pipewire: context hardening — combines #226 + #227, reconciled

[jcelerier]

Combines #226 (@ogauthiersat) and #227 into one coherent series, with the two invoke_sync fixes reconciled — merging both PRs as-is would auto-merge cleanly and deadlock (each adds its own lock around the blocking invoke; the recursive mutex would be held twice, and the loop-control hooks release exactly one level, so the worker could never dispatch the invoke).

Contents:

• pipewire: fix thread-loop lifetime & recursive-lock crashes in the shared context #226 merged intact (authorship preserved): invoke_sync lock+guard, the synchronize() rewrite (no more two threads iterating one pw_loop — pw_core_sync + private CV notified from on_core_done), the reconnect() self-destruct fix (no more pthread_join(self) via invoke_sync), and the three watchdog-armed regression examples.
• pipewire: hold the thread-loop lock across blocking invokes; buffer size/stride as ranges #227's format.hpp change kept: SPA_PARAM_BUFFERS_size/stride as CHOICE_RANGE(tight, tight, INT32_MAX) so padded-stride producers (GPU allocations) can link.
• Reconciliation commit: pipewire: hold the thread-loop lock across blocking invokes; buffer size/stride as ranges #227's with_lock wrappers dropped in favor of pipewire: fix thread-loop lifetime & recursive-lock crashes in the shared context #226's single guard (same semantics — lock held exactly once at the invoke, per the hook contract in thread-loop.c impl_before/impl_after); plus a defensive m_thread_loop null check in the early return so a mid-teardown invoke_sync can't lock a null loop.

Validation: ossia score's PipewireRoundtrip harness against a live PipeWire 1.3.0 daemon — 28-cell format×transport matrix (SHM + DMA-BUF, OpenGL + Vulkan, 12 pixel formats incl. padded strides): 24 PASS + 4 PASS(honest-fallback), zero deadlocks/asserts across repeated stream create/destroy cycles. #226's regression examples compile and are included unchanged.

Supersedes #227 (I'll close it); #226 can be closed in favor of this or merged first — this branch contains it verbatim either way.

🤖 Generated with Claude Code

https://claude.ai/code/session_014rZgzE8JjWvHDtaVUhxpLE

---

Update (91ecbd5): invoke_sync is now rewritten to a non-blocking pw_loop_invoke + private mutex/CV with a sync_deadline bound, instead of a lock-held blocking invoke. Rationale: the blocking-invoke lock contract flip-flopped across PipeWire releases (hooks removed/reverted three times upstream; 1.3.0–1.3.80 and 1.5.0–1.5.80 dev clients deadlock with a held lock, all 1.2/1.4 releases require it, 1.5.81+ accepts either) — the non-blocking pattern is contract-stable on every series. Details and the per-series matrix in the comments below. Validated with score's 28-cell round-trip harness and the three regression examples from #226.

[jcelerier]

Follow-up commit 91ecbd5: invoke_sync rewritten to be correct on every PipeWire series, addressing the 1.4-era concerns.

Version archaeology (verified per tag in the pipewire sources, spa/plugins/support/loop.c blocking-wait section): upstream removed and re-reverted the loop-control-hook calls around the blocking-invoke wait three times, so the lock contract of pw_loop_invoke(block=true) from a foreign thread depends on which client library you run against:

PipeWire client	blocking invoke: hooks fired	correct caller pattern
1.2.0–1.2.8, 1.3.81–1.3.83, 1.4.0–1.4.11 (all releases)	yes	lock held exactly once
1.3.0–1.3.80, 1.5.0–1.5.80 (dev series, shipped by some distros)	no	lock must NOT be held → deadlocks otherwise
1.5.81+, 1.6.0–1.6.8	no (self-managing wait)	either

No blocking invoke is correct against all three states — so the new invoke_sync doesn't use one: it queues a non-blocking invoke (fires no hooks, needs no lock, identical on every series) and waits on a private mutex/CV that the trampoline notifies, bounded by sync_deadline so teardown races return instead of hanging. An abandoned handshake under the payload mutex guarantees by-reference captures are either consumed before a timeout is observed or never touched, and the shared_ptr-owned payload prevents use-after-free on either side.

Validation on this branch: ossia score's 28-cell PipeWire round-trip matrix (24 PASS + 4 honest-fallback, zero recurse asserts) plus the three watchdog-armed regression examples from #226 — pipewire_context_sync (320k synchronize() round-trips), pipewire_context_reconnect (8 generations), pipewire_context_subscriptions (incl. on-loop-thread synchronize). Note for packagers: on 1.3.0–1.3.80 / 1.5.0–1.5.80 dev clients, PipeWire's own pw_stream internals are broken regardless of what client code does (that is why upstream reverted twice) — this change just ensures libremidi adds no hazard of its own there.