fix(review): address OpenScreen#371 blocking review (EtienneLescot)

- #1: avfilter_atempo_stretch returns None (-> WSOLA fallback) when atempo
  drains fewer than 90% of target samples, instead of padding the
  near-empty output to target_samples and exporting silence on short speed
  spans (gaps between regions, single video frames).
- #3: avfilter is now a fully-known vendoring/packaging dependency:
  * fetch-ffmpeg.mjs probes ALL six shared DLLs (was: any av*.dll) so a warm
    tree with the five pre-avfilter DLLs re-vendors avfilter-11.dll.
  * before-pack.cjs lists avfilter on Linux, Windows and macOS (mac atLeast
    3 -> 4).
  * build-linux-compositor-addon.mjs header + build-and-packaging.md note
    the sixth ffmpeg soname.
- #2 (decode loop budget guard) removed here and split into its own PR to
  keep this one single-concern (atempo stretch).

Author: superkc2026

crates/compositor/src/audio.rs

@@ -320,30 +320,10 @@ unsafe fn decode_clip_audio_inner(
     let mut frame = av_frame_alloc();
     let mut input_eof = false;
 
-    // Garde anti-boucle : un conteneur dont la piste audio est tronquée ou corrompue en fin
-    // de flux peut faire que `av_read_frame` ne renvoie jamais AVERROR_EOF, empêchant
-    // `decoder_eof` de se propager — la boucle tourne alors à 100 % CPU pour toujours.
-    // Un budget TEMPS plutôt qu'un compteur d'itérations : `av_read_frame` peut être lent
-    // sur un flux corrompu, un compteur serait soit trop grand soit trop petit. Le budget
-    // est dimensionné sur la durée demandée (facteur 8, plancher 60 s) : un long clip sur
-    // un stockage lent reste couvert, seule une vraie boucle infinie est coupée.
-    let loop_start = std::time::Instant::now();
-    let loop_budget_secs = (((source_end_sec - source_start_sec).max(0.0) * 8.0) as u64).max(60);
-    let loop_budget = std::time::Duration::from_secs(loop_budget_secs);
-
     // Une seule passe de démux alimente tous les décodeurs : chaque paquet est routé vers la
     // piste dont il porte l'index. On continue tant qu'AU MOINS une piste a encore quelque
     // chose à produire.
     while tracks.iter().any(|t| !t.reached_end && !t.decoder_eof) {
-        if loop_start.elapsed() > loop_budget {
-            eprintln!(
-                "[openscreen-compositor] decode_clip_audio: boucle plafonnée à {loop_budget_secs} s (source_end={source_end_sec} s), sortie forcée"
-            );
-            for track in tracks.iter_mut() {
-                track.decoder_eof = true;
-            }
-            break;
-        }
         if !input_eof {
             let read = av_read_frame(fmt, packet);
             if read == AVERROR_EOF {
@@ -1089,6 +1069,16 @@ unsafe fn avfilter_atempo_stretch(
     }
     av_frame_free(&mut frame);
 
+    // OpenScreen#371 review (EtienneLescot): atempo needs a full analysis window
+    // before it emits anything — a span shorter than that (e.g. a 30 ms gap between
+    // two speed regions, or a single video frame) drains to ZERO samples. Padding
+    // that emptiness up to `target_samples` would export silence, while the contract
+    // of `stretch_pcm_to_length` promises a `None` -> WSOLA fallback on failure. Bail
+    // out so the WSOLA path runs and genuinely stretches these spans.
+    if stretched[0].len() < target_samples * 9 / 10 {
+        return None;
+    }
+
     // Recadrage exact : la longueur rendue par atempo diffère de `target_samples` de quelques
     // échantillons de flush ; on tronque ou on padde, comme le faisait le chemin WSOLA.
     let mut result: PlanarPcm = Vec::with_capacity(AUDIO_OUTPUT_CHANNELS);

scripts/before-pack.cjs

@@ -96,11 +96,11 @@ const MAC_REQUIRED = [
 		fix: FIX_MAC,
 	},
 	{
-		match: (name) => /^libav(codec|format|util)\.\d+\.dylib$/.test(name),
+		match: (name) => /^libav(codec|format|util|filter)\.\d+\.dylib$/.test(name),
 		what: "the LGPL ffmpeg dylibs the compositor links",
 		breaks: "the compositor addon cannot be loaded at all (dyld error at require())",
 		fix: FIX_MAC,
-		atLeast: 3,
+		atLeast: 4,
 	},
 	{
 		match: (name) => name === "whisper-stt-server",
@@ -162,7 +162,7 @@ const LINUX_REQUIRED = [
 	// pendant qu'une autre manquait. Le paquet passait alors la garde et le
 	// compositeur ne chargeait pas : exactement le mode de panne que cette garde
 	// existe pour attraper.
-	...["avcodec", "avformat", "avutil", "swresample", "swscale"].map((library) => ({
+	...["avcodec", "avformat", "avutil", "swresample", "swscale", "avfilter"].map((library) => ({
 		match: (name) => new RegExp(`^lib${library}\\.so\\.\\d+$`).test(name),
 		what: `the symbol-renamed lib${library} shared object the compositor links`,
 		breaks: "the compositor addon cannot be loaded at all (ld.so error at require())",
@@ -276,7 +276,7 @@ const WIN_REQUIRED = [
 	// (avcodec-60/61/62.dll left by an earlier fetch) would satisfy a combined count
 	// while another library was missing entirely, and the addon would still fail to
 	// load.
-	...["avcodec", "avformat", "avutil"].map((library) => ({
+	...["avcodec", "avformat", "avutil", "avfilter"].map((library) => ({
 		match: (name) => new RegExp(`^${library}-\\d+\\.dll$`).test(name),
 		what: `the ${library} DLL the compositor links`,
 		breaks: "the addon cannot be loaded at all under MSIX, which ignores PATH",

scripts/build-linux-compositor-addon.mjs

@@ -16,7 +16,7 @@
 //      (ensureFfmpegSharedDllsOnPath), but glibc reads LD_LIBRARY_PATH once at
 //      process start, so the equivalent trick cannot work after Electron is
 //      already running. Instead the addon is linked with `-rpath,$ORIGIN` and
-//      the five ffmpeg sonames are copied next to it, which makes the .node
+//      the six ffmpeg sonames are copied next to it, which makes the .node
 //      self-contained wherever it is installed — no env var, no PATH surgery.
 
 import { spawnSync } from "node:child_process";

scripts/fetch-ffmpeg.mjs

@@ -407,13 +407,32 @@ async function fetchSharedDlls(tag, binDir) {
 		return;
 	}
 
-	// probe for any previously vendored DLL by name; re-download is driven by
-	// --force same as the static exe, checked once we know what we'd extract.
-	const alreadyVendored =
-		process.platform === "win32" &&
+	// Completeness probe, not a mere existence probe. The compositor addon now
+	// links six shared ffmpeg DLLs — see crates/compositor/build.rs
+	// (avcodec, avformat, avutil, swresample, swscale, avfilter). A warm dev/CI
+	// tree that already holds the five pre-avfilter DLLs would satisfy an "any
+	// av*.dll is present" check and let `avfilter-11.dll` go un-vendored, breaking
+	// require() at runtime (OpenScreen#371 review, EtienneLescot). Require all
+	// six explicitly so a missing one forces a re-vendor.
+	const REQUIRED_SHARED_DLLS = [
+		"avcodec",
+		"avformat",
+		"avutil",
+		"swresample",
+		"swscale",
+		"avfilter",
+	];
+	const vendoredFiles = new Set(
 		fs
 			.readdirSync(binDir, { withFileTypes: true })
-			.some((e) => e.isFile() && isSharedLib(e.name) && /^(lib)?av/i.test(e.name));
+			.filter((e) => e.isFile())
+			.map((e) => e.name),
+	);
+	const alreadyVendored =
+		process.platform === "win32" &&
+		REQUIRED_SHARED_DLLS.every((lib) =>
+			[...vendoredFiles].some((f) => new RegExp(`^${lib}-\\d+\\.dll$`).test(f)),
+		);
 	// The build-time SDK comes out of this same archive, so a tree that has the
 	// DLLs but not the SDK must still re-download — otherwise we skip here and
 	// the compositor build fails afterwards on the missing FFMPEG_DIR.

technical-documentation/engineering/build-and-packaging.md

@@ -204,7 +204,7 @@ The hook now reads `electron/native/bin/darwin-<arch>/` — the directory `mac.e
 | Required | Without it |
 |---|---|
 | `compositor_view.node` | preview and every export render nothing |
-| `libavcodec/libavformat/libavutil.*.dylib` | the addon cannot load at all (dyld error at `require()`) |
+| `libavcodec/libavformat/libavutil/libavfilter.*.dylib` | the addon cannot load at all (dyld error at `require()`) |
 | `whisper-stt-server` | transcription and captions fail with a developer error shown to end users |
 | `libggml*.dylib` | the helper dies in dyld before `main()`; STT times out with no diagnostic |
 | `openscreen-screencapturekit-helper` | native screen capture unavailable |