Measure selected-zone UDP payload reachability before streaming

[zortos293]

Summary

Adds a default-off Network test control to the Qt desktop and console settings. The Rust core allocates the vendor network-test session and signs bounded UDP probes with its provisioned HMAC key. The probe validates the reply's source, session, requested size and received length. The vendor MTUPONG reply is unsigned and does not echo the sequence number.

A confirmed result can reduce the existing conservative NVST packet size. Missing keys, unsupported allocation data, cancellation, timeouts and unmeasured paths keep the existing packet policy. The allocation profile uses the same frame-rate resolver as session creation, including the capability and entitlement gates from #968.

Bounds and verification

Allocation reads are capped at 4 MiB with an eight-second timeout. UDP probing has a 400 ms budget and at most 12 probes. The receive timeout is recomputed for each receive, so foreign traffic cannot extend the deadline. Keys are excluded from returned session data and diagnostics.

Independent checks on the final frozen tree:

• cargo test --locked --manifest-path native/opennow-core/Cargo.toml: 468 passed, 4 ignored.
• Bundled-FFmpeg streamer workspace: 684 passed, 15 ignored. The final cleanup did not alter those native source files.
• Locked strict Clippy and formatting passed.
• env -u LD_LIBRARY_PATH -u LD_PRELOAD python3 -m unittest discover -s opennow-qt/tests -p 'test_*.py': 158 passed. The packaging fixtures need their own test libraries rather than the development Qt library path.
• npm run locales:check passed.
• Debug Qt build and five focused network/FPS acceptance tests passed.
• ctest --test-dir build/opennow-qt --no-tests=error --output-on-failure: 342/342 passed.
• The published 15-file tree was checked against its final checkpoint byte-for-byte.

Limits

This measures selected-zone UDP payload reachability, not proven IP path MTU. Server-side IPv4 DF configuration is not established. No authenticated vendor session or live network measurement was exercised; protocol and allocation paths were tested with local fixtures. A zone without a provisioned HMAC key remains unavailable. An unused network-test allocation relies on server expiry because no cleanup endpoint is evidenced.

Rendered acceptance fixture

Dependency

Base: capy/enable-capability-gated-360-fps at b470c330c59d411ad18eb03b5a629d0f8e920896. Land #968 and its parents first, then revalidate the integrated stack.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: bda65db0-6768-458a-9516-019b9f19f102

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[capy-ai]

Reconciled with actual dev through #970 using normal merge commits, with no rebase or force-push. Published head is afb2b499bb1b029dfcfea3d87d1d7e471d47bbab.

Independent parent verification on this exact source passed: 624 core tests with 4 ignored, 777 bundled-native tests with 16 ignored, strict Clippy for both workspaces, and formatting checks. The native test and Clippy commands explicitly used --features linux-ffmpeg-bundled. Worker verification additionally passed the full 350-test Qt suite, both network and bandwidth acceptance cases, 158 contracts, and localization checks.

Reviewed conflict resolutions preserve network, bandwidth, and store-launch resources/routes and all three measured-path/dynamic-quality ANNOUNCE tests. The diff against dev remains the original 15-file network slice. Compared with the independently reconstructed full non-Sony target, differences are limited to ordering of unchanged tests/helpers, resources/registrations, and acceptance-fixture flags. Required CI on this new head must pass before merge.

This remains selected-zone UDP payload reachability, not IP PMTU. No authenticated or live-server qualification is claimed.

[capy-ai]

The new Windows run exposed a real bug in confirm_datagram, not a flaky timing assertion. stale_replies_for_another_size_are_ignored receives the deliberately larger stale datagram into a size + 4 buffer. Winsock returns WSAEMSGSIZE for that truncation, and the current error branch abandons the attempt before the valid reply. Linux truncates the datagram instead, which hid the bug there.

The fix will receive into the existing bounded 64 KiB message limit, then keep the current source/session/size correlation and absolute probe deadline. The existing regression and its expected result remain unchanged. Merge stays blocked until the corrected head passes Windows CI.