From 9c69287309110982335f2261e761a2418b4ba816 Mon Sep 17 00:00:00 2001 From: AAA <35992542+TNTcraftHIM@users.noreply.github.com> Date: Wed, 19 Aug 2026 23:59:07 +0800 Subject: [PATCH 1/2] docs(quality): record per-flow shaping preflight --- docs/research/realtime-quality-adaptation.md | 66 +++++++++++++++++--- docs/status.md | 8 +-- 2 files changed, 62 insertions(+), 12 deletions(-) diff --git a/docs/research/realtime-quality-adaptation.md b/docs/research/realtime-quality-adaptation.md index 6d7e908..2aaa53b 100644 --- a/docs/research/realtime-quality-adaptation.md +++ b/docs/research/realtime-quality-adaptation.md @@ -327,14 +327,60 @@ hardware encoder, game FPS/p1 low, CPU/GPU, interval encode cost, upload, and per-layer byte budgets. Before default enablement, a separate root-with-children gate must inject an autonomous downshift, observe `suspect`, evacuate after bounded confirmation, and limit temporary descendant impact; no confirmed -`FALLBACK` root may retain children. Screener's current publisher remains `simulcast: false`, -leaves Dynacast at default `false`, and does not call `setVideoQuality()`. -Its subscriber also does not attach a `RemoteTrack`, so SDK `adaptiveStream` is -not directly usable without changing that ownership; built-in SFU bandwidth -adaptation does not depend on enabling that feature. If built-in selection fails -the product gates, test explicit standard subscriber quality selection before -manual sender activation/deactivation. This is a candidate rather than a -current runtime claim, and no browser run belongs in this static SVC review. +`FALLBACK` root may retain children. At `main` commit `13b8dad`, Screener's +default-off publisher configures exactly two ordered `q`/`f` encodings, leaves +Dynacast at `false`, disables backup-codec publication, and its subscriber sets +a `HIGH` ceiling after subscribing. This is implemented configuration, not +browser or performance evidence. The subscriber also does not attach a +`RemoteTrack`, so SDK `adaptiveStream` is not directly usable without changing +that ownership; built-in SFU bandwidth adaptation does not depend on enabling +that feature. If built-in selection fails the product gates, test explicit +standard subscriber quality selection before manual sender +activation/deactivation. + +### Per-Flow Shaping Preflight + +The 2026-08-19 Windows preflight stopped before downloading LiveKit, writing a +harness, or starting Chrome. Chrome 151 is available, and the official LiveKit +1.13.5 release provides a checksummed Windows amd64 binary, so obtaining the +pinned server is not the blocker. The workstation has no Docker installation, +no installed WSL distribution, and no Linux `tc`; the current session is also +not elevated. The existing peer-assisted benchmark starts neither LiveKit nor +an SFU quality fixture. + +Windows policy-based QoS can match outbound traffic by application or IP +tuple, but this setup has not proved that it can follow one ICE-generated, +ephemeral subscriber downtrack across generation changes or apply an auditable +limit to the local loopback media path. CDP `Network` throttling likewise has no +accepted per-WebRTC-flow contract. Neither mechanism may be used as evidence +that one SFU subscriber was weakened while another stayed healthy. + +Resume this gate only on an isolated Linux VM or equivalent host that can put +the publisher, healthy leaf, and weak leaf in separate network namespaces with +separate veth devices. Run the pinned application and LiveKit 1.13.5 without +TURN or media TCP. Before media, prove only the namespace, route, and veth +isolation and the availability of `tc`; the selected ICE tuple does not exist +yet. Use `tbf` for a bounded rate and `netem` only when the case explicitly adds +loss or delay. + +The sole browser run has three ordered phases. First establish both leaves +without shaping, identify the selected LiveKit ICE/UDP tuples locally, record +the healthy and weak veth baselines, and require `HIGH/HIGH`. Next attach the +filter and qdisc to only the weak leaf's selected media tuple and direction. +Require filter packet/byte growth, independent TBF overlimit/queue evidence and +the expected weak-path throughput bound before accepting `HIGH/LOW`; a filter +counter alone proves classification, not shaping. The healthy veth counters, +inbound bitrate, dimensions, FPS, and decode progress must remain within the +unshaped baseline envelope. Finally remove the weak qdisc and require recovery +to `HIGH/HIGH` while the healthy leaf remains unchanged. + +Retain gate evidence for the publisher's ordered `q`/`f` encodings and +per-layer bytes, both subscribers' actual dimensions, FPS, bytes, codec and +decode progress, correlated A+B/C windows, Host upload and interval encode +cost, and available system CPU/GPU/game proxies. A third layer, an affected +healthy leaf, missing classification or shaping counters, or an +application-issued `LOW` command fails the run. Root migration remains outside +this zero-descendant-leaf gate. SVC is the third static no-go, `no-go-web-svc-cross-path-hardware-contract`. WebRTC-SVC configures an outgoing @@ -554,6 +600,10 @@ is a separate optimization. - [LiveKit client 2.22.0 Dynacast layer control](https://github.com/livekit/client-sdk-js/blob/v2.22.0/src/room/track/LocalVideoTrack.ts) - [LiveKit server 1.13.5 Dynacast quality aggregation](https://github.com/livekit/livekit/blob/v1.13.5/pkg/rtc/dynacast/dynacastqualityvideo.go) - [LiveKit server 1.13.5 enabled-quality generation](https://github.com/livekit/livekit/blob/v1.13.5/pkg/rtc/dynacast/dynacastmanagervideo.go) +- [LiveKit server 1.13.5 release assets and checksums](https://github.com/livekit/livekit/releases/tag/v1.13.5) +- [Microsoft `New-NetQosPolicy`](https://learn.microsoft.com/en-us/powershell/module/netqos/new-netqospolicy) +- [Linux network namespaces](https://man7.org/linux/man-pages/man7/network_namespaces.7.html) +- [Linux `tc-tbf`](https://man7.org/linux/man-pages/man8/tc-tbf.8.html) and [`tc-netem`](https://man7.org/linux/man-pages/man8/tc-netem.8.html) - [Jitsi desktop degradation preference](https://github.com/jitsi/lib-jitsi-meet/blob/master/modules/RTC/TraceablePeerConnection.ts) - [Discord Go Live architecture](https://discord.com/blog/how-it-all-goes-live-an-overview-of-discords-streaming-technology) - [Discord encoder-quality case study](https://discord.com/blog/from-blocky-to-brilliant-improving-video-quality-on-discord-go-live-on-amd-gpus) diff --git a/docs/status.md b/docs/status.md index da01ac5..b7774f3 100644 --- a/docs/status.md +++ b/docs/status.md @@ -13,10 +13,10 @@ unconfigured, so production remains one host connection per viewer and P2P/TURN. - Capture precedes room creation; live source/quality changes preserve peers and picture pause keeps audio/connections. Quality defaults to `maintain-resolution` with balanced/fluid options. - Current runtime still uses optional `ACCESS_PASSWORD` and one stateless 12-hour HMAC HttpOnly Strict cookie for both roles; Host auth stays internal and signaling role-bound. - Current SQLite still stores only room ID and Host-token digest. Amended ADR-0002 accepts a later atomic `HOST_ADMISSION_PASSWORD`/`screener-v2` migration with default room-scoped private Viewer grants, explicit public-watch, rotate/revoke, and one nullable digest column; no runtime is implemented. -- PR #44 merged the default-off exact-room candidate code: ordinary ICE is process-wide STUN-only, LiveKit SFU/UDP feeds at most two roots, browser relays stay at one child, the host stays at two, and exhaustion fails boundedly. Old production/coturn remains rollback; HTTPS/WSS stays TLS/TCP. +- PR #44 merged the default-off exact-room STUN-only/SFU-UDP router: host/SFU roots stay at two, browser relays at one, and exhaustion fails boundedly. Production/coturn is rollback; HTTPS/WSS stays TLS/TCP. - Fallback prewarm is token-free and dormant without configuration. Mobile/iPad viewers are leaves and healthy edges stay sticky. -- Manual readback and read-only A+B/C exist. The default-off exact-room SFU candidate now configures exactly `HIGH+LOW`, keeps Dynacast off, and sets a per-subscriber `HIGH` ceiling; topology classification remains absent. Browser audio is request/presence-only. -- A later explicit fallback evacuates first. Autonomous BWE enters `suspect`; confirmation evacuates children, and no confirmed `FALLBACK` parent remains. Root impact is a default-on gate; self-report alone cannot trigger it. +- PR #49/#50 accepted and implemented the default-off built-in-first `q/f` candidate: exactly `HIGH+LOW`, Dynacast/backup codec off, and a subscriber `HIGH` ceiling; it has no browser evidence. +- A+B/P2P C remains read-only. Autonomous BWE is only `suspect`; confirmed fallback evacuates children and loses parent capacity. Root impact remains a default-on gate. ## Verified Evidence @@ -37,7 +37,7 @@ unconfigured, so production remains one host connection per viewer and P2P/TURN. - Production `769de201f7cc` reportedly sustains bandwidth-limited blur on a capable LAN; Host refresh recovered while Viewer refresh did not, and persistence across churn was also reported. This prioritizes, but does not prove, host sender/PC/GCC/capture generation. - Browser relays re-encode. ADR-0006 is no-go-unclassified: downstream checkpoints and two-edge/FIFO/TURN gates are absent. Spikes prove one WebCodecs object, not hardware; GCC+RTX is no-go and no-RTX weakens stats. - Browser fanout is host two/viewer one; any accepted endpoint relay stays capped at two downstream edges. -- ADR-0007/SFU C remain unverified: the exactly-two candidate has no browser evidence or default enablement. Next is built-in BWE on zero-descendant SFU leaves, then root suspect/evacuation; root-with-children behavior is a default-on gate. Web P2P/current SVC shortcuts remain no-go. +- PR #49/#50 BWE is unverified/default-off: test zero-child leaves, then root impact. No local per-leaf UDP shaper; resume with Linux `tc` or public canary, never CDP. Web P2P/SVC shortcuts remain no-go. - The corrected standby smoke is localhost/headless/video-only; public DNS/TLS reuse, transport, audio, shaping, load, mobile, endurance, and sub-25 ms overlap remain open. - Scoped Viewer access is designed but unimplemented. Tests owe role bounds, fragment clearing/no-leak, expiry/cross-room/rotate/revoke, v1 tab termination, and SQLite locked migration/restore. Human passwords/accounts stay out. From ef7aba8f1983d650164f5284da62a36e4a68afd0 Mon Sep 17 00:00:00 2001 From: AAA <35992542+TNTcraftHIM@users.noreply.github.com> Date: Thu, 20 Aug 2026 00:00:29 +0800 Subject: [PATCH 2/2] docs(status): preserve snapshot budget --- docs/status.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/status.md b/docs/status.md index 472be21..2f6439b 100644 --- a/docs/status.md +++ b/docs/status.md @@ -13,7 +13,7 @@ unconfigured, so production remains one host connection per viewer and P2P/TURN. - Capture precedes room creation; live source/quality changes preserve peers and picture pause keeps audio/connections. Quality defaults to `maintain-resolution` with balanced/fluid options. - Current runtime still uses optional `ACCESS_PASSWORD` and one stateless 12-hour HMAC HttpOnly Strict cookie for both roles; Host auth stays internal and signaling role-bound. - Current SQLite still stores only room ID and Host-token digest. Amended ADR-0002 accepts a later atomic `HOST_ADMISSION_PASSWORD`/`screener-v2` migration with default room-scoped private Viewer grants, explicit public-watch, rotate/revoke, and one nullable digest column; no runtime is implemented. -- PR #44 merged the default-off exact-room STUN-only/SFU-UDP router: host/SFU roots stay at two, browser relays at one, and exhaustion fails boundedly. Production/coturn is rollback; HTTPS/WSS stays TLS/TCP. +- PR #44 merged default-off exact-room STUN-only/SFU-UDP router: host/SFU roots <=2, browser relay <=1, bounded failure. Production/coturn is rollback; HTTPS/WSS stays TLS/TCP. - Fallback prewarm is token-free and dormant without configuration. Mobile/iPad viewers are leaves and healthy edges stay sticky. - PR #49/#50 accepted and implemented the default-off built-in-first `q/f` candidate: exactly `HIGH+LOW`, Dynacast/backup codec off, and a subscriber `HIGH` ceiling; it has no browser evidence. - A+B/P2P C remains read-only. Autonomous BWE is only `suspect`; confirmed fallback evacuates children and loses parent capacity. Root impact remains a default-on gate.