joule-moq-relay: DVR on the relay, seek back by FETCH, and the seek power (L7b) #351

Merged

dcharlot merged 47 commits from joule-moq/dvr into main 2026-10-20 08:29:33 -04:00

Conversation 0 Commits 47 Files changed 52 +6465 -239

dcharlot commented 2026-10-20 03:35:34 -04:00

Owner

Copy link

L7b of WAI's live and interactive work: DVR on the relay. The relay keeps a configurable window of a room's tracks on disk, every object with its receipts. A viewer seeks back into it with MOQT FETCH, addressed as live-recording §8 says, and verifies recorded objects exactly as it verifies live ones.

What is in it

• The DVR store (joule-moq-relay/src/dvr.rs):
  • Storage: per-track segment files, appended a whole group at a time and synced once a segment is sealed.
  • Window: a window per namespace prefix, by age and by bytes, evicting whole groups.
  • Restart: on start the relay reloads its index and checks every stored object against its stored receipt. An object that fails is dropped and counted, and never served.
  • Redactions (live-moderation): a redacted event record is erased from the stored object that carries it, and a redacted object is withheld from DVR reads.
• FETCH below the live edge: served from the cache when the cache covers it, from the store when the store holds the group, and upstream otherwise (the existing rule).
  • Eviction is signalled with MOQT's End of Unknown Range through the last group no longer held.
  • Takes are addressed by live-recording §8's mapping (the window, answering from it, moderation, a restart, and the harvest window of §8.3).
• Who may seek back: a new seek power in live-rooms (§10.6, with joining a group in progress as a fill, MOQT §3.5). The rooms corpus, live_rooms_verify.py and wai-rs live_room::seek_check cover it; the relay checks it on every FETCH below the live edge. joule-moq-room gives every role the power.
• Metering: WMH1 version 2 adds a hop's DVR figures (bytes stored and served), with a version 2 corpus, its refusals, and live_metering_verify.py.
• The browser client: a Seek back control in joule-moq-web/web/room, with its end-to-end scenario. joule-moq-ingest reads the seek power.
• Docs: the relay README's DVR section and config, both CHANGELOGs, and SPEC §5 (the DVR window and the seek power).

Defects found and fixed while finishing (the builder stopped at the account's weekly limit)

1. A relay panic. local_plan built a run of store-evicted groups by searching the cache from the run's first group, which the cache had already declined. The run then ended at g − 1: inverted, and at group 0 a subtraction overflow that panicked the session's task. The search now starts after g and skips cache-evicted groups. There are unit tests, shown failing under the old rule (exit 101).
2. Gaps in the stored window under load. The store evicted by arrival time across groups, and moving the evicted mark removed only the victim. Groups finish, and are sealed, out of order under load, so a lower group could stay held below the mark: for example a window of [29, 32, 34, …]. Now each track evicts its lowest group first, moving the mark evicts every group at or below it in the track and its partner, and the writer refuses a seal below the mark when it writes it, not only when it was queued.
3. Media cached without its receipts. The cache's byte budget evicted oldest first across tracks, and a group's receipts are cached before its media. So a media group could stay cached while its receipts group was gone, and a FETCH would serve media nothing could verify. A media group and its receipts group now leave the cache together. Evicting one moves the partner track's mark as well, even when the partner's group hasn't arrived yet, so a late partner is never served alone. This applies to every relay, not only DVR.
4. Test fixes. The by-age test now waits until the relay has taken the last group before fetching. The e2e harness clears its results between runs (a second run's room-service keygen refused the first run's key file). A session that doesn't end is reported with its diagnostics.

Found while merging main: an end-to-end encrypted room was kept

L10 (#345) merged while this PR was being finished. Its confidentiality §9 says a room with a confidentiality record is never recorded, and "a relay keeps nothing of the room's tracks beyond delivery". The DVR store kept every track its prefix rules matched, sealed rooms included. Each slice was consistent alone, and the merge was clean apart from the changelog. Fixed here:

• How the store recognises a sealed room. The store needs no key: a sealed object carries the secure-objects Key ID (SECURE_OBJECT_KEY_ID, confidentiality §4.3) in its properties. Properties that do not read count as sealed too.
• What it does then. The first such group is never written. The store deletes what it already held of the room, since the room's events and receipts tracks are in the clear and can be whole before its first sealed group. It drops the room's decisions from decisions.wdl and writes nothing more of the room. Moderation still honours the room's decisions for what the cache delivers.
• Restarts. The room is recorded in sealed.wdl (room(32) check(32)), so the store keeps refusing it after a restart. Every other room keeps its window.
• Spec. live-recording §8.2 gains A room it never keeps, confidentiality §9 points to it, and SPEC §5 says so.
• Test. a_sealed_room_is_never_kept runs a sealed room beside a clear room, before and after a restart. Falsified twice: with detection off it fails at the sealed-room wait, and with deletion off it fails at "… is kept" (exit 101 each).
• The relay's write paths (the seal hand-off, the cache's keep-for-the-store rule, keep_late) now use Dvr::stores (a rule matches and the room is not sealed). keeps still decides which events tracks moderation reads.

Checks on the build host (rb, at c297283ff, after merging main)

The head after it, f8b199a65, rewords one sentence of live-metering §3.1. As a link, the sentence tripped the section-reference check (its [ matched the table's [start, end) interval), and "keeps none signs" matched the public-text check. The verifier and both checks pass on it.

run	result
every Cargo.lock with cargo metadata --locked --offline	all current (the vendored libwebrtc skipped, as check-lockfiles.sh does)
cargo test --all-targets of joule-moq-relay and joule-moq-ingest; joule-moq-web; joule-moq-room (its own workspace)	0 each, main's sealed_objects relay tests among them
cargo clippy of the relay, ingest and web, all targets	0; no note in this PR's code (those shown are in joule-moq and at server.rs:167, session.rs:302, all on main)
wai registry export --check; --lib codecs::registry; --features live_room --test live_room; --features live_metering --test live_metering	0
header with cbindgen.toml touched	include/wai.h unchanged
live_rooms_verify.py, live_metering_verify.py, live_record_verify.py, e2ee_verify.py	0
browser e2e (e2e/run.sh --runs 2, real Chrome, seek-back included)	2 of 2, 238 of 238 checks
--test dvr --test late_joiner, 4 rounds of 16 concurrent copies, load average about 73 (before the merge)	64 of 64

The first round after the merge caught that secure-objects was on only through the relay's dev-dependency: the relay's own tests passed, while the relay built as joule-moq-ingest's dependency did not. The feature is now on the normal dependency, and joule-moq-room's lock gains the crates it brings (additions only, at the versions the joule-code lock holds).

Seen earlier, not reproduced after fix 3: in 3 of 64 earlier stress runs, the viewer's WebSocket session didn't end within 40 s of the client closing. conn.closed() never resolved. That is in the WebSocket binding, not the DVR code, and none of the 64 runs after the pairing fix showed it. If it reappears, the test now prints the open session's diagnostics.

The live demo room (not changed by this PR)

To turn DVR on for wai.transaction.science/room/, add to the relay's relay.toml on prod:

[dvr]
path = "/Users/dcharlot/sites/wai-room/dvr"

[[dvr.window]]
prefix = ["*"]
max_age_s = 900
max_bytes = 900000000

At the room's limits (4 publishers at 1500 kbit/s each), a 15-minute window is about 0.7 GB of media. Each receipts object adds 359 bytes per group, which is negligible next to that.

🤖 Generated with Claude Code

L7b of WAI's live and interactive work: **DVR on the relay**. The relay keeps a configurable window of a room's tracks on disk, every object with its receipts. A viewer seeks back into it with MOQT FETCH, addressed as live-recording §8 says, and verifies recorded objects exactly as it verifies live ones. ## What is in it - **The DVR store** (`joule-moq-relay/src/dvr.rs`): - **Storage:** per-track segment files, appended a whole group at a time and synced once a segment is sealed. - **Window:** a window per namespace prefix, by age and by bytes, evicting whole groups. - **Restart:** on start the relay reloads its index and checks every stored object against its stored receipt. An object that fails is dropped and counted, and never served. - **Redactions** (live-moderation): a redacted event record is erased from the stored object that carries it, and a redacted object is withheld from DVR reads. - **FETCH below the live edge:** served from the cache when the cache covers it, from the store when the store holds the group, and upstream otherwise (the existing rule). - **Eviction is signalled with MOQT's End of Unknown Range** through the last group no longer held. - **Takes are addressed** by live-recording §8's mapping (the window, answering from it, moderation, a restart, and the harvest window of §8.3). - **Who may seek back:** a new **seek power** in live-rooms (§10.6, with joining a group in progress as a fill, MOQT §3.5). The rooms corpus, `live_rooms_verify.py` and wai-rs `live_room::seek_check` cover it; the relay checks it on every FETCH below the live edge. `joule-moq-room` gives every role the power. - **Metering:** `WMH1` **version 2** adds a hop's DVR figures (bytes stored and served), with a version 2 corpus, its refusals, and `live_metering_verify.py`. - **The browser client:** a **Seek back** control in `joule-moq-web/web/room`, with its end-to-end scenario. `joule-moq-ingest` reads the seek power. - **Docs:** the relay README's DVR section and config, both CHANGELOGs, and SPEC §5 (the DVR window and the seek power). ## Defects found and fixed while finishing (the builder stopped at the account's weekly limit) 1. **A relay panic.** `local_plan` built a run of store-evicted groups by searching the cache from the run's first group, which the cache had already declined. The run then ended at `g − 1`: inverted, and at group 0 a subtraction overflow that panicked the session's task. The search now starts after `g` and skips cache-evicted groups. There are unit tests, shown failing under the old rule (exit 101). 2. **Gaps in the stored window under load.** The store evicted by arrival time across groups, and moving the evicted mark removed only the victim. Groups finish, and are sealed, out of order under load, so a lower group could stay held below the mark: for example a window of [29, 32, 34, …]. Now each track evicts its lowest group first, moving the mark evicts every group at or below it in the track and its partner, and the writer refuses a seal below the mark when it writes it, not only when it was queued. 3. **Media cached without its receipts.** The cache's byte budget evicted oldest first across tracks, and a group's receipts are cached before its media. So a media group could stay cached while its receipts group was gone, and a FETCH would serve media nothing could verify. A media group and its receipts group now leave the cache together. Evicting one moves the partner track's mark as well, even when the partner's group hasn't arrived yet, so a late partner is never served alone. **This applies to every relay, not only DVR.** 4. **Test fixes.** The by-age test now waits until the relay has taken the last group before fetching. The e2e harness clears its results between runs (a second run's room-service keygen refused the first run's key file). A session that doesn't end is reported with its diagnostics. ## Found while merging main: an end-to-end encrypted room was kept L10 (#345) merged while this PR was being finished. Its confidentiality §9 says a room with a confidentiality record is never recorded, and "a relay keeps nothing of the room's tracks beyond delivery". The DVR store kept every track its prefix rules matched, sealed rooms included. Each slice was consistent alone, and the merge was clean apart from the changelog. Fixed here: - **How the store recognises a sealed room.** The store needs no key: a sealed object carries the secure-objects Key ID (`SECURE_OBJECT_KEY_ID`, confidentiality §4.3) in its properties. Properties that do not read count as sealed too. - **What it does then.** The first such group is never written. The store deletes what it already held of the room, since the room's events and receipts tracks are in the clear and can be whole before its first sealed group. It drops the room's decisions from `decisions.wdl` and writes nothing more of the room. Moderation still honours the room's decisions for what the cache delivers. - **Restarts.** The room is recorded in `sealed.wdl` (`room(32) check(32)`), so the store keeps refusing it after a restart. Every other room keeps its window. - **Spec.** live-recording §8.2 gains *A room it never keeps*, confidentiality §9 points to it, and SPEC §5 says so. - **Test.** `a_sealed_room_is_never_kept` runs a sealed room beside a clear room, before and after a restart. **Falsified twice**: with detection off it fails at the sealed-room wait, and with deletion off it fails at "… is kept" (exit 101 each). - The relay's write paths (the seal hand-off, the cache's keep-for-the-store rule, `keep_late`) now use `Dvr::stores` (a rule matches and the room is not sealed). `keeps` still decides which events tracks moderation reads. ## Checks on the build host (rb, at c297283ff, after merging main) The head after it, f8b199a65, rewords one sentence of live-metering §3.1. As a link, the sentence tripped the section-reference check (its `[` matched the table's `[start, end)` interval), and "keeps none signs" matched the public-text check. The verifier and both checks pass on it. | run | result | |---|---| | every `Cargo.lock` with `cargo metadata --locked --offline` | all current (the vendored `libwebrtc` skipped, as `check-lockfiles.sh` does) | | `cargo test --all-targets` of `joule-moq-relay` and `joule-moq-ingest`; `joule-moq-web`; `joule-moq-room` (its own workspace) | 0 each, main's `sealed_objects` relay tests among them | | `cargo clippy` of the relay, ingest and web, all targets | 0; no note in this PR's code (those shown are in `joule-moq` and at `server.rs:167`, `session.rs:302`, all on main) | | `wai registry export --check`; `--lib codecs::registry`; `--features live_room --test live_room`; `--features live_metering --test live_metering` | 0 | | header with `cbindgen.toml` touched | `include/wai.h` unchanged | | `live_rooms_verify.py`, `live_metering_verify.py`, `live_record_verify.py`, `e2ee_verify.py` | 0 | | browser e2e (`e2e/run.sh --runs 2`, real Chrome, seek-back included) | **2 of 2, 238 of 238 checks** | | `--test dvr --test late_joiner`, 4 rounds of 16 concurrent copies, load average about 73 (before the merge) | **64 of 64** | The first round after the merge caught that `secure-objects` was on only through the relay's dev-dependency: the relay's own tests passed, while the relay built as `joule-moq-ingest`'s dependency did not. The feature is now on the normal dependency, and `joule-moq-room`'s lock gains the crates it brings (additions only, at the versions the joule-code lock holds). **Seen earlier, not reproduced after fix 3:** in 3 of 64 earlier stress runs, the viewer's WebSocket session didn't end within 40 s of the client closing. `conn.closed()` never resolved. That is in the WebSocket binding, not the DVR code, and none of the 64 runs after the pairing fix showed it. If it reappears, the test now prints the open session's diagnostics. ## The live demo room (not changed by this PR) To turn DVR on for wai.transaction.science/room/, add to the relay's `relay.toml` on prod: ```toml [dvr] path = "/Users/dcharlot/sites/wai-room/dvr" [[dvr.window]] prefix = ["*"] max_age_s = 900 max_bytes = 900000000 ``` At the room's limits (4 publishers at 1500 kbit/s each), a 15-minute window is about 0.7 GB of media. Each receipts object adds 359 bytes per group, which is negligible next to that. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dcharlot added 40 commits 2026-10-20 03:35:34 -04:00

joule-moq-relay: a DVR store on disk, FETCH from it, the seek power, and WMH1 version 2 (work in progress) ... a9f1f9a293

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay: the events reader's test flips a payload byte ... dd75aa38bf

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay: the DVR tests ... 68a7b00593

Co-Authored-By: Claude Opus 5.5 <[email protected]>

live-metering: WMH1 version 2, a hop's DVR figures ... ed8bebb330

Version 2 of the per-hop session record adds one field, dvr, after ledger
and before sig: six u64 of what a hop that keeps a DVR window served from
it, stored in it, held in it (byte-seconds, rounded down) and dropped from
it for not verifying against their receipts. A reader reads version 1 or
2 by its own layout; version 2's out and stored figures are held to the
out and in entries (record_invalid); its bound is B2(M) = 600 + 180(M+2),
chosen by the fifth byte before anything else is read. The units do not
sum the DVR figures; the outcome states each record's version and, for
version 2, its figures. The receipt stays version 1.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-rs live_metering: read and write WMH1 version 2 ... d577ce246b

HopRecord gains dvr: Option<DvrFigures>; Some is version 2, None version 1,
whose bytes are unchanged. A record reads as version 1 or 2 by its own
layout, any other version unknown_version; version 2's out figures are
held to the out entries and its stored figures to the in entries
(record_invalid). The size bound is chosen by the fifth byte before
anything else is read: B2(M) = B(M) + 48 for version 2, B(M) otherwise.
DvrFigures::byte_seconds floors the sum once. energy_steering's corpus
builds its records as version 1.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

live-metering corpus: a version 2 relay record and its refusals ... 36ceb357d5

dvr_relay (accepted): the lesson's relay keeps a ten-second DVR window of
the composite and signs a version 2 record of it, a viewer joining at
20 s filled from the window. Refused: dvr_out_exceeds and
dvr_stored_exceeds (record_invalid), record_unknown_version (version 3),
dvr_record_too_large (past B2(M) by less than an entry). Each accepted
record's facts state its version, and a version 2 record's six DVR
figures; every existing record keeps its bytes.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

live-metering corpus: regenerated with version 2 ... 98ea7833b3

Five vectors added (dvr_relay accepted; dvr_out_exceeds,
dvr_stored_exceeds, record_unknown_version, dvr_record_too_large
refused); every existing vector's records and receipt are unchanged and
its accepted records gain only their version, 1.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

live_metering_verify.py and the corpus README: version 2 ... a2529d1339

The second implementation reads WMH1 version 1 or 2 by its own layout,
holds version 2's out and stored figures to the entries, chooses the
bound by the fifth byte (B2(M) for 2, B(M) otherwise), and states each
record's version and a version 2 record's DVR figures. New mutations
cover the stated version, figures and bound, the record's DVR bytes, and
the four new refusals. The README describes the new vectors.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay: mark what cannot be served group by group, and keep arriving groups of kept tracks in the cache ... 8dd2c31690

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay: DVR tests with a cache of a few groups; warn when a kept group comes after the cache moved past it ... 41bb4369df

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay: a group written again at load keeps its new offsets ... 1e89809b37

Co-Authored-By: Claude Opus 5.5 <[email protected]>

live-rooms: the seek power, and §10.6 seeking back below a track's live edge ... ad01ff7d2f

powers gains bit 4 seek; a role's and a grant's powers set none above
bit 4, and a grant's seek stays within its role's (§4.3 step 7). §10.6
fixes the live edge (MOQT §3.1.4) and when a FETCH or a SUBSCRIBE's fill
seeks back, which a relay serves only under a proved grant holding
seek, refusing any other with REQUEST_ERROR UNAUTHORIZED and the reason
phrase seek_not_granted (§11). §12 describes the new corpus content.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-rs live_room: the seek power, seek_check (§10.6), and the corpus's DVR room and seek cases ... ab1b91e633

power::SEEK is bit 4, which the descriptor's and the grant's field rules
now allow; seek_check refuses seek_not_granted a request that starts in a
group below the live edge under a grant without it. The corpus gains the
accepted dvr room, three refused vectors (a grant with seek its role
lacks; a grant and a role with powers bit 5), each accepted grant's seek,
and the seek section.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

live-conformance/rooms: regenerate with the dvr room, the seek-power refusals and the seek section ... f9f3cb9b3c

Every existing record and stated outcome is unchanged; each accepted
grant's moqt entry gains its seek, false for every grant before the dvr
room.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

live_rooms_verify.py and the rooms README: the seek power and §10.6's seek requests ... 78b45a5d1d

The second implementation allows powers bit 4, states each accepted
grant's seek, and gives every request of seek its outcome by §10.6's
rule from the room's grants as §4.3 checks them; the README describes
the dvr room, the new refusals and the seek section.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay: count groups that become whole after the window passed them ... 4eacf7027b

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge origin/main into joule-moq/dvr ... 18d5030d96

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-room: every role holds the seek power ... 9be13006a1

Co-Authored-By: Claude Opus 5.5 <[email protected]>

live-rooms §10.6: joining the group in progress is a fill (MOQT §3.5) ... c0bebc7a82

Co-Authored-By: Claude Opus 5.5 <[email protected]>

live-recording §8: the DVR window, answering a FETCH from it, moderation, a restart, and the time-shift mapping ... 0018fba9d6

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-web: the Seek back control and its e2e scenario; joule-moq-ingest reads the seek power ... a29b84fb0c

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay: clippy in the DVR test and module ... db2d92106f

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay README: the DVR store; CHANGELOGs; SPEC §5: the DVR window and the seek power ... 038fc5cc92

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay: cite live-recording §8.3 for a harvest window ... c52270a17c

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay: a redacted event record is erased from the stored object that carries it ... 9953ede352

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-code CHANGELOG: name no browser ... 398d55e493

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay: the DVR store appends groups to per-track segments and syncs them once a second ... 3175fa56a3

One durable sync per group file could not keep up with a room's audio groups (fifty a second
per publisher), so the writer fell behind and recent groups were neither cached nor stored.
Segments take ten seconds of a track each; a record a later one replaces is marked and
zeroed; a crash loses at most the last second, and what it leaves cut short is cut off and
counted at start.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay README: segments and their durability rule ... 911ecb2d2a

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay: each session summary is appended in one write ... f7b7ea2be5

Two sessions that ended together could interleave a line and its newline, leaving two
summaries on one line of summary.out_path.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge origin/main into joule-moq/dvr ... 4f15755e81

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay: a kept track's cache takes a group whose streams finish after a later group was evicted ... 31ddb28c04

Under load a group's stream can finish after the cache evicted a later group of its track;
the cache refused it, so the DVR store never got it. For a track the store keeps, the cache
now takes it and eviction drops the evicted group's state alone; coverage is unchanged. The
mux test of a stream that arrives after the close no longer fails when, on a loaded host, the
close arrives before its writes do.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay: a FETCH's evicted run never ends before it starts ... 93eea43c57

local_plan's run of groups the DVR store evicted searched the cache for the next whole
group from the run's first group itself, which the cache had already declined (it was at
or below the cache's own eviction mark), so the run ended at g - 1: an inverted range, and
at group 0 a subtraction overflow that panicked the session's task (seen in the DVR test
a_window_by_age_empties_as_its_groups_pass_it). The search now starts after g and skips
groups the cache evicted. local_plan takes the track's cache rather than the track, so the
two cases are unit tests.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay: the DVR window stays one run of groups under load ... 4a9affc4d5

Groups finish, and are sealed, out of order under load. The store evicted by arrival
across all groups, so a group sealed late could sit below groups already evicted, leaving
gaps in the window (seen as [29, 32, 34, ...] in the window test under concurrent runs).
Each track now evicts its lowest group first (across tracks, the one whose lowest group
arrived first), and the writer refuses a seal below the evicted mark when it writes it,
not only when it was queued.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay: a media group and its receipts group leave the cache together ... d3bf0a2366

The cache's byte budget evicted oldest first across tracks, and a group's receipts are
cached just before its media, so under pressure a media group could stay cached while its
receipts group was gone: a FETCH then served media no receipts covered (seen in the DVR
test a_window_by_age_empties_as_its_groups_pass_it under concurrent runs). The pair is now
evicted together, as the DVR store already evicts it, and kept together while either is
still arriving on a track the store keeps. Budget::take drops the partner's accounting.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-web e2e: each run starts from no results ... 68a3c57d07

A second run in the same output directory failed its service scenario: the room service's
keygen refuses the key file the first run left.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay: evicting a stored group evicts every group at or below the mark ... 070795105f

The DVR store evicts the track whose lowest group arrived first; a group's arrival time
can be later than a higher group's (the cache recreates a group's state when it takes a
late group), so the store could evict groups 31 and 32 while group 30 stayed held below
the new mark: a gap in the window (1 of 16 concurrent runs of the window test). Moving a
track's evicted mark now removes every group at or below it, in the track and its
partner, so none is ever held below the mark.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay: local_plan's last branch with ? ... 1dcb3bffa0

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay DVR test: a session that does not end is named, with its diagnostics ... b74ed0e5cc

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay DVR test: the by-age case fetches only after the relay took group 3 ... b7d5dd61e1

Taking group 3 can evict a media and receipts pair from the cache; the test's media and
receipts FETCHes are two requests, so an eviction between them left media without its
receipts ("the receipts of group 2 come with it", 16 of 64 runs under load with logging).
The test now waits until the relay's largest object of both tracks is group 3's.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay: an evicted group moves its partner track's mark too ... f0c5402080

A group's receipts are cached before its media, and under load the media's stream can be
taken after later groups, so the budget could evict receipts group g before media group g
had arrived: the pairing found no partner to evict, and media g was then cached and served
without receipts (the DVR by-age test, 8 of 64 runs under load). Evicting group g now moves
the partner track's evicted mark to g as well, so a partner group arriving later is never
served from the cache alone; a DVR-kept track still takes it for the store.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot added 5 commits 2026-10-20 04:03:52 -04:00

Merge remote-tracking branch 'origin/main' into joule-moq/dvr ... 7ec9e7f044

# Conflicts:
#	wai/CHANGELOG.md

joule-moq-relay: a sealed room is never kept in the DVR window ... 6cad445cd1

confidentiality §9 (merged with L10) says a relay keeps nothing of an
end-to-end encrypted room's tracks beyond delivery; the DVR store kept
every track its prefix rules matched. The store now knows such a room by
its first object carrying a secure-objects Key ID (or properties that do
not read), never writes that group, deletes what it held of the room (its
events and receipts tracks are in the clear and can be whole first),
drops the room's decisions from decisions.wdl, writes nothing more of it,
and records it in sealed.wdl so a restart keeps refusing it. Moderation
still honours the room's decisions for what the cache serves.

live-recording §8.2 states the rule; confidentiality §9 points to it.
The joule-code changelog's stale "a file per group" now describes the
segments, and the cache's media/receipts pairing is documented.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay: clippy's notes on the sealed-room code and its test ... 7de2c27cf7

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-relay: depend on joule-moq's secure-objects feature, for the Key ID reader ... 7af5133352

The DVR store reads an object's Key ID to know a sealed room; the feature
was on only through the dev-dependency, so the relay built as another
crate's dependency (joule-moq-ingest, the e2e's release binary) did not
compile. tests/sealed_objects.rs now gets it from the normal dependency.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

joule-moq-room: Cargo.lock with the relay's secure-objects dependencies ... c297283ff6

Additions only, at the versions joule-code-rs's lock already holds.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot added 1 commit 2026-10-20 04:06:15 -04:00

live-metering §3.1: the version 2 sentence cites live-recording §8 in prose ... f8b199a657

The link after the table's [start, end) interval read, to the section
reference check, as one link text reaching back to energy-measurement
§2.7; and "keeps none signs" matched the public-text check's "none signs".

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot added 1 commit 2026-10-20 08:29:11 -04:00

Merge remote-tracking branch 'origin/main' into joule-moq/dvr ... 99dae8f0a0

# Conflicts:
#	wai/CHANGELOG.md

dcharlot merged commit f871af559c into main 2026-10-20 08:29:33 -04:00

dcharlot referenced this pull request from a commit 2026-10-20 08:29:38 -04:00

Merge pull request 'joule-moq-relay: DVR on the relay, seek back by FETCH, and the seek power (L7b)' (#351) from joule-moq/dvr into main

dcharlot referenced this pull request 2026-10-20 08:51:31 -04:00

wai.live.watermark: forensic watermark session records, matched and disclosed one at a time (L14) #358

dcharlot referenced this pull request 2026-10-20 08:59:47 -04:00

wai.live.ads: server-guided ad insertion for rooms — cues to HLS interstitials and DASH alternative presentations, asset lists, and the break form of wai.video.ssai (L11) #360

dcharlot referenced this pull request 2026-10-20 13:47:14 -04:00

joule-moq-relay: a WebTransport session closes with its MOQT code and reason (WT_CLOSE_SESSION), on a vendored wtransport 0.7.2 #365

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Transaction-Science/open-standards!351

No description provided.