gramps
72cb3ad55a
A dead encoder used to run the whole stop path, so a one-second blip ended the broadcast. Now a dropped push is relaunched against the same ingest while the broadcast is still alive. - `Services/StreamRetryPolicy.cs` — immediate, +1 s, +2 s, +3 s. Minimum waits on purpose (creator ruling): YouTube's grace is short, so every second not pushing is grace spent. - `Services/StreamRecovery.cs` — the loop, with the audio pipe recreated before every attempt (its server is single-instance and unusable after the old client dies, so a naive relaunch fails on a missing input). After a push comes up it asks the API whether the broadcast survived: "complete" ends recovery as `BroadcastComplete` instead of showing a live sign over a dead stream; an API hiccup counts as recovered rather than ending a healthy session. - `FramePump.EncoderFailed` — a dead push is recoverable; a compositor fault still goes through `Failed` and ends the session, because retrying it would loop. - `MainViewModel.Recovery.cs` — wires the steps, reports each episode into the left panel alert stack (one row per episode, updated in place, log range painted), and cancels on Stop. - Alert stack polish: a rule and a gap now separate the stack from the scene layers (they read as one list before), and the licence indicator uses the creator's wording — `STEAM ID NOT PRESENT` / `Steam ID Limit: 30fps` / `Click for More Info`, becoming `STEAM ID PRESENT` / `60fps` with a close control once owned. Tests: `StreamRecoveryTests` (schedule, recover on attempt 2 with the pipe restarted each time, complete-broadcast honesty, unknown liveness, give-up, cancel, audio-restart fault), `FramePumpTests` now pin that process death raises `EncoderFailed` and not `Failed`. FAST gate: 538 passed (one documented pre-existing audio failure), 0 warnings.
4.1 KiB
4.1 KiB
TASK 32 — Stream resilience (queued 2026-09-01 — merges the orphaned TASK 2 resume clause into the pills/signs architecture)
Catalog:
TASKS.md— status and requirements live here.
Goal: a dropped stream heals itself when physically possible, tells the truth when it isn't, and gets the creator back on air in one click. The ON-AIR sign + primary button in the top bar are the surface — they already mean "reality" (pills = intent, lights = reality, TASK 18/30); reality just isn't two-state. Resumption of a completed broadcast is explicitly out of scope (impossible via the API — creator ruling 2026-09-01): no lying in the copy.
Slices (one integration test each, in order):
- ✅ Blip retry (shipped 2026-11-05) — app-side encoder restart: push dies while live (ProcessFailed / stdin
backpressure death) → bounded-backoff relaunch (2s/5s/10s, N attempts) against the cached
constant reusable-stream ingest URL. Success = push running again while the broadcast is still
live; viewers never know. Fixes the map's stale "ffmpeg does reconnect" claim (corrected
2026-09-01: reconnect flags are input-side only). Test: fake process fails once then starts →
pump recovers without surfacing to the VM.
Shipped:
Services/StreamRetryPolicy.cs(immediate, +1 s, +2 s, +3 s — minimum waits, because YouTube's grace is short),Services/StreamRecovery.cs(the loop, with the audio pipe recreated per attempt because its single-instance server is unusable after the old client died), andFramePump.EncoderFailedseparating a dead push (recoverable) from a fatal pump fault. Each episode reports into the left panel's alert stack; a reconnect that lands on a complete broadcast is reported as such instead of showing a live sign over a dead stream. Tests:StreamRecoveryTests. - ☐ Measured grace + the sign — while the push is dead, escalate the existing health poll
(30s → ~5s). ON-AIR dot goes amber "RECONNECTING" with a mm:ss countdown to the observed
YouTube cutoff; the grace length is a measured, pinned constant — probe it on a real private
test stream, cite the observation (spin-guard rule; do NOT invent a number). Poll reports the
broadcast
complete→ dot red "OFF AIR", primary button relabels "● Back on air" and pulses. Test: fake status provider drives the dot through live → reconnecting → cut-off. - ☐ One-click Back on air — the relabeled button fires the existing go-live path with saved
Broadcast.*+ cached stream, dialog skipped: new broadcast, new VOD (accepted cost, stated in-product). Test: seeded saved form + fake stream service → click creates + pushes, no dialog. - ✅ Crash-safe recording (shipped 2026-11-05) — fragmented MP4 on the record block (
-movflags frag_keyframe+empty_moov+default_base_moof): plain MP4's trailing moov atom means a power loss kills the WHOLE file. Rename-on-stop unchanged. Closes the TASK 18 "MKV as an option" design-note remnant (fragmented MP4 chosen over MKV: single container, YouTube-upload-native — verify player/ editor tolerance, cite the research). Test:Args_RecordBlock_IsFragmentedMp4_SoACrashKeepsTheFile— the flags are on the record block and absent from the streaming block. Verified by construction only: the file still needs one real interrupted-take check on Windows (kill ffmpeg mid-recording, play the result). - ☐ Pre-flight — before broadcast insert, one TCP probe to the ingest host:1935 (~2s timeout). Unreachable → Error toast, no insert, no ghost broadcast ("check VPN/network"). The "forgot the VPN" story, solved as prevention instead of recovery. Test: fake probe failure aborts go-live before any API call.
Design decisions
- The sign is the status, the button is the action — no new chrome, no log lines, no spinners.
- Honest windows: countdown = observed grace; at zero we say OFF AIR, we don't pretend to reconnect.
- Why us > incumbents: constant reusable stream + persisted form make retry/restart cheap; OBS shows a reconnecting log line and Streamlabs silently dies.