diff --git a/docs/deployment.md b/docs/deployment.md index f3b8ec9..6c4d590 100644 --- a/docs/deployment.md +++ b/docs/deployment.md @@ -20,27 +20,30 @@ tracked coturn example remains `stun-only`; the shared host retains its older authenticated-relay daemon configuration and firewall range. The application does not pre-advertise TURN credentials to ordinary peers. -Production currently runs exact `16f6eab27bdfb1c15cdbd814a35864f4f18be767` +Production currently runs exact `ecc794d6f01ff8e90cc07a267d221daaac8da9e1` on the existing shared public IP, with local/public health 200 and SQLite v3 -integrity. The 1,027,423-byte artifact has SHA-256 -`74e0274ab11a162cb9dd4be1c34bb6b639e2ea76005969c30ae3a1daa656742f`. -The 2026-08-20T23:44:57Z UTC cutover held the deployment lock for 10,238 ms; -local health returned 641 ms after service stop (570 ms after the symlink +integrity. The 951,317-byte artifact has SHA-256 +`22c82d0e06f34abb746ee9e652821deebeea0174643b31ec6e21e159933f5431`. +The 2026-08-21T02:37:28Z UTC cutover held the deployment lock for 2,646.166 ms; +local health returned 425.531 ms after service stop (364.286 ms after the symlink switch). Screener, LiveKit, coturn, and nginx are active/running with observed `NRestarts=0`. SQLite v3 contains five rooms including room `1`, with the service owner/mode and database hash preserved. `SITE_ACCESS_PASSWORD`, `/api/site-access`, and the nginx limiter replaced their retired Host-admission names in the prior access cutover; this release preserved the environment hash and the old endpoint remains 404. Exact -`22119b907d3cf03ce8b06d6fb4596ce1a26fedd7` -is the immediate rollback target; exact `fd76277b05d491af8840b28f3132b7ff445d3cbe` +`16f6eab27bdfb1c15cdbd814a35864f4f18be767` +is the immediate rollback target; exact `22119b907d3cf03ce8b06d6fb4596ce1a26fedd7` remains a secondary rollback. -The selected-edge UDP tuple is configured with TTL 120. The cutover itself -triggered no TURN/SFU media and remains configuration evidence. A separate -post-deploy local Screener canary using this exact Web source and the production -LiveKit/coturn tuple later proved active Host-ingress relay function without -using the production application room or database; it is not broad-rollout or -performance acceptance. +This release deploys the window/full-display audio picker hints, audio `music` +hint, interval A/V loss percentages, audio codec/format/bitrate/jitter details, +and the one-per-room `peer-selected` attempt cap excluding Host ingress. The +selected-edge UDP tuple remains configured with TTL 120. This cutover triggered +no browser, TURN, SFU, or other media canary and remains configuration evidence. +A separate earlier local Screener canary using exact `16f6eab` source and the +production LiveKit/coturn tuple later proved active Host-ingress relay function +without using the production application room or database; it is not +broad-rollout or performance acceptance. ## Topology and prerequisites @@ -531,6 +534,34 @@ initial/active Host-ingress selected retry; no browser, SFU media, TURN relay, or performance canary ran during that cutover. The later post-deploy functional canary is recorded above and does not change this cutover record. +The Web audio, A/V diagnostics, and per-room selected-last-mile cap cutover used +exact source `ecc794d6f01ff8e90cc07a267d221daaac8da9e1` and immutable artifact +`screener-ecc794d6f01ff8e90cc07a267d221daaac8da9e1-20260821T022454Z-git.tar.gz` +(951,317 bytes, SHA-256 +`22c82d0e06f34abb746ee9e652821deebeea0174643b31ec6e21e159933f5431`). +Fresh exact-source `npm ci` plus `npm run check` passed typecheck, both builds, +and 30 test files/452 tests. The lock-held cutover ran from +2026-08-21T02:37:28.219189514Z to 02:37:30.865127203Z: 2,646.166 ms total, +425.531 ms from service stop to local health, and 364.286 ms from symlink switch +to local health. The release and exact `16f6eab27bdf` rollback share zero +regular-file inodes. + +Environment, nginx, LiveKit, coturn, nftables, listener, and SQLite hashes were +unchanged. SQLite v3 retained five rooms including room `1`, owner/mode +`screener:screener`/0600, and SHA-256 +`6762f92759258278ec13c6acb69e1f0fa6f9247d798a917b419748c3b54341b6`. +Local/public health, root, room `1`, the exact built asset, site-access status, +and retired-endpoint 404 passed; all four services were active/running with +observed `NRestarts=0`. The all-room controller retained an SFU-root cap of two, +ordinary STUN-only ICE, and one selected-edge UDP tuple at TTL 120. Source +inspection confirmed at most one pending/answered `peer-selected` attempt per +room while `host-sfu-ingress` remains independent. Backup +`/opt/screener/backups/ecc794d6f01f-precutover-20260821T023728Z` preserves the +exact `16f6eab27bdfb1c15cdbd814a35864f4f18be767` rollback; exact +`22119b907d3cf03ce8b06d6fb4596ce1a26fedd7` remains secondary. This rollout ran +no browser, media, SFU, TURN, or performance canary; the earlier exact-`16f6eab` +Host-ingress functional evidence was not rerun. + Enabling persistence does not migrate rooms that existed only in memory. The deployment restart invalidates those temporary links; the first subsequently created persistent room receives ID `1`. diff --git a/docs/project-memory.md b/docs/project-memory.md index a67ac10..9bbf5c8 100644 --- a/docs/project-memory.md +++ b/docs/project-memory.md @@ -26,7 +26,7 @@ Last updated: 2026-08-21 - Keep experiments bounded: the standard representation sequence is below; native RTP relay, encoded-object striping, and FEC remain separate. - ADR-0006's historical browser-bridge canary remains no-go; VP8 stays default. Browser H.264 rendered 298/299; Native WGC/MF rendered 203 with PID/LUID-correlated `VideoEncode`. Downloaded use, multi-viewer/endurance/public proof remain open. - Mobile endpoints are Web Viewer-only. Current Android/iOS browsers do not expose Web Host capture; AirPlay/system mirroring is Viewer-local output. -- ADR-0005: direct/peer UDP -> bounded SFU roots -> selected-edge TURN. Source caps pending/answered `peer-selected` at one per room; Host ingress is independent. An exact-source/production-media canary proves active Host ingress only. Ordinary peers stay STUN-only. +- ADR-0005: direct/peer UDP -> bounded SFU roots -> selected-edge TURN. The deployed controller caps pending/answered `peer-selected` at one per room; Host ingress is independent. A pre-`ecc794d` exact-source/production-media canary proves active Host ingress only. Ordinary peers stay STUN-only. - The controller is process-enabled, not room-allowlisted: `PEER_ASSISTED_MEDIA=true` gives every normal room the same direct/peer -> SFU -> selected-edge path with per-room state. Room `1` is historical smoke. Preserve sticky P2P, mobile leaves and break-before-make; recovery gets one attempt per layer (ICE restart, same-parent rebuild, alternate peer, then SFU), never three identical retries. - C+B quality reparenting is edge-local and cooldown-bound; no score, timer, or global parent penalty. - Flagship media is UDP; HTTPS/WSS stays TLS/TCP; the old release remains rollback-only. @@ -43,10 +43,10 @@ Last updated: 2026-08-21 ## Current Implementation - The repository is one npm package using Node.js 24, React, TypeScript, Vite, native WebRTC, `ws`, Zod, Vitest, and separate coturn. -- Production is exact `16f6eab27bdfb1c15cdbd814a35864f4f18be767` at `https://share.bonfire.icu`; its 1,027,423-byte artifact SHA-256 is `74e0274ab11a162cb9dd4be1c34bb6b639e2ea76005969c30ae3a1daa656742f`. The 2026-08-20T23:44:57Z cutover took 10,238 ms lock/641 ms stop-health/570 ms switch-health. Immediate rollback is exact `22119b907d3cf03ce8b06d6fb4596ce1a26fedd7`; exact `fd76277b05d491af8840b28f3132b7ff445d3cbe` remains secondary. -- `main` is ahead only in Native/test evidence; the Windows Native sender stays source-only. Host-ingress retry is deployed. +- Production at `https://share.bonfire.icu` is exact `ecc794d6f01ff8e90cc07a267d221daaac8da9e1`; artifact 951,317 bytes, SHA-256 `22c82d0e06f34abb746ee9e652821deebeea0174643b31ec6e21e159933f5431`. Cutover took 2,646.166 ms lock/425.531 ms stop-health/364.286 ms switch-health. Rollback is exact `16f6eab27bdfb1c15cdbd814a35864f4f18be767`; `22119b907d3cf03ce8b06d6fb4596ce1a26fedd7` is secondary. +- `main` is ahead only in non-runtime gate/export, tooling, and docs work. Windows Native stays source-only; Host-ingress retry and the per-room selected-last-mile cap are deployed. - The four services are active/running with observed `NRestarts=0`; local/public health are 200. SQLite v3 has five rooms including room `1`, with DB owner/mode `screener:screener`/0600. -- Production ICE is ordinary STUN-only. The all-room controller has one selected-edge UDP tuple at TTL 120. A local exact-source canary used production LiveKit/coturn without production app/DB writes and proved active Host-ingress function only. +- Production ordinary ICE is STUN-only; all-room config is SFU roots <=2, one selected-edge UDP tuple/TTL 120, and at most one pending/answered `peer-selected` per room excluding Host ingress. The `ecc794d` rollout ran no browser/media/TURN canary; an earlier exact-`16f6eab` canary used production LiveKit/coturn without app/DB writes and proved active Host ingress only. - Production requires the independent site-access secret through `SITE_ACCESS_PASSWORD`. Its stateless cookie authorizes creation/Host and permits code-only Viewer attempts; valid private fragment grants remain direct. Public-watch accepts site access plus code, while private code-only entry additionally requires the room password. The env, endpoint, cookie, and nginx limiter naming migrated atomically; anonymous failures stay neutral, and there are no accounts/JWT/session rows. - Production uses nginx, Node.js 24.19.0, coturn 4.17.2, and LiveKit 1.13.5 on UDP 7882 (TCP fallback off). Ordinary peer ICE receives no TURN; the selected-edge tuple is configured only for the current controller edge, with no credential pre-advertised to ordinary peers. Coturn retains the old authenticated-relay ports. Services are healthy with zero restarts. - ADR-0005 rejects `PEER_ASSISTED_ROOM_IDS`; `PEER_ASSISTED_MEDIA=true` enables every room and ordinary peers stay STUN-only. Initial or active Host ingress may consume one bound relay-only grant; ready/abort clears it and failure restores peer baseline. Stale room-ID config fails startup; `screener-v2` is the only deployed wire. @@ -54,7 +54,7 @@ Last updated: 2026-08-21 - Chrome 151 synthetic topology/quality runs kept fanout 2/1 and decoding; one relay close recovered in 5.32 seconds. Control evidence only. - Deployed Web uses LiveKit 2.22.0 `q,h`. Chrome 151 proves local SFU/UDP and, separately, active selected TURN/UDP Host ingress against production media services with Viewer frame progress and clean stop. Initial/peer-selected relay, BWE, and C+B remain open. - C+B uses three hard-bad pairs, one-use samples and guarded intent/cooldown. Deployed admission rescue moves the oldest childless zero-capacity Host leaf below an unassigned one-slot relay in one revision; no score/timer/global rebalance. Deployment passed, but no real room triggered it. -- Web names/window audio are deployed; source adds full-display system audio, music hint, interval AV loss% and audio codec/bitrate/jitter details. Native WGC/MF remains source-only: 203 rendered frames, 500 Opus packets, matched PID/LUID `VideoEncode`. New Web audio work is undeployed; VP8 remains default. +- Web names, window/system-audio picker hints, audio `music`, interval A/V loss%, and audio codec/format/bitrate/jitter are deployed. Native WGC/MF stays source-only: 203 rendered frames, 500 Opus packets, matched PID/LUID `VideoEncode`. VP8 remains default. ## Provisional Quality Targets diff --git a/docs/status.md b/docs/status.md index 11b79a9..9e8760a 100644 --- a/docs/status.md +++ b/docs/status.md @@ -4,10 +4,10 @@ Last updated: 2026-08-21 ## Phase -Production at `https://share.bonfire.icu` is exact `16f6eab27bdfb1c15cdbd814a35864f4f18be767`; artifact 1,027,423 bytes, SHA-256 `74e0274ab11a162cb9dd4be1c34bb6b639e2ea76005969c30ae3a1daa656742f`. -Cutover: 10,238 ms lock/641 ms stop-health/570 ms switch-health; SQLite v3/five rooms/four active services, observed `NRestarts=0`. Initial Host-ingress retry is deployed; mobile endpoints are Web Viewer-only. -Ordinary ICE is STUN-only; all rooms use bounded peer/SFU-UDP plus selected-edge UDP TTL 120. Room `1` is historical. An exact-source/production-media canary proves active Host-ingress relay only. -Web names/audio hint are deployed. Native WGC/MF/package is source-only; Web defaults VP8. +Production at `https://share.bonfire.icu` is exact `ecc794d6f01ff8e90cc07a267d221daaac8da9e1`; artifact 951,317 bytes, SHA-256 `22c82d0e06f34abb746ee9e652821deebeea0174643b31ec6e21e159933f5431`. +Cutover: 2,646.166 ms lock/425.531 ms stop-health/364.286 ms switch-health; SQLite v3/five rooms/four active services, observed `NRestarts=0`. Rollback is exact `16f6eab`; `22119b9` remains secondary. +Ordinary ICE is STUN-only; all-room limits are SFU roots <=2 and one `peer-selected` attempt excluding Host ingress; selected UDP TTL is 120. This rollout ran no media canary; earlier exact-`16f6eab` Host-ingress proof remains separate. +Web window/system-audio and music hints, interval A/V loss%, and audio codec/format/bitrate/jitter are deployed. Native stays source-only; Web defaults VP8. ## Execution Principle @@ -23,7 +23,7 @@ Flagship; parallel; min run/smoke/rollback; benchmark later. Active UI/config/lo - After an answer, a generation-bound 15s initial-connect deadline enters ICE restart; success/replacement/disposal cancels it. It is deployed but not mobile-verified. - Production `q,h` is deployed; an exact-source/production-media canary proves active Host ingress without production app/DB. - Room `1` C+B reparenting remains uncalibrated. Deployed admission rescue promotes an unassigned one-slot relay over the oldest childless zero-capacity Host leaf, with no scores or periodic optimization. -- Web roster names are deployed. Source window/system audio, music hint, interval AV loss% and audio codec/bitrate/jitter details await deploy. +- Web roster, audio picker/music hints, interval A/V loss%, and audio codec/format/bitrate/jitter are deployed. ## Verified Evidence @@ -36,13 +36,13 @@ Flagship; parallel; min run/smoke/rollback; benchmark later. Active UI/config/lo - Native Win11 audio is source-only/default-off: target isolation was 4018x and one Viewer got 495 Opus packets. Download, game sync, Win10, and other routes remain open. - Access protocol/config/HTTP/storage/SQLite/signaling focused tests pass, including commit-first teardown and v1 rollback. - Native wire/session tests enforce at most two authoritative children, no presence-created edge, stale-revision ignore, and one bounded unsupported-route failure per revision. -- Source caps pending/answered `peer-selected` at one per room, excluding Host ingress. Focused tests cover admission/release/rollback/STUN-only; exact-source Chrome proves active TURN/UDP media, Viewer progress, Host edge one and stop zero. Functional only. -- Host names/window audio/all-room routing/Host selected ingress are active. AV stats pass 42 tests/typecheck; a retained Chrome 151 dual-Viewer sample kept hidden-tab inbound/decode/Opus counters moving while its presentation callback stayed flat. Audible/mobile proof remains open. -- Exact `16f6eab` passed typecheck, builds and 445 tests; deploy preserved config/network/SQLite/services/routes. Rollback is `22119b9`; `fd76277` remains secondary. +- Production caps pending/answered `peer-selected` at one per room; Host ingress is independent. Focused admission/release/rollback/STUN-only tests pass; earlier Chrome proves active Host-ingress function only. +- Host names, Web audio, all-room routing, Host selected ingress and AV/audio diagnostics are active. Retained hidden-tab media counters progressed; audible/mobile proof remains open. +- Exact `ecc794d` passed typecheck, builds and 452 tests. Deploy preserved config/network/SQLite hashes; SQLite v3/five rooms, routes/assets/SiteAccess and four zero-restart services passed. Rollback is `16f6eab`; `22119b9` is secondary. ## Unverified Boundaries -- The cutover is config evidence; the separate canary closes active Host-ingress relay/frame/cap/stop function. Initial ingress, peer last mile, external cohorts, admission rescue, quality/resources/performance, and game blur remain open. +- The `ecc794d` cutover ran no browser/media/TURN canary. Earlier exact-`16f6eab` proof covers active Host ingress only; initial/peer last mile, external cohorts, admission rescue, quality/resources/performance and game blur remain open. - Mobile is Viewer-only. Its persistent audible media element keeps media/signaling active while the page lives; iOS lock-screen, reclamation and background reconnection remain device gates. AirPlay/system mirroring is local output; live WebRTC `srcObject` has no portable in-app TV-output contract. - Silent partitions can wait 30 to 60 seconds for heartbeat detection before the default 5-second grace; this remains unverified. - The former release reportedly sustained bandwidth-limited blur on a capable LAN; Host refresh recovered while Viewer refresh did not. The new deployment has not yet reproduced or cleared it.