diff --git a/docs/deployment.md b/docs/deployment.md index e359457..88e3346 100644 --- a/docs/deployment.md +++ b/docs/deployment.md @@ -3,7 +3,7 @@ Last verified: 2026-08-26. This page records production running exact deployed application/runtime revision -`8164102af8083d55632cf5de10197b5823b3d140`, release `8164102`, and the single +`ceb38e1b0ddd7ea7ca4e2d330c1b64a4d97b98ba`, release `ceb38e1`, and the single Browser `screener-v12` contract. Product direction and pending work are owned by [project memory](./project-memory.md) and [the TODO ledger](./todo.md). @@ -25,16 +25,16 @@ ICE/UDP only. Ordinary peer ICE remains STUN-only and production coturn uses the tracked STUN-only configuration with TCP/TLS disabled. The source and production configure no TURN, ICE/TCP, media TCP, or TLS-relayed media. -Production runs exact `8164102af8083d55632cf5de10197b5823b3d140`, release -`8164102`, from `/opt/screener/releases/8164102`. The immutable runtime tar +Production runs exact `ceb38e1b0ddd7ea7ca4e2d330c1b64a4d97b98ba`, release +`ceb38e1`, from `/opt/screener/releases/ceb38e1`. The immutable runtime tar SHA-256 is -`1f61395702afaabfda8c178a08c7896af77e1c4750dcc9f29ffaafbd56bba80f`. +`d1f8b9c5982c66163220d74efd87e076e13f5270282028bd173eaecd545ab1b0`. Its 41-file path/size/hash manifest SHA-256 is -`55b9779fdaf4fe2ba98d5612b16e398fbf2ad6b9ebcfeeeef6e0ce5c3595ac8d`. +`85f05a98e712eb74a03261c022d902cf1b3ab5c6f73ad5f365a537edd2973763`. Local and public `/healthz` return 200; Screener, LiveKit, coturn, and nginx are active with `NRestarts=0`. The public main Browser asset is -`assets/index-CPECbwjN.js` with SHA-256 -`dfcbed5d4178afbd7f6713f1ae348a70921b936199fa56d87fa05c785564559e`. +`assets/index-BLqbpOcC.js` with SHA-256 +`8e1c3a77a61e5c10f34a801428516379d40809c60bcd0b5b6db461e4e4f1797e`. The release deploys the single Browser `screener-v12` wire and one internal, content-independent H.264 sender gate with VP8 fallback across Browser direct, @@ -296,7 +296,7 @@ must fail or wait before a fourth endpoint copy is issued. Supplying the removed `MAX_PEER_RELAY_DOWNSTREAM_EDGES`, even blank, fails startup. -Production release `8164102` runs the deployed server and Browser assets +Production release `ceb38e1` runs the deployed server and Browser assets atomically on `screener-v12`; every stale Browser or executable-sender wire fails before room authority. Native senders and helpers are outside this release. diff --git a/docs/status.md b/docs/status.md index 25e9edc..65998a2 100644 --- a/docs/status.md +++ b/docs/status.md @@ -8,15 +8,15 @@ This is the current execution index. Git history owns completed timelines; ## Production - `https://share.bonfire.icu` runs exact application/runtime revision - `8164102af8083d55632cf5de10197b5823b3d140`, release `8164102`, wire - `screener-v12`, from `/opt/screener/releases/8164102`. The immutable runtime + `ceb38e1b0ddd7ea7ca4e2d330c1b64a4d97b98ba`, release `ceb38e1`, wire + `screener-v12`, from `/opt/screener/releases/ceb38e1`. The immutable runtime tar SHA-256 is - `1f61395702afaabfda8c178a08c7896af77e1c4750dcc9f29ffaafbd56bba80f`; + `d1f8b9c5982c66163220d74efd87e076e13f5270282028bd173eaecd545ab1b0`; its 41-file manifest SHA-256 is - `55b9779fdaf4fe2ba98d5612b16e398fbf2ad6b9ebcfeeeef6e0ce5c3595ac8d`. -- The served Browser entry references `assets/index-CPECbwjN.js`; the public + `85f05a98e712eb74a03261c022d902cf1b3ab5c6f73ad5f365a537edd2973763`. +- The served Browser entry references `assets/index-BLqbpOcC.js`; the public asset SHA-256 is - `dfcbed5d4178afbd7f6713f1ae348a70921b936199fa56d87fa05c785564559e`. + `8e1c3a77a61e5c10f34a801428516379d40809c60bcd0b5b6db461e4e4f1797e`. Public `/healthz` returns 200. The release postflight found Screener, LiveKit, coturn, and nginx active with zero restarts. - Production enables SQLite room authority at @@ -42,7 +42,7 @@ This is the current execution index. Git history owns completed timelines; ## Current Source -- Canonical `main` contains the same application tree deployed from `8164102`. +- Canonical `main` contains the same application tree deployed from `ceb38e1`. Optional SQLite stable authority, non-expiring local preferred code, atomic room replacement and the Host codec selector are implemented; production selects stable storage. Graceful restart, crash, timeout and network loss use @@ -64,15 +64,11 @@ This is the current execution index. Git history owns completed timelines; ## Current Milestone -1. Close the confirmed authority/recovery P1s: typed KDF gate outcomes, exact - route-terminal ownership, assignment-fenced child creation, bounded SFU - refresh, exact Viewer authentication outcomes, and reconnect-safe Host - quality intent. -2. Implement presentation-authoritative freeze/pause evidence with decoded +1. Implement presentation-authoritative freeze/pause evidence with decoded progress and the controller-owned shadow aggregate; collect production samples without active route changes. -3. Finish the Android Chrome and iOS Safari Viewer lifecycle matrix. -4. Finish representative public-network direct, peer-relay, SFU, recovery, +2. Finish the Android Chrome and iOS Safari Viewer lifecycle matrix. +3. Finish representative public-network direct, peer-relay, SFU, recovery, Pause/Resume, screen-audio, real-game A/V, and all-UDP-blocked acceptance without adding another transport or quality controller. @@ -91,6 +87,5 @@ This is the current execution index. Git history owns completed timelines; ## Current Hold -No source or deployment P0 is open. The recovery/authority P1 milestone blocks -active quality-route behavior; representative real-network and mobile physical -evidence remains required before route acceptance is complete. +No source or deployment P0/P1 is open. Representative real-network and mobile +physical evidence remains required before route acceptance is complete. diff --git a/docs/todo.md b/docs/todo.md index ccf0b26..e0705ae 100644 --- a/docs/todo.md +++ b/docs/todo.md @@ -7,15 +7,7 @@ later topic is not implementation authority by itself. ## Now -1. **Recovery and authority convergence.** Close the confirmed P1 owner gaps - before active quality work: return distinct KDF `busy | cancelled | value` - outcomes without committing a passwordless room; return the exact exhausted - demand identity from the route controller and emit its terminal once; fence - every Host child retry to the current assignment; make SFU refresh end in - typed config or failure; preserve exact Viewer authentication outcomes; and - retain one Host quality intent until the server confirms or rejects it. These - are existing owner corrections, not new retry loops or fallback controllers. -2. **Quality-route evidence and shadow calibration.** Make current Viewer +1. **Quality-route evidence and shadow calibration.** Make current Viewer quality evidence presentation-authoritative with standard freeze/pause deltas, continuing decoded progress, exact presentation epochs and baseline fencing. Keep one bounded @@ -23,12 +15,12 @@ later topic is not implementation authority by itself. expose it only through the Host acceptance snapshot. It must not alter facts, capacity, routes or SFU usage. Collect annotated production samples before accepting an active trigger, probation, restore or cooldown policy. -3. **Mobile Viewer lifecycle.** Run Android Chrome and iOS Safari matrices for +2. **Mobile Viewer lifecycle.** Run Android Chrome and iOS Safari matrices for autoplay gesture, foreground/background audio, foreground video recovery, lock/page reclamation, rotation, Wi-Fi/cellular migration, and assigned-relay survival or controller recovery. Web does not promise background video or relay execution after OS suspension. -4. **Finish real-network route and media acceptance.** Exercise direct peer, +3. **Finish real-network route and media acceptance.** Exercise direct peer, Browser relay, SFU, relay-ingress recovery with subtree retention, disconnect/capacity drain, Pause/Resume, source replacement, screen-audio continuity, and real-game A/V sync across representative IPv4/IPv6, diff --git a/docs/verification-status.md b/docs/verification-status.md index e8fbcf1..4526e27 100644 --- a/docs/verification-status.md +++ b/docs/verification-status.md @@ -8,14 +8,14 @@ may be interpreted. Git and pull requests own routine completed checks. ## Current Production Identity - Production runs exact application/runtime revision - `8164102af8083d55632cf5de10197b5823b3d140`, release `8164102`, wire - `screener-v12`, from `/opt/screener/releases/8164102`. + `ceb38e1b0ddd7ea7ca4e2d330c1b64a4d97b98ba`, release `ceb38e1`, wire + `screener-v12`, from `/opt/screener/releases/ceb38e1`. - Runtime tar SHA-256: - `1f61395702afaabfda8c178a08c7896af77e1c4750dcc9f29ffaafbd56bba80f`. + `d1f8b9c5982c66163220d74efd87e076e13f5270282028bd173eaecd545ab1b0`. The 41-file manifest SHA-256 is - `55b9779fdaf4fe2ba98d5612b16e398fbf2ad6b9ebcfeeeef6e0ce5c3595ac8d`. -- Public Browser asset `assets/index-CPECbwjN.js` has SHA-256 - `dfcbed5d4178afbd7f6713f1ae348a70921b936199fa56d87fa05c785564559e`. + `85f05a98e712eb74a03261c022d902cf1b3ab5c6f73ad5f365a537edd2973763`. +- Public Browser asset `assets/index-BLqbpOcC.js` has SHA-256 + `8e1c3a77a61e5c10f34a801428516379d40809c60bcd0b5b6db461e4e4f1797e`. Public `/healthz` returns 200. Release postflight found Screener, LiveKit, coturn, and nginx active with zero restarts. @@ -57,10 +57,14 @@ may be interpreted. Git and pull requests own routine completed checks. - Browser SFU publisher/subscriber PCs use empty external ICE-server lists while ordinary peers retain deployment STUN. The reported Host/Viewer TUN conflict was closed by that isolation without adding TURN or TCP media. +- Password-KDF capacity now fails before room or SQLite mutation; route terminal + identity comes from the controller; Host child creation is assignment-fenced; + explicit SFU refresh has a typed failure path; Viewer access outcomes remain + exact; and Host quality intent survives signaling interruption. ## Current Source Evidence -- Canonical source contains the same application tree deployed from `8164102`: +- Canonical source contains the same application tree deployed from `ceb38e1`: the adaptive H.264/VP8 sender decision with `contentHint = "motion"` reapplies the selected video profile after answer negotiation, leaves SFU representation construction to pinned LiveKit, keeps Dynacast/send-side BWE, disables