From 3d1f114fd81e1b780df696a016ea6df51f10276f Mon Sep 17 00:00:00 2001 From: Mollusk Date: Fri, 21 Aug 2026 16:13:41 -0400 Subject: [PATCH] docs: record owned fanout checkpoint --- docs/screenshare-audio-exclusion-impl-plan.md | 38 +++++++++++++------ docs/screenshare-audio-exclusion-plan.md | 23 ++++++----- 2 files changed, 40 insertions(+), 21 deletions(-) diff --git a/docs/screenshare-audio-exclusion-impl-plan.md b/docs/screenshare-audio-exclusion-impl-plan.md index 784748e..ca656b5 100644 --- a/docs/screenshare-audio-exclusion-impl-plan.md +++ b/docs/screenshare-audio-exclusion-impl-plan.md @@ -9,9 +9,11 @@ sliced S1–S5: S1 and S2 are merged; **S3a is merged locally** in pixelpass (`15d1374`); and **S3b is built, validated, and committed locally** (`5d3da8b`). **S4, S5, 0d, round 11's bridge changes, and Phase 6's first pure channel-planning prerequisite are built, validated, and committed locally in pixelpass -(`781defc`).** The Phase 6 mutation and phases 7–9 are not built — nothing released to date -changes the feature's user-visible behaviour. **Phase 6 is now the current front**; its live -fan-out remains the first audio-exclusion graph mutation. +(`781defc`).** The first bounded Phase 6 mutation slice is now built, validated and committed +locally in PixelPass (`98cde2c`): the hidden production path creates, retains, revokes and +crash-cleans exact-channel non-lingering fan-out links. Phase 6's status events and +sink-replacement recovery, plus phases 7–9, are not built — nothing released to date changes +the feature's user-visible behaviour. **Phase 6 remains the current front.** **Date:** 2026-07-21 (v4); status line refreshed 2026-08-21 **Design of record:** [`screenshare-audio-exclusion-plan.md`](screenshare-audio-exclusion-plan.md) v3.8, round 11. **Scope:** *ordering, gates and acceptance criteria only.* @@ -669,15 +671,27 @@ retained for the life of the share, per-port link sets, "captured" only when **e link is `ACTIVE`, same-epoch revalidation immediately before each creation, proxy drop on ancestry becoming unsafe. -> **Status 2026-08-21 — Phase 6 started, mutation not yet enabled.** The first bounded slice -> found and closed a prerequisite the old model did not carry: Port snapshots now retain -> `audio.channel`, and a pure planner produces exact link specs by channel rather than global-id -> or enumeration order. Five matrix tests pin FL/FR mapping, MONO fan-out, unknown/surround -> refusal, excluded-candidate refusal, and capture-sink replacement. Full non-GUI PixelPass: -> 318 passed, 0 failed, 9 ignored; the serialized live observer boundary test and strict Clippy -> pass. The next slice is the same-observer-callback mutation edge that creates and retains the -> planned non-lingering proxies; no fan-out link is created by the current checkpoint, committed -> locally in pixelpass `781defc`. +> **Status 2026-08-21 — first Phase 6 mutation slice built, validated and committed locally.** The +> hidden `DesktopExcluding` production path now launches a same-observer-callback link manager. +> It revalidates every recyclable id against its `object.serial` immediately before mutation, +> creates exact FL/FR (or MONO fan-out) links through `link-factory`, retains the proxies, marks a +> stream captured only when every required link is `ACTIVE`, and drops owned links before the +> capture sink on normal teardown. The links explicitly set `object.linger=false`. +> +> Twelve deterministic controller tests cover channel planning, recycled ids, idempotence, +> partial activation, late arrivals, newly unsafe ancestry, AEC gating/revocation and mutation +> failure. The full non-GUI suite passes with 326 passed, 0 failed and 10 ignored, and strict +> all-target Clippy is clean. The real hidden host path was also tested with a late stereo +> stream: exactly two native links became `ACTIVE`, no Pulse `module-loopback` fed the capture +> sink, and both links were revoked when the stream ended. A separate subprocess gate sent +> PixelPass `SIGKILL`; the connection-owned capture sink and both link object serials disappeared +> without Rust destructors. The three serialized live observer tests and `pixelpass --doctor` +> pass. +> +> This does **not** complete Phase 6. Versioned causal status events and actual capture-sink +> replacement/relink recovery remain, along with the unclosed failure-matrix rows. The public +> mode selector remains Phase 7 and PeerSpeak integration remains Phase 8. The last committed +> PixelPass base is `781defc`; this mutation slice is local commit `98cde2c` and remains unpushed. Failure ⇒ report the stream unsupported. **Never** fall back to the default monitor — and after 0d that fallback is unconstructible in this mode, by either path. diff --git a/docs/screenshare-audio-exclusion-plan.md b/docs/screenshare-audio-exclusion-plan.md index 34b8c34..7b8713a 100644 --- a/docs/screenshare-audio-exclusion-plan.md +++ b/docs/screenshare-audio-exclusion-plan.md @@ -4,8 +4,8 @@ models an unobservable playback-to-capture route as a conservative same-`device.id` hardware edge (§6.9), and the 2 s readiness budget is retained after repeated baseline, inflated-graph, and live-churn calibration. The targeted live dry-run partition passed. The first pure Phase 6 -channel-planning prerequisite is committed locally in PixelPass `781defc`; the live fan-out -remains the first graph mutation. +channel-planning prerequisite is committed locally in PixelPass `781defc`; the first bounded +live fan-out mutation slice is built, validated and committed locally in PixelPass `98cde2c`. **Date:** 2026-08-21 (v1: 07-19 · v2: 07-20 · Option C 07-20 · v3.1 r4 · v3.2 r5 · v3.3 r6 · v3.4 r7 · v3.5 r8 · v3.6 r9 · v3.7 r10 · v3.8 r11 2026-08-21) **Origin:** Joe's suggestion — "whitelist all audio except audio coming from peerspeak." @@ -1283,7 +1283,8 @@ paths, 13 a real `Audio/Duplex` device) and the third-party samples stay owed. **Round-11 supersession (2026-08-21):** the row above is the round-10 snapshot, not current status. F11-1 and phases 0b/0c/0d are satisfied, and §6.9 closes the hardware-path decision plus readiness calibration. S4/S5/0d, round 11, and Phase 6's first pure channel planner are -committed locally in PixelPass `781defc`; the first live fan-out mutation remains pending. +committed locally in PixelPass `781defc`; the first live fan-out mutation is committed locally +in `98cde2c`. **Round 9 (2026-07-25).** Phase 3r shipped §6.7 and the audit was re-run immediately; it found a *second* measured defect within minutes — a permanent sticky taint @@ -1375,15 +1376,19 @@ no-coalescing contract. Phases 0a–5 and 3r are built; the full phase-5 matrix passed; 0b is merged; and 0c/0d plus the S4/S5 ownership work are built, validated, and committed locally. Round 11 closes the last two pre-Phase-6 design decisions with pure, observer, live PipeWire and targeted dry-run -evidence. Phase 6's channel-aware pure planner is also committed in PixelPass `781defc`. +evidence. Phase 6's channel-aware pure planner is also committed in PixelPass `781defc`. On top +of that checkpoint, local commit `98cde2c` creates and retains serial-guarded +non-lingering links through the hidden production path, requires all planned links to be +`ACTIVE`, revokes them when eligibility changes, and passed both normal-teardown and `SIGKILL` +cleanup gates. -1. **Continue Phase 6:** implement the owned, non-lingering fan-out link manager and causal - status events through the real host path. This is still the first exclusion-related graph - mutation. +1. **Continue Phase 6:** add the four versioned causal status events, complete the remaining + failure-matrix rows, and implement actual capture-sink replacement/relink recovery through + the real host path. 2. Carry the revised row-9 partition forward: music-only and a different-device microphone stay eligible; same-device capture and a tainted-monitor capture are excluded. -3. Build the next bounded mutation slice from PixelPass checkpoint `781defc`, preserving its - ownership, fail-closed, and exact-channel planning gates. +3. Preserve the new live mutation slice's ownership, serial-revalidation, fail-closed, + exact-channel, all-links-active and crash-cleanup gates while finishing the phase. Still owed beyond that, unchanged: the §9.2 rig upgrade before any exclusion claim is published, and **field-test §12** — nothing in this design has been tested over the real