media/03-transport

[SunkenInTime]

Stack: 03/05

What becomes usable

• Widgets can declare capabilities: ["media-transport"] and call
  useMediaTransport() for play, pause, next, previous, and absolute seek.
• The existing per-widget provider endpoint is duplex on Windows and macOS,
  with separate bounded frame and acknowledgement lanes in the runtime.
• Windows dispatches commands through SMTC and returns the frozen
  Promise<boolean> semantics.
• weaver check follows the SDK symbol through aliases, namespace imports,
  and helper modules; manifests and pack/install audit output carry the
  declared capability.
• examples/now-playing proves the real play/pause loop.

Deliberately missing

• The macOS MediaRemote adapter remains spike-gated for layer 04. The duplex
  plumbing exists here, but valid macOS commands honestly acknowledge
  false.
• The noro-shell provider wiring, click-to-seek control, performance report,
  and side-by-side visual gate remain layer 05.
• Drag-to-seek is out of scope; layer 05 requires click-to-seek only.

Verification

• npm test ? PASS, 63/63.
• npm run typecheck ? PASS.
• node cli/bin/weaver.js check examples/now-playing ? PASS.
• runtime: zig build test -Dweb-layer=exclude -Dtrace=off ? PASS with Zig
  0.16.0.
• host: zig build test ? PASS with Zig 0.16.0.
• runtime: zig build -Dweb-layer=exclude -Dtrace=off ? PASS.
• host: zig build ? PASS.
• Real Spotify: play, pause, next, previous, and seek all resolved true;
  next/previous changed tracks, and seek reached 129 s for a 128 s target.

The live gate exposed a synchronous duplex deadlock on the first provider
write. Both Windows pipe handles now use overlapped I/O while retaining one
blocking reader thread and one host-loop writer. Host/runtime partial-line
tests cover the repaired framing path.

Performance

Performance claim deliberately declined. Transport adds one bounded reader
thread to each widget with a provider endpoint. It adds no transport polling
loop; commands and acknowledgements are request-driven.

Visual gate

PASS. The committed example was launched on the desktop layer; other windows
were minimized; the actual widget region was captured with
System.Drawing.CopyFromScreen; every accepted PNG was reopened and viewed.
The per-element checklist and verb evidence are in
docs/media-evidence/pr03-visual.md, including:

• docs/media-evidence/pr03-now-playing-live.png
• docs/media-evidence/pr03-now-playing-paused.png
• docs/media-evidence/pr03-now-playing-final-paused.png
• docs/media-evidence/pr03-verb-next.png
• docs/media-evidence/pr03-verb-previous-track.png
• docs/media-evidence/pr03-verb-seek.png

Adversarial review update (2026-07-25)

This layer now owns F1/F2/F3/F4/F10/F11/F12: both endpoints authenticate the launched child PID; all command/runtime readers reject EOF residuals; transport-only widgets remain idle-zero; ack arrival wakes the app loop; the deadline is an exact one-shot 3000 ms; acks are keyed by pending ID; the nine-slot nack bound is proven; SDK detection is forced/symbol-based through aliases; endpoint writes and Windows OS calls are bounded and isolated from supervision.

Mandatory adversarial tests cover Windows and macOS PID hijack, command/ack EOF residuals, hostile bursts, late-ack rollover, exact timeout, transport-only idle, hostile tsconfig mapping, and const aliases. Final owning-layer gates: npm 63/63, typecheck, all 18 examples through weaver check, runtime/host zig build test, and direct macOS reader semantic compiles ? PASS.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c479f246-5597-420c-9f81-368018b66bc3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch media/03-transport

---

_{Comment @coderabbitai help to get the list of available commands.}