test(ci): [CI-01] checkpoint installed audio and subtitle coverage

test/browser/audio-fixture.js

@@ -3,7 +3,7 @@ import { Buffer } from 'node:buffer'
 import fs from 'node:fs'
 import process from 'node:process'
 import { ensureArchive, hash, readMember } from '../../refactor/scripts/releases.mjs'
-import { compilePackage } from '../helpers/load.js'
+import { browserCandidate } from '../helpers/browser-candidate.js'
 import { expect, test } from './fixtures.js'
 
 export function useAudioFixture() {
@@ -32,14 +32,14 @@ export function useAudioFixture() {
   test.beforeAll(async () => {
     assert.equal(hash(tone), toneManifest.sha256)
     assert.equal(tone.length, toneManifest.bytes)
-    assert(!process.env.ARTPLAYER_BROWSER_ARTIFACTS, 'Audio source tests cannot represent installed artifacts')
     const { release } = JSON.parse(fs.readFileSync(new URL('../../refactor/baselines/audio-track-release.json', import.meta.url)))
     const member = 'package/dist/artplayer-plugin-audio-track.js'
     const bytes = readMember(await ensureArchive(release), member)
     assert.equal(hash(bytes), release.files[member])
     publishedCode = bytes.toString()
-    sourceCode = process.env.ARTPLAYER_AUDIO_ARTIFACT ? fs.readFileSync(process.env.ARTPLAYER_AUDIO_ARTIFACT, 'utf8') : await compilePackage(release.name, 'umd')
-    evidence = { release, sourceSHA256: hash(sourceCode), candidate: process.env.ARTPLAYER_AUDIO_ARTIFACT || 'workspace source build', audio: { sha256: hash(tone), bytes: tone.length, format: 'AAC mono 48000 Hz, 16 seconds, 440 Hz tone in MP4' }, wav: { sha256: hash(wav), bytes: wav.length, format: 'PCM16LE mono 16000 Hz, 16 seconds, integer square wave 200 Hz' }, scope: 'Source or explicit artifact browser checks; no physical device or installed package acceptance' }
+    const candidate = await browserCandidate(release.name, process.env.ARTPLAYER_AUDIO_ARTIFACT)
+    sourceCode = candidate.code
+    evidence = { release, sourceSHA256: hash(sourceCode), candidate: candidate.provenance, audio: { sha256: hash(tone), bytes: tone.length, format: 'AAC mono 48000 Hz, 16 seconds, 440 Hz tone in MP4' }, wav: { sha256: hash(wav), bytes: wav.length, format: 'PCM16LE mono 16000 Hz, 16 seconds, integer square wave 200 Hz' }, scope: 'Desktop browser media checks; candidate provenance identifies installed, source or explicit artifact. No physical device acceptance.' }
   })
 
   test.afterEach(async ({ page }, testInfo) => {
@@ -53,7 +53,7 @@ export function useAudioFixture() {
   })
 
   async function openAudio(page, core, plugin, testInfo, url = '/test/audio-tone.m4a?source=first') {
-    await testInfo.attach('audio-inputs', { contentType: 'application/json', body: JSON.stringify(evidence) })
+    await testInfo.attach('audio-inputs', { contentType: 'application/json', body: JSON.stringify({ ...evidence, core, plugin, selected: plugin === 'published' ? { kind: 'published', sha256: hash(publishedCode) } : evidence.candidate }) })
     await page.goto(`/test/player.html?core=${core}`)
     await page.addScriptTag({ content: plugin === 'published' ? publishedCode : sourceCode })
     await page.evaluate((url) => {

test/browser/multiple-subtitles-ass.spec.js

@@ -8,6 +8,7 @@ const ass = '[Events]\r\nDialogue: 0,0:00:01.25,0:00:03.75,Default,,0,0,0,,漢
 
 for (const core of ['published-5.1.2', 'published-5.1.7', 'published-5.3.0', 'published', 'candidate']) {
   test(`Multiple subtitles ASS / ${core}: encoded multiline cues, overlapping translation and selection`, async ({ page, browser }, testInfo) => {
+    await testInfo.attach('ass-inputs', { contentType: 'application/json', body: JSON.stringify({ core, sha256: hash(candidate.code), provenance: candidate.provenance }) })
     await page.route('**/test/ass-data.bin', route => route.fulfill({ contentType: 'application/octet-stream', body: Buffer.from(ass, 'utf16le') }))
     await page.route('**/test/ass-translation.vtt', route => route.fulfill({ contentType: 'text/vtt', body: 'WEBVTT\n\n00:02.000 --> 00:04.000\nTranslation\n' }))
     await page.goto(`/test/player.html?core=${core}`)
@@ -47,12 +48,12 @@ for (const core of ['published-5.1.2', 'published-5.1.7', 'published-5.3.0', 'pu
     await page.evaluate(() => window.art.plugins.multipleSubtitles.reset())
     await expect(page.locator('.art-subtitle-ass b')).toBeVisible()
     await seek(5)
-    await expect(page.locator('.art-subtitle-ass')).toHaveText('Later cue')
+    await expect(page.locator('.art-subtitle-ass')).toHaveText(['Later cue'])
     await expect(page.locator('.art-subtitle-translation')).toHaveCount(0)
     await seek(7.5)
     await expect(page.locator('.art-subtitle-ass, .art-subtitle-translation')).toHaveCount(0)
     const rawHostOutput = await page.evaluate(ass => window.Artplayer.utils.assToVtt(ass), ass)
-    await testInfo.attach('ass-conversion', { contentType: 'application/json', body: JSON.stringify({ core, browser: browser.version(), pluginSha256: hash(candidate.code), sourceSha256: hash(Buffer.from(ass, 'utf16le')), rawHostOutput, native, scope: 'Desktop native playback with UTF16 ASS, explicit type override, independently timed multiline/semantic captions, overlap, selection/reset and clearing; original core converter is unchanged.' }) })
+    await testInfo.attach('ass-conversion', { contentType: 'application/json', body: JSON.stringify({ core, browser: browser.version(), pluginSha256: hash(candidate.code), provenance: candidate.provenance, sourceSha256: hash(Buffer.from(ass, 'utf16le')), rawHostOutput, native, scope: 'Desktop native playback with UTF16 ASS, explicit type override, independently timed multiline/semantic captions, overlap, selection/reset and clearing; original core converter is unchanged.' }) })
     await page.evaluate(() => window.art.destroy())
   })
 }

test/browser/multiple-subtitles-combinations.spec.js

@@ -32,7 +32,7 @@ async function prepare(page, core, implementation, browser, testInfo) {
   await expect.poll(() => page.evaluate(() => window.art.isReady)).toBe(true)
   if (['1', 'events'].includes(process.env.ARTPLAYER_SOURCE_SEEK_TRACE))
     await installSeekDiagnostics(page, process.env.ARTPLAYER_SOURCE_SEEK_TRACE === '1')
-  await testInfo.attach('multiple-combination-inputs', { contentType: 'application/json', body: JSON.stringify({ core, plugin: implementation.name, pluginSha256: hash(implementation.code), browser: browser.version(), traceMode: process.env.ARTPLAYER_SOURCE_SEEK_TRACE || 'off', sourceRestoration: process.env.ARTPLAYER_SOURCE_RESTORE_EVENT === '1' ? 'native-event-control' : 'promise-and-seeking-property', scope: 'Desktop engines; 5.3.0 is adjacent stable, not the unavailable 5.3.1 release; no minimum-version or physical-device claim' }) })
+  await testInfo.attach('multiple-combination-inputs', { contentType: 'application/json', body: JSON.stringify({ core, plugin: implementation.name, pluginSha256: hash(implementation.code), provenance: implementation.provenance, browser: browser.version(), traceMode: process.env.ARTPLAYER_SOURCE_SEEK_TRACE || 'off', sourceRestoration: process.env.ARTPLAYER_SOURCE_RESTORE_EVENT === '1' ? 'native-event-control' : 'promise-and-seeking-property', scope: 'Desktop engines; 5.3.0 is adjacent stable, not the unavailable 5.3.1 release; no minimum-version or physical-device claim' }) })
 }
 
 async function seek(page, time) {

test/browser/multiple-subtitles-entities.spec.js

@@ -35,7 +35,7 @@ for (const core of ['published', 'candidate']) {
     await expect.poll(() => page.locator('.art-subtitle-a').textContent()).toBe(literal)
     await page.evaluate(() => window.art.plugins.multipleSubtitles.reset())
     await expect(page.locator('.art-subtitle-b b')).toHaveText('bold & safe')
-    await testInfo.attach('entities.json', { contentType: 'application/json', body: JSON.stringify({ core, browser: browser.version(), pluginSha256: hash(implementation.code), native, literal, scope: 'Actual native VTT and HTML caption display, playback, selection/reset; desktop browser engines only' }) })
+    await testInfo.attach('entities.json', { contentType: 'application/json', body: JSON.stringify({ core, browser: browser.version(), pluginSha256: hash(implementation.code), provenance: implementation.provenance, native, literal, scope: 'Actual native VTT and HTML caption display, playback, selection/reset; desktop browser engines only' }) })
     await page.evaluate(() => window.art.destroy(false))
     expect(errors).toEqual([])
   })

test/browser/multiple-subtitles-legacy.spec.js

@@ -69,7 +69,7 @@ for (const core of ['published-5.1.2', 'published-5.1.7']) {
     await expect(page.locator('.art-subtitle-c')).toHaveText('C')
     await seek(4.5)
     await expect(page.locator('.art-subtitle-a, .art-subtitle-b, .art-subtitle-c')).toHaveCount(0)
-    await testInfo.attach('legacy-captions', { contentType: 'application/json', body: JSON.stringify({ core, browser: browser.version(), pluginSha256: hash(candidate.code), thirdFormat, state, scope: 'Native VTT/SRT/ASS overlaps on both old cores, semantic HTML/CSS, legacy scalar event payload, original host method and cue identities, repeated update/selection/reset/empty intervals' }) })
+    await testInfo.attach('legacy-captions', { contentType: 'application/json', body: JSON.stringify({ core, browser: browser.version(), pluginSha256: hash(candidate.code), provenance: candidate.provenance, thirdFormat, state, scope: 'Native VTT/SRT/ASS overlaps on both old cores, semantic HTML/CSS, legacy scalar event payload, original host method and cue identities, repeated update/selection/reset/empty intervals' }) })
     await page.evaluate(() => window.art.destroy())
   })
 }

test/browser/multiple-subtitles-lifecycle.spec.js

@@ -40,7 +40,7 @@ async function prepare(page, core) {
 async function evidence(page, testInfo, core, observation) {
   const probe = await page.evaluate(() => ({ ...window.multipleProbe, signal: window.multipleProbe.signal ? { aborted: window.multipleProbe.signal.aborted } : null }))
   expect(probe.errors).toEqual([])
-  await testInfo.attach('multiple-subtitles-lifecycle', { body: JSON.stringify({ core, implementation: { name: implementation.name, sha256: hash(implementation.code) }, observation, probe }), contentType: 'application/json' })
+  await testInfo.attach('multiple-subtitles-lifecycle', { body: JSON.stringify({ core, implementation: { name: implementation.name, sha256: hash(implementation.code), provenance: implementation.provenance }, observation, probe }), contentType: 'application/json' })
 }
 
 for (const core of ['published', 'candidate']) {

test/browser/multiple-subtitles-switch.spec.js

@@ -75,7 +75,7 @@ for (const core of ['published-5.3.0', 'published', 'candidate']) {
           await expect(page.locator('.art-subtitle-caption')).toHaveText('Caption')
         outcomes.push({ round, settled, firstSeek, landed, afterSettledSeek: await page.evaluate(() => window.switchState()) })
       }
-      await testInfo.attach('source-seek-order', { contentType: 'application/json', body: JSON.stringify({ core, plugin: implementation?.name || 'none', pluginSha256: implementation ? hash(implementation.code) : null, browser: browser.version(), outcomes, trace: await page.evaluate(() => window.switchTrace), scope: 'Three real source changes with immediate versus settled seek; old misses are recorded, candidate must honor every first seek' }) })
+      await testInfo.attach('source-seek-order', { contentType: 'application/json', body: JSON.stringify({ core, plugin: implementation?.name || 'none', pluginSha256: implementation ? hash(implementation.code) : null, provenance: implementation?.provenance, browser: browser.version(), outcomes, trace: await page.evaluate(() => window.switchTrace), scope: 'Three real source changes with immediate versus settled seek; old misses are recorded, candidate must honor every first seek' }) })
       if (core === 'candidate')
         expect(outcomes.every(item => item.landed)).toBe(true)
       await page.evaluate(() => window.art.destroy())

test/browser/vtt-thumbnail-combinations.spec.js

@@ -32,7 +32,7 @@ async function install(page, core, implementation, testInfo) {
   await expect.poll(() => page.evaluate(() => window.art.isReady)).toBe(true)
   await testInfo.attach('vtt-combination-inputs', {
     contentType: 'application/json',
-    body: JSON.stringify({ core, implementation: implementation.name, sha256: hash(implementation.code), cueFormat: /^published-1\.0\./.test(implementation.name) ? 'historical compact arrow; ordinary-space failures retained separately' : 'standard spaced arrow', mobile: 'desktop unless test declares an emulated user agent; no physical-device inference' }),
+    body: JSON.stringify({ core, implementation: implementation.name, sha256: hash(implementation.code), provenance: implementation.provenance, cueFormat: /^published-1\.0\./.test(implementation.name) ? 'historical compact arrow; ordinary-space failures retained separately' : 'standard spaced arrow', mobile: 'desktop unless test declares an emulated user agent; no physical-device inference' }),
   })
   return () => requests
 }
@@ -157,7 +157,7 @@ for (const core of ['published-5.1.7', 'published', 'candidate']) {
     })
     expect(state.error).toContain('Can\'t add an existing [thumbnails] to the [control]')
     expect(state.sameReservedControl).toBe(true)
-    await testInfo.attach('vtt-historical-conflict', { contentType: 'application/json', body: JSON.stringify({ core, plugin: implementation.name, sha256: hash(implementation.code), state, scope: 'Existing incompatibility, not successful old-plugin/new-core acceptance and not a newly introduced refactor regression' }) })
+    await testInfo.attach('vtt-historical-conflict', { contentType: 'application/json', body: JSON.stringify({ core, plugin: implementation.name, sha256: hash(implementation.code), provenance: implementation.provenance, state, scope: 'Existing incompatibility, not successful old-plugin/new-core acceptance and not a newly introduced refactor regression' }) })
   })
 }
 

test/browser/vtt-thumbnail-lifecycle.spec.js

@@ -43,7 +43,7 @@ for (const core of ['published', 'candidate']) {
     await testInfo.attach('selected-sprite', { body: await preview.screenshot(), contentType: 'image/png' })
     await page.evaluate(() => window.art.destroy(false))
     await expect(preview).toHaveCount(0)
-    await testInfo.attach('vtt-candidate', { body: JSON.stringify({ core, implementation: hash(implementation.code), pixels }), contentType: 'application/json' })
+    await testInfo.attach('vtt-candidate', { body: JSON.stringify({ core, implementation: hash(implementation.code), provenance: implementation.provenance, pixels }), contentType: 'application/json' })
   })
 
   test(`VTT native ${core} core: malformed sprite rejects before mounting and a corrected registration recovers`, async ({ page }, testInfo) => {
@@ -69,7 +69,7 @@ for (const core of ['published', 'candidate']) {
     await expect(page.locator('.art-control-vtt-thumbnail')).toHaveCount(1)
     await page.evaluate(() => window.art.destroy(false))
     await expect(page.locator('.art-control-vtt-thumbnail')).toHaveCount(0)
-    await testInfo.attach('vtt-candidate', { body: JSON.stringify({ core, implementation: hash(implementation.code), recoveredAfter: error }), contentType: 'application/json' })
+    await testInfo.attach('vtt-candidate', { body: JSON.stringify({ core, implementation: hash(implementation.code), provenance: implementation.provenance, recoveredAfter: error }), contentType: 'application/json' })
   })
 
   test(`VTT native ${core} core: destroy aborts a pending native fetch and settles registration`, async ({ page }, testInfo) => {
@@ -111,7 +111,7 @@ for (const core of ['published', 'candidate']) {
       await page.evaluate(() => window.vttPending)
       await expect(page.locator('.art-control-vtt-thumbnail')).toHaveCount(0)
       expect(await page.evaluate(() => window.vttResult)).toEqual({ name: 'artplayerPluginVttThumbnail' })
-      await testInfo.attach('vtt-candidate', { body: JSON.stringify({ core, implementation: hash(implementation.code), nativeAbort: true }), contentType: 'application/json' })
+      await testInfo.attach('vtt-candidate', { body: JSON.stringify({ core, implementation: hash(implementation.code), provenance: implementation.provenance, nativeAbort: true }), contentType: 'application/json' })
     }
     finally { release() }
   })

test/helpers/multiple-subtitles.js

@@ -1,15 +1,14 @@
-import fs from 'node:fs'
 import process from 'node:process'
 import vm from 'node:vm'
 import { transform } from 'esbuild'
 import { verifyMultipleSubtitlesContract } from '../../refactor/scripts/multiple-subtitles-contract.mjs'
 import { readMember } from '../../refactor/scripts/releases.mjs'
-import { compilePackage } from './load.js'
+import { browserCandidate } from './browser-candidate.js'
 
 export const subtitleVtt = text => `WEBVTT\n\n00:00.000 --> 00:02.000\n${text}\n`
 
 export async function multipleSubtitlesCandidate() {
-  return { name: 'candidate', version: 'candidate', code: process.env.ARTPLAYER_MULTIPLE_SUBTITLES_ARTIFACT ? fs.readFileSync(process.env.ARTPLAYER_MULTIPLE_SUBTITLES_ARTIFACT, 'utf8') : await compilePackage('artplayer-plugin-multiple-subtitles', 'umd') }
+  return { name: 'candidate', version: 'candidate', ...await browserCandidate('artplayer-plugin-multiple-subtitles', process.env.ARTPLAYER_MULTIPLE_SUBTITLES_ARTIFACT) }
 }
 
 export async function multipleSubtitlesHistorical() {

test/helpers/vtt-thumbnail.js

@@ -1,15 +1,17 @@
-import fs from 'node:fs'
+import assert from 'node:assert/strict'
 import process from 'node:process'
 import vm from 'node:vm'
 import { transform } from 'esbuild'
 import { readMember } from '../../refactor/scripts/releases.mjs'
 import { verifyVttThumbnailContract } from '../../refactor/scripts/vtt-thumbnail-contract.mjs'
-import { compilePackage } from './load.js'
+import { browserCandidate } from './browser-candidate.js'
 
 export async function vttThumbnailCandidate() {
-  if (process.env.ARTPLAYER_VTT_THUMBNAIL_BASELINE === '1')
+  if (process.env.ARTPLAYER_VTT_THUMBNAIL_BASELINE === '1') {
+    assert(!process.env.ARTPLAYER_BROWSER_ARTIFACTS, 'Installed VTT thumbnail checks cannot use the frozen workspace')
     return (await vttThumbnailHistorical()).find(item => item.name === 'frozen-workspace-js')
-  return { name: 'candidate', profile: 'current', code: process.env.ARTPLAYER_VTT_THUMBNAIL_ARTIFACT ? fs.readFileSync(process.env.ARTPLAYER_VTT_THUMBNAIL_ARTIFACT, 'utf8') : await compilePackage('artplayer-plugin-vtt-thumbnail', 'umd') }
+  }
+  return { name: 'candidate', profile: 'current', ...await browserCandidate('artplayer-plugin-vtt-thumbnail', process.env.ARTPLAYER_VTT_THUMBNAIL_ARTIFACT) }
 }
 
 export async function vttThumbnailHistorical() {

test/package-check.test.js

@@ -11,13 +11,15 @@ import { ambilightCandidate } from './helpers/ambilight.js'
 import { browserCandidate } from './helpers/browser-candidate.js'
 import { canvasCandidate } from './helpers/canvas.js'
 import { dpipCandidate } from './helpers/dpip.js'
+import { multipleSubtitlesCandidate } from './helpers/multiple-subtitles.js'
+import { vttThumbnailCandidate } from './helpers/vtt-thumbnail.js'
 
 test('Additional browser packages cannot be mistaken for full release consumer acceptance', async () => {
   await assert.rejects(checkPackages({ release: true, include: ['artplayer-plugin-ambilight'] }), /not full release acceptance/)
 })
 
 test('Explicit installed plugin maps never fall back to source or frozen workspace', async () => {
-  const keys = ['ARTPLAYER_BROWSER_ARTIFACTS', 'ARTPLAYER_AMBILIGHT_BASELINE', 'ARTPLAYER_CANVAS_BASELINE', 'ARTPLAYER_DPIP_BASELINE', 'ARTPLAYER_DPIP_ARTIFACT']
+  const keys = ['ARTPLAYER_BROWSER_ARTIFACTS', 'ARTPLAYER_AMBILIGHT_BASELINE', 'ARTPLAYER_CANVAS_BASELINE', 'ARTPLAYER_DPIP_BASELINE', 'ARTPLAYER_DPIP_ARTIFACT', 'ARTPLAYER_VTT_THUMBNAIL_BASELINE', 'ARTPLAYER_VTT_THUMBNAIL_ARTIFACT', 'ARTPLAYER_MULTIPLE_SUBTITLES_ARTIFACT']
   const previous = Object.fromEntries(keys.map(key => [key, process.env[key]]))
   try {
     process.env.ARTPLAYER_BROWSER_ARTIFACTS = path.resolve('refactor/.cache/absent-installed-plugin-map.json')
@@ -26,11 +28,25 @@ test('Explicit installed plugin maps never fall back to source or frozen workspa
     delete process.env.ARTPLAYER_CANVAS_BASELINE
     delete process.env.ARTPLAYER_DPIP_BASELINE
     delete process.env.ARTPLAYER_DPIP_ARTIFACT
+    delete process.env.ARTPLAYER_VTT_THUMBNAIL_BASELINE
+    delete process.env.ARTPLAYER_VTT_THUMBNAIL_ARTIFACT
+    delete process.env.ARTPLAYER_MULTIPLE_SUBTITLES_ARTIFACT
     await assert.rejects(ambilightCandidate(), { code: 'ENOENT' })
     await assert.rejects(canvasCandidate(), { code: 'ENOENT' })
     await assert.rejects(dpipCandidate(), { code: 'ENOENT' })
     await assert.rejects(browserCandidate('artplayer-plugin-ads'), { code: 'ENOENT' })
     await assert.rejects(browserCandidate('artplayer-plugin-ads', 'override.js'), /cannot override artplayer-plugin-ads artifact/)
+    await assert.rejects(browserCandidate('artplayer-plugin-audio-track'), { code: 'ENOENT' })
+    await assert.rejects(browserCandidate('artplayer-plugin-audio-track', 'override.js'), /cannot override artplayer-plugin-audio-track artifact/)
+    await assert.rejects(vttThumbnailCandidate(), { code: 'ENOENT' })
+    await assert.rejects(multipleSubtitlesCandidate(), { code: 'ENOENT' })
+    process.env.ARTPLAYER_VTT_THUMBNAIL_BASELINE = '1'
+    await assert.rejects(vttThumbnailCandidate(), /cannot use the frozen workspace/)
+    delete process.env.ARTPLAYER_VTT_THUMBNAIL_BASELINE
+    process.env.ARTPLAYER_VTT_THUMBNAIL_ARTIFACT = 'override.js'
+    process.env.ARTPLAYER_MULTIPLE_SUBTITLES_ARTIFACT = 'override.js'
+    await assert.rejects(vttThumbnailCandidate(), /cannot override artplayer-plugin-vtt-thumbnail artifact/)
+    await assert.rejects(multipleSubtitlesCandidate(), /cannot override artplayer-plugin-multiple-subtitles artifact/)
     process.env.ARTPLAYER_AMBILIGHT_BASELINE = '1'
     process.env.ARTPLAYER_CANVAS_BASELINE = '1'
     process.env.ARTPLAYER_DPIP_BASELINE = '1'

test/package/README.md

@@ -9,8 +9,8 @@ step through `ARTPLAYER_BROWSER_ARTIFACTS`. See
 browser scope and the remaining package-specific release gates.
 
 Run `yarn test:package` with the pinned Node and Yarn after a frozen install. The
-default consumer scope is core and chapter. For Ambilight/Canvas/Document PiP/Ads browser work,
-run `yarn test:package --include=artplayer-plugin-ambilight,artplayer-proxy-canvas,artplayer-plugin-document-pip,artplayer-plugin-ads`.
+default consumer scope is core and chapter. For Ambilight/Canvas/Document PiP/Ads/Audio Track/VTT Thumbnail/Multiple Subtitles browser work,
+run `yarn test:package --include=artplayer-plugin-ambilight,artplayer-proxy-canvas,artplayer-plugin-document-pip,artplayer-plugin-ads,artplayer-plugin-audio-track,artplayer-plugin-vtt-thumbnail,artplayer-plugin-multiple-subtitles`.
 These four additional packages have reviewed published contracts and use the same
 source snapshot/build/pack/offline-install/frozen-reinstall pipeline. Installed
 files are copied only after archive hash checks. The report explicitly separates