fix(video): give live muxerFailed pump exits a recovery arm

[tschuegy]

Problem

A live pump death with muxerFailed has no recovery arm: handlePumpFinished hits a bare return, shouldHaltLiveProduction returns false for it (so the provider is not even halted), and no host signal fires. The provider keeps serving a frozen playlist, AVPlayer parks on it waiting for buffer that never comes, and the session zombifies until the viewer zaps away.

Field trace (immediately after the rotation death that #340 fixes at its root):

[HLSSegmentProducer] pump finished: reason=muxerFailed packetsRead=39549 packetsWritten=24320 lastError=0
[NativeAVPlayerHost] #7 errorLog ... -12888 - Playlist File unchanged for longer than 1.5 * target duration  (repeats forever)
[LagDiag] clk=483.66 dclk=0.00 tcs=waiting rate=1.00 wait=AVPlayerWaitingToMinimizeStallsReason fwd=2.0 ... (frozen until app exit)

The shouldHaltLiveProduction comment assumed "AE#222 rebuilds into the same provider" — that was doubly false for live:

1. muxerFailed never reaches the AE#222 arm at all (bridged sessions are excluded from the exit-scan, so the reason is never converted).
2. Even the AE#222 arm itself was a silent no-op for live: its live paths returned without doing anything, and the admitted rebuild goes through requestRestart, which bails on the empty live segmentPlan (performRestart's idx < segmentPlan.count guard) — a second zombie path, hit by non-bridged E-AC-3 rotations.

Fix

New handleLiveMuxerFailure: rebuilds the producer in place on the same demuxer and provider at liveContinuationPoint() — finishLiveReopen minus the fresh connection. A reopen is deliberately not used: the socket is healthy (the muxer died, not the connection), and performLiveReopen opens its new connection before closing the old demuxer, which would double-connect against max_connections=1 portals.

• Bounded by progress, not per session: new segments since the last death reset the budget (an hours-long channel legitimately crosses several encoder restarts); three consecutive barren deaths exhaust it.
• On exhaustion (or a producer-build throw): markLiveProductionHalted() — releasing held blocking-reload waiters — and onLiveSourceReset so the host can retune. Same last-resort surface as Rerouted live-ingest session death relands on the known-bad native path: #168 verdict not remembered, no in-engine revive #199's reopen exhaustion.
• Live .needsAudioSampleEntryPrime is routed through the same in-place rebuild (the captured prime is already in sessionAudioMoovPrimeFrame), closing zombie path 2.
• shouldHaltLiveProduction still returns false for both reasons — an eager halt would 503 the very provider the rebuild serves — but the comment now names the owning arm, and both arms halt themselves on budget exhaustion.

Tests

• liveMuxerRebuildDecision extracted as a pure decision and pinned in LiveProductionHaltTests: first death always rebuilds; progress resets the budget; exactly the cap's worth of barren rebuilds, then halt + host retune.
• Existing halt-classification assertions updated with rationale strings naming the new arm.

Root-cause companion: #340 prevents this particular muxer death entirely; this arm is what keeps any future live muxer death from zombifying the session.

🤖 Generated with Claude Code

[superuser404notfound]

Merged. Verified onto current main (the branch was based on 6.15.2): 1689 swift-testing plus 468 XCTest green, tvOS Simulator build clean, and the cap test is load-bearing (flipping cycles < cap to <= fails it on 4 vs 3).

The two diagnoses check out against the source, both of them:

• performRestart really does bail on live at idx < segmentPlan.count with an empty plan, so the admitted AE#222 rebuild consumed its gate and rebuilt nothing. Silent, because the guard returns before it touches anything.
• The in-place rebuild is the right tool rather than a reopen, and liveReopenOutputEndSeconds is what makes it safe: it sets videoTarget = Int64.min and stamps the first tfdt at the continuation point, so wiring onVideoShiftKnown to the rebase handler is required, not incidental. stop() nils the producer under restartLock before it joins the pump, so the producer === failed guard covers the teardown race and there is no lock inversion from the pump thread.

One thing pulled in on top in 513fd83: the reopen ladder directly above handlePumpFinished's new arm has always made the identical decision from an inline copy (continuation point vs the last one, count barren attempts, give up at 3), untested. Both arms now call the shared liveRecoveryBudgetDecision, renamed off the muxer arm since it is no longer only about muxer rebuilds. Same predicate over the same counters, each arm keeps its own counter pair.

Also written down at the decision rather than in either arm: a source that dies after every handful of segments never goes barren and recovers forever. Deliberate, since bounding it needs a rate rather than a counter and an eager cap would kill the long-running channels the progress budget exists for, but worth naming where the next reader will look.

Ships in the next release, together with #340.