fix(vmafx-tune-go): deep bug audit — 5 fixes (JSON NaN, subprocess hang, codec cache)

[lusoris]

Summary

Deep audit of cmd/vmafx-tune/ (Stage-1 Go CLI per ADR-0705 / ADR-0713) and its
pkg/{report,bisect,encoder,ladder} dependencies. Five distinct bugs bundled
into one PR, every fix shipping with a focused regression test.

• Bug 1 — JSON NaN propagation in bisect_samples. report.EmitJSON and
  cmd/vmafx-tune/cmd.emitSweepJSON sanitised only the top-level row floats,
  leaving []bisect.Sample declared as raw float64 in the wire shape. A
  single non-finite VMAF / bitrate / encode-time sample (e.g. propagated from
  a corrupt vmaf XML mean) crashed json.MarshalIndent with "unsupported value: NaN" and broke the Python ↔ Go parser-parity invariant (AGENTS.md
  rebase-sensitive invariant chore(docs): update mkdocs site_url to vmafx.github.io/vmafx #2). New public helper
  report.SanitizeBisectSamples walks the nested floats; mirrored coverage
  added in emitLadderJSON for Cloud + Hull + Renditions across
  BitratekBps, VMAF, TargetVMAF.

• Bug 2 — parseVMAFXMLMean accepted the literal tokens "NaN" / "+Inf"
  / "-Inf". Go strconv.ParseFloat returns those silently. The parser now
  rejects non-finite means at the source so the bisect step records a score
  failure rather than seeding bug 1 failure mode.

• Bugs 3 / 4 / 5 — Subprocess hang risk (ffmpeg, vmaf, ffprobe / codec
  discovery). Every exec.Command in pkg/encoder and pkg/bisect ran with
  no context and no timeout, so a hung child pinned the sweep forever. All
  switched to exec.CommandContext with per-stage upper bounds overridable
  via VMAFX_TUNE_ENCODE_TIMEOUT (default 60m), VMAFX_TUNE_SCORE_TIMEOUT
  (default 30m), VMAFX_TUNE_PROBE_TIMEOUT (default 30s).

• Bug 6 — Codec-discovery cache stale-key. The prior sync.Once gate
  locked in whichever ffmpeg binary path was probed first, with
  _ = ffmpegBin masquerading as cache invalidation. Cache key is now the
  binary path; calling with a different path triggers a re-probe and replaces
  the cache.

Plus a pkg/encoder/discover_test.go update to the new per-binary cache
shape (removed the sync.Once references) and minor gofmt alignment of
the timeout helpers.

No ADR — bug fixes per CLAUDE §12 r8.

Test plan

• go test -race -count=1 -timeout=180s ./cmd/vmafx-tune/... ./pkg/bisect/... ./pkg/encoder/... ./pkg/ladder/... ./pkg/report/... — all packages pass.
• go vet ./... clean.
• gofmt -l ... clean.
• pre-commit run --files <all touched files> clean.
• Python parser parity: pytest tools/vmaf-tune/tests/test_bisect.py tools/vmaf-tune/tests/test_compare.py tools/vmaf-tune/tests/test_compare_rate_quality_sweep.py tools/vmaf-tune/tests/test_compare_no_bisect.py — 88/88 pass.
• Reproducer for the JSON NaN bug — see TestEmitJSON_NaNInBisectSamplesDoesNotCrash (pkg/report/sanitize_test.go); pre-fix it would crash with "json: unsupported value: NaN", post-fix it round-trips cleanly through json.Unmarshal.
• Reproducer for the codec-cache bug — see TestProbeAvailableCodecs_CacheRespectsBinaryPath (pkg/encoder/discover_cache_test.go); pre-fix the second call returns the stale first-binary result, post-fix it re-probes.

Per-surface notes (CLAUDE §12 r10)

• cmd/vmafx-tune/cmd/{compare,ladder}.go — public-CLI emitter behaviour
  (NaN sanitisation) hardened; no user-visible CLI flag change, so the
  doc-substance rule has nothing to update.
• pkg/report.SanitizeBisectSamples — new exported helper; internal to the
  Go binary (not a libvmaf C-API surface), no docs/api/ update needed.
• New env-var knobs VMAFX_TUNE_{ENCODE,SCORE,PROBE}_TIMEOUT — surfaced in
  the changelog fragment and rebase-notes for operator discoverability.

Deep-dive deliverables (CLAUDE §12 r11)

1. Research digest: no digest needed (bug fix in fork-local Go package).
2. Decision matrix: no alternatives — every fix is the only-correct shape
   (NaN→null, ctx with timeout, cache-key on binary path).
3. AGENTS.md invariant note: rebase invariants in
   cmd/vmafx-tune/AGENTS.md already cover NaN coercion (chore(docs): update mkdocs site_url to vmafx.github.io/vmafx #2) and the
   bisect midpoint (chore(deps): Pin dependencies #3); no edits needed.
4. Reproducer / smoke command: see Test plan above.
5. Changelog fragment: changelog.d/fixed/0979-vmafx-tune-go-deep-bug-audit.md.
6. Rebase notes: docs/rebase-notes.md entry added.

Scope guardrails

• Draft-only; no admin bypass; standard pre-commit hooks all run.
• Pre-push: go test -race, go vet, gofmt, pre-commit run all clean.
• Python parser-parity test sweep run locally; 88/88 green.
• AHEAD safety: rebased onto current origin/master (1 ahead, 0 behind at push time).
• docs/state.md row added per CLAUDE §12 r13.

🤖 Generated with Claude Code