fix(app): improve capture selection and media recovery (#433)

## Problem and outcome / 问题与结果

This maintenance phase fixes failures around native capture startup, room reconnection and media handoffs. Capture mutations stay cancellable, relayed-content failures remain request-scoped, and failed media connections return to the existing route controller. Windows Auto codec selection measures delivered cadence instead of timer-sensitive per-frame work estimates.

The phase preserves P2P-first routing, one committed graph and one route operation. It adds no signaling replay mechanism, changes no wire/schema version, and includes no interaction prototype or 4K feature work.

## Release notes

### 中文

Piik v1.6.8 是一次稳定性修复，重点改善 Windows 原生采集、断线恢复和分享过程中的控制响应。

#### 修复与改善

- **更准确地选择编码器。** Windows 的自动模式按实际出帧表现评估 H.264，并正确区分启动预热和持续性能不足，减少计时误差导致的不必要 VP8 回退。硬件编码事件改为异步等待。
- **改善断线与线路切换。** 房间信令短暂断开后保留观众成员身份 20 秒；修复线路切换、SFU 订阅恢复及声音重协商卡住的问题。失效连接及时交回现有路由控制器处理，原生 SFU 发送端不再把短暂断连直接判为终止。
- **保持 App 控制响应。** 开始分享和更换来源时仍可取消操作；合法消息突发不再直接关闭控制连接。中继信令的单条内容错误不会连带结束整场原生分享。
- **修正设备列表与配置保存。** 来源或麦克风数量达到上限时保留可用列表；配置替换失败时保留原有设置。
- **改善紧凑布局和辅助功能。** 调整手机横屏下的画面与播控布局、画质预设标签和长邀请链接显示，修正部分提示与辅助功能语义。
- **加强站点访问保护。** 站点登录 Cookie 使用独立随机签名密钥，应用自身阻止被其他页面嵌套。发布说明也会在合并前检查。

#### 升级说明

通信协议和持久化格式保持不变。设置了站点密码时，App 或 Server 重启后需要重新输入站点密码；持久化房间和邀请授权不受这项 Cookie 调整影响。Piik 操作页面不再支持嵌入 iframe。

### English

Piik v1.6.8 is a stability update focused on Windows native capture, connection recovery and responsive sharing controls.

#### Fixes and improvements

- **More accurate codec selection.** Windows Auto mode evaluates H.264 using delivered frames and distinguishes startup warmup from sustained performance limits, reducing unnecessary VP8 fallback caused by timing noise. Hardware encoder events now use asynchronous waiting.
- **Improved reconnection and route handoffs.** Viewer membership survives brief signaling outages for 20 seconds. Fixes cover route activation, SFU subscription recovery and stalled audio renegotiation. Failed connections return to the existing route controller, and the native SFU publisher no longer treats a transient disconnect as immediate termination.
- **Responsive App controls.** Starting a share and replacing its source remain cancellable. Valid message bursts no longer close the control connection, and an invalid relayed payload cannot terminate the entire native sharing session.
- **Device lists and saved settings.** Source and microphone enumeration retain a usable list at their limits. Failed configuration replacement preserves the previous settings.
- **Compact layouts and accessibility.** Improved picture and playback-control layout on landscape phones, quality preset labels and long invitation links, with corrected tooltip and accessibility semantics.
- **Stronger site-access protection.** Login cookies use an independent random signing key, and the application prevents embedding by other pages. Release notes are also checked before merge.

#### Upgrade notes

Wire protocols and persistent formats are unchanged. If a site password is configured, restarting the App or Server requires entering it again; this cookie change does not revoke persisted rooms or invitation grants. Piik operation pages can no longer be embedded in an iframe.

## Verification / 验证

- `npm run check`: passed, 76 test files / 1,171 tests, TypeScript and production Web build.
- `npm run check:go-core`: passed; full Go/native checks also passed during integration of the capture changes. macOS cgo builds remain native-runner checks.
- Windows native Host gates: Auto, H.264 and VP8 passed during the phase; final control changes rechecked with Auto, including live/paused quality, source replacement, failure retirement and subsequent sharing.
- Embedded SFU browser VP8 recovery: passed with production Host/Viewer route owners.
- Embedded SFU native H.264, two rooms: passed, including recovered decoded video/audio, independent room retirement and resource cleanup.
- Documentation, repository hygiene and diff checks: passed. Final follow-up changes only align operations documentation with the PR note check.
- Go race checks could not run locally because no cgo/GCC toolchain is available; the existing Linux CI race job remains required. AMD/Intel hardware, broader device combinations, public-NAT field reports and long endurance are not established by these local checks.

## Impact / 影响

Compatible patch release after v1.6.7. The cookie and frame-protection effects are disclosed in the public upgrade notes. No automatic retry budget, room-code admission policy, room lifetime or media topology is replaced. Reports without matched diagnostics and unmeasured native performance costs remain in the TODO ledger.

native/capture/darwin/main.swift

@@ -266,7 +266,7 @@ private func listSources() async throws {
     let windows = shareableWindows(content).map { $0.1 }.sorted {
         $0.title.localizedCaseInsensitiveCompare($1.title) == .orderedAscending
     }
-    try writeJSON(displays + windows)
+    try writeJSON(Array((displays + windows).prefix(1024)))
 }
 
 private final class StopSignal {
@@ -1746,8 +1746,7 @@ private func microphoneDevices() throws -> [(id: AudioDeviceID, uid: String, nam
 }
 
 private func listMicrophones() throws {
-    let devices = try microphoneDevices().map { ["id": $0.uid, "label": $0.name] }
-    guard devices.count <= 64 else { throw CaptureFailure(description: "too many microphones") }
+    let devices = try microphoneDevices().prefix(64).map { ["id": $0.uid, "label": $0.name] }
     FileHandle.standardOutput.write(try JSONSerialization.data(withJSONObject: devices))
 }
 

native/capture/windows/adaptive_encoder.cpp

@@ -140,9 +140,10 @@ class Readback final {
 class NativeVideoFrameBuffer : public webrtc::VideoFrameBuffer {
  public:
   NativeVideoFrameBuffer(ComPtr<ID3D11Texture2D> texture, UINT32 width, UINT32 height,
-                        UINT64 timestamp100ns, Readback& readback)
+                        UINT64 timestamp100ns, Readback& readback,
+                        EncoderClock::time_point deadline)
       : texture_(std::move(texture)), width_(width), height_(height),
-        timestamp100ns_(timestamp100ns), readback_(readback) {}
+        timestamp100ns_(timestamp100ns), readback_(readback), deadline_(deadline) {}
   Type type() const override { return Type::kNative; }
   int width() const override { return static_cast<int>(width_); }
   int height() const override { return static_cast<int>(height_); }
@@ -151,12 +152,14 @@ class NativeVideoFrameBuffer : public webrtc::VideoFrameBuffer {
   }
   ID3D11Texture2D* texture() const { return texture_.Get(); }
   UINT64 timestamp100ns() const { return timestamp100ns_; }
+  EncoderClock::time_point deadline() const { return deadline_; }
 
  private:
   ComPtr<ID3D11Texture2D> texture_;
   const UINT32 width_, height_;
   const UINT64 timestamp100ns_;
   Readback& readback_;
+  const EncoderClock::time_point deadline_;
 };
 
 class HardwareEncoder final : public webrtc::VideoEncoder {
@@ -269,7 +272,7 @@ class HardwareEncoder final : public webrtc::VideoEncoder {
         Fail("adaptive-h264-input", "H264 requires the selected native NV12 surface");
       const auto began = env_.clock().TimeInMilliseconds();
       const auto access_unit = encoder_->Encode(native->texture(), native->timestamp100ns(),
-                                                key_frame_pending_);
+                                                key_frame_pending_, native->deadline());
       key_frame_pending_ = false;
       webrtc::EncodedImage image;
       image.SetEncodedData(webrtc::EncodedImageBuffer::Create(
@@ -426,7 +429,8 @@ class AdaptiveEncoder::Impl final : public webrtc::VideoSourceInterface<webrtc::
   }
 
   std::optional<AdaptiveAccessUnit> Encode(FrameProducer produce, UINT32 source_width,
-      UINT32 source_height, UINT64 timestamp100ns, bool key_frame, UINT32 bitrate) {
+      UINT32 source_height, UINT64 timestamp100ns, bool key_frame, UINT32 bitrate,
+      EncoderClock::time_point deadline) {
     if (!produce || source_width == 0 || source_height == 0 ||
         source_width > ceiling_.width || source_height > ceiling_.height ||
         timestamp100ns > static_cast<UINT64>(std::numeric_limits<INT64>::max()))
@@ -476,7 +480,7 @@ class AdaptiveEncoder::Impl final : public webrtc::VideoSourceInterface<webrtc::
       }
       auto buffer = webrtc::make_ref_counted<NativeVideoFrameBuffer>(
           std::move(texture), static_cast<UINT32>(width), static_cast<UINT32>(height),
-          timestamp100ns, readback_);
+          timestamp100ns, readback_, deadline);
       source_sink_->OnFrame(webrtc::VideoFrame::Builder().set_video_frame_buffer(buffer)
           .set_timestamp_us(capture_us).set_ntp_time_ms(ntp_ms).build());
     });
@@ -643,9 +647,9 @@ AdaptiveEncoder::~AdaptiveEncoder() = default;
 
 std::optional<AdaptiveAccessUnit> AdaptiveEncoder::Encode(FrameProducer produce,
     UINT32 source_width, UINT32 source_height, UINT64 timestamp100ns,
-    bool key_frame, UINT32 bitrate) {
+    bool key_frame, UINT32 bitrate, EncoderClock::time_point deadline) {
   return impl_->Encode(std::move(produce), source_width, source_height, timestamp100ns,
-                       key_frame, bitrate);
+                       key_frame, bitrate, deadline);
 }
 
 }  // namespace piik::capture::windows

native/capture/windows/adaptive_encoder.h

@@ -29,7 +29,8 @@ class AdaptiveEncoder final {
 
   std::optional<AdaptiveAccessUnit> Encode(
       FrameProducer produce, UINT32 source_width, UINT32 source_height,
-      UINT64 timestamp100ns, bool key_frame, UINT32 bitrate);
+      UINT64 timestamp100ns, bool key_frame, UINT32 bitrate,
+      EncoderClock::time_point deadline = EncoderClock::time_point::max());
 
  private:
   class Impl;

native/capture/windows/build.ps1

@@ -56,7 +56,7 @@ Invoke-CaptureBuild ('{0} /out:"{1}" {2} "{3}" {4}' -f $linkCommand,$executableP
 if ($Check) {
     $vp8Object = Join-Path $outputPath 'vp8_encoder.obj'
     Invoke-CaptureBuild ('cl.exe {0} /DNDEBUG "{1}" /Fo:"{2}"' -f $compileFlags,(Join-Path $helperDirectory 'vp8_encoder.cpp'),$vp8Object)
-    foreach ($name in @('capture_geometry', 'capture_control', 'capture_target', 'output_worker')) {
+    foreach ($name in @('capture_geometry', 'capture_control', 'capture_target', 'output_worker', 'mft_event_reader')) {
         $source = Join-Path $helperDirectory ($name + '.test.cpp')
         $object = Join-Path $outputPath ($name + '.test.obj')
         $executable = Join-Path $outputPath ($name + '.test.exe')

native/capture/windows/capture_target.cpp

@@ -166,7 +166,8 @@ std::string JsonString(const std::string& value) {
 
 BOOL CALLBACK CollectWindow(HWND window, LPARAM parameter) {
   auto* targets = reinterpret_cast<std::vector<SourceTarget>*>(parameter);
-  if (targets->size() >= kMaxSources) return FALSE;
+  // FALSE makes EnumWindows report failure; a full list is still usable.
+  if (targets->size() >= kMaxSources) return TRUE;
   if (!IsWindowVisible(window) || GetWindow(window, GW_OWNER) != nullptr) {
     return TRUE;
   }
@@ -209,7 +210,7 @@ BOOL CALLBACK CollectWindow(HWND window, LPARAM parameter) {
 
 BOOL CALLBACK CollectDisplay(HMONITOR monitor, HDC, LPRECT, LPARAM parameter) {
   auto* targets = reinterpret_cast<std::vector<SourceTarget>*>(parameter);
-  if (targets->size() >= kMaxSources) return FALSE;
+  if (targets->size() >= kMaxSources) return TRUE;
   MONITORINFOEXW info{};
   info.cbSize = sizeof(info);
   if (!GetMonitorInfoW(monitor, &info)) return TRUE;
@@ -931,10 +932,10 @@ int WriteMicrophoneList() {
     if (FAILED(CoCreateInstance(__uuidof(MMDeviceEnumerator), nullptr, CLSCTX_ALL, IID_PPV_ARGS(&enumerator))) ||
         FAILED(enumerator->EnumAudioEndpoints(eCapture, DEVICE_STATE_ACTIVE, &devices))) return 2;
     UINT count = 0;
-    if (FAILED(devices->GetCount(&count)) || count > 64) return 2;
+    if (FAILED(devices->GetCount(&count))) return 2;
     std::cout << '[';
     bool first = true;
-    for (UINT index = 0; index < count; ++index) {
+    for (UINT index = 0; index < count && index < 64; ++index) {
       ComPtr<IMMDevice> device;
       ComPtr<IPropertyStore> properties;
       if (FAILED(devices->Item(index, &device)) || FAILED(device->OpenPropertyStore(STGM_READ, &properties))) continue;

native/capture/windows/h264_encoder.cpp

@@ -8,7 +8,6 @@
 #include <propvarutil.h>
 
 #include <algorithm>
-#include <thread>
 
 namespace piik::capture::windows {
 
@@ -608,7 +607,7 @@ LiveEncoder::LiveEncoder(
     SelectedTransform selected,
     VideoProfile profile)
     : VideoEncoder(OutputKind::h264, selected.name, selected.clsid),
-      selected_(std::move(selected)), profile_(profile) {
+      selected_(std::move(selected)), events_(selected_.events.Get()), profile_(profile) {
   ConfigureCodec(selected_.codec.Get(), profile_);
   ComPtr<IMFMediaType> output_type = CreateOutputType(profile_);
   Check(selected_.transform->SetOutputType(0, output_type.Get(), 0),
@@ -701,24 +700,14 @@ EncodedAccessUnit LiveEncoder::Encode(
 
 MediaEventType LiveEncoder::NextEvent(
     EncoderClock::time_point deadline, const char* timeout_stage) {
-  while (std::chrono::steady_clock::now() < deadline) {
-    ComPtr<IMFMediaEvent> event;
-    HRESULT result = selected_.events->GetEvent(MF_EVENT_FLAG_NO_WAIT,
-                                                 &event);
-    if (result == MF_E_NO_EVENTS_AVAILABLE) {
-      std::this_thread::sleep_for(std::chrono::milliseconds(1));
-      continue;
-    }
-    Check(result, "mft-get-event");
-    HRESULT status = S_OK;
-    Check(event->GetStatus(&status), "mft-event-status-read");
-    Check(status, "mft-event-status");
-    MediaEventType type = MEUnknown;
-    Check(event->GetType(&type), "mft-event-type");
-    if (type == MEError) Fail("mft-error-event", "hardware MFT emitted MEError");
-    return type;
-  }
-  Fail(timeout_stage, "hardware MFT event wait timed out");
+  ComPtr<IMFMediaEvent> event = events_.Read(deadline, timeout_stage);
+  HRESULT status = S_OK;
+  Check(event->GetStatus(&status), "mft-event-status-read");
+  Check(status, "mft-event-status");
+  MediaEventType type = MEUnknown;
+  Check(event->GetType(&type), "mft-event-type");
+  if (type == MEError) Fail("mft-error-event", "hardware MFT emitted MEError");
+  return type;
 }
 
 void LiveEncoder::WaitForInput(EncoderClock::time_point probe_deadline) {

native/capture/windows/h264_encoder.h

@@ -15,6 +15,7 @@
 #include <wrl/client.h>
 
 #include "capture_error.h"
+#include "mft_event_reader.h"
 
 #include <chrono>
 #include <iomanip>
@@ -229,6 +230,7 @@ class LiveEncoder final : public VideoEncoder {
   void WaitForInput(EncoderClock::time_point deadline);
 
   SelectedTransform selected_;
+  MftEventReader events_;
   VideoProfile profile_;
   MFT_OUTPUT_STREAM_INFO output_info_ = {};
   UINT32 input_requests_ = 0;

native/capture/windows/main.cpp

@@ -1212,52 +1212,53 @@ void WriteCapabilityProbe() {
   }
 }
 
-double MeasureEncoderWork(VideoEncoder* hardware, ID3D11Device* device,
-                          const VideoProfile& profile,
-                          EncoderClock::time_point deadline) {
+// Some drivers emit valid H264 at a fraction of the source rate, while the
+// encoder reports no limitation (realtime-quality-adaptation.md). Pace synthetic
+// frames through the same WebRTC pipeline as a live output, including its rate
+// control and frame dropper, with the Browser probe's warmup, one-second sample
+// and 100 ms lag allowance (video-codec-preflight.ts).
+UINT32 CadenceLagFrames(UINT32 frame_rate) {
+  return std::max<UINT32>(1, (frame_rate + 9) / 10);
+}
+
+bool SustainsEncodedCadence(const AdaptiveEncoder::Factory& create, ID3D11Device* device,
+                            const VideoProfile& profile, EncoderClock::time_point deadline) {
+  RequireEncoderTime(deadline);
   const UINT32 warmup_frames = (profile.frame_rate + 1) / 2;
   const UINT32 sample_frames = profile.frame_rate;
-  std::unique_ptr<AdaptiveEncoder> adaptive;
-  if (!hardware) {
-    adaptive = std::make_unique<AdaptiveEncoder>(OutputKind::vp8, profile, device,
-                                               AdaptiveEncoder::Factory{});
+  const UINT32 lag = CadenceLagFrames(profile.frame_rate);
+  // Synthesis is CPU work of the probe, not the encoder; prepare it before pacing.
+  std::array<ComPtr<ID3D11Texture2D>, 8> textures;
+  for (UINT32 index = 0; index < textures.size(); ++index) {
+    textures[index] = CreateSyntheticTexture(device, index * 7, profile);
   }
-  const auto cadence_start = EncoderClock::now();
-  std::chrono::duration<double> measured{};
+  AdaptiveEncoder encoder(OutputKind::h264, profile, device, create);
+  const auto interval = std::chrono::nanoseconds(
+      static_cast<INT64>(profile.frame_duration_100ns()) * 100);
+  auto start = EncoderClock::now();
+  UINT32 delivered = 0;
   for (UINT32 frame = 0; frame < warmup_frames + sample_frames; ++frame) {
+    // Cold activation and the first IDR belong to warmup, not steady cadence.
+    // Start the measured schedule afresh; do not carry warmup lag into it.
+    if (frame == warmup_frames) start = EncoderClock::now() - interval * frame;
+    const auto due = start + interval * frame;
+    std::this_thread::sleep_until(std::min(due, deadline));
     RequireEncoderTime(deadline);
-    auto texture = CreateSyntheticTexture(device, frame, profile);
-    if (adaptive) {
-      // VSE observes real input cadence; pacing is not encoder work.
-      std::this_thread::sleep_until(cadence_start + std::chrono::nanoseconds(
-          static_cast<INT64>(frame) * profile.frame_duration_100ns() * 100));
-      RequireEncoderTime(deadline);
-    }
-    const auto start = EncoderClock::now();
-    const auto timestamp = (static_cast<UINT64>(frame) + 1) * profile.frame_duration_100ns();
-    EncodedAccessUnit encoded;
-    if (adaptive) {
-      auto output = adaptive->Encode([&](UINT32 width, UINT32 height) {
-        if (width != profile.width || height != profile.height)
-          Fail("codec-probe-output", "encoder reduced the probe resolution");
-        return texture;
-      }, profile.width, profile.height, timestamp, frame == 0, profile.bit_rate);
-      RequireEncoderTime(deadline);
-      if (!output || output->width != profile.width || output->height != profile.height ||
-          output->duration100ns != static_cast<UINT64>(profile.frame_duration_100ns())) {
-        Fail("codec-probe-output", "encoder reduced the probe profile or dropped a frame");
-      }
-      encoded = std::move(output->access_unit);
-    } else {
-      encoded = hardware->Encode(texture.Get(), timestamp, frame == 0, deadline);
-    }
-    // A dropped input cannot count as a throughput-probe output frame.
-    if (encoded.bytes.empty() || encoded.bytes.size() > kMaxProductAccessUnitBytes) {
-      Fail("codec-probe-output", "encoder produced an invalid probe frame");
-    }
-    if (frame >= warmup_frames) measured += EncoderClock::now() - start;
+    // One encode is in flight, so a slow encoder delays every later source frame.
+    if (frame >= warmup_frames && EncoderClock::now() > due + interval * lag) return false;
+    const auto& texture = textures[frame % textures.size()];
+    auto output = encoder.Encode([&](UINT32 width, UINT32 height) {
+      if (width != profile.width || height != profile.height)
+        Fail("codec-probe-output", "encoder reduced the probe resolution");
+      return texture;
+    }, profile.width, profile.height,
+        (static_cast<UINT64>(frame) + 1) * profile.frame_duration_100ns(), frame == 0,
+        profile.bit_rate, deadline);
+    RequireEncoderTime(deadline);
+    if (frame >= warmup_frames && EncoderClock::now() > due + interval * lag) return false;
+    if (frame >= warmup_frames && output && !output->access_unit.bytes.empty()) ++delivered;
   }
-  return measured.count() / sample_frames;
+  return delivered + lag >= sample_frames;
 }
 
 struct VideoEncoderSelection final {
@@ -1265,20 +1266,6 @@ struct VideoEncoderSelection final {
   std::unique_ptr<VideoEncoder> initial;
 };
 
-template <typename Measure>
-VideoEncoderSelection CompareSoftwareEncoder(std::unique_ptr<VideoEncoder> hardware,
-    std::optional<double> hardware_work, EncoderClock::time_point deadline, Measure measure) {
-  // No comparison is needed when only the ordinary VP8 path remains.
-  if (!hardware_work) return {};
-  try {
-    RequireEncoderTime(deadline);
-    const double software_work = measure();
-    if (software_work <= *hardware_work) return {};
-  } catch (const std::exception&) {}
-  // The deadline bounds new probing, not reuse of an already-proved encoder.
-  return {OutputKind::h264, std::move(hardware)};
-}
-
 using EncoderCandidate = std::pair<UINT, UINT>;
 
 void LogEncoderRejection(EncoderCandidate candidate, const GateFailure& error) {
@@ -1319,16 +1306,12 @@ VideoEncoderSelection SelectVideoEncoder(
     device = CreateDevice(SelectAdapter(adapters, arguments.adapter_index));
     return {};
   }
-  const auto began = EncoderClock::now();
-  const auto budget = std::chrono::seconds(4);
-  const auto deadline = began + budget;
-  const auto hardware_deadline = arguments.codec == "auto" ? began + budget / 2 : deadline;
-  std::optional<double> hardware_work;
+  const auto deadline = EncoderClock::now() + std::chrono::seconds(4);
   std::unique_ptr<VideoEncoder> hardware;
   try {
     std::vector<EncoderCandidate> candidates;
     for (const auto& adapter : adapters) {
-      RequireEncoderTime(hardware_deadline);
+      RequireEncoderTime(deadline);
       try {
         const auto encoders = EnumerateHardwareEncoders(adapter, false);
         for (UINT index = 0; index < encoders.count; ++index)
@@ -1338,41 +1321,42 @@ VideoEncoderSelection SelectVideoEncoder(
       }
     }
     const auto chosen = SelectEncoderCandidate(candidates,
-        {arguments.adapter_index, arguments.mft_index}, hardware_deadline,
+        {arguments.adapter_index, arguments.mft_index}, deadline,
         [&](EncoderCandidate candidate) {
           const auto& adapter = SelectAdapter(adapters, candidate.first);
           auto next_device = CreateDevice(adapter);
           const auto encoders = EnumerateHardwareEncoders(adapter);
+          // Retire the Auto probe before preparing the live encoder, so selection
+          // does not require two simultaneous hardware sessions on this device.
+          if (arguments.codec == "auto" && !SustainsEncodedCadence(
+                  [&](const VideoProfile& profile) -> std::unique_ptr<VideoEncoder> {
+                    auto activations = EnumerateHardwareEncoders(adapter);
+                    return std::make_unique<LiveEncoder>(ActivateTransform(
+                        activations, candidate.second, next_device.manager.Get()), profile);
+                  },
+                  next_device.device.Get(), arguments.profile, deadline)) {
+            Fail("codec-probe-cadence", "hardware H264 did not sustain the target frame rate");
+          }
+          RequireEncoderTime(deadline);
           auto selected = ActivateTransform(encoders, candidate.second, next_device.manager.Get());
           auto next = std::make_unique<LiveEncoder>(std::move(selected), arguments.profile);
-          if (arguments.codec == "auto") {
-            hardware_work = MeasureEncoderWork(next.get(), next_device.device.Get(),
-                                               arguments.profile, hardware_deadline);
-          } else {
-            // Enumeration and activation alone do not prove usable H264 output.
-            const auto texture = CreateSyntheticTexture(next_device.device.Get(), 0, arguments.profile);
-            next->Encode(texture.Get(), 0, true, hardware_deadline);
-          }
-          RequireEncoderTime(hardware_deadline);
+          // Enumeration and activation alone do not prove usable H264 output.
+          const auto texture = CreateSyntheticTexture(next_device.device.Get(), 0, arguments.profile);
+          next->Encode(texture.Get(), 0, true, deadline);
+          RequireEncoderTime(deadline);
           device = std::move(next_device);
           hardware = std::move(next);
         });
     arguments.adapter_index = chosen.first;
     arguments.mft_index = chosen.second;
-    if (arguments.codec == "h264" || *hardware_work <= 1.0 / arguments.profile.frame_rate)
-      return {OutputKind::h264, std::move(hardware)};
+    return {OutputKind::h264, std::move(hardware)};
   } catch (const GateFailure&) {
     if (arguments.codec == "h264") throw;
-    hardware_work.reset();
     hardware.reset();
-    device = DeviceContext{};
   }
-  if (!device.device) {
-    device = CreateDevice(SelectAdapter(adapters, arguments.adapter_index));
-  }
-  return CompareSoftwareEncoder(std::move(hardware), hardware_work, deadline, [&] {
-    return MeasureEncoderWork(nullptr, device.device.Get(), arguments.profile, deadline);
-  });
+  // Without a sustaining hardware candidate, Auto starts the ordinary VP8 path.
+  device = CreateDevice(SelectAdapter(adapters, arguments.adapter_index));
+  return {};
 }
 
 struct CaptureInput final {

native/capture/windows/mft_event_reader.h

@@ -0,0 +1,102 @@
+#pragma once
+
+#include "capture_error.h"
+
+#include <mfobjects.h>
+#include <wrl.h>
+
+#include <chrono>
+#include <condition_variable>
+#include <mutex>
+
+namespace piik::capture::windows {
+
+// One serialized reader, one outstanding request. The callback owns its state
+// even when an MFT completes after the encoder's deadline or destruction.
+// A failed Read retires the reader; Read and destruction are never concurrent.
+class MftEventReader final {
+  class Completion final : public Microsoft::WRL::RuntimeClass<
+      Microsoft::WRL::RuntimeClassFlags<Microsoft::WRL::ClassicCom>, IMFAsyncCallback> {
+   public:
+    explicit Completion(IMFMediaEventGenerator* source) : source_(source) {}
+
+    HRESULT STDMETHODCALLTYPE GetParameters(DWORD*, DWORD*) override { return E_NOTIMPL; }
+
+    HRESULT STDMETHODCALLTYPE Invoke(IMFAsyncResult* result) override {
+      Microsoft::WRL::ComPtr<IMFMediaEventGenerator> source;
+      {
+        std::lock_guard lock(mutex_);
+        source = source_;
+      }
+      if (!source) return S_OK;
+      Microsoft::WRL::ComPtr<IMFMediaEvent> event;
+      const HRESULT status = source->EndGetEvent(result, &event);
+      {
+        std::lock_guard lock(mutex_);
+        if (!source_) return S_OK;
+        status_ = status;
+        event_ = std::move(event);
+        ready_ = true;
+      }
+      ready_event_.notify_one();
+      return S_OK;
+    }
+
+    Microsoft::WRL::ComPtr<IMFMediaEvent> Read(
+        std::chrono::steady_clock::time_point deadline, const char* timeout_stage) {
+      if (std::chrono::steady_clock::now() >= deadline) Timeout(timeout_stage);
+      {
+        std::lock_guard lock(mutex_);
+        ready_ = false;
+      }
+      Check(source_->BeginGetEvent(this, nullptr), "mft-begin-get-event");
+      std::unique_lock lock(mutex_);
+      if (!ready_event_.wait_until(lock, deadline, [this] { return ready_; }) ||
+          std::chrono::steady_clock::now() >= deadline) {
+        Timeout(timeout_stage);
+      }
+      Check(status_, "mft-get-event");
+      return std::move(event_);
+    }
+
+    void Close() {
+      // Break the generator/callback reference cycle before its existing owner
+      // shuts down the MFT. Shutdown need not deliver a final callback.
+      Microsoft::WRL::ComPtr<IMFMediaEventGenerator> source;
+      {
+        std::lock_guard lock(mutex_);
+        source.Swap(source_);
+      }
+    }
+
+   private:
+    [[noreturn]] static void Timeout(const char* stage) {
+      Fail(stage, "hardware MFT event wait timed out");
+    }
+    std::mutex mutex_;
+    std::condition_variable ready_event_;
+    Microsoft::WRL::ComPtr<IMFMediaEventGenerator> source_;
+    Microsoft::WRL::ComPtr<IMFMediaEvent> event_;
+    HRESULT status_ = S_OK;
+    bool ready_ = false;
+  };
+
+ public:
+  explicit MftEventReader(IMFMediaEventGenerator* source)
+      : completion_(Microsoft::WRL::Make<Completion>(source)) {
+    Check(completion_ ? S_OK : E_OUTOFMEMORY, "mft-event-reader");
+  }
+  ~MftEventReader() { completion_->Close(); }
+  MftEventReader(const MftEventReader&) = delete;
+  MftEventReader& operator=(const MftEventReader&) = delete;
+
+  Microsoft::WRL::ComPtr<IMFMediaEvent> Read(
+      std::chrono::steady_clock::time_point deadline, const char* timeout_stage) {
+    return completion_->Read(deadline, timeout_stage);
+  }
+
+ private:
+  Microsoft::WRL::ComPtr<Completion> completion_;
+};
+
+}  // namespace piik::capture::windows

native/capture/windows/mft_event_reader.test.cpp

@@ -0,0 +1,133 @@
+#include "mft_event_reader.h"
+
+#include <mfapi.h>
+#include <mferror.h>
+#include <cassert>
+#include <future>
+#include <thread>
+
+using namespace piik::capture::windows;
+using Microsoft::WRL::ComPtr;
+using namespace std::chrono_literals;
+
+class Generator final : public Microsoft::WRL::RuntimeClass<
+    Microsoft::WRL::RuntimeClassFlags<Microsoft::WRL::ClassicCom>, IMFMediaEventGenerator> {
+ public:
+  Generator() { Check(MFCreateEventQueue(&queue), "fixture-queue"); }
+  ~Generator() { if (destroyed) destroyed->set_value(); }
+  HRESULT STDMETHODCALLTYPE GetEvent(DWORD flags, IMFMediaEvent** event) override {
+    return queue->GetEvent(flags, event);
+  }
+  HRESULT STDMETHODCALLTYPE BeginGetEvent(IMFAsyncCallback* callback, IUnknown* state) override {
+    ++begins;
+    if (FAILED(begin_error)) return begin_error;
+    if (hold) { held = callback; return S_OK; }
+    return queue->BeginGetEvent(callback, state);
+  }
+  HRESULT STDMETHODCALLTYPE EndGetEvent(IMFAsyncResult* result, IMFMediaEvent** event) override {
+    ++ends;
+    const HRESULT status = queue->EndGetEvent(result, event);
+    if (end_entered) { end_entered->set_value(); release_end.wait(); }
+    return FAILED(end_error) ? end_error : status;
+  }
+  HRESULT STDMETHODCALLTYPE QueueEvent(MediaEventType type, REFGUID extended,
+      HRESULT status, const PROPVARIANT* payload) override {
+    return queue->QueueEventParamVar(type, extended, status, payload);
+  }
+  void Push(MediaEventType type) { Check(QueueEvent(type, GUID_NULL, S_OK, nullptr), "fixture-push"); }
+  ComPtr<IMFMediaEventQueue> queue;
+  ComPtr<IMFAsyncCallback> held;
+  HRESULT begin_error = S_OK;
+  HRESULT end_error = S_OK;
+  bool hold = false;
+  unsigned begins = 0;
+  unsigned ends = 0;
+  std::promise<void>* end_entered = nullptr;
+  std::promise<void>* destroyed = nullptr;
+  std::shared_future<void> release_end;
+};
+
+template <typename F>
+void ExpectFailure(F action, const char* stage) {
+  try { action(); assert(false); }
+  catch (const GateFailure& failure) { assert(failure.stage() == stage); }
+}
+
+int main() {
+  Check(CoInitializeEx(nullptr, COINIT_MULTITHREADED), "fixture-com");
+  Check(MFStartup(MF_VERSION), "fixture-mf");
+  {
+    auto source = Microsoft::WRL::Make<Generator>();
+    MftEventReader reader(source.Get());
+    source->Push(METransformNeedInput);
+    auto event = reader.Read(std::chrono::steady_clock::now() + 1s, "fixture-timeout");
+    MediaEventType type = MEUnknown;
+    Check(event->GetType(&type), "fixture-type");
+    assert(type == METransformNeedInput);
+    std::thread delayed([&] { std::this_thread::sleep_for(20ms); source->Push(METransformHaveOutput); });
+    event = reader.Read(std::chrono::steady_clock::now() + 1s, "fixture-timeout");
+    delayed.join();
+    Check(event->GetType(&type), "fixture-type");
+    assert(type == METransformHaveOutput);
+    assert(source->begins == 2 && source->ends == 2);
+    source->queue->Shutdown();
+  }
+  for (bool begin : {false, true}) {
+    auto source = Microsoft::WRL::Make<Generator>();
+    if (begin) source->begin_error = E_FAIL;
+    else { source->end_error = E_FAIL; source->Push(MEError); }
+    MftEventReader reader(source.Get());
+    ExpectFailure([&] { reader.Read(std::chrono::steady_clock::now() + 1s, "fixture-timeout"); },
+                  begin ? "mft-begin-get-event" : "mft-get-event");
+    source->queue->Shutdown();
+  }
+  {
+    auto source = Microsoft::WRL::Make<Generator>();
+    source->hold = true;
+    {
+      MftEventReader reader(source.Get());
+      ExpectFailure([&] { reader.Read(std::chrono::steady_clock::now() - 1ms, "fixture-timeout"); }, "fixture-timeout");
+      assert(source->begins == 0);
+      ExpectFailure([&] { reader.Read(std::chrono::steady_clock::now() + 20ms, "fixture-timeout"); }, "fixture-timeout");
+      assert(source->begins == 1);
+    }
+    // Late callback must neither access the dead reader nor retain its source.
+    ComPtr<IMFAsyncCallback> late = source->held;
+    source->queue->Shutdown();
+    assert(source.Reset() == 0);
+    Check(late->Invoke(nullptr), "fixture-late-callback");
+  }
+  {
+    auto source = Microsoft::WRL::Make<Generator>();
+    {
+      MftEventReader reader(source.Get());
+      ExpectFailure([&] { reader.Read(std::chrono::steady_clock::now() + 20ms, "fixture-timeout"); }, "fixture-timeout");
+    }
+    source->queue->Shutdown();
+    assert(source.Reset() == 0);
+  }
+  {
+    std::promise<void> entered, release, destroyed;
+    auto began = entered.get_future();
+    auto retired = destroyed.get_future();
+    auto source = Microsoft::WRL::Make<Generator>();
+    source->end_entered = &entered;
+    source->destroyed = &destroyed;
+    source->release_end = release.get_future().share();
+    source->Push(METransformHaveOutput);
+    {
+      MftEventReader reader(source.Get());
+      ExpectFailure([&] { reader.Read(std::chrono::steady_clock::now() + 500ms, "fixture-timeout"); }, "fixture-timeout");
+      assert(began.wait_for(1s) == std::future_status::ready);
+    }
+    source->queue->Shutdown();
+    source.Reset();
+    // EndGetEvent was already running when Close detached the source. Its
+    // local reference keeps the generator alive, then releases it without join.
+    assert(retired.wait_for(0ms) == std::future_status::timeout);
+    release.set_value();
+    assert(retired.wait_for(1s) == std::future_status::ready);
+  }
+  MFShutdown();
+  CoUninitialize();
+}

native/capture/windows/output_worker.test.cpp

@@ -20,9 +20,10 @@ AdaptiveEncoder::AdaptiveEncoder(OutputKind, VideoProfile profile, ID3D11Device*
 AdaptiveEncoder::~AdaptiveEncoder() = default;
 
 std::optional<AdaptiveAccessUnit> AdaptiveEncoder::Encode(FrameProducer,
-    UINT32 width, UINT32 height, UINT64 timestamp, bool key, UINT32 bitrate) {
+    UINT32 width, UINT32 height, UINT64 timestamp, bool key, UINT32 bitrate,
+    EncoderClock::time_point deadline) {
   impl_->encoder->SetBitrate(bitrate);
-  return AdaptiveAccessUnit{impl_->encoder->Encode(nullptr, timestamp, key),
+  return AdaptiveAccessUnit{impl_->encoder->Encode(nullptr, timestamp, key, deadline),
                             width, height, 333'333};
 }
 }  // namespace piik::capture::windows
@@ -149,46 +150,65 @@ void CheckEncoderCandidates() {
   assert(tried.empty());
 }
 
-void CheckAutoEncoderFallback() {
-  const auto deadline = EncoderClock::time_point::max();
-  const auto expired = EncoderClock::time_point::min();
-  auto hardware = [] { return std::make_unique<FixtureEncoder>(nullptr, std::shared_future<void>{}); };
-  for (const auto probe_deadline : {deadline, expired}) {
-    auto initial = hardware();
-    const auto* proven = initial.get();
-    bool probed = false;
-    const auto selected = CompareSoftwareEncoder(std::move(initial), .04, probe_deadline, [&]() -> double {
-      probed = true;
-      // A slow software comparison exhausts its budget after H264 succeeded.
-      RequireEncoderTime(expired);
-      return 0;
-    });
-    assert(selected.kind == OutputKind::h264 && selected.initial.get() == proven);
-    assert(probed == (probe_deadline == deadline));
+class CadenceFixtureEncoder final : public VideoEncoder {
+ public:
+  CadenceFixtureEncoder(std::chrono::milliseconds latency, bool dropped, bool cold_only)
+      : VideoEncoder(OutputKind::h264, "cadence-fixture", "cadence-fixture"),
+        latency_(latency), dropped_(dropped), cold_only_(cold_only) {}
+
+  EncodedAccessUnit Encode(ID3D11Texture2D*, UINT64 timestamp, bool key,
+      EncoderClock::time_point deadline) override {
+    if (!cold_only_ || calls_ == 0) std::this_thread::sleep_for(latency_);
+    ++calls_;
+    RequireEncoderTime(deadline);
+    // An empty unit stands for an input the pipeline did not encode.
+    return dropped_ ? EncodedAccessUnit{timestamp, key, {}} : EncodedAccessUnit{timestamp, key, {1, 2, 3}};
   }
-  for (const double software_work : {.02, .04, .06}) {
-    const auto selected = CompareSoftwareEncoder(hardware(), .04, deadline, [&] { return software_work; });
-    assert((selected.kind == OutputKind::vp8) == (software_work <= .04));
-    assert(static_cast<bool>(selected.initial) == (software_work > .04));
-  }
-  for (const auto probe_deadline : {deadline, expired}) {
-    bool probed = false;
-    const auto software_only = CompareSoftwareEncoder(nullptr, std::nullopt, probe_deadline, [&]() -> double {
-      probed = true;
-      throw GateFailure("codec-probe-timeout", "Optional comparison is unavailable");
-    });
-    // With no hardware candidate to compare, use the same VP8 path as manual selection.
-    assert(software_only.kind == OutputKind::vp8 && !software_only.initial && !probed);
+  void SetBitrate(UINT32) override {}
+
+ private:
+  std::chrono::milliseconds latency_;
+  bool dropped_;
+  bool cold_only_;
+  unsigned calls_ = 0;
+};
+
+void CheckAutoCadenceProbe(ID3D11Device* device) {
+  // The Browser probe allows one 100 ms poll of lag at each target rate.
+  assert(CadenceLagFrames(5) == 1 && CadenceLagFrames(15) == 2 &&
+         CadenceLagFrames(30) == 3 && CadenceLagFrames(60) == 6);
+  VideoProfile profile;
+  profile.width = 64;
+  profile.height = 64;
+  auto probe = [&](std::chrono::milliseconds latency, bool dropped,
+                   EncoderClock::time_point deadline, bool cold_only = false) {
+    return SustainsEncodedCadence([=](const VideoProfile&) -> std::unique_ptr<VideoEncoder> {
+      return std::make_unique<CadenceFixtureEncoder>(latency, dropped, cold_only);
+    }, device, profile, deadline);
+  };
+  const auto deadline = EncoderClock::now() + std::chrono::seconds(30);
+  // Valid output at a fraction of the source rate is the driver defect Auto rejects.
+  assert(!probe(std::chrono::milliseconds(0), true, deadline));
+  // Cold startup must not reject an encoder that sustains the measured cadence.
+  assert(probe(std::chrono::milliseconds(220), false, deadline, true));
+  // Sustained slow encoding still fails after warmup.
+  assert(!probe(std::chrono::milliseconds(300), false, deadline));
+  bool expired = false;
+  try {
+    probe(std::chrono::milliseconds(0), false, EncoderClock::time_point::min());
+  } catch (const GateFailure& error) {
+    expired = error.stage() == "codec-probe-timeout";
   }
+  assert(expired);
 }
 
 int main() {
   CheckEncoderCandidates();
-  CheckAutoEncoderFallback();
   CheckPrimaryFailureDetails();
   ComPtr<ID3D11Device> device;
   Check(D3D11CreateDevice(nullptr, D3D_DRIVER_TYPE_WARP, nullptr, 0, nullptr, 0,
                          D3D11_SDK_VERSION, &device, nullptr, nullptr), "fixture-warp");
+  CheckAutoCadenceProbe(device.Get());
   CheckWorkerFailureGeneration(device.Get(), false);
   CheckWorkerFailureGeneration(device.Get(), true);
 }