fix(whip): consolidate the WHIP Input fixes from #759, #893, #787, #901 and #943

[srperens]

Refs #759, #893, #787, #901, #943, #805, #792, #906, #914

Problem

Seven open PRs by @wagenet fix WHIP Input, and nearly all of them change the same two files (whip.rs, whip_session_manager.rs). Each merge made the rest conflict harder: after #756 and #763 landed, #759 needed its logic merged with main's, not just its text. This PR takes the WHIP Input fixes as one series, evaluated and tested against current main.

Each fix below was reproduced by a test that fails with the fix removed, and passes with it.

Change

Commits keep @wagenet as author where the code is his, in dependency order:

From	Commit	What it fixes
#759	fix(whip): stop an unstamped buffer at the session bridge	A buffer with no PTS crossed the session → slot bridge; qtmux answered Buffer has no PTS and took the whole flow down. Now dropped and counted in gst::pipeline_bridge::SessionBridge, with the shared A/V offset set once per session (compare_exchange).
#893	fix(whip): keep a slot's video PTS moving forward	A jitterbuffer burst released several frames on one PTS; h264parse stripped the PTS from all but the first, and the GPU vision mixer failed the flow (Need timestamped buffers!). A new frame at most 1 ms behind the previous one is moved 1 ns past it.
#787	fix(whip): stop a session's second stream stalling below PLAYING	The session appsink kept async=true; the second pad's branch, added during the first one's preroll, stayed in READY and blocked for good. Rig: 7/18 frozen before, 0/18 after.
#787	fix(thumbnail): turn off async on the thumbnail tap appsink	Same defect in the thumbnail tap's dynamically added appsink.
#901	fix(whip): give a reused slot a fresh video decoder (+ test)	A reused slot kept the previous session's decoder: VP8 after H.264 stopped with not-negotiated, and Safari reuses decoded slowly or not at all on VideoToolbox. The video decodebin is restarted from an IDLE probe on reuse.
#943	fix(whip): ask for a keyframe when a running session's video breaks	After video first decoded, an unrepaired loss left the decoder broken for the rest of the session. Two buffer probes (atomics only) raise a per-slot damage flag; a session thread asks for a keyframe, at most once a second and 10 times per episode.
—	test(whip): guard that a reused slot reports its video as decoding	See #805 below.

Adapted, not taken as is:

• fix(whip): stop an unstamped buffer at the session bridge before qtmux sees it #759: rebuilt on main's slot callback, so it keeps fix(whip): let a rejoining client take over a dead session's slot #753's session_finished gate and fix(whip): judge a session by the media it produces, not what arrives #756's ingress liveness stamp. install_slot_bridge wraps that callback so the wiring test drives the real one. The Media Player half is left out: feat(mediaplayer): play live streams, extra tracks and URLs #945 replaced that bridge's timing with its own, so SessionBridge no longer fits there.
• fix(whip): keep a slot's video PTS moving forward frame to frame #893: the ordering runs on the session PTS before SessionBridge rebases it, and copies the buffer only when the PTS moves. Same result, since the offset is constant.
• fix(whip): stop a session's second stream stalling below PLAYING #787, fix(whip): give a reused slot a fresh video decoder #901, fix(whip): ask for a keyframe when a running session's video breaks #943: conflicts only, no change to the logic.

Left out:

• fix(whip): stop asking a reconnecting publisher for needless keyframes #805 (stop needless keyframe requests on reconnect): fix(whip): give a reused slot a fresh video decoder #901 already fixes it. Restarting the decodebin brings pad-added back for each session, so video_decoding is set again and the requester stops. The last commit asserts it; with the restart disabled it fails with "the second session decoded, but the slot never reported its video as decoding". fix(whip): stop asking a reconnecting publisher for needless keyframes #805's stamp-based stop also had the takeover weakness its body describes.
• feat(whip): track a slot's liveness per medium #792 (liveness per medium): reports through the block-health framework of feat(gst): report blocks whose element chain has stopped #786/feat(gst): report a branch whose link never formed #796, which is not on main. It belongs with that design discussion.
• fix(whip): zero the processing deadline on whipclientsink's input appsinks #855 (WHIP Output latency), refactor(whip): split whip.rs and whip_session_manager.rs into sub-modules #854 (module split), chore: remove dead code #897 (dead code): outside WHIP Input, or best done after this lands.

Evidence

Each regression test was run with its fix removed:

Fix removed	Fails
bridge replaced by a bare push_sample	an_unstamped_buffer_never_reaches_the_slot_appsrc: "the unstamped buffer must not be here"
session_finished gate removed	a_finished_session_stops_feeding_its_slot
PTS ordering bypassed	video_frames_on_one_pts_reach_the_slot_in_order
1 ms bound removed	video_b_frames_keep_their_pts, video_frame_far_ahead_does_not_hold_back_later_frames
async(false) removed	both_session_branches_keep_running_when_attached_in_succession
decoder restart disabled	reused_slot_decodes_through_a_fresh_video_decoder, reused_slot_accepts_a_different_codec (not-negotiated), and the decoding-flag assertion
depayloader damage probe removed	a_lost_packet_damages_the_slot_until_the_next_keyframe, a_keyframe_that_lost_a_packet_does_not_repair_the_slot

Rig results quoted in the source PRs (7/18 → 0/18 for #787, 5/8 → 0/8 for #893, the #943 loss table) are from @wagenet's rig on the original branches and were not re-run on this branch.

Unverified: the Safari/VideoToolbox decoder reuse failure (#901) cannot run in CI; the fresh-decoder assertion stands in for it.

Tests

Ran (macOS, GStreamer 1.28, STROM_REQUIRE_GST_PLUGINS=1 for the WHIP tests): cargo test --workspace --no-fail-fast (1106 passed, 0 failed), cargo clippy --all-targets -- -D warnings, cargo fmt --check.

The new integration tests need x264enc, vp8enc, rtph264pay/depay and an H.264 decoder, all in CI's package list, and CI sets STROM_REQUIRE_GST_PLUGINS=1, so a missing element fails instead of skipping.

Not run: Linux, Windows, the WASM clippy. A rig run with real browsers follows on the integration branch.

For the reviewer

• fix(whip): keep a slot's video PTS moving forward frame to frame #893's PR says it reproduced alongside the vision mixer fix fix(vision mixer): keep a source's new shape when it changes size #894, which should land close to this one.
• The thumbnail tap commit is outside WHIP Input. It is one line with the same mechanism; drop it if you would rather have it separately.
• Once this merges, the source PRs can be closed with a pointer here.

Out of scope

• WHIP Input: a reused slot's new session receives frames queued by the previous one #914 (frames queued by the previous session drain into the next) and WHIP Input: a stalled video chain is not restarted when a new session claims the slot #906 (a stalled chain is not restarted on claim) are still open.
• The Media Player bridge still forwards a buffer with no PTS; a small separate fix.

🤖 Generated with Claude Code