@urun-sh/core 0.2.47 → 0.2.48

package/CHANGELOG.md

@@ -1,5 +1,50 @@
 # Changelog
 
+## Unreleased
+
+- **Wall-clock media liveness is gone.** Streams are not guaranteed to be
+  continuous, so "seconds since the last inbound byte / decoded frame" was never
+  a valid death signal. Two rules keyed on it, and both are removed:
+  - the inbound-stall rule (`media-stall` + its `media-idle` companion). It also
+    emitted a `console.warn` **on every sample interval** — "[urun] no inbound
+    media for 6s, but the ICE path is connected — the sender is idle, not dead;
+    holding the transport" — at a perfectly healthy path (live receipt:
+    inboundTotal 1985272, packetsReceived 1744, packetsLost 0). The bursty gop=1
+    image-as-video lane, where one frame per completed render means silence is
+    NORMAL, logged that line forever. Both the diagnostic and the recovery are
+    deleted; a quiet stream is now completely silent and completely untouched.
+  - the mid-session decode-gap rule. `decode-wall` no longer means "framesDecoded
+    stopped advancing"; it now means **the decoder never produced its FIRST frame**
+    within `stallTimeoutMs` of first byte arrival — the actual failure it was
+    written for (a mid-stream join with no keyframe: healthy RTP, `framesDecoded`
+    stuck at 0, black video). That check is a BOUNDED one-shot join probe anchored
+    to first byte arrival; once a frame decodes, the probe disarms permanently and
+    nothing polls the stream again.
+- **Recovery keys only on the transport's own signals**, per the library-native
+  mechanism rule: `connectionstatechange` → `restartIce()` in place → and, once
+  the in-place restart budget is spent (or the restart watchdog expires with the
+  path still down), the same resolve-then-dial `_renegotiate()` that re-resolves a
+  rebound SFU backend. That escalation is NEW and replaces the flat-counter path,
+  so the SFU-GameServer-recycle protection is preserved without a clock: ICE
+  consent freshness (RFC 7675) re-probes the selected pair every ~5s regardless of
+  media, which is why the ICE agent's verdict — and not a receive counter — is
+  authoritative. A higher control-doc incarnation still renegotiates.
+- **The join probe is PER-CONSUMER.** A session-wide aggregate `framesDecoded`
+  would let one already-decoding (or audio) lane settle the probe on behalf of a
+  NEW video lane that joined with no keyframe — masking exactly the black video
+  the probe exists to catch. Each consumer now carries its own first-byte anchor,
+  its own loss baseline and its own settled latch; the timer runs while any live
+  lane is unsettled, stops when all are, and a later `consume` re-arms only for
+  the lane it announces. `decode-wall` detail now names the failing lane
+  (`consumerId`) and reports THAT lane's counters instead of session-wide sums.
+- `mediaLiveness` keeps its shape (`pollMs`, `stallTimeoutMs`); `stallTimeoutMs`
+  now bounds the first-frame join window. No public API change.
+- The ast-grep conformance guard is retargeted and widened:
+  `no-teardown-on-idle-inbound-counter` → `no-wallclock-media-liveness`, which now
+  fails the build on ANY wall-clock media-gap branch that drives
+  `_renegotiate()`/`_attemptReconnect()` (inbound counter or decode counter),
+  while allowing the bounded first-byte-anchored join probe.
+
 ## 0.2.44
 
 - **A flat inbound RTP counter no longer tears down a healthy media transport.** The