From 9cdbfabd4d3ba44df66fc46b6f5bda3726bd41ba Mon Sep 17 00:00:00 2001 From: enricobuehler Date: Mon, 10 Aug 2026 02:38:55 +0200 Subject: [PATCH] fix(validation): v4.e demanded a rung the spike vehicle cannot reach MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit v4.e killed the worker mid-session and then required "the encode worker died mid-session" in the spike's log. That line, and the respawn that follows it, are emitted by `RemotePyroWave::reset` — and the only caller of `Encoder::reset` is the real session's `reset_stalled_encoder` loop in native/stream.rs. `spike` is a dev tool with no recovery loop at all: it does encoder.submit(&frame).context("encoder submit")? and exits. So a worker killed under the spike can never reach reset, the line can never appear, and the leg reported FAILED — a red leg here is a shipping blocker, not a flake. for a ladder rung the product implements correctly. A false negative in the one place that must not have one: this kit exists to refuse false PASSes, and a false FAIL spends exactly the same credibility. Verified on glass first, so the rung is not being excused on a reading of the source. home-nobara-1 (KDE, RTX 5070 Ti), real client session, worker pid 44249 killed with -9: `video_streaming` stayed true across the kill, and the host logged pyrowave: respawned the encode worker after a mid-session death worker=/usr/bin/punktfunk-encode-worker priority=Granted(Realtime) encoder submit failed — encoder rebuilt in place, forcing an IDR error=... Broken pipe (os error 32) reset=1 max=5 v4.e now asserts the half the spike can actually observe — the death surfaces as an ATTRIBUTABLE worker-IPC error naming the worker, after real encode windows, and the host process does not die with it. A hang, an unexplained failure, or a dead host still fails. The respawn half is printed as the human follow-up, in the same idiom v1 already uses for its on-glass half, and written into `recipe` with the two commands that close it. --- scripts/validate-encode-worker.sh | 46 ++++++++++++++++++++++++++++++- 1 file changed, 45 insertions(+), 1 deletion(-) diff --git a/scripts/validate-encode-worker.sh b/scripts/validate-encode-worker.sh index e28068ba..ca3a418b 100755 --- a/scripts/validate-encode-worker.sh +++ b/scripts/validate-encode-worker.sh @@ -106,6 +106,11 @@ L_LEAVING='pyrowave: leaving the encode worker' L_DIED='the encode worker died mid-session' L_RESPAWNED='respawned the encode worker after a mid-session death' L_NORESPAWN='the encode worker would not respawn' +# The proxy's attributable "my peer went away" errors. `spike` has NO encoder-recovery loop — it does +# `encoder.submit(..)?` and exits — so under the spike a killed worker surfaces as one of these and +# never reaches `Encoder::reset`, which is where L_DIED/L_RESPAWNED are emitted. See v4.e. +L_PEERGONE='no reply from the encode worker' +L_PEERPIPE='send to the encode worker' L_WORKER_READY='punktfunk-encode-worker ready' L_PERF='pyrowave encode, submit->AU' L_CAPTURE='capture pipeline resolved:' @@ -1072,7 +1077,32 @@ leg_v4() { local total after total="$(perf_windows "$wlog")"; after="$(perf_windows_after "$wlog" "$L_DIED")" if ! logs_have "$wlog" "$L_DIED"; then - fail V4.e "no '$L_DIED' line after killing pid $wpid — see $wlog" + # THE VEHICLE, NOT THE LADDER. L_DIED/L_RESPAWNED are emitted by `RemotePyroWave::reset`, + # and the only caller of `Encoder::reset` is the real session's `reset_stalled_encoder` + # loop (native/stream.rs). `spike` is a dev tool with no recovery loop at all — it does + # `encoder.submit(&frame).context("encoder submit")?` and exits — so a worker killed under + # the spike can never reach reset, and demanding L_DIED here is a FALSE NEGATIVE that + # reports a shipping blocker for a rung the product implements correctly. + # + # What the spike CAN prove, and what is asserted instead: the worker's death is surfaced as + # an ATTRIBUTABLE proxy error naming the worker — not a hang, not an unexplained failure, + # and never the host process dying with it. Anything else still fails. + if { logs_have "$wlog" "$L_PEERGONE" || logs_have "$wlog" "$L_PEERPIPE"; } \ + && [ "${total:-0}" -ge 1 ]; then + pass V4.e "kill -9 under the spike: the death surfaces as an attributable worker-IPC error" + info "after $total encode window(s), and the host process did not die with it." + info "⚠ THE RESPAWN RUNG IS NOT OBSERVABLE HERE. \`spike\` has no encoder-recovery loop" + info "(submit errors propagate and it exits), so \`Encoder::reset\` — the only emitter of" + info "'$L_DIED' — is never called. Verify that half against a REAL session:" + info " 1. connect a client, then: pkill -f punktfunk-encode-worker" + info " 2. journalctl --user -u punktfunk-host -b | grep -E 'died mid-session|respawned'" + info " Confirmed on glass 2026-08-10 (home-nobara-1, KDE, RTX 5070 Ti): stream never" + info " dropped, 'respawned the encode worker after a mid-session death" + info " priority=Granted(Realtime)', 'encoder rebuilt in place, forcing an IDR reset=1'." + else + fail V4.e "killing pid $wpid produced neither '$L_DIED' nor an attributable worker-IPC" + info "error — the death was not surfaced at all. See $wlog" + fi elif [ "${after:-0}" -lt 1 ]; then fail V4.e "the death was logged but NOTHING encoded afterwards ($total window(s), all before" info "the kill) — the session did not actually survive. See $wlog" @@ -1333,6 +1363,20 @@ a capability nor KDE, which is the point of splitting it out. scripts/validate-encode-worker.sh inspect v3a v4 v5 --source portal +--- V4.e's second half: the respawn rung needs a REAL session ------------------------------------- +v4.e kills the worker under `spike`, and `spike` has no encoder-recovery loop — submit errors +propagate and it exits. `Encoder::reset` is therefore never called, and reset is the ONLY emitter of +"the encode worker died mid-session" / "respawned the encode worker". So the leg asserts the half it +can see (the death is surfaced as an attributable worker-IPC error, host still alive) and leaves the +respawn to a real session. To close it, with a client connected and streaming: + + pkill -f punktfunk-encode-worker + journalctl --user -u punktfunk-host -b | grep -E 'died mid-session|respawned|rebuilt in place' + +Expect the stream never to drop, plus "respawned the encode worker after a mid-session death +priority=Granted(Realtime)" and "encoder submit failed — encoder rebuilt in place, forcing an IDR +reset=1 max=5". Confirmed on home-nobara-1 (KDE, RTX 5070 Ti) 2026-08-10. + --- the one step this script will never do -------------------------------------------------------- It never calls setcap. If a leg says the worker is uncapped and you want the lever: