From 03e2a5face2463855a2c534ba00d09f8bdebd893 Mon Sep 17 00:00:00 2001 From: AAA <35992542+TNTcraftHIM@users.noreply.github.com> Date: Mon, 24 Aug 2026 09:10:23 +0800 Subject: [PATCH] docs(release): record Browser v9 production postflight --- docs/README.md | 6 +-- docs/adr/0001-p2p-first-media-topology.md | 2 +- .../0002-memory-resident-protected-rooms.md | 21 ++++---- .../0005-automatic-hybrid-media-routing.md | 23 ++++----- docs/deployment.md | 49 +++++++++++-------- docs/project-memory.md | 20 ++++---- docs/research/advanced-peer-distribution.md | 13 +++-- docs/research/browser-background-capture.md | 7 +-- docs/research/browser-screen-audio-quality.md | 6 +-- docs/research/low-server-media-routes.md | 16 +++--- docs/research/peer-assisted-media.md | 30 ++++++------ docs/research/realtime-quality-adaptation.md | 17 ++++--- docs/session-handoff.md | 38 ++++++++------ docs/status.md | 28 ++++++----- docs/todo.md | 15 +++--- docs/verification-status.md | 24 ++++----- docs/方案设计.md | 9 ++-- 17 files changed, 167 insertions(+), 157 deletions(-) diff --git a/docs/README.md b/docs/README.md index b1eea94..f01cc44 100644 --- a/docs/README.md +++ b/docs/README.md @@ -4,10 +4,10 @@ - [方案设计](./方案设计.md): accepted implementation design; unfinished release and validation work is tracked in the current TODO ledger. - [Project memory](./project-memory.md): durable current product and source snapshot to read at the start of future work. - [Current status](./status.md): bounded current/index snapshot of production, active milestones, decisions, blockers, and links to detail. -- [Verification status](./verification-status.md): exact v9 source gates, current v8 production evidence, open physical proof boundaries, and expensive-test applicability. +- [Verification status](./verification-status.md): exact integrated/deployed v9 gates, current production evidence, open physical proof boundaries, and expensive-test applicability. - [Session handoff](./session-handoff.md): temporary bootstrap prompt that points a new session back to the canonical truth owners. - [Current TODO](./todo.md): unresolved work, active truth holds, and decisions that still require user confirmation. -- [Deployment](./deployment.md): exact v8 current/rollback production configuration, the not-yet-deployed v9 source contract, release operations, and transport evidence boundaries. +- [Deployment](./deployment.md): exact current v9 production and rollback configuration, release operations, and transport evidence boundaries. - [Maintenance guide](./maintenance.md): Git workflow, context hygiene, document lifecycle, research policy, and automation. - [P2P WebRTC research](./research/webrtc-p2p-screen-sharing.md): evidence, bandwidth model, browser constraints, reference implementations, and feasibility assessment. - [Peer-assisted media research](./research/peer-assisted-media.md): browser shared-encode limits, standard relay re-encoding, deterministic sticky topology, v9 exact-route implementation evidence, and remaining physical gates. @@ -25,7 +25,7 @@ - [ADR-0001](./adr/0001-p2p-first-media-topology.md): historical P2P-first baseline; later access and automatic-routing decisions supersede its stale current-state details. - [ADR-0002](./adr/0002-memory-resident-protected-rooms.md): four-digit leased in-memory rooms, local Host defaults, scoped Viewer grants, and orthogonal code entry. - [ADR-0004](./adr/0004-peer-assisted-media-experiment.md): historical standard-WebRTC peer-assisted experiment and reusable evidence. -- [ADR-0005](./adr/0005-automatic-hybrid-media-routing.md): accepted P2P-first single-reconcile route model; its v8 baseline is deployed, while exact v9 first-frame/resource/lifecycle corrections are implemented but not yet deployed and remaining real-network validation is tracked in verification status. +- [ADR-0005](./adr/0005-automatic-hybrid-media-routing.md): accepted and deployed v9 P2P-first single-reconcile route model; remaining real-network validation is tracked in verification status. - [ADR-0006](./adr/0006-fixed-high-native-sender-canary.md): proposed fixed-`HIGH` native canary, current no-go result, and staged revalidation boundary. - [ADR-0007](./adr/0007-demand-driven-dual-representation-quality.md): accepted path-isolated `HIGH + at most one LOW` policy, optional idle-layer stop, evidence contract, and SVC boundary. - [ADR-0008](./adr/0008-window-scoped-audio-capture.md): browser window-audio hint and the Windows WASAPI process-loopback boundary. diff --git a/docs/adr/0001-p2p-first-media-topology.md b/docs/adr/0001-p2p-first-media-topology.md index a0d5b8a..cfac541 100644 --- a/docs/adr/0001-p2p-first-media-topology.md +++ b/docs/adr/0001-p2p-first-media-topology.md @@ -31,7 +31,7 @@ contradict the private-room cost model or duplicate mature WebRTC capabilities. ## Current Ownership [ADR-0005](./0005-automatic-hybrid-media-routing.md) owns current routing -invariants and assisted-route roles; the Browser `screener-v8` runtime is +invariants and assisted-route roles; the Browser `screener-v9` runtime is implemented and deployed, while real-network validation remains open. [ADR-0004](./0004-peer-assisted-media-experiment.md) owns only historical peer-assisted evidence. Access and room lifetime are owned by [ADR-0002](./0002-memory-resident-protected-rooms.md). diff --git a/docs/adr/0002-memory-resident-protected-rooms.md b/docs/adr/0002-memory-resident-protected-rooms.md index 5363950..5dbcb4d 100644 --- a/docs/adr/0002-memory-resident-protected-rooms.md +++ b/docs/adr/0002-memory-resident-protected-rooms.md @@ -1,6 +1,6 @@ # ADR-0002: Memory-Resident Rooms And Scoped Viewer Access -- Status: Accepted; v9 source implemented at `d543f38aacad3df5ef65fde1055cc8e733972afe`; production remains v8 +- Status: Accepted; implemented and deployed in exact release `39fcf93` - Date: 2026-08-23 ## Context @@ -160,14 +160,13 @@ the generic `SERVER_ERROR`. None of those paths is folded into ## Implementation Status -Exact source `d543f38aacad3df5ef65fde1055cc8e733972afe` runs the single -`screener-v9` wire and implements this complete room boundary, including -allocation, leases, orthogonal grant/code admission, rotate/revoke, password -policy, local profile replay, restart loss, browser storage privacy, and the -neutral `ROOM_ACCESS_DENIED` result. All expected code-only denials use that -same public result followed by the shared authentication-failed close code. +Production exact `39fcf93bae057fcbb1002702c3be6b90bac9027f`, release `39fcf93`, +runs the single `screener-v9` wire and implements this complete room boundary, +including allocation, leases, orthogonal grant/code admission, rotate/revoke, +password policy, local profile replay, restart loss, browser storage privacy, +and the neutral `ROOM_ACCESS_DENIED` result. All expected code-only denials use +that same public result followed by the shared authentication-failed close code. -Production exact `8f5b3f192ddd010ca01c969008e512191312736a`, release `8f5b3f1`, -still runs `screener-v8`. It implements the memory-resident room core, but not -the v9 neutral code-only denial. No v9 room-entry behavior is deployed yet; -exact operational evidence remains owned by deployment and verification status. +The atomic deployment postflight passed. Its rollback boundary is +`/opt/screener/backups/39fcf93-pre-v9-20260824T004257Z`; exact operational +evidence remains owned by deployment and verification status. diff --git a/docs/adr/0005-automatic-hybrid-media-routing.md b/docs/adr/0005-automatic-hybrid-media-routing.md index c1209ae..079209e 100644 --- a/docs/adr/0005-automatic-hybrid-media-routing.md +++ b/docs/adr/0005-automatic-hybrid-media-routing.md @@ -1,6 +1,6 @@ # ADR-0005: Automatic Hybrid Media Routing -- Status: Accepted; route core deployed in v8; v9 route/diagnostic source implemented at `d543f38aacad3df5ef65fde1055cc8e733972afe`, not deployed +- Status: Accepted; v9 route and diagnostic contract deployed in exact release `39fcf93` - Date: 2026-08-20 - Last updated: 2026-08-24 @@ -353,15 +353,13 @@ deployment-wide. ## Current Deployment Boundary -Production exact `8f5b3f192ddd010ca01c969008e512191312736a`, release `8f5b3f1`, -runs the `screener-v8` Browser runtime with only direct/STUN peer and LiveKit -SFU/UDP routes. Its exact configuration, rollback artifacts, and postflight -evidence are owned by the deployment document; real heterogeneous-network and -SFU media validation remains open. - -Exact source `d543f38aacad3df5ef65fde1055cc8e733972afe` implements the single -`screener-v9` route, first-frame, typed-status, and Host-only diagnostic -contract described above. Production has not deployed that source contract. +Production exact `39fcf93bae057fcbb1002702c3be6b90bac9027f`, release `39fcf93`, +runs the single `screener-v9` Browser runtime with direct/STUN peer and LiveKit +SFU/UDP routes, including the route, first-frame, typed-status, and Host-only +diagnostic contract described above. The atomic deployment postflight passed; +its rollback boundary is `/opt/screener/backups/39fcf93-pre-v9-20260824T004257Z`. +Exact configuration and operational evidence are owned by the deployment +document; real heterogeneous-network and SFU media validation remains open. ## Acceptance Boundary @@ -437,9 +435,8 @@ Negative: burst; - make-before-break consumes explicit endpoint and server reservations and may require a bounded-gap cutover when no overlap slot exists; and -- real SFU and target-network evidence is still required. The v9 diagnostic - source is not part of deployed v8 and must ship atomically with its single - current protocol. +- real SFU and target-network evidence is still required. Deploying the v9 + diagnostic does not grant it route authority or close that physical evidence. ## Relationship to other ADRs diff --git a/docs/deployment.md b/docs/deployment.md index 4a8ea83..5632bd3 100644 --- a/docs/deployment.md +++ b/docs/deployment.md @@ -2,11 +2,10 @@ Last verified against upstream documentation: 2026-08-24. -This page records exact release `8f5b3f1` production facts and the deployment -contract for exact Browser v9 source -`d543f38aacad3df5ef65fde1055cc8e733972afe`. V9 is implemented in source but is -not yet deployed. Product direction and pending -work are owned by [project memory](./project-memory.md) and [the TODO ledger](./todo.md). +This page records the production deployment of exact integrated main +`39fcf93bae057fcbb1002702c3be6b90bac9027f`, release `39fcf93`, and the single +Browser `screener-v9` contract. Product direction and pending work are owned by +[project memory](./project-memory.md) and [the TODO ledger](./todo.md). This section documents the repository's UDP-only deployment candidate: one Node.js process provides the built Web client, room API, and WebSocket signaling @@ -23,21 +22,29 @@ ICE/UDP only. Ordinary peer ICE remains STUN-only and production coturn uses the tracked STUN-only configuration with TCP/TLS disabled. The source and production configure no TURN, ICE/TCP, media TCP, or TLS-relayed media. -Production runs exact `8f5b3f192ddd010ca01c969008e512191312736a`, release -`8f5b3f1`, from `/opt/screener/releases/8f5b3f1`. The immutable runtime archive +Production runs exact `39fcf93bae057fcbb1002702c3be6b90bac9027f`, release +`39fcf93`, from `/opt/screener/releases/39fcf93`. The immutable runtime ZIP SHA-256 is -`09c18d3604b64b627b01164b5a8d954fcbaeb567ca12dedf0b89deaac72bd767`. -Its verified rollback boundary is -`/opt/screener/backups/8f5b3f1-precutover-20260823T182438Z`. Local and public -health return 200; Screener, LiveKit, coturn, and nginx are active with -`NRestarts=0`. +`28190c3a69ec937d39ab5d49fdbc8db6a07e6013c2ddd5f5590bf8249bf6bce6`. +Its 40-file path/size/hash manifest SHA-256 is +`0a8bb7bb4c880e80358492a8bdef5d8897bd453b7957861708655e75f717c2bf`. +The verified pre-v9 rollback boundary is +`/opt/screener/backups/39fcf93-pre-v9-20260824T004257Z`; its internal +`SHA256SUMS` hash is +`1f741f29022f5eb1eb311a24f87f5f48598dca7b1879b88f9033c331fa06bd37`. +Local and trusted-IP public `/` and `/healthz` return 200; Screener, LiveKit, +coturn, and nginx are active with `NRestarts=0`. The public main Browser asset is +`assets/index-DLLdorRt.js` with SHA-256 +`891b1fc861b12655d53a38c1dbf56d8981fa4ed24643760ed8d7838efcbf46f3`. -The release deploys the single Browser `screener-v8` wire, random four-digit +The release deploys the single Browser `screener-v9` wire, random four-digit memory rooms with a 24-hour dormant lease, orthogonal grant/code admission, -20-Viewer room admission, the uniform endpoint media-copy cap `2`, the -one-controller exact-candidate route runtime, and stale-v7 rejection before -room authority. The service unit has no writable room StateDirectory; all room -authority is process-memory-only. LiveKit is dedicated, has `room.auto_create: false` and +20-Viewer room admission, the uniform endpoint media-copy cap `2`, and the +one-controller exact-candidate route runtime. A credential-free postflight sent +a well-formed authentication shape with stale `screener-v8`; it received +`INVALID_MESSAGE` and WebSocket close 1008 before room authority without creating +a room. The service unit has no writable room StateDirectory; all room authority +is process-memory-only. LiveKit is dedicated, has `room.auto_create: false` and `max_participants: 21`, and is admitted to one global publication ingress plus twenty subscription egress handles. Coturn listens only on UDP 3478 for STUN; LiveKit media listens on UDP 7882. @@ -237,7 +244,7 @@ lifetime. An actively connected Host prevents expiry; explicit stop or Host disconnect starts the lease, and only the exact Host token renews it before expiry. Viewer activity never renews ownership. `ROOM_DATABASE_PATH` and `ROOM_TTL_SECONDS` fail startup even when blank. -Production `8f5b3f1` accepts 1 through 20 and explicitly selects 20. This is an +Production `39fcf93` accepts 1 through 20 and explicitly selects 20. This is an admission limit, not evidence that every publisher, network, or quality profile can sustain that many streams. `ENDPOINT_MEDIA_COPY_CAPACITY` defaults to 2 and accepts only 1, 2, or 3. It is @@ -250,8 +257,8 @@ must fail or wait before a fourth endpoint copy is issued. Supplying the removed `MAX_PEER_RELAY_DOWNSTREAM_EDGES`, even blank, fails startup. -Production release `8f5b3f1` runs the deployed server and Browser assets -atomically on `screener-v8`; stale v7 Browser and executable-sender wires fail +Production release `39fcf93` runs the deployed server and Browser assets +atomically on `screener-v9`; every stale Browser or executable-sender wire fails before room authority. Native senders and helpers are outside this release. Restore only an exact recorded release with its matching environment, unit, LiveKit, coturn, and firewall snapshot when rolling back. @@ -496,7 +503,7 @@ Open only these public listeners: ## Verification -Run these checks from real external networks before calling the deployment usable: +Run these checks from real external networks before closing route acceptance: 1. Open the official [Trickle ICE sample](https://webrtc.github.io/samples/src/content/peerconnection/trickle-ice/) and test the configured STUN URL. It must produce an `srflx` candidate over diff --git a/docs/project-memory.md b/docs/project-memory.md index f4ce776..58bfaec 100644 --- a/docs/project-memory.md +++ b/docs/project-memory.md @@ -27,22 +27,20 @@ Last updated: 2026-08-24 ## Current Source And Production -- Canonical integration truth remains the root `main` branch. The current Browser v9 source checkpoint is exact `d543f38aacad3df5ef65fde1055cc8e733972afe`; it must be integrated atomically before deployment, and auxiliary branches or older worktrees do not supersede it. -- Current source admits up to `20` Viewers and implements the uniform `1/2/3` endpoint cap, single Browser `screener-v9` wire, exact prepare candidate, first-decoded-frame commit, strict rollback revision, decoded-progress stall, a two-stage direct/SFU operation deadline, and one event-driven room controller. A short-lived exact-generation decoded-frame observer proves only the pending candidate inside the existing total deadline; the periodic stats sampler remains responsible for active-path diagnostics and stalls. Ordinary peer ICE is STUN-only and the sole application fallback is SFU/UDP; stale TURN environment keys fail startup. SFU admission uses exact publication and Viewer-subscription handles with explicit no-default ingress/egress capacities and a listener-fenced dedicated LiveKit owner. -- Current source and production implement the memory-resident room model: random free four-digit codes, the configurable dormant lease, exact-Host resume, restart loss, local creation-preference replay, orthogonal Viewer grants and `open | password | disabled` code entry, and direct invitation/policy controls. SQLite room persistence, `ROOM_DATABASE_PATH`, `ROOM_TTL_SECONDS`, and the writable room StateDirectory are absent from both current runtimes; the stopped v7 SQLite snapshot exists only in the verified rollback backup. -- Production runs exact `8f5b3f192ddd010ca01c969008e512191312736a`, release `8f5b3f1`, wire `screener-v8`; `/opt/screener/backups/8f5b3f1-precutover-20260823T182438Z` is its verified rollback boundary. -- Production implements the endpoint-cap and two-stage direct-to-SFU controller contract, admits 20 Viewers, and uses LiveKit admission of one publication ingress plus 20 subscription egress handles on a dedicated non-auto-create instance. Coturn provides STUN-only UDP 3478 with TCP/TLS and relay ranges disabled; LiveKit media uses UDP 7882. +- Production runs Browser runtime `39fcf93bae057fcbb1002702c3be6b90bac9027f`, release `39fcf93`, on `screener-v9`. Canonical root `main` contains that runtime plus the docs-only postflight truth; auxiliary branches and older worktrees do not supersede it. +- Integrated source and production admit up to `20` Viewers and implement the uniform `1/2/3` endpoint cap, exact prepare candidate, first-decoded-frame commit, strict rollback revision, decoded-progress stall, a two-stage direct/SFU operation deadline, and one event-driven room controller. A short-lived exact-generation decoded-frame observer proves only the pending candidate inside the existing total deadline; the periodic stats sampler remains responsible for active-path diagnostics and stalls. Ordinary peer ICE is STUN-only and the sole application fallback is SFU/UDP; stale TURN environment keys fail startup. SFU admission uses exact publication and Viewer-subscription handles with explicit no-default ingress/egress capacities and a listener-fenced dedicated LiveKit owner. +- Integrated source and production use the memory-resident room model: random free four-digit codes, the configurable dormant lease, exact-Host resume, restart loss, local creation-preference replay, orthogonal Viewer grants and `open | password | disabled` code entry, and direct invitation/policy controls. SQLite room persistence, `ROOM_DATABASE_PATH`, `ROOM_TTL_SECONDS`, and a writable room StateDirectory are absent from the current runtime. +- Production runs from `/opt/screener/releases/39fcf93`. Its immutable runtime ZIP SHA-256 is `28190c3a69ec937d39ab5d49fdbc8db6a07e6013c2ddd5f5590bf8249bf6bce6`; `/opt/screener/backups/39fcf93-pre-v9-20260824T004257Z` is the verified rollback boundary and its `SHA256SUMS` hash is `1f741f29022f5eb1eb311a24f87f5f48598dca7b1879b88f9033c331fa06bd37`. +- Production implements live 64/128/256 kbps audio-ceiling mutation; generation-fenced paused codec prepare, Resume source acknowledgement, decoded-progress proof, and rollback; typed first-frame Viewer presentation and privacy-safe on-demand route diagnostics; neutral room-code denial and responsive entry controls; exactly three recommended profiles with `1080p30` as default and advanced-only `854x480`; and no parent-edge quality-proof wire. - Browser SFU subscribers reconcile eligible Host screen publications across connect/activate event ordering, participant/track arrival, and reconnect. Production LiveKit logs only warn/error, and the application service has a bounded same-host LiveKit readiness preflight. -- Current source implements live 64/128/256 kbps audio-ceiling mutation; generation-fenced paused codec prepare, Resume source acknowledgement, decoded-progress proof, and rollback; typed first-frame Viewer presentation and privacy-safe on-demand route diagnostics; neutral room-code denial and responsive entry controls; exactly three recommended profiles with `1080p30` as default and advanced-only `854x480`; and removal of the unused parent-edge quality-proof wire. Production retains the v8 behavior and has none of this v9 batch yet. -- Exact source `d543f38aacad3df5ef65fde1055cc8e733972afe` passed 670 Web tests in 48 files, TypeScript typecheck, client/server production builds, the access/privacy gate, production-dependency audit, and repository hygiene. Its one-Host/20-Viewer Chrome loopback decoded every Viewer and kept endpoint fanout within cap `2`, but used direct local peer routes and observed no SFU publication; it is not public-network, SFU, mobile, audio-quality, codec-switch, H.264 performance, or background-lifecycle evidence. -- `screener`, LiveKit, coturn, and nginx are healthy; local and public health return 200 and `screener` has `NRestarts=0`. Deployment detail is owned by [deployment](./deployment.md). +- Exact runtime source `d543f38aacad3df5ef65fde1055cc8e733972afe`, integrated without runtime changes by main `39fcf93bae057fcbb1002702c3be6b90bac9027f`, passed 670 Web tests in 48 files, TypeScript typecheck, client/server production builds, the access/privacy gate, production-dependency audit, and repository hygiene. Its one-Host/20-Viewer Chrome loopback decoded every Viewer and kept endpoint fanout within cap `2`, but used direct local peer routes and observed no SFU publication; it is not public-network, SFU, mobile, audio-quality, codec-switch, H.264 performance, or background-lifecycle evidence. +- Postflight found `screener`, LiveKit, coturn, and nginx active with `NRestarts=0`; local and public `/` and `/healthz` return 200, every served client file matches the immutable release, the public Browser bundle contains `screener-v9` and no `screener-v8`, the release shares no regular-file inode with its rollback predecessor, and the accepted socket/firewall boundary is intact. No current v9 media room was created, so deployment evidence is not route or physical-media acceptance. Detail is owned by [deployment](./deployment.md) and [verification status](./verification-status.md). - Chrome loopback, cap2/cap3, short resource, recovery, MBB, and A/V fixtures are bounded evidence only. They do not establish quality, resource limits, or product policy. ## Current Priority -1. Integrate and atomically deploy the exact Browser v9 source checkpoint without mixing it with the still-live v8 production state. -2. Close the [current evidence ledger](./todo.md) with physical codec/audio, H.264, Host-background, and representative direct/SFU network runs. Browser loopback and state-machine tests do not substitute for those paths. -3. Run the mobile lifecycle matrix and later mechanism-simplification audit only at their stated boundaries; Native/executable and distribution work remain later product phases. +1. Close the [current evidence ledger](./todo.md) with physical codec and live-audio validation, controlled H.264 and Host-background diagnosis, and representative direct/peer-relay/SFU network runs. Browser loopback, state-machine gates, and deployment health do not substitute for those paths. +2. Run the mobile lifecycle matrix and later mechanism-simplification audit only at their stated boundaries; Native/executable and distribution work remain later product phases. ## Working Rules diff --git a/docs/research/advanced-peer-distribution.md b/docs/research/advanced-peer-distribution.md index a7e1da3..d3c8c1b 100644 --- a/docs/research/advanced-peer-distribution.md +++ b/docs/research/advanced-peer-distribution.md @@ -8,7 +8,8 @@ retained evidence. Exact Browser v9 source `d543f38aacad3df5ef65fde1055cc8e733972afe` implements ADR-0005's single child-reparent reconciliation and exact first-frame transaction; production - remains v8, and advanced encoded-media routes remain unimplemented candidates + now runs that v9 contract, and advanced encoded-media routes remain + unimplemented candidates This document is research evidence, not current architecture or a backlog. See [ADR-0005](../adr/0005-automatic-hybrid-media-routing.md) for accepted routing @@ -254,18 +255,16 @@ Every completion is guarded by the current authenticated sessions, share generation, pending route revision, and candidate connection. Sustained bitrate, FPS, resolution, and blur remain diagnostic. -The first room-1 production trace on 2026-08-20 observed two short Host +The historical v8 room-1 production trace on 2026-08-20 observed two short Host participants while two roots remained for roughly 4.6 seconds; all ended with client-requested leave, no track publication survived, and neither service restarted. This proves LiveKit participant entry. The timing is consistent with the then-current one-shot grant refresh and recovery state machine, but logs do not prove those transitions and cannot distinguish connect, source, video publish, sender configuration, optional audio publish, or -transport failure. Exact v9 source implements the accepted diagnostic, which is -not part of deployed v8: it exposes only a closed local stage/outcome enum to an -on-demand Host snapshot -and deliberately keeps raw errors, URLs, tokens, candidates, and addresses out -of wire and logs. +transport failure. The deployed v9 diagnostic exposes only a closed local +stage/outcome enum to an on-demand Host snapshot and deliberately keeps raw +errors, URLs, tokens, candidates, and addresses out of wire and logs. ## Automatic Route Controller Boundary diff --git a/docs/research/browser-background-capture.md b/docs/research/browser-background-capture.md index 8cdfeca..6f5f8fc 100644 --- a/docs/research/browser-background-capture.md +++ b/docs/research/browser-background-capture.md @@ -44,9 +44,10 @@ stable baseline exists; none is a page-keepalive mechanism. ## Current Source Boundary The source review covers exact Browser v9 source -`d543f38aacad3df5ef65fde1055cc8e733972afe`. Production remains exact v8 -`8f5b3f192ddd010ca01c969008e512191312736a`; none of the v9 changes claims or -implements a page-keepalive mechanism. +`d543f38aacad3df5ef65fde1055cc8e733972afe`, integrated and deployed by exact +main `39fcf93bae057fcbb1002702c3be6b90bac9027f`. None of the v9 changes claims or +implements a page-keepalive mechanism, and the production cutover added no +physical background-capture evidence. - `src/client/media/quality.ts` obtains one `getDisplayMedia()` stream, applies ideal/max capture constraints, marks video as `motion`, and applies sender diff --git a/docs/research/browser-screen-audio-quality.md b/docs/research/browser-screen-audio-quality.md index 0447253..39cfc59 100644 --- a/docs/research/browser-screen-audio-quality.md +++ b/docs/research/browser-screen-audio-quality.md @@ -9,8 +9,8 @@ local speech processing unless the request disables it. The source request is explicit. Exact Browser v9 source `d543f38aacad3df5ef65fde1055cc8e733972afe` exposes bounded 64/128/256 kbps choices, applies them to new P2P, browser-relay, and SFU senders, and implements -serialized live mutation with applied readback. Production remains v8 and does -not yet deploy live mutation. Target-device audible proof remains open. +serialized live mutation with applied readback. Production now deploys that v9 +path. Target-device audible proof remains open. ## Scope And Decision @@ -465,7 +465,7 @@ A/V playout timing using a distinguishable stereo fixture plus game/film audio. Share advanced settings offers exactly 64/128/256 kbps and defaults to 128. Exact v9 source applies the selected choice before sharing, to every newly created P2P, browser-relay, or SFU sender, and through a serialized live -mutation. Production v8 does not live-update an active sender. The v9 path reads +mutation; production deploys the same path. It reads the latest desired profile into each sender and keeps endpoint-local applied readback rather than claiming one room-wide applied commit. The setting remains a sender ceiling, not a guaranteed or constant bitrate. Do not expose sample diff --git a/docs/research/low-server-media-routes.md b/docs/research/low-server-media-routes.md index 2941915..807b726 100644 --- a/docs/research/low-server-media-routes.md +++ b/docs/research/low-server-media-routes.md @@ -6,8 +6,9 @@ - Status: research and dated route evidence. Current invariants and assisted transport roles are in [ADR-0005](../adr/0005-automatic-hybrid-media-routing.md). Exact Browser v9 source `d543f38aacad3df5ef65fde1055cc8e733972afe` - implements the current route transaction and diagnostics; production remains - v8, while real-network validation remains in [verification status](../verification-status.md). + implements the current route transaction and diagnostics; production now runs + that v9 contract, while real-network validation remains in + [verification status](../verification-status.md). ## Current Transport Conclusion @@ -59,7 +60,7 @@ fail closed at `sender-config`. After correcting that contract, Viewer inbound packets and decoded/rendered frames increased, endpoint edges stayed bounded, and both clients left cleanly. TURN did not participate in that first run. A later exact-source canary against the then-production media tuple proved the -historical Host-ingress selected relay described below. The current `8f5b3f1` +historical Host-ingress selected relay described below. A historical v8 production canary subsequently committed two SFU assignments and decoded 1920x1080 video. These are functional, not performance, evidence; heterogeneous networks, mobile, resources, and endurance remain open. @@ -300,9 +301,8 @@ ingress/egress caps. ## Privacy-Safe Route Diagnostic Boundary Start with locally retained, redacted `webrtc-internals` as manual ground truth. -The deployed v8 product already has a user-initiated local stats export. Exact -v9 source also implements the route-timing snapshot, but it is not deployed. It -may observe only existing +Production v9 deploys the user-initiated local stats export and route-timing +snapshot. It may observe only existing join, route-demand, operation-start, candidate-start, first-decoded-frame, settle, share-stop, departure, and room-delete events. It keeps one latest timing/outcome record per current child; a new demand overwrites that record, @@ -557,10 +557,10 @@ counters would not be deployment-wide admission. | Route | Where copies are emitted | Endpoint cost | Evidence status | | --- | --- | --- | --- | | Direct host P2P | Host emits one copy per Viewer | Host upload and sender pipelines grow with Viewers | Baseline evidence; current capacity is owned by the product contract | -| Bounded browser relay DAG | Host and each Web relay emit at most the configured endpoint cap | Ordinary browser, but every relay decodes and re-encodes and adds a hop | V9 source and v8 production admit up to 20; the exact v9 local direct loopback gate passed, while heterogeneous networks remain open | +| Bounded browser relay DAG | Host and each Web relay emit at most the configured endpoint cap | Ordinary browser, but every relay decodes and re-encodes and adds a hop | V9 source and production admit up to 20; the exact v9 local direct loopback gate passed, while heterogeneous networks remain open | | Native shared-encode host | Host targets one encode for standard WebRTC edges | libwebrtc public-API proxy risk spike, with Pion as fallback | Research evidence; still pays per-edge upload | | Native volunteer encoded-RTP relay | Each volunteer forwards one encoded copy | Native install, RTP/RTCP forwarding, packaging, and opt-in relay policy | Research only; no current product authorization | -| SFU service | SFU emits authorized subscription copies | Service pays bounded egress; an authoritative Host publisher supplies media | V9 source implements the current topology/admission and a v8 production canary decoded media; v9 deployment plus heterogeneous-network/resource validation remain open | +| SFU service | SFU emits authorized subscription copies | Service pays bounded egress; an authoritative Host publisher supplies media | Production deploys the v9 topology/admission; only a historical v8 production canary decoded media, so current heterogeneous-network/resource validation remains open | | SFU fallback | SFU emits authorized copies | Additional central ingress and egress cost | Deployed bounded path; real heterogeneous-network and resource acceptance remains open | | SVC plus multiple trees | Peers emit striped layer copies across several trees | Layer scheduling, reassembly, redundancy, and more churn state | Separate conditional spike; target endpoint upload near `B` | | Network coding | Peers or servers emit coded blocks | Generations, buffering, decoding, integrity, and a custom media plane | Trace/FEC spike only; optimize loss recovery, not clean bandwidth | diff --git a/docs/research/peer-assisted-media.md b/docs/research/peer-assisted-media.md index 8107c54..043bbd9 100644 --- a/docs/research/peer-assisted-media.md +++ b/docs/research/peer-assisted-media.md @@ -6,9 +6,9 @@ earlier resource/quality gate remains eight - Status: historical evidence plus the bounded controller. Exact Browser v9 source `d543f38aacad3df5ef65fde1055cc8e733972afe` implements the current - ADR-0005 route transaction; production remains v8 and a controlled canary - decoded SFU media. Heterogeneous-network, mobile, resource, and endurance - evidence remains open. + ADR-0005 route transaction, and production now runs that v9 contract. A + historical v8 canary decoded SFU media. Heterogeneous-network, mobile, + resource, and endurance evidence remains open. This document owns dated measurements and implementation evidence. Current capacity and routing authority live in [ADR-0005](../adr/0005-automatic-hybrid-media-routing.md) @@ -36,11 +36,11 @@ publication and per-Viewer SFU subscriptions provide server-fed ingress when sel same bounded controller. Direct P2P remains the simplest path while a healthy endpoint sender slot is available; later Viewers may be assigned to peers automatically. ADR-0005 makes SFU capacity part of the flagship -target while retaining peer descendants. The first production rollout used a -room-`1` exact smoke and observed only participant entry. Production later -removed that room boundary; a controlled current-release canary subsequently -committed two SFU assignments and decoded 1920x1080 video. That does not close -the real-network or resource matrix. +target while retaining peer descendants. The historical v8 production rollout +used a room-`1` exact smoke and observed only participant entry, then removed +that room boundary. A controlled v8 canary subsequently committed two SFU +assignments and decoded 1920x1080 video. That does not close the real-network or +resource matrix. ## What Browsers Can Share @@ -240,8 +240,8 @@ rather than wire IDs, and `480p` is only the advanced 854x480 resolution. The server stores the latest complete object in a room-count-bounded in-memory map, defaults to 1080p30 at 5 Mbps with balanced priority in v9 source, includes it in peer-assisted authenticated snapshots, and broadcasts Host changes to online -Viewers. Production v8 retains its 1080p60 default and lacks advanced 480p until -the atomic v9 deployment. The value survives a stopped share, is removed with +Viewers. Production v9 uses the same 1080p30 default and advanced 480p boundary. +The value survives a stopped share, is removed with the room, and is not persisted. Ordinary P2P authentication remains unchanged and setting-control messages are forbidden in that mode. @@ -508,9 +508,9 @@ relay experiment keeps standard P2P plus explicit user-operated or central SFU fallbacks. Passing these historical gates proved only that a second design phase was -justified. ADR-0005 subsequently accepted the bounded controller; production -first ran a room-`1` smoke and later removed that rollout boundary. A controlled -current-release canary decoded two SFU assignments; heterogeneous-network, +justified. ADR-0005 subsequently accepted the bounded controller; historical v8 +production first ran a room-`1` smoke and later removed that rollout boundary. A +controlled v8 canary decoded two SFU assignments; heterogeneous-network, resource, and broader audio/A-V verification remain open. The native host shared-encode sender is a separate planned phase regardless of this experiment's result and is not implemented here. @@ -529,7 +529,7 @@ event arrives later. The application therefore needs a small text-message challenge rather than waiting for either protocol Ping/Pong or the old socket's close event. -Exact v9 source and deployed v8 both send +Deployed v9 sends `signaling-challenge { sequence }`, and the server sends the exact `signaling-challenge-response { sequence }` only to that requesting socket. Server and Browser assets deploy atomically; stale Browser and executable-sender @@ -547,7 +547,7 @@ socket generation are ignored, and the server revalidates the current authenticated session before replying. A hidden document, a visibility restore, or an obviously late timer callback clears pending evidence and starts a fresh five-second baseline instead of declaring failure. -This response-only watchdog remains deployed in v8 and retained in v9 source; +This response-only watchdog is deployed in v9; real silent-partition timing remains a production/browser evidence boundary. The response is socket-local, contains no room state, secret, candidate, or raw diff --git a/docs/research/realtime-quality-adaptation.md b/docs/research/realtime-quality-adaptation.md index 45d8ca9..6fa907b 100644 --- a/docs/research/realtime-quality-adaptation.md +++ b/docs/research/realtime-quality-adaptation.md @@ -222,7 +222,8 @@ baseline. `HostSfuRoute` may expose that local snapshot to one Host-only publisher row; it must not duplicate the shared Host-to-SFU ingress inside each SFU Viewer card. Viewer inbound remains the per-Viewer C signal. This needs no wire, server telemetry, global score, selector or new UI framework. Production -v8 does not yet deploy this v9 publisher view. +deploys this v9 publisher view; its target-browser fields and values still need +physical evidence. ## Codec Preference And Evidence Boundary @@ -717,9 +718,9 @@ The three user-visible profiles remain ceilings rather than promised rates: | 1080p30 | 1920x1080 at 30 fps | 5 Mbps | | 720p30 | 1280x720 at 30 fps | 3 Mbps | -Exact v9 source defaults to the middle `1080p30` ceiling; production v8 still -defaults to `1080p60`. Choosing the v9 default trades a 60 fps ceiling for a -1080p capture bound. The recommended set remains exactly the three profiles +V9 source and production default to the middle `1080p30` ceiling. Choosing that +default trades a 60 fps ceiling for a 1080p capture bound. The recommended set +remains exactly the three profiles above. V9 adds `480p` only as an advanced `854x480` resolution whose frame rate and bitrate are selected independently, not as a fourth profile or preset ID. LiveKit currently @@ -740,8 +741,8 @@ guarantees the emitted resolution, frame rate, or bitrate. 480p/720p/1080p/1440p, integer 15-60 fps, 2-12 Mbps, the three preferences, and Automatic/H.264/VP8. The `480p` choice is only advanced `854x480`, not a fourth recommended profile. Its 64/128/256 kbps audio ceiling, default 128, - is live-switchable on the existing Opus path. Production v8 has neither the - 480p advanced resolution nor live audio mutation. The first + is live-switchable on the existing Opus path. Production deploys both the + advanced 480p resolution and live audio mutation. The first codec-switch product boundary is a generation-fenced renegotiation and SFU republish while sharing is explicitly paused; pause or `replaceTrack()` alone does not switch codec. Display capture does not standardize channel-count or @@ -764,8 +765,8 @@ guarantees the emitted resolution, frame rate, or bitrate. - Pausing sharing disables every track in the current capture stream, producing black video and silence without closing the room or media connection. -The exact v9 source implementation deliberately stops at manual bounded -controls and is not yet deployed. It adds no composite score, periodic +The deployed v9 implementation deliberately stops at manual bounded controls. +It adds no composite score, periodic adjustment, automatic codec forcing, SDP bitrate manipulation, or scene detector. Three consecutive samples of one non-`none` native `qualityLimitationReason` produce one explanatory warning; a reason change or diff --git a/docs/session-handoff.md b/docs/session-handoff.md index d6eeec9..738d6a1 100644 --- a/docs/session-handoff.md +++ b/docs/session-handoff.md @@ -32,9 +32,9 @@ Current high-signal boundary: - docs/status.md owns the exact source/production/hold state. - docs/todo.md is the only executable work ledger and owns ordering. - ADR-0005 owns the accepted automatic route model: direct/STUN peer followed - only by the dedicated LiveKit SFU/UDP fallback. Current Browser v9 source - checkpoint `d543f38aacad3df5ef65fde1055cc8e733972afe` and production v8 release - `8f5b3f1` implement that two-stage model. Current source uses one short-lived + only by the dedicated LiveKit SFU/UDP fallback. Exact Browser runtime + `39fcf93bae057fcbb1002702c3be6b90bac9027f` is integrated and deployed as + release `39fcf93` on the single `screener-v9` wire. It uses one short-lived exact-generation decoded-frame observer only for the pending candidate inside the existing total deadline; the periodic stats sampler still owns active-path diagnostics and stalls. Real external-network and SFU media evidence remains @@ -43,10 +43,11 @@ Current high-signal boundary: - ADR-0002 owns the implemented room model: one process-memory RoomStore, random free four-digit codes, configurable 24-hour dormant leases, restart loss, local Host preference replay, an independent expiring Viewer grant, and - open/password/disabled code entry. Current source uses the single - `screener-v9` wire, production uses the single `screener-v8` wire, and neither - runtime uses SQLite; exact rollback artifacts are owned by deployment. -- Exact source `d543f38aacad3df5ef65fde1055cc8e733972afe` implements the atomic Browser + open/password/disabled code entry. Current source and production use the + single `screener-v9` wire and neither runtime uses SQLite; exact rollback + artifacts are owned by deployment. +- Exact runtime source `d543f38aacad3df5ef65fde1055cc8e733972afe`, integrated + without runtime changes by main `39fcf93bae057fcbb1002702c3be6b90bac9027f`, implements the Browser v9 batch: live audio-ceiling mutation, paused codec switching with exact Resume source authority and proof, typed Viewer presentation, Host-on-demand route diagnostics, neutral room-code denial, responsive entry controls, default @@ -55,9 +56,15 @@ Current high-signal boundary: repository hygiene. Its exact 20-Viewer Chrome run passed on direct loopback with no SFU publication, so it is not SFU or public-network evidence. -- Production remains exact `8f5b3f192ddd010ca01c969008e512191312736a`, - release `8f5b3f1`, wire `screener-v8`. Do not report v9 as deployed until one - atomic cutover and postflight prove the exact release. +- Production runs exact `39fcf93bae057fcbb1002702c3be6b90bac9027f`, release + `39fcf93`, wire `screener-v9`. The immutable runtime ZIP SHA-256 is + `28190c3a69ec937d39ab5d49fdbc8db6a07e6013c2ddd5f5590bf8249bf6bce6`; + `/opt/screener/backups/39fcf93-pre-v9-20260824T004257Z` is the verified + rollback boundary and its `SHA256SUMS` hash is + `1f741f29022f5eb1eb311a24f87f5f48598dca7b1879b88f9033c331fa06bd37`. + Postflight proved service health, exact public assets, v9/no-v8, release + ownership/inode isolation, socket/firewall continuity, and rollback checksum + without creating a media room; physical route/media evidence remains open. - Ordinary browser ICE owns direct reachability. Do not build port prediction, guessed candidates, NAT classification, TCP probes, quality scores, or quality-driven reparenting. Current-path quality is diagnostic; a healthy @@ -74,13 +81,12 @@ Current high-signal boundary: material. Do not merge or delete them until their unique changes, references, and reparse/junction safety are checked against current main. -Current TODO priority is the atomic v9 deployment, then physical codec and audio -validation, controlled H.264 and Host-background diagnosis, and representative -direct/peer-relay/SFU network acceptance. Mobile lifecycle, distribution/native +Current TODO priority is physical codec and audio validation, controlled H.264 +and Host-background diagnosis, and representative direct/peer-relay/SFU network +acceptance. Mobile lifecycle, distribution/native packages, retained product decisions, and the read-only simplification audit stay at their later boundaries. -Follow the current ledger in order and report each verified integration, -deployment, and physical-evidence boundary without reviving stale agent or branch -facts. +Follow the current ledger in order and report each verified physical-evidence +boundary without reviving stale agent or branch facts. ``` diff --git a/docs/status.md b/docs/status.md index 72b0e0b..126b9dd 100644 --- a/docs/status.md +++ b/docs/status.md @@ -6,40 +6,42 @@ This is the current execution index. Git history owns completed timelines; [veri ## Production -- `https://share.bonfire.icu` runs exact `8f5b3f192ddd010ca01c969008e512191312736a`, release `8f5b3f1`, wire `screener-v8`; `/opt/screener/backups/8f5b3f1-precutover-20260823T182438Z` retains the exact previous application/environment/LiveKit/coturn/nft/unit boundary and the immutable archive SHA-256 is `09c18d3604b64b627b01164b5a8d954fcbaeb567ca12dedf0b89deaac72bd767`. -- `screener`, LiveKit, coturn, and nginx are active; local/public health return 200 and all services report `NRestarts=0`. The v8 unit has no writable room `StateDirectory`, the process has no SQLite descriptor, and the old live SQLite path is absent. +- `https://share.bonfire.icu` runs exact integrated main `39fcf93bae057fcbb1002702c3be6b90bac9027f`, release `39fcf93`, wire `screener-v9`, from `/opt/screener/releases/39fcf93`. Its immutable runtime ZIP SHA-256 is `28190c3a69ec937d39ab5d49fdbc8db6a07e6013c2ddd5f5590bf8249bf6bce6`; `/opt/screener/backups/39fcf93-pre-v9-20260824T004257Z` is the verified rollback boundary and its `SHA256SUMS` hash is `1f741f29022f5eb1eb311a24f87f5f48598dca7b1879b88f9033c331fa06bd37`. +- `screener`, LiveKit, coturn, and nginx are active/running; local/public `/` and `/healthz` return 200 and all four services report `NRestarts=0`. Every served client file matches the immutable release, `assets/index-DLLdorRt.js` has SHA-256 `891b1fc861b12655d53a38c1dbf56d8981fa4ed24643760ed8d7838efcbf46f3`, contains one `screener-v9` literal and no `screener-v8`, and the retired v8 asset returns 404. +- The release is root-owned, has no group/world-writable real file or directory, has no dangling or escaping symlink, and shares zero regular-file inodes with release `8f5b3f1`. The service process resolves its working directory to exact release `39fcf93`; it has no writable room `StateDirectory` or SQLite runtime. - Production admits one Host plus 20 Viewers, applies endpoint capacity `2`, rejects stale Browser and executable-sender wires before room authority, and runs the one-controller exact-candidate route model with one staged total deadline. Rooms use random free four-digit codes, a 24-hour dormant lease, restart loss, local Host creation preferences, independent Viewer grants, and `open | password | disabled` code entry. LiveKit remains dedicated with `room.auto_create: false`, `max_participants: 21`, and global admission `1` publication ingress / `20` subscription egress. - Production media ports are STUN-only UDP 3478 and LiveKit UDP 7882; coturn TCP/TLS and relay ranges are disabled. The public Web ingress remains TCP 80/443; Node 8787 and LiveKit control/signaling 7880 are internal-only. These deployment facts do not close the real heterogeneous-network, SFU, mobile, or endurance evidence boundaries. -- SFU subscribers reconcile Host screen publications across connect, activation, participant arrival, track publication, and reconnect. A controlled production canary forced two SFU roots; both committed `route-ready`, reached active SFU assignments, and decoded 1920x1080 video. LiveKit runs at `warn`/Pion `error`, and the Screener unit waits boundedly for the same-host LiveKit control listener before startup. +- SFU subscribers reconcile Host screen publications across connect, activation, participant arrival, track publication, and reconnect. LiveKit runs at `warn`/Pion `error`, and the Screener unit waits boundedly for the same-host LiveKit control listener before startup. Postflight created no v9 media room, so physical direct, peer-relay, and SFU behavior remains an open current-release gate. ## Current Source -- Canonical integration truth remains the root `main` branch. The current Browser v9 source checkpoint is exact `d543f38aacad3df5ef65fde1055cc8e733972afe`; auxiliary branches and older worktrees do not supersede it, and it is not the deployed release. +- Canonical root `main` is the source and integration truth. It contains the deployed Browser runtime checkpoint `39fcf93bae057fcbb1002702c3be6b90bac9027f` plus this docs-only postflight truth; auxiliary branches and older worktrees do not supersede it. - The single Browser `screener-v9` boundary rejects stale clients before room authority. Current source implements one Host plus up to `20` Viewers, one steady outbound media-copy cap for every non-server endpoint (default `2`, static `1/2/3`), and the process-memory room model with random four-digit codes, a default 24-hour dormant lease, exact-Host resume, restart loss, local Host preference replay, independent token invitations, `open | password | disabled` code entry, and no SQLite runtime. - One event-driven controller owns the committed graph and at most one room-serial child operation. It uses one deterministic candidate list/cursor and one total direct-then-SFU deadline; exact admission and physical resources remain charged through drain, and the pending candidate commits only after an exact-generation decoded-frame proof. A short-lived 100 ms stats observer proves only that candidate inside the existing deadline, while the 2-second sampler remains responsible for active-path diagnostics and decoded-frame stalls. Healthy edges remain sticky and current-path quality does not authorize reparenting. - Ordinary peer ICE is STUN-only and the only application fallback is the dedicated LiveKit SFU over UDP. SFU generations use explicit no-default ingress/egress capacities, exact `reserved | committed | draining` accounting, delete-plus-absence release, one Host publication, and exact Viewer subscription handles. No Screener TURN, ICE/TCP, media TCP, or TLS-relayed media route exists. - Current source implements live 64/128/256 kbps audio-ceiling mutation for current and future Host/relay/SFU senders. It also implements paused `automatic | H.264 | VP8` switching as one generation-fenced prepare/Resume/source-ack/proof transaction with a server-monotonic `resumeAttempt`, authoritative re-pause, bounded rollback preparation, and no automatic Resume. - Current source implements typed first-frame Viewer presentation and recovery, Chinese user-facing route/access failures, privacy-safe failed-page export, authenticated Host-only on-demand route snapshots, neutral `ROOM_ACCESS_DENIED` room-code admission, and responsive entry controls. The unused parent-edge quality-proof protocol is absent. - Recommended quality remains exactly `1080p60`, `1080p30`, and `720p30`; current source defaults to `1080p30`. Advanced resolution adds `480p` as `854x480` without adding a fourth preset, and advanced FPS and bitrate remain independent. -- Exact source `d543f38aacad3df5ef65fde1055cc8e733972afe` passed 670 Web tests in 48 files, TypeScript typecheck, client/server production builds, the access/privacy gate, production-dependency audit, and repository hygiene. Its exact one-Host/20-Viewer Chrome loopback passed every gate with all Viewers decoding and Host/relay fanout bounded by cap `2`; all observed media routes were local direct peers and no SFU publication appeared. This is source, state-machine, build, privacy, and direct-loopback evidence, not deployment, public-network, SFU, mobile, physical audio/codec, H.264 performance, or Host-background evidence. +- Exact runtime source `d543f38aacad3df5ef65fde1055cc8e733972afe`, integrated without runtime changes by main `39fcf93bae057fcbb1002702c3be6b90bac9027f`, passed 670 Web tests in 48 files, TypeScript typecheck, client/server production builds, the access/privacy gate, production-dependency audit, and repository hygiene. Its exact one-Host/20-Viewer Chrome loopback passed every gate with all Viewers decoding and Host/relay fanout bounded by cap `2`; all observed media routes were local direct peers and no SFU publication appeared. This is source, state-machine, build, privacy, and direct-loopback evidence, not public-network, SFU, mobile, physical audio/codec, H.264 performance, or Host-background evidence. ## Current Milestone -1. Integrate and deploy Browser v9 as one atomic release; production stays on exact v8 until postflight proves the full checkpoint. -2. Validate codec switching and live audio ceilings on physical direct, peer-relay, and SFU media paths, including actual codec/bitrate, first-frame, source authority, rollback, audible quality, and A/V synchronization. -3. Reproduce the dated H.264/blur and Host background/minimized reports under controlled conditions, then finish representative ICE/STUN/SFU acceptance including mobile networks. Browser port prediction, NAT classification, TCP probing, fake page keepalive, and quality-driven reparenting remain outside the accepted model. +1. Validate codec switching and live audio ceilings on physical direct, peer-relay, and SFU media paths, including actual codec/bitrate, first-frame, source authority, rollback, audible quality, and A/V synchronization. +2. Reproduce the dated H.264/blur and Host background/minimized reports under controlled conditions. +3. Finish representative ICE/STUN/SFU acceptance including mobile networks. Browser port prediction, NAT classification, TCP probing, fake page keepalive, and quality-driven reparenting remain outside the accepted model. ## Active Boundaries - `fix/configurable-relay-cap` is an old, incomplete draft and must not be merged as-is. - Open PR #192 and the Native stack are evidence/research, not pending product releases. Native senders, capture helpers, shared-encode executables, and their test binaries are outside the current Browser milestone and are not built or run. - Deployed surfaces and retained candidates that still need product decisions are indexed only in [the TODO ledger](./todo.md); do not extend or roll them back automatically. -- Room lifetime, authorization/storage semantics, restart loss, and rollback restoration remain aligned. Source uses the v9 stale-client boundary and new room-entry presentation; production remains on the v8 boundary and v8 UI until atomic deployment. +- GitHub Actions run `32677084865` for the v9 integration did not start a step (`runner_id=0`) because the account payment or spending limit blocked runner allocation. It produced no code evidence and was not retried; the exact local gates remain the current source evidence. +- Room lifetime, authorization/storage semantics, restart loss, Browser v9 entry/presentation, and rollback restoration are aligned between exact main and production. - Real SFU recovery, heterogeneous networks, mobile lifecycle, audio/A-V device behavior, and endurance/resource measurements remain external acceptance evidence, not blockers for unrelated reversible work. ## Current Hold -There is no active P0/P1 source hold. Browser v9 is implemented and locally gated but not deployed; -production remains on exact v8 until the atomic release and postflight complete. Physical codec/audio, -heterogeneous-network, SFU, H.264/background, and mobile evidence remains open. Native/executable work -and broad repository cleanup remain outside this release boundary. +There is no active P0/P1 source or deployment hold. Browser v9 is integrated, locally gated, atomically +deployed, and postflight-clean. Physical codec/audio, heterogeneous-network, SFU, H.264/background, +and mobile evidence remains open. Native/executable work and broad repository cleanup remain outside +the current evidence boundary. diff --git a/docs/todo.md b/docs/todo.md index 43cad3c..7f0f683 100644 --- a/docs/todo.md +++ b/docs/todo.md @@ -6,16 +6,15 @@ Only items in **Now** are executable after their stated decision gate. A branch ## Now -1. **Deploy Browser v9 atomically.** Integrate the exact `d543f38aacad3df5ef65fde1055cc8e733972afe` runtime checkpoint with its aligned truth, build the clean exact integration commit, and cut one release containing the single `screener-v9` wire. Verify archive identity, stale-v8 rejection before room authority, service health, public assets, media listeners, zero restarts, secret-safe logs, and rollback readiness before declaring production v9. Do not publish a protocol subset or mix v8 and v9 assets. -2. **Physically validate paused codec switching.** On current Chrome and Edge, exercise `automatic | H.264 | VP8` across a direct Viewer, a browser-relay descendant, and an SFU subscriber. Capture the exact negotiated outbound/inbound codec, source-enabled acknowledgement boundary, newly decoded progress, and first presented frame after each normal Resume. Exercise a real preparation or proof failure and prove authoritative re-pause plus old-preference rollback on the next user Resume; local state-machine tests alone do not close this item. -3. **Physically validate live screen-audio ceilings.** With audible game/music capture, switch 64/128/256 kbps while sharing across direct, browser-relay, and SFU paths, then create a new edge and switch source. Record sender readback, observed bitrate, route continuity, audible result, and A/V synchronization. Treat every setting as a ceiling, and do not infer fidelity or room-wide atomic convergence from configuration alone. -4. **Diagnose the dated H.264/blur report.** Reproduce the 2026-08-19 then-production release `769de201f7cc` against current source on the same Host/browser/driver/game and one wired direct Viewer, changing one variable at a time. Implement a codec-specific repair only if codec/encoder evidence identifies it; otherwise fix the proven capture, sender, BWE, or lifecycle cause. -5. **Diagnose desktop Host background/minimized performance.** On the same machine, dynamic scene, direct Viewer, browser, and fresh share, compare foreground, occluded, minimized, and hidden states while separately verifying actual negotiated VP8/H.264. Correlate capture settings/FPS, frames captured/encoded/sent/decoded, bitrate, `qualityLimitationReason`, encode time, browser/game CPU and GPU, and the existing local-preview pause boundary. Treat browser scheduling/throttling and codec effects as hypotheses until measured. Do not spoof page activity, add keepalive timers, or misuse Wake Lock; if current Chrome/Edge cannot preserve the accepted Host behavior through standard Web APIs, record that capability boundary before considering the packaged/native Host. -6. **Finish real-network route acceptance.** Measure standard ICE/STUN direct paths, peer relay, SFU ingress/subscription, exact first-frame commit and rollback, relay-ingress repair with subtree retention, disconnect/capacity drain, pause/Resume, and bounded explicit failure across representative IPv4/IPv6 NATs and mobile networks. Include an all-UDP-blocked case to establish the current failure boundary. Do not add port prediction, NAT classification, TCP probes, guessed candidates, route scores, or quality-driven reparenting. +1. **Physically validate paused codec switching.** On current Chrome and Edge, exercise `automatic | H.264 | VP8` across a direct Viewer, a browser-relay descendant, and an SFU subscriber. Capture the exact negotiated outbound/inbound codec, source-enabled acknowledgement boundary, newly decoded progress, and first presented frame after each normal Resume. Exercise a real preparation or proof failure and prove authoritative re-pause plus old-preference rollback on the next user Resume; local state-machine tests alone do not close this item. +2. **Physically validate live screen-audio ceilings.** With audible game/music capture, switch 64/128/256 kbps while sharing across direct, browser-relay, and SFU paths, then create a new edge and switch source. Record sender readback, observed bitrate, route continuity, audible result, and A/V synchronization. Treat every setting as a ceiling, and do not infer fidelity or room-wide atomic convergence from configuration alone. +3. **Diagnose the dated H.264/blur report.** Reproduce the 2026-08-19 then-production release `769de201f7cc` against current source on the same Host/browser/driver/game and one wired direct Viewer, changing one variable at a time. Implement a codec-specific repair only if codec/encoder evidence identifies it; otherwise fix the proven capture, sender, BWE, or lifecycle cause. +4. **Diagnose desktop Host background/minimized performance.** On the same machine, dynamic scene, direct Viewer, browser, and fresh share, compare foreground, occluded, minimized, and hidden states while separately verifying actual negotiated VP8/H.264. Correlate capture settings/FPS, frames captured/encoded/sent/decoded, bitrate, `qualityLimitationReason`, encode time, browser/game CPU and GPU, and the existing local-preview pause boundary. Treat browser scheduling/throttling and codec effects as hypotheses until measured. Do not spoof page activity, add keepalive timers, or misuse Wake Lock; if current Chrome/Edge cannot preserve the accepted Host behavior through standard Web APIs, record that capability boundary before considering the packaged/native Host. +5. **Finish real-network route acceptance.** Measure standard ICE/STUN direct paths, peer relay, SFU ingress/subscription, exact first-frame commit and rollback, relay-ingress repair with subtree retention, disconnect/capacity drain, pause/Resume, and bounded explicit failure across representative IPv4/IPv6 NATs and mobile networks. Include an all-UDP-blocked case to establish the current failure boundary. Do not add port prediction, NAT classification, TCP probes, guessed candidates, route scores, or quality-driven reparenting. ## Accepted Later Roadmap -These items are real product work, ordered after the current release boundary; they are not permission to resume an old branch wholesale. +These items are real product work, ordered after the current physical-media, real-network, and product-decision gates; they are not permission to resume an old branch wholesale. 1. **Mobile Viewer lifecycle.** Run Android Chrome and iOS Safari device matrices for autoplay gesture, foreground/background audio, foreground video recovery, lock/page reclamation, rotation, Wi-Fi/cellular migration, and an assigned relay's outbound-media survival or controller failover across those transitions. Preserve the same media element and current reconnect path; do not promise background video composition, background relay continuity, or unsupported lock-screen behavior. 2. **Platform output only when real.** Revisit AirPlay/Cast only when a target browser and physical receiver prove the live `MediaStream` contract. System mirroring remains external; no placeholder button, custom receiver, or server transcode is scheduled. @@ -41,7 +40,7 @@ These decisions are not permission to continue old branches, and current deploym - Open PR #192 measures synthetic flash/tone timing; it is not an A/V correction feature. - The Native PR stack #16/#18/#22/#23/#25/#28 and related fanout branches are one research program, not six product TODOs. - Cap3, resource, route-recovery, Viewer-MBB, signaling-blackhole, Host-generation, SFU-shaping, NAT, mobile, and endurance artifacts remain bounded evidence. Merge or retain them only when a current decision consumes them. Raw-IP ranking, port prediction, NAT classification, AirPlay/Cast receivers, and mobile background guarantees are not implied by the current implementation batch. -- Real heterogeneous-network SFU, mobile lifecycle, audio/A-V device, and endurance/resource acceptance are scheduled at the relevant release boundary. +- Real heterogeneous-network SFU, mobile lifecycle, audio/A-V device, and endurance/resource acceptance remain owned by the corresponding Now or Later evidence gate. ## Candidate Handling diff --git a/docs/verification-status.md b/docs/verification-status.md index 0a2a593..cc48d33 100644 --- a/docs/verification-status.md +++ b/docs/verification-status.md @@ -10,17 +10,19 @@ Capacity and routing entries below describe the exact tested source or release o ## Deployment Evidence -- Production runs exact `8f5b3f192ddd010ca01c969008e512191312736a`, release `8f5b3f1`, wire `screener-v8`, from `/opt/screener/releases/8f5b3f1`; the immutable runtime archive SHA-256 is `09c18d3604b64b627b01164b5a8d954fcbaeb567ca12dedf0b89deaac72bd767`, and `/opt/screener/backups/8f5b3f1-precutover-20260823T182438Z` contains the exact previous application/environment/LiveKit/coturn/nft/unit boundary. -- The 2026-08-24 postflight found `screener`, LiveKit, coturn, and nginx active with zero restarts; local/public health returned 200. The deployed browser asset `assets/index-sh8IJzwp.js` matches local SHA-256 `7fbc2f7ed67478c160e0122873116c03539084d637f3495cc588af70058364fc` and contains exactly one `screener-v8` wire literal. -- Production uses endpoint capacity `2`, room admission `20`, random free four-digit memory rooms, `ROOM_LEASE_SECONDS=86400`, a dedicated LiveKit instance with `room.auto_create: false` and `max_participants: 21`, and global SFU admission `1` ingress / `20` egress. Coturn is `stun-only`, `no-tcp`, and `no-tls`; only UDP 3478 listens, a randomized external STUN Binding request returned a matching 40-byte success response, and nft exposes only UDP 3478/7882 for Screener media. The v8 service has no StateDirectory or SQLite descriptor and the old live SQLite path is absent. -- A public control-plane smoke passed site access, four-digit creation, Host v8 authentication, stale-v7 rejection before authority, independent code-only and grant Viewer admission, grant rotation that preserved the code Viewer, signaling challenge, and exact room abandonment. A separate service-restart smoke rejected the old Host token and Viewer grant, atomically created a password-policy replacement room, and abandoned it. -- A production Host plus three zero-downstream Viewers forced one peer and two active 1920x1080 SFU roots over LiveKit UDP. This proves the deployed v8 SFU path can publish, subscribe, decode, and clean up under that controlled canary; the reported heterogeneous and cellular failures still require an exact current-release field recheck. +- Production runs exact `39fcf93bae057fcbb1002702c3be6b90bac9027f`, release `39fcf93`, wire `screener-v9`, from `/opt/screener/releases/39fcf93`. The immutable runtime ZIP SHA-256 is `28190c3a69ec937d39ab5d49fdbc8db6a07e6013c2ddd5f5590bf8249bf6bce6`. +- `/opt/screener/backups/39fcf93-pre-v9-20260824T004257Z` retains the exact pre-v9 current target plus application environment, systemd, LiveKit, coturn, nft, and nginx boundary; its internal manifest SHA-256 is `1f741f29022f5eb1eb311a24f87f5f48598dca7b1879b88f9033c331fa06bd37`. +- The 2026-08-24 v9 postflight found `screener`, LiveKit, coturn, and nginx active with zero restarts and local/public health at 200. Public root and all referenced assets returned 200; `assets/index-DLLdorRt.js` matched the release artifact SHA-256 `891b1fc861b12655d53a38c1dbf56d8981fa4ed24643760ed8d7838efcbf46f3` and contains the single `screener-v9` wire with no `screener-v8` literal. +- A public stale-v8 signaling probe reached the v9 server and received the fatal stale-client result before role or room authority. The probe created no room, and the service remained healthy with zero restart. +- GitHub Actions run `32677084865` for integration commit `39fcf93` started no step (`runner_id=0`) because account payment or spending-limit state prevented runner allocation. It has no logs, was not retried, and is neither validation evidence nor a source failure; the exact local gates below remain the available source evidence. +- Production uses endpoint capacity `2`, room admission `20`, random free four-digit memory rooms, `ROOM_LEASE_SECONDS=86400`, a dedicated LiveKit instance with `room.auto_create: false` and `max_participants: 21`, and global SFU admission `1` ingress / `20` egress. Room authority is process-memory-only. Coturn is `stun-only`, `no-tcp`, and `no-tls`; only UDP 3478 listens, and nft exposes only UDP 3478/7882 for Screener media. - The production service orders Screener after LiveKit and boundedly waits for its control listener. Current journals use warn/Pion-error logging, contain zero `PublisherOffer` record, and the current/rollback release regular-file sets share zero inodes. -- Share audio presets, local-only diagnostics, self-check, diagnostic export, and signaling-partition recovery remain deployed surfaces. Their remaining real-route media behavior and target-browser field availability remain unverified. +- This postflight proves archive identity, atomic application/assets, stale-wire rejection, process health, listener/firewall continuity, log sentinels, and rollback readiness only. It did not create a current v9 media room or exercise direct, peer-relay, SFU, audio, codec, mobile, quality, or endurance behavior. +- A historical v8 production canary forced one peer and two active 1920x1080 SFU roots over LiveKit UDP and decoded all three Viewers. It remains dated infrastructure/path evidence, not a current v9 media acceptance result. ## Retained Functional Evidence -- Exact Browser v9 source `d543f38aacad3df5ef65fde1055cc8e733972afe` passed repository hygiene, TypeScript typecheck, client and server production builds, all 670 Web tests in 48 files, the access/privacy Browser gate, and the production-dependency audit with zero vulnerability. This covers the in-memory room/access boundary, v9 protocol, one serialized exact-candidate route controller, generation-bound first-decoded-frame proof, physical resource retention, SFU lifecycle and admission, paused codec transition/rollback/source authority, live media-setting mutation, on-demand route observability, Viewer presentation state, and entry UI. It is local source/state-machine/build evidence and is not deployed production, heterogeneous-network, target-device quality, or real LiveKit packet-flow proof. +- Exact Browser v9 source `d543f38aacad3df5ef65fde1055cc8e733972afe`, integrated by deployed main `39fcf93bae057fcbb1002702c3be6b90bac9027f`, passed repository hygiene, TypeScript typecheck, client and server production builds, all 670 Web tests in 48 files, the access/privacy Browser gate, and the production-dependency audit with zero vulnerability. This covers the in-memory room/access boundary, v9 protocol, one serialized exact-candidate route controller, generation-bound first-decoded-frame proof, physical resource retention, SFU lifecycle and admission, paused codec transition/rollback/source authority, live media-setting mutation, on-demand route observability, Viewer presentation state, and entry UI. These are local source/state-machine/build gates, not heterogeneous-network, target-device quality, or real LiveKit packet-flow proof. - The same exact v9 source passed the required one-Host/20-Viewer local Browser gate with endpoint cap `2`; report SHA-256 is `EB879256C13C75FF1C7F3BC313DE1681FC5D89FC1F51D63B96ECD3ECB93DD09F`. Queue, candidate, first-frame, and final timing each recorded `20/0` populated/missing values. The sorted millisecond evidence is: | Timing | Raw values (ms) | p50 / p95 / max (ms) | @@ -41,14 +43,14 @@ Capacity and routing entries below describe the exact tested source or release o - Routing: exact v9 local direct loopback covers admission-20 initial ingress and exact-candidate first-frame commit timing. Still verify rollback, direct-stage exhaustion and SFU admission, relay-ingress reparent with subtree retention, disconnect/effective-capacity drain, pause/resume, and bounded failure on real browser/media paths. Silent control partitions may wait 30 to 60 seconds for heartbeat detection before the default five-second grace; a non-paused decoded-frame stall may invalidate only that exact child edge. - Quality: production startup blur remains unclassified. One same-`balanced` local A/B retained route/PC/SSRC/track while 720p rose to 1080p, but natural ramp prevents causal, production, or SFU conclusions. Correlate Host capture/encode/send with Viewer receive/decode before changing policy. -- Relay resources: v9 source and v8 production expose the authenticated `1/2/3` endpoint-cap boundary, and local loopback evidence covers 20 Viewers at cap `2`. CPU/GPU/upload and heterogeneous-network measurements remain diagnostics, not authority to change the contract. -- Room scale: v9 source and v8 production admit 20 Viewers plus one Host, and the exact v9 local Browser convergence gate covers that bound on direct loopback. A real public-network 1:20 session, quality, and sustained resource matrix remain open. +- Relay resources: v9 source and production expose the authenticated `1/2/3` endpoint-cap boundary, and local loopback evidence covers 20 Viewers at cap `2`. CPU/GPU/upload and heterogeneous-network measurements remain diagnostics, not authority to change the contract. +- Room scale: v9 source and production admit 20 Viewers plus one Host, and the exact v9 local Browser convergence gate covers that bound on direct loopback. A real public-network 1:20 session, quality, and sustained resource matrix remain open. - SFU: production uses one Host publication with exact Viewer subscriptions and no fixed root-count or room-wide lease rule. Real LiveKit lifecycle/JWT replay, shaped packet-flow, BWE downshift/recovery, resource use, and SFU-fed first-child evidence remain open. Use Linux `tc` or an authorized public canary for per-leaf shaping, never CDP throttling. - Audio: verify the 64/128/256 kbps Share settings, negotiated/observed bitrate, audible music quality, route changes, and game A/V synchronization. Bitrate settings are ceilings, not quality proof. -- Observability: the v8 UI and local stats/export plumbing are deployed, including identity-bound relayed-detail retention and export freshness guards. Exact v9 source also implements the Viewer stage and on-demand Host route snapshot, but those v9 surfaces are not deployed. Target-browser availability and actual values remain unverified for Host SFU sender evidence, codec/fmtp and encoder implementation/power efficiency, media-source and encoded FPS, A/V playout/jitter/concealment, selected candidate endpoints, and bounded same-pair STUN-response observation. All fields diagnose and have no recovery authority; they do not by themselves prove hardware encode, synchronization quality, or route quality. +- Observability: the v9 Viewer stage, local stats/export plumbing, identity-bound relayed-detail retention, export freshness guards, and on-demand Host route snapshot are deployed. Target-browser availability and actual values remain unverified for Host SFU sender evidence, codec/fmtp and encoder implementation/power efficiency, media-source and encoded FPS, A/V playout/jitter/concealment, selected candidate endpoints, and bounded same-pair STUN-response observation. All fields diagnose and have no recovery authority; they do not by themselves prove hardware encode, synchronization quality, or route quality. - Mobile: Android/iOS remain Viewer-only. Autoplay, rotation, iOS lock-screen/page reclamation, background reconnection, and network changes need device evidence. AirPlay/system mirroring is Viewer-local output, not a portable in-app WebRTC output contract. - Native: ADR-0006 has one-Viewer evidence only. Viewer2/FIFO, hardware diversity, endurance, downloaded-package/public-host, game A/V, and browser diversity remain open. -- Access and operations: exact v9 source passed the access/privacy Browser gate. V8 production preflight/postflight, atomic environment/unit replacement, stale-v7 rejection, restart-wide room loss, password-profile creation, grant/code orthogonality, rotate/revoke, memory-only runtime, and exact current journal/nginx sentinel checks passed. Headful same-browser preference replay and the isolated VM/IP clean-port matrix remain open; shared-IP smoke cannot approve them. +- Access and operations: exact v9 source passed the access/privacy Browser gate, and production passed atomic v9 cutover/postflight plus stale-v8 rejection before authority. Restart-wide room loss, password-profile creation, grant/code orthogonality, rotate/revoke, memory-only runtime, and exact current journal/nginx sentinel checks retain their focused evidence. Headful same-browser preference replay and the isolated VM/IP clean-port matrix remain open; shared-IP smoke cannot approve them. ## Evidence Rules diff --git a/docs/方案设计.md b/docs/方案设计.md index e7ad3ac..7dfc0c3 100644 --- a/docs/方案设计.md +++ b/docs/方案设计.md @@ -2,7 +2,7 @@ ## 2026-08-18 14:45 -状态：exact source commit `d543f38aacad3df5ef65fde1055cc8e733972afe` 已实现单一 `screener-v9` Browser 合同，包括 live-media mutation、Viewer presentation/diagnostics、无枚举房间准入和质量选择。Production 仍是 exact `8f5b3f192ddd010ca01c969008e512191312736a`、release `8f5b3f1`、wire `screener-v8`，尚未部署 v9；精确 deployed behavior 只由 deployment 文档记录。 +状态：production Browser runtime 为 exact `39fcf93bae057fcbb1002702c3be6b90bac9027f`、release `39fcf93`、wire `screener-v9`；canonical main 包含该 runtime 和其上的 docs-only postflight truth。当前 Browser 合同包括 live-media mutation、Viewer presentation/diagnostics、无枚举房间准入和质量选择，并已通过原子部署 postflight；精确 deployed behavior 只由 deployment 文档记录。 ## 目标与边界 @@ -174,7 +174,7 @@ Web display-audio 请求显式关闭 `echoCancellation`、`noiseSuppression`、` Host 本地预览直接绑定现有 capture stream，不创建 viewer、`RTCPeerConnection` 或额外媒体边，也不产生 SFU/应用服务器出口。预览仍可能有本地合成、缩放和 GPU 显示成本；在同一动态场景对预览开/关采集 Host CPU、GPU、encode time 和实际 FPS。后台性能诊断必须把 Host 页面前台/遮挡/最小化、被捕获 source 前台/遮挡/最小化以及 preview 播放/暂停分成独立变量，并关联 document visibility/focus、track mute/readyState 与 capture/outbound/inbound stats。页面 timer、伪活跃和 Screen Wake Lock 都不构成屏幕捕获保活方案；若标准浏览器无法维持目标行为，应记录平台能力边界而不是制造第二套 lifecycle。只有稳定收益且捕获、编码和远端画面不变时，才把直播后的默认动态预览改为静止缩略图或隐藏并允许按需展开；隐藏预览绝不停止 capture track 或 sender encode。 -2026-08-19 当时生产 release `769de201f7cc` 的模糊、游戏低帧、持续 `bandwidth` 提示和 Host 刷新恢复都只作为该 release 的用户报告；当前生产已是 `8f5b3f1`。首轮复现必须在相同机器、Chrome/Edge、驱动、游戏场景和单个有线 direct Viewer 上对照该历史 release 与最新 `main`。生命周期实验固定 `automatic`，每个独立 affected baseline 只运行 observe、受影响 `HostPeer` rebuild、capture replace、Host reload 或 preview cycle 中一个动作；codec A/B 另以全新 Host/share/PeerConnection 会话分别请求 automatic/H.264/VP8 并校验 actual codec。质量判断只使用同一 generation 且时间重叠的 capture A、sender B、Viewer C 窗口；stats identity poll 不推进采样 accumulator，可选 encoder 字段缺失保持 unknown。若实际 codec/encoder 不变而 BWE/发送恢复，则下调 codec 根因优先级；只有编码成本异常时才进入受控 codec repair。 +2026-08-19 当时生产 release `769de201f7cc` 的模糊、游戏低帧、持续 `bandwidth` 提示和 Host 刷新恢复都只作为该 release 的用户报告；当前生产已是 `39fcf93`。首轮复现必须在相同机器、Chrome/Edge、驱动、游戏场景和单个有线 direct Viewer 上对照该历史 release 与最新 `main`。生命周期实验固定 `automatic`，每个独立 affected baseline 只运行 observe、受影响 `HostPeer` rebuild、capture replace、Host reload 或 preview cycle 中一个动作；codec A/B 另以全新 Host/share/PeerConnection 会话分别请求 automatic/H.264/VP8 并校验 actual codec。质量判断只使用同一 generation 且时间重叠的 capture A、sender B、Viewer C 窗口；stats identity poll 不推进采样 accumulator，可选 encoder 字段缺失保持 unknown。若实际 codec/encoder 不变而 BWE/发送恢复，则下调 codec 根因优先级；只有编码成本异常时才进入受控 codec repair。 `track.getSettings()` 中存在的 EC/NS/AGC/voice-isolation、`channelCount` 和 `sampleRate` 只能作为当前捕获观测；缺失字段保持未知，Opus 协商仍是独立事实。每个 Web Host 或浏览器 relay 的实际音频 sender 在首次绑定和换源后通过标准 `RTCRtpSender.setParameters()` 请求并读回当前 64/128/256 kbps ceiling；这只是上限，浏览器 WebRTC 拥塞控制仍可降低实际流量，不新增应用层音频降级器。128 kbps 保持默认，因为 RFC 7587 将 20 ms full-band stereo music 的建议区间列为 64--128 kbps，pinned LiveKit 2.22.0 也把 128 kbps 命名为 `musicHighQualityStereo`；256 kbps 是用户显式选择的较高上限，不是质量保证。Peer answer 声明 `stereo=1;maxaveragebitrate=256000`，让同一接收协商覆盖所有三档，实际 sender ceiling 仍由所选档位约束；普通 PC synthetic 不用于标定参数、听感或性能。 @@ -359,10 +359,9 @@ Token-free SFU standby prewarm 保持可选且不创建 participant、publicatio ## 当前交付边界 -- Exact source `d543f38aacad3df5ef65fde1055cc8e733972afe` 是一个完整的 Browser v9 release candidate；live audio ceiling、paused codec transaction、first-frame Viewer presentation、typed failure、按需 route timing、无枚举房间准入、1080p30 默认值和 advanced 480p 必须随单一 `screener-v9` wire 一起原子部署，不发布协议子集。 -- Production 当前仍运行 exact `8f5b3f192ddd010ca01c969008e512191312736a`、release `8f5b3f1`、wire `screener-v8`。Git commit、部署备份和原子 symlink cutover 承担回滚；生产切换前不得把 source v9 行为写成已部署。 +- Production 当前运行 exact `39fcf93bae057fcbb1002702c3be6b90bac9027f`、release `39fcf93`、wire `screener-v9`。Live audio ceiling、paused codec transaction、first-frame Viewer presentation、typed failure、按需 route timing、无枚举房间准入、1080p30 默认值和 advanced 480p 已随同一 wire 原子部署；该 release 的 deployment postflight 已通过，回滚边界为 `/opt/screener/backups/39fcf93-pre-v9-20260824T004257Z`。 - H.264/模糊与 Host 后台性能继续按受控根因证据诊断；标准 ICE/SFU 继续按真实异构网络验收，不增加 guessed candidate、NAT classifier、TCP probe 或 quality-driven reparent。 -- 当前发布面只包含 Web Host、Viewer 和 browser relay。Native sender、capture helper、shared-encode executable 与两个分发包仍由各自后续决策和物理证据驱动，不参与 Browser v9 部署。 +- 当前发布面只包含 Web Host、Viewer 和 browser relay。Native sender、capture helper、shared-encode executable 与两个分发包仍由各自后续决策和物理证据驱动，不属于当前 Browser release。 任何一步只实现当前消费者需要的接口。不得为未来账号、第三种媒体拓扑或原生 sender 预建抽象层。