7.1 KiB
Moonlight-level reliability acceptance ledger
This ledger distinguishes implemented mechanisms from evidence that the actual Raven-to-Starfire program timeline survives pressure. Passing unit tests is not permission to call the field path done.
Required contracts
| Contract | Current authority | Evidence | Status |
|---|---|---|---|
| Experimental CultMesh/CultNet lineage | Odin vendored CultLib snapshot 8965f3c0 |
Snapshot provenance plus CultNet/Muninn/Sleipnir suites | proved locally |
| Low-delay NVENC | Muninn controllable encoder | D3D11 desktop capture, no B frames/lookahead, two-frame VBV, clean Annex-B decode | proved locally |
| Consumer deadline owns media lifetime | Muninn queues, repair cache, Mimir assembly/reorder | 100 ms default/250 ms Raven profile, bounded queues/cache/reliable expiry, late-frame repair refusal | proved structurally |
| Recoverable video loss avoids decoder reset | Mimir V4 block FEC/repair, Odin repair cache | Exhaustive 2..80 chunk, burst 1..8 tests in Rust/C++; completed-frame tombstones | proved locally |
| Decoder-chain loss forces immediate IDR | Muninn feedback owner and native encoder | Live 2560x1440 command produced IDR at frame 22 under a 600-frame GOP | proved locally |
| Congestion changes encoder output in-session | Muninn AIMD controller and native encoder | Half-ceiling start and protected cap; live 12-to-6 Mbps reconfiguration produced clean IDR | proved locally |
| Audio survives small erasure bursts | Odin 4+2 GF(256), Mimir FEC/reorder/concealment | Exhaustive one/two-erasure Rust and C++ tests; production DLL build | proved locally |
| Latest input state supersedes stale state | Muninn epoch/state sequence, Sleipnir cursor | Duplicate/reorder/stale epoch tests | proved locally |
| Button edges are not lost or retained forever | Muninn replay/app ACK/epoch rebase, Sleipnir ordered cursor | Quick-tap, ACK, overflow rebase, sparse-gap tests | proved locally |
| Raven runtime is LAN-only and non-interrupting | Hidden Raven scheduled task, direct LAN SSH/media | One coherent Muninn/WASAPI/NVENC/FFmpeg tree; no WireGuard route; -WindowStyle Hidden |
proved operationally |
| Real field path survives impairment and soak | Raven sender, Starfire receiver/OBS, cultnet-impair |
Direct LAN clean run 05:34:17–05:44:37: 79,200 records, 697,450,085 bytes, 18,588 recovered shards, zero decode/assembly/media/audio failures and zero sender capacity eviction; proxy matrix and long soak remain | direct clean passed |
Field acceptance matrix
Run the real capture body, production receiver plugin, decoder, audio output,
and Sleipnir virtual input through the seeded profiles under
E:\Projects\Odin\tests\realtime-impairment. Observe the rendered/audio/input
timeline, not only proxy CSV counters.
| Profile | Required result |
|---|---|
| clean, 10 minutes | no decoder reset, audio discontinuity, input edge loss, queue growth, or timestamp drift; video p99 delivery under 50 ms |
| iid 1%, 10 minutes | no input edge loss; audio FEC recovers eligible holes; at least 99.9% video frames presented; media p99 under 80 ms |
| iid 3%, 5 minutes | bounded degradation; at least 99% video frames presented; decoder recovery within 250 ms; no stuck controls |
| burst 4 and burst 8 | parity/repair handles eligible damage; unrecoverable dependency loss produces one requested IDR and recovery within 250 ms |
| reorder and duplicate | no duplicate input action, stale state regression, or unbounded assembly/reorder storage |
| delay/jitter | AIMD reduces bitrate before sustained deadline loss and recovers no faster than one step per two stable seconds |
| stall 250 ms | obsolete media expires; queues remain bounded; input latest state converges within 35 ms after release |
| reconnect | old input epoch cannot act; neutral/current state within 100 ms; decoded video within 500 ms |
| mixed 60-minute soak | stable memory/handle/thread counts and no progressive A/V drift |
The first seeded 1% proxy run is a failed acceptance result, not a pass: 987 of 95,741 datagrams were dropped; in roughly one minute the receiver recorded 38 expired video assemblies and 56 skipped audio packets while remaining bounded and avoiding decoder reset. CultNet fragmentation currently sits below application-level FEC, so one lost transport fragment discards an entire FEC shard. The next reliability cut is to make protected media shards fit one wire datagram or move fragmentation above the erasure-code boundary.
Field scars
- A fragmented CultNet RUDP session failed repeatably after roughly eight to
nine minutes because the
u16fragment-set ID used saturating increment and became permanently stuck at 65,535. Every later fragmented audio document then collided in one receiver reassembly key. The allocator now wraps from 65,535 to 1, with a boundary test. The clean field run above crossed that boundary without a single audio reorder, skip, stale packet, or failure. - Audio and video producer ingress now use separate bounded channels. Video capture can no longer block audio ingestion before the audio-priority send scheduler sees it. Capacity-eviction counters proved zero during the clean acceptance run.
2026-07-17 bounded-media field cut
The live path now keeps every protected shard in one datagram, sends AAC ADTS
in fixed 864-byte 4+2 audio blocks, uses 768-byte video shards with 8+4 block
FEC, and begins each decoder epoch at a complete IDR. The sender admits video
to its repair cache when the frame enters the queue, accepts the production
CultNet realtime channel, and can service bounded repair requests at
64/96/128 ms in batches of up to eight chunks.
Seeded Raven-to-Starfire evidence:
- iid 1%: 802 of 78,406 datagrams dropped; zero decode drop, video expiry, audio failure, or audio skip; 1,800 video frames recovered;
- burst-4: 1,436 of 71,910 datagrams dropped; zero expiry or audio skip across 1,800 forwarded frames;
- reorder: 2,872 reorder events; zero expiry or audio skip across 900 frames;
- iid 3%: 2,564 of 85,731 datagrams dropped; three of 5,400 frames expired, zero audio skip (99.94 percent video delivery);
- burst-8: 190 chunks repaired; one of 1,800 frames expired, zero audio skip;
- 250 ms stall: 420 datagrams withheld, one frame expired, 68 chunks repaired, an IDR was requested, and another 900 frames arrived without a stuck decoder or audio skip.
Delay/jitter produced one expiry in 900 frames. Duplicate, reconnect, longer iid runs, and the 60-minute mixed soak remain open acceptance rows.
Field scar: production video uses the realtime channel, but the repair cache
previously admitted only legacy media payloads. Synthetic tests built the
legacy shape and certified a repair path that was empty in production. The
production-channel regression test now owns this boundary.
Completion rule
Moonlight-level performance is reasonably expected only after all local rows remain green and the real field matrix passes twice: once on direct LAN and once on the deployed route actually used during streaming. Failure should change the owning deadline, FEC, encoder, or input authority—not add a repair loop around the symptom.