[wagenet]

Written by Claude (Claude Code) on behalf of @wagenet.

Stacked on #796, which carries #786. It is merged in because the report reaches operators through their block health scan. Reviewable content is the last commit only:

main
 └─ merge of #796  wagenet/unlinked-branch-health-pr  (carries #786)
     └─ feat(whip): track a slot's liveness per medium   ← this PR

Problem

A WHIP slot's audio and video are separate chains from the publisher's RTP session to the flow's consumers, but #756 gives the slot one output ActivityStamp for both. Either medium stamping it keeps the whole seat looking alive.

On the five-seat mix-minus rig a seat delivered no audio to the audio mixer, the vision mixer or the return router for its whole session while its video kept flowing, and every liveness signal reported it healthy: a commentator whose microphone has silently stopped reaching the mix.

Change

SlotOutput replaces the per-slot output stamp with one stamp per medium, written by the same tee probes. WhipSlotLiveness names any occupied slot medium that has stopped producing while its counterpart has not.

The verdict reaches block health through a new BlockLiveness hook on BlockBuildContext. Neither existing scan can see this failure: the pad-task scan needs a task that paused, the unformed-link scan needs a link that never formed, and a chain that is linked and never pushed to has neither. The scan applies a block's own verdict last, so a more specific failure still wins. The operator gets a BlockHealthChanged event, an entry in flow.block_health, and:

ERROR Block 'whip_p1' in flow 'race day' is not passing data: WHIP endpoint 'p1':
slot 0 has produced no audio for 5.6 s while its video is still flowing.
The pipeline still reports Playing

Against #756's design. Only the output side is split. #756's ingress stays one stamp: idle() wants the newest arrival of either medium and the first arrival of any, which a single stamp already gives. idle() reads SlotOutput on its newest medium, so the decode grace, the takeover tail handling and the StallSide label behave exactly as in #756. has_delivered_audio stays on ingress_audio.

Reap policy: unchanged, deliberately. Reaping on one dead medium drops the video the publisher is still delivering and throws a client that renegotiated its microphone away into a reconnect loop. A per-medium idle in takeover would also reopen the eviction of a healthy video-only publisher at 3.1 s: TAKEOVER_IDLE_THRESHOLD is 2 s because audio has a ~20 ms cadence, and it is only sound as a whole-session test because has_delivered_audio gates it. What to do about a dead microphone is a production decision.

Thresholds.

medium	silent before reported
audio	2 s
video	10 s
never produced at all	10 s, from the counterpart's first buffer

A connected publisher sends audio every ~20 ms even when muted (WebRTC keeps the RTP stream running with silence), so two seconds of nothing is a broken chain. A screen share of an idle window legitimately goes many seconds between frames.

A medium is reported only when its counterpart outlived it by that medium's own budget. Without that, a seat losing its transport reads as half dead for the difference between the budgets; the rig showed a killed publisher reported as an audio failure for 5.6 s before the watchdog reaped it.

Evidence

• Per-medium stamps are what make the report possible: a_slot_reports_the_medium_that_died_while_the_other_kept_flowing builds a real audio_video block, pushes buffers into the real per-slot appsrcs and reads the real reporter. Wiring both probes to the audio stamp (output.touch(Medium::Audio)) makes it fail. Run on the head before the rebase onto main.
• A whole-seat drop is not reported as half dead: a_seat_that_stopped_altogether_is_not_reported_as_half_dead fails when the counterpart term is dropped (silent >= thresholds.stopped(medium)). Run on the head before the rebase onto main.
• Quiet and empty slots are not reported: an_empty_or_wholly_idle_slot_is_not_reported.
• A block's own verdict reaches the scan: a_blocks_own_failure_report_reaches_its_health.
• Reap policy unchanged: a_session_whose_audio_died_keeps_its_slot. Passes before the change too, so it guards the decision, not the fix.
• fix(whip): judge a session by the media it produces, not what arrives #756's guards pass unchanged against the split output, including a_predecessors_trailing_frames_do_not_cut_the_decode_grace_short and a_reaped_session_names_which_side_of_the_chain_stopped.
• Rig, from the earlier build of this commit before it was redone on the current fix(whip): judge a session by the media it produces, not what arrives #756, not re-run: a video-only publisher was reported 14.1 s after slot allocation and kept its slot; a killed publisher produced no report and was reaped at 10 s; releasing the slot returned the block to ok.

Tests

Ran on this head, macOS: cargo clippy --workspace --all-targets -- -D warnings, cargo fmt --all -- --check, cargo test --test block_health_test --test whip_idle_slot_test --test whip_session_branch_test --test whip_slot_caps_reuse_test --test whip_slot_decoder_reuse_test --test whip_video_damage_test --test whip_whep_ice_transport_policy_test --test pipeline_lifecycle_test (27 passed, 0 failed), and the backend unit tests filtered to whip, health and stats:: (65 passed, 0 failed). The full workspace suite last ran on the head before the rebase (998 passed).

Not run: the headless rig and the full mix-minus rig with tone capture, the nvidia feature, the WASM clippy, the full workspace suite on this head. CI has not run on this head.

For the reviewer

• A publisher that legitimately sends video only (screen share, no microphone) on an audio_video endpoint is reported after ~14 s and stays reported. It is the same code path as the rig failure, where audio never arrived either, so it cannot be suppressed without losing that case. The endpoint mode is the operator's declaration of what the seat carries, so I think reporting is right; a second opinion is welcome.
• refactor(whip): split whip.rs and whip_session_manager.rs into sub-modules #854 (pure-move split of whip.rs and whip_session_manager.rs) touches the same files. Whichever lands second has to be rebased.

Out of scope

• Telling "the publisher never sent audio" from "audio arrived and never left the slot's chain" needs per-medium ingress on the session, which the block cannot reach.

🤖 Generated with Claude Code

[srperens]

Noted as a draft, so I am holding off on a full review until it is marked ready for
review. If you want one before then, say so here or request me as a reviewer.

[srperens]

Written by Claude (AI) on behalf of @srperens.

Not in #957. The per-medium report goes through the block-health hook from #786/#796, which is not on main, and we want to settle the block-health and failure-policy design first. This PR stays open for that discussion. #957 does keep the per-slot output stamp from #756 that this builds on.

[wagenet]

Claude (AI), on behalf of @wagenet.

Rebuilt on main now that #756 has merged: main, then the #796 merge, then the per-medium commit. Conflicts were with #957 in whip.rs and whip_session_manager.rs. Both sides were kept: SlotDecodebin and VideoDamage from #957, and SlotOutput from this PR. One change goes beyond picking sides. #957's an_unstamped_buffer_never_reaches_the_slot_appsrc built its SessionActivity from an ActivityStamp. It now builds it from a SlotOutput, because this PR changed that constructor.

Ran: clippy -D warnings, fmt check, the block health, WHIP and pipeline lifecycle integration tests (27 passed), and the backend unit tests filtered to whip, health and stats (65 passed).

[srperens]

#983 has landed the same per-medium SlotOutput split, and uses it for reaping/takeover (a seat whose video died while audio flows is displaced). Your BlockLiveness health reporting isn't in it — this could rebase onto #983's SlotOutput and keep just the health hook.

🤖 Generated with Claude Code

[wagenet]

Comment by Claude on behalf of @wagenet.

Replaced by #1025, which rebuilds this on the per-medium stamps #983 added. It only reports; reaping and takeover stay with #983, so this PR's a_session_whose_audio_died_keeps_its_slot is dropped. It also tells a publisher that stopped sending a medium apart from a medium that arrives but is never decoded, and gives the block health report structured causes. #796 is not underneath #1025 and stays its own PR.