CivicCast v1.0.0-rc18 — audit-remediation controlled beta

rc18 is the audit-remediation release on top of rc17. A full stage gate against
the rc17 line returned do not advance with sixteen findings (3 Critical,
8 Major, 5 Minor); rc18 fixes all sixteen. A gate against rc18 itself then
raised twenty more, and those are fixed too. The stage-gate re-run against this
candidate returned no blocker or critical findings. Every fix merged with
required checks green and none with an admin override.

What this fixes (the ones a records clerk cares about)

• Archive provenance. The simulated Internet Archive target produced a link
  that looked like a genuine archive.org permalink for an item that was never
  created. Fixed at every layer, and the publish dashboard now says plainly when
  nothing was actually archived.
• Public contributor uploads are no longer an open surface. The public
  upload endpoint had no sign-in, size limit, or rate limit. rc18 adds a per-file
  size ceiling, per-IP upload and submission rate limits, a per-IP and aggregate
  byte budget with race-safe accounting, single-use upload references (one upload
  backs at most one submission), and a reaper that reclaims stale uploads —
  returning clear, actionable errors at every limit instead of a bare failure.
• Playback fails gracefully. Recorded playback returned a bare server error
  when durable storage was briefly unreachable; it now returns an actionable
  status, and the connect attempt is time-bounded.

First run

• The first-run screen no longer names a button that isn't there. On a
  machine without WSL set up, it told the operator twice to choose "Set up
  Windows helper" while the only button on screen read "Resume after reboot".
  The bootstrap was reporting a pending reboot for a step that deliberately
  changes nothing, and that flag suppressed the control its own message named.

Operator experience

• The operator console now speaks one consistent readiness vocabulary across
  every screen — a city clerk never has to read a raw machine enum — including
  the live pre-flight checklist and notification-delivery status, with a
  screen-reader-announced readiness headline.

Under the hood (station-IT relevant)

• All ffmpeg invocation is routed through one audited adapter (ADR 0007), now
  enforced by a CI policy check that resolves import aliases instead of matching
  text.
• A contributor-upload directory that is misconfigured or unwritable now returns
  an actionable error rather than an unhandled failure.
• Two policy gates and a large-blob / Git-LFS guard now run on every pull
  request, instead of only when an agent remembered to run them.
• Documentation: the user manual, API reference, and OpenAPI contract are current
  with the shipped behavior.

Scope — what rc18 does NOT yet prove

The controlled beta proves one bounded local workflow: create or upload recorded
media, rehearse it privately, package it privately, approve Portal publication,
and play it in the resident portal. Live 24/7 ingest, physical hardware and
headend delivery, external providers, and app-store distribution still require
separate field proof. The clean-host proof covers packaging, lifecycle and the
installer wizard; it does not cover cold-reboot recovery or first-run station
setup.

Install

• Windows: download civiccast-1.0.0-rc18-windows-setup.exe (SHA-256
  af4d2017c6287eaed8cb4b1553d539281fc14c3e3863869c0ea5b8d2e73c311b, 243,742,408 bytes) from the assets below. Verify the
  SHA-256 against the attached .sidecar.json before running. The installer is
  Authenticode-signed (CN=Scott Converse) and Sigstore-verifiable, and its
  signing certificate binds it to this tag's commit.
• rc17 remains published as the rollback target. It carries all sixteen findings
  above, so rolling back is a deliberate trade, not a safe default.

Supersedes

Three earlier rc18 builds (SHA-256 25305a6c…, 900dd6d5…, 993d4b39…) were
never published, and each carries findings this release fixes. Discard them.