[GLinnik21]

First PR of the playback-refusal series (#918). It is a pure refactor: each playback request carries one capability value, read once at play start, and every plan, profile and recovery in that request uses it. The planner no longer reads the process-wide devcaps::caps().

Closes #1044

What changed

• One read per request, at the app's play start. app/playback.rs, app/content.rs and app/playback/queue_transport.rs read devcaps::caps() once and pass the Arc<Caps> into route::request_play*. That calls PlaybackSession::begin_attempt, the field's only start writer.
  • PlaybackSession.caps is an Option<Arc<Caps>> because PlaybackSession::IDLE is a const. The Option is handled only in attempt_caps(); the planner takes &Caps.
  • Retries and re-resolves reuse the same request's value. A new play or preview always begins a fresh one.
• Every reader follows the request's value. That covers the planner, the profile builders (TranscodeSpec.caps), the MDE ask, the Encode claim, RetranscodeClaimInputs, RebasePlan, OriginalRecoveryPlan and HlsAbrControl.
  • ResolveEnv carries the value into build_stream, classify_outcome and the preview paths.
  • The zero-argument is_dp_audio, is_dp_audio_track, profile_extra and forced_direct_profile are deleted; is_dp_audio_track_with(&Caps, ..) is the only form left.
• Caps::without(&Facet) narrows a copy by the same rule a learned refusal applies (refusal_ceiling, shared with apply_learned).
  • A native-audio refusal the pump just learned narrows the playing request's own value before the recovery is picked. Nothing re-reads the global.
  • That covers Audio: per-TV Opus limits, and formats the player learns to avoid #1034's conversion and the rollback of a pending HLS→Original trial, which outranks the conversion.
• Readers left on the boot snapshot, by design: engine.rs (×3), the Forced preview, the track menu's "converted by the server" read-out, app/diagnostics.rs and lab/snapshot.rs.

Gate: coverage expansion, not a shrink

ci/check-deps.sh's globals rule now also matches devcaps::caps, is_dp_audio and is_dp_audio_track. Both qualified and bare-after-import spellings match, with the same import rule as peek/revision; the _with forms do not.

• After this change no machine in scope reads them, so the widening lands at zero ledger lines and PINNED_LEDGER_TOTALS is unchanged.
• route/plan.rs is now pinned at zero global capability reads. A later change that puts one back fails make check.
• New self-test: DepGates.test_globals_ledger_sees_the_capability_answer_readers_in_a_machine.

Tests

New, all green:

• devcaps::tests::without_an_audio_facet_narrows_a_copy_by_the_learned_refusal_rule
• plan::track_selection_tests::an_attempt_without_dts_picks_the_ac3_sibling_while_the_wider_attempt_keeps_the_dts
• decision::plan_tests::a_transcode_profile_names_the_codecs_of_the_attempts_own_caps. It needs no global installed or read.
• player::pump::flight_tests::a_native_audio_refusal_learned_during_the_original_trial_reaches_the_rollbacks_profile. Written first; it failed on the branch before the fix ("the rollback's profile must carry the Opus ceiling the pipeline just refused"), then passed.

The flight rig now begins its attempt from the thread's table, so rig tests plan from the table they install. No rig test changed outcome.

Crate suites, on the committed tree:

• make test-crate C=plx_platform: test result: ok. 307 passed; 0 failed
• make test-crate C=plx_plex: test result: ok. 735 passed; 0 failed
• make test-crate C=plx_media: test result: ok. 1766 passed; 0 failed; 64 ignored
• make test-hostsim C=plx_media: test result: ok. 1934 passed; 0 failed; 64 ignored
• make test-crate C=app: test result: ok. 1059 passed; 0 failed
• make test-hostsim: test result: ok. 1172 passed; 0 failed
• bash ci/check-deps.sh: check-deps: all gates green
• python3 ci/check-module-layers.py: green

make check, --no-default-features and the ARM build are left to this PR's CI.

Docs

• session::learn_native_audio_refusal and devcaps::learn_refusal no longer claim the conversion plans against the global answer.
• The Caps doc says the value is read once per attempt.
• plex/mod.rs's dead-code list drops profile_for, which production now reaches.
• docs/webos5-port.md's "codec capability is still asserted, not probed" bullet had been false since the profile started deriving from the set's own codec table. It now says what is probed and what is still asserted (bitDepth=10, the unreadable-table fallback).
• docs/sans-io.md describes the gate.

Notes

• No behaviour change is intended. The plan, the profile bytes and the recovery are the same as main for every caller.
• This conflicts with Transcode: audio above 48 kHz is converted, and the local gate agrees with the profile #1049 in transcoder.rs, plan.rs and devcaps.rs. Whichever lands second merges main.

🤖 Generated with Claude Code