audio: make the PipeWire backend robust to quantum/rate changes and unscheduled graphs

[jcelerier]

Problem

The PipeWire process callback rejected any cycle whose clock.duration differed from the configured buffer size. The graph quantum is a global negotiation the client does not control (verified in the PipeWire sources, 0.3.48 through 1.6.8):

• node.force-quantum is last-stamp-wins between all follower nodes of a driver — any later-joining client that also forces (a pipewire-jack app, another score instance) flips the graph;
• the global clock.force-quantum setting overrides every node force;
• quantum-floor/limit clamp the result (and pre-1.0.5 servers additionally round forced quantums to powers of two and let follower max-latency shrink them);
• the first cycles after joining run at the previous quantum;
• node.lock-quantum/node.lock-rate cannot help: the driver cancels the lock whenever any follower forces the value, and this node always forces both.

Returning without dequeuing the output buffers leaves them in NEED_DATA, so a persistent mismatch meant permanent silence plus one warning per cycle from the RT thread (unexpected block size 512 (expected 128), skipping cycle).

Changes

• Process every cycle, sliced into chunks of at most the configured block size; buffers fetched exactly once per port per cycle through pw_filter_dequeue_buffer, with writes clamped to the buffer's real capacity (client and daemon clock.quantum-limit can differ; no PipeWire version checks n_samples against maxsize).
• Truthful sample rate: node.force-rate can lose to the global clock.force-rate or a competing client; the constructor now observes the rate the graph actually granted and publishes it in effective_sample_rate, so hosts stop resampling soundfiles for a rate that is not being played. Mid-run rate changes are reported once (live adaptation deferred to a future PR).
• Stall watchdog: when no active driver with priority.driver > 0 exists (missing Dummy-Driver, session-manager race, vanished device), pw_context_recalc_graph silently stops the node — no error reaches the client and playback never starts. A watchdog counts process cycles and, after a bounded stall, re-exports the node (disconnect + connect, legal on all validated versions), with bounded per-outage attempts and public counters for host UIs.
• Teardown fixes (a constructor failure after a successful filter_connect used to leave a live RT callback over freed members), removal of per-cycle allocas, distinct silence/discard scratch buffers, once-per-reconfiguration logging with a hard cap.
• The cycle policy lives in pipewire_quantum.hpp, free of PipeWire types, unit-tested without a daemon.

Validation

• Unit + integration tests live in the matching ossia/score PR (private daemons in a scratch PIPEWIRE_RUNTIME_DIR, driven via pw-metadata forces; the old code fails them with the exact reported symptoms).
• Behavior validated against the PipeWire sources at 0.3.48 (Ubuntu 22.04), 0.3.65 (Debian 12), 1.0.5 (Ubuntu 24.04), 1.2.8, 1.4.2/1.4.9 (Debian 13), 1.6.2 (Ubuntu 26.04), 1.6.8.
• Two adversarial review passes; final verdict: no critical/major findings, net RT improvement over the previous code.

🤖 Generated with Claude Code