Skip to content

Command contract is not authoritative: production sync emits dispatcher no-ops; unknown batch members are dropped #616

Closed

Description

@iamfatness

Problem

The production command contract is not a single authoritative list. The WinUI production-sync path emits commands the C++ dispatcher does not handle. Unknown commands inside a batch are silently ignored. The parity gate is one-way substring matching against a non-shipping TypeScript mirror, so a live no-op can stay green.

This is not #530. #530 is the Control API advertising programPreview while the implementation spelling is program-preview. Same class of silent control-plane lie, different defect.

Evidence

Static review at 6f4f025687f02e14ce33fa012200afaf7396a536 (2026-09-24).

  • MediaCoreCommandBuilder.cs ~20–38, 326–370 — production sync command construction
  • native/src/core/MediaCore.cpp ~1447–1552 — dispatcher
  • ContractParityTest.cpp ~111–120 — one-way substring match vs TypeScript mirror
  • Protocol.h ~44–70 — handwritten command surface

Every production sync currently emits three commands the dispatcher does not handle.

Done when

  • One executable command manifest is derived from the live C++ dispatcher, not from the C# builder and not from the React/Node mirror.
  • The shell builder is checked against that manifest at compile or test time.
  • An unknown command in a batch is a structured protocol failure, not a silent skip.
  • The three current no-ops are implemented or deleted from the builder in the same change.
  • ContractParityTest compares production command names. Substring matching a non-shipping TypeScript mirror is not the gate.

Related, not duplicate

Activity

  1. added
    bugSomething isn't working
    backlogRanked in docs/BACKLOG.md
    on Sep 24, 2026
  2. added a commit that references this issue on Sep 24, 2026
  3. iamfatness commented on Sep 24, 2026

    @iamfatness
    OwnerAuthor

    Prioritization play (recommendation only — owner ranks)

    Review commit: 6f4f025 (2026-09-24). Rules: AGENTS.md §3 — agents do not promote to Now.

    Do not jump Now

    #535 remaining adapter lifecycle stays Now. #538 stays Next. Architecture that does not save tonight's show does not replace those rows.

    If you promote anything from this cluster

    Promote as a single Next slice after #535, before or beside #538, not as a fourth Now item:

    1. Command contract is not authoritative: production sync emits dispatcher no-ops; unknown batch members are dropped #616 command manifest + reject unknown batch members (unblocks every later contract field).
    2. Ride Program shared-texture events ride the throttled preview queue; dedicated drain is empty #619 (Program texture queue) and High-priority stdout response queue is unbounded; a wedged shell can stall the writer #620 (bound the response lane) in that same PR. They are small and on the same wire.
    3. Capability handshake advertises compile flags, not the constructed runtime #617 capabilities from constructed adapters — required before Core edge I/O: receive and send SRT, NDI, RTMP, HLS as adapters #538/SRT ingest decoder: packets must become VideoFrame pixels + PCM on the source bus #536 admission, and before DeckLink/AJA: live frames on the source bus (not probe-only) #537 can ever be advertised.
    4. CI Windows job compiles the stub core; production D3D11/MF/WASAPI adapters can merge unbuilt #618 Windows production native compile lane — required before anyone can trust a merge that touches D3D11/MF/WASAPI. Compile-only; no soak gate on the runner.
    5. Single-slot sync plus UI-thread snapshot apply can drop a fire-and-forget command #622 single-slot sync — after the wire is honest, before more fire-and-forget commands land.
    6. Three snapshot truths: typed operator snapshot, redacted qualification JSON, and ControlState drift independently #621 one observation model — after Command contract is not authoritative: production sync emits dispatcher no-ops; unknown batch members are dropped #616, so Stream backpressure: no operator-facing degraded-stream readout #610 / RTMP sender bytesSent and latencyMs are fake (estimated/hard-coded) and mislead diagnosis #519 / ISO writer framesWritten/bytesWritten read 0 mid-recording for async independent writers (status-only) #551 stop growing a fourth projection.

    Leave parked from this review

    MediaCore/StudioViewModel extraction (#540 only), Program/Preview/Multiview thread split, atomic native Take, NDI out-of-process, retiring React/native-core from CI, enabling DeckLink/AJA.

    Live-show items that still beat this cluster

    #615 (RTMP vs PC-wide connectivity), #608 (audio dropout when others leave), #597 acceptance, #601 (encoder ignores bitrate), #604 (stopFfmpegProcess never kills the child). Those are tonight's show. This cluster is whether we can tell the truth about the show.

  4. iamfatness commented on Sep 26, 2026

    @iamfatness
    OwnerAuthor

    Completed by merged #631 and #639. The live dispatcher rejects unknown commands through its final branch, parity checks the full executable branch set against the native contract and production C# builder, Program texture events use the Program drain, and the response lane is bounded. The final #639 CI run passed across the native, macOS, Windows shell, and analysis jobs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    backlogRanked in docs/BACKLOG.mdbugSomething isn't working

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions