chore(merge): merge master into chore/remove-dead-jit-scaffolding

Resolves conflicts:
- Directory.Packages.props: take AiDotNet.Tensors 0.46.1 from master,
  keep AiDotNet.Native.OneDNN 0.46.0 for ecosystem alignment.
- src/NeuralNetworks/MobileNetV2Network.cs: keep both overrides --
  GetNamedLayerActivations (master, 3D->4D probe shape) and
  PredictEager (HEAD, compiled-plan routing). Master's Predict
  override was superseded by PredictEager + base-class routing.

Author: franklinic

.github/workflows/deploy-website.yml

@@ -59,10 +59,28 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Verify required build secrets
+        env:
+          PUBLIC_SUPABASE_URL: ${{ secrets.PUBLIC_SUPABASE_URL }}
+          PUBLIC_SUPABASE_ANON_KEY: ${{ secrets.PUBLIC_SUPABASE_ANON_KEY }}
+        run: |
+          # Fail the job here rather than deploying a site that silently
+          # disables auth. Astro bakes these at build time — a missing or
+          # rotated secret would otherwise produce a broken production bundle.
+          : "${PUBLIC_SUPABASE_URL:?Missing PUBLIC_SUPABASE_URL GitHub secret}"
+          : "${PUBLIC_SUPABASE_ANON_KEY:?Missing PUBLIC_SUPABASE_ANON_KEY GitHub secret}"
+
       - name: Build website
         run: npx astro build
         env:
           VERCEL: '1'
+          # Astro bakes import.meta.env.PUBLIC_* values at build time. Without these
+          # the client-side Supabase client throws "Missing Supabase environment
+          # variables" at page load, which in turn means every script that imports
+          # src/lib/supabase.ts crashes — sign-in buttons silently become no-ops.
+          # Keep these in lockstep with the Vercel project env vars.
+          PUBLIC_SUPABASE_URL: ${{ secrets.PUBLIC_SUPABASE_URL }}
+          PUBLIC_SUPABASE_ANON_KEY: ${{ secrets.PUBLIC_SUPABASE_ANON_KEY }}
 
       - name: Verify build output
         run: |

Directory.Packages.props

@@ -5,7 +5,7 @@
   <ItemGroup>
     <!-- AiDotNet ecosystem -->
     <PackageVersion Include="AiDotNet" Version="0.113.0" />
-    <PackageVersion Include="AiDotNet.Tensors" Version="0.46.0" />
+    <PackageVersion Include="AiDotNet.Tensors" Version="0.46.1" />
     <PackageVersion Include="AiDotNet.Native.OneDNN" Version="0.46.0" />
     <PackageVersion Include="AiDotNet.Native.OpenBLAS" Version="0.28.0" />
     <PackageVersion Include="AiDotNet.Native.CLBlast" Version="0.37.0" />

src/AiDotNet.Generators/TestScaffoldGenerator.cs

@@ -1492,14 +1492,21 @@ private static void EmitGeneratedTestClass(
                     }
                 }
             }
-            else if (model.Domains.Contains(3) && !model.Tasks.Contains(35))
+            else if (model.Domains.Contains(4) && !model.Tasks.Contains(35))
             {
                 // Temporal video models (ActionRecognition=22, VideoGeneration=41, etc.)
                 // need a 4D [frames, channels, height, width] input shape, but
                 // NeuralNetworkArchitecture only expresses 3D (height/width/depth).
                 // Rather than silently emit a mismatched 3D architecture alongside a
                 // 4D InputShape, route these to a runtime placeholder until the
                 // architecture type can represent a temporal dimension.
+                //
+                // The enum ordinal for ModelDomain.Video is 4
+                // (General=0, Vision=1, Language=2, Audio=3, Video=4, ...).
+                // This check previously used 3, which incorrectly flagged every
+                // *audio* model (PlayHT, Bark, etc.) as "temporal video" and
+                // emitted a NotImplementedException factory — ten PlayHTTests
+                // failures on PR #1156 traced to this off-by-one.
                 constructorExpr = "throw new System.NotImplementedException(" +
                     $"\"'{GeneratorHelpers.StripGenericSuffix(model.ClassName)}' is a temporal video model; NeuralNetworkArchitecture<T> cannot express its 4D [frames, channels, height, width] input. Implement this factory manually.\")";
             }
@@ -1510,7 +1517,7 @@ private static void EmitGeneratedTestClass(
                 // others default to OneDimensional. Temporal video is handled above.
                 needsArchitectureUsing = true;
                 bool isVision = model.Domains.Contains(1) || model.Domains.Contains(11); // Vision=1, ThreeD=11
-                bool isAudio = model.Domains.Contains(4); // Audio=4
+                bool isAudio = model.Domains.Contains(3); // Audio=3 (enum ordinal, not Video=4)
                 bool isFrameInterp = model.Tasks.Contains(35); // FrameInterpolation → 3D input
 
                 string inputTypeExpr;
@@ -1623,11 +1630,12 @@ private static void EmitGeneratedTestClass(
 
         // Override InputShape/OutputShape for domain-appropriate test data.
         // Vision/Video/3D models need [C, H, W]; default is [1, 4].
-        bool isVideoModel = model.Domains.Contains(3);
+        // Enum ordinals: General=0, Vision=1, Language=2, Audio=3, Video=4.
+        bool isVideoModel = model.Domains.Contains(4); // Video=4 (was incorrectly 3)
         bool isFrameInterpModel = model.Tasks.Contains(35); // FrameInterpolation
         bool isTemporalVideoModel = isVideoModel && !isFrameInterpModel;
         bool isVisionModel = model.Domains.Contains(1) || model.Domains.Contains(11);
-        bool isAudioModel = model.Domains.Contains(4);
+        bool isAudioModel = model.Domains.Contains(3); // Audio=3 (was incorrectly 4)
         if (isTemporalVideoModel)
         {
             // Temporal video: [frames, channels, height, width]
@@ -1660,6 +1668,23 @@ private static void EmitGeneratedTestClass(
             sb.AppendLine($"    protected override int[] InputShape => new[] {{ {dim} }};");
             sb.AppendLine("    protected override int[] OutputShape => new[] { 4 };");
         }
+        else if (family == TestFamily.TransformerNER || family == TestFamily.SpanBasedNER)
+        {
+            // TransformerNERBase and SpanBasedNERBase both default to
+            // HiddenDimension=768 (BERT-base). Inputs are validated as
+            // [seqLen, 768], so the base-class default [1, 4] causes a
+            // hard "embedding dim mismatch" failure inside MultiHeadAttention
+            // before any downstream logic runs. Use a short sequence to
+            // keep the test fast while matching the model's expected
+            // embedding size. Models with non-default hidden dimensions
+            // (TinyBERT=312, etc.) need a manual test override.
+            sb.AppendLine("    protected override int[] InputShape => new[] { 8, 768 };");
+        }
+        else if (family == TestFamily.SequenceLabelingNER)
+        {
+            // LSTM-CRF family defaults to EmbeddingDimension=100.
+            sb.AppendLine("    protected override int[] InputShape => new[] { 8, 100 };");
+        }
 
         sb.AppendLine($"    protected override {returnTypeCode} {factoryMethodName}()");
         sb.AppendLine(factoryBody);

src/AiDotNet.Serving/Services/AesGcmModelArtifactProtector.cs

@@ -72,11 +72,67 @@ public ProtectedModelArtifact ProtectToFile(string modelName, string sourcePath,
         }
     }
 
+    /// <summary>
+    /// Cross-platform-invalid filename characters. Combines the Windows
+    /// invalid set (most restrictive: ":" + "\\" + reserved punctuation +
+    /// control chars) with POSIX "/" and "\0". Used instead of
+    /// <see cref="Path.GetInvalidFileNameChars"/> because that method
+    /// returns a platform-specific set — on Linux it only contains '\0'
+    /// and '/', so a model name like "my:model" sanitizes to "my:model"
+    /// on Linux but "my_model" on Windows. Encrypted artifacts are
+    /// designed to be portable, so we apply the strict Windows superset
+    /// on every OS to guarantee the output is mountable everywhere.
+    /// </summary>
+    private static readonly HashSet<char> CrossPlatformInvalidFileNameChars =
+        new(new[]
+        {
+            '\0', '/', '\\', ':', '*', '?', '"', '<', '>', '|',
+        }
+        .Concat(Enumerable.Range(1, 31).Select(i => (char)i)));
+
+    /// <summary>
+    /// DOS reserved device names. Creating a file with any of these as the
+    /// base name (with or without extension) fails on Windows with
+    /// <c>PathTooLongException</c> / <c>IOException</c> because the kernel
+    /// still routes them to legacy character devices. Cross-platform
+    /// portability requires rejecting them even on POSIX hosts so an
+    /// artifact produced on Linux can't be loaded on Windows.
+    /// </summary>
+    private static readonly HashSet<string> WindowsReservedFileNames =
+        new(StringComparer.OrdinalIgnoreCase)
+        {
+            "CON", "PRN", "AUX", "NUL",
+            "COM1", "COM2", "COM3", "COM4", "COM5", "COM6", "COM7", "COM8", "COM9",
+            "LPT1", "LPT2", "LPT3", "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9",
+        };
+
     private static string SanitizeFileName(string name)
     {
-        var invalid = Path.GetInvalidFileNameChars();
-        var chars = name.Select(c => invalid.Contains(c) ? '_' : c).ToArray();
-        return new string(chars);
+        // 1. Replace cross-platform-invalid characters.
+        var chars = name.Select(c => CrossPlatformInvalidFileNameChars.Contains(c) ? '_' : c).ToArray();
+        var sanitized = new string(chars);
+
+        // 2. Windows strips trailing dots and spaces from filenames at create-time
+        //    (so "model." silently becomes "model", but "model." on some paths fails
+        //    with PathNotFound). Trim on every platform to avoid the mismatch.
+        sanitized = sanitized.TrimEnd(' ', '.');
+
+        // 3. If the base (pre-extension) is a reserved DOS device name, prefix it
+        //    so the artifact remains portable. Split on the first dot so "NUL.bin"
+        //    also gets rewritten.
+        if (sanitized.Length == 0)
+        {
+            return "_";
+        }
+
+        var dotIndex = sanitized.IndexOf('.');
+        var baseName = dotIndex >= 0 ? sanitized.Substring(0, dotIndex) : sanitized;
+        if (WindowsReservedFileNames.Contains(baseName))
+        {
+            sanitized = "_" + sanitized;
+        }
+
+        return sanitized;
     }
 }
 

src/ComputerVision/Weights/WeightDownloader.cs

@@ -1,4 +1,5 @@
 using System.Net.Http;
+using AiDotNet.Data;
 
 namespace AiDotNet.ComputerVision.Weights;
 
@@ -108,8 +109,10 @@ public async Task DownloadAsync(
                 }
             }
 
-            // Move completed download to final location
-            File.Move(tempPath, localPath);
+            // Move completed download to final location. Uses RobustFileOps
+            // so a transient Windows Defender / indexer lock doesn't abort
+            // the download (the finally block would wipe the temp file).
+            await RobustFileOps.MoveWithRetryAsync(tempPath, localPath, cancellationToken);
         }
         finally
         {

src/Data/DatasetDownloader.cs

@@ -73,23 +73,35 @@ public static async Task<bool> DownloadFileAsync(
         string tempPath = destinationPath + ".tmp";
         try
         {
-            using var response = await SharedHttpClient.GetAsync(url, HttpCompletionOption.ResponseHeadersRead, cancellationToken);
-            response.EnsureSuccessStatusCode();
+            using (var response = await SharedHttpClient.GetAsync(url, HttpCompletionOption.ResponseHeadersRead, cancellationToken))
+            {
+                response.EnsureSuccessStatusCode();
 
-            using var fileStream = new FileStream(tempPath, FileMode.Create, FileAccess.Write, FileShare.None);
+                // Close the file stream explicitly (via nested using) before
+                // File.Move runs. The nested scope guarantees the handle is
+                // released; otherwise the outer `using` would dispose *after*
+                // the move attempt.
+                using var fileStream = new FileStream(tempPath, FileMode.Create, FileAccess.Write, FileShare.None);
 #if NET6_0_OR_GREATER
-            await response.Content.CopyToAsync(fileStream, cancellationToken);
+                await response.Content.CopyToAsync(fileStream, cancellationToken);
+                await fileStream.FlushAsync(cancellationToken);
 #else
-            await response.Content.CopyToAsync(fileStream);
+                await response.Content.CopyToAsync(fileStream);
+                fileStream.Flush();
 #endif
+            }
 
-            // Move temp file to final location
+            // Move temp file to final location.
             if (File.Exists(destinationPath))
             {
                 File.Delete(destinationPath);
             }
 
-            File.Move(tempPath, destinationPath);
+            // Retry the rename. On Windows the freshly-written file can be
+            // briefly locked by antivirus (Defender) or the search indexer,
+            // which makes File.Move fail with a sharing violation even after
+            // the writer's handle is closed. Short backoff tolerates that.
+            await RobustFileOps.MoveWithRetryAsync(tempPath, destinationPath, cancellationToken);
             return true;
         }
         finally