Keep failing commands, slow tools and untrusted update links from breaking the session

[Kentarohakase]

Replaces #2, which GitHub closed automatically when its base branch was deleted along with the merge of #1. Same four commits, rebased onto the current main.

Fixed

• A failing asynchronous command shut the app down. Commands run as async void, so any exception that escaped one reached the dispatcher handler and ended the session. They now report through the view model: the error is logged and shown as status, and a cancelled command counts as a normal outcome.
• Saving the run log could end the session. The most likely trigger was writing the log after a finished batch. It is caught separately now — the exported files are done at that point, so a read-only or full output folder is only a warning. Writing the crash log is wrapped as well, so a failure there cannot throw inside the crash handler.
• Result validation used the selected export format instead of the effective one. The archive preset forces FLAC and a stream copy keeps the source format, so a correct export was reported with a sample-rate warning whenever the Premiere profile was still selected. Both cases now resolve the format the same way the processing does, and a stream copy no longer claims a lossy source was written to a lossless format.

Changed

• The tool probe is bounded. The startup check ran <tool> -version without a time limit, so a binary that never answers (broken download, unreachable network path) kept the tool status pending forever. The probe now stops after 20 seconds, kills the process and reports the tool as unavailable.
• The update link is restricted. The release link from the API is handed to the shell when the user clicks the update notice, so it is checked first: only an absolute https URL on github.com is used, anything else falls back to the known releases page. The update check also shares one HttpClient instead of creating a connection pool per instance.

The ProcessRunner conflict with #1

Both branches bounded the output drain. The merged version keeps the structure from #1 — TerminationWaitTimeout, the linked cancellation source that lets the watchdog end the exit wait, the cancelled/timed-out distinction, the locked buffer snapshot, and CancelOutputRead/CancelErrorRead as the fallback after an unsuccessful drain — and takes the split timeouts from this branch:

• ReaderDrainTimeout = 10 s on the normal path
• CancelDrainTimeout = 2 s after a cancellation

#1 used 2 s for both. If that drain times out, the last captured lines are dropped — and those carry the loudnorm measurements of the first pass. The parser swallows a missing measurement, so a two-pass run would quietly degrade to a single pass. After a cancellation the remaining output is discarded anyway, so 2 s stays right there.

Verification

dotnet format .\AudioQualityEnhancer.slnx --verify-no-changes   -> clean
dotnet build  .\AudioQualityEnhancer.slnx -c Release            -> 0 warnings, 0 errors
dotnet test   .\AudioQualityEnhancer.slnx -c Release            -> 204 passed, 0 failed

PRs #3 through #7 remain stacked on this branch and were rebased along with it.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 191e6e5551

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reset active queue items when handling command errors

When StartProcessingAsync throws after MarkProcessingStarted or MarkValidationStarted, this handler only clears IsBusy and updates the global status, leaving the selected item in Processing or Validating. BatchQueueService considers only Ready items processable and only Failed/Cancelled items retryable, so the recovered session contains an item that cannot be processed or retried without removing and re-adding it; transition the active item to Failed (and attach the error) as part of command-error recovery.

Useful? React with 👍 / 👎.