Bound the supervisor's stand-off for a self-managed retry and require it to be fresh (#612)

[iamfatness]

Fixes #612

Problem

When a destination serves its own restart backoff it publishes lastResultCode = "ffmpeg-retry-backoff", and the supervisor stands off so the adapter's bounded ladder is not walked to give-up. That stand-off was keyed on a latched code with no freshness test and no deadline:

• give-up for a destination that really is dead was probabilistic, because the true code lives roughly one media tick per rung while the supervisor polls every 250 ms;
• if frames stopped reaching the sender mid-rung, the latched code was never refreshed and nothing ended the stand-off.

Change

In OutputDestinationSupervisorPolicy::observe:

• Fresh: the stand-off needs this cycle's record (observed); a remembered code from a child that stopped publishing does not hold the supervisor off.
• Bounded: a continuous stand-off may last at most kSelfManagedRetryStandoffMaxMs = the tallest rung the adapter's own ladder can serve (60 s) plus the start grace (15 s). Accepted output ends the stand-off; any other result code resets the clock. When the bound is exceeded the observation goes back to the ordinary fault rules, which arm a fault with the reason "Destination reported its own retry backoff (…) for Ns without producing; the stand-off has expired." and escalate through the ladder.

Nothing else changes: the terminal-code bypass, the healthy-run budget return and give-up are untouched, and a destination alternating backoff with real output (the congested-link shape) never trips the bound, since it is per stand-off.

Verification

• ADestinationServingItsOwnRestartBackoffIsWaitingNotFailing now holds the stand-off through a full tallest rung, then pins that a stale code expires at the bound and arms exactly one fault with the expiry reason.
• New: AnUnobservedBackoffCodeDoesNotHoldTheSupervisorOff (freshness) and ProgressEndsAStandoffBeforeItCanExpire (six minutes of 50 s backoff bursts with output between: no fault, no give-up).
• Dev (D3D11, non-stub) build: full native suite 1,380 pass.
• Not exercised against a live FFmpeg child; the policy is pure and the adapter contract (ffmpeg-retry-backoff for the whole rung) is unchanged.

Also drops the BACKLOG reference to #703, which the owner closed as resolved on 2026-10-02.

🤖 Generated with Claude Code