T4.2.1: Real VideoToolbox VTCompressionSession / VTDecompressionSession wiring (macOS)

docs/PRD/reports/T4.4-report.md

@@ -1,10 +1,10 @@
 # T4.4 — `SignalMessage::Nack` variant + RTT-gated NACK loop
 
-**Status:** Pending Review
+**Status:** Approved
 **Agent:** Kimi Code CLI
 **Started:** 2026-05-11T16:29Z
-**Completed:** 2026-05-11T16:29Z
-**Commit:** (see git log)
+**Completed:** 2026-05-12T05:25Z
+**Commit:** 81042ac
 **PRD:** ../PRD-video-v1.md
 
 ## What I changed
@@ -102,8 +102,27 @@ $ cargo fmt --all -- --check
 
 ## Reviewer checklist (filled in by reviewer)
 
-- [ ] Code matches PRD intent
-- [ ] Verification output is real (re-run if suspicious)
-- [ ] No backward-incompat surprises
-- [ ] Tests cover the new behavior
-- [ ] Approved
+- [x] Code matches PRD intent — `SignalMessage::Nack` + `PictureLossIndication`; `NackSender` (500 ms ring cache) + `NackReceiver` (gap detection + RTT-gated decision + 2×RTT backoff + 50/sec rate cap)
+- [x] Verification output is real — re-ran `cargo test -p wzp-video --lib nack` (8 pass) + `cargo test -p wzp-proto --lib nack` (2 pass) + `cargo test -p wzp-proto picture_loss` (2 pass); wzp-video + wzp-proto clippy clean
+- [x] No backward-incompat surprises — additive (two new signal variants with `#[serde(default)]` version field)
+- [x] Tests cover the new behavior — 8 nack state-machine tests including the tricky cases (wraparound, rate-cap fallback to PLI, backoff per seq)
+- [x] Approved
+
+### Reviewer notes (2026-05-12)
+
+**Substance: real work this time, not stubs.** Both signal variants land cleanly. `NackSender`'s 500 ms TTL ring is the right cache budget for video — long enough to catch most loss/recovery cycles, short enough to bound memory. `NackReceiver`'s RTT-gated NACK-vs-PLI decision matches the PRD ("NACK if RTT < 2 × frame_interval, else PLI"). The 50 NACKs/sec rate cap with batch-truncation-rather-than-rejection is the right call.
+
+**Test coverage is strong:**
+- `receiver_uses_pli_when_rtt_is_high` — the gating logic.
+- `receiver_backoff_respects_2x_rtt` — per-seq backoff prevents spam.
+- `receiver_rate_cap_falls_back_to_pli` — graceful degradation at the limit.
+- `receiver_wraparound_ok` — handles u32 seq wrap (relevant given T1.1's widening).
+- `sender_evicts_after_500ms` — TTL behavior.
+
+**Skeleton self-expansion was warranted.** T4.4 in TASKS.md was a skeleton ("expand before claiming"). Per the agreement from T4.1, agent can self-expand against the parent PRD as long as they stay in scope. Adding `PictureLossIndication` alongside `Nack` is mandated by PRD-video-v1's NACK-loop description ("Otherwise (high RTT) skip NACK and request a keyframe via `PictureLossIndication`"). Properly disclosed under "Deviations".
+
+**Process improvement:** unlike T4.2/T4.3, this one isn't stubs. The PRD acceptance ("P-frame loss recovery") is met at the signaling + state-machine level. Real wiring to encoder.request_keyframe / SFU forwarding happens in T4.6/T4.7 by design.
+
+**One repeated process issue noted (not blocking):** commit `81042ac` still absorbed 36 lines of changes to `T4.3-report.md` (my T4.3 reviewer notes) via `git add -A`. Stop using `git add -A`. This is the third time the agent has swallowed reviewer state into a task commit. Stage only files in your "What I changed".
+
+Standing by for T4.5.