test(archive): prove recording, replay, and retention end to end

[kixelated]

Problem

The archive line landed a writer, reader, recovery, and HLS export, each with unit tests, but nothing proved one broadcast end to end: that stored bytes are deterministic, that FETCH replays exactly, that playback reads only the requested rendition, and that the persistence and retention boundaries hold. Proving it turned up two defects:

• Stored timeline objects carried the writer's wall clock (moq_json::window stamps live frames with Timestamp::now()), so the same content recorded twice produced different bytes.
• After merging main (fix(net): hold a parked track's warm cache until the upstream confirms it #4104 changes idle-track lifetimes), the reader re-GETs .info whenever a track is requested again, which broke playlists_read_only_the_timeline_and_segments_one_object on this line.

Approach

• rs/moq-archive/src/proof.rs: records five enrolled tracks (two video renditions, audio with four groups per segment, catalog.json, a sparse non-media track), then checks:
  • the exact key layout, with no manifest or completion marker;
  • byte-identical objects on memory, local disk, and an unordered listing, next to a rec-other sibling;
  • exact FETCH replay of every group;
  • that 360p and audio-only playback GET only their own objects, with adjacent audio groups served from the LRU;
  • that an offline reader follows DVR expiry with one timeline-scoped listing after its cursor.
• rs/moq-archive/src/mock.rs: one shared test store (op log, injected PUT/GET/list failures, unordered listing, S3 ListObjectsV2-style pagination). It replaces the three copies in store, writer, and reader tests.
• Gap tests beside the owning code:
  • keys and tables: largest QUIC varint in keys and deltas, direct Key construction, empty prefix, frame offsets that don't tile the payload;
  • store: ordered groups_from lookup at endpoints and between ranges, malformed or unsupported existing .info that is refused and kept;
  • writer: out-of-order group completion, a DVR crash between pop and delete, an archive restart that leaves an uncommitted upload unadvertised;
  • reader: a missing tail retried on the next refresh, a track with a missing or unsupported .info, following that lists only new timeline keys, an unordered listing.
• Writer: stamp each stored timeline frame with the record's pts. The reader and HLS fixtures already assumed this.
• Reader: cache each track's parsed .info (immutable) after its first load.
• HLS: archive playlists now render against a store that fails every media GET, and segment requests are pinned to issue no listing.
• Merges origin/main into the line, so the diff against the line includes main's commits.

Local checks: just check passes lint and docs but fails to compile moq-ffi tests (ambiguous IntoRendition, #4137 vs #4089, already broken on main). cargo nextest with clippy passes for moq-archive, moq-hls, moq-mux, moq-cli, and quest.

Impact

• Public API: none.
• Wire/format: none. Stored timeline frame timestamps change from wall clock to content time. The draft does not specify them, and the reader only republishes them.
• Tests run inline in the existing moq-archive and moq-hls nextest suites (CI check).

Alternatives

• S3 coverage: the repo has no in-process S3 server, so S3 listing semantics are emulated in Mock. Running the proof through object_store's S3 client is a follow-up quest.
• The quest asked a restarted DVR to finish cleanup before accepting new groups. The draft (Recording, retention) requires only recovery and listing before accepting, with deletion one grace period later. Per-track floors keep new objects above every stored key, so they cannot collide with pending deletions. The test pins this: expired objects survive until the grace elapses while recording resumes.

Follow-ups

• DVR timeline pruning: a DVR never deletes segments/ objects, so they grow without bound.
• Archive S3 wire proof: run the proof through the S3 client against an in-process server.
• moq-cli's an_opening_snapshot_records_every_rendition flaked once under load with "writer closed". The test treats .info as proof of enrollment, but .info is stored before the enroll command reaches the run loop, so ending the broadcast right then refuses the enrollment.
• The segmenter lets a pacing track that is still open cut the final segment once the others close (the proof adds a one-frame tail to stay deterministic). Worth a look in moq-mux if an audio-only tail segment matters for HLS.

(Written by Claude Opus 5.5)

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-09-25T22:49:58.079282Z	975f97b	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 84a0467088

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Add handwritten binding surfaces for binary tracks

The new UniFFI binary publisher methods are exposed only through Rust and the generated dart/moq_ffi layer. A repo-wide search finds no corresponding API in py/moq-rs, go/wrapper/moq, swift/Sources, kt/moq, or the high-level dart/moq package, so consumers of those supported bindings cannot use this feature. Add the ergonomic wrappers, tests, and binding docs alongside these exports.

AGENTS.md reference: AGENTS.md:L94-L96

Useful? React with 👍 / 👎.

[kixelated]

Not part of this change after the rebase onto quest/m1/archive/README. The binary publisher methods came in with the main merge, and that merge is already on the base, so this diff no longer touches rs/moq-ffi. Handwritten wrappers for that existing API belong on their own PR, not in the archive proof.

(Written by Grok 4.7)

[chatgpt-codex-connector]

Wait for an observed writer state before publishing sparse groups

On a slow or busy executor, 256 scheduler yields do not guarantee that the writer has processed every pacing group. If this helper returns early, the following sparse groups can be assigned to the wrong open segment, making the end-to-end proof flaky and invalidating its expected object layout. Synchronize on an observable writer or store state instead of using a fixed amount of scheduler progress.

AGENTS.md reference: AGENTS.md:L15-L18

Useful? React with 👍 / 👎.

[kixelated]

Leaving the yield loop. Sparse groups have to join the segment that is still open, after the writer has accepted that segment's pacing groups and before it closes. A store or timeline object only appears once the segment has already committed, so waiting on that would put the sparse groups in the next segment and break the layout this proof pins. The writer has no "group accepted" signal without a new API, and a wrong assignment fails the exact key assertion instead of passing. Not adding that observation point while landing.

(Written by Grok 4.7)

[kixelated]

Rebased onto quest/m1/archive/README (2ae46078d) and force-pushed. The squash is the archive proof, not another copy of main.

Landing: an end-to-end recording of five tracks, byte-identical on memory, disk, and an unordered listing; exact FETCH replay; playback that GETs only the requested rendition; DVR expiry followed by an offline reader. Stored timeline frames use content time. The reader keeps each track's .info. HLS playlists render with media GETs refused, and a segment request does not list. Follow-ups are DVR timeline pruning and an S3 wire proof. Diff is 15 files, +1290/-358.

The rebase dropped the merge of origin/main (lite-07-wip #4148, the release #4091, and the commits between) and the earlier merge of this quest branch. Those commits are already on the base. #4166 was not replayed.

Conflicts: the repeated HLS segment expects no GET, including .info, and no listing, rather than the base re-reading .info. quest/m1/archive/proof.md is deleted because this proof finishes that quest. #4168 had pointed the same file at per-track timelines; that work stays in the per-track quest.

moq-ffi's ambiguous config.into() is unchanged from the base and not in this diff, so the Config::from annotation from #4171 is not applied here. just check against the quest base passed.

(Written by Grok 4.7)