified normal advancement and held-frame outputs against the 5-frame
  fixture range.

Next action: feed validated GUI ranges into the export executor and report the
same boundaries in export status.
- GUI In/Out marks now select the worker `--export-range` path. Range exports
  return `export-range-report-v1` with the exact first/end frame boundaries;
  the fixture completed its packet-copy phase with validation explicitly still
  pending, so it cannot be mistaken for a final validated export.

Next action: implement range-output validation and promote range exports only
after their copied packet window and audio policy are independently checked.
- Implemented `range-validation-report-v1`. Range export now audits the exact
  selected packet window, payload order, and first keyframe boundary before
  returning `PASSED`; the fixture range 0..1 passed.

Next action: extend the range audit to validate audio overlap/retiming and bind
the range output fingerprint into render completion.
- Range validation now audits audio packet timing and the range writer retimes
  the selected packet window to zero. The prior fixture PTS -21 is now PTS 0;
  the complete range export passes with audio timing violations at zero.

Next action: bind the range output UUID and range validation artifact into the
render completion gate.
- Added `validate-range-mkv` and bound its `range-validation-report-v1` into
  the existing completion gate. The range fixture completed with
  `source_bound: true`, `output_bound: true`, and `tracks_validated: true`.

Next action: carry range boundaries and validation evidence into persisted
project/export history.
- Added `ExportEvidence` to the project model and journal. Source UUID, output
  UUID, In/Out boundaries, and completion status now survive journal recovery;
  unit coverage verifies the evidence is restored.

Next action: have the GUI append export evidence after a passing worker result
and surface recovered export history in the inspector.
- GUI export completion now invokes `worker-export-evidence-v1`, which records
  source/output UUIDs, selected boundaries, and PASSED status into the output
  journal. The range fixture produced a recoverable evidence record.

Next action: load journal evidence on project open and display prior exports in
the inspector history panel.
- Added `worker-export-history-v1`. Choosing an export path now requests its
  adjacent journal and appends recovered evidence records to the inspector;
  the fixture history read back its PASSED source/output-bound range.

Next action: add explicit project open/save controls and associate journal
paths with project files rather than output filenames.
- Added GUI Save Project/Open Project controls. Save uses the worker's atomic
  project writer with the current source and In/Out range; Open loads the
  project JSON into the inspector, and project saves no longer trigger export
  evidence recording.

Next action: associate the project journal directly with the saved project and
restore its export history on project open.
- Export evidence now targets `<project>.journal` whenever a project is open;
  opening that project immediately reads the same journal into the inspector.
  Output sidecars remain the fallback when no project has been saved.

Next action: persist project journal path metadata and add a project-level
history summary instead of displaying raw journal JSON.
- Inspector history is now summarized as entry and validated-export counts;
  reopened projects no longer display raw journal lines.

Next action: persist the project journal path in the project document itself.
- Project documents now persist `journal_path`; GUI project saves pass the
  associated journal path to the atomic worker save, and the fixture document
  records `build/m8-project-journal.json.journal` explicitly.

Next action: use the persisted journal path when reopening projects and add a
project document schema check for the new field.
- Project reopen now reads `journal_path` from the document, with legacy
  sidecar fallback when absent. The project schema recognizes the optional
  field, preserving compatibility with older documents.

Next action: add project schema validation feedback and migrate stored source
paths to canonical portable forms.
- Project open now rejects documents missing the project schema/sources/segments
  markers and reports the failure in the status line. Project JSON serialization
  now escapes Windows backslashes and quotes correctly, producing valid portable
  JSON paths.

Next action: add formal schema validation for project documents and portable
path normalization across Windows/Linux project reopen.
- Added `worker-project-validation-v1` for formal project document checks and
  normalized serialized source/journal paths to forward slashes. The saved
  fixture validates successfully and remains portable JSON.

Next action: have GUI project open consume the worker validation result before
loading document contents.
- GUI Open Project now waits for `worker-project-validation-v1`; only a passing
  validation loads the document and its journal history into the inspector.

Next action: add negative-path GUI coverage for malformed project documents.
- Added `smartcut-project-validation-negative`; it creates a malformed project
  fixture, confirms the worker rejects it, and removes the fixture afterward.

Next action: add schema-level validation for required source and segment field
types beyond the current structural gate.
- Project validation now checks source UUID/path fields and segment video/range
  fields in addition to top-level structure. The negative integration fixture
  now uses the correct schema name but missing fields and is rejected.

Next action: validate field value types and cross-reference segment source UUIDs
against declared project sources.
- Project validation now checks segment source UUID cross-references against the
  declared source list. The negative fixture includes complete fields but an
  orphan source reference and is rejected.

Next action: validate numeric range ordering and stream index bounds against
probed source metadata.
- Project validation now verifies every segment has `end_display_frame_exclusive
  > first_display_frame` and reports `range_ordering`; the saved fixture passes
  with all structural, reference, and ordering checks true.

Next action: validate segment video stream indices against the probed source
stream inventory.
- Project validation now probes the declared source and checks each segment
  video stream index against the actual stream count. The saved fixture passes
  with `stream_bounds: true`.

Next action: distinguish video-stream type from mere index bounds and reject
segments targeting non-video streams.
- Project validation now confirms each referenced stream entry is type video,
  not merely an in-range stream index. The saved fixture passes with
  `video_stream_types: true`.

Next action: add a negative fixture targeting an in-range audio stream.
- The negative validation test now also targets stream index 1 in the
  audio/video fixture and confirms it is rejected as a non-video stream.

- Project save now persists the primary audio stream index, time base, sample
  rate, and channel count. Project validation cross-checks those fields against
  the source media when an audio stream exists; the generated project passes,
  while projects omitting or falsifying the metadata are rejected.

- Render-plan operations now carry `copy-complete-source-audio-packets` when a
  source has validated audio stream/time-base metadata, and explicitly mark
  missing metadata as blocked instead of leaving the policy pending.

- The GUI project inspector now displays the validated audio policy, stream,
  time base, sample rate, and channel count after a project passes validation.

- The GUI export action now performs a project-aware audio metadata preflight;
  projects without validated stream/time-base metadata are blocked with a
  corrective status message before worker execution starts.

- Added `worker-project-audio-validation-v1`, a structured worker response for
  audio metadata preflight. The negative project integration test now verifies
  that missing metadata returns `audio_metadata:false` and a failing status.

- GUI project opening now invokes the structured audio-validation worker
  command and stores its exit state; export preflight uses that result rather
  than parsing audio fields locally.

- Audio preflight results are now appended to the project journal as
  `audio_validation` records, and the structured worker response is visible in
  the GUI export log.

- Export-history readback now includes `audio_validation` records, and the GUI
  inspector reports their count and latest pass/fail state beside export
  evidence.

- Journal recovery coverage now includes an `audio_validation` record and
  confirms recovery preserves the project segments and export evidence while
  safely tolerating the informational preflight event.

- Project now carries `audio_validation_status` as a first-class field; project
  JSON schema recognizes it and journal recovery restores the latest status.

- GUI project inspection now displays the persisted audio-validation status
  alongside the live validated audio policy and metadata.

- Successful or failed audio preflight now refreshes `audio_validation_status`
  directly in the project JSON through a worker atomic-update command; the
  journal remains the audit trail.

- Regression coverage now updates a project JSON with the worker status command,
  reads it back, and verifies the persisted `audio_validation_status` value.

- Added `worker-project-summary-v1` with typed persisted audio status and key
  audio metadata; GUI project opening now requests and logs this response.

- The GUI inspector now uses `worker-project-summary-v1` as its displayed
  project state and shows a typed loading state while that response is pending.

- GUI smoke mode now asserts the expected export controls and inspector are
  constructed, including the initial audio state indicator.

- GUI smoke mode now accepts a project path, drives project validation and the
  typed-summary worker path, and asserts that the summary becomes available.
  The fixture passed against the generated project.

- Interactive GUI smoke now supports `--blocked`; it drives the actual Export
  control with invalid project-audio state and asserts the visible blocked
  status. Both summary and blocked smoke paths pass.

- Summary and blocked-export interactive smoke paths are now named CTest
  entries. The UCRT GUI suite runs 7/7 tests successfully.

- CMake now generates the GUI smoke project fixture from the checked-in media
  fixture during configuration; the summary and blocked-export tests no longer
  depend on `m10-project.json`.

- Added `worker-audio-info-v1`, a typed media probe response exposing stream,
  time-base, sample-rate, and channel metadata for fixture and tooling use.

- CMake GUI smoke tests now invoke `worker-audio-info-v1` at test time and use
  the probed stream/time-base/sample-rate/channel values to generate their
  project fixture.

- Added `worker-source-identity-v1`; GUI smoke fixture generation now derives
  the source UUID from the actual worker identity probe.

- Smoke fixture generation now asserts the expected schema and `PASSED` status
  markers for both audio-info and source-identity worker responses before
  creating the project.

- Added a named negative CTest that injects a malformed audio probe response
  and confirms the smoke fixture generator rejects it before GUI execution.

- Added equivalent negative CTest coverage for malformed source-identity
  responses. The UCRT GUI matrix now runs 9/9 tests successfully.

- Smoke fixture validation now checks typed positive numeric ranges for audio
  metadata and rejects empty source UUIDs in addition to schema/status markers.

- Probe schema/status, numeric range, and identity checks are centralized in
  `cmake/validate-probe-response.cmake` and reused by GUI smoke generation.

- Shared validation now covers `worker-project-summary-v1` before the GUI is
  launched, including typed audio fields and persisted validation status.

- Added negative project-summary response coverage; the UCRT GUI matrix now
  runs 10/10 tests successfully across positive and malformed-response paths.

- Smoke generation now writes a machine-readable
  `smartcut-gui-probe-contract-v1` report summarizing successful audio,
  identity, and project-summary validation, with a checked-in JSON schema.

- CTest smoke output now reports the absolute probe-contract artifact path;
  verbose CI logs can collect it directly.

- Smoke generation now asserts that the reported contract artifact exists and
  contains the expected schema and all three passed probe outcomes.

- Contract reports now use the deterministic path
  `build/<preset>/test-results/gui-probe-contract.json`; the generated artifact
  was verified after the 10-test UCRT run.

The deterministic report path is now recorded in `docs/TEST_MATRIX.md` for
handover and CI artifact collection.

Release documentation now requires the probe-contract artifact before GUI
packaging, including its schema and all-passed checks.

- Added `smartcut-gui-probe-contract-release-gate`, a dependent CTest that
  verifies the deterministic contract artifact before packaging.

- The release-gate CTest now emits a machine-readable
  `smartcut-gui-release-gate-v1` summary beside the probe contract artifact.

- Added dependent `smartcut-gui-release-summary-gate`, validating the emitted
  release summary before packaging. The UCRT GUI matrix now runs 12/12 tests.

The complete release-gate dependency chain is now documented in
`docs/TEST_MATRIX.md`.

A one-command Windows release gate now runs the complete UCRT suite and checks
both emitted artifacts.

The non-interactive CI invocation and expected release artifacts are now
documented in `docs/BUILDING.md`.

The release gate now rejects uncommitted tracked changes before configuring or
packaging.

The clean-worktree gate was exercised and correctly rejected the current
working tree because tracked pre-existing changes remain; those changes were
left untouched.

The clean-worktree check now uses native Windows Git to avoid false positives
from MSYS2 line-ending normalization, and the complete release gate passes.

The successful 12-test release-gate summary path is now recorded in
`docs/RELEASE.md` for final handover.

Packaging-readiness review is documented in `docs/RELEASE.md`: build and
validation gates are green; distributable packaging remains pending the
remaining release-plan gates.

A reproducible CPack ZIP prototype now builds successfully for the UCRT GUI
preset and includes bundled media and Qt runtime DLLs. The release gate now
rebuilds this ZIP and verifies its required executable, runtime, and SBOM
entries. Isolated extraction, CLI/GUI launch, and cleanup validation also pass.
Cryptographic signing remains pending a release code-signing certificate and
signing tool.

Release audit corrections: the portable package now includes the MinGW and Qt
support DLLs required on a machine without MSYS2, and its launch test runs with
a system-only PATH. GUI source identity probing now invokes the typed identity
worker command, and timeline marker scaling uses the actual frame count.

The A/V integration fixture is now stored deterministically in the repository
and materialized during CMake configuration, removing the prior clean-checkout
dependency on an ignored `build/m4-av-fixture.mkv` file.

Catch2 3.8.1 is now linked into the UCRT unit-test target. A separate
`windows-ucrt-gui-release` preset builds optimized binaries, runs the full
12-test matrix, and produces the portable package used by the release gate.

Both UCRT GUI presets now enforce warnings as errors. Ambiguous chained media
control flow was split and parenthesized; the optimized build completes cleanly
under GCC 16.1 with `-Werror`.

M0 governance gaps identified by the release audit are closed with checked-in
contribution rules and a Windows x64 CI workflow that verifies the dependency
lock, warning-clean MSVC build, tests, and PE architecture gates.

Distribution compliance now emits a deterministic 14-component CycloneDX SBOM
covering pinned media and MinGW runtime libraries, packages separate GNU debug
symbols and 73 dependency licence entries, and creates an 80 MB corresponding
source ZIP only after all seven source archive hashes pass verification.

M4 seek correctness now emits a padding-independent packed-pixel hash for every
decoded frame. The media-enabled presets run 10,000 deterministic randomized
seeks against linear-decode PTS/hash references; the complete UCRT matrix is
13/13. The MSVC preset now explicitly clears the MinGW media root, preventing a
stale CMake cache from mixing incompatible MinGW archives into an MSVC link.

M5 planning now distinguishes closed BLA/IDR access points from CRA/open-GOP
starts and emits conservative head/copy/tail ranges. Every cut position in the
synthetic GOP fixture is checked so copied spans begin and end only at proven
safe boundaries. Catch2 release checks now remain active under `NDEBUG`.

Public build, architecture, format, HDR, test, release, and third-party notes
have been reconciled with the prototype. They explicitly avoid claiming the
remaining M3-M13 production matrix, signing, installer, sanitizer/fuzz,
failure-injection, UHD performance, or interoperability work as complete.

M3 index caching now uses a versioned `index-cache-v3` envelope with a checksum
over the source identity and access-unit payload. Validation distinguishes
corruption, stale source fingerprints, unsupported schemas, and I/O failures;
`repair-index` atomically rebuilds truncated or corrupt caches. Dedicated CLI
coverage corrupts an on-disk cache, requires rejection, repairs it, and
revalidates it. Current gates pass 14/14 under UCRT and 4/4 under MSVC.

M3 probing now uses RAII ownership for its FFmpeg input context and emits typed
container metadata, stream count, chapters, profile/level, codec tags, bit
rates, frame rates, SAR/interlace, channel layout, dispositions, stream
metadata, and HDR mastering/CLL/HDR10+/DOVI side-data presence and DV
profile/level. A CMake JSON parser validates the deterministic A/V fixture
contract. Current gates pass 15/15 under UCRT and 4/4 under MSVC.

M3 decoded indexing now maps display frames to source packet number, file
position/size, PTS/DTS/duration and rational timebase without collapsing
duplicate timestamps. It records independently parsed AVC/HEVC random-access
type, parameter-set and Dolby RPU evidence, GOP safety, decoded format/colour/
SAR/interlace, HDR10+/mastering/CLL/caption hashes, and corruption flags. The
fixture gate requires the indexed frame count to equal an independent linear
decode and validates exact sequential display identities. Hand-authored BLA,
IDR, CRA, RASL, and RADL classifications are covered. Current UCRT coverage is
16/16.

The GUI worker `--source-info` path now returns the decoded frame index and its
NAL-derived random-access frame list. Timeline frame counts therefore represent
decoded display frames rather than packet counts, and J/K navigation no longer
trusts container key flags as codec-safety evidence.

Decoded container indexes now use the same checksummed, source-bound cache
envelope as the Annex-B laboratory index. GUI source loading reuses
`%LOCALAPPDATA%/SmartCut64/indexes/<source-uuid>-video-N.json`; malformed,
truncated, wrong-schema, or stale entries are rebuilt with atomic replacement.
The frame-index gate deliberately appends corrupt data and requires transparent
recovery before accepting the cache.

Dependency-aware index schema v2 now retains exact HEVC VCL classification,
including RADL/RASL, flags leading and discardable pictures, carries active
parameter-set hashes across the GOP, and records a conservative decode-start
packet for every display frame. Incompatible v1 payloads are invalidated by the
v2 frame-index/v2 cache and v2 Annex-B/v3 cache schema upgrades rather than
being silently reused.

The obsolete packet-count/container-key navigation probe has been removed.
Remaining stream-probe audio discovery now uses the same RAII format-context
ownership as the typed probe and decoded index paths.

M4 queue cancellation now uses C++20 stop tokens and condition-variable waits;
blocked producer/consumer and preview-acquire operations wake on cancellation or
close, and the unit gate requires completion in under two seconds. Frame and
preview requests now resolve exact PTS from the source-bound display-frame
index before seeking, eliminating the former frame-rate-derived identity on VFR
sources. The frame-index gate requests every fixture frame through the
production CLI and requires its PTS and decoded pixel hash to match the index.

Frame navigation now performs saturating signed stepping without unsigned
wraparound and supports integer one-second movement against indexed PTS and an
explicit rational timebase. The GUI binds Page Up/Page Down to this path while
Left/Right remain frame steps and J/K remain NAL-derived random-access steps.

M4 audio-master playback now decodes the primary audio stream through FFmpeg
and libswresample to interleaved S16 PCM, sends it to the Windows waveOut
device, and emits integer-microsecond worker progress for indexed video
navigation. The deterministic A/V fixture has a PCM hash gate, and an actual
device run completed through 207250 us. UCRT coverage is 17/17 and MSVC remains
4/4. Device playback now retains at most four decoded waveOut blocks rather than
the complete track. GUI pause requests graceful cancellation through a
per-session signal file and uses forced process termination only as a two-second
safety fallback. Versioned named-pipe control remains future protocol work.

Thumbnail cache identities now include both the immutable source UUID and an
index-generation fingerprint (schema, frame count, and random-access map).
Changing either identity cannot return a stale preview, while revisiting an
unchanged source can reuse its bounded eight-frame GUI cache.

M5 plans now expose a deterministic human-readable explainer alongside their
versioned JSON. `smartcut-cli explain-plan --input FILE --first-frame A
--end-frame B` lists each operation, frame range, source fingerprint, safety
reason, and audio policy.

Dependency-aware multi-segment planning now carries each source's validated
audio stream and rational timebase into both video and audio operations. Sources
without validated audio metadata remain explicitly pending rather than silently
inheriting another segment's track policy.

The M6 full-file MKV copy proof is now an active release test rather than only
historical evidence. It remuxes the deterministic A/V fixture, compares every
stream payload byte-for-byte, validates stream/container/chapter metadata, and
requires nonnegative monotonic output timestamps. UCRT coverage is 18/18.

The M7 boundary encoder is now release-gated on the deterministic fixture. It
encodes a three-frame independent Main 10 GOP and requires exact decoded frame
count, a key first packet, source colour agreement, and zero timestamp
violations. UCRT coverage is 19/19.

The M7 transition join is also release-gated: one copied source packet is joined
to a three-frame independent replacement GOP, then strictly decoded and checked
against both source payload sequences with zero timestamp violations. UCRT
coverage is 20/20.

The deterministic Main 10 generator now emits BT.2020/PQ VUI plus physical
mastering-display and CLL SEI. M8 boundary encoding reconstructs x265 HDR10
parameters from decoded source side data before opening the encoder. The release
gate compares every replacement frame's colour and static-metadata hashes to the
source and now passes 21/21 UCRT tests.

M9 boundary encoding now extracts physical HEVC prefix-SEI payload-type-4 NALs
from source packets in display order and prepends the corresponding payload to
each replacement packet. The deterministic Main 10 generator serializes five
valid, distinct FFmpeg ST 2094-40 scene payloads. `hdr10plus-sequence-v1` reports
exact per-packet hashes; the gate cuts across adjacent scene changes, requires
source frames 1-3 to map exactly to replacement frames 0-2, proves 3/3 physical
coverage and three physical variants, and strictly decodes the result. The
automated M9 gate is closed; broader long-form/player coverage remains in M13.

M10 now has an active pinned-fixture gate sourced from the hash-locked MIT
libdovi archive. The M1 build installs the linkable libdovi C API with pinned
cargo-c `0.10.24+cargo-0.98.0`; a tracked patch exposes upstream
`set_scene_cut` and causes libdovi to recompute the RPU CRC after mutation.
Boundary encoding rewrites an ordinary cut's first RPU as a self-contained
scene refresh, preserves every following type-62 RPU exactly, and copies the
Matroska DOVI configuration before writing the output header. The gate proves
both frames 1-5 (ordinary source frame) and 120-124 (true scene boundary): 5/5
physical RPU coverage, exact non-boundary alignment, Profile 8, Level 1, BL
compatibility ID 1, Main 10 BT.2020/PQ strict decode, and independent dovi_tool
extraction/parsing. UCRT coverage remains 23/23. Automated M10 correctness is
closed; compatible-player interoperability remains part of the M13 manual
matrix and no Dolby certification claim is made.

M11 now uses temporal overlap rather than the legacy "all non-video packets
before range end" behavior. A deterministic five-stream Matroska fixture has
VFR video timing, two offset AAC tracks with names/languages/dispositions, a
text event crossing the cut, a font attachment, and a chapter. Whole-file and
timed-range gates preserve stream order and payloads exactly, copy complete
overlapping audio codec frames, report 14 ms leading and 12 ms trailing
tolerance, split the crossing text event, trim the chapter, retain the
attachment, and strictly decode the primary audio. `av-drift-report-v1` samples
the beginning, every ten minutes, and the end; the sparse 20-minute fixture
proves checkpoint construction while the rendered short range stays within
27 ms. UCRT coverage is now 25 tests.

M12 now exposes frame/keyframe navigation, In/Out marks, real selection
undo/redo, keep/cut policy, keyboard shortcuts, bounded worker-decoded preview,
audio-master playback, project open/save validation, recent sources, source
HDR/profile inspection, plan review, progress/cancellation, logs, and accessible
control names through the Qt desktop shell. UI automation proves that its
serialized render plan is byte-identical to the CLI plan, drives a validated
range export through the worker, and verifies restart after a missing-worker
failure without damaging state. That export gate also found and fixed the
chapter validator's incorrect assumption that every source has one chapter.
The complete UCRT matrix passes 26/26 tests.

M13 hardening is active. The automated matrix now passes 36/36 UCRT tests and
adds 67 malformed/truncated-input cases, unavailable/read-only source and
destination checks, deterministic full-disk failure cleanup, interrupted GUI
export cleanup, Application Verifier heap/handle evidence, external ffplay
interoperability, and an eight-frame 3840x2160 Main10 decode whose measured
peak working set is 162,140,160 bytes under the 1 GiB gate. A separate MSVC
AddressSanitizer preset passes 4/4 portable-core tests. The NSIS artifact passes
silent install, isolated launch, and uninstall in addition to the portable ZIP
gate. Signing awaits a code-signing certificate; independent legal review and
the wider manual player/format matrix remain external release gates.

The desktop shell has now been rebuilt around the independently implemented
VideoReDo-style editor structure: the eight reference menu groups, dominant
preview, thumbnail strip, green seek bar, cut table, adjacent action rail,
compact information panel, transport controls, and bottom cut/trim/save actions
are all present. The GUI smoke gate asserts the menu and cut-table structure.
No VideoReDo source code or binary resources are used.

Build-tree runtime deployment now copies the pinned media DLLs, MinGW/UCRT
runtime, Qt runtime, and platform plugin beside every applicable executable.
An isolated-runtime CTest strips MSYS2 and Qt from `PATH` before launching both
the unit executable and GUI smoke test, preventing a developer installation
from masking missing DLLs. A fresh plain-Windows launch of the GUI succeeds.

A real DVD-derived MPEG-2 MKV exposed a long-source GUI freeze after indexing:
the GUI parsed the full per-frame index with repeated suffix copies, producing
quadratic work on 36,875 frames. The worker now returns a compact navigation
document and the GUI parses it linearly; a 250,000-frame stress document passes
in under one second. Source indexing remains asynchronous and displays elapsed
time with an indeterminate progress indicator. The MPEG-2 indexer now derives
random-access frames from container/I-picture evidence rather than interpreting
MPEG-2 bytes as HEVC NAL units, and cache revisioning invalidates the incorrect
old result. The reported user file opens responsively in automation with all
36,875 frame timestamps and 3,142 random-access frames loaded.

Rapid playback preview requests are now single-flight and latest-frame-wins;
the GUI no longer kills and immediately restarts an active `QProcess`, which
previously surfaced the killed operation as `Preview decode failed`. The GUI
passes indexed PTS directly to the preview worker, reducing measured MPEG-2 DVD
frame requests from roughly 2.5 seconds to 54-64 ms. Rapid-preview automation
passes on both the deterministic fixture and the reported DVD-derived MKV. The
green timeline now implements left-button click and drag seeking, with its
painted handle and marks aligned to the full first-to-last-frame range.

The former numbered thumbnail placeholders are replaced by a decoded nine-frame
filmstrip centered on the current display frame. Each cell uses a center-cropped
source frame, the active frame has the VideoReDo-style green selection border,
and clicking a surrounding thumbnail seeks directly to that frame. Updates are
debounced during dragging and generated as one background batch with indexed
PTS values. The rapid-preview gate now also requires all nine thumbnails; the
reported MPEG-2 MKV produces nine distinct frame images around frame 6,130.

Continuous playback now presents each completed trailing decode while the
audio-master playhead is moving, instead of discarding every image that no
longer exactly equals the newest requested frame. The preview stress gate
requires the displayed image to advance during active playback. Audio playback
seeks the demuxer to the selected timeline timestamp and trims only the small
residual decoded overlap, replacing the former decode-and-discard path from the
start of the file. On the reported DVD-derived MKV, playback at 00:04:05.200 now
emits audio-clock progress immediately; failure to start the audio worker also
switches reliably to video-only playback.

Thumbnail and preview geometry now applies the probed video sample-aspect ratio
instead of treating stored pixels as square. Thumbnail cells derive their
height from the resulting display aspect, fit the complete frame without
center-cropping, and place the selection border around the fitted image. The
reported 720x576 MPEG-2 source has SAR 16:15 and is therefore rendered as 4:3;
real-file GUI automation confirms all nine full-frame thumbnail geometries and
continuous playback together.

VideoReDo-style cut visualization now uses real edit state rather than the
former keep/cut label placeholder. `Trim Unselected` adds the leading and
trailing discarded ranges, paints both ranges red while leaving the selected
interval green, and populates the right-hand Cut Start/Cut End/Frames table in
source-frame timecode. `Cut Selection`, `Invert All Cuts`, `Remove Selected
Cuts`, undo, and redo update the same normalized cut ranges. The cut containing
the cursor is selected in the table, matching the reference interaction. GUI
automation now requires both populated cut rows and red removed-range state on
the deterministic fixture and the reported 36,875-frame DVD-derived MKV.

Range export now executes the edit boundaries instead of assuming that every
selected start frame is random-access. It discovers display-order keyframes,
re-encodes only the leading/trailing GOP fragments with the source codec and
format, packet-copies complete interior GOPs, joins the video segments, and
then remuxes every overlapping audio/subtitle stream plus chapters,
attachments, cover art, metadata, and dispositions. The reported four-frame
DVD-derived MPEG-2 selection passes with four encoded frames and all four
streams; a 484-frame real-file selection passes with 478 byte-copied interior
frames and six encoded boundary frames. Copy, boundary, join, codec/profile,
pixel-format/colour, payload, timestamp, stream-layout, and chapter audits must
all pass or the partial output is removed. A new deterministic non-keyframe
export gate is included in the passing UCRT matrix.

The reusable `test-media-corpus.ps1` sweep probed 207 files under `O:\Films`
and exercised ten distinct container/video profile/pixel-format combinations
plus 22 audio codec/rate/layout combinations. All 22 bounded audio decodes
passed. H.264 High/Main from MKV and MP4, MPEG-2, MPEG-4, HEVC Main/Main10,
AV1 Main10, and VP9 profile 0 smart exports pass while retaining stream count
and format; MP4 codec tags and embedded JPEG cover art are normalized correctly
for Matroska output. Longer real-file tests prove copied interior GOPs for HEVC
Main 8, AV1, and VP9. HEVC parameter-set transitions reinsert only the original
VPS/SPS/PPS bytes before the copied random-access packet; the compressed source
frame remains unmodified and is not re-encoded. All ten video representatives
and all 22 audio representatives now pass. Two `.mkv` files failed EBML parsing
and appear damaged or mislabelled. Windows command-line handling reconstructs
UTF-8 arguments from the native wide command line, so curly-apostrophe and
other Unicode paths probe successfully.

The lower VideoReDo-style fine-tune control is now a spring-centred relative
seek slider. A normal drag spans up to plus or minus 120 seconds from the frame
where the drag began; Shift reduces that to 60 seconds, Ctrl to 40 seconds,
and Shift+Ctrl to 20 seconds. Right-button dragging spans plus or minus one
second for frame-accurate placement. The preview and thumbnail strip follow
the cursor during the drag, playback is paused before seeking, and the thumb
returns to the centre on release. GUI smoke coverage verifies all six seek
modes and the neutral return position.

The editor shell now independently reproduces the VideoReDo TVSuite 6 Default
layout and interaction structure. It includes the black letterboxed preview,
18-cell frame ribbon, waveform/frame-number guide, scene and cut markers,
green/red navigation bar, centred frame and fine-tune controls, three transport
clusters, volume control, icon-over-label action rail, cut table, and tabular
Info panel. Media supplied on the command line opens automatically, matching
normal file-association launch behaviour. The denser ribbon decodes nine source
frames per refresh and shares them between adjacent cells, retaining responsive
scrubbing while matching the reference density.

Large constant-frame-rate sources now use a container-timing navigation index
when opened instead of scanning and software-decoding every frame before the
timeline becomes available. The fast path validates constant timing, seeks near
EOF to derive the exact final frame, and supplies PTS values directly to preview
and A/V synchronization workers; variable-frame-rate material still falls back
to the exhaustive index. The 20.27 GB, 4K HEVC Pillion test source on `O:` now
builds its 153,478-frame navigation response in 563 ms rather than reading the
whole source for more than five minutes. The exhaustive packet/GOP index remains
the authority for smart-render planning. All 79 configured release tests pass;
the optional AppVerifier test remains skipped when AppVerifier is unavailable.

Large CFR smart-render exports now seek independently to the cut-in and cut-out
GOPs instead of scanning the complete retained interval during boundary
planning. Production-size joins defer their duplicate temporary-file decode to
the final output audit, while that audit compares every stream with a
constant-memory streaming payload hash; small deterministic fixtures retain
exhaustive packet-by-packet validation. Boundary encoding uses the `veryfast`
preset, and the GUI progress monitor now discovers the range and nested
smart-render temporary files generated from the output stem. On the reported
4K HEVC Main 10 Dolby Vision/HDR10 Pillion edit (frames 30,123 through 35,494),
5,343 frames are packet-copied and only 28 edge frames are encoded. Measured
wall time fell from 70.3 seconds to 21.6 seconds, with identical 740,394,227-byte
output size and passing video/audio payload, timestamp, metadata, chapter, and
SHA-256 validation. The complete 79-test UCRT GUI matrix passes after the
change; AppVerifier remains the sole optional skip.

The 4K filmstrip and waveform paths now remain interactive on large HEVC
sources. A thumbnail strip opens and seeks the decoder once, decodes the 19
adjacent frames sequentially, scales each frame to 320 pixels inside the worker,
and transfers about 3.2 MB instead of nineteen full-resolution frames totalling
roughly 600 MB. The reported Pillion strip at frame 69,744 completes in 3.2
seconds instead of exceeding two minutes. Waveforms now seek through the
container's globally indexed clusters rather than relying on a frequently
unindexed audio-stream seek; the same 1,200-point Pillion window completes in
0.07 seconds instead of 83 seconds. Pending waveform requests are coalesced
without repeatedly killing the active decoder. Each filmstrip cell again has a
three-pixel local edit-status edge (green retained, red cut), updated immediately
when cuts change. Real-file GUI automation confirms thumbnails, display aspect,
waveform, playback, cut list, and removed-range state together, and all 79 UCRT
tests pass with only optional AppVerifier skipped.

Preview mode now presents the retained edit decision list instead of the full
source timeline with alternate colouring. Timeline clicks and drags, fine-tune
seeks, single-frame steps, keyframe/chapter jumps, playback, and thumbnail
windows map between compressed output positions and retained source frames;
removed frames cannot be selected or decoded while Preview is active. Multiple
cuts collapse to edit boundaries, the central readout continues to identify the
underlying source frame, and the blue preview timeline reports the shortened
output extent. Switching modes invalidates in-flight image, thumbnail, and
waveform work so stale cut frames cannot reappear. Audio playback is segmented
at exact cut timestamps in the worker and resumes at the first retained frame,
preventing queued audio from removed ranges leaking across a preview edit.

Windows media acceleration is now operational without tying the application to
one GPU vendor. The preview, filmstrip and Ad-Detective workers open the default
D3D11VA adapter and retry in software when the codec, profile or driver rejects
hardware decoding. Filmstrip and Ad-Detective reduction uses the D3D11 video
processor before the final CPU transfer; a 3840x2076 HEVC/Dolby Vision test frame
produced a 320x172 thumbnail through `d3d11va+scale_d3d11` in 0.54 seconds.
Full-transcode profiles can optionally use NVENC, Intel Quick Sync or AMD AMF;
the global option is off by default and automatic selection verifies that an
encoder can actually open before choosing it. Smart-render boundary GOPs are
unchanged and software-only. The hardware-enabled package passes all 85 release
tests, with only the unavailable optional AppVerifier gate skipped.
GUI smoke coverage checks bidirectional stepping, direct and proportional
seeking, start/end navigation, source/output mapping, and a thumbnail window
that crosses two cuts without containing a removed frame.

## FFmpeg 9.0 upgrade

The previous FFmpeg 8.1.2 state is preserved by Git tag
`smartcut64-ffmpeg-8.1.2-baseline-20260809`, a standalone Git bundle, and the
original locked source archive. The active branch pins the official `n9.0` tag
at commit `d32b387f2b0a484599d4587d651891f0c63c4238` and archive SHA-256
`661f8b71ebbaf3bdf4e06ac577a29b5441f7f057e0bf94a737c814b60687991b`.

FFmpeg 9 runtime ABI majors are deployed exclusively (`avcodec-63`,
`avdevice-63`, `avfilter-12`, `avformat-63`, `avutil-61`, `swresample-7`, and
`swscale-10`). Preview, filmstrip and Ad-Detective decoding retain D3D11VA as
the first Windows path and add Vulkan decode/scaling fallback for FFV1, ProRes,
and ProRes RAW. Full-transcode profiles now include FFV1 Lossless and 10-bit
Apple ProRes with explicit FFmpeg 9 Vulkan encoders, runtime device probing,
and software fallback. Smart-render boundary GOPs remain software-only.

The clean FFmpeg 9 Debug and Release matrices both report 100% pass in their
90-test configurations: 89 tests execute and the optional Application Verifier
test is skipped because that external Microsoft tool is not installed. This
includes dedicated software/Vulkan FFV1 and ProRes encode, decode, dimensions,
bit-depth, timing, keyframe and fallback checks, plus the machine-specific
hardware recommendation contract.

A real 720x576 MPEG-2/AC-3/DVD-subtitle Matroska source was also transcoded for
100 frames through FFV1 software, FFV1 Vulkan, ProRes software and ProRes
Vulkan. All four outputs retained the four-stream layout and decoded in an
independent FFmpeg build. Measured wall times on the development NVIDIA system
were 0.90 s/5.84 s for FFV1 software/Vulkan and 0.80 s/1.94 s for ProRes
software/Vulkan. Vulkan initialization and CPU-to-GPU upload dominate such a
short SD job, supporting the existing policy that hardware full transcoding is
off by default and must fall back cleanly rather than being forced.

SmartCut64 now exposes **Tools > Hardware Acceleration Self-Test** and a
separate preview hardware-decoding checkbox. The self-test benchmarks validated
software and available GPU paths on a representative user-selected source for
preview, H.264, HEVC, FFV1 and ProRes. Advice is workload-specific and requires
the GPU path to pass output validation and beat software by at least 10%; no
GPU option is removed and no recommendation is applied automatically. On the
development machine, a 60-frame 720x576 sample selected HEVC/NVENC at 4.50x,
while software remained preferable for preview (D3D11VA 0.19x), H.264/NVENC
(0.73x), FFV1/Vulkan (0.32x), and ProRes/Vulkan (0.31x). This demonstrates why
per-machine, per-codec measurement is more reliable than a global GPU default.
