merge upstream v1.5.7 (+6 master fixes) and feat: add SRTO_PERIODICNAKGATE (1.5.7+ceralive.2)

[andrescera]

Summary

Release PR for 1.5.7+ceralive.2 (tag srt-v1.5.7+ceralive.2, owner tags after merge). Version, tag and asset names come from the sender repo's docs/evidence/bpc/srt-release.json; nothing was decided or hardcoded here.

Merge as a normal merge (do not squash): the history shape is the upstream v1.5.7 merge commit, then the option commits, then the post-tag fold merge, then this release commit. Two true merge commits must survive.

Upstream merge: Haivision v1.5.7

379d129 is a true two-parent merge of Haivision 899348d ("Change to version 1.5.7") onto 1615b82. It brings:

• KMREQ / encryption-state validation, ACK and DROPREQ validation, FEC bounds checks, bonding BACKUP lifetime (UAF) fix, and sample-tool path validation (6f817b6, fcae571).
• Upstream CI/ABI checker fixes (a13859e).

Conflicts were confined to workflows, encryption test storage and test_main helpers; the fork's SRTO_REORDERFREEZE and deterministic socket teardown merged cleanly and are retained.

The patch: SRTO_PERIODICNAKGATE (opt-in, default off)

Receiver-side bool socket option (SRTO_R_PRE, inherited by accepted sockets, URI periodicnakgate). When on, checkNAKTimer subtracts the m_FreshLoss ranges (packets still inside the packet-count reorder window) from the loss array before building the periodic NAK report, so only losses that have outlived the reorder window are re-reported. On a bonded SRTLA path the periodic report is otherwise dominated by packets that are merely late, and each re-report requests a retransmission that is about to arrive anyway.

• Ports the subtraction hunk of onsmith/srt b5690bc (2026-07-05) without its SRTLAPATCHES build switch; adapted to v1.5.7's FixedArray<int32_t> / one-arg getLossArray, static comparator for C++03.
• Scope: periodic-report gating only. Immediate loss report, unlose, NAK scheduling, LiveCC interval floor and reorder-tolerance decay are untouched. Default-off is byte-for-byte upstream behavior. Independent of SRTO_REORDERFREEZE and SRTO_NAKREPORT.
• Commits: 5bd9a23 (plumbing + URI rows), ca14c8b (behavior), 8f33e0e (+ceralive.1 release: docs, package contract, enum value fix, ABI evidence), c70586b (+ceralive.2 release: fold docs + version bump).
• Docs: docs/CERALIVE-PATCHES.md §2 and AGENTS.md → SANCTIONED CERALIVE PATCHES, including the fork-reserved value band, collision policy and upstream-proposal status (deferred, field-evidence gated).

Post-tag master fixes folded (new in 1.5.7+ceralive.2)

Six Haivision master commits landed after the v1.5.7 tag (899348d). They are folded here as a second true two-parent merge (12426a3, parents 8f33e0e + 1078f2f): built as a linear git cherry-pick -x series onto 899348d, then merged with --no-ff and no strategy flag. Every commit keeps its (cherry picked from commit <full-sha>) trailer, so the original upstream SHAs survive review.

PR	SHA	Files	Why
#3366	922a890	srtcore/buffer_tools.cpp	Potential division by zero in CSndRateEstimator
#3371	73d8cd6	srtcore/buffer_rcv.{cpp,h}, test/test_buffer_rcv.cpp	Potential crash and wrong receive-buffer state from outdated positionals
#3369	8b852eb	srtcore/api.cpp, srtcore/queue.h	Fixes for rough cleanup actions
#3333	abf708d	srtcore/{api,core,group,packet}.cpp, srtcore/packet.h, test/test_bonding.cpp, testing/*, configure-data.tcl, scripts/*	Collection of small detailed fixes and cleanups
#3330	03fae0e	srtcore/core.{cpp,h}, examples/fork-test/*	Simplified socket close on fork cleanup, prevents potential deadlocks
#3351	cae8f62	test/test_file_transmission.cpp	UnitTest: file transmission interrupted by an immediately closed socket

srtcore/srt.h is untouched by all six, so no installed public header moves.

Merge needed no conflict resolution — and that was verified, not assumed

None of the six touch checkNAKTimer, so the // CERALIVE periodic-nak-ttl block and both // CERALIVE reorder-freeze gates are untouched; upstream's core.cpp edits land in unrelated functions. Because nothing was hand-resolved, the result was proven by git patch-id --stable in both directions:

• diff 8f33e0e..12426a3 == diff 899348d..1078f2f (33aa6cd5…) — the merge adds exactly the six upstream commits, nothing more, nothing less.
• diff 1078f2f..12426a3 == diff 899348d..8f33e0e (8b650f79…) — every CeraLive change survives intact.

Deliberately excluded (2 of the 8 commits in range)

PR	SHA	Why excluded
#3380	ff8ab25	Public-header signature change. Deprecates the public UDPSOCKET typedef and retypes srt_bind_acquire's 2nd parameter to SYSSOCKET. Public-API churn with no functional fix → out of scope for a runtime-fork release. Measured, see the control below.
#3355	500b1c8	ABI-lane rewrite. Rewrites shared CI into scripts/workflows/** and rewrites abi.yml itself, which would replace the CeraLive ccache contract and the pinned SRT_BASE: srt-v1.5.6+ceralive.1. A CI decision, not a source fix; must not ride along in a source release.

The exclusion is verified exactly, not by omission: the fold tip differs from upstream cae8f62 by precisely 500b1c8's patch-id (f66a5c1a…), and git diff --stat over srtcore/ test/ apps/ common/ haicrypt/ examples/ testing/ CMakeLists.txt between them is empty — zero source drift.

Falsifiability control for the #3380 exclusion

ff8ab25 was cherry-picked onto a throwaway branch and run through the identical ABI procedure. Result, recorded as measured rather than as predicted:

Binary compatibility: 100%   Source compatibility: 100%
Total binary compatibility problems: 0, warnings: 2     (the fold: warnings: 0)
ABI_CHECKER_EXIT=0

Two Low-severity symbol problems — srt_bind_acquire (srt.h) and UDT::bind2 (udt.h), "Type of 2nd parameter has been changed from UDPSOCKET to SYSSOCKET… may indicate a change in its semantic meaning". On Linux both typedefs are int, so binary compatibility stays 100% and the checker exits 0.

So #3380 would not have failed the lane. It is excluded as out-of-scope public-API churn, not as an ABI break — the "would break ABI" framing is withdrawn, and the fold without it is strictly cleaner (warnings: 0 vs 2). Throwaway branch deleted after the run.

Test evidence

• test/test_socket_options.cpp: PeriodicNakGateDefaultOff, SetGetRoundTrip, RefusedAfterConnect, IndependentOfReorderFreezeAndNakReport (all 8 bool combinations).
• test/test_periodic_nak_gate.cpp Wire/PeriodicNakGate.ReorderingAndGenuineLoss/{false,true}: 200 ordered packets, stransmit crashes within minutes of running on Windows Haivision/srt#100 held >400 ms behind exactly 40 overtaking packets, Adopt an official code of conduct policy Haivision/srt#150 and all its retransmissions dropped. Option on: zero premature NAKs for stransmit crashes within minutes of running on Windows Haivision/srt#100. Option off (control): 4 premature NAKs. Both arms: genuine loss Adopt an official code of conduct policy Haivision/srt#150 expires and is still periodically re-reported. Flake-guarded 20x (120 executions, 0 failures).
• Full ctest: 301/301 enabled tests pass of 302 registered (1 pre-existing disabled CTimer.SleeptoAccuracy), 245 s, run in an isolated netns because the sandbox host fails 11 bind/reuse cases regardless of source state. The fold adds exactly two tests over +ceralive.1's 300 — CRcvBufferReadMsg.SmallNonOrderReadBuffer ([core][test] Fixed potential crash and wrong buffer state through outdated positionals Haivision/srt#3371) and Transmission.FileUploadInterrupted (Added UnitTest for file transmission - interrupted reading with immediately closed socket Haivision/srt#3351); none removed. ctest -R PeriodicNakGate: 6/6, including the option-off premature-NAK control arm.
• codespell 2.4.3: clean.
• Package: packaging/package-contract.sh OK (1.5.7+ceralive.2 / Provides (= 1.5.7)); the .deb build + verify-runtime-replacement.sh was validated in debian:bookworm at +ceralive.1 and the packaging delta since is the version string only. The contract also asserts deb prefix == Provides == CMake SRT_VERSION.

ABI result (baseline unchanged: srt-v1.5.6+ceralive.1)

Re-ran the abi.yml procedure (Debug, BONDING/PKTINFO/MAXREXMITBW, abi-dumper 1.2, abi-compliance-checker 2.3, public installed headers) in Ubuntu 24.04 against the baseline tag; baseline dump hash identical to the one used for the merge decision.

• First candidate (SRTO_PERIODICNAKGATE = 121): FAIL, 97.2% binary, one Medium problem: SRTO_E_SIZE moved 121 → 122 (the auto-valued public sentinel). The new member itself was "No effect".
• Fix in the option, not the lane: SRTO_PERIODICNAKGATE = 119, placed below the frozen band top SRTO_REORDERFREEZE = 120, so SRTO_E_SIZE stays 121. Fork options are now allocated downward (111-120), which keeps the sentinel fixed for every future fork option.
• Result: 100% binary / 100% source, 0 problems, 0 warnings, checker exit 0. Only "other change": member added with value 119, no effect.
• Re-run on the fold (12426a3): still 100% / 100%, 0 problems, 0 warnings, exit 0. Baseline dump hash identical to the earlier runs (1756e5be…), so the comparison target is provably unchanged. The only reported change remains our own SRTO_PERIODICNAKGATE = 119 ("No effect") — the six folded commits add zero ABI surface, which is what srt.h being untouched predicts.

abi.yml's SRT_BASE was NOT advanced and the lane was NOT silenced; advancing to srt-v1.5.7+ceralive.2 is a separate PR after the owner publishes the tag.

Owner actions after merge

1. Tag srt-v1.5.7+ceralive.2 on the merge result.
2. Run publish-release.yml (default version already 1.5.7+ceralive.2) to produce libsrt1.5-ceralive_1.5.7+ceralive.2_{amd64,arm64}.deb.
3. Separately, advance abi.yml SRT_BASE to the new tag.

[andrescera]

Closed unmerged: superseded by feat/srtla-options-1.5.7 (reset-to-master + minimal re-implementation, plan upstream-rebase-hard-fork). Branch retained as reference.