molluskandClaude Opus 4.8
ebfc39de46
CoreController::send put every app->core command on a single bounded depth-100 channel via try_send and discarded the result. iced slider drags emit ~60-120 commands/sec, so a drag burst could transiently saturate the queue exactly when the user hit mute / released PTT / left a room, silently dropping that critical command and leaving the mic hot -- a privacy/state mismatch. Split the queue by drop-tolerance: - A pure delivery_class(&CoreCommand) classifier in messages.rs maps the 7 continuous audio sliders to BestEffort and every other (discrete, human-paced) command to Reliable. The match has no wildcard arm, so a new CoreCommand variant fails to compile until it is classified. - CoreController now holds two senders: an unbounded reliable channel and the existing bounded(100) best-effort channel. send() routes by class; Reliable uses unbounded send (fails only if the core loop is dead), BestEffort keeps today's bounded try_send. - run_core_loop takes both receivers and drains them with a biased select: reliable first, best-effort second, game-change third. Unbounded is safe because the only machine-rate producer (slider drags) stays on the bounded channel; Reliable commands are all human-paced. command_sender() and the awaiting Shutdown path are unchanged. Implemented by Codex (gpt-5.5), senior-reviewed and verified here: 454 lib tests pass, clippy --all-targets clean, release builds. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>