docs(status): close viewer release checkpoint (#262)

docs/adr/0005-automatic-hybrid-media-routing.md

@@ -1,8 +1,9 @@
 # ADR-0005: Automatic Hybrid Media Routing
 
-- Status: The route model is accepted and deployed in exact release `af348ee`
-  on strict v12, including Browser SFU ICE-server isolation, no product
-  diagnostic-download UI, and the retained Host-only acceptance snapshot.
+- Status: Accepted and deployed on strict v12, including Browser SFU ICE-server
+  isolation, no product diagnostic-download UI, and the retained Host-only
+  acceptance snapshot. Exact current identity is owned by
+  [status](../status.md).
 - Date: 2026-08-20
 - Last updated: 2026-08-25
 
@@ -373,9 +374,9 @@ deployment-wide.
 
 ## Current Source And Deployment Boundary
 
-Production and canonical `main` run exact application/runtime revision
-`af348ee1d508a3af02b18a7f46c461953798e19d`, release `af348ee`, on strict
-`screener-v12` with the direct/STUN peer plus LiveKit SFU/UDP route model.
+Production and canonical application/runtime source use strict `screener-v12`
+with the direct/STUN peer plus LiveKit SFU/UDP route model. Exact current source
+and deployment identity is indexed by [status](../status.md).
 Browser SFU PCs use empty external ICE-server lists. The controlled exact-
 candidate rollback/SFU commit and active-SFU cadence gates are closed. The
 operation owner remains only `route`; broader heterogeneous-network and SFU

docs/deployment.md

@@ -3,7 +3,7 @@
 Last verified against upstream documentation: 2026-08-24.
 
 This page records production running exact deployed application/runtime revision
-`af348ee1d508a3af02b18a7f46c461953798e19d`, release `af348ee`, and the single
+`4f46d9ebc4fe11a6648749f2b8b447eb83041fd5`, release `4f46d9e`, and the single
 Browser `screener-v12` contract. Product direction and pending work are owned by
 [project memory](./project-memory.md) and [the TODO ledger](./todo.md).
 
@@ -25,16 +25,16 @@ ICE/UDP only. Ordinary peer ICE remains STUN-only and production coturn uses the
 tracked STUN-only configuration with TCP/TLS disabled. The source and production
 configure no TURN, ICE/TCP, media TCP, or TLS-relayed media.
 
-Production runs exact `af348ee1d508a3af02b18a7f46c461953798e19d`, release
-`af348ee`, from `/opt/screener/releases/af348ee`. The immutable runtime tar
+Production runs exact `4f46d9ebc4fe11a6648749f2b8b447eb83041fd5`, release
+`4f46d9e`, from `/opt/screener/releases/4f46d9e`. The immutable runtime tar
 SHA-256 is
-`4922cc31d7caaad7c5412b1f2fe1d73f788d16d92386efad6eac358a97b8a78e`.
+`a832fd401955f9913e8ac03857851b302c49f8eef7b049c39d21a214586227d2`.
 Its 39-file path/size/hash manifest SHA-256 is
-`5b397809b664b9a55885ac603df615b537bf51276e7274416820870956242d7d`.
+`47050583ff4a7e691339bc4087f95e704c242625a2ec92ff2d5166cf3c6eca7c`.
 Local and public `/healthz` return 200; Screener, LiveKit, coturn, and nginx are
 active with `NRestarts=0`. The public main Browser asset is
-`assets/index-BvuZY6Hc.js` with SHA-256
-`e8fc0500496ee101031a9cfebfcc22d3b69e66d2cac5e875448b56620dbb21c5`.
+`assets/index-kQCZyrsd.js` with SHA-256
+`28b706a88085ff411b70eee8865fad53406b7679020cfe3fd0fa47e5091792e9`.
 
 The release deploys the single Browser `screener-v12` wire, fixed VP8 for Browser
 direct, browser-relay, and SFU video, pinned LiveKit default screen-share
@@ -283,7 +283,7 @@ lifetime. An actively connected Host prevents expiry; explicit stop or Host
 disconnect starts the lease, and only the exact Host token renews it before
 expiry. Viewer activity never renews ownership. `ROOM_DATABASE_PATH` and
 `ROOM_TTL_SECONDS` fail startup even when blank.
-Production `af348ee` accepts 1 through 20 and explicitly selects 20. This is an
+Production `4f46d9e` accepts 1 through 20 and explicitly selects 20. This is an
 admission limit, not evidence that every publisher, network, or quality profile
 can sustain that many streams.
 `ENDPOINT_MEDIA_COPY_CAPACITY` defaults to 2 and accepts only 1, 2, or 3. It is
@@ -296,7 +296,7 @@ must fail or wait before a fourth endpoint copy is issued.
 Supplying the removed `MAX_PEER_RELAY_DOWNSTREAM_EDGES`, even blank, fails
 startup.
 
-Production release `af348ee` runs the deployed server and Browser assets
+Production release `4f46d9e` runs the deployed server and Browser assets
 atomically on `screener-v12`; every stale Browser or executable-sender wire fails
 before room authority. Native senders and helpers are outside this release.
 

docs/project-memory.md

@@ -100,9 +100,8 @@ Last updated: 2026-08-25
 
 ## Current Source And Production
 
-- Canonical `main` and production run exact application/runtime revision
-  `af348ee1d508a3af02b18a7f46c461953798e19d`, release `af348ee`, on strict
-  `screener-v12`.
+- Production and the matching canonical application/runtime tree use strict
+  `screener-v12`; exact identity is indexed by [status](./status.md).
 - Production uses random memory rooms, 20-Viewer admission, endpoint cap `2`,
   dedicated LiveKit admission `1` ingress / `20` egress, STUN UDP 3478, LiveKit
   media UDP 7882, and Web TCP 80/443. Node 8787 and LiveKit 7880 remain private.
@@ -112,13 +111,13 @@ Last updated: 2026-08-25
 
 ## Current Priority
 
-1. Integrate and deploy the accepted Viewer lifecycle/native-control/current-
-   route reconnect candidate, then finish representative real-network route,
-   screen-audio, real-game A/V, and mobile lifecycle acceptance.
+1. Measure Browser VP8 hardware use and game-load performance, then complete the
+   mobile Viewer lifecycle matrix and representative real-network route/media
+   acceptance.
 
-Quality-driven parent selection, VP8 hardware evidence, Native sender work,
-distribution packages, whole-product UI/bilingual polish, and repository-wide
-simplification remain later decisions in [the TODO ledger](./todo.md).
+Quality-driven parent selection, Native sender work, distribution packages,
+whole-product UI/bilingual polish, and repository-wide simplification remain
+later decisions in [the TODO ledger](./todo.md).
 
 ## Working Rules
 

docs/status.md

@@ -8,15 +8,15 @@ This is the current execution index. Git history owns completed timelines;
 ## Production
 
 - `https://share.bonfire.icu` runs exact application/runtime revision
-  `af348ee1d508a3af02b18a7f46c461953798e19d`, release `af348ee`, wire
-  `screener-v12`, from `/opt/screener/releases/af348ee`. The immutable runtime
+  `4f46d9ebc4fe11a6648749f2b8b447eb83041fd5`, release `4f46d9e`, wire
+  `screener-v12`, from `/opt/screener/releases/4f46d9e`. The immutable runtime
   tar SHA-256 is
-  `4922cc31d7caaad7c5412b1f2fe1d73f788d16d92386efad6eac358a97b8a78e`;
+  `a832fd401955f9913e8ac03857851b302c49f8eef7b049c39d21a214586227d2`;
   its 39-file manifest SHA-256 is
-  `5b397809b664b9a55885ac603df615b537bf51276e7274416820870956242d7d`.
-- The served Browser entry references `assets/index-BvuZY6Hc.js`; the public
-  asset is 488473 bytes with SHA-256
-  `e8fc0500496ee101031a9cfebfcc22d3b69e66d2cac5e875448b56620dbb21c5`.
+  `47050583ff4a7e691339bc4087f95e704c242625a2ec92ff2d5166cf3c6eca7c`.
+- The served Browser entry references `assets/index-kQCZyrsd.js`; the public
+  asset is 486071 bytes with SHA-256
+  `28b706a88085ff411b70eee8865fad53406b7679020cfe3fd0fa47e5091792e9`.
   Public `/healthz` returns 200. The release postflight found Screener, LiveKit,
   coturn, and nginx active with zero restarts.
 - Production uses process-memory four-digit rooms, a 24-hour dormant lease,
@@ -36,8 +36,9 @@ This is the current execution index. Git history owns completed timelines;
 
 ## Current Source
 
-- Canonical root `main` is clean at the same exact `af348ee` revision as
-  production. Auxiliary branches and worktrees do not supersede it.
+- Canonical root `main` is clean and its application/runtime tree matches exact
+  production revision `4f46d9e`. Auxiliary branches and worktrees do not
+  supersede it.
 - One event-driven controller owns the committed graph and one room-serial child
   operation. It uses exact candidate identity, first-decoded-frame commit,
   strict rollback revisions, direct-then-SFU total deadline, and typed endpoint
@@ -46,19 +47,19 @@ This is the current execution index. Git history owns completed timelines;
   quality score, layer selector, periodic rebalancing, or quality-driven parent
   change. P2P and SFU recover their current route before actual failure enters
   normal reassignment.
-- The staged `fix/viewer-page-lifecycle` candidate is based on exact `af348ee`.
-  It rebaselines Viewer decoded-stall timing after page resume, makes a new
-  current-generation frame clear stale media recovery state, uses native Viewer
-  video controls, removes Host preview controls, and makes manual P2P reconnect
-  rebuild the same parent. It is accepted but not yet committed, merged, or
-  deployed.
+- Viewer page resume rebaselines decoded-stall timing, a new current-generation
+  frame clears stale media recovery state, native Viewer video controls own local
+  playback, Host preview is control-free, and manual reconnect stays on the
+  current P2P parent or SFU subscription.
 
 ## Current Milestone
 
-1. Integrate, validate, deploy, and postflight `fix/viewer-page-lifecycle`.
-2. Finish representative public-network direct, peer-relay, SFU, recovery,
-   Pause/Resume, screen-audio, real-game A/V, mobile lifecycle, and all-UDP-
-   blocked acceptance without adding another transport or quality controller.
+1. Measure Browser VP8 hardware use and the current game-load performance
+   bottleneck on supported Chrome/Edge platforms.
+2. Finish the Android Chrome and iOS Safari Viewer lifecycle matrix.
+3. Finish representative public-network direct, peer-relay, SFU, recovery,
+   Pause/Resume, screen-audio, real-game A/V, and all-UDP-blocked acceptance
+   without adding another transport or quality controller.
 
 ## Active Boundaries
 

docs/todo.md

@@ -7,23 +7,6 @@ later topic is not implementation authority by itself.
 
 ## Now
 
-1. **Close the Viewer lifecycle/native-control release.** Integrate the staged
-   `fix/viewer-page-lifecycle` candidate from the accepted truth checkpoint,
-   run the full repository check, review the exact diff, merge through PR,
-   deploy one immutable application artifact, and perform scoped production
-   postflight. Verify native Viewer controls plus current-route P2P and SFU
-   reconnect without adding route reselection.
-2. **Finish real-network route and media acceptance.** Exercise direct peer,
-   Browser relay, SFU, relay-ingress recovery with subtree retention,
-   disconnect/capacity drain, Pause/Resume, source replacement, screen-audio
-   continuity, and real-game A/V sync across representative IPv4/IPv6,
-   Wi-Fi/cellular, and Host/Viewer TUN/VPN cases. Include an all-UDP-blocked case
-   and weak-network audio after SFU RED was disabled. Every exhausted path must
-   end in bounded wait/failure without TURN, TCP probing, NAT classification,
-   guessed candidates, or another watchdog.
-
-## Accepted Later Roadmap
-
 1. **Browser VP8 hardware evidence.** Measure supported Chrome/Edge platforms
    under real game load using actual codec, encoder implementation, encode time,
    frame rate, and CPU/GPU attribution. Do not add another codec, custom encoder,
@@ -33,30 +16,41 @@ later topic is not implementation authority by itself.
    lock/page reclamation, rotation, Wi-Fi/cellular migration, and assigned-relay
    survival or controller recovery. Web does not promise background video or
    relay execution after OS suspension.
-3. **Quality-based topology research.** After the real-network baseline, decide
+3. **Finish real-network route and media acceptance.** Exercise direct peer,
+   Browser relay, SFU, relay-ingress recovery with subtree retention,
+   disconnect/capacity drain, Pause/Resume, source replacement, screen-audio
+   continuity, and real-game A/V sync across representative IPv4/IPv6,
+   Wi-Fi/cellular, and Host/Viewer TUN/VPN cases. Include an all-UDP-blocked case
+   and weak-network audio after SFU RED was disabled. Every exhausted path must
+   end in bounded wait/failure without TURN, TCP probing, NAT classification,
+   guessed candidates, or another watchdog.
+
+## Accepted Later Roadmap
+
+1. **Quality-based topology research.** After the real-network baseline, decide
    whether measured user-visible quality justifies any active parent-selection
    mechanism. Current evidence cannot compare an active route with an
    unconnected alternative, so no quality score, all-pairs probing, periodic
    rebalancing, relay abdication threshold, or active parent switch is accepted.
    Prefer mature algorithms and one general model if this boundary is reopened.
-4. **Platform output only when real.** Revisit AirPlay/Cast only when a target
+2. **Platform output only when real.** Revisit AirPlay/Cast only when a target
    browser and physical receiver prove the live `MediaStream` contract. System
    mirroring remains external.
-5. **Public-server one-click package.** After functional and real-network work,
+3. **Public-server one-click package.** After functional and real-network work,
    package the exact application, STUN/SFU, reverse proxy, secrets, and health
    checks for a user-owned public server. Do not call a partial installer ready.
-6. **Fully local one-click package.** Package Windows/macOS/Linux Host capture,
+4. **Fully local one-click package.** Package Windows/macOS/Linux Host capture,
    application server, and local state without requiring source or Node. Report
    public-origin, TLS, gateway, NAT, and firewall limits honestly.
-7. **Native Host and shared encode, Windows first.** Productize only after real
+5. **Native Host and shared encode, Windows first.** Productize only after real
    capture, hardware-only encode, audio, identity, RTP/RTCP feedback, resource,
    packaging, and licensing gates pass. Browser Host/relay keeps standard
    per-`RTCPeerConnection` encoding.
-8. **Whole-product UI and bilingual decision.** Once media and route behavior
+6. **Whole-product UI and bilingual decision.** Once media and route behavior
    stabilizes, review copy, responsive hierarchy, visual consistency, restrained
    motion, bundle/rendering cost, and Chinese/English scope once as a whole.
    Ordinary screen-specific edits do not create parallel documentation.
-9. **Repository simplification audit.** After the Browser, route, room, and
+7. **Repository simplification audit.** After the Browser, route, room, and
    physical-media checkpoints settle, inventory components, configuration,
    migrations, timers, compatibility paths, tests, and truth duplication using
    the [maintenance review](./maintenance.md#机制减负审查). Begin read-only and do
@@ -82,7 +76,5 @@ later topic is not implementation authority by itself.
 
 - Preserve dirty or unique worktrees and open stacks until reviewed. Never
   import old truth wholesale.
-- `fix/media-followup` is clean and tree-equivalent to current `main`; it may be
-  removed only after merged-head, reference, and reparse checks.
 - Sample worktree and branch state immediately before cleanup rather than
   maintaining a permanent inventory here.

docs/verification-status.md

@@ -8,14 +8,14 @@ may be interpreted. Git and pull requests own routine completed checks.
 ## Current Production Identity
 
 - Production runs exact application/runtime revision
-  `af348ee1d508a3af02b18a7f46c461953798e19d`, release `af348ee`, wire
-  `screener-v12`, from `/opt/screener/releases/af348ee`.
+  `4f46d9ebc4fe11a6648749f2b8b447eb83041fd5`, release `4f46d9e`, wire
+  `screener-v12`, from `/opt/screener/releases/4f46d9e`.
 - Runtime tar SHA-256:
-  `4922cc31d7caaad7c5412b1f2fe1d73f788d16d92386efad6eac358a97b8a78e`.
+  `a832fd401955f9913e8ac03857851b302c49f8eef7b049c39d21a214586227d2`.
   The 39-file manifest SHA-256 is
-  `5b397809b664b9a55885ac603df615b537bf51276e7274416820870956242d7d`.
-- Public Browser asset `assets/index-BvuZY6Hc.js` is 488473 bytes with SHA-256
-  `e8fc0500496ee101031a9cfebfcc22d3b69e66d2cac5e875448b56620dbb21c5`.
+  `47050583ff4a7e691339bc4087f95e704c242625a2ec92ff2d5166cf3c6eca7c`.
+- Public Browser asset `assets/index-kQCZyrsd.js` is 486071 bytes with SHA-256
+  `28b706a88085ff411b70eee8865fad53406b7679020cfe3fd0fa47e5091792e9`.
   Public `/healthz` returns 200. Release postflight found Screener, LiveKit,
   coturn, and nginx active with zero restarts.
 
@@ -49,14 +49,13 @@ may be interpreted. Git and pull requests own routine completed checks.
 
 ## Current Source Evidence
 
-- `af348ee` fixes Browser VP8 with `contentHint = "motion"`, reapplies the
+- Current `4f46d9e` uses Browser VP8 with `contentHint = "motion"`, reapplies the
   selected video profile after answer negotiation, leaves SFU representation
   construction to pinned LiveKit, keeps Dynacast/send-side BWE, disables
   AdaptiveStream, and disables SFU audio RED.
-- The accepted `fix/viewer-page-lifecycle` candidate has focused coverage for
-  page-resume decoded-stall rebaselining, current-frame presentation authority,
-  and same-parent P2P manual rebuild. TypeScript and the client production build
-  pass. It is not current source or production until its release is integrated.
+- Viewer page-resume decoded-stall rebaselining, current-frame presentation
+  authority, native controls, and same-route manual reconnect are current source
+  and production behavior.
 
 ## Open Physical Gates
 

docs/方案设计.md

@@ -2,7 +2,7 @@
 
 ## 2026-08-18 14:45
 
-状态：production 与 canonical `main` 运行精确 application/runtime revision `af348ee1d508a3af02b18a7f46c461953798e19d`、release `af348ee` 和严格 `screener-v12`。Browser 视频固定 VP8 并使用 `contentHint = "motion"`，音频使用 `music`；codec UI/state/wire、自定义 SFU layer list 与应用媒体质量 controller 均不存在。SFU 由 pinned LiveKit 默认 representations、Dynacast、server send-side BWE 和 disabled AdaptiveStream 拥有质量适配；screen audio 使用 64/128/256 kbps ceiling、stereo、DTX off 与 RED off。当前 Viewer 页面生命周期/原生控件候选已接受但尚未集成或部署，精确执行状态由 `docs/status.md` 持有。
+状态：production 与 canonical application/runtime tree 使用严格 `screener-v12`。Browser 视频固定 VP8 并使用 `contentHint = "motion"`，音频使用 `music`；codec UI/state/wire、自定义 SFU layer list与应用媒体质量 controller 均不存在。SFU 由 pinned LiveKit 默认 representations、Dynacast、server send-side BWE 和 disabled AdaptiveStream 拥有质量适配；screen audio 使用 64/128/256 kbps ceiling、stereo、DTX off 与 RED off。Viewer 页面恢复、原生控件和当前线路重连已进入 source 与 production，精确执行状态由 `docs/status.md` 持有。
 
 ## 目标与边界
 
@@ -362,7 +362,7 @@ Token-free SFU standby prewarm 保持可选且不创建 participant、publicatio
 
 ## 当前交付边界
 
-- Production 与 canonical `main` 使用严格单一 `screener-v12` wire 和精确 deployed application/runtime revision `af348ee1d508a3af02b18a7f46c461953798e19d`、release `af348ee`。两者均实现短 room-lived grant、明确 missing-room 结果、产品诊断下载移除、完整短 URL 邀请 UI、exact-current audio stats 与音轨跨 relay/SFU reconnect 连续性，固定 Browser VP8、video `contentHint = "motion"`、audio `music`，且不存在 codec selector、quality-state/wire 字段、自定义 SFU layer list或分享生命周期 codec 分支。Browser SFU 使用 pinned LiveKit 默认 representations、Dynacast、server send-side BWE、disabled AdaptiveStream 与 RED off。
+- Production 与 canonical application/runtime tree 使用严格单一 `screener-v12` wire。当前实现包含短 room-lived grant、明确 missing-room 结果、产品诊断下载移除、完整短 URL 邀请 UI、exact-current audio stats 与音轨跨 relay/SFU reconnect 连续性，固定 Browser VP8、video `contentHint = "motion"`、audio `music`，且不存在 codec selector、quality-state/wire 字段、自定义 SFU layer list或分享生命周期 codec 分支。Browser SFU 使用 pinned LiveKit 默认 representations、Dynacast、server send-side BWE、disabled AdaptiveStream 与 RED off；精确执行状态由 `docs/status.md` 持有。
 - Pause/Resume 由当前 Host session 和 `shareGeneration` 约束。Host 后台性能和 VP8 hardware acceleration 分别按受控根因证据诊断；标准 ICE/SFU 按真实异构网络验收。
 - 当前发布面只包含 Web Host、Viewer 和 browser relay。Native sender、capture helper、shared-encode executable 与两个分发包仍由各自后续决策和物理证据驱动，不属于当前 Browser release。