FORK_AUDIT.md

Fork reconstruction audit

Last updated: 2026-09-04

This ledger tracks the completed reconstruction of the FrameWorks fork on the current upstream base. The reviewed reconstruction has been promoted to master. Every retained local change has a clear origin, focused regression coverage, an ablation that fails for the intended reason, and a clean topical replacement commit.

Branches and scope

• Proof/audit branch: rewrite/master-proof-20260902
• Promoted clean tree: master (originated as rewrite/master-final-clean-20260903)
• Pre-proof candidate: rewrite/master-final-20260902 (71d1de7dd)
• Safety backup: backup/master-final-pre-proof-audit-20260902
• Original local queue: 32 commits after the three preview integrations
• Preview integrations retained as independently replaceable squash commits: CMAF, NDI/camera/UI, and ONNX AI processing

Status rules

• pending: not yet reviewed under the strict audit standard.
• partial: at least one behavior is proved or rejected, but other hunks remain.
• media-proved: passed a focused end-to-end media matrix, but still needs a permanent automated regression before final reconstruction.
• proved: every behavior currently attributed to the original commit has focused coverage and an ablation result. This still does not mean the final history has been reconstructed.
• dropped: behavior was stale, accidental, redundant, or could not justify itself.
• replaced: implementation and tests have been rebuilt into final clean topical commits.

Progress summary

Measure	Count
Original local commits	32
Proved	29
Media-proved, automation pending	0
Partial	0
Pending	0
Dropped	3
Archived behavior/proof commits above the preview stack	167
Final reconstructed commits above upstream development	32
Residue hunks already dropped/restored	27

The temporary proof commits remain archived on the proof branch. The clean history replaces them with three independently replaceable preview squashes, 25 narrow implementation-and-regression commits, this reconstruction record, and three focused ONNX dependency/artifact/release commits.

Commit ledger

Original	Subject	Status	Current evidence / remaining work	Final replacement
87dd6ae46	embed: reconcile modular player with playback stack	proved	The old fork's Video.js wrapper translated its HLS media clock into Mist packet time; the modular-player preview replaced that wrapper and the candidate reconciles the behavior with Video.js 10 custom elements. embed/test/wrappers.test.js proves exact PDT mapping, stable API-edge fallback, seek clamping, buffered/duration translation, native DASH timing, native-media versus display-tree ownership, and module loading. Removing each timeline/display/module bridge fails its focused assertion. The source regenerates all player bundles byte-for-byte, and the frozen workspace lock is current. Fold this reconciliation and its test into the modular-player preview squash.	preview integration
69716dc94	interface: preserve input-list form serialization	proved	The structured inputlist branch belongs to the NDI/interface preview integration. The local source hunk merely removed a duplicate unreachable case; restoring it leaves the focused conversion test green, while removing the real structured branch fails with str !== inputlist. Regenerating from the pre-commit bundles reproduces the large preview-source catch-up (the playground bundle exactly; MI differs only by a two-symbol minifier rename). Keep the regression, fold source cleanup and generated bundles into the preview squash rather than a fork feature commit.	preview integration
cc0639bb7	foghorn: add relay discovery and NAT traversal	proved	The relay protocol is proved with structural packet tests plus an actual localhost MistUtilFoghorn process. Coverage includes authenticated announcements and requests, 16-bit fields above 255 bytes, every truncated request length, IPv4/IPv6 instructions, endpoint discovery and pagination, protocol isolation, NAT-mapped two-sided instructions, opaque additional data, duplicate suppression, publish timing, and thread lifetime. A Linux two-peer integration now proves that SRT input and output preserve their direction, transfer ownership of the punched UDP descriptor, perform the required same-port rendezvous handshake without reopening the socket, retain distinct SRTO_SENDER roles, and carry a complete 1316-byte transport packet through Mist's nonblocking send/receive methods. The audit fixed corrupt high-byte encoding, unsafe parsing, false startup flags, off-by-one publishing/ranges, catalog framing/pagination, a detached-thread UAF, the macOS IPv4/IPv6 reply failure, the broken new-base SRT handoff, a mistaken both-sides-sender configuration, descriptor ownership, and first-packet loss caused by immediate libsrt statistics sampling. The packet/relay path passes ASan and TSAN; 50 concurrent rendezvous process repetitions pass against Ubuntu's system libsrt 1.5.3. Restored unrelated sourcery.cpp and generic TSSRT churn; removed incomplete type-6/type-7 port-scan state. The unbuilt Nautophone developer proxy is dropped because it leaks a UDP socket per successful request, logs/echoes passphrases, exposes unauthenticated CORS-enabled arbitrary UDP, hangs favicon requests, and claims IPv6 while always creating udp4.	split ownership
520778119	processing: add observable VOD lifecycle control	proved	Amended current commit: 583420c55. This is confirmed as an omnibus snapshot, not one topical change. Its newer pre-reconstruction-fork origins include trigger/stats plumbing, adaptive rate control, producer EOF/drain handling, processing retry/drain fixes, recording readiness, packet diagnostics, offline stream state, thumbnail track selection, and EBML recording helpers. Trusted-proxy replacement was already extracted and proved. The audit also removed three stale target-parameter separator hunks from the dropped EFG/avrefactor preview: output parsing, MST_ORIG_TARGET parsing, and push capability matching now retain upstream's ? contract. The ProcState/NodePressure ABI, normalized feed votes, bounded rate transitions, seqlock snapshots, severity aggregation, producer-EOF state machine, output/EBML drain decisions, recording track-readiness gate, stale-DTSH recovery, file-recording speed/drain diagnostics, and processor supervisor exit/restart behavior now have focused coverage. The actual InputBuffer::userLeadOut() transition matrix is tested, including resume feeders and sticky drain state. Real Controller -> InputBuffer -> processor -> MistOutEBML recordings now prove ProcAV late-track startup and B-frame EOF timing/tail preservation, Livepeer tail drain, and a chained AV -> ONNX model-backed VOD tail, including the live PID-scoped ProcState contract. The ProcAV EOF fixture requires all 200 frames, a zero-based presentation origin, a full eight-second span, clean decoding, frame-sequence SSIM >= 0.98, a truthful sub-timeout drain duration, retained speed statistics in RECORDING_END, one clean PROCESS_EXIT, and no fixed-policy processor restart after source EOF. The audit fixed fatal-reason publication, source/consumer miscounting around DONOTTRACK, accidental application of process-only shutdown draining to ordinary live outputs, a boot race where STRMSTAT_OFF could bypass an unresolved output contract, timestamp-zero ProcAV output loss, recording waits on mask-invisible intermediate outputs, premature VOD feed while a downstream selector awaited an intermediate track, feed-clock catch-up after startup pauses, processor-only source EOF recognition, ProcAV's two-frame B-frame timestamp shift, a 25-second EOF lookahead stall, final-packet loss, drained-track auto-reselection, status-only restart suppression, invalid iteration while stopping multiple removed processes, a boot-time-zero packet-warning hole, and lookahead-clock underflow. Specific input startup failures now survive into shutdown/trigger state. Unbounded per-restarted-PID text aggregation was removed in favor of the bounded structured recording payload. Ablations fail exactly and the focused suite is green under ASan and TSAN. Every behavior hidden by this omnibus is now either proved here, assigned to another ledger row, or explicitly dropped.	split during final reconstruction
8c82998ab	amf: give objects value-safe ownership	proved	test/amf.cpp; copy and assignment ablations expose aliasing/stale values.	—
aa85fc88e	http: harden downloader completion and retry state	proved	test/downloader_regression.cpp, test/urireader_regression.cpp; connection, POST phase, terminal range, and reopen ablations fail.	—
528630551	sockets: harden diagnostics and TLS callbacks	proved	Unknown-address severity is proved by test/socket_address_unit.cpp. test/tls_setup_unit.cpp proves key logging follows the active TLS setup object on MbedTLS 3 and 2.28; removing the v2 callback assignment fails. Socket-buffer tests pass while linking through public libmist.	—
8d7bf7199	srt: preserve URL paths and use the default port	proved	URL test matrix covers default/non-default ports and resource paths; both path and port ablations fail.	—
e84e51e84	ebml: align live input timestamps to the server clock	proved	test/input_ebml_unit.cpp drives normal buffered and EOF-drain getNext() paths. It proves VOD pass-through, first-live-packet clock alignment, negative offset handling, and preserved packet spacing. Each call-site ablation fails independently; restored code passes under ASan.	—
1b1257e53	http: fix bearer tokens and trusted proxy reloads	proved	test/http_response.cpp, test/trusted_proxy_unit.cpp; parser boundary, replacement notification, stale-data, and non-blocking incomplete-page cases.	—
7afee1378	mpegts: finish segment reads once and disable recording pacing	dropped	Both remaining hunks are no-ops. The SegmentReader edit removed only a duplicate finish() in one invocation, not repeated EOF calls; finish() consumes the PES, so its immediate repeat has nothing left to emit. Generic recording setup already sets realTime = 0 before packet output unless realtime is requested.	—
6e41a1eea	webrtc: negotiate one valid track per media type	proved	The original blend contained four contracts plus an unrelated verbosity tweak. test/sdp_answer_unit.cpp proves one enabled answer per media type, rejected duplicate m-lines with their original mids, and exact BUNDLE membership. test/webrtc_output_policy_unit.cpp proves that output selects the first packetizable video/audio and first JSON track, rejects meta-only or unsupported offers, never remaps packets from other selected tracks into the negotiated RTP stream, and exposes post-seek WHEP media/UTC time with the correct explicit-UTC or live-boot anchor. Selection, packet-gating, primary-media, and UTC-anchor ablations each fail exactly. Normal, ASan, and TSAN suites pass and the production MistOutWebRTC target builds with data channels disabled locally; the data-channel build remains subject to the known Homebrew usrsctp include-path packaging defect. Restored the old-base SDES CNAME log level because changing verbosity had no demonstrated fork contract, and restored the original playback-only scope/order of the constant rate-control option.	split ownership
1779b3c12	streams: distinguish offline inputs from fallback failures	proved	The blend is now split by ownership. 3154b4544 gives every input-start attempt an isolated result page, restores an inherited result-channel environment exactly, and proves same-process and exec-child offline reporting plus all three real startup-failure diagnostics. 0fa87daf1 proves the balancer matrix: explicit/empty/provider-only offline outcomes are authoritative, remote URLs replace the source, and unsupported/local failures remain fallback-eligible. 3f9bd6581 proves sourcepids is always an array, excludes PID zero, and keeps non-loopback macOS interfaces whose names merely begin with lo. b8fd341b5 proves deliberate offline bypasses HTTP fallback while ordinary failures retain it. Normal and ASan tests pass; isolated result, empty-array, interface-filter, balancer, and fallback ablations each fail their exact assertion. Origin is the old-fork offline-state line (f9a68c547/764ac090d) plus the separate macOS statistics fix, not preview-branch residue.	split ownership
0a1d02226	mp4: normalize negative composition offsets	proved	This was another blend. test/mp4_track_header_unit.cpp proves zero-timescale rejection and uniform multi-track non-fragmented CTTS rebasing. The audit found that fragmented version-1 TRUN offsets were still stored unsigned; they are now parsed according to TRUN version, preserving signed v1 and unsigned v0 values. Restoring unsigned parsing fails at version-1 TRUN composition offset lost its sign; normal and ASan tests pass. The unrelated VOD retry hunk is separately exercised through a real ranged HTTP peer: two short responses force success on the third configured retry, and a pure boundary check forbids pointless retries at known EOF. Reducing the retry count or restoring the old `!= npos
3f6c73032	mpegts: harden Opus ingest and PID mapping	proved	Opus descriptor round-trip, complete PID policy, final-PES flush, post-EOF queue handling, and atomic HLS segment snapshots are proved. Stale HLS tolerance, unused packet counts, noisy seek logging, and the negative PES clamp were rejected.	—
2d04becfe	recording: finalize live EBML clusters cleanly	proved	A permanent real-process test streams B-frame H.264/AAC through mkv-exec -> MistInEBML/Buffer -> MistOutEBML and verifies a three-second live file decodes with no diagnostics and contains all 76 video/141 audio packets. Removing final-cluster flush loses one video and three audio packets; disabling buffered live clusters yields File ended prematurely; ignoring packet composition offsets yields non-monotonic video DTS. The existing cluster-readiness policy test proves active/unused/ended track boundaries. A newly extracted live-layout predicate proves a file recording that started live keeps unknown-size live Matroska layout after metadata shutdown; removing that source-live memory fails exactly.	—
b8cd682e8	livepeer: harden segmented processor lifecycle	proved	Amended lifecycle commit: 1de1b3cbe; focused concurrency/policy replacement: 00168fa2f. A real loopback broadcaster deliberately completes segment 1 before segment 0, rejects a missing or incorrect Content-Resolution, and introduces external backpressure while Livepeer feeds a recording. The result decodes without diagnostics, contains only source audio plus processed video, applies the internal ?audio=none&video=maxbps selector, reaches 29.4 seconds, finalizes exactly one EOF tail, preserves insertion order, publishes measured external-processing capacity through its PID-scoped ProcState, and joins all threads cleanly. Focused policy tests cover fatal 401/403/503 responses, the five-rejection fallback, deadline-derived socket/retry settings, and same-broadcaster retry only after a fully sent request. An ordering invariant rejects premature slot completion. TSAN initially found 21 reports in MistProcLivepeer; synchronized segment publication, statistics, insertion turns, option reads, shutdown state, and process-wide config state reduce that to zero. The only remaining pipeline reports are the unchanged upstream-development lib/procs.cpp::thread_handler race and are not attributed to this fork commit. Removing the tail guard or ordering invariant fails its exact regression.	split ownership
7a1c95a12	livepeer: forward job token in transcode requests	proved	test/livepeer_request_unit.cpp proves the camelCase header contract, exact opaque-token forwarding, omission for absent/non-string tokens, and preservation of workload/deadline/minimum-speed fields. The real MistProcLivepeer builds; deleting only token forwarding fails the exact token assertion; restored code passes under ASan.	—
88174ac2b	media: add thumbnail processing and outputs	proved	This historical blend is now fully assigned. Generic video selection is proved to exclude JPEG/PNG image tracks while explicit selectors retain them. Permanent opt-in pipelines cover H.264 with reorder depth two, AV1, and JPEG sources through their real MP4/EBML/Buffer inputs into Thumbs, disk artifacts, trigger delivery, and ThumbVTT. All three advertised decoders publish the expected six presentation-time cues and complete poster/sprite/VTT set; H.264 owns the realtime multipart VTT/JPEG transport proof, while H.264 and AV1 both prove ThumbVTT GET and bodyless HEAD. Keeping the transport assertion in one codec case avoids coupling AV1 encoder startup time to a redundant live-pacing check without reducing coverage. The audit fixed H.264 keyframe loss without decoding inter-frames, ignored regeneration intervals, direct partial file writes, unsafe FFmpeg allocation paths, unbounded sprite geometry, unsanitized artifact paths, and source/sink stats races. File replacement and failure behavior have focused normal/ASan/TSAN coverage; decoder, interval, and target-validation ablations fail exactly. Process-level TSAN is blocked before startup by the unchanged upstream lib/procs.cpp::thread_handler race. The already-proved Annex-B initialization conversion owns lib/dtsc.cpp and lib/h264.*; the one-use Util::hexLog diagnostic copied with it was removed as redundant residue. The older JPEGReceiver preview is separately hardened and proved with marker-level tests and real 4:2:0/4:2:2 JPEG-to-H.264 recordings; its nonfunctional minimum-FPS synthesizer is dropped.	split ownership
ad59646fa	tests: cover media initialization and FFmpeg registry	proved	This blended two independent contracts. The Annex-B test now exercises the production DTSC::Meta::setInit() path, both legal start-code widths in every combination, exact AVCC output, and malformed inputs without relying on compiled-out assertions; disabling only metadata conversion fails exactly, and normal/ASan builds pass. The registry list belongs to the pinned WITH_AV release toolchain rather than only MistProcAV, so the test and CI label now say so. A Linux static-fallback build proved the wrap patch: without dependency-aware x264 probes FFmpeg silently set CONFIG_LIBX264_ENCODER=0 and the test failed on H.264; with the committed patch, the full registry test and MistProcAV link passed. Fold Annex-B coverage with its media-init implementation and registry coverage with static FFmpeg packaging.	split ownership
ac962892b	writers: finish external DTSC uploads before closing	proved	test/external_writer_unit.cpp drives public DTSC::Meta::toFile() through a local HTTP PUT peer. It observes the zero chunk and proves the call waits for a delayed final response. Restoring raw close() fails at the missing final chunk; restored code passes under ASan.	—
7b0b111b9	build: add CI and dependency tooling	proved	Exact Ubuntu 24.04 system-dependency builds compile all 806 Ninja actions and assert NDI/ONVIF availability. The project configures successfully at its declared Meson 1.6.1 minimum; CI now quotes that requirement instead of accidentally treating > as shell redirection, and static release jobs no longer rely on Ubuntu's older Meson package. GCC exposed and now proves the explicit HLS <mutex> dependency; OpenSSL development headers are declared directly. The static FFmpeg fallback and x264 registry/link contract pass with their dependency-aware probe and fail under its ablation. Obsolete QUIC packages left after dropping the broken preview, unrelated checkout-version churn, and the local .DS_Store ignore addition were removed. Workflow action linting and modified shell syntax passed. The exact Ubuntu media run finished with 195 passes, one expected failure, and one redundant AV1 multipart timing assertion; after separating that already-covered transport contract, both owning H.264 and AV1 tests pass independently. The local macOS static profile remains limited by stale Homebrew .pc references to removed Cellar versions, a host package-state defect not hidden by source changes.	build and CI topical replacement
48b2452d7	runtime: ignore unhandled process diagnostic signals	proved	test/config_signal_unit.cpp proves activation ignores only a default SIGUSR2 disposition, preserves custom/explicit-ignore handlers, leaves SIGUSR1 alone, and still deactivates on SIGTERM. The fallback was moved from the candidate's no-argument constructor to Config::activate(), matching its 2022 source and covering string-constructed binaries. Removing the fallback fails exactly; restored code passes under ASan.	—
5f4766faf	controller: join the logger on every exit path	proved	The candidate's manual cleanup missed both TLS setup returns. Controller::LogThread now owns descriptor closure and joining through RAII, while normal shutdown still explicitly stops it before storage teardown. test/controller_log_thread_unit.cpp proves early-return destruction, explicit stop, and idempotence; removing destructor cleanup aborts on a joinable thread. The controller builds and the restored test passes under ASan.	—
1a5870929	triggers: publish complete processing and recording contracts	proved	abab0e5e1 proves typed HTTP actions, executable legacy compatibility, failure policy validation, controller persistence, and the LSP form contract; it also fixes case-insensitive LEGACY parsing and removes a 10–30 second optional-config backoff from trigger failure paths. 575e2b6c5 extracts the fork event/action capabilities from the monolithic Controller table, makes rebuilding idempotent, and verifies every advertised action against runtime policy plus the exact processing, recording, Livepeer, ProcAV, and thumbnail payload contracts. Normal and ASan tests pass and Controller builds. Header, legacy-offline, UI-onfail, and missing-capability ablations fail exactly. The typed routing originates in the newer old-fork ed6d6797e line; these are compatibility-preserving fork contracts, not old-base substitutions.	split ownership
46341c43d	controller: release the config lock during capability probes	dropped	Reconstruction-only residue with no corresponding old-fork source. Its comment claimed checkCapable() opens executables/files, but that function only copies in-memory load counters into JSON. Unlocking configMutex therefore introduced an unprotected interval without removing blocking work. Restored the new-base behavior; MistController and the Controller suite pass.	—
8f6662724	controller: expose push stop and reinitialize commands	proved	Traced to the 2024 push_kill and push_reinit feature commits. test/push_control_request_unit.cpp proves absent commands, scalar/array kill IDs, scalar/array reinit IDs, streamname/target pairs, and invalid-entry accounting. Kill and reinit routing ablations each fail their exact assertions; restored code passes under ASan and MistController builds. The underlying process-signal primitives predate this API-only commit and remain assigned to 520778119.	—
002be4ab0	mp4: preserve reordered frames at clip boundaries	proved	test/bframe_clip_integration.sh synthesizes H.264 with two B-frames plus AAC and drives the real Controller -> MistInMP4 -> MistOutMP4 path. AV and video-only cuts each contain 76 encoded samples, decode to the exact expected 75 displayed-frame hashes, and report 3.000 seconds. A short-audio fixture proves mismatched track tails are diagnosed before audio enters video sample slots. Independent ablations prove the presentation limiter and planned-stop drain each lose the decode-tail sample, removing the edit-list offset loses two visible frames, timestamp-bounded ordering causes invalid H.264 NAL units, omitting post-seek order reset creates a partial unreadable file, and disabling the mismatch guard silently cross-writes tracks. Normal CI runs the media test explicitly; ordinary local suites skip it to avoid colliding with process-global Controller resources.	—
7533599fe	runtime: restore node pressure and platform load reporting	proved	The macOS CPU/memory/load collection is traced to old-fork commit a97bad7f1; its companion network counters remain assigned to the separate streams/offline blend. The node-pressure publisher is a fork adaptation required by adaptive process-controlled VOD feeding. test/runtime_stats_unit.cpp proves PSI parsing, interval normalization, initial baselines, missing-read recovery, counter rollback, saturation, portable CPU tick accounting, and safe memory accounting. The audit fixed a false-pressure spike after any transient PSI read failure by invalidating and rebuilding the baseline. The full Controller builds and executes its native macOS collection path in the model-backed pipeline; that pipeline also reads the Controller's live versioned NodePressure page alongside the actual ONNX ProcState page. Retaining a baseline across a missing read and suppressing live publication each fail their exact focused assertion; normal and ASan tests pass.	—
9255f7347	streams: complete offline and trigger control contracts	proved	Storage/UI validation moved to abab0e5e1; output and shutdown semantics moved to b8fd341b5. A shared state contract now makes OFF and deliberate OFFLINE terminal for MistUtilNuke and publishes consistent status text to Controller and HTTP consumers. HTTP startup preserves fallback for ordinary failures but suppresses it for an authoritative offline attempt. The audit found and fixed a replay defect where a status request ran PLAY_REWRITE and generic initialization ran it again; the shared output operation and per-connection gate now apply it once while preserving rewrite, keep, and deny outcomes. A disabled rule may still be evaluated after a later fallback target is chosen. Normal/ASan policy tests and all affected binaries pass; second-run, offline-fallback, and terminal-state ablations fail exactly.	split ownership
f8e536bd3	media: restore raw generator input	proved	The preview input now has a permanent Controller -> RawGenerator -> Buffer -> session-enabled MistOutEBML recording test. Three consecutive runs each produced exactly 50 decoder-clean 800x600 UYVY frames at 50 fps, with 960,000-byte packets, a zero timestamp origin, and a fully initialized first frame. Capability JSON now advertises only the UYVY video and timed-subtitle tracks it actually creates. A ring-fill/wrap unit exercises in-memory and shared-memory metadata normally and under ASan. The audit fixed 52-byte embedded-table underallocation, aligned seek/key/read boundaries to the safe 75% window, preserved frame timestamps under limiters, switched generic output readiness to the embedded-aware key accessor, delayed EBML file seeking until recording mode is active, initialized raw frames safely, published explicit live/50-fps metadata, and replaced RawGenerator's immediately-failing generic inactivity loop with its source/buffer lifecycle. Ablations of the accessor, recording-mode deferral, live metadata, fps, frame initialization, and lifecycle loop respectively reproduce the session-path UAF, playback-mode race/crash, VOD-layout crash, output crash, null append crash, and immediate no activity shutdown. Speculative generic buffer readiness, embedded-only EBML layout, young-live seek, and media-clock changes passed ablation and were removed. Existing compressed live EBML recording remains decoder-clean with all 76 video/141 audio packets.	be6603782, 3cb30cc3e
71d1de7dd	transport: restore optional DTSC over QUIC output	dropped	This is a repeatedly carried copy of the old upstream Nissan/master preview, not a current fork feature. Ubuntu 24.04 with the exact ngtcp2/GnuTLS dependency set builds MistOutDTSCQuic, proving optional detection was not hiding compile failure. A real certificate-backed localhost server/client launch then fails before DTSC exchange: the newer Output-API adaptation forks its handler with an empty Util::Config, and the child aborts on a nonexistent target option. The explicit IPv4 listener also fails its bind path, and review found the TLS ALPN call passes two entries while initializing only one. Repair would require reconstructing and testing the entire stale 1,317-line transport, not preserving a known feature contract. The preview, its build flags/dependencies, and its sole-use Meta::addTrackFrom(..., noLastMs) core API were removed together.	d2bb320bf

Proven and rejected hunks

Area	Result	Evidence
AMF copy/assignment	keep	Value isolation tests fail when deep-copy behavior is removed.
SRT URL normalization	keep	Default port and path tests fail independently on ablation.
Downloader connection/POST state	keep	Focused local HTTP server tests fail on each reverted condition.
URIReader ranged terminal recovery	keep	Reopen/retry tests fail when either recovery path is removed.
Bearer parsing	keep, extracted	Parser tests catch the former first-character truncation.
Trusted proxy replacement	keep, rewritten	Tests prove notification, complete replacement, and immediate handling of incomplete pages.
WebRTC SDP media/BUNDLE selection	keep	Duplicate-media and single-media BUNDLE tests fail on upstream behavior.
WebRTC output track selection	keep, extracted	Production-used policy tests prove first-supported A/V/JSON selection and reject the former behavior that silently remapped packets from additional selected tracks into the negotiated RTP stream.
WHEP playhead headers	keep, extracted	Tests prove VOD media time, explicit UTC anchoring, live boot-time anchoring, and suppression for push/missing-metadata sessions; the constant option is again applied only to playback before the initial seek.
SDES CNAME verbosity override	drop	This was an old-base logging preference with no functional consumer or demonstrated failure mode; restoring ordinary SDES logging removes it from the fork delta.
Non-fragmented MP4 negative CTTS normalization	keep	Constructed multi-track timing tests prove a uniform global presentation shift.
Fragmented MP4 TRUN composition offsets	keep, corrected	TRUN v1 defines signed offsets while v0 defines unsigned offsets. The candidate stored both as uint32_t, turning negative fragmented offsets into huge positive times. Version-aware parsing and round-trip tests now preserve -80 for v1 and 0x80000000 for v0; the unsigned ablation fails exactly.
MP4 incomplete ranged-read retries	keep, split from timing	A loopback HTTP fixture returns three short ranges before a complete response, proving the configured third attempt is required and replaces the partial buffer. A separate policy matrix proves unknown/growing sources may retry while known EOF may not. Retry-count and old-boolean ablations each fail independently; ASan passes.
Stale DTSH page recovery	keep, proved	A real Controller -> MP4 input/output fixture replaces a source while preserving the cached size and mtime, forcing the page contents to disagree with an otherwise accepted sidecar. The first recording is rejected, the stale sidecar is removed, and the next request regenerates metadata and produces a decodable recording with the replacement's 176x144 dimensions. Disabling only the two-failure disk-header recovery path removes the diagnostic and fails the test. The restored path passes normally and under ASan.
Unknown socket-family diagnostic severity	keep	Captured diagnostic test rejects an operational FAIL classification.
Explicit UDP bind family	keep, extracted	Numeric IPv4 interfaces now create native IPv4 sockets. Restoring the forced IPv6/v4-mapped behavior fails the socket-family assertion and makes the real Foghorn relay time out with EINVAL sends on macOS.
Connecting an already-bound UDP socket	keep, extracted	A UDP request/reply test connects the already-bound receiver to its observed peer. The old unconditional second bind() fails with EINVAL; the guarded path passes and removes Foghorn's ignored background-connect failure.
TLS keylog callback routing	keep, rewritten	A shared setup helper couples callback registration to the active TLS object. It passes locally on MbedTLS 3 and in Ubuntu on MbedTLS 2.28; the v2 callback-removal ablation fails at the active-config assertion.
Live EBML timestamp alignment	keep, hardened	A real InputEBML::getNext() test covers buffered and EOF-drained packets, VOD pass-through, server-clock alignment, negative offsets, and spacing. Removing either application point fails its dedicated assertion.
External DTSC upload finalization	keep	A local PUT peer proves Meta::toFile() sends the final zero chunk and waits for the delayed response. The former direct-close path fails before the response can be sent.
Annex-B H.264 initialization	keep, assign to media init	The helper handles mixed three/four-byte start codes and rejects missing/truncated parameter sets. The regression now drives the real metadata setter and checks exact AVCC storage. Disabling only its Annex-B dispatch stores raw start codes as invalid AVCC and fails exactly; normal and ASan builds pass.
Static FFmpeg codec registry	keep, assign to packaging	In an isolated Ubuntu static-fallback build, the unpatched Meson version probe could not see fallback x264 headers, silently disabled CONFIG_LIBX264_ENCODER, and failed the registry test. Applying the committed dependency-aware probe retained x264, linked MistProcAV, and passed the full pinned-codec contract. The contract was renamed because it covers all WITH_AV targets, not only MistProcAV.
Livepeer job-token forwarding	keep, extracted	A pure request builder makes the no-access-token header contract directly testable. Removing only the jobToken mapping fails the opaque-token assertion; the production processor still builds and the restored test passes under ASan.
Dropped avrefactor target separator	drop, amended at origin	The newer fork snapshot had replayed only part of the dropped EFG/avrefactor # convention while current upstream and every internal processor still emitted ?. The three residue blocks were removed from the lifecycle omnibus itself, and all recording/clip fixtures were amended to use ?. Real B-frame MP4, live EBML, ProcAV, ONNX, and Livepeer recordings pass; Livepeer additionally proves audio=none is parsed rather than silently returning a derived AAC track.
Livepeer VOD lifecycle and upload order	keep, hardened	A real loopback broadcaster introduces deterministic external backpressure, completes segment 1 before segment 0, and validates the 320x180 source-resolution header. The final recording remains ordered, decodes cleanly through the processed 29.4-second tail, logs exactly one tail finalization, and retains measured external-processing capacity in ProcState. Removing only the idempotence guard finalizes an overlapping stale segment twice; bypassing the insertion-turn invariant permits premature slot completion. Request-policy tests cover fatal statuses, sustained rejection fallback, deadline timeout/retry settings, and sent-request affinity.
Process-wide config lifecycle state	keep, extracted proof fix	The multi-threaded Livepeer process exposed races on active/restart/type globals. Lock-free atomics remove the shutdown and type races without weakening signal-handler safety. Input and Output components now claim an unset binary type rather than overwriting an explicit PROCESS classification; a forked-process regression proves both standalone claiming and process ownership. The full build and signal-contract suite pass, and Livepeer TSAN no longer reports config-state races.
SIGUSR2 diagnostic fallback	keep, corrected	The candidate accidentally tied the fallback to no-argument construction. A forked-process matrix proves it belongs in Config::activate(), covers both constructors, preserves installed handlers, and does not mask SIGTERM or unrelated signals.
Controller logger shutdown	keep, rewritten	Manual cleanup covered named returns but missed two TLS failures. A scope-owned logger now joins on every return by construction; its destructor ablation terminates on the live thread, while explicit normal-path stop remains ordered before storage teardown.
Capability-probe mutex release	drop	The split commit was invented during reconstruction rather than sourced from the old fork, and its premise is false for the current in-memory-only checkCapable(). Restoring locked evaluation removes a race window and builds cleanly.
Push control API routing	keep, extracted	A pure parser proves the old-fork push_kill and push_reinit wire shapes independently of the controller omnibus. Removing either command family fails its focused assertion; production dispatch builds cleanly.
Input-list capability conversion	keep in preview integration	The dedicated structured conversion path preserves nested field validation. Its focused ablation falls back to str; the local duplicate-case deletion itself is behavior-neutral and only removes a build warning.
Modular player reconciliation	keep in preview integration	Six focused wrapper tests prove live HLS packet-time mapping, seek clamping, stable sliding-window fallback, DASH's native timeline, Video.js 10 display/native element ownership, and ES-module loading. Removing the corresponding bridges fails independently; regenerated bundles are byte-identical.
Foghorn source-embedder and generic SRT receive edits	drop	sourcery.cpp integer/include churn is unrelated to Foghorn. RecvNow() already switches to blocking for the call and restores the prior state; permanently forcing blocking and deleting the exceptional zero-read backoff adds no Foghorn capability and risks a busy loop. Both files are restored to the new upstream base before protocol testing.
Foghorn packet codecs and relay traversal	keep, hardened	Unit and process-level tests prove announcement/request/instruction parsing, discovery, pagination, protocol matching, publisher/client instruction exchange, and opaque payload forwarding. Individual encoding, publish-timing, startup-flag, catalog-framing, pagination, and socket-family ablations fail their intended assertions. The complete path passes under ASan and TSAN.
Foghorn port-scan skeleton	drop	Packet type 6 was only logged and never emitted; type 7 accumulated results in an unbounded map whose portResult values were never read. The range-selection helper itself contained dead, incorrect arithmetic. Removing the disconnected skeleton changes no supported path.
Foghorn SRT punched-socket handoff	keep, rebuilt	The old constructor only set rendezvous mode and returned an acquired socket; the newer upstream connect() always reopens the socket, so the blended input/output call sites silently discarded the punched descriptor. A dedicated constructor now configures, acquires, and connects the existing UDP descriptor atomically, preserves input/output direction, and releases descriptor ownership from the UDP wrapper. A two-process Linux test uses the SRT-required same port on separate host addresses and transfers an exact TS payload through Mist's wrappers. Reopening the socket, omitting symmetric rendezvous sender configuration, retaining duplicate descriptor ownership, or sampling statistics immediately after the first nonblocking send each fails the regression.
Nautophone standalone web proxy	drop	No build, install, package, or top-level documentation references the three-file developer artifact. Successful requests never close their UDP socket; responses and logs expose the Foghorn passphrase; wildcard CORS turns it into an unauthenticated HTTP-to-arbitrary-UDP proxy; favicon requests never end; and its advertised IPv6 support still creates only udp4. Those are functional defects independent of current monorepo usage, so the unsupported proxy is removed while MistUtilFoghorn remains the proved diagnostic utility.
B-frame clip-tail preservation	keep	A permanent real-process regression proves exact AV and video-only cuts: 76 encoded samples retain the decode-tail reference while producing precisely 75 expected visible hashes over 3.000 seconds. Limiter, drain, edit-list, bounded-order, and post-seek reset ablations each fail for a distinct boundary defect.
MP4 cross-track mismatch guard	keep, fail closed	A deliberately shorter audio track makes the generic reader outrun the bounded MP4 sample table. The guard reports Inconsistent MP4 input before cross-writing; disabling it produces repeated invalid H.264 NAL units. Failed direct file outputs now return nonzero, remove their non-append local partial artifact, and publish FORMAT_SPECIFIC plus the human-readable reason through RECORDING_END.
Process-controlled producer EOF state machine	keep, hardened	Pure policy tests plus InputBuffer::userLeadOut() integration prove pre-start, active, consumer-draining, final drain, sticky shutdown, resume-feeder, ordinary-resume, and ordinary-stop transitions. Reverting resume-feeder handling fails both policy and integration tests.
Processing drain consumer accounting	keep, corrected	The former connectedUsers > sourceUsers.size() inference mixes tracked users with source registrations and is invalid when sources carry DONOTTRACK. Explicit non-source consumer counting is tested through the real buffer transition; restoring the inferred count skips WAIT and fails exactly.
Process-only output drain gating	keep, corrected	Shutdown/offline drain acceleration is now gated by both live mode and process_controlled_realtime; the former code silently changed ordinary live output timing because it only checked live status. The ungated ablation fails the non-processing shutdown assertion.
Processing lookahead and EBML tail release	keep, hardened	Decision tables prove lookahead remains enforced before producer EOF, original tracks drain after their source ends, derived tracks wait for processor completion, and exhausted tracks cannot be silently auto-reselected. A real eight-second, two-B-frame ProcAV recording completes before the old 25-second data timeout, emits exactly all 200 source frames from 0.000 through 8.000 seconds, starts on a keyframe, decodes cleanly, and reaches SSIM 0.98 or better. The former state lost the last packet, could duplicate a drained track through auto-selection, and reported an 8 ms drain while actually waiting for the timeout. The restored path and shared-state bounds tests pass normally and under ASan.
Image-aware generic video selection	keep, extracted	A focused metadata fixture proves generic resolution/bitrate video selectors do not accidentally choose JPEG/PNG still-image tracks, while explicit JPEG and PNG selectors continue to work. Removing only the image exclusion selects the highest-resolution JPEG and fails exactly.
Thumbnail codec and publication matrix	keep, hardened	Real H.264, AV1, and JPEG sources traverse MP4 or EBML input, Buffer, and the advertised thumbnail decoder paths. The 200-frame H.264 B-frame asset is consumed at only its six IDR packets: resetting and draining each independent access point preserves all six presentation-time cues without decoding 194 inter-frames. The configured interval coalesces those keyframes into two sprite encodes, complete artifact sets are staged before per-file atomic replacement, triggers fire only after successful publication, and finite buffered sources force one final generation. Exact geometry, VTT cells, GET/HEAD/push delivery, trigger payloads, cleanup, bounds, and failure diagnostics are automated; decoder, interval, and publisher-validation ablations fail. JPEG proves the stable completed-artifact contract but intentionally skips live HTTP attachment because its six-frame source has already torn down by then.
JPEGReceiver raw-camera ingest	keep, hardened and separated	This originated on the older dev_reverse_MJPEG preview (089fd468b and follow-ups), not in thumbnail processing. The old marker parser understood only a narrow APP subset, trusted malformed lengths, and a real 10 fps source yielded only seven packets during a three-second recording. A bounded marker-aware scanner now handles arbitrary length-coded markers, APP14 payloads containing false EOI bytes, entropy stuffing, restart markers, progressive scans, fragmented and concatenated frames, malformed-prefix resynchronization, and oversized input. Real 4:2:0 and 4:2:2 camera fixtures each produce at least 30 distinct, decoder-clean H.264 frames with the configured GOP and a keyframe first packet. The connector publishes AVCC only after actual SPS/PPS arrive; restoring its former empty init fails on the production Invalid H264 init data received diagnostic. Rejecting APP14 fails the framing unit, while ASan covers the scanner and connector build. Speculative repeated socket reads, explicit libx264 preference, decoded-frame flag/PTS changes, and encoder tuning changes all passed ablation and were removed.
JPEGReceiver minimum-FPS frame synthesis	drop	The option used function-static state shared by connections and depended on sparse request-loop wakeups to duplicate frames, so it could not uphold its advertised minimum rate. It also performed extra H.264 encodes without new camera input. The connector now has the honest one-JPEG-in/one-H.264-frame contract; the real 10 fps fixtures prove complete sequences without synthetic decoding or encoding work.
Invalid H.264 initialization hex logger	drop	The only caller supplemented an existing warning by copying the complete invalid blob into log output. It had no consumer, emitted an empty first log line, and sign-extended bytes above 0x7f; the existing generic hex dumper is sufficient when an explicit diagnostic is needed. Removing this preview residue leaves the production Annex-B conversion regression green normally and under ASan.
Asynchronous trigger UUID generation	keep, corrected upstream defect	The real RECORDING_END integration exposed an existing upstream stack-buffer overread: generateUUID() consumed one random byte for each of 32 hex digits from a 16-byte buffer. UUIDs now encode both nibbles of each byte, preserve RFC 4122 version/variant bits, and pass a 1024-sample format/uniqueness test under ASan; the old implementation fails ASan in the actual asynchronous trigger path.
Process supervisor exits and restart suppression	keep, hardened	The exact nine-line PROCESS_EXIT status/payload contract and every restart status are unit-tested, while the real ProcAV recording captures a clean process exit. The fixture deliberately uses fixed restart policy: the former status-only guard restarted ProcAV after source EOF, held the recording for 34 seconds, and ended through SHM loss. The supervisor now also consumes the explicit source-EOF marker. A two-child production-path test exposed iterator invalidation that could skip one of several removed processes; both removals now complete in one reconciliation. Normal and ASan runs pass.
Generic inactive-output classification as clean	drop	is_active is set false by many output-specific error paths, so globally converting an otherwise unknown exit into CLEAN_INTENDED_STOP can mask failures. Successful EOF recordings already publish their earlier CLEAN_EOF reason. The generic fallback is restored to upstream UNKNOWN; callers that know a stop is intentional must publish that reason at the source.
Unreachable no-valid-track supervisor reason	drop	checkProcesses() returns before process reconciliation when metadata has no valid tracks, so the inner branch and its claimed stop attribution could never execute. It was removed rather than documented as supported behavior.
Packet and Livepeer segment drop diagnostics	keep, hardened	Live ingest still drops packets under the same three existing conditions, but loss is promoted from silent/debug output to a per-track warning no more than once per ten seconds. The limiter now treats boot time zero as a valid first timestamp and resets safely after clock rollback; restoring the original zero-sentinel implementation fails the focused test. Livepeer's fully-consumed/no-packet segment condition is production-shared with a decision test, and suppressing its diagnostic predicate fails exactly. Normal and ASan tests pass and both production targets build.
Structured processing rate diagnostics	keep, simplified	InputBuffer continues to aggregate every processor's bounded speed, slowdown, lockout, and stale-hold ticks into the versioned stream-state snapshot consumed by RECORDING_END; production-used accumulation tests cover every field. The parallel text-only per-PID map and periodic/final log summaries were removed because no consumer parsed them and one entry leaked for every restarted PID on long-running streams.
Output lookahead stall diagnostics	keep, hardened	The track-specific five-second warning exposed the real 25-second EOF-tail stall during this audit. Its three ad hoc fields are now a production-used state machine with tests for initial silence, cadence, gating-track switches, clearing, and monotonic-clock rollback. Suppressing the due signal fails exactly; normal and ASan tests pass and MistOutEBML builds.
Input startup exit reasons	keep, proved	Real MistInBuffer/MistInRawGenerator tests exercise all three added call sites: an already-online singular stream, a failed singular buffer launch, and a failed non-singular/live push-buffer launch. Each retains READ_START_FAILURE and its specific message through exitAndLogReason() instead of closing with an empty reason. Removing the calls fails the exact assertion; restored code passes normally and under ASan.
Live EBML cluster finalization	keep	A real Controller/input/buffer/output pipeline proves duration-bound live Matroska recordings decode cleanly with their deterministic 76 video/141 audio packets. Final-flush, live-cluster-buffering, and composition-offset ablations respectively truncate the tail, prematurely terminate the file, and create non-monotonic DTS. A policy test separately preserves live layout across source metadata shutdown only for file recordings that actually began live.
Recording output expectation publication	keep, hardened	The real InputBuffer count/publication path now has tests for AV, FFmpeg, per-profile Livepeer outputs, retired/hard-failed processes, another-stream sinks, malformed/non-gating processes, and output validity masks. Viewer-only AV, processing-only ONNX, and default raw AV intermediates no longer hold a file recording open; push-visible outputs still count. Removing the visibility filter fails the exact assertion.
Recording output/header readiness gate	keep, extracted	Production-used policy tests prove the unresolved boot window, stream-wide process output count, selected original/output data readiness, narrow selections, shutdown release, and the requirement to hold both initial seek and first header. A real process-controlled AV recording visibly waits for its late output, then finalizes one audio and one video track whose first processed packet is a keyframe and whose four-second packet interval decodes without diagnostics. Contract, count, selection, shutdown, wait, and initial-packet ablations fail independently; normal, ASan, and TSAN policy/lifecycle tests pass and MP4/EBML/ProcAV targets build.
ProcAV timestamp-zero output	keep, corrected	New ProcAV output tracks use zero as the sentinel for “no resume point”; the old unconditional thisTime <= resumeFrom check therefore discarded their first encoded packet. With a long GOP this leaves the live page without a keyframe and the recording without its processed video. The real-process regression fails with the exact page 0 not starting with a keyframe diagnostic when the guard is reverted. A separate ablation restored ProcAV's upstream forced-P encoder request and still passed, proving that proposed frame-type change was unnecessary and should not enter the fork.
ONNX recording readiness integration	keep, added during preview blend	The old local readiness gate predated ONNX and ignored its lazily created tracks, allowing an MKV header to be written before AI output existed. ProcState v4 now carries a process-authored output count and coarse input modality. MistProcONNX publishes the contract only after its model/mode has resolved: vision reports one result plus optional annotated MJPEG, while audio and tensor always report one output even if the irrelevant annotated_video option is present. InputBuffer leaves recording readiness unresolved during startup and then consumes the exact PID-scoped contract instead of guessing from config; ONNX outputs intentionally masked for processing-only chains are excluded before contract resolution so they cannot deadlock a recorder that may not select them. A selector aimed at a configured AV/FFmpeg intermediate now remains pending until that track exists. Reinstating the guess, suppressing publication, allowing periodic pressure updates to erase the contract, counting mask-invisible outputs, or ignoring configured intermediates each fails its focused assertion. The model-backed AV -> ONNX recording test starts the recorder before ONNX is ready and proves the final MKV has complete A/V and JSON tails.
ONNX processing capacity and exit publication	keep, added as fork adaptation	MistProcONNX now publishes the same versioned PID-scoped ProcState contract used by the fork's adaptive VOD feeder, while retaining its existing controller JSON. A modality-aware policy distinguishes tensor queue saturation, audio-buffer drops, genuine vision overload, intentional latest-frame replacement at a satisfied inference cap, and source starvation. It derives achieved input/output speed separately from sustainable media-time/work capacity, retains the last measured capacity across idle samples, reports the actual execution-provider resource, publishes the resolved modality/output-track contract, and persists startup/thread failure reasons through ProcExitState. The policy and shared-page writer have focused tests; source-starvation, dropped-audio, intentional-rate-limit, output-publication, and output-retention ablations fail exactly. The real model-backed test resolves the actual ONNX child PID and validates its live shared page: versioned snapshot, phase, provider resource, modality, output count, measured capacity, recommended feed, completed work, and update clock. Normal, ASan, and TSAN tests pass, and the full MistProcONNX target builds and serves its capability JSON.
ONNX producer-EOF output drain	keep, added as fork adaptation	Source EOF now stops source consumption and inference but leaves the sink alive until the processing thread has published its final output and every tensor, ordered metadata, latest metadata, and annotated-frame slot is empty. The former main-thread shutdown deactivated the sink immediately and could discard vision/tensor tails; audio alone had a bespoke late-drain loop. A lifecycle decision table covers producer-active waiting, post-processing drain, completed drain, and external sink failure; removing the queued-tail clause fails exactly. A permanent opt-in model-backed integration now feeds 30 seconds of H.264/AAC through AV -> NV12 -> ONNX while recording the first eight seconds; the result decodes silently, contains one video/audio stream and an M_JSON track, carries at least 20 inference results, and reaches the complete A/V and metadata tails.
ONNX dependency closure	keep, build hardening	ONNX_STATIC=true previously accepted Homebrew OpenCV 5 archives whose pkg-config file has an empty Libs.private, then failed at final link on TIFF/WebP/PNG/OpenJPEG/LAPACK symbols. Meson links both an ONNX Runtime C-API probe and an imgcodecs/Kalman probe. An explicitly enabled static build now fails at configuration when either closure is incomplete; auto-detection may fall back only OpenCV to a complete shared dependency. The locked dependency builder retains a verified monolithic static ONNX Runtime path for development, while Linux CPU release artifacts consume Microsoft's checksum-pinned architecture-specific shared runtimes and package an audited executable-relative closure. Accelerator profiles retain their provider-specific shared closure.
HLS remap tolerance narrowed from (interval + 5) * 60	drop	Stale-base regression; restored current upstream tolerance.
fillPacket() packet-count return	drop	Every caller ignored it; no behavior depended on the count.
high-volume liveSeek log	drop	Diagnostic residue with no functional consumer.
negative MPEG-TS PES composition-offset clamp	drop	PES permits distinct PTS/DTS for reordered video; a regression proves negative offsets remain representable instead of being collapsed to zero.
SegmentReader's second same-branch finish() removal	drop	It did not make finalization one-shot and had no output effect: the first call consumes the pending PES before the immediate second call.
HTTPTS sendTS() recording pacing override	drop	Shared recording initialization already selects uncapped output before sendTS() unless the caller explicitly requests real-time pacing.

Current MPEG-TS work

• Extracted the complete PID assignment policy into a testable helper and proved explicit mapping, per-media ranges, fallback allocation, PCR PID, and PMT elementary PIDs. Removing custom mapping fails the exact assertions.
• Restored EOF final-PES flushing in InputTS::postHeader() and bounded the loop at EOF. A generated one-PES fixture proves the packet is absent without finish() and present with it.
• Rejected the negative PES-offset clamp and added a timestamp-level regression proving reordered PTS/DTS remains encoded.
• Proved HLS playlist-entry synchronization with a rotation test. The unchecked ablation throws on a removed entry; the lock-free ablation produces a torn segment snapshot under the concurrent writer. The synchronized version also passes under ThreadSanitizer.

Current processing/VOD decomposition

The 520778119 subject hides multiple old-fork topic lines. They are being audited as independent behavior groups rather than accepted as a single feature:

Behavior group	Main old-fork origins	Audit state
Proc contract ABI, adaptive feed rate, and exit severity	de7e683df, 150c89477, 500cc98b8, 51c613a46	Contract/rate/exit behavior, Controller node-pressure publication, ONNX process publication, the real shared-page ABI, and InputBuffer's structured cross-process rate aggregation are proved. The redundant unbounded per-PID text summary was removed.
ONNX fork processing contract adaptation	7c3495ec7, af77f29c5, fceec7a7d, 51375f568, cd2588a15, 89ebc321d above rebased ONNX preview	Modality-aware capacity/pressure derivation, shared-page publication, provider resource mapping, exact process-authored output expectations, chained intermediate discovery, startup feed gating with clock compensation, durable startup/thread exit reasons, producer-EOF output drain, static-dependency validation, and model-backed end-to-end tail recording are proved. These remain fork adaptation commits, not edits folded invisibly into the upstream ONNX preview squash.
Producer EOF, realtime recording drain, and completed resume drain	1a83c166f, 9403dfc07, b618d1325	State/policy and actual InputBuffer transitions proved under normal, ASan, and TSAN builds. Ordinary live EBML file finalization and process-controlled ONNX and ProcAV recordings now have end-to-end decode/probe coverage.
ProcAV/Livepeer drain and startup sequencing	2dc1f6691, a01a4fa5e, e55f89c7a; amended Livepeer commit 1de1b3cbe; concurrency/policy commit 00168fa2f	ProcAV late-track startup, processor-only input EOF recognition, complete encoded tail, and B-frame presentation origin/order are proved through real MP4-to-EBML recordings. Livepeer startup, internal source selection, one-shot EOF finalization, delayed and deliberately out-of-order external processing, ordered output drain, recording tail, source dimensions, request policy, shared state, capacity publication, and deterministic thread join are proved.
Recording output/track readiness	383b85a41, db885cd64, edb9fe39e, b8b8bfd5f	InputBuffer expectation count, retirement, sink routing, validity-mask filtering, ONNX integration, SHM publication, Output's pre-seek/header gate, and a real late-track AV recording are proved.
Supervisor, rate, packet, and stale-page diagnostics	4919d1826, 37e9f9d4d, c711e3cef, d041e529d, 8baaa6f26	Stale-DTSH recovery, recording speed/drain payloads, structured rate aggregation, bounded lookahead-stall reporting, specific input startup reasons, supervisor exit attribution, multi-process removal, source-EOF restart suppression, packet-drop warning limits, and empty Livepeer-segment detection are proved by real process tests and focused ablations. The audit fixed a real 34-second respawn/drain failure, invalid iteration, boot-time-zero and clock-rollback limiter holes, and removed unbounded per-PID text aggregation. Unsupported unconditional child debug propagation, the local pre-stat shortcut, generic clean-output classification, and an unreachable no-track reason were restored/removed. This historical diagnostic group is closed.
Offline state and typed trigger routing	f9a68c547, 36ee9a71f, ed6d6797e, 68f8deffc	Assigned to 1779b3c12, 9255f7347, and 1a5870929; do not leave copies in the VOD commit.
Thumbnail/image selection and EBML recording assembly	97a66b09a, 1a83c166f	Assigned to 88174ac2b and 2d04becfe; do not leave copies in the VOD commit.
B-frame boundary experiments	3db7eecf5, 262a6e695, 195c3d504	Excluded from this group; tracked only under 002be4ab0.

Cross-cutting follow-ups discovered during proof

• Two proposed generic Output changes were rejected during the ONNX integration audit. Requiring a separately computed selection-stability flag and exempting every process-controlled growing VOD from tail waits each passed four model-backed runs after the actual chain/feed fixes were present. Existing valid-data snapshots and selected-output readiness already provide the former guarantee; the latter had merely hidden startup clock/feed defects. Both hunks were removed.

• ProcAV EOF ablation rejected four compensating changes: changing the terminal drain comparison, adding a second terminal-packet escape, tracking a separate source-thread-active flag, and relaxing decoder/encoder flush loops all remained green after removal. The retained PROCESS-only WAIT-state EOF rule fails by losing the processing output contract when removed. Removing decoded PTS/DTS propagation and presentation-clock anchoring shifts the output origin from 0 to 80 ms on a two-B-frame MP4; the restored path emits all 200 frames from 0 through 8 seconds at 0.994 SSIM.

• MP4's internal mismatch guard and external rejection contract have permanent coverage. A failed direct file target returns nonzero, removes its non-append local partial artifact, and reports its machine- and human-readable reasons through RECORDING_END.

• A binary has_bframes diagnostic would be too coarse: ordinary reorder depth two is now proved clip-safe. If metadata/UI exposure is still needed, derive an operational value such as maximum presentation lead/tail or required decode preroll, and tie it to a demonstrated unsupported cut shape rather than rejecting all reordered video.

Final acceptance gate

All six acceptance gates are satisfied:

1. All 32 original local commits are proved or dropped: 29 proved, 3 dropped, with no pending or partial rows.
2. Every retained behavior is reconstructed with its regression in a narrowly scoped commit.
3. CMAF, NDI/camera/UI, and ONNX remain three independently replaceable preview squash commits.
4. The full build, unit suite, sanitizers, and VOD/live seek/clip/record matrix pass.
5. The final source tree is byte-identical to the audited proof tree, and every intentionally omitted old delta is accounted for above.
6. The reviewed rewrite/master-final-clean-20260903 tree has been promoted to local and remote master; the proof and safety branches retain the pre-promotion evidence.

Final validation evidence

• Ubuntu 24.04 GCC coverage build: all 806 Ninja actions completed with libav enabled, NDI compiled, and ONVIF enabled.
• Meson compatibility floor: a fresh configuration succeeds with Meson 1.6.1 and discovers the same NDI/ONVIF feature set.
• Ubuntu Clang AddressSanitizer build: all 804 Ninja actions completed; 183 tests passed, one intentional expected-failure passed as expected, and there were zero failures or skips with leak, initialization-order, stack-use-after-return, and strict string checks enabled.
• Complete opt-in media matrix: 196 tests passed, one intentional expected-failure passed as expected, and there were zero failures. This includes reordered H.264 clip boundaries, VOD and live recordings, ProcAV and Livepeer EOF tails, ONNX chaining, H.264/AV1/JPEG thumbnails, JPEGReceiver, and RawGenerator.
• Linux SRT rendezvous: 50 concurrent two-peer repetitions retained distinct sender roles and moved a complete 1316-byte transport packet through the adopted punched sockets.
• Production Dockerfile.mistserver: the Alpine arm64 image completed all 775 build/install actions and produced mistserver-audit:final.
• Locked ONNX CPU dependencies: the static Ubuntu arm64 source-build proof passed all seven ONNX tests, pinned YOLO26n image inference, raw ONNXTENSOR inference, capability/profile checks, and unavailable-provider rejection. The release path now consumes Microsoft's checksum-pinned official AArch64 CPU archive and bundles its shared runtime/OpenCV closure, avoiding that source build while preserving the same provider contract.
• Locked ONNX CoreML dependencies: native macOS arm64 used Microsoft's checksum-pinned ONNX Runtime archive plus the exact shared OpenCV closure and built the full MistServer target set. The staged native bundle resolves those dylibs through an executable-relative rpath without loader environment overrides. Explicit CoreML inference compiled the pinned YOLO26n graph, assigned 353 of 400 nodes to CoreML (the remainder is ORT's normal CPU fallback), and passed image, annotation, raw-tensor, profile, rejection, linkage, and seven-test release gates.
• Production Dockerfile.mistserver-onnx: the Ubuntu arm64 CPU image compiles ONNX, NDI, and ONVIF, advertises only its packaged CPU provider, and contains the locked ONNX Runtime/OpenCV shared closure and notices. The final Dockerfile additionally runs the complete pinned-model ONNX release verifier before installing an image and separates the locked dependency layer from ordinary source edits for caching.
• CUDA, TensorRT, and OpenVINO (Linux amd64) are fail-closed, SDK-bound shared profiles. Ordinary GitHub-hosted CPU runners build digest-pinned, provider-specific full MistServer platform images and verify their compilation, representative stock binaries (including MistProcAV), ONNX unit tests, capability, loader closure, notices, and packaging. Each platform job also exports a native tarball with a machine-readable OS, package, loader, device, and external vendor-runtime contract for preflighted bare-metal edge deployment. macOS arm64 remains a first-class native CoreML target in the main release workflow, with the same full-MistServer and deployment-contract assertions before signing and notarization. Optional labelled hardware runners pull those exact images for provider-load, YOLO26n, and raw-tensor execution evidence; absence of such a runner no longer prevents building or publishing the image. The generic Linux CPU and macOS CoreML artifacts do not silently advertise another provider.
• Shell syntax checks pass for every script under test/ and scripts/.
• The checksum-pinned ONNX Runtime distribution and locked OpenCV prefix remove the previous Homebrew pkg-config ambiguity from the macOS ONNX release path. General media dependencies still use the declared Homebrew release environment.