fix(whip): evaluate the inactivity watchdog per poll tick, not per timeout - #752

The bug

backend/src/blocks/builtin/whip.rs — the WHIP inactivity watchdog slept a full
INACTIVITY_TIMEOUT (10s) and then evaluated idle time exactly once:

let deadline = Instant::now() + INACTIVITY_TIMEOUT;   // fresh 10s every iteration
if wait_until_deadline_or_stop(&cleanup_sent_watchdog, deadline) { break; }

A drop landing just after a check went unnoticed until the next one, so real detection
was 10-20s depending on where the drop fell in the cycle. A production
Inactivity timeout (17s idle) is only possible because of that coarseness — with
continuous evaluation the reported idle can never exceed the threshold by more than one
poll interval.

Why it matters

This watchdog is the only time-driven path that reclaims a WHIP session, and a publisher
that dies without sending a WHIP DELETE — network loss, the common case — reaches no
other one: an abruptly killed peer leaves webrtcbin at completed until consent
freshness expires. Until it fires, the session's isolated pipeline (the libnice #52
workaround) holds its UDP sockets, threads and jitterbuffers; the slot stays occupied, so
a rejoining client gets 503 All session slots are occupied (max_sessions is 1 per
endpoint); and the API keeps reporting a publisher that is gone.

Relationship to the slot-takeover work

A separate change lets a new session displace a slot whose transport is already dead
(whip_ingest.rs allocate_slot). It covers the rejoin case and makes the 503 window
moot, but it is demand-driven and never runs when nobody reconnects — which is where this
watchdog stays the only reclamation path.

Takeover must decide a session is dead and then evict it, and a wrong predicate evicts a
healthy publisher during a transient stall, precisely what the 10s threshold exists to
prevent. That change can misfire; this one cannot, since it only makes an already-correct
teardown happen on schedule. That argues for landing this first.

The fix

Extract the loop into wait_for_inactivity, which re-evaluates idle on every
WATCHDOG_POLL (250ms) tick — a constant that already existed in this file and was used
only to re-check the stop flag inside the wait.

INACTIVITY_TIMEOUT is deliberately unchanged at 10s: it guards against tearing down a
session during a brief network stall. The bug was that 10s silently meant up to 20s.

The log line now reports idle in milliseconds rather than truncated seconds. Nothing
parses that string.

Measured

A headless whipclientsink publisher, SIGKILLed to simulate network loss — a clean
SIGINT sends the WHIP DELETE and frees the slot instantly, which is not the case under
test. Media flow was confirmed by the Pad video_0 ... → appsink → slot 0 appsrc link
line, not by ICE state. Dwell is seconds of streaming before the kill, sweeping the drop
across a full watchdog cycle; the figure is the idle time the watchdog itself reports.

Before is a sawtooth from 19.2s down to 11.2s, wrapping — the production 17s sits on it.
After is flat at 10.06-10.23s, every sample within one WATCHDOG_POLL of the threshold.
Eight consecutive kill/rejoin cycles gave 10006-10197ms with zero 503s, each
re-allocating slot 0.

Tests

watchdog_detects_inactivity_within_one_poll_of_the_timeout calls the real
wait_for_inactivity with the production WATCHDOG_POLL. It is a guard, not a
demonstration — reverting the one-line change and re-running gives:

inactivity took 2.015019458s to detect with a 1s timeout — idle is being
evaluated once per timeout, not once per poll

watchdog_inactivity_wait_gives_up_when_stopped covers the other exit: a teardown path
setting cleanup_sent must end the wait even though the session never went idle,
otherwise the watchdog outlives its session and asks the manager to clean up a port it no
longer knows.

Both are plain std timing with no GStreamer element, so they run in CI under
cargo test --package strom.

Ran: cargo test --package strom (543 lib + all integration tests, passing),
cargo fmt --all, cargo clippy --all-targets, plus the measurements above on macOS.
Not run: the Linux CI matrix.

Scope

Watchdog only — no change to allocate_slot or the session manager, so this stays
independently reviewable from the takeover work.

🤖 Generated with Claude Code