IzzmooPro · Aug 27, 2026 · Aug 27, 2026 · Aug 27, 2026
diff --git a/docs/CONTINUITY.md b/docs/CONTINUITY.md
@@ -6,10 +6,10 @@ Bu dosya projenin tek canlı devir noktasıdır. Tarihsel continuity kronolojisi
 `ROADMAP.md` ve `ENGINEERING_AUDIT.md` içindedir.
 
 - Güncelleme: 27 Ağustos 2026
-- Kayıt hazırlanırken doğrulanan HEAD: `f658fc1bcde6f6b13d16e4bea22e581a0b0e88a8`
+- Kayıt hazırlanırken doğrulanan HEAD: `50c60ee42835fe6304d55eb2a51c9547e9c9dd23`
 - Güncel HEAD/origin farkı her oturumda `git rev-list --left-right --count` ile ölçülür; bu belge kendi commit hash'ini tahmin etmez.
-- Dal: `codex/internet-video-format-fallback` (origin dalından `1`, `origin/master`dan 7 ileride; EV023 provenance kaydı uncommitted)
-- Son kanıt: `EV-20260827-023`
+- Dal: `codex/v040-build-evidence-2e75fbd` (uzak görev dalıyla `0/0`, `origin/master`dan `1/0`; PR #65 blocked, EV026-EV027 uncommitted)
+- Son kanıt: `EV-20260827-027`
 - Yayın kararı: **v0.39 canlı/latest; 87 varlık eş, public indirme/kurulum/açılış/medya kabulü geçti.**
 
 ## Canlı ürün ve yayın durumu
@@ -101,6 +101,18 @@ Bu dosya projenin tek canlı devir noktasıdır. Tarihsel continuity kronolojisi
 - Internet Video düzeltmesi hedef **2/2**, aile **42 passed / 2 skipped** verdi; paket `3abdf13`, provenance `e64f8c2`, koruma `07df9c1` olarak bağlıdır (`EV-20260827-014/015/016`).
   PR #64 `07df9c1` head'i **5059 passed / 30 skipped / 0 failed** verdi (`EV-20260827-017`); yalnız belge commit'i `d465ee2` sonrasında yeni required run Qt testinde native AV ile FAILED (`EV-20260827-018`).
   Regression-first session sahipliği exact `417877c` oldu; `50c4928` hosted koşumu native AV olmadan **5059 passed / 30 skipped / 2 failed** verdi. İki geçici `QMenu` test ömrü kırmızı **2 failed**, sonra hedef/aile **2/32 passed**, karşıt P0/P1/P2=0 ve exact commit `f658fc1` ile test-only düzeltildi (`EV-20260827-019/020/021/022/023`). Ağ/native NOT_RUN.
+- PR #64 exact `2e75fbd` merge commit'iyle protected master'a alındı. Ayrı
+  exact-master dispatch **5061 passed / 30 skipped / 0 failed** verdi
+  (`EV-20260827-024`). Resmî build iki v0.40 setup ve doğrulanan detached
+  Ed25519 imzalarını üretti; ana/add-on EXE `7cdb6b58...533089d` /
+  `d4a4d799...f9e675`, Authenticode `NotSigned`; ölçülen build/ürün-hedef
+  süreçleri sıfır (`EV-20260827-025`). Add-on'a özgü payload-final kapısı
+  tanımlı/kanıtlı değil; exact-artifact B2 fiziksel kabulü **NOT_RUN**,
+  tag/release blokludur.
+- PR #65 run `33076170838`, continuity'de dört kalite yolunun `docs/` öneki
+  sıkıştırılırken düşürüldüğünü **248 passed / 1 failed** ile yakaladı; retry yok
+  (`EV-20260827-026`). Exact kırmızıdan sonra yalnız yollar düzeltildi; hedef
+  **1 passed**, CI-belge ailesi **249 passed** (`EV-20260827-027`).
 - `WIN-P0-03` ilk native koşumu exact `06cebc4` üzerinde fixture kapısını
   geçtikten sonra QMenu sınırında TIMEOUT oldu; exit 1 ve eksik final marker
   nedeniyle **FAILED** kaydedildi, seçim/ürün bug'ı iddia edilmedi
@@ -164,15 +176,13 @@ merge/parent/run/`0/0` readback'ini sonraki gerçek kayıt provenance'ına bağl
 
 ## Sıradaki tek adım
 
-Exact iki belgeli `EV-20260827-023` provenance kaydını ayrıca açık onayla commit et; push, CI retry, merge, build, kurulum, tag veya release başlatma.
+Exact iki belgeli `EV-20260827-026`–`027` CI-failure/path-fix paketini ayrıca
+açık onayla commit et; push, retry, merge, fiziksel kabul, tag veya release yok.
 
 ## Sonraki sıra
 
-1. Protected merge sonrası build ve fiziksel kabulü ayrı onaylarla sıfırdan
-   uygula; silent/ikinci uninstall/invalid-target bitmeden tag/release yapma.
-2. Kalan `P0-06`, `P0-07`, `P0-08` boşluklarını yayın sonrasına bırak.
-3. Thumbnail timeline genişlemesinden önce kalıcı cache boyut/yaş temizleme
-   politikasını ürün kararı olarak ele al.
+1. B2 fiziksel kabulünde silent/ikinci uninstall/invalid-target bitmeden tag/release yapma.
+2. `P0-06`–`08` yayın sonrası; thumbnail cache politikası ürün kararıdır.
 
 ## Dokunulmayacaklar ve ayrı onaylar
 
@@ -185,16 +195,6 @@ Exact iki belgeli `EV-20260827-023` provenance kaydını ayrıca açık onayla c
 
 ## Kanonik kayıt kaynakları
 
-- Canlı durum ve tek sonraki adım: `docs/CONTINUITY.md`.
-- Ayrılmış continuity kronolojisi: `docs/CONTINUITY_HISTORY.md`.
-- Makinece kanıt: `docs/VERIFICATION_LEDGER.json`.
-- Tarihsel ayrıntı: `docs/PROJECT_STATUS.md`, `docs/ROADMAP.md`,
-  `docs/ENGINEERING_AUDIT.md`.
-- Paketleme ve installer kararları: `docs/PACKAGING_PLAN.md`.
-- Değişiklik akışı: `docs/CHANGE_WORKFLOW.md`.
-- Yayın sırası: `docs/RELEASE_PROCESS.md`.
-- Mimari kalite programı: `docs/QUALITY_EVOLUTION_PLAN.md`.
-- Güncel mimari envanter: `docs/ARCHITECTURE_INVENTORY.md` ve
-  `docs/ARCHITECTURE_INVENTORY.json`.
-- Gerçek Windows senaryoları: `docs/WINDOWS_ACCEPTANCE_MATRIX.md` ve video
-  formatı kabul dosyaları.
+- Canlı durum: `CONTINUITY.md`; kronoloji: `CONTINUITY_HISTORY.md`; kanıt: `VERIFICATION_LEDGER.json`; tarihçe: `PROJECT_STATUS.md`, `ROADMAP.md`, `ENGINEERING_AUDIT.md`.
+- Paketleme/akış/yayın: `PACKAGING_PLAN.md`, `CHANGE_WORKFLOW.md`, `RELEASE_PROCESS.md`.
+- Kalite/mimari/Windows: `docs/QUALITY_EVOLUTION_PLAN.md`, `docs/ARCHITECTURE_INVENTORY.md`, `docs/ARCHITECTURE_INVENTORY.json`, `docs/WINDOWS_ACCEPTANCE_MATRIX.md` ve video formatı kabul dosyaları.
diff --git a/docs/VERIFICATION_LEDGER.json b/docs/VERIFICATION_LEDGER.json
@@ -8360,6 +8360,179 @@
         "Commit provenance does not add hosted CI, network, native libmpv, build, installer, installed-artifact, merge, tag or release evidence."
       ],
       "next_action": "Request separate approval to commit this exact two-document EV023 provenance record; do not push, retry CI, merge, build, install, tag or release."
+    },
+    {
+      "id": "EV-20260827-024",
+      "recorded_at_utc": "2026-08-27T13:05:39Z",
+      "proof_layer": "hosted_ci",
+      "result": "passed",
+      "commit": "2e75fbd538ec2026ab30a2932c40767f74a5486e",
+      "baseline_commit": "2e75fbd538ec2026ab30a2932c40767f74a5486e",
+      "working_tree_state": "uncommitted",
+      "changed_files": [
+        "docs/CONTINUITY.md",
+        "docs/VERIFICATION_LEDGER.json"
+      ],
+      "commands": [
+        "gh pr view 64 --repo IzzmooPro/MLCPlayer --json state,mergedAt,mergeCommit,headRefOid,baseRefOid,url",
+        "git show -s --format=%H%n%P%n%s origin/master",
+        "gh run view 33073259245 --repo IzzmooPro/MLCPlayer --json event,headBranch,headSha,status,conclusion,url,jobs",
+        "gh run view 33073259245 --repo IzzmooPro/MLCPlayer --job 98520717119 --log",
+        "git rev-parse HEAD",
+        "git rev-parse origin/master",
+        "git rev-list --left-right --count HEAD...origin/master"
+      ],
+      "subject": "Exact-master v0.40 release-candidate hosted test",
+      "evidence": [
+        "PR 64 read-back reported MERGED at 2026-08-27T12:35:49Z as exact merge commit 2e75fbd538ec2026ab30a2932c40767f74a5486e with base parent 9090cafaf9dea52c0aa0422fa8f00c6aa9795680 and head parent 821943bdf410351014c6794e4bb767ac1fccb94a",
+        "local origin/master read-back independently returned the same exact merge commit and both parents; HEAD and origin/master were 0/0",
+        "separately approved workflow_dispatch run 33073259245 job 98520717119 completed successfully on refs/heads/master at exact commit 2e75fbd538ec2026ab30a2932c40767f74a5486e",
+        "the fail-closed expected ref and SHA gate passed before the suite",
+        "the full hosted suite reported 5061 passed, 30 skipped and 0 failed in 122.56 seconds",
+        "locked dependency verification, Python compilation and translation checks completed successfully"
+      ],
+      "summary": "The exact protected-master merge commit passed its separately approved release-candidate hosted suite with 5061 passed, 30 skipped and no failures.",
+      "limitations": [
+        "Hosted CI does not prove native Windows playback, installer behavior, installed artifact acceptance or human visual acceptance.",
+        "Thirty skipped tests remain skipped and are not promoted to PASS.",
+        "This record does not claim LEDGER_APPEND_ONLY_OK because that marker was not established from the inspected dispatch log."
+      ],
+      "next_action": "Record the separately approved official source build for the same exact commit; do not install, tag or release."
+    },
+    {
+      "id": "EV-20260827-025",
+      "recorded_at_utc": "2026-08-27T13:05:39Z",
+      "proof_layer": "source_build",
+      "result": "passed",
+      "commit": "2e75fbd538ec2026ab30a2932c40767f74a5486e",
+      "baseline_commit": "2e75fbd538ec2026ab30a2932c40767f74a5486e",
+      "working_tree_state": "uncommitted",
+      "changed_files": [
+        "docs/CONTINUITY.md",
+        "docs/VERIFICATION_LEDGER.json"
+      ],
+      "commands": [
+        "python -B packaging/verify_dependencies.py requirements-lock.txt",
+        "python -B packaging/verify_build.py --pre",
+        "python -B packaging/check_publishable.py",
+        "python packaging/verify_inno.py all",
+        "cmd.exe /d /c packaging\\build_release.bat",
+        "python -B packaging/verify_build.py --post",
+        "python -B packaging/verify_build.py --final installer_output/MLCPlayer_Setup_v0.40.exe",
+        "python -B -c \"import sys; sys.path.insert(0,'packaging'); from prepublish import signature_is_valid; files=['installer_output/MLCPlayer_Setup_v0.40.exe','installer_output/MLCPlayer_InternetVideo_v0.40.exe']; results=[signature_is_valid(f) for f in files]; print('SIGNATURES_VALID',results); raise SystemExit(0 if all(results) else 1)\"",
+        "Get-FileHash -Algorithm SHA256 installer_output\\MLCPlayer_Setup_v0.40.exe,installer_output\\MLCPlayer_Setup_v0.40.exe.sig,installer_output\\MLCPlayer_InternetVideo_v0.40.exe,installer_output\\MLCPlayer_InternetVideo_v0.40.exe.sig",
+        "Get-AuthenticodeSignature installer_output\\MLCPlayer_Setup_v0.40.exe,installer_output\\MLCPlayer_InternetVideo_v0.40.exe",
+        "$targets = @(Get-CimInstance Win32_Process | Where-Object { $_.Name -match '^(MLC Player|yt-dlp|deno|mpv|ffmpeg)\\.exe$' } | Select-Object ProcessId,Name,ExecutablePath); 'TARGET_PROCESS_COUNT ' + $targets.Count",
+        "git status --short --branch",
+        "git rev-list --left-right --count HEAD...origin/master"
+      ],
+      "subject": "Official v0.40 source build from exact protected master",
+      "private_artifact_digests": [
+        {
+          "name": "MLCPlayer_Setup_v0.40.exe",
+          "size_bytes": 55932256,
+          "sha256": "7CDB6B585873CD22DCAF12ED1F62891AB395CB3CC13203B2BF04E7B16533089D"
+        },
+        {
+          "name": "MLCPlayer_Setup_v0.40.exe.sig",
+          "size_bytes": 88,
+          "sha256": "148A40D13FD05D8CC3FC532BCAAD6204DCE3D5FF37D9337382E5095FA0435DBF"
+        },
+        {
+          "name": "MLCPlayer_InternetVideo_v0.40.exe",
+          "size_bytes": 48909126,
+          "sha256": "D4A4D79995B23228231B8D16091AB85D4805862FDBDDEC415842CE9DFDF9E675"
+        },
+        {
+          "name": "MLCPlayer_InternetVideo_v0.40.exe.sig",
+          "size_bytes": 88,
+          "sha256": "516CA07EE797C06C8B0902CE16EB85E98BCC2713D277FFDC689D6C4D15E2DF73"
+        }
+      ],
+      "evidence": [
+        "the separately approved official packaging/build_release.bat command completed once with exit code 0 from clean exact commit 2e75fbd538ec2026ab30a2932c40767f74a5486e; no retry was performed",
+        "the build produced both v0.40 installer executables and their detached Ed25519 signatures with the recorded safe names, byte sizes and SHA-256 values",
+        "both detached Ed25519 signatures verified against their exact installer bytes; both executable Authenticode states were NotSigned, consistent with the active release policy",
+        "the main packaged distribution contained 91 files and 188467894 bytes; packaged MLC Player.exe was 3133269 bytes with SHA-256 8D9A70B85197B7E8C50608863166D696E4D5BF9C94C950DA3D4DB29D2956149F and version v0.40",
+        "packaged mpv-2.dll was 112772608 bytes with SHA-256 DE80329F5C019BA2EE48184B5DC1E1D0C2EE9EEBA3F1FB7959F20B4B0F684F4E, matching the verified runtime input",
+        "post-build and final read-back found zero measured MLC Player, yt-dlp, deno, mpv or ffmpeg target processes; the source checkout remained exact 2e75fbd at origin/master 0/0"
+      ],
+      "summary": "The official exact-master v0.40 source build completed and produced two identified unsigned installers with valid detached Ed25519 signatures and a verified main distribution.",
+      "limitations": [
+        "The project has no add-on-specific payload-final gate; packaging/verify_build.py --final semantically verifies the main distribution even if passed the add-on path, so add-on evidence is limited to successful Inno compilation, artifact identity and detached-signature validity.",
+        "No aggregate dist tree SHA-256 is recorded because the project does not define a canonical tree-hash algorithm.",
+        "Source-build PASS does not prove interactive or silent install, upgrade, uninstall, Restart Manager, invalid-target, running-process, network, native playback or human visual behavior.",
+        "The exact artifacts have not completed mandatory release-process step B2 installed-artifact acceptance; tag and release remain blocked."
+      ],
+      "next_action": "Request separate approval to commit this exact two-document EV024-EV025 evidence package; do not push, install, tag or release."
+    },
+    {
+      "id": "EV-20260827-026",
+      "recorded_at_utc": "2026-08-27T13:21:30Z",
+      "proof_layer": "hosted_ci",
+      "result": "failed",
+      "commit": "50c60ee42835fe6304d55eb2a51c9547e9c9dd23",
+      "baseline_commit": "50c60ee42835fe6304d55eb2a51c9547e9c9dd23",
+      "working_tree_state": "uncommitted",
+      "changed_files": [
+        "docs/CONTINUITY.md",
+        "docs/VERIFICATION_LEDGER.json"
+      ],
+      "commands": [
+        "gh run watch 33076170838 --repo IzzmooPro/MLCPlayer --exit-status",
+        "gh run view 33076170838 --repo IzzmooPro/MLCPlayer --job 98530815065 --log-failed",
+        "gh pr view 65 --repo IzzmooPro/MLCPlayer --json state,headRefOid,mergeable,mergeStateStatus,statusCheckRollup"
+      ],
+      "subject": "PR 65 documentation check rejects shortened canonical quality paths",
+      "evidence": [
+        "required pull-request run 33076170838 job 98530815065 failed on exact head 50c60ee42835fe6304d55eb2a51c9547e9c9dd23; PR 65 remained OPEN, MERGEABLE and BLOCKED",
+        "the documentation and continuity family reported 248 passed and 1 failed before the full CI-safe suite was skipped",
+        "the single failure was test_quality_documents_are_wired_into_the_current_handoff because docs/QUALITY_EVOLUTION_PLAN.md was no longer an exact substring of CONTINUITY.md",
+        "ledger append-only verification passed before the documentation family failed"
+      ],
+      "summary": "PR 65 failed one documentation-contract test after continuity compaction removed the docs prefix from canonical quality-document paths.",
+      "limitations": [
+        "This is a failed hosted result; 248 passing documentation tests do not promote the required check or PR to PASS.",
+        "The full CI-safe test suite did not run and is not claimed.",
+        "The failed run was not retried."
+      ],
+      "next_action": "Reproduce the exact contract failure locally and restore only the four canonical docs-prefixed quality paths; do not change product code or retry the failed run."
+    },
+    {
+      "id": "EV-20260827-027",
+      "recorded_at_utc": "2026-08-27T13:21:30Z",
+      "proof_layer": "deterministic",
+      "result": "passed",
+      "commit": "50c60ee42835fe6304d55eb2a51c9547e9c9dd23",
+      "baseline_commit": "50c60ee42835fe6304d55eb2a51c9547e9c9dd23",
+      "working_tree_state": "uncommitted",
+      "changed_files": [
+        "docs/CONTINUITY.md",
+        "docs/VERIFICATION_LEDGER.json"
+      ],
+      "commands": [
+        "python -m pytest -q --noconftest tests/test_quality_evolution_plan_regressions.py::test_quality_documents_are_wired_into_the_current_handoff (before fix: 1 failed)",
+        "python -m pytest -q --noconftest tests/test_quality_evolution_plan_regressions.py::test_quality_documents_are_wired_into_the_current_handoff (after fix: 1 passed)",
+        "python -m pytest -q --noconftest tests/test_continuity_regressions.py tests/test_change_workflow_regressions.py tests/test_quality_evolution_plan_regressions.py tests/test_readme_user_guidance_regressions.py tests/test_release_documentation_regressions.py tests/test_signpath_readiness_regressions.py tests/test_video_format_acceptance_plan_regressions.py",
+        "python -m json.tool docs/VERIFICATION_LEDGER.json",
+        "python scripts/verify_ledger_append_only.py --base-ref origin/master",
+        "python -c \"import json,pathlib,subprocess,os,tempfile; norm=lambda s:s.replace(chr(92),'/').casefold(); needles=(norm(os.environ['USERPROFILE']),norm(tempfile.gettempdir()),'.'+'codex/visualizations','.'+'codex/generated_images'); base=json.loads(subprocess.check_output(['git','show','HEAD:docs/VERIFICATION_LEDGER.json'],text=True,encoding='utf-8')); cur=json.load(open('docs/VERIFICATION_LEDGER.json',encoding='utf-8')); new=cur['entries'][len(base['entries']):]; blobs=[json.dumps(new),pathlib.Path('docs/CONTINUITY.md').read_text(encoding='utf-8')]; assert not any(norm(n) in norm(b) for n in needles for b in blobs); print('PRIVATE_PATH_SCAN_OK',len(new))\"",
+        "git diff --check"
+      ],
+      "subject": "Restore canonical docs-prefixed quality-document paths in continuity",
+      "evidence": [
+        "the exact hosted assertion reproduced locally as one failure on the committed 50c60ee baseline",
+        "only the four canonical quality-document references in CONTINUITY.md regained their docs prefixes; product code and tests are unchanged",
+        "the exact target passed once after the fix and the same seven-file CI documentation family passed all 249 tests",
+        "continuity remained within its two-hundred-line contract",
+        "JSON parsing passed and ledger verification reported LEDGER_APPEND_ONLY_OK with the exact 284-entry committed prefix and two unique appended IDs; an initial self-referential privacy scan was rejected because its own literal needles matched, then the corrected runtime-derived scan covered commands plus all new entry content and continuity and reported PRIVATE_PATH_SCAN_OK for both entries"
+      ],
+      "summary": "A minimal continuity-only path correction restores the four exact quality-document links and passes the complete CI documentation family.",
+      "limitations": [
+        "Deterministic documentation tests do not repair the failed hosted run; a new required PR run is needed only after separately approved commit and push.",
+        "No full CI-safe, native, build, installer, installed-artifact, tag or release evidence is added."
+      ],
+      "next_action": "Request separate approval to commit the exact two-document EV026-EV027 repair package; do not push, retry, merge, install, tag or release."
     }
   ]
 }