docs: resume quality route milestone (#285)

docs/deployment.md

@@ -3,7 +3,7 @@
 Last verified: 2026-08-26.
 
 This page records production running exact deployed application/runtime revision
-`8164102af8083d55632cf5de10197b5823b3d140`, release `8164102`, and the single
+`ceb38e1b0ddd7ea7ca4e2d330c1b64a4d97b98ba`, release `ceb38e1`, and the single
 Browser `screener-v12` contract. Product direction and pending work are owned by
 [project memory](./project-memory.md) and [the TODO ledger](./todo.md).
 
@@ -25,16 +25,16 @@ ICE/UDP only. Ordinary peer ICE remains STUN-only and production coturn uses the
 tracked STUN-only configuration with TCP/TLS disabled. The source and production
 configure no TURN, ICE/TCP, media TCP, or TLS-relayed media.
 
-Production runs exact `8164102af8083d55632cf5de10197b5823b3d140`, release
-`8164102`, from `/opt/screener/releases/8164102`. The immutable runtime tar
+Production runs exact `ceb38e1b0ddd7ea7ca4e2d330c1b64a4d97b98ba`, release
+`ceb38e1`, from `/opt/screener/releases/ceb38e1`. The immutable runtime tar
 SHA-256 is
-`1f61395702afaabfda8c178a08c7896af77e1c4750dcc9f29ffaafbd56bba80f`.
+`d1f8b9c5982c66163220d74efd87e076e13f5270282028bd173eaecd545ab1b0`.
 Its 41-file path/size/hash manifest SHA-256 is
-`55b9779fdaf4fe2ba98d5612b16e398fbf2ad6b9ebcfeeeef6e0ce5c3595ac8d`.
+`85f05a98e712eb74a03261c022d902cf1b3ab5c6f73ad5f365a537edd2973763`.
 Local and public `/healthz` return 200; Screener, LiveKit, coturn, and nginx are
 active with `NRestarts=0`. The public main Browser asset is
-`assets/index-CPECbwjN.js` with SHA-256
-`dfcbed5d4178afbd7f6713f1ae348a70921b936199fa56d87fa05c785564559e`.
+`assets/index-BLqbpOcC.js` with SHA-256
+`8e1c3a77a61e5c10f34a801428516379d40809c60bcd0b5b6db461e4e4f1797e`.
 
 The release deploys the single Browser `screener-v12` wire and one internal,
 content-independent H.264 sender gate with VP8 fallback across Browser direct,
@@ -296,7 +296,7 @@ must fail or wait before a fourth endpoint copy is issued.
 Supplying the removed `MAX_PEER_RELAY_DOWNSTREAM_EDGES`, even blank, fails
 startup.
 
-Production release `8164102` runs the deployed server and Browser assets
+Production release `ceb38e1` runs the deployed server and Browser assets
 atomically on `screener-v12`; every stale Browser or executable-sender wire fails
 before room authority. Native senders and helpers are outside this release.
 

docs/status.md

@@ -8,15 +8,15 @@ This is the current execution index. Git history owns completed timelines;
 ## Production
 
 - `https://share.bonfire.icu` runs exact application/runtime revision
-  `8164102af8083d55632cf5de10197b5823b3d140`, release `8164102`, wire
-  `screener-v12`, from `/opt/screener/releases/8164102`. The immutable runtime
+  `ceb38e1b0ddd7ea7ca4e2d330c1b64a4d97b98ba`, release `ceb38e1`, wire
+  `screener-v12`, from `/opt/screener/releases/ceb38e1`. The immutable runtime
   tar SHA-256 is
-  `1f61395702afaabfda8c178a08c7896af77e1c4750dcc9f29ffaafbd56bba80f`;
+  `d1f8b9c5982c66163220d74efd87e076e13f5270282028bd173eaecd545ab1b0`;
   its 41-file manifest SHA-256 is
-  `55b9779fdaf4fe2ba98d5612b16e398fbf2ad6b9ebcfeeeef6e0ce5c3595ac8d`.
-- The served Browser entry references `assets/index-CPECbwjN.js`; the public
+  `85f05a98e712eb74a03261c022d902cf1b3ab5c6f73ad5f365a537edd2973763`.
+- The served Browser entry references `assets/index-BLqbpOcC.js`; the public
   asset SHA-256 is
-  `dfcbed5d4178afbd7f6713f1ae348a70921b936199fa56d87fa05c785564559e`.
+  `8e1c3a77a61e5c10f34a801428516379d40809c60bcd0b5b6db461e4e4f1797e`.
   Public `/healthz` returns 200. The release postflight found Screener, LiveKit,
   coturn, and nginx active with zero restarts.
 - Production enables SQLite room authority at
@@ -42,7 +42,7 @@ This is the current execution index. Git history owns completed timelines;
 
 ## Current Source
 
-- Canonical `main` contains the same application tree deployed from `8164102`.
+- Canonical `main` contains the same application tree deployed from `ceb38e1`.
   Optional SQLite stable authority, non-expiring local preferred code, atomic
   room replacement and the Host codec selector are implemented; production
   selects stable storage. Graceful restart, crash, timeout and network loss use
@@ -64,15 +64,11 @@ This is the current execution index. Git history owns completed timelines;
 
 ## Current Milestone
 
-1. Close the confirmed authority/recovery P1s: typed KDF gate outcomes, exact
-   route-terminal ownership, assignment-fenced child creation, bounded SFU
-   refresh, exact Viewer authentication outcomes, and reconnect-safe Host
-   quality intent.
-2. Implement presentation-authoritative freeze/pause evidence with decoded
+1. Implement presentation-authoritative freeze/pause evidence with decoded
    progress and the controller-owned shadow aggregate; collect production
    samples without active route changes.
-3. Finish the Android Chrome and iOS Safari Viewer lifecycle matrix.
-4. Finish representative public-network direct, peer-relay, SFU, recovery,
+2. Finish the Android Chrome and iOS Safari Viewer lifecycle matrix.
+3. Finish representative public-network direct, peer-relay, SFU, recovery,
    Pause/Resume, screen-audio, real-game A/V, and all-UDP-blocked acceptance
    without adding another transport or quality controller.
 
@@ -91,6 +87,5 @@ This is the current execution index. Git history owns completed timelines;
 
 ## Current Hold
 
-No source or deployment P0 is open. The recovery/authority P1 milestone blocks
-active quality-route behavior; representative real-network and mobile physical
-evidence remains required before route acceptance is complete.
+No source or deployment P0/P1 is open. Representative real-network and mobile
+physical evidence remains required before route acceptance is complete.

docs/todo.md

@@ -7,15 +7,7 @@ later topic is not implementation authority by itself.
 
 ## Now
 
-1. **Recovery and authority convergence.** Close the confirmed P1 owner gaps
-   before active quality work: return distinct KDF `busy | cancelled | value`
-   outcomes without committing a passwordless room; return the exact exhausted
-   demand identity from the route controller and emit its terminal once; fence
-   every Host child retry to the current assignment; make SFU refresh end in
-   typed config or failure; preserve exact Viewer authentication outcomes; and
-   retain one Host quality intent until the server confirms or rejects it. These
-   are existing owner corrections, not new retry loops or fallback controllers.
-2. **Quality-route evidence and shadow calibration.** Make current Viewer
+1. **Quality-route evidence and shadow calibration.** Make current Viewer
    quality evidence presentation-authoritative with standard freeze/pause
    deltas, continuing decoded progress, exact presentation epochs and baseline
    fencing. Keep one bounded
@@ -23,12 +15,12 @@ later topic is not implementation authority by itself.
    expose it only through the Host acceptance snapshot. It must not alter facts,
    capacity, routes or SFU usage. Collect annotated production samples before
    accepting an active trigger, probation, restore or cooldown policy.
-3. **Mobile Viewer lifecycle.** Run Android Chrome and iOS Safari matrices for
+2. **Mobile Viewer lifecycle.** Run Android Chrome and iOS Safari matrices for
    autoplay gesture, foreground/background audio, foreground video recovery,
    lock/page reclamation, rotation, Wi-Fi/cellular migration, and assigned-relay
    survival or controller recovery. Web does not promise background video or
    relay execution after OS suspension.
-4. **Finish real-network route and media acceptance.** Exercise direct peer,
+3. **Finish real-network route and media acceptance.** Exercise direct peer,
    Browser relay, SFU, relay-ingress recovery with subtree retention,
    disconnect/capacity drain, Pause/Resume, source replacement, screen-audio
    continuity, and real-game A/V sync across representative IPv4/IPv6,

docs/verification-status.md

@@ -8,14 +8,14 @@ may be interpreted. Git and pull requests own routine completed checks.
 ## Current Production Identity
 
 - Production runs exact application/runtime revision
-  `8164102af8083d55632cf5de10197b5823b3d140`, release `8164102`, wire
-  `screener-v12`, from `/opt/screener/releases/8164102`.
+  `ceb38e1b0ddd7ea7ca4e2d330c1b64a4d97b98ba`, release `ceb38e1`, wire
+  `screener-v12`, from `/opt/screener/releases/ceb38e1`.
 - Runtime tar SHA-256:
-  `1f61395702afaabfda8c178a08c7896af77e1c4750dcc9f29ffaafbd56bba80f`.
+  `d1f8b9c5982c66163220d74efd87e076e13f5270282028bd173eaecd545ab1b0`.
   The 41-file manifest SHA-256 is
-  `55b9779fdaf4fe2ba98d5612b16e398fbf2ad6b9ebcfeeeef6e0ce5c3595ac8d`.
-- Public Browser asset `assets/index-CPECbwjN.js` has SHA-256
-  `dfcbed5d4178afbd7f6713f1ae348a70921b936199fa56d87fa05c785564559e`.
+  `85f05a98e712eb74a03261c022d902cf1b3ab5c6f73ad5f365a537edd2973763`.
+- Public Browser asset `assets/index-BLqbpOcC.js` has SHA-256
+  `8e1c3a77a61e5c10f34a801428516379d40809c60bcd0b5b6db461e4e4f1797e`.
   Public `/healthz` returns 200. Release postflight found Screener, LiveKit,
   coturn, and nginx active with zero restarts.
 
@@ -57,10 +57,14 @@ may be interpreted. Git and pull requests own routine completed checks.
 - Browser SFU publisher/subscriber PCs use empty external ICE-server lists while
   ordinary peers retain deployment STUN. The reported Host/Viewer TUN conflict
   was closed by that isolation without adding TURN or TCP media.
+- Password-KDF capacity now fails before room or SQLite mutation; route terminal
+  identity comes from the controller; Host child creation is assignment-fenced;
+  explicit SFU refresh has a typed failure path; Viewer access outcomes remain
+  exact; and Host quality intent survives signaling interruption.
 
 ## Current Source Evidence
 
-- Canonical source contains the same application tree deployed from `8164102`:
+- Canonical source contains the same application tree deployed from `ceb38e1`:
   the adaptive H.264/VP8 sender decision with `contentHint = "motion"` reapplies the
   selected video profile after answer negotiation, leaves SFU representation
   construction to pinned LiveKit, keeps Dynacast/send-side BWE, disables